458 files changed, 15121 insertions, 3784 deletions
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 70bdb852a7fd..a7799a99f2d9 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -9,6 +9,7 @@ menuconfig ACPI
        depends on PCI
        depends on PM
        select PNP
+        select CPU_IDLE
        default y
        ---help---
          Advanced Configuration and Power Interface (ACPI) support for 
diff --git a/drivers/acpi/acpica/uteval.c b/drivers/acpi/acpica/uteval.c
index da9450bc60f7..9c9897dbe907 100644
--- a/drivers/acpi/acpica/uteval.c
+++ b/drivers/acpi/acpica/uteval.c
@@ -116,9 +116,9 @@ acpi_status acpi_ut_osi_implementation(struct acpi_walk_state *walk_state)
                return_ACPI_STATUS(AE_NO_MEMORY);
        }
-        /* Default return value is SUPPORTED */
+        /* Default return value is 0, NOT-SUPPORTED */
-        return_desc->integer.value = ACPI_UINT32_MAX;
+        return_desc->integer.value = 0;
        walk_state->return_desc = return_desc;
        /* Compare input string to static table of supported interfaces */
@@ -127,10 +127,8 @@ acpi_status acpi_ut_osi_implementation(struct acpi_walk_state *walk_state)
                if (!ACPI_STRCMP
                    (string_desc->string.pointer,
                     acpi_interfaces_supported[i])) {
+                        return_desc->integer.value = ACPI_UINT32_MAX;
-                        /* The interface is supported */
+                        goto done;
-                        return_ACPI_STATUS(AE_OK);
                }
        }
@@ -141,15 +139,14 @@ acpi_status acpi_ut_osi_implementation(struct acpi_walk_state *walk_state)
         */
        status = acpi_os_validate_interface(string_desc->string.pointer);
        if (ACPI_SUCCESS(status)) {
+                return_desc->integer.value = ACPI_UINT32_MAX;
-                /* The interface is supported */
-                return_ACPI_STATUS(AE_OK);
        }
-        /* The interface is not supported */
+done:
+        ACPI_DEBUG_PRINT_RAW((ACPI_DB_INFO, "ACPI: BIOS _OSI(%s) %ssupported\n",
+                string_desc->string.pointer,
+                return_desc->integer.value == 0 ? "not-" : ""));
-        return_desc->integer.value = 0;
        return_ACPI_STATUS(AE_OK);
 }
diff --git a/drivers/acpi/container.c b/drivers/acpi/container.c
index 17020c12623c..fe0cdf83641a 100644
--- a/drivers/acpi/container.c
+++ b/drivers/acpi/container.c
@@ -163,7 +163,7 @@ static void container_notify_cb(acpi_handle handle, u32 type, void *context)
        case ACPI_NOTIFY_BUS_CHECK:
                /* Fall through */
        case ACPI_NOTIFY_DEVICE_CHECK:
-                printk("Container driver received %s event\n",
+                printk(KERN_WARNING "Container driver received %s event\n",
                       (type == ACPI_NOTIFY_BUS_CHECK) ?
                       "ACPI_NOTIFY_BUS_CHECK" : "ACPI_NOTIFY_DEVICE_CHECK");
                status = acpi_bus_get_device(handle, &device);
@@ -174,7 +174,8 @@ static void container_notify_cb(acpi_handle handle, u32 type, void *context)
                                        kobject_uevent(&device->dev.kobj,
                                                       KOBJ_ONLINE);
                                else
-                                        printk("Failed to add container\n");
+                                        printk(KERN_WARNING
+                                               "Failed to add container\n");
                        }
                } else {
                        if (ACPI_SUCCESS(status)) {
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
index afd5db3c7562..35094f230b1e 100644
--- a/drivers/acpi/dock.c
+++ b/drivers/acpi/dock.c
@@ -988,7 +988,7 @@ static int dock_add(acpi_handle handle)
        ret = device_create_file(&dock_device->dev, &dev_attr_docked);
        if (ret) {
-                printk("Error %d adding sysfs file\n", ret);
+                printk(KERN_ERR "Error %d adding sysfs file\n", ret);
                platform_device_unregister(dock_device);
                kfree(dock_station);
                dock_station = NULL;
@@ -996,7 +996,7 @@ static int dock_add(acpi_handle handle)
        }
        ret = device_create_file(&dock_device->dev, &dev_attr_undock);
        if (ret) {
-                printk("Error %d adding sysfs file\n", ret);
+                printk(KERN_ERR "Error %d adding sysfs file\n", ret);
                device_remove_file(&dock_device->dev, &dev_attr_docked);
                platform_device_unregister(dock_device);
                kfree(dock_station);
@@ -1005,7 +1005,7 @@ static int dock_add(acpi_handle handle)
        }
        ret = device_create_file(&dock_device->dev, &dev_attr_uid);
        if (ret) {
-                printk("Error %d adding sysfs file\n", ret);
+                printk(KERN_ERR "Error %d adding sysfs file\n", ret);
                device_remove_file(&dock_device->dev, &dev_attr_docked);
                device_remove_file(&dock_device->dev, &dev_attr_undock);
                platform_device_unregister(dock_device);
@@ -1015,7 +1015,7 @@ static int dock_add(acpi_handle handle)
        }
        ret = device_create_file(&dock_device->dev, &dev_attr_flags);
        if (ret) {
-                printk("Error %d adding sysfs file\n", ret);
+                printk(KERN_ERR "Error %d adding sysfs file\n", ret);
                device_remove_file(&dock_device->dev, &dev_attr_docked);
                device_remove_file(&dock_device->dev, &dev_attr_undock);
                device_remove_file(&dock_device->dev, &dev_attr_uid);
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index a2b82c90a683..5c2f5d343be6 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -982,7 +982,7 @@ int __init acpi_ec_ecdt_probe(void)
                saved_ec = kmalloc(sizeof(struct acpi_ec), GFP_KERNEL);
                if (!saved_ec)
                        return -ENOMEM;
-                memcpy(&saved_ec, boot_ec, sizeof(saved_ec));
+                memcpy(saved_ec, boot_ec, sizeof(*saved_ec));
        /* fall through */
        }
        /* This workaround is needed only on some broken machines,
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 6729a4992f2b..b3193ec0a2ef 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -228,10 +228,10 @@ void acpi_os_vprintf(const char *fmt, va_list args)
        if (acpi_in_debugger) {
                kdb_printf("%s", buffer);
        } else {
-                printk("%s", buffer);
+                printk(KERN_CONT "%s", buffer);
        }
 #else
-        printk("%s", buffer);
+        printk(KERN_CONT "%s", buffer);
 #endif
 }
@@ -1317,6 +1317,54 @@ acpi_os_validate_interface (char *interface)
        return AE_SUPPORT;
 }
+#ifdef  CONFIG_X86
+struct aml_port_desc {
+        uint    start;
+        uint    end;
+        char*   name;
+        char    warned;
+};
+static struct aml_port_desc aml_invalid_port_list[] = {
+        {0x20, 0x21, "PIC0", 0},
+        {0xA0, 0xA1, "PIC1", 0},
+        {0x4D0, 0x4D1, "ELCR", 0}
+};
+/*
+ * valid_aml_io_address()
+ *
+ * if valid, return true
+ * else invalid, warn once, return false
+ */
+static bool valid_aml_io_address(uint address, uint length)
+{
+        int i;
+        int entries = sizeof(aml_invalid_port_list) / sizeof(struct aml_port_desc);
+        for (i = 0; i < entries; ++i) {
+                if ((address >= aml_invalid_port_list[i].start &&
+                        address <= aml_invalid_port_list[i].end) ||
+                        (address + length >= aml_invalid_port_list[i].start &&
+                        address  + length <= aml_invalid_port_list[i].end))
+                {
+                        if (!aml_invalid_port_list[i].warned)
+                        {
+                                printk(KERN_ERR "ACPI: Denied BIOS AML access"
+                                        " to invalid port 0x%x+0x%x (%s)\n",
+                                        address, length,
+                                        aml_invalid_port_list[i].name);
+                                aml_invalid_port_list[i].warned = 1;
+                        }
+                        return false;   /* invalid */
+                }
+        }
+        return true;    /* valid */
+}
+#else
+static inline bool valid_aml_io_address(uint address, uint length) { return true; }
+#endif
 /******************************************************************************
 *
 * FUNCTION:    acpi_os_validate_address
@@ -1346,6 +1394,8 @@ acpi_os_validate_address (
        switch (space_id) {
        case ACPI_ADR_SPACE_SYSTEM_IO:
+                if (!valid_aml_io_address(address, length))
+                        return AE_AML_ILLEGAL_ADDRESS;
        case ACPI_ADR_SPACE_SYSTEM_MEMORY:
                /* Only interference checks against SystemIO and SytemMemory
                   are needed */
diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
index 1c6e73c7865e..6c772ca76bd1 100644
--- a/drivers/acpi/pci_link.c
+++ b/drivers/acpi/pci_link.c
@@ -593,7 +593,7 @@ static int acpi_pci_link_allocate(struct acpi_pci_link *link)
                return -ENODEV;
        } else {
                acpi_irq_penalty[link->irq.active] += PIRQ_PENALTY_PCI_USING;
-                printk(PREFIX "%s [%s] enabled at IRQ %d\n",
+                printk(KERN_WARNING PREFIX "%s [%s] enabled at IRQ %d\n",
                       acpi_device_name(link->device),
                       acpi_device_bid(link->device), link->irq.active);
        }
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 66a9d8145562..7bc22a471fe3 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -66,43 +66,17 @@ ACPI_MODULE_NAME("processor_idle");
 #define ACPI_PROCESSOR_FILE_POWER       "power"
 #define US_TO_PM_TIMER_TICKS(t)         ((t * (PM_TIMER_FREQUENCY/1000)) / 1000)
 #define PM_TIMER_TICK_NS                (1000000000ULL/PM_TIMER_FREQUENCY)
-#ifndef CONFIG_CPU_IDLE
-#define C2_OVERHEAD                     4       /* 1us (3.579 ticks per us) */
-#define C3_OVERHEAD                     4       /* 1us (3.579 ticks per us) */
-static void (*pm_idle_save) (void) __read_mostly;
-#else
 #define C2_OVERHEAD                     1       /* 1us */
 #define C3_OVERHEAD                     1       /* 1us */
-#endif
 #define PM_TIMER_TICKS_TO_US(p)         (((p) * 1000)/(PM_TIMER_FREQUENCY/1000))
 static unsigned int max_cstate __read_mostly = ACPI_PROCESSOR_MAX_POWER;
-#ifdef CONFIG_CPU_IDLE
 module_param(max_cstate, uint, 0000);
-#else
-module_param(max_cstate, uint, 0644);
-#endif
 static unsigned int nocst __read_mostly;
 module_param(nocst, uint, 0000);
-#ifndef CONFIG_CPU_IDLE
-/*
- * bm_history -- bit-mask with a bit per jiffy of bus-master activity
- * 1000 HZ: 0xFFFFFFFF: 32 jiffies = 32ms
- * 800 HZ: 0xFFFFFFFF: 32 jiffies = 40ms
- * 100 HZ: 0x0000000F: 4 jiffies = 40ms
- * reduce history for more aggressive entry into C3
- */
-static unsigned int bm_history __read_mostly =
-    (HZ >= 800 ? 0xFFFFFFFF : ((1U << (HZ / 25)) - 1));
-module_param(bm_history, uint, 0644);
-static int acpi_processor_set_power_policy(struct acpi_processor *pr);
-#else   /* CONFIG_CPU_IDLE */
 static unsigned int latency_factor __read_mostly = 2;
 module_param(latency_factor, uint, 0644);
-#endif
 /*
 * IBM ThinkPad R40e crashes mysteriously when going into C2 or C3.
@@ -224,71 +198,6 @@ static void acpi_safe_halt(void)
        current_thread_info()->status |= TS_POLLING;
 }
-#ifndef CONFIG_CPU_IDLE
-static void
-acpi_processor_power_activate(struct acpi_processor *pr,
-                              struct acpi_processor_cx *new)
-{
-        struct acpi_processor_cx *old;
-        if (!pr || !new)
-                return;
-        old = pr->power.state;
-        if (old)
-                old->promotion.count = 0;
-        new->demotion.count = 0;
-        /* Cleanup from old state. */
-        if (old) {
-                switch (old->type) {
-                case ACPI_STATE_C3:
-                        /* Disable bus master reload */
-                        if (new->type != ACPI_STATE_C3 && pr->flags.bm_check)
-                                acpi_set_register(ACPI_BITREG_BUS_MASTER_RLD, 0);
-                        break;
-                }
-        }
-        /* Prepare to use new state. */
-        switch (new->type) {
-        case ACPI_STATE_C3:
-                /* Enable bus master reload */
-                if (old->type != ACPI_STATE_C3 && pr->flags.bm_check)
-                        acpi_set_register(ACPI_BITREG_BUS_MASTER_RLD, 1);
-                break;
-        }
-        pr->power.state = new;
-        return;
-}
-static atomic_t c3_cpu_count;
-/* Common C-state entry for C2, C3, .. */
-static void acpi_cstate_enter(struct acpi_processor_cx *cstate)
-{
-        /* Don't trace irqs off for idle */
-        stop_critical_timings();
-        if (cstate->entry_method == ACPI_CSTATE_FFH) {
-                /* Call into architectural FFH based C-state */
-                acpi_processor_ffh_cstate_enter(cstate);
-        } else {
-                int unused;
-                /* IO port based C-state */
-                inb(cstate->address);
-                /* Dummy wait op - must do something useless after P_LVL2 read
-                   because chipsets cannot guarantee that STPCLK# signal
-                   gets asserted in time to freeze execution properly. */
-                unused = inl(acpi_gbl_FADT.xpm_timer_block.address);
-        }
-        start_critical_timings();
-}
-#endif /* !CONFIG_CPU_IDLE */
 #ifdef ARCH_APICTIMER_STOPS_ON_C3
 /*
@@ -390,421 +299,6 @@ static int tsc_halts_in_c(int state)
 }
 #endif
-#ifndef CONFIG_CPU_IDLE
-static void acpi_processor_idle(void)
-{
-        struct acpi_processor *pr = NULL;
-        struct acpi_processor_cx *cx = NULL;
-        struct acpi_processor_cx *next_state = NULL;
-        int sleep_ticks = 0;
-        u32 t1, t2 = 0;
-        /*
-         * Interrupts must be disabled during bus mastering calculations and
-         * for C2/C3 transitions.
-         */
-        local_irq_disable();
-        pr = __get_cpu_var(processors);
-        if (!pr) {
-                local_irq_enable();
-                return;
-        }
-        /*
-         * Check whether we truly need to go idle, or should
-         * reschedule:
-         */
-        if (unlikely(need_resched())) {
-                local_irq_enable();
-                return;
-        }
-        cx = pr->power.state;
-        if (!cx || acpi_idle_suspend) {
-                if (pm_idle_save) {
-                        pm_idle_save(); /* enables IRQs */
-                } else {
-                        acpi_safe_halt();
-                        local_irq_enable();
-                }
-                return;
-        }
-        /*
-         * Check BM Activity
-         * -----------------
-         * Check for bus mastering activity (if required), record, and check
-         * for demotion.
-         */
-        if (pr->flags.bm_check) {
-                u32 bm_status = 0;
-                unsigned long diff = jiffies - pr->power.bm_check_timestamp;
-                if (diff > 31)
-                        diff = 31;
-                pr->power.bm_activity <<= diff;
-                acpi_get_register(ACPI_BITREG_BUS_MASTER_STATUS, &bm_status);
-                if (bm_status) {
-                        pr->power.bm_activity |= 0x1;
-                        acpi_set_register(ACPI_BITREG_BUS_MASTER_STATUS, 1);
-                }
-                /*
-                 * PIIX4 Erratum #18: Note that BM_STS doesn't always reflect
-                 * the true state of bus mastering activity; forcing us to
-                 * manually check the BMIDEA bit of each IDE channel.
-                 */
-                else if (errata.piix4.bmisx) {
-                        if ((inb_p(errata.piix4.bmisx + 0x02) & 0x01)
-                            || (inb_p(errata.piix4.bmisx + 0x0A) & 0x01))
-                                pr->power.bm_activity |= 0x1;
-                }
-                pr->power.bm_check_timestamp = jiffies;
-                /*
-                 * If bus mastering is or was active this jiffy, demote
-                 * to avoid a faulty transition.  Note that the processor
-                 * won't enter a low-power state during this call (to this
-                 * function) but should upon the next.
-                 *
-                 * TBD: A better policy might be to fallback to the demotion
-                 *      state (use it for this quantum only) istead of
-                 *      demoting -- and rely on duration as our sole demotion
-                 *      qualification.  This may, however, introduce DMA
-                 *      issues (e.g. floppy DMA transfer overrun/underrun).
-                 */
-                if ((pr->power.bm_activity & 0x1) &&
-                    cx->demotion.threshold.bm) {
-                        local_irq_enable();
-                        next_state = cx->demotion.state;
-                        goto end;
-                }
-        }
-#ifdef CONFIG_HOTPLUG_CPU
-        /*
-         * Check for P_LVL2_UP flag before entering C2 and above on
-         * an SMP system. We do it here instead of doing it at _CST/P_LVL
-         * detection phase, to work cleanly with logical CPU hotplug.
-         */
-        if ((cx->type != ACPI_STATE_C1) && (num_online_cpus() > 1) &&
-            !pr->flags.has_cst && !(acpi_gbl_FADT.flags & ACPI_FADT_C2_MP_SUPPORTED))
-                cx = &pr->power.states[ACPI_STATE_C1];
-#endif
-        /*
-         * Sleep:
-         * ------
-         * Invoke the current Cx state to put the processor to sleep.
-         */
-        if (cx->type == ACPI_STATE_C2 || cx->type == ACPI_STATE_C3) {
-                current_thread_info()->status &= ~TS_POLLING;
-                /*
-                 * TS_POLLING-cleared state must be visible before we
-                 * test NEED_RESCHED:
-                 */
-                smp_mb();
-                if (need_resched()) {
-                        current_thread_info()->status |= TS_POLLING;
-                        local_irq_enable();
-                        return;
-                }
-        }
-        switch (cx->type) {
-        case ACPI_STATE_C1:
-                /*
-                 * Invoke C1.
-                 * Use the appropriate idle routine, the one that would
-                 * be used without acpi C-states.
-                 */
-                if (pm_idle_save) {
-                        pm_idle_save(); /* enables IRQs */
-                } else {
-                        acpi_safe_halt();
-                        local_irq_enable();
-                }
-                /*
-                 * TBD: Can't get time duration while in C1, as resumes
-                 *      go to an ISR rather than here.  Need to instrument
-                 *      base interrupt handler.
-                 *
-                 * Note: the TSC better not stop in C1, sched_clock() will
-                 *       skew otherwise.
-                 */
-                sleep_ticks = 0xFFFFFFFF;
-                break;
-        case ACPI_STATE_C2:
-                /* Get start time (ticks) */
-                t1 = inl(acpi_gbl_FADT.xpm_timer_block.address);
-                /* Tell the scheduler that we are going deep-idle: */
-                sched_clock_idle_sleep_event();
-                /* Invoke C2 */
-                acpi_state_timer_broadcast(pr, cx, 1);
-                acpi_cstate_enter(cx);
-                /* Get end time (ticks) */
-                t2 = inl(acpi_gbl_FADT.xpm_timer_block.address);
-#if defined (CONFIG_GENERIC_TIME) && defined (CONFIG_X86)
-                /* TSC halts in C2, so notify users */
-                if (tsc_halts_in_c(ACPI_STATE_C2))
-                        mark_tsc_unstable("possible TSC halt in C2");
-#endif
-                /* Compute time (ticks) that we were actually asleep */
-                sleep_ticks = ticks_elapsed(t1, t2);
-                /* Tell the scheduler how much we idled: */
-                sched_clock_idle_wakeup_event(sleep_ticks*PM_TIMER_TICK_NS);
-                /* Re-enable interrupts */
-                local_irq_enable();
-                /* Do not account our idle-switching overhead: */
-                sleep_ticks -= cx->latency_ticks + C2_OVERHEAD;
-                current_thread_info()->status |= TS_POLLING;
-                acpi_state_timer_broadcast(pr, cx, 0);
-                break;
-        case ACPI_STATE_C3:
-                acpi_unlazy_tlb(smp_processor_id());
-                /*
-                 * Must be done before busmaster disable as we might
-                 * need to access HPET !
-                 */
-                acpi_state_timer_broadcast(pr, cx, 1);
-                /*
-                 * disable bus master
-                 * bm_check implies we need ARB_DIS
-                 * !bm_check implies we need cache flush
-                 * bm_control implies whether we can do ARB_DIS
-                 *
-                 * That leaves a case where bm_check is set and bm_control is
-                 * not set. In that case we cannot do much, we enter C3
-                 * without doing anything.
-                 */
-                if (pr->flags.bm_check && pr->flags.bm_control) {
-                        if (atomic_inc_return(&c3_cpu_count) ==
-                            num_online_cpus()) {
-                                /*
-                                 * All CPUs are trying to go to C3
-                                 * Disable bus master arbitration
-                                 */
-                                acpi_set_register(ACPI_BITREG_ARB_DISABLE, 1);
-                        }
-                } else if (!pr->flags.bm_check) {
-                        /* SMP with no shared cache... Invalidate cache  */
-                        ACPI_FLUSH_CPU_CACHE();
-                }
-                /* Get start time (ticks) */
-                t1 = inl(acpi_gbl_FADT.xpm_timer_block.address);
-                /* Invoke C3 */
-                /* Tell the scheduler that we are going deep-idle: */
-                sched_clock_idle_sleep_event();
-                acpi_cstate_enter(cx);
-                /* Get end time (ticks) */
-                t2 = inl(acpi_gbl_FADT.xpm_timer_block.address);
-                if (pr->flags.bm_check && pr->flags.bm_control) {
-                        /* Enable bus master arbitration */
-                        atomic_dec(&c3_cpu_count);
-                        acpi_set_register(ACPI_BITREG_ARB_DISABLE, 0);
-                }
-#if defined (CONFIG_GENERIC_TIME) && defined (CONFIG_X86)
-                /* TSC halts in C3, so notify users */
-                if (tsc_halts_in_c(ACPI_STATE_C3))
-                        mark_tsc_unstable("TSC halts in C3");
-#endif
-                /* Compute time (ticks) that we were actually asleep */
-                sleep_ticks = ticks_elapsed(t1, t2);
-                /* Tell the scheduler how much we idled: */
-                sched_clock_idle_wakeup_event(sleep_ticks*PM_TIMER_TICK_NS);
-                /* Re-enable interrupts */
-                local_irq_enable();
-                /* Do not account our idle-switching overhead: */
-                sleep_ticks -= cx->latency_ticks + C3_OVERHEAD;
-                current_thread_info()->status |= TS_POLLING;
-                acpi_state_timer_broadcast(pr, cx, 0);
-                break;
-        default:
-                local_irq_enable();
-                return;
-        }
-        cx->usage++;
-        if ((cx->type != ACPI_STATE_C1) && (sleep_ticks > 0))
-                cx->time += sleep_ticks;
-        next_state = pr->power.state;
-#ifdef CONFIG_HOTPLUG_CPU
-        /* Don't do promotion/demotion */
-        if ((cx->type == ACPI_STATE_C1) && (num_online_cpus() > 1) &&
-            !pr->flags.has_cst && !(acpi_gbl_FADT.flags & ACPI_FADT_C2_MP_SUPPORTED)) {
-                next_state = cx;
-                goto end;
-        }
-#endif
-        /*
-         * Promotion?
-         * ----------
-         * Track the number of longs (time asleep is greater than threshold)
-         * and promote when the count threshold is reached.  Note that bus
-         * mastering activity may prevent promotions.
-         * Do not promote above max_cstate.
-         */
-        if (cx->promotion.state &&
-            ((cx->promotion.state - pr->power.states) <= max_cstate)) {
-                if (sleep_ticks > cx->promotion.threshold.ticks &&
-                  cx->promotion.state->latency <=
-                                pm_qos_requirement(PM_QOS_CPU_DMA_LATENCY)) {
-                        cx->promotion.count++;
-                        cx->demotion.count = 0;
-                        if (cx->promotion.count >=
-                            cx->promotion.threshold.count) {
-                                if (pr->flags.bm_check) {
-                                        if (!
-                                            (pr->power.bm_activity & cx->
-                                             promotion.threshold.bm)) {
-                                                next_state =
-                                                    cx->promotion.state;
-                                                goto end;
-                                        }
-                                } else {
-                                        next_state = cx->promotion.state;
-                                        goto end;
-                                }
-                        }
-                }
-        }
-        /*
-         * Demotion?
-         * ---------
-         * Track the number of shorts (time asleep is less than time threshold)
-         * and demote when the usage threshold is reached.
-         */
-        if (cx->demotion.state) {
-                if (sleep_ticks < cx->demotion.threshold.ticks) {
-                        cx->demotion.count++;
-                        cx->promotion.count = 0;
-                        if (cx->demotion.count >= cx->demotion.threshold.count) {
-                                next_state = cx->demotion.state;
-                                goto end;
-                        }
-                }
-        }
-      end:
-        /*
-         * Demote if current state exceeds max_cstate
-         * or if the latency of the current state is unacceptable
-         */
-        if ((pr->power.state - pr->power.states) > max_cstate ||
-                pr->power.state->latency >
-                                pm_qos_requirement(PM_QOS_CPU_DMA_LATENCY)) {
-                if (cx->demotion.state)
-                        next_state = cx->demotion.state;
-        }
-        /*
-         * New Cx State?
-         * -------------
-         * If we're going to start using a new Cx state we must clean up
-         * from the previous and prepare to use the new.
-         */
-        if (next_state != pr->power.state)
-                acpi_processor_power_activate(pr, next_state);
-}
-static int acpi_processor_set_power_policy(struct acpi_processor *pr)
-{
-        unsigned int i;
-        unsigned int state_is_set = 0;
-        struct acpi_processor_cx *lower = NULL;
-        struct acpi_processor_cx *higher = NULL;
-        struct acpi_processor_cx *cx;
-        if (!pr)
-                return -EINVAL;
-        /*
-         * This function sets the default Cx state policy (OS idle handler).
-         * Our scheme is to promote quickly to C2 but more conservatively
-         * to C3.  We're favoring C2  for its characteristics of low latency
-         * (quick response), good power savings, and ability to allow bus
-         * mastering activity.  Note that the Cx state policy is completely
-         * customizable and can be altered dynamically.
-         */
-        /* startup state */
-        for (i = 1; i < ACPI_PROCESSOR_MAX_POWER; i++) {
-                cx = &pr->power.states[i];
-                if (!cx->valid)
-                        continue;
-                if (!state_is_set)
-                        pr->power.state = cx;
-                state_is_set++;
-                break;
-        }
-        if (!state_is_set)
-                return -ENODEV;
-        /* demotion */
-        for (i = 1; i < ACPI_PROCESSOR_MAX_POWER; i++) {
-                cx = &pr->power.states[i];
-                if (!cx->valid)
-                        continue;
-                if (lower) {
-                        cx->demotion.state = lower;
-                        cx->demotion.threshold.ticks = cx->latency_ticks;
-                        cx->demotion.threshold.count = 1;
-                        if (cx->type == ACPI_STATE_C3)
-                                cx->demotion.threshold.bm = bm_history;
-                }
-                lower = cx;
-        }
-        /* promotion */
-        for (i = (ACPI_PROCESSOR_MAX_POWER - 1); i > 0; i--) {
-                cx = &pr->power.states[i];
-                if (!cx->valid)
-                        continue;
-                if (higher) {
-                        cx->promotion.state = higher;
-                        cx->promotion.threshold.ticks = cx->latency_ticks;
-                        if (cx->type >= ACPI_STATE_C2)
-                                cx->promotion.threshold.count = 4;
-                        else
-                                cx->promotion.threshold.count = 10;
-                        if (higher->type == ACPI_STATE_C3)
-                                cx->promotion.threshold.bm = bm_history;
-                }
-                higher = cx;
-        }
-        return 0;
-}
-#endif /* !CONFIG_CPU_IDLE */
 static int acpi_processor_get_power_info_fadt(struct acpi_processor *pr)
 {
@@ -1047,11 +541,7 @@ static void acpi_processor_power_verify_c2(struct acpi_processor_cx *cx)
         */
        cx->valid = 1;
-#ifndef CONFIG_CPU_IDLE
-        cx->latency_ticks = US_TO_PM_TIMER_TICKS(cx->latency);
-#else
        cx->latency_ticks = cx->latency;
-#endif
        return;
 }
@@ -1121,7 +611,6 @@ static void acpi_processor_power_verify_c3(struct acpi_processor *pr,
                                          " for C3 to be enabled on SMP systems\n"));
                        return;
                }
-                acpi_set_register(ACPI_BITREG_BUS_MASTER_RLD, 0);
        }
        /*
@@ -1132,11 +621,16 @@ static void acpi_processor_power_verify_c3(struct acpi_processor *pr,
         */
        cx->valid = 1;
-#ifndef CONFIG_CPU_IDLE
-        cx->latency_ticks = US_TO_PM_TIMER_TICKS(cx->latency);
-#else
        cx->latency_ticks = cx->latency;
-#endif
+        /*
+         * On older chipsets, BM_RLD needs to be set
+         * in order for Bus Master activity to wake the
+         * system from C3.  Newer chipsets handle DMA
+         * during C3 automatically and BM_RLD is a NOP.
+         * In either case, the proper way to
+         * handle BM_RLD is to set it and leave it set.
+         */
+        acpi_set_register(ACPI_BITREG_BUS_MASTER_RLD, 1);
        return;
 }
@@ -1201,20 +695,6 @@ static int acpi_processor_get_power_info(struct acpi_processor *pr)
        pr->power.count = acpi_processor_power_verify(pr);
-#ifndef CONFIG_CPU_IDLE
-        /*
-         * Set Default Policy
-         * ------------------
-         * Now that we know which states are supported, set the default
-         * policy.  Note that this policy can be changed dynamically
-         * (e.g. encourage deeper sleeps to conserve battery life when
-         * not on AC).
-         */
-        result = acpi_processor_set_power_policy(pr);
-        if (result)
-                return result;
-#endif
        /*
         * if one state of type C2 or C3 is available, mark this
         * CPU as being "idle manageable"
@@ -1312,69 +792,6 @@ static const struct file_operations acpi_processor_power_fops = {
        .release = single_release,
 };
-#ifndef CONFIG_CPU_IDLE
-int acpi_processor_cst_has_changed(struct acpi_processor *pr)
-{
-        int result = 0;
-        if (boot_option_idle_override)
-                return 0;
-        if (!pr)
-                return -EINVAL;
-        if (nocst) {
-                return -ENODEV;
-        }
-        if (!pr->flags.power_setup_done)
-                return -ENODEV;
-        /*
-         * Fall back to the default idle loop, when pm_idle_save had
-         * been initialized.
-         */
-        if (pm_idle_save) {
-                pm_idle = pm_idle_save;
-                /* Relies on interrupts forcing exit from idle. */
-                synchronize_sched();
-        }
-        pr->flags.power = 0;
-        result = acpi_processor_get_power_info(pr);
-        if ((pr->flags.power == 1) && (pr->flags.power_setup_done))
-                pm_idle = acpi_processor_idle;
-        return result;
-}
-#ifdef CONFIG_SMP
-static void smp_callback(void *v)
-{
-        /* we already woke the CPU up, nothing more to do */
-}
-/*
- * This function gets called when a part of the kernel has a new latency
- * requirement.  This means we need to get all processors out of their C-state,
- * and then recalculate a new suitable C-state. Just do a cross-cpu IPI; that
- * wakes them all right up.
- */
-static int acpi_processor_latency_notify(struct notifier_block *b,
-                unsigned long l, void *v)
-{
-        smp_call_function(smp_callback, NULL, 1);
-        return NOTIFY_OK;
-}
-static struct notifier_block acpi_processor_latency_notifier = {
-        .notifier_call = acpi_processor_latency_notify,
-};
-#endif
-#else /* CONFIG_CPU_IDLE */
 /**
 * acpi_idle_bm_check - checks if bus master activity was detected
@@ -1383,7 +800,7 @@ static int acpi_idle_bm_check(void)
 {
        u32 bm_status = 0;
-        acpi_get_register(ACPI_BITREG_BUS_MASTER_STATUS, &bm_status);
+        acpi_get_register_unlocked(ACPI_BITREG_BUS_MASTER_STATUS, &bm_status);
        if (bm_status)
                acpi_set_register(ACPI_BITREG_BUS_MASTER_STATUS, 1);
        /*
@@ -1400,25 +817,6 @@ static int acpi_idle_bm_check(void)
 }
 /**
- * acpi_idle_update_bm_rld - updates the BM_RLD bit depending on target state
- * @pr: the processor
- * @target: the new target state
- */
-static inline void acpi_idle_update_bm_rld(struct acpi_processor *pr,
-                                           struct acpi_processor_cx *target)
-{
-        if (pr->flags.bm_rld_set && target->type != ACPI_STATE_C3) {
-                acpi_set_register(ACPI_BITREG_BUS_MASTER_RLD, 0);
-                pr->flags.bm_rld_set = 0;
-        }
-        if (!pr->flags.bm_rld_set && target->type == ACPI_STATE_C3) {
-                acpi_set_register(ACPI_BITREG_BUS_MASTER_RLD, 1);
-                pr->flags.bm_rld_set = 1;
-        }
-}
-/**
 * acpi_idle_do_entry - a helper function that does C2 and C3 type entry
 * @cx: cstate data
 *
@@ -1473,9 +871,6 @@ static int acpi_idle_enter_c1(struct cpuidle_device *dev,
                return 0;
        }
-        if (pr->flags.bm_check)
-                acpi_idle_update_bm_rld(pr, cx);
        t1 = inl(acpi_gbl_FADT.xpm_timer_block.address);
        acpi_idle_do_entry(cx);
        t2 = inl(acpi_gbl_FADT.xpm_timer_block.address);
@@ -1527,9 +922,6 @@ static int acpi_idle_enter_simple(struct cpuidle_device *dev,
         */
        acpi_state_timer_broadcast(pr, cx, 1);
-        if (pr->flags.bm_check)
-                acpi_idle_update_bm_rld(pr, cx);
        if (cx->type == ACPI_STATE_C3)
                ACPI_FLUSH_CPU_CACHE();
@@ -1621,8 +1013,6 @@ static int acpi_idle_enter_bm(struct cpuidle_device *dev,
         */
        acpi_state_timer_broadcast(pr, cx, 1);
-        acpi_idle_update_bm_rld(pr, cx);
        /*
         * disable bus master
         * bm_check implies we need ARB_DIS
@@ -1795,8 +1185,6 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
        return ret;
 }
-#endif /* CONFIG_CPU_IDLE */
 int __cpuinit acpi_processor_power_init(struct acpi_processor *pr,
                              struct acpi_device *device)
 {
@@ -1825,10 +1213,6 @@ int __cpuinit acpi_processor_power_init(struct acpi_processor *pr,
                               "ACPI: processor limited to max C-state %d\n",
                               max_cstate);
                first_run++;
-#if !defined(CONFIG_CPU_IDLE) && defined(CONFIG_SMP)
-                pm_qos_add_notifier(PM_QOS_CPU_DMA_LATENCY,
-                                &acpi_processor_latency_notifier);
-#endif
        }
        if (!pr)
@@ -1852,11 +1236,9 @@ int __cpuinit acpi_processor_power_init(struct acpi_processor *pr,
         * platforms that only support C1.
         */
        if (pr->flags.power) {
-#ifdef CONFIG_CPU_IDLE
                acpi_processor_setup_cpuidle(pr);
                if (cpuidle_register_device(&pr->power.dev))
                        return -EIO;
-#endif
                printk(KERN_INFO PREFIX "CPU%d (power states:", pr->id);
                for (i = 1; i <= pr->power.count; i++)
@@ -1864,13 +1246,6 @@ int __cpuinit acpi_processor_power_init(struct acpi_processor *pr,
                                printk(" C%d[C%d]", i,
                                       pr->power.states[i].type);
                printk(")\n");
-#ifndef CONFIG_CPU_IDLE
-                if (pr->id == 0) {
-                        pm_idle_save = pm_idle;
-                        pm_idle = acpi_processor_idle;
-                }
-#endif
        }
        /* 'power' [R] */
@@ -1889,34 +1264,12 @@ int acpi_processor_power_exit(struct acpi_processor *pr,
        if (boot_option_idle_override)
                return 0;
-#ifdef CONFIG_CPU_IDLE
        cpuidle_unregister_device(&pr->power.dev);
-#endif
        pr->flags.power_setup_done = 0;
        if (acpi_device_dir(device))
                remove_proc_entry(ACPI_PROCESSOR_FILE_POWER,
                                  acpi_device_dir(device));
-#ifndef CONFIG_CPU_IDLE
-        /* Unregister the idle handler when processor #0 is removed. */
-        if (pr->id == 0) {
-                if (pm_idle_save)
-                        pm_idle = pm_idle_save;
-                /*
-                 * We are about to unload the current idle thread pm callback
-                 * (pm_idle), Wait for all processors to update cached/local
-                 * copies of pm_idle before proceeding.
-                 */
-                cpu_idle_wait();
-#ifdef CONFIG_SMP
-                pm_qos_remove_notifier(PM_QOS_CPU_DMA_LATENCY,
-                                &acpi_processor_latency_notifier);
-#endif
-        }
-#endif
        return 0;
 }
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index 846e227592d4..9cc769b587ff 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -31,14 +31,6 @@
 #include <linux/init.h>
 #include <linux/cpufreq.h>
-#ifdef CONFIG_X86_ACPI_CPUFREQ_PROC_INTF
-#include <linux/proc_fs.h>
-#include <linux/seq_file.h>
-#include <linux/mutex.h>
-#include <asm/uaccess.h>
-#endif
 #ifdef CONFIG_X86
 #include <asm/cpufeature.h>
 #endif
@@ -434,96 +426,6 @@ int acpi_processor_notify_smm(struct module *calling_module)
 EXPORT_SYMBOL(acpi_processor_notify_smm);
-#ifdef CONFIG_X86_ACPI_CPUFREQ_PROC_INTF
-/* /proc/acpi/processor/../performance interface (DEPRECATED) */
-static int acpi_processor_perf_open_fs(struct inode *inode, struct file *file);
-static struct file_operations acpi_processor_perf_fops = {
-        .owner = THIS_MODULE,
-        .open = acpi_processor_perf_open_fs,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-static int acpi_processor_perf_seq_show(struct seq_file *seq, void *offset)
-{
-        struct acpi_processor *pr = seq->private;
-        int i;
-        if (!pr)
-                goto end;
-        if (!pr->performance) {
-                seq_puts(seq, "<not supported>\n");
-                goto end;
-        }
-        seq_printf(seq, "state count:             %d\n"
-                   "active state:            P%d\n",
-                   pr->performance->state_count, pr->performance->state);
-        seq_puts(seq, "states:\n");
-        for (i = 0; i < pr->performance->state_count; i++)
-                seq_printf(seq,
-                           "   %cP%d:                  %d MHz, %d mW, %d uS\n",
-                           (i == pr->performance->state ? '*' : ' '), i,
-                           (u32) pr->performance->states[i].core_frequency,
-                           (u32) pr->performance->states[i].power,
-                           (u32) pr->performance->states[i].transition_latency);
-      end:
-        return 0;
-}
-static int acpi_processor_perf_open_fs(struct inode *inode, struct file *file)
-{
-        return single_open(file, acpi_processor_perf_seq_show,
-                           PDE(inode)->data);
-}
-static void acpi_cpufreq_add_file(struct acpi_processor *pr)
-{
-        struct acpi_device *device = NULL;
-        if (acpi_bus_get_device(pr->handle, &device))
-                return;
-        /* add file 'performance' [R/W] */
-        proc_create_data(ACPI_PROCESSOR_FILE_PERFORMANCE, S_IFREG | S_IRUGO,
-                         acpi_device_dir(device),
-                         &acpi_processor_perf_fops, acpi_driver_data(device));
-        return;
-}
-static void acpi_cpufreq_remove_file(struct acpi_processor *pr)
-{
-        struct acpi_device *device = NULL;
-        if (acpi_bus_get_device(pr->handle, &device))
-                return;
-        /* remove file 'performance' */
-        remove_proc_entry(ACPI_PROCESSOR_FILE_PERFORMANCE,
-                          acpi_device_dir(device));
-        return;
-}
-#else
-static void acpi_cpufreq_add_file(struct acpi_processor *pr)
-{
-        return;
-}
-static void acpi_cpufreq_remove_file(struct acpi_processor *pr)
-{
-        return;
-}
-#endif                          /* CONFIG_X86_ACPI_CPUFREQ_PROC_INTF */
 static int acpi_processor_get_psd(struct acpi_processor *pr)
 {
        int result = 0;
@@ -747,14 +649,12 @@ err_ret:
 }
 EXPORT_SYMBOL(acpi_processor_preregister_performance);
 int
 acpi_processor_register_performance(struct acpi_processor_performance
                                    *performance, unsigned int cpu)
 {
        struct acpi_processor *pr;
        if (!(acpi_processor_ppc_status & PPC_REGISTERED))
                return -EINVAL;
@@ -781,8 +681,6 @@ acpi_processor_register_performance(struct acpi_processor_performance
                return -EIO;
        }
-        acpi_cpufreq_add_file(pr);
        mutex_unlock(&performance_mutex);
        return 0;
 }
@@ -795,7 +693,6 @@ acpi_processor_unregister_performance(struct acpi_processor_performance
 {
        struct acpi_processor *pr;
        mutex_lock(&performance_mutex);
        pr = per_cpu(processors, cpu);
@@ -808,8 +705,6 @@ acpi_processor_unregister_performance(struct acpi_processor_performance
                kfree(pr->performance->states);
        pr->performance = NULL;
-        acpi_cpufreq_remove_file(pr);
        mutex_unlock(&performance_mutex);
        return;
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index af85f5ba1be7..519266654f06 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -680,7 +680,7 @@ static void acpi_power_off_prepare(void)
 static void acpi_power_off(void)
 {
        /* acpi_sleep_prepare(ACPI_STATE_S5) should have already been called */
-        printk("%s called\n", __func__);
+        printk(KERN_DEBUG "%s called\n", __func__);
        local_irq_disable();
        acpi_enable_wakeup_device(ACPI_STATE_S5);
        acpi_enter_sleep_state(ACPI_STATE_S5);
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 1981eaf9fa7b..bb5ed059114a 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -1020,7 +1020,7 @@ acpi_video_device_brightness_seq_show(struct seq_file *seq, void *offset)
        }
        seq_printf(seq, "levels: ");
-        for (i = 0; i < dev->brightness->count; i++)
+        for (i = 2; i < dev->brightness->count; i++)
                seq_printf(seq, " %d", dev->brightness->levels[i]);
        seq_printf(seq, "\ncurrent: %d\n", dev->brightness->curr);
@@ -1059,7 +1059,7 @@ acpi_video_device_write_brightness(struct file *file,
                return -EFAULT;
        /* validate through the list of available levels */
-        for (i = 0; i < dev->brightness->count; i++)
+        for (i = 2; i < dev->brightness->count; i++)
                if (level == dev->brightness->levels[i]) {
                        if (ACPI_SUCCESS
                            (acpi_video_device_lcd_set_level(dev, level)))
@@ -1260,7 +1260,7 @@ static int acpi_video_bus_POST_info_seq_show(struct seq_file *seq, void *offset)
                        printk(KERN_WARNING PREFIX
                               "This indicates a BIOS bug. Please contact the manufacturer.\n");
                }
-                printk("%llx\n", options);
+                printk(KERN_WARNING "%llx\n", options);
                seq_printf(seq, "can POST: <integrated video>");
                if (options & 2)
                        seq_printf(seq, " <PCI video>");
@@ -1712,7 +1712,7 @@ acpi_video_get_next_level(struct acpi_video_device *device,
        max = max_below = 0;
        min = min_above = 255;
        /* Find closest level to level_current */
-        for (i = 0; i < device->brightness->count; i++) {
+        for (i = 2; i < device->brightness->count; i++) {
                l = device->brightness->levels[i];
                if (abs(l - level_current) < abs(delta)) {
                        delta = l - level_current;
@@ -1722,7 +1722,7 @@ acpi_video_get_next_level(struct acpi_video_device *device,
        }
        /* Ajust level_current to closest available level */
        level_current += delta;
-        for (i = 0; i < device->brightness->count; i++) {
+        for (i = 2; i < device->brightness->count; i++) {
                l = device->brightness->levels[i];
                if (l < min)
                        min = l;
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 503a908afc80..0bcf26464670 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -112,11 +112,11 @@ config ATA_PIIX
          If unsure, say N.
 config SATA_MV
-        tristate "Marvell SATA support (HIGHLY EXPERIMENTAL)"
+        tristate "Marvell SATA support"
-        depends on EXPERIMENTAL
        help
          This option enables support for the Marvell Serial ATA family.
-          Currently supports 88SX[56]0[48][01] chips.
+          Currently supports 88SX[56]0[48][01] PCI(-X) chips,
+          as well as the newer [67]042 PCI-X/PCIe and SOC devices.
          If unsure, say N.
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 96039671e3b9..a603bbf9b1b7 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -61,9 +61,14 @@
 #define EM_MSG_LED_VALUE_ON           0x00010000
 static int ahci_skip_host_reset;
+static int ahci_ignore_sss;
 module_param_named(skip_host_reset, ahci_skip_host_reset, int, 0444);
 MODULE_PARM_DESC(skip_host_reset, "skip global host reset (0=don't skip, 1=skip)");
+module_param_named(ignore_sss, ahci_ignore_sss, int, 0444);
+MODULE_PARM_DESC(ignore_sss, "Ignore staggered spinup flag (0=don't ignore, 1=ignore)");
 static int ahci_enable_alpm(struct ata_port *ap,
                enum link_pm policy);
 static void ahci_disable_alpm(struct ata_port *ap);
@@ -2548,6 +2553,32 @@ static void ahci_p5wdh_workaround(struct ata_host *host)
        }
 }
+static bool ahci_broken_system_poweroff(struct pci_dev *pdev)
+{
+        static const struct dmi_system_id broken_systems[] = {
+                {
+                        .ident = "HP Compaq nx6310",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                                DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq nx6310"),
+                        },
+                        /* PCI slot number of the controller */
+                        .driver_data = (void *)0x1FUL,
+                },
+                { }     /* terminate list */
+        };
+        const struct dmi_system_id *dmi = dmi_first_match(broken_systems);
+        if (dmi) {
+                unsigned long slot = (unsigned long)dmi->driver_data;
+                /* apply the quirk only to on-board controllers */
+                return slot == PCI_SLOT(pdev->devfn);
+        }
+        return false;
+}
 static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
        static int printed_version;
@@ -2647,6 +2678,12 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                }
        }
+        if (ahci_broken_system_poweroff(pdev)) {
+                pi.flags |= ATA_FLAG_NO_POWEROFF_SPINDOWN;
+                dev_info(&pdev->dev,
+                        "quirky BIOS, skipping spindown on poweroff\n");
+        }
        /* CAP.NP sometimes indicate the index of the last enabled
         * port, at other times, that of the last possible port, so
         * determining the maximum port number requires looking at
@@ -2660,8 +2697,10 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        host->iomap = pcim_iomap_table(pdev);
        host->private_data = hpriv;
-        if (!(hpriv->cap & HOST_CAP_SSS))
+        if (!(hpriv->cap & HOST_CAP_SSS) || ahci_ignore_sss)
                host->flags |= ATA_HOST_PARALLEL_SCAN;
+        else
+                printk(KERN_INFO "ahci: SSS flag set, parallel bus scan disabled\n");
        if (pi.flags & ATA_FLAG_EM)
                ahci_reset_em(host);
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 887d8f46a287..54961c0b2c73 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -1387,6 +1387,32 @@ static void piix_iocfg_bit18_quirk(struct ata_host *host)
        }
 }
+static bool piix_broken_system_poweroff(struct pci_dev *pdev)
+{
+        static const struct dmi_system_id broken_systems[] = {
+                {
+                        .ident = "HP Compaq 2510p",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                                DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq 2510p"),
+                        },
+                        /* PCI slot number of the controller */
+                        .driver_data = (void *)0x1FUL,
+                },
+                { }     /* terminate list */
+        };
+        const struct dmi_system_id *dmi = dmi_first_match(broken_systems);
+        if (dmi) {
+                unsigned long slot = (unsigned long)dmi->driver_data;
+                /* apply the quirk only to on-board controllers */
+                return slot == PCI_SLOT(pdev->devfn);
+        }
+        return false;
+}
 /**
 *      piix_init_one - Register PIIX ATA PCI device with kernel services
 *      @pdev: PCI device to register
@@ -1422,6 +1448,14 @@ static int __devinit piix_init_one(struct pci_dev *pdev,
        if (!in_module_init)
                return -ENODEV;
+        if (piix_broken_system_poweroff(pdev)) {
+                piix_port_info[ent->driver_data].flags |=
+                                ATA_FLAG_NO_POWEROFF_SPINDOWN |
+                                        ATA_FLAG_NO_HIBERNATE_SPINDOWN;
+                dev_info(&pdev->dev, "quirky BIOS, skipping spindown "
+                                "on poweroff and hibernation\n");
+        }
        port_info[0] = piix_port_info[ent->driver_data];
        port_info[1] = piix_port_info[ent->driver_data];
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 88c242856dae..9fbf0595f3d4 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -164,6 +164,11 @@ MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
+static bool ata_sstatus_online(u32 sstatus)
+{
+        return (sstatus & 0xf) == 0x3;
+}
 /**
 *      ata_link_next - link iteration helper
 *      @link: the previous link, NULL to start
@@ -1015,18 +1020,6 @@ static const char *sata_spd_string(unsigned int spd)
        return spd_str[spd - 1];
 }
-void ata_dev_disable(struct ata_device *dev)
-{
-        if (ata_dev_enabled(dev)) {
-                if (ata_msg_drv(dev->link->ap))
-                        ata_dev_printk(dev, KERN_WARNING, "disabled\n");
-                ata_acpi_on_disable(dev);
-                ata_down_xfermask_limit(dev, ATA_DNXFER_FORCE_PIO0 |
-                                             ATA_DNXFER_QUIET);
-                dev->class++;
-        }
-}
 static int ata_dev_set_dipm(struct ata_device *dev, enum link_pm policy)
 {
        struct ata_link *link = dev->link;
@@ -2239,6 +2232,40 @@ retry:
        return rc;
 }
+static int ata_do_link_spd_horkage(struct ata_device *dev)
+{
+        struct ata_link *plink = ata_dev_phys_link(dev);
+        u32 target, target_limit;
+        if (!sata_scr_valid(plink))
+                return 0;
+        if (dev->horkage & ATA_HORKAGE_1_5_GBPS)
+                target = 1;
+        else
+                return 0;
+        target_limit = (1 << target) - 1;
+        /* if already on stricter limit, no need to push further */
+        if (plink->sata_spd_limit <= target_limit)
+                return 0;
+        plink->sata_spd_limit = target_limit;
+        /* Request another EH round by returning -EAGAIN if link is
+         * going faster than the target speed.  Forward progress is
+         * guaranteed by setting sata_spd_limit to target_limit above.
+         */
+        if (plink->sata_spd > target) {
+                ata_dev_printk(dev, KERN_INFO,
+                               "applying link speed limit horkage to %s\n",
+                               sata_spd_string(target));
+                return -EAGAIN;
+        }
+        return 0;
+}
 static inline u8 ata_dev_knobble(struct ata_device *dev)
 {
        struct ata_port *ap = dev->link->ap;
@@ -2329,6 +2356,10 @@ int ata_dev_configure(struct ata_device *dev)
                return 0;
        }
+        rc = ata_do_link_spd_horkage(dev);
+        if (rc)
+                return rc;
        /* let ACPI work its magic */
        rc = ata_acpi_on_devcfg(dev);
        if (rc)
@@ -2784,7 +2815,7 @@ int ata_bus_probe(struct ata_port *ap)
                        /* This is the last chance, better to slow
                         * down than lose it.
                         */
-                        sata_down_spd_limit(&ap->link);
+                        sata_down_spd_limit(&ap->link, 0);
                        ata_down_xfermask_limit(dev, ATA_DNXFER_PIO);
                }
        }
@@ -2880,21 +2911,27 @@ void ata_port_disable(struct ata_port *ap)
 /**
 *      sata_down_spd_limit - adjust SATA spd limit downward
 *      @link: Link to adjust SATA spd limit for
+ *      @spd_limit: Additional limit
 *
 *      Adjust SATA spd limit of @link downward.  Note that this
 *      function only adjusts the limit.  The change must be applied
 *      using sata_set_spd().
 *
+ *      If @spd_limit is non-zero, the speed is limited to equal to or
+ *      lower than @spd_limit if such speed is supported.  If
+ *      @spd_limit is slower than any supported speed, only the lowest
+ *      supported speed is allowed.
+ *
 *      LOCKING:
 *      Inherited from caller.
 *
 *      RETURNS:
 *      0 on success, negative errno on failure
 */
-int sata_down_spd_limit(struct ata_link *link)
+int sata_down_spd_limit(struct ata_link *link, u32 spd_limit)
 {
        u32 sstatus, spd, mask;
-        int rc, highbit;
+        int rc, bit;
        if (!sata_scr_valid(link))
                return -EOPNOTSUPP;
@@ -2903,7 +2940,7 @@ int sata_down_spd_limit(struct ata_link *link)
         * If not, use cached value in link->sata_spd.
         */
        rc = sata_scr_read(link, SCR_STATUS, &sstatus);
-        if (rc == 0)
+        if (rc == 0 && ata_sstatus_online(sstatus))
                spd = (sstatus >> 4) & 0xf;
        else
                spd = link->sata_spd;
@@ -2913,8 +2950,8 @@ int sata_down_spd_limit(struct ata_link *link)
                return -EINVAL;
        /* unconditionally mask off the highest bit */
-        highbit = fls(mask) - 1;
+        bit = fls(mask) - 1;
-        mask &= ~(1 << highbit);
+        mask &= ~(1 << bit);
        /* Mask off all speeds higher than or equal to the current
         * one.  Force 1.5Gbps if current SPD is not available.
@@ -2928,6 +2965,15 @@ int sata_down_spd_limit(struct ata_link *link)
        if (!mask)
                return -EINVAL;
+        if (spd_limit) {
+                if (mask & ((1 << spd_limit) - 1))
+                        mask &= (1 << spd_limit) - 1;
+                else {
+                        bit = ffs(mask) - 1;
+                        mask = 1 << bit;
+                }
+        }
        link->sata_spd_limit = mask;
        ata_link_printk(link, KERN_WARNING, "limiting SATA link speed to %s\n",
@@ -4215,6 +4261,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        /* Devices that do not need bridging limits applied */
        { "MTRON MSP-SATA*",            NULL,   ATA_HORKAGE_BRIDGE_OK, },
+        /* Devices which aren't very happy with higher link speeds */
+        { "WD My Book",                 NULL,   ATA_HORKAGE_1_5_GBPS, },
        /* End Marker */
        { }
 };
@@ -4709,8 +4758,7 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
 /**
 *      ata_qc_new - Request an available ATA command, for queueing
- *      @ap: Port associated with device @dev
+ *      @ap: target port
- *      @dev: Device from whom we request an available command structure
 *
 *      LOCKING:
 *      None.
@@ -5175,7 +5223,7 @@ bool ata_phys_link_online(struct ata_link *link)
        u32 sstatus;
        if (sata_scr_read(link, SCR_STATUS, &sstatus) == 0 &&
-            (sstatus & 0xf) == 0x3)
+            ata_sstatus_online(sstatus))
                return true;
        return false;
 }
@@ -5199,7 +5247,7 @@ bool ata_phys_link_offline(struct ata_link *link)
        u32 sstatus;
        if (sata_scr_read(link, SCR_STATUS, &sstatus) == 0 &&
-            (sstatus & 0xf) != 0x3)
+            !ata_sstatus_online(sstatus))
                return true;
        return false;
 }
@@ -5412,8 +5460,8 @@ void ata_dev_init(struct ata_device *dev)
        dev->horkage = 0;
        spin_unlock_irqrestore(ap->lock, flags);
-        memset((void *)dev + ATA_DEVICE_CLEAR_OFFSET, 0,
+        memset((void *)dev + ATA_DEVICE_CLEAR_BEGIN, 0,
-               sizeof(*dev) - ATA_DEVICE_CLEAR_OFFSET);
+               ATA_DEVICE_CLEAR_END - ATA_DEVICE_CLEAR_BEGIN);
        dev->pio_mask = UINT_MAX;
        dev->mwdma_mask = UINT_MAX;
        dev->udma_mask = UINT_MAX;
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 8147a8386370..ce2ef0475339 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -82,6 +82,10 @@ enum {
        ATA_EH_FASTDRAIN_INTERVAL       =  3000,
        ATA_EH_UA_TRIES                 = 5,
+        /* probe speed down parameters, see ata_eh_schedule_probe() */
+        ATA_EH_PROBE_TRIAL_INTERVAL     = 60000,        /* 1 min */
+        ATA_EH_PROBE_TRIALS             = 2,
 };
 /* The following table determines how we sequence resets.  Each entry
@@ -1176,6 +1180,32 @@ void ata_eh_qc_retry(struct ata_queued_cmd *qc)
 }
 /**
+ *      ata_dev_disable - disable ATA device
+ *      @dev: ATA device to disable
+ *
+ *      Disable @dev.
+ *
+ *      Locking:
+ *      EH context.
+ */
+void ata_dev_disable(struct ata_device *dev)
+{
+        if (!ata_dev_enabled(dev))
+                return;
+        if (ata_msg_drv(dev->link->ap))
+                ata_dev_printk(dev, KERN_WARNING, "disabled\n");
+        ata_acpi_on_disable(dev);
+        ata_down_xfermask_limit(dev, ATA_DNXFER_FORCE_PIO0 | ATA_DNXFER_QUIET);
+        dev->class++;
+        /* From now till the next successful probe, ering is used to
+         * track probe failures.  Clear accumulated device error info.
+         */
+        ata_ering_clear(&dev->ering);
+}
+/**
 *      ata_eh_detach_dev - detach ATA device
 *      @dev: ATA device to detach
 *
@@ -1849,7 +1879,7 @@ static unsigned int ata_eh_speed_down(struct ata_device *dev,
        /* speed down? */
        if (verdict & ATA_EH_SPDN_SPEED_DOWN) {
                /* speed down SATA link speed if possible */
-                if (sata_down_spd_limit(link) == 0) {
+                if (sata_down_spd_limit(link, 0) == 0) {
                        action |= ATA_EH_RESET;
                        goto done;
                }
@@ -2601,11 +2631,11 @@ int ata_eh_reset(struct ata_link *link, int classify,
        }
        if (try == max_tries - 1) {
-                sata_down_spd_limit(link);
+                sata_down_spd_limit(link, 0);
                if (slave)
-                        sata_down_spd_limit(slave);
+                        sata_down_spd_limit(slave, 0);
        } else if (rc == -EPIPE)
-                sata_down_spd_limit(failed_link);
+                sata_down_spd_limit(failed_link, 0);
        if (hardreset)
                reset = hardreset;
@@ -2744,6 +2774,8 @@ static int ata_eh_revalidate_and_attach(struct ata_link *link,
                                                     readid_flags, dev->id);
                        switch (rc) {
                        case 0:
+                                /* clear error info accumulated during probe */
+                                ata_ering_clear(&dev->ering);
                                new_mask |= 1 << dev->devno;
                                break;
                        case -ENOENT:
@@ -2947,9 +2979,24 @@ static int ata_eh_skip_recovery(struct ata_link *link)
        return 1;
 }
+static int ata_count_probe_trials_cb(struct ata_ering_entry *ent, void *void_arg)
+{
+        u64 interval = msecs_to_jiffies(ATA_EH_PROBE_TRIAL_INTERVAL);
+        u64 now = get_jiffies_64();
+        int *trials = void_arg;
+        if (ent->timestamp < now - min(now, interval))
+                return -1;
+        (*trials)++;
+        return 0;
+}
 static int ata_eh_schedule_probe(struct ata_device *dev)
 {
        struct ata_eh_context *ehc = &dev->link->eh_context;
+        struct ata_link *link = ata_dev_phys_link(dev);
+        int trials = 0;
        if (!(ehc->i.probe_mask & (1 << dev->devno)) ||
            (ehc->did_probe_mask & (1 << dev->devno)))
@@ -2962,6 +3009,25 @@ static int ata_eh_schedule_probe(struct ata_device *dev)
        ehc->saved_xfer_mode[dev->devno] = 0;
        ehc->saved_ncq_enabled &= ~(1 << dev->devno);
+        /* Record and count probe trials on the ering.  The specific
+         * error mask used is irrelevant.  Because a successful device
+         * detection clears the ering, this count accumulates only if
+         * there are consecutive failed probes.
+         *
+         * If the count is equal to or higher than ATA_EH_PROBE_TRIALS
+         * in the last ATA_EH_PROBE_TRIAL_INTERVAL, link speed is
+         * forced to 1.5Gbps.
+         *
+         * This is to work around cases where failed link speed
+         * negotiation results in device misdetection leading to
+         * infinite DEVXCHG or PHRDY CHG events.
+         */
+        ata_ering_record(&dev->ering, 0, AC_ERR_OTHER);
+        ata_ering_map(&dev->ering, ata_count_probe_trials_cb, &trials);
+        if (trials > ATA_EH_PROBE_TRIALS)
+                sata_down_spd_limit(link, 1);
        return 1;
 }
@@ -2969,7 +3035,11 @@ static int ata_eh_handle_dev_fail(struct ata_device *dev, int err)
 {
        struct ata_eh_context *ehc = &dev->link->eh_context;
-        ehc->tries[dev->devno]--;
+        /* -EAGAIN from EH routine indicates retry without prejudice.
+         * The requester is responsible for ensuring forward progress.
+         */
+        if (err != -EAGAIN)
+                ehc->tries[dev->devno]--;
        switch (err) {
        case -ENODEV:
@@ -2979,12 +3049,13 @@ static int ata_eh_handle_dev_fail(struct ata_device *dev, int err)
                /* give it just one more chance */
                ehc->tries[dev->devno] = min(ehc->tries[dev->devno], 1);
        case -EIO:
-                if (ehc->tries[dev->devno] == 1 && dev->pio_mode > XFER_PIO_0) {
+                if (ehc->tries[dev->devno] == 1) {
                        /* This is the last chance, better to slow
                         * down than lose it.
                         */
-                        sata_down_spd_limit(ata_dev_phys_link(dev));
+                        sata_down_spd_limit(ata_dev_phys_link(dev), 0);
-                        ata_down_xfermask_limit(dev, ATA_DNXFER_PIO);
+                        if (dev->pio_mode > XFER_PIO_0)
+                                ata_down_xfermask_limit(dev, ATA_DNXFER_PIO);
                }
        }
diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
index 98ca07a2db87..619f2c33950e 100644
--- a/drivers/ata/libata-pmp.c
+++ b/drivers/ata/libata-pmp.c
@@ -729,7 +729,7 @@ static int sata_pmp_eh_recover_pmp(struct ata_port *ap,
                if (tries) {
                        /* consecutive revalidation failures? speed down */
                        if (reval_failed)
-                                sata_down_spd_limit(link);
+                                sata_down_spd_limit(link, 0);
                        else
                                reval_failed = 1;
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index a1a6e6298c33..b9747fa59e54 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -46,6 +46,7 @@
 #include <linux/libata.h>
 #include <linux/hdreg.h>
 #include <linux/uaccess.h>
+#include <linux/suspend.h>
 #include "libata.h"
@@ -414,6 +415,7 @@ int ata_std_bios_param(struct scsi_device *sdev, struct block_device *bdev,
 /**
 *      ata_get_identity - Handler for HDIO_GET_IDENTITY ioctl
+ *      @ap: target port
 *      @sdev: SCSI device to get identify data for
 *      @arg: User buffer area for identify data
 *
@@ -1303,6 +1305,17 @@ static unsigned int ata_scsi_start_stop_xlat(struct ata_queued_cmd *qc)
                tf->command = ATA_CMD_VERIFY;   /* READ VERIFY */
        } else {
+                /* Some odd clown BIOSen issue spindown on power off (ACPI S4
+                 * or S5) causing some drives to spin up and down again.
+                 */
+                if ((qc->ap->flags & ATA_FLAG_NO_POWEROFF_SPINDOWN) &&
+                    system_state == SYSTEM_POWER_OFF)
+                        goto skip;
+                if ((qc->ap->flags & ATA_FLAG_NO_HIBERNATE_SPINDOWN) &&
+                     system_entering_hibernation())
+                        goto skip;
                /* XXX: This is for backward compatibility, will be
                 * removed.  Read Documentation/feature-removal-schedule.txt
                 * for more info.
@@ -1326,8 +1339,7 @@ static unsigned int ata_scsi_start_stop_xlat(struct ata_queued_cmd *qc)
                                scmd->scsi_done = qc->scsidone;
                                qc->scsidone = ata_delayed_done;
                        }
-                        scmd->result = SAM_STAT_GOOD;
+                        goto skip;
-                        return 1;
                }
                /* Issue ATA STANDBY IMMEDIATE command */
@@ -1343,10 +1355,13 @@ static unsigned int ata_scsi_start_stop_xlat(struct ata_queued_cmd *qc)
        return 0;
-invalid_fld:
+ invalid_fld:
        ata_scsi_set_sense(scmd, ILLEGAL_REQUEST, 0x24, 0x0);
        /* "Invalid field in cbd" */
        return 1;
+ skip:
+        scmd->result = SAM_STAT_GOOD;
+        return 1;
 }
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 5a4aad123c42..0b299b0f8172 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -1322,7 +1322,7 @@ fsm_start:
                                         * condition.  Mark hint.
                                         */
                                        ata_ehi_push_desc(ehi, "ST-ATA: "
-                                                "DRQ=1 with device error, "
+                                                "DRQ=0 without device error, "
                                                "dev_stat 0x%X", status);
                                        qc->err_mask |= AC_ERR_HSM |
                                                        AC_ERR_NODEV_HINT;
@@ -1358,6 +1358,16 @@ fsm_start:
                                        qc->err_mask |= AC_ERR_HSM;
                                }
+                                /* There are oddball controllers with
+                                 * status register stuck at 0x7f and
+                                 * lbal/m/h at zero which makes it
+                                 * pass all other presence detection
+                                 * mechanisms we have.  Set NODEV_HINT
+                                 * for it.  Kernel bz#7241.
+                                 */
+                                if (status == 0x7f)
+                                        qc->err_mask |= AC_ERR_NODEV_HINT;
                                /* ata_pio_sectors() might change the
                                 * state to HSM_ST_LAST. so, the state
                                 * is changed after ata_pio_sectors().
diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
index fe2839e58774..cea8014cd87e 100644
--- a/drivers/ata/libata.h
+++ b/drivers/ata/libata.h
@@ -79,7 +79,6 @@ extern int ata_build_rw_tf(struct ata_taskfile *tf, struct ata_device *dev,
                           u64 block, u32 n_block, unsigned int tf_flags,
                           unsigned int tag);
 extern u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev);
-extern void ata_dev_disable(struct ata_device *dev);
 extern void ata_pio_queue_task(struct ata_port *ap, void *data,
                               unsigned long delay);
 extern void ata_port_flush_task(struct ata_port *ap);
@@ -100,7 +99,7 @@ extern int ata_dev_reread_id(struct ata_device *dev, unsigned int readid_flags);
 extern int ata_dev_revalidate(struct ata_device *dev, unsigned int new_class,
                              unsigned int readid_flags);
 extern int ata_dev_configure(struct ata_device *dev);
-extern int sata_down_spd_limit(struct ata_link *link);
+extern int sata_down_spd_limit(struct ata_link *link, u32 spd_limit);
 extern int ata_down_xfermask_limit(struct ata_device *dev, unsigned int sel);
 extern void ata_sg_clean(struct ata_queued_cmd *qc);
 extern void ata_qc_free(struct ata_queued_cmd *qc);
@@ -160,6 +159,7 @@ extern void ata_scsi_error(struct Scsi_Host *host);
 extern void ata_port_wait_eh(struct ata_port *ap);
 extern void ata_eh_fastdrain_timerfn(unsigned long arg);
 extern void ata_qc_schedule_eh(struct ata_queued_cmd *qc);
+extern void ata_dev_disable(struct ata_device *dev);
 extern void ata_eh_detach_dev(struct ata_device *dev);
 extern void ata_eh_about_to_do(struct ata_link *link, struct ata_device *dev,
                               unsigned int action);
diff --git a/drivers/ata/pata_qdi.c b/drivers/ata/pata_qdi.c
index 3080f371222c..f1b26f7c8e4d 100644
--- a/drivers/ata/pata_qdi.c
+++ b/drivers/ata/pata_qdi.c
@@ -12,7 +12,7 @@
 *
 * Probe code based on drivers/ide/legacy/qd65xx.c
 * Rewritten from the work of Colten Edwards <pje120@cs.usask.ca> by
- * Samuel Thibault <samuel.thibault@fnac.net>
+ * Samuel Thibault <samuel.thibault@ens-lyon.org>
 */
 #include <linux/kernel.h>
diff --git a/drivers/ata/pata_rb532_cf.c b/drivers/ata/pata_rb532_cf.c
index c2e6fb9f2ef9..ebfcda26d639 100644
--- a/drivers/ata/pata_rb532_cf.c
+++ b/drivers/ata/pata_rb532_cf.c
@@ -63,8 +63,6 @@ static inline void rb532_pata_finish_io(struct ata_port *ap)
           ata_sff_sync might be sufficient. */
        ata_sff_dma_pause(ap);
        ndelay(RB500_CF_IO_DELAY);
-        set_irq_type(info->irq, IRQ_TYPE_LEVEL_HIGH);
 }
 static void rb532_pata_exec_command(struct ata_port *ap,
diff --git a/drivers/ata/pata_via.c b/drivers/ata/pata_via.c
index 681169c9c640..79a6c9a0b721 100644
--- a/drivers/ata/pata_via.c
+++ b/drivers/ata/pata_via.c
@@ -86,6 +86,10 @@ enum {
        VIA_SATA_PATA   = 0x800, /* SATA/PATA combined configuration */
 };
+enum {
+        VIA_IDFLAG_SINGLE = (1 << 0), /* single channel controller) */
+};
 /*
 * VIA SouthBridge chips.
 */
@@ -97,8 +101,12 @@ static const struct via_isa_bridge {
        u8 rev_max;
        u16 flags;
 } via_isa_bridges[] = {
+        { "vx855",      PCI_DEVICE_ID_VIA_VX855,    0x00, 0x2f,
+          VIA_UDMA_133 | VIA_BAD_AST | VIA_SATA_PATA },
        { "vx800",      PCI_DEVICE_ID_VIA_VX800,    0x00, 0x2f, VIA_UDMA_133 |
        VIA_BAD_AST | VIA_SATA_PATA },
+        { "vt8261",     PCI_DEVICE_ID_VIA_8261,     0x00, 0x2f,
+          VIA_UDMA_133 | VIA_BAD_AST },
        { "vt8237s",    PCI_DEVICE_ID_VIA_8237S,    0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
        { "vt8251",     PCI_DEVICE_ID_VIA_8251,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
        { "cx700",      PCI_DEVICE_ID_VIA_CX700,    0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_SATA_PATA },
@@ -122,6 +130,8 @@ static const struct via_isa_bridge {
        { "vt82c586",   PCI_DEVICE_ID_VIA_82C586_0, 0x00, 0x0f, VIA_UDMA_NONE | VIA_SET_FIFO },
        { "vt82c576",   PCI_DEVICE_ID_VIA_82C576,   0x00, 0x2f, VIA_UDMA_NONE | VIA_SET_FIFO | VIA_NO_UNMASK },
        { "vt82c576",   PCI_DEVICE_ID_VIA_82C576,   0x00, 0x2f, VIA_UDMA_NONE | VIA_SET_FIFO | VIA_NO_UNMASK | VIA_BAD_ID },
+        { "vtxxxx",     PCI_DEVICE_ID_VIA_ANON,    0x00, 0x2f,
+          VIA_UDMA_133 | VIA_BAD_AST },
        { NULL }
 };
@@ -460,6 +470,7 @@ static int via_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
        static int printed_version;
        u8 enable;
        u32 timing;
+        unsigned long flags = id->driver_data;
        int rc;
        if (!printed_version++)
@@ -469,9 +480,13 @@ static int via_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
        if (rc)
                return rc;
+        if (flags & VIA_IDFLAG_SINGLE)
+                ppi[1] = &ata_dummy_port_info;
        /* To find out how the IDE will behave and what features we
           actually have to look at the bridge not the IDE controller */
-        for (config = via_isa_bridges; config->id; config++)
+        for (config = via_isa_bridges; config->id != PCI_DEVICE_ID_VIA_ANON;
+             config++)
                if ((isa = pci_get_device(PCI_VENDOR_ID_VIA +
                        !!(config->flags & VIA_BAD_ID),
                        config->id, NULL))) {
@@ -482,10 +497,6 @@ static int via_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
                        pci_dev_put(isa);
                }
-        if (!config->id) {
-                printk(KERN_WARNING "via: Unknown VIA SouthBridge, disabling.\n");
-                return -ENODEV;
-        }
        pci_dev_put(isa);
        if (!(config->flags & VIA_NO_ENABLES)) {
@@ -587,6 +598,7 @@ static const struct pci_device_id via[] = {
        { PCI_VDEVICE(VIA, 0x1571), },
        { PCI_VDEVICE(VIA, 0x3164), },
        { PCI_VDEVICE(VIA, 0x5324), },
+        { PCI_VDEVICE(VIA, 0xC409), VIA_IDFLAG_SINGLE },
        { },
 };
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 86918634a4c5..4ae1a4138b47 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -33,10 +33,6 @@
 *
 * --> ATAPI support (Marvell claims the 60xx/70xx chips can do it).
 *
- * --> Investigate problems with PCI Message Signalled Interrupts (MSI).
- *
- * --> Cache frequently-accessed registers in mv_port_priv to reduce overhead.
- *
 * --> Develop a low-power-consumption strategy, and implement it.
 *
 * --> [Experiment, low priority] Investigate interrupt coalescing.
@@ -72,7 +68,7 @@
 #include <linux/libata.h>
 #define DRV_NAME        "sata_mv"
-#define DRV_VERSION     "1.24"
+#define DRV_VERSION     "1.25"
 enum {
        /* BAR's are enumerated in terms of pci_resource_start() terms */
@@ -351,8 +347,6 @@ enum {
        EDMA_HALTCOND_OFS       = 0x60,         /* GenIIe halt conditions */
-        GEN_II_NCQ_MAX_SECTORS  = 256,          /* max sects/io on Gen2 w/NCQ */
        /* Host private flags (hp_flags) */
        MV_HP_FLAG_MSI          = (1 << 0),
        MV_HP_ERRATA_50XXB0     = (1 << 1),
@@ -669,8 +663,8 @@ static const struct pci_device_id mv_pci_tbl[] = {
        { PCI_VDEVICE(MARVELL, 0x5081), chip_508x },
        /* RocketRAID 1720/174x have different identifiers */
        { PCI_VDEVICE(TTI, 0x1720), chip_6042 },
-        { PCI_VDEVICE(TTI, 0x1740), chip_508x },
+        { PCI_VDEVICE(TTI, 0x1740), chip_6042 },
-        { PCI_VDEVICE(TTI, 0x1742), chip_508x },
+        { PCI_VDEVICE(TTI, 0x1742), chip_6042 },
        { PCI_VDEVICE(MARVELL, 0x6040), chip_604x },
        { PCI_VDEVICE(MARVELL, 0x6041), chip_604x },
@@ -883,19 +877,15 @@ static void mv_start_dma(struct ata_port *ap, void __iomem *port_mmio,
                struct mv_host_priv *hpriv = ap->host->private_data;
                int hardport = mv_hardport_from_port(ap->port_no);
                void __iomem *hc_mmio = mv_hc_base_from_port(
-                                        mv_host_base(ap->host), hardport);
+                                        mv_host_base(ap->host), ap->port_no);
-                u32 hc_irq_cause, ipending;
+                u32 hc_irq_cause;
                /* clear EDMA event indicators, if any */
                writelfl(0, port_mmio + EDMA_ERR_IRQ_CAUSE_OFS);
-                /* clear EDMA interrupt indicator, if any */
+                /* clear pending irq events */
-                hc_irq_cause = readl(hc_mmio + HC_IRQ_CAUSE_OFS);
+                hc_irq_cause = ~((DEV_IRQ | DMA_IRQ) << hardport);
-                ipending = (DEV_IRQ | DMA_IRQ) << hardport;
+                writelfl(hc_irq_cause, hc_mmio + HC_IRQ_CAUSE_OFS);
-                if (hc_irq_cause & ipending) {
-                        writelfl(hc_irq_cause & ~ipending,
-                                 hc_mmio + HC_IRQ_CAUSE_OFS);
-                }
                mv_edma_cfg(ap, want_ncq);
@@ -1099,20 +1089,12 @@ static void mv6_dev_config(struct ata_device *adev)
         *
         * Gen-II does not support NCQ over a port multiplier
         *  (no FIS-based switching).
-         *
-         * We don't have hob_nsect when doing NCQ commands on Gen-II.
-         * See mv_qc_prep() for more info.
         */
        if (adev->flags & ATA_DFLAG_NCQ) {
                if (sata_pmp_attached(adev->link->ap)) {
                        adev->flags &= ~ATA_DFLAG_NCQ;
                        ata_dev_printk(adev, KERN_INFO,
                                "NCQ disabled for command-based switching\n");
-                } else if (adev->max_sectors > GEN_II_NCQ_MAX_SECTORS) {
-                        adev->max_sectors = GEN_II_NCQ_MAX_SECTORS;
-                        ata_dev_printk(adev, KERN_INFO,
-                                "max_sectors limited to %u for NCQ\n",
-                                adev->max_sectors);
                }
        }
 }
@@ -1450,7 +1432,8 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
         * only 11 bytes...so we must pick and choose required
         * registers based on the command.  So, we drop feature and
         * hob_feature for [RW] DMA commands, but they are needed for
-         * NCQ.  NCQ will drop hob_nsect.
+         * NCQ.  NCQ will drop hob_nsect, which is not needed there
+         * (nsect is used only for the tag; feat/hob_feat hold true nsect).
         */
        switch (tf->command) {
        case ATA_CMD_READ:
@@ -2214,9 +2197,15 @@ static irqreturn_t mv_interrupt(int irq, void *dev_instance)
        struct ata_host *host = dev_instance;
        struct mv_host_priv *hpriv = host->private_data;
        unsigned int handled = 0;
+        int using_msi = hpriv->hp_flags & MV_HP_FLAG_MSI;
        u32 main_irq_cause, pending_irqs;
        spin_lock(&host->lock);
+        /* for MSI:  block new interrupts while in here */
+        if (using_msi)
+                writel(0, hpriv->main_irq_mask_addr);
        main_irq_cause = readl(hpriv->main_irq_cause_addr);
        pending_irqs   = main_irq_cause & hpriv->main_irq_mask;
        /*
@@ -2230,6 +2219,11 @@ static irqreturn_t mv_interrupt(int irq, void *dev_instance)
                        handled = mv_host_intr(host, pending_irqs);
        }
        spin_unlock(&host->lock);
+        /* for MSI: unmask; interrupt cause bits will retrigger now */
+        if (using_msi)
+                writel(hpriv->main_irq_mask, hpriv->main_irq_mask_addr);
        return IRQ_RETVAL(handled);
 }
@@ -2821,8 +2815,7 @@ static void mv_eh_thaw(struct ata_port *ap)
        writel(0, port_mmio + EDMA_ERR_IRQ_CAUSE_OFS);
        /* clear pending irq events */
-        hc_irq_cause = readl(hc_mmio + HC_IRQ_CAUSE_OFS);
+        hc_irq_cause = ~((DEV_IRQ | DMA_IRQ) << hardport);
-        hc_irq_cause &= ~((DEV_IRQ | DMA_IRQ) << hardport);
        writelfl(hc_irq_cause, hc_mmio + HC_IRQ_CAUSE_OFS);
        mv_enable_port_irqs(ap, ERR_IRQ);
@@ -3075,6 +3068,9 @@ static int mv_init_host(struct ata_host *host, unsigned int board_idx)
                hpriv->main_irq_mask_addr  = mmio + PCI_HC_MAIN_IRQ_MASK_OFS;
        }
+        /* initialize shadow irq mask with register's value */
+        hpriv->main_irq_mask = readl(hpriv->main_irq_mask_addr);
        /* global interrupt mask: 0 == mask everything */
        mv_set_main_irq_mask(host, ~0, 0);
@@ -3430,9 +3426,9 @@ static int mv_pci_init_one(struct pci_dev *pdev,
        if (rc)
                return rc;
-        /* Enable interrupts */
+        /* Enable message-switched interrupts, if requested */
-        if (msi && pci_enable_msi(pdev))
+        if (msi && pci_enable_msi(pdev) == 0)
-                pci_intx(pdev, 1);
+                hpriv->hp_flags |= MV_HP_FLAG_MSI;
        mv_dump_pci_cfg(pdev, 0x68);
        mv_print_info(host);
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index 6f1460614325..444af0415ca1 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -305,10 +305,10 @@ static irqreturn_t nv_ck804_interrupt(int irq, void *dev_instance);
 static int nv_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val);
 static int nv_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
+static int nv_noclassify_hardreset(struct ata_link *link, unsigned int *class,
+                                   unsigned long deadline);
 static void nv_nf2_freeze(struct ata_port *ap);
 static void nv_nf2_thaw(struct ata_port *ap);
-static int nv_nf2_hardreset(struct ata_link *link, unsigned int *class,
-                            unsigned long deadline);
 static void nv_ck804_freeze(struct ata_port *ap);
 static void nv_ck804_thaw(struct ata_port *ap);
 static int nv_adma_slave_config(struct scsi_device *sdev);
@@ -352,6 +352,7 @@ enum nv_host_type
        NFORCE3 = NFORCE2,      /* NF2 == NF3 as far as sata_nv is concerned */
        CK804,
        ADMA,
+        MCP5x,
        SWNCQ,
 };
@@ -363,10 +364,10 @@ static const struct pci_device_id nv_pci_tbl[] = {
        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_CK804_SATA2), CK804 },
        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_SATA), CK804 },
        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_SATA2), CK804 },
-        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA), SWNCQ },
+        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA), MCP5x },
-        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA2), SWNCQ },
+        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA2), MCP5x },
-        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA), SWNCQ },
+        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA), MCP5x },
-        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA2), SWNCQ },
+        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA2), MCP5x },
        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA), GENERIC },
        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA2), GENERIC },
        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA3), GENERIC },
@@ -432,14 +433,19 @@ static struct ata_port_operations nv_nf2_ops = {
        .inherits               = &nv_common_ops,
        .freeze                 = nv_nf2_freeze,
        .thaw                   = nv_nf2_thaw,
-        .hardreset              = nv_nf2_hardreset,
+        .hardreset              = nv_noclassify_hardreset,
 };
-/* CK804 finally gets hardreset right */
+/* For initial probing after boot and hot plugging, hardreset mostly
+ * works fine on CK804 but curiously, reprobing on the initial port by
+ * rescanning or rmmod/insmod fails to acquire the initial D2H Reg FIS
+ * in somewhat undeterministic way.  Use noclassify hardreset.
+ */
 static struct ata_port_operations nv_ck804_ops = {
        .inherits               = &nv_common_ops,
        .freeze                 = nv_ck804_freeze,
        .thaw                   = nv_ck804_thaw,
+        .hardreset              = nv_noclassify_hardreset,
        .host_stop              = nv_ck804_host_stop,
 };
@@ -467,8 +473,19 @@ static struct ata_port_operations nv_adma_ops = {
        .host_stop              = nv_adma_host_stop,
 };
+/* Kernel bz#12351 reports that when SWNCQ is enabled, for hotplug to
+ * work, hardreset should be used and hardreset can't report proper
+ * signature, which suggests that mcp5x is closer to nf2 as long as
+ * reset quirkiness is concerned.  Define separate ops for mcp5x with
+ * nv_noclassify_hardreset().
+ */
+static struct ata_port_operations nv_mcp5x_ops = {
+        .inherits               = &nv_common_ops,
+        .hardreset              = nv_noclassify_hardreset,
+};
 static struct ata_port_operations nv_swncq_ops = {
-        .inherits               = &nv_generic_ops,
+        .inherits               = &nv_mcp5x_ops,
        .qc_defer               = ata_std_qc_defer,
        .qc_prep                = nv_swncq_qc_prep,
@@ -531,6 +548,15 @@ static const struct ata_port_info nv_port_info[] = {
                .port_ops       = &nv_adma_ops,
                .private_data   = NV_PI_PRIV(nv_adma_interrupt, &nv_adma_sht),
        },
+        /* MCP5x */
+        {
+                .flags          = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY,
+                .pio_mask       = NV_PIO_MASK,
+                .mwdma_mask     = NV_MWDMA_MASK,
+                .udma_mask      = NV_UDMA_MASK,
+                .port_ops       = &nv_mcp5x_ops,
+                .private_data   = NV_PI_PRIV(nv_generic_interrupt, &nv_sht),
+        },
        /* SWNCQ */
        {
                .flags          = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
@@ -1530,6 +1556,17 @@ static int nv_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val)
        return 0;
 }
+static int nv_noclassify_hardreset(struct ata_link *link, unsigned int *class,
+                                   unsigned long deadline)
+{
+        bool online;
+        int rc;
+        rc = sata_link_hardreset(link, sata_deb_timing_hotplug, deadline,
+                                 &online, NULL);
+        return online ? -EAGAIN : rc;
+}
 static void nv_nf2_freeze(struct ata_port *ap)
 {
        void __iomem *scr_addr = ap->host->ports[0]->ioaddr.scr_addr;
@@ -1554,17 +1591,6 @@ static void nv_nf2_thaw(struct ata_port *ap)
        iowrite8(mask, scr_addr + NV_INT_ENABLE);
 }
-static int nv_nf2_hardreset(struct ata_link *link, unsigned int *class,
-                            unsigned long deadline)
-{
-        bool online;
-        int rc;
-        rc = sata_link_hardreset(link, sata_deb_timing_hotplug, deadline,
-                                 &online, NULL);
-        return online ? -EAGAIN : rc;
-}
 static void nv_ck804_freeze(struct ata_port *ap)
 {
        void __iomem *mmio_base = ap->host->iomap[NV_MMIO_BAR];
@@ -2355,14 +2381,9 @@ static int nv_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (type == CK804 && adma_enabled) {
                dev_printk(KERN_NOTICE, &pdev->dev, "Using ADMA mode\n");
                type = ADMA;
-        }
+        } else if (type == MCP5x && swncq_enabled) {
+                dev_printk(KERN_NOTICE, &pdev->dev, "Using SWNCQ mode\n");
-        if (type == SWNCQ) {
+                type = SWNCQ;
-                if (swncq_enabled)
-                        dev_printk(KERN_NOTICE, &pdev->dev,
-                                   "Using SWNCQ mode\n");
-                else
-                        type = GENERIC;
        }
        ppi[0] = &nv_port_info[type];
diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
index 564c142b03b0..d0091609e210 100644
--- a/drivers/ata/sata_sil.c
+++ b/drivers/ata/sata_sil.c
@@ -44,6 +44,7 @@
 #include <linux/device.h>
 #include <scsi/scsi_host.h>
 #include <linux/libata.h>
+#include <linux/dmi.h>
 #define DRV_NAME        "sata_sil"
 #define DRV_VERSION     "2.4"
@@ -323,7 +324,7 @@ static void sil_fill_sg(struct ata_queued_cmd *qc)
                prd->addr = cpu_to_le32(addr);
                prd->flags_len = cpu_to_le32(sg_len);
-                VPRINTK("PRD[%u] = (0x%X, 0x%X)\n", pi, addr, sg_len);
+                VPRINTK("PRD[%u] = (0x%X, 0x%X)\n", si, addr, sg_len);
                last_prd = prd;
                prd++;
@@ -695,11 +696,38 @@ static void sil_init_controller(struct ata_host *host)
        }
 }
+static bool sil_broken_system_poweroff(struct pci_dev *pdev)
+{
+        static const struct dmi_system_id broken_systems[] = {
+                {
+                        .ident = "HP Compaq nx6325",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                                DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq nx6325"),
+                        },
+                        /* PCI slot number of the controller */
+                        .driver_data = (void *)0x12UL,
+                },
+                { }     /* terminate list */
+        };
+        const struct dmi_system_id *dmi = dmi_first_match(broken_systems);
+        if (dmi) {
+                unsigned long slot = (unsigned long)dmi->driver_data;
+                /* apply the quirk only to on-board controllers */
+                return slot == PCI_SLOT(pdev->devfn);
+        }
+        return false;
+}
 static int sil_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
        static int printed_version;
        int board_id = ent->driver_data;
-        const struct ata_port_info *ppi[] = { &sil_port_info[board_id], NULL };
+        struct ata_port_info pi = sil_port_info[board_id];
+        const struct ata_port_info *ppi[] = { &pi, NULL };
        struct ata_host *host;
        void __iomem *mmio_base;
        int n_ports, rc;
@@ -713,6 +741,13 @@ static int sil_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (board_id == sil_3114)
                n_ports = 4;
+        if (sil_broken_system_poweroff(pdev)) {
+                pi.flags |= ATA_FLAG_NO_POWEROFF_SPINDOWN |
+                                        ATA_FLAG_NO_HIBERNATE_SPINDOWN;
+                dev_info(&pdev->dev, "quirky BIOS, skipping spindown "
+                                "on poweroff and hibernation\n");
+        }
        host = ata_host_alloc_pinfo(&pdev->dev, ppi, n_ports);
        if (!host)
                return -ENOMEM;
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 8079afca4972..f3eae630e589 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -777,10 +777,16 @@ static void device_remove_class_symlinks(struct device *dev)
 int dev_set_name(struct device *dev, const char *fmt, ...)
 {
        va_list vargs;
+        char *s;
        va_start(vargs, fmt);
        vsnprintf(dev->bus_id, sizeof(dev->bus_id), fmt, vargs);
        va_end(vargs);
+        /* ewww... some of these buggers have / in the name... */
+        while ((s = strchr(dev->bus_id, '/')))
+                *s = '!';
        return 0;
 }
 EXPORT_SYMBOL_GPL(dev_set_name);
@@ -1274,7 +1280,7 @@ EXPORT_SYMBOL_GPL(__root_device_register);
 /**
 * root_device_unregister - unregister and free a root device
- * @root: device going away.
+ * @dev: device going away
 *
 * This function unregisters and cleans up a device that was created by
 * root_device_register().
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index f5be8081cd81..735bbe2be51a 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -761,7 +761,7 @@ source "drivers/char/hw_random/Kconfig"
 config NVRAM
        tristate "/dev/nvram support"
-        depends on ATARI || X86 || ARM || GENERIC_NVRAM
+        depends on ATARI || X86 || (ARM && RTC_DRV_CMOS) || GENERIC_NVRAM
        ---help---
          If you say Y here and create a character special file /dev/nvram
          with major number 10 and minor number 144 using mknod ("man mknod"),
diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c
index d4e7dca06e4f..ba68a4671cb5 100644
--- a/drivers/char/hw_random/omap-rng.c
+++ b/drivers/char/hw_random/omap-rng.c
@@ -102,7 +102,7 @@ static int __init omap_rng_probe(struct platform_device *pdev)
                return -EBUSY;
        if (cpu_is_omap24xx()) {
-                rng_ick = clk_get(NULL, "rng_ick");
+                rng_ick = clk_get(&pdev->dev, "rng_ick");
                if (IS_ERR(rng_ick)) {
                        dev_err(&pdev->dev, "Could not get rng_ick\n");
                        ret = PTR_ERR(rng_ick);
diff --git a/drivers/char/selection.c b/drivers/char/selection.c
index f29fbe9b8ed7..cb8ca5698963 100644
--- a/drivers/char/selection.c
+++ b/drivers/char/selection.c
@@ -268,7 +268,7 @@ int set_selection(const struct tiocl_selection __user *sel, struct tty_struct *t
        /* Allocate a new buffer before freeing the old one ... */
        multiplier = use_unicode ? 3 : 1;  /* chars can take up to 3 bytes */
-        bp = kmalloc((sel_end-sel_start)/2*multiplier+1, GFP_KERNEL);
+        bp = kmalloc(((sel_end-sel_start)/2+1)*multiplier, GFP_KERNEL);
        if (!bp) {
                printk(KERN_WARNING "selection: kmalloc() failed\n");
                clear_selection();
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index b60be7b0decf..f146e90404fa 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -1713,8 +1713,8 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd,
                for (i = 0; i < SX_NBOARDS; i++)
                        sx_dprintk(SX_DEBUG_FIRMWARE, "<%x> ", boards[i].flags);
                sx_dprintk(SX_DEBUG_FIRMWARE, "\n");
-                unlock_kernel();
+                rc = -EIO;
-                return -EIO;
+                goto out;
        }
        switch (cmd) {
@@ -1747,7 +1747,8 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd,
                break;
        case SXIO_DO_RAMTEST:
                if (sx_initialized)     /* Already initialized: better not ramtest the board.  */
-                        return -EPERM;
+                        rc = -EPERM;
+                        break;
                if (IS_SX_BOARD(board)) {
                        rc = do_memtest(board, 0, 0x7000);
                        if (!rc)
@@ -1844,6 +1845,7 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd,
                rc = -ENOTTY;
                break;
        }
+out:
        unlock_kernel();
        func_exit();
        return rc;
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index d33e5ab06177..bc84e125c6bc 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -1817,8 +1817,10 @@ got_driver:
                /* check whether we're reopening an existing tty */
                tty = tty_driver_lookup_tty(driver, inode, index);
-                if (IS_ERR(tty))
+                if (IS_ERR(tty)) {
+                        mutex_unlock(&tty_mutex);
                        return PTR_ERR(tty);
+                }
        }
        if (tty) {
diff --git a/drivers/dca/dca-core.c b/drivers/dca/dca-core.c
index 55433849bfa6..33bd75347518 100644
--- a/drivers/dca/dca-core.c
+++ b/drivers/dca/dca-core.c
@@ -28,7 +28,7 @@
 #include <linux/device.h>
 #include <linux/dca.h>
-#define DCA_VERSION "1.4"
+#define DCA_VERSION "1.8"
 MODULE_VERSION(DCA_VERSION);
 MODULE_LICENSE("GPL");
@@ -60,16 +60,17 @@ int dca_add_requester(struct device *dev)
 {
        struct dca_provider *dca;
        int err, slot = -ENODEV;
+        unsigned long flags;
        if (!dev)
                return -EFAULT;
-        spin_lock(&dca_lock);
+        spin_lock_irqsave(&dca_lock, flags);
        /* check if the requester has not been added already */
        dca = dca_find_provider_by_dev(dev);
        if (dca) {
-                spin_unlock(&dca_lock);
+                spin_unlock_irqrestore(&dca_lock, flags);
                return -EEXIST;
        }
@@ -78,19 +79,21 @@ int dca_add_requester(struct device *dev)
                if (slot >= 0)
                        break;
        }
-        if (slot < 0) {
-                spin_unlock(&dca_lock);
+        spin_unlock_irqrestore(&dca_lock, flags);
+        if (slot < 0)
                return slot;
-        }
        err = dca_sysfs_add_req(dca, dev, slot);
        if (err) {
-                dca->ops->remove_requester(dca, dev);
+                spin_lock_irqsave(&dca_lock, flags);
-                spin_unlock(&dca_lock);
+                if (dca == dca_find_provider_by_dev(dev))
+                        dca->ops->remove_requester(dca, dev);
+                spin_unlock_irqrestore(&dca_lock, flags);
                return err;
        }
-        spin_unlock(&dca_lock);
        return 0;
 }
 EXPORT_SYMBOL_GPL(dca_add_requester);
@@ -103,25 +106,25 @@ int dca_remove_requester(struct device *dev)
 {
        struct dca_provider *dca;
        int slot;
+        unsigned long flags;
        if (!dev)
                return -EFAULT;
-        spin_lock(&dca_lock);
+        spin_lock_irqsave(&dca_lock, flags);
        dca = dca_find_provider_by_dev(dev);
        if (!dca) {
-                spin_unlock(&dca_lock);
+                spin_unlock_irqrestore(&dca_lock, flags);
                return -ENODEV;
        }
        slot = dca->ops->remove_requester(dca, dev);
-        if (slot < 0) {
+        spin_unlock_irqrestore(&dca_lock, flags);
-                spin_unlock(&dca_lock);
+        if (slot < 0)
                return slot;
-        }
        dca_sysfs_remove_req(dca, slot);
-        spin_unlock(&dca_lock);
        return 0;
 }
 EXPORT_SYMBOL_GPL(dca_remove_requester);
@@ -135,17 +138,18 @@ u8 dca_common_get_tag(struct device *dev, int cpu)
 {
        struct dca_provider *dca;
        u8 tag;
+        unsigned long flags;
-        spin_lock(&dca_lock);
+        spin_lock_irqsave(&dca_lock, flags);
        dca = dca_find_provider_by_dev(dev);
        if (!dca) {
-                spin_unlock(&dca_lock);
+                spin_unlock_irqrestore(&dca_lock, flags);
                return -ENODEV;
        }
        tag = dca->ops->get_tag(dca, dev, cpu);
-        spin_unlock(&dca_lock);
+        spin_unlock_irqrestore(&dca_lock, flags);
        return tag;
 }
@@ -217,11 +221,16 @@ static BLOCKING_NOTIFIER_HEAD(dca_provider_chain);
 int register_dca_provider(struct dca_provider *dca, struct device *dev)
 {
        int err;
+        unsigned long flags;
        err = dca_sysfs_add_provider(dca, dev);
        if (err)
                return err;
+        spin_lock_irqsave(&dca_lock, flags);
        list_add(&dca->node, &dca_providers);
+        spin_unlock_irqrestore(&dca_lock, flags);
        blocking_notifier_call_chain(&dca_provider_chain,
                                     DCA_PROVIDER_ADD, NULL);
        return 0;
@@ -234,9 +243,15 @@ EXPORT_SYMBOL_GPL(register_dca_provider);
 */
 void unregister_dca_provider(struct dca_provider *dca)
 {
+        unsigned long flags;
        blocking_notifier_call_chain(&dca_provider_chain,
                                     DCA_PROVIDER_REMOVE, NULL);
+        spin_lock_irqsave(&dca_lock, flags);
        list_del(&dca->node);
+        spin_unlock_irqrestore(&dca_lock, flags);
        dca_sysfs_remove_provider(dca);
 }
 EXPORT_SYMBOL_GPL(unregister_dca_provider);
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index e34b06420816..48ea59e79672 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -62,6 +62,25 @@ config MV_XOR
        ---help---
          Enable support for the Marvell XOR engine.
+config MX3_IPU
+        bool "MX3x Image Processing Unit support"
+        depends on ARCH_MX3
+        select DMA_ENGINE
+        default y
+        help
+          If you plan to use the Image Processing unit in the i.MX3x, say
+          Y here. If unsure, select Y.
+config MX3_IPU_IRQS
+        int "Number of dynamically mapped interrupts for IPU"
+        depends on MX3_IPU
+        range 2 137
+        default 4
+        help
+          Out of 137 interrupt sources on i.MX31 IPU only very few are used.
+          To avoid bloating the irq_desc[] array we allocate a sufficient
+          number of IRQ slots and map them dynamically to specific sources.
 config DMA_ENGINE
        bool
diff --git a/drivers/dma/Makefile b/drivers/dma/Makefile
index 14f59527d4f6..2e5dc96700d2 100644
--- a/drivers/dma/Makefile
+++ b/drivers/dma/Makefile
@@ -7,3 +7,4 @@ obj-$(CONFIG_INTEL_IOP_ADMA) += iop-adma.o
 obj-$(CONFIG_FSL_DMA) += fsldma.o
 obj-$(CONFIG_MV_XOR) += mv_xor.o
 obj-$(CONFIG_DW_DMAC) += dw_dmac.o
+obj-$(CONFIG_MX3_IPU) += ipu/
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 403dbe781122..a58993011edb 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -329,9 +329,6 @@ struct dma_chan *dma_find_channel(enum dma_transaction_type tx_type)
        struct dma_chan *chan;
        int cpu;
-        WARN_ONCE(dmaengine_ref_count == 0,
-                  "client called %s without a reference", __func__);
        cpu = get_cpu();
        chan = per_cpu_ptr(channel_table[tx_type], cpu)->chan;
        put_cpu();
@@ -348,9 +345,6 @@ void dma_issue_pending_all(void)
        struct dma_device *device;
        struct dma_chan *chan;
-        WARN_ONCE(dmaengine_ref_count == 0,
-                  "client called %s without a reference", __func__);
        rcu_read_lock();
        list_for_each_entry_rcu(device, &dma_device_list, global_node) {
                if (dma_has_cap(DMA_PRIVATE, device->cap_mask))
@@ -961,6 +955,8 @@ void dma_run_dependencies(struct dma_async_tx_descriptor *tx)
        if (!dep)
                return;
+        /* we'll submit tx->next now, so clear the link */
+        tx->next = NULL;
        chan = dep->chan;
        /* keep submitting up until a channel switch is detected
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 3603f1ea5b28..732fa1ec36ab 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -217,6 +217,10 @@ static int dmatest_func(void *data)
        chan = thread->chan;
        while (!kthread_should_stop()) {
+                struct dma_device *dev = chan->device;
+                struct dma_async_tx_descriptor *tx;
+                dma_addr_t dma_src, dma_dest;
                total_tests++;
                len = dmatest_random() % test_buf_size + 1;
@@ -226,10 +230,30 @@ static int dmatest_func(void *data)
                dmatest_init_srcbuf(thread->srcbuf, src_off, len);
                dmatest_init_dstbuf(thread->dstbuf, dst_off, len);
-                cookie = dma_async_memcpy_buf_to_buf(chan,
+                dma_src = dma_map_single(dev->dev, thread->srcbuf + src_off,
-                                thread->dstbuf + dst_off,
+                                len, DMA_TO_DEVICE);
-                                thread->srcbuf + src_off,
+                /* map with DMA_BIDIRECTIONAL to force writeback/invalidate */
-                                len);
+                dma_dest = dma_map_single(dev->dev, thread->dstbuf,
+                                test_buf_size, DMA_BIDIRECTIONAL);
+                tx = dev->device_prep_dma_memcpy(chan, dma_dest + dst_off,
+                                dma_src, len,
+                                DMA_CTRL_ACK | DMA_COMPL_SKIP_DEST_UNMAP);
+                if (!tx) {
+                        dma_unmap_single(dev->dev, dma_src, len, DMA_TO_DEVICE);
+                        dma_unmap_single(dev->dev, dma_dest,
+                                        test_buf_size, DMA_BIDIRECTIONAL);
+                        pr_warning("%s: #%u: prep error with src_off=0x%x "
+                                        "dst_off=0x%x len=0x%x\n",
+                                        thread_name, total_tests - 1,
+                                        src_off, dst_off, len);
+                        msleep(100);
+                        failed_tests++;
+                        continue;
+                }
+                tx->callback = NULL;
+                cookie = tx->tx_submit(tx);
                if (dma_submit_error(cookie)) {
                        pr_warning("%s: #%u: submit error %d with src_off=0x%x "
                                        "dst_off=0x%x len=0x%x\n",
@@ -253,6 +277,9 @@ static int dmatest_func(void *data)
                        failed_tests++;
                        continue;
                }
+                /* Unmap by myself (see DMA_COMPL_SKIP_DEST_UNMAP above) */
+                dma_unmap_single(dev->dev, dma_dest,
+                                test_buf_size, DMA_BIDIRECTIONAL);
                error_count = 0;
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index ca70a21afc68..70126a606239 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -822,7 +822,7 @@ static int __devinit fsl_dma_chan_probe(struct fsl_dma_device *fdev,
         */
        WARN_ON(fdev->feature != new_fsl_chan->feature);
-        new_fsl_chan->dev = &new_fsl_chan->common.dev->device;
+        new_fsl_chan->dev = fdev->dev;
        new_fsl_chan->reg_base = ioremap(new_fsl_chan->reg.start,
                        new_fsl_chan->reg.end - new_fsl_chan->reg.start + 1);
@@ -875,7 +875,8 @@ static int __devinit fsl_dma_chan_probe(struct fsl_dma_device *fdev,
        }
        dev_info(fdev->dev, "#%d (%s), irq %d\n", new_fsl_chan->id,
-                                compatible, new_fsl_chan->irq);
+                 compatible,
+                 new_fsl_chan->irq != NO_IRQ ? new_fsl_chan->irq : fdev->irq);
        return 0;
@@ -890,7 +891,8 @@ err_no_reg:
 static void fsl_dma_chan_remove(struct fsl_dma_chan *fchan)
 {
-        free_irq(fchan->irq, fchan);
+        if (fchan->irq != NO_IRQ)
+                free_irq(fchan->irq, fchan);
        list_del(&fchan->common.device_node);
        iounmap(fchan->reg_base);
        kfree(fchan);
diff --git a/drivers/dma/ipu/Makefile b/drivers/dma/ipu/Makefile
new file mode 100644
index 000000000000..6704cf48326d
--- /dev/null
+++ b/drivers/dma/ipu/Makefile
@@ -0,0 +1 @@
+obj-y   += ipu_irq.o ipu_idmac.o
diff --git a/drivers/dma/ipu/ipu_idmac.c b/drivers/dma/ipu/ipu_idmac.c
new file mode 100644
index 000000000000..1f154d08e98f
--- /dev/null
+++ b/drivers/dma/ipu/ipu_idmac.c
@@ -0,0 +1,1740 @@
+/*
+ * Copyright (C) 2008
+ * Guennadi Liakhovetski, DENX Software Engineering, <lg@denx.de>
+ *
+ * Copyright (C) 2005-2007 Freescale Semiconductor, Inc. All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/err.h>
+#include <linux/spinlock.h>
+#include <linux/delay.h>
+#include <linux/list.h>
+#include <linux/clk.h>
+#include <linux/vmalloc.h>
+#include <linux/string.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <mach/ipu.h>
+#include "ipu_intern.h"
+#define FS_VF_IN_VALID  0x00000002
+#define FS_ENC_IN_VALID 0x00000001
+/*
+ * There can be only one, we could allocate it dynamically, but then we'd have
+ * to add an extra parameter to some functions, and use something as ugly as
+ *      struct ipu *ipu = to_ipu(to_idmac(ichan->dma_chan.device));
+ * in the ISR
+ */
+static struct ipu ipu_data;
+#define to_ipu(id) container_of(id, struct ipu, idmac)
+static u32 __idmac_read_icreg(struct ipu *ipu, unsigned long reg)
+{
+        return __raw_readl(ipu->reg_ic + reg);
+}
+#define idmac_read_icreg(ipu, reg) __idmac_read_icreg(ipu, reg - IC_CONF)
+static void __idmac_write_icreg(struct ipu *ipu, u32 value, unsigned long reg)
+{
+        __raw_writel(value, ipu->reg_ic + reg);
+}
+#define idmac_write_icreg(ipu, v, reg) __idmac_write_icreg(ipu, v, reg - IC_CONF)
+static u32 idmac_read_ipureg(struct ipu *ipu, unsigned long reg)
+{
+        return __raw_readl(ipu->reg_ipu + reg);
+}
+static void idmac_write_ipureg(struct ipu *ipu, u32 value, unsigned long reg)
+{
+        __raw_writel(value, ipu->reg_ipu + reg);
+}
+/*****************************************************************************
+ * IPU / IC common functions
+ */
+static void dump_idmac_reg(struct ipu *ipu)
+{
+        dev_dbg(ipu->dev, "IDMAC_CONF 0x%x, IC_CONF 0x%x, IDMAC_CHA_EN 0x%x, "
+                "IDMAC_CHA_PRI 0x%x, IDMAC_CHA_BUSY 0x%x\n",
+                idmac_read_icreg(ipu, IDMAC_CONF),
+                idmac_read_icreg(ipu, IC_CONF),
+                idmac_read_icreg(ipu, IDMAC_CHA_EN),
+                idmac_read_icreg(ipu, IDMAC_CHA_PRI),
+                idmac_read_icreg(ipu, IDMAC_CHA_BUSY));
+        dev_dbg(ipu->dev, "BUF0_RDY 0x%x, BUF1_RDY 0x%x, CUR_BUF 0x%x, "
+                "DB_MODE 0x%x, TASKS_STAT 0x%x\n",
+                idmac_read_ipureg(ipu, IPU_CHA_BUF0_RDY),
+                idmac_read_ipureg(ipu, IPU_CHA_BUF1_RDY),
+                idmac_read_ipureg(ipu, IPU_CHA_CUR_BUF),
+                idmac_read_ipureg(ipu, IPU_CHA_DB_MODE_SEL),
+                idmac_read_ipureg(ipu, IPU_TASKS_STAT));
+}
+static uint32_t bytes_per_pixel(enum pixel_fmt fmt)
+{
+        switch (fmt) {
+        case IPU_PIX_FMT_GENERIC:       /* generic data */
+        case IPU_PIX_FMT_RGB332:
+        case IPU_PIX_FMT_YUV420P:
+        case IPU_PIX_FMT_YUV422P:
+        default:
+                return 1;
+        case IPU_PIX_FMT_RGB565:
+        case IPU_PIX_FMT_YUYV:
+        case IPU_PIX_FMT_UYVY:
+                return 2;
+        case IPU_PIX_FMT_BGR24:
+        case IPU_PIX_FMT_RGB24:
+                return 3;
+        case IPU_PIX_FMT_GENERIC_32:    /* generic data */
+        case IPU_PIX_FMT_BGR32:
+        case IPU_PIX_FMT_RGB32:
+        case IPU_PIX_FMT_ABGR32:
+                return 4;
+        }
+}
+/* Enable / disable direct write to memory by the Camera Sensor Interface */
+static void ipu_ic_enable_task(struct ipu *ipu, enum ipu_channel channel)
+{
+        uint32_t ic_conf, mask;
+        switch (channel) {
+        case IDMAC_IC_0:
+                mask = IC_CONF_PRPENC_EN;
+                break;
+        case IDMAC_IC_7:
+                mask = IC_CONF_RWS_EN | IC_CONF_PRPENC_EN;
+                break;
+        default:
+                return;
+        }
+        ic_conf = idmac_read_icreg(ipu, IC_CONF) | mask;
+        idmac_write_icreg(ipu, ic_conf, IC_CONF);
+}
+static void ipu_ic_disable_task(struct ipu *ipu, enum ipu_channel channel)
+{
+        uint32_t ic_conf, mask;
+        switch (channel) {
+        case IDMAC_IC_0:
+                mask = IC_CONF_PRPENC_EN;
+                break;
+        case IDMAC_IC_7:
+                mask = IC_CONF_RWS_EN | IC_CONF_PRPENC_EN;
+                break;
+        default:
+                return;
+        }
+        ic_conf = idmac_read_icreg(ipu, IC_CONF) & ~mask;
+        idmac_write_icreg(ipu, ic_conf, IC_CONF);
+}
+static uint32_t ipu_channel_status(struct ipu *ipu, enum ipu_channel channel)
+{
+        uint32_t stat = TASK_STAT_IDLE;
+        uint32_t task_stat_reg = idmac_read_ipureg(ipu, IPU_TASKS_STAT);
+        switch (channel) {
+        case IDMAC_IC_7:
+                stat = (task_stat_reg & TSTAT_CSI2MEM_MASK) >>
+                        TSTAT_CSI2MEM_OFFSET;
+                break;
+        case IDMAC_IC_0:
+        case IDMAC_SDC_0:
+        case IDMAC_SDC_1:
+        default:
+                break;
+        }
+        return stat;
+}
+struct chan_param_mem_planar {
+        /* Word 0 */
+        u32     xv:10;
+        u32     yv:10;
+        u32     xb:12;
+        u32     yb:12;
+        u32     res1:2;
+        u32     nsb:1;
+        u32     lnpb:6;
+        u32     ubo_l:11;
+        u32     ubo_h:15;
+        u32     vbo_l:17;
+        u32     vbo_h:9;
+        u32     res2:3;
+        u32     fw:12;
+        u32     fh_l:8;
+        u32     fh_h:4;
+        u32     res3:28;
+        /* Word 1 */
+        u32     eba0;
+        u32     eba1;
+        u32     bpp:3;
+        u32     sl:14;
+        u32     pfs:3;
+        u32     bam:3;
+        u32     res4:2;
+        u32     npb:6;
+        u32     res5:1;
+        u32     sat:2;
+        u32     res6:30;
+} __attribute__ ((packed));
+struct chan_param_mem_interleaved {
+        /* Word 0 */
+        u32     xv:10;
+        u32     yv:10;
+        u32     xb:12;
+        u32     yb:12;
+        u32     sce:1;
+        u32     res1:1;
+        u32     nsb:1;
+        u32     lnpb:6;
+        u32     sx:10;
+        u32     sy_l:1;
+        u32     sy_h:9;
+        u32     ns:10;
+        u32     sm:10;
+        u32     sdx_l:3;
+        u32     sdx_h:2;
+        u32     sdy:5;
+        u32     sdrx:1;
+        u32     sdry:1;
+        u32     sdr1:1;
+        u32     res2:2;
+        u32     fw:12;
+        u32     fh_l:8;
+        u32     fh_h:4;
+        u32     res3:28;
+        /* Word 1 */
+        u32     eba0;
+        u32     eba1;
+        u32     bpp:3;
+        u32     sl:14;
+        u32     pfs:3;
+        u32     bam:3;
+        u32     res4:2;
+        u32     npb:6;
+        u32     res5:1;
+        u32     sat:2;
+        u32     scc:1;
+        u32     ofs0:5;
+        u32     ofs1:5;
+        u32     ofs2:5;
+        u32     ofs3:5;
+        u32     wid0:3;
+        u32     wid1:3;
+        u32     wid2:3;
+        u32     wid3:3;
+        u32     dec_sel:1;
+        u32     res6:28;
+} __attribute__ ((packed));
+union chan_param_mem {
+        struct chan_param_mem_planar            pp;
+        struct chan_param_mem_interleaved       ip;
+};
+static void ipu_ch_param_set_plane_offset(union chan_param_mem *params,
+                                          u32 u_offset, u32 v_offset)
+{
+        params->pp.ubo_l = u_offset & 0x7ff;
+        params->pp.ubo_h = u_offset >> 11;
+        params->pp.vbo_l = v_offset & 0x1ffff;
+        params->pp.vbo_h = v_offset >> 17;
+}
+static void ipu_ch_param_set_size(union chan_param_mem *params,
+                                  uint32_t pixel_fmt, uint16_t width,
+                                  uint16_t height, uint16_t stride)
+{
+        u32 u_offset;
+        u32 v_offset;
+        params->pp.fw           = width - 1;
+        params->pp.fh_l         = height - 1;
+        params->pp.fh_h         = (height - 1) >> 8;
+        params->pp.sl           = stride - 1;
+        switch (pixel_fmt) {
+        case IPU_PIX_FMT_GENERIC:
+                /*Represents 8-bit Generic data */
+                params->pp.bpp  = 3;
+                params->pp.pfs  = 7;
+                params->pp.npb  = 31;
+                params->pp.sat  = 2;            /* SAT = use 32-bit access */
+                break;
+        case IPU_PIX_FMT_GENERIC_32:
+                /*Represents 32-bit Generic data */
+                params->pp.bpp  = 0;
+                params->pp.pfs  = 7;
+                params->pp.npb  = 7;
+                params->pp.sat  = 2;            /* SAT = use 32-bit access */
+                break;
+        case IPU_PIX_FMT_RGB565:
+                params->ip.bpp  = 2;
+                params->ip.pfs  = 4;
+                params->ip.npb  = 7;
+                params->ip.sat  = 2;            /* SAT = 32-bit access */
+                params->ip.ofs0 = 0;            /* Red bit offset */
+                params->ip.ofs1 = 5;            /* Green bit offset */
+                params->ip.ofs2 = 11;           /* Blue bit offset */
+                params->ip.ofs3 = 16;           /* Alpha bit offset */
+                params->ip.wid0 = 4;            /* Red bit width - 1 */
+                params->ip.wid1 = 5;            /* Green bit width - 1 */
+                params->ip.wid2 = 4;            /* Blue bit width - 1 */
+                break;
+        case IPU_PIX_FMT_BGR24:
+                params->ip.bpp  = 1;            /* 24 BPP & RGB PFS */
+                params->ip.pfs  = 4;
+                params->ip.npb  = 7;
+                params->ip.sat  = 2;            /* SAT = 32-bit access */
+                params->ip.ofs0 = 0;            /* Red bit offset */
+                params->ip.ofs1 = 8;            /* Green bit offset */
+                params->ip.ofs2 = 16;           /* Blue bit offset */
+                params->ip.ofs3 = 24;           /* Alpha bit offset */
+                params->ip.wid0 = 7;            /* Red bit width - 1 */
+                params->ip.wid1 = 7;            /* Green bit width - 1 */
+                params->ip.wid2 = 7;            /* Blue bit width - 1 */
+                break;
+        case IPU_PIX_FMT_RGB24:
+                params->ip.bpp  = 1;            /* 24 BPP & RGB PFS */
+                params->ip.pfs  = 4;
+                params->ip.npb  = 7;
+                params->ip.sat  = 2;            /* SAT = 32-bit access */
+                params->ip.ofs0 = 16;           /* Red bit offset */
+                params->ip.ofs1 = 8;            /* Green bit offset */
+                params->ip.ofs2 = 0;            /* Blue bit offset */
+                params->ip.ofs3 = 24;           /* Alpha bit offset */
+                params->ip.wid0 = 7;            /* Red bit width - 1 */
+                params->ip.wid1 = 7;            /* Green bit width - 1 */
+                params->ip.wid2 = 7;            /* Blue bit width - 1 */
+                break;
+        case IPU_PIX_FMT_BGRA32:
+        case IPU_PIX_FMT_BGR32:
+                params->ip.bpp  = 0;
+                params->ip.pfs  = 4;
+                params->ip.npb  = 7;
+                params->ip.sat  = 2;            /* SAT = 32-bit access */
+                params->ip.ofs0 = 8;            /* Red bit offset */
+                params->ip.ofs1 = 16;           /* Green bit offset */
+                params->ip.ofs2 = 24;           /* Blue bit offset */
+                params->ip.ofs3 = 0;            /* Alpha bit offset */
+                params->ip.wid0 = 7;            /* Red bit width - 1 */
+                params->ip.wid1 = 7;            /* Green bit width - 1 */
+                params->ip.wid2 = 7;            /* Blue bit width - 1 */
+                params->ip.wid3 = 7;            /* Alpha bit width - 1 */
+                break;
+        case IPU_PIX_FMT_RGBA32:
+        case IPU_PIX_FMT_RGB32:
+                params->ip.bpp  = 0;
+                params->ip.pfs  = 4;
+                params->ip.npb  = 7;
+                params->ip.sat  = 2;            /* SAT = 32-bit access */
+                params->ip.ofs0 = 24;           /* Red bit offset */
+                params->ip.ofs1 = 16;           /* Green bit offset */
+                params->ip.ofs2 = 8;            /* Blue bit offset */
+                params->ip.ofs3 = 0;            /* Alpha bit offset */
+                params->ip.wid0 = 7;            /* Red bit width - 1 */
+                params->ip.wid1 = 7;            /* Green bit width - 1 */
+                params->ip.wid2 = 7;            /* Blue bit width - 1 */
+                params->ip.wid3 = 7;            /* Alpha bit width - 1 */
+                break;
+        case IPU_PIX_FMT_ABGR32:
+                params->ip.bpp  = 0;
+                params->ip.pfs  = 4;
+                params->ip.npb  = 7;
+                params->ip.sat  = 2;            /* SAT = 32-bit access */
+                params->ip.ofs0 = 8;            /* Red bit offset */
+                params->ip.ofs1 = 16;           /* Green bit offset */
+                params->ip.ofs2 = 24;           /* Blue bit offset */
+                params->ip.ofs3 = 0;            /* Alpha bit offset */
+                params->ip.wid0 = 7;            /* Red bit width - 1 */
+                params->ip.wid1 = 7;            /* Green bit width - 1 */
+                params->ip.wid2 = 7;            /* Blue bit width - 1 */
+                params->ip.wid3 = 7;            /* Alpha bit width - 1 */
+                break;
+        case IPU_PIX_FMT_UYVY:
+                params->ip.bpp  = 2;
+                params->ip.pfs  = 6;
+                params->ip.npb  = 7;
+                params->ip.sat  = 2;            /* SAT = 32-bit access */
+                break;
+        case IPU_PIX_FMT_YUV420P2:
+        case IPU_PIX_FMT_YUV420P:
+                params->ip.bpp  = 3;
+                params->ip.pfs  = 3;
+                params->ip.npb  = 7;
+                params->ip.sat  = 2;            /* SAT = 32-bit access */
+                u_offset = stride * height;
+                v_offset = u_offset + u_offset / 4;
+                ipu_ch_param_set_plane_offset(params, u_offset, v_offset);
+                break;
+        case IPU_PIX_FMT_YVU422P:
+                params->ip.bpp  = 3;
+                params->ip.pfs  = 2;
+                params->ip.npb  = 7;
+                params->ip.sat  = 2;            /* SAT = 32-bit access */
+                v_offset = stride * height;
+                u_offset = v_offset + v_offset / 2;
+                ipu_ch_param_set_plane_offset(params, u_offset, v_offset);
+                break;
+        case IPU_PIX_FMT_YUV422P:
+                params->ip.bpp  = 3;
+                params->ip.pfs  = 2;
+                params->ip.npb  = 7;
+                params->ip.sat  = 2;            /* SAT = 32-bit access */
+                u_offset = stride * height;
+                v_offset = u_offset + u_offset / 2;
+                ipu_ch_param_set_plane_offset(params, u_offset, v_offset);
+                break;
+        default:
+                dev_err(ipu_data.dev,
+                        "mxc ipu: unimplemented pixel format %d\n", pixel_fmt);
+                break;
+        }
+        params->pp.nsb = 1;
+}
+static void ipu_ch_param_set_burst_size(union chan_param_mem *params,
+                                        uint16_t burst_pixels)
+{
+        params->pp.npb = burst_pixels - 1;
+};
+static void ipu_ch_param_set_buffer(union chan_param_mem *params,
+                                    dma_addr_t buf0, dma_addr_t buf1)
+{
+        params->pp.eba0 = buf0;
+        params->pp.eba1 = buf1;
+};
+static void ipu_ch_param_set_rotation(union chan_param_mem *params,
+                                      enum ipu_rotate_mode rotate)
+{
+        params->pp.bam = rotate;
+};
+static void ipu_write_param_mem(uint32_t addr, uint32_t *data,
+                                uint32_t num_words)
+{
+        for (; num_words > 0; num_words--) {
+                dev_dbg(ipu_data.dev,
+                        "write param mem - addr = 0x%08X, data = 0x%08X\n",
+                        addr, *data);
+                idmac_write_ipureg(&ipu_data, addr, IPU_IMA_ADDR);
+                idmac_write_ipureg(&ipu_data, *data++, IPU_IMA_DATA);
+                addr++;
+                if ((addr & 0x7) == 5) {
+                        addr &= ~0x7;   /* set to word 0 */
+                        addr += 8;      /* increment to next row */
+                }
+        }
+}
+static int calc_resize_coeffs(uint32_t in_size, uint32_t out_size,
+                              uint32_t *resize_coeff,
+                              uint32_t *downsize_coeff)
+{
+        uint32_t temp_size;
+        uint32_t temp_downsize;
+        *resize_coeff   = 1 << 13;
+        *downsize_coeff = 1 << 13;
+        /* Cannot downsize more than 8:1 */
+        if (out_size << 3 < in_size)
+                return -EINVAL;
+        /* compute downsizing coefficient */
+        temp_downsize = 0;
+        temp_size = in_size;
+        while (temp_size >= out_size * 2 && temp_downsize < 2) {
+                temp_size >>= 1;
+                temp_downsize++;
+        }
+        *downsize_coeff = temp_downsize;
+        /*
+         * compute resizing coefficient using the following formula:
+         * resize_coeff = M*(SI -1)/(SO - 1)
+         * where M = 2^13, SI - input size, SO - output size
+         */
+        *resize_coeff = (8192L * (temp_size - 1)) / (out_size - 1);
+        if (*resize_coeff >= 16384L) {
+                dev_err(ipu_data.dev, "Warning! Overflow on resize coeff.\n");
+                *resize_coeff = 0x3FFF;
+        }
+        dev_dbg(ipu_data.dev, "resizing from %u -> %u pixels, "
+                "downsize=%u, resize=%u.%lu (reg=%u)\n", in_size, out_size,
+                *downsize_coeff, *resize_coeff >= 8192L ? 1 : 0,
+                ((*resize_coeff & 0x1FFF) * 10000L) / 8192L, *resize_coeff);
+        return 0;
+}
+static enum ipu_color_space format_to_colorspace(enum pixel_fmt fmt)
+{
+        switch (fmt) {
+        case IPU_PIX_FMT_RGB565:
+        case IPU_PIX_FMT_BGR24:
+        case IPU_PIX_FMT_RGB24:
+        case IPU_PIX_FMT_BGR32:
+        case IPU_PIX_FMT_RGB32:
+                return IPU_COLORSPACE_RGB;
+        default:
+                return IPU_COLORSPACE_YCBCR;
+        }
+}
+static int ipu_ic_init_prpenc(struct ipu *ipu,
+                              union ipu_channel_param *params, bool src_is_csi)
+{
+        uint32_t reg, ic_conf;
+        uint32_t downsize_coeff, resize_coeff;
+        enum ipu_color_space in_fmt, out_fmt;
+        /* Setup vertical resizing */
+        calc_resize_coeffs(params->video.in_height,
+                            params->video.out_height,
+                            &resize_coeff, &downsize_coeff);
+        reg = (downsize_coeff << 30) | (resize_coeff << 16);
+        /* Setup horizontal resizing */
+        calc_resize_coeffs(params->video.in_width,
+                            params->video.out_width,
+                            &resize_coeff, &downsize_coeff);
+        reg |= (downsize_coeff << 14) | resize_coeff;
+        /* Setup color space conversion */
+        in_fmt = format_to_colorspace(params->video.in_pixel_fmt);
+        out_fmt = format_to_colorspace(params->video.out_pixel_fmt);
+        /*
+         * Colourspace conversion unsupported yet - see _init_csc() in
+         * Freescale sources
+         */
+        if (in_fmt != out_fmt) {
+                dev_err(ipu->dev, "Colourspace conversion unsupported!\n");
+                return -EOPNOTSUPP;
+        }
+        idmac_write_icreg(ipu, reg, IC_PRP_ENC_RSC);
+        ic_conf = idmac_read_icreg(ipu, IC_CONF);
+        if (src_is_csi)
+                ic_conf &= ~IC_CONF_RWS_EN;
+        else
+                ic_conf |= IC_CONF_RWS_EN;
+        idmac_write_icreg(ipu, ic_conf, IC_CONF);
+        return 0;
+}
+static uint32_t dma_param_addr(uint32_t dma_ch)
+{
+        /* Channel Parameter Memory */
+        return 0x10000 | (dma_ch << 4);
+};
+static void ipu_channel_set_priority(struct ipu *ipu, enum ipu_channel channel,
+                                     bool prio)
+{
+        u32 reg = idmac_read_icreg(ipu, IDMAC_CHA_PRI);
+        if (prio)
+                reg |= 1UL << channel;
+        else
+                reg &= ~(1UL << channel);
+        idmac_write_icreg(ipu, reg, IDMAC_CHA_PRI);
+        dump_idmac_reg(ipu);
+}
+static uint32_t ipu_channel_conf_mask(enum ipu_channel channel)
+{
+        uint32_t mask;
+        switch (channel) {
+        case IDMAC_IC_0:
+        case IDMAC_IC_7:
+                mask = IPU_CONF_CSI_EN | IPU_CONF_IC_EN;
+                break;
+        case IDMAC_SDC_0:
+        case IDMAC_SDC_1:
+                mask = IPU_CONF_SDC_EN | IPU_CONF_DI_EN;
+                break;
+        default:
+                mask = 0;
+                break;
+        }
+        return mask;
+}
+/**
+ * ipu_enable_channel() - enable an IPU channel.
+ * @channel:    channel ID.
+ * @return:     0 on success or negative error code on failure.
+ */
+static int ipu_enable_channel(struct idmac *idmac, struct idmac_channel *ichan)
+{
+        struct ipu *ipu = to_ipu(idmac);
+        enum ipu_channel channel = ichan->dma_chan.chan_id;
+        uint32_t reg;
+        unsigned long flags;
+        spin_lock_irqsave(&ipu->lock, flags);
+        /* Reset to buffer 0 */
+        idmac_write_ipureg(ipu, 1UL << channel, IPU_CHA_CUR_BUF);
+        ichan->active_buffer = 0;
+        ichan->status = IPU_CHANNEL_ENABLED;
+        switch (channel) {
+        case IDMAC_SDC_0:
+        case IDMAC_SDC_1:
+        case IDMAC_IC_7:
+                ipu_channel_set_priority(ipu, channel, true);
+        default:
+                break;
+        }
+        reg = idmac_read_icreg(ipu, IDMAC_CHA_EN);
+        idmac_write_icreg(ipu, reg | (1UL << channel), IDMAC_CHA_EN);
+        ipu_ic_enable_task(ipu, channel);
+        spin_unlock_irqrestore(&ipu->lock, flags);
+        return 0;
+}
+/**
+ * ipu_init_channel_buffer() - initialize a buffer for logical IPU channel.
+ * @channel:    channel ID.
+ * @pixel_fmt:  pixel format of buffer. Pixel format is a FOURCC ASCII code.
+ * @width:      width of buffer in pixels.
+ * @height:     height of buffer in pixels.
+ * @stride:     stride length of buffer in pixels.
+ * @rot_mode:   rotation mode of buffer. A rotation setting other than
+ *              IPU_ROTATE_VERT_FLIP should only be used for input buffers of
+ *              rotation channels.
+ * @phyaddr_0:  buffer 0 physical address.
+ * @phyaddr_1:  buffer 1 physical address. Setting this to a value other than
+ *              NULL enables double buffering mode.
+ * @return:     0 on success or negative error code on failure.
+ */
+static int ipu_init_channel_buffer(struct idmac_channel *ichan,
+                                   enum pixel_fmt pixel_fmt,
+                                   uint16_t width, uint16_t height,
+                                   uint32_t stride,
+                                   enum ipu_rotate_mode rot_mode,
+                                   dma_addr_t phyaddr_0, dma_addr_t phyaddr_1)
+{
+        enum ipu_channel channel = ichan->dma_chan.chan_id;
+        struct idmac *idmac = to_idmac(ichan->dma_chan.device);
+        struct ipu *ipu = to_ipu(idmac);
+        union chan_param_mem params = {};
+        unsigned long flags;
+        uint32_t reg;
+        uint32_t stride_bytes;
+        stride_bytes = stride * bytes_per_pixel(pixel_fmt);
+        if (stride_bytes % 4) {
+                dev_err(ipu->dev,
+                        "Stride length must be 32-bit aligned, stride = %d, bytes = %d\n",
+                        stride, stride_bytes);
+                return -EINVAL;
+        }
+        /* IC channel's stride must be a multiple of 8 pixels */
+        if ((channel <= 13) && (stride % 8)) {
+                dev_err(ipu->dev, "Stride must be 8 pixel multiple\n");
+                return -EINVAL;
+        }
+        /* Build parameter memory data for DMA channel */
+        ipu_ch_param_set_size(&params, pixel_fmt, width, height, stride_bytes);
+        ipu_ch_param_set_buffer(&params, phyaddr_0, phyaddr_1);
+        ipu_ch_param_set_rotation(&params, rot_mode);
+        /* Some channels (rotation) have restriction on burst length */
+        switch (channel) {
+        case IDMAC_IC_7:        /* Hangs with burst 8, 16, other values
+                                   invalid - Table 44-30 */
+/*
+                ipu_ch_param_set_burst_size(&params, 8);
+ */
+                break;
+        case IDMAC_SDC_0:
+        case IDMAC_SDC_1:
+                /* In original code only IPU_PIX_FMT_RGB565 was setting burst */
+                ipu_ch_param_set_burst_size(&params, 16);
+                break;
+        case IDMAC_IC_0:
+        default:
+                break;
+        }
+        spin_lock_irqsave(&ipu->lock, flags);
+        ipu_write_param_mem(dma_param_addr(channel), (uint32_t *)&params, 10);
+        reg = idmac_read_ipureg(ipu, IPU_CHA_DB_MODE_SEL);
+        if (phyaddr_1)
+                reg |= 1UL << channel;
+        else
+                reg &= ~(1UL << channel);
+        idmac_write_ipureg(ipu, reg, IPU_CHA_DB_MODE_SEL);
+        ichan->status = IPU_CHANNEL_READY;
+        spin_unlock_irqrestore(ipu->lock, flags);
+        return 0;
+}
+/**
+ * ipu_select_buffer() - mark a channel's buffer as ready.
+ * @channel:    channel ID.
+ * @buffer_n:   buffer number to mark ready.
+ */
+static void ipu_select_buffer(enum ipu_channel channel, int buffer_n)
+{
+        /* No locking - this is a write-one-to-set register, cleared by IPU */
+        if (buffer_n == 0)
+                /* Mark buffer 0 as ready. */
+                idmac_write_ipureg(&ipu_data, 1UL << channel, IPU_CHA_BUF0_RDY);
+        else
+                /* Mark buffer 1 as ready. */
+                idmac_write_ipureg(&ipu_data, 1UL << channel, IPU_CHA_BUF1_RDY);
+}
+/**
+ * ipu_update_channel_buffer() - update physical address of a channel buffer.
+ * @channel:    channel ID.
+ * @buffer_n:   buffer number to update.
+ *              0 or 1 are the only valid values.
+ * @phyaddr:    buffer physical address.
+ * @return:     Returns 0 on success or negative error code on failure. This
+ *              function will fail if the buffer is set to ready.
+ */
+/* Called under spin_lock(_irqsave)(&ichan->lock) */
+static int ipu_update_channel_buffer(enum ipu_channel channel,
+                                     int buffer_n, dma_addr_t phyaddr)
+{
+        uint32_t reg;
+        unsigned long flags;
+        spin_lock_irqsave(&ipu_data.lock, flags);
+        if (buffer_n == 0) {
+                reg = idmac_read_ipureg(&ipu_data, IPU_CHA_BUF0_RDY);
+                if (reg & (1UL << channel)) {
+                        spin_unlock_irqrestore(&ipu_data.lock, flags);
+                        return -EACCES;
+                }
+                /* 44.3.3.1.9 - Row Number 1 (WORD1, offset 0) */
+                idmac_write_ipureg(&ipu_data, dma_param_addr(channel) +
+                                   0x0008UL, IPU_IMA_ADDR);
+                idmac_write_ipureg(&ipu_data, phyaddr, IPU_IMA_DATA);
+        } else {
+                reg = idmac_read_ipureg(&ipu_data, IPU_CHA_BUF1_RDY);
+                if (reg & (1UL << channel)) {
+                        spin_unlock_irqrestore(&ipu_data.lock, flags);
+                        return -EACCES;
+                }
+                /* Check if double-buffering is already enabled */
+                reg = idmac_read_ipureg(&ipu_data, IPU_CHA_DB_MODE_SEL);
+                if (!(reg & (1UL << channel)))
+                        idmac_write_ipureg(&ipu_data, reg | (1UL << channel),
+                                           IPU_CHA_DB_MODE_SEL);
+                /* 44.3.3.1.9 - Row Number 1 (WORD1, offset 1) */
+                idmac_write_ipureg(&ipu_data, dma_param_addr(channel) +
+                                   0x0009UL, IPU_IMA_ADDR);
+                idmac_write_ipureg(&ipu_data, phyaddr, IPU_IMA_DATA);
+        }
+        spin_unlock_irqrestore(&ipu_data.lock, flags);
+        return 0;
+}
+/* Called under spin_lock_irqsave(&ichan->lock) */
+static int ipu_submit_channel_buffers(struct idmac_channel *ichan,
+                                      struct idmac_tx_desc *desc)
+{
+        struct scatterlist *sg;
+        int i, ret = 0;
+        for (i = 0, sg = desc->sg; i < 2 && sg; i++) {
+                if (!ichan->sg[i]) {
+                        ichan->sg[i] = sg;
+                        /*
+                         * On first invocation this shouldn't be necessary, the
+                         * call to ipu_init_channel_buffer() above will set
+                         * addresses for us, so we could make it conditional
+                         * on status >= IPU_CHANNEL_ENABLED, but doing it again
+                         * shouldn't hurt either.
+                         */
+                        ret = ipu_update_channel_buffer(ichan->dma_chan.chan_id, i,
+                                                        sg_dma_address(sg));
+                        if (ret < 0)
+                                return ret;
+                        ipu_select_buffer(ichan->dma_chan.chan_id, i);
+                        sg = sg_next(sg);
+                }
+        }
+        return ret;
+}
+static dma_cookie_t idmac_tx_submit(struct dma_async_tx_descriptor *tx)
+{
+        struct idmac_tx_desc *desc = to_tx_desc(tx);
+        struct idmac_channel *ichan = to_idmac_chan(tx->chan);
+        struct idmac *idmac = to_idmac(tx->chan->device);
+        struct ipu *ipu = to_ipu(idmac);
+        dma_cookie_t cookie;
+        unsigned long flags;
+        /* Sanity check */
+        if (!list_empty(&desc->list)) {
+                /* The descriptor doesn't belong to client */
+                dev_err(&ichan->dma_chan.dev->device,
+                        "Descriptor %p not prepared!\n", tx);
+                return -EBUSY;
+        }
+        mutex_lock(&ichan->chan_mutex);
+        if (ichan->status < IPU_CHANNEL_READY) {
+                struct idmac_video_param *video = &ichan->params.video;
+                /*
+                 * Initial buffer assignment - the first two sg-entries from
+                 * the descriptor will end up in the IDMAC buffers
+                 */
+                dma_addr_t dma_1 = sg_is_last(desc->sg) ? 0 :
+                        sg_dma_address(&desc->sg[1]);
+                WARN_ON(ichan->sg[0] || ichan->sg[1]);
+                cookie = ipu_init_channel_buffer(ichan,
+                                                 video->out_pixel_fmt,
+                                                 video->out_width,
+                                                 video->out_height,
+                                                 video->out_stride,
+                                                 IPU_ROTATE_NONE,
+                                                 sg_dma_address(&desc->sg[0]),
+                                                 dma_1);
+                if (cookie < 0)
+                        goto out;
+        }
+        /* ipu->lock can be taken under ichan->lock, but not v.v. */
+        spin_lock_irqsave(&ichan->lock, flags);
+        /* submit_buffers() atomically verifies and fills empty sg slots */
+        cookie = ipu_submit_channel_buffers(ichan, desc);
+        spin_unlock_irqrestore(&ichan->lock, flags);
+        if (cookie < 0)
+                goto out;
+        cookie = ichan->dma_chan.cookie;
+        if (++cookie < 0)
+                cookie = 1;
+        /* from dmaengine.h: "last cookie value returned to client" */
+        ichan->dma_chan.cookie = cookie;
+        tx->cookie = cookie;
+        spin_lock_irqsave(&ichan->lock, flags);
+        list_add_tail(&desc->list, &ichan->queue);
+        spin_unlock_irqrestore(&ichan->lock, flags);
+        if (ichan->status < IPU_CHANNEL_ENABLED) {
+                int ret = ipu_enable_channel(idmac, ichan);
+                if (ret < 0) {
+                        cookie = ret;
+                        spin_lock_irqsave(&ichan->lock, flags);
+                        list_del_init(&desc->list);
+                        spin_unlock_irqrestore(&ichan->lock, flags);
+                        tx->cookie = cookie;
+                        ichan->dma_chan.cookie = cookie;
+                }
+        }
+        dump_idmac_reg(ipu);
+out:
+        mutex_unlock(&ichan->chan_mutex);
+        return cookie;
+}
+/* Called with ichan->chan_mutex held */
+static int idmac_desc_alloc(struct idmac_channel *ichan, int n)
+{
+        struct idmac_tx_desc *desc = vmalloc(n * sizeof(struct idmac_tx_desc));
+        struct idmac *idmac = to_idmac(ichan->dma_chan.device);
+        if (!desc)
+                return -ENOMEM;
+        /* No interrupts, just disable the tasklet for a moment */
+        tasklet_disable(&to_ipu(idmac)->tasklet);
+        ichan->n_tx_desc = n;
+        ichan->desc = desc;
+        INIT_LIST_HEAD(&ichan->queue);
+        INIT_LIST_HEAD(&ichan->free_list);
+        while (n--) {
+                struct dma_async_tx_descriptor *txd = &desc->txd;
+                memset(txd, 0, sizeof(*txd));
+                dma_async_tx_descriptor_init(txd, &ichan->dma_chan);
+                txd->tx_submit          = idmac_tx_submit;
+                txd->chan               = &ichan->dma_chan;
+                INIT_LIST_HEAD(&txd->tx_list);
+                list_add(&desc->list, &ichan->free_list);
+                desc++;
+        }
+        tasklet_enable(&to_ipu(idmac)->tasklet);
+        return 0;
+}
+/**
+ * ipu_init_channel() - initialize an IPU channel.
+ * @idmac:      IPU DMAC context.
+ * @ichan:      pointer to the channel object.
+ * @return      0 on success or negative error code on failure.
+ */
+static int ipu_init_channel(struct idmac *idmac, struct idmac_channel *ichan)
+{
+        union ipu_channel_param *params = &ichan->params;
+        uint32_t ipu_conf;
+        enum ipu_channel channel = ichan->dma_chan.chan_id;
+        unsigned long flags;
+        uint32_t reg;
+        struct ipu *ipu = to_ipu(idmac);
+        int ret = 0, n_desc = 0;
+        dev_dbg(ipu->dev, "init channel = %d\n", channel);
+        if (channel != IDMAC_SDC_0 && channel != IDMAC_SDC_1 &&
+            channel != IDMAC_IC_7)
+                return -EINVAL;
+        spin_lock_irqsave(&ipu->lock, flags);
+        switch (channel) {
+        case IDMAC_IC_7:
+                n_desc = 16;
+                reg = idmac_read_icreg(ipu, IC_CONF);
+                idmac_write_icreg(ipu, reg & ~IC_CONF_CSI_MEM_WR_EN, IC_CONF);
+                break;
+        case IDMAC_IC_0:
+                n_desc = 16;
+                reg = idmac_read_ipureg(ipu, IPU_FS_PROC_FLOW);
+                idmac_write_ipureg(ipu, reg & ~FS_ENC_IN_VALID, IPU_FS_PROC_FLOW);
+                ret = ipu_ic_init_prpenc(ipu, params, true);
+                break;
+        case IDMAC_SDC_0:
+        case IDMAC_SDC_1:
+                n_desc = 4;
+        default:
+                break;
+        }
+        ipu->channel_init_mask |= 1L << channel;
+        /* Enable IPU sub module */
+        ipu_conf = idmac_read_ipureg(ipu, IPU_CONF) |
+                ipu_channel_conf_mask(channel);
+        idmac_write_ipureg(ipu, ipu_conf, IPU_CONF);
+        spin_unlock_irqrestore(&ipu->lock, flags);
+        if (n_desc && !ichan->desc)
+                ret = idmac_desc_alloc(ichan, n_desc);
+        dump_idmac_reg(ipu);
+        return ret;
+}
+/**
+ * ipu_uninit_channel() - uninitialize an IPU channel.
+ * @idmac:      IPU DMAC context.
+ * @ichan:      pointer to the channel object.
+ */
+static void ipu_uninit_channel(struct idmac *idmac, struct idmac_channel *ichan)
+{
+        enum ipu_channel channel = ichan->dma_chan.chan_id;
+        unsigned long flags;
+        uint32_t reg;
+        unsigned long chan_mask = 1UL << channel;
+        uint32_t ipu_conf;
+        struct ipu *ipu = to_ipu(idmac);
+        spin_lock_irqsave(&ipu->lock, flags);
+        if (!(ipu->channel_init_mask & chan_mask)) {
+                dev_err(ipu->dev, "Channel already uninitialized %d\n",
+                        channel);
+                spin_unlock_irqrestore(&ipu->lock, flags);
+                return;
+        }
+        /* Reset the double buffer */
+        reg = idmac_read_ipureg(ipu, IPU_CHA_DB_MODE_SEL);
+        idmac_write_ipureg(ipu, reg & ~chan_mask, IPU_CHA_DB_MODE_SEL);
+        ichan->sec_chan_en = false;
+        switch (channel) {
+        case IDMAC_IC_7:
+                reg = idmac_read_icreg(ipu, IC_CONF);
+                idmac_write_icreg(ipu, reg & ~(IC_CONF_RWS_EN | IC_CONF_PRPENC_EN),
+                             IC_CONF);
+                break;
+        case IDMAC_IC_0:
+                reg = idmac_read_icreg(ipu, IC_CONF);
+                idmac_write_icreg(ipu, reg & ~(IC_CONF_PRPENC_EN | IC_CONF_PRPENC_CSC1),
+                                  IC_CONF);
+                break;
+        case IDMAC_SDC_0:
+        case IDMAC_SDC_1:
+        default:
+                break;
+        }
+        ipu->channel_init_mask &= ~(1L << channel);
+        ipu_conf = idmac_read_ipureg(ipu, IPU_CONF) &
+                ~ipu_channel_conf_mask(channel);
+        idmac_write_ipureg(ipu, ipu_conf, IPU_CONF);
+        spin_unlock_irqrestore(&ipu->lock, flags);
+        ichan->n_tx_desc = 0;
+        vfree(ichan->desc);
+        ichan->desc = NULL;
+}
+/**
+ * ipu_disable_channel() - disable an IPU channel.
+ * @idmac:              IPU DMAC context.
+ * @ichan:              channel object pointer.
+ * @wait_for_stop:      flag to set whether to wait for channel end of frame or
+ *                      return immediately.
+ * @return:             0 on success or negative error code on failure.
+ */
+static int ipu_disable_channel(struct idmac *idmac, struct idmac_channel *ichan,
+                               bool wait_for_stop)
+{
+        enum ipu_channel channel = ichan->dma_chan.chan_id;
+        struct ipu *ipu = to_ipu(idmac);
+        uint32_t reg;
+        unsigned long flags;
+        unsigned long chan_mask = 1UL << channel;
+        unsigned int timeout;
+        if (wait_for_stop && channel != IDMAC_SDC_1 && channel != IDMAC_SDC_0) {
+                timeout = 40;
+                /* This waiting always fails. Related to spurious irq problem */
+                while ((idmac_read_icreg(ipu, IDMAC_CHA_BUSY) & chan_mask) ||
+                       (ipu_channel_status(ipu, channel) == TASK_STAT_ACTIVE)) {
+                        timeout--;
+                        msleep(10);
+                        if (!timeout) {
+                                dev_dbg(ipu->dev,
+                                        "Warning: timeout waiting for channel %u to "
+                                        "stop: buf0_rdy = 0x%08X, buf1_rdy = 0x%08X, "
+                                        "busy = 0x%08X, tstat = 0x%08X\n", channel,
+                                        idmac_read_ipureg(ipu, IPU_CHA_BUF0_RDY),
+                                        idmac_read_ipureg(ipu, IPU_CHA_BUF1_RDY),
+                                        idmac_read_icreg(ipu, IDMAC_CHA_BUSY),
+                                        idmac_read_ipureg(ipu, IPU_TASKS_STAT));
+                                break;
+                        }
+                }
+                dev_dbg(ipu->dev, "timeout = %d * 10ms\n", 40 - timeout);
+        }
+        /* SDC BG and FG must be disabled before DMA is disabled */
+        if (wait_for_stop && (channel == IDMAC_SDC_0 ||
+                              channel == IDMAC_SDC_1)) {
+                for (timeout = 5;
+                     timeout && !ipu_irq_status(ichan->eof_irq); timeout--)
+                        msleep(5);
+        }
+        spin_lock_irqsave(&ipu->lock, flags);
+        /* Disable IC task */
+        ipu_ic_disable_task(ipu, channel);
+        /* Disable DMA channel(s) */
+        reg = idmac_read_icreg(ipu, IDMAC_CHA_EN);
+        idmac_write_icreg(ipu, reg & ~chan_mask, IDMAC_CHA_EN);
+        /*
+         * Problem (observed with channel DMAIC_7): after enabling the channel
+         * and initialising buffers, there comes an interrupt with current still
+         * pointing at buffer 0, whereas it should use buffer 0 first and only
+         * generate an interrupt when it is done, then current should already
+         * point to buffer 1. This spurious interrupt also comes on channel
+         * DMASDC_0. With DMAIC_7 normally, is we just leave the ISR after the
+         * first interrupt, there comes the second with current correctly
+         * pointing to buffer 1 this time. But sometimes this second interrupt
+         * doesn't come and the channel hangs. Clearing BUFx_RDY when disabling
+         * the channel seems to prevent the channel from hanging, but it doesn't
+         * prevent the spurious interrupt. This might also be unsafe. Think
+         * about the IDMAC controller trying to switch to a buffer, when we
+         * clear the ready bit, and re-enable it a moment later.
+         */
+        reg = idmac_read_ipureg(ipu, IPU_CHA_BUF0_RDY);
+        idmac_write_ipureg(ipu, 0, IPU_CHA_BUF0_RDY);
+        idmac_write_ipureg(ipu, reg & ~(1UL << channel), IPU_CHA_BUF0_RDY);
+        reg = idmac_read_ipureg(ipu, IPU_CHA_BUF1_RDY);
+        idmac_write_ipureg(ipu, 0, IPU_CHA_BUF1_RDY);
+        idmac_write_ipureg(ipu, reg & ~(1UL << channel), IPU_CHA_BUF1_RDY);
+        spin_unlock_irqrestore(&ipu->lock, flags);
+        return 0;
+}
+/*
+ * We have several possibilities here:
+ * current BUF          next BUF
+ *
+ * not last sg          next not last sg
+ * not last sg          next last sg
+ * last sg              first sg from next descriptor
+ * last sg              NULL
+ *
+ * Besides, the descriptor queue might be empty or not. We process all these
+ * cases carefully.
+ */
+static irqreturn_t idmac_interrupt(int irq, void *dev_id)
+{
+        struct idmac_channel *ichan = dev_id;
+        unsigned int chan_id = ichan->dma_chan.chan_id;
+        struct scatterlist **sg, *sgnext, *sgnew = NULL;
+        /* Next transfer descriptor */
+        struct idmac_tx_desc *desc = NULL, *descnew;
+        dma_async_tx_callback callback;
+        void *callback_param;
+        bool done = false;
+        u32     ready0 = idmac_read_ipureg(&ipu_data, IPU_CHA_BUF0_RDY),
+                ready1 = idmac_read_ipureg(&ipu_data, IPU_CHA_BUF1_RDY),
+                curbuf = idmac_read_ipureg(&ipu_data, IPU_CHA_CUR_BUF);
+        /* IDMAC has cleared the respective BUFx_RDY bit, we manage the buffer */
+        pr_debug("IDMAC irq %d\n", irq);
+        /* Other interrupts do not interfere with this channel */
+        spin_lock(&ichan->lock);
+        if (unlikely(chan_id != IDMAC_SDC_0 && chan_id != IDMAC_SDC_1 &&
+                     ((curbuf >> chan_id) & 1) == ichan->active_buffer)) {
+                int i = 100;
+                /* This doesn't help. See comment in ipu_disable_channel() */
+                while (--i) {
+                        curbuf = idmac_read_ipureg(&ipu_data, IPU_CHA_CUR_BUF);
+                        if (((curbuf >> chan_id) & 1) != ichan->active_buffer)
+                                break;
+                        cpu_relax();
+                }
+                if (!i) {
+                        spin_unlock(&ichan->lock);
+                        dev_dbg(ichan->dma_chan.device->dev,
+                                "IRQ on active buffer on channel %x, active "
+                                "%d, ready %x, %x, current %x!\n", chan_id,
+                                ichan->active_buffer, ready0, ready1, curbuf);
+                        return IRQ_NONE;
+                }
+        }
+        if (unlikely((ichan->active_buffer && (ready1 >> chan_id) & 1) ||
+                     (!ichan->active_buffer && (ready0 >> chan_id) & 1)
+                     )) {
+                spin_unlock(&ichan->lock);
+                dev_dbg(ichan->dma_chan.device->dev,
+                        "IRQ with active buffer still ready on channel %x, "
+                        "active %d, ready %x, %x!\n", chan_id,
+                        ichan->active_buffer, ready0, ready1);
+                return IRQ_NONE;
+        }
+        if (unlikely(list_empty(&ichan->queue))) {
+                spin_unlock(&ichan->lock);
+                dev_err(ichan->dma_chan.device->dev,
+                        "IRQ without queued buffers on channel %x, active %d, "
+                        "ready %x, %x!\n", chan_id,
+                        ichan->active_buffer, ready0, ready1);
+                return IRQ_NONE;
+        }
+        /*
+         * active_buffer is a software flag, it shows which buffer we are
+         * currently expecting back from the hardware, IDMAC should be
+         * processing the other buffer already
+         */
+        sg = &ichan->sg[ichan->active_buffer];
+        sgnext = ichan->sg[!ichan->active_buffer];
+        /*
+         * if sgnext == NULL sg must be the last element in a scatterlist and
+         * queue must be empty
+         */
+        if (unlikely(!sgnext)) {
+                if (unlikely(sg_next(*sg))) {
+                        dev_err(ichan->dma_chan.device->dev,
+                                "Broken buffer-update locking on channel %x!\n",
+                                chan_id);
+                        /* We'll let the user catch up */
+                } else {
+                        /* Underrun */
+                        ipu_ic_disable_task(&ipu_data, chan_id);
+                        dev_dbg(ichan->dma_chan.device->dev,
+                                "Underrun on channel %x\n", chan_id);
+                        ichan->status = IPU_CHANNEL_READY;
+                        /* Continue to check for complete descriptor */
+                }
+        }
+        desc = list_entry(ichan->queue.next, struct idmac_tx_desc, list);
+        /* First calculate and submit the next sg element */
+        if (likely(sgnext))
+                sgnew = sg_next(sgnext);
+        if (unlikely(!sgnew)) {
+                /* Start a new scatterlist, if any queued */
+                if (likely(desc->list.next != &ichan->queue)) {
+                        descnew = list_entry(desc->list.next,
+                                             struct idmac_tx_desc, list);
+                        sgnew = &descnew->sg[0];
+                }
+        }
+        if (unlikely(!sg_next(*sg)) || !sgnext) {
+                /*
+                 * Last element in scatterlist done, remove from the queue,
+                 * _init for debugging
+                 */
+                list_del_init(&desc->list);
+                done = true;
+        }
+        *sg = sgnew;
+        if (likely(sgnew)) {
+                int ret;
+                ret = ipu_update_channel_buffer(chan_id, ichan->active_buffer,
+                                                sg_dma_address(*sg));
+                if (ret < 0)
+                        dev_err(ichan->dma_chan.device->dev,
+                                "Failed to update buffer on channel %x buffer %d!\n",
+                                chan_id, ichan->active_buffer);
+                else
+                        ipu_select_buffer(chan_id, ichan->active_buffer);
+        }
+        /* Flip the active buffer - even if update above failed */
+        ichan->active_buffer = !ichan->active_buffer;
+        if (done)
+                ichan->completed = desc->txd.cookie;
+        callback = desc->txd.callback;
+        callback_param = desc->txd.callback_param;
+        spin_unlock(&ichan->lock);
+        if (done && (desc->txd.flags & DMA_PREP_INTERRUPT) && callback)
+                callback(callback_param);
+        return IRQ_HANDLED;
+}
+static void ipu_gc_tasklet(unsigned long arg)
+{
+        struct ipu *ipu = (struct ipu *)arg;
+        int i;
+        for (i = 0; i < IPU_CHANNELS_NUM; i++) {
+                struct idmac_channel *ichan = ipu->channel + i;
+                struct idmac_tx_desc *desc;
+                unsigned long flags;
+                int j;
+                for (j = 0; j < ichan->n_tx_desc; j++) {
+                        desc = ichan->desc + j;
+                        spin_lock_irqsave(&ichan->lock, flags);
+                        if (async_tx_test_ack(&desc->txd)) {
+                                list_move(&desc->list, &ichan->free_list);
+                                async_tx_clear_ack(&desc->txd);
+                        }
+                        spin_unlock_irqrestore(&ichan->lock, flags);
+                }
+        }
+}
+/*
+ * At the time .device_alloc_chan_resources() method is called, we cannot know,
+ * whether the client will accept the channel. Thus we must only check, if we
+ * can satisfy client's request but the only real criterion to verify, whether
+ * the client has accepted our offer is the client_count. That's why we have to
+ * perform the rest of our allocation tasks on the first call to this function.
+ */
+static struct dma_async_tx_descriptor *idmac_prep_slave_sg(struct dma_chan *chan,
+                struct scatterlist *sgl, unsigned int sg_len,
+                enum dma_data_direction direction, unsigned long tx_flags)
+{
+        struct idmac_channel *ichan = to_idmac_chan(chan);
+        struct idmac_tx_desc *desc = NULL;
+        struct dma_async_tx_descriptor *txd = NULL;
+        unsigned long flags;
+        /* We only can handle these three channels so far */
+        if (ichan->dma_chan.chan_id != IDMAC_SDC_0 && ichan->dma_chan.chan_id != IDMAC_SDC_1 &&
+            ichan->dma_chan.chan_id != IDMAC_IC_7)
+                return NULL;
+        if (direction != DMA_FROM_DEVICE && direction != DMA_TO_DEVICE) {
+                dev_err(chan->device->dev, "Invalid DMA direction %d!\n", direction);
+                return NULL;
+        }
+        mutex_lock(&ichan->chan_mutex);
+        spin_lock_irqsave(&ichan->lock, flags);
+        if (!list_empty(&ichan->free_list)) {
+                desc = list_entry(ichan->free_list.next,
+                                  struct idmac_tx_desc, list);
+                list_del_init(&desc->list);
+                desc->sg_len    = sg_len;
+                desc->sg        = sgl;
+                txd             = &desc->txd;
+                txd->flags      = tx_flags;
+        }
+        spin_unlock_irqrestore(&ichan->lock, flags);
+        mutex_unlock(&ichan->chan_mutex);
+        tasklet_schedule(&to_ipu(to_idmac(chan->device))->tasklet);
+        return txd;
+}
+/* Re-select the current buffer and re-activate the channel */
+static void idmac_issue_pending(struct dma_chan *chan)
+{
+        struct idmac_channel *ichan = to_idmac_chan(chan);
+        struct idmac *idmac = to_idmac(chan->device);
+        struct ipu *ipu = to_ipu(idmac);
+        unsigned long flags;
+        /* This is not always needed, but doesn't hurt either */
+        spin_lock_irqsave(&ipu->lock, flags);
+        ipu_select_buffer(ichan->dma_chan.chan_id, ichan->active_buffer);
+        spin_unlock_irqrestore(&ipu->lock, flags);
+        /*
+         * Might need to perform some parts of initialisation from
+         * ipu_enable_channel(), but not all, we do not want to reset to buffer
+         * 0, don't need to set priority again either, but re-enabling the task
+         * and the channel might be a good idea.
+         */
+}
+static void __idmac_terminate_all(struct dma_chan *chan)
+{
+        struct idmac_channel *ichan = to_idmac_chan(chan);
+        struct idmac *idmac = to_idmac(chan->device);
+        unsigned long flags;
+        int i;
+        ipu_disable_channel(idmac, ichan,
+                            ichan->status >= IPU_CHANNEL_ENABLED);
+        tasklet_disable(&to_ipu(idmac)->tasklet);
+        /* ichan->queue is modified in ISR, have to spinlock */
+        spin_lock_irqsave(&ichan->lock, flags);
+        list_splice_init(&ichan->queue, &ichan->free_list);
+        if (ichan->desc)
+                for (i = 0; i < ichan->n_tx_desc; i++) {
+                        struct idmac_tx_desc *desc = ichan->desc + i;
+                        if (list_empty(&desc->list))
+                                /* Descriptor was prepared, but not submitted */
+                                list_add(&desc->list,
+                                         &ichan->free_list);
+                        async_tx_clear_ack(&desc->txd);
+                }
+        ichan->sg[0] = NULL;
+        ichan->sg[1] = NULL;
+        spin_unlock_irqrestore(&ichan->lock, flags);
+        tasklet_enable(&to_ipu(idmac)->tasklet);
+        ichan->status = IPU_CHANNEL_INITIALIZED;
+}
+static void idmac_terminate_all(struct dma_chan *chan)
+{
+        struct idmac_channel *ichan = to_idmac_chan(chan);
+        mutex_lock(&ichan->chan_mutex);
+        __idmac_terminate_all(chan);
+        mutex_unlock(&ichan->chan_mutex);
+}
+static int idmac_alloc_chan_resources(struct dma_chan *chan)
+{
+        struct idmac_channel *ichan = to_idmac_chan(chan);
+        struct idmac *idmac = to_idmac(chan->device);
+        int ret;
+        /* dmaengine.c now guarantees to only offer free channels */
+        BUG_ON(chan->client_count > 1);
+        WARN_ON(ichan->status != IPU_CHANNEL_FREE);
+        chan->cookie            = 1;
+        ichan->completed        = -ENXIO;
+        ret = ipu_irq_map(ichan->dma_chan.chan_id);
+        if (ret < 0)
+                goto eimap;
+        ichan->eof_irq = ret;
+        ret = request_irq(ichan->eof_irq, idmac_interrupt, 0,
+                          ichan->eof_name, ichan);
+        if (ret < 0)
+                goto erirq;
+        ret = ipu_init_channel(idmac, ichan);
+        if (ret < 0)
+                goto eichan;
+        ichan->status = IPU_CHANNEL_INITIALIZED;
+        dev_dbg(&ichan->dma_chan.dev->device, "Found channel 0x%x, irq %d\n",
+                ichan->dma_chan.chan_id, ichan->eof_irq);
+        return ret;
+eichan:
+        free_irq(ichan->eof_irq, ichan);
+erirq:
+        ipu_irq_unmap(ichan->dma_chan.chan_id);
+eimap:
+        return ret;
+}
+static void idmac_free_chan_resources(struct dma_chan *chan)
+{
+        struct idmac_channel *ichan = to_idmac_chan(chan);
+        struct idmac *idmac = to_idmac(chan->device);
+        mutex_lock(&ichan->chan_mutex);
+        __idmac_terminate_all(chan);
+        if (ichan->status > IPU_CHANNEL_FREE) {
+                free_irq(ichan->eof_irq, ichan);
+                ipu_irq_unmap(ichan->dma_chan.chan_id);
+        }
+        ichan->status = IPU_CHANNEL_FREE;
+        ipu_uninit_channel(idmac, ichan);
+        mutex_unlock(&ichan->chan_mutex);
+        tasklet_schedule(&to_ipu(idmac)->tasklet);
+}
+static enum dma_status idmac_is_tx_complete(struct dma_chan *chan,
+                dma_cookie_t cookie, dma_cookie_t *done, dma_cookie_t *used)
+{
+        struct idmac_channel *ichan = to_idmac_chan(chan);
+        if (done)
+                *done = ichan->completed;
+        if (used)
+                *used = chan->cookie;
+        if (cookie != chan->cookie)
+                return DMA_ERROR;
+        return DMA_SUCCESS;
+}
+static int __init ipu_idmac_init(struct ipu *ipu)
+{
+        struct idmac *idmac = &ipu->idmac;
+        struct dma_device *dma = &idmac->dma;
+        int i;
+        dma_cap_set(DMA_SLAVE, dma->cap_mask);
+        dma_cap_set(DMA_PRIVATE, dma->cap_mask);
+        /* Compulsory common fields */
+        dma->dev                                = ipu->dev;
+        dma->device_alloc_chan_resources        = idmac_alloc_chan_resources;
+        dma->device_free_chan_resources         = idmac_free_chan_resources;
+        dma->device_is_tx_complete              = idmac_is_tx_complete;
+        dma->device_issue_pending               = idmac_issue_pending;
+        /* Compulsory for DMA_SLAVE fields */
+        dma->device_prep_slave_sg               = idmac_prep_slave_sg;
+        dma->device_terminate_all               = idmac_terminate_all;
+        INIT_LIST_HEAD(&dma->channels);
+        for (i = 0; i < IPU_CHANNELS_NUM; i++) {
+                struct idmac_channel *ichan = ipu->channel + i;
+                struct dma_chan *dma_chan = &ichan->dma_chan;
+                spin_lock_init(&ichan->lock);
+                mutex_init(&ichan->chan_mutex);
+                ichan->status           = IPU_CHANNEL_FREE;
+                ichan->sec_chan_en      = false;
+                ichan->completed        = -ENXIO;
+                snprintf(ichan->eof_name, sizeof(ichan->eof_name), "IDMAC EOF %d", i);
+                dma_chan->device        = &idmac->dma;
+                dma_chan->cookie        = 1;
+                dma_chan->chan_id       = i;
+                list_add_tail(&ichan->dma_chan.device_node, &dma->channels);
+        }
+        idmac_write_icreg(ipu, 0x00000070, IDMAC_CONF);
+        return dma_async_device_register(&idmac->dma);
+}
+static void ipu_idmac_exit(struct ipu *ipu)
+{
+        int i;
+        struct idmac *idmac = &ipu->idmac;
+        for (i = 0; i < IPU_CHANNELS_NUM; i++) {
+                struct idmac_channel *ichan = ipu->channel + i;
+                idmac_terminate_all(&ichan->dma_chan);
+                idmac_prep_slave_sg(&ichan->dma_chan, NULL, 0, DMA_NONE, 0);
+        }
+        dma_async_device_unregister(&idmac->dma);
+}
+/*****************************************************************************
+ * IPU common probe / remove
+ */
+static int ipu_probe(struct platform_device *pdev)
+{
+        struct ipu_platform_data *pdata = pdev->dev.platform_data;
+        struct resource *mem_ipu, *mem_ic;
+        int ret;
+        spin_lock_init(&ipu_data.lock);
+        mem_ipu = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        mem_ic  = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+        if (!pdata || !mem_ipu || !mem_ic)
+                return -EINVAL;
+        ipu_data.dev = &pdev->dev;
+        platform_set_drvdata(pdev, &ipu_data);
+        ret = platform_get_irq(pdev, 0);
+        if (ret < 0)
+                goto err_noirq;
+        ipu_data.irq_fn = ret;
+        ret = platform_get_irq(pdev, 1);
+        if (ret < 0)
+                goto err_noirq;
+        ipu_data.irq_err = ret;
+        ipu_data.irq_base = pdata->irq_base;
+        dev_dbg(&pdev->dev, "fn irq %u, err irq %u, irq-base %u\n",
+                ipu_data.irq_fn, ipu_data.irq_err, ipu_data.irq_base);
+        /* Remap IPU common registers */
+        ipu_data.reg_ipu = ioremap(mem_ipu->start,
+                                   mem_ipu->end - mem_ipu->start + 1);
+        if (!ipu_data.reg_ipu) {
+                ret = -ENOMEM;
+                goto err_ioremap_ipu;
+        }
+        /* Remap Image Converter and Image DMA Controller registers */
+        ipu_data.reg_ic = ioremap(mem_ic->start,
+                                  mem_ic->end - mem_ic->start + 1);
+        if (!ipu_data.reg_ic) {
+                ret = -ENOMEM;
+                goto err_ioremap_ic;
+        }
+        /* Get IPU clock */
+        ipu_data.ipu_clk = clk_get(&pdev->dev, "ipu_clk");
+        if (IS_ERR(ipu_data.ipu_clk)) {
+                ret = PTR_ERR(ipu_data.ipu_clk);
+                goto err_clk_get;
+        }
+        /* Make sure IPU HSP clock is running */
+        clk_enable(ipu_data.ipu_clk);
+        /* Disable all interrupts */
+        idmac_write_ipureg(&ipu_data, 0, IPU_INT_CTRL_1);
+        idmac_write_ipureg(&ipu_data, 0, IPU_INT_CTRL_2);
+        idmac_write_ipureg(&ipu_data, 0, IPU_INT_CTRL_3);
+        idmac_write_ipureg(&ipu_data, 0, IPU_INT_CTRL_4);
+        idmac_write_ipureg(&ipu_data, 0, IPU_INT_CTRL_5);
+        dev_dbg(&pdev->dev, "%s @ 0x%08lx, fn irq %u, err irq %u\n", pdev->name,
+                (unsigned long)mem_ipu->start, ipu_data.irq_fn, ipu_data.irq_err);
+        ret = ipu_irq_attach_irq(&ipu_data, pdev);
+        if (ret < 0)
+                goto err_attach_irq;
+        /* Initialize DMA engine */
+        ret = ipu_idmac_init(&ipu_data);
+        if (ret < 0)
+                goto err_idmac_init;
+        tasklet_init(&ipu_data.tasklet, ipu_gc_tasklet, (unsigned long)&ipu_data);
+        ipu_data.dev = &pdev->dev;
+        dev_dbg(ipu_data.dev, "IPU initialized\n");
+        return 0;
+err_idmac_init:
+err_attach_irq:
+        ipu_irq_detach_irq(&ipu_data, pdev);
+        clk_disable(ipu_data.ipu_clk);
+        clk_put(ipu_data.ipu_clk);
+err_clk_get:
+        iounmap(ipu_data.reg_ic);
+err_ioremap_ic:
+        iounmap(ipu_data.reg_ipu);
+err_ioremap_ipu:
+err_noirq:
+        dev_err(&pdev->dev, "Failed to probe IPU: %d\n", ret);
+        return ret;
+}
+static int ipu_remove(struct platform_device *pdev)
+{
+        struct ipu *ipu = platform_get_drvdata(pdev);
+        ipu_idmac_exit(ipu);
+        ipu_irq_detach_irq(ipu, pdev);
+        clk_disable(ipu->ipu_clk);
+        clk_put(ipu->ipu_clk);
+        iounmap(ipu->reg_ic);
+        iounmap(ipu->reg_ipu);
+        tasklet_kill(&ipu->tasklet);
+        platform_set_drvdata(pdev, NULL);
+        return 0;
+}
+/*
+ * We need two MEM resources - with IPU-common and Image Converter registers,
+ * including PF_CONF and IDMAC_* registers, and two IRQs - function and error
+ */
+static struct platform_driver ipu_platform_driver = {
+        .driver = {
+                .name   = "ipu-core",
+                .owner  = THIS_MODULE,
+        },
+        .remove         = ipu_remove,
+};
+static int __init ipu_init(void)
+{
+        return platform_driver_probe(&ipu_platform_driver, ipu_probe);
+}
+subsys_initcall(ipu_init);
+MODULE_DESCRIPTION("IPU core driver");
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Guennadi Liakhovetski <lg@denx.de>");
+MODULE_ALIAS("platform:ipu-core");
diff --git a/drivers/dma/ipu/ipu_intern.h b/drivers/dma/ipu/ipu_intern.h
new file mode 100644
index 000000000000..545cf11a94ab
--- /dev/null
+++ b/drivers/dma/ipu/ipu_intern.h
@@ -0,0 +1,176 @@
+/*
+ * Copyright (C) 2008
+ * Guennadi Liakhovetski, DENX Software Engineering, <lg@denx.de>
+ *
+ * Copyright (C) 2005-2007 Freescale Semiconductor, Inc. All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#ifndef _IPU_INTERN_H_
+#define _IPU_INTERN_H_
+#include <linux/dmaengine.h>
+#include <linux/platform_device.h>
+#include <linux/interrupt.h>
+/* IPU Common registers */
+#define IPU_CONF                0x00
+#define IPU_CHA_BUF0_RDY        0x04
+#define IPU_CHA_BUF1_RDY        0x08
+#define IPU_CHA_DB_MODE_SEL     0x0C
+#define IPU_CHA_CUR_BUF         0x10
+#define IPU_FS_PROC_FLOW        0x14
+#define IPU_FS_DISP_FLOW        0x18
+#define IPU_TASKS_STAT          0x1C
+#define IPU_IMA_ADDR            0x20
+#define IPU_IMA_DATA            0x24
+#define IPU_INT_CTRL_1          0x28
+#define IPU_INT_CTRL_2          0x2C
+#define IPU_INT_CTRL_3          0x30
+#define IPU_INT_CTRL_4          0x34
+#define IPU_INT_CTRL_5          0x38
+#define IPU_INT_STAT_1          0x3C
+#define IPU_INT_STAT_2          0x40
+#define IPU_INT_STAT_3          0x44
+#define IPU_INT_STAT_4          0x48
+#define IPU_INT_STAT_5          0x4C
+#define IPU_BRK_CTRL_1          0x50
+#define IPU_BRK_CTRL_2          0x54
+#define IPU_BRK_STAT            0x58
+#define IPU_DIAGB_CTRL          0x5C
+/* IPU_CONF Register bits */
+#define IPU_CONF_CSI_EN         0x00000001
+#define IPU_CONF_IC_EN          0x00000002
+#define IPU_CONF_ROT_EN         0x00000004
+#define IPU_CONF_PF_EN          0x00000008
+#define IPU_CONF_SDC_EN         0x00000010
+#define IPU_CONF_ADC_EN         0x00000020
+#define IPU_CONF_DI_EN          0x00000040
+#define IPU_CONF_DU_EN          0x00000080
+#define IPU_CONF_PXL_ENDIAN     0x00000100
+/* Image Converter Registers */
+#define IC_CONF                 0x88
+#define IC_PRP_ENC_RSC          0x8C
+#define IC_PRP_VF_RSC           0x90
+#define IC_PP_RSC               0x94
+#define IC_CMBP_1               0x98
+#define IC_CMBP_2               0x9C
+#define PF_CONF                 0xA0
+#define IDMAC_CONF              0xA4
+#define IDMAC_CHA_EN            0xA8
+#define IDMAC_CHA_PRI           0xAC
+#define IDMAC_CHA_BUSY          0xB0
+/* Image Converter Register bits */
+#define IC_CONF_PRPENC_EN       0x00000001
+#define IC_CONF_PRPENC_CSC1     0x00000002
+#define IC_CONF_PRPENC_ROT_EN   0x00000004
+#define IC_CONF_PRPVF_EN        0x00000100
+#define IC_CONF_PRPVF_CSC1      0x00000200
+#define IC_CONF_PRPVF_CSC2      0x00000400
+#define IC_CONF_PRPVF_CMB       0x00000800
+#define IC_CONF_PRPVF_ROT_EN    0x00001000
+#define IC_CONF_PP_EN           0x00010000
+#define IC_CONF_PP_CSC1         0x00020000
+#define IC_CONF_PP_CSC2         0x00040000
+#define IC_CONF_PP_CMB          0x00080000
+#define IC_CONF_PP_ROT_EN       0x00100000
+#define IC_CONF_IC_GLB_LOC_A    0x10000000
+#define IC_CONF_KEY_COLOR_EN    0x20000000
+#define IC_CONF_RWS_EN          0x40000000
+#define IC_CONF_CSI_MEM_WR_EN   0x80000000
+#define IDMA_CHAN_INVALID       0x000000FF
+#define IDMA_IC_0               0x00000001
+#define IDMA_IC_1               0x00000002
+#define IDMA_IC_2               0x00000004
+#define IDMA_IC_3               0x00000008
+#define IDMA_IC_4               0x00000010
+#define IDMA_IC_5               0x00000020
+#define IDMA_IC_6               0x00000040
+#define IDMA_IC_7               0x00000080
+#define IDMA_IC_8               0x00000100
+#define IDMA_IC_9               0x00000200
+#define IDMA_IC_10              0x00000400
+#define IDMA_IC_11              0x00000800
+#define IDMA_IC_12              0x00001000
+#define IDMA_IC_13              0x00002000
+#define IDMA_SDC_BG             0x00004000
+#define IDMA_SDC_FG             0x00008000
+#define IDMA_SDC_MASK           0x00010000
+#define IDMA_SDC_PARTIAL        0x00020000
+#define IDMA_ADC_SYS1_WR        0x00040000
+#define IDMA_ADC_SYS2_WR        0x00080000
+#define IDMA_ADC_SYS1_CMD       0x00100000
+#define IDMA_ADC_SYS2_CMD       0x00200000
+#define IDMA_ADC_SYS1_RD        0x00400000
+#define IDMA_ADC_SYS2_RD        0x00800000
+#define IDMA_PF_QP              0x01000000
+#define IDMA_PF_BSP             0x02000000
+#define IDMA_PF_Y_IN            0x04000000
+#define IDMA_PF_U_IN            0x08000000
+#define IDMA_PF_V_IN            0x10000000
+#define IDMA_PF_Y_OUT           0x20000000
+#define IDMA_PF_U_OUT           0x40000000
+#define IDMA_PF_V_OUT           0x80000000
+#define TSTAT_PF_H264_PAUSE     0x00000001
+#define TSTAT_CSI2MEM_MASK      0x0000000C
+#define TSTAT_CSI2MEM_OFFSET    2
+#define TSTAT_VF_MASK           0x00000600
+#define TSTAT_VF_OFFSET         9
+#define TSTAT_VF_ROT_MASK       0x000C0000
+#define TSTAT_VF_ROT_OFFSET     18
+#define TSTAT_ENC_MASK          0x00000180
+#define TSTAT_ENC_OFFSET        7
+#define TSTAT_ENC_ROT_MASK      0x00030000
+#define TSTAT_ENC_ROT_OFFSET    16
+#define TSTAT_PP_MASK           0x00001800
+#define TSTAT_PP_OFFSET         11
+#define TSTAT_PP_ROT_MASK       0x00300000
+#define TSTAT_PP_ROT_OFFSET     20
+#define TSTAT_PF_MASK           0x00C00000
+#define TSTAT_PF_OFFSET         22
+#define TSTAT_ADCSYS1_MASK      0x03000000
+#define TSTAT_ADCSYS1_OFFSET    24
+#define TSTAT_ADCSYS2_MASK      0x0C000000
+#define TSTAT_ADCSYS2_OFFSET    26
+#define TASK_STAT_IDLE          0
+#define TASK_STAT_ACTIVE        1
+#define TASK_STAT_WAIT4READY    2
+struct idmac {
+        struct dma_device       dma;
+};
+struct ipu {
+        void __iomem            *reg_ipu;
+        void __iomem            *reg_ic;
+        unsigned int            irq_fn;         /* IPU Function IRQ to the CPU */
+        unsigned int            irq_err;        /* IPU Error IRQ to the CPU */
+        unsigned int            irq_base;       /* Beginning of the IPU IRQ range */
+        unsigned long           channel_init_mask;
+        spinlock_t              lock;
+        struct clk              *ipu_clk;
+        struct device           *dev;
+        struct idmac            idmac;
+        struct idmac_channel    channel[IPU_CHANNELS_NUM];
+        struct tasklet_struct   tasklet;
+};
+#define to_idmac(d) container_of(d, struct idmac, dma)
+extern int ipu_irq_attach_irq(struct ipu *ipu, struct platform_device *dev);
+extern void ipu_irq_detach_irq(struct ipu *ipu, struct platform_device *dev);
+extern bool ipu_irq_status(uint32_t irq);
+extern int ipu_irq_map(unsigned int source);
+extern int ipu_irq_unmap(unsigned int source);
+#endif
diff --git a/drivers/dma/ipu/ipu_irq.c b/drivers/dma/ipu/ipu_irq.c
new file mode 100644
index 000000000000..83f532cc767f
--- /dev/null
+++ b/drivers/dma/ipu/ipu_irq.c
@@ -0,0 +1,413 @@
+/*
+ * Copyright (C) 2008
+ * Guennadi Liakhovetski, DENX Software Engineering, <lg@denx.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/init.h>
+#include <linux/err.h>
+#include <linux/spinlock.h>
+#include <linux/delay.h>
+#include <linux/clk.h>
+#include <linux/irq.h>
+#include <linux/io.h>
+#include <mach/ipu.h>
+#include "ipu_intern.h"
+/*
+ * Register read / write - shall be inlined by the compiler
+ */
+static u32 ipu_read_reg(struct ipu *ipu, unsigned long reg)
+{
+        return __raw_readl(ipu->reg_ipu + reg);
+}
+static void ipu_write_reg(struct ipu *ipu, u32 value, unsigned long reg)
+{
+        __raw_writel(value, ipu->reg_ipu + reg);
+}
+/*
+ * IPU IRQ chip driver
+ */
+#define IPU_IRQ_NR_FN_BANKS 3
+#define IPU_IRQ_NR_ERR_BANKS 2
+#define IPU_IRQ_NR_BANKS (IPU_IRQ_NR_FN_BANKS + IPU_IRQ_NR_ERR_BANKS)
+struct ipu_irq_bank {
+        unsigned int    control;
+        unsigned int    status;
+        spinlock_t      lock;
+        struct ipu      *ipu;
+};
+static struct ipu_irq_bank irq_bank[IPU_IRQ_NR_BANKS] = {
+        /* 3 groups of functional interrupts */
+        {
+                .control        = IPU_INT_CTRL_1,
+                .status         = IPU_INT_STAT_1,
+        }, {
+                .control        = IPU_INT_CTRL_2,
+                .status         = IPU_INT_STAT_2,
+        }, {
+                .control        = IPU_INT_CTRL_3,
+                .status         = IPU_INT_STAT_3,
+        },
+        /* 2 groups of error interrupts */
+        {
+                .control        = IPU_INT_CTRL_4,
+                .status         = IPU_INT_STAT_4,
+        }, {
+                .control        = IPU_INT_CTRL_5,
+                .status         = IPU_INT_STAT_5,
+        },
+};
+struct ipu_irq_map {
+        unsigned int            irq;
+        int                     source;
+        struct ipu_irq_bank     *bank;
+        struct ipu              *ipu;
+};
+static struct ipu_irq_map irq_map[CONFIG_MX3_IPU_IRQS];
+/* Protects allocations from the above array of maps */
+static DEFINE_MUTEX(map_lock);
+/* Protects register accesses and individual mappings */
+static DEFINE_SPINLOCK(bank_lock);
+static struct ipu_irq_map *src2map(unsigned int src)
+{
+        int i;
+        for (i = 0; i < CONFIG_MX3_IPU_IRQS; i++)
+                if (irq_map[i].source == src)
+                        return irq_map + i;
+        return NULL;
+}
+static void ipu_irq_unmask(unsigned int irq)
+{
+        struct ipu_irq_map *map = get_irq_chip_data(irq);
+        struct ipu_irq_bank *bank;
+        uint32_t reg;
+        unsigned long lock_flags;
+        spin_lock_irqsave(&bank_lock, lock_flags);
+        bank = map->bank;
+        if (!bank) {
+                spin_unlock_irqrestore(&bank_lock, lock_flags);
+                pr_err("IPU: %s(%u) - unmapped!\n", __func__, irq);
+                return;
+        }
+        reg = ipu_read_reg(bank->ipu, bank->control);
+        reg |= (1UL << (map->source & 31));
+        ipu_write_reg(bank->ipu, reg, bank->control);
+        spin_unlock_irqrestore(&bank_lock, lock_flags);
+}
+static void ipu_irq_mask(unsigned int irq)
+{
+        struct ipu_irq_map *map = get_irq_chip_data(irq);
+        struct ipu_irq_bank *bank;
+        uint32_t reg;
+        unsigned long lock_flags;
+        spin_lock_irqsave(&bank_lock, lock_flags);
+        bank = map->bank;
+        if (!bank) {
+                spin_unlock_irqrestore(&bank_lock, lock_flags);
+                pr_err("IPU: %s(%u) - unmapped!\n", __func__, irq);
+                return;
+        }
+        reg = ipu_read_reg(bank->ipu, bank->control);
+        reg &= ~(1UL << (map->source & 31));
+        ipu_write_reg(bank->ipu, reg, bank->control);
+        spin_unlock_irqrestore(&bank_lock, lock_flags);
+}
+static void ipu_irq_ack(unsigned int irq)
+{
+        struct ipu_irq_map *map = get_irq_chip_data(irq);
+        struct ipu_irq_bank *bank;
+        unsigned long lock_flags;
+        spin_lock_irqsave(&bank_lock, lock_flags);
+        bank = map->bank;
+        if (!bank) {
+                spin_unlock_irqrestore(&bank_lock, lock_flags);
+                pr_err("IPU: %s(%u) - unmapped!\n", __func__, irq);
+                return;
+        }
+        ipu_write_reg(bank->ipu, 1UL << (map->source & 31), bank->status);
+        spin_unlock_irqrestore(&bank_lock, lock_flags);
+}
+/**
+ * ipu_irq_status() - returns the current interrupt status of the specified IRQ.
+ * @irq:        interrupt line to get status for.
+ * @return:     true if the interrupt is pending/asserted or false if the
+ *              interrupt is not pending.
+ */
+bool ipu_irq_status(unsigned int irq)
+{
+        struct ipu_irq_map *map = get_irq_chip_data(irq);
+        struct ipu_irq_bank *bank;
+        unsigned long lock_flags;
+        bool ret;
+        spin_lock_irqsave(&bank_lock, lock_flags);
+        bank = map->bank;
+        ret = bank && ipu_read_reg(bank->ipu, bank->status) &
+                (1UL << (map->source & 31));
+        spin_unlock_irqrestore(&bank_lock, lock_flags);
+        return ret;
+}
+/**
+ * ipu_irq_map() - map an IPU interrupt source to an IRQ number
+ * @source:     interrupt source bit position (see below)
+ * @return:     mapped IRQ number or negative error code
+ *
+ * The source parameter has to be explained further. On i.MX31 IPU has 137 IRQ
+ * sources, they are broken down in 5 32-bit registers, like 32, 32, 24, 32, 17.
+ * However, the source argument of this function is not the sequence number of
+ * the possible IRQ, but rather its bit position. So, first interrupt in fourth
+ * register has source number 96, and not 88. This makes calculations easier,
+ * and also provides forward compatibility with any future IPU implementations
+ * with any interrupt bit assignments.
+ */
+int ipu_irq_map(unsigned int source)
+{
+        int i, ret = -ENOMEM;
+        struct ipu_irq_map *map;
+        might_sleep();
+        mutex_lock(&map_lock);
+        map = src2map(source);
+        if (map) {
+                pr_err("IPU: Source %u already mapped to IRQ %u\n", source, map->irq);
+                ret = -EBUSY;
+                goto out;
+        }
+        for (i = 0; i < CONFIG_MX3_IPU_IRQS; i++) {
+                if (irq_map[i].source < 0) {
+                        unsigned long lock_flags;
+                        spin_lock_irqsave(&bank_lock, lock_flags);
+                        irq_map[i].source = source;
+                        irq_map[i].bank = irq_bank + source / 32;
+                        spin_unlock_irqrestore(&bank_lock, lock_flags);
+                        ret = irq_map[i].irq;
+                        pr_debug("IPU: mapped source %u to IRQ %u\n",
+                                 source, ret);
+                        break;
+                }
+        }
+out:
+        mutex_unlock(&map_lock);
+        if (ret < 0)
+                pr_err("IPU: couldn't map source %u: %d\n", source, ret);
+        return ret;
+}
+/**
+ * ipu_irq_map() - map an IPU interrupt source to an IRQ number
+ * @source:     interrupt source bit position (see ipu_irq_map())
+ * @return:     0 or negative error code
+ */
+int ipu_irq_unmap(unsigned int source)
+{
+        int i, ret = -EINVAL;
+        might_sleep();
+        mutex_lock(&map_lock);
+        for (i = 0; i < CONFIG_MX3_IPU_IRQS; i++) {
+                if (irq_map[i].source == source) {
+                        unsigned long lock_flags;
+                        pr_debug("IPU: unmapped source %u from IRQ %u\n",
+                                 source, irq_map[i].irq);
+                        spin_lock_irqsave(&bank_lock, lock_flags);
+                        irq_map[i].source = -EINVAL;
+                        irq_map[i].bank = NULL;
+                        spin_unlock_irqrestore(&bank_lock, lock_flags);
+                        ret = 0;
+                        break;
+                }
+        }
+        mutex_unlock(&map_lock);
+        return ret;
+}
+/* Chained IRQ handler for IPU error interrupt */
+static void ipu_irq_err(unsigned int irq, struct irq_desc *desc)
+{
+        struct ipu *ipu = get_irq_data(irq);
+        u32 status;
+        int i, line;
+        for (i = IPU_IRQ_NR_FN_BANKS; i < IPU_IRQ_NR_BANKS; i++) {
+                struct ipu_irq_bank *bank = irq_bank + i;
+                spin_lock(&bank_lock);
+                status = ipu_read_reg(ipu, bank->status);
+                /*
+                 * Don't think we have to clear all interrupts here, they will
+                 * be acked by ->handle_irq() (handle_level_irq). However, we
+                 * might want to clear unhandled interrupts after the loop...
+                 */
+                status &= ipu_read_reg(ipu, bank->control);
+                spin_unlock(&bank_lock);
+                while ((line = ffs(status))) {
+                        struct ipu_irq_map *map;
+                        line--;
+                        status &= ~(1UL << line);
+                        spin_lock(&bank_lock);
+                        map = src2map(32 * i + line);
+                        if (map)
+                                irq = map->irq;
+                        spin_unlock(&bank_lock);
+                        if (!map) {
+                                pr_err("IPU: Interrupt on unmapped source %u bank %d\n",
+                                       line, i);
+                                continue;
+                        }
+                        generic_handle_irq(irq);
+                }
+        }
+}
+/* Chained IRQ handler for IPU function interrupt */
+static void ipu_irq_fn(unsigned int irq, struct irq_desc *desc)
+{
+        struct ipu *ipu = get_irq_data(irq);
+        u32 status;
+        int i, line;
+        for (i = 0; i < IPU_IRQ_NR_FN_BANKS; i++) {
+                struct ipu_irq_bank *bank = irq_bank + i;
+                spin_lock(&bank_lock);
+                status = ipu_read_reg(ipu, bank->status);
+                /* Not clearing all interrupts, see above */
+                status &= ipu_read_reg(ipu, bank->control);
+                spin_unlock(&bank_lock);
+                while ((line = ffs(status))) {
+                        struct ipu_irq_map *map;
+                        line--;
+                        status &= ~(1UL << line);
+                        spin_lock(&bank_lock);
+                        map = src2map(32 * i + line);
+                        if (map)
+                                irq = map->irq;
+                        spin_unlock(&bank_lock);
+                        if (!map) {
+                                pr_err("IPU: Interrupt on unmapped source %u bank %d\n",
+                                       line, i);
+                                continue;
+                        }
+                        generic_handle_irq(irq);
+                }
+        }
+}
+static struct irq_chip ipu_irq_chip = {
+        .name   = "ipu_irq",
+        .ack    = ipu_irq_ack,
+        .mask   = ipu_irq_mask,
+        .unmask = ipu_irq_unmask,
+};
+/* Install the IRQ handler */
+int ipu_irq_attach_irq(struct ipu *ipu, struct platform_device *dev)
+{
+        struct ipu_platform_data *pdata = dev->dev.platform_data;
+        unsigned int irq, irq_base, i;
+        irq_base = pdata->irq_base;
+        for (i = 0; i < IPU_IRQ_NR_BANKS; i++)
+                irq_bank[i].ipu = ipu;
+        for (i = 0; i < CONFIG_MX3_IPU_IRQS; i++) {
+                int ret;
+                irq = irq_base + i;
+                ret = set_irq_chip(irq, &ipu_irq_chip);
+                if (ret < 0)
+                        return ret;
+                ret = set_irq_chip_data(irq, irq_map + i);
+                if (ret < 0)
+                        return ret;
+                irq_map[i].ipu = ipu;
+                irq_map[i].irq = irq;
+                irq_map[i].source = -EINVAL;
+                set_irq_handler(irq, handle_level_irq);
+#ifdef CONFIG_ARM
+                set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
+#endif
+        }
+        set_irq_data(ipu->irq_fn, ipu);
+        set_irq_chained_handler(ipu->irq_fn, ipu_irq_fn);
+        set_irq_data(ipu->irq_err, ipu);
+        set_irq_chained_handler(ipu->irq_err, ipu_irq_err);
+        return 0;
+}
+void ipu_irq_detach_irq(struct ipu *ipu, struct platform_device *dev)
+{
+        struct ipu_platform_data *pdata = dev->dev.platform_data;
+        unsigned int irq, irq_base;
+        irq_base = pdata->irq_base;
+        set_irq_chained_handler(ipu->irq_fn, NULL);
+        set_irq_data(ipu->irq_fn, NULL);
+        set_irq_chained_handler(ipu->irq_err, NULL);
+        set_irq_data(ipu->irq_err, NULL);
+        for (irq = irq_base; irq < irq_base + CONFIG_MX3_IPU_IRQS; irq++) {
+#ifdef CONFIG_ARM
+                set_irq_flags(irq, 0);
+#endif
+                set_irq_chip(irq, NULL);
+                set_irq_chip_data(irq, NULL);
+        }
+}
diff --git a/drivers/edac/cell_edac.c b/drivers/edac/cell_edac.c
index cd2e3b8087e7..24f3ca851523 100644
--- a/drivers/edac/cell_edac.c
+++ b/drivers/edac/cell_edac.c
@@ -36,7 +36,7 @@ static void cell_edac_count_ce(struct mem_ctl_info *mci, int chan, u64 ar)
        struct csrow_info               *csrow = &mci->csrows[0];
        unsigned long                   address, pfn, offset, syndrome;
-        dev_dbg(mci->dev, "ECC CE err on node %d, channel %d, ar = 0x%016lx\n",
+        dev_dbg(mci->dev, "ECC CE err on node %d, channel %d, ar = 0x%016llx\n",
                priv->node, chan, ar);
        /* Address decoding is likely a bit bogus, to dbl check */
@@ -58,7 +58,7 @@ static void cell_edac_count_ue(struct mem_ctl_info *mci, int chan, u64 ar)
        struct csrow_info               *csrow = &mci->csrows[0];
        unsigned long                   address, pfn, offset;
-        dev_dbg(mci->dev, "ECC UE err on node %d, channel %d, ar = 0x%016lx\n",
+        dev_dbg(mci->dev, "ECC UE err on node %d, channel %d, ar = 0x%016llx\n",
                priv->node, chan, ar);
        /* Address decoding is likely a bit bogus, to dbl check */
@@ -169,7 +169,7 @@ static int __devinit cell_edac_probe(struct platform_device *pdev)
        /* Get channel population */
        reg = in_be64(&regs->mic_mnt_cfg);
-        dev_dbg(&pdev->dev, "MIC_MNT_CFG = 0x%016lx\n", reg);
+        dev_dbg(&pdev->dev, "MIC_MNT_CFG = 0x%016llx\n", reg);
        chanmask = 0;
        if (reg & CBE_MIC_MNT_CFG_CHAN_0_POP)
                chanmask |= 0x1;
@@ -180,7 +180,7 @@ static int __devinit cell_edac_probe(struct platform_device *pdev)
                         "Yuck ! No channel populated ? Aborting !\n");
                return -ENODEV;
        }
-        dev_dbg(&pdev->dev, "Initial FIR = 0x%016lx\n",
+        dev_dbg(&pdev->dev, "Initial FIR = 0x%016llx\n",
                in_be64(&regs->mic_fir));
        /* Allocate & init EDAC MC data structure */
diff --git a/drivers/firewire/fw-card.c b/drivers/firewire/fw-card.c
index 6bd91a15d5e6..a5dd7a665aa8 100644
--- a/drivers/firewire/fw-card.c
+++ b/drivers/firewire/fw-card.c
@@ -232,7 +232,7 @@ fw_card_bm_work(struct work_struct *work)
        root_id = root_node->node_id;
        grace = time_after(jiffies, card->reset_jiffies + DIV_ROUND_UP(HZ, 10));
-        if (card->bm_generation + 1 == generation ||
+        if (is_next_generation(generation, card->bm_generation) ||
            (card->bm_generation != generation && grace)) {
                /*
                 * This first step is to figure out who is IRM and
@@ -412,6 +412,7 @@ fw_card_add(struct fw_card *card,
 {
        u32 *config_rom;
        size_t length;
+        int err;
        card->max_receive = max_receive;
        card->link_speed = link_speed;
@@ -422,7 +423,13 @@ fw_card_add(struct fw_card *card,
        list_add_tail(&card->link, &card_list);
        mutex_unlock(&card_mutex);
-        return card->driver->enable(card, config_rom, length);
+        err = card->driver->enable(card, config_rom, length);
+        if (err < 0) {
+                mutex_lock(&card_mutex);
+                list_del(&card->link);
+                mutex_unlock(&card_mutex);
+        }
+        return err;
 }
 EXPORT_SYMBOL(fw_card_add);
@@ -512,7 +519,7 @@ fw_core_remove_card(struct fw_card *card)
        fw_core_initiate_bus_reset(card, 1);
        mutex_lock(&card_mutex);
-        list_del(&card->link);
+        list_del_init(&card->link);
        mutex_unlock(&card_mutex);
        /* Set up the dummy driver. */
diff --git a/drivers/firewire/fw-device.c b/drivers/firewire/fw-device.c
index 2af5a8d1e012..bf53acb45652 100644
--- a/drivers/firewire/fw-device.c
+++ b/drivers/firewire/fw-device.c
@@ -25,6 +25,7 @@
 #include <linux/device.h>
 #include <linux/delay.h>
 #include <linux/idr.h>
+#include <linux/jiffies.h>
 #include <linux/string.h>
 #include <linux/rwsem.h>
 #include <linux/semaphore.h>
@@ -634,12 +635,39 @@ struct fw_device *fw_device_get_by_devt(dev_t devt)
        return device;
 }
+/*
+ * These defines control the retry behavior for reading the config
+ * rom.  It shouldn't be necessary to tweak these; if the device
+ * doesn't respond to a config rom read within 10 seconds, it's not
+ * going to respond at all.  As for the initial delay, a lot of
+ * devices will be able to respond within half a second after bus
+ * reset.  On the other hand, it's not really worth being more
+ * aggressive than that, since it scales pretty well; if 10 devices
+ * are plugged in, they're all getting read within one second.
+ */
+#define MAX_RETRIES     10
+#define RETRY_DELAY     (3 * HZ)
+#define INITIAL_DELAY   (HZ / 2)
+#define SHUTDOWN_DELAY  (2 * HZ)
 static void fw_device_shutdown(struct work_struct *work)
 {
        struct fw_device *device =
                container_of(work, struct fw_device, work.work);
        int minor = MINOR(device->device.devt);
+        if (time_is_after_jiffies(device->card->reset_jiffies + SHUTDOWN_DELAY)
+            && !list_empty(&device->card->link)) {
+                schedule_delayed_work(&device->work, SHUTDOWN_DELAY);
+                return;
+        }
+        if (atomic_cmpxchg(&device->state,
+                           FW_DEVICE_GONE,
+                           FW_DEVICE_SHUTDOWN) != FW_DEVICE_GONE)
+                return;
        fw_device_cdev_remove(device);
        device_for_each_child(&device->device, NULL, shutdown_unit);
        device_unregister(&device->device);
@@ -647,6 +675,7 @@ static void fw_device_shutdown(struct work_struct *work)
        down_write(&fw_device_rwsem);
        idr_remove(&fw_device_idr, minor);
        up_write(&fw_device_rwsem);
        fw_device_put(device);
 }
@@ -654,25 +683,63 @@ static struct device_type fw_device_type = {
        .release        = fw_device_release,
 };
+static void fw_device_update(struct work_struct *work);
 /*
- * These defines control the retry behavior for reading the config
+ * If a device was pending for deletion because its node went away but its
- * rom.  It shouldn't be necessary to tweak these; if the device
+ * bus info block and root directory header matches that of a newly discovered
- * doesn't respond to a config rom read within 10 seconds, it's not
+ * device, revive the existing fw_device.
- * going to respond at all.  As for the initial delay, a lot of
+ * The newly allocated fw_device becomes obsolete instead.
- * devices will be able to respond within half a second after bus
- * reset.  On the other hand, it's not really worth being more
- * aggressive than that, since it scales pretty well; if 10 devices
- * are plugged in, they're all getting read within one second.
 */
+static int lookup_existing_device(struct device *dev, void *data)
+{
+        struct fw_device *old = fw_device(dev);
+        struct fw_device *new = data;
+        struct fw_card *card = new->card;
+        int match = 0;
+        down_read(&fw_device_rwsem); /* serialize config_rom access */
+        spin_lock_irq(&card->lock);  /* serialize node access */
+        if (memcmp(old->config_rom, new->config_rom, 6 * 4) == 0 &&
+            atomic_cmpxchg(&old->state,
+                           FW_DEVICE_GONE,
+                           FW_DEVICE_RUNNING) == FW_DEVICE_GONE) {
+                struct fw_node *current_node = new->node;
+                struct fw_node *obsolete_node = old->node;
+                new->node = obsolete_node;
+                new->node->data = new;
+                old->node = current_node;
+                old->node->data = old;
+                old->max_speed = new->max_speed;
+                old->node_id = current_node->node_id;
+                smp_wmb();  /* update node_id before generation */
+                old->generation = card->generation;
+                old->config_rom_retries = 0;
+                fw_notify("rediscovered device %s\n", dev_name(dev));
-#define MAX_RETRIES     10
+                PREPARE_DELAYED_WORK(&old->work, fw_device_update);
-#define RETRY_DELAY     (3 * HZ)
+                schedule_delayed_work(&old->work, 0);
-#define INITIAL_DELAY   (HZ / 2)
+                if (current_node == card->root_node)
+                        fw_schedule_bm_work(card, 0);
+                match = 1;
+        }
+        spin_unlock_irq(&card->lock);
+        up_read(&fw_device_rwsem);
+        return match;
+}
 static void fw_device_init(struct work_struct *work)
 {
        struct fw_device *device =
                container_of(work, struct fw_device, work.work);
+        struct device *revived_dev;
        int minor, err;
        /*
@@ -696,6 +763,15 @@ static void fw_device_init(struct work_struct *work)
                return;
        }
+        revived_dev = device_find_child(device->card->device,
+                                        device, lookup_existing_device);
+        if (revived_dev) {
+                put_device(revived_dev);
+                fw_device_release(&device->device);
+                return;
+        }
        device_initialize(&device->device);
        fw_device_get(device);
@@ -734,9 +810,10 @@ static void fw_device_init(struct work_struct *work)
         * fw_node_event().
         */
        if (atomic_cmpxchg(&device->state,
-                    FW_DEVICE_INITIALIZING,
+                           FW_DEVICE_INITIALIZING,
-                    FW_DEVICE_RUNNING) == FW_DEVICE_SHUTDOWN) {
+                           FW_DEVICE_RUNNING) == FW_DEVICE_GONE) {
-                fw_device_shutdown(work);
+                PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
+                schedule_delayed_work(&device->work, SHUTDOWN_DELAY);
        } else {
                if (device->config_rom_retries)
                        fw_notify("created device %s: GUID %08x%08x, S%d00, "
@@ -847,8 +924,8 @@ static void fw_device_refresh(struct work_struct *work)
        case REREAD_BIB_UNCHANGED:
                if (atomic_cmpxchg(&device->state,
-                            FW_DEVICE_INITIALIZING,
+                                   FW_DEVICE_INITIALIZING,
-                            FW_DEVICE_RUNNING) == FW_DEVICE_SHUTDOWN)
+                                   FW_DEVICE_RUNNING) == FW_DEVICE_GONE)
                        goto gone;
                fw_device_update(work);
@@ -879,8 +956,8 @@ static void fw_device_refresh(struct work_struct *work)
        create_units(device);
        if (atomic_cmpxchg(&device->state,
-                    FW_DEVICE_INITIALIZING,
+                           FW_DEVICE_INITIALIZING,
-                    FW_DEVICE_RUNNING) == FW_DEVICE_SHUTDOWN)
+                           FW_DEVICE_RUNNING) == FW_DEVICE_GONE)
                goto gone;
        fw_notify("refreshed device %s\n", dev_name(&device->device));
@@ -890,8 +967,9 @@ static void fw_device_refresh(struct work_struct *work)
 give_up:
        fw_notify("giving up on refresh of device %s\n", dev_name(&device->device));
 gone:
-        atomic_set(&device->state, FW_DEVICE_SHUTDOWN);
+        atomic_set(&device->state, FW_DEVICE_GONE);
-        fw_device_shutdown(work);
+        PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
+        schedule_delayed_work(&device->work, SHUTDOWN_DELAY);
 out:
        if (node_id == card->root_node->node_id)
                fw_schedule_bm_work(card, 0);
@@ -995,9 +1073,10 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                 */
                device = node->data;
                if (atomic_xchg(&device->state,
-                                FW_DEVICE_SHUTDOWN) == FW_DEVICE_RUNNING) {
+                                FW_DEVICE_GONE) == FW_DEVICE_RUNNING) {
                        PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
-                        schedule_delayed_work(&device->work, 0);
+                        schedule_delayed_work(&device->work,
+                                list_empty(&card->link) ? 0 : SHUTDOWN_DELAY);
                }
                break;
        }
diff --git a/drivers/firewire/fw-device.h b/drivers/firewire/fw-device.h
index df51732608d9..8ef6ec2ca21c 100644
--- a/drivers/firewire/fw-device.h
+++ b/drivers/firewire/fw-device.h
@@ -28,6 +28,7 @@
 enum fw_device_state {
        FW_DEVICE_INITIALIZING,
        FW_DEVICE_RUNNING,
+        FW_DEVICE_GONE,
        FW_DEVICE_SHUTDOWN,
 };
diff --git a/drivers/firewire/fw-ohci.c b/drivers/firewire/fw-ohci.c
index ab9c01e462ef..6d19828a93a5 100644
--- a/drivers/firewire/fw-ohci.c
+++ b/drivers/firewire/fw-ohci.c
@@ -226,7 +226,7 @@ static inline struct fw_ohci *fw_ohci(struct fw_card *card)
 #define CONTEXT_DEAD    0x0800
 #define CONTEXT_ACTIVE  0x0400
-#define OHCI1394_MAX_AT_REQ_RETRIES     0x2
+#define OHCI1394_MAX_AT_REQ_RETRIES     0xf
 #define OHCI1394_MAX_AT_RESP_RETRIES    0x2
 #define OHCI1394_MAX_PHYS_RESP_RETRIES  0x8
@@ -896,11 +896,11 @@ static void context_stop(struct context *ctx)
        for (i = 0; i < 10; i++) {
                reg = reg_read(ctx->ohci, CONTROL_SET(ctx->regs));
                if ((reg & CONTEXT_ACTIVE) == 0)
-                        break;
+                        return;
-                fw_notify("context_stop: still active (0x%08x)\n", reg);
                mdelay(1);
        }
+        fw_error("Error: DMA context still active (0x%08x)\n", reg);
 }
 struct driver_data {
diff --git a/drivers/firewire/fw-sbp2.c b/drivers/firewire/fw-sbp2.c
index e88d5067448c..c71c4419d9e8 100644
--- a/drivers/firewire/fw-sbp2.c
+++ b/drivers/firewire/fw-sbp2.c
@@ -168,6 +168,7 @@ struct sbp2_target {
        int address_high;
        unsigned int workarounds;
        unsigned int mgt_orb_timeout;
+        unsigned int max_payload;
        int dont_block; /* counter for each logical unit */
        int blocked;    /* ditto */
@@ -310,14 +311,16 @@ struct sbp2_command_orb {
        dma_addr_t page_table_bus;
 };
+#define SBP2_ROM_VALUE_WILDCARD ~0         /* match all */
+#define SBP2_ROM_VALUE_MISSING  0xff000000 /* not present in the unit dir. */
 /*
 * List of devices with known bugs.
 *
 * The firmware_revision field, masked with 0xffff00, is the best
 * indicator for the type of bridge chip of a device.  It yields a few
 * false positives but this did not break correctly behaving devices
- * so far.  We use ~0 as a wildcard, since the 24 bit values we get
+ * so far.
- * from the config rom can never match that.
 */
 static const struct {
        u32 firmware_revision;
@@ -339,33 +342,35 @@ static const struct {
        },
        /* Initio bridges, actually only needed for some older ones */ {
                .firmware_revision      = 0x000200,
-                .model                  = ~0,
+                .model                  = SBP2_ROM_VALUE_WILDCARD,
                .workarounds            = SBP2_WORKAROUND_INQUIRY_36,
        },
        /* PL-3507 bridge with Prolific firmware */ {
                .firmware_revision      = 0x012800,
-                .model                  = ~0,
+                .model                  = SBP2_ROM_VALUE_WILDCARD,
                .workarounds            = SBP2_WORKAROUND_POWER_CONDITION,
        },
        /* Symbios bridge */ {
                .firmware_revision      = 0xa0b800,
-                .model                  = ~0,
+                .model                  = SBP2_ROM_VALUE_WILDCARD,
                .workarounds            = SBP2_WORKAROUND_128K_MAX_TRANS,
        },
        /* Datafab MD2-FW2 with Symbios/LSILogic SYM13FW500 bridge */ {
                .firmware_revision      = 0x002600,
-                .model                  = ~0,
+                .model                  = SBP2_ROM_VALUE_WILDCARD,
                .workarounds            = SBP2_WORKAROUND_128K_MAX_TRANS,
        },
        /*
-         * There are iPods (2nd gen, 3rd gen) with model_id == 0, but
+         * iPod 2nd generation: needs 128k max transfer size workaround
-         * these iPods do not feature the read_capacity bug according
+         * iPod 3rd generation: needs fix capacity workaround
-         * to one report.  Read_capacity behaviour as well as model_id
-         * could change due to Apple-supplied firmware updates though.
         */
+        {
-        /* iPod 4th generation. */ {
+                .firmware_revision      = 0x0a2700,
+                .model                  = 0x000000,
+                .workarounds            = SBP2_WORKAROUND_128K_MAX_TRANS |
+                                          SBP2_WORKAROUND_FIX_CAPACITY,
+        },
+        /* iPod 4th generation */ {
                .firmware_revision      = 0x0a2700,
                .model                  = 0x000021,
                .workarounds            = SBP2_WORKAROUND_FIX_CAPACITY,
@@ -1092,7 +1097,7 @@ static void sbp2_init_workarounds(struct sbp2_target *tgt, u32 model,
                        continue;
                if (sbp2_workarounds_table[i].model != model &&
-                    sbp2_workarounds_table[i].model != ~0)
+                    sbp2_workarounds_table[i].model != SBP2_ROM_VALUE_WILDCARD)
                        continue;
                w |= sbp2_workarounds_table[i].workarounds;
@@ -1142,20 +1147,28 @@ static int sbp2_probe(struct device *dev)
        fw_device_get(device);
        fw_unit_get(unit);
-        /* Initialize to values that won't match anything in our table. */
-        firmware_revision = 0xff000000;
-        model = 0xff000000;
        /* implicit directory ID */
        tgt->directory_id = ((unit->directory - device->config_rom) * 4
                             + CSR_CONFIG_ROM) & 0xffffff;
+        firmware_revision = SBP2_ROM_VALUE_MISSING;
+        model             = SBP2_ROM_VALUE_MISSING;
        if (sbp2_scan_unit_dir(tgt, unit->directory, &model,
                               &firmware_revision) < 0)
                goto fail_tgt_put;
        sbp2_init_workarounds(tgt, model, firmware_revision);
+        /*
+         * At S100 we can do 512 bytes per packet, at S200 1024 bytes,
+         * and so on up to 4096 bytes.  The SBP-2 max_payload field
+         * specifies the max payload size as 2 ^ (max_payload + 2), so
+         * if we set this to max_speed + 7, we get the right value.
+         */
+        tgt->max_payload = min(device->max_speed + 7, 10U);
+        tgt->max_payload = min(tgt->max_payload, device->card->max_receive - 1);
        /* Do the login in a workqueue so we can easily reschedule retries. */
        list_for_each_entry(lu, &tgt->lu_list, link)
                sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5));
@@ -1273,6 +1286,19 @@ static struct fw_driver sbp2_driver = {
        .id_table = sbp2_id_table,
 };
+static void sbp2_unmap_scatterlist(struct device *card_device,
+                                   struct sbp2_command_orb *orb)
+{
+        if (scsi_sg_count(orb->cmd))
+                dma_unmap_sg(card_device, scsi_sglist(orb->cmd),
+                             scsi_sg_count(orb->cmd),
+                             orb->cmd->sc_data_direction);
+        if (orb->request.misc & cpu_to_be32(COMMAND_ORB_PAGE_TABLE_PRESENT))
+                dma_unmap_single(card_device, orb->page_table_bus,
+                                 sizeof(orb->page_table), DMA_TO_DEVICE);
+}
 static unsigned int
 sbp2_status_to_sense_data(u8 *sbp2_status, u8 *sense_data)
 {
@@ -1352,15 +1378,7 @@ complete_command_orb(struct sbp2_orb *base_orb, struct sbp2_status *status)
        dma_unmap_single(device->card->device, orb->base.request_bus,
                         sizeof(orb->request), DMA_TO_DEVICE);
+        sbp2_unmap_scatterlist(device->card->device, orb);
-        if (scsi_sg_count(orb->cmd) > 0)
-                dma_unmap_sg(device->card->device, scsi_sglist(orb->cmd),
-                             scsi_sg_count(orb->cmd),
-                             orb->cmd->sc_data_direction);
-        if (orb->page_table_bus != 0)
-                dma_unmap_single(device->card->device, orb->page_table_bus,
-                                 sizeof(orb->page_table), DMA_TO_DEVICE);
        orb->cmd->result = result;
        orb->done(orb->cmd);
@@ -1434,7 +1452,6 @@ static int sbp2_scsi_queuecommand(struct scsi_cmnd *cmd, scsi_done_fn_t done)
        struct sbp2_logical_unit *lu = cmd->device->hostdata;
        struct fw_device *device = fw_device(lu->tgt->unit->device.parent);
        struct sbp2_command_orb *orb;
-        unsigned int max_payload;
        int generation, retval = SCSI_MLQUEUE_HOST_BUSY;
        /*
@@ -1462,17 +1479,9 @@ static int sbp2_scsi_queuecommand(struct scsi_cmnd *cmd, scsi_done_fn_t done)
        orb->done = done;
        orb->cmd  = cmd;
-        orb->request.next.high   = cpu_to_be32(SBP2_ORB_NULL);
+        orb->request.next.high = cpu_to_be32(SBP2_ORB_NULL);
-        /*
-         * At speed 100 we can do 512 bytes per packet, at speed 200,
-         * 1024 bytes per packet etc.  The SBP-2 max_payload field
-         * specifies the max payload size as 2 ^ (max_payload + 2), so
-         * if we set this to max_speed + 7, we get the right value.
-         */
-        max_payload = min(device->max_speed + 7,
-                          device->card->max_receive - 1);
        orb->request.misc = cpu_to_be32(
-                COMMAND_ORB_MAX_PAYLOAD(max_payload) |
+                COMMAND_ORB_MAX_PAYLOAD(lu->tgt->max_payload) |
                COMMAND_ORB_SPEED(device->max_speed) |
                COMMAND_ORB_NOTIFY);
@@ -1491,8 +1500,10 @@ static int sbp2_scsi_queuecommand(struct scsi_cmnd *cmd, scsi_done_fn_t done)
        orb->base.request_bus =
                dma_map_single(device->card->device, &orb->request,
                               sizeof(orb->request), DMA_TO_DEVICE);
-        if (dma_mapping_error(device->card->device, orb->base.request_bus))
+        if (dma_mapping_error(device->card->device, orb->base.request_bus)) {
+                sbp2_unmap_scatterlist(device->card->device, orb);
                goto out;
+        }
        sbp2_send_orb(&orb->base, lu, lu->tgt->node_id, generation,
                      lu->command_block_agent_address + SBP2_ORB_POINTER);
diff --git a/drivers/firewire/fw-topology.c b/drivers/firewire/fw-topology.c
index c9be6e6948c4..8dd6703b55cd 100644
--- a/drivers/firewire/fw-topology.c
+++ b/drivers/firewire/fw-topology.c
@@ -518,6 +518,18 @@ fw_core_handle_bus_reset(struct fw_card *card,
        struct fw_node *local_node;
        unsigned long flags;
+        /*
+         * If the selfID buffer is not the immediate successor of the
+         * previously processed one, we cannot reliably compare the
+         * old and new topologies.
+         */
+        if (!is_next_generation(generation, card->generation) &&
+            card->local_node != NULL) {
+                fw_notify("skipped bus generations, destroying all nodes\n");
+                fw_destroy_nodes(card);
+                card->bm_retries = 0;
+        }
        spin_lock_irqsave(&card->lock, flags);
        card->node_id = node_id;
diff --git a/drivers/firewire/fw-transaction.h b/drivers/firewire/fw-transaction.h
index c9ab12a15f6e..1d78e9cc5940 100644
--- a/drivers/firewire/fw-transaction.h
+++ b/drivers/firewire/fw-transaction.h
@@ -276,6 +276,15 @@ static inline void fw_card_put(struct fw_card *card)
 extern void fw_schedule_bm_work(struct fw_card *card, unsigned long delay);
 /*
+ * Check whether new_generation is the immediate successor of old_generation.
+ * Take counter roll-over at 255 (as per to OHCI) into account.
+ */
+static inline bool is_next_generation(int new_generation, int old_generation)
+{
+        return (new_generation & 0xff) == ((old_generation + 1) & 0xff);
+}
+/*
 * The iso packet format allows for an immediate header/payload part
 * stored in 'header' immediately after the packet info plus an
 * indirect payload part that is pointer to by the 'payload' field.
diff --git a/drivers/firmware/dell_rbu.c b/drivers/firmware/dell_rbu.c
index 13946ebd77d6..b4704e150b28 100644
--- a/drivers/firmware/dell_rbu.c
+++ b/drivers/firmware/dell_rbu.c
@@ -576,7 +576,7 @@ static ssize_t read_rbu_image_type(struct kobject *kobj,
 {
        int size = 0;
        if (!pos)
-                size = sprintf(buffer, "%s\n", image_type);
+                size = scnprintf(buffer, count, "%s\n", image_type);
        return size;
 }
@@ -648,7 +648,7 @@ static ssize_t read_rbu_packet_size(struct kobject *kobj,
        int size = 0;
        if (!pos) {
                spin_lock(&rbu_data.lock);
-                size = sprintf(buffer, "%lu\n", rbu_data.packetsize);
+                size = scnprintf(buffer, count, "%lu\n", rbu_data.packetsize);
                spin_unlock(&rbu_data.lock);
        }
        return size;
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index d76adfea5df7..8f0f7c449305 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -415,6 +415,29 @@ void __init dmi_scan_machine(void)
 }
 /**
+ *      dmi_matches - check if dmi_system_id structure matches system DMI data
+ *      @dmi: pointer to the dmi_system_id structure to check
+ */
+static bool dmi_matches(const struct dmi_system_id *dmi)
+{
+        int i;
+        WARN(!dmi_initialized, KERN_ERR "dmi check: not initialized yet.\n");
+        for (i = 0; i < ARRAY_SIZE(dmi->matches); i++) {
+                int s = dmi->matches[i].slot;
+                if (s == DMI_NONE)
+                        continue;
+                if (dmi_ident[s]
+                    && strstr(dmi_ident[s], dmi->matches[i].substr))
+                        continue;
+                /* No match */
+                return false;
+        }
+        return true;
+}
+/**
 *      dmi_check_system - check system DMI data
 *      @list: array of dmi_system_id structures to match against
 *              All non-null elements of the list must match
@@ -429,32 +452,45 @@ void __init dmi_scan_machine(void)
 */
 int dmi_check_system(const struct dmi_system_id *list)
 {
-        int i, count = 0;
+        int count = 0;
-        const struct dmi_system_id *d = list;
+        const struct dmi_system_id *d;
-        WARN(!dmi_initialized, KERN_ERR "dmi check: not initialized yet.\n");
+        for (d = list; d->ident; d++)
+                if (dmi_matches(d)) {
-        while (d->ident) {
+                        count++;
-                for (i = 0; i < ARRAY_SIZE(d->matches); i++) {
+                        if (d->callback && d->callback(d))
-                        int s = d->matches[i].slot;
+                                break;
-                        if (s == DMI_NONE)
-                                continue;
-                        if (dmi_ident[s] && strstr(dmi_ident[s], d->matches[i].substr))
-                                continue;
-                        /* No match */
-                        goto fail;
                }
-                count++;
-                if (d->callback && d->callback(d))
-                        break;
-fail:           d++;
-        }
        return count;
 }
 EXPORT_SYMBOL(dmi_check_system);
 /**
+ *      dmi_first_match - find dmi_system_id structure matching system DMI data
+ *      @list: array of dmi_system_id structures to match against
+ *              All non-null elements of the list must match
+ *              their slot's (field index's) data (i.e., each
+ *              list string must be a substring of the specified
+ *              DMI slot's string data) to be considered a
+ *              successful match.
+ *
+ *      Walk the blacklist table until the first match is found.  Return the
+ *      pointer to the matching entry or NULL if there's no match.
+ */
+const struct dmi_system_id *dmi_first_match(const struct dmi_system_id *list)
+{
+        const struct dmi_system_id *d;
+        for (d = list; d->ident; d++)
+                if (dmi_matches(d))
+                        return d;
+        return NULL;
+}
+EXPORT_SYMBOL(dmi_first_match);
+/**
 *      dmi_get_system_info - return DMI data value
 *      @field: data index (see enum dmi_field)
 *
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 35e7aea4222c..42fb2fd24c0c 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -789,6 +789,7 @@ int gpio_request(unsigned gpio, const char *label)
        } else {
                status = -EBUSY;
                module_put(chip->owner);
+                goto done;
        }
        if (chip->request) {
diff --git a/drivers/gpu/drm/drm_agpsupport.c b/drivers/gpu/drm/drm_agpsupport.c
index 3d33b8252b58..14796594e5d9 100644
--- a/drivers/gpu/drm/drm_agpsupport.c
+++ b/drivers/gpu/drm/drm_agpsupport.c
@@ -33,10 +33,11 @@
 #include "drmP.h"
 #include <linux/module.h>
-#include <asm/agp.h>
 #if __OS_HAS_AGP
+#include <asm/agp.h>
 /**
 * Get AGP information.
 *
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 5b2cbb778162..bfce0992fefb 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -194,7 +194,6 @@ char *drm_get_connector_status_name(enum drm_connector_status status)
 * @type: object type
 *
 * LOCKING:
- * Caller must hold DRM mode_config lock.
 *
 * Create a unique identifier based on @ptr in @dev's identifier space.  Used
 * for tracking modes, CRTCs and connectors.
@@ -209,15 +208,15 @@ static int drm_mode_object_get(struct drm_device *dev,
        int new_id = 0;
        int ret;
-        WARN(!mutex_is_locked(&dev->mode_config.mutex),
-             "%s called w/o mode_config lock\n", __func__);
 again:
        if (idr_pre_get(&dev->mode_config.crtc_idr, GFP_KERNEL) == 0) {
                DRM_ERROR("Ran out memory getting a mode number\n");
                return -EINVAL;
        }
+        mutex_lock(&dev->mode_config.idr_mutex);
        ret = idr_get_new_above(&dev->mode_config.crtc_idr, obj, 1, &new_id);
+        mutex_unlock(&dev->mode_config.idr_mutex);
        if (ret == -EAGAIN)
                goto again;
@@ -239,16 +238,20 @@ again:
 static void drm_mode_object_put(struct drm_device *dev,
                                struct drm_mode_object *object)
 {
+        mutex_lock(&dev->mode_config.idr_mutex);
        idr_remove(&dev->mode_config.crtc_idr, object->id);
+        mutex_unlock(&dev->mode_config.idr_mutex);
 }
 void *drm_mode_object_find(struct drm_device *dev, uint32_t id, uint32_t type)
 {
-        struct drm_mode_object *obj;
+        struct drm_mode_object *obj = NULL;
+        mutex_lock(&dev->mode_config.idr_mutex);
        obj = idr_find(&dev->mode_config.crtc_idr, id);
        if (!obj || (obj->type != type) || (obj->id != id))
-                return NULL;
+                obj = NULL;
+        mutex_unlock(&dev->mode_config.idr_mutex);
        return obj;
 }
@@ -786,6 +789,7 @@ EXPORT_SYMBOL(drm_mode_create_dithering_property);
 void drm_mode_config_init(struct drm_device *dev)
 {
        mutex_init(&dev->mode_config.mutex);
+        mutex_init(&dev->mode_config.idr_mutex);
        INIT_LIST_HEAD(&dev->mode_config.fb_list);
        INIT_LIST_HEAD(&dev->mode_config.fb_kernel_list);
        INIT_LIST_HEAD(&dev->mode_config.crtc_list);
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 5ff88d952226..14c7a23dc157 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -294,6 +294,7 @@ EXPORT_SYMBOL(drm_init);
 */
 static void drm_cleanup(struct drm_device * dev)
 {
+        struct drm_map_list *r_list, *list_temp;
        DRM_DEBUG("\n");
        if (!dev) {
@@ -325,6 +326,9 @@ static void drm_cleanup(struct drm_device * dev)
        drm_ht_remove(&dev->map_hash);
        drm_ctxbitmap_cleanup(dev);
+        list_for_each_entry_safe(r_list, list_temp, &dev->maplist, head)
+                drm_rmmap(dev, r_list->map);
        if (drm_core_check_feature(dev, DRIVER_MODESET))
                drm_put_minor(&dev->control);
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 0fbb0da342cb..5a4d3244758a 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -660,7 +660,7 @@ struct edid *drm_get_edid(struct drm_connector *connector,
        edid = (struct edid *)drm_ddc_read(adapter);
        if (!edid) {
-                dev_warn(&connector->dev->pdev->dev, "%s: no EDID data\n",
+                dev_info(&connector->dev->pdev->dev, "%s: no EDID data\n",
                         drm_get_connector_name(connector));
                return NULL;
        }
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 9da581452874..6915fb82d0b0 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -136,7 +136,7 @@ drm_gem_object_alloc(struct drm_device *dev, size_t size)
        obj = kcalloc(1, sizeof(*obj), GFP_KERNEL);
        obj->dev = dev;
-        obj->filp = shmem_file_setup("drm mm object", size, 0);
+        obj->filp = shmem_file_setup("drm mm object", size, VM_NORESERVE);
        if (IS_ERR(obj->filp)) {
                kfree(obj);
                return NULL;
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 477caa1b1e4b..69aa0ab28403 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -106,8 +106,6 @@ void drm_vblank_cleanup(struct drm_device *dev)
        drm_free(dev->vbl_queue, sizeof(*dev->vbl_queue) * dev->num_crtcs,
                 DRM_MEM_DRIVER);
-        drm_free(dev->vbl_sigs, sizeof(*dev->vbl_sigs) * dev->num_crtcs,
-                 DRM_MEM_DRIVER);
        drm_free(dev->_vblank_count, sizeof(*dev->_vblank_count) *
                 dev->num_crtcs, DRM_MEM_DRIVER);
        drm_free(dev->vblank_refcount, sizeof(*dev->vblank_refcount) *
@@ -132,7 +130,6 @@ int drm_vblank_init(struct drm_device *dev, int num_crtcs)
        setup_timer(&dev->vblank_disable_timer, vblank_disable_fn,
                    (unsigned long)dev);
        spin_lock_init(&dev->vbl_lock);
-        atomic_set(&dev->vbl_signal_pending, 0);
        dev->num_crtcs = num_crtcs;
        dev->vbl_queue = drm_alloc(sizeof(wait_queue_head_t) * num_crtcs,
@@ -140,11 +137,6 @@ int drm_vblank_init(struct drm_device *dev, int num_crtcs)
        if (!dev->vbl_queue)
                goto err;
-        dev->vbl_sigs = drm_alloc(sizeof(struct list_head) * num_crtcs,
-                                  DRM_MEM_DRIVER);
-        if (!dev->vbl_sigs)
-                goto err;
        dev->_vblank_count = drm_alloc(sizeof(atomic_t) * num_crtcs,
                                      DRM_MEM_DRIVER);
        if (!dev->_vblank_count)
@@ -177,7 +169,6 @@ int drm_vblank_init(struct drm_device *dev, int num_crtcs)
        /* Zero per-crtc vblank stuff */
        for (i = 0; i < num_crtcs; i++) {
                init_waitqueue_head(&dev->vbl_queue[i]);
-                INIT_LIST_HEAD(&dev->vbl_sigs[i]);
                atomic_set(&dev->_vblank_count[i], 0);
                atomic_set(&dev->vblank_refcount[i], 0);
        }
@@ -540,15 +531,10 @@ out:
 * \param data user argument, pointing to a drm_wait_vblank structure.
 * \return zero on success or a negative number on failure.
 *
- * Verifies the IRQ is installed.
+ * This function enables the vblank interrupt on the pipe requested, then
- *
+ * sleeps waiting for the requested sequence number to occur, and drops
- * If a signal is requested checks if this task has already scheduled the same signal
+ * the vblank interrupt refcount afterwards. (vblank irq disable follows that
- * for the same vblank sequence number - nothing to be done in
+ * after a timeout with no further vblank waits scheduled).
- * that case. If the number of tasks waiting for the interrupt exceeds 100 the
- * function fails. Otherwise adds a new entry to drm_device::vbl_sigs for this
- * task.
- *
- * If a signal is not requested, then calls vblank_wait().
 */
 int drm_wait_vblank(struct drm_device *dev, void *data,
                    struct drm_file *file_priv)
@@ -560,6 +546,9 @@ int drm_wait_vblank(struct drm_device *dev, void *data,
        if ((!dev->pdev->irq) || (!dev->irq_enabled))
                return -EINVAL;
+        if (vblwait->request.type & _DRM_VBLANK_SIGNAL)
+                return -EINVAL;
        if (vblwait->request.type &
            ~(_DRM_VBLANK_TYPES_MASK | _DRM_VBLANK_FLAGS_MASK)) {
                DRM_ERROR("Unsupported type value 0x%x, supported mask 0x%x\n",
@@ -597,89 +586,26 @@ int drm_wait_vblank(struct drm_device *dev, void *data,
                vblwait->request.sequence = seq + 1;
        }
-        if (flags & _DRM_VBLANK_SIGNAL) {
+        DRM_DEBUG("waiting on vblank count %d, crtc %d\n",
-                unsigned long irqflags;
+                  vblwait->request.sequence, crtc);
-                struct list_head *vbl_sigs = &dev->vbl_sigs[crtc];
+        dev->last_vblank_wait[crtc] = vblwait->request.sequence;
-                struct drm_vbl_sig *vbl_sig;
+        DRM_WAIT_ON(ret, dev->vbl_queue[crtc], 3 * DRM_HZ,
+                    (((drm_vblank_count(dev, crtc) -
-                spin_lock_irqsave(&dev->vbl_lock, irqflags);
+                       vblwait->request.sequence) <= (1 << 23)) ||
+                     !dev->irq_enabled));
-                /* Check if this task has already scheduled the same signal
-                 * for the same vblank sequence number; nothing to be done in
-                 * that case
-                 */
-                list_for_each_entry(vbl_sig, vbl_sigs, head) {
-                        if (vbl_sig->sequence == vblwait->request.sequence
-                            && vbl_sig->info.si_signo ==
-                            vblwait->request.signal
-                            && vbl_sig->task == current) {
-                                spin_unlock_irqrestore(&dev->vbl_lock,
-                                                       irqflags);
-                                vblwait->reply.sequence = seq;
-                                goto done;
-                        }
-                }
-                if (atomic_read(&dev->vbl_signal_pending) >= 100) {
-                        spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
-                        ret = -EBUSY;
-                        goto done;
-                }
-                spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
-                vbl_sig = drm_calloc(1, sizeof(struct drm_vbl_sig),
-                                     DRM_MEM_DRIVER);
-                if (!vbl_sig) {
-                        ret = -ENOMEM;
-                        goto done;
-                }
-                /* Get a refcount on the vblank, which will be released by
-                 * drm_vbl_send_signals().
-                 */
-                ret = drm_vblank_get(dev, crtc);
-                if (ret) {
-                        drm_free(vbl_sig, sizeof(struct drm_vbl_sig),
-                                 DRM_MEM_DRIVER);
-                        goto done;
-                }
-                atomic_inc(&dev->vbl_signal_pending);
-                vbl_sig->sequence = vblwait->request.sequence;
-                vbl_sig->info.si_signo = vblwait->request.signal;
-                vbl_sig->task = current;
-                spin_lock_irqsave(&dev->vbl_lock, irqflags);
+        if (ret != -EINTR) {
+                struct timeval now;
-                list_add_tail(&vbl_sig->head, vbl_sigs);
-                spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
+                do_gettimeofday(&now);
-                vblwait->reply.sequence = seq;
+                vblwait->reply.tval_sec = now.tv_sec;
+                vblwait->reply.tval_usec = now.tv_usec;
+                vblwait->reply.sequence = drm_vblank_count(dev, crtc);
+                DRM_DEBUG("returning %d to client\n",
+                          vblwait->reply.sequence);
        } else {
-                DRM_DEBUG("waiting on vblank count %d, crtc %d\n",
+                DRM_DEBUG("vblank wait interrupted by signal\n");
-                          vblwait->request.sequence, crtc);
-                dev->last_vblank_wait[crtc] = vblwait->request.sequence;
-                DRM_WAIT_ON(ret, dev->vbl_queue[crtc], 3 * DRM_HZ,
-                            (((drm_vblank_count(dev, crtc) -
-                               vblwait->request.sequence) <= (1 << 23)) ||
-                             !dev->irq_enabled));
-                if (ret != -EINTR) {
-                        struct timeval now;
-                        do_gettimeofday(&now);
-                        vblwait->reply.tval_sec = now.tv_sec;
-                        vblwait->reply.tval_usec = now.tv_usec;
-                        vblwait->reply.sequence = drm_vblank_count(dev, crtc);
-                        DRM_DEBUG("returning %d to client\n",
-                                  vblwait->reply.sequence);
-                } else {
-                        DRM_DEBUG("vblank wait interrupted by signal\n");
-                }
        }
 done:
@@ -688,46 +614,6 @@ done:
 }
 /**
- * Send the VBLANK signals.
- *
- * \param dev DRM device.
- * \param crtc CRTC where the vblank event occurred
- *
- * Sends a signal for each task in drm_device::vbl_sigs and empties the list.
- *
- * If a signal is not requested, then calls vblank_wait().
- */
-static void drm_vbl_send_signals(struct drm_device *dev, int crtc)
-{
-        struct drm_vbl_sig *vbl_sig, *tmp;
-        struct list_head *vbl_sigs;
-        unsigned int vbl_seq;
-        unsigned long flags;
-        spin_lock_irqsave(&dev->vbl_lock, flags);
-        vbl_sigs = &dev->vbl_sigs[crtc];
-        vbl_seq = drm_vblank_count(dev, crtc);
-        list_for_each_entry_safe(vbl_sig, tmp, vbl_sigs, head) {
-            if ((vbl_seq - vbl_sig->sequence) <= (1 << 23)) {
-                vbl_sig->info.si_code = vbl_seq;
-                send_sig_info(vbl_sig->info.si_signo,
-                              &vbl_sig->info, vbl_sig->task);
-                list_del(&vbl_sig->head);
-                drm_free(vbl_sig, sizeof(*vbl_sig),
-                         DRM_MEM_DRIVER);
-                atomic_dec(&dev->vbl_signal_pending);
-                drm_vblank_put(dev, crtc);
-            }
-        }
-        spin_unlock_irqrestore(&dev->vbl_lock, flags);
-}
-/**
 * drm_handle_vblank - handle a vblank event
 * @dev: DRM device
 * @crtc: where this event occurred
@@ -739,6 +625,5 @@ void drm_handle_vblank(struct drm_device *dev, int crtc)
 {
        atomic_inc(&dev->_vblank_count[crtc]);
        DRM_WAKEUP(&dev->vbl_queue[crtc]);
-        drm_vbl_send_signals(dev, crtc);
 }
 EXPORT_SYMBOL(drm_handle_vblank);
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index 5ca132afa4f2..46bb923b097c 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -118,12 +118,20 @@ static void drm_master_destroy(struct kref *kref)
        struct drm_master *master = container_of(kref, struct drm_master, refcount);
        struct drm_magic_entry *pt, *next;
        struct drm_device *dev = master->minor->dev;
+        struct drm_map_list *r_list, *list_temp;
        list_del(&master->head);
        if (dev->driver->master_destroy)
                dev->driver->master_destroy(dev, master);
+        list_for_each_entry_safe(r_list, list_temp, &dev->maplist, head) {
+                if (r_list->master == master) {
+                        drm_rmmap_locked(dev, r_list->map);
+                        r_list = NULL;
+                }
+        }
        if (master->unique) {
                drm_free(master->unique, master->unique_size, DRM_MEM_DRIVER);
                master->unique = NULL;
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index bbadf1c04142..ee64b7301f67 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -944,13 +944,14 @@ static int i915_load_modeset_init(struct drm_device *dev)
        dev->mode_config.fb_base = drm_get_resource_start(dev, fb_bar) &
                0xff000000;
-        DRM_DEBUG("*** fb base 0x%08lx\n", dev->mode_config.fb_base);
+        if (IS_MOBILE(dev) || IS_I9XX(dev))
-        if (IS_MOBILE(dev) || (IS_I9XX(dev) && !IS_I965G(dev) && !IS_G33(dev)))
                dev_priv->cursor_needs_physical = true;
        else
                dev_priv->cursor_needs_physical = false;
+        if (IS_I965G(dev) || IS_G33(dev))
+                dev_priv->cursor_needs_physical = false;
        ret = i915_probe_agp(dev, &agp_size, &prealloc_size);
        if (ret)
                goto kfree_devname;
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 96316fd47233..debad5c04cc0 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3364,7 +3364,7 @@ void i915_gem_free_all_phys_object(struct drm_device *dev)
 {
        int i;
-        for (i = 0; i < I915_MAX_PHYS_OBJECT; i++)
+        for (i = I915_GEM_PHYS_CURSOR_0; i <= I915_MAX_PHYS_OBJECT; i++)
                i915_gem_free_phys_object(dev, i);
 }
@@ -3427,7 +3427,7 @@ i915_gem_attach_phys_object(struct drm_device *dev,
                ret = i915_gem_init_phys_object(dev, id,
                                                obj->size);
                if (ret) {
-                        DRM_ERROR("failed to init phys object %d size: %d\n", id, obj->size);
+                        DRM_ERROR("failed to init phys object %d size: %zu\n", id, obj->size);
                        goto out;
                }
        }
diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
index a5a2f5339e9e..5ee9d4c25753 100644
--- a/drivers/gpu/drm/i915/intel_i2c.c
+++ b/drivers/gpu/drm/i915/intel_i2c.c
@@ -137,10 +137,6 @@ struct intel_i2c_chan *intel_i2c_create(struct drm_device *dev, const u32 reg,
        chan->reg = reg;
        snprintf(chan->adapter.name, I2C_NAME_SIZE, "intel drm %s", name);
        chan->adapter.owner = THIS_MODULE;
-#ifndef I2C_HW_B_INTELFB
-#define I2C_HW_B_INTELFB I2C_HW_B_I810
-#endif
-        chan->adapter.id = I2C_HW_B_INTELFB;
        chan->adapter.algo_data = &chan->algo;
        chan->adapter.dev.parent = &dev->pdev->dev;
        chan->algo.setsda = set_data;
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 2fafdcc108fe..b36a5214d8df 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -311,7 +311,7 @@ static int intel_lvds_get_modes(struct drm_connector *connector)
        if (dev_priv->panel_fixed_mode != NULL) {
                struct drm_display_mode *mode;
-                mutex_unlock(&dev->mode_config.mutex);
+                mutex_lock(&dev->mode_config.mutex);
                mode = drm_mode_duplicate(dev, dev_priv->panel_fixed_mode);
                drm_mode_probed_add(connector, mode);
                mutex_unlock(&dev->mode_config.mutex);
@@ -340,6 +340,18 @@ static void intel_lvds_destroy(struct drm_connector *connector)
        kfree(connector);
 }
+static int intel_lvds_set_property(struct drm_connector *connector,
+                                   struct drm_property *property,
+                                   uint64_t value)
+{
+        struct drm_device *dev = connector->dev;
+        if (property == dev->mode_config.dpms_property && connector->encoder)
+                intel_lvds_dpms(connector->encoder, (uint32_t)(value & 0xf));
+        return 0;
+}
 static const struct drm_encoder_helper_funcs intel_lvds_helper_funcs = {
        .dpms = intel_lvds_dpms,
        .mode_fixup = intel_lvds_mode_fixup,
@@ -359,6 +371,7 @@ static const struct drm_connector_funcs intel_lvds_connector_funcs = {
        .restore = intel_lvds_restore,
        .detect = intel_lvds_detect,
        .fill_modes = drm_helper_probe_single_connector_modes,
+        .set_property = intel_lvds_set_property,
        .destroy = intel_lvds_destroy,
 };
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 5d7640e49dc5..6cad69ed21c5 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1218,6 +1218,7 @@ int hid_connect(struct hid_device *hdev, unsigned int connect_mask)
 }
 EXPORT_SYMBOL_GPL(hid_connect);
+/* a list of devices for which there is a specialized driver on HID bus */
 static const struct hid_device_id hid_blacklist[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU) },
        { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_X5_005D) },
@@ -1476,6 +1477,7 @@ static struct bus_type hid_bus_type = {
        .uevent         = hid_uevent,
 };
+/* a list of devices that shouldn't be handled by HID core at all */
 static const struct hid_device_id hid_ignore_list[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_ACECAD, USB_DEVICE_ID_ACECAD_FLAIR) },
        { HID_USB_DEVICE(USB_VENDOR_ID_ACECAD, USB_DEVICE_ID_ACECAD_302) },
@@ -1606,6 +1608,8 @@ static const struct hid_device_id hid_ignore_list[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD) },
        { HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD2) },
        { HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD3) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD4) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD5) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TENX, USB_DEVICE_ID_TENX_IBUDDY1) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TENX, USB_DEVICE_ID_TENX_IBUDDY2) },
        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb300) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index acc1abc834a4..e899f510ebeb 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -362,6 +362,8 @@
 #define USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD       0x0038
 #define USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD2      0x0036
 #define USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD3      0x0034
+#define USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD4      0x0044
+#define USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD5      0x0045
 #define USB_VENDOR_ID_SUN               0x0430
 #define USB_DEVICE_ID_RARITAN_KVM_DONGLE        0xcdab
diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
index d718b1607d0f..25b10dcad90d 100644
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -30,7 +30,7 @@
 #define MS_NOGET        0x10
 /*
- * Microsoft Wireless Desktop Receiver (Model 1028) has several
+ * Microsoft Wireless Desktop Receiver (Model 1028) has
 * 'Usage Min/Max' where it ought to have 'Physical Min/Max'
 */
 static void ms_report_fixup(struct hid_device *hdev, __u8 *rdesc,
@@ -38,17 +38,12 @@ static void ms_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 {
        unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
-        if ((quirks & MS_RDESC) && rsize == 571 && rdesc[284] == 0x19 &&
+        if ((quirks & MS_RDESC) && rsize == 571 && rdesc[557] == 0x19 &&
-                        rdesc[286] == 0x2a && rdesc[304] == 0x19 &&
-                        rdesc[306] == 0x29 && rdesc[352] == 0x1a &&
-                        rdesc[355] == 0x2a && rdesc[557] == 0x19 &&
                        rdesc[559] == 0x29) {
                dev_info(&hdev->dev, "fixing up Microsoft Wireless Receiver "
                                "Model 1028 report descriptor\n");
-                rdesc[284] = rdesc[304] = rdesc[557] = 0x35;
+                rdesc[557] = 0x35;
-                rdesc[352] = 0x36;
+                rdesc[559] = 0x45;
-                rdesc[286] = rdesc[355] = 0x46;
-                rdesc[306] = rdesc[559] = 0x45;
        }
 }
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index d73eea382ab3..4940e4d70c2d 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -656,7 +656,7 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
        case HIDIOCGSTRING:
                mutex_lock(&hiddev->existancelock);
-                if (!hiddev->exist)
+                if (hiddev->exist)
                        r = hiddev_ioctl_string(hiddev, cmd, user_arg);
                else
                        r = -ENODEV;
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index e30186236588..678e34b01e52 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -83,7 +83,7 @@
 /*
 * Temperature sensors keys (sp78 - 2 bytes).
 */
-static const char* temperature_sensors_sets[][36] = {
+static const char *temperature_sensors_sets[][41] = {
 /* Set 0: Macbook Pro */
        { "TA0P", "TB0T", "TC0D", "TC0P", "TG0H", "TG0P", "TG0T", "Th0H",
          "Th1H", "Tm0P", "Ts0P", "Ts1P", NULL },
@@ -135,6 +135,13 @@ static const char* temperature_sensors_sets[][36] = {
        { "TB0T", "TB1S", "TB1T", "TB2S", "TB2T", "TC0D", "TN0D", "TTF0",
          "TV0P", "TVFP", "TW0P", "Th0P", "Tp0P", "Tp1P", "TpFP", "Ts0P",
          "Ts0S", NULL },
+/* Set 16: Mac Pro 3,1 (2 x Quad-Core) */
+        { "TA0P", "TCAG", "TCAH", "TCBG", "TCBH", "TC0C", "TC0D", "TC0P",
+          "TC1C", "TC1D", "TC2C", "TC2D", "TC3C", "TC3D", "TH0P", "TH1P",
+          "TH2P", "TH3P", "TMAP", "TMAS", "TMBS", "TM0P", "TM0S", "TM1P",
+          "TM1S", "TM2P", "TM2S", "TM3S", "TM8P", "TM8S", "TM9P", "TM9S",
+          "TN0C", "TN0D", "TN0H", "TS0C", "Tp0C", "Tp1C", "Tv0S", "Tv1S",
+          NULL },
 };
 /* List of keys used to read/write fan speeds */
@@ -1153,6 +1160,16 @@ static SENSOR_DEVICE_ATTR(temp34_input, S_IRUGO,
                                        applesmc_show_temperature, NULL, 33);
 static SENSOR_DEVICE_ATTR(temp35_input, S_IRUGO,
                                        applesmc_show_temperature, NULL, 34);
+static SENSOR_DEVICE_ATTR(temp36_input, S_IRUGO,
+                                        applesmc_show_temperature, NULL, 35);
+static SENSOR_DEVICE_ATTR(temp37_input, S_IRUGO,
+                                        applesmc_show_temperature, NULL, 36);
+static SENSOR_DEVICE_ATTR(temp38_input, S_IRUGO,
+                                        applesmc_show_temperature, NULL, 37);
+static SENSOR_DEVICE_ATTR(temp39_input, S_IRUGO,
+                                        applesmc_show_temperature, NULL, 38);
+static SENSOR_DEVICE_ATTR(temp40_input, S_IRUGO,
+                                        applesmc_show_temperature, NULL, 39);
 static struct attribute *temperature_attributes[] = {
        &sensor_dev_attr_temp1_input.dev_attr.attr,
@@ -1190,6 +1207,11 @@ static struct attribute *temperature_attributes[] = {
        &sensor_dev_attr_temp33_input.dev_attr.attr,
        &sensor_dev_attr_temp34_input.dev_attr.attr,
        &sensor_dev_attr_temp35_input.dev_attr.attr,
+        &sensor_dev_attr_temp36_input.dev_attr.attr,
+        &sensor_dev_attr_temp37_input.dev_attr.attr,
+        &sensor_dev_attr_temp38_input.dev_attr.attr,
+        &sensor_dev_attr_temp39_input.dev_attr.attr,
+        &sensor_dev_attr_temp40_input.dev_attr.attr,
        NULL
 };
@@ -1312,6 +1334,8 @@ static __initdata struct dmi_match_data applesmc_dmi_data[] = {
        { .accelerometer = 0, .light = 0, .temperature_set = 14 },
 /* MacBook Air 2,1: accelerometer, backlight and temperature set 15 */
        { .accelerometer = 1, .light = 1, .temperature_set = 15 },
+/* MacPro3,1: temperature set 16 */
+        { .accelerometer = 0, .light = 0, .temperature_set = 16 },
 };
 /* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1".
@@ -1369,6 +1393,10 @@ static __initdata struct dmi_system_id applesmc_whitelist[] = {
          DMI_MATCH(DMI_BOARD_VENDOR,"Apple"),
          DMI_MATCH(DMI_PRODUCT_NAME,"MacPro2") },
                &applesmc_dmi_data[4]},
+        { applesmc_dmi_match, "Apple MacPro3", {
+          DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+          DMI_MATCH(DMI_PRODUCT_NAME, "MacPro3") },
+                &applesmc_dmi_data[16]},
        { applesmc_dmi_match, "Apple MacPro", {
          DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
          DMI_MATCH(DMI_PRODUCT_NAME, "MacPro") },
diff --git a/drivers/hwmon/hp_accel.c b/drivers/hwmon/hp_accel.c
index 03705240000f..abf4dfc8ec22 100644
--- a/drivers/hwmon/hp_accel.c
+++ b/drivers/hwmon/hp_accel.c
@@ -153,7 +153,10 @@ static struct axis_conversion lis3lv02d_axis_y_inverted = {1, -2, 3};
 static struct axis_conversion lis3lv02d_axis_x_inverted = {-1, 2, 3};
 static struct axis_conversion lis3lv02d_axis_z_inverted = {1, 2, -3};
 static struct axis_conversion lis3lv02d_axis_xy_rotated_left = {-2, 1, 3};
+static struct axis_conversion lis3lv02d_axis_xy_rotated_left_usd = {-2, 1, -3};
 static struct axis_conversion lis3lv02d_axis_xy_swap_inverted = {-2, -1, 3};
+static struct axis_conversion lis3lv02d_axis_xy_rotated_right = {2, -1, 3};
+static struct axis_conversion lis3lv02d_axis_xy_swap_yz_inverted = {2, -1, -3};
 #define AXIS_DMI_MATCH(_ident, _name, _axis) {          \
        .ident = _ident,                                \
@@ -172,10 +175,12 @@ static struct dmi_system_id lis3lv02d_dmi_ids[] = {
        AXIS_DMI_MATCH("NC2510", "HP Compaq 2510", y_inverted),
        AXIS_DMI_MATCH("NC8510", "HP Compaq 8510", xy_swap_inverted),
        AXIS_DMI_MATCH("HP2133", "HP 2133", xy_rotated_left),
+        AXIS_DMI_MATCH("NC653x", "HP Compaq 653", xy_rotated_left_usd),
+        AXIS_DMI_MATCH("NC673x", "HP Compaq 673", xy_rotated_left_usd),
+        AXIS_DMI_MATCH("NC651xx", "HP Compaq 651", xy_rotated_right),
+        AXIS_DMI_MATCH("NC671xx", "HP Compaq 671", xy_swap_yz_inverted),
        { NULL, }
 /* Laptop models without axis info (yet):
- * "NC651xx" "HP Compaq 651"
- * "NC671xx" "HP Compaq 671"
 * "NC6910" "HP Compaq 6910"
 * HP Compaq 8710x Notebook PC / Mobile Workstation
 * "NC2400" "HP Compaq nc2400"
diff --git a/drivers/i2c/busses/i2c-acorn.c b/drivers/i2c/busses/i2c-acorn.c
index 75089febbc13..9fee3ca17344 100644
--- a/drivers/i2c/busses/i2c-acorn.c
+++ b/drivers/i2c/busses/i2c-acorn.c
@@ -83,7 +83,6 @@ static struct i2c_algo_bit_data ioc_data = {
 };
 static struct i2c_adapter ioc_ops = {
-        .id                     = I2C_HW_B_IOC,
        .algo_data              = &ioc_data,
 };
diff --git a/drivers/i2c/busses/i2c-ali1535.c b/drivers/i2c/busses/i2c-ali1535.c
index 9cead9b9458e..981e080b32ae 100644
--- a/drivers/i2c/busses/i2c-ali1535.c
+++ b/drivers/i2c/busses/i2c-ali1535.c
@@ -476,7 +476,6 @@ static const struct i2c_algorithm smbus_algorithm = {
 static struct i2c_adapter ali1535_adapter = {
        .owner          = THIS_MODULE,
-        .id             = I2C_HW_SMBUS_ALI1535,
        .class          = I2C_CLASS_HWMON | I2C_CLASS_SPD,
        .algo           = &smbus_algorithm,
 };
diff --git a/drivers/i2c/busses/i2c-ali1563.c b/drivers/i2c/busses/i2c-ali1563.c
index dd9e796fad69..f70f46582c6c 100644
--- a/drivers/i2c/busses/i2c-ali1563.c
+++ b/drivers/i2c/busses/i2c-ali1563.c
@@ -386,7 +386,6 @@ static const struct i2c_algorithm ali1563_algorithm = {
 static struct i2c_adapter ali1563_adapter = {
        .owner  = THIS_MODULE,
-        .id     = I2C_HW_SMBUS_ALI1563,
        .class  = I2C_CLASS_HWMON | I2C_CLASS_SPD,
        .algo   = &ali1563_algorithm,
 };
diff --git a/drivers/i2c/busses/i2c-ali15x3.c b/drivers/i2c/busses/i2c-ali15x3.c
index 234fdde7d40e..39066dee46e3 100644
--- a/drivers/i2c/busses/i2c-ali15x3.c
+++ b/drivers/i2c/busses/i2c-ali15x3.c
@@ -473,7 +473,6 @@ static const struct i2c_algorithm smbus_algorithm = {
 static struct i2c_adapter ali15x3_adapter = {
        .owner          = THIS_MODULE,
-        .id             = I2C_HW_SMBUS_ALI15X3,
        .class          = I2C_CLASS_HWMON | I2C_CLASS_SPD,
        .algo           = &smbus_algorithm,
 };
diff --git a/drivers/i2c/busses/i2c-amd756.c b/drivers/i2c/busses/i2c-amd756.c
index 36bee5b9c952..220f4a1eee1d 100644
--- a/drivers/i2c/busses/i2c-amd756.c
+++ b/drivers/i2c/busses/i2c-amd756.c
@@ -298,7 +298,6 @@ static const struct i2c_algorithm smbus_algorithm = {
 struct i2c_adapter amd756_smbus = {
        .owner          = THIS_MODULE,
-        .id             = I2C_HW_SMBUS_AMD756,
        .class          = I2C_CLASS_HWMON | I2C_CLASS_SPD,
        .algo           = &smbus_algorithm,
 };
diff --git a/drivers/i2c/busses/i2c-amd8111.c b/drivers/i2c/busses/i2c-amd8111.c
index 3972208876b3..edab51973bf5 100644
--- a/drivers/i2c/busses/i2c-amd8111.c
+++ b/drivers/i2c/busses/i2c-amd8111.c
@@ -387,7 +387,6 @@ static int __devinit amd8111_probe(struct pci_dev *dev,
        smbus->adapter.owner = THIS_MODULE;
        snprintf(smbus->adapter.name, sizeof(smbus->adapter.name),
                "SMBus2 AMD8111 adapter at %04x", smbus->base);
-        smbus->adapter.id = I2C_HW_SMBUS_AMD8111;
        smbus->adapter.class = I2C_CLASS_HWMON | I2C_CLASS_SPD;
        smbus->adapter.algo = &smbus_algorithm;
        smbus->adapter.algo_data = smbus;
diff --git a/drivers/i2c/busses/i2c-au1550.c b/drivers/i2c/busses/i2c-au1550.c
index 66a04c2c660f..f78ce523e3db 100644
--- a/drivers/i2c/busses/i2c-au1550.c
+++ b/drivers/i2c/busses/i2c-au1550.c
@@ -400,7 +400,6 @@ i2c_au1550_probe(struct platform_device *pdev)
        priv->xfer_timeout = 200;
        priv->ack_timeout = 200;
-        priv->adap.id = I2C_HW_AU1550_PSC;
        priv->adap.nr = pdev->id;
        priv->adap.algo = &au1550_algo;
        priv->adap.algo_data = priv;
diff --git a/drivers/i2c/busses/i2c-bfin-twi.c b/drivers/i2c/busses/i2c-bfin-twi.c
index 3fd2c417c1e0..fc548b3d002e 100644
--- a/drivers/i2c/busses/i2c-bfin-twi.c
+++ b/drivers/i2c/busses/i2c-bfin-twi.c
@@ -651,7 +651,6 @@ static int i2c_bfin_twi_probe(struct platform_device *pdev)
        iface->timeout_timer.data = (unsigned long)iface;
        p_adap = &iface->adap;
-        p_adap->id = I2C_HW_BLACKFIN;
        p_adap->nr = pdev->id;
        strlcpy(p_adap->name, pdev->name, sizeof(p_adap->name));
        p_adap->algo = &bfin_twi_algorithm;
diff --git a/drivers/i2c/busses/i2c-elektor.c b/drivers/i2c/busses/i2c-elektor.c
index 0ed3ccb81b63..448b4bf35eb7 100644
--- a/drivers/i2c/busses/i2c-elektor.c
+++ b/drivers/i2c/busses/i2c-elektor.c
@@ -202,7 +202,6 @@ static struct i2c_algo_pcf_data pcf_isa_data = {
 static struct i2c_adapter pcf_isa_ops = {
        .owner          = THIS_MODULE,
        .class          = I2C_CLASS_HWMON | I2C_CLASS_SPD,
-        .id             = I2C_HW_P_ELEK,
        .algo_data      = &pcf_isa_data,
        .name           = "i2c-elektor",
 };
diff --git a/drivers/i2c/busses/i2c-hydra.c b/drivers/i2c/busses/i2c-hydra.c
index 648aa7baff83..bec9b845dd16 100644
--- a/drivers/i2c/busses/i2c-hydra.c
+++ b/drivers/i2c/busses/i2c-hydra.c
@@ -102,7 +102,6 @@ static struct i2c_algo_bit_data hydra_bit_data = {
 static struct i2c_adapter hydra_adap = {
        .owner          = THIS_MODULE,
        .name           = "Hydra i2c",
-        .id             = I2C_HW_B_HYDRA,
        .algo_data      = &hydra_bit_data,
 };
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 526625eaa84b..230238df56c4 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -556,7 +556,6 @@ static const struct i2c_algorithm smbus_algorithm = {
 static struct i2c_adapter i801_adapter = {
        .owner          = THIS_MODULE,
-        .id             = I2C_HW_SMBUS_I801,
        .class          = I2C_CLASS_HWMON | I2C_CLASS_SPD,
        .algo           = &smbus_algorithm,
 };
diff --git a/drivers/i2c/busses/i2c-ibm_iic.c b/drivers/i2c/busses/i2c-ibm_iic.c
index 651f2f1ae5b7..88f0db73b364 100644
--- a/drivers/i2c/busses/i2c-ibm_iic.c
+++ b/drivers/i2c/busses/i2c-ibm_iic.c
@@ -746,7 +746,6 @@ static int __devinit iic_probe(struct of_device *ofdev,
        adap->dev.parent = &ofdev->dev;
        strlcpy(adap->name, "IBM IIC", sizeof(adap->name));
        i2c_set_adapdata(adap, dev);
-        adap->id = I2C_HW_OCP;
        adap->class = I2C_CLASS_HWMON | I2C_CLASS_SPD;
        adap->algo = &iic_algo;
        adap->timeout = 1;
diff --git a/drivers/i2c/busses/i2c-iop3xx.c b/drivers/i2c/busses/i2c-iop3xx.c
index fc2714ac0c0f..3190690c26ce 100644
--- a/drivers/i2c/busses/i2c-iop3xx.c
+++ b/drivers/i2c/busses/i2c-iop3xx.c
@@ -480,7 +480,6 @@ iop3xx_i2c_probe(struct platform_device *pdev)
        }
        memcpy(new_adapter->name, pdev->name, strlen(pdev->name));
-        new_adapter->id = I2C_HW_IOP3XX;
        new_adapter->owner = THIS_MODULE;
        new_adapter->class = I2C_CLASS_HWMON | I2C_CLASS_SPD;
        new_adapter->dev.parent = &pdev->dev;
diff --git a/drivers/i2c/busses/i2c-ixp2000.c b/drivers/i2c/busses/i2c-ixp2000.c
index 05d72e981353..8e8467970481 100644
--- a/drivers/i2c/busses/i2c-ixp2000.c
+++ b/drivers/i2c/busses/i2c-ixp2000.c
@@ -116,7 +116,6 @@ static int ixp2000_i2c_probe(struct platform_device *plat_dev)
        drv_data->algo_data.udelay = 6;
        drv_data->algo_data.timeout = 100;
-        drv_data->adapter.id = I2C_HW_B_IXP2000,
        strlcpy(drv_data->adapter.name, plat_dev->dev.driver->name,
                sizeof(drv_data->adapter.name));
        drv_data->adapter.algo_data = &drv_data->algo_data,
diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
index a9a45fcc8544..aedbbe6618db 100644
--- a/drivers/i2c/busses/i2c-mpc.c
+++ b/drivers/i2c/busses/i2c-mpc.c
@@ -310,7 +310,6 @@ static const struct i2c_algorithm mpc_algo = {
 static struct i2c_adapter mpc_ops = {
        .owner = THIS_MODULE,
        .name = "MPC adapter",
-        .id = I2C_HW_MPC107,
        .algo = &mpc_algo,
        .timeout = 1,
 };
diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
index 9e8118d2fe64..eeda276f8f16 100644
--- a/drivers/i2c/busses/i2c-mv64xxx.c
+++ b/drivers/i2c/busses/i2c-mv64xxx.c
@@ -527,7 +527,6 @@ mv64xxx_i2c_probe(struct platform_device *pd)
                goto exit_unmap_regs;
        }
        drv_data->adapter.dev.parent = &pd->dev;
-        drv_data->adapter.id = I2C_HW_MV64XXX;
        drv_data->adapter.algo = &mv64xxx_i2c_algo;
        drv_data->adapter.owner = THIS_MODULE;
        drv_data->adapter.class = I2C_CLASS_HWMON | I2C_CLASS_SPD;
diff --git a/drivers/i2c/busses/i2c-nforce2.c b/drivers/i2c/busses/i2c-nforce2.c
index 3b19bc41a60b..05af6cd7f270 100644
--- a/drivers/i2c/busses/i2c-nforce2.c
+++ b/drivers/i2c/busses/i2c-nforce2.c
@@ -355,7 +355,6 @@ static int __devinit nforce2_probe_smb (struct pci_dev *dev, int bar,
                return -EBUSY;
        }
        smbus->adapter.owner = THIS_MODULE;
-        smbus->adapter.id = I2C_HW_SMBUS_NFORCE2;
        smbus->adapter.class = I2C_CLASS_HWMON | I2C_CLASS_SPD;
        smbus->adapter.algo = &smbus_algorithm;
        smbus->adapter.algo_data = smbus;
diff --git a/drivers/i2c/busses/i2c-parport-light.c b/drivers/i2c/busses/i2c-parport-light.c
index b2b8380f6602..322c5691e38e 100644
--- a/drivers/i2c/busses/i2c-parport-light.c
+++ b/drivers/i2c/busses/i2c-parport-light.c
@@ -115,7 +115,6 @@ static struct i2c_algo_bit_data parport_algo_data = {
 static struct i2c_adapter parport_adapter = {
        .owner          = THIS_MODULE,
        .class          = I2C_CLASS_HWMON,
-        .id             = I2C_HW_B_LP,
        .algo_data      = &parport_algo_data,
        .name           = "Parallel port adapter (light)",
 };
diff --git a/drivers/i2c/busses/i2c-parport.c b/drivers/i2c/busses/i2c-parport.c
index a257cd5cd134..0d8998610c74 100644
--- a/drivers/i2c/busses/i2c-parport.c
+++ b/drivers/i2c/busses/i2c-parport.c
@@ -164,7 +164,6 @@ static void i2c_parport_attach (struct parport *port)
        /* Fill the rest of the structure */
        adapter->adapter.owner = THIS_MODULE;
        adapter->adapter.class = I2C_CLASS_HWMON;
-        adapter->adapter.id = I2C_HW_B_LP;
        strlcpy(adapter->adapter.name, "Parallel port adapter",
                sizeof(adapter->adapter.name));
        adapter->algo_data = parport_algo_data;
diff --git a/drivers/i2c/busses/i2c-pca-isa.c b/drivers/i2c/busses/i2c-pca-isa.c
index 9eb76268ec78..4aa8138cb0a9 100644
--- a/drivers/i2c/busses/i2c-pca-isa.c
+++ b/drivers/i2c/busses/i2c-pca-isa.c
@@ -101,7 +101,6 @@ static struct i2c_algo_pca_data pca_isa_data = {
 static struct i2c_adapter pca_isa_ops = {
        .owner          = THIS_MODULE,
-        .id             = I2C_HW_A_ISA,
        .algo_data      = &pca_isa_data,
        .name           = "PCA9564 ISA Adapter",
        .timeout        = 100,
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index eaa9b387543e..761f9dd53620 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -403,7 +403,6 @@ static const struct i2c_algorithm smbus_algorithm = {
 static struct i2c_adapter piix4_adapter = {
        .owner          = THIS_MODULE,
-        .id             = I2C_HW_SMBUS_PIIX4,
        .class          = I2C_CLASS_HWMON | I2C_CLASS_SPD,
        .algo           = &smbus_algorithm,
 };
diff --git a/drivers/i2c/busses/i2c-sibyte.c b/drivers/i2c/busses/i2c-sibyte.c
index 4ddefbf238e9..98b1ec489159 100644
--- a/drivers/i2c/busses/i2c-sibyte.c
+++ b/drivers/i2c/busses/i2c-sibyte.c
@@ -155,7 +155,6 @@ static struct i2c_algo_sibyte_data sibyte_board_data[2] = {
 static struct i2c_adapter sibyte_board_adapter[2] = {
        {
                .owner          = THIS_MODULE,
-                .id             = I2C_HW_SIBYTE,
                .class          = I2C_CLASS_HWMON | I2C_CLASS_SPD,
                .algo           = NULL,
                .algo_data      = &sibyte_board_data[0],
@@ -164,7 +163,6 @@ static struct i2c_adapter sibyte_board_adapter[2] = {
        },
        {
                .owner          = THIS_MODULE,
-                .id             = I2C_HW_SIBYTE,
                .class          = I2C_CLASS_HWMON | I2C_CLASS_SPD,
                .algo           = NULL,
                .algo_data      = &sibyte_board_data[1],
diff --git a/drivers/i2c/busses/i2c-sis5595.c b/drivers/i2c/busses/i2c-sis5595.c
index 8ce2daff985c..f320ab27da46 100644
--- a/drivers/i2c/busses/i2c-sis5595.c
+++ b/drivers/i2c/busses/i2c-sis5595.c
@@ -365,7 +365,6 @@ static const struct i2c_algorithm smbus_algorithm = {
 static struct i2c_adapter sis5595_adapter = {
        .owner          = THIS_MODULE,
-        .id             = I2C_HW_SMBUS_SIS5595,
        .class          = I2C_CLASS_HWMON | I2C_CLASS_SPD,
        .algo           = &smbus_algorithm,
 };
diff --git a/drivers/i2c/busses/i2c-sis630.c b/drivers/i2c/busses/i2c-sis630.c
index 9c9c016ff2b5..50c3610e6028 100644
--- a/drivers/i2c/busses/i2c-sis630.c
+++ b/drivers/i2c/busses/i2c-sis630.c
@@ -464,7 +464,6 @@ static const struct i2c_algorithm smbus_algorithm = {
 static struct i2c_adapter sis630_adapter = {
        .owner          = THIS_MODULE,
-        .id             = I2C_HW_SMBUS_SIS630,
        .class          = I2C_CLASS_HWMON | I2C_CLASS_SPD,
        .algo           = &smbus_algorithm,
 };
diff --git a/drivers/i2c/busses/i2c-sis96x.c b/drivers/i2c/busses/i2c-sis96x.c
index f1bba6396641..7e1594b40579 100644
--- a/drivers/i2c/busses/i2c-sis96x.c
+++ b/drivers/i2c/busses/i2c-sis96x.c
@@ -241,7 +241,6 @@ static const struct i2c_algorithm smbus_algorithm = {
 static struct i2c_adapter sis96x_adapter = {
        .owner          = THIS_MODULE,
-        .id             = I2C_HW_SMBUS_SIS96X,
        .class          = I2C_CLASS_HWMON | I2C_CLASS_SPD,
        .algo           = &smbus_algorithm,
 };
diff --git a/drivers/i2c/busses/i2c-via.c b/drivers/i2c/busses/i2c-via.c
index 29cef0433f34..8b24f192103a 100644
--- a/drivers/i2c/busses/i2c-via.c
+++ b/drivers/i2c/busses/i2c-via.c
@@ -83,7 +83,6 @@ static struct i2c_algo_bit_data bit_data = {
 static struct i2c_adapter vt586b_adapter = {
        .owner          = THIS_MODULE,
-        .id             = I2C_HW_B_VIA,
        .class          = I2C_CLASS_HWMON | I2C_CLASS_SPD,
        .name           = "VIA i2c",
        .algo_data      = &bit_data,
diff --git a/drivers/i2c/busses/i2c-viapro.c b/drivers/i2c/busses/i2c-viapro.c
index 9f194d9efd91..02e6f724b05f 100644
--- a/drivers/i2c/busses/i2c-viapro.c
+++ b/drivers/i2c/busses/i2c-viapro.c
@@ -321,7 +321,6 @@ static const struct i2c_algorithm smbus_algorithm = {
 static struct i2c_adapter vt596_adapter = {
        .owner          = THIS_MODULE,
-        .id             = I2C_HW_SMBUS_VIA2,
        .class          = I2C_CLASS_HWMON | I2C_CLASS_SPD,
        .algo           = &smbus_algorithm,
 };
diff --git a/drivers/i2c/busses/i2c-voodoo3.c b/drivers/i2c/busses/i2c-voodoo3.c
index 1d4ae26ba73d..1a474acc0ddd 100644
--- a/drivers/i2c/busses/i2c-voodoo3.c
+++ b/drivers/i2c/busses/i2c-voodoo3.c
@@ -163,7 +163,6 @@ static struct i2c_algo_bit_data voo_i2c_bit_data = {
 static struct i2c_adapter voodoo3_i2c_adapter = {
        .owner          = THIS_MODULE,
-        .id             = I2C_HW_B_VOO,
        .class          = I2C_CLASS_TV_ANALOG, 
        .name           = "I2C Voodoo3/Banshee adapter",
        .algo_data      = &voo_i2c_bit_data,
@@ -180,7 +179,6 @@ static struct i2c_algo_bit_data voo_ddc_bit_data = {
 static struct i2c_adapter voodoo3_ddc_adapter = {
        .owner          = THIS_MODULE,
-        .id             = I2C_HW_B_VOO,
        .class          = I2C_CLASS_DDC, 
        .name           = "DDC Voodoo3/Banshee adapter",
        .algo_data      = &voo_ddc_bit_data,
diff --git a/drivers/i2c/busses/scx200_acb.c b/drivers/i2c/busses/scx200_acb.c
index ed794b145a11..648ecc6f60e6 100644
--- a/drivers/i2c/busses/scx200_acb.c
+++ b/drivers/i2c/busses/scx200_acb.c
@@ -440,7 +440,6 @@ static __init struct scx200_acb_iface *scx200_create_iface(const char *text,
        i2c_set_adapdata(adapter, iface);
        snprintf(adapter->name, sizeof(adapter->name), "%s ACB%d", text, index);
        adapter->owner = THIS_MODULE;
-        adapter->id = I2C_HW_SMBUS_SCX200;
        adapter->algo = &scx200_acb_algorithm;
        adapter->class = I2C_CLASS_HWMON | I2C_CLASS_SPD;
        adapter->dev.parent = dev;
diff --git a/drivers/i2c/busses/scx200_i2c.c b/drivers/i2c/busses/scx200_i2c.c
index e4c98539c517..162b74a04886 100644
--- a/drivers/i2c/busses/scx200_i2c.c
+++ b/drivers/i2c/busses/scx200_i2c.c
@@ -82,7 +82,6 @@ static struct i2c_algo_bit_data scx200_i2c_data = {
 static struct i2c_adapter scx200_i2c_ops = {
        .owner             = THIS_MODULE,
        .class             = I2C_CLASS_HWMON | I2C_CLASS_SPD,
-        .id                = I2C_HW_B_SCX200,
        .algo_data         = &scx200_i2c_data,
        .name   = "NatSemi SCx200 I2C",
 };
diff --git a/drivers/i2c/chips/Kconfig b/drivers/i2c/chips/Kconfig
index b9bef04b7be4..c80312c1f382 100644
--- a/drivers/i2c/chips/Kconfig
+++ b/drivers/i2c/chips/Kconfig
@@ -16,43 +16,6 @@ config DS1682
          This driver can also be built as a module.  If so, the module
          will be called ds1682.
-config AT24
-        tristate "EEPROMs from most vendors"
-        depends on SYSFS && EXPERIMENTAL
-        help
-          Enable this driver to get read/write support to most I2C EEPROMs,
-          after you configure the driver to know about each EEPROM on
-          your target board.  Use these generic chip names, instead of
-          vendor-specific ones like at24c64 or 24lc02:
-             24c00, 24c01, 24c02, spd (readonly 24c02), 24c04, 24c08,
-             24c16, 24c32, 24c64, 24c128, 24c256, 24c512, 24c1024
-          Unless you like data loss puzzles, always be sure that any chip
-          you configure as a 24c32 (32 kbit) or larger is NOT really a
-          24c16 (16 kbit) or smaller, and vice versa. Marking the chip
-          as read-only won't help recover from this. Also, if your chip
-          has any software write-protect mechanism you may want to review the
-          code to make sure this driver won't turn it on by accident.
-          If you use this with an SMBus adapter instead of an I2C adapter,
-          full functionality is not available.  Only smaller devices are
-          supported (24c16 and below, max 4 kByte).
-          This driver can also be built as a module.  If so, the module
-          will be called at24.
-config SENSORS_EEPROM
-        tristate "EEPROM reader"
-        depends on EXPERIMENTAL
-        help
-          If you say yes here you get read-only access to the EEPROM data
-          available on modern memory DIMMs and Sony Vaio laptops.  Such
-          EEPROMs could theoretically be available on other devices as well.
-          This driver can also be built as a module.  If so, the module
-          will be called eeprom.
 config SENSORS_PCF8574
        tristate "Philips PCF8574 and PCF8574A (DEPRECATED)"
        depends on EXPERIMENTAL && GPIO_PCF857X = "n"
diff --git a/drivers/i2c/chips/Makefile b/drivers/i2c/chips/Makefile
index 00fcb5193ac2..d142f238a2de 100644
--- a/drivers/i2c/chips/Makefile
+++ b/drivers/i2c/chips/Makefile
@@ -11,8 +11,6 @@
 #
 obj-$(CONFIG_DS1682)            += ds1682.o
-obj-$(CONFIG_AT24)              += at24.o
-obj-$(CONFIG_SENSORS_EEPROM)    += eeprom.o
 obj-$(CONFIG_SENSORS_MAX6875)   += max6875.o
 obj-$(CONFIG_SENSORS_PCA9539)   += pca9539.o
 obj-$(CONFIG_SENSORS_PCF8574)   += pcf8574.o
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index b1c6f68d98ce..3dad2299d9c5 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -465,6 +465,16 @@ config BLK_DEV_CS5535
          It is safe to say Y to this question.
+config BLK_DEV_CS5536
+        tristate "CS5536 chipset support"
+        depends on X86_32
+        select BLK_DEV_IDEDMA_PCI
+        help
+          This option enables support for the AMD CS5536
+          companion chip used with the Geode LX processor family.
+          If unsure, say N.
 config BLK_DEV_HPT366
        tristate "HPT36X/37X chipset support"
        select BLK_DEV_IDEDMA_PCI
diff --git a/drivers/ide/Makefile b/drivers/ide/Makefile
index c2b9c93f0095..d0e3d7d5b467 100644
--- a/drivers/ide/Makefile
+++ b/drivers/ide/Makefile
@@ -43,6 +43,7 @@ obj-$(CONFIG_BLK_DEV_CMD64X)		+= cmd64x.o
 obj-$(CONFIG_BLK_DEV_CS5520)            += cs5520.o
 obj-$(CONFIG_BLK_DEV_CS5530)            += cs5530.o
 obj-$(CONFIG_BLK_DEV_CS5535)            += cs5535.o
+obj-$(CONFIG_BLK_DEV_CS5536)            += cs5536.o
 obj-$(CONFIG_BLK_DEV_SC1200)            += sc1200.o
 obj-$(CONFIG_BLK_DEV_CY82C693)          += cy82c693.o
 obj-$(CONFIG_BLK_DEV_DELKIN)            += delkin_cb.o
diff --git a/drivers/ide/cs5536.c b/drivers/ide/cs5536.c
new file mode 100644
index 000000000000..7a62db719a46
--- /dev/null
+++ b/drivers/ide/cs5536.c
@@ -0,0 +1,308 @@
+/*
+ * CS5536 PATA support
+ * (C) 2007 Martin K. Petersen <mkp@mkp.net>
+ * (C) 2009 Bartlomiej Zolnierkiewicz
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ * Documentation:
+ *      Available from AMD web site.
+ *
+ * The IDE timing registers for the CS5536 live in the Geode Machine
+ * Specific Register file and not PCI config space.  Most BIOSes
+ * virtualize the PCI registers so the chip looks like a standard IDE
+ * controller.  Unfortunately not all implementations get this right.
+ * In particular some have problems with unaligned accesses to the
+ * virtualized PCI registers.  This driver always does full dword
+ * writes to work around the issue.  Also, in case of a bad BIOS this
+ * driver can be loaded with the "msr=1" parameter which forces using
+ * the Machine Specific Registers to configure the device.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/init.h>
+#include <linux/ide.h>
+#include <asm/msr.h>
+#define DRV_NAME        "cs5536"
+enum {
+        MSR_IDE_CFG             = 0x51300010,
+        PCI_IDE_CFG             = 0x40,
+        CFG                     = 0,
+        DTC                     = 2,
+        CAST                    = 3,
+        ETC                     = 4,
+        IDE_CFG_CHANEN          = (1 << 1),
+        IDE_CFG_CABLE           = (1 << 17) | (1 << 16),
+        IDE_D0_SHIFT            = 24,
+        IDE_D1_SHIFT            = 16,
+        IDE_DRV_MASK            = 0xff,
+        IDE_CAST_D0_SHIFT       = 6,
+        IDE_CAST_D1_SHIFT       = 4,
+        IDE_CAST_DRV_MASK       = 0x3,
+        IDE_CAST_CMD_SHIFT      = 24,
+        IDE_CAST_CMD_MASK       = 0xff,
+        IDE_ETC_UDMA_MASK       = 0xc0,
+};
+static int use_msr;
+static int cs5536_read(struct pci_dev *pdev, int reg, u32 *val)
+{
+        if (unlikely(use_msr)) {
+                u32 dummy;
+                rdmsr(MSR_IDE_CFG + reg, *val, dummy);
+                return 0;
+        }
+        return pci_read_config_dword(pdev, PCI_IDE_CFG + reg * 4, val);
+}
+static int cs5536_write(struct pci_dev *pdev, int reg, int val)
+{
+        if (unlikely(use_msr)) {
+                wrmsr(MSR_IDE_CFG + reg, val, 0);
+                return 0;
+        }
+        return pci_write_config_dword(pdev, PCI_IDE_CFG + reg * 4, val);
+}
+static void cs5536_program_dtc(ide_drive_t *drive, u8 tim)
+{
+        struct pci_dev *pdev = to_pci_dev(drive->hwif->dev);
+        int dshift = (drive->dn & 1) ? IDE_D1_SHIFT : IDE_D0_SHIFT;
+        u32 dtc;
+        cs5536_read(pdev, DTC, &dtc);
+        dtc &= ~(IDE_DRV_MASK << dshift);
+        dtc |= tim << dshift;
+        cs5536_write(pdev, DTC, dtc);
+}
+/**
+ *      cs5536_cable_detect     -       detect cable type
+ *      @hwif: Port to detect on
+ *
+ *      Perform cable detection for ATA66 capable cable.
+ *
+ *      Returns a cable type.
+ */
+static u8 cs5536_cable_detect(ide_hwif_t *hwif)
+{
+        struct pci_dev *pdev = to_pci_dev(hwif->dev);
+        u32 cfg;
+        cs5536_read(pdev, CFG, &cfg);
+        if (cfg & IDE_CFG_CABLE)
+                return ATA_CBL_PATA80;
+        else
+                return ATA_CBL_PATA40;
+}
+/**
+ *      cs5536_set_pio_mode             -       PIO timing setup
+ *      @drive: ATA device
+ *      @pio: PIO mode number
+ */
+static void cs5536_set_pio_mode(ide_drive_t *drive, const u8 pio)
+{
+        static const u8 drv_timings[5] = {
+                0x98, 0x55, 0x32, 0x21, 0x20,
+        };
+        static const u8 addr_timings[5] = {
+                0x2, 0x1, 0x0, 0x0, 0x0,
+        };
+        static const u8 cmd_timings[5] = {
+                0x99, 0x92, 0x90, 0x22, 0x20,
+        };
+        struct pci_dev *pdev = to_pci_dev(drive->hwif->dev);
+        ide_drive_t *pair = ide_get_pair_dev(drive);
+        int cshift = (drive->dn & 1) ? IDE_CAST_D1_SHIFT : IDE_CAST_D0_SHIFT;
+        u32 cast;
+        u8 cmd_pio = pio;
+        if (pair)
+                cmd_pio = min(pio, ide_get_best_pio_mode(pair, 255, 4));
+        drive->drive_data &= (IDE_DRV_MASK << 8);
+        drive->drive_data |= drv_timings[pio];
+        cs5536_program_dtc(drive, drv_timings[pio]);
+        cs5536_read(pdev, CAST, &cast);
+        cast &= ~(IDE_CAST_DRV_MASK << cshift);
+        cast |= addr_timings[pio] << cshift;
+        cast &= ~(IDE_CAST_CMD_MASK << IDE_CAST_CMD_SHIFT);
+        cast |= cmd_timings[cmd_pio] << IDE_CAST_CMD_SHIFT;
+        cs5536_write(pdev, CAST, cast);
+}
+/**
+ *      cs5536_set_dma_mode             -       DMA timing setup
+ *      @drive: ATA device
+ *      @mode: DMA mode
+ */
+static void cs5536_set_dma_mode(ide_drive_t *drive, const u8 mode)
+{
+        static const u8 udma_timings[6] = {
+                0xc2, 0xc1, 0xc0, 0xc4, 0xc5, 0xc6,
+        };
+        static const u8 mwdma_timings[3] = {
+                0x67, 0x21, 0x20,
+        };
+        struct pci_dev *pdev = to_pci_dev(drive->hwif->dev);
+        int dshift = (drive->dn & 1) ? IDE_D1_SHIFT : IDE_D0_SHIFT;
+        u32 etc;
+        cs5536_read(pdev, ETC, &etc);
+        if (mode >= XFER_UDMA_0) {
+                etc &= ~(IDE_DRV_MASK << dshift);
+                etc |= udma_timings[mode - XFER_UDMA_0] << dshift;
+        } else { /* MWDMA */
+                etc &= ~(IDE_ETC_UDMA_MASK << dshift);
+                drive->drive_data &= IDE_DRV_MASK;
+                drive->drive_data |= mwdma_timings[mode - XFER_MW_DMA_0] << 8;
+        }
+        cs5536_write(pdev, ETC, etc);
+}
+static void cs5536_dma_start(ide_drive_t *drive)
+{
+        if (drive->current_speed < XFER_UDMA_0 &&
+            (drive->drive_data >> 8) != (drive->drive_data & IDE_DRV_MASK))
+                cs5536_program_dtc(drive, drive->drive_data >> 8);
+        ide_dma_start(drive);
+}
+static int cs5536_dma_end(ide_drive_t *drive)
+{
+        int ret = ide_dma_end(drive);
+        if (drive->current_speed < XFER_UDMA_0 &&
+            (drive->drive_data >> 8) != (drive->drive_data & IDE_DRV_MASK))
+                cs5536_program_dtc(drive, drive->drive_data & IDE_DRV_MASK);
+        return ret;
+}
+static const struct ide_port_ops cs5536_port_ops = {
+        .set_pio_mode           = cs5536_set_pio_mode,
+        .set_dma_mode           = cs5536_set_dma_mode,
+        .cable_detect           = cs5536_cable_detect,
+};
+static const struct ide_dma_ops cs5536_dma_ops = {
+        .dma_host_set           = ide_dma_host_set,
+        .dma_setup              = ide_dma_setup,
+        .dma_exec_cmd           = ide_dma_exec_cmd,
+        .dma_start              = cs5536_dma_start,
+        .dma_end                = cs5536_dma_end,
+        .dma_test_irq           = ide_dma_test_irq,
+        .dma_lost_irq           = ide_dma_lost_irq,
+        .dma_timeout            = ide_dma_timeout,
+};
+static const struct ide_port_info cs5536_info = {
+        .name           = DRV_NAME,
+        .port_ops       = &cs5536_port_ops,
+        .dma_ops        = &cs5536_dma_ops,
+        .host_flags     = IDE_HFLAG_SINGLE,
+        .pio_mask       = ATA_PIO4,
+        .mwdma_mask     = ATA_MWDMA2,
+        .udma_mask      = ATA_UDMA5,
+};
+/**
+ *      cs5536_init_one
+ *      @dev: PCI device
+ *      @id: Entry in match table
+ */
+static int cs5536_init_one(struct pci_dev *dev, const struct pci_device_id *id)
+{
+        u32 cfg;
+        if (use_msr)
+                printk(KERN_INFO DRV_NAME ": Using MSR regs instead of PCI\n");
+        cs5536_read(dev, CFG, &cfg);
+        if ((cfg & IDE_CFG_CHANEN) == 0) {
+                printk(KERN_ERR DRV_NAME ": disabled by BIOS\n");
+                return -ENODEV;
+        }
+        return ide_pci_init_one(dev, &cs5536_info, NULL);
+}
+static const struct pci_device_id cs5536_pci_tbl[] = {
+        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CS5536_IDE), },
+        { },
+};
+static struct pci_driver cs5536_pci_driver = {
+        .name           = DRV_NAME,
+        .id_table       = cs5536_pci_tbl,
+        .probe          = cs5536_init_one,
+        .remove         = ide_pci_remove,
+        .suspend        = ide_pci_suspend,
+        .resume         = ide_pci_resume,
+};
+static int __init cs5536_init(void)
+{
+        return pci_register_driver(&cs5536_pci_driver);
+}
+static void __exit cs5536_exit(void)
+{
+        pci_unregister_driver(&cs5536_pci_driver);
+}
+MODULE_AUTHOR("Martin K. Petersen, Bartlomiej Zolnierkiewicz");
+MODULE_DESCRIPTION("low-level driver for the CS5536 IDE controller");
+MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(pci, cs5536_pci_tbl);
+module_param_named(msr, use_msr, int, 0644);
+MODULE_PARM_DESC(msr, "Force using MSR to configure IDE function (Default: 0)");
+module_init(cs5536_init);
+module_exit(cs5536_exit);
diff --git a/drivers/ide/falconide.c b/drivers/ide/falconide.c
index a5ba820d69bb..a638e952d67a 100644
--- a/drivers/ide/falconide.c
+++ b/drivers/ide/falconide.c
@@ -82,7 +82,7 @@ static const struct ide_tp_ops falconide_tp_ops = {
 static const struct ide_port_info falconide_port_info = {
        .tp_ops                 = &falconide_tp_ops,
-        .host_flags             = IDE_HFLAG_NO_DMA,
+        .host_flags             = IDE_HFLAG_NO_DMA | IDE_HFLAG_SERIALIZE,
 };
 static void __init falconide_setup_ports(hw_regs_t *hw)
diff --git a/drivers/ide/icside.c b/drivers/ide/icside.c
index 97a35c667aee..415d7e24f2b6 100644
--- a/drivers/ide/icside.c
+++ b/drivers/ide/icside.c
@@ -534,7 +534,7 @@ icside_register_v6(struct icside_state *state, struct expansion_card *ec)
                d.dma_ops = NULL;
        }
-        ret = ide_host_register(host, NULL, hws);
+        ret = ide_host_register(host, &d, hws);
        if (ret)
                goto err_free;
diff --git a/drivers/ide/ide-acpi.c b/drivers/ide/ide-acpi.c
index d8f295bdad76..ec7d07fa570a 100644
--- a/drivers/ide/ide-acpi.c
+++ b/drivers/ide/ide-acpi.c
@@ -282,7 +282,7 @@ static int do_drive_get_GTF(ide_drive_t *drive,
        port = hwif->channel ? drive->dn - 2: drive->dn;
        DEBPRINT("ENTER: %s at %s, port#: %d, hard_port#: %d\n",
-                 hwif->name, dev->bus_id, port, hwif->channel);
+                 hwif->name, dev_name(dev), port, hwif->channel);
        if ((drive->dev_flags & IDE_DFLAG_PRESENT) == 0) {
                DEBPRINT("%s drive %d:%d not present\n",
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index cae69372cf45..0bfeb0c79d6e 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -787,6 +787,9 @@ static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive)
                if (blk_fs_request(rq)) {
                        ide_end_request(drive, 1, rq->nr_sectors);
                        return ide_stopped;
+                } else if (rq->cmd_type == REQ_TYPE_ATA_PC && !rq->bio) {
+                        ide_end_request(drive, 1, 1);
+                        return ide_stopped;
                }
                goto end_request;
        }
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index cc163319dfbd..9ee51adf567f 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -418,11 +418,14 @@ void ide_map_sg(ide_drive_t *drive, struct request *rq)
        ide_hwif_t *hwif = drive->hwif;
        struct scatterlist *sg = hwif->sg_table;
-        if (rq->cmd_type != REQ_TYPE_ATA_TASKFILE) {
+        if (rq->cmd_type == REQ_TYPE_ATA_TASKFILE) {
-                hwif->sg_nents = blk_rq_map_sg(drive->queue, rq, sg);
-        } else {
                sg_init_one(sg, rq->buffer, rq->nr_sectors * SECTOR_SIZE);
                hwif->sg_nents = 1;
+        } else if (!rq->bio) {
+                sg_init_one(sg, rq->data, rq->data_len);
+                hwif->sg_nents = 1;
+        } else {
+                hwif->sg_nents = blk_rq_map_sg(drive->queue, rq, sg);
        }
 }
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 312127ea443a..ce0818a993f6 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -649,7 +649,8 @@ static int ide_register_port(ide_hwif_t *hwif)
        /* register with global device tree */
        dev_set_name(&hwif->gendev, hwif->name);
        hwif->gendev.driver_data = hwif;
-        hwif->gendev.parent = hwif->dev;
+        if (hwif->gendev.parent == NULL)
+                hwif->gendev.parent = hwif->dev;
        hwif->gendev.release = hwif_release_dev;
        ret = device_register(&hwif->gendev);
@@ -1466,6 +1467,30 @@ struct ide_host *ide_host_alloc(const struct ide_port_info *d, hw_regs_t **hws)
 }
 EXPORT_SYMBOL_GPL(ide_host_alloc);
+static void ide_port_free(ide_hwif_t *hwif)
+{
+        ide_port_free_devices(hwif);
+        ide_free_port_slot(hwif->index);
+        kfree(hwif);
+}
+static void ide_disable_port(ide_hwif_t *hwif)
+{
+        struct ide_host *host = hwif->host;
+        int i;
+        printk(KERN_INFO "%s: disabling port\n", hwif->name);
+        for (i = 0; i < MAX_HOST_PORTS; i++) {
+                if (host->ports[i] == hwif) {
+                        host->ports[i] = NULL;
+                        host->n_ports--;
+                }
+        }
+        ide_port_free(hwif);
+}
 int ide_host_register(struct ide_host *host, const struct ide_port_info *d,
                      hw_regs_t **hws)
 {
@@ -1506,8 +1531,12 @@ int ide_host_register(struct ide_host *host, const struct ide_port_info *d,
                        hwif->present = 1;
                if (hwif->chipset != ide_4drives || !hwif->mate ||
-                    !hwif->mate->present)
+                    !hwif->mate->present) {
-                        ide_register_port(hwif);
+                        if (ide_register_port(hwif)) {
+                                ide_disable_port(hwif);
+                                continue;
+                        }
+                }
                if (hwif->present)
                        ide_port_tune_devices(hwif);
@@ -1520,7 +1549,8 @@ int ide_host_register(struct ide_host *host, const struct ide_port_info *d,
                if (hwif_init(hwif) == 0) {
                        printk(KERN_INFO "%s: failed to initialize IDE "
                                         "interface\n", hwif->name);
-                        hwif->present = 0;
+                        device_unregister(&hwif->gendev);
+                        ide_disable_port(hwif);
                        continue;
                }
@@ -1659,12 +1689,8 @@ void ide_host_free(struct ide_host *host)
        int i;
        ide_host_for_each_port(i, hwif, host) {
-                if (hwif == NULL)
+                if (hwif)
-                        continue;
+                        ide_port_free(hwif);
-                ide_port_free_devices(hwif);
-                ide_free_port_slot(hwif->index);
-                kfree(hwif);
        }
        kfree(host);
diff --git a/drivers/ide/palm_bk3710.c b/drivers/ide/palm_bk3710.c
index a7ac490c9ae3..f38aac78044c 100644
--- a/drivers/ide/palm_bk3710.c
+++ b/drivers/ide/palm_bk3710.c
@@ -346,7 +346,8 @@ static int __init palm_bk3710_probe(struct platform_device *pdev)
 {
        struct clk *clk;
        struct resource *mem, *irq;
-        unsigned long base, rate;
+        void __iomem *base;
+        unsigned long rate;
        int i, rc;
        hw_regs_t hw, *hws[] = { &hw, NULL, NULL, NULL };
@@ -382,11 +383,13 @@ static int __init palm_bk3710_probe(struct platform_device *pdev)
        base = IO_ADDRESS(mem->start);
        /* Configure the Palm Chip controller */
-        palm_bk3710_chipinit((void __iomem *)base);
+        palm_bk3710_chipinit(base);
        for (i = 0; i < IDE_NR_PORTS - 2; i++)
-                hw.io_ports_array[i] = base + IDE_PALM_ATA_PRI_REG_OFFSET + i;
+                hw.io_ports_array[i] = (unsigned long)
-        hw.io_ports.ctl_addr = base + IDE_PALM_ATA_PRI_CTL_OFFSET;
+                                (base + IDE_PALM_ATA_PRI_REG_OFFSET + i);
+        hw.io_ports.ctl_addr = (unsigned long)
+                        (base + IDE_PALM_ATA_PRI_CTL_OFFSET);
        hw.irq = irq->start;
        hw.dev = &pdev->dev;
        hw.chipset = ide_palm3710;
diff --git a/drivers/ide/qd65xx.c b/drivers/ide/qd65xx.c
index 5b2e3af43c4b..08c4fa35e9b1 100644
--- a/drivers/ide/qd65xx.c
+++ b/drivers/ide/qd65xx.c
@@ -16,7 +16,7 @@
 /*
 * Rewritten from the work of Colten Edwards <pje120@cs.usask.ca> by
- * Samuel Thibault <samuel.thibault@fnac.net>
+ * Samuel Thibault <samuel.thibault@ens-lyon.org>
 */
 #include <linux/module.h>
diff --git a/drivers/ide/qd65xx.h b/drivers/ide/qd65xx.h
index 6636f9665d16..d7e67a1a1dcc 100644
--- a/drivers/ide/qd65xx.h
+++ b/drivers/ide/qd65xx.h
@@ -4,7 +4,7 @@
 /*
 * Authors:     Petr Soucek <petr@ryston.cz>
- *              Samuel Thibault <samuel.thibault@fnac.net>
+ *              Samuel Thibault <samuel.thibault@ens-lyon.org>
 */
 /* truncates a in [b,c] */
diff --git a/drivers/ide/tx4939ide.c b/drivers/ide/tx4939ide.c
index 882f6f07c476..40b0812a045c 100644
--- a/drivers/ide/tx4939ide.c
+++ b/drivers/ide/tx4939ide.c
@@ -261,9 +261,9 @@ static int tx4939ide_build_dmatable(ide_drive_t *drive, struct request *rq)
                                bcount = cur_len;
                        /*
                         * This workaround for zero count seems required.
-                         * (standard ide_build_dmatable do it too)
+                         * (standard ide_build_dmatable does it too)
                         */
-                        if ((bcount & 0xffff) == 0x0000)
+                        if (bcount == 0x10000)
                                bcount = 0x8000;
                        *table++ = bcount & 0xffff;
                        *table++ = cur_addr;
diff --git a/drivers/ide/via82cxxx.c b/drivers/ide/via82cxxx.c
index 703c3eeb20a8..6092fe3f409d 100644
--- a/drivers/ide/via82cxxx.c
+++ b/drivers/ide/via82cxxx.c
@@ -448,6 +448,11 @@ static int __devinit via_init_one(struct pci_dev *dev, const struct pci_device_i
                d.host_flags |= IDE_HFLAG_FORCE_LEGACY_IRQS;
 #endif
+#ifdef CONFIG_AMIGAONE
+        if (machine_is(amigaone))
+                d.host_flags |= IDE_HFLAG_FORCE_LEGACY_IRQS;
+#endif
        d.udma_mask = via_config->udma_mask;
        vdev = kzalloc(sizeof(*vdev), GFP_KERNEL);
diff --git a/drivers/ieee1394/dv1394.c b/drivers/ieee1394/dv1394.c
index a329e6bd5d2d..3838bc4acaba 100644
--- a/drivers/ieee1394/dv1394.c
+++ b/drivers/ieee1394/dv1394.c
@@ -1823,6 +1823,10 @@ static int dv1394_open(struct inode *inode, struct file *file)
 #endif
+        printk(KERN_INFO "%s: NOTE, the dv1394 interface is unsupported "
+               "and will not be available in the new firewire driver stack. "
+               "Try libraw1394 based programs instead.\n", current->comm);
        return 0;
 }
@@ -2567,10 +2571,6 @@ static int __init dv1394_init_module(void)
 {
        int ret;
-        printk(KERN_WARNING
-               "NOTE: The dv1394 driver is unsupported and may be removed in a "
-               "future Linux release. Use raw1394 instead.\n");
        cdev_init(&dv1394_cdev, &dv1394_fops);
        dv1394_cdev.owner = THIS_MODULE;
        ret = cdev_add(&dv1394_cdev, IEEE1394_DV1394_DEV, 16);
diff --git a/drivers/ieee1394/ieee1394.h b/drivers/ieee1394/ieee1394.h
index e0ae0d3d747f..af320e2c5079 100644
--- a/drivers/ieee1394/ieee1394.h
+++ b/drivers/ieee1394/ieee1394.h
@@ -54,9 +54,7 @@
 #define IEEE1394_SPEED_800      0x03
 #define IEEE1394_SPEED_1600     0x04
 #define IEEE1394_SPEED_3200     0x05
+#define IEEE1394_SPEED_MAX      IEEE1394_SPEED_3200
-/* The current highest tested speed supported by the subsystem */
-#define IEEE1394_SPEED_MAX      IEEE1394_SPEED_800
 /* Maps speed values above to a string representation */
 extern const char *hpsb_speedto_str[];
diff --git a/drivers/ieee1394/ieee1394_core.c b/drivers/ieee1394/ieee1394_core.c
index dcdb71a7718d..2beb8d94f7bd 100644
--- a/drivers/ieee1394/ieee1394_core.c
+++ b/drivers/ieee1394/ieee1394_core.c
@@ -338,6 +338,7 @@ static void build_speed_map(struct hpsb_host *host, int nodecount)
        u8 cldcnt[nodecount];
        u8 *map = host->speed_map;
        u8 *speedcap = host->speed;
+        u8 local_link_speed = host->csr.lnk_spd;
        struct selfid *sid;
        struct ext_selfid *esid;
        int i, j, n;
@@ -373,8 +374,8 @@ static void build_speed_map(struct hpsb_host *host, int nodecount)
                        if (sid->port2 == SELFID_PORT_CHILD) cldcnt[n]++;
                        speedcap[n] = sid->speed;
-                        if (speedcap[n] > host->csr.lnk_spd)
+                        if (speedcap[n] > local_link_speed)
-                                speedcap[n] = host->csr.lnk_spd;
+                                speedcap[n] = local_link_speed;
                        n--;
                }
        }
@@ -407,12 +408,11 @@ static void build_speed_map(struct hpsb_host *host, int nodecount)
                }
        }
-#if SELFID_SPEED_UNKNOWN != IEEE1394_SPEED_MAX
+        /* assume a maximum speed for 1394b PHYs, nodemgr will correct it */
-        /* assume maximum speed for 1394b PHYs, nodemgr will correct it */
+        if (local_link_speed > SELFID_SPEED_UNKNOWN)
-        for (n = 0; n < nodecount; n++)
+                for (i = 0; i < nodecount; i++)
-                if (speedcap[n] == SELFID_SPEED_UNKNOWN)
+                        if (speedcap[i] == SELFID_SPEED_UNKNOWN)
-                        speedcap[n] = IEEE1394_SPEED_MAX;
+                                speedcap[i] = local_link_speed;
-#endif
 }
diff --git a/drivers/ieee1394/ohci1394.h b/drivers/ieee1394/ohci1394.h
index 4320bf010495..7fb8ab9780ae 100644
--- a/drivers/ieee1394/ohci1394.h
+++ b/drivers/ieee1394/ohci1394.h
@@ -26,7 +26,7 @@
 #define OHCI1394_DRIVER_NAME      "ohci1394"
-#define OHCI1394_MAX_AT_REQ_RETRIES     0x2
+#define OHCI1394_MAX_AT_REQ_RETRIES     0xf
 #define OHCI1394_MAX_AT_RESP_RETRIES    0x2
 #define OHCI1394_MAX_PHYS_RESP_RETRIES  0x8
 #define OHCI1394_MAX_SELF_ID_ERRORS     16
diff --git a/drivers/ieee1394/pcilynx.c b/drivers/ieee1394/pcilynx.c
index dc15cadb06ef..38f712036201 100644
--- a/drivers/ieee1394/pcilynx.c
+++ b/drivers/ieee1394/pcilynx.c
@@ -1419,7 +1419,6 @@ static int __devinit add_card(struct pci_dev *dev,
                i2c_ad = kzalloc(sizeof(*i2c_ad), GFP_KERNEL);
                if (!i2c_ad) FAIL("failed to allocate I2C adapter memory");
-                i2c_ad->id = I2C_HW_B_PCILYNX;
                strlcpy(i2c_ad->name, "PCILynx I2C", sizeof(i2c_ad->name));
                i2c_adapter_data = bit_data;
                i2c_ad->algo_data = &i2c_adapter_data;
diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
index ab1034ccb7fb..f3fd8657ce4b 100644
--- a/drivers/ieee1394/sbp2.c
+++ b/drivers/ieee1394/sbp2.c
@@ -115,8 +115,8 @@
 */
 static int sbp2_max_speed = IEEE1394_SPEED_MAX;
 module_param_named(max_speed, sbp2_max_speed, int, 0644);
-MODULE_PARM_DESC(max_speed, "Force max speed "
+MODULE_PARM_DESC(max_speed, "Limit data transfer speed (5 <= 3200, "
-                 "(3 = 800Mb/s, 2 = 400Mb/s, 1 = 200Mb/s, 0 = 100Mb/s)");
+                 "4 <= 1600, 3 <= 800, 2 <= 400, 1 <= 200, 0 = 100 Mb/s)");
 /*
 * Set serialize_io to 0 or N to use dynamically appended lists of command ORBs.
@@ -256,7 +256,7 @@ static int sbp2_set_busy_timeout(struct sbp2_lu *);
 static int sbp2_max_speed_and_size(struct sbp2_lu *);
-static const u8 sbp2_speedto_max_payload[] = { 0x7, 0x8, 0x9, 0xA, 0xB, 0xC };
+static const u8 sbp2_speedto_max_payload[] = { 0x7, 0x8, 0x9, 0xa, 0xa, 0xa };
 static DEFINE_RWLOCK(sbp2_hi_logical_units_lock);
@@ -347,8 +347,8 @@ static struct scsi_host_template sbp2_shost_template = {
        .sdev_attrs              = sbp2_sysfs_sdev_attrs,
 };
-/* for match-all entries in sbp2_workarounds_table */
+#define SBP2_ROM_VALUE_WILDCARD ~0         /* match all */
-#define SBP2_ROM_VALUE_WILDCARD 0x1000000
+#define SBP2_ROM_VALUE_MISSING  0xff000000 /* not present in the unit dir. */
 /*
 * List of devices with known bugs.
@@ -359,60 +359,70 @@ static struct scsi_host_template sbp2_shost_template = {
 */
 static const struct {
        u32 firmware_revision;
-        u32 model_id;
+        u32 model;
        unsigned workarounds;
 } sbp2_workarounds_table[] = {
        /* DViCO Momobay CX-1 with TSB42AA9 bridge */ {
                .firmware_revision      = 0x002800,
-                .model_id               = 0x001010,
+                .model                  = 0x001010,
                .workarounds            = SBP2_WORKAROUND_INQUIRY_36 |
                                          SBP2_WORKAROUND_MODE_SENSE_8 |
                                          SBP2_WORKAROUND_POWER_CONDITION,
        },
        /* DViCO Momobay FX-3A with TSB42AA9A bridge */ {
                .firmware_revision      = 0x002800,
-                .model_id               = 0x000000,
+                .model                  = 0x000000,
                .workarounds            = SBP2_WORKAROUND_DELAY_INQUIRY |
                                          SBP2_WORKAROUND_POWER_CONDITION,
        },
        /* Initio bridges, actually only needed for some older ones */ {
                .firmware_revision      = 0x000200,
-                .model_id               = SBP2_ROM_VALUE_WILDCARD,
+                .model                  = SBP2_ROM_VALUE_WILDCARD,
                .workarounds            = SBP2_WORKAROUND_INQUIRY_36,
        },
        /* PL-3507 bridge with Prolific firmware */ {
                .firmware_revision      = 0x012800,
-                .model_id               = SBP2_ROM_VALUE_WILDCARD,
+                .model                  = SBP2_ROM_VALUE_WILDCARD,
                .workarounds            = SBP2_WORKAROUND_POWER_CONDITION,
        },
        /* Symbios bridge */ {
                .firmware_revision      = 0xa0b800,
-                .model_id               = SBP2_ROM_VALUE_WILDCARD,
+                .model                  = SBP2_ROM_VALUE_WILDCARD,
                .workarounds            = SBP2_WORKAROUND_128K_MAX_TRANS,
        },
        /* Datafab MD2-FW2 with Symbios/LSILogic SYM13FW500 bridge */ {
                .firmware_revision      = 0x002600,
-                .model_id               = SBP2_ROM_VALUE_WILDCARD,
+                .model                  = SBP2_ROM_VALUE_WILDCARD,
                .workarounds            = SBP2_WORKAROUND_128K_MAX_TRANS,
        },
+        /*
+         * iPod 2nd generation: needs 128k max transfer size workaround
+         * iPod 3rd generation: needs fix capacity workaround
+         */
+        {
+                .firmware_revision      = 0x0a2700,
+                .model                  = 0x000000,
+                .workarounds            = SBP2_WORKAROUND_128K_MAX_TRANS |
+                                          SBP2_WORKAROUND_FIX_CAPACITY,
+        },
        /* iPod 4th generation */ {
                .firmware_revision      = 0x0a2700,
-                .model_id               = 0x000021,
+                .model                  = 0x000021,
                .workarounds            = SBP2_WORKAROUND_FIX_CAPACITY,
        },
        /* iPod mini */ {
                .firmware_revision      = 0x0a2700,
-                .model_id               = 0x000022,
+                .model                  = 0x000022,
                .workarounds            = SBP2_WORKAROUND_FIX_CAPACITY,
        },
        /* iPod mini */ {
                .firmware_revision      = 0x0a2700,
-                .model_id               = 0x000023,
+                .model                  = 0x000023,
                .workarounds            = SBP2_WORKAROUND_FIX_CAPACITY,
        },
        /* iPod Photo */ {
                .firmware_revision      = 0x0a2700,
-                .model_id               = 0x00007e,
+                .model                  = 0x00007e,
                .workarounds            = SBP2_WORKAROUND_FIX_CAPACITY,
        }
 };
@@ -1341,13 +1351,15 @@ static void sbp2_parse_unit_directory(struct sbp2_lu *lu,
        struct csr1212_keyval *kv;
        struct csr1212_dentry *dentry;
        u64 management_agent_addr;
-        u32 unit_characteristics, firmware_revision;
+        u32 unit_characteristics, firmware_revision, model;
        unsigned workarounds;
        int i;
        management_agent_addr = 0;
        unit_characteristics = 0;
-        firmware_revision = 0;
+        firmware_revision = SBP2_ROM_VALUE_MISSING;
+        model = ud->flags & UNIT_DIRECTORY_MODEL_ID ?
+                                ud->model_id : SBP2_ROM_VALUE_MISSING;
        csr1212_for_each_dir_entry(ud->ne->csr, kv, ud->ud_kv, dentry) {
                switch (kv->key.id) {
@@ -1388,9 +1400,9 @@ static void sbp2_parse_unit_directory(struct sbp2_lu *lu,
                            sbp2_workarounds_table[i].firmware_revision !=
                            (firmware_revision & 0xffff00))
                                continue;
-                        if (sbp2_workarounds_table[i].model_id !=
+                        if (sbp2_workarounds_table[i].model !=
                            SBP2_ROM_VALUE_WILDCARD &&
-                            sbp2_workarounds_table[i].model_id != ud->model_id)
+                            sbp2_workarounds_table[i].model != model)
                                continue;
                        workarounds |= sbp2_workarounds_table[i].workarounds;
                        break;
@@ -1403,7 +1415,7 @@ static void sbp2_parse_unit_directory(struct sbp2_lu *lu,
                          NODE_BUS_ARGS(ud->ne->host, ud->ne->nodeid),
                          workarounds, firmware_revision,
                          ud->vendor_id ? ud->vendor_id : ud->ne->vendor_id,
-                          ud->model_id);
+                          model);
        /* We would need one SCSI host template for each target to adjust
         * max_sectors on the fly, therefore warn only. */
diff --git a/drivers/infiniband/hw/ehca/ehca_cq.c b/drivers/infiniband/hw/ehca/ehca_cq.c
index 2f4c28a30271..97e4b231cdc4 100644
--- a/drivers/infiniband/hw/ehca/ehca_cq.c
+++ b/drivers/infiniband/hw/ehca/ehca_cq.c
@@ -196,7 +196,7 @@ struct ib_cq *ehca_create_cq(struct ib_device *device, int cqe, int comp_vector,
        if (h_ret != H_SUCCESS) {
                ehca_err(device, "hipz_h_alloc_resource_cq() failed "
-                         "h_ret=%li device=%p", h_ret, device);
+                         "h_ret=%lli device=%p", h_ret, device);
                cq = ERR_PTR(ehca2ib_return_code(h_ret));
                goto create_cq_exit2;
        }
@@ -232,7 +232,7 @@ struct ib_cq *ehca_create_cq(struct ib_device *device, int cqe, int comp_vector,
                if (h_ret < H_SUCCESS) {
                        ehca_err(device, "hipz_h_register_rpage_cq() failed "
-                                 "ehca_cq=%p cq_num=%x h_ret=%li counter=%i "
+                                 "ehca_cq=%p cq_num=%x h_ret=%lli counter=%i "
                                 "act_pages=%i", my_cq, my_cq->cq_number,
                                 h_ret, counter, param.act_pages);
                        cq = ERR_PTR(-EINVAL);
@@ -244,7 +244,7 @@ struct ib_cq *ehca_create_cq(struct ib_device *device, int cqe, int comp_vector,
                        if ((h_ret != H_SUCCESS) || vpage) {
                                ehca_err(device, "Registration of pages not "
                                         "complete ehca_cq=%p cq_num=%x "
-                                         "h_ret=%li", my_cq, my_cq->cq_number,
+                                         "h_ret=%lli", my_cq, my_cq->cq_number,
                                         h_ret);
                                cq = ERR_PTR(-EAGAIN);
                                goto create_cq_exit4;
@@ -252,7 +252,7 @@ struct ib_cq *ehca_create_cq(struct ib_device *device, int cqe, int comp_vector,
                } else {
                        if (h_ret != H_PAGE_REGISTERED) {
                                ehca_err(device, "Registration of page failed "
-                                         "ehca_cq=%p cq_num=%x h_ret=%li "
+                                         "ehca_cq=%p cq_num=%x h_ret=%lli "
                                         "counter=%i act_pages=%i",
                                         my_cq, my_cq->cq_number,
                                         h_ret, counter, param.act_pages);
@@ -266,7 +266,7 @@ struct ib_cq *ehca_create_cq(struct ib_device *device, int cqe, int comp_vector,
        gal = my_cq->galpas.kernel;
        cqx_fec = hipz_galpa_load(gal, CQTEMM_OFFSET(cqx_fec));
-        ehca_dbg(device, "ehca_cq=%p cq_num=%x CQX_FEC=%lx",
+        ehca_dbg(device, "ehca_cq=%p cq_num=%x CQX_FEC=%llx",
                 my_cq, my_cq->cq_number, cqx_fec);
        my_cq->ib_cq.cqe = my_cq->nr_of_entries =
@@ -307,7 +307,7 @@ create_cq_exit3:
        h_ret = hipz_h_destroy_cq(adapter_handle, my_cq, 1);
        if (h_ret != H_SUCCESS)
                ehca_err(device, "hipz_h_destroy_cq() failed ehca_cq=%p "
-                         "cq_num=%x h_ret=%li", my_cq, my_cq->cq_number, h_ret);
+                         "cq_num=%x h_ret=%lli", my_cq, my_cq->cq_number, h_ret);
 create_cq_exit2:
        write_lock_irqsave(&ehca_cq_idr_lock, flags);
@@ -355,7 +355,7 @@ int ehca_destroy_cq(struct ib_cq *cq)
        h_ret = hipz_h_destroy_cq(adapter_handle, my_cq, 0);
        if (h_ret == H_R_STATE) {
                /* cq in err: read err data and destroy it forcibly */
-                ehca_dbg(device, "ehca_cq=%p cq_num=%x ressource=%lx in err "
+                ehca_dbg(device, "ehca_cq=%p cq_num=%x resource=%llx in err "
                         "state. Try to delete it forcibly.",
                         my_cq, cq_num, my_cq->ipz_cq_handle.handle);
                ehca_error_data(shca, my_cq, my_cq->ipz_cq_handle.handle);
@@ -365,7 +365,7 @@ int ehca_destroy_cq(struct ib_cq *cq)
                                 cq_num);
        }
        if (h_ret != H_SUCCESS) {
-                ehca_err(device, "hipz_h_destroy_cq() failed h_ret=%li "
+                ehca_err(device, "hipz_h_destroy_cq() failed h_ret=%lli "
                         "ehca_cq=%p cq_num=%x", h_ret, my_cq, cq_num);
                return ehca2ib_return_code(h_ret);
        }
diff --git a/drivers/infiniband/hw/ehca/ehca_hca.c b/drivers/infiniband/hw/ehca/ehca_hca.c
index 46288220cfbb..9209c5332dfe 100644
--- a/drivers/infiniband/hw/ehca/ehca_hca.c
+++ b/drivers/infiniband/hw/ehca/ehca_hca.c
@@ -393,7 +393,7 @@ int ehca_modify_port(struct ib_device *ibdev,
        hret = hipz_h_modify_port(shca->ipz_hca_handle, port,
                                  cap, props->init_type, port_modify_mask);
        if (hret != H_SUCCESS) {
-                ehca_err(&shca->ib_device, "Modify port failed  h_ret=%li",
+                ehca_err(&shca->ib_device, "Modify port failed  h_ret=%lli",
                         hret);
                ret = -EINVAL;
        }
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index 3128a5090dbd..99bcbd7ffb0a 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -99,7 +99,7 @@ static void print_error_data(struct ehca_shca *shca, void *data,
                        return;
                ehca_err(&shca->ib_device,
-                         "QP 0x%x (resource=%lx) has errors.",
+                         "QP 0x%x (resource=%llx) has errors.",
                         qp->ib_qp.qp_num, resource);
                break;
        }
@@ -108,21 +108,21 @@ static void print_error_data(struct ehca_shca *shca, void *data,
                struct ehca_cq *cq = (struct ehca_cq *)data;
                ehca_err(&shca->ib_device,
-                         "CQ 0x%x (resource=%lx) has errors.",
+                         "CQ 0x%x (resource=%llx) has errors.",
                         cq->cq_number, resource);
                break;
        }
        default:
                ehca_err(&shca->ib_device,
-                         "Unknown error type: %lx on %s.",
+                         "Unknown error type: %llx on %s.",
                         type, shca->ib_device.name);
                break;
        }
-        ehca_err(&shca->ib_device, "Error data is available: %lx.", resource);
+        ehca_err(&shca->ib_device, "Error data is available: %llx.", resource);
        ehca_err(&shca->ib_device, "EHCA ----- error data begin "
                 "---------------------------------------------------");
-        ehca_dmp(rblock, length, "resource=%lx", resource);
+        ehca_dmp(rblock, length, "resource=%llx", resource);
        ehca_err(&shca->ib_device, "EHCA ----- error data end "
                 "----------------------------------------------------");
@@ -152,7 +152,7 @@ int ehca_error_data(struct ehca_shca *shca, void *data,
        if (ret == H_R_STATE)
                ehca_err(&shca->ib_device,
-                         "No error data is available: %lx.", resource);
+                         "No error data is available: %llx.", resource);
        else if (ret == H_SUCCESS) {
                int length;
@@ -164,7 +164,7 @@ int ehca_error_data(struct ehca_shca *shca, void *data,
                print_error_data(shca, data, rblock, length);
        } else
                ehca_err(&shca->ib_device,
-                         "Error data could not be fetched: %lx", resource);
+                         "Error data could not be fetched: %llx", resource);
        ehca_free_fw_ctrlblock(rblock);
@@ -514,7 +514,7 @@ static inline void process_eqe(struct ehca_shca *shca, struct ehca_eqe *eqe)
        struct ehca_cq *cq;
        eqe_value = eqe->entry;
-        ehca_dbg(&shca->ib_device, "eqe_value=%lx", eqe_value);
+        ehca_dbg(&shca->ib_device, "eqe_value=%llx", eqe_value);
        if (EHCA_BMASK_GET(EQE_COMPLETION_EVENT, eqe_value)) {
                ehca_dbg(&shca->ib_device, "Got completion event");
                token = EHCA_BMASK_GET(EQE_CQ_TOKEN, eqe_value);
@@ -603,7 +603,7 @@ void ehca_process_eq(struct ehca_shca *shca, int is_irq)
                ret = hipz_h_eoi(eq->ist);
                if (ret != H_SUCCESS)
                        ehca_err(&shca->ib_device,
-                                 "bad return code EOI -rc = %ld\n", ret);
+                                 "bad return code EOI -rc = %lld\n", ret);
                ehca_dbg(&shca->ib_device, "deadman found %x eqe", eqe_cnt);
        }
        if (unlikely(eqe_cnt == EHCA_EQE_CACHE_SIZE))
diff --git a/drivers/infiniband/hw/ehca/ehca_main.c b/drivers/infiniband/hw/ehca/ehca_main.c
index c7b8a506af65..368311ce332b 100644
--- a/drivers/infiniband/hw/ehca/ehca_main.c
+++ b/drivers/infiniband/hw/ehca/ehca_main.c
@@ -304,7 +304,7 @@ static int ehca_sense_attributes(struct ehca_shca *shca)
        h_ret = hipz_h_query_hca(shca->ipz_hca_handle, rblock);
        if (h_ret != H_SUCCESS) {
-                ehca_gen_err("Cannot query device properties. h_ret=%li",
+                ehca_gen_err("Cannot query device properties. h_ret=%lli",
                             h_ret);
                ret = -EPERM;
                goto sense_attributes1;
@@ -391,7 +391,7 @@ static int ehca_sense_attributes(struct ehca_shca *shca)
        port = (struct hipz_query_port *)rblock;
        h_ret = hipz_h_query_port(shca->ipz_hca_handle, 1, port);
        if (h_ret != H_SUCCESS) {
-                ehca_gen_err("Cannot query port properties. h_ret=%li",
+                ehca_gen_err("Cannot query port properties. h_ret=%lli",
                             h_ret);
                ret = -EPERM;
                goto sense_attributes1;
@@ -682,7 +682,7 @@ static ssize_t ehca_show_adapter_handle(struct device *dev,
 {
        struct ehca_shca *shca = dev->driver_data;
-        return sprintf(buf, "%lx\n", shca->ipz_hca_handle.handle);
+        return sprintf(buf, "%llx\n", shca->ipz_hca_handle.handle);
 }
 static DEVICE_ATTR(adapter_handle, S_IRUGO, ehca_show_adapter_handle, NULL);
diff --git a/drivers/infiniband/hw/ehca/ehca_mcast.c b/drivers/infiniband/hw/ehca/ehca_mcast.c
index e3ef0264ccc6..120aedf9f989 100644
--- a/drivers/infiniband/hw/ehca/ehca_mcast.c
+++ b/drivers/infiniband/hw/ehca/ehca_mcast.c
@@ -88,7 +88,7 @@ int ehca_attach_mcast(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
        if (h_ret != H_SUCCESS)
                ehca_err(ibqp->device,
                         "ehca_qp=%p qp_num=%x hipz_h_attach_mcqp() failed "
-                         "h_ret=%li", my_qp, ibqp->qp_num, h_ret);
+                         "h_ret=%lli", my_qp, ibqp->qp_num, h_ret);
        return ehca2ib_return_code(h_ret);
 }
@@ -125,7 +125,7 @@ int ehca_detach_mcast(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
        if (h_ret != H_SUCCESS)
                ehca_err(ibqp->device,
                         "ehca_qp=%p qp_num=%x hipz_h_detach_mcqp() failed "
-                         "h_ret=%li", my_qp, ibqp->qp_num, h_ret);
+                         "h_ret=%lli", my_qp, ibqp->qp_num, h_ret);
        return ehca2ib_return_code(h_ret);
 }
diff --git a/drivers/infiniband/hw/ehca/ehca_mrmw.c b/drivers/infiniband/hw/ehca/ehca_mrmw.c
index f974367cad40..72f83f7df614 100644
--- a/drivers/infiniband/hw/ehca/ehca_mrmw.c
+++ b/drivers/infiniband/hw/ehca/ehca_mrmw.c
@@ -204,7 +204,7 @@ struct ib_mr *ehca_reg_phys_mr(struct ib_pd *pd,
        }
        if ((size == 0) ||
            (((u64)iova_start + size) < (u64)iova_start)) {
-                ehca_err(pd->device, "bad input values: size=%lx iova_start=%p",
+                ehca_err(pd->device, "bad input values: size=%llx iova_start=%p",
                         size, iova_start);
                ib_mr = ERR_PTR(-EINVAL);
                goto reg_phys_mr_exit0;
@@ -309,8 +309,8 @@ struct ib_mr *ehca_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
        }
        if (length == 0 || virt + length < virt) {
-                ehca_err(pd->device, "bad input values: length=%lx "
+                ehca_err(pd->device, "bad input values: length=%llx "
-                         "virt_base=%lx", length, virt);
+                         "virt_base=%llx", length, virt);
                ib_mr = ERR_PTR(-EINVAL);
                goto reg_user_mr_exit0;
        }
@@ -373,7 +373,7 @@ reg_user_mr_fallback:
                          &e_mr->ib.ib_mr.rkey);
        if (ret == -EINVAL && pginfo.hwpage_size > PAGE_SIZE) {
                ehca_warn(pd->device, "failed to register mr "
-                          "with hwpage_size=%lx", hwpage_size);
+                          "with hwpage_size=%llx", hwpage_size);
                ehca_info(pd->device, "try to register mr with "
                          "kpage_size=%lx", PAGE_SIZE);
                /*
@@ -509,7 +509,7 @@ int ehca_rereg_phys_mr(struct ib_mr *mr,
                        goto rereg_phys_mr_exit1;
                if ((new_size == 0) ||
                    (((u64)iova_start + new_size) < (u64)iova_start)) {
-                        ehca_err(mr->device, "bad input values: new_size=%lx "
+                        ehca_err(mr->device, "bad input values: new_size=%llx "
                                 "iova_start=%p", new_size, iova_start);
                        ret = -EINVAL;
                        goto rereg_phys_mr_exit1;
@@ -580,8 +580,8 @@ int ehca_query_mr(struct ib_mr *mr, struct ib_mr_attr *mr_attr)
        h_ret = hipz_h_query_mr(shca->ipz_hca_handle, e_mr, &hipzout);
        if (h_ret != H_SUCCESS) {
-                ehca_err(mr->device, "hipz_mr_query failed, h_ret=%li mr=%p "
+                ehca_err(mr->device, "hipz_mr_query failed, h_ret=%lli mr=%p "
-                         "hca_hndl=%lx mr_hndl=%lx lkey=%x",
+                         "hca_hndl=%llx mr_hndl=%llx lkey=%x",
                         h_ret, mr, shca->ipz_hca_handle.handle,
                         e_mr->ipz_mr_handle.handle, mr->lkey);
                ret = ehca2ib_return_code(h_ret);
@@ -630,8 +630,8 @@ int ehca_dereg_mr(struct ib_mr *mr)
        /* TODO: BUSY: MR still has bound window(s) */
        h_ret = hipz_h_free_resource_mr(shca->ipz_hca_handle, e_mr);
        if (h_ret != H_SUCCESS) {
-                ehca_err(mr->device, "hipz_free_mr failed, h_ret=%li shca=%p "
+                ehca_err(mr->device, "hipz_free_mr failed, h_ret=%lli shca=%p "
-                         "e_mr=%p hca_hndl=%lx mr_hndl=%lx mr->lkey=%x",
+                         "e_mr=%p hca_hndl=%llx mr_hndl=%llx mr->lkey=%x",
                         h_ret, shca, e_mr, shca->ipz_hca_handle.handle,
                         e_mr->ipz_mr_handle.handle, mr->lkey);
                ret = ehca2ib_return_code(h_ret);
@@ -671,8 +671,8 @@ struct ib_mw *ehca_alloc_mw(struct ib_pd *pd)
        h_ret = hipz_h_alloc_resource_mw(shca->ipz_hca_handle, e_mw,
                                         e_pd->fw_pd, &hipzout);
        if (h_ret != H_SUCCESS) {
-                ehca_err(pd->device, "hipz_mw_allocate failed, h_ret=%li "
+                ehca_err(pd->device, "hipz_mw_allocate failed, h_ret=%lli "
-                         "shca=%p hca_hndl=%lx mw=%p",
+                         "shca=%p hca_hndl=%llx mw=%p",
                         h_ret, shca, shca->ipz_hca_handle.handle, e_mw);
                ib_mw = ERR_PTR(ehca2ib_return_code(h_ret));
                goto alloc_mw_exit1;
@@ -713,8 +713,8 @@ int ehca_dealloc_mw(struct ib_mw *mw)
        h_ret = hipz_h_free_resource_mw(shca->ipz_hca_handle, e_mw);
        if (h_ret != H_SUCCESS) {
-                ehca_err(mw->device, "hipz_free_mw failed, h_ret=%li shca=%p "
+                ehca_err(mw->device, "hipz_free_mw failed, h_ret=%lli shca=%p "
-                         "mw=%p rkey=%x hca_hndl=%lx mw_hndl=%lx",
+                         "mw=%p rkey=%x hca_hndl=%llx mw_hndl=%llx",
                         h_ret, shca, mw, mw->rkey, shca->ipz_hca_handle.handle,
                         e_mw->ipz_mw_handle.handle);
                return ehca2ib_return_code(h_ret);
@@ -840,7 +840,7 @@ int ehca_map_phys_fmr(struct ib_fmr *fmr,
                goto map_phys_fmr_exit0;
        if (iova % e_fmr->fmr_page_size) {
                /* only whole-numbered pages */
-                ehca_err(fmr->device, "bad iova, iova=%lx fmr_page_size=%x",
+                ehca_err(fmr->device, "bad iova, iova=%llx fmr_page_size=%x",
                         iova, e_fmr->fmr_page_size);
                ret = -EINVAL;
                goto map_phys_fmr_exit0;
@@ -878,7 +878,7 @@ int ehca_map_phys_fmr(struct ib_fmr *fmr,
 map_phys_fmr_exit0:
        if (ret)
                ehca_err(fmr->device, "ret=%i fmr=%p page_list=%p list_len=%x "
-                         "iova=%lx", ret, fmr, page_list, list_len, iova);
+                         "iova=%llx", ret, fmr, page_list, list_len, iova);
        return ret;
 } /* end ehca_map_phys_fmr() */
@@ -964,8 +964,8 @@ int ehca_dealloc_fmr(struct ib_fmr *fmr)
        h_ret = hipz_h_free_resource_mr(shca->ipz_hca_handle, e_fmr);
        if (h_ret != H_SUCCESS) {
-                ehca_err(fmr->device, "hipz_free_mr failed, h_ret=%li e_fmr=%p "
+                ehca_err(fmr->device, "hipz_free_mr failed, h_ret=%lli e_fmr=%p "
-                         "hca_hndl=%lx fmr_hndl=%lx fmr->lkey=%x",
+                         "hca_hndl=%llx fmr_hndl=%llx fmr->lkey=%x",
                         h_ret, e_fmr, shca->ipz_hca_handle.handle,
                         e_fmr->ipz_mr_handle.handle, fmr->lkey);
                ret = ehca2ib_return_code(h_ret);
@@ -1007,8 +1007,8 @@ int ehca_reg_mr(struct ehca_shca *shca,
                                         (u64)iova_start, size, hipz_acl,
                                         e_pd->fw_pd, &hipzout);
        if (h_ret != H_SUCCESS) {
-                ehca_err(&shca->ib_device, "hipz_alloc_mr failed, h_ret=%li "
+                ehca_err(&shca->ib_device, "hipz_alloc_mr failed, h_ret=%lli "
-                         "hca_hndl=%lx", h_ret, shca->ipz_hca_handle.handle);
+                         "hca_hndl=%llx", h_ret, shca->ipz_hca_handle.handle);
                ret = ehca2ib_return_code(h_ret);
                goto ehca_reg_mr_exit0;
        }
@@ -1033,9 +1033,9 @@ int ehca_reg_mr(struct ehca_shca *shca,
 ehca_reg_mr_exit1:
        h_ret = hipz_h_free_resource_mr(shca->ipz_hca_handle, e_mr);
        if (h_ret != H_SUCCESS) {
-                ehca_err(&shca->ib_device, "h_ret=%li shca=%p e_mr=%p "
+                ehca_err(&shca->ib_device, "h_ret=%lli shca=%p e_mr=%p "
-                         "iova_start=%p size=%lx acl=%x e_pd=%p lkey=%x "
+                         "iova_start=%p size=%llx acl=%x e_pd=%p lkey=%x "
-                         "pginfo=%p num_kpages=%lx num_hwpages=%lx ret=%i",
+                         "pginfo=%p num_kpages=%llx num_hwpages=%llx ret=%i",
                         h_ret, shca, e_mr, iova_start, size, acl, e_pd,
                         hipzout.lkey, pginfo, pginfo->num_kpages,
                         pginfo->num_hwpages, ret);
@@ -1045,8 +1045,8 @@ ehca_reg_mr_exit1:
 ehca_reg_mr_exit0:
        if (ret)
                ehca_err(&shca->ib_device, "ret=%i shca=%p e_mr=%p "
-                         "iova_start=%p size=%lx acl=%x e_pd=%p pginfo=%p "
+                         "iova_start=%p size=%llx acl=%x e_pd=%p pginfo=%p "
-                         "num_kpages=%lx num_hwpages=%lx",
+                         "num_kpages=%llx num_hwpages=%llx",
                         ret, shca, e_mr, iova_start, size, acl, e_pd, pginfo,
                         pginfo->num_kpages, pginfo->num_hwpages);
        return ret;
@@ -1116,8 +1116,8 @@ int ehca_reg_mr_rpages(struct ehca_shca *shca,
                         */
                        if (h_ret != H_SUCCESS) {
                                ehca_err(&shca->ib_device, "last "
-                                         "hipz_reg_rpage_mr failed, h_ret=%li "
+                                         "hipz_reg_rpage_mr failed, h_ret=%lli "
-                                         "e_mr=%p i=%x hca_hndl=%lx mr_hndl=%lx"
+                                         "e_mr=%p i=%x hca_hndl=%llx mr_hndl=%llx"
                                         " lkey=%x", h_ret, e_mr, i,
                                         shca->ipz_hca_handle.handle,
                                         e_mr->ipz_mr_handle.handle,
@@ -1128,8 +1128,8 @@ int ehca_reg_mr_rpages(struct ehca_shca *shca,
                                ret = 0;
                } else if (h_ret != H_PAGE_REGISTERED) {
                        ehca_err(&shca->ib_device, "hipz_reg_rpage_mr failed, "
-                                 "h_ret=%li e_mr=%p i=%x lkey=%x hca_hndl=%lx "
+                                 "h_ret=%lli e_mr=%p i=%x lkey=%x hca_hndl=%llx "
-                                 "mr_hndl=%lx", h_ret, e_mr, i,
+                                 "mr_hndl=%llx", h_ret, e_mr, i,
                                 e_mr->ib.ib_mr.lkey,
                                 shca->ipz_hca_handle.handle,
                                 e_mr->ipz_mr_handle.handle);
@@ -1145,7 +1145,7 @@ ehca_reg_mr_rpages_exit1:
 ehca_reg_mr_rpages_exit0:
        if (ret)
                ehca_err(&shca->ib_device, "ret=%i shca=%p e_mr=%p pginfo=%p "
-                         "num_kpages=%lx num_hwpages=%lx", ret, shca, e_mr,
+                         "num_kpages=%llx num_hwpages=%llx", ret, shca, e_mr,
                         pginfo, pginfo->num_kpages, pginfo->num_hwpages);
        return ret;
 } /* end ehca_reg_mr_rpages() */
@@ -1184,7 +1184,7 @@ inline int ehca_rereg_mr_rereg1(struct ehca_shca *shca,
        ret = ehca_set_pagebuf(pginfo, pginfo->num_hwpages, kpage);
        if (ret) {
                ehca_err(&shca->ib_device, "set pagebuf failed, e_mr=%p "
-                         "pginfo=%p type=%x num_kpages=%lx num_hwpages=%lx "
+                         "pginfo=%p type=%x num_kpages=%llx num_hwpages=%llx "
                         "kpage=%p", e_mr, pginfo, pginfo->type,
                         pginfo->num_kpages, pginfo->num_hwpages, kpage);
                goto ehca_rereg_mr_rereg1_exit1;
@@ -1205,13 +1205,13 @@ inline int ehca_rereg_mr_rereg1(struct ehca_shca *shca,
                 * (MW bound or MR is shared)
                 */
                ehca_warn(&shca->ib_device, "hipz_h_reregister_pmr failed "
-                          "(Rereg1), h_ret=%li e_mr=%p", h_ret, e_mr);
+                          "(Rereg1), h_ret=%lli e_mr=%p", h_ret, e_mr);
                *pginfo = pginfo_save;
                ret = -EAGAIN;
        } else if ((u64 *)hipzout.vaddr != iova_start) {
                ehca_err(&shca->ib_device, "PHYP changed iova_start in "
-                         "rereg_pmr, iova_start=%p iova_start_out=%lx e_mr=%p "
+                         "rereg_pmr, iova_start=%p iova_start_out=%llx e_mr=%p "
-                         "mr_handle=%lx lkey=%x lkey_out=%x", iova_start,
+                         "mr_handle=%llx lkey=%x lkey_out=%x", iova_start,
                         hipzout.vaddr, e_mr, e_mr->ipz_mr_handle.handle,
                         e_mr->ib.ib_mr.lkey, hipzout.lkey);
                ret = -EFAULT;
@@ -1235,7 +1235,7 @@ ehca_rereg_mr_rereg1_exit1:
 ehca_rereg_mr_rereg1_exit0:
        if ( ret && (ret != -EAGAIN) )
                ehca_err(&shca->ib_device, "ret=%i lkey=%x rkey=%x "
-                         "pginfo=%p num_kpages=%lx num_hwpages=%lx",
+                         "pginfo=%p num_kpages=%llx num_hwpages=%llx",
                         ret, *lkey, *rkey, pginfo, pginfo->num_kpages,
                         pginfo->num_hwpages);
        return ret;
@@ -1263,7 +1263,7 @@ int ehca_rereg_mr(struct ehca_shca *shca,
            (e_mr->num_hwpages > MAX_RPAGES) ||
            (pginfo->num_hwpages > e_mr->num_hwpages)) {
                ehca_dbg(&shca->ib_device, "Rereg3 case, "
-                         "pginfo->num_hwpages=%lx e_mr->num_hwpages=%x",
+                         "pginfo->num_hwpages=%llx e_mr->num_hwpages=%x",
                         pginfo->num_hwpages, e_mr->num_hwpages);
                rereg_1_hcall = 0;
                rereg_3_hcall = 1;
@@ -1295,7 +1295,7 @@ int ehca_rereg_mr(struct ehca_shca *shca,
                h_ret = hipz_h_free_resource_mr(shca->ipz_hca_handle, e_mr);
                if (h_ret != H_SUCCESS) {
                        ehca_err(&shca->ib_device, "hipz_free_mr failed, "
-                                 "h_ret=%li e_mr=%p hca_hndl=%lx mr_hndl=%lx "
+                                 "h_ret=%lli e_mr=%p hca_hndl=%llx mr_hndl=%llx "
                                 "mr->lkey=%x",
                                 h_ret, e_mr, shca->ipz_hca_handle.handle,
                                 e_mr->ipz_mr_handle.handle,
@@ -1328,8 +1328,8 @@ int ehca_rereg_mr(struct ehca_shca *shca,
 ehca_rereg_mr_exit0:
        if (ret)
                ehca_err(&shca->ib_device, "ret=%i shca=%p e_mr=%p "
-                         "iova_start=%p size=%lx acl=%x e_pd=%p pginfo=%p "
+                         "iova_start=%p size=%llx acl=%x e_pd=%p pginfo=%p "
-                         "num_kpages=%lx lkey=%x rkey=%x rereg_1_hcall=%x "
+                         "num_kpages=%llx lkey=%x rkey=%x rereg_1_hcall=%x "
                         "rereg_3_hcall=%x", ret, shca, e_mr, iova_start, size,
                         acl, e_pd, pginfo, pginfo->num_kpages, *lkey, *rkey,
                         rereg_1_hcall, rereg_3_hcall);
@@ -1371,8 +1371,8 @@ int ehca_unmap_one_fmr(struct ehca_shca *shca,
                 * FMRs are not shared and no MW bound to FMRs
                 */
                ehca_err(&shca->ib_device, "hipz_reregister_pmr failed "
-                         "(Rereg1), h_ret=%li e_fmr=%p hca_hndl=%lx "
+                         "(Rereg1), h_ret=%lli e_fmr=%p hca_hndl=%llx "
-                         "mr_hndl=%lx lkey=%x lkey_out=%x",
+                         "mr_hndl=%llx lkey=%x lkey_out=%x",
                         h_ret, e_fmr, shca->ipz_hca_handle.handle,
                         e_fmr->ipz_mr_handle.handle,
                         e_fmr->ib.ib_fmr.lkey, hipzout.lkey);
@@ -1383,7 +1383,7 @@ int ehca_unmap_one_fmr(struct ehca_shca *shca,
        h_ret = hipz_h_free_resource_mr(shca->ipz_hca_handle, e_fmr);
        if (h_ret != H_SUCCESS) {
                ehca_err(&shca->ib_device, "hipz_free_mr failed, "
-                         "h_ret=%li e_fmr=%p hca_hndl=%lx mr_hndl=%lx "
+                         "h_ret=%lli e_fmr=%p hca_hndl=%llx mr_hndl=%llx "
                         "lkey=%x",
                         h_ret, e_fmr, shca->ipz_hca_handle.handle,
                         e_fmr->ipz_mr_handle.handle,
@@ -1447,9 +1447,9 @@ int ehca_reg_smr(struct ehca_shca *shca,
                                    (u64)iova_start, hipz_acl, e_pd->fw_pd,
                                    &hipzout);
        if (h_ret != H_SUCCESS) {
-                ehca_err(&shca->ib_device, "hipz_reg_smr failed, h_ret=%li "
+                ehca_err(&shca->ib_device, "hipz_reg_smr failed, h_ret=%lli "
                         "shca=%p e_origmr=%p e_newmr=%p iova_start=%p acl=%x "
-                         "e_pd=%p hca_hndl=%lx mr_hndl=%lx lkey=%x",
+                         "e_pd=%p hca_hndl=%llx mr_hndl=%llx lkey=%x",
                         h_ret, shca, e_origmr, e_newmr, iova_start, acl, e_pd,
                         shca->ipz_hca_handle.handle,
                         e_origmr->ipz_mr_handle.handle,
@@ -1527,7 +1527,7 @@ int ehca_reg_internal_maxmr(
                          &e_mr->ib.ib_mr.rkey);
        if (ret) {
                ehca_err(&shca->ib_device, "reg of internal max MR failed, "
-                         "e_mr=%p iova_start=%p size_maxmr=%lx num_kpages=%x "
+                         "e_mr=%p iova_start=%p size_maxmr=%llx num_kpages=%x "
                         "num_hwpages=%x", e_mr, iova_start, size_maxmr,
                         num_kpages, num_hwpages);
                goto ehca_reg_internal_maxmr_exit1;
@@ -1573,8 +1573,8 @@ int ehca_reg_maxmr(struct ehca_shca *shca,
                                    (u64)iova_start, hipz_acl, e_pd->fw_pd,
                                    &hipzout);
        if (h_ret != H_SUCCESS) {
-                ehca_err(&shca->ib_device, "hipz_reg_smr failed, h_ret=%li "
+                ehca_err(&shca->ib_device, "hipz_reg_smr failed, h_ret=%lli "
-                         "e_origmr=%p hca_hndl=%lx mr_hndl=%lx lkey=%x",
+                         "e_origmr=%p hca_hndl=%llx mr_hndl=%llx lkey=%x",
                         h_ret, e_origmr, shca->ipz_hca_handle.handle,
                         e_origmr->ipz_mr_handle.handle,
                         e_origmr->ib.ib_mr.lkey);
@@ -1651,28 +1651,28 @@ int ehca_mr_chk_buf_and_calc_size(struct ib_phys_buf *phys_buf_array,
        /* check first buffer */
        if (((u64)iova_start & ~PAGE_MASK) != (pbuf->addr & ~PAGE_MASK)) {
                ehca_gen_err("iova_start/addr mismatch, iova_start=%p "
-                             "pbuf->addr=%lx pbuf->size=%lx",
+                             "pbuf->addr=%llx pbuf->size=%llx",
                             iova_start, pbuf->addr, pbuf->size);
                return -EINVAL;
        }
        if (((pbuf->addr + pbuf->size) % PAGE_SIZE) &&
            (num_phys_buf > 1)) {
-                ehca_gen_err("addr/size mismatch in 1st buf, pbuf->addr=%lx "
+                ehca_gen_err("addr/size mismatch in 1st buf, pbuf->addr=%llx "
-                             "pbuf->size=%lx", pbuf->addr, pbuf->size);
+                             "pbuf->size=%llx", pbuf->addr, pbuf->size);
                return -EINVAL;
        }
        for (i = 0; i < num_phys_buf; i++) {
                if ((i > 0) && (pbuf->addr % PAGE_SIZE)) {
-                        ehca_gen_err("bad address, i=%x pbuf->addr=%lx "
+                        ehca_gen_err("bad address, i=%x pbuf->addr=%llx "
-                                     "pbuf->size=%lx",
+                                     "pbuf->size=%llx",
                                     i, pbuf->addr, pbuf->size);
                        return -EINVAL;
                }
                if (((i > 0) && /* not 1st */
                     (i < (num_phys_buf - 1)) &&        /* not last */
                     (pbuf->size % PAGE_SIZE)) || (pbuf->size == 0)) {
-                        ehca_gen_err("bad size, i=%x pbuf->size=%lx",
+                        ehca_gen_err("bad size, i=%x pbuf->size=%llx",
                                     i, pbuf->size);
                        return -EINVAL;
                }
@@ -1705,7 +1705,7 @@ int ehca_fmr_check_page_list(struct ehca_mr *e_fmr,
        page = page_list;
        for (i = 0; i < list_len; i++) {
                if (*page % e_fmr->fmr_page_size) {
-                        ehca_gen_err("bad page, i=%x *page=%lx page=%p fmr=%p "
+                        ehca_gen_err("bad page, i=%x *page=%llx page=%p fmr=%p "
                                     "fmr_page_size=%x", i, *page, page, e_fmr,
                                     e_fmr->fmr_page_size);
                        return -EINVAL;
@@ -1743,9 +1743,9 @@ static int ehca_set_pagebuf_user1(struct ehca_mr_pginfo *pginfo,
                                             (pginfo->next_hwpage *
                                              pginfo->hwpage_size));
                        if ( !(*kpage) ) {
-                                ehca_gen_err("pgaddr=%lx "
+                                ehca_gen_err("pgaddr=%llx "
-                                             "chunk->page_list[i]=%lx "
+                                             "chunk->page_list[i]=%llx "
-                                             "i=%x next_hwpage=%lx",
+                                             "i=%x next_hwpage=%llx",
                                             pgaddr, (u64)sg_dma_address(
                                                     &chunk->page_list[i]),
                                             i, pginfo->next_hwpage);
@@ -1795,11 +1795,11 @@ static int ehca_check_kpages_per_ate(struct scatterlist *page_list,
        for (t = start_idx; t <= end_idx; t++) {
                u64 pgaddr = page_to_pfn(sg_page(&page_list[t])) << PAGE_SHIFT;
                if (ehca_debug_level >= 3)
-                        ehca_gen_dbg("chunk_page=%lx value=%016lx", pgaddr,
+                        ehca_gen_dbg("chunk_page=%llx value=%016llx", pgaddr,
                                     *(u64 *)abs_to_virt(phys_to_abs(pgaddr)));
                if (pgaddr - PAGE_SIZE != *prev_pgaddr) {
-                        ehca_gen_err("uncontiguous page found pgaddr=%lx "
+                        ehca_gen_err("uncontiguous page found pgaddr=%llx "
-                                     "prev_pgaddr=%lx page_list_i=%x",
+                                     "prev_pgaddr=%llx page_list_i=%x",
                                     pgaddr, *prev_pgaddr, t);
                        return -EINVAL;
                }
@@ -1833,7 +1833,7 @@ static int ehca_set_pagebuf_user2(struct ehca_mr_pginfo *pginfo,
                                           << PAGE_SHIFT );
                                *kpage = phys_to_abs(pgaddr);
                                if ( !(*kpage) ) {
-                                        ehca_gen_err("pgaddr=%lx i=%x",
+                                        ehca_gen_err("pgaddr=%llx i=%x",
                                                     pgaddr, i);
                                        ret = -EFAULT;
                                        return ret;
@@ -1846,8 +1846,8 @@ static int ehca_set_pagebuf_user2(struct ehca_mr_pginfo *pginfo,
                                        if (pginfo->hwpage_cnt) {
                                                ehca_gen_err(
                                                        "invalid alignment "
-                                                        "pgaddr=%lx i=%x "
+                                                        "pgaddr=%llx i=%x "
-                                                        "mr_pgsize=%lx",
+                                                        "mr_pgsize=%llx",
                                                        pgaddr, i,
                                                        pginfo->hwpage_size);
                                                ret = -EFAULT;
@@ -1866,8 +1866,8 @@ static int ehca_set_pagebuf_user2(struct ehca_mr_pginfo *pginfo,
                                if (ehca_debug_level >= 3) {
                                        u64 val = *(u64 *)abs_to_virt(
                                                phys_to_abs(pgaddr));
-                                        ehca_gen_dbg("kpage=%lx chunk_page=%lx "
+                                        ehca_gen_dbg("kpage=%llx chunk_page=%llx "
-                                                     "value=%016lx",
+                                                     "value=%016llx",
                                                     *kpage, pgaddr, val);
                                }
                                prev_pgaddr = pgaddr;
@@ -1944,9 +1944,9 @@ static int ehca_set_pagebuf_phys(struct ehca_mr_pginfo *pginfo,
                        if ((pginfo->kpage_cnt >= pginfo->num_kpages) ||
                            (pginfo->hwpage_cnt >= pginfo->num_hwpages)) {
                                ehca_gen_err("kpage_cnt >= num_kpages, "
-                                             "kpage_cnt=%lx num_kpages=%lx "
+                                             "kpage_cnt=%llx num_kpages=%llx "
-                                             "hwpage_cnt=%lx "
+                                             "hwpage_cnt=%llx "
-                                             "num_hwpages=%lx i=%x",
+                                             "num_hwpages=%llx i=%x",
                                             pginfo->kpage_cnt,
                                             pginfo->num_kpages,
                                             pginfo->hwpage_cnt,
@@ -1957,8 +1957,8 @@ static int ehca_set_pagebuf_phys(struct ehca_mr_pginfo *pginfo,
                                (pbuf->addr & ~(pginfo->hwpage_size - 1)) +
                                (pginfo->next_hwpage * pginfo->hwpage_size));
                        if ( !(*kpage) && pbuf->addr ) {
-                                ehca_gen_err("pbuf->addr=%lx pbuf->size=%lx "
+                                ehca_gen_err("pbuf->addr=%llx pbuf->size=%llx "
-                                             "next_hwpage=%lx", pbuf->addr,
+                                             "next_hwpage=%llx", pbuf->addr,
                                             pbuf->size, pginfo->next_hwpage);
                                return -EFAULT;
                        }
@@ -1996,8 +1996,8 @@ static int ehca_set_pagebuf_fmr(struct ehca_mr_pginfo *pginfo,
                *kpage = phys_to_abs((*fmrlist & ~(pginfo->hwpage_size - 1)) +
                                     pginfo->next_hwpage * pginfo->hwpage_size);
                if ( !(*kpage) ) {
-                        ehca_gen_err("*fmrlist=%lx fmrlist=%p "
+                        ehca_gen_err("*fmrlist=%llx fmrlist=%p "
-                                     "next_listelem=%lx next_hwpage=%lx",
+                                     "next_listelem=%llx next_hwpage=%llx",
                                     *fmrlist, fmrlist,
                                     pginfo->u.fmr.next_listelem,
                                     pginfo->next_hwpage);
@@ -2025,7 +2025,7 @@ static int ehca_set_pagebuf_fmr(struct ehca_mr_pginfo *pginfo,
                                                    ~(pginfo->hwpage_size - 1));
                                if (prev + pginfo->u.fmr.fmr_pgsize != p) {
                                        ehca_gen_err("uncontiguous fmr pages "
-                                                     "found prev=%lx p=%lx "
+                                                     "found prev=%llx p=%llx "
                                                     "idx=%x", prev, p, i + j);
                                        return -EINVAL;
                                }
diff --git a/drivers/infiniband/hw/ehca/ehca_qp.c b/drivers/infiniband/hw/ehca/ehca_qp.c
index f161cf173dbe..00c108159714 100644
--- a/drivers/infiniband/hw/ehca/ehca_qp.c
+++ b/drivers/infiniband/hw/ehca/ehca_qp.c
@@ -331,7 +331,7 @@ static inline int init_qp_queue(struct ehca_shca *shca,
                if (cnt == (nr_q_pages - 1)) {  /* last page! */
                        if (h_ret != expected_hret) {
                                ehca_err(ib_dev, "hipz_qp_register_rpage() "
-                                         "h_ret=%li", h_ret);
+                                         "h_ret=%lli", h_ret);
                                ret = ehca2ib_return_code(h_ret);
                                goto init_qp_queue1;
                        }
@@ -345,7 +345,7 @@ static inline int init_qp_queue(struct ehca_shca *shca,
                } else {
                        if (h_ret != H_PAGE_REGISTERED) {
                                ehca_err(ib_dev, "hipz_qp_register_rpage() "
-                                         "h_ret=%li", h_ret);
+                                         "h_ret=%lli", h_ret);
                                ret = ehca2ib_return_code(h_ret);
                                goto init_qp_queue1;
                        }
@@ -709,7 +709,7 @@ static struct ehca_qp *internal_create_qp(
        h_ret = hipz_h_alloc_resource_qp(shca->ipz_hca_handle, &parms);
        if (h_ret != H_SUCCESS) {
-                ehca_err(pd->device, "h_alloc_resource_qp() failed h_ret=%li",
+                ehca_err(pd->device, "h_alloc_resource_qp() failed h_ret=%lli",
                         h_ret);
                ret = ehca2ib_return_code(h_ret);
                goto create_qp_exit1;
@@ -1010,7 +1010,7 @@ struct ib_srq *ehca_create_srq(struct ib_pd *pd,
                                mqpcb, my_qp->galpas.kernel);
        if (hret != H_SUCCESS) {
                ehca_err(pd->device, "Could not modify SRQ to INIT "
-                         "ehca_qp=%p qp_num=%x h_ret=%li",
+                         "ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, my_qp->real_qp_num, hret);
                goto create_srq2;
        }
@@ -1024,7 +1024,7 @@ struct ib_srq *ehca_create_srq(struct ib_pd *pd,
                                mqpcb, my_qp->galpas.kernel);
        if (hret != H_SUCCESS) {
                ehca_err(pd->device, "Could not enable SRQ "
-                         "ehca_qp=%p qp_num=%x h_ret=%li",
+                         "ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, my_qp->real_qp_num, hret);
                goto create_srq2;
        }
@@ -1038,7 +1038,7 @@ struct ib_srq *ehca_create_srq(struct ib_pd *pd,
                                mqpcb, my_qp->galpas.kernel);
        if (hret != H_SUCCESS) {
                ehca_err(pd->device, "Could not modify SRQ to RTR "
-                         "ehca_qp=%p qp_num=%x h_ret=%li",
+                         "ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, my_qp->real_qp_num, hret);
                goto create_srq2;
        }
@@ -1078,7 +1078,7 @@ static int prepare_sqe_rts(struct ehca_qp *my_qp, struct ehca_shca *shca,
                                           &bad_send_wqe_p, NULL, 2);
        if (h_ret != H_SUCCESS) {
                ehca_err(&shca->ib_device, "hipz_h_disable_and_get_wqe() failed"
-                         " ehca_qp=%p qp_num=%x h_ret=%li",
+                         " ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, qp_num, h_ret);
                return ehca2ib_return_code(h_ret);
        }
@@ -1134,7 +1134,7 @@ static int calc_left_cqes(u64 wqe_p, struct ipz_queue *ipz_queue,
        if (ipz_queue_abs_to_offset(ipz_queue, wqe_p, &q_ofs)) {
                ehca_gen_err("Invalid offset for calculating left cqes "
-                                "wqe_p=%#lx wqe_v=%p\n", wqe_p, wqe_v);
+                                "wqe_p=%#llx wqe_v=%p\n", wqe_p, wqe_v);
                return -EFAULT;
        }
@@ -1168,7 +1168,7 @@ static int check_for_left_cqes(struct ehca_qp *my_qp, struct ehca_shca *shca)
                                &send_wqe_p, &recv_wqe_p, 4);
                if (h_ret != H_SUCCESS) {
                        ehca_err(&shca->ib_device, "disable_and_get_wqe() "
-                                 "failed ehca_qp=%p qp_num=%x h_ret=%li",
+                                 "failed ehca_qp=%p qp_num=%x h_ret=%lli",
                                 my_qp, qp_num, h_ret);
                        return ehca2ib_return_code(h_ret);
                }
@@ -1261,7 +1261,7 @@ static int internal_modify_qp(struct ib_qp *ibqp,
                                mqpcb, my_qp->galpas.kernel);
        if (h_ret != H_SUCCESS) {
                ehca_err(ibqp->device, "hipz_h_query_qp() failed "
-                         "ehca_qp=%p qp_num=%x h_ret=%li",
+                         "ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, ibqp->qp_num, h_ret);
                ret = ehca2ib_return_code(h_ret);
                goto modify_qp_exit1;
@@ -1690,7 +1690,7 @@ static int internal_modify_qp(struct ib_qp *ibqp,
        if (h_ret != H_SUCCESS) {
                ret = ehca2ib_return_code(h_ret);
-                ehca_err(ibqp->device, "hipz_h_modify_qp() failed h_ret=%li "
+                ehca_err(ibqp->device, "hipz_h_modify_qp() failed h_ret=%lli "
                         "ehca_qp=%p qp_num=%x", h_ret, my_qp, ibqp->qp_num);
                goto modify_qp_exit2;
        }
@@ -1723,7 +1723,7 @@ static int internal_modify_qp(struct ib_qp *ibqp,
                        ret = ehca2ib_return_code(h_ret);
                        ehca_err(ibqp->device, "ENABLE in context of "
                                 "RESET_2_INIT failed! Maybe you didn't get "
-                                 "a LID h_ret=%li ehca_qp=%p qp_num=%x",
+                                 "a LID h_ret=%lli ehca_qp=%p qp_num=%x",
                                 h_ret, my_qp, ibqp->qp_num);
                        goto modify_qp_exit2;
                }
@@ -1909,7 +1909,7 @@ int ehca_query_qp(struct ib_qp *qp,
        if (h_ret != H_SUCCESS) {
                ret = ehca2ib_return_code(h_ret);
                ehca_err(qp->device, "hipz_h_query_qp() failed "
-                         "ehca_qp=%p qp_num=%x h_ret=%li",
+                         "ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, qp->qp_num, h_ret);
                goto query_qp_exit1;
        }
@@ -2074,7 +2074,7 @@ int ehca_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
        if (h_ret != H_SUCCESS) {
                ret = ehca2ib_return_code(h_ret);
-                ehca_err(ibsrq->device, "hipz_h_modify_qp() failed h_ret=%li "
+                ehca_err(ibsrq->device, "hipz_h_modify_qp() failed h_ret=%lli "
                         "ehca_qp=%p qp_num=%x",
                         h_ret, my_qp, my_qp->real_qp_num);
        }
@@ -2108,7 +2108,7 @@ int ehca_query_srq(struct ib_srq *srq, struct ib_srq_attr *srq_attr)
        if (h_ret != H_SUCCESS) {
                ret = ehca2ib_return_code(h_ret);
                ehca_err(srq->device, "hipz_h_query_qp() failed "
-                         "ehca_qp=%p qp_num=%x h_ret=%li",
+                         "ehca_qp=%p qp_num=%x h_ret=%lli",
                         my_qp, my_qp->real_qp_num, h_ret);
                goto query_srq_exit1;
        }
@@ -2179,7 +2179,7 @@ static int internal_destroy_qp(struct ib_device *dev, struct ehca_qp *my_qp,
        h_ret = hipz_h_destroy_qp(shca->ipz_hca_handle, my_qp);
        if (h_ret != H_SUCCESS) {
-                ehca_err(dev, "hipz_h_destroy_qp() failed h_ret=%li "
+                ehca_err(dev, "hipz_h_destroy_qp() failed h_ret=%lli "
                         "ehca_qp=%p qp_num=%x", h_ret, my_qp, qp_num);
                return ehca2ib_return_code(h_ret);
        }
diff --git a/drivers/infiniband/hw/ehca/ehca_reqs.c b/drivers/infiniband/hw/ehca/ehca_reqs.c
index c7112686782f..5a3d96f84c79 100644
--- a/drivers/infiniband/hw/ehca/ehca_reqs.c
+++ b/drivers/infiniband/hw/ehca/ehca_reqs.c
@@ -822,7 +822,7 @@ static int generate_flush_cqes(struct ehca_qp *my_qp, struct ib_cq *cq,
                offset = qmap->next_wqe_idx * ipz_queue->qe_size;
                wqe = (struct ehca_wqe *)ipz_qeit_calc(ipz_queue, offset);
                if (!wqe) {
-                        ehca_err(cq->device, "Invalid wqe offset=%#lx on "
+                        ehca_err(cq->device, "Invalid wqe offset=%#llx on "
                                 "qp_num=%#x", offset, my_qp->real_qp_num);
                        return nr;
                }
diff --git a/drivers/infiniband/hw/ehca/ehca_sqp.c b/drivers/infiniband/hw/ehca/ehca_sqp.c
index 706d97ad5555..44447aaa5501 100644
--- a/drivers/infiniband/hw/ehca/ehca_sqp.c
+++ b/drivers/infiniband/hw/ehca/ehca_sqp.c
@@ -85,7 +85,7 @@ u64 ehca_define_sqp(struct ehca_shca *shca,
                if (ret != H_SUCCESS) {
                        ehca_err(&shca->ib_device,
-                                 "Can't define AQP1 for port %x. h_ret=%li",
+                                 "Can't define AQP1 for port %x. h_ret=%lli",
                                 port, ret);
                        return ret;
                }
diff --git a/drivers/infiniband/hw/ehca/ehca_tools.h b/drivers/infiniband/hw/ehca/ehca_tools.h
index 21f7d06f14ad..f09914cccf53 100644
--- a/drivers/infiniband/hw/ehca/ehca_tools.h
+++ b/drivers/infiniband/hw/ehca/ehca_tools.h
@@ -116,7 +116,7 @@ extern int ehca_debug_level;
                unsigned char *deb = (unsigned char *)(adr); \
                for (x = 0; x < l; x += 16) { \
                        printk(KERN_INFO "EHCA_DMP:%s " format \
-                               " adr=%p ofs=%04x %016lx %016lx\n", \
+                               " adr=%p ofs=%04x %016llx %016llx\n", \
                               __func__, ##args, deb, x, \
                               *((u64 *)&deb[0]), *((u64 *)&deb[8])); \
                        deb += 16; \
diff --git a/drivers/infiniband/hw/ehca/ehca_uverbs.c b/drivers/infiniband/hw/ehca/ehca_uverbs.c
index e43ed8f8a0c8..3cb688d29131 100644
--- a/drivers/infiniband/hw/ehca/ehca_uverbs.c
+++ b/drivers/infiniband/hw/ehca/ehca_uverbs.c
@@ -114,7 +114,7 @@ static int ehca_mmap_fw(struct vm_area_struct *vma, struct h_galpas *galpas,
        physical = galpas->user.fw_handle;
        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
-        ehca_gen_dbg("vsize=%lx physical=%lx", vsize, physical);
+        ehca_gen_dbg("vsize=%llx physical=%llx", vsize, physical);
        /* VM_IO | VM_RESERVED are set by remap_pfn_range() */
        ret = remap_4k_pfn(vma, vma->vm_start, physical >> EHCA_PAGESHIFT,
                           vma->vm_page_prot);
diff --git a/drivers/infiniband/hw/ehca/hcp_if.c b/drivers/infiniband/hw/ehca/hcp_if.c
index 415d3a465de6..d0ab0c0d5e91 100644
--- a/drivers/infiniband/hw/ehca/hcp_if.c
+++ b/drivers/infiniband/hw/ehca/hcp_if.c
@@ -226,7 +226,7 @@ u64 hipz_h_alloc_resource_eq(const struct ipz_adapter_handle adapter_handle,
                             u32 *eq_ist)
 {
        u64 ret;
-        u64 outs[PLPAR_HCALL9_BUFSIZE];
+        unsigned long outs[PLPAR_HCALL9_BUFSIZE];
        u64 allocate_controls;
        /* resource type */
@@ -249,7 +249,7 @@ u64 hipz_h_alloc_resource_eq(const struct ipz_adapter_handle adapter_handle,
        *eq_ist = (u32)outs[5];
        if (ret == H_NOT_ENOUGH_RESOURCES)
-                ehca_gen_err("Not enough resource - ret=%li ", ret);
+                ehca_gen_err("Not enough resource - ret=%lli ", ret);
        return ret;
 }
@@ -270,7 +270,7 @@ u64 hipz_h_alloc_resource_cq(const struct ipz_adapter_handle adapter_handle,
                             struct ehca_alloc_cq_parms *param)
 {
        u64 ret;
-        u64 outs[PLPAR_HCALL9_BUFSIZE];
+        unsigned long outs[PLPAR_HCALL9_BUFSIZE];
        ret = ehca_plpar_hcall9(H_ALLOC_RESOURCE, outs,
                                adapter_handle.handle,   /* r4  */
@@ -287,7 +287,7 @@ u64 hipz_h_alloc_resource_cq(const struct ipz_adapter_handle adapter_handle,
                hcp_galpas_ctor(&cq->galpas, outs[5], outs[6]);
        if (ret == H_NOT_ENOUGH_RESOURCES)
-                ehca_gen_err("Not enough resources. ret=%li", ret);
+                ehca_gen_err("Not enough resources. ret=%lli", ret);
        return ret;
 }
@@ -297,7 +297,7 @@ u64 hipz_h_alloc_resource_qp(const struct ipz_adapter_handle adapter_handle,
 {
        u64 ret;
        u64 allocate_controls, max_r10_reg, r11, r12;
-        u64 outs[PLPAR_HCALL9_BUFSIZE];
+        unsigned long outs[PLPAR_HCALL9_BUFSIZE];
        allocate_controls =
                EHCA_BMASK_SET(H_ALL_RES_QP_ENHANCED_OPS, parms->ext_type)
@@ -362,7 +362,7 @@ u64 hipz_h_alloc_resource_qp(const struct ipz_adapter_handle adapter_handle,
                hcp_galpas_ctor(&parms->galpas, outs[6], outs[6]);
        if (ret == H_NOT_ENOUGH_RESOURCES)
-                ehca_gen_err("Not enough resources. ret=%li", ret);
+                ehca_gen_err("Not enough resources. ret=%lli", ret);
        return ret;
 }
@@ -454,7 +454,7 @@ u64 hipz_h_register_rpage_eq(const struct ipz_adapter_handle adapter_handle,
                             const u64 count)
 {
        if (count != 1) {
-                ehca_gen_err("Ppage counter=%lx", count);
+                ehca_gen_err("Ppage counter=%llx", count);
                return H_PARAMETER;
        }
        return hipz_h_register_rpage(adapter_handle,
@@ -489,7 +489,7 @@ u64 hipz_h_register_rpage_cq(const struct ipz_adapter_handle adapter_handle,
                             const struct h_galpa gal)
 {
        if (count != 1) {
-                ehca_gen_err("Page counter=%lx", count);
+                ehca_gen_err("Page counter=%llx", count);
                return H_PARAMETER;
        }
@@ -508,7 +508,7 @@ u64 hipz_h_register_rpage_qp(const struct ipz_adapter_handle adapter_handle,
                             const struct h_galpa galpa)
 {
        if (count > 1) {
-                ehca_gen_err("Page counter=%lx", count);
+                ehca_gen_err("Page counter=%llx", count);
                return H_PARAMETER;
        }
@@ -525,7 +525,7 @@ u64 hipz_h_disable_and_get_wqe(const struct ipz_adapter_handle adapter_handle,
                               int dis_and_get_function_code)
 {
        u64 ret;
-        u64 outs[PLPAR_HCALL9_BUFSIZE];
+        unsigned long outs[PLPAR_HCALL9_BUFSIZE];
        ret = ehca_plpar_hcall9(H_DISABLE_AND_GETC, outs,
                                adapter_handle.handle,     /* r4 */
@@ -548,7 +548,7 @@ u64 hipz_h_modify_qp(const struct ipz_adapter_handle adapter_handle,
                     struct h_galpa gal)
 {
        u64 ret;
-        u64 outs[PLPAR_HCALL9_BUFSIZE];
+        unsigned long outs[PLPAR_HCALL9_BUFSIZE];
        ret = ehca_plpar_hcall9(H_MODIFY_QP, outs,
                                adapter_handle.handle, /* r4 */
                                qp_handle.handle,      /* r5 */
@@ -557,7 +557,7 @@ u64 hipz_h_modify_qp(const struct ipz_adapter_handle adapter_handle,
                                0, 0, 0, 0, 0);
        if (ret == H_NOT_ENOUGH_RESOURCES)
-                ehca_gen_err("Insufficient resources ret=%li", ret);
+                ehca_gen_err("Insufficient resources ret=%lli", ret);
        return ret;
 }
@@ -579,7 +579,7 @@ u64 hipz_h_destroy_qp(const struct ipz_adapter_handle adapter_handle,
                      struct ehca_qp *qp)
 {
        u64 ret;
-        u64 outs[PLPAR_HCALL9_BUFSIZE];
+        unsigned long outs[PLPAR_HCALL9_BUFSIZE];
        ret = hcp_galpas_dtor(&qp->galpas);
        if (ret) {
@@ -593,7 +593,7 @@ u64 hipz_h_destroy_qp(const struct ipz_adapter_handle adapter_handle,
                                qp->ipz_qp_handle.handle,  /* r6 */
                                0, 0, 0, 0, 0, 0);
        if (ret == H_HARDWARE)
-                ehca_gen_err("HCA not operational. ret=%li", ret);
+                ehca_gen_err("HCA not operational. ret=%lli", ret);
        ret = ehca_plpar_hcall_norets(H_FREE_RESOURCE,
                                      adapter_handle.handle,     /* r4 */
@@ -601,7 +601,7 @@ u64 hipz_h_destroy_qp(const struct ipz_adapter_handle adapter_handle,
                                      0, 0, 0, 0, 0);
        if (ret == H_RESOURCE)
-                ehca_gen_err("Resource still in use. ret=%li", ret);
+                ehca_gen_err("Resource still in use. ret=%lli", ret);
        return ret;
 }
@@ -625,7 +625,7 @@ u64 hipz_h_define_aqp1(const struct ipz_adapter_handle adapter_handle,
                       u32 * bma_qp_nr)
 {
        u64 ret;
-        u64 outs[PLPAR_HCALL9_BUFSIZE];
+        unsigned long outs[PLPAR_HCALL9_BUFSIZE];
        ret = ehca_plpar_hcall9(H_DEFINE_AQP1, outs,
                                adapter_handle.handle, /* r4 */
@@ -636,7 +636,7 @@ u64 hipz_h_define_aqp1(const struct ipz_adapter_handle adapter_handle,
        *bma_qp_nr = (u32)outs[1];
        if (ret == H_ALIAS_EXIST)
-                ehca_gen_err("AQP1 already exists. ret=%li", ret);
+                ehca_gen_err("AQP1 already exists. ret=%lli", ret);
        return ret;
 }
@@ -658,7 +658,7 @@ u64 hipz_h_attach_mcqp(const struct ipz_adapter_handle adapter_handle,
                                      0, 0);
        if (ret == H_NOT_ENOUGH_RESOURCES)
-                ehca_gen_err("Not enough resources. ret=%li", ret);
+                ehca_gen_err("Not enough resources. ret=%lli", ret);
        return ret;
 }
@@ -697,7 +697,7 @@ u64 hipz_h_destroy_cq(const struct ipz_adapter_handle adapter_handle,
                                      0, 0, 0, 0);
        if (ret == H_RESOURCE)
-                ehca_gen_err("H_FREE_RESOURCE failed ret=%li ", ret);
+                ehca_gen_err("H_FREE_RESOURCE failed ret=%lli ", ret);
        return ret;
 }
@@ -719,7 +719,7 @@ u64 hipz_h_destroy_eq(const struct ipz_adapter_handle adapter_handle,
                                      0, 0, 0, 0, 0);
        if (ret == H_RESOURCE)
-                ehca_gen_err("Resource in use. ret=%li ", ret);
+                ehca_gen_err("Resource in use. ret=%lli ", ret);
        return ret;
 }
@@ -733,7 +733,7 @@ u64 hipz_h_alloc_resource_mr(const struct ipz_adapter_handle adapter_handle,
                             struct ehca_mr_hipzout_parms *outparms)
 {
        u64 ret;
-        u64 outs[PLPAR_HCALL9_BUFSIZE];
+        unsigned long outs[PLPAR_HCALL9_BUFSIZE];
        ret = ehca_plpar_hcall9(H_ALLOC_RESOURCE, outs,
                                adapter_handle.handle,            /* r4 */
@@ -774,9 +774,9 @@ u64 hipz_h_register_rpage_mr(const struct ipz_adapter_handle adapter_handle,
        if ((count > 1) && (logical_address_of_page & (EHCA_PAGESIZE-1))) {
                ehca_gen_err("logical_address_of_page not on a 4k boundary "
-                             "adapter_handle=%lx mr=%p mr_handle=%lx "
+                             "adapter_handle=%llx mr=%p mr_handle=%llx "
                             "pagesize=%x queue_type=%x "
-                             "logical_address_of_page=%lx count=%lx",
+                             "logical_address_of_page=%llx count=%llx",
                             adapter_handle.handle, mr,
                             mr->ipz_mr_handle.handle, pagesize, queue_type,
                             logical_address_of_page, count);
@@ -794,7 +794,7 @@ u64 hipz_h_query_mr(const struct ipz_adapter_handle adapter_handle,
                    struct ehca_mr_hipzout_parms *outparms)
 {
        u64 ret;
-        u64 outs[PLPAR_HCALL9_BUFSIZE];
+        unsigned long outs[PLPAR_HCALL9_BUFSIZE];
        ret = ehca_plpar_hcall9(H_QUERY_MR, outs,
                                adapter_handle.handle,     /* r4 */
@@ -828,7 +828,7 @@ u64 hipz_h_reregister_pmr(const struct ipz_adapter_handle adapter_handle,
                          struct ehca_mr_hipzout_parms *outparms)
 {
        u64 ret;
-        u64 outs[PLPAR_HCALL9_BUFSIZE];
+        unsigned long outs[PLPAR_HCALL9_BUFSIZE];
        ret = ehca_plpar_hcall9(H_REREGISTER_PMR, outs,
                                adapter_handle.handle,    /* r4 */
@@ -855,7 +855,7 @@ u64 hipz_h_register_smr(const struct ipz_adapter_handle adapter_handle,
                        struct ehca_mr_hipzout_parms *outparms)
 {
        u64 ret;
-        u64 outs[PLPAR_HCALL9_BUFSIZE];
+        unsigned long outs[PLPAR_HCALL9_BUFSIZE];
        ret = ehca_plpar_hcall9(H_REGISTER_SMR, outs,
                                adapter_handle.handle,            /* r4 */
@@ -877,7 +877,7 @@ u64 hipz_h_alloc_resource_mw(const struct ipz_adapter_handle adapter_handle,
                             struct ehca_mw_hipzout_parms *outparms)
 {
        u64 ret;
-        u64 outs[PLPAR_HCALL9_BUFSIZE];
+        unsigned long outs[PLPAR_HCALL9_BUFSIZE];
        ret = ehca_plpar_hcall9(H_ALLOC_RESOURCE, outs,
                                adapter_handle.handle,      /* r4 */
@@ -895,7 +895,7 @@ u64 hipz_h_query_mw(const struct ipz_adapter_handle adapter_handle,
                    struct ehca_mw_hipzout_parms *outparms)
 {
        u64 ret;
-        u64 outs[PLPAR_HCALL9_BUFSIZE];
+        unsigned long outs[PLPAR_HCALL9_BUFSIZE];
        ret = ehca_plpar_hcall9(H_QUERY_MW, outs,
                                adapter_handle.handle,    /* r4 */
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 39167a797f99..a91cb4c3fa5c 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1462,7 +1462,8 @@ static void __set_data_seg(struct mlx4_wqe_data_seg *dseg, struct ib_sge *sg)
 }
 static int build_lso_seg(struct mlx4_wqe_lso_seg *wqe, struct ib_send_wr *wr,
-                         struct mlx4_ib_qp *qp, unsigned *lso_seg_len)
+                         struct mlx4_ib_qp *qp, unsigned *lso_seg_len,
+                         __be32 *lso_hdr_sz)
 {
        unsigned halign = ALIGN(sizeof *wqe + wr->wr.ud.hlen, 16);
@@ -1479,12 +1480,8 @@ static int build_lso_seg(struct mlx4_wqe_lso_seg *wqe, struct ib_send_wr *wr,
        memcpy(wqe->header, wr->wr.ud.header, wr->wr.ud.hlen);
-        /* make sure LSO header is written before overwriting stamping */
+        *lso_hdr_sz  = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 |
-        wmb();
+                                   wr->wr.ud.hlen);
-        wqe->mss_hdr_size = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 |
-                                        wr->wr.ud.hlen);
        *lso_seg_len = halign;
        return 0;
 }
@@ -1518,6 +1515,9 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
        int uninitialized_var(stamp);
        int uninitialized_var(size);
        unsigned uninitialized_var(seglen);
+        __be32 dummy;
+        __be32 *lso_wqe;
+        __be32 uninitialized_var(lso_hdr_sz);
        int i;
        spin_lock_irqsave(&qp->sq.lock, flags);
@@ -1525,6 +1525,8 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
        ind = qp->sq_next_wqe;
        for (nreq = 0; wr; ++nreq, wr = wr->next) {
+                lso_wqe = &dummy;
                if (mlx4_wq_overflow(&qp->sq, nreq, qp->ibqp.send_cq)) {
                        err = -ENOMEM;
                        *bad_wr = wr;
@@ -1606,11 +1608,12 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                        size += sizeof (struct mlx4_wqe_datagram_seg) / 16;
                        if (wr->opcode == IB_WR_LSO) {
-                                err = build_lso_seg(wqe, wr, qp, &seglen);
+                                err = build_lso_seg(wqe, wr, qp, &seglen, &lso_hdr_sz);
                                if (unlikely(err)) {
                                        *bad_wr = wr;
                                        goto out;
                                }
+                                lso_wqe = (__be32 *) wqe;
                                wqe  += seglen;
                                size += seglen / 16;
                        }
@@ -1652,6 +1655,14 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                for (i = wr->num_sge - 1; i >= 0; --i, --dseg)
                        set_data_seg(dseg, wr->sg_list + i);
+                /*
+                 * Possibly overwrite stamping in cacheline with LSO
+                 * segment only after making sure all data segments
+                 * are written.
+                 */
+                wmb();
+                *lso_wqe = lso_hdr_sz;
                ctrl->fence_size = (wr->send_flags & IB_SEND_FENCE ?
                                    MLX4_WQE_CTRL_FENCE : 0) | size;
@@ -1686,7 +1697,6 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                        stamp_send_wqe(qp, stamp, size * 16);
                        ind = pad_wraparound(qp, ind);
                }
        }
 out:
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index dce0443f9d69..0bd2a4ff0842 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -106,23 +106,17 @@ int ipoib_open(struct net_device *dev)
        ipoib_dbg(priv, "bringing up interface\n");
-        set_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags);
+        if (!test_and_set_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags))
+                napi_enable(&priv->napi);
        if (ipoib_pkey_dev_delay_open(dev))
                return 0;
-        napi_enable(&priv->napi);
+        if (ipoib_ib_dev_open(dev))
+                goto err_disable;
-        if (ipoib_ib_dev_open(dev)) {
+        if (ipoib_ib_dev_up(dev))
-                napi_disable(&priv->napi);
+                goto err_stop;
-                return -EINVAL;
-        }
-        if (ipoib_ib_dev_up(dev)) {
-                ipoib_ib_dev_stop(dev, 1);
-                napi_disable(&priv->napi);
-                return -EINVAL;
-        }
        if (!test_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags)) {
                struct ipoib_dev_priv *cpriv;
@@ -144,6 +138,15 @@ int ipoib_open(struct net_device *dev)
        netif_start_queue(dev);
        return 0;
+err_stop:
+        ipoib_ib_dev_stop(dev, 1);
+err_disable:
+        napi_disable(&priv->napi);
+        clear_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags);
+        return -EINVAL;
 }
 static int ipoib_stop(struct net_device *dev)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 59d02e0b8df1..425e31112ed7 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -409,7 +409,7 @@ static int ipoib_mcast_join_complete(int status,
        }
        if (mcast->logcount++ < 20) {
-                if (status == -ETIMEDOUT) {
+                if (status == -ETIMEDOUT || status == -EAGAIN) {
                        ipoib_dbg_mcast(priv, "multicast join failed for %pI6, status %d\n",
                                        mcast->mcmember.mgid.raw, status);
                } else {
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index 2cf1a4088718..5a76a5510350 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -61,6 +61,7 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey)
        ppriv = netdev_priv(pdev);
+        rtnl_lock();
        mutex_lock(&ppriv->vlan_mutex);
        /*
@@ -111,7 +112,7 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey)
                goto device_init_failed;
        }
-        result = register_netdev(priv->dev);
+        result = register_netdevice(priv->dev);
        if (result) {
                ipoib_warn(priv, "failed to initialize; error %i", result);
                goto register_failed;
@@ -134,12 +135,13 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey)
        list_add_tail(&priv->list, &ppriv->child_intfs);
        mutex_unlock(&ppriv->vlan_mutex);
+        rtnl_unlock();
        return 0;
 sysfs_failed:
        ipoib_delete_debug_files(priv->dev);
-        unregister_netdev(priv->dev);
+        unregister_netdevice(priv->dev);
 register_failed:
        ipoib_dev_cleanup(priv->dev);
@@ -149,6 +151,7 @@ device_init_failed:
 err:
        mutex_unlock(&ppriv->vlan_mutex);
+        rtnl_unlock();
        return result;
 }
@@ -162,10 +165,11 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
        ppriv = netdev_priv(pdev);
+        rtnl_lock();
        mutex_lock(&ppriv->vlan_mutex);
        list_for_each_entry_safe(priv, tpriv, &ppriv->child_intfs, list) {
                if (priv->pkey == pkey) {
-                        unregister_netdev(priv->dev);
+                        unregister_netdevice(priv->dev);
                        ipoib_dev_cleanup(priv->dev);
                        list_del(&priv->list);
                        free_netdev(priv->dev);
@@ -175,6 +179,7 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
                }
        }
        mutex_unlock(&ppriv->vlan_mutex);
+        rtnl_unlock();
        return ret;
 }
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index a3551dd0324d..aa30b5cb3513 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -431,6 +431,7 @@ set_arg(void __user *b, void *val,int len)
        return 0;
 }
+#ifdef CONFIG_IPPP_FILTER
 static int get_filter(void __user *arg, struct sock_filter **p)
 {
        struct sock_fprog uprog;
@@ -465,6 +466,7 @@ static int get_filter(void __user *arg, struct sock_filter **p)
        *p = code;
        return uprog.len;
 }
+#endif /* CONFIG_IPPP_FILTER */
 /*
 * ippp device ioctl
diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
index 90663e01a56e..60156dfdc608 100644
--- a/drivers/lguest/core.c
+++ b/drivers/lguest/core.c
@@ -224,7 +224,7 @@ int run_guest(struct lg_cpu *cpu, unsigned long __user *user)
                        break;
                /* If the Guest asked to be stopped, we sleep.  The Guest's
-                 * clock timer or LHCALL_BREAK from the Waker will wake us. */
+                 * clock timer or LHREQ_BREAK from the Waker will wake us. */
                if (cpu->halted) {
                        set_current_state(TASK_INTERRUPTIBLE);
                        schedule();
diff --git a/drivers/lguest/lguest_user.c b/drivers/lguest/lguest_user.c
index 34bc017b8b3c..b8ee103eed5f 100644
--- a/drivers/lguest/lguest_user.c
+++ b/drivers/lguest/lguest_user.c
@@ -307,9 +307,8 @@ static int close(struct inode *inode, struct file *file)
         * kmalloc()ed string, either of which is ok to hand to kfree(). */
        if (!IS_ERR(lg->dead))
                kfree(lg->dead);
-        /* We clear the entire structure, which also marks it as free for the
+        /* Free the memory allocated to the lguest_struct */
-         * next user. */
+        kfree(lg);
-        memset(lg, 0, sizeof(*lg));
        /* Release lock and exit. */
        mutex_unlock(&lguest_lock);
diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index 1e3aea9eecf1..09658b218474 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -25,13 +25,13 @@ static inline dev_info_t *which_dev(mddev_t *mddev, sector_t sector)
 {
        dev_info_t *hash;
        linear_conf_t *conf = mddev_to_conf(mddev);
+        sector_t idx = sector >> conf->sector_shift;
        /*
         * sector_div(a,b) returns the remainer and sets a to a/b
         */
-        sector >>= conf->sector_shift;
+        (void)sector_div(idx, conf->spacing);
-        (void)sector_div(sector, conf->spacing);
+        hash = conf->hash_table[idx];
-        hash = conf->hash_table[sector];
        while (sector >= hash->num_sectors + hash->start_sector)
                hash++;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 41e2509bf896..4495104f6c9f 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1481,6 +1481,11 @@ static int bind_rdev_to_array(mdk_rdev_t * rdev, mddev_t * mddev)
                if (find_rdev_nr(mddev, rdev->desc_nr))
                        return -EBUSY;
        }
+        if (mddev->max_disks && rdev->desc_nr >= mddev->max_disks) {
+                printk(KERN_WARNING "md: %s: array is limited to %d devices\n",
+                       mdname(mddev), mddev->max_disks);
+                return -EBUSY;
+        }
        bdevname(rdev->bdev,b);
        while ( (s=strchr(b, '/')) != NULL)
                *s = '!';
@@ -2441,6 +2446,15 @@ static void analyze_sbs(mddev_t * mddev)
        i = 0;
        rdev_for_each(rdev, tmp, mddev) {
+                if (rdev->desc_nr >= mddev->max_disks ||
+                    i > mddev->max_disks) {
+                        printk(KERN_WARNING
+                               "md: %s: %s: only %d devices permitted\n",
+                               mdname(mddev), bdevname(rdev->bdev, b),
+                               mddev->max_disks);
+                        kick_rdev_from_array(rdev);
+                        continue;
+                }
                if (rdev != freshest)
                        if (super_types[mddev->major_version].
                            validate_super(mddev, rdev)) {
@@ -4614,13 +4628,6 @@ static int hot_add_disk(mddev_t * mddev, dev_t dev)
         * noticed in interrupt contexts ...
         */
-        if (rdev->desc_nr == mddev->max_disks) {
-                printk(KERN_WARNING "%s: can not hot-add to full array!\n",
-                        mdname(mddev));
-                err = -EBUSY;
-                goto abort_unbind_export;
-        }
        rdev->raid_disk = -1;
        md_update_sb(mddev, 1);
@@ -4634,9 +4641,6 @@ static int hot_add_disk(mddev_t * mddev, dev_t dev)
        md_new_event(mddev);
        return 0;
-abort_unbind_export:
-        unbind_rdev_from_array(rdev);
 abort_export:
        export_rdev(rdev);
        return err;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 7b4f5f7155d8..01e3cffd03b8 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1640,7 +1640,8 @@ static void raid1d(mddev_t *mddev)
                        }
                        bio = r1_bio->bios[r1_bio->read_disk];
-                        if ((disk=read_balance(conf, r1_bio)) == -1) {
+                        if ((disk=read_balance(conf, r1_bio)) == -1 ||
+                            disk == r1_bio->read_disk) {
                                printk(KERN_ALERT "raid1: %s: unrecoverable I/O"
                                       " read error for block %llu\n",
                                       bdevname(bio->bi_bdev,b),
diff --git a/drivers/media/common/saa7146_video.c b/drivers/media/common/saa7146_video.c
index 6098b626811f..47fee05eaefb 100644
--- a/drivers/media/common/saa7146_video.c
+++ b/drivers/media/common/saa7146_video.c
@@ -576,6 +576,7 @@ static int set_control(struct saa7146_fh *fh, struct v4l2_control *c)
                vv->vflip = c->value;
                break;
        default: {
+                mutex_unlock(&dev->lock);
                return -EINVAL;
        }
        }
diff --git a/drivers/media/common/tuners/mxl5007t.c b/drivers/media/common/tuners/mxl5007t.c
index 64379f2bf237..3ec28945c26f 100644
--- a/drivers/media/common/tuners/mxl5007t.c
+++ b/drivers/media/common/tuners/mxl5007t.c
@@ -657,7 +657,7 @@ static int mxl5007t_get_status(struct dvb_frontend *fe, u32 *status)
 {
        struct mxl5007t_state *state = fe->tuner_priv;
        int rf_locked, ref_locked;
-        s32 rf_input_level;
+        s32 rf_input_level = 0;
        int ret;
        if (fe->ops.i2c_gate_ctrl)
diff --git a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
index 98ee16773ff2..7e3aeaa7370f 100644
--- a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
+++ b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
@@ -93,6 +93,9 @@ struct dvb_ca_slot {
        /* current state of the CAM */
        int slot_state;
+        /* mutex used for serializing access to one CI slot */
+        struct mutex slot_lock;
        /* Number of CAMCHANGES that have occurred since last processing */
        atomic_t camchange_count;
@@ -711,14 +714,20 @@ static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot, u8 * b
        dprintk("%s\n", __func__);
-        // sanity check
+        /* sanity check */
        if (bytes_write > ca->slot_info[slot].link_buf_size)
                return -EINVAL;
-        /* check if interface is actually waiting for us to read from it, or if a read is in progress */
+        /* it is possible we are dealing with a single buffer implementation,
+           thus if there is data available for read or if there is even a read
+           already in progress, we do nothing but awake the kernel thread to
+           process the data if necessary. */
        if ((status = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_STATUS)) < 0)
                goto exitnowrite;
        if (status & (STATUSREG_DA | STATUSREG_RE)) {
+                if (status & STATUSREG_DA)
+                        dvb_ca_en50221_thread_wakeup(ca);
                status = -EAGAIN;
                goto exitnowrite;
        }
@@ -987,6 +996,8 @@ static int dvb_ca_en50221_thread(void *data)
                /* go through all the slots processing them */
                for (slot = 0; slot < ca->slot_count; slot++) {
+                        mutex_lock(&ca->slot_info[slot].slot_lock);
                        // check the cam status + deal with CAMCHANGEs
                        while (dvb_ca_en50221_check_camstatus(ca, slot)) {
                                /* clear down an old CI slot if necessary */
@@ -1122,7 +1133,7 @@ static int dvb_ca_en50221_thread(void *data)
                        case DVB_CA_SLOTSTATE_RUNNING:
                                if (!ca->open)
-                                        continue;
+                                        break;
                                // poll slots for data
                                pktcount = 0;
@@ -1146,6 +1157,8 @@ static int dvb_ca_en50221_thread(void *data)
                                }
                                break;
                        }
+                        mutex_unlock(&ca->slot_info[slot].slot_lock);
                }
        }
@@ -1181,6 +1194,7 @@ static int dvb_ca_en50221_io_do_ioctl(struct inode *inode, struct file *file,
        switch (cmd) {
        case CA_RESET:
                for (slot = 0; slot < ca->slot_count; slot++) {
+                        mutex_lock(&ca->slot_info[slot].slot_lock);
                        if (ca->slot_info[slot].slot_state != DVB_CA_SLOTSTATE_NONE) {
                                dvb_ca_en50221_slot_shutdown(ca, slot);
                                if (ca->flags & DVB_CA_EN50221_FLAG_IRQ_CAMCHANGE)
@@ -1188,6 +1202,7 @@ static int dvb_ca_en50221_io_do_ioctl(struct inode *inode, struct file *file,
                                                                     slot,
                                                                     DVB_CA_EN50221_CAMCHANGE_INSERTED);
                        }
+                        mutex_unlock(&ca->slot_info[slot].slot_lock);
                }
                ca->next_read_slot = 0;
                dvb_ca_en50221_thread_wakeup(ca);
@@ -1308,7 +1323,9 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
                                goto exit;
                        }
+                        mutex_lock(&ca->slot_info[slot].slot_lock);
                        status = dvb_ca_en50221_write_data(ca, slot, fragbuf, fraglen + 2);
+                        mutex_unlock(&ca->slot_info[slot].slot_lock);
                        if (status == (fraglen + 2)) {
                                written = 1;
                                break;
@@ -1664,6 +1681,7 @@ int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter,
                ca->slot_info[i].slot_state = DVB_CA_SLOTSTATE_NONE;
                atomic_set(&ca->slot_info[i].camchange_count, 0);
                ca->slot_info[i].camchange_type = DVB_CA_EN50221_CAMCHANGE_REMOVED;
+                mutex_init(&ca->slot_info[i].slot_lock);
        }
        if (signal_pending(current)) {
diff --git a/drivers/media/dvb/dvb-core/dvb_ca_en50221.h b/drivers/media/dvb/dvb-core/dvb_ca_en50221.h
index 8467e63ddc0d..7df2e141187a 100644
--- a/drivers/media/dvb/dvb-core/dvb_ca_en50221.h
+++ b/drivers/media/dvb/dvb-core/dvb_ca_en50221.h
@@ -45,8 +45,10 @@ struct dvb_ca_en50221 {
        /* the module owning this structure */
        struct module* owner;
-        /* NOTE: the read_*, write_* and poll_slot_status functions must use locks as
+        /* NOTE: the read_*, write_* and poll_slot_status functions will be
-         * they may be called from several threads at once */
+         * called for different slots concurrently and need to use locks where
+         * and if appropriate. There will be no concurrent access to one slot.
+         */
        /* functions for accessing attribute memory on the CAM */
        int (*read_attribute_mem)(struct dvb_ca_en50221* ca, int slot, int address);
diff --git a/drivers/media/dvb/dvb-usb/af9005-fe.c b/drivers/media/dvb/dvb-usb/af9005-fe.c
index b1a9c4cdec93..199ece0d4883 100644
--- a/drivers/media/dvb/dvb-usb/af9005-fe.c
+++ b/drivers/media/dvb/dvb-usb/af9005-fe.c
@@ -220,7 +220,7 @@ static int af9005_get_post_vit_ber(struct dvb_frontend *fe,
                                   u16 * abort_count)
 {
        u32 loc_cw_count = 0, loc_err_count;
-        u16 loc_abort_count;
+        u16 loc_abort_count = 0;
        int ret;
        ret =
diff --git a/drivers/media/dvb/dvb-usb/af9015.c b/drivers/media/dvb/dvb-usb/af9015.c
index e1e9aa5c6b84..6a97a40d3dfb 100644
--- a/drivers/media/dvb/dvb-usb/af9015.c
+++ b/drivers/media/dvb/dvb-usb/af9015.c
@@ -694,7 +694,12 @@ static int af9015_read_config(struct usb_device *udev)
        /* IR remote controller */
        req.addr = AF9015_EEPROM_IR_MODE;
-        ret = af9015_rw_udev(udev, &req);
+        /* first message will timeout often due to possible hw bug */
+        for (i = 0; i < 4; i++) {
+                ret = af9015_rw_udev(udev, &req);
+                if (!ret)
+                        break;
+        }
        if (ret)
                goto error;
        deb_info("%s: IR mode:%d\n", __func__, val);
@@ -835,18 +840,19 @@ static int af9015_read_config(struct usb_device *udev)
        if (!dvb_usb_af9015_dual_mode)
                af9015_config.dual_mode = 0;
-        /* set buffer size according to USB port speed */
+        /* Set adapter0 buffer size according to USB port speed, adapter1 buffer
+           size can be static because it is enabled only USB2.0 */
        for (i = 0; i < af9015_properties_count; i++) {
                /* USB1.1 set smaller buffersize and disable 2nd adapter */
                if (udev->speed == USB_SPEED_FULL) {
-                        af9015_properties[i].adapter->stream.u.bulk.buffersize =
+                        af9015_properties[i].adapter[0].stream.u.bulk.buffersize
-                                TS_USB11_MAX_PACKET_SIZE;
+                                = TS_USB11_MAX_PACKET_SIZE;
                        /* disable 2nd adapter because we don't have
                           PID-filters */
                        af9015_config.dual_mode = 0;
                } else {
-                        af9015_properties[i].adapter->stream.u.bulk.buffersize =
+                        af9015_properties[i].adapter[0].stream.u.bulk.buffersize
-                                TS_USB20_MAX_PACKET_SIZE;
+                                = TS_USB20_MAX_PACKET_SIZE;
                }
        }
@@ -1254,6 +1260,12 @@ static struct dvb_usb_device_properties af9015_properties[] = {
                                        .type = USB_BULK,
                                        .count = 6,
                                        .endpoint = 0x85,
+                                        .u = {
+                                                .bulk = {
+                                                        .buffersize =
+                                                TS_USB20_MAX_PACKET_SIZE,
+                                                }
+                                        }
                                },
                        }
                },
@@ -1353,6 +1365,12 @@ static struct dvb_usb_device_properties af9015_properties[] = {
                                        .type = USB_BULK,
                                        .count = 6,
                                        .endpoint = 0x85,
+                                        .u = {
+                                                .bulk = {
+                                                        .buffersize =
+                                                TS_USB20_MAX_PACKET_SIZE,
+                                                }
+                                        }
                                },
                        }
                },
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index 391732788911..635d30a55078 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -1393,6 +1393,9 @@ struct usb_device_id dib0700_usb_id_table[] = {
        { USB_DEVICE(USB_VID_ASUS,      USB_PID_ASUS_U3000H) },
 /* 40 */{ USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV801E) },
        { USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV801E_SE) },
+        { USB_DEVICE(USB_VID_TERRATEC,  USB_PID_TERRATEC_CINERGY_T_EXPRESS) },
+        { USB_DEVICE(USB_VID_TERRATEC,
+                        USB_PID_TERRATEC_CINERGY_DT_XS_DIVERSITY_2) },
        { 0 }           /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, dib0700_usb_id_table);
@@ -1537,7 +1540,8 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                        {   "DiBcom STK7700D reference design",
                                { &dib0700_usb_id_table[14], NULL },
                                { NULL },
-                        }
+                        },
                },
                .rc_interval      = DEFAULT_RC_INTERVAL,
@@ -1557,7 +1561,7 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                        },
                },
-                .num_device_descs = 2,
+                .num_device_descs = 3,
                .devices = {
                        {   "ASUS My Cinema U3000 Mini DVBT Tuner",
                                { &dib0700_usb_id_table[23], NULL },
@@ -1566,6 +1570,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                        {   "Yuan EC372S",
                                { &dib0700_usb_id_table[31], NULL },
                                { NULL },
+                        },
+                        {   "Terratec Cinergy T Express",
+                                { &dib0700_usb_id_table[42], NULL },
+                                { NULL },
                        }
                },
@@ -1653,7 +1661,7 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                        }
                },
-                .num_device_descs = 4,
+                .num_device_descs = 5,
                .devices = {
                        {   "DiBcom STK7070PD reference design",
                                { &dib0700_usb_id_table[17], NULL },
@@ -1670,6 +1678,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                        {   "Hauppauge Nova-TD-500 (84xxx)",
                                { &dib0700_usb_id_table[36], NULL },
                                { NULL },
+                        },
+                        {  "Terratec Cinergy DT USB XS Diversity",
+                                { &dib0700_usb_id_table[43], NULL },
+                                { NULL },
                        }
                }
        }, { DIB0700_DEFAULT_DEVICE_PROPERTIES,
diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
index a4fca3fca5ee..0db0c06ee6f2 100644
--- a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
+++ b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
@@ -162,8 +162,10 @@
 #define USB_PID_AVERMEDIA_A309                          0xa309
 #define USB_PID_TECHNOTREND_CONNECT_S2400               0x3006
 #define USB_PID_TERRATEC_CINERGY_DT_XS_DIVERSITY        0x005a
+#define USB_PID_TERRATEC_CINERGY_DT_XS_DIVERSITY_2      0x0081
 #define USB_PID_TERRATEC_CINERGY_HT_USB_XE              0x0058
 #define USB_PID_TERRATEC_CINERGY_HT_EXPRESS             0x0060
+#define USB_PID_TERRATEC_CINERGY_T_EXPRESS              0x0062
 #define USB_PID_TERRATEC_CINERGY_T_XXS                  0x0078
 #define USB_PID_PINNACLE_EXPRESSCARD_320CX              0x022e
 #define USB_PID_PINNACLE_PCTV2000E                      0x022c
diff --git a/drivers/media/dvb/frontends/drx397xD.c b/drivers/media/dvb/frontends/drx397xD.c
index ec4e08dbc699..1e81e713df63 100644
--- a/drivers/media/dvb/frontends/drx397xD.c
+++ b/drivers/media/dvb/frontends/drx397xD.c
@@ -646,7 +646,7 @@ static int drx_tune(struct drx397xD_state *s,
        u32 edi = 0, ebx = 0, ebp = 0, edx = 0;
        u16 v20 = 0, v1E = 0, v16 = 0, v14 = 0, v12 = 0, v10 = 0, v0E = 0;
-        int rc, df_tuner;
+        int rc, df_tuner = 0;
        int a, b, c, d;
        pr_debug("%s %d\n", __func__, s->config.d60);
diff --git a/drivers/media/dvb/frontends/s5h1409.c b/drivers/media/dvb/frontends/s5h1409.c
index cf4d8936bb83..3e08d985d6e5 100644
--- a/drivers/media/dvb/frontends/s5h1409.c
+++ b/drivers/media/dvb/frontends/s5h1409.c
@@ -545,9 +545,6 @@ static int s5h1409_set_frontend(struct dvb_frontend *fe,
        s5h1409_enable_modulation(fe, p->u.vsb.modulation);
-        /* Allow the demod to settle */
-        msleep(100);
        if (fe->ops.tuner_ops.set_params) {
                if (fe->ops.i2c_gate_ctrl)
                        fe->ops.i2c_gate_ctrl(fe, 1);
@@ -562,6 +559,10 @@ static int s5h1409_set_frontend(struct dvb_frontend *fe,
                s5h1409_set_qam_interleave_mode(fe);
        }
+        /* Issue a reset to the demod so it knows to resync against the
+           newly tuned frequency */
+        s5h1409_softreset(fe);
        return 0;
 }
diff --git a/drivers/media/dvb/frontends/stb0899_algo.c b/drivers/media/dvb/frontends/stb0899_algo.c
index 83dc7e12d5f0..a67d1775a43c 100644
--- a/drivers/media/dvb/frontends/stb0899_algo.c
+++ b/drivers/media/dvb/frontends/stb0899_algo.c
@@ -31,6 +31,8 @@ inline u32 stb0899_do_div(u64 n, u32 d)
        return n;
 }
+#if 0
+/* These functions are currently unused */
 /*
 * stb0899_calc_srate
 * Compute symbol rate
@@ -63,6 +65,7 @@ static u32 stb0899_get_srate(struct stb0899_state *state)
        return stb0899_calc_srate(internal->master_clk, sfr);
 }
+#endif
 /*
 * stb0899_set_srate
diff --git a/drivers/media/dvb/ttpci/budget.c b/drivers/media/dvb/ttpci/budget.c
index 1638e1d9f538..83e9e7750c8c 100644
--- a/drivers/media/dvb/ttpci/budget.c
+++ b/drivers/media/dvb/ttpci/budget.c
@@ -470,6 +470,7 @@ static void frontend_init(struct budget *budget)
                budget->dvb_frontend = dvb_attach(l64781_attach, &grundig_29504_401_config, &budget->i2c_adap);
                if (budget->dvb_frontend) {
                        budget->dvb_frontend->ops.tuner_ops.set_params = grundig_29504_401_tuner_set_params;
+                        budget->dvb_frontend->tuner_priv = NULL;
                        break;
                }
                break;
diff --git a/drivers/media/dvb/ttusb-dec/ttusb_dec.c b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
index 0aa96df80fc2..d91e0638448f 100644
--- a/drivers/media/dvb/ttusb-dec/ttusb_dec.c
+++ b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
@@ -1384,7 +1384,7 @@ static int ttusb_dec_boot_dsp(struct ttusb_dec *dec)
 static int ttusb_dec_init_stb(struct ttusb_dec *dec)
 {
        int result;
-        unsigned int mode, model, version;
+        unsigned int mode = 0, model = 0, version = 0;
        dprintk("%s\n", __func__);
diff --git a/drivers/media/radio/radio-mr800.c b/drivers/media/radio/radio-mr800.c
index 0747dc8862b0..fdfc7bf86b9e 100644
--- a/drivers/media/radio/radio-mr800.c
+++ b/drivers/media/radio/radio-mr800.c
@@ -194,10 +194,10 @@ static int amradio_start(struct amradio_device *radio)
                return retval;
        }
-        mutex_unlock(&radio->lock);
        radio->muted = 0;
+        mutex_unlock(&radio->lock);
        return retval;
 }
@@ -230,10 +230,10 @@ static int amradio_stop(struct amradio_device *radio)
                return retval;
        }
-        mutex_unlock(&radio->lock);
        radio->muted = 1;
+        mutex_unlock(&radio->lock);
        return retval;
 }
@@ -284,10 +284,10 @@ static int amradio_setfreq(struct amradio_device *radio, int freq)
                return retval;
        }
-        mutex_unlock(&radio->lock);
        radio->stereo = 0;
+        mutex_unlock(&radio->lock);
        return retval;
 }
diff --git a/drivers/media/video/cs5345.c b/drivers/media/video/cs5345.c
index 14bebf8a116f..87e91072627a 100644
--- a/drivers/media/video/cs5345.c
+++ b/drivers/media/video/cs5345.c
@@ -18,7 +18,6 @@
 */
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/i2c.h>
diff --git a/drivers/media/video/cx23885/cx23885-417.c b/drivers/media/video/cx23885/cx23885-417.c
index 8f1db57bd1dd..bfe25841dbf4 100644
--- a/drivers/media/video/cx23885/cx23885-417.c
+++ b/drivers/media/video/cx23885/cx23885-417.c
@@ -1586,7 +1586,8 @@ static int mpeg_open(struct file *file)
        lock_kernel();
        list_for_each(list, &cx23885_devlist) {
                h = list_entry(list, struct cx23885_dev, devlist);
-                if (h->v4l_device->minor == minor) {
+                if (h->v4l_device &&
+                    h->v4l_device->minor == minor) {
                        dev = h;
                        break;
                }
diff --git a/drivers/media/video/cx23885/cx23885-video.c b/drivers/media/video/cx23885/cx23885-video.c
index 2d81c4d04340..eaa11893bfe9 100644
--- a/drivers/media/video/cx23885/cx23885-video.c
+++ b/drivers/media/video/cx23885/cx23885-video.c
@@ -730,12 +730,13 @@ static int video_open(struct file *file)
        lock_kernel();
        list_for_each(list, &cx23885_devlist) {
                h = list_entry(list, struct cx23885_dev, devlist);
-                if (h->video_dev->minor == minor) {
+                if (h->video_dev &&
+                    h->video_dev->minor == minor) {
                        dev  = h;
                        type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
                }
                if (h->vbi_dev &&
-                   h->vbi_dev->minor == minor) {
+                    h->vbi_dev->minor == minor) {
                        dev  = h;
                        type = V4L2_BUF_TYPE_VBI_CAPTURE;
                }
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index 88f2fd32bfe3..25eb3bec9e5d 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -1382,6 +1382,14 @@ static int cx25840_log_status(struct v4l2_subdev *sd)
 static int cx25840_command(struct i2c_client *client, unsigned cmd, void *arg)
 {
+        /* ignore this command */
+        if (cmd == TUNER_SET_TYPE_ADDR || cmd == TUNER_SET_CONFIG)
+                return 0;
+        /* Old-style drivers rely on initialization on first use, so
+           call the init whenever a command is issued to this driver.
+           New-style drivers using v4l2_subdev should call init explicitly. */
+        cx25840_init(i2c_get_clientdata(client), 0);
        return v4l2_subdev_command(i2c_get_clientdata(client), cmd, arg);
 }
diff --git a/drivers/media/video/cx88/cx88-dvb.c b/drivers/media/video/cx88/cx88-dvb.c
index 613dfea4ff3e..aef5297534af 100644
--- a/drivers/media/video/cx88/cx88-dvb.c
+++ b/drivers/media/video/cx88/cx88-dvb.c
@@ -614,34 +614,41 @@ static struct stv0288_config tevii_tuner_earda_config = {
        .set_ts_params = cx24116_set_ts_param,
 };
-static int dvb_register(struct cx8802_dev *dev)
+static int cx8802_alloc_frontends(struct cx8802_dev *dev)
 {
        struct cx88_core *core = dev->core;
-        struct videobuf_dvb_frontend *fe0, *fe1 = NULL;
+        struct videobuf_dvb_frontend *fe = NULL;
-        int mfe_shared = 0; /* bus not shared by default */
        int i;
-        if (0 != core->i2c_rc) {
-                printk(KERN_ERR "%s/2: no i2c-bus available, cannot attach dvb drivers\n", core->name);
-                goto frontend_detach;
-        }
-        if (!core->board.num_frontends)
-                return -EINVAL;
        mutex_init(&dev->frontends.lock);
        INIT_LIST_HEAD(&dev->frontends.felist);
+        if (!core->board.num_frontends)
+                return -ENODEV;
        printk(KERN_INFO "%s() allocating %d frontend(s)\n", __func__,
                         core->board.num_frontends);
        for (i = 1; i <= core->board.num_frontends; i++) {
-                fe0 = videobuf_dvb_alloc_frontend(&dev->frontends, i);
+                fe = videobuf_dvb_alloc_frontend(&dev->frontends, i);
-                if (!fe0) {
+                if (!fe) {
                        printk(KERN_ERR "%s() failed to alloc\n", __func__);
                        videobuf_dvb_dealloc_frontends(&dev->frontends);
-                        goto frontend_detach;
+                        return -ENOMEM;
                }
        }
+        return 0;
+}
+static int dvb_register(struct cx8802_dev *dev)
+{
+        struct cx88_core *core = dev->core;
+        struct videobuf_dvb_frontend *fe0, *fe1 = NULL;
+        int mfe_shared = 0; /* bus not shared by default */
+        if (0 != core->i2c_rc) {
+                printk(KERN_ERR "%s/2: no i2c-bus available, cannot attach dvb drivers\n", core->name);
+                goto frontend_detach;
+        }
        /* Get the first frontend */
        fe0 = videobuf_dvb_get_frontend(&dev->frontends, 1);
@@ -1243,6 +1250,8 @@ static int cx8802_dvb_probe(struct cx8802_driver *drv)
        struct cx88_core *core = drv->core;
        struct cx8802_dev *dev = drv->core->dvbdev;
        int err;
+        struct videobuf_dvb_frontend *fe;
+        int i;
        dprintk( 1, "%s\n", __func__);
        dprintk( 1, " ->being probed by Card=%d Name=%s, PCI %02x:%02x\n",
@@ -1258,39 +1267,34 @@ static int cx8802_dvb_probe(struct cx8802_driver *drv)
        /* If vp3054 isn't enabled, a stub will just return 0 */
        err = vp3054_i2c_probe(dev);
        if (0 != err)
-                goto fail_probe;
+                goto fail_core;
        /* dvb stuff */
        printk(KERN_INFO "%s/2: cx2388x based DVB/ATSC card\n", core->name);
        dev->ts_gen_cntrl = 0x0c;
+        err = cx8802_alloc_frontends(dev);
+        if (err)
+                goto fail_core;
        err = -ENODEV;
-        if (core->board.num_frontends) {
+        for (i = 1; i <= core->board.num_frontends; i++) {
-                struct videobuf_dvb_frontend *fe;
+                fe = videobuf_dvb_get_frontend(&core->dvbdev->frontends, i);
-                int i;
+                if (fe == NULL) {
+                        printk(KERN_ERR "%s() failed to get frontend(%d)\n",
-                for (i = 1; i <= core->board.num_frontends; i++) {
-                        fe = videobuf_dvb_get_frontend(&core->dvbdev->frontends, i);
-                        if (fe == NULL) {
-                                printk(KERN_ERR "%s() failed to get frontend(%d)\n",
                                        __func__, i);
-                                goto fail_probe;
+                        goto fail_probe;
-                        }
+                }
-                        videobuf_queue_sg_init(&fe->dvb.dvbq, &dvb_qops,
+                videobuf_queue_sg_init(&fe->dvb.dvbq, &dvb_qops,
                                    &dev->pci->dev, &dev->slock,
                                    V4L2_BUF_TYPE_VIDEO_CAPTURE,
                                    V4L2_FIELD_TOP,
                                    sizeof(struct cx88_buffer),
                                    dev);
-                        /* init struct videobuf_dvb */
+                /* init struct videobuf_dvb */
-                        fe->dvb.name = dev->core->name;
+                fe->dvb.name = dev->core->name;
-                }
-        } else {
-                /* no frontends allocated */
-                printk(KERN_ERR "%s/2 .num_frontends should be non-zero\n",
-                        core->name);
-                goto fail_core;
        }
        err = dvb_register(dev);
        if (err)
                /* frontends/adapter de-allocated in dvb_register */
diff --git a/drivers/media/video/cx88/cx88.h b/drivers/media/video/cx88/cx88.h
index 60a8b3187f14..6025fdd23344 100644
--- a/drivers/media/video/cx88/cx88.h
+++ b/drivers/media/video/cx88/cx88.h
@@ -336,8 +336,8 @@ struct cx88_core {
        /* config info -- dvb */
 #if defined(CONFIG_VIDEO_CX88_DVB) || defined(CONFIG_VIDEO_CX88_DVB_MODULE)
        int                        (*prev_set_voltage)(struct dvb_frontend *fe, fe_sec_voltage_t voltage);
-        void                       (*gate_ctrl)(struct cx88_core  *core, int open);
 #endif
+        void                       (*gate_ctrl)(struct cx88_core  *core, int open);
        /* state info */
        struct task_struct         *kthread;
diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index 94378ccb7505..5d882a44e3ee 100644
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -62,9 +62,15 @@ static int em28xx_isoc_audio_deinit(struct em28xx *dev)
        dprintk("Stopping isoc\n");
        for (i = 0; i < EM28XX_AUDIO_BUFS; i++) {
-                usb_unlink_urb(dev->adev.urb[i]);
+                if (!irqs_disabled())
+                        usb_kill_urb(dev->adev.urb[i]);
+                else
+                        usb_unlink_urb(dev->adev.urb[i]);
                usb_free_urb(dev->adev.urb[i]);
                dev->adev.urb[i] = NULL;
+                kfree(dev->adev.transfer_buffer[i]);
+                dev->adev.transfer_buffer[i] = NULL;
        }
        return 0;
@@ -389,11 +395,15 @@ static int snd_em28xx_capture_trigger(struct snd_pcm_substream *substream,
 static snd_pcm_uframes_t snd_em28xx_capture_pointer(struct snd_pcm_substream
                                                    *substream)
 {
-        struct em28xx *dev;
+       unsigned long flags;
+        struct em28xx *dev;
        snd_pcm_uframes_t hwptr_done;
        dev = snd_pcm_substream_chip(substream);
+       spin_lock_irqsave(&dev->adev.slock, flags);
        hwptr_done = dev->adev.hwptr_done_capture;
+       spin_unlock_irqrestore(&dev->adev.slock, flags);
        return hwptr_done;
 }
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index ef9bf008a924..3b3ca3f46d52 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -102,6 +102,18 @@ static struct em28xx_reg_seq em2880_msi_digivox_ad_analog[] = {
 /* Board  - EM2870 Kworld 355u
   Analog - No input analog */
+static struct em28xx_reg_seq kworld_330u_analog[] = {
+        {EM28XX_R08_GPIO,       0x6d,   ~EM_GPIO_4,     10},
+        {EM2880_R04_GPO,        0x00,   0xff,           10},
+        { -1,                   -1,     -1,             -1},
+};
+static struct em28xx_reg_seq kworld_330u_digital[] = {
+        {EM28XX_R08_GPIO,       0x6e,   ~EM_GPIO_4,     10},
+        {EM2880_R04_GPO,        0x08,   0xff,           10},
+        { -1,                   -1,     -1,             -1},
+};
 /* Callback for the most boards */
 static struct em28xx_reg_seq default_tuner_gpio[] = {
        {EM28XX_R08_GPIO,       EM_GPIO_4,      EM_GPIO_4,      10},
@@ -1177,29 +1189,33 @@ struct em28xx_board em28xx_boards[] = {
                        .gpio     = hauppauge_wintv_hvr_900_analog,
                } },
        },
-        [EM2883_BOARD_KWORLD_HYBRID_A316] = {
+        [EM2883_BOARD_KWORLD_HYBRID_330U] = {
                .name         = "Kworld PlusTV HD Hybrid 330",
                .tuner_type   = TUNER_XC2028,
                .tuner_gpio   = default_tuner_gpio,
                .decoder      = EM28XX_TVP5150,
                .mts_firmware = 1,
                .has_dvb      = 1,
-                .dvb_gpio     = default_digital,
+                .dvb_gpio     = kworld_330u_digital,
+                .xclk             = EM28XX_XCLK_FREQUENCY_12MHZ,
+                .i2c_speed        = EM28XX_I2C_CLK_WAIT_ENABLE | EM28XX_I2C_EEPROM_ON_BOARD | EM28XX_I2C_EEPROM_KEY_VALID,
                .input        = { {
                        .type     = EM28XX_VMUX_TELEVISION,
                        .vmux     = TVP5150_COMPOSITE0,
                        .amux     = EM28XX_AMUX_VIDEO,
-                        .gpio     = default_analog,
+                        .gpio     = kworld_330u_analog,
+                        .aout     = EM28XX_AOUT_PCM_IN | EM28XX_AOUT_PCM_STEREO,
                }, {
                        .type     = EM28XX_VMUX_COMPOSITE1,
                        .vmux     = TVP5150_COMPOSITE1,
                        .amux     = EM28XX_AMUX_LINE_IN,
-                        .gpio     = hauppauge_wintv_hvr_900_analog,
+                        .gpio     = kworld_330u_analog,
+                        .aout     = EM28XX_AOUT_PCM_IN | EM28XX_AOUT_PCM_STEREO,
                }, {
                        .type     = EM28XX_VMUX_SVIDEO,
                        .vmux     = TVP5150_SVIDEO,
                        .amux     = EM28XX_AMUX_LINE_IN,
-                        .gpio     = hauppauge_wintv_hvr_900_analog,
+                        .gpio     = kworld_330u_analog,
                } },
        },
        [EM2820_BOARD_COMPRO_VIDEOMATE_FORYOU] = {
@@ -1249,7 +1265,7 @@ struct usb_device_id em28xx_id_table [] = {
        { USB_DEVICE(0xeb1a, 0xe310),
                        .driver_info = EM2880_BOARD_MSI_DIGIVOX_AD },
        { USB_DEVICE(0xeb1a, 0xa316),
-                        .driver_info = EM2883_BOARD_KWORLD_HYBRID_A316 },
+                        .driver_info = EM2883_BOARD_KWORLD_HYBRID_330U },
        { USB_DEVICE(0xeb1a, 0xe320),
                        .driver_info = EM2880_BOARD_MSI_DIGIVOX_AD_II },
        { USB_DEVICE(0xeb1a, 0xe323),
@@ -1526,6 +1542,10 @@ static void em28xx_setup_xc3028(struct em28xx *dev, struct xc2028_ctrl *ctl)
                /* FIXME: Better to specify the needed IF */
                ctl->demod = XC3028_FE_DEFAULT;
                break;
+        case EM2883_BOARD_KWORLD_HYBRID_330U:
+                ctl->demod = XC3028_FE_CHINA;
+                ctl->fname = XC2028_DEFAULT_FIRMWARE;
+                break;
        default:
                ctl->demod = XC3028_FE_OREN538;
        }
diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index eb5fb05fab22..94fb1b639a2e 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -438,6 +438,10 @@ int em28xx_audio_analog_set(struct em28xx *dev)
        if (dev->audio_mode.ac97 != EM28XX_NO_AC97) {
                int vol;
+                em28xx_write_ac97(dev, AC97_POWER_DOWN_CTRL, 0x4200);
+                em28xx_write_ac97(dev, AC97_EXT_AUD_CTRL, 0x0031);
+                em28xx_write_ac97(dev, AC97_PCM_IN_SRATE, 0xbb80);
                /* LSB: left channel - both channels with the same level */
                vol = (0x1f - dev->volume) | ((0x1f - dev->volume) << 8);
@@ -454,6 +458,15 @@ int em28xx_audio_analog_set(struct em28xx *dev)
                                em28xx_warn("couldn't setup AC97 register %d\n",
                                     outputs[i].reg);
                }
+                if (dev->ctl_aoutput & EM28XX_AOUT_PCM_IN) {
+                        int sel = ac97_return_record_select(dev->ctl_aoutput);
+                        /* Use the same input for both left and right channels */
+                        sel |= (sel << 8);
+                        em28xx_write_ac97(dev, AC97_RECORD_SELECT, sel);
+                }
        }
        return ret;
@@ -847,8 +860,11 @@ void em28xx_uninit_isoc(struct em28xx *dev)
        for (i = 0; i < dev->isoc_ctl.num_bufs; i++) {
                urb = dev->isoc_ctl.urb[i];
                if (urb) {
-                        usb_kill_urb(urb);
+                        if (!irqs_disabled())
-                        usb_unlink_urb(urb);
+                                usb_kill_urb(urb);
+                        else
+                                usb_unlink_urb(urb);
                        if (dev->isoc_ctl.transfer_buffer[i]) {
                                usb_buffer_free(dev->udev,
                                        urb->transfer_buffer_length,
diff --git a/drivers/media/video/em28xx/em28xx-dvb.c b/drivers/media/video/em28xx/em28xx-dvb.c
index d38cb21834d9..9ad8527b3fda 100644
--- a/drivers/media/video/em28xx/em28xx-dvb.c
+++ b/drivers/media/video/em28xx/em28xx-dvb.c
@@ -28,6 +28,7 @@
 #include "lgdt330x.h"
 #include "zl10353.h"
+#include "s5h1409.h"
 #ifdef EM28XX_DRX397XD_SUPPORT
 #include "drx397xD.h"
 #endif
@@ -232,6 +233,15 @@ static struct zl10353_config em28xx_zl10353_with_xc3028 = {
        .if2 = 45600,
 };
+static struct s5h1409_config em28xx_s5h1409_with_xc3028 = {
+        .demod_address = 0x32 >> 1,
+        .output_mode   = S5H1409_PARALLEL_OUTPUT,
+        .gpio          = S5H1409_GPIO_OFF,
+        .inversion     = S5H1409_INVERSION_OFF,
+        .status_mode   = S5H1409_DEMODLOCKING,
+        .mpeg_timing   = S5H1409_MPEGTIMING_CONTINOUS_NONINVERTING_CLOCK
+};
 #ifdef EM28XX_DRX397XD_SUPPORT
 /* [TODO] djh - not sure yet what the device config needs to contain */
 static struct drx397xD_config em28xx_drx397xD_with_xc3028 = {
@@ -412,7 +422,6 @@ static int dvb_init(struct em28xx *dev)
        case EM2883_BOARD_HAUPPAUGE_WINTV_HVR_850:
        case EM2883_BOARD_HAUPPAUGE_WINTV_HVR_950:
        case EM2880_BOARD_PINNACLE_PCTV_HD_PRO:
-        case EM2883_BOARD_KWORLD_HYBRID_A316:
        case EM2880_BOARD_AMD_ATI_TV_WONDER_HD_600:
                dvb->frontend = dvb_attach(lgdt330x_attach,
                                           &em2880_lgdt3303_dev,
@@ -433,6 +442,15 @@ static int dvb_init(struct em28xx *dev)
                        goto out_free;
                }
                break;
+        case EM2883_BOARD_KWORLD_HYBRID_330U:
+                dvb->frontend = dvb_attach(s5h1409_attach,
+                                           &em28xx_s5h1409_with_xc3028,
+                                           &dev->i2c_adap);
+                if (attach_xc3028(0x61, dev) < 0) {
+                        result = -EINVAL;
+                        goto out_free;
+                }
+                break;
        case EM2880_BOARD_HAUPPAUGE_WINTV_HVR_900_R2:
 #ifdef EM28XX_DRX397XD_SUPPORT
                /* We don't have the config structure properly populated, so
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index 416b691c33c1..8e61b2ca9167 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -886,10 +886,10 @@ static int vidioc_s_input(struct file *file, void *priv, unsigned int i)
        if (0 == INPUT(i)->type)
                return -EINVAL;
-        mutex_lock(&dev->lock);
+        dev->ctl_input = i;
-        video_mux(dev, i);
+        mutex_lock(&dev->lock);
+        video_mux(dev, dev->ctl_input);
        mutex_unlock(&dev->lock);
        return 0;
 }
@@ -939,6 +939,12 @@ static int vidioc_s_audio(struct file *file, void *priv, struct v4l2_audio *a)
        struct em28xx_fh   *fh  = priv;
        struct em28xx      *dev = fh->dev;
+        if (a->index >= MAX_EM28XX_INPUT)
+                return -EINVAL;
+        if (0 == INPUT(a->index)->type)
+                return -EINVAL;
        mutex_lock(&dev->lock);
        dev->ctl_ainput = INPUT(a->index)->amux;
@@ -1950,6 +1956,7 @@ static struct video_device *em28xx_vdev_init(struct em28xx *dev,
 int em28xx_register_analog_devices(struct em28xx *dev)
 {
+      u8 val;
        int ret;
        printk(KERN_INFO "%s: v4l2 driver version %d.%d.%d\n",
@@ -1957,34 +1964,34 @@ int em28xx_register_analog_devices(struct em28xx *dev)
                (EM28XX_VERSION_CODE >> 16) & 0xff,
                (EM28XX_VERSION_CODE >> 8) & 0xff, EM28XX_VERSION_CODE & 0xff);
+        /* set default norm */
+        dev->norm = em28xx_video_template.current_norm;
+        dev->width = norm_maxw(dev);
+        dev->height = norm_maxh(dev);
+        dev->interlaced = EM28XX_INTERLACED_DEFAULT;
+        dev->hscale = 0;
+        dev->vscale = 0;
+        dev->ctl_input = 0;
        /* Analog specific initialization */
        dev->format = &format[0];
-        video_mux(dev, 0);
+        video_mux(dev, dev->ctl_input);
+        /* Audio defaults */
+        dev->mute = 1;
+        dev->volume = 0x1f;
        /* enable vbi capturing */
 /*      em28xx_write_reg(dev, EM28XX_R0E_AUDIOSRC, 0xc0); audio register */
-/*      em28xx_write_reg(dev, EM28XX_R0F_XCLK, 0x80); clk register */
+       val = (u8)em28xx_read_reg(dev, EM28XX_R0F_XCLK);
+       em28xx_write_reg(dev, EM28XX_R0F_XCLK, (EM28XX_XCLK_AUDIO_UNMUTE | val));
        em28xx_write_reg(dev, EM28XX_R11_VINCTRL, 0x51);
-        dev->mute = 1;          /* maybe not the right place... */
-        dev->volume = 0x1f;
        em28xx_set_outfmt(dev);
        em28xx_colorlevels_set_default(dev);
        em28xx_compression_disable(dev);
-        /* set default norm */
-        dev->norm = em28xx_video_template.current_norm;
-        dev->width = norm_maxw(dev);
-        dev->height = norm_maxh(dev);
-        dev->interlaced = EM28XX_INTERLACED_DEFAULT;
-        dev->hscale = 0;
-        dev->vscale = 0;
-        /* FIXME: This is a very bad hack! Not all devices have TV on input 2 */
-        dev->ctl_input = 2;
        /* allocate and fill video video_device struct */
        dev->vdev = em28xx_vdev_init(dev, &em28xx_video_template, "video");
        if (!dev->vdev) {
diff --git a/drivers/media/video/em28xx/em28xx.h b/drivers/media/video/em28xx/em28xx.h
index 6c6b94aa05b2..dd2cd36fb1bb 100644
--- a/drivers/media/video/em28xx/em28xx.h
+++ b/drivers/media/video/em28xx/em28xx.h
@@ -94,7 +94,7 @@
 #define EM2882_BOARD_KWORLD_VS_DVBT               54
 #define EM2882_BOARD_TERRATEC_HYBRID_XS           55
 #define EM2882_BOARD_PINNACLE_HYBRID_PRO          56
-#define EM2883_BOARD_KWORLD_HYBRID_A316           57
+#define EM2883_BOARD_KWORLD_HYBRID_330U                  57
 #define EM2820_BOARD_COMPRO_VIDEOMATE_FORYOU      58
 #define EM2883_BOARD_HAUPPAUGE_WINTV_HVR_850      60
 #define EM2820_BOARD_PROLINK_PLAYTV_BOX4_USB2     61
@@ -300,13 +300,32 @@ enum em28xx_amux {
 };
 enum em28xx_aout {
+        /* AC97 outputs */
        EM28XX_AOUT_MASTER = 1 << 0,
        EM28XX_AOUT_LINE   = 1 << 1,
        EM28XX_AOUT_MONO   = 1 << 2,
        EM28XX_AOUT_LFE    = 1 << 3,
        EM28XX_AOUT_SURR   = 1 << 4,
+        /* PCM IN Mixer - used by AC97_RECORD_SELECT register */
+        EM28XX_AOUT_PCM_IN = 1 << 7,
+        /* Bits 10-8 are used to indicate the PCM IN record select */
+        EM28XX_AOUT_PCM_MIC_PCM = 0 << 8,
+        EM28XX_AOUT_PCM_CD      = 1 << 8,
+        EM28XX_AOUT_PCM_VIDEO   = 2 << 8,
+        EM28XX_AOUT_PCM_AUX     = 3 << 8,
+        EM28XX_AOUT_PCM_LINE    = 4 << 8,
+        EM28XX_AOUT_PCM_STEREO  = 5 << 8,
+        EM28XX_AOUT_PCM_MONO    = 6 << 8,
+        EM28XX_AOUT_PCM_PHONE   = 7 << 8,
 };
+static inline int ac97_return_record_select(int a_out)
+{
+        return (a_out & 0x700) >> 8;
+}
 struct em28xx_reg_seq {
        int reg;
        unsigned char val, mask;
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index 5e36b9a4ae3e..2ed24527ecd6 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -423,7 +423,8 @@ static void destroy_urbs(struct gspca_dev *gspca_dev)
                        break;
                gspca_dev->urb[i] = NULL;
-                usb_kill_urb(urb);
+                if (!gspca_dev->present)
+                        usb_kill_urb(urb);
                if (urb->transfer_buffer != NULL)
                        usb_buffer_free(gspca_dev->dev,
                                        urb->transfer_buffer_length,
@@ -1950,7 +1951,6 @@ void gspca_disconnect(struct usb_interface *intf)
        struct gspca_dev *gspca_dev = usb_get_intfdata(intf);
        gspca_dev->present = 0;
-        gspca_dev->streaming = 0;
        usb_set_intfdata(intf, NULL);
diff --git a/drivers/media/video/ivtv/ivtv-driver.c b/drivers/media/video/ivtv/ivtv-driver.c
index e8e5921cdc34..c46c990987f9 100644
--- a/drivers/media/video/ivtv/ivtv-driver.c
+++ b/drivers/media/video/ivtv/ivtv-driver.c
@@ -949,8 +949,10 @@ static int __devinit ivtv_probe(struct pci_dev *dev,
        itv->instance = atomic_inc_return(&ivtv_instance) - 1;
        retval = v4l2_device_register(&dev->dev, &itv->device);
-        if (retval)
+        if (retval) {
+                kfree(itv);
                return retval;
+        }
        /* "ivtv + PCI ID" is a bit of a mouthful, so use
           "ivtv + instance" instead. */
        snprintf(itv->device.name, sizeof(itv->device.name),
diff --git a/drivers/media/video/pwc/pwc-if.c b/drivers/media/video/pwc/pwc-if.c
index 39fbc970f43d..0d810189dd87 100644
--- a/drivers/media/video/pwc/pwc-if.c
+++ b/drivers/media/video/pwc/pwc-if.c
@@ -62,7 +62,6 @@
 #include <linux/poll.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
-#include <linux/version.h>
 #include <asm/io.h>
 #include "pwc.h"
diff --git a/drivers/media/video/saa7127.c b/drivers/media/video/saa7127.c
index d6848f7a503b..05221d47dd4c 100644
--- a/drivers/media/video/saa7127.c
+++ b/drivers/media/video/saa7127.c
@@ -149,7 +149,7 @@ static const struct i2c_reg_value saa7127_init_config_common[] = {
        { SAA7127_REG_COPYGEN_0,                        0x77 },
        { SAA7127_REG_COPYGEN_1,                        0x41 },
        { SAA7127_REG_COPYGEN_2,                        0x00 }, /* Macrovision enable/disable */
-        { SAA7127_REG_OUTPUT_PORT_CONTROL,              0x9e },
+        { SAA7127_REG_OUTPUT_PORT_CONTROL,              0xbf },
        { SAA7127_REG_GAIN_LUMINANCE_RGB,               0x00 },
        { SAA7127_REG_GAIN_COLORDIFF_RGB,               0x00 },
        { SAA7127_REG_INPUT_PORT_CONTROL_1,             0x80 }, /* for color bars */
@@ -488,12 +488,18 @@ static int saa7127_set_output_type(struct v4l2_subdev *sd, int output)
                break;
        case SAA7127_OUTPUT_TYPE_COMPOSITE:
-                state->reg_2d = 0x08;   /* 00001000 CVBS only, RGB DAC's off (high impedance mode) */
+                if (state->ident == V4L2_IDENT_SAA7129)
+                        state->reg_2d = 0x20;   /* CVBS only */
+                else
+                        state->reg_2d = 0x08;   /* 00001000 CVBS only, RGB DAC's off (high impedance mode) */
                state->reg_3a = 0x13;   /* by default switch YUV to RGB-matrix on */
                break;
        case SAA7127_OUTPUT_TYPE_SVIDEO:
-                state->reg_2d = 0xff;   /* 11111111  croma -> R, luma -> CVBS + G + B */
+                if (state->ident == V4L2_IDENT_SAA7129)
+                        state->reg_2d = 0x18;   /* Y + C */
+                else
+                        state->reg_2d = 0xff;   /*11111111  croma -> R, luma -> CVBS + G + B */
                state->reg_3a = 0x13;   /* by default switch YUV to RGB-matrix on */
                break;
@@ -508,7 +514,10 @@ static int saa7127_set_output_type(struct v4l2_subdev *sd, int output)
                break;
        case SAA7127_OUTPUT_TYPE_BOTH:
-                state->reg_2d = 0xbf;
+                if (state->ident == V4L2_IDENT_SAA7129)
+                        state->reg_2d = 0x38;
+                else
+                        state->reg_2d = 0xbf;
                state->reg_3a = 0x13;   /* by default switch YUV to RGB-matrix on */
                break;
@@ -731,24 +740,6 @@ static int saa7127_probe(struct i2c_client *client,
                return -ENODEV;
        }
-        /* Configure Encoder */
-        v4l2_dbg(1, debug, sd, "Configuring encoder\n");
-        saa7127_write_inittab(sd, saa7127_init_config_common);
-        saa7127_set_std(sd, V4L2_STD_NTSC);
-        saa7127_set_output_type(sd, SAA7127_OUTPUT_TYPE_BOTH);
-        saa7127_set_vps(sd, &vbi);
-        saa7127_set_wss(sd, &vbi);
-        saa7127_set_cc(sd, &vbi);
-        saa7127_set_xds(sd, &vbi);
-        if (test_image == 1)
-                /* The Encoder has an internal Colorbar generator */
-                /* This can be used for debugging */
-                saa7127_set_input_type(sd, SAA7127_INPUT_TYPE_TEST_IMAGE);
-        else
-                saa7127_set_input_type(sd, SAA7127_INPUT_TYPE_NORMAL);
-        saa7127_set_video_enable(sd, 1);
        if (id->driver_data) {  /* Chip type is already known */
                state->ident = id->driver_data;
        } else {                /* Needs detection */
@@ -770,6 +761,23 @@ static int saa7127_probe(struct i2c_client *client,
        v4l2_info(sd, "%s found @ 0x%x (%s)\n", client->name,
                        client->addr << 1, client->adapter->name);
+        v4l2_dbg(1, debug, sd, "Configuring encoder\n");
+        saa7127_write_inittab(sd, saa7127_init_config_common);
+        saa7127_set_std(sd, V4L2_STD_NTSC);
+        saa7127_set_output_type(sd, SAA7127_OUTPUT_TYPE_BOTH);
+        saa7127_set_vps(sd, &vbi);
+        saa7127_set_wss(sd, &vbi);
+        saa7127_set_cc(sd, &vbi);
+        saa7127_set_xds(sd, &vbi);
+        if (test_image == 1)
+                /* The Encoder has an internal Colorbar generator */
+                /* This can be used for debugging */
+                saa7127_set_input_type(sd, SAA7127_INPUT_TYPE_TEST_IMAGE);
+        else
+                saa7127_set_input_type(sd, SAA7127_INPUT_TYPE_NORMAL);
+        saa7127_set_video_enable(sd, 1);
        if (state->ident == V4L2_IDENT_SAA7129)
                saa7127_write_inittab(sd, saa7129_init_config_extra);
        return 0;
diff --git a/drivers/media/video/saa7134/saa7134-alsa.c b/drivers/media/video/saa7134/saa7134-alsa.c
index 26194a0ce927..c750d3dd57d2 100644
--- a/drivers/media/video/saa7134/saa7134-alsa.c
+++ b/drivers/media/video/saa7134/saa7134-alsa.c
@@ -1089,7 +1089,11 @@ static int saa7134_alsa_init(void)
        list_for_each(list,&saa7134_devlist) {
                dev = list_entry(list, struct saa7134_dev, devlist);
-                alsa_device_init(dev);
+                if (dev->pci->device == PCI_DEVICE_ID_PHILIPS_SAA7130)
+                        printk(KERN_INFO "%s/alsa: %s doesn't support digital audio\n",
+                                dev->name, saa7134_boards[dev->board].name);
+                else
+                        alsa_device_init(dev);
        }
        if (dev == NULL)
diff --git a/drivers/media/video/saa7134/saa7134-core.c b/drivers/media/video/saa7134/saa7134-core.c
index dfbe08a9ad9b..99221d726edb 100644
--- a/drivers/media/video/saa7134/saa7134-core.c
+++ b/drivers/media/video/saa7134/saa7134-core.c
@@ -660,6 +660,10 @@ static int saa7134_hwinit1(struct saa7134_dev *dev)
        saa_writel(SAA7134_IRQ1, 0);
        saa_writel(SAA7134_IRQ2, 0);
+        /* Clear any stale IRQ reports */
+        saa_writel(SAA7134_IRQ_REPORT, saa_readl(SAA7134_IRQ_REPORT));
        mutex_init(&dev->lock);
        spin_lock_init(&dev->slock);
diff --git a/drivers/media/video/saa717x.c b/drivers/media/video/saa717x.c
index 454ad1dd7507..88c5e942f751 100644
--- a/drivers/media/video/saa717x.c
+++ b/drivers/media/video/saa717x.c
@@ -30,7 +30,6 @@
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
diff --git a/drivers/media/video/tda9875.c b/drivers/media/video/tda9875.c
index 56f0c0eb500f..00c6cbe06ab0 100644
--- a/drivers/media/video/tda9875.c
+++ b/drivers/media/video/tda9875.c
@@ -242,7 +242,7 @@ static int tda9875_g_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 static int tda9875_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 {
        struct tda9875 *t = to_state(sd);
-        int chvol=0, volume, balance, left, right;
+        int chvol = 0, volume = 0, balance = 0, left, right;
        switch (ctrl->id) {
        case V4L2_CID_AUDIO_VOLUME:
diff --git a/drivers/media/video/tveeprom.c b/drivers/media/video/tveeprom.c
index 3b0b84c2e451..78277abb733b 100644
--- a/drivers/media/video/tveeprom.c
+++ b/drivers/media/video/tveeprom.c
@@ -427,6 +427,9 @@ void tveeprom_hauppauge_analog(struct i2c_client *c, struct tveeprom *tvee,
        const char *t_fmt_name2[8] = { " none", "", "", "", "", "", "", "" };
        memset(tvee, 0, sizeof(*tvee));
+        tvee->tuner_type = TUNER_ABSENT;
+        tvee->tuner2_type = TUNER_ABSENT;
        done = len = beenhere = 0;
        /* Different eeprom start offsets for em28xx, cx2388x and cx23418 */
diff --git a/drivers/media/video/tvp514x.c b/drivers/media/video/tvp514x.c
index ac9aa40d09f6..8e23aa53c29a 100644
--- a/drivers/media/video/tvp514x.c
+++ b/drivers/media/video/tvp514x.c
@@ -1401,7 +1401,7 @@ tvp514x_probe(struct i2c_client *client, const struct i2c_device_id *id)
        decoder->pdata = client->dev.platform_data;
        if (!decoder->pdata) {
-                v4l_err(client, "No platform data\n!!");
+                v4l_err(client, "No platform data!!\n");
                return -ENODEV;
        }
        /*
diff --git a/drivers/media/video/upd64031a.c b/drivers/media/video/upd64031a.c
index 4f16effb530f..f4522bb08916 100644
--- a/drivers/media/video/upd64031a.c
+++ b/drivers/media/video/upd64031a.c
@@ -21,7 +21,6 @@
 */
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/i2c.h>
diff --git a/drivers/media/video/upd64083.c b/drivers/media/video/upd64083.c
index 4b712f69d1b7..a5fb74bf2407 100644
--- a/drivers/media/video/upd64083.c
+++ b/drivers/media/video/upd64083.c
@@ -21,7 +21,6 @@
 * 02110-1301, USA.
 */
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/i2c.h>
diff --git a/drivers/media/video/usbvision/usbvision-i2c.c b/drivers/media/video/usbvision/usbvision-i2c.c
index 9907b9aff2b9..6b66ae4f430f 100644
--- a/drivers/media/video/usbvision/usbvision-i2c.c
+++ b/drivers/media/video/usbvision/usbvision-i2c.c
@@ -157,7 +157,7 @@ usbvision_i2c_xfer(struct i2c_adapter *i2c_adap, struct i2c_msg msgs[], int num)
        struct i2c_msg *pmsg;
        struct usb_usbvision *usbvision;
        int i, ret;
-        unsigned char addr;
+        unsigned char addr = 0;
        usbvision = (struct usb_usbvision *)i2c_get_adapdata(i2c_adap);
diff --git a/drivers/media/video/uvc/uvc_ctrl.c b/drivers/media/video/uvc/uvc_ctrl.c
index 2208165aa6f0..d2576f6391c0 100644
--- a/drivers/media/video/uvc/uvc_ctrl.c
+++ b/drivers/media/video/uvc/uvc_ctrl.c
@@ -1,7 +1,7 @@
 /*
 *      uvc_ctrl.c  --  USB Video Class driver - Controls
 *
- *      Copyright (C) 2005-2008
+ *      Copyright (C) 2005-2009
 *          Laurent Pinchart (laurent.pinchart@skynet.be)
 *
 *      This program is free software; you can redistribute it and/or modify
@@ -12,7 +12,6 @@
 */
 #include <linux/kernel.h>
-#include <linux/version.h>
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/uaccess.h>
@@ -29,7 +28,7 @@
 #define UVC_CTRL_DATA_BACKUP    1
 /* ------------------------------------------------------------------------
- * Control, formats, ...
+ * Controls
 */
 static struct uvc_control_info uvc_ctrls[] = {
@@ -635,7 +634,7 @@ static __s32 uvc_get_le_value(struct uvc_control_mapping *mapping,
                mask = (1 << bits) - 1;
        }
-        /* Sign-extend the value if needed */
+        /* Sign-extend the value if needed. */
        if (mapping->data_type == UVC_CTRL_DATA_TYPE_SIGNED)
                value |= -(value & (1 << (mapping->size - 1)));
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 89d8bd10a852..b12873265cc5 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -1,7 +1,7 @@
 /*
 *      uvc_driver.c  --  USB Video Class driver
 *
- *      Copyright (C) 2005-2008
+ *      Copyright (C) 2005-2009
 *          Laurent Pinchart (laurent.pinchart@skynet.be)
 *
 *      This program is free software; you can redistribute it and/or modify
@@ -24,7 +24,6 @@
 */
 #include <linux/kernel.h>
-#include <linux/version.h>
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/usb.h>
@@ -49,7 +48,7 @@ static unsigned int uvc_quirks_param;
 unsigned int uvc_trace_param;
 /* ------------------------------------------------------------------------
- * Control, formats, ...
+ * Video formats
 */
 static struct uvc_format_desc uvc_fmts[] = {
@@ -474,7 +473,7 @@ static int uvc_parse_format(struct uvc_device *dev,
                /* Several UVC chipsets screw up dwMaxVideoFrameBufferSize
                 * completely. Observed behaviours range from setting the
-                 * value to 1.1x the actual frame size of hardwiring the
+                 * value to 1.1x the actual frame size to hardwiring the
                 * 16 low bits to 0. This results in a higher than necessary
                 * memory usage as well as a wrong image size information. For
                 * uncompressed formats this can be fixed by computing the
@@ -487,7 +486,7 @@ static int uvc_parse_format(struct uvc_device *dev,
                /* Some bogus devices report dwMinFrameInterval equal to
                 * dwMaxFrameInterval and have dwFrameIntervalStep set to
                 * zero. Setting all null intervals to 1 fixes the problem and
-                 * some other divisions by zero which could happen.
+                 * some other divisions by zero that could happen.
                 */
                for (i = 0; i < n; ++i) {
                        interval = get_unaligned_le32(&buffer[26+4*i]);
@@ -1200,13 +1199,13 @@ static void uvc_unregister_video(struct uvc_device *dev)
 * Scan the UVC descriptors to locate a chain starting at an Output Terminal
 * and containing the following units:
 *
- * - a USB Streaming Output Terminal
+ * - one Output Terminal (USB Streaming or Display)
 * - zero or one Processing Unit
 * - zero, one or mode single-input Selector Units
 * - zero or one multiple-input Selector Units, provided all inputs are
 *   connected to input terminals
 * - zero, one or mode single-input Extension Units
- * - one Camera Input Terminal, or one or more External terminals.
+ * - one or more Input Terminals (Camera, External or USB Streaming)
 *
 * A side forward scan is made on each detected entity to check for additional
 * extension units.
@@ -1531,10 +1530,6 @@ static int uvc_register_video(struct uvc_device *dev)
        /* Set the driver data before calling video_register_device, otherwise
         * uvc_v4l2_open might race us.
-         *
-         * FIXME: usb_set_intfdata hasn't been called so far. Is that a
-         *        problem ? Does any function which could be called here get
-         *        a pointer to the usb_interface ?
         */
        dev->video.vdev = vdev;
        video_set_drvdata(vdev, &dev->video);
@@ -1569,7 +1564,7 @@ void uvc_delete(struct kref *kref)
        struct uvc_device *dev = container_of(kref, struct uvc_device, kref);
        struct list_head *p, *n;
-        /* Unregister the video device */
+        /* Unregister the video device. */
        uvc_unregister_video(dev);
        usb_put_intf(dev->intf);
        usb_put_dev(dev->udev);
@@ -1612,7 +1607,7 @@ static int uvc_probe(struct usb_interface *intf,
                uvc_trace(UVC_TRACE_PROBE, "Probing generic UVC device %s\n",
                                udev->devpath);
-        /* Allocate memory for the device and initialize it */
+        /* Allocate memory for the device and initialize it. */
        if ((dev = kzalloc(sizeof *dev, GFP_KERNEL)) == NULL)
                return -ENOMEM;
@@ -1633,14 +1628,14 @@ static int uvc_probe(struct usb_interface *intf,
                        le16_to_cpu(udev->descriptor.idVendor),
                        le16_to_cpu(udev->descriptor.idProduct));
-        /* Parse the Video Class control descriptor */
+        /* Parse the Video Class control descriptor. */
        if (uvc_parse_control(dev) < 0) {
                uvc_trace(UVC_TRACE_PROBE, "Unable to parse UVC "
                        "descriptors.\n");
                goto error;
        }
-        uvc_printk(KERN_INFO, "Found UVC %u.%02u device %s (%04x:%04x)\n",
+        uvc_printk(KERN_INFO, "Found UVC %u.%02x device %s (%04x:%04x)\n",
                dev->uvc_version >> 8, dev->uvc_version & 0xff,
                udev->product ? udev->product : "<unnamed>",
                le16_to_cpu(udev->descriptor.idVendor),
@@ -1653,18 +1648,18 @@ static int uvc_probe(struct usb_interface *intf,
                        "linux-uvc-devel mailing list.\n");
        }
-        /* Initialize controls */
+        /* Initialize controls. */
        if (uvc_ctrl_init_device(dev) < 0)
                goto error;
-        /* Register the video devices */
+        /* Register the video devices. */
        if (uvc_register_video(dev) < 0)
                goto error;
-        /* Save our data pointer in the interface data */
+        /* Save our data pointer in the interface data. */
        usb_set_intfdata(intf, dev);
-        /* Initialize the interrupt URB */
+        /* Initialize the interrupt URB. */
        if ((ret = uvc_status_init(dev)) < 0) {
                uvc_printk(KERN_INFO, "Unable to initialize the status "
                        "endpoint (%d), status interrupt will not be "
@@ -1839,24 +1834,24 @@ static struct usb_device_id uvc_ids[] = {
          .bInterfaceSubClass   = 1,
          .bInterfaceProtocol   = 0 },
        /* Apple Built-In iSight */
-        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                | USB_DEVICE_ID_MATCH_INT_INFO,
          .idVendor             = 0x05ac,
          .idProduct            = 0x8501,
-          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
-          .bInterfaceSubClass   = 1,
+          .bInterfaceSubClass   = 1,
-          .bInterfaceProtocol   = 0,
+          .bInterfaceProtocol   = 0,
          .driver_info          = UVC_QUIRK_PROBE_MINMAX
                                | UVC_QUIRK_BUILTIN_ISIGHT },
        /* Genesys Logic USB 2.0 PC Camera */
-        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                | USB_DEVICE_ID_MATCH_INT_INFO,
-          .idVendor             = 0x05e3,
+          .idVendor             = 0x05e3,
-          .idProduct            = 0x0505,
+          .idProduct            = 0x0505,
-          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
-          .bInterfaceSubClass   = 1,
+          .bInterfaceSubClass   = 1,
-          .bInterfaceProtocol   = 0,
+          .bInterfaceProtocol   = 0,
-          .driver_info          = UVC_QUIRK_STREAM_NO_FID },
+          .driver_info          = UVC_QUIRK_STREAM_NO_FID },
        /* MT6227 */
        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                | USB_DEVICE_ID_MATCH_INT_INFO,
diff --git a/drivers/media/video/uvc/uvc_isight.c b/drivers/media/video/uvc/uvc_isight.c
index 37bdefdbead5..436f462685a0 100644
--- a/drivers/media/video/uvc/uvc_isight.c
+++ b/drivers/media/video/uvc/uvc_isight.c
@@ -3,6 +3,8 @@
 *
 *      Copyright (C) 2006-2007
 *              Ivan N. Zlatev <contact@i-nz.net>
+ *      Copyright (C) 2008-2009
+ *              Laurent Pinchart <laurent.pinchart@skynet.be>
 *
 *      This program is free software; you can redistribute it and/or modify
 *      it under the terms of the GNU General Public License as published by
diff --git a/drivers/media/video/uvc/uvc_queue.c b/drivers/media/video/uvc/uvc_queue.c
index 42546342e97d..0155752e4a5a 100644
--- a/drivers/media/video/uvc/uvc_queue.c
+++ b/drivers/media/video/uvc/uvc_queue.c
@@ -1,7 +1,7 @@
 /*
 *      uvc_queue.c  --  USB Video Class driver - Buffers management
 *
- *      Copyright (C) 2005-2008
+ *      Copyright (C) 2005-2009
 *          Laurent Pinchart (laurent.pinchart@skynet.be)
 *
 *      This program is free software; you can redistribute it and/or modify
@@ -12,7 +12,6 @@
 */
 #include <linux/kernel.h>
-#include <linux/version.h>
 #include <linux/mm.h>
 #include <linux/list.h>
 #include <linux/module.h>
@@ -37,22 +36,22 @@
 * to user space will return -EBUSY.
 *
 * Video buffers are managed using two queues. However, unlike most USB video
- * drivers which use an in queue and an out queue, we use a main queue which
+ * drivers that use an in queue and an out queue, we use a main queue to hold
- * holds all queued buffers (both 'empty' and 'done' buffers), and an irq
+ * all queued buffers (both 'empty' and 'done' buffers), and an irq queue to
- * queue which holds empty buffers. This design (copied from video-buf)
+ * hold empty buffers. This design (copied from video-buf) minimizes locking
- * minimizes locking in interrupt, as only one queue is shared between
+ * in interrupt, as only one queue is shared between interrupt and user
- * interrupt and user contexts.
+ * contexts.
 *
 * Use cases
 * ---------
 *
- * Unless stated otherwise, all operations which modify the irq buffers queue
+ * Unless stated otherwise, all operations that modify the irq buffers queue
 * are protected by the irq spinlock.
 *
 * 1. The user queues the buffers, starts streaming and dequeues a buffer.
 *
 *    The buffers are added to the main and irq queues. Both operations are
- *    protected by the queue lock, and the latert is protected by the irq
+ *    protected by the queue lock, and the later is protected by the irq
 *    spinlock as well.
 *
 *    The completion handler fetches a buffer from the irq queue and fills it
@@ -60,7 +59,7 @@
 *    returns immediately.
 *
 *    When the buffer is full, the completion handler removes it from the irq
- *    queue, marks it as ready (UVC_BUF_STATE_DONE) and wake its wait queue.
+ *    queue, marks it as ready (UVC_BUF_STATE_DONE) and wakes its wait queue.
 *    At that point, any process waiting on the buffer will be woken up. If a
 *    process tries to dequeue a buffer after it has been marked ready, the
 *    dequeing will succeed immediately.
@@ -91,8 +90,8 @@ void uvc_queue_init(struct uvc_video_queue *queue, enum v4l2_buf_type type)
 /*
 * Allocate the video buffers.
 *
- * Pages are reserved to make sure they will not be swaped, as they will be
+ * Pages are reserved to make sure they will not be swapped, as they will be
- * filled in URB completion handler.
+ * filled in the URB completion handler.
 *
 * Buffers will be individually mapped, so they must all be page aligned.
 */
@@ -210,8 +209,8 @@ int uvc_query_buffer(struct uvc_video_queue *queue,
        __uvc_query_buffer(&queue->buffer[v4l2_buf->index], v4l2_buf);
 done:
-       mutex_unlock(&queue->mutex);
+        mutex_unlock(&queue->mutex);
-       return ret;
+        return ret;
 }
 /*
@@ -236,7 +235,7 @@ int uvc_queue_buffer(struct uvc_video_queue *queue,
        }
        mutex_lock(&queue->mutex);
-        if (v4l2_buf->index >= queue->count)  {
+        if (v4l2_buf->index >= queue->count) {
                uvc_trace(UVC_TRACE_CAPTURE, "[E] Out of range index.\n");
                ret = -EINVAL;
                goto done;
@@ -429,7 +428,7 @@ done:
 * Cancel the video buffers queue.
 *
 * Cancelling the queue marks all buffers on the irq queue as erroneous,
- * wakes them up and remove them from the queue.
+ * wakes them up and removes them from the queue.
 *
 * If the disconnect parameter is set, further calls to uvc_queue_buffer will
 * fail with -ENODEV.
diff --git a/drivers/media/video/uvc/uvc_status.c b/drivers/media/video/uvc/uvc_status.c
index 5d60b264d59a..c1e4ae27c613 100644
--- a/drivers/media/video/uvc/uvc_status.c
+++ b/drivers/media/video/uvc/uvc_status.c
@@ -1,7 +1,7 @@
 /*
 *      uvc_status.c  --  USB Video Class driver - Status endpoint
 *
- *      Copyright (C) 2007-2008
+ *      Copyright (C) 2007-2009
 *          Laurent Pinchart (laurent.pinchart@skynet.be)
 *
 *      This program is free software; you can redistribute it and/or modify
@@ -12,7 +12,6 @@
 */
 #include <linux/kernel.h>
-#include <linux/version.h>
 #include <linux/input.h>
 #include <linux/usb.h>
 #include <linux/usb/input.h>
diff --git a/drivers/media/video/uvc/uvc_v4l2.c b/drivers/media/video/uvc/uvc_v4l2.c
index fa150fff2c10..d681519d0c8a 100644
--- a/drivers/media/video/uvc/uvc_v4l2.c
+++ b/drivers/media/video/uvc/uvc_v4l2.c
@@ -1,7 +1,7 @@
 /*
 *      uvc_v4l2.c  --  USB Video Class driver - V4L2 API
 *
- *      Copyright (C) 2005-2008
+ *      Copyright (C) 2005-2009
 *          Laurent Pinchart (laurent.pinchart@skynet.be)
 *
 *      This program is free software; you can redistribute it and/or modify
@@ -37,7 +37,7 @@
 * must be grouped (for instance the Red Balance, Blue Balance and Do White
 * Balance V4L2 controls use the White Balance Component UVC control) or
 * otherwise translated. The approach we take here is to use a translation
- * table for the controls which can be mapped directly, and handle the others
+ * table for the controls that can be mapped directly, and handle the others
 * manually.
 */
 static int uvc_v4l2_query_menu(struct uvc_video_device *video,
@@ -189,7 +189,7 @@ static int uvc_v4l2_try_format(struct uvc_video_device *video,
                probe->dwMaxVideoFrameSize =
                        video->streaming->ctrl.dwMaxVideoFrameSize;
-        /* Probe the device */
+        /* Probe the device. */
        if ((ret = uvc_probe_video(video, probe)) < 0)
                goto done;
@@ -354,11 +354,11 @@ static int uvc_v4l2_set_streamparm(struct uvc_video_device *video,
 *
 * Each open instance of a UVC device can either be in a privileged or
 * unprivileged state. Only a single instance can be in a privileged state at
- * a given time. Trying to perform an operation which requires privileges will
+ * a given time. Trying to perform an operation that requires privileges will
 * automatically acquire the required privileges if possible, or return -EBUSY
 * otherwise. Privileges are dismissed when closing the instance.
 *
- * Operations which require privileges are:
+ * Operations that require privileges are:
 *
 * - VIDIOC_S_INPUT
 * - VIDIOC_S_PARM
diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index e7c31995527f..9bc4705be78d 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -1,7 +1,7 @@
 /*
 *      uvc_video.c  --  USB Video Class driver - Video handling
 *
- *      Copyright (C) 2005-2008
+ *      Copyright (C) 2005-2009
 *          Laurent Pinchart (laurent.pinchart@skynet.be)
 *
 *      This program is free software; you can redistribute it and/or modify
@@ -12,7 +12,6 @@
 */
 #include <linux/kernel.h>
-#include <linux/version.h>
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/usb.h>
@@ -115,7 +114,7 @@ static int uvc_get_video_ctrl(struct uvc_video_device *video,
                ctrl->wCompQuality = le16_to_cpup((__le16 *)data);
                ret = 0;
                goto out;
-        } else if (query == GET_DEF && probe == 1) {
+        } else if (query == GET_DEF && probe == 1 && ret != size) {
                /* Many cameras don't support the GET_DEF request on their
                 * video probe control. Warn once and return, the caller will
                 * fall back to GET_CUR.
@@ -160,7 +159,7 @@ static int uvc_get_video_ctrl(struct uvc_video_device *video,
        }
        /* Some broken devices return a null or wrong dwMaxVideoFrameSize.
-         * Try to get the value from the format and frame descriptor.
+         * Try to get the value from the format and frame descriptors.
         */
        uvc_fixup_buffer_size(video, ctrl);
        ret = 0;
@@ -191,9 +190,6 @@ static int uvc_set_video_ctrl(struct uvc_video_device *video,
        *(__le16 *)&data[12] = cpu_to_le16(ctrl->wCompQuality);
        *(__le16 *)&data[14] = cpu_to_le16(ctrl->wCompWindowSize);
        *(__le16 *)&data[16] = cpu_to_le16(ctrl->wDelay);
-        /* Note: Some of the fields below are not required for IN devices (see
-         * UVC spec, 4.3.1.1), but we still copy them in case support for OUT
-         * devices is added in the future. */
        put_unaligned_le32(ctrl->dwMaxVideoFrameSize, &data[18]);
        put_unaligned_le32(ctrl->dwMaxPayloadTransferSize, &data[22]);
@@ -400,7 +396,7 @@ static int uvc_video_decode_start(struct uvc_video_device *video,
         *
         * Empty buffers (bytesused == 0) don't trigger end of frame detection
         * as it doesn't make sense to return an empty buffer. This also
-         * avoids detecting and of frame conditions at FID toggling if the
+         * avoids detecting end of frame conditions at FID toggling if the
         * previous payload had the EOF bit set.
         */
        if (fid != video->last_fid && buf->buf.bytesused != 0) {
@@ -453,6 +449,17 @@ static void uvc_video_decode_end(struct uvc_video_device *video,
        }
 }
+/* Video payload encoding is handled by uvc_video_encode_header() and
+ * uvc_video_encode_data(). Only bulk transfers are currently supported.
+ *
+ * uvc_video_encode_header is called at the start of a payload. It adds header
+ * data to the transfer buffer and returns the header size. As the only known
+ * UVC output device transfers a whole frame in a single payload, the EOF bit
+ * is always set in the header.
+ *
+ * uvc_video_encode_data is called for every URB and copies the data from the
+ * video buffer to the transfer buffer.
+ */
 static int uvc_video_encode_header(struct uvc_video_device *video,
                struct uvc_buffer *buf, __u8 *data, int len)
 {
@@ -953,7 +960,7 @@ int uvc_video_suspend(struct uvc_video_device *video)
 }
 /*
- * Reconfigure the video interface and restart streaming if it was enable
+ * Reconfigure the video interface and restart streaming if it was enabled
 * before suspend.
 *
 * If an error occurs, disable the video queue. This will wake all pending
@@ -985,8 +992,8 @@ int uvc_video_resume(struct uvc_video_device *video)
 */
 /*
- * Initialize the UVC video device by retrieving the default format and
+ * Initialize the UVC video device by switching to alternate setting 0 and
- * committing it.
+ * retrieve the default format.
 *
 * Some cameras (namely the Fuji Finepix) set the format and frame
 * indexes to zero. The UVC standard doesn't clearly make this a spec
@@ -1014,7 +1021,7 @@ int uvc_video_init(struct uvc_video_device *video)
         */
        usb_set_interface(video->dev->udev, video->streaming->intfnum, 0);
-        /* Some webcams don't suport GET_DEF request on the probe control. We
+        /* Some webcams don't suport GET_DEF requests on the probe control. We
         * fall back to GET_CUR if GET_DEF fails.
         */
        if ((ret = uvc_get_video_ctrl(video, probe, 1, GET_DEF)) < 0 &&
diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
index bcf4361dc1bc..027947ea9b6e 100644
--- a/drivers/media/video/uvc/uvcvideo.h
+++ b/drivers/media/video/uvc/uvcvideo.h
@@ -72,149 +72,149 @@ struct uvc_xu_control {
 * UVC constants
 */
-#define SC_UNDEFINED                    0x00
+#define SC_UNDEFINED                    0x00
-#define SC_VIDEOCONTROL                 0x01
+#define SC_VIDEOCONTROL                 0x01
-#define SC_VIDEOSTREAMING               0x02
+#define SC_VIDEOSTREAMING               0x02
-#define SC_VIDEO_INTERFACE_COLLECTION   0x03
+#define SC_VIDEO_INTERFACE_COLLECTION   0x03
-#define PC_PROTOCOL_UNDEFINED           0x00
+#define PC_PROTOCOL_UNDEFINED           0x00
-#define CS_UNDEFINED                    0x20
+#define CS_UNDEFINED                    0x20
-#define CS_DEVICE                       0x21
+#define CS_DEVICE                       0x21
-#define CS_CONFIGURATION                0x22
+#define CS_CONFIGURATION                0x22
-#define CS_STRING                       0x23
+#define CS_STRING                       0x23
-#define CS_INTERFACE                    0x24
+#define CS_INTERFACE                    0x24
-#define CS_ENDPOINT                     0x25
+#define CS_ENDPOINT                     0x25
 /* VideoControl class specific interface descriptor */
-#define VC_DESCRIPTOR_UNDEFINED         0x00
+#define VC_DESCRIPTOR_UNDEFINED         0x00
-#define VC_HEADER                       0x01
+#define VC_HEADER                       0x01
-#define VC_INPUT_TERMINAL               0x02
+#define VC_INPUT_TERMINAL               0x02
-#define VC_OUTPUT_TERMINAL              0x03
+#define VC_OUTPUT_TERMINAL              0x03
-#define VC_SELECTOR_UNIT                0x04
+#define VC_SELECTOR_UNIT                0x04
-#define VC_PROCESSING_UNIT              0x05
+#define VC_PROCESSING_UNIT              0x05
-#define VC_EXTENSION_UNIT               0x06
+#define VC_EXTENSION_UNIT               0x06
 /* VideoStreaming class specific interface descriptor */
-#define VS_UNDEFINED                    0x00
+#define VS_UNDEFINED                    0x00
-#define VS_INPUT_HEADER                 0x01
+#define VS_INPUT_HEADER                 0x01
-#define VS_OUTPUT_HEADER                0x02
+#define VS_OUTPUT_HEADER                0x02
-#define VS_STILL_IMAGE_FRAME            0x03
+#define VS_STILL_IMAGE_FRAME            0x03
-#define VS_FORMAT_UNCOMPRESSED          0x04
+#define VS_FORMAT_UNCOMPRESSED          0x04
-#define VS_FRAME_UNCOMPRESSED           0x05
+#define VS_FRAME_UNCOMPRESSED           0x05
-#define VS_FORMAT_MJPEG                 0x06
+#define VS_FORMAT_MJPEG                 0x06
-#define VS_FRAME_MJPEG                  0x07
+#define VS_FRAME_MJPEG                  0x07
-#define VS_FORMAT_MPEG2TS               0x0a
+#define VS_FORMAT_MPEG2TS               0x0a
-#define VS_FORMAT_DV                    0x0c
+#define VS_FORMAT_DV                    0x0c
-#define VS_COLORFORMAT                  0x0d
+#define VS_COLORFORMAT                  0x0d
-#define VS_FORMAT_FRAME_BASED           0x10
+#define VS_FORMAT_FRAME_BASED           0x10
-#define VS_FRAME_FRAME_BASED            0x11
+#define VS_FRAME_FRAME_BASED            0x11
-#define VS_FORMAT_STREAM_BASED          0x12
+#define VS_FORMAT_STREAM_BASED          0x12
 /* Endpoint type */
-#define EP_UNDEFINED                    0x00
+#define EP_UNDEFINED                    0x00
-#define EP_GENERAL                      0x01
+#define EP_GENERAL                      0x01
-#define EP_ENDPOINT                     0x02
+#define EP_ENDPOINT                     0x02
-#define EP_INTERRUPT                    0x03
+#define EP_INTERRUPT                    0x03
 /* Request codes */
-#define RC_UNDEFINED                    0x00
+#define RC_UNDEFINED                    0x00
-#define SET_CUR                         0x01
+#define SET_CUR                         0x01
-#define GET_CUR                         0x81
+#define GET_CUR                         0x81
-#define GET_MIN                         0x82
+#define GET_MIN                         0x82
-#define GET_MAX                         0x83
+#define GET_MAX                         0x83
-#define GET_RES                         0x84
+#define GET_RES                         0x84
-#define GET_LEN                         0x85
+#define GET_LEN                         0x85
-#define GET_INFO                        0x86
+#define GET_INFO                        0x86
-#define GET_DEF                         0x87
+#define GET_DEF                         0x87
 /* VideoControl interface controls */
-#define VC_CONTROL_UNDEFINED            0x00
+#define VC_CONTROL_UNDEFINED            0x00
-#define VC_VIDEO_POWER_MODE_CONTROL     0x01
+#define VC_VIDEO_POWER_MODE_CONTROL     0x01
-#define VC_REQUEST_ERROR_CODE_CONTROL   0x02
+#define VC_REQUEST_ERROR_CODE_CONTROL   0x02
 /* Terminal controls */
-#define TE_CONTROL_UNDEFINED            0x00
+#define TE_CONTROL_UNDEFINED            0x00
 /* Selector Unit controls */
-#define SU_CONTROL_UNDEFINED            0x00
+#define SU_CONTROL_UNDEFINED            0x00
-#define SU_INPUT_SELECT_CONTROL         0x01
+#define SU_INPUT_SELECT_CONTROL         0x01
 /* Camera Terminal controls */
-#define CT_CONTROL_UNDEFINED                            0x00
+#define CT_CONTROL_UNDEFINED                            0x00
-#define CT_SCANNING_MODE_CONTROL                        0x01
+#define CT_SCANNING_MODE_CONTROL                        0x01
-#define CT_AE_MODE_CONTROL                              0x02
+#define CT_AE_MODE_CONTROL                              0x02
-#define CT_AE_PRIORITY_CONTROL                          0x03
+#define CT_AE_PRIORITY_CONTROL                          0x03
-#define CT_EXPOSURE_TIME_ABSOLUTE_CONTROL               0x04
+#define CT_EXPOSURE_TIME_ABSOLUTE_CONTROL               0x04
-#define CT_EXPOSURE_TIME_RELATIVE_CONTROL               0x05
+#define CT_EXPOSURE_TIME_RELATIVE_CONTROL               0x05
-#define CT_FOCUS_ABSOLUTE_CONTROL                       0x06
+#define CT_FOCUS_ABSOLUTE_CONTROL                       0x06
-#define CT_FOCUS_RELATIVE_CONTROL                       0x07
+#define CT_FOCUS_RELATIVE_CONTROL                       0x07
-#define CT_FOCUS_AUTO_CONTROL                           0x08
+#define CT_FOCUS_AUTO_CONTROL                           0x08
-#define CT_IRIS_ABSOLUTE_CONTROL                        0x09
+#define CT_IRIS_ABSOLUTE_CONTROL                        0x09
-#define CT_IRIS_RELATIVE_CONTROL                        0x0a
+#define CT_IRIS_RELATIVE_CONTROL                        0x0a
-#define CT_ZOOM_ABSOLUTE_CONTROL                        0x0b
+#define CT_ZOOM_ABSOLUTE_CONTROL                        0x0b
-#define CT_ZOOM_RELATIVE_CONTROL                        0x0c
+#define CT_ZOOM_RELATIVE_CONTROL                        0x0c
-#define CT_PANTILT_ABSOLUTE_CONTROL                     0x0d
+#define CT_PANTILT_ABSOLUTE_CONTROL                     0x0d
-#define CT_PANTILT_RELATIVE_CONTROL                     0x0e
+#define CT_PANTILT_RELATIVE_CONTROL                     0x0e
-#define CT_ROLL_ABSOLUTE_CONTROL                        0x0f
+#define CT_ROLL_ABSOLUTE_CONTROL                        0x0f
-#define CT_ROLL_RELATIVE_CONTROL                        0x10
+#define CT_ROLL_RELATIVE_CONTROL                        0x10
-#define CT_PRIVACY_CONTROL                              0x11
+#define CT_PRIVACY_CONTROL                              0x11
 /* Processing Unit controls */
-#define PU_CONTROL_UNDEFINED                            0x00
+#define PU_CONTROL_UNDEFINED                            0x00
-#define PU_BACKLIGHT_COMPENSATION_CONTROL               0x01
+#define PU_BACKLIGHT_COMPENSATION_CONTROL               0x01
-#define PU_BRIGHTNESS_CONTROL                           0x02
+#define PU_BRIGHTNESS_CONTROL                           0x02
-#define PU_CONTRAST_CONTROL                             0x03
+#define PU_CONTRAST_CONTROL                             0x03
-#define PU_GAIN_CONTROL                                 0x04
+#define PU_GAIN_CONTROL                                 0x04
-#define PU_POWER_LINE_FREQUENCY_CONTROL                 0x05
+#define PU_POWER_LINE_FREQUENCY_CONTROL                 0x05
-#define PU_HUE_CONTROL                                  0x06
+#define PU_HUE_CONTROL                                  0x06
-#define PU_SATURATION_CONTROL                           0x07
+#define PU_SATURATION_CONTROL                           0x07
-#define PU_SHARPNESS_CONTROL                            0x08
+#define PU_SHARPNESS_CONTROL                            0x08
-#define PU_GAMMA_CONTROL                                0x09
+#define PU_GAMMA_CONTROL                                0x09
-#define PU_WHITE_BALANCE_TEMPERATURE_CONTROL            0x0a
+#define PU_WHITE_BALANCE_TEMPERATURE_CONTROL            0x0a
-#define PU_WHITE_BALANCE_TEMPERATURE_AUTO_CONTROL       0x0b
+#define PU_WHITE_BALANCE_TEMPERATURE_AUTO_CONTROL       0x0b
-#define PU_WHITE_BALANCE_COMPONENT_CONTROL              0x0c
+#define PU_WHITE_BALANCE_COMPONENT_CONTROL              0x0c
-#define PU_WHITE_BALANCE_COMPONENT_AUTO_CONTROL         0x0d
+#define PU_WHITE_BALANCE_COMPONENT_AUTO_CONTROL         0x0d
-#define PU_DIGITAL_MULTIPLIER_CONTROL                   0x0e
+#define PU_DIGITAL_MULTIPLIER_CONTROL                   0x0e
-#define PU_DIGITAL_MULTIPLIER_LIMIT_CONTROL             0x0f
+#define PU_DIGITAL_MULTIPLIER_LIMIT_CONTROL             0x0f
-#define PU_HUE_AUTO_CONTROL                             0x10
+#define PU_HUE_AUTO_CONTROL                             0x10
-#define PU_ANALOG_VIDEO_STANDARD_CONTROL                0x11
+#define PU_ANALOG_VIDEO_STANDARD_CONTROL                0x11
-#define PU_ANALOG_LOCK_STATUS_CONTROL                   0x12
+#define PU_ANALOG_LOCK_STATUS_CONTROL                   0x12
 #define LXU_MOTOR_PANTILT_RELATIVE_CONTROL              0x01
 #define LXU_MOTOR_PANTILT_RESET_CONTROL                 0x02
 #define LXU_MOTOR_FOCUS_MOTOR_CONTROL                   0x03
 /* VideoStreaming interface controls */
-#define VS_CONTROL_UNDEFINED            0x00
+#define VS_CONTROL_UNDEFINED            0x00
-#define VS_PROBE_CONTROL                0x01
+#define VS_PROBE_CONTROL                0x01
-#define VS_COMMIT_CONTROL               0x02
+#define VS_COMMIT_CONTROL               0x02
-#define VS_STILL_PROBE_CONTROL          0x03
+#define VS_STILL_PROBE_CONTROL          0x03
-#define VS_STILL_COMMIT_CONTROL         0x04
+#define VS_STILL_COMMIT_CONTROL         0x04
-#define VS_STILL_IMAGE_TRIGGER_CONTROL  0x05
+#define VS_STILL_IMAGE_TRIGGER_CONTROL  0x05
-#define VS_STREAM_ERROR_CODE_CONTROL    0x06
+#define VS_STREAM_ERROR_CODE_CONTROL    0x06
-#define VS_GENERATE_KEY_FRAME_CONTROL   0x07
+#define VS_GENERATE_KEY_FRAME_CONTROL   0x07
-#define VS_UPDATE_FRAME_SEGMENT_CONTROL 0x08
+#define VS_UPDATE_FRAME_SEGMENT_CONTROL 0x08
-#define VS_SYNC_DELAY_CONTROL           0x09
+#define VS_SYNC_DELAY_CONTROL           0x09
-#define TT_VENDOR_SPECIFIC              0x0100
+#define TT_VENDOR_SPECIFIC              0x0100
-#define TT_STREAMING                    0x0101
+#define TT_STREAMING                    0x0101
 /* Input Terminal types */
-#define ITT_VENDOR_SPECIFIC             0x0200
+#define ITT_VENDOR_SPECIFIC             0x0200
-#define ITT_CAMERA                      0x0201
+#define ITT_CAMERA                      0x0201
-#define ITT_MEDIA_TRANSPORT_INPUT       0x0202
+#define ITT_MEDIA_TRANSPORT_INPUT       0x0202
 /* Output Terminal types */
-#define OTT_VENDOR_SPECIFIC             0x0300
+#define OTT_VENDOR_SPECIFIC             0x0300
-#define OTT_DISPLAY                     0x0301
+#define OTT_DISPLAY                     0x0301
-#define OTT_MEDIA_TRANSPORT_OUTPUT      0x0302
+#define OTT_MEDIA_TRANSPORT_OUTPUT      0x0302
 /* External Terminal types */
-#define EXTERNAL_VENDOR_SPECIFIC        0x0400
+#define EXTERNAL_VENDOR_SPECIFIC        0x0400
-#define COMPOSITE_CONNECTOR             0x0401
+#define COMPOSITE_CONNECTOR             0x0401
-#define SVIDEO_CONNECTOR                0x0402
+#define SVIDEO_CONNECTOR                0x0402
-#define COMPONENT_CONNECTOR             0x0403
+#define COMPONENT_CONNECTOR             0x0403
 #define UVC_TERM_INPUT                  0x0000
 #define UVC_TERM_OUTPUT                 0x8000
@@ -541,11 +541,11 @@ struct uvc_streaming {
 };
 enum uvc_buffer_state {
-        UVC_BUF_STATE_IDLE       = 0,
+        UVC_BUF_STATE_IDLE      = 0,
-        UVC_BUF_STATE_QUEUED     = 1,
+        UVC_BUF_STATE_QUEUED    = 1,
-        UVC_BUF_STATE_ACTIVE     = 2,
+        UVC_BUF_STATE_ACTIVE    = 2,
-        UVC_BUF_STATE_DONE       = 3,
+        UVC_BUF_STATE_DONE      = 3,
-        UVC_BUF_STATE_ERROR      = 4,
+        UVC_BUF_STATE_ERROR     = 4,
 };
 struct uvc_buffer {
diff --git a/drivers/media/video/v4l2-subdev.c b/drivers/media/video/v4l2-subdev.c
index fbe9cc0d433a..21208805ea9b 100644
--- a/drivers/media/video/v4l2-subdev.c
+++ b/drivers/media/video/v4l2-subdev.c
@@ -28,13 +28,13 @@ int v4l2_subdev_command(struct v4l2_subdev *sd, unsigned cmd, void *arg)
 {
        switch (cmd) {
        case VIDIOC_QUERYCTRL:
-                return v4l2_subdev_call(sd, core, querymenu, arg);
+                return v4l2_subdev_call(sd, core, queryctrl, arg);
        case VIDIOC_G_CTRL:
                return v4l2_subdev_call(sd, core, g_ctrl, arg);
        case VIDIOC_S_CTRL:
                return v4l2_subdev_call(sd, core, s_ctrl, arg);
        case VIDIOC_QUERYMENU:
-                return v4l2_subdev_call(sd, core, queryctrl, arg);
+                return v4l2_subdev_call(sd, core, querymenu, arg);
        case VIDIOC_LOG_STATUS:
                return v4l2_subdev_call(sd, core, log_status);
        case VIDIOC_DBG_G_CHIP_IDENT:
diff --git a/drivers/media/video/zoran/zoran.h b/drivers/media/video/zoran/zoran.h
index 46b7ad477ceb..e873a916250f 100644
--- a/drivers/media/video/zoran/zoran.h
+++ b/drivers/media/video/zoran/zoran.h
@@ -349,7 +349,6 @@ struct card_info {
        u16 i2c_decoder, i2c_encoder;                   /* I2C types */
        u16 video_vfe, video_codec;                     /* videocodec types */
        u16 audio_chip;                                 /* audio type */
-        u16 vendor_id, device_id;       /* subsystem vendor/device ID */
        int inputs;             /* number of video inputs */
        struct input {
@@ -401,7 +400,6 @@ struct zoran {
        char name[32];          /* name of this device */
        struct pci_dev *pci_dev;        /* PCI device */
        unsigned char revision; /* revision of zr36057 */
-        unsigned int zr36057_adr;       /* bus address of IO mem returned by PCI BIOS */
        unsigned char __iomem *zr36057_mem;/* pointer to mapped IO memory */
        spinlock_t spinlock;    /* Spinlock */
@@ -490,16 +488,10 @@ struct zoran {
        wait_queue_head_t test_q;
 };
-/*The following should be done in more portable way. It depends on define
+/* There was something called _ALPHA_BUZ that used the PCI address instead of
-  of _ALPHA_BUZ in the Makefile.*/
+ * the kernel iomapped address for btread/btwrite.  */
-#ifdef _ALPHA_BUZ
-#define btwrite(dat,adr)    writel((dat), zr->zr36057_adr+(adr))
-#define btread(adr)         readl(zr->zr36057_adr+(adr))
-#else
 #define btwrite(dat,adr)    writel((dat), zr->zr36057_mem+(adr))
 #define btread(adr)         readl(zr->zr36057_mem+(adr))
-#endif
 #define btand(dat,adr)      btwrite((dat) & btread(adr), adr)
 #define btor(dat,adr)       btwrite((dat) | btread(adr), adr)
diff --git a/drivers/media/video/zoran/zoran_card.c b/drivers/media/video/zoran/zoran_card.c
index 05f39195372e..5d2f090aa0f8 100644
--- a/drivers/media/video/zoran/zoran_card.c
+++ b/drivers/media/video/zoran/zoran_card.c
@@ -61,17 +61,17 @@
 extern const struct zoran_format zoran_formats[];
-static int card[BUZ_MAX] = { -1, -1, -1, -1 };
+static int card[BUZ_MAX] = { [0 ... (BUZ_MAX-1)] = -1 };
 module_param_array(card, int, NULL, 0444);
-MODULE_PARM_DESC(card, "The type of card");
+MODULE_PARM_DESC(card, "Card type");
-static int encoder[BUZ_MAX] = { -1, -1, -1, -1 };
+static int encoder[BUZ_MAX] = { [0 ... (BUZ_MAX-1)] = -1 };
 module_param_array(encoder, int, NULL, 0444);
-MODULE_PARM_DESC(encoder, "i2c TV encoder");
+MODULE_PARM_DESC(encoder, "Video encoder chip");
-static int decoder[BUZ_MAX] = { -1, -1, -1, -1 };
+static int decoder[BUZ_MAX] = { [0 ... (BUZ_MAX-1)] = -1 };
 module_param_array(decoder, int, NULL, 0444);
-MODULE_PARM_DESC(decoder, "i2c TV decoder");
+MODULE_PARM_DESC(decoder, "Video decoder chip");
 /*
   The video mem address of the video card.
@@ -104,9 +104,9 @@ module_param(default_norm, int, 0444);
 MODULE_PARM_DESC(default_norm, "Default norm (0=PAL, 1=NTSC, 2=SECAM)");
 /* /dev/videoN, -1 for autodetect */
-static int video_nr[BUZ_MAX] = {-1, -1, -1, -1};
+static int video_nr[BUZ_MAX] = { [0 ... (BUZ_MAX-1)] = -1 };
 module_param_array(video_nr, int, NULL, 0444);
-MODULE_PARM_DESC(video_nr, "video device number (-1=Auto)");
+MODULE_PARM_DESC(video_nr, "Video device number (-1=Auto)");
 /*
   Number and size of grab buffers for Video 4 Linux
@@ -153,9 +153,21 @@ MODULE_DESCRIPTION("Zoran-36057/36067 JPEG codec driver");
 MODULE_AUTHOR("Serguei Miridonov");
 MODULE_LICENSE("GPL");
+#define ZR_DEVICE(subven, subdev, data) { \
+        .vendor = PCI_VENDOR_ID_ZORAN, .device = PCI_DEVICE_ID_ZORAN_36057, \
+        .subvendor = (subven), .subdevice = (subdev), .driver_data = (data) }
+static struct pci_device_id zr36067_pci_tbl[] = {
+        ZR_DEVICE(PCI_VENDOR_ID_MIRO, PCI_DEVICE_ID_MIRO_DC10PLUS, DC10plus),
+        ZR_DEVICE(PCI_VENDOR_ID_MIRO, PCI_DEVICE_ID_MIRO_DC30PLUS, DC30plus),
+        ZR_DEVICE(PCI_VENDOR_ID_ELECTRONICDESIGNGMBH, PCI_DEVICE_ID_LML_33R10, LML33R10),
+        ZR_DEVICE(PCI_VENDOR_ID_IOMEGA, PCI_DEVICE_ID_IOMEGA_BUZ, BUZ),
+        ZR_DEVICE(PCI_ANY_ID, PCI_ANY_ID, NUM_CARDS),
+        {0}
+};
+MODULE_DEVICE_TABLE(pci, zr36067_pci_tbl);
-int zoran_num;                  /* number of Buzs in use */
+static unsigned int zoran_num;          /* number of cards found */
-struct zoran *zoran[BUZ_MAX];
 /* videocodec bus functions ZR36060 */
 static u32
@@ -472,8 +484,6 @@ static struct card_info zoran_cards[NUM_CARDS] __devinitdata = {
        }, {
                .type = DC10plus,
                .name = "DC10plus",
-                .vendor_id = PCI_VENDOR_ID_MIRO,
-                .device_id = PCI_DEVICE_ID_MIRO_DC10PLUS,
                .i2c_decoder = I2C_DRIVERID_SAA7110,
                .i2c_encoder = I2C_DRIVERID_ADV7175,
                .video_codec = CODEC_TYPE_ZR36060,
@@ -531,8 +541,6 @@ static struct card_info zoran_cards[NUM_CARDS] __devinitdata = {
        }, {
                .type = DC30plus,
                .name = "DC30plus",
-                .vendor_id = PCI_VENDOR_ID_MIRO,
-                .device_id = PCI_DEVICE_ID_MIRO_DC30PLUS,
                .i2c_decoder = I2C_DRIVERID_VPX3220,
                .i2c_encoder = I2C_DRIVERID_ADV7175,
                .video_codec = CODEC_TYPE_ZR36050,
@@ -589,8 +597,6 @@ static struct card_info zoran_cards[NUM_CARDS] __devinitdata = {
        }, {
                .type = LML33R10,
                .name = "LML33R10",
-                .vendor_id = PCI_VENDOR_ID_ELECTRONICDESIGNGMBH,
-                .device_id = PCI_DEVICE_ID_LML_33R10,
                .i2c_decoder = I2C_DRIVERID_SAA7114,
                .i2c_encoder = I2C_DRIVERID_ADV7170,
                .video_codec = CODEC_TYPE_ZR36060,
@@ -618,8 +624,6 @@ static struct card_info zoran_cards[NUM_CARDS] __devinitdata = {
        }, {
                .type = BUZ,
                .name = "Buz",
-                .vendor_id = PCI_VENDOR_ID_IOMEGA,
-                .device_id = PCI_DEVICE_ID_IOMEGA_BUZ,
                .i2c_decoder = I2C_DRIVERID_SAA7111A,
                .i2c_encoder = I2C_DRIVERID_SAA7185B,
                .video_codec = CODEC_TYPE_ZR36060,
@@ -649,8 +653,6 @@ static struct card_info zoran_cards[NUM_CARDS] __devinitdata = {
                .name = "6-Eyes",
                /* AverMedia chose not to brand the 6-Eyes. Thus it
                   can't be autodetected, and requires card=x. */
-                .vendor_id = -1,
-                .device_id = -1,
                .i2c_decoder = I2C_DRIVERID_KS0127,
                .i2c_encoder = I2C_DRIVERID_BT866,
                .video_codec = CODEC_TYPE_ZR36060,
@@ -1138,7 +1140,8 @@ zr36057_init (struct zoran *zr)
        strcpy(zr->video_dev->name, ZR_DEVNAME(zr));
        err = video_register_device(zr->video_dev, VFL_TYPE_GRABBER, video_nr[zr->id]);
        if (err < 0)
-                goto exit_unregister;
+                goto exit_free;
+        video_set_drvdata(zr->video_dev, zr);
        zoran_init_hardware(zr);
        if (zr36067_debug > 2)
@@ -1153,19 +1156,19 @@ zr36057_init (struct zoran *zr)
        zr->initialized = 1;
        return 0;
-exit_unregister:
-        zoran_unregister_i2c(zr);
 exit_free:
        kfree(zr->stat_com);
        kfree(zr->video_dev);
        return err;
 }
-static void
+static void __devexit zoran_remove(struct pci_dev *pdev)
-zoran_release (struct zoran *zr)
 {
+        struct zoran *zr = pci_get_drvdata(pdev);
        if (!zr->initialized)
                goto exit_free;
        /* unregister videocodec bus */
        if (zr->codec) {
                struct videocodec_master *master = zr->codec->master_data;
@@ -1194,6 +1197,7 @@ zoran_release (struct zoran *zr)
        pci_disable_device(zr->pci_dev);
        video_unregister_device(zr->video_dev);
 exit_free:
+        pci_set_drvdata(pdev, NULL);
        kfree(zr);
 }
@@ -1256,338 +1260,329 @@ zoran_setup_videocodec (struct zoran *zr,
 *   Scan for a Buz card (actually for the PCI controller ZR36057),
 *   request the irq and map the io memory
 */
-static int __devinit
+static int __devinit zoran_probe(struct pci_dev *pdev,
-find_zr36057 (void)
+                                 const struct pci_device_id *ent)
 {
        unsigned char latency, need_latency;
        struct zoran *zr;
-        struct pci_dev *dev = NULL;
        int result;
        struct videocodec_master *master_vfe = NULL;
        struct videocodec_master *master_codec = NULL;
        int card_num;
        char *i2c_enc_name, *i2c_dec_name, *codec_name, *vfe_name;
+        unsigned int nr;
-        zoran_num = 0;
-        while (zoran_num < BUZ_MAX &&
-               (dev = pci_get_device(PCI_VENDOR_ID_ZORAN, PCI_DEVICE_ID_ZORAN_36057, dev)) != NULL) {
-                card_num = card[zoran_num];
-                zr = kzalloc(sizeof(struct zoran), GFP_KERNEL);
-                if (!zr) {
-                        dprintk(1,
-                                KERN_ERR
-                                "%s: find_zr36057() - kzalloc failed\n",
-                                ZORAN_NAME);
-                        continue;
-                }
-                zr->pci_dev = dev;
-                //zr->zr36057_mem = NULL;
-                zr->id = zoran_num;
-                snprintf(ZR_DEVNAME(zr), sizeof(ZR_DEVNAME(zr)), "MJPEG[%u]", zr->id);
-                spin_lock_init(&zr->spinlock);
-                mutex_init(&zr->resource_lock);
-                if (pci_enable_device(dev))
-                        goto zr_free_mem;
-                zr->zr36057_adr = pci_resource_start(zr->pci_dev, 0);
-                pci_read_config_byte(zr->pci_dev, PCI_CLASS_REVISION,
-                                     &zr->revision);
-                if (zr->revision < 2) {
-                        dprintk(1,
-                                KERN_INFO
-                                "%s: Zoran ZR36057 (rev %d) irq: %d, memory: 0x%08x.\n",
-                                ZR_DEVNAME(zr), zr->revision, zr->pci_dev->irq,
-                                zr->zr36057_adr);
-                        if (card_num == -1) {
+        nr = zoran_num++;
-                                dprintk(1,
+        if (nr >= BUZ_MAX) {
-                                        KERN_ERR
+                dprintk(1,
-                                        "%s: find_zr36057() - no card specified, please use the card=X insmod option\n",
+                        KERN_ERR
-                                        ZR_DEVNAME(zr));
+                        "%s: driver limited to %d card(s) maximum\n",
-                                goto zr_free_mem;
+                        ZORAN_NAME, BUZ_MAX);
-                        }
+                return -ENOENT;
-                } else {
+        }
-                        int i;
-                        unsigned short ss_vendor, ss_device;
-                        ss_vendor = zr->pci_dev->subsystem_vendor;
+        zr = kzalloc(sizeof(struct zoran), GFP_KERNEL);
-                        ss_device = zr->pci_dev->subsystem_device;
+        if (!zr) {
+                dprintk(1,
+                        KERN_ERR
+                        "%s: find_zr36057() - kzalloc failed\n",
+                        ZORAN_NAME);
+                return -ENOMEM;
+        }
+        zr->pci_dev = pdev;
+        zr->id = nr;
+        snprintf(ZR_DEVNAME(zr), sizeof(ZR_DEVNAME(zr)), "MJPEG[%u]", zr->id);
+        spin_lock_init(&zr->spinlock);
+        mutex_init(&zr->resource_lock);
+        if (pci_enable_device(pdev))
+                goto zr_free_mem;
+        pci_read_config_byte(zr->pci_dev, PCI_CLASS_REVISION, &zr->revision);
+        dprintk(1,
+                KERN_INFO
+                "%s: Zoran ZR360%c7 (rev %d), irq: %d, memory: 0x%08llx\n",
+                ZR_DEVNAME(zr), zr->revision < 2 ? '5' : '6', zr->revision,
+                zr->pci_dev->irq, (uint64_t)pci_resource_start(zr->pci_dev, 0));
+        if (zr->revision >= 2) {
+                dprintk(1,
+                        KERN_INFO
+                        "%s: Subsystem vendor=0x%04x id=0x%04x\n",
+                        ZR_DEVNAME(zr), zr->pci_dev->subsystem_vendor,
+                        zr->pci_dev->subsystem_device);
+        }
+        /* Use auto-detected card type? */
+        if (card[nr] == -1) {
+                if (zr->revision < 2) {
                        dprintk(1,
-                                KERN_INFO
+                                KERN_ERR
-                                "%s: Zoran ZR36067 (rev %d) irq: %d, memory: 0x%08x\n",
+                                "%s: No card type specified, please use the card=X module parameter\n",
-                                ZR_DEVNAME(zr), zr->revision, zr->pci_dev->irq,
+                                ZR_DEVNAME(zr));
-                                zr->zr36057_adr);
                        dprintk(1,
-                                KERN_INFO
-                                "%s: subsystem vendor=0x%04x id=0x%04x\n",
-                                ZR_DEVNAME(zr), ss_vendor, ss_device);
-                        if (card_num == -1) {
-                                dprintk(3,
-                                        KERN_DEBUG
-                                        "%s: find_zr36057() - trying to autodetect card type\n",
-                                        ZR_DEVNAME(zr));
-                                for (i=0;i<NUM_CARDS;i++) {
-                                        if (ss_vendor == zoran_cards[i].vendor_id &&
-                                            ss_device == zoran_cards[i].device_id) {
-                                                dprintk(3,
-                                                        KERN_DEBUG
-                                                        "%s: find_zr36057() - card %s detected\n",
-                                                        ZR_DEVNAME(zr),
-                                                        zoran_cards[i].name);
-                                                card_num = i;
-                                                break;
-                                        }
-                                }
-                                if (i == NUM_CARDS) {
-                                        dprintk(1,
-                                                KERN_ERR
-                                                "%s: find_zr36057() - unknown card\n",
-                                                ZR_DEVNAME(zr));
-                                        goto zr_free_mem;
-                                }
-                        }
-                }
-                if (card_num < 0 || card_num >= NUM_CARDS) {
-                        dprintk(2,
                                KERN_ERR
-                                "%s: find_zr36057() - invalid cardnum %d\n",
+                                "%s: It is not possible to auto-detect ZR36057 based cards\n",
-                                ZR_DEVNAME(zr), card_num);
+                                ZR_DEVNAME(zr));
                        goto zr_free_mem;
                }
-                /* even though we make this a non pointer and thus
+                card_num = ent->driver_data;
-                 * theoretically allow for making changes to this struct
+                if (card_num >= NUM_CARDS) {
-                 * on a per-individual card basis at runtime, this is
-                 * strongly discouraged. This structure is intended to
-                 * keep general card information, no settings or anything */
-                zr->card = zoran_cards[card_num];
-                snprintf(ZR_DEVNAME(zr), sizeof(ZR_DEVNAME(zr)),
-                         "%s[%u]", zr->card.name, zr->id);
-                zr->zr36057_mem = ioremap_nocache(zr->zr36057_adr, 0x1000);
-                if (!zr->zr36057_mem) {
                        dprintk(1,
                                KERN_ERR
-                                "%s: find_zr36057() - ioremap failed\n",
+                                "%s: Unknown card, try specifying card=X module parameter\n",
                                ZR_DEVNAME(zr));
                        goto zr_free_mem;
                }
+                dprintk(3,
-                result = request_irq(zr->pci_dev->irq,
+                        KERN_DEBUG
-                                     zoran_irq,
+                        "%s: %s() - card %s detected\n",
-                                     IRQF_SHARED | IRQF_DISABLED,
+                        ZR_DEVNAME(zr), __func__, zoran_cards[card_num].name);
-                                     ZR_DEVNAME(zr),
+        } else {
-                                     (void *) zr);
+                card_num = card[nr];
-                if (result < 0) {
+                if (card_num >= NUM_CARDS || card_num < 0) {
-                        if (result == -EINVAL) {
+                        dprintk(1,
-                                dprintk(1,
+                                KERN_ERR
-                                        KERN_ERR
+                                "%s: User specified card type %d out of range (0 .. %d)\n",
-                                        "%s: find_zr36057() - bad irq number or handler\n",
+                                ZR_DEVNAME(zr), card_num, NUM_CARDS - 1);
-                                        ZR_DEVNAME(zr));
+                        goto zr_free_mem;
-                        } else if (result == -EBUSY) {
-                                dprintk(1,
-                                        KERN_ERR
-                                        "%s: find_zr36057() - IRQ %d busy, change your PnP config in BIOS\n",
-                                        ZR_DEVNAME(zr), zr->pci_dev->irq);
-                        } else {
-                                dprintk(1,
-                                        KERN_ERR
-                                        "%s: find_zr36057() - can't assign irq, error code %d\n",
-                                        ZR_DEVNAME(zr), result);
-                        }
-                        goto zr_unmap;
-                }
-                /* set PCI latency timer */
-                pci_read_config_byte(zr->pci_dev, PCI_LATENCY_TIMER,
-                                     &latency);
-                need_latency = zr->revision > 1 ? 32 : 48;
-                if (latency != need_latency) {
-                        dprintk(2,
-                                KERN_INFO
-                                "%s: Changing PCI latency from %d to %d.\n",
-                                ZR_DEVNAME(zr), latency, need_latency);
-                        pci_write_config_byte(zr->pci_dev,
-                                              PCI_LATENCY_TIMER,
-                                              need_latency);
                }
+        }
-                zr36057_restart(zr);
+        /* even though we make this a non pointer and thus
-                /* i2c */
+         * theoretically allow for making changes to this struct
-                dprintk(2, KERN_INFO "%s: Initializing i2c bus...\n",
+         * on a per-individual card basis at runtime, this is
-                        ZR_DEVNAME(zr));
+         * strongly discouraged. This structure is intended to
+         * keep general card information, no settings or anything */
+        zr->card = zoran_cards[card_num];
+        snprintf(ZR_DEVNAME(zr), sizeof(ZR_DEVNAME(zr)),
+                 "%s[%u]", zr->card.name, zr->id);
+        zr->zr36057_mem = pci_ioremap_bar(zr->pci_dev, 0);
+        if (!zr->zr36057_mem) {
+                dprintk(1,
+                        KERN_ERR
+                        "%s: %s() - ioremap failed\n",
+                        ZR_DEVNAME(zr), __func__);
+                goto zr_free_mem;
+        }
-                /* i2c decoder */
+        result = request_irq(zr->pci_dev->irq, zoran_irq,
-                if (decoder[zr->id] != -1) {
+                             IRQF_SHARED | IRQF_DISABLED, ZR_DEVNAME(zr), zr);
-                        i2c_dec_name = i2cid_to_modulename(decoder[zr->id]);
+        if (result < 0) {
-                        zr->card.i2c_decoder = decoder[zr->id];
+                if (result == -EINVAL) {
-                } else if (zr->card.i2c_decoder != 0) {
+                        dprintk(1,
-                        i2c_dec_name =
+                                KERN_ERR
-                                i2cid_to_modulename(zr->card.i2c_decoder);
+                                "%s: find_zr36057() - bad irq number or handler\n",
+                                ZR_DEVNAME(zr));
+                } else if (result == -EBUSY) {
+                        dprintk(1,
+                                KERN_ERR
+                                "%s: find_zr36057() - IRQ %d busy, change your PnP config in BIOS\n",
+                                ZR_DEVNAME(zr), zr->pci_dev->irq);
                } else {
-                        i2c_dec_name = NULL;
+                        dprintk(1,
+                                KERN_ERR
+                                "%s: find_zr36057() - can't assign irq, error code %d\n",
+                                ZR_DEVNAME(zr), result);
                }
+                goto zr_unmap;
+        }
-                if (i2c_dec_name) {
+        /* set PCI latency timer */
-                        if ((result = request_module(i2c_dec_name)) < 0) {
+        pci_read_config_byte(zr->pci_dev, PCI_LATENCY_TIMER,
-                                dprintk(1,
+                             &latency);
-                                        KERN_ERR
+        need_latency = zr->revision > 1 ? 32 : 48;
-                                        "%s: failed to load module %s: %d\n",
+        if (latency != need_latency) {
-                                        ZR_DEVNAME(zr), i2c_dec_name, result);
+                dprintk(2,
-                        }
+                        KERN_INFO
-                }
+                        "%s: Changing PCI latency from %d to %d\n",
+                        ZR_DEVNAME(zr), latency, need_latency);
+                pci_write_config_byte(zr->pci_dev, PCI_LATENCY_TIMER,
+                                      need_latency);
+        }
-                /* i2c encoder */
+        zr36057_restart(zr);
-                if (encoder[zr->id] != -1) {
+        /* i2c */
-                        i2c_enc_name = i2cid_to_modulename(encoder[zr->id]);
+        dprintk(2, KERN_INFO "%s: Initializing i2c bus...\n",
-                        zr->card.i2c_encoder = encoder[zr->id];
+                ZR_DEVNAME(zr));
-                } else if (zr->card.i2c_encoder != 0) {
-                        i2c_enc_name =
+        /* i2c decoder */
-                                i2cid_to_modulename(zr->card.i2c_encoder);
+        if (decoder[zr->id] != -1) {
-                } else {
+                i2c_dec_name = i2cid_to_modulename(decoder[zr->id]);
-                        i2c_enc_name = NULL;
+                zr->card.i2c_decoder = decoder[zr->id];
-                }
+        } else if (zr->card.i2c_decoder != 0) {
+                i2c_dec_name = i2cid_to_modulename(zr->card.i2c_decoder);
+        } else {
+                i2c_dec_name = NULL;
+        }
-                if (i2c_enc_name) {
+        if (i2c_dec_name) {
-                        if ((result = request_module(i2c_enc_name)) < 0) {
+                result = request_module(i2c_dec_name);
-                                dprintk(1,
+                if (result < 0) {
-                                        KERN_ERR
+                        dprintk(1,
-                                        "%s: failed to load module %s: %d\n",
+                                KERN_ERR
-                                        ZR_DEVNAME(zr), i2c_enc_name, result);
+                                "%s: failed to load module %s: %d\n",
-                        }
+                                ZR_DEVNAME(zr), i2c_dec_name, result);
                }
+        }
+        /* i2c encoder */
+        if (encoder[zr->id] != -1) {
+                i2c_enc_name = i2cid_to_modulename(encoder[zr->id]);
+                zr->card.i2c_encoder = encoder[zr->id];
+        } else if (zr->card.i2c_encoder != 0) {
+                i2c_enc_name = i2cid_to_modulename(zr->card.i2c_encoder);
+        } else {
+                i2c_enc_name = NULL;
+        }
-                if (zoran_register_i2c(zr) < 0) {
+        if (i2c_enc_name) {
+                result = request_module(i2c_enc_name);
+                if (result < 0) {
                        dprintk(1,
                                KERN_ERR
-                                "%s: find_zr36057() - can't initialize i2c bus\n",
+                                "%s: failed to load module %s: %d\n",
-                                ZR_DEVNAME(zr));
+                                ZR_DEVNAME(zr), i2c_enc_name, result);
-                        goto zr_free_irq;
                }
+        }
-                dprintk(2,
+        if (zoran_register_i2c(zr) < 0) {
-                        KERN_INFO "%s: Initializing videocodec bus...\n",
+                dprintk(1,
+                        KERN_ERR
+                        "%s: find_zr36057() - can't initialize i2c bus\n",
                        ZR_DEVNAME(zr));
+                goto zr_free_irq;
+        }
-                if (zr->card.video_codec != 0 &&
+        dprintk(2,
-                    (codec_name =
+                KERN_INFO "%s: Initializing videocodec bus...\n",
-                     codecid_to_modulename(zr->card.video_codec)) != NULL) {
+                ZR_DEVNAME(zr));
-                        if ((result = request_module(codec_name)) < 0) {
+        if (zr->card.video_codec) {
+                codec_name = codecid_to_modulename(zr->card.video_codec);
+                if (codec_name) {
+                        result = request_module(codec_name);
+                        if (result) {
                                dprintk(1,
                                        KERN_ERR
                                        "%s: failed to load modules %s: %d\n",
                                        ZR_DEVNAME(zr), codec_name, result);
                        }
                }
-                if (zr->card.video_vfe != 0 &&
+        }
-                    (vfe_name =
+        if (zr->card.video_vfe) {
-                     codecid_to_modulename(zr->card.video_vfe)) != NULL) {
+                vfe_name = codecid_to_modulename(zr->card.video_vfe);
-                        if ((result = request_module(vfe_name)) < 0) {
+                if (vfe_name) {
+                        result = request_module(vfe_name);
+                        if (result < 0) {
                                dprintk(1,
                                        KERN_ERR
                                        "%s: failed to load modules %s: %d\n",
                                        ZR_DEVNAME(zr), vfe_name, result);
                        }
                }
+        }
-                /* reset JPEG codec */
+        /* reset JPEG codec */
-                jpeg_codec_sleep(zr, 1);
+        jpeg_codec_sleep(zr, 1);
-                jpeg_codec_reset(zr);
+        jpeg_codec_reset(zr);
-                /* video bus enabled */
+        /* video bus enabled */
-                /* display codec revision */
+        /* display codec revision */
-                if (zr->card.video_codec != 0) {
+        if (zr->card.video_codec != 0) {
-                        master_codec = zoran_setup_videocodec(zr,
+                master_codec = zoran_setup_videocodec(zr, zr->card.video_codec);
-                                                              zr->card.video_codec);
+                if (!master_codec)
-                        if (!master_codec)
+                        goto zr_unreg_i2c;
-                                goto zr_unreg_i2c;
+                zr->codec = videocodec_attach(master_codec);
-                        zr->codec = videocodec_attach(master_codec);
+                if (!zr->codec) {
-                        if (!zr->codec) {
+                        dprintk(1,
-                                dprintk(1,
+                                KERN_ERR
-                                        KERN_ERR
+                                "%s: find_zr36057() - no codec found\n",
-                                        "%s: find_zr36057() - no codec found\n",
+                                ZR_DEVNAME(zr));
-                                        ZR_DEVNAME(zr));
+                        goto zr_free_codec;
-                                goto zr_free_codec;
-                        }
-                        if (zr->codec->type != zr->card.video_codec) {
-                                dprintk(1,
-                                        KERN_ERR
-                                        "%s: find_zr36057() - wrong codec\n",
-                                        ZR_DEVNAME(zr));
-                                goto zr_detach_codec;
-                        }
                }
-                if (zr->card.video_vfe != 0) {
+                if (zr->codec->type != zr->card.video_codec) {
-                        master_vfe = zoran_setup_videocodec(zr,
+                        dprintk(1,
-                                                            zr->card.video_vfe);
+                                KERN_ERR
-                        if (!master_vfe)
+                                "%s: find_zr36057() - wrong codec\n",
-                                goto zr_detach_codec;
+                                ZR_DEVNAME(zr));
-                        zr->vfe = videocodec_attach(master_vfe);
+                        goto zr_detach_codec;
-                        if (!zr->vfe) {
+                }
-                                dprintk(1,
+        }
-                                        KERN_ERR
+        if (zr->card.video_vfe != 0) {
-                                        "%s: find_zr36057() - no VFE found\n",
+                master_vfe = zoran_setup_videocodec(zr, zr->card.video_vfe);
-                                        ZR_DEVNAME(zr));
+                if (!master_vfe)
-                                goto zr_free_vfe;
+                        goto zr_detach_codec;
-                        }
+                zr->vfe = videocodec_attach(master_vfe);
-                        if (zr->vfe->type != zr->card.video_vfe) {
+                if (!zr->vfe) {
-                                dprintk(1,
+                        dprintk(1,
-                                        KERN_ERR
+                                KERN_ERR
-                                        "%s: find_zr36057() = wrong VFE\n",
+                                "%s: find_zr36057() - no VFE found\n",
-                                        ZR_DEVNAME(zr));
+                                ZR_DEVNAME(zr));
-                                goto zr_detach_vfe;
+                        goto zr_free_vfe;
-                        }
+                }
+                if (zr->vfe->type != zr->card.video_vfe) {
+                        dprintk(1,
+                                KERN_ERR
+                                "%s: find_zr36057() = wrong VFE\n",
+                                ZR_DEVNAME(zr));
+                        goto zr_detach_vfe;
                }
-                /* Success so keep the pci_dev referenced */
-                pci_dev_get(zr->pci_dev);
-                zoran[zoran_num++] = zr;
-                continue;
-                // Init errors
-              zr_detach_vfe:
-                videocodec_detach(zr->vfe);
-              zr_free_vfe:
-                kfree(master_vfe);
-              zr_detach_codec:
-                videocodec_detach(zr->codec);
-              zr_free_codec:
-                kfree(master_codec);
-              zr_unreg_i2c:
-                zoran_unregister_i2c(zr);
-              zr_free_irq:
-                btwrite(0, ZR36057_SPGPPCR);
-                free_irq(zr->pci_dev->irq, zr);
-              zr_unmap:
-                iounmap(zr->zr36057_mem);
-              zr_free_mem:
-                kfree(zr);
-                continue;
        }
-        if (dev)        /* Clean up ref count on early exit */
-                pci_dev_put(dev);
-        if (zoran_num == 0) {
+        /* take care of Natoma chipset and a revision 1 zr36057 */
-                dprintk(1, KERN_INFO "No known MJPEG cards found.\n");
+        if ((pci_pci_problems & PCIPCI_NATOMA) && zr->revision <= 1) {
+                zr->jpg_buffers.need_contiguous = 1;
+                dprintk(1,
+                        KERN_INFO
+                        "%s: ZR36057/Natoma bug, max. buffer size is 128K\n",
+                        ZR_DEVNAME(zr));
        }
-        return zoran_num;
+        if (zr36057_init(zr) < 0)
+                goto zr_detach_vfe;
+        zoran_proc_init(zr);
+        pci_set_drvdata(pdev, zr);
+        return 0;
+zr_detach_vfe:
+        videocodec_detach(zr->vfe);
+zr_free_vfe:
+        kfree(master_vfe);
+zr_detach_codec:
+        videocodec_detach(zr->codec);
+zr_free_codec:
+        kfree(master_codec);
+zr_unreg_i2c:
+        zoran_unregister_i2c(zr);
+zr_free_irq:
+        btwrite(0, ZR36057_SPGPPCR);
+        free_irq(zr->pci_dev->irq, zr);
+zr_unmap:
+        iounmap(zr->zr36057_mem);
+zr_free_mem:
+        kfree(zr);
+        return -ENODEV;
 }
-static int __init
+static struct pci_driver zoran_driver = {
-init_dc10_cards (void)
+        .name = "zr36067",
+        .id_table = zr36067_pci_tbl,
+        .probe = zoran_probe,
+        .remove = zoran_remove,
+};
+static int __init zoran_init(void)
 {
-        int i;
+        int res;
-        memset(zoran, 0, sizeof(zoran));
        printk(KERN_INFO "Zoran MJPEG board driver version %d.%d.%d\n",
               MAJOR_VERSION, MINOR_VERSION, RELEASE_VERSION);
-        /* Look for cards */
-        if (find_zr36057() < 0) {
-                return -EIO;
-        }
-        if (zoran_num == 0)
-                return -ENODEV;
-        dprintk(1, KERN_INFO "%s: %d card(s) found\n", ZORAN_NAME,
-                zoran_num);
        /* check the parameters we have been given, adjust if necessary */
        if (v4l_nbufs < 2)
                v4l_nbufs = 2;
@@ -1629,37 +1624,22 @@ init_dc10_cards (void)
                        ZORAN_NAME);
        }
-        /* take care of Natoma chipset and a revision 1 zr36057 */
+        res = pci_register_driver(&zoran_driver);
-        for (i = 0; i < zoran_num; i++) {
+        if (res) {
-                struct zoran *zr = zoran[i];
+                dprintk(1,
+                        KERN_ERR
-                if ((pci_pci_problems & PCIPCI_NATOMA) && zr->revision <= 1) {
+                        "%s: Unable to register ZR36057 driver\n",
-                        zr->jpg_buffers.need_contiguous = 1;
+                        ZORAN_NAME);
-                        dprintk(1,
+                return res;
-                                KERN_INFO
-                                "%s: ZR36057/Natoma bug, max. buffer size is 128K\n",
-                                ZR_DEVNAME(zr));
-                }
-                if (zr36057_init(zr) < 0) {
-                        for (i = 0; i < zoran_num; i++)
-                                zoran_release(zoran[i]);
-                        return -EIO;
-                }
-                zoran_proc_init(zr);
        }
        return 0;
 }
-static void __exit
+static void __exit zoran_exit(void)
-unload_dc10_cards (void)
 {
-        int i;
+        pci_unregister_driver(&zoran_driver);
-        for (i = 0; i < zoran_num; i++)
-                zoran_release(zoran[i]);
 }
-module_init(init_dc10_cards);
+module_init(zoran_init);
-module_exit(unload_dc10_cards);
+module_exit(zoran_exit);
diff --git a/drivers/media/video/zoran/zoran_card.h b/drivers/media/video/zoran/zoran_card.h
index e4dc9d29b404..4507bdc5e338 100644
--- a/drivers/media/video/zoran/zoran_card.h
+++ b/drivers/media/video/zoran/zoran_card.h
@@ -40,8 +40,6 @@ extern int zr36067_debug;
 /* Anybody who uses more than four? */
 #define BUZ_MAX 4
-extern int zoran_num;
-extern struct zoran *zoran[BUZ_MAX];
 extern struct video_device zoran_template;
diff --git a/drivers/media/video/zoran/zoran_driver.c b/drivers/media/video/zoran/zoran_driver.c
index b58b9dda715c..120ef235e63d 100644
--- a/drivers/media/video/zoran/zoran_driver.c
+++ b/drivers/media/video/zoran/zoran_driver.c
@@ -1196,83 +1196,54 @@ zoran_close_end_session (struct file *file)
 *   Open a zoran card. Right now the flags stuff is just playing
 */
-static int
+static int zoran_open(struct file *file)
-zoran_open(struct file  *file)
 {
-        unsigned int minor = video_devdata(file)->minor;
+        struct zoran *zr = video_drvdata(file);
-        struct zoran *zr = NULL;
        struct zoran_fh *fh;
-        int i, res, first_open = 0, have_module_locks = 0;
+        int res, first_open = 0;
-        lock_kernel();
+        dprintk(2, KERN_INFO "%s: zoran_open(%s, pid=[%d]), users(-)=%d\n",
-        /* find the device */
+                ZR_DEVNAME(zr), current->comm, task_pid_nr(current), zr->user + 1);
-        for (i = 0; i < zoran_num; i++) {
-                if (zoran[i]->video_dev->minor == minor) {
-                        zr = zoran[i];
-                        break;
-                }
-        }
-        if (!zr) {
+        lock_kernel();
-                dprintk(1, KERN_ERR "%s: device not found!\n", ZORAN_NAME);
-                res = -ENODEV;
-                goto open_unlock_and_return;
-        }
        /* see fs/device.c - the kernel already locks during open(),
         * so locking ourselves only causes deadlocks */
        /*mutex_lock(&zr->resource_lock);*/
+        if (zr->user >= 2048) {
+                dprintk(1, KERN_ERR "%s: too many users (%d) on device\n",
+                        ZR_DEVNAME(zr), zr->user);
+                res = -EBUSY;
+                goto fail_unlock;
+        }
        if (!zr->decoder) {
                dprintk(1,
                        KERN_ERR "%s: no TV decoder loaded for device!\n",
                        ZR_DEVNAME(zr));
                res = -EIO;
-                goto open_unlock_and_return;
+                goto fail_unlock;
        }
-        /* try to grab a module lock */
-        if (!try_module_get(THIS_MODULE)) {
-                dprintk(1,
-                        KERN_ERR
-                        "%s: failed to acquire my own lock! PANIC!\n",
-                        ZR_DEVNAME(zr));
-                res = -ENODEV;
-                goto open_unlock_and_return;
-        }
        if (!try_module_get(zr->decoder->driver->driver.owner)) {
                dprintk(1,
                        KERN_ERR
-                        "%s: failed to grab ownership of i2c decoder\n",
+                        "%s: failed to grab ownership of video decoder\n",
                        ZR_DEVNAME(zr));
                res = -EIO;
-                module_put(THIS_MODULE);
+                goto fail_unlock;
-                goto open_unlock_and_return;
        }
        if (zr->encoder &&
            !try_module_get(zr->encoder->driver->driver.owner)) {
                dprintk(1,
                        KERN_ERR
-                        "%s: failed to grab ownership of i2c encoder\n",
+                        "%s: failed to grab ownership of video encoder\n",
                        ZR_DEVNAME(zr));
                res = -EIO;
-                module_put(zr->decoder->driver->driver.owner);
+                goto fail_decoder;
-                module_put(THIS_MODULE);
-                goto open_unlock_and_return;
        }
-        have_module_locks = 1;
-        if (zr->user >= 2048) {
-                dprintk(1, KERN_ERR "%s: too many users (%d) on device\n",
-                        ZR_DEVNAME(zr), zr->user);
-                res = -EBUSY;
-                goto open_unlock_and_return;
-        }
-        dprintk(1, KERN_INFO "%s: zoran_open(%s, pid=[%d]), users(-)=%d\n",
-                ZR_DEVNAME(zr), current->comm, task_pid_nr(current), zr->user);
        /* now, create the open()-specific file_ops struct */
        fh = kzalloc(sizeof(struct zoran_fh), GFP_KERNEL);
        if (!fh) {
@@ -1281,7 +1252,7 @@ zoran_open(struct file  *file)
                        "%s: zoran_open() - allocation of zoran_fh failed\n",
                        ZR_DEVNAME(zr));
                res = -ENOMEM;
-                goto open_unlock_and_return;
+                goto fail_encoder;
        }
        /* used to be BUZ_MAX_WIDTH/HEIGHT, but that gives overflows
         * on norm-change! */
@@ -1292,9 +1263,8 @@ zoran_open(struct file  *file)
                        KERN_ERR
                        "%s: zoran_open() - allocation of overlay_mask failed\n",
                        ZR_DEVNAME(zr));
-                kfree(fh);
                res = -ENOMEM;
-                goto open_unlock_and_return;
+                goto fail_fh;
        }
        if (zr->user++ == 0)
@@ -1319,22 +1289,19 @@ zoran_open(struct file  *file)
        return 0;
-open_unlock_and_return:
+fail_fh:
-        /* if we grabbed locks, release them accordingly */
+        kfree(fh);
-        if (have_module_locks) {
+fail_encoder:
-                module_put(zr->decoder->driver->driver.owner);
+        if (zr->encoder)
-                if (zr->encoder) {
+                module_put(zr->encoder->driver->driver.owner);
-                        module_put(zr->encoder->driver->driver.owner);
+fail_decoder:
-                }
+        module_put(zr->decoder->driver->driver.owner);
-                module_put(THIS_MODULE);
+fail_unlock:
-        }
-        /* if there's no device found, we didn't obtain the lock either */
-        if (zr) {
-                /*mutex_unlock(&zr->resource_lock);*/
-        }
        unlock_kernel();
+        dprintk(2, KERN_INFO "%s: open failed (%d), users(-)=%d\n",
+                ZR_DEVNAME(zr), res, zr->user);
        return res;
 }
@@ -1344,8 +1311,8 @@ zoran_close(struct file  *file)
        struct zoran_fh *fh = file->private_data;
        struct zoran *zr = fh->zr;
-        dprintk(1, KERN_INFO "%s: zoran_close(%s, pid=[%d]), users(+)=%d\n",
+        dprintk(2, KERN_INFO "%s: zoran_close(%s, pid=[%d]), users(+)=%d\n",
-                ZR_DEVNAME(zr), current->comm, task_pid_nr(current), zr->user);
+                ZR_DEVNAME(zr), current->comm, task_pid_nr(current), zr->user - 1);
        /* kernel locks (fs/device.c), so don't do that ourselves
         * (prevents deadlocks) */
@@ -1391,10 +1358,8 @@ zoran_close(struct file  *file)
        /* release locks on the i2c modules */
        module_put(zr->decoder->driver->driver.owner);
-        if (zr->encoder) {
+        if (zr->encoder)
-                 module_put(zr->encoder->driver->driver.owner);
+                module_put(zr->encoder->driver->driver.owner);
-        }
-        module_put(THIS_MODULE);
        /*mutex_unlock(&zr->resource_lock);*/
diff --git a/drivers/mfd/pcf50633-core.c b/drivers/mfd/pcf50633-core.c
index 24508e28e3fb..ea9488e7ad6d 100644
--- a/drivers/mfd/pcf50633-core.c
+++ b/drivers/mfd/pcf50633-core.c
@@ -626,7 +626,6 @@ static int __devinit pcf50633_probe(struct i2c_client *client,
        }
        if (client->irq) {
-                set_irq_handler(client->irq, handle_level_irq);
                ret = request_irq(client->irq, pcf50633_irq,
                                IRQF_TRIGGER_LOW, "pcf50633", pcf);
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 419c378bd24b..c64e6798878a 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -87,14 +87,6 @@ config PHANTOM
          If you choose to build module, its name will be phantom. If unsure,
          say N here.
-config EEPROM_93CX6
-        tristate "EEPROM 93CX6 support"
-        ---help---
-          This is a driver for the EEPROM chipsets 93c46 and 93c66.
-          The driver supports both read as well as write commands.
-          If unsure, say N.
 config SGI_IOC4
        tristate "SGI IOC4 Base IO support"
        depends on PCI
@@ -225,11 +217,13 @@ config DELL_LAPTOP
        depends on EXPERIMENTAL
        depends on BACKLIGHT_CLASS_DEVICE
        depends on RFKILL
+        depends on POWER_SUPPLY
        default n
        ---help---
        This driver adds support for rfkill and backlight control to Dell
        laptops.
 source "drivers/misc/c2port/Kconfig"
+source "drivers/misc/eeprom/Kconfig"
 endif # MISC_DEVICES
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index d5749a7bc777..bc1199830554 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -13,10 +13,10 @@ obj-$(CONFIG_TIFM_CORE)       	+= tifm_core.o
 obj-$(CONFIG_TIFM_7XX1)         += tifm_7xx1.o
 obj-$(CONFIG_PHANTOM)           += phantom.o
 obj-$(CONFIG_SGI_IOC4)          += ioc4.o
-obj-$(CONFIG_EEPROM_93CX6)      += eeprom_93cx6.o
 obj-$(CONFIG_ENCLOSURE_SERVICES) += enclosure.o
 obj-$(CONFIG_KGDB_TESTS)        += kgdbts.o
 obj-$(CONFIG_SGI_XP)            += sgi-xp/
 obj-$(CONFIG_SGI_GRU)           += sgi-gru/
 obj-$(CONFIG_HP_ILO)            += hpilo.o
 obj-$(CONFIG_C2PORT)            += c2port/
+obj-y                           += eeprom/
diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
index bf5e4d065436..558bf3f2c276 100644
--- a/drivers/misc/atmel-ssc.c
+++ b/drivers/misc/atmel-ssc.c
@@ -35,7 +35,7 @@ struct ssc_device *ssc_request(unsigned int ssc_num)
        if (!ssc_valid) {
                spin_unlock(&user_lock);
-                dev_dbg(&ssc->pdev->dev, "could not find requested device\n");
+                pr_err("ssc: ssc%d platform device is missing\n", ssc_num);
                return ERR_PTR(-ENODEV);
        }
diff --git a/drivers/misc/eeprom/Kconfig b/drivers/misc/eeprom/Kconfig
new file mode 100644
index 000000000000..c76df8cda5ef
--- /dev/null
+++ b/drivers/misc/eeprom/Kconfig
@@ -0,0 +1,59 @@
+menu "EEPROM support"
+config EEPROM_AT24
+        tristate "I2C EEPROMs from most vendors"
+        depends on I2C && SYSFS && EXPERIMENTAL
+        help
+          Enable this driver to get read/write support to most I2C EEPROMs,
+          after you configure the driver to know about each EEPROM on
+          your target board.  Use these generic chip names, instead of
+          vendor-specific ones like at24c64 or 24lc02:
+             24c00, 24c01, 24c02, spd (readonly 24c02), 24c04, 24c08,
+             24c16, 24c32, 24c64, 24c128, 24c256, 24c512, 24c1024
+          Unless you like data loss puzzles, always be sure that any chip
+          you configure as a 24c32 (32 kbit) or larger is NOT really a
+          24c16 (16 kbit) or smaller, and vice versa. Marking the chip
+          as read-only won't help recover from this. Also, if your chip
+          has any software write-protect mechanism you may want to review the
+          code to make sure this driver won't turn it on by accident.
+          If you use this with an SMBus adapter instead of an I2C adapter,
+          full functionality is not available.  Only smaller devices are
+          supported (24c16 and below, max 4 kByte).
+          This driver can also be built as a module.  If so, the module
+          will be called at24.
+config EEPROM_AT25
+        tristate "SPI EEPROMs from most vendors"
+        depends on SPI && SYSFS
+        help
+          Enable this driver to get read/write support to most SPI EEPROMs,
+          after you configure the board init code to know about each eeprom
+          on your target board.
+          This driver can also be built as a module.  If so, the module
+          will be called at25.
+config EEPROM_LEGACY
+        tristate "Old I2C EEPROM reader"
+        depends on I2C && SYSFS
+        help
+          If you say yes here you get read-only access to the EEPROM data
+          available on modern memory DIMMs and Sony Vaio laptops via I2C. Such
+          EEPROMs could theoretically be available on other devices as well.
+          This driver can also be built as a module.  If so, the module
+          will be called eeprom.
+config EEPROM_93CX6
+        tristate "EEPROM 93CX6 support"
+        help
+          This is a driver for the EEPROM chipsets 93c46 and 93c66.
+          The driver supports both read as well as write commands.
+          If unsure, say N.
+endmenu
diff --git a/drivers/misc/eeprom/Makefile b/drivers/misc/eeprom/Makefile
new file mode 100644
index 000000000000..539dd8f88128
--- /dev/null
+++ b/drivers/misc/eeprom/Makefile
@@ -0,0 +1,4 @@
+obj-$(CONFIG_EEPROM_AT24)       += at24.o
+obj-$(CONFIG_EEPROM_AT25)       += at25.o
+obj-$(CONFIG_EEPROM_LEGACY)     += eeprom.o
+obj-$(CONFIG_EEPROM_93CX6)      += eeprom_93cx6.o
diff --git a/drivers/i2c/chips/at24.c b/drivers/misc/eeprom/at24.c
index d4775528abc6..d4775528abc6 100644
--- a/drivers/i2c/chips/at24.c
+++ b/drivers/misc/eeprom/at24.c
diff --git a/drivers/spi/at25.c b/drivers/misc/eeprom/at25.c
index 290dbe99647a..290dbe99647a 100644
--- a/drivers/spi/at25.c
+++ b/drivers/misc/eeprom/at25.c
diff --git a/drivers/i2c/chips/eeprom.c b/drivers/misc/eeprom/eeprom.c
index 2c27193aeaa0..2c27193aeaa0 100644
--- a/drivers/i2c/chips/eeprom.c
+++ b/drivers/misc/eeprom/eeprom.c
diff --git a/drivers/misc/eeprom_93cx6.c b/drivers/misc/eeprom/eeprom_93cx6.c
index 15b1780025c8..15b1780025c8 100644
--- a/drivers/misc/eeprom_93cx6.c
+++ b/drivers/misc/eeprom/eeprom_93cx6.c
diff --git a/drivers/misc/hpilo.c b/drivers/misc/hpilo.c
index 05e298289238..f26667a7abf7 100644
--- a/drivers/misc/hpilo.c
+++ b/drivers/misc/hpilo.c
@@ -207,7 +207,7 @@ static void ilo_ccb_close(struct pci_dev *pdev, struct ccb_data *data)
                  &device_ccb->recv_ctrl);
        /* give iLO some time to process stop request */
-        for (retries = 1000; retries > 0; retries--) {
+        for (retries = MAX_WAIT; retries > 0; retries--) {
                doorbell_set(driver_ccb);
                udelay(1);
                if (!(ioread32(&device_ccb->send_ctrl) & (1 << CTRL_BITPOS_A))
@@ -309,7 +309,7 @@ static int ilo_ccb_open(struct ilo_hwinfo *hw, struct ccb_data *data, int slot)
        doorbell_clr(driver_ccb);
        /* make sure iLO is really handling requests */
-        for (i = 1000; i > 0; i--) {
+        for (i = MAX_WAIT; i > 0; i--) {
                if (ilo_pkt_dequeue(hw, driver_ccb, SENDQ, &pkt_id, NULL, NULL))
                        break;
                udelay(1);
@@ -326,7 +326,7 @@ static int ilo_ccb_open(struct ilo_hwinfo *hw, struct ccb_data *data, int slot)
        return 0;
 free:
-        pci_free_consistent(pdev, data->dma_size, data->dma_va, data->dma_pa);
+        ilo_ccb_close(pdev, data);
 out:
        return error;
 }
@@ -758,7 +758,7 @@ static void __exit ilo_exit(void)
        class_destroy(ilo_class);
 }
-MODULE_VERSION("0.05");
+MODULE_VERSION("0.06");
 MODULE_ALIAS(ILO_NAME);
 MODULE_DESCRIPTION(ILO_NAME);
 MODULE_AUTHOR("David Altobelli <david.altobelli@hp.com>");
diff --git a/drivers/misc/hpilo.h b/drivers/misc/hpilo.h
index a281207696c1..b64a20ef07e3 100644
--- a/drivers/misc/hpilo.h
+++ b/drivers/misc/hpilo.h
@@ -19,6 +19,8 @@
 #define MAX_ILO_DEV     1
 /* max number of files */
 #define MAX_OPEN        (MAX_CCB * MAX_ILO_DEV)
+/* spin counter for open/close delay */
+#define MAX_WAIT        10000
 /*
 * Per device, used to track global memory allocations.
diff --git a/drivers/misc/sgi-xp/xpc.h b/drivers/misc/sgi-xp/xpc.h
index a5bd658c2e83..275b78896a73 100644
--- a/drivers/misc/sgi-xp/xpc.h
+++ b/drivers/misc/sgi-xp/xpc.h
@@ -3,7 +3,7 @@
 * License.  See the file "COPYING" in the main directory of this archive
 * for more details.
 *
- * Copyright (c) 2004-2008 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (c) 2004-2009 Silicon Graphics, Inc.  All Rights Reserved.
 */
 /*
@@ -514,7 +514,8 @@ struct xpc_channel_uv {
                                                /* partition's notify mq */
        struct xpc_send_msg_slot_uv *send_msg_slots;
-        struct xpc_notify_mq_msg_uv *recv_msg_slots;
+        void *recv_msg_slots;   /* each slot will hold a xpc_notify_mq_msg_uv */
+                                /* structure plus the user's payload */
        struct xpc_fifo_head_uv msg_slot_free_list;
        struct xpc_fifo_head_uv recv_msg_list;  /* deliverable payloads */
diff --git a/drivers/misc/sgi-xp/xpc_channel.c b/drivers/misc/sgi-xp/xpc_channel.c
index 9cd2ebe2a3b6..45fd653dbe31 100644
--- a/drivers/misc/sgi-xp/xpc_channel.c
+++ b/drivers/misc/sgi-xp/xpc_channel.c
@@ -49,9 +49,6 @@ xpc_process_connect(struct xpc_channel *ch, unsigned long *irq_flags)
                if (ch->flags & (XPC_C_CONNECTED | XPC_C_DISCONNECTING))
                        return;
-                DBUG_ON(ch->local_msgqueue == NULL);
-                DBUG_ON(ch->remote_msgqueue == NULL);
        }
        if (!(ch->flags & XPC_C_OPENREPLY)) {
diff --git a/drivers/misc/sgi-xp/xpc_sn2.c b/drivers/misc/sgi-xp/xpc_sn2.c
index 82fb9958f22f..2e975762c32b 100644
--- a/drivers/misc/sgi-xp/xpc_sn2.c
+++ b/drivers/misc/sgi-xp/xpc_sn2.c
@@ -1106,8 +1106,6 @@ xpc_process_activate_IRQ_rcvd_sn2(void)
        int n_IRQs_expected;
        int n_IRQs_detected;
-        DBUG_ON(xpc_activate_IRQ_rcvd == 0);
        spin_lock_irqsave(&xpc_activate_IRQ_rcvd_lock, irq_flags);
        n_IRQs_expected = xpc_activate_IRQ_rcvd;
        xpc_activate_IRQ_rcvd = 0;
@@ -1726,6 +1724,7 @@ xpc_clear_local_msgqueue_flags_sn2(struct xpc_channel *ch)
                msg = (struct xpc_msg_sn2 *)((u64)ch_sn2->local_msgqueue +
                                             (get % ch->local_nentries) *
                                             ch->entry_size);
+                DBUG_ON(!(msg->flags & XPC_M_SN2_READY));
                msg->flags = 0;
        } while (++get < ch_sn2->remote_GP.get);
 }
@@ -1740,11 +1739,18 @@ xpc_clear_remote_msgqueue_flags_sn2(struct xpc_channel *ch)
        struct xpc_msg_sn2 *msg;
        s64 put;
-        put = ch_sn2->w_remote_GP.put;
+        /* flags are zeroed when the buffer is allocated */
+        if (ch_sn2->remote_GP.put < ch->remote_nentries)
+                return;
+        put = max(ch_sn2->w_remote_GP.put, ch->remote_nentries);
        do {
                msg = (struct xpc_msg_sn2 *)((u64)ch_sn2->remote_msgqueue +
                                             (put % ch->remote_nentries) *
                                             ch->entry_size);
+                DBUG_ON(!(msg->flags & XPC_M_SN2_READY));
+                DBUG_ON(!(msg->flags & XPC_M_SN2_DONE));
+                DBUG_ON(msg->number != put - ch->remote_nentries);
                msg->flags = 0;
        } while (++put < ch_sn2->remote_GP.put);
 }
@@ -1836,6 +1842,7 @@ xpc_process_msg_chctl_flags_sn2(struct xpc_partition *part, int ch_number)
                 */
                xpc_clear_remote_msgqueue_flags_sn2(ch);
+                smp_wmb(); /* ensure flags have been cleared before bte_copy */
                ch_sn2->w_remote_GP.put = ch_sn2->remote_GP.put;
                dev_dbg(xpc_chan, "w_remote_GP.put changed to %ld, partid=%d, "
@@ -1934,7 +1941,7 @@ xpc_get_deliverable_payload_sn2(struct xpc_channel *ch)
                        break;
                get = ch_sn2->w_local_GP.get;
-                rmb();  /* guarantee that .get loads before .put */
+                smp_rmb();      /* guarantee that .get loads before .put */
                if (get == ch_sn2->w_remote_GP.put)
                        break;
@@ -1956,11 +1963,13 @@ xpc_get_deliverable_payload_sn2(struct xpc_channel *ch)
                        msg = xpc_pull_remote_msg_sn2(ch, get);
-                        DBUG_ON(msg != NULL && msg->number != get);
+                        if (msg != NULL) {
-                        DBUG_ON(msg != NULL && (msg->flags & XPC_M_SN2_DONE));
+                                DBUG_ON(msg->number != get);
-                        DBUG_ON(msg != NULL && !(msg->flags & XPC_M_SN2_READY));
+                                DBUG_ON(msg->flags & XPC_M_SN2_DONE);
+                                DBUG_ON(!(msg->flags & XPC_M_SN2_READY));
-                        payload = &msg->payload;
+                                payload = &msg->payload;
+                        }
                        break;
                }
@@ -2053,7 +2062,7 @@ xpc_allocate_msg_sn2(struct xpc_channel *ch, u32 flags,
        while (1) {
                put = ch_sn2->w_local_GP.put;
-                rmb();  /* guarantee that .put loads before .get */
+                smp_rmb();      /* guarantee that .put loads before .get */
                if (put - ch_sn2->w_remote_GP.get < ch->local_nentries) {
                        /* There are available message entries. We need to try
@@ -2186,7 +2195,7 @@ xpc_send_payload_sn2(struct xpc_channel *ch, u32 flags, void *payload,
         * The preceding store of msg->flags must occur before the following
         * load of local_GP->put.
         */
-        mb();
+        smp_mb();
        /* see if the message is next in line to be sent, if so send it */
@@ -2277,8 +2286,9 @@ xpc_received_payload_sn2(struct xpc_channel *ch, void *payload)
        dev_dbg(xpc_chan, "msg=0x%p, msg_number=%ld, partid=%d, channel=%d\n",
                (void *)msg, msg_number, ch->partid, ch->number);
-        DBUG_ON((((u64)msg - (u64)ch->remote_msgqueue) / ch->entry_size) !=
+        DBUG_ON((((u64)msg - (u64)ch->sn.sn2.remote_msgqueue) / ch->entry_size) !=
                msg_number % ch->remote_nentries);
+        DBUG_ON(!(msg->flags & XPC_M_SN2_READY));
        DBUG_ON(msg->flags & XPC_M_SN2_DONE);
        msg->flags |= XPC_M_SN2_DONE;
@@ -2287,7 +2297,7 @@ xpc_received_payload_sn2(struct xpc_channel *ch, void *payload)
         * The preceding store of msg->flags must occur before the following
         * load of local_GP->get.
         */
-        mb();
+        smp_mb();
        /*
         * See if this message is next in line to be acknowledged as having
diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
index 91a55b1b1037..29c0502a96b2 100644
--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -3,7 +3,7 @@
 * License.  See the file "COPYING" in the main directory of this archive
 * for more details.
 *
- * Copyright (c) 2008 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (c) 2008-2009 Silicon Graphics, Inc.  All Rights Reserved.
 */
 /*
@@ -1010,8 +1010,8 @@ xpc_allocate_recv_msg_slot_uv(struct xpc_channel *ch)
                        continue;
                for (entry = 0; entry < nentries; entry++) {
-                        msg_slot = ch_uv->recv_msg_slots + entry *
+                        msg_slot = ch_uv->recv_msg_slots +
-                            ch->entry_size;
+                            entry * ch->entry_size;
                        msg_slot->hdr.msg_slot_number = entry;
                }
@@ -1308,9 +1308,8 @@ xpc_handle_notify_mq_msg_uv(struct xpc_partition *part,
        /* we're dealing with a normal message sent via the notify_mq */
        ch_uv = &ch->sn.uv;
-        msg_slot = (struct xpc_notify_mq_msg_uv *)((u64)ch_uv->recv_msg_slots +
+        msg_slot = ch_uv->recv_msg_slots +
-                    (msg->hdr.msg_slot_number % ch->remote_nentries) *
+            (msg->hdr.msg_slot_number % ch->remote_nentries) * ch->entry_size;
-                    ch->entry_size);
        BUG_ON(msg->hdr.msg_slot_number != msg_slot->hdr.msg_slot_number);
        BUG_ON(msg_slot->hdr.size != 0);
@@ -1423,7 +1422,7 @@ xpc_send_payload_uv(struct xpc_channel *ch, u32 flags, void *payload,
                atomic_inc(&ch->n_to_notify);
                msg_slot->key = key;
-                wmb(); /* a non-NULL func must hit memory after the key */
+                smp_wmb(); /* a non-NULL func must hit memory after the key */
                msg_slot->func = func;
                if (ch->flags & XPC_C_DISCONNECTING) {
diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c
index 7957f525b2f4..6faefcffcb53 100644
--- a/drivers/misc/sgi-xp/xpnet.c
+++ b/drivers/misc/sgi-xp/xpnet.c
@@ -3,7 +3,7 @@
 * License.  See the file "COPYING" in the main directory of this archive
 * for more details.
 *
- * Copyright (C) 1999-2008 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (C) 1999-2009 Silicon Graphics, Inc. All rights reserved.
 */
 /*
@@ -551,6 +551,7 @@ xpnet_init(void)
        netif_carrier_off(xpnet_device);
+        xpnet_device->netdev_ops = &xpnet_netdev_ops;
        xpnet_device->mtu = XPNET_DEF_MTU;
        /*
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index dfa585f7feaf..99d4b28d52ed 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -76,6 +76,16 @@ config MMC_OMAP
          If unsure, say N.
+config MMC_OMAP_HS
+        tristate "TI OMAP High Speed Multimedia Card Interface support"
+        depends on ARCH_OMAP2430 || ARCH_OMAP3
+        help
+          This selects the TI OMAP High Speed Multimedia card Interface.
+          If you have an OMAP2430 or OMAP3 board with a Multimedia Card slot,
+          say Y or M here.
+          If unsure, say N.
 config MMC_WBSD
        tristate "Winbond W83L51xD SD/MMC Card Interface support"
        depends on ISA_DMA_API
@@ -135,6 +145,16 @@ config MMC_IMX
          If unsure, say N.
+config MMC_MXC
+        tristate "Freescale i.MX2/3 Multimedia Card Interface support"
+        depends on ARCH_MXC
+        help
+          This selects the Freescale i.MX2/3 Multimedia card Interface.
+          If you have a i.MX platform with a Multimedia Card slot,
+          say Y or M here.
+          If unsure, say N.
 config MMC_TIFM_SD
        tristate "TI Flash Media MMC/SD Interface support  (EXPERIMENTAL)"
        depends on EXPERIMENTAL && PCI
diff --git a/drivers/mmc/host/Makefile b/drivers/mmc/host/Makefile
index f4853288bbb1..dedec55861d9 100644
--- a/drivers/mmc/host/Makefile
+++ b/drivers/mmc/host/Makefile
@@ -9,12 +9,14 @@ endif
 obj-$(CONFIG_MMC_ARMMMCI)       += mmci.o
 obj-$(CONFIG_MMC_PXA)           += pxamci.o
 obj-$(CONFIG_MMC_IMX)           += imxmmc.o
+obj-$(CONFIG_MMC_MXC)           += mxcmmc.o
 obj-$(CONFIG_MMC_SDHCI)         += sdhci.o
 obj-$(CONFIG_MMC_SDHCI_PCI)     += sdhci-pci.o
 obj-$(CONFIG_MMC_RICOH_MMC)     += ricoh_mmc.o
 obj-$(CONFIG_MMC_WBSD)          += wbsd.o
 obj-$(CONFIG_MMC_AU1X)          += au1xmmc.o
 obj-$(CONFIG_MMC_OMAP)          += omap.o
+obj-$(CONFIG_MMC_OMAP_HS)       += omap_hsmmc.o
 obj-$(CONFIG_MMC_AT91)          += at91_mci.o
 obj-$(CONFIG_MMC_ATMELMCI)      += atmel-mci.o
 obj-$(CONFIG_MMC_TIFM_SD)       += tifm_sd.o
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index 1bcbdd6763ac..2909bbc8ad00 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -430,6 +430,8 @@ static void mmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                                clk = 255;
                        host->cclk = host->mclk / (2 * (clk + 1));
                }
+                if (host->hw_designer == 0x80)
+                        clk |= MCI_FCEN; /* Bug fix in ST IP block */
                clk |= MCI_CLK_ENABLE;
        }
@@ -440,15 +442,27 @@ static void mmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
        case MMC_POWER_OFF:
                break;
        case MMC_POWER_UP:
-                pwr |= MCI_PWR_UP;
+                /* The ST version does not have this, fall through to POWER_ON */
-                break;
+                if (host->hw_designer != 0x80) {
+                        pwr |= MCI_PWR_UP;
+                        break;
+                }
        case MMC_POWER_ON:
                pwr |= MCI_PWR_ON;
                break;
        }
-        if (ios->bus_mode == MMC_BUSMODE_OPENDRAIN)
+        if (ios->bus_mode == MMC_BUSMODE_OPENDRAIN) {
-                pwr |= MCI_ROD;
+                if (host->hw_designer != 0x80)
+                        pwr |= MCI_ROD;
+                else {
+                        /*
+                         * The ST Micro variant use the ROD bit for something
+                         * else and only has OD (Open Drain).
+                         */
+                        pwr |= MCI_OD;
+                }
+        }
        writel(clk, host->base + MMCICLOCK);
@@ -500,6 +514,12 @@ static int mmci_probe(struct amba_device *dev, void *id)
        }
        host = mmc_priv(mmc);
+        /* Bits 12 thru 19 is the designer */
+        host->hw_designer = (dev->periphid >> 12) & 0xff;
+        /* Bits 20 thru 23 is the revison */
+        host->hw_revision = (dev->periphid >> 20) & 0xf;
+        DBG(host, "designer ID = 0x%02x\n", host->hw_designer);
+        DBG(host, "revision = 0x%01x\n", host->hw_revision);
        host->clk = clk_get(&dev->dev, NULL);
        if (IS_ERR(host->clk)) {
                ret = PTR_ERR(host->clk);
@@ -693,6 +713,15 @@ static struct amba_id mmci_ids[] = {
                .id     = 0x00041181,
                .mask   = 0x000fffff,
        },
+        /* ST Micro variants */
+        {
+                .id     = 0x00180180,
+                .mask   = 0x00ffffff,
+        },
+        {
+                .id     = 0x00280180,
+                .mask   = 0x00ffffff,
+        },
        { 0, 0 },
 };
diff --git a/drivers/mmc/host/mmci.h b/drivers/mmc/host/mmci.h
index 0f39c490f022..0441bac1c0ec 100644
--- a/drivers/mmc/host/mmci.h
+++ b/drivers/mmc/host/mmci.h
@@ -11,13 +11,23 @@
 #define MCI_PWR_OFF             0x00
 #define MCI_PWR_UP              0x02
 #define MCI_PWR_ON              0x03
+#define MCI_DATA2DIREN          (1 << 2)
+#define MCI_CMDDIREN            (1 << 3)
+#define MCI_DATA0DIREN          (1 << 4)
+#define MCI_DATA31DIREN         (1 << 5)
 #define MCI_OD                  (1 << 6)
 #define MCI_ROD                 (1 << 7)
+/* The ST Micro version does not have ROD */
+#define MCI_FBCLKEN             (1 << 7)
+#define MCI_DATA74DIREN         (1 << 8)
 #define MMCICLOCK               0x004
 #define MCI_CLK_ENABLE          (1 << 8)
 #define MCI_CLK_PWRSAVE         (1 << 9)
 #define MCI_CLK_BYPASS          (1 << 10)
+#define MCI_WIDE_BUS            (1 << 11)
+/* HW flow control on the ST Micro version */
+#define MCI_FCEN                (1 << 13)
 #define MMCIARGUMENT            0x008
 #define MMCICOMMAND             0x00c
@@ -26,6 +36,10 @@
 #define MCI_CPSM_INTERRUPT      (1 << 8)
 #define MCI_CPSM_PENDING        (1 << 9)
 #define MCI_CPSM_ENABLE         (1 << 10)
+#define MCI_SDIO_SUSP           (1 << 11)
+#define MCI_ENCMD_COMPL         (1 << 12)
+#define MCI_NIEN                (1 << 13)
+#define MCI_CE_ATACMD           (1 << 14)
 #define MMCIRESPCMD             0x010
 #define MMCIRESPONSE0           0x014
@@ -39,6 +53,11 @@
 #define MCI_DPSM_DIRECTION      (1 << 1)
 #define MCI_DPSM_MODE           (1 << 2)
 #define MCI_DPSM_DMAENABLE      (1 << 3)
+#define MCI_DPSM_BLOCKSIZE      (1 << 4)
+#define MCI_DPSM_RWSTART        (1 << 8)
+#define MCI_DPSM_RWSTOP         (1 << 9)
+#define MCI_DPSM_RWMOD          (1 << 10)
+#define MCI_DPSM_SDIOEN         (1 << 11)
 #define MMCIDATACNT             0x030
 #define MMCISTATUS              0x034
@@ -63,6 +82,8 @@
 #define MCI_RXFIFOEMPTY         (1 << 19)
 #define MCI_TXDATAAVLBL         (1 << 20)
 #define MCI_RXDATAAVLBL         (1 << 21)
+#define MCI_SDIOIT              (1 << 22)
+#define MCI_CEATAEND            (1 << 23)
 #define MMCICLEAR               0x038
 #define MCI_CMDCRCFAILCLR       (1 << 0)
@@ -75,6 +96,8 @@
 #define MCI_CMDSENTCLR          (1 << 7)
 #define MCI_DATAENDCLR          (1 << 8)
 #define MCI_DATABLOCKENDCLR     (1 << 10)
+#define MCI_SDIOITC             (1 << 22)
+#define MCI_CEATAENDC           (1 << 23)
 #define MMCIMASK0               0x03c
 #define MCI_CMDCRCFAILMASK      (1 << 0)
@@ -98,6 +121,8 @@
 #define MCI_RXFIFOEMPTYMASK     (1 << 19)
 #define MCI_TXDATAAVLBLMASK     (1 << 20)
 #define MCI_RXDATAAVLBLMASK     (1 << 21)
+#define MCI_SDIOITMASK          (1 << 22)
+#define MCI_CEATAENDMASK        (1 << 23)
 #define MMCIMASK1               0x040
 #define MMCIFIFOCNT             0x048
@@ -136,6 +161,9 @@ struct mmci_host {
        u32                     pwr;
        struct mmc_platform_data *plat;
+        u8                      hw_designer;
+        u8                      hw_revision:4;
        struct timer_list       timer;
        unsigned int            oldstat;
diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c
new file mode 100644
index 000000000000..dda0be4e25dc
--- /dev/null
+++ b/drivers/mmc/host/mxcmmc.c
@@ -0,0 +1,880 @@
+/*
+ *  linux/drivers/mmc/host/mxcmmc.c - Freescale i.MX MMCI driver
+ *
+ *  This is a driver for the SDHC controller found in Freescale MX2/MX3
+ *  SoCs. It is basically the same hardware as found on MX1 (imxmmc.c).
+ *  Unlike the hardware found on MX1, this hardware just works and does
+ *  not need all the quirks found in imxmmc.c, hence the seperate driver.
+ *
+ *  Copyright (C) 2008 Sascha Hauer, Pengutronix <s.hauer@pengutronix.de>
+ *  Copyright (C) 2006 Pavel Pisa, PiKRON <ppisa@pikron.com>
+ *
+ *  derived from pxamci.c by Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/platform_device.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/blkdev.h>
+#include <linux/dma-mapping.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/card.h>
+#include <linux/delay.h>
+#include <linux/clk.h>
+#include <linux/io.h>
+#include <linux/gpio.h>
+#include <asm/dma.h>
+#include <asm/irq.h>
+#include <asm/sizes.h>
+#include <mach/mmc.h>
+#ifdef CONFIG_ARCH_MX2
+#include <mach/dma-mx1-mx2.h>
+#define HAS_DMA
+#endif
+#define DRIVER_NAME "imx-mmc"
+#define MMC_REG_STR_STP_CLK             0x00
+#define MMC_REG_STATUS                  0x04
+#define MMC_REG_CLK_RATE                0x08
+#define MMC_REG_CMD_DAT_CONT            0x0C
+#define MMC_REG_RES_TO                  0x10
+#define MMC_REG_READ_TO                 0x14
+#define MMC_REG_BLK_LEN                 0x18
+#define MMC_REG_NOB                     0x1C
+#define MMC_REG_REV_NO                  0x20
+#define MMC_REG_INT_CNTR                0x24
+#define MMC_REG_CMD                     0x28
+#define MMC_REG_ARG                     0x2C
+#define MMC_REG_RES_FIFO                0x34
+#define MMC_REG_BUFFER_ACCESS           0x38
+#define STR_STP_CLK_RESET               (1 << 3)
+#define STR_STP_CLK_START_CLK           (1 << 1)
+#define STR_STP_CLK_STOP_CLK            (1 << 0)
+#define STATUS_CARD_INSERTION           (1 << 31)
+#define STATUS_CARD_REMOVAL             (1 << 30)
+#define STATUS_YBUF_EMPTY               (1 << 29)
+#define STATUS_XBUF_EMPTY               (1 << 28)
+#define STATUS_YBUF_FULL                (1 << 27)
+#define STATUS_XBUF_FULL                (1 << 26)
+#define STATUS_BUF_UND_RUN              (1 << 25)
+#define STATUS_BUF_OVFL                 (1 << 24)
+#define STATUS_SDIO_INT_ACTIVE          (1 << 14)
+#define STATUS_END_CMD_RESP             (1 << 13)
+#define STATUS_WRITE_OP_DONE            (1 << 12)
+#define STATUS_DATA_TRANS_DONE          (1 << 11)
+#define STATUS_READ_OP_DONE             (1 << 11)
+#define STATUS_WR_CRC_ERROR_CODE_MASK   (3 << 10)
+#define STATUS_CARD_BUS_CLK_RUN         (1 << 8)
+#define STATUS_BUF_READ_RDY             (1 << 7)
+#define STATUS_BUF_WRITE_RDY            (1 << 6)
+#define STATUS_RESP_CRC_ERR             (1 << 5)
+#define STATUS_CRC_READ_ERR             (1 << 3)
+#define STATUS_CRC_WRITE_ERR            (1 << 2)
+#define STATUS_TIME_OUT_RESP            (1 << 1)
+#define STATUS_TIME_OUT_READ            (1 << 0)
+#define STATUS_ERR_MASK                 0x2f
+#define CMD_DAT_CONT_CMD_RESP_LONG_OFF  (1 << 12)
+#define CMD_DAT_CONT_STOP_READWAIT      (1 << 11)
+#define CMD_DAT_CONT_START_READWAIT     (1 << 10)
+#define CMD_DAT_CONT_BUS_WIDTH_4        (2 << 8)
+#define CMD_DAT_CONT_INIT               (1 << 7)
+#define CMD_DAT_CONT_WRITE              (1 << 4)
+#define CMD_DAT_CONT_DATA_ENABLE        (1 << 3)
+#define CMD_DAT_CONT_RESPONSE_48BIT_CRC (1 << 0)
+#define CMD_DAT_CONT_RESPONSE_136BIT    (2 << 0)
+#define CMD_DAT_CONT_RESPONSE_48BIT     (3 << 0)
+#define INT_SDIO_INT_WKP_EN             (1 << 18)
+#define INT_CARD_INSERTION_WKP_EN       (1 << 17)
+#define INT_CARD_REMOVAL_WKP_EN         (1 << 16)
+#define INT_CARD_INSERTION_EN           (1 << 15)
+#define INT_CARD_REMOVAL_EN             (1 << 14)
+#define INT_SDIO_IRQ_EN                 (1 << 13)
+#define INT_DAT0_EN                     (1 << 12)
+#define INT_BUF_READ_EN                 (1 << 4)
+#define INT_BUF_WRITE_EN                (1 << 3)
+#define INT_END_CMD_RES_EN              (1 << 2)
+#define INT_WRITE_OP_DONE_EN            (1 << 1)
+#define INT_READ_OP_EN                  (1 << 0)
+struct mxcmci_host {
+        struct mmc_host         *mmc;
+        struct resource         *res;
+        void __iomem            *base;
+        int                     irq;
+        int                     detect_irq;
+        int                     dma;
+        int                     do_dma;
+        unsigned int            power_mode;
+        struct imxmmc_platform_data *pdata;
+        struct mmc_request      *req;
+        struct mmc_command      *cmd;
+        struct mmc_data         *data;
+        unsigned int            dma_nents;
+        unsigned int            datasize;
+        unsigned int            dma_dir;
+        u16                     rev_no;
+        unsigned int            cmdat;
+        struct clk              *clk;
+        int                     clock;
+        struct work_struct      datawork;
+};
+static inline int mxcmci_use_dma(struct mxcmci_host *host)
+{
+        return host->do_dma;
+}
+static void mxcmci_softreset(struct mxcmci_host *host)
+{
+        int i;
+        /* reset sequence */
+        writew(STR_STP_CLK_RESET, host->base + MMC_REG_STR_STP_CLK);
+        writew(STR_STP_CLK_RESET | STR_STP_CLK_START_CLK,
+                        host->base + MMC_REG_STR_STP_CLK);
+        for (i = 0; i < 8; i++)
+                writew(STR_STP_CLK_START_CLK, host->base + MMC_REG_STR_STP_CLK);
+        writew(0xff, host->base + MMC_REG_RES_TO);
+}
+static void mxcmci_setup_data(struct mxcmci_host *host, struct mmc_data *data)
+{
+        unsigned int nob = data->blocks;
+        unsigned int blksz = data->blksz;
+        unsigned int datasize = nob * blksz;
+#ifdef HAS_DMA
+        struct scatterlist *sg;
+        int i;
+#endif
+        if (data->flags & MMC_DATA_STREAM)
+                nob = 0xffff;
+        host->data = data;
+        data->bytes_xfered = 0;
+        writew(nob, host->base + MMC_REG_NOB);
+        writew(blksz, host->base + MMC_REG_BLK_LEN);
+        host->datasize = datasize;
+#ifdef HAS_DMA
+        for_each_sg(data->sg, sg, data->sg_len, i) {
+                if (sg->offset & 3 || sg->length & 3) {
+                        host->do_dma = 0;
+                        return;
+                }
+        }
+        if (data->flags & MMC_DATA_READ) {
+                host->dma_dir = DMA_FROM_DEVICE;
+                host->dma_nents = dma_map_sg(mmc_dev(host->mmc), data->sg,
+                                             data->sg_len,  host->dma_dir);
+                imx_dma_setup_sg(host->dma, data->sg, host->dma_nents, datasize,
+                                 host->res->start + MMC_REG_BUFFER_ACCESS,
+                                 DMA_MODE_READ);
+        } else {
+                host->dma_dir = DMA_TO_DEVICE;
+                host->dma_nents = dma_map_sg(mmc_dev(host->mmc), data->sg,
+                                             data->sg_len,  host->dma_dir);
+                imx_dma_setup_sg(host->dma, data->sg, host->dma_nents, datasize,
+                                 host->res->start + MMC_REG_BUFFER_ACCESS,
+                                 DMA_MODE_WRITE);
+        }
+        wmb();
+        imx_dma_enable(host->dma);
+#endif /* HAS_DMA */
+}
+static int mxcmci_start_cmd(struct mxcmci_host *host, struct mmc_command *cmd,
+                unsigned int cmdat)
+{
+        WARN_ON(host->cmd != NULL);
+        host->cmd = cmd;
+        switch (mmc_resp_type(cmd)) {
+        case MMC_RSP_R1: /* short CRC, OPCODE */
+        case MMC_RSP_R1B:/* short CRC, OPCODE, BUSY */
+                cmdat |= CMD_DAT_CONT_RESPONSE_48BIT_CRC;
+                break;
+        case MMC_RSP_R2: /* long 136 bit + CRC */
+                cmdat |= CMD_DAT_CONT_RESPONSE_136BIT;
+                break;
+        case MMC_RSP_R3: /* short */
+                cmdat |= CMD_DAT_CONT_RESPONSE_48BIT;
+                break;
+        case MMC_RSP_NONE:
+                break;
+        default:
+                dev_err(mmc_dev(host->mmc), "unhandled response type 0x%x\n",
+                                mmc_resp_type(cmd));
+                cmd->error = -EINVAL;
+                return -EINVAL;
+        }
+        if (mxcmci_use_dma(host))
+                writel(INT_READ_OP_EN | INT_WRITE_OP_DONE_EN |
+                                INT_END_CMD_RES_EN,
+                                host->base + MMC_REG_INT_CNTR);
+        else
+                writel(INT_END_CMD_RES_EN, host->base + MMC_REG_INT_CNTR);
+        writew(cmd->opcode, host->base + MMC_REG_CMD);
+        writel(cmd->arg, host->base + MMC_REG_ARG);
+        writew(cmdat, host->base + MMC_REG_CMD_DAT_CONT);
+        return 0;
+}
+static void mxcmci_finish_request(struct mxcmci_host *host,
+                struct mmc_request *req)
+{
+        writel(0, host->base + MMC_REG_INT_CNTR);
+        host->req = NULL;
+        host->cmd = NULL;
+        host->data = NULL;
+        mmc_request_done(host->mmc, req);
+}
+static int mxcmci_finish_data(struct mxcmci_host *host, unsigned int stat)
+{
+        struct mmc_data *data = host->data;
+        int data_error;
+#ifdef HAS_DMA
+        if (mxcmci_use_dma(host)) {
+                imx_dma_disable(host->dma);
+                dma_unmap_sg(mmc_dev(host->mmc), data->sg, host->dma_nents,
+                                host->dma_dir);
+        }
+#endif
+        if (stat & STATUS_ERR_MASK) {
+                dev_dbg(mmc_dev(host->mmc), "request failed. status: 0x%08x\n",
+                                stat);
+                if (stat & STATUS_CRC_READ_ERR) {
+                        data->error = -EILSEQ;
+                } else if (stat & STATUS_CRC_WRITE_ERR) {
+                        u32 err_code = (stat >> 9) & 0x3;
+                        if (err_code == 2) /* No CRC response */
+                                data->error = -ETIMEDOUT;
+                        else
+                                data->error = -EILSEQ;
+                } else if (stat & STATUS_TIME_OUT_READ) {
+                        data->error = -ETIMEDOUT;
+                } else {
+                        data->error = -EIO;
+                }
+        } else {
+                data->bytes_xfered = host->datasize;
+        }
+        data_error = data->error;
+        host->data = NULL;
+        return data_error;
+}
+static void mxcmci_read_response(struct mxcmci_host *host, unsigned int stat)
+{
+        struct mmc_command *cmd = host->cmd;
+        int i;
+        u32 a, b, c;
+        if (!cmd)
+                return;
+        if (stat & STATUS_TIME_OUT_RESP) {
+                dev_dbg(mmc_dev(host->mmc), "CMD TIMEOUT\n");
+                cmd->error = -ETIMEDOUT;
+        } else if (stat & STATUS_RESP_CRC_ERR && cmd->flags & MMC_RSP_CRC) {
+                dev_dbg(mmc_dev(host->mmc), "cmd crc error\n");
+                cmd->error = -EILSEQ;
+        }
+        if (cmd->flags & MMC_RSP_PRESENT) {
+                if (cmd->flags & MMC_RSP_136) {
+                        for (i = 0; i < 4; i++) {
+                                a = readw(host->base + MMC_REG_RES_FIFO);
+                                b = readw(host->base + MMC_REG_RES_FIFO);
+                                cmd->resp[i] = a << 16 | b;
+                        }
+                } else {
+                        a = readw(host->base + MMC_REG_RES_FIFO);
+                        b = readw(host->base + MMC_REG_RES_FIFO);
+                        c = readw(host->base + MMC_REG_RES_FIFO);
+                        cmd->resp[0] = a << 24 | b << 8 | c >> 8;
+                }
+        }
+}
+static int mxcmci_poll_status(struct mxcmci_host *host, u32 mask)
+{
+        u32 stat;
+        unsigned long timeout = jiffies + HZ;
+        do {
+                stat = readl(host->base + MMC_REG_STATUS);
+                if (stat & STATUS_ERR_MASK)
+                        return stat;
+                if (time_after(jiffies, timeout))
+                        return STATUS_TIME_OUT_READ;
+                if (stat & mask)
+                        return 0;
+                cpu_relax();
+        } while (1);
+}
+static int mxcmci_pull(struct mxcmci_host *host, void *_buf, int bytes)
+{
+        unsigned int stat;
+        u32 *buf = _buf;
+        while (bytes > 3) {
+                stat = mxcmci_poll_status(host,
+                                STATUS_BUF_READ_RDY | STATUS_READ_OP_DONE);
+                if (stat)
+                        return stat;
+                *buf++ = readl(host->base + MMC_REG_BUFFER_ACCESS);
+                bytes -= 4;
+        }
+        if (bytes) {
+                u8 *b = (u8 *)buf;
+                u32 tmp;
+                stat = mxcmci_poll_status(host,
+                                STATUS_BUF_READ_RDY | STATUS_READ_OP_DONE);
+                if (stat)
+                        return stat;
+                tmp = readl(host->base + MMC_REG_BUFFER_ACCESS);
+                memcpy(b, &tmp, bytes);
+        }
+        return 0;
+}
+static int mxcmci_push(struct mxcmci_host *host, void *_buf, int bytes)
+{
+        unsigned int stat;
+        u32 *buf = _buf;
+        while (bytes > 3) {
+                stat = mxcmci_poll_status(host, STATUS_BUF_WRITE_RDY);
+                if (stat)
+                        return stat;
+                writel(*buf++, host->base + MMC_REG_BUFFER_ACCESS);
+                bytes -= 4;
+        }
+        if (bytes) {
+                u8 *b = (u8 *)buf;
+                u32 tmp;
+                stat = mxcmci_poll_status(host, STATUS_BUF_WRITE_RDY);
+                if (stat)
+                        return stat;
+                memcpy(&tmp, b, bytes);
+                writel(tmp, host->base + MMC_REG_BUFFER_ACCESS);
+        }
+        stat = mxcmci_poll_status(host, STATUS_BUF_WRITE_RDY);
+        if (stat)
+                return stat;
+        return 0;
+}
+static int mxcmci_transfer_data(struct mxcmci_host *host)
+{
+        struct mmc_data *data = host->req->data;
+        struct scatterlist *sg;
+        int stat, i;
+        host->datasize = 0;
+        host->data = data;
+        host->datasize = 0;
+        if (data->flags & MMC_DATA_READ) {
+                for_each_sg(data->sg, sg, data->sg_len, i) {
+                        stat = mxcmci_pull(host, sg_virt(sg), sg->length);
+                        if (stat)
+                                return stat;
+                        host->datasize += sg->length;
+                }
+        } else {
+                for_each_sg(data->sg, sg, data->sg_len, i) {
+                        stat = mxcmci_push(host, sg_virt(sg), sg->length);
+                        if (stat)
+                                return stat;
+                        host->datasize += sg->length;
+                }
+                stat = mxcmci_poll_status(host, STATUS_WRITE_OP_DONE);
+                if (stat)
+                        return stat;
+        }
+        return 0;
+}
+static void mxcmci_datawork(struct work_struct *work)
+{
+        struct mxcmci_host *host = container_of(work, struct mxcmci_host,
+                                                  datawork);
+        int datastat = mxcmci_transfer_data(host);
+        mxcmci_finish_data(host, datastat);
+        if (host->req->stop) {
+                if (mxcmci_start_cmd(host, host->req->stop, 0)) {
+                        mxcmci_finish_request(host, host->req);
+                        return;
+                }
+        } else {
+                mxcmci_finish_request(host, host->req);
+        }
+}
+#ifdef HAS_DMA
+static void mxcmci_data_done(struct mxcmci_host *host, unsigned int stat)
+{
+        struct mmc_data *data = host->data;
+        int data_error;
+        if (!data)
+                return;
+        data_error = mxcmci_finish_data(host, stat);
+        mxcmci_read_response(host, stat);
+        host->cmd = NULL;
+        if (host->req->stop) {
+                if (mxcmci_start_cmd(host, host->req->stop, 0)) {
+                        mxcmci_finish_request(host, host->req);
+                        return;
+                }
+        } else {
+                mxcmci_finish_request(host, host->req);
+        }
+}
+#endif /* HAS_DMA */
+static void mxcmci_cmd_done(struct mxcmci_host *host, unsigned int stat)
+{
+        mxcmci_read_response(host, stat);
+        host->cmd = NULL;
+        if (!host->data && host->req) {
+                mxcmci_finish_request(host, host->req);
+                return;
+        }
+        /* For the DMA case the DMA engine handles the data transfer
+         * automatically. For non DMA we have to to it ourselves.
+         * Don't do it in interrupt context though.
+         */
+        if (!mxcmci_use_dma(host) && host->data)
+                schedule_work(&host->datawork);
+}
+static irqreturn_t mxcmci_irq(int irq, void *devid)
+{
+        struct mxcmci_host *host = devid;
+        u32 stat;
+        stat = readl(host->base + MMC_REG_STATUS);
+        writel(stat, host->base + MMC_REG_STATUS);
+        dev_dbg(mmc_dev(host->mmc), "%s: 0x%08x\n", __func__, stat);
+        if (stat & STATUS_END_CMD_RESP)
+                mxcmci_cmd_done(host, stat);
+#ifdef HAS_DMA
+        if (mxcmci_use_dma(host) &&
+                  (stat & (STATUS_DATA_TRANS_DONE | STATUS_WRITE_OP_DONE)))
+                mxcmci_data_done(host, stat);
+#endif
+        return IRQ_HANDLED;
+}
+static void mxcmci_request(struct mmc_host *mmc, struct mmc_request *req)
+{
+        struct mxcmci_host *host = mmc_priv(mmc);
+        unsigned int cmdat = host->cmdat;
+        WARN_ON(host->req != NULL);
+        host->req = req;
+        host->cmdat &= ~CMD_DAT_CONT_INIT;
+#ifdef HAS_DMA
+        host->do_dma = 1;
+#endif
+        if (req->data) {
+                mxcmci_setup_data(host, req->data);
+                cmdat |= CMD_DAT_CONT_DATA_ENABLE;
+                if (req->data->flags & MMC_DATA_WRITE)
+                        cmdat |= CMD_DAT_CONT_WRITE;
+        }
+        if (mxcmci_start_cmd(host, req->cmd, cmdat))
+                mxcmci_finish_request(host, req);
+}
+static void mxcmci_set_clk_rate(struct mxcmci_host *host, unsigned int clk_ios)
+{
+        unsigned int divider;
+        int prescaler = 0;
+        unsigned int clk_in = clk_get_rate(host->clk);
+        while (prescaler <= 0x800) {
+                for (divider = 1; divider <= 0xF; divider++) {
+                        int x;
+                        x = (clk_in / (divider + 1));
+                        if (prescaler)
+                                x /= (prescaler * 2);
+                        if (x <= clk_ios)
+                                break;
+                }
+                if (divider < 0x10)
+                        break;
+                if (prescaler == 0)
+                        prescaler = 1;
+                else
+                        prescaler <<= 1;
+        }
+        writew((prescaler << 4) | divider, host->base + MMC_REG_CLK_RATE);
+        dev_dbg(mmc_dev(host->mmc), "scaler: %d divider: %d in: %d out: %d\n",
+                        prescaler, divider, clk_in, clk_ios);
+}
+static void mxcmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+{
+        struct mxcmci_host *host = mmc_priv(mmc);
+#ifdef HAS_DMA
+        unsigned int blen;
+        /*
+         * use burstlen of 64 in 4 bit mode (--> reg value  0)
+         * use burstlen of 16 in 1 bit mode (--> reg value 16)
+         */
+        if (ios->bus_width == MMC_BUS_WIDTH_4)
+                blen = 0;
+        else
+                blen = 16;
+        imx_dma_config_burstlen(host->dma, blen);
+#endif
+        if (ios->bus_width == MMC_BUS_WIDTH_4)
+                host->cmdat |= CMD_DAT_CONT_BUS_WIDTH_4;
+        else
+                host->cmdat &= ~CMD_DAT_CONT_BUS_WIDTH_4;
+        if (host->power_mode != ios->power_mode) {
+                if (host->pdata && host->pdata->setpower)
+                        host->pdata->setpower(mmc_dev(mmc), ios->vdd);
+                host->power_mode = ios->power_mode;
+                if (ios->power_mode == MMC_POWER_ON)
+                        host->cmdat |= CMD_DAT_CONT_INIT;
+        }
+        if (ios->clock) {
+                mxcmci_set_clk_rate(host, ios->clock);
+                writew(STR_STP_CLK_START_CLK, host->base + MMC_REG_STR_STP_CLK);
+        } else {
+                writew(STR_STP_CLK_STOP_CLK, host->base + MMC_REG_STR_STP_CLK);
+        }
+        host->clock = ios->clock;
+}
+static irqreturn_t mxcmci_detect_irq(int irq, void *data)
+{
+        struct mmc_host *mmc = data;
+        dev_dbg(mmc_dev(mmc), "%s\n", __func__);
+        mmc_detect_change(mmc, msecs_to_jiffies(250));
+        return IRQ_HANDLED;
+}
+static int mxcmci_get_ro(struct mmc_host *mmc)
+{
+        struct mxcmci_host *host = mmc_priv(mmc);
+        if (host->pdata && host->pdata->get_ro)
+                return !!host->pdata->get_ro(mmc_dev(mmc));
+        /*
+         * Board doesn't support read only detection; let the mmc core
+         * decide what to do.
+         */
+        return -ENOSYS;
+}
+static const struct mmc_host_ops mxcmci_ops = {
+        .request        = mxcmci_request,
+        .set_ios        = mxcmci_set_ios,
+        .get_ro         = mxcmci_get_ro,
+};
+static int mxcmci_probe(struct platform_device *pdev)
+{
+        struct mmc_host *mmc;
+        struct mxcmci_host *host = NULL;
+        struct resource *r;
+        int ret = 0, irq;
+        printk(KERN_INFO "i.MX SDHC driver\n");
+        r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        irq = platform_get_irq(pdev, 0);
+        if (!r || irq < 0)
+                return -EINVAL;
+        r = request_mem_region(r->start, resource_size(r), pdev->name);
+        if (!r)
+                return -EBUSY;
+        mmc = mmc_alloc_host(sizeof(struct mxcmci_host), &pdev->dev);
+        if (!mmc) {
+                ret = -ENOMEM;
+                goto out_release_mem;
+        }
+        mmc->ops = &mxcmci_ops;
+        mmc->caps = MMC_CAP_4_BIT_DATA;
+        /* MMC core transfer sizes tunable parameters */
+        mmc->max_hw_segs = 64;
+        mmc->max_phys_segs = 64;
+        mmc->max_blk_size = 2048;
+        mmc->max_blk_count = 65535;
+        mmc->max_req_size = mmc->max_blk_size * mmc->max_blk_count;
+        mmc->max_seg_size = mmc->max_seg_size;
+        host = mmc_priv(mmc);
+        host->base = ioremap(r->start, resource_size(r));
+        if (!host->base) {
+                ret = -ENOMEM;
+                goto out_free;
+        }
+        host->mmc = mmc;
+        host->pdata = pdev->dev.platform_data;
+        if (host->pdata && host->pdata->ocr_avail)
+                mmc->ocr_avail = host->pdata->ocr_avail;
+        else
+                mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
+        host->res = r;
+        host->irq = irq;
+        host->clk = clk_get(&pdev->dev, "sdhc_clk");
+        if (IS_ERR(host->clk)) {
+                ret = PTR_ERR(host->clk);
+                goto out_iounmap;
+        }
+        clk_enable(host->clk);
+        mxcmci_softreset(host);
+        host->rev_no = readw(host->base + MMC_REG_REV_NO);
+        if (host->rev_no != 0x400) {
+                ret = -ENODEV;
+                dev_err(mmc_dev(host->mmc), "wrong rev.no. 0x%08x. aborting.\n",
+                        host->rev_no);
+                goto out_clk_put;
+        }
+        mmc->f_min = clk_get_rate(host->clk) >> 7;
+        mmc->f_max = clk_get_rate(host->clk) >> 1;
+        /* recommended in data sheet */
+        writew(0x2db4, host->base + MMC_REG_READ_TO);
+        writel(0, host->base + MMC_REG_INT_CNTR);
+#ifdef HAS_DMA
+        host->dma = imx_dma_request_by_prio(DRIVER_NAME, DMA_PRIO_LOW);
+        if (host->dma < 0) {
+                dev_err(mmc_dev(host->mmc), "imx_dma_request_by_prio failed\n");
+                ret = -EBUSY;
+                goto out_clk_put;
+        }
+        r = platform_get_resource(pdev, IORESOURCE_DMA, 0);
+        if (!r) {
+                ret = -EINVAL;
+                goto out_free_dma;
+        }
+        ret = imx_dma_config_channel(host->dma,
+                                     IMX_DMA_MEMSIZE_32 | IMX_DMA_TYPE_FIFO,
+                                     IMX_DMA_MEMSIZE_32 | IMX_DMA_TYPE_LINEAR,
+                                     r->start, 0);
+        if (ret) {
+                dev_err(mmc_dev(host->mmc), "failed to config DMA channel\n");
+                goto out_free_dma;
+        }
+#endif
+        INIT_WORK(&host->datawork, mxcmci_datawork);
+        ret = request_irq(host->irq, mxcmci_irq, 0, DRIVER_NAME, host);
+        if (ret)
+                goto out_free_dma;
+        platform_set_drvdata(pdev, mmc);
+        if (host->pdata && host->pdata->init) {
+                ret = host->pdata->init(&pdev->dev, mxcmci_detect_irq,
+                                host->mmc);
+                if (ret)
+                        goto out_free_irq;
+        }
+        mmc_add_host(mmc);
+        return 0;
+out_free_irq:
+        free_irq(host->irq, host);
+out_free_dma:
+#ifdef HAS_DMA
+        imx_dma_free(host->dma);
+#endif
+out_clk_put:
+        clk_disable(host->clk);
+        clk_put(host->clk);
+out_iounmap:
+        iounmap(host->base);
+out_free:
+        mmc_free_host(mmc);
+out_release_mem:
+        release_mem_region(host->res->start, resource_size(host->res));
+        return ret;
+}
+static int mxcmci_remove(struct platform_device *pdev)
+{
+        struct mmc_host *mmc = platform_get_drvdata(pdev);
+        struct mxcmci_host *host = mmc_priv(mmc);
+        platform_set_drvdata(pdev, NULL);
+        mmc_remove_host(mmc);
+        if (host->pdata && host->pdata->exit)
+                host->pdata->exit(&pdev->dev, mmc);
+        free_irq(host->irq, host);
+        iounmap(host->base);
+#ifdef HAS_DMA
+        imx_dma_free(host->dma);
+#endif
+        clk_disable(host->clk);
+        clk_put(host->clk);
+        release_mem_region(host->res->start, resource_size(host->res));
+        release_resource(host->res);
+        mmc_free_host(mmc);
+        return 0;
+}
+#ifdef CONFIG_PM
+static int mxcmci_suspend(struct platform_device *dev, pm_message_t state)
+{
+        struct mmc_host *mmc = platform_get_drvdata(dev);
+        int ret = 0;
+        if (mmc)
+                ret = mmc_suspend_host(mmc, state);
+        return ret;
+}
+static int mxcmci_resume(struct platform_device *dev)
+{
+        struct mmc_host *mmc = platform_get_drvdata(dev);
+        struct mxcmci_host *host;
+        int ret = 0;
+        if (mmc) {
+                host = mmc_priv(mmc);
+                ret = mmc_resume_host(mmc);
+        }
+        return ret;
+}
+#else
+#define mxcmci_suspend  NULL
+#define mxcmci_resume   NULL
+#endif /* CONFIG_PM */
+static struct platform_driver mxcmci_driver = {
+        .probe          = mxcmci_probe,
+        .remove         = mxcmci_remove,
+        .suspend        = mxcmci_suspend,
+        .resume         = mxcmci_resume,
+        .driver         = {
+                .name           = DRIVER_NAME,
+                .owner          = THIS_MODULE,
+        }
+};
+static int __init mxcmci_init(void)
+{
+        return platform_driver_register(&mxcmci_driver);
+}
+static void __exit mxcmci_exit(void)
+{
+        platform_driver_unregister(&mxcmci_driver);
+}
+module_init(mxcmci_init);
+module_exit(mxcmci_exit);
+MODULE_DESCRIPTION("i.MX Multimedia Card Interface Driver");
+MODULE_AUTHOR("Sascha Hauer, Pengutronix");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:imx-mmc");
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
new file mode 100644
index 000000000000..db37490f67ec
--- /dev/null
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -0,0 +1,1242 @@
+/*
+ * drivers/mmc/host/omap_hsmmc.c
+ *
+ * Driver for OMAP2430/3430 MMC controller.
+ *
+ * Copyright (C) 2007 Texas Instruments.
+ *
+ * Authors:
+ *      Syed Mohammed Khasim    <x0khasim@ti.com>
+ *      Madhusudhan             <madhu.cr@ti.com>
+ *      Mohit Jalori            <mjalori@ti.com>
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2. This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/delay.h>
+#include <linux/dma-mapping.h>
+#include <linux/platform_device.h>
+#include <linux/workqueue.h>
+#include <linux/timer.h>
+#include <linux/clk.h>
+#include <linux/mmc/host.h>
+#include <linux/io.h>
+#include <linux/semaphore.h>
+#include <mach/dma.h>
+#include <mach/hardware.h>
+#include <mach/board.h>
+#include <mach/mmc.h>
+#include <mach/cpu.h>
+/* OMAP HSMMC Host Controller Registers */
+#define OMAP_HSMMC_SYSCONFIG    0x0010
+#define OMAP_HSMMC_CON          0x002C
+#define OMAP_HSMMC_BLK          0x0104
+#define OMAP_HSMMC_ARG          0x0108
+#define OMAP_HSMMC_CMD          0x010C
+#define OMAP_HSMMC_RSP10        0x0110
+#define OMAP_HSMMC_RSP32        0x0114
+#define OMAP_HSMMC_RSP54        0x0118
+#define OMAP_HSMMC_RSP76        0x011C
+#define OMAP_HSMMC_DATA         0x0120
+#define OMAP_HSMMC_HCTL         0x0128
+#define OMAP_HSMMC_SYSCTL       0x012C
+#define OMAP_HSMMC_STAT         0x0130
+#define OMAP_HSMMC_IE           0x0134
+#define OMAP_HSMMC_ISE          0x0138
+#define OMAP_HSMMC_CAPA         0x0140
+#define VS18                    (1 << 26)
+#define VS30                    (1 << 25)
+#define SDVS18                  (0x5 << 9)
+#define SDVS30                  (0x6 << 9)
+#define SDVSCLR                 0xFFFFF1FF
+#define SDVSDET                 0x00000400
+#define AUTOIDLE                0x1
+#define SDBP                    (1 << 8)
+#define DTO                     0xe
+#define ICE                     0x1
+#define ICS                     0x2
+#define CEN                     (1 << 2)
+#define CLKD_MASK               0x0000FFC0
+#define CLKD_SHIFT              6
+#define DTO_MASK                0x000F0000
+#define DTO_SHIFT               16
+#define INT_EN_MASK             0x307F0033
+#define INIT_STREAM             (1 << 1)
+#define DP_SELECT               (1 << 21)
+#define DDIR                    (1 << 4)
+#define DMA_EN                  0x1
+#define MSBS                    (1 << 5)
+#define BCE                     (1 << 1)
+#define FOUR_BIT                (1 << 1)
+#define CC                      0x1
+#define TC                      0x02
+#define OD                      0x1
+#define ERR                     (1 << 15)
+#define CMD_TIMEOUT             (1 << 16)
+#define DATA_TIMEOUT            (1 << 20)
+#define CMD_CRC                 (1 << 17)
+#define DATA_CRC                (1 << 21)
+#define CARD_ERR                (1 << 28)
+#define STAT_CLEAR              0xFFFFFFFF
+#define INIT_STREAM_CMD         0x00000000
+#define DUAL_VOLT_OCR_BIT       7
+#define SRC                     (1 << 25)
+#define SRD                     (1 << 26)
+/*
+ * FIXME: Most likely all the data using these _DEVID defines should come
+ * from the platform_data, or implemented in controller and slot specific
+ * functions.
+ */
+#define OMAP_MMC1_DEVID         0
+#define OMAP_MMC2_DEVID         1
+#define OMAP_MMC_DATADIR_NONE   0
+#define OMAP_MMC_DATADIR_READ   1
+#define OMAP_MMC_DATADIR_WRITE  2
+#define MMC_TIMEOUT_MS          20
+#define OMAP_MMC_MASTER_CLOCK   96000000
+#define DRIVER_NAME             "mmci-omap-hs"
+/*
+ * One controller can have multiple slots, like on some omap boards using
+ * omap.c controller driver. Luckily this is not currently done on any known
+ * omap_hsmmc.c device.
+ */
+#define mmc_slot(host)          (host->pdata->slots[host->slot_id])
+/*
+ * MMC Host controller read/write API's
+ */
+#define OMAP_HSMMC_READ(base, reg)      \
+        __raw_readl((base) + OMAP_HSMMC_##reg)
+#define OMAP_HSMMC_WRITE(base, reg, val) \
+        __raw_writel((val), (base) + OMAP_HSMMC_##reg)
+struct mmc_omap_host {
+        struct  device          *dev;
+        struct  mmc_host        *mmc;
+        struct  mmc_request     *mrq;
+        struct  mmc_command     *cmd;
+        struct  mmc_data        *data;
+        struct  clk             *fclk;
+        struct  clk             *iclk;
+        struct  clk             *dbclk;
+        struct  semaphore       sem;
+        struct  work_struct     mmc_carddetect_work;
+        void    __iomem         *base;
+        resource_size_t         mapbase;
+        unsigned int            id;
+        unsigned int            dma_len;
+        unsigned int            dma_dir;
+        unsigned char           bus_mode;
+        unsigned char           datadir;
+        u32                     *buffer;
+        u32                     bytesleft;
+        int                     suspended;
+        int                     irq;
+        int                     carddetect;
+        int                     use_dma, dma_ch;
+        int                     initstr;
+        int                     slot_id;
+        int                     dbclk_enabled;
+        struct  omap_mmc_platform_data  *pdata;
+};
+/*
+ * Stop clock to the card
+ */
+static void omap_mmc_stop_clock(struct mmc_omap_host *host)
+{
+        OMAP_HSMMC_WRITE(host->base, SYSCTL,
+                OMAP_HSMMC_READ(host->base, SYSCTL) & ~CEN);
+        if ((OMAP_HSMMC_READ(host->base, SYSCTL) & CEN) != 0x0)
+                dev_dbg(mmc_dev(host->mmc), "MMC Clock is not stoped\n");
+}
+/*
+ * Send init stream sequence to card
+ * before sending IDLE command
+ */
+static void send_init_stream(struct mmc_omap_host *host)
+{
+        int reg = 0;
+        unsigned long timeout;
+        disable_irq(host->irq);
+        OMAP_HSMMC_WRITE(host->base, CON,
+                OMAP_HSMMC_READ(host->base, CON) | INIT_STREAM);
+        OMAP_HSMMC_WRITE(host->base, CMD, INIT_STREAM_CMD);
+        timeout = jiffies + msecs_to_jiffies(MMC_TIMEOUT_MS);
+        while ((reg != CC) && time_before(jiffies, timeout))
+                reg = OMAP_HSMMC_READ(host->base, STAT) & CC;
+        OMAP_HSMMC_WRITE(host->base, CON,
+                OMAP_HSMMC_READ(host->base, CON) & ~INIT_STREAM);
+        enable_irq(host->irq);
+}
+static inline
+int mmc_omap_cover_is_closed(struct mmc_omap_host *host)
+{
+        int r = 1;
+        if (host->pdata->slots[host->slot_id].get_cover_state)
+                r = host->pdata->slots[host->slot_id].get_cover_state(host->dev,
+                        host->slot_id);
+        return r;
+}
+static ssize_t
+mmc_omap_show_cover_switch(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct mmc_host *mmc = container_of(dev, struct mmc_host, class_dev);
+        struct mmc_omap_host *host = mmc_priv(mmc);
+        return sprintf(buf, "%s\n", mmc_omap_cover_is_closed(host) ? "closed" :
+                       "open");
+}
+static DEVICE_ATTR(cover_switch, S_IRUGO, mmc_omap_show_cover_switch, NULL);
+static ssize_t
+mmc_omap_show_slot_name(struct device *dev, struct device_attribute *attr,
+                        char *buf)
+{
+        struct mmc_host *mmc = container_of(dev, struct mmc_host, class_dev);
+        struct mmc_omap_host *host = mmc_priv(mmc);
+        struct omap_mmc_slot_data slot = host->pdata->slots[host->slot_id];
+        return sprintf(buf, "slot:%s\n", slot.name);
+}
+static DEVICE_ATTR(slot_name, S_IRUGO, mmc_omap_show_slot_name, NULL);
+/*
+ * Configure the response type and send the cmd.
+ */
+static void
+mmc_omap_start_command(struct mmc_omap_host *host, struct mmc_command *cmd,
+        struct mmc_data *data)
+{
+        int cmdreg = 0, resptype = 0, cmdtype = 0;
+        dev_dbg(mmc_dev(host->mmc), "%s: CMD%d, argument 0x%08x\n",
+                mmc_hostname(host->mmc), cmd->opcode, cmd->arg);
+        host->cmd = cmd;
+        /*
+         * Clear status bits and enable interrupts
+         */
+        OMAP_HSMMC_WRITE(host->base, STAT, STAT_CLEAR);
+        OMAP_HSMMC_WRITE(host->base, ISE, INT_EN_MASK);
+        OMAP_HSMMC_WRITE(host->base, IE, INT_EN_MASK);
+        if (cmd->flags & MMC_RSP_PRESENT) {
+                if (cmd->flags & MMC_RSP_136)
+                        resptype = 1;
+                else
+                        resptype = 2;
+        }
+        /*
+         * Unlike OMAP1 controller, the cmdtype does not seem to be based on
+         * ac, bc, adtc, bcr. Only commands ending an open ended transfer need
+         * a val of 0x3, rest 0x0.
+         */
+        if (cmd == host->mrq->stop)
+                cmdtype = 0x3;
+        cmdreg = (cmd->opcode << 24) | (resptype << 16) | (cmdtype << 22);
+        if (data) {
+                cmdreg |= DP_SELECT | MSBS | BCE;
+                if (data->flags & MMC_DATA_READ)
+                        cmdreg |= DDIR;
+                else
+                        cmdreg &= ~(DDIR);
+        }
+        if (host->use_dma)
+                cmdreg |= DMA_EN;
+        OMAP_HSMMC_WRITE(host->base, ARG, cmd->arg);
+        OMAP_HSMMC_WRITE(host->base, CMD, cmdreg);
+}
+/*
+ * Notify the transfer complete to MMC core
+ */
+static void
+mmc_omap_xfer_done(struct mmc_omap_host *host, struct mmc_data *data)
+{
+        host->data = NULL;
+        if (host->use_dma && host->dma_ch != -1)
+                dma_unmap_sg(mmc_dev(host->mmc), data->sg, host->dma_len,
+                        host->dma_dir);
+        host->datadir = OMAP_MMC_DATADIR_NONE;
+        if (!data->error)
+                data->bytes_xfered += data->blocks * (data->blksz);
+        else
+                data->bytes_xfered = 0;
+        if (!data->stop) {
+                host->mrq = NULL;
+                mmc_request_done(host->mmc, data->mrq);
+                return;
+        }
+        mmc_omap_start_command(host, data->stop, NULL);
+}
+/*
+ * Notify the core about command completion
+ */
+static void
+mmc_omap_cmd_done(struct mmc_omap_host *host, struct mmc_command *cmd)
+{
+        host->cmd = NULL;
+        if (cmd->flags & MMC_RSP_PRESENT) {
+                if (cmd->flags & MMC_RSP_136) {
+                        /* response type 2 */
+                        cmd->resp[3] = OMAP_HSMMC_READ(host->base, RSP10);
+                        cmd->resp[2] = OMAP_HSMMC_READ(host->base, RSP32);
+                        cmd->resp[1] = OMAP_HSMMC_READ(host->base, RSP54);
+                        cmd->resp[0] = OMAP_HSMMC_READ(host->base, RSP76);
+                } else {
+                        /* response types 1, 1b, 3, 4, 5, 6 */
+                        cmd->resp[0] = OMAP_HSMMC_READ(host->base, RSP10);
+                }
+        }
+        if (host->data == NULL || cmd->error) {
+                host->mrq = NULL;
+                mmc_request_done(host->mmc, cmd->mrq);
+        }
+}
+/*
+ * DMA clean up for command errors
+ */
+static void mmc_dma_cleanup(struct mmc_omap_host *host)
+{
+        host->data->error = -ETIMEDOUT;
+        if (host->use_dma && host->dma_ch != -1) {
+                dma_unmap_sg(mmc_dev(host->mmc), host->data->sg, host->dma_len,
+                        host->dma_dir);
+                omap_free_dma(host->dma_ch);
+                host->dma_ch = -1;
+                up(&host->sem);
+        }
+        host->data = NULL;
+        host->datadir = OMAP_MMC_DATADIR_NONE;
+}
+/*
+ * Readable error output
+ */
+#ifdef CONFIG_MMC_DEBUG
+static void mmc_omap_report_irq(struct mmc_omap_host *host, u32 status)
+{
+        /* --- means reserved bit without definition at documentation */
+        static const char *mmc_omap_status_bits[] = {
+                "CC", "TC", "BGE", "---", "BWR", "BRR", "---", "---", "CIRQ",
+                "OBI", "---", "---", "---", "---", "---", "ERRI", "CTO", "CCRC",
+                "CEB", "CIE", "DTO", "DCRC", "DEB", "---", "ACE", "---",
+                "---", "---", "---", "CERR", "CERR", "BADA", "---", "---", "---"
+        };
+        char res[256];
+        char *buf = res;
+        int len, i;
+        len = sprintf(buf, "MMC IRQ 0x%x :", status);
+        buf += len;
+        for (i = 0; i < ARRAY_SIZE(mmc_omap_status_bits); i++)
+                if (status & (1 << i)) {
+                        len = sprintf(buf, " %s", mmc_omap_status_bits[i]);
+                        buf += len;
+                }
+        dev_dbg(mmc_dev(host->mmc), "%s\n", res);
+}
+#endif  /* CONFIG_MMC_DEBUG */
+/*
+ * MMC controller IRQ handler
+ */
+static irqreturn_t mmc_omap_irq(int irq, void *dev_id)
+{
+        struct mmc_omap_host *host = dev_id;
+        struct mmc_data *data;
+        int end_cmd = 0, end_trans = 0, status;
+        if (host->cmd == NULL && host->data == NULL) {
+                OMAP_HSMMC_WRITE(host->base, STAT,
+                        OMAP_HSMMC_READ(host->base, STAT));
+                return IRQ_HANDLED;
+        }
+        data = host->data;
+        status = OMAP_HSMMC_READ(host->base, STAT);
+        dev_dbg(mmc_dev(host->mmc), "IRQ Status is %x\n", status);
+        if (status & ERR) {
+#ifdef CONFIG_MMC_DEBUG
+                mmc_omap_report_irq(host, status);
+#endif
+                if ((status & CMD_TIMEOUT) ||
+                        (status & CMD_CRC)) {
+                        if (host->cmd) {
+                                if (status & CMD_TIMEOUT) {
+                                        OMAP_HSMMC_WRITE(host->base, SYSCTL,
+                                                OMAP_HSMMC_READ(host->base,
+                                                                SYSCTL) | SRC);
+                                        while (OMAP_HSMMC_READ(host->base,
+                                                        SYSCTL) & SRC)
+                                                ;
+                                        host->cmd->error = -ETIMEDOUT;
+                                } else {
+                                        host->cmd->error = -EILSEQ;
+                                }
+                                end_cmd = 1;
+                        }
+                        if (host->data)
+                                mmc_dma_cleanup(host);
+                }
+                if ((status & DATA_TIMEOUT) ||
+                        (status & DATA_CRC)) {
+                        if (host->data) {
+                                if (status & DATA_TIMEOUT)
+                                        mmc_dma_cleanup(host);
+                                else
+                                        host->data->error = -EILSEQ;
+                                OMAP_HSMMC_WRITE(host->base, SYSCTL,
+                                        OMAP_HSMMC_READ(host->base,
+                                                        SYSCTL) | SRD);
+                                while (OMAP_HSMMC_READ(host->base,
+                                                SYSCTL) & SRD)
+                                        ;
+                                end_trans = 1;
+                        }
+                }
+                if (status & CARD_ERR) {
+                        dev_dbg(mmc_dev(host->mmc),
+                                "Ignoring card err CMD%d\n", host->cmd->opcode);
+                        if (host->cmd)
+                                end_cmd = 1;
+                        if (host->data)
+                                end_trans = 1;
+                }
+        }
+        OMAP_HSMMC_WRITE(host->base, STAT, status);
+        if (end_cmd || (status & CC))
+                mmc_omap_cmd_done(host, host->cmd);
+        if (end_trans || (status & TC))
+                mmc_omap_xfer_done(host, data);
+        return IRQ_HANDLED;
+}
+/*
+ * Switch MMC operating voltage
+ */
+static int omap_mmc_switch_opcond(struct mmc_omap_host *host, int vdd)
+{
+        u32 reg_val = 0;
+        int ret;
+        /* Disable the clocks */
+        clk_disable(host->fclk);
+        clk_disable(host->iclk);
+        clk_disable(host->dbclk);
+        /* Turn the power off */
+        ret = mmc_slot(host).set_power(host->dev, host->slot_id, 0, 0);
+        if (ret != 0)
+                goto err;
+        /* Turn the power ON with given VDD 1.8 or 3.0v */
+        ret = mmc_slot(host).set_power(host->dev, host->slot_id, 1, vdd);
+        if (ret != 0)
+                goto err;
+        clk_enable(host->fclk);
+        clk_enable(host->iclk);
+        clk_enable(host->dbclk);
+        OMAP_HSMMC_WRITE(host->base, HCTL,
+                OMAP_HSMMC_READ(host->base, HCTL) & SDVSCLR);
+        reg_val = OMAP_HSMMC_READ(host->base, HCTL);
+        /*
+         * If a MMC dual voltage card is detected, the set_ios fn calls
+         * this fn with VDD bit set for 1.8V. Upon card removal from the
+         * slot, omap_mmc_set_ios sets the VDD back to 3V on MMC_POWER_OFF.
+         *
+         * Only MMC1 supports 3.0V.  MMC2 will not function if SDVS30 is
+         * set in HCTL.
+         */
+        if (host->id == OMAP_MMC1_DEVID && (((1 << vdd) == MMC_VDD_32_33) ||
+                                ((1 << vdd) == MMC_VDD_33_34)))
+                reg_val |= SDVS30;
+        if ((1 << vdd) == MMC_VDD_165_195)
+                reg_val |= SDVS18;
+        OMAP_HSMMC_WRITE(host->base, HCTL, reg_val);
+        OMAP_HSMMC_WRITE(host->base, HCTL,
+                OMAP_HSMMC_READ(host->base, HCTL) | SDBP);
+        return 0;
+err:
+        dev_dbg(mmc_dev(host->mmc), "Unable to switch operating voltage\n");
+        return ret;
+}
+/*
+ * Work Item to notify the core about card insertion/removal
+ */
+static void mmc_omap_detect(struct work_struct *work)
+{
+        struct mmc_omap_host *host = container_of(work, struct mmc_omap_host,
+                                                mmc_carddetect_work);
+        sysfs_notify(&host->mmc->class_dev.kobj, NULL, "cover_switch");
+        if (host->carddetect) {
+                mmc_detect_change(host->mmc, (HZ * 200) / 1000);
+        } else {
+                OMAP_HSMMC_WRITE(host->base, SYSCTL,
+                        OMAP_HSMMC_READ(host->base, SYSCTL) | SRD);
+                while (OMAP_HSMMC_READ(host->base, SYSCTL) & SRD)
+                        ;
+                mmc_detect_change(host->mmc, (HZ * 50) / 1000);
+        }
+}
+/*
+ * ISR for handling card insertion and removal
+ */
+static irqreturn_t omap_mmc_cd_handler(int irq, void *dev_id)
+{
+        struct mmc_omap_host *host = (struct mmc_omap_host *)dev_id;
+        host->carddetect = mmc_slot(host).card_detect(irq);
+        schedule_work(&host->mmc_carddetect_work);
+        return IRQ_HANDLED;
+}
+/*
+ * DMA call back function
+ */
+static void mmc_omap_dma_cb(int lch, u16 ch_status, void *data)
+{
+        struct mmc_omap_host *host = data;
+        if (ch_status & OMAP2_DMA_MISALIGNED_ERR_IRQ)
+                dev_dbg(mmc_dev(host->mmc), "MISALIGNED_ADRS_ERR\n");
+        if (host->dma_ch < 0)
+                return;
+        omap_free_dma(host->dma_ch);
+        host->dma_ch = -1;
+        /*
+         * DMA Callback: run in interrupt context.
+         * mutex_unlock will through a kernel warning if used.
+         */
+        up(&host->sem);
+}
+/*
+ * Configure dma src and destination parameters
+ */
+static int mmc_omap_config_dma_param(int sync_dir, struct mmc_omap_host *host,
+                                struct mmc_data *data)
+{
+        if (sync_dir == 0) {
+                omap_set_dma_dest_params(host->dma_ch, 0,
+                        OMAP_DMA_AMODE_CONSTANT,
+                        (host->mapbase + OMAP_HSMMC_DATA), 0, 0);
+                omap_set_dma_src_params(host->dma_ch, 0,
+                        OMAP_DMA_AMODE_POST_INC,
+                        sg_dma_address(&data->sg[0]), 0, 0);
+        } else {
+                omap_set_dma_src_params(host->dma_ch, 0,
+                        OMAP_DMA_AMODE_CONSTANT,
+                        (host->mapbase + OMAP_HSMMC_DATA), 0, 0);
+                omap_set_dma_dest_params(host->dma_ch, 0,
+                        OMAP_DMA_AMODE_POST_INC,
+                        sg_dma_address(&data->sg[0]), 0, 0);
+        }
+        return 0;
+}
+/*
+ * Routine to configure and start DMA for the MMC card
+ */
+static int
+mmc_omap_start_dma_transfer(struct mmc_omap_host *host, struct mmc_request *req)
+{
+        int sync_dev, sync_dir = 0;
+        int dma_ch = 0, ret = 0, err = 1;
+        struct mmc_data *data = req->data;
+        /*
+         * If for some reason the DMA transfer is still active,
+         * we wait for timeout period and free the dma
+         */
+        if (host->dma_ch != -1) {
+                set_current_state(TASK_UNINTERRUPTIBLE);
+                schedule_timeout(100);
+                if (down_trylock(&host->sem)) {
+                        omap_free_dma(host->dma_ch);
+                        host->dma_ch = -1;
+                        up(&host->sem);
+                        return err;
+                }
+        } else {
+                if (down_trylock(&host->sem))
+                        return err;
+        }
+        if (!(data->flags & MMC_DATA_WRITE)) {
+                host->dma_dir = DMA_FROM_DEVICE;
+                if (host->id == OMAP_MMC1_DEVID)
+                        sync_dev = OMAP24XX_DMA_MMC1_RX;
+                else
+                        sync_dev = OMAP24XX_DMA_MMC2_RX;
+        } else {
+                host->dma_dir = DMA_TO_DEVICE;
+                if (host->id == OMAP_MMC1_DEVID)
+                        sync_dev = OMAP24XX_DMA_MMC1_TX;
+                else
+                        sync_dev = OMAP24XX_DMA_MMC2_TX;
+        }
+        ret = omap_request_dma(sync_dev, "MMC/SD", mmc_omap_dma_cb,
+                        host, &dma_ch);
+        if (ret != 0) {
+                dev_dbg(mmc_dev(host->mmc),
+                        "%s: omap_request_dma() failed with %d\n",
+                        mmc_hostname(host->mmc), ret);
+                return ret;
+        }
+        host->dma_len = dma_map_sg(mmc_dev(host->mmc), data->sg,
+                        data->sg_len, host->dma_dir);
+        host->dma_ch = dma_ch;
+        if (!(data->flags & MMC_DATA_WRITE))
+                mmc_omap_config_dma_param(1, host, data);
+        else
+                mmc_omap_config_dma_param(0, host, data);
+        if ((data->blksz % 4) == 0)
+                omap_set_dma_transfer_params(dma_ch, OMAP_DMA_DATA_TYPE_S32,
+                        (data->blksz / 4), data->blocks, OMAP_DMA_SYNC_FRAME,
+                        sync_dev, sync_dir);
+        else
+                /* REVISIT: The MMC buffer increments only when MSB is written.
+                 * Return error for blksz which is non multiple of four.
+                 */
+                return -EINVAL;
+        omap_start_dma(dma_ch);
+        return 0;
+}
+static void set_data_timeout(struct mmc_omap_host *host,
+                             struct mmc_request *req)
+{
+        unsigned int timeout, cycle_ns;
+        uint32_t reg, clkd, dto = 0;
+        reg = OMAP_HSMMC_READ(host->base, SYSCTL);
+        clkd = (reg & CLKD_MASK) >> CLKD_SHIFT;
+        if (clkd == 0)
+                clkd = 1;
+        cycle_ns = 1000000000 / (clk_get_rate(host->fclk) / clkd);
+        timeout = req->data->timeout_ns / cycle_ns;
+        timeout += req->data->timeout_clks;
+        if (timeout) {
+                while ((timeout & 0x80000000) == 0) {
+                        dto += 1;
+                        timeout <<= 1;
+                }
+                dto = 31 - dto;
+                timeout <<= 1;
+                if (timeout && dto)
+                        dto += 1;
+                if (dto >= 13)
+                        dto -= 13;
+                else
+                        dto = 0;
+                if (dto > 14)
+                        dto = 14;
+        }
+        reg &= ~DTO_MASK;
+        reg |= dto << DTO_SHIFT;
+        OMAP_HSMMC_WRITE(host->base, SYSCTL, reg);
+}
+/*
+ * Configure block length for MMC/SD cards and initiate the transfer.
+ */
+static int
+mmc_omap_prepare_data(struct mmc_omap_host *host, struct mmc_request *req)
+{
+        int ret;
+        host->data = req->data;
+        if (req->data == NULL) {
+                host->datadir = OMAP_MMC_DATADIR_NONE;
+                OMAP_HSMMC_WRITE(host->base, BLK, 0);
+                return 0;
+        }
+        OMAP_HSMMC_WRITE(host->base, BLK, (req->data->blksz)
+                                        | (req->data->blocks << 16));
+        set_data_timeout(host, req);
+        host->datadir = (req->data->flags & MMC_DATA_WRITE) ?
+                        OMAP_MMC_DATADIR_WRITE : OMAP_MMC_DATADIR_READ;
+        if (host->use_dma) {
+                ret = mmc_omap_start_dma_transfer(host, req);
+                if (ret != 0) {
+                        dev_dbg(mmc_dev(host->mmc), "MMC start dma failure\n");
+                        return ret;
+                }
+        }
+        return 0;
+}
+/*
+ * Request function. for read/write operation
+ */
+static void omap_mmc_request(struct mmc_host *mmc, struct mmc_request *req)
+{
+        struct mmc_omap_host *host = mmc_priv(mmc);
+        WARN_ON(host->mrq != NULL);
+        host->mrq = req;
+        mmc_omap_prepare_data(host, req);
+        mmc_omap_start_command(host, req->cmd, req->data);
+}
+/* Routine to configure clock values. Exposed API to core */
+static void omap_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+{
+        struct mmc_omap_host *host = mmc_priv(mmc);
+        u16 dsor = 0;
+        unsigned long regval;
+        unsigned long timeout;
+        switch (ios->power_mode) {
+        case MMC_POWER_OFF:
+                mmc_slot(host).set_power(host->dev, host->slot_id, 0, 0);
+                /*
+                 * Reset bus voltage to 3V if it got set to 1.8V earlier.
+                 * REVISIT: If we are able to detect cards after unplugging
+                 * a 1.8V card, this code should not be needed.
+                 */
+                if (!(OMAP_HSMMC_READ(host->base, HCTL) & SDVSDET)) {
+                        int vdd = fls(host->mmc->ocr_avail) - 1;
+                        if (omap_mmc_switch_opcond(host, vdd) != 0)
+                                host->mmc->ios.vdd = vdd;
+                }
+                break;
+        case MMC_POWER_UP:
+                mmc_slot(host).set_power(host->dev, host->slot_id, 1, ios->vdd);
+                break;
+        }
+        switch (mmc->ios.bus_width) {
+        case MMC_BUS_WIDTH_4:
+                OMAP_HSMMC_WRITE(host->base, HCTL,
+                        OMAP_HSMMC_READ(host->base, HCTL) | FOUR_BIT);
+                break;
+        case MMC_BUS_WIDTH_1:
+                OMAP_HSMMC_WRITE(host->base, HCTL,
+                        OMAP_HSMMC_READ(host->base, HCTL) & ~FOUR_BIT);
+                break;
+        }
+        if (host->id == OMAP_MMC1_DEVID) {
+                /* Only MMC1 can operate at 3V/1.8V */
+                if ((OMAP_HSMMC_READ(host->base, HCTL) & SDVSDET) &&
+                        (ios->vdd == DUAL_VOLT_OCR_BIT)) {
+                                /*
+                                 * The mmc_select_voltage fn of the core does
+                                 * not seem to set the power_mode to
+                                 * MMC_POWER_UP upon recalculating the voltage.
+                                 * vdd 1.8v.
+                                 */
+                                if (omap_mmc_switch_opcond(host, ios->vdd) != 0)
+                                        dev_dbg(mmc_dev(host->mmc),
+                                                "Switch operation failed\n");
+                }
+        }
+        if (ios->clock) {
+                dsor = OMAP_MMC_MASTER_CLOCK / ios->clock;
+                if (dsor < 1)
+                        dsor = 1;
+                if (OMAP_MMC_MASTER_CLOCK / dsor > ios->clock)
+                        dsor++;
+                if (dsor > 250)
+                        dsor = 250;
+        }
+        omap_mmc_stop_clock(host);
+        regval = OMAP_HSMMC_READ(host->base, SYSCTL);
+        regval = regval & ~(CLKD_MASK);
+        regval = regval | (dsor << 6) | (DTO << 16);
+        OMAP_HSMMC_WRITE(host->base, SYSCTL, regval);
+        OMAP_HSMMC_WRITE(host->base, SYSCTL,
+                OMAP_HSMMC_READ(host->base, SYSCTL) | ICE);
+        /* Wait till the ICS bit is set */
+        timeout = jiffies + msecs_to_jiffies(MMC_TIMEOUT_MS);
+        while ((OMAP_HSMMC_READ(host->base, SYSCTL) & ICS) != 0x2
+                && time_before(jiffies, timeout))
+                msleep(1);
+        OMAP_HSMMC_WRITE(host->base, SYSCTL,
+                OMAP_HSMMC_READ(host->base, SYSCTL) | CEN);
+        if (ios->power_mode == MMC_POWER_ON)
+                send_init_stream(host);
+        if (ios->bus_mode == MMC_BUSMODE_OPENDRAIN)
+                OMAP_HSMMC_WRITE(host->base, CON,
+                                OMAP_HSMMC_READ(host->base, CON) | OD);
+}
+static int omap_hsmmc_get_cd(struct mmc_host *mmc)
+{
+        struct mmc_omap_host *host = mmc_priv(mmc);
+        struct omap_mmc_platform_data *pdata = host->pdata;
+        if (!pdata->slots[0].card_detect)
+                return -ENOSYS;
+        return pdata->slots[0].card_detect(pdata->slots[0].card_detect_irq);
+}
+static int omap_hsmmc_get_ro(struct mmc_host *mmc)
+{
+        struct mmc_omap_host *host = mmc_priv(mmc);
+        struct omap_mmc_platform_data *pdata = host->pdata;
+        if (!pdata->slots[0].get_ro)
+                return -ENOSYS;
+        return pdata->slots[0].get_ro(host->dev, 0);
+}
+static struct mmc_host_ops mmc_omap_ops = {
+        .request = omap_mmc_request,
+        .set_ios = omap_mmc_set_ios,
+        .get_cd = omap_hsmmc_get_cd,
+        .get_ro = omap_hsmmc_get_ro,
+        /* NYET -- enable_sdio_irq */
+};
+static int __init omap_mmc_probe(struct platform_device *pdev)
+{
+        struct omap_mmc_platform_data *pdata = pdev->dev.platform_data;
+        struct mmc_host *mmc;
+        struct mmc_omap_host *host = NULL;
+        struct resource *res;
+        int ret = 0, irq;
+        u32 hctl, capa;
+        if (pdata == NULL) {
+                dev_err(&pdev->dev, "Platform Data is missing\n");
+                return -ENXIO;
+        }
+        if (pdata->nr_slots == 0) {
+                dev_err(&pdev->dev, "No Slots\n");
+                return -ENXIO;
+        }
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        irq = platform_get_irq(pdev, 0);
+        if (res == NULL || irq < 0)
+                return -ENXIO;
+        res = request_mem_region(res->start, res->end - res->start + 1,
+                                                        pdev->name);
+        if (res == NULL)
+                return -EBUSY;
+        mmc = mmc_alloc_host(sizeof(struct mmc_omap_host), &pdev->dev);
+        if (!mmc) {
+                ret = -ENOMEM;
+                goto err;
+        }
+        host            = mmc_priv(mmc);
+        host->mmc       = mmc;
+        host->pdata     = pdata;
+        host->dev       = &pdev->dev;
+        host->use_dma   = 1;
+        host->dev->dma_mask = &pdata->dma_mask;
+        host->dma_ch    = -1;
+        host->irq       = irq;
+        host->id        = pdev->id;
+        host->slot_id   = 0;
+        host->mapbase   = res->start;
+        host->base      = ioremap(host->mapbase, SZ_4K);
+        platform_set_drvdata(pdev, host);
+        INIT_WORK(&host->mmc_carddetect_work, mmc_omap_detect);
+        mmc->ops        = &mmc_omap_ops;
+        mmc->f_min      = 400000;
+        mmc->f_max      = 52000000;
+        sema_init(&host->sem, 1);
+        host->iclk = clk_get(&pdev->dev, "mmchs_ick");
+        if (IS_ERR(host->iclk)) {
+                ret = PTR_ERR(host->iclk);
+                host->iclk = NULL;
+                goto err1;
+        }
+        host->fclk = clk_get(&pdev->dev, "mmchs_fck");
+        if (IS_ERR(host->fclk)) {
+                ret = PTR_ERR(host->fclk);
+                host->fclk = NULL;
+                clk_put(host->iclk);
+                goto err1;
+        }
+        if (clk_enable(host->fclk) != 0) {
+                clk_put(host->iclk);
+                clk_put(host->fclk);
+                goto err1;
+        }
+        if (clk_enable(host->iclk) != 0) {
+                clk_disable(host->fclk);
+                clk_put(host->iclk);
+                clk_put(host->fclk);
+                goto err1;
+        }
+        host->dbclk = clk_get(&pdev->dev, "mmchsdb_fck");
+        /*
+         * MMC can still work without debounce clock.
+         */
+        if (IS_ERR(host->dbclk))
+                dev_warn(mmc_dev(host->mmc), "Failed to get debounce clock\n");
+        else
+                if (clk_enable(host->dbclk) != 0)
+                        dev_dbg(mmc_dev(host->mmc), "Enabling debounce"
+                                                        " clk failed\n");
+                else
+                        host->dbclk_enabled = 1;
+#ifdef CONFIG_MMC_BLOCK_BOUNCE
+        mmc->max_phys_segs = 1;
+        mmc->max_hw_segs = 1;
+#endif
+        mmc->max_blk_size = 512;       /* Block Length at max can be 1024 */
+        mmc->max_blk_count = 0xFFFF;    /* No. of Blocks is 16 bits */
+        mmc->max_req_size = mmc->max_blk_size * mmc->max_blk_count;
+        mmc->max_seg_size = mmc->max_req_size;
+        mmc->ocr_avail = mmc_slot(host).ocr_mask;
+        mmc->caps |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED;
+        if (pdata->slots[host->slot_id].wires >= 4)
+                mmc->caps |= MMC_CAP_4_BIT_DATA;
+        /* Only MMC1 supports 3.0V */
+        if (host->id == OMAP_MMC1_DEVID) {
+                hctl = SDVS30;
+                capa = VS30 | VS18;
+        } else {
+                hctl = SDVS18;
+                capa = VS18;
+        }
+        OMAP_HSMMC_WRITE(host->base, HCTL,
+                        OMAP_HSMMC_READ(host->base, HCTL) | hctl);
+        OMAP_HSMMC_WRITE(host->base, CAPA,
+                        OMAP_HSMMC_READ(host->base, CAPA) | capa);
+        /* Set the controller to AUTO IDLE mode */
+        OMAP_HSMMC_WRITE(host->base, SYSCONFIG,
+                        OMAP_HSMMC_READ(host->base, SYSCONFIG) | AUTOIDLE);
+        /* Set SD bus power bit */
+        OMAP_HSMMC_WRITE(host->base, HCTL,
+                        OMAP_HSMMC_READ(host->base, HCTL) | SDBP);
+        /* Request IRQ for MMC operations */
+        ret = request_irq(host->irq, mmc_omap_irq, IRQF_DISABLED,
+                        mmc_hostname(mmc), host);
+        if (ret) {
+                dev_dbg(mmc_dev(host->mmc), "Unable to grab HSMMC IRQ\n");
+                goto err_irq;
+        }
+        if (pdata->init != NULL) {
+                if (pdata->init(&pdev->dev) != 0) {
+                        dev_dbg(mmc_dev(host->mmc),
+                                "Unable to configure MMC IRQs\n");
+                        goto err_irq_cd_init;
+                }
+        }
+        /* Request IRQ for card detect */
+        if ((mmc_slot(host).card_detect_irq) && (mmc_slot(host).card_detect)) {
+                ret = request_irq(mmc_slot(host).card_detect_irq,
+                                  omap_mmc_cd_handler,
+                                  IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING
+                                          | IRQF_DISABLED,
+                                  mmc_hostname(mmc), host);
+                if (ret) {
+                        dev_dbg(mmc_dev(host->mmc),
+                                "Unable to grab MMC CD IRQ\n");
+                        goto err_irq_cd;
+                }
+        }
+        OMAP_HSMMC_WRITE(host->base, ISE, INT_EN_MASK);
+        OMAP_HSMMC_WRITE(host->base, IE, INT_EN_MASK);
+        mmc_add_host(mmc);
+        if (host->pdata->slots[host->slot_id].name != NULL) {
+                ret = device_create_file(&mmc->class_dev, &dev_attr_slot_name);
+                if (ret < 0)
+                        goto err_slot_name;
+        }
+        if (mmc_slot(host).card_detect_irq && mmc_slot(host).card_detect &&
+                        host->pdata->slots[host->slot_id].get_cover_state) {
+                ret = device_create_file(&mmc->class_dev,
+                                        &dev_attr_cover_switch);
+                if (ret < 0)
+                        goto err_cover_switch;
+        }
+        return 0;
+err_cover_switch:
+        device_remove_file(&mmc->class_dev, &dev_attr_cover_switch);
+err_slot_name:
+        mmc_remove_host(mmc);
+err_irq_cd:
+        free_irq(mmc_slot(host).card_detect_irq, host);
+err_irq_cd_init:
+        free_irq(host->irq, host);
+err_irq:
+        clk_disable(host->fclk);
+        clk_disable(host->iclk);
+        clk_put(host->fclk);
+        clk_put(host->iclk);
+        if (host->dbclk_enabled) {
+                clk_disable(host->dbclk);
+                clk_put(host->dbclk);
+        }
+err1:
+        iounmap(host->base);
+err:
+        dev_dbg(mmc_dev(host->mmc), "Probe Failed\n");
+        release_mem_region(res->start, res->end - res->start + 1);
+        if (host)
+                mmc_free_host(mmc);
+        return ret;
+}
+static int omap_mmc_remove(struct platform_device *pdev)
+{
+        struct mmc_omap_host *host = platform_get_drvdata(pdev);
+        struct resource *res;
+        if (host) {
+                mmc_remove_host(host->mmc);
+                if (host->pdata->cleanup)
+                        host->pdata->cleanup(&pdev->dev);
+                free_irq(host->irq, host);
+                if (mmc_slot(host).card_detect_irq)
+                        free_irq(mmc_slot(host).card_detect_irq, host);
+                flush_scheduled_work();
+                clk_disable(host->fclk);
+                clk_disable(host->iclk);
+                clk_put(host->fclk);
+                clk_put(host->iclk);
+                if (host->dbclk_enabled) {
+                        clk_disable(host->dbclk);
+                        clk_put(host->dbclk);
+                }
+                mmc_free_host(host->mmc);
+                iounmap(host->base);
+        }
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (res)
+                release_mem_region(res->start, res->end - res->start + 1);
+        platform_set_drvdata(pdev, NULL);
+        return 0;
+}
+#ifdef CONFIG_PM
+static int omap_mmc_suspend(struct platform_device *pdev, pm_message_t state)
+{
+        int ret = 0;
+        struct mmc_omap_host *host = platform_get_drvdata(pdev);
+        if (host && host->suspended)
+                return 0;
+        if (host) {
+                ret = mmc_suspend_host(host->mmc, state);
+                if (ret == 0) {
+                        host->suspended = 1;
+                        OMAP_HSMMC_WRITE(host->base, ISE, 0);
+                        OMAP_HSMMC_WRITE(host->base, IE, 0);
+                        if (host->pdata->suspend) {
+                                ret = host->pdata->suspend(&pdev->dev,
+                                                                host->slot_id);
+                                if (ret)
+                                        dev_dbg(mmc_dev(host->mmc),
+                                                "Unable to handle MMC board"
+                                                " level suspend\n");
+                        }
+                        if (!(OMAP_HSMMC_READ(host->base, HCTL) & SDVSDET)) {
+                                OMAP_HSMMC_WRITE(host->base, HCTL,
+                                        OMAP_HSMMC_READ(host->base, HCTL)
+                                        & SDVSCLR);
+                                OMAP_HSMMC_WRITE(host->base, HCTL,
+                                        OMAP_HSMMC_READ(host->base, HCTL)
+                                        | SDVS30);
+                                OMAP_HSMMC_WRITE(host->base, HCTL,
+                                        OMAP_HSMMC_READ(host->base, HCTL)
+                                        | SDBP);
+                        }
+                        clk_disable(host->fclk);
+                        clk_disable(host->iclk);
+                        clk_disable(host->dbclk);
+                }
+        }
+        return ret;
+}
+/* Routine to resume the MMC device */
+static int omap_mmc_resume(struct platform_device *pdev)
+{
+        int ret = 0;
+        struct mmc_omap_host *host = platform_get_drvdata(pdev);
+        if (host && !host->suspended)
+                return 0;
+        if (host) {
+                ret = clk_enable(host->fclk);
+                if (ret)
+                        goto clk_en_err;
+                ret = clk_enable(host->iclk);
+                if (ret) {
+                        clk_disable(host->fclk);
+                        clk_put(host->fclk);
+                        goto clk_en_err;
+                }
+                if (clk_enable(host->dbclk) != 0)
+                        dev_dbg(mmc_dev(host->mmc),
+                                        "Enabling debounce clk failed\n");
+                if (host->pdata->resume) {
+                        ret = host->pdata->resume(&pdev->dev, host->slot_id);
+                        if (ret)
+                                dev_dbg(mmc_dev(host->mmc),
+                                        "Unmask interrupt failed\n");
+                }
+                /* Notify the core to resume the host */
+                ret = mmc_resume_host(host->mmc);
+                if (ret == 0)
+                        host->suspended = 0;
+        }
+        return ret;
+clk_en_err:
+        dev_dbg(mmc_dev(host->mmc),
+                "Failed to enable MMC clocks during resume\n");
+        return ret;
+}
+#else
+#define omap_mmc_suspend        NULL
+#define omap_mmc_resume         NULL
+#endif
+static struct platform_driver omap_mmc_driver = {
+        .probe          = omap_mmc_probe,
+        .remove         = omap_mmc_remove,
+        .suspend        = omap_mmc_suspend,
+        .resume         = omap_mmc_resume,
+        .driver         = {
+                .name = DRIVER_NAME,
+                .owner = THIS_MODULE,
+        },
+};
+static int __init omap_mmc_init(void)
+{
+        /* Register the MMC driver */
+        return platform_driver_register(&omap_mmc_driver);
+}
+static void __exit omap_mmc_cleanup(void)
+{
+        /* Unregister MMC driver */
+        platform_driver_unregister(&omap_mmc_driver);
+}
+module_init(omap_mmc_init);
+module_exit(omap_mmc_cleanup);
+MODULE_DESCRIPTION("OMAP High Speed Multimedia Card driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:" DRIVER_NAME);
+MODULE_AUTHOR("Texas Instruments Inc");
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index 3c5483b75da4..9702ad3774cf 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -180,7 +180,15 @@ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data)
        else
                DALGN &= ~(1 << host->dma);
        DDADR(host->dma) = host->sg_dma;
-        DCSR(host->dma) = DCSR_RUN;
+        /*
+         * workaround for erratum #91:
+         * only start DMA now if we are doing a read,
+         * otherwise we wait until CMD/RESP has finished
+         * before starting DMA.
+         */
+        if (!cpu_is_pxa27x() || data->flags & MMC_DATA_READ)
+                DCSR(host->dma) = DCSR_RUN;
 }
 static void pxamci_start_cmd(struct pxamci_host *host, struct mmc_command *cmd, unsigned int cmdat)
@@ -251,23 +259,28 @@ static int pxamci_cmd_done(struct pxamci_host *host, unsigned int stat)
        if (stat & STAT_TIME_OUT_RESPONSE) {
                cmd->error = -ETIMEDOUT;
        } else if (stat & STAT_RES_CRC_ERR && cmd->flags & MMC_RSP_CRC) {
-#ifdef CONFIG_PXA27x
                /*
                 * workaround for erratum #42:
                 * Intel PXA27x Family Processor Specification Update Rev 001
                 * A bogus CRC error can appear if the msb of a 136 bit
                 * response is a one.
                 */
-                if (cmd->flags & MMC_RSP_136 && cmd->resp[0] & 0x80000000) {
+                if (cpu_is_pxa27x() &&
+                    (cmd->flags & MMC_RSP_136 && cmd->resp[0] & 0x80000000))
                        pr_debug("ignoring CRC from command %d - *risky*\n", cmd->opcode);
-                } else
+                else
-#endif
+                        cmd->error = -EILSEQ;
-                cmd->error = -EILSEQ;
        }
        pxamci_disable_irq(host, END_CMD_RES);
        if (host->data && !cmd->error) {
                pxamci_enable_irq(host, DATA_TRAN_DONE);
+                /*
+                 * workaround for erratum #91, if doing write
+                 * enable DMA late
+                 */
+                if (cpu_is_pxa27x() && host->data->flags & MMC_DATA_WRITE)
+                        DCSR(host->dma) = DCSR_RUN;
        } else {
                pxamci_finish_request(host, host->mrq);
        }
diff --git a/drivers/mmc/host/ricoh_mmc.c b/drivers/mmc/host/ricoh_mmc.c
index be9e7b32b34e..f62790513322 100644
--- a/drivers/mmc/host/ricoh_mmc.c
+++ b/drivers/mmc/host/ricoh_mmc.c
@@ -196,7 +196,7 @@ static void __devexit ricoh_mmc_remove(struct pci_dev *pdev)
        pci_set_drvdata(pdev, NULL);
 }
-static int ricoh_mmc_suspend(struct pci_dev *pdev, pm_message_t state)
+static int ricoh_mmc_suspend_late(struct pci_dev *pdev, pm_message_t state)
 {
        struct pci_dev *fw_dev = NULL;
@@ -210,7 +210,7 @@ static int ricoh_mmc_suspend(struct pci_dev *pdev, pm_message_t state)
        return 0;
 }
-static int ricoh_mmc_resume(struct pci_dev *pdev)
+static int ricoh_mmc_resume_early(struct pci_dev *pdev)
 {
        struct pci_dev *fw_dev = NULL;
@@ -229,8 +229,8 @@ static struct pci_driver ricoh_mmc_driver = {
        .id_table =     pci_ids,
        .probe =        ricoh_mmc_probe,
        .remove =       __devexit_p(ricoh_mmc_remove),
-        .suspend =      ricoh_mmc_suspend,
+        .suspend_late = ricoh_mmc_suspend_late,
-        .resume =       ricoh_mmc_resume,
+        .resume_early = ricoh_mmc_resume_early,
 };
 /*****************************************************************************\
diff --git a/drivers/mmc/host/s3cmci.c b/drivers/mmc/host/s3cmci.c
index fcc98a4cce3c..35a98eec7414 100644
--- a/drivers/mmc/host/s3cmci.c
+++ b/drivers/mmc/host/s3cmci.c
@@ -20,7 +20,7 @@
 #include <linux/irq.h>
 #include <linux/io.h>
-#include <asm/dma.h>
+#include <mach/dma.h>
 #include <mach/regs-sdi.h>
 #include <mach/regs-gpio.h>
diff --git a/drivers/mtd/maps/sa1100-flash.c b/drivers/mtd/maps/sa1100-flash.c
index 7df6bbf0e4d9..6f6a0f6dafd6 100644
--- a/drivers/mtd/maps/sa1100-flash.c
+++ b/drivers/mtd/maps/sa1100-flash.c
@@ -453,7 +453,7 @@ static struct platform_driver sa1100_mtd_driver = {
        .resume         = sa1100_mtd_resume,
        .shutdown       = sa1100_mtd_shutdown,
        .driver         = {
-                .name   = "flash",
+                .name   = "sa1100-mtd",
                .owner  = THIS_MODULE,
        },
 };
@@ -474,4 +474,4 @@ module_exit(sa1100_mtd_exit);
 MODULE_AUTHOR("Nicolas Pitre");
 MODULE_DESCRIPTION("SA1100 CFI map driver");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:flash");
+MODULE_ALIAS("platform:sa1100-mtd");
diff --git a/drivers/mtd/nand/fsl_elbc_nand.c b/drivers/mtd/nand/fsl_elbc_nand.c
index 65929db29446..1f6eb2578717 100644
--- a/drivers/mtd/nand/fsl_elbc_nand.c
+++ b/drivers/mtd/nand/fsl_elbc_nand.c
@@ -676,7 +676,7 @@ static int fsl_elbc_chip_init_tail(struct mtd_info *mtd)
        dev_dbg(ctrl->dev, "fsl_elbc_init: nand->numchips = %d\n",
                chip->numchips);
-        dev_dbg(ctrl->dev, "fsl_elbc_init: nand->chipsize = %ld\n",
+        dev_dbg(ctrl->dev, "fsl_elbc_init: nand->chipsize = %lld\n",
                chip->chipsize);
        dev_dbg(ctrl->dev, "fsl_elbc_init: nand->pagemask = %8x\n",
                chip->pagemask);
@@ -703,7 +703,7 @@ static int fsl_elbc_chip_init_tail(struct mtd_info *mtd)
        dev_dbg(ctrl->dev, "fsl_elbc_init: nand->ecc.layout = %p\n",
                chip->ecc.layout);
        dev_dbg(ctrl->dev, "fsl_elbc_init: mtd->flags = %08x\n", mtd->flags);
-        dev_dbg(ctrl->dev, "fsl_elbc_init: mtd->size = %d\n", mtd->size);
+        dev_dbg(ctrl->dev, "fsl_elbc_init: mtd->size = %lld\n", mtd->size);
        dev_dbg(ctrl->dev, "fsl_elbc_init: mtd->erasesize = %d\n",
                mtd->erasesize);
        dev_dbg(ctrl->dev, "fsl_elbc_init: mtd->writesize = %d\n",
@@ -932,8 +932,8 @@ static int __devinit fsl_elbc_chip_probe(struct fsl_elbc_ctrl *ctrl,
 #endif
                add_mtd_device(&priv->mtd);
-        printk(KERN_INFO "eLBC NAND device at 0x%zx, bank %d\n",
+        printk(KERN_INFO "eLBC NAND device at 0x%llx, bank %d\n",
-               res.start, priv->bank);
+               (unsigned long long)res.start, priv->bank);
        return 0;
 err:
diff --git a/drivers/mtd/nand/pasemi_nand.c b/drivers/mtd/nand/pasemi_nand.c
index 9bd6c9ac8443..a8b9376cf324 100644
--- a/drivers/mtd/nand/pasemi_nand.c
+++ b/drivers/mtd/nand/pasemi_nand.c
@@ -107,7 +107,7 @@ static int __devinit pasemi_nand_probe(struct of_device *ofdev,
        if (pasemi_nand_mtd)
                return -ENODEV;
-        pr_debug("pasemi_nand at %lx-%lx\n", res.start, res.end);
+        pr_debug("pasemi_nand at %llx-%llx\n", res.start, res.end);
        /* Allocate memory for MTD device structure and private data */
        pasemi_nand_mtd = kzalloc(sizeof(struct mtd_info) +
@@ -170,7 +170,7 @@ static int __devinit pasemi_nand_probe(struct of_device *ofdev,
                goto out_lpc;
        }
-        printk(KERN_INFO "PA Semi NAND flash at %08lx, control at I/O %x\n",
+        printk(KERN_INFO "PA Semi NAND flash at %08llx, control at I/O %x\n",
               res.start, lpcctl);
        return 0;
diff --git a/drivers/mtd/onenand/omap2.c b/drivers/mtd/onenand/omap2.c
index 96ecc1766fa8..77a4f1446156 100644
--- a/drivers/mtd/onenand/omap2.c
+++ b/drivers/mtd/onenand/omap2.c
@@ -629,7 +629,7 @@ static int __devinit omap2_onenand_probe(struct platform_device *pdev)
        }
        if (c->gpio_irq) {
-                if ((r = omap_request_gpio(c->gpio_irq)) < 0) {
+                if ((r = gpio_request(c->gpio_irq, "OneNAND irq")) < 0) {
                        dev_err(&pdev->dev,  "Failed to request GPIO%d for "
                                "OneNAND\n", c->gpio_irq);
                        goto err_iounmap;
@@ -726,7 +726,7 @@ err_release_dma:
                free_irq(gpio_to_irq(c->gpio_irq), c);
 err_release_gpio:
        if (c->gpio_irq)
-                omap_free_gpio(c->gpio_irq);
+                gpio_free(c->gpio_irq);
 err_iounmap:
        iounmap(c->onenand.base);
 err_release_mem_region:
@@ -761,7 +761,7 @@ static int __devexit omap2_onenand_remove(struct platform_device *pdev)
        platform_set_drvdata(pdev, NULL);
        if (c->gpio_irq) {
                free_irq(gpio_to_irq(c->gpio_irq), c);
-                omap_free_gpio(c->gpio_irq);
+                gpio_free(c->gpio_irq);
        }
        iounmap(c->onenand.base);
        release_mem_region(c->phys_base, ONENAND_IO_SIZE);
diff --git a/drivers/mtd/ubi/Kconfig.debug b/drivers/mtd/ubi/Kconfig.debug
index 1e2ee22edeff..2246f154e2f7 100644
--- a/drivers/mtd/ubi/Kconfig.debug
+++ b/drivers/mtd/ubi/Kconfig.debug
@@ -33,16 +33,6 @@ config MTD_UBI_DEBUG_DISABLE_BGT
          This option switches the background thread off by default. The thread
          may be also be enabled/disabled via UBI sysfs.
-config MTD_UBI_DEBUG_USERSPACE_IO
-        bool "Direct user-space write/erase support"
-        default n
-        depends on MTD_UBI_DEBUG
-        help
-          By default, users cannot directly write and erase individual
-          eraseblocks of dynamic volumes, and have to use update operation
-          instead. This option enables this capability - it is very useful for
-          debugging and testing.
 config MTD_UBI_DEBUG_EMULATE_BITFLIPS
        bool "Emulate flash bit-flips"
        depends on MTD_UBI_DEBUG
diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
index 9082768cc6c3..4048db83aef6 100644
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -263,8 +263,12 @@ static ssize_t dev_attribute_show(struct device *dev,
        return ret;
 }
-/* Fake "release" method for UBI devices */
+static void dev_release(struct device *dev)
-static void dev_release(struct device *dev) { }
+{
+        struct ubi_device *ubi = container_of(dev, struct ubi_device, dev);
+        kfree(ubi);
+}
 /**
 * ubi_sysfs_init - initialize sysfs for an UBI device.
@@ -380,7 +384,7 @@ static void free_user_volumes(struct ubi_device *ubi)
 */
 static int uif_init(struct ubi_device *ubi)
 {
-        int i, err, do_free = 0;
+        int i, err;
        dev_t dev;
        sprintf(ubi->ubi_name, UBI_NAME_STR "%d", ubi->ubi_num);
@@ -427,13 +431,10 @@ static int uif_init(struct ubi_device *ubi)
 out_volumes:
        kill_volumes(ubi);
-        do_free = 0;
 out_sysfs:
        ubi_sysfs_close(ubi);
        cdev_del(&ubi->cdev);
 out_unreg:
-        if (do_free)
-                free_user_volumes(ubi);
        unregister_chrdev_region(ubi->cdev.dev, ubi->vtbl_slots + 1);
        ubi_err("cannot initialize UBI %s, error %d", ubi->ubi_name, err);
        return err;
@@ -947,6 +948,12 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
        if (ubi->bgt_thread)
                kthread_stop(ubi->bgt_thread);
+        /*
+         * Get a reference to the device in order to prevent 'dev_release()'
+         * from freeing @ubi object.
+         */
+        get_device(&ubi->dev);
        uif_close(ubi);
        ubi_wl_close(ubi);
        free_internal_volumes(ubi);
@@ -958,7 +965,7 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
        vfree(ubi->dbg_peb_buf);
 #endif
        ubi_msg("mtd%d is detached from ubi%d", ubi->mtd->index, ubi->ubi_num);
-        kfree(ubi);
+        put_device(&ubi->dev);
        return 0;
 }
diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
index 98cf31ed0814..e63c8fc3df3a 100644
--- a/drivers/mtd/ubi/cdev.c
+++ b/drivers/mtd/ubi/cdev.c
@@ -40,9 +40,9 @@
 #include <linux/ioctl.h>
 #include <linux/capability.h>
 #include <linux/uaccess.h>
-#include <linux/smp_lock.h>
+#include <linux/compat.h>
+#include <linux/math64.h>
 #include <mtd/ubi-user.h>
-#include <asm/div64.h>
 #include "ubi.h"
 /**
@@ -195,7 +195,6 @@ static ssize_t vol_cdev_read(struct file *file, __user char *buf, size_t count,
        int err, lnum, off, len,  tbuf_size;
        size_t count_save = count;
        void *tbuf;
-        uint64_t tmp;
        dbg_gen("read %zd bytes from offset %lld of volume %d",
                count, *offp, vol->vol_id);
@@ -225,10 +224,7 @@ static ssize_t vol_cdev_read(struct file *file, __user char *buf, size_t count,
                return -ENOMEM;
        len = count > tbuf_size ? tbuf_size : count;
+        lnum = div_u64_rem(*offp, vol->usable_leb_size, &off);
-        tmp = *offp;
-        off = do_div(tmp, vol->usable_leb_size);
-        lnum = tmp;
        do {
                cond_resched();
@@ -263,12 +259,9 @@ static ssize_t vol_cdev_read(struct file *file, __user char *buf, size_t count,
        return err ? err : count_save - count;
 }
-#ifdef CONFIG_MTD_UBI_DEBUG_USERSPACE_IO
 /*
 * This function allows to directly write to dynamic UBI volumes, without
- * issuing the volume update operation. Available only as a debugging feature.
+ * issuing the volume update operation.
- * Very useful for testing UBI.
 */
 static ssize_t vol_cdev_direct_write(struct file *file, const char __user *buf,
                                     size_t count, loff_t *offp)
@@ -279,7 +272,9 @@ static ssize_t vol_cdev_direct_write(struct file *file, const char __user *buf,
        int lnum, off, len, tbuf_size, err = 0;
        size_t count_save = count;
        char *tbuf;
-        uint64_t tmp;
+        if (!vol->direct_writes)
+                return -EPERM;
        dbg_gen("requested: write %zd bytes to offset %lld of volume %u",
                count, *offp, vol->vol_id);
@@ -287,10 +282,7 @@ static ssize_t vol_cdev_direct_write(struct file *file, const char __user *buf,
        if (vol->vol_type == UBI_STATIC_VOLUME)
                return -EROFS;
-        tmp = *offp;
+        lnum = div_u64_rem(*offp, vol->usable_leb_size, &off);
-        off = do_div(tmp, vol->usable_leb_size);
-        lnum = tmp;
        if (off & (ubi->min_io_size - 1)) {
                dbg_err("unaligned position");
                return -EINVAL;
@@ -347,10 +339,6 @@ static ssize_t vol_cdev_direct_write(struct file *file, const char __user *buf,
        return err ? err : count_save - count;
 }
-#else
-#define vol_cdev_direct_write(file, buf, count, offp) (-EPERM)
-#endif /* CONFIG_MTD_UBI_DEBUG_USERSPACE_IO */
 static ssize_t vol_cdev_write(struct file *file, const char __user *buf,
                              size_t count, loff_t *offp)
 {
@@ -402,8 +390,8 @@ static ssize_t vol_cdev_write(struct file *file, const char __user *buf,
        return count;
 }
-static int vol_cdev_ioctl(struct inode *inode, struct file *file,
+static long vol_cdev_ioctl(struct file *file, unsigned int cmd,
-                          unsigned int cmd, unsigned long arg)
+                           unsigned long arg)
 {
        int err = 0;
        struct ubi_volume_desc *desc = file->private_data;
@@ -487,7 +475,6 @@ static int vol_cdev_ioctl(struct inode *inode, struct file *file,
                break;
        }
-#ifdef CONFIG_MTD_UBI_DEBUG_USERSPACE_IO
        /* Logical eraseblock erasure command */
        case UBI_IOCEBER:
        {
@@ -518,13 +505,77 @@ static int vol_cdev_ioctl(struct inode *inode, struct file *file,
                err = ubi_wl_flush(ubi);
                break;
        }
-#endif
+        /* Logical eraseblock map command */
+        case UBI_IOCEBMAP:
+        {
+                struct ubi_map_req req;
+                err = copy_from_user(&req, argp, sizeof(struct ubi_map_req));
+                if (err) {
+                        err = -EFAULT;
+                        break;
+                }
+                err = ubi_leb_map(desc, req.lnum, req.dtype);
+                break;
+        }
+        /* Logical eraseblock un-map command */
+        case UBI_IOCEBUNMAP:
+        {
+                int32_t lnum;
+                err = get_user(lnum, (__user int32_t *)argp);
+                if (err) {
+                        err = -EFAULT;
+                        break;
+                }
+                err = ubi_leb_unmap(desc, lnum);
+                break;
+        }
+        /* Check if logical eraseblock is mapped command */
+        case UBI_IOCEBISMAP:
+        {
+                int32_t lnum;
+                err = get_user(lnum, (__user int32_t *)argp);
+                if (err) {
+                        err = -EFAULT;
+                        break;
+                }
+                err = ubi_is_mapped(desc, lnum);
+                break;
+        }
+        /* Set volume property command*/
+        case UBI_IOCSETPROP:
+        {
+                struct ubi_set_prop_req req;
+                err = copy_from_user(&req, argp,
+                                sizeof(struct ubi_set_prop_req));
+                if (err) {
+                        err = -EFAULT;
+                        break;
+                }
+                switch (req.property) {
+                case UBI_PROP_DIRECT_WRITE:
+                        mutex_lock(&ubi->volumes_mutex);
+                        desc->vol->direct_writes = !!req.value;
+                        mutex_unlock(&ubi->volumes_mutex);
+                        break;
+                default:
+                        err = -EINVAL;
+                        break;
+                }
+                break;
+        }
        default:
                err = -ENOTTY;
                break;
        }
        return err;
 }
@@ -762,8 +813,8 @@ out_free:
        return err;
 }
-static int ubi_cdev_ioctl(struct inode *inode, struct file *file,
+static long ubi_cdev_ioctl(struct file *file, unsigned int cmd,
-                          unsigned int cmd, unsigned long arg)
+                           unsigned long arg)
 {
        int err = 0;
        struct ubi_device *ubi;
@@ -773,7 +824,7 @@ static int ubi_cdev_ioctl(struct inode *inode, struct file *file,
        if (!capable(CAP_SYS_RESOURCE))
                return -EPERM;
-        ubi = ubi_get_by_major(imajor(inode));
+        ubi = ubi_get_by_major(imajor(file->f_mapping->host));
        if (!ubi)
                return -ENODEV;
@@ -843,7 +894,6 @@ static int ubi_cdev_ioctl(struct inode *inode, struct file *file,
        case UBI_IOCRSVOL:
        {
                int pebs;
-                uint64_t tmp;
                struct ubi_rsvol_req req;
                dbg_gen("re-size volume");
@@ -863,9 +913,8 @@ static int ubi_cdev_ioctl(struct inode *inode, struct file *file,
                        break;
                }
-                tmp = req.bytes;
+                pebs = div_u64(req.bytes + desc->vol->usable_leb_size - 1,
-                pebs = !!do_div(tmp, desc->vol->usable_leb_size);
+                               desc->vol->usable_leb_size);
-                pebs += tmp;
                mutex_lock(&ubi->volumes_mutex);
                err = ubi_resize_volume(desc, pebs);
@@ -909,8 +958,8 @@ static int ubi_cdev_ioctl(struct inode *inode, struct file *file,
        return err;
 }
-static int ctrl_cdev_ioctl(struct inode *inode, struct file *file,
+static long ctrl_cdev_ioctl(struct file *file, unsigned int cmd,
-                           unsigned int cmd, unsigned long arg)
+                            unsigned long arg)
 {
        int err = 0;
        void __user *argp = (void __user *)arg;
@@ -986,26 +1035,59 @@ static int ctrl_cdev_ioctl(struct inode *inode, struct file *file,
        return err;
 }
-/* UBI control character device operations */
+#ifdef CONFIG_COMPAT
-struct file_operations ubi_ctrl_cdev_operations = {
+static long vol_cdev_compat_ioctl(struct file *file, unsigned int cmd,
-        .ioctl = ctrl_cdev_ioctl,
+                                  unsigned long arg)
-        .owner = THIS_MODULE,
+{
+        unsigned long translated_arg = (unsigned long)compat_ptr(arg);
+        return vol_cdev_ioctl(file, cmd, translated_arg);
+}
+static long ubi_cdev_compat_ioctl(struct file *file, unsigned int cmd,
+                                  unsigned long arg)
+{
+        unsigned long translated_arg = (unsigned long)compat_ptr(arg);
+        return ubi_cdev_ioctl(file, cmd, translated_arg);
+}
+static long ctrl_cdev_compat_ioctl(struct file *file, unsigned int cmd,
+                                   unsigned long arg)
+{
+        unsigned long translated_arg = (unsigned long)compat_ptr(arg);
+        return ctrl_cdev_ioctl(file, cmd, translated_arg);
+}
+#else
+#define vol_cdev_compat_ioctl  NULL
+#define ubi_cdev_compat_ioctl  NULL
+#define ctrl_cdev_compat_ioctl NULL
+#endif
+/* UBI volume character device operations */
+const struct file_operations ubi_vol_cdev_operations = {
+        .owner          = THIS_MODULE,
+        .open           = vol_cdev_open,
+        .release        = vol_cdev_release,
+        .llseek         = vol_cdev_llseek,
+        .read           = vol_cdev_read,
+        .write          = vol_cdev_write,
+        .unlocked_ioctl = vol_cdev_ioctl,
+        .compat_ioctl   = vol_cdev_compat_ioctl,
 };
 /* UBI character device operations */
-struct file_operations ubi_cdev_operations = {
+const struct file_operations ubi_cdev_operations = {
-        .owner = THIS_MODULE,
+        .owner          = THIS_MODULE,
-        .ioctl = ubi_cdev_ioctl,
+        .llseek         = no_llseek,
-        .llseek = no_llseek,
+        .unlocked_ioctl = ubi_cdev_ioctl,
+        .compat_ioctl   = ubi_cdev_compat_ioctl,
 };
-/* UBI volume character device operations */
+/* UBI control character device operations */
-struct file_operations ubi_vol_cdev_operations = {
+const struct file_operations ubi_ctrl_cdev_operations = {
-        .owner   = THIS_MODULE,
+        .owner          = THIS_MODULE,
-        .open    = vol_cdev_open,
+        .unlocked_ioctl = ctrl_cdev_ioctl,
-        .release = vol_cdev_release,
+        .compat_ioctl   = ctrl_cdev_compat_ioctl,
-        .llseek  = vol_cdev_llseek,
-        .read    = vol_cdev_read,
-        .write   = vol_cdev_write,
-        .ioctl   = vol_cdev_ioctl,
 };
diff --git a/drivers/mtd/ubi/gluebi.c b/drivers/mtd/ubi/gluebi.c
index 6dd4f5e77f82..49cd55ade9c8 100644
--- a/drivers/mtd/ubi/gluebi.c
+++ b/drivers/mtd/ubi/gluebi.c
@@ -28,7 +28,7 @@
 * eraseblock size is equivalent to the logical eraseblock size of the volume.
 */
-#include <asm/div64.h>
+#include <linux/math64.h>
 #include "ubi.h"
 /**
@@ -109,7 +109,6 @@ static int gluebi_read(struct mtd_info *mtd, loff_t from, size_t len,
        int err = 0, lnum, offs, total_read;
        struct ubi_volume *vol;
        struct ubi_device *ubi;
-        uint64_t tmp = from;
        dbg_gen("read %zd bytes from offset %lld", len, from);
@@ -119,9 +118,7 @@ static int gluebi_read(struct mtd_info *mtd, loff_t from, size_t len,
        vol = container_of(mtd, struct ubi_volume, gluebi_mtd);
        ubi = vol->ubi;
-        offs = do_div(tmp, mtd->erasesize);
+        lnum = div_u64_rem(from, mtd->erasesize, &offs);
-        lnum = tmp;
        total_read = len;
        while (total_read) {
                size_t to_read = mtd->erasesize - offs;
@@ -160,7 +157,6 @@ static int gluebi_write(struct mtd_info *mtd, loff_t to, size_t len,
        int err = 0, lnum, offs, total_written;
        struct ubi_volume *vol;
        struct ubi_device *ubi;
-        uint64_t tmp = to;
        dbg_gen("write %zd bytes to offset %lld", len, to);
@@ -173,8 +169,7 @@ static int gluebi_write(struct mtd_info *mtd, loff_t to, size_t len,
        if (ubi->ro_mode)
                return -EROFS;
-        offs = do_div(tmp, mtd->erasesize);
+        lnum = div_u64_rem(to, mtd->erasesize, &offs);
-        lnum = tmp;
        if (len % mtd->writesize || offs % mtd->writesize)
                return -EINVAL;
diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
index ecde202a5a12..c3d653ba5ca0 100644
--- a/drivers/mtd/ubi/scan.c
+++ b/drivers/mtd/ubi/scan.c
@@ -42,7 +42,7 @@
 #include <linux/err.h>
 #include <linux/crc32.h>
-#include <asm/div64.h>
+#include <linux/math64.h>
 #include "ubi.h"
 #ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
@@ -904,10 +904,8 @@ struct ubi_scan_info *ubi_scan(struct ubi_device *ubi)
        dbg_msg("scanning is finished");
        /* Calculate mean erase counter */
-        if (si->ec_count) {
+        if (si->ec_count)
-                do_div(si->ec_sum, si->ec_count);
+                si->mean_ec = div_u64(si->ec_sum, si->ec_count);
-                si->mean_ec = si->ec_sum;
-        }
        if (si->is_empty)
                ubi_msg("empty MTD device detected");
diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h
index 4a8ec485c91d..c055511bb1b2 100644
--- a/drivers/mtd/ubi/ubi.h
+++ b/drivers/mtd/ubi/ubi.h
@@ -206,6 +206,7 @@ struct ubi_volume_desc;
 * @upd_marker: %1 if the update marker is set for this volume
 * @updating: %1 if the volume is being updated
 * @changing_leb: %1 if the atomic LEB change ioctl command is in progress
+ * @direct_writes: %1 if direct writes are enabled for this volume
 *
 * @gluebi_desc: gluebi UBI volume descriptor
 * @gluebi_refcount: reference count of the gluebi MTD device
@@ -253,6 +254,7 @@ struct ubi_volume {
        unsigned int upd_marker:1;
        unsigned int updating:1;
        unsigned int changing_leb:1;
+        unsigned int direct_writes:1;
 #ifdef CONFIG_MTD_UBI_GLUEBI
        /*
@@ -304,7 +306,8 @@ struct ubi_wl_entry;
 * @vtbl_size: size of the volume table in bytes
 * @vtbl: in-RAM volume table copy
 * @volumes_mutex: protects on-flash volume table and serializes volume
- *                 changes, like creation, deletion, update, re-size and re-name
+ *                 changes, like creation, deletion, update, re-size,
+ *                 re-name and set property
 *
 * @max_ec: current highest erase counter value
 * @mean_ec: current mean erase counter value
@@ -449,9 +452,9 @@ struct ubi_device {
 };
 extern struct kmem_cache *ubi_wl_entry_slab;
-extern struct file_operations ubi_ctrl_cdev_operations;
+extern const struct file_operations ubi_ctrl_cdev_operations;
-extern struct file_operations ubi_cdev_operations;
+extern const struct file_operations ubi_cdev_operations;
-extern struct file_operations ubi_vol_cdev_operations;
+extern const struct file_operations ubi_vol_cdev_operations;
 extern struct class *ubi_class;
 extern struct mutex ubi_devices_mutex;
diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c
index 8b89cc18ff0b..6b4d1ae891ae 100644
--- a/drivers/mtd/ubi/upd.c
+++ b/drivers/mtd/ubi/upd.c
@@ -40,7 +40,7 @@
 #include <linux/err.h>
 #include <linux/uaccess.h>
-#include <asm/div64.h>
+#include <linux/math64.h>
 #include "ubi.h"
 /**
@@ -89,7 +89,6 @@ static int clear_update_marker(struct ubi_device *ubi, struct ubi_volume *vol,
                               long long bytes)
 {
        int err;
-        uint64_t tmp;
        struct ubi_vtbl_record vtbl_rec;
        dbg_gen("clear update marker for volume %d", vol->vol_id);
@@ -101,9 +100,9 @@ static int clear_update_marker(struct ubi_device *ubi, struct ubi_volume *vol,
        if (vol->vol_type == UBI_STATIC_VOLUME) {
                vol->corrupted = 0;
-                vol->used_bytes = tmp = bytes;
+                vol->used_bytes = bytes;
-                vol->last_eb_bytes = do_div(tmp, vol->usable_leb_size);
+                vol->used_ebs = div_u64_rem(bytes, vol->usable_leb_size,
-                vol->used_ebs = tmp;
+                                            &vol->last_eb_bytes);
                if (vol->last_eb_bytes)
                        vol->used_ebs += 1;
                else
@@ -131,7 +130,6 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol,
                     long long bytes)
 {
        int i, err;
-        uint64_t tmp;
        dbg_gen("start update of volume %d, %llu bytes", vol->vol_id, bytes);
        ubi_assert(!vol->updating && !vol->changing_leb);
@@ -161,9 +159,8 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol,
        if (!vol->upd_buf)
                return -ENOMEM;
-        tmp = bytes;
+        vol->upd_ebs = div_u64(bytes + vol->usable_leb_size - 1,
-        vol->upd_ebs = !!do_div(tmp, vol->usable_leb_size);
+                               vol->usable_leb_size);
-        vol->upd_ebs += tmp;
        vol->upd_bytes = bytes;
        vol->upd_received = 0;
        return 0;
@@ -282,7 +279,6 @@ static int write_leb(struct ubi_device *ubi, struct ubi_volume *vol, int lnum,
 int ubi_more_update_data(struct ubi_device *ubi, struct ubi_volume *vol,
                         const void __user *buf, int count)
 {
-        uint64_t tmp;
        int lnum, offs, err = 0, len, to_write = count;
        dbg_gen("write %d of %lld bytes, %lld already passed",
@@ -291,10 +287,7 @@ int ubi_more_update_data(struct ubi_device *ubi, struct ubi_volume *vol,
        if (ubi->ro_mode)
                return -EROFS;
-        tmp = vol->upd_received;
+        lnum = div_u64_rem(vol->upd_received,  vol->usable_leb_size, &offs);
-        offs = do_div(tmp, vol->usable_leb_size);
-        lnum = tmp;
        if (vol->upd_received + count > vol->upd_bytes)
                to_write = count = vol->upd_bytes - vol->upd_received;
diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c
index 22e1d7398fce..df5483562b7a 100644
--- a/drivers/mtd/ubi/vmt.c
+++ b/drivers/mtd/ubi/vmt.c
@@ -24,7 +24,7 @@
 */
 #include <linux/err.h>
-#include <asm/div64.h>
+#include <linux/math64.h>
 #include "ubi.h"
 #ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
@@ -205,7 +205,6 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
        int i, err, vol_id = req->vol_id, do_free = 1;
        struct ubi_volume *vol;
        struct ubi_vtbl_record vtbl_rec;
-        uint64_t bytes;
        dev_t dev;
        if (ubi->ro_mode)
@@ -255,10 +254,8 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
        /* Calculate how many eraseblocks are requested */
        vol->usable_leb_size = ubi->leb_size - ubi->leb_size % req->alignment;
-        bytes = req->bytes;
+        vol->reserved_pebs += div_u64(req->bytes + vol->usable_leb_size - 1,
-        if (do_div(bytes, vol->usable_leb_size))
+                                      vol->usable_leb_size);
-                vol->reserved_pebs = 1;
-        vol->reserved_pebs += bytes;
        /* Reserve physical eraseblocks */
        if (vol->reserved_pebs > ubi->avail_pebs) {
@@ -301,10 +298,10 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
                vol->used_bytes =
                        (long long)vol->used_ebs * vol->usable_leb_size;
        } else {
-                bytes = vol->used_bytes;
+                vol->used_ebs = div_u64_rem(vol->used_bytes,
-                vol->last_eb_bytes = do_div(bytes, vol->usable_leb_size);
+                                            vol->usable_leb_size,
-                vol->used_ebs = bytes;
+                                            &vol->last_eb_bytes);
-                if (vol->last_eb_bytes)
+                if (vol->last_eb_bytes != 0)
                        vol->used_ebs += 1;
                else
                        vol->last_eb_bytes = vol->usable_leb_size;
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 9fe8cb7d43ac..6bdfd47d679d 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1829,7 +1829,7 @@ config 68360_ENET
 config FEC
        bool "FEC ethernet controller (of ColdFire CPUs)"
-        depends on M523x || M527x || M5272 || M528x || M520x
+        depends on M523x || M527x || M5272 || M528x || M520x || M532x
        help
          Say Y here if you want to use the built-in 10/100 Fast ethernet
          controller on some Motorola ColdFire processors.
diff --git a/drivers/net/arm/am79c961a.c b/drivers/net/arm/am79c961a.c
index 0c628a9e5339..c2d012fcc29b 100644
--- a/drivers/net/arm/am79c961a.c
+++ b/drivers/net/arm/am79c961a.c
@@ -208,9 +208,9 @@ am79c961_init_for_open(struct net_device *dev)
        /*
         * Stop the chip.
         */
-        spin_lock_irqsave(priv->chip_lock, flags);
+        spin_lock_irqsave(&priv->chip_lock, flags);
        write_rreg (dev->base_addr, CSR0, CSR0_BABL|CSR0_CERR|CSR0_MISS|CSR0_MERR|CSR0_TINT|CSR0_RINT|CSR0_STOP);
-        spin_unlock_irqrestore(priv->chip_lock, flags);
+        spin_unlock_irqrestore(&priv->chip_lock, flags);
        write_ireg (dev->base_addr, 5, 0x00a0); /* Receive address LED */
        write_ireg (dev->base_addr, 6, 0x0081); /* Collision LED */
@@ -332,10 +332,10 @@ am79c961_close(struct net_device *dev)
        netif_stop_queue(dev);
        netif_carrier_off(dev);
-        spin_lock_irqsave(priv->chip_lock, flags);
+        spin_lock_irqsave(&priv->chip_lock, flags);
        write_rreg (dev->base_addr, CSR0, CSR0_STOP);
        write_rreg (dev->base_addr, CSR3, CSR3_MASKALL);
-        spin_unlock_irqrestore(priv->chip_lock, flags);
+        spin_unlock_irqrestore(&priv->chip_lock, flags);
        free_irq (dev->irq, dev);
@@ -391,7 +391,7 @@ static void am79c961_setmulticastlist (struct net_device *dev)
                        am79c961_mc_hash(dmi, multi_hash);
        }
-        spin_lock_irqsave(priv->chip_lock, flags);
+        spin_lock_irqsave(&priv->chip_lock, flags);
        stopped = read_rreg(dev->base_addr, CSR0) & CSR0_STOP;
@@ -405,9 +405,9 @@ static void am79c961_setmulticastlist (struct net_device *dev)
                 * Spin waiting for chip to report suspend mode
                 */
                while ((read_rreg(dev->base_addr, CTRL1) & CTRL1_SPND) == 0) {
-                        spin_unlock_irqrestore(priv->chip_lock, flags);
+                        spin_unlock_irqrestore(&priv->chip_lock, flags);
                        nop();
-                        spin_lock_irqsave(priv->chip_lock, flags);
+                        spin_lock_irqsave(&priv->chip_lock, flags);
                }
        }
@@ -429,7 +429,7 @@ static void am79c961_setmulticastlist (struct net_device *dev)
                write_rreg(dev->base_addr, CTRL1, 0);
        }
-        spin_unlock_irqrestore(priv->chip_lock, flags);
+        spin_unlock_irqrestore(&priv->chip_lock, flags);
 }
 static void am79c961_timeout(struct net_device *dev)
@@ -467,10 +467,10 @@ am79c961_sendpacket(struct sk_buff *skb, struct net_device *dev)
        am_writeword (dev, hdraddr + 2, TMD_OWN|TMD_STP|TMD_ENP);
        priv->txhead = head;
-        spin_lock_irqsave(priv->chip_lock, flags);
+        spin_lock_irqsave(&priv->chip_lock, flags);
        write_rreg (dev->base_addr, CSR0, CSR0_TDMD|CSR0_IENA);
        dev->trans_start = jiffies;
-        spin_unlock_irqrestore(priv->chip_lock, flags);
+        spin_unlock_irqrestore(&priv->chip_lock, flags);
        /*
         * If the next packet is owned by the ethernet device,
diff --git a/drivers/net/arm/etherh.c b/drivers/net/arm/etherh.c
index d15d8b79d8e5..54b52e5b1821 100644
--- a/drivers/net/arm/etherh.c
+++ b/drivers/net/arm/etherh.c
@@ -646,7 +646,7 @@ static const struct net_device_ops etherh_netdev_ops = {
        .ndo_get_stats          = ei_get_stats,
        .ndo_set_multicast_list = ei_set_multicast_list,
        .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_set_mac_addr,
+        .ndo_set_mac_address    = eth_mac_addr,
        .ndo_change_mtu         = eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
        .ndo_poll_controller    = ei_poll,
diff --git a/drivers/net/bnx2x.h b/drivers/net/bnx2x.h
index 6fcccef4cf3d..15a5cf0f676b 100644
--- a/drivers/net/bnx2x.h
+++ b/drivers/net/bnx2x.h
@@ -1,6 +1,6 @@
 /* bnx2x.h: Broadcom Everest network driver.
 *
- * Copyright (c) 2007-2008 Broadcom Corporation
+ * Copyright (c) 2007-2009 Broadcom Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -271,14 +271,7 @@ struct bnx2x_fastpath {
 #define bnx2x_fp(bp, nr, var)           (bp->fp[nr].var)
-#define BNX2X_HAS_TX_WORK(fp) \
+#define BNX2X_HAS_WORK(fp)      (bnx2x_has_rx_work(fp) || bnx2x_has_tx_work(fp))
-                        ((fp->tx_pkt_prod != le16_to_cpu(*fp->tx_cons_sb)) || \
-                         (fp->tx_pkt_prod != fp->tx_pkt_cons))
-#define BNX2X_HAS_RX_WORK(fp) \
-                        (fp->rx_comp_cons != rx_cons_sb)
-#define BNX2X_HAS_WORK(fp)      (BNX2X_HAS_RX_WORK(fp) || BNX2X_HAS_TX_WORK(fp))
 /* MC hsi */
diff --git a/drivers/net/bnx2x_link.c b/drivers/net/bnx2x_link.c
index fefa6ab13064..aea26b4dc453 100644
--- a/drivers/net/bnx2x_link.c
+++ b/drivers/net/bnx2x_link.c
@@ -1,4 +1,4 @@
-/* Copyright 2008 Broadcom Corporation
+/* Copyright 2008-2009 Broadcom Corporation
 *
 * Unless you and Broadcom execute a separate written software license
 * agreement governing use of this software, this software is licensed to you
@@ -317,6 +317,9 @@ static u8 bnx2x_emac_enable(struct link_params *params,
                val &= ~0x810;
        EMAC_WR(bp, EMAC_REG_EMAC_MODE, val);
+        /* enable emac */
+        REG_WR(bp, NIG_REG_NIG_EMAC0_EN + port*4, 1);
        /* enable emac for jumbo packets */
        EMAC_WR(bp, EMAC_REG_EMAC_RX_MTU_SIZE,
                (EMAC_RX_MTU_SIZE_JUMBO_ENA |
@@ -1609,7 +1612,7 @@ static u8 bnx2x_link_settings_status(struct link_params *params,
                                      u32 gp_status)
 {
        struct bnx2x *bp = params->bp;
+        u16 new_line_speed;
        u8 rc = 0;
        vars->link_status = 0;
@@ -1629,7 +1632,7 @@ static u8 bnx2x_link_settings_status(struct link_params *params,
                switch (gp_status & GP_STATUS_SPEED_MASK) {
                case GP_STATUS_10M:
-                        vars->line_speed = SPEED_10;
+                        new_line_speed = SPEED_10;
                        if (vars->duplex == DUPLEX_FULL)
                                vars->link_status |= LINK_10TFD;
                        else
@@ -1637,7 +1640,7 @@ static u8 bnx2x_link_settings_status(struct link_params *params,
                        break;
                case GP_STATUS_100M:
-                        vars->line_speed = SPEED_100;
+                        new_line_speed = SPEED_100;
                        if (vars->duplex == DUPLEX_FULL)
                                vars->link_status |= LINK_100TXFD;
                        else
@@ -1646,7 +1649,7 @@ static u8 bnx2x_link_settings_status(struct link_params *params,
                case GP_STATUS_1G:
                case GP_STATUS_1G_KX:
-                        vars->line_speed = SPEED_1000;
+                        new_line_speed = SPEED_1000;
                        if (vars->duplex == DUPLEX_FULL)
                                vars->link_status |= LINK_1000TFD;
                        else
@@ -1654,7 +1657,7 @@ static u8 bnx2x_link_settings_status(struct link_params *params,
                        break;
                case GP_STATUS_2_5G:
-                        vars->line_speed = SPEED_2500;
+                        new_line_speed = SPEED_2500;
                        if (vars->duplex == DUPLEX_FULL)
                                vars->link_status |= LINK_2500TFD;
                        else
@@ -1671,32 +1674,32 @@ static u8 bnx2x_link_settings_status(struct link_params *params,
                case GP_STATUS_10G_KX4:
                case GP_STATUS_10G_HIG:
                case GP_STATUS_10G_CX4:
-                        vars->line_speed = SPEED_10000;
+                        new_line_speed = SPEED_10000;
                        vars->link_status |= LINK_10GTFD;
                        break;
                case GP_STATUS_12G_HIG:
-                        vars->line_speed = SPEED_12000;
+                        new_line_speed = SPEED_12000;
                        vars->link_status |= LINK_12GTFD;
                        break;
                case GP_STATUS_12_5G:
-                        vars->line_speed = SPEED_12500;
+                        new_line_speed = SPEED_12500;
                        vars->link_status |= LINK_12_5GTFD;
                        break;
                case GP_STATUS_13G:
-                        vars->line_speed = SPEED_13000;
+                        new_line_speed = SPEED_13000;
                        vars->link_status |= LINK_13GTFD;
                        break;
                case GP_STATUS_15G:
-                        vars->line_speed = SPEED_15000;
+                        new_line_speed = SPEED_15000;
                        vars->link_status |= LINK_15GTFD;
                        break;
                case GP_STATUS_16G:
-                        vars->line_speed = SPEED_16000;
+                        new_line_speed = SPEED_16000;
                        vars->link_status |= LINK_16GTFD;
                        break;
@@ -1708,6 +1711,15 @@ static u8 bnx2x_link_settings_status(struct link_params *params,
                        break;
                }
+                /* Upon link speed change set the NIG into drain mode.
+                Comes to deals with possible FIFO glitch due to clk change
+                when speed is decreased without link down indicator */
+                if (new_line_speed != vars->line_speed) {
+                        REG_WR(bp, NIG_REG_EGRESS_DRAIN0_MODE
+                                    + params->port*4, 0);
+                        msleep(1);
+                }
+                vars->line_speed = new_line_speed;
                vars->link_status |= LINK_STATUS_SERDES_LINK;
                if ((params->req_line_speed == SPEED_AUTO_NEG) &&
@@ -3571,7 +3583,7 @@ static void bnx2x_set_xgxs_loopback(struct link_params *params,
                               (MDIO_REG_BANK_CL73_IEEEB0 +
                                (MDIO_CL73_IEEEB0_CL73_AN_CONTROL & 0xf)),
                               0x6041);
+                msleep(200);
                /* set aer mmd back */
                bnx2x_set_aer_mmd(params, vars);
@@ -3870,9 +3882,15 @@ static u8 bnx2x_link_initialize(struct link_params *params,
        }
        if (vars->phy_flags & PHY_XGXS_FLAG) {
-                if (params->req_line_speed &&
+                if ((params->req_line_speed &&
                    ((params->req_line_speed == SPEED_100) ||
-                     (params->req_line_speed == SPEED_10))) {
+                     (params->req_line_speed == SPEED_10))) ||
+                    (!params->req_line_speed &&
+                     (params->speed_cap_mask >=
+                       PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL) &&
+                     (params->speed_cap_mask <
+                       PORT_HW_CFG_SPEED_CAPABILITY_D0_1G)
+                     ))  {
                        vars->phy_flags |= PHY_SGMII_FLAG;
                } else {
                        vars->phy_flags &= ~PHY_SGMII_FLAG;
@@ -4194,6 +4212,11 @@ static u8 bnx2x_update_link_down(struct link_params *params,
        /* activate nig drain */
        REG_WR(bp, NIG_REG_EGRESS_DRAIN0_MODE + port*4, 1);
+        /* disable emac */
+        REG_WR(bp, NIG_REG_NIG_EMAC0_EN + port*4, 0);
+        msleep(10);
        /* reset BigMac */
        bnx2x_bmac_rx_disable(bp, params->port);
        REG_WR(bp, GRCBASE_MISC +
@@ -4238,6 +4261,7 @@ static u8 bnx2x_update_link_up(struct link_params *params,
        /* update shared memory */
        bnx2x_update_mng(params, vars->link_status);
+        msleep(20);
        return rc;
 }
 /* This function should called upon link interrupt */
@@ -4276,6 +4300,9 @@ u8 bnx2x_link_update(struct link_params *params, struct link_vars *vars)
          REG_RD(bp, NIG_REG_XGXS0_STATUS_LINK10G + port*0x68),
          REG_RD(bp, NIG_REG_XGXS0_STATUS_LINK_STATUS + port*0x68));
+        /* disable emac */
+        REG_WR(bp, NIG_REG_NIG_EMAC0_EN + port*4, 0);
        ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
        /* Check external link change only for non-direct */
@@ -4377,10 +4404,11 @@ static u8 bnx2x_8073_common_init_phy(struct bnx2x *bp, u32 shmem_base)
                              ext_phy_addr[port],
                              MDIO_PMA_DEVAD,
                              MDIO_PMA_REG_ROM_VER1, &fw_ver1);
-                if (fw_ver1 == 0) {
+                if (fw_ver1 == 0 || fw_ver1 == 0x4321) {
                        DP(NETIF_MSG_LINK,
-                                 "bnx2x_8073_common_init_phy port %x "
+                                 "bnx2x_8073_common_init_phy port %x:"
-                                 "fw Download failed\n", port);
+                                 "Download failed. fw version = 0x%x\n",
+                                 port, fw_ver1);
                        return -EINVAL;
                }
diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c
index 7c533797c064..d3e7775a9ccf 100644
--- a/drivers/net/bnx2x_main.c
+++ b/drivers/net/bnx2x_main.c
@@ -1,6 +1,6 @@
 /* bnx2x_main.c: Broadcom Everest network driver.
 *
- * Copyright (c) 2007-2008 Broadcom Corporation
+ * Copyright (c) 2007-2009 Broadcom Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -57,8 +57,8 @@
 #include "bnx2x.h"
 #include "bnx2x_init.h"
-#define DRV_MODULE_VERSION      "1.45.23"
+#define DRV_MODULE_VERSION      "1.45.26"
-#define DRV_MODULE_RELDATE      "2008/11/03"
+#define DRV_MODULE_RELDATE      "2009/01/26"
 #define BNX2X_BC_VER            0x040200
 /* Time in jiffies before concluding the transmitter is hung */
@@ -69,7 +69,7 @@ static char version[] __devinitdata =
        DRV_MODULE_NAME " " DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
 MODULE_AUTHOR("Eliezer Tamir");
-MODULE_DESCRIPTION("Broadcom NetXtreme II BCM57710 Driver");
+MODULE_DESCRIPTION("Broadcom NetXtreme II BCM57710/57711/57711E Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_MODULE_VERSION);
@@ -733,6 +733,24 @@ static u16 bnx2x_ack_int(struct bnx2x *bp)
 * fast path service functions
 */
+static inline int bnx2x_has_tx_work(struct bnx2x_fastpath *fp)
+{
+        u16 tx_cons_sb;
+        /* Tell compiler that status block fields can change */
+        barrier();
+        tx_cons_sb = le16_to_cpu(*fp->tx_cons_sb);
+        return (fp->tx_pkt_cons != tx_cons_sb);
+}
+static inline int bnx2x_has_tx_work_unload(struct bnx2x_fastpath *fp)
+{
+        /* Tell compiler that consumer and producer can change */
+        barrier();
+        return (fp->tx_pkt_prod != fp->tx_pkt_cons);
+}
 /* free skb in the packet ring at pos idx
 * return idx of last bd freed
 */
@@ -5137,12 +5155,21 @@ static void enable_blocks_attention(struct bnx2x *bp)
 }
+static void bnx2x_reset_common(struct bnx2x *bp)
+{
+        /* reset_common */
+        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_1_CLEAR,
+               0xd3ffff7f);
+        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_CLEAR, 0x1403);
+}
 static int bnx2x_init_common(struct bnx2x *bp)
 {
        u32 val, i;
        DP(BNX2X_MSG_MCP, "starting common init  func %d\n", BP_FUNC(bp));
+        bnx2x_reset_common(bp);
        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_1_SET, 0xffffffff);
        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_SET, 0xfffc);
@@ -6123,8 +6150,8 @@ static void bnx2x_netif_start(struct bnx2x *bp)
 static void bnx2x_netif_stop(struct bnx2x *bp, int disable_hw)
 {
        bnx2x_int_disable_sync(bp, disable_hw);
+        bnx2x_napi_disable(bp);
        if (netif_running(bp->dev)) {
-                bnx2x_napi_disable(bp);
                netif_tx_disable(bp->dev);
                bp->dev->trans_start = jiffies; /* prevent tx timeout */
        }
@@ -6144,7 +6171,7 @@ static void bnx2x_set_mac_addr_e1(struct bnx2x *bp, int set)
         * multicast 64-127:port0 128-191:port1
         */
        config->hdr.length_6b = 2;
-        config->hdr.offset = port ? 31 : 0;
+        config->hdr.offset = port ? 32 : 0;
        config->hdr.client_id = BP_CL_ID(bp);
        config->hdr.reserved1 = 0;
@@ -6308,7 +6335,7 @@ static void bnx2x_set_rx_mode(struct net_device *dev);
 static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
 {
        u32 load_code;
-        int i, rc;
+        int i, rc = 0;
 #ifdef BNX2X_STOP_ON_ERROR
        if (unlikely(bp->panic))
                return -EPERM;
@@ -6316,48 +6343,6 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
        bp->state = BNX2X_STATE_OPENING_WAIT4_LOAD;
-        /* Send LOAD_REQUEST command to MCP
-           Returns the type of LOAD command:
-           if it is the first port to be initialized
-           common blocks should be initialized, otherwise - not
-        */
-        if (!BP_NOMCP(bp)) {
-                load_code = bnx2x_fw_command(bp, DRV_MSG_CODE_LOAD_REQ);
-                if (!load_code) {
-                        BNX2X_ERR("MCP response failure, aborting\n");
-                        return -EBUSY;
-                }
-                if (load_code == FW_MSG_CODE_DRV_LOAD_REFUSED)
-                        return -EBUSY; /* other port in diagnostic mode */
-        } else {
-                int port = BP_PORT(bp);
-                DP(NETIF_MSG_IFUP, "NO MCP load counts before us %d, %d, %d\n",
-                   load_count[0], load_count[1], load_count[2]);
-                load_count[0]++;
-                load_count[1 + port]++;
-                DP(NETIF_MSG_IFUP, "NO MCP new load counts       %d, %d, %d\n",
-                   load_count[0], load_count[1], load_count[2]);
-                if (load_count[0] == 1)
-                        load_code = FW_MSG_CODE_DRV_LOAD_COMMON;
-                else if (load_count[1 + port] == 1)
-                        load_code = FW_MSG_CODE_DRV_LOAD_PORT;
-                else
-                        load_code = FW_MSG_CODE_DRV_LOAD_FUNCTION;
-        }
-        if ((load_code == FW_MSG_CODE_DRV_LOAD_COMMON) ||
-            (load_code == FW_MSG_CODE_DRV_LOAD_PORT))
-                bp->port.pmf = 1;
-        else
-                bp->port.pmf = 0;
-        DP(NETIF_MSG_LINK, "pmf %d\n", bp->port.pmf);
-        /* if we can't use MSI-X we only need one fp,
-         * so try to enable MSI-X with the requested number of fp's
-         * and fallback to inta with one fp
-         */
        if (use_inta) {
                bp->num_queues = 1;
@@ -6372,7 +6357,15 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
                else
                        bp->num_queues = 1;
-                if (bnx2x_enable_msix(bp)) {
+                DP(NETIF_MSG_IFUP,
+                   "set number of queues to %d\n", bp->num_queues);
+                /* if we can't use MSI-X we only need one fp,
+                 * so try to enable MSI-X with the requested number of fp's
+                 * and fallback to MSI or legacy INTx with one fp
+                 */
+                rc = bnx2x_enable_msix(bp);
+                if (rc) {
                        /* failed to enable MSI-X */
                        bp->num_queues = 1;
                        if (use_multi)
@@ -6380,8 +6373,6 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
                                          " to enable MSI-X\n");
                }
        }
-        DP(NETIF_MSG_IFUP,
-           "set number of queues to %d\n", bp->num_queues);
        if (bnx2x_alloc_mem(bp))
                return -ENOMEM;
@@ -6390,30 +6381,85 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
                bnx2x_fp(bp, i, disable_tpa) =
                                        ((bp->flags & TPA_ENABLE_FLAG) == 0);
+        for_each_queue(bp, i)
+                netif_napi_add(bp->dev, &bnx2x_fp(bp, i, napi),
+                               bnx2x_poll, 128);
+#ifdef BNX2X_STOP_ON_ERROR
+        for_each_queue(bp, i) {
+                struct bnx2x_fastpath *fp = &bp->fp[i];
+                fp->poll_no_work = 0;
+                fp->poll_calls = 0;
+                fp->poll_max_calls = 0;
+                fp->poll_complete = 0;
+                fp->poll_exit = 0;
+        }
+#endif
+        bnx2x_napi_enable(bp);
        if (bp->flags & USING_MSIX_FLAG) {
                rc = bnx2x_req_msix_irqs(bp);
                if (rc) {
                        pci_disable_msix(bp->pdev);
-                        goto load_error;
+                        goto load_error1;
                }
+                printk(KERN_INFO PFX "%s: using MSI-X\n", bp->dev->name);
        } else {
                bnx2x_ack_int(bp);
                rc = bnx2x_req_irq(bp);
                if (rc) {
-                        BNX2X_ERR("IRQ request failed, aborting\n");
+                        BNX2X_ERR("IRQ request failed  rc %d, aborting\n", rc);
-                        goto load_error;
+                        goto load_error1;
                }
        }
-        for_each_queue(bp, i)
+        /* Send LOAD_REQUEST command to MCP
-                netif_napi_add(bp->dev, &bnx2x_fp(bp, i, napi),
+           Returns the type of LOAD command:
-                               bnx2x_poll, 128);
+           if it is the first port to be initialized
+           common blocks should be initialized, otherwise - not
+        */
+        if (!BP_NOMCP(bp)) {
+                load_code = bnx2x_fw_command(bp, DRV_MSG_CODE_LOAD_REQ);
+                if (!load_code) {
+                        BNX2X_ERR("MCP response failure, aborting\n");
+                        rc = -EBUSY;
+                        goto load_error2;
+                }
+                if (load_code == FW_MSG_CODE_DRV_LOAD_REFUSED) {
+                        rc = -EBUSY; /* other port in diagnostic mode */
+                        goto load_error2;
+                }
+        } else {
+                int port = BP_PORT(bp);
+                DP(NETIF_MSG_IFUP, "NO MCP load counts before us %d, %d, %d\n",
+                   load_count[0], load_count[1], load_count[2]);
+                load_count[0]++;
+                load_count[1 + port]++;
+                DP(NETIF_MSG_IFUP, "NO MCP new load counts       %d, %d, %d\n",
+                   load_count[0], load_count[1], load_count[2]);
+                if (load_count[0] == 1)
+                        load_code = FW_MSG_CODE_DRV_LOAD_COMMON;
+                else if (load_count[1 + port] == 1)
+                        load_code = FW_MSG_CODE_DRV_LOAD_PORT;
+                else
+                        load_code = FW_MSG_CODE_DRV_LOAD_FUNCTION;
+        }
+        if ((load_code == FW_MSG_CODE_DRV_LOAD_COMMON) ||
+            (load_code == FW_MSG_CODE_DRV_LOAD_PORT))
+                bp->port.pmf = 1;
+        else
+                bp->port.pmf = 0;
+        DP(NETIF_MSG_LINK, "pmf %d\n", bp->port.pmf);
        /* Initialize HW */
        rc = bnx2x_init_hw(bp, load_code);
        if (rc) {
                BNX2X_ERR("HW init failed, aborting\n");
-                goto load_int_disable;
+                goto load_error2;
        }
        /* Setup NIC internals and enable interrupts */
@@ -6425,7 +6471,7 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
                if (!load_code) {
                        BNX2X_ERR("MCP response failure, aborting\n");
                        rc = -EBUSY;
-                        goto load_rings_free;
+                        goto load_error3;
                }
        }
@@ -6434,7 +6480,7 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
        rc = bnx2x_setup_leading(bp);
        if (rc) {
                BNX2X_ERR("Setup leading failed!\n");
-                goto load_netif_stop;
+                goto load_error3;
        }
        if (CHIP_IS_E1H(bp))
@@ -6447,7 +6493,7 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
                for_each_nondefault_queue(bp, i) {
                        rc = bnx2x_setup_multi(bp, i);
                        if (rc)
-                                goto load_netif_stop;
+                                goto load_error3;
                }
        if (CHIP_IS_E1(bp))
@@ -6463,18 +6509,18 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
        case LOAD_NORMAL:
                /* Tx queue should be only reenabled */
                netif_wake_queue(bp->dev);
+                /* Initialize the receive filter. */
                bnx2x_set_rx_mode(bp->dev);
                break;
        case LOAD_OPEN:
                netif_start_queue(bp->dev);
+                /* Initialize the receive filter. */
                bnx2x_set_rx_mode(bp->dev);
-                if (bp->flags & USING_MSIX_FLAG)
-                        printk(KERN_INFO PFX "%s: using MSI-X\n",
-                               bp->dev->name);
                break;
        case LOAD_DIAG:
+                /* Initialize the receive filter. */
                bnx2x_set_rx_mode(bp->dev);
                bp->state = BNX2X_STATE_DIAG;
                break;
@@ -6492,20 +6538,25 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
        return 0;
-load_netif_stop:
+load_error3:
-        bnx2x_napi_disable(bp);
+        bnx2x_int_disable_sync(bp, 1);
-load_rings_free:
+        if (!BP_NOMCP(bp)) {
+                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_REQ_WOL_MCP);
+                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_DONE);
+        }
+        bp->port.pmf = 0;
        /* Free SKBs, SGEs, TPA pool and driver internals */
        bnx2x_free_skbs(bp);
        for_each_queue(bp, i)
                bnx2x_free_rx_sge_range(bp, bp->fp + i, NUM_RX_SGE);
-load_int_disable:
+load_error2:
-        bnx2x_int_disable_sync(bp, 1);
        /* Release IRQs */
        bnx2x_free_irq(bp);
-load_error:
+load_error1:
+        bnx2x_napi_disable(bp);
+        for_each_queue(bp, i)
+                netif_napi_del(&bnx2x_fp(bp, i, napi));
        bnx2x_free_mem(bp);
-        bp->port.pmf = 0;
        /* TBD we really need to reset the chip
           if we want to recover from this */
@@ -6578,6 +6629,7 @@ static int bnx2x_stop_leading(struct bnx2x *bp)
                }
                cnt--;
                msleep(1);
+                rmb(); /* Refresh the dsb_sp_prod */
        }
        bp->state = BNX2X_STATE_CLOSING_WAIT4_UNLOAD;
        bp->fp[0].state = BNX2X_FP_STATE_CLOSED;
@@ -6629,14 +6681,6 @@ static void bnx2x_reset_port(struct bnx2x *bp)
        /* TODO: Close Doorbell port? */
 }
-static void bnx2x_reset_common(struct bnx2x *bp)
-{
-        /* reset_common */
-        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_1_CLEAR,
-               0xd3ffff7f);
-        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_CLEAR, 0x1403);
-}
 static void bnx2x_reset_chip(struct bnx2x *bp, u32 reset_code)
 {
        DP(BNX2X_MSG_MCP, "function %d  reset_code %x\n",
@@ -6677,20 +6721,22 @@ static int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode)
        bnx2x_set_storm_rx_mode(bp);
        bnx2x_netif_stop(bp, 1);
-        if (!netif_running(bp->dev))
-                bnx2x_napi_disable(bp);
        del_timer_sync(&bp->timer);
        SHMEM_WR(bp, func_mb[BP_FUNC(bp)].drv_pulse_mb,
                 (DRV_PULSE_ALWAYS_ALIVE | bp->fw_drv_pulse_wr_seq));
        bnx2x_stats_handle(bp, STATS_EVENT_STOP);
+        /* Release IRQs */
+        bnx2x_free_irq(bp);
        /* Wait until tx fast path tasks complete */
        for_each_queue(bp, i) {
                struct bnx2x_fastpath *fp = &bp->fp[i];
                cnt = 1000;
                smp_rmb();
-                while (BNX2X_HAS_TX_WORK(fp)) {
+                while (bnx2x_has_tx_work_unload(fp)) {
                        bnx2x_tx_int(fp, 1000);
                        if (!cnt) {
@@ -6711,9 +6757,6 @@ static int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode)
        /* Give HW time to discard old tx messages */
        msleep(1);
-        /* Release IRQs */
-        bnx2x_free_irq(bp);
        if (CHIP_IS_E1(bp)) {
                struct mac_configuration_cmd *config =
                                                bnx2x_sp(bp, mcast_config);
@@ -6822,6 +6865,8 @@ unload_error:
        bnx2x_free_skbs(bp);
        for_each_queue(bp, i)
                bnx2x_free_rx_sge_range(bp, bp->fp + i, NUM_RX_SGE);
+        for_each_queue(bp, i)
+                netif_napi_del(&bnx2x_fp(bp, i, napi));
        bnx2x_free_mem(bp);
        bp->state = BNX2X_STATE_CLOSED;
@@ -6874,10 +6919,6 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
                 */
                bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
                val = REG_RD(bp, DORQ_REG_NORM_CID_OFST);
-                if (val == 0x7)
-                        REG_WR(bp, DORQ_REG_NORM_CID_OFST, 0);
-                bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
                if (val == 0x7) {
                        u32 reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_DIS;
                        /* save our func */
@@ -6885,6 +6926,9 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
                        u32 swap_en;
                        u32 swap_val;
+                        /* clear the UNDI indication */
+                        REG_WR(bp, DORQ_REG_NORM_CID_OFST, 0);
                        BNX2X_DEV_INFO("UNDI is active! reset device\n");
                        /* try unload UNDI on port 0 */
@@ -6910,6 +6954,9 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
                                bnx2x_fw_command(bp, reset_code);
                        }
+                        /* now it's safe to release the lock */
+                        bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
                        REG_WR(bp, (BP_PORT(bp) ? HC_REG_CONFIG_1 :
                                    HC_REG_CONFIG_0), 0x1000);
@@ -6954,7 +7001,9 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
                        bp->fw_seq =
                               (SHMEM_RD(bp, func_mb[bp->func].drv_mb_header) &
                                DRV_MSG_SEQ_NUMBER_MASK);
-                }
+                } else
+                        bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
        }
 }
@@ -6971,7 +7020,7 @@ static void __devinit bnx2x_get_common_hwinfo(struct bnx2x *bp)
        id |= ((val & 0xf) << 12);
        val = REG_RD(bp, MISC_REG_CHIP_METAL);
        id |= ((val & 0xff) << 4);
-        REG_RD(bp, MISC_REG_BOND_ID);
+        val = REG_RD(bp, MISC_REG_BOND_ID);
        id |= (val & 0xf);
        bp->common.chip_id = id;
        bp->link_params.chip_id = bp->common.chip_id;
@@ -8103,6 +8152,9 @@ static int bnx2x_get_eeprom(struct net_device *dev,
        struct bnx2x *bp = netdev_priv(dev);
        int rc;
+        if (!netif_running(dev))
+                return -EAGAIN;
        DP(BNX2X_MSG_NVM, "ethtool_eeprom: cmd %d\n"
           DP_LEVEL "  magic 0x%x  offset 0x%x (%d)  len 0x%x (%d)\n",
           eeprom->cmd, eeprom->magic, eeprom->offset, eeprom->offset,
@@ -8705,18 +8757,17 @@ static int bnx2x_run_loopback(struct bnx2x *bp, int loopback_mode, u8 link_up)
        if (loopback_mode == BNX2X_MAC_LOOPBACK) {
                bp->link_params.loopback_mode = LOOPBACK_BMAC;
-                bnx2x_acquire_phy_lock(bp);
                bnx2x_phy_init(&bp->link_params, &bp->link_vars);
-                bnx2x_release_phy_lock(bp);
        } else if (loopback_mode == BNX2X_PHY_LOOPBACK) {
+                u16 cnt = 1000;
                bp->link_params.loopback_mode = LOOPBACK_XGXS_10;
-                bnx2x_acquire_phy_lock(bp);
                bnx2x_phy_init(&bp->link_params, &bp->link_vars);
-                bnx2x_release_phy_lock(bp);
                /* wait until link state is restored */
-                bnx2x_wait_for_link(bp, link_up);
+                if (link_up)
+                        while (cnt-- && bnx2x_test_link(&bp->link_params,
+                                                        &bp->link_vars))
+                                msleep(10);
        } else
                return -EINVAL;
@@ -8822,6 +8873,7 @@ static int bnx2x_test_loopback(struct bnx2x *bp, u8 link_up)
                return BNX2X_LOOPBACK_FAILED;
        bnx2x_netif_stop(bp, 1);
+        bnx2x_acquire_phy_lock(bp);
        if (bnx2x_run_loopback(bp, BNX2X_MAC_LOOPBACK, link_up)) {
                DP(NETIF_MSG_PROBE, "MAC loopback failed\n");
@@ -8833,6 +8885,7 @@ static int bnx2x_test_loopback(struct bnx2x *bp, u8 link_up)
                rc |= BNX2X_PHY_LOOPBACK_FAILED;
        }
+        bnx2x_release_phy_lock(bp);
        bnx2x_netif_start(bp);
        return rc;
@@ -8906,7 +8959,10 @@ static int bnx2x_test_intr(struct bnx2x *bp)
                return -ENODEV;
        config->hdr.length_6b = 0;
-        config->hdr.offset = 0;
+        if (CHIP_IS_E1(bp))
+                config->hdr.offset = (BP_PORT(bp) ? 32 : 0);
+        else
+                config->hdr.offset = BP_FUNC(bp);
        config->hdr.client_id = BP_CL_ID(bp);
        config->hdr.reserved1 = 0;
@@ -9271,6 +9327,18 @@ static int bnx2x_set_power_state(struct bnx2x *bp, pci_power_t state)
        return 0;
 }
+static inline int bnx2x_has_rx_work(struct bnx2x_fastpath *fp)
+{
+        u16 rx_cons_sb;
+        /* Tell compiler that status block fields can change */
+        barrier();
+        rx_cons_sb = le16_to_cpu(*fp->rx_cons_sb);
+        if ((rx_cons_sb & MAX_RCQ_DESC_CNT) == MAX_RCQ_DESC_CNT)
+                rx_cons_sb++;
+        return (fp->rx_comp_cons != rx_cons_sb);
+}
 /*
 * net_device service functions
 */
@@ -9281,7 +9349,6 @@ static int bnx2x_poll(struct napi_struct *napi, int budget)
                                                 napi);
        struct bnx2x *bp = fp->bp;
        int work_done = 0;
-        u16 rx_cons_sb;
 #ifdef BNX2X_STOP_ON_ERROR
        if (unlikely(bp->panic))
@@ -9294,19 +9361,12 @@ static int bnx2x_poll(struct napi_struct *napi, int budget)
        bnx2x_update_fpsb_idx(fp);
-        if (BNX2X_HAS_TX_WORK(fp))
+        if (bnx2x_has_tx_work(fp))
                bnx2x_tx_int(fp, budget);
-        rx_cons_sb = le16_to_cpu(*fp->rx_cons_sb);
+        if (bnx2x_has_rx_work(fp))
-        if ((rx_cons_sb & MAX_RCQ_DESC_CNT) == MAX_RCQ_DESC_CNT)
-                rx_cons_sb++;
-        if (BNX2X_HAS_RX_WORK(fp))
                work_done = bnx2x_rx_int(fp, budget);
        rmb(); /* BNX2X_HAS_WORK() reads the status block */
-        rx_cons_sb = le16_to_cpu(*fp->rx_cons_sb);
-        if ((rx_cons_sb & MAX_RCQ_DESC_CNT) == MAX_RCQ_DESC_CNT)
-                rx_cons_sb++;
        /* must not complete if we consumed full budget */
        if ((work_done < budget) && !BNX2X_HAS_WORK(fp)) {
@@ -9417,6 +9477,7 @@ static inline u32 bnx2x_xmit_type(struct bnx2x *bp, struct sk_buff *skb)
        return rc;
 }
+#if (MAX_SKB_FRAGS >= MAX_FETCH_BD - 3)
 /* check if packet requires linearization (packet is too fragmented) */
 static int bnx2x_pkt_req_lin(struct bnx2x *bp, struct sk_buff *skb,
                             u32 xmit_type)
@@ -9494,6 +9555,7 @@ exit_lbl:
        return to_copy;
 }
+#endif
 /* called with netif_tx_lock
 * bnx2x_tx_int() runs without netif_tx_lock unless it needs to call
@@ -9534,6 +9596,7 @@ static int bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
           skb->ip_summed, skb->protocol, ipv6_hdr(skb)->nexthdr,
           ip_hdr(skb)->protocol, skb_shinfo(skb)->gso_type, xmit_type);
+#if (MAX_SKB_FRAGS >= MAX_FETCH_BD - 3)
        /* First, check if we need to linearize the skb
           (due to FW restrictions) */
        if (bnx2x_pkt_req_lin(bp, skb, xmit_type)) {
@@ -9546,6 +9609,7 @@ static int bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                        return NETDEV_TX_OK;
                }
        }
+#endif
        /*
        Please read carefully. First we use one BD which we mark as start,
@@ -9776,6 +9840,8 @@ static int bnx2x_open(struct net_device *dev)
 {
        struct bnx2x *bp = netdev_priv(dev);
+        netif_carrier_off(dev);
        bnx2x_set_power_state(bp, PCI_D0);
        return bnx2x_nic_load(bp, LOAD_OPEN);
@@ -9859,7 +9925,7 @@ static void bnx2x_set_rx_mode(struct net_device *dev)
                                for (; i < old; i++) {
                                        if (CAM_IS_INVALID(config->
                                                           config_table[i])) {
-                                                i--; /* already invalidated */
+                                                /* already invalidated */
                                                break;
                                        }
                                        /* invalidate */
@@ -10269,22 +10335,18 @@ static int __devinit bnx2x_init_one(struct pci_dev *pdev,
                return rc;
        }
-        rc = register_netdev(dev);
-        if (rc) {
-                dev_err(&pdev->dev, "Cannot register net device\n");
-                goto init_one_exit;
-        }
        pci_set_drvdata(pdev, dev);
        rc = bnx2x_init_bp(bp);
+        if (rc)
+                goto init_one_exit;
+        rc = register_netdev(dev);
        if (rc) {
-                unregister_netdev(dev);
+                dev_err(&pdev->dev, "Cannot register net device\n");
                goto init_one_exit;
        }
-        netif_carrier_off(dev);
        bp->common.name = board_info[ent->driver_data].name;
        printk(KERN_INFO "%s: %s (%c%d) PCI-E x%d %s found at mem %lx,"
               " IRQ %d, ", dev->name, bp->common.name,
@@ -10432,6 +10494,8 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp)
        bnx2x_free_skbs(bp);
        for_each_queue(bp, i)
                bnx2x_free_rx_sge_range(bp, bp->fp + i, NUM_RX_SGE);
+        for_each_queue(bp, i)
+                netif_napi_del(&bnx2x_fp(bp, i, napi));
        bnx2x_free_mem(bp);
        bp->state = BNX2X_STATE_CLOSED;
diff --git a/drivers/net/bnx2x_reg.h b/drivers/net/bnx2x_reg.h
index a67b0c358ae4..d084e5fc4b51 100644
--- a/drivers/net/bnx2x_reg.h
+++ b/drivers/net/bnx2x_reg.h
@@ -1,6 +1,6 @@
 /* bnx2x_reg.h: Broadcom Everest network driver.
 *
- * Copyright (c) 2007-2008 Broadcom Corporation
+ * Copyright (c) 2007-2009 Broadcom Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
diff --git a/drivers/net/cassini.c b/drivers/net/cassini.c
index 840b3d1a22f5..bbbc3bb08aa5 100644
--- a/drivers/net/cassini.c
+++ b/drivers/net/cassini.c
@@ -806,7 +806,7 @@ static int cas_reset_mii_phy(struct cas *cp)
        cas_phy_write(cp, MII_BMCR, BMCR_RESET);
        udelay(100);
-        while (limit--) {
+        while (--limit) {
                val = cas_phy_read(cp, MII_BMCR);
                if ((val & BMCR_RESET) == 0)
                        break;
@@ -979,7 +979,7 @@ static void cas_phy_init(struct cas *cp)
                writel(val, cp->regs + REG_PCS_MII_CTRL);
                limit = STOP_TRIES;
-                while (limit-- > 0) {
+                while (--limit > 0) {
                        udelay(10);
                        if ((readl(cp->regs + REG_PCS_MII_CTRL) &
                             PCS_MII_RESET) == 0)
diff --git a/drivers/net/cxgb3/sge.c b/drivers/net/cxgb3/sge.c
index 14f9fb3e8795..d31791f60292 100644
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -2104,6 +2104,7 @@ static void init_lro_mgr(struct sge_qset *qs, struct net_lro_mgr *lro_mgr)
 {
        lro_mgr->dev = qs->netdev;
        lro_mgr->features = LRO_F_NAPI;
+        lro_mgr->frag_align_pad = NET_IP_ALIGN;
        lro_mgr->ip_summed = CHECKSUM_UNNECESSARY;
        lro_mgr->ip_summed_aggr = CHECKSUM_UNNECESSARY;
        lro_mgr->max_desc = T3_MAX_LRO_SES;
@@ -2275,8 +2276,7 @@ no_mem:
                } else if ((len = ntohl(r->len_cq)) != 0) {
                        struct sge_fl *fl;
-                        if (eth)
+                        lro &= eth && is_eth_tcp(rss_hi);
-                                lro = qs->lro_enabled && is_eth_tcp(rss_hi);
                        fl = (len & F_RSPD_FLQ) ? &qs->fl[1] : &qs->fl[0];
                        if (fl->use_pages) {
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 26474c92193f..6bd63cc67b3e 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -31,7 +31,7 @@
 char e1000_driver_name[] = "e1000";
 static char e1000_driver_string[] = "Intel(R) PRO/1000 Network Driver";
-#define DRV_VERSION "7.3.20-k3-NAPI"
+#define DRV_VERSION "7.3.21-k3-NAPI"
 const char e1000_driver_version[] = DRV_VERSION;
 static const char e1000_copyright[] = "Copyright (c) 1999-2006 Intel Corporation.";
@@ -940,7 +940,7 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
                err = pci_enable_device(pdev);
        } else {
                bars = pci_select_bars(pdev, IORESOURCE_MEM);
-                err = pci_enable_device(pdev);
+                err = pci_enable_device_mem(pdev);
        }
        if (err)
                return err;
@@ -3712,7 +3712,7 @@ static irqreturn_t e1000_intr(int irq, void *data)
        struct e1000_hw *hw = &adapter->hw;
        u32 rctl, icr = er32(ICR);
-        if (unlikely(!icr))
+        if (unlikely((!icr) || test_bit(__E1000_RESETTING, &adapter->flags)))
                return IRQ_NONE;  /* Not our interrupt */
        /* IMS will not auto-mask if INT_ASSERTED is not set, and if it is
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index cf43ee743b3c..0890162953e9 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -981,11 +981,15 @@ static void e1000_initialize_hw_bits_82571(struct e1000_hw *hw)
                ew32(PBA_ECC, reg);
        }
-        /* PCI-Ex Control Register */
+        /* PCI-Ex Control Registers */
        if (hw->mac.type == e1000_82574) {
                reg = er32(GCR);
                reg |= (1 << 22);
                ew32(GCR, reg);
+                reg = er32(GCR2);
+                reg |= 1;
+                ew32(GCR2, reg);
        }
        return;
diff --git a/drivers/net/e1000e/hw.h b/drivers/net/e1000e/hw.h
index f25e961c6b3b..2d4ce0492df0 100644
--- a/drivers/net/e1000e/hw.h
+++ b/drivers/net/e1000e/hw.h
@@ -206,6 +206,7 @@ enum e1e_registers {
        E1000_MANC2H    = 0x05860, /* Management Control To Host - RW */
        E1000_SW_FW_SYNC = 0x05B5C, /* Software-Firmware Synchronization - RW */
        E1000_GCR       = 0x05B00, /* PCI-Ex Control */
+        E1000_GCR2      = 0x05B64, /* PCI-Ex Control #2 */
        E1000_FACTPS    = 0x05B30, /* Function Active and Power State to MNG */
        E1000_SWSM      = 0x05B50, /* SW Semaphore */
        E1000_FWSM      = 0x05B54, /* FW Semaphore */
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 7e33c129d51c..2769083bfe83 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -1698,7 +1698,7 @@ static void __inline__ fec_set_mii(struct net_device *dev, struct fec_enet_priva
        /*
         * Set MII speed to 2.5 MHz
         */
-        fep->phy_speed = ((((MCF_CLK / 2) / (2500000 / 10)) + 5) / 10) * 2;
+        fep->phy_speed = (MCF_CLK / 3) / (2500000 * 2 ) * 2;
        fecp->fec_mii_speed = fep->phy_speed;
        fec_restart(dev, 0);
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index ea530673236e..acae2d8cd688 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -351,6 +351,9 @@ static int gfar_probe(struct of_device *ofdev,
        /* Reset MAC layer */
        gfar_write(&priv->regs->maccfg1, MACCFG1_SOFT_RESET);
+        /* We need to delay at least 3 TX clocks */
+        udelay(2);
        tempval = (MACCFG1_TX_FLOW | MACCFG1_RX_FLOW);
        gfar_write(&priv->regs->maccfg1, tempval);
@@ -1423,15 +1426,11 @@ static void gfar_vlan_rx_register(struct net_device *dev,
 {
        struct gfar_private *priv = netdev_priv(dev);
        unsigned long flags;
-        struct vlan_group *old_grp;
        u32 tempval;
        spin_lock_irqsave(&priv->rxlock, flags);
-        old_grp = priv->vlgrp;
+        priv->vlgrp = grp;
-        if (old_grp == grp)
-                return;
        if (grp) {
                /* Enable VLAN tag insertion */
diff --git a/drivers/net/gianfar.h b/drivers/net/gianfar.h
index b1a83344acc7..eaa86897f5c3 100644
--- a/drivers/net/gianfar.h
+++ b/drivers/net/gianfar.h
@@ -312,7 +312,7 @@ extern const char gfar_driver_version[];
 #define ATTRELI_EI(x) (x)
 #define BD_LFLAG(flags) ((flags) << 16)
-#define BD_LENGTH_MASK          0x00ff
+#define BD_LENGTH_MASK          0x0000ffff
 /* TxBD status field bits */
 #define TXBD_READY              0x8000
diff --git a/drivers/net/gianfar_mii.c b/drivers/net/gianfar_mii.c
index f3706e415b45..f49a426ad681 100644
--- a/drivers/net/gianfar_mii.c
+++ b/drivers/net/gianfar_mii.c
@@ -234,6 +234,8 @@ static int gfar_mdio_probe(struct of_device *ofdev,
        if (NULL == new_bus)
                return -ENOMEM;
+        device_init_wakeup(&ofdev->dev, 1);
        new_bus->name = "Gianfar MII Bus",
        new_bus->read = &gfar_mdio_read,
        new_bus->write = &gfar_mdio_write,
diff --git a/drivers/net/ibm_newemac/phy.c b/drivers/net/ibm_newemac/phy.c
index c40cd8df2212..ac9d964e59ec 100644
--- a/drivers/net/ibm_newemac/phy.c
+++ b/drivers/net/ibm_newemac/phy.c
@@ -60,7 +60,7 @@ int emac_mii_reset_phy(struct mii_phy *phy)
        udelay(300);
-        while (limit--) {
+        while (--limit) {
                val = phy_read(phy, MII_BMCR);
                if (val >= 0 && (val & BMCR_RESET) == 0)
                        break;
@@ -84,7 +84,7 @@ int emac_mii_reset_gpcs(struct mii_phy *phy)
        udelay(300);
-        while (limit--) {
+        while (--limit) {
                val = gpcs_phy_read(phy, MII_BMCR);
                if (val >= 0 && (val & BMCR_RESET) == 0)
                        break;
diff --git a/drivers/net/igb/e1000_82575.c b/drivers/net/igb/e1000_82575.c
index f5e2e7235fcb..13ca73f96ec6 100644
--- a/drivers/net/igb/e1000_82575.c
+++ b/drivers/net/igb/e1000_82575.c
@@ -699,11 +699,18 @@ static s32 igb_check_for_link_82575(struct e1000_hw *hw)
        /* SGMII link check is done through the PCS register. */
        if ((hw->phy.media_type != e1000_media_type_copper) ||
-            (igb_sgmii_active_82575(hw)))
+            (igb_sgmii_active_82575(hw))) {
                ret_val = igb_get_pcs_speed_and_duplex_82575(hw, &speed,
                                                             &duplex);
-        else
+                /*
+                 * Use this flag to determine if link needs to be checked or
+                 * not.  If  we have link clear the flag so that we do not
+                 * continue to check for link.
+                 */
+                hw->mac.get_link_status = !hw->mac.serdes_has_link;
+        } else {
                ret_val = igb_check_for_copper_link(hw);
+        }
        return ret_val;
 }
diff --git a/drivers/net/igb/igb.h b/drivers/net/igb/igb.h
index 5a27825cc48a..aebef8e48e76 100644
--- a/drivers/net/igb/igb.h
+++ b/drivers/net/igb/igb.h
@@ -300,11 +300,10 @@ struct igb_adapter {
 #define IGB_FLAG_HAS_MSI           (1 << 0)
 #define IGB_FLAG_MSI_ENABLE        (1 << 1)
-#define IGB_FLAG_HAS_DCA           (1 << 2)
+#define IGB_FLAG_DCA_ENABLED       (1 << 2)
-#define IGB_FLAG_DCA_ENABLED       (1 << 3)
+#define IGB_FLAG_IN_NETPOLL        (1 << 3)
-#define IGB_FLAG_IN_NETPOLL        (1 << 5)
+#define IGB_FLAG_QUAD_PORT_A       (1 << 4)
-#define IGB_FLAG_QUAD_PORT_A       (1 << 6)
+#define IGB_FLAG_NEED_CTX_IDX      (1 << 5)
-#define IGB_FLAG_NEED_CTX_IDX      (1 << 7)
 enum e1000_state_t {
        __IGB_TESTING,
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index b82b0fb2056c..a50db5398fa5 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -206,10 +206,11 @@ static int __init igb_init_module(void)
        global_quad_port_a = 0;
-        ret = pci_register_driver(&igb_driver);
 #ifdef CONFIG_IGB_DCA
        dca_register_notify(&dca_notifier);
 #endif
+        ret = pci_register_driver(&igb_driver);
        return ret;
 }
@@ -1156,11 +1157,10 @@ static int __devinit igb_probe(struct pci_dev *pdev,
        /* set flags */
        switch (hw->mac.type) {
-        case e1000_82576:
        case e1000_82575:
-                adapter->flags |= IGB_FLAG_HAS_DCA;
                adapter->flags |= IGB_FLAG_NEED_CTX_IDX;
                break;
+        case e1000_82576:
        default:
                break;
        }
@@ -1310,8 +1310,7 @@ static int __devinit igb_probe(struct pci_dev *pdev,
                goto err_register;
 #ifdef CONFIG_IGB_DCA
-        if ((adapter->flags & IGB_FLAG_HAS_DCA) &&
+        if (dca_add_requester(&pdev->dev) == 0) {
-            (dca_add_requester(&pdev->dev) == 0)) {
                adapter->flags |= IGB_FLAG_DCA_ENABLED;
                dev_info(&pdev->dev, "DCA enabled\n");
                /* Always use CB2 mode, difference is masked
@@ -1835,11 +1834,11 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
        rctl |= E1000_RCTL_SECRC;
        /*
-         * disable store bad packets, long packet enable, and clear size bits.
+         * disable store bad packets and clear size bits.
         */
-        rctl &= ~(E1000_RCTL_SBP | E1000_RCTL_LPE | E1000_RCTL_SZ_256);
+        rctl &= ~(E1000_RCTL_SBP | E1000_RCTL_SZ_256);
-        if (adapter->netdev->mtu > ETH_DATA_LEN)
+        /* enable LPE when to prevent packets larger than max_frame_size */
                rctl |= E1000_RCTL_LPE;
        /* Setup buffer sizes */
@@ -1865,7 +1864,7 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
         */
        /* allocations using alloc_page take too long for regular MTU
         * so only enable packet split for jumbo frames */
-        if (rctl & E1000_RCTL_LPE) {
+        if (adapter->netdev->mtu > ETH_DATA_LEN) {
                adapter->rx_ps_hdr_size = IGB_RXBUFFER_128;
                srrctl |= adapter->rx_ps_hdr_size <<
                         E1000_SRRCTL_BSIZEHDRSIZE_SHIFT;
@@ -3473,19 +3472,16 @@ static int __igb_notify_dca(struct device *dev, void *data)
        struct e1000_hw *hw = &adapter->hw;
        unsigned long event = *(unsigned long *)data;
-        if (!(adapter->flags & IGB_FLAG_HAS_DCA))
-                goto out;
        switch (event) {
        case DCA_PROVIDER_ADD:
                /* if already enabled, don't do it again */
                if (adapter->flags & IGB_FLAG_DCA_ENABLED)
                        break;
-                adapter->flags |= IGB_FLAG_DCA_ENABLED;
                /* Always use CB2 mode, difference is masked
                 * in the CB driver. */
                wr32(E1000_DCA_CTRL, 2);
                if (dca_add_requester(dev) == 0) {
+                        adapter->flags |= IGB_FLAG_DCA_ENABLED;
                        dev_info(&adapter->pdev->dev, "DCA enabled\n");
                        igb_setup_dca(adapter);
                        break;
@@ -3502,7 +3498,7 @@ static int __igb_notify_dca(struct device *dev, void *data)
                }
                break;
        }
-out:
        return 0;
 }
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index acef3c65cd2c..d2f4d5f508b7 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -318,6 +318,9 @@ static void ixgbe_update_rx_dca(struct ixgbe_adapter *adapter,
                rxctrl |= dca3_get_tag(&adapter->pdev->dev, cpu);
                rxctrl |= IXGBE_DCA_RXCTRL_DESC_DCA_EN;
                rxctrl |= IXGBE_DCA_RXCTRL_HEAD_DCA_EN;
+                rxctrl &= ~(IXGBE_DCA_RXCTRL_DESC_RRO_EN);
+                rxctrl &= ~(IXGBE_DCA_RXCTRL_DESC_WRO_EN |
+                            IXGBE_DCA_RXCTRL_DESC_HSRO_EN);
                IXGBE_WRITE_REG(&adapter->hw, IXGBE_DCA_RXCTRL(q), rxctrl);
                rx_ring->cpu = cpu;
        }
@@ -1741,6 +1744,32 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
        IXGBE_WRITE_REG(hw, IXGBE_RXCSUM, rxcsum);
 }
+static void ixgbe_vlan_rx_add_vid(struct net_device *netdev, u16 vid)
+{
+        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        struct ixgbe_hw *hw = &adapter->hw;
+        /* add VID to filter table */
+        hw->mac.ops.set_vfta(&adapter->hw, vid, 0, true);
+}
+static void ixgbe_vlan_rx_kill_vid(struct net_device *netdev, u16 vid)
+{
+        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        struct ixgbe_hw *hw = &adapter->hw;
+        if (!test_bit(__IXGBE_DOWN, &adapter->state))
+                ixgbe_irq_disable(adapter);
+        vlan_group_set_device(adapter->vlgrp, vid, NULL);
+        if (!test_bit(__IXGBE_DOWN, &adapter->state))
+                ixgbe_irq_enable(adapter);
+        /* remove VID from filter table */
+        hw->mac.ops.set_vfta(&adapter->hw, vid, 0, false);
+}
 static void ixgbe_vlan_rx_register(struct net_device *netdev,
                                   struct vlan_group *grp)
 {
@@ -1760,6 +1789,7 @@ static void ixgbe_vlan_rx_register(struct net_device *netdev,
        ctrl |= IXGBE_VLNCTRL_VME;
        ctrl &= ~IXGBE_VLNCTRL_CFIEN;
        IXGBE_WRITE_REG(&adapter->hw, IXGBE_VLNCTRL, ctrl);
+        ixgbe_vlan_rx_add_vid(netdev, 0);
        if (grp) {
                /* enable VLAN tag insert/strip */
@@ -1773,32 +1803,6 @@ static void ixgbe_vlan_rx_register(struct net_device *netdev,
                ixgbe_irq_enable(adapter);
 }
-static void ixgbe_vlan_rx_add_vid(struct net_device *netdev, u16 vid)
-{
-        struct ixgbe_adapter *adapter = netdev_priv(netdev);
-        struct ixgbe_hw *hw = &adapter->hw;
-        /* add VID to filter table */
-        hw->mac.ops.set_vfta(&adapter->hw, vid, 0, true);
-}
-static void ixgbe_vlan_rx_kill_vid(struct net_device *netdev, u16 vid)
-{
-        struct ixgbe_adapter *adapter = netdev_priv(netdev);
-        struct ixgbe_hw *hw = &adapter->hw;
-        if (!test_bit(__IXGBE_DOWN, &adapter->state))
-                ixgbe_irq_disable(adapter);
-        vlan_group_set_device(adapter->vlgrp, vid, NULL);
-        if (!test_bit(__IXGBE_DOWN, &adapter->state))
-                ixgbe_irq_enable(adapter);
-        /* remove VID from filter table */
-        hw->mac.ops.set_vfta(&adapter->hw, vid, 0, false);
-}
 static void ixgbe_restore_vlan(struct ixgbe_adapter *adapter)
 {
        ixgbe_vlan_rx_register(adapter->netdev, adapter->vlgrp);
@@ -2074,6 +2078,9 @@ static int ixgbe_up_complete(struct ixgbe_adapter *adapter)
        ixgbe_irq_enable(adapter);
+        /* enable transmits */
+        netif_tx_start_all_queues(netdev);
        /* bring the link up in the watchdog, this could race with our first
         * link up interrupt but shouldn't be a problem */
        adapter->flags |= IXGBE_FLAG_NEED_LINK_UPDATE;
@@ -3475,7 +3482,6 @@ static void ixgbe_watchdog_task(struct work_struct *work)
                                (FLOW_TX ? "TX" : "None"))));
                        netif_carrier_on(netdev);
-                        netif_tx_wake_all_queues(netdev);
                } else {
                        /* Force detection of hung controller */
                        adapter->detect_tx_hung = true;
@@ -3487,7 +3493,6 @@ static void ixgbe_watchdog_task(struct work_struct *work)
                        printk(KERN_INFO "ixgbe: %s NIC Link is Down\n",
                               netdev->name);
                        netif_carrier_off(netdev);
-                        netif_tx_stop_all_queues(netdev);
                }
        }
@@ -4218,7 +4223,6 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
        }
        netif_carrier_off(netdev);
-        netif_tx_stop_all_queues(netdev);
        strcpy(netdev->name, "eth%d");
        err = register_netdev(netdev);
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index 83a11ff9ffd1..f011c57c9205 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -404,6 +404,9 @@
 #define IXGBE_DCA_RXCTRL_DESC_DCA_EN (1 << 5) /* DCA Rx Desc enable */
 #define IXGBE_DCA_RXCTRL_HEAD_DCA_EN (1 << 6) /* DCA Rx Desc header enable */
 #define IXGBE_DCA_RXCTRL_DATA_DCA_EN (1 << 7) /* DCA Rx Desc payload enable */
+#define IXGBE_DCA_RXCTRL_DESC_RRO_EN (1 << 9) /* DCA Rx rd Desc Relax Order */
+#define IXGBE_DCA_RXCTRL_DESC_WRO_EN (1 << 13) /* DCA Rx wr Desc Relax Order */
+#define IXGBE_DCA_RXCTRL_DESC_HSRO_EN (1 << 15) /* DCA Rx Split Header RO */
 #define IXGBE_DCA_TXCTRL_CPUID_MASK 0x0000001F /* Tx CPUID Mask */
 #define IXGBE_DCA_TXCTRL_DESC_DCA_EN (1 << 5) /* DCA Tx Desc enable */
diff --git a/drivers/net/korina.c b/drivers/net/korina.c
index 1d6e48e13366..75010cac76ac 100644
--- a/drivers/net/korina.c
+++ b/drivers/net/korina.c
@@ -416,6 +416,9 @@ static int korina_rx(struct net_device *dev, int limit)
                        if (devcs & ETH_RX_MP)
                                dev->stats.multicast++;
+                        /* 16 bit align */
+                        skb_reserve(skb_new, 2);
                        lp->rx_skb[lp->rx_next_done] = skb_new;
                }
@@ -740,6 +743,7 @@ static struct ethtool_ops netdev_ethtool_ops = {
 static void korina_alloc_ring(struct net_device *dev)
 {
        struct korina_private *lp = netdev_priv(dev);
+        struct sk_buff *skb;
        int i;
        /* Initialize the transmit descriptors */
@@ -755,8 +759,6 @@ static void korina_alloc_ring(struct net_device *dev)
        /* Initialize the receive descriptors */
        for (i = 0; i < KORINA_NUM_RDS; i++) {
-                struct sk_buff *skb = lp->rx_skb[i];
                skb = dev_alloc_skb(KORINA_RBSIZE + 2);
                if (!skb)
                        break;
@@ -769,11 +771,12 @@ static void korina_alloc_ring(struct net_device *dev)
                lp->rd_ring[i].link = CPHYSADDR(&lp->rd_ring[i+1]);
        }
-        /* loop back */
+        /* loop back receive descriptors, so the last
-        lp->rd_ring[i].link = CPHYSADDR(&lp->rd_ring[0]);
+         * descriptor points to the first one */
-        lp->rx_next_done  = 0;
+        lp->rd_ring[i - 1].link = CPHYSADDR(&lp->rd_ring[0]);
+        lp->rd_ring[i - 1].control |= DMA_DESC_COD;
-        lp->rd_ring[i].control |= DMA_DESC_COD;
+        lp->rx_next_done  = 0;
        lp->rx_chain_head = 0;
        lp->rx_chain_tail = 0;
        lp->rx_chain_status = desc_empty;
diff --git a/drivers/net/macb.c b/drivers/net/macb.c
index a04da4ecaa88..f6c4936e2fa8 100644
--- a/drivers/net/macb.c
+++ b/drivers/net/macb.c
@@ -321,6 +321,10 @@ static void macb_tx(struct macb *bp)
                printk(KERN_ERR "%s: TX underrun, resetting buffers\n",
                        bp->dev->name);
+                /* Transfer ongoing, disable transmitter, to avoid confusion */
+                if (status & MACB_BIT(TGO))
+                        macb_writel(bp, NCR, macb_readl(bp, NCR) & ~MACB_BIT(TE));
                head = bp->tx_head;
                /*Mark all the buffer as used to avoid sending a lost buffer*/
@@ -343,6 +347,10 @@ static void macb_tx(struct macb *bp)
                }
                bp->tx_head = bp->tx_tail = 0;
+                /* Enable the transmitter again */
+                if (status & MACB_BIT(TGO))
+                        macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(TE));
        }
        if (!(status & MACB_BIT(COMP)))
diff --git a/drivers/net/mlx4/profile.c b/drivers/net/mlx4/profile.c
index 919fb9eb1b62..cebdf3243ca1 100644
--- a/drivers/net/mlx4/profile.c
+++ b/drivers/net/mlx4/profile.c
@@ -107,9 +107,9 @@ u64 mlx4_make_profile(struct mlx4_dev *dev,
        profile[MLX4_RES_AUXC].num    = request->num_qp;
        profile[MLX4_RES_SRQ].num     = request->num_srq;
        profile[MLX4_RES_CQ].num      = request->num_cq;
-        profile[MLX4_RES_EQ].num      = min(dev_cap->max_eqs,
+        profile[MLX4_RES_EQ].num      = min_t(unsigned, dev_cap->max_eqs,
-                                            dev_cap->reserved_eqs +
+                                              dev_cap->reserved_eqs +
-                                            num_possible_cpus() + 1);
+                                              num_possible_cpus() + 1);
        profile[MLX4_RES_DMPT].num    = request->num_mpt;
        profile[MLX4_RES_CMPT].num    = MLX4_NUM_CMPTS;
        profile[MLX4_RES_MTT].num     = request->num_mtt;
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 7253a499d9c8..5f31bbb614af 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -136,21 +136,23 @@ static char mv643xx_eth_driver_version[] = "1.4";
 /*
 * SDMA configuration register.
 */
+#define RX_BURST_SIZE_4_64BIT           (2 << 1)
 #define RX_BURST_SIZE_16_64BIT          (4 << 1)
 #define BLM_RX_NO_SWAP                  (1 << 4)
 #define BLM_TX_NO_SWAP                  (1 << 5)
+#define TX_BURST_SIZE_4_64BIT           (2 << 22)
 #define TX_BURST_SIZE_16_64BIT          (4 << 22)
 #if defined(__BIG_ENDIAN)
 #define PORT_SDMA_CONFIG_DEFAULT_VALUE          \
-                (RX_BURST_SIZE_16_64BIT |       \
+                (RX_BURST_SIZE_4_64BIT  |       \
-                TX_BURST_SIZE_16_64BIT)
+                 TX_BURST_SIZE_4_64BIT)
 #elif defined(__LITTLE_ENDIAN)
 #define PORT_SDMA_CONFIG_DEFAULT_VALUE          \
-                (RX_BURST_SIZE_16_64BIT |       \
+                (RX_BURST_SIZE_4_64BIT  |       \
-                BLM_RX_NO_SWAP          |       \
+                 BLM_RX_NO_SWAP         |       \
-                BLM_TX_NO_SWAP          |       \
+                 BLM_TX_NO_SWAP         |       \
-                TX_BURST_SIZE_16_64BIT)
+                 TX_BURST_SIZE_4_64BIT)
 #else
 #error One of __BIG_ENDIAN or __LITTLE_ENDIAN must be defined
 #endif
@@ -1594,7 +1596,7 @@ oom:
                        entry = addr_crc(a);
                }
-                table[entry >> 2] |= 1 << (entry & 3);
+                table[entry >> 2] |= 1 << (8 * (entry & 3));
        }
        for (i = 0; i < 0x100; i += 4) {
@@ -2210,6 +2212,7 @@ static int mv643xx_eth_stop(struct net_device *dev)
        struct mv643xx_eth_private *mp = netdev_priv(dev);
        int i;
+        wrlp(mp, INT_MASK_EXT, 0x00000000);
        wrlp(mp, INT_MASK, 0x00000000);
        rdlp(mp, INT_MASK);
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index 6bb71b687f7b..e9c1296b267e 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -1,7 +1,7 @@
 /*************************************************************************
 * myri10ge.c: Myricom Myri-10G Ethernet driver.
 *
- * Copyright (C) 2005 - 2007 Myricom, Inc.
+ * Copyright (C) 2005 - 2009 Myricom, Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -75,7 +75,7 @@
 #include "myri10ge_mcp.h"
 #include "myri10ge_mcp_gen_header.h"
-#define MYRI10GE_VERSION_STR "1.4.4-1.398"
+#define MYRI10GE_VERSION_STR "1.4.4-1.401"
 MODULE_DESCRIPTION("Myricom 10G driver (10GbE)");
 MODULE_AUTHOR("Maintainer: help@myri.com");
@@ -3786,7 +3786,7 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (status != 0) {
                dev_err(&pdev->dev, "Error %d writing PCI_EXP_DEVCTL\n",
                        status);
-                goto abort_with_netdev;
+                goto abort_with_enabled;
        }
        pci_set_master(pdev);
@@ -3801,13 +3801,13 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        }
        if (status != 0) {
                dev_err(&pdev->dev, "Error %d setting DMA mask\n", status);
-                goto abort_with_netdev;
+                goto abort_with_enabled;
        }
        (void)pci_set_consistent_dma_mask(pdev, DMA_64BIT_MASK);
        mgp->cmd = dma_alloc_coherent(&pdev->dev, sizeof(*mgp->cmd),
                                      &mgp->cmd_bus, GFP_KERNEL);
        if (mgp->cmd == NULL)
-                goto abort_with_netdev;
+                goto abort_with_enabled;
        mgp->board_span = pci_resource_len(pdev, 0);
        mgp->iomem_base = pci_resource_start(pdev, 0);
@@ -3943,8 +3943,10 @@ abort_with_mtrr:
        dma_free_coherent(&pdev->dev, sizeof(*mgp->cmd),
                          mgp->cmd, mgp->cmd_bus);
-abort_with_netdev:
+abort_with_enabled:
+        pci_disable_device(pdev);
+abort_with_netdev:
        free_netdev(netdev);
        return status;
 }
@@ -3990,6 +3992,7 @@ static void myri10ge_remove(struct pci_dev *pdev)
                          mgp->cmd, mgp->cmd_bus);
        free_netdev(netdev);
+        pci_disable_device(pdev);
        pci_set_drvdata(pdev, NULL);
 }
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index c11c568fd7db..9c78c963b721 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -146,7 +146,7 @@
 #define MAX_RX_BUFFER_LENGTH            1760
 #define MAX_RX_JUMBO_BUFFER_LENGTH      8062
-#define MAX_RX_LRO_BUFFER_LENGTH        ((48*1024)-512)
+#define MAX_RX_LRO_BUFFER_LENGTH        (8062)
 #define RX_DMA_MAP_LEN                  (MAX_RX_BUFFER_LENGTH - 2)
 #define RX_JUMBO_DMA_MAP_LEN    \
        (MAX_RX_JUMBO_BUFFER_LENGTH - 2)
@@ -207,11 +207,11 @@
 #define MAX_CMD_DESCRIPTORS             4096
 #define MAX_RCV_DESCRIPTORS             16384
-#define MAX_CMD_DESCRIPTORS_HOST        (MAX_CMD_DESCRIPTORS / 4)
+#define MAX_CMD_DESCRIPTORS_HOST        1024
-#define MAX_RCV_DESCRIPTORS_1G          (MAX_RCV_DESCRIPTORS / 4)
+#define MAX_RCV_DESCRIPTORS_1G          2048
-#define MAX_RCV_DESCRIPTORS_10G         8192
+#define MAX_RCV_DESCRIPTORS_10G         4096
 #define MAX_JUMBO_RCV_DESCRIPTORS       1024
-#define MAX_LRO_RCV_DESCRIPTORS         64
+#define MAX_LRO_RCV_DESCRIPTORS         8
 #define MAX_RCVSTATUS_DESCRIPTORS       MAX_RCV_DESCRIPTORS
 #define MAX_JUMBO_RCV_DESC      MAX_JUMBO_RCV_DESCRIPTORS
 #define MAX_RCV_DESC            MAX_RCV_DESCRIPTORS
diff --git a/drivers/net/netxen/netxen_nic_ethtool.c b/drivers/net/netxen/netxen_nic_ethtool.c
index c0bd40fcf708..0894a7be0225 100644
--- a/drivers/net/netxen/netxen_nic_ethtool.c
+++ b/drivers/net/netxen/netxen_nic_ethtool.c
@@ -561,7 +561,10 @@ netxen_nic_get_ringparam(struct net_device *dev, struct ethtool_ringparam *ring)
        }
        ring->tx_pending = adapter->max_tx_desc_count;
-        ring->rx_max_pending = MAX_RCV_DESCRIPTORS;
+        if (adapter->ahw.board_type == NETXEN_NIC_GBE)
+                ring->rx_max_pending = MAX_RCV_DESCRIPTORS_1G;
+        else
+                ring->rx_max_pending = MAX_RCV_DESCRIPTORS_10G;
        ring->tx_max_pending = MAX_CMD_DESCRIPTORS_HOST;
        ring->rx_jumbo_max_pending = MAX_JUMBO_RCV_DESCRIPTORS;
        ring->rx_mini_max_pending = 0;
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index ca7c8d8050c9..ffd37bea1628 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -947,8 +947,10 @@ int netxen_pinit_from_rom(struct netxen_adapter *adapter, int verbose)
        }
        for (i = 0; i < n; i++) {
                if (netxen_rom_fast_read(adapter, 8*i + 4*offset, &val) != 0 ||
-                netxen_rom_fast_read(adapter, 8*i + 4*offset + 4, &addr) != 0)
+                netxen_rom_fast_read(adapter, 8*i + 4*offset + 4, &addr) != 0) {
+                        kfree(buf);
                        return -EIO;
+                }
                buf[i].addr = addr;
                buf[i].data = val;
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index d854f07ef4d3..645d384fe87e 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -735,17 +735,18 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        SET_ETHTOOL_OPS(netdev, &netxen_nic_ethtool_ops);
-        /* ScatterGather support */
+        netdev->features |= (NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO);
-        netdev->features = NETIF_F_SG;
+        netdev->vlan_features |= (NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO);
-        netdev->features |= NETIF_F_IP_CSUM;
-        netdev->features |= NETIF_F_TSO;
        if (NX_IS_REVISION_P3(revision_id)) {
-                netdev->features |= NETIF_F_IPV6_CSUM;
+                netdev->features |= (NETIF_F_IPV6_CSUM | NETIF_F_TSO6);
-                netdev->features |= NETIF_F_TSO6;
+                netdev->vlan_features |= (NETIF_F_IPV6_CSUM | NETIF_F_TSO6);
        }
-        if (adapter->pci_using_dac)
+        if (adapter->pci_using_dac) {
                netdev->features |= NETIF_F_HIGHDMA;
+                netdev->vlan_features |= NETIF_F_HIGHDMA;
+        }
        /*
         * Set the CRB window to invalid. If any register in window 0 is
@@ -1166,6 +1167,14 @@ static bool netxen_tso_check(struct net_device *netdev,
 {
        bool tso = false;
        u8 opcode = TX_ETHER_PKT;
+        __be16 protocol = skb->protocol;
+        u16 flags = 0;
+        if (protocol == __constant_htons(ETH_P_8021Q)) {
+                struct vlan_ethhdr *vh = (struct vlan_ethhdr *)skb->data;
+                protocol = vh->h_vlan_encapsulated_proto;
+                flags = FLAGS_VLAN_TAGGED;
+        }
        if ((netdev->features & (NETIF_F_TSO | NETIF_F_TSO6)) &&
                        skb_shinfo(skb)->gso_size > 0) {
@@ -1174,21 +1183,21 @@ static bool netxen_tso_check(struct net_device *netdev,
                desc->total_hdr_length =
                        skb_transport_offset(skb) + tcp_hdrlen(skb);
-                opcode = (skb->protocol == htons(ETH_P_IPV6)) ?
+                opcode = (protocol == __constant_htons(ETH_P_IPV6)) ?
                                TX_TCP_LSO6 : TX_TCP_LSO;
                tso = true;
        } else if (skb->ip_summed == CHECKSUM_PARTIAL) {
                u8 l4proto;
-                if (skb->protocol == htons(ETH_P_IP)) {
+                if (protocol == __constant_htons(ETH_P_IP)) {
                        l4proto = ip_hdr(skb)->protocol;
                        if (l4proto == IPPROTO_TCP)
                                opcode = TX_TCP_PKT;
                        else if(l4proto == IPPROTO_UDP)
                                opcode = TX_UDP_PKT;
-                } else if (skb->protocol == htons(ETH_P_IPV6)) {
+                } else if (protocol == __constant_htons(ETH_P_IPV6)) {
                        l4proto = ipv6_hdr(skb)->nexthdr;
                        if (l4proto == IPPROTO_TCP)
@@ -1199,7 +1208,7 @@ static bool netxen_tso_check(struct net_device *netdev,
        }
        desc->tcp_hdr_offset = skb_transport_offset(skb);
        desc->ip_hdr_offset = skb_network_offset(skb);
-        netxen_set_tx_flags_opcode(desc, 0, opcode);
+        netxen_set_tx_flags_opcode(desc, flags, opcode);
        return tso;
 }
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index c38ed777f0a8..a6999403f37b 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -586,7 +586,7 @@ static int pcnet_config(struct pcmcia_device *link)
    }
    if ((link->conf.ConfigBase == 0x03c0)
-        && (link->manf_id == 0x149) && (link->card_id = 0xc1ab)) {
+        && (link->manf_id == 0x149) && (link->card_id == 0xc1ab)) {
        printk(KERN_INFO "pcnet_cs: this is an AX88190 card!\n");
        printk(KERN_INFO "pcnet_cs: use axnet_cs instead.\n");
        goto failed;
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 11adf6ed4628..811a637695ca 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -296,9 +296,8 @@ static int mdio_bus_suspend(struct device * dev, pm_message_t state)
        struct phy_driver *phydrv = to_phy_driver(drv);
        struct phy_device *phydev = to_phy_device(dev);
-        if ((!device_may_wakeup(phydev->dev.parent)) &&
+        if (drv && phydrv->suspend && !device_may_wakeup(phydev->dev.parent))
-                (phydrv && phydrv->suspend))
+                ret = phydrv->suspend(phydev);
-                        ret = phydrv->suspend(phydev);
        return ret;
 }
@@ -310,8 +309,7 @@ static int mdio_bus_resume(struct device * dev)
        struct phy_driver *phydrv = to_phy_driver(drv);
        struct phy_device *phydev = to_phy_device(dev);
-        if ((!device_may_wakeup(phydev->dev.parent)) &&
+        if (drv && phydrv->resume && !device_may_wakeup(phydev->dev.parent))
-                (phydrv && phydrv->resume))
                ret = phydrv->resume(phydev);
        return ret;
diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c
index c05d38d46350..1387187543e4 100644
--- a/drivers/net/phy/smsc.c
+++ b/drivers/net/phy/smsc.c
@@ -81,6 +81,9 @@ static struct phy_driver lan83c185_driver = {
        .ack_interrupt  = smsc_phy_ack_interrupt,
        .config_intr    = smsc_phy_config_intr,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
        .driver         = { .owner = THIS_MODULE, }
 };
@@ -102,6 +105,9 @@ static struct phy_driver lan8187_driver = {
        .ack_interrupt  = smsc_phy_ack_interrupt,
        .config_intr    = smsc_phy_config_intr,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
        .driver         = { .owner = THIS_MODULE, }
 };
@@ -123,6 +129,9 @@ static struct phy_driver lan8700_driver = {
        .ack_interrupt  = smsc_phy_ack_interrupt,
        .config_intr    = smsc_phy_config_intr,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
        .driver         = { .owner = THIS_MODULE, }
 };
@@ -144,6 +153,9 @@ static struct phy_driver lan911x_int_driver = {
        .ack_interrupt  = smsc_phy_ack_interrupt,
        .config_intr    = smsc_phy_config_intr,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
        .driver         = { .owner = THIS_MODULE, }
 };
diff --git a/drivers/net/ps3_gelic_wireless.c b/drivers/net/ps3_gelic_wireless.c
index ec2314246682..335da4831ab3 100644
--- a/drivers/net/ps3_gelic_wireless.c
+++ b/drivers/net/ps3_gelic_wireless.c
@@ -2168,7 +2168,7 @@ static void gelic_wl_connected_event(struct gelic_wl_info *wl,
                complete(&wl->assoc_done);
                netif_carrier_on(port_to_netdev(wl_port(wl)));
        } else
-                pr_debug("%s: event %#lx under wpa\n",
+                pr_debug("%s: event %#llx under wpa\n",
                                 __func__, event);
 }
diff --git a/drivers/net/qlge/qlge.h b/drivers/net/qlge/qlge.h
index c1dadadfab18..e6fdce9206cc 100644
--- a/drivers/net/qlge/qlge.h
+++ b/drivers/net/qlge/qlge.h
@@ -787,12 +787,12 @@ struct mbox_params {
 struct flash_params {
        u8 dev_id_str[4];
-        u16 size;
+        __le16 size;
-        u16 csum;
+        __le16 csum;
-        u16 ver;
+        __le16 ver;
-        u16 sub_dev_id;
+        __le16 sub_dev_id;
        u8 mac_addr[6];
-        u16 res;
+        __le16 res;
 };
diff --git a/drivers/net/qlge/qlge_main.c b/drivers/net/qlge/qlge_main.c
index 45421c8b6010..3d1d7b6e55aa 100644
--- a/drivers/net/qlge/qlge_main.c
+++ b/drivers/net/qlge/qlge_main.c
@@ -641,7 +641,7 @@ static void ql_enable_all_completion_interrupts(struct ql_adapter *qdev)
 }
-static int ql_read_flash_word(struct ql_adapter *qdev, int offset, u32 *data)
+static int ql_read_flash_word(struct ql_adapter *qdev, int offset, __le32 *data)
 {
        int status = 0;
        /* wait for reg to come ready */
@@ -656,8 +656,11 @@ static int ql_read_flash_word(struct ql_adapter *qdev, int offset, u32 *data)
                        FLASH_ADDR, FLASH_ADDR_RDY, FLASH_ADDR_ERR);
        if (status)
                goto exit;
-        /* get the data */
+         /* This data is stored on flash as an array of
-        *data = ql_read32(qdev, FLASH_DATA);
+         * __le32.  Since ql_read32() returns cpu endian
+         * we need to swap it back.
+         */
+        *data = cpu_to_le32(ql_read32(qdev, FLASH_DATA));
 exit:
        return status;
 }
@@ -666,13 +669,20 @@ static int ql_get_flash_params(struct ql_adapter *qdev)
 {
        int i;
        int status;
-        u32 *p = (u32 *)&qdev->flash;
+        __le32 *p = (__le32 *)&qdev->flash;
+        u32 offset = 0;
+        /* Second function's parameters follow the first
+         * function's.
+         */
+        if (qdev->func)
+                offset = sizeof(qdev->flash) / sizeof(u32);
        if (ql_sem_spinlock(qdev, SEM_FLASH_MASK))
                return -ETIMEDOUT;
        for (i = 0; i < sizeof(qdev->flash) / sizeof(u32); i++, p++) {
-                status = ql_read_flash_word(qdev, i, p);
+                status = ql_read_flash_word(qdev, i+offset, p);
                if (status) {
                        QPRINTK(qdev, IFUP, ERR, "Error reading flash.\n");
                        goto exit;
@@ -3826,7 +3836,7 @@ static int qlge_suspend(struct pci_dev *pdev, pm_message_t state)
 {
        struct net_device *ndev = pci_get_drvdata(pdev);
        struct ql_adapter *qdev = netdev_priv(ndev);
-        int err;
+        int err, i;
        netif_device_detach(ndev);
@@ -3836,6 +3846,9 @@ static int qlge_suspend(struct pci_dev *pdev, pm_message_t state)
                        return err;
        }
+        for (i = qdev->rss_ring_first_cq_id; i < qdev->rx_ring_count; i++)
+                netif_napi_del(&qdev->rx_ring[i].napi);
        err = pci_save_state(pdev);
        if (err)
                return err;
diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
index 72fd9e97c190..b2dcdb5ed8bd 100644
--- a/drivers/net/r6040.c
+++ b/drivers/net/r6040.c
@@ -438,7 +438,6 @@ static void r6040_down(struct net_device *dev)
 {
        struct r6040_private *lp = netdev_priv(dev);
        void __iomem *ioaddr = lp->base;
-        struct pci_dev *pdev = lp->pdev;
        int limit = 2048;
        u16 *adrp;
        u16 cmd;
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index 7673fd92eaf5..ab0e09bf154d 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -676,9 +676,8 @@ static int efx_init_port(struct efx_nic *efx)
        rc = efx->phy_op->init(efx);
        if (rc)
                return rc;
-        efx->phy_op->reconfigure(efx);
        mutex_lock(&efx->mac_lock);
+        efx->phy_op->reconfigure(efx);
        rc = falcon_switch_mac(efx);
        mutex_unlock(&efx->mac_lock);
        if (rc)
@@ -686,7 +685,7 @@ static int efx_init_port(struct efx_nic *efx)
        efx->mac_op->reconfigure(efx);
        efx->port_initialized = true;
-        efx->stats_enabled = true;
+        efx_stats_enable(efx);
        return 0;
 fail:
@@ -735,6 +734,7 @@ static void efx_fini_port(struct efx_nic *efx)
        if (!efx->port_initialized)
                return;
+        efx_stats_disable(efx);
        efx->phy_op->fini(efx);
        efx->port_initialized = false;
@@ -1361,6 +1361,20 @@ static int efx_net_stop(struct net_device *net_dev)
        return 0;
 }
+void efx_stats_disable(struct efx_nic *efx)
+{
+        spin_lock(&efx->stats_lock);
+        ++efx->stats_disable_count;
+        spin_unlock(&efx->stats_lock);
+}
+void efx_stats_enable(struct efx_nic *efx)
+{
+        spin_lock(&efx->stats_lock);
+        --efx->stats_disable_count;
+        spin_unlock(&efx->stats_lock);
+}
 /* Context: process, dev_base_lock or RTNL held, non-blocking. */
 static struct net_device_stats *efx_net_stats(struct net_device *net_dev)
 {
@@ -1369,12 +1383,12 @@ static struct net_device_stats *efx_net_stats(struct net_device *net_dev)
        struct net_device_stats *stats = &net_dev->stats;
        /* Update stats if possible, but do not wait if another thread
-         * is updating them (or resetting the NIC); slightly stale
+         * is updating them or if MAC stats fetches are temporarily
-         * stats are acceptable.
+         * disabled; slightly stale stats are acceptable.
         */
        if (!spin_trylock(&efx->stats_lock))
                return stats;
-        if (efx->stats_enabled) {
+        if (!efx->stats_disable_count) {
                efx->mac_op->update_stats(efx);
                falcon_update_nic_stats(efx);
        }
@@ -1622,16 +1636,12 @@ static void efx_unregister_netdev(struct efx_nic *efx)
 /* Tears down the entire software state and most of the hardware state
 * before reset.  */
-void efx_reset_down(struct efx_nic *efx, struct ethtool_cmd *ecmd)
+void efx_reset_down(struct efx_nic *efx, enum reset_type method,
+                    struct ethtool_cmd *ecmd)
 {
        EFX_ASSERT_RESET_SERIALISED(efx);
-        /* The net_dev->get_stats handler is quite slow, and will fail
+        efx_stats_disable(efx);
-         * if a fetch is pending over reset. Serialise against it. */
-        spin_lock(&efx->stats_lock);
-        efx->stats_enabled = false;
-        spin_unlock(&efx->stats_lock);
        efx_stop_all(efx);
        mutex_lock(&efx->mac_lock);
        mutex_lock(&efx->spi_lock);
@@ -1639,6 +1649,8 @@ void efx_reset_down(struct efx_nic *efx, struct ethtool_cmd *ecmd)
        efx->phy_op->get_settings(efx, ecmd);
        efx_fini_channels(efx);
+        if (efx->port_initialized && method != RESET_TYPE_INVISIBLE)
+                efx->phy_op->fini(efx);
 }
 /* This function will always ensure that the locks acquired in
@@ -1646,7 +1658,8 @@ void efx_reset_down(struct efx_nic *efx, struct ethtool_cmd *ecmd)
 * that we were unable to reinitialise the hardware, and the
 * driver should be disabled. If ok is false, then the rx and tx
 * engines are not restarted, pending a RESET_DISABLE. */
-int efx_reset_up(struct efx_nic *efx, struct ethtool_cmd *ecmd, bool ok)
+int efx_reset_up(struct efx_nic *efx, enum reset_type method,
+                 struct ethtool_cmd *ecmd, bool ok)
 {
        int rc;
@@ -1658,6 +1671,15 @@ int efx_reset_up(struct efx_nic *efx, struct ethtool_cmd *ecmd, bool ok)
                ok = false;
        }
+        if (efx->port_initialized && method != RESET_TYPE_INVISIBLE) {
+                if (ok) {
+                        rc = efx->phy_op->init(efx);
+                        if (rc)
+                                ok = false;
+                } else
+                        efx->port_initialized = false;
+        }
        if (ok) {
                efx_init_channels(efx);
@@ -1670,7 +1692,7 @@ int efx_reset_up(struct efx_nic *efx, struct ethtool_cmd *ecmd, bool ok)
        if (ok) {
                efx_start_all(efx);
-                efx->stats_enabled = true;
+                efx_stats_enable(efx);
        }
        return rc;
 }
@@ -1702,7 +1724,7 @@ static int efx_reset(struct efx_nic *efx)
        EFX_INFO(efx, "resetting (%d)\n", method);
-        efx_reset_down(efx, &ecmd);
+        efx_reset_down(efx, method, &ecmd);
        rc = falcon_reset_hw(efx, method);
        if (rc) {
@@ -1721,10 +1743,10 @@ static int efx_reset(struct efx_nic *efx)
        /* Leave device stopped if necessary */
        if (method == RESET_TYPE_DISABLE) {
-                efx_reset_up(efx, &ecmd, false);
+                efx_reset_up(efx, method, &ecmd, false);
                rc = -EIO;
        } else {
-                rc = efx_reset_up(efx, &ecmd, true);
+                rc = efx_reset_up(efx, method, &ecmd, true);
        }
 out_disable:
@@ -1876,6 +1898,7 @@ static int efx_init_struct(struct efx_nic *efx, struct efx_nic_type *type,
        efx->rx_checksum_enabled = true;
        spin_lock_init(&efx->netif_stop_lock);
        spin_lock_init(&efx->stats_lock);
+        efx->stats_disable_count = 1;
        mutex_init(&efx->mac_lock);
        efx->mac_op = &efx_dummy_mac_operations;
        efx->phy_op = &efx_dummy_phy_operations;
diff --git a/drivers/net/sfc/efx.h b/drivers/net/sfc/efx.h
index 0dd7a532c78a..55d0f131b0e9 100644
--- a/drivers/net/sfc/efx.h
+++ b/drivers/net/sfc/efx.h
@@ -36,13 +36,16 @@ extern void efx_process_channel_now(struct efx_channel *channel);
 extern void efx_flush_queues(struct efx_nic *efx);
 /* Ports */
+extern void efx_stats_disable(struct efx_nic *efx);
+extern void efx_stats_enable(struct efx_nic *efx);
 extern void efx_reconfigure_port(struct efx_nic *efx);
 extern void __efx_reconfigure_port(struct efx_nic *efx);
 /* Reset handling */
-extern void efx_reset_down(struct efx_nic *efx, struct ethtool_cmd *ecmd);
+extern void efx_reset_down(struct efx_nic *efx, enum reset_type method,
-extern int efx_reset_up(struct efx_nic *efx, struct ethtool_cmd *ecmd,
+                           struct ethtool_cmd *ecmd);
-                        bool ok);
+extern int efx_reset_up(struct efx_nic *efx, enum reset_type method,
+                        struct ethtool_cmd *ecmd, bool ok);
 /* Global */
 extern void efx_schedule_reset(struct efx_nic *efx, enum reset_type type);
diff --git a/drivers/net/sfc/ethtool.c b/drivers/net/sfc/ethtool.c
index 53d259e90187..7b5924c039b3 100644
--- a/drivers/net/sfc/ethtool.c
+++ b/drivers/net/sfc/ethtool.c
@@ -219,9 +219,6 @@ int efx_ethtool_set_settings(struct net_device *net_dev,
        struct efx_nic *efx = netdev_priv(net_dev);
        int rc;
-        if (EFX_WORKAROUND_13963(efx) && !ecmd->autoneg)
-                return -EINVAL;
        /* Falcon GMAC does not support 1000Mbps HD */
        if (ecmd->speed == SPEED_1000 && ecmd->duplex != DUPLEX_FULL) {
                EFX_LOG(efx, "rejecting unsupported 1000Mbps HD"
diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
index 5b9f2d9cc4ed..d5378e60fcdd 100644
--- a/drivers/net/sfc/falcon.c
+++ b/drivers/net/sfc/falcon.c
@@ -824,10 +824,6 @@ static void falcon_handle_rx_not_ok(struct efx_rx_queue *rx_queue,
                            rx_ev_pause_frm ? " [PAUSE]" : "");
        }
 #endif
-        if (unlikely(rx_ev_eth_crc_err && EFX_WORKAROUND_10750(efx) &&
-                     efx->phy_type == PHY_TYPE_SFX7101))
-                tenxpress_crc_err(efx);
 }
 /* Handle receive events that are not in-order. */
@@ -1887,7 +1883,7 @@ static int falcon_reset_macs(struct efx_nic *efx)
        /* MAC stats will fail whilst the TX fifo is draining. Serialise
         * the drain sequence with the statistics fetch */
-        spin_lock(&efx->stats_lock);
+        efx_stats_disable(efx);
        falcon_read(efx, &reg, MAC0_CTRL_REG_KER);
        EFX_SET_OWORD_FIELD(reg, TXFIFO_DRAIN_EN_B0, 1);
@@ -1917,7 +1913,7 @@ static int falcon_reset_macs(struct efx_nic *efx)
                udelay(10);
        }
-        spin_unlock(&efx->stats_lock);
+        efx_stats_enable(efx);
        /* If we've reset the EM block and the link is up, then
         * we'll have to kick the XAUI link so the PHY can recover */
@@ -2277,6 +2273,10 @@ int falcon_switch_mac(struct efx_nic *efx)
        struct efx_mac_operations *old_mac_op = efx->mac_op;
        efx_oword_t nic_stat;
        unsigned strap_val;
+        int rc = 0;
+        /* Don't try to fetch MAC stats while we're switching MACs */
+        efx_stats_disable(efx);
        /* Internal loopbacks override the phy speed setting */
        if (efx->loopback_mode == LOOPBACK_GMAC) {
@@ -2287,16 +2287,12 @@ int falcon_switch_mac(struct efx_nic *efx)
                efx->link_fd = true;
        }
+        WARN_ON(!mutex_is_locked(&efx->mac_lock));
        efx->mac_op = (EFX_IS10G(efx) ?
                       &falcon_xmac_operations : &falcon_gmac_operations);
-        if (old_mac_op == efx->mac_op)
-                return 0;
-        WARN_ON(!mutex_is_locked(&efx->mac_lock));
-        /* Not all macs support a mac-level link state */
-        efx->mac_up = true;
+        /* Always push the NIC_STAT_REG setting even if the mac hasn't
+         * changed, because this function is run post online reset */
        falcon_read(efx, &nic_stat, NIC_STAT_REG);
        strap_val = EFX_IS10G(efx) ? 5 : 3;
        if (falcon_rev(efx) >= FALCON_REV_B0) {
@@ -2309,9 +2305,17 @@ int falcon_switch_mac(struct efx_nic *efx)
                BUG_ON(EFX_OWORD_FIELD(nic_stat, STRAP_PINS) != strap_val);
        }
+        if (old_mac_op == efx->mac_op)
+                goto out;
        EFX_LOG(efx, "selected %cMAC\n", EFX_IS10G(efx) ? 'X' : 'G');
-        return falcon_reset_macs(efx);
+        /* Not all macs support a mac-level link state */
+        efx->mac_up = true;
+        rc = falcon_reset_macs(efx);
+out:
+        efx_stats_enable(efx);
+        return rc;
 }
 /* This call is responsible for hooking in the MAC and PHY operations */
diff --git a/drivers/net/sfc/mdio_10g.c b/drivers/net/sfc/mdio_10g.c
index f6a16428113d..f9e2f95c3b48 100644
--- a/drivers/net/sfc/mdio_10g.c
+++ b/drivers/net/sfc/mdio_10g.c
@@ -15,6 +15,7 @@
 #include "net_driver.h"
 #include "mdio_10g.h"
 #include "boards.h"
+#include "workarounds.h"
 int mdio_clause45_reset_mmd(struct efx_nic *port, int mmd,
                            int spins, int spintime)
@@ -179,17 +180,12 @@ bool mdio_clause45_links_ok(struct efx_nic *efx, unsigned int mmd_mask)
                return false;
        else if (efx_phy_mode_disabled(efx->phy_mode))
                return false;
-        else if (efx->loopback_mode == LOOPBACK_PHYXS) {
+        else if (efx->loopback_mode == LOOPBACK_PHYXS)
                mmd_mask &= ~(MDIO_MMDREG_DEVS_PHYXS |
                              MDIO_MMDREG_DEVS_PCS |
                              MDIO_MMDREG_DEVS_PMAPMD |
                              MDIO_MMDREG_DEVS_AN);
-                if (!mmd_mask) {
+        else if (efx->loopback_mode == LOOPBACK_PCS)
-                        reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_PHYXS,
-                                                 MDIO_PHYXS_STATUS2);
-                        return !(reg & (1 << MDIO_PHYXS_STATUS2_RX_FAULT_LBN));
-                }
-        } else if (efx->loopback_mode == LOOPBACK_PCS)
                mmd_mask &= ~(MDIO_MMDREG_DEVS_PCS |
                              MDIO_MMDREG_DEVS_PMAPMD |
                              MDIO_MMDREG_DEVS_AN);
@@ -197,6 +193,13 @@ bool mdio_clause45_links_ok(struct efx_nic *efx, unsigned int mmd_mask)
                mmd_mask &= ~(MDIO_MMDREG_DEVS_PMAPMD |
                              MDIO_MMDREG_DEVS_AN);
+        if (!mmd_mask) {
+                /* Use presence of XGMII faults in leui of link state */
+                reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_PHYXS,
+                                         MDIO_PHYXS_STATUS2);
+                return !(reg & (1 << MDIO_PHYXS_STATUS2_RX_FAULT_LBN));
+        }
        while (mmd_mask) {
                if (mmd_mask & 1) {
                        /* Double reads because link state is latched, and a
@@ -263,7 +266,7 @@ void mdio_clause45_set_mmds_lpower(struct efx_nic *efx,
        }
 }
-static u32 mdio_clause45_get_an(struct efx_nic *efx, u16 addr, u32 xnp)
+static u32 mdio_clause45_get_an(struct efx_nic *efx, u16 addr)
 {
        int phy_id = efx->mii.phy_id;
        u32 result = 0;
@@ -278,9 +281,6 @@ static u32 mdio_clause45_get_an(struct efx_nic *efx, u16 addr, u32 xnp)
                result |= ADVERTISED_100baseT_Half;
        if (reg & ADVERTISE_100FULL)
                result |= ADVERTISED_100baseT_Full;
-        if (reg & LPA_RESV)
-                result |= xnp;
        return result;
 }
@@ -310,7 +310,7 @@ void mdio_clause45_get_settings(struct efx_nic *efx,
 */
 void mdio_clause45_get_settings_ext(struct efx_nic *efx,
                                    struct ethtool_cmd *ecmd,
-                                    u32 xnp, u32 xnp_lpa)
+                                    u32 npage_adv, u32 npage_lpa)
 {
        int phy_id = efx->mii.phy_id;
        int reg;
@@ -361,8 +361,8 @@ void mdio_clause45_get_settings_ext(struct efx_nic *efx,
                        ecmd->autoneg = AUTONEG_ENABLE;
                        ecmd->advertising |=
                                ADVERTISED_Autoneg |
-                                mdio_clause45_get_an(efx,
+                                mdio_clause45_get_an(efx, MDIO_AN_ADVERTISE) |
-                                                     MDIO_AN_ADVERTISE, xnp);
+                                npage_adv;
                } else
                        ecmd->autoneg = AUTONEG_DISABLE;
        } else
@@ -371,27 +371,30 @@ void mdio_clause45_get_settings_ext(struct efx_nic *efx,
        if (ecmd->autoneg) {
                /* If AN is complete, report best common mode,
                 * otherwise report best advertised mode. */
-                u32 common = ecmd->advertising;
+                u32 modes = 0;
                if (mdio_clause45_read(efx, phy_id, MDIO_MMD_AN,
                                       MDIO_MMDREG_STAT1) &
-                    (1 << MDIO_AN_STATUS_AN_DONE_LBN)) {
+                    (1 << MDIO_AN_STATUS_AN_DONE_LBN))
-                        common &= mdio_clause45_get_an(efx, MDIO_AN_LPA,
+                        modes = (ecmd->advertising &
-                                                       xnp_lpa);
+                                 (mdio_clause45_get_an(efx, MDIO_AN_LPA) |
-                }
+                                  npage_lpa));
-                if (common & ADVERTISED_10000baseT_Full) {
+                if (modes == 0)
+                        modes = ecmd->advertising;
+                if (modes & ADVERTISED_10000baseT_Full) {
                        ecmd->speed = SPEED_10000;
                        ecmd->duplex = DUPLEX_FULL;
-                } else if (common & (ADVERTISED_1000baseT_Full |
+                } else if (modes & (ADVERTISED_1000baseT_Full |
-                                     ADVERTISED_1000baseT_Half)) {
+                                    ADVERTISED_1000baseT_Half)) {
                        ecmd->speed = SPEED_1000;
-                        ecmd->duplex = !!(common & ADVERTISED_1000baseT_Full);
+                        ecmd->duplex = !!(modes & ADVERTISED_1000baseT_Full);
-                } else if (common & (ADVERTISED_100baseT_Full |
+                } else if (modes & (ADVERTISED_100baseT_Full |
-                                     ADVERTISED_100baseT_Half)) {
+                                    ADVERTISED_100baseT_Half)) {
                        ecmd->speed = SPEED_100;
-                        ecmd->duplex = !!(common & ADVERTISED_100baseT_Full);
+                        ecmd->duplex = !!(modes & ADVERTISED_100baseT_Full);
                } else {
                        ecmd->speed = SPEED_10;
-                        ecmd->duplex = !!(common & ADVERTISED_10baseT_Full);
+                        ecmd->duplex = !!(modes & ADVERTISED_10baseT_Full);
                }
        } else {
                /* Report forced settings */
@@ -415,7 +418,7 @@ int mdio_clause45_set_settings(struct efx_nic *efx,
        int phy_id = efx->mii.phy_id;
        struct ethtool_cmd prev;
        u32 required;
-        int ctrl1_bits, reg;
+        int reg;
        efx->phy_op->get_settings(efx, &prev);
@@ -430,99 +433,83 @@ int mdio_clause45_set_settings(struct efx_nic *efx,
        if (prev.port != PORT_TP || ecmd->port != PORT_TP)
                return -EINVAL;
-        /* Check that PHY supports these settings and work out the
+        /* Check that PHY supports these settings */
-         * basic control bits */
+        if (ecmd->autoneg) {
-        if (ecmd->duplex) {
+                required = SUPPORTED_Autoneg;
+        } else if (ecmd->duplex) {
                switch (ecmd->speed) {
-                case SPEED_10:
+                case SPEED_10:  required = SUPPORTED_10baseT_Full;  break;
-                        ctrl1_bits = BMCR_FULLDPLX;
+                case SPEED_100: required = SUPPORTED_100baseT_Full; break;
-                        required = SUPPORTED_10baseT_Full;
+                default:        return -EINVAL;
-                        break;
-                case SPEED_100:
-                        ctrl1_bits = BMCR_SPEED100 | BMCR_FULLDPLX;
-                        required = SUPPORTED_100baseT_Full;
-                        break;
-                case SPEED_1000:
-                        ctrl1_bits = BMCR_SPEED1000 | BMCR_FULLDPLX;
-                        required = SUPPORTED_1000baseT_Full;
-                        break;
-                case SPEED_10000:
-                        ctrl1_bits = (BMCR_SPEED1000 | BMCR_SPEED100 |
-                                      BMCR_FULLDPLX);
-                        required = SUPPORTED_10000baseT_Full;
-                        break;
-                default:
-                        return -EINVAL;
                }
        } else {
                switch (ecmd->speed) {
-                case SPEED_10:
+                case SPEED_10:  required = SUPPORTED_10baseT_Half;  break;
-                        ctrl1_bits = 0;
+                case SPEED_100: required = SUPPORTED_100baseT_Half; break;
-                        required = SUPPORTED_10baseT_Half;
+                default:        return -EINVAL;
-                        break;
-                case SPEED_100:
-                        ctrl1_bits = BMCR_SPEED100;
-                        required = SUPPORTED_100baseT_Half;
-                        break;
-                case SPEED_1000:
-                        ctrl1_bits = BMCR_SPEED1000;
-                        required = SUPPORTED_1000baseT_Half;
-                        break;
-                default:
-                        return -EINVAL;
                }
        }
-        if (ecmd->autoneg)
-                required |= SUPPORTED_Autoneg;
        required |= ecmd->advertising;
        if (required & ~prev.supported)
                return -EINVAL;
-        /* Set the basic control bits */
+        if (ecmd->autoneg) {
-        reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_PMAPMD,
+                bool xnp = (ecmd->advertising & ADVERTISED_10000baseT_Full
-                                 MDIO_MMDREG_CTRL1);
+                            || EFX_WORKAROUND_13204(efx));
-        reg &= ~(BMCR_SPEED1000 | BMCR_SPEED100 | BMCR_FULLDPLX | 0x003c);
-        reg |= ctrl1_bits;
+                /* Set up the base page */
-        mdio_clause45_write(efx, phy_id, MDIO_MMD_PMAPMD, MDIO_MMDREG_CTRL1,
+                reg = ADVERTISE_CSMA;
-                            reg);
+                if (ecmd->advertising & ADVERTISED_10baseT_Half)
+                        reg |= ADVERTISE_10HALF;
-        /* Set the AN registers */
+                if (ecmd->advertising & ADVERTISED_10baseT_Full)
-        if (ecmd->autoneg != prev.autoneg ||
+                        reg |= ADVERTISE_10FULL;
-            ecmd->advertising != prev.advertising) {
+                if (ecmd->advertising & ADVERTISED_100baseT_Half)
-                bool xnp = false;
+                        reg |= ADVERTISE_100HALF;
+                if (ecmd->advertising & ADVERTISED_100baseT_Full)
-                if (efx->phy_op->set_xnp_advertise)
+                        reg |= ADVERTISE_100FULL;
-                        xnp = efx->phy_op->set_xnp_advertise(efx,
+                if (xnp)
-                                                             ecmd->advertising);
+                        reg |= ADVERTISE_RESV;
+                else if (ecmd->advertising & (ADVERTISED_1000baseT_Half |
-                if (ecmd->autoneg) {
+                                              ADVERTISED_1000baseT_Full))
-                        reg = 0;
+                        reg |= ADVERTISE_NPAGE;
-                        if (ecmd->advertising & ADVERTISED_10baseT_Half)
+                reg |= efx_fc_advertise(efx->wanted_fc);
-                                reg |= ADVERTISE_10HALF;
+                mdio_clause45_write(efx, phy_id, MDIO_MMD_AN,
-                        if (ecmd->advertising & ADVERTISED_10baseT_Full)
+                                    MDIO_AN_ADVERTISE, reg);
-                                reg |= ADVERTISE_10FULL;
-                        if (ecmd->advertising & ADVERTISED_100baseT_Half)
+                /* Set up the (extended) next page if necessary */
-                                reg |= ADVERTISE_100HALF;
+                if (efx->phy_op->set_npage_adv)
-                        if (ecmd->advertising & ADVERTISED_100baseT_Full)
+                        efx->phy_op->set_npage_adv(efx, ecmd->advertising);
-                                reg |= ADVERTISE_100FULL;
-                        if (xnp)
-                                reg |= ADVERTISE_RESV;
-                        mdio_clause45_write(efx, phy_id, MDIO_MMD_AN,
-                                            MDIO_AN_ADVERTISE, reg);
-                }
+                /* Enable and restart AN */
                reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_AN,
                                         MDIO_MMDREG_CTRL1);
-                if (ecmd->autoneg)
+                reg |= BMCR_ANENABLE;
-                        reg |= BMCR_ANENABLE | BMCR_ANRESTART;
+                if (!(EFX_WORKAROUND_15195(efx) &&
-                else
+                      LOOPBACK_MASK(efx) & efx->phy_op->loopbacks))
-                        reg &= ~BMCR_ANENABLE;
+                        reg |= BMCR_ANRESTART;
                if (xnp)
                        reg |= 1 << MDIO_AN_CTRL_XNP_LBN;
                else
                        reg &= ~(1 << MDIO_AN_CTRL_XNP_LBN);
                mdio_clause45_write(efx, phy_id, MDIO_MMD_AN,
                                    MDIO_MMDREG_CTRL1, reg);
+        } else {
+                /* Disable AN */
+                mdio_clause45_set_flag(efx, phy_id, MDIO_MMD_AN,
+                                       MDIO_MMDREG_CTRL1,
+                                       __ffs(BMCR_ANENABLE), false);
+                /* Set the basic control bits */
+                reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_PMAPMD,
+                                         MDIO_MMDREG_CTRL1);
+                reg &= ~(BMCR_SPEED1000 | BMCR_SPEED100 | BMCR_FULLDPLX |
+                         0x003c);
+                if (ecmd->speed == SPEED_100)
+                        reg |= BMCR_SPEED100;
+                if (ecmd->duplex)
+                        reg |= BMCR_FULLDPLX;
+                mdio_clause45_write(efx, phy_id, MDIO_MMD_PMAPMD,
+                                    MDIO_MMDREG_CTRL1, reg);
        }
        return 0;
diff --git a/drivers/net/sfc/mdio_10g.h b/drivers/net/sfc/mdio_10g.h
index 09bf801d0569..8ba49773ce7e 100644
--- a/drivers/net/sfc/mdio_10g.h
+++ b/drivers/net/sfc/mdio_10g.h
@@ -155,7 +155,8 @@
 #define MDIO_AN_XNP                     22
 #define MDIO_AN_LPA_XNP                 25
-#define MDIO_AN_10GBT_ADVERTISE         32
+#define MDIO_AN_10GBT_CTRL              32
+#define MDIO_AN_10GBT_CTRL_ADV_10G_LBN  12
 #define MDIO_AN_10GBT_STATUS            (33)
 #define MDIO_AN_10GBT_STATUS_MS_FLT_LBN (15) /* MASTER/SLAVE config fault */
 #define MDIO_AN_10GBT_STATUS_MS_LBN     (14) /* MASTER/SLAVE config */
diff --git a/drivers/net/sfc/net_driver.h b/drivers/net/sfc/net_driver.h
index 5f255f75754e..e019ad1fb9a0 100644
--- a/drivers/net/sfc/net_driver.h
+++ b/drivers/net/sfc/net_driver.h
@@ -566,7 +566,7 @@ struct efx_mac_operations {
 * @poll: Poll for hardware state. Serialised by the mac_lock.
 * @get_settings: Get ethtool settings. Serialised by the mac_lock.
 * @set_settings: Set ethtool settings. Serialised by the mac_lock.
- * @set_xnp_advertise: Set abilities advertised in Extended Next Page
+ * @set_npage_adv: Set abilities advertised in (Extended) Next Page
 *      (only needed where AN bit is set in mmds)
 * @num_tests: Number of PHY-specific tests/results
 * @test_names: Names of the tests/results
@@ -586,7 +586,7 @@ struct efx_phy_operations {
                              struct ethtool_cmd *ecmd);
        int (*set_settings) (struct efx_nic *efx,
                             struct ethtool_cmd *ecmd);
-        bool (*set_xnp_advertise) (struct efx_nic *efx, u32);
+        void (*set_npage_adv) (struct efx_nic *efx, u32);
        u32 num_tests;
        const char *const *test_names;
        int (*run_tests) (struct efx_nic *efx, int *results, unsigned flags);
@@ -754,8 +754,7 @@ union efx_multicast_hash {
 *      &struct net_device_stats.
 * @stats_buffer: DMA buffer for statistics
 * @stats_lock: Statistics update lock. Serialises statistics fetches
- * @stats_enabled: Temporarily disable statistics fetches.
+ * @stats_disable_count: Nest count for disabling statistics fetches
- *      Serialised by @stats_lock
 * @mac_op: MAC interface
 * @mac_address: Permanent MAC address
 * @phy_type: PHY type
@@ -837,7 +836,7 @@ struct efx_nic {
        struct efx_mac_stats mac_stats;
        struct efx_buffer stats_buffer;
        spinlock_t stats_lock;
-        bool stats_enabled;
+        unsigned int stats_disable_count;
        struct efx_mac_operations *mac_op;
        unsigned char mac_address[ETH_ALEN];
diff --git a/drivers/net/sfc/phy.h b/drivers/net/sfc/phy.h
index 58c493ef81bb..07e855c148bc 100644
--- a/drivers/net/sfc/phy.h
+++ b/drivers/net/sfc/phy.h
@@ -17,7 +17,6 @@ extern struct efx_phy_operations falcon_sfx7101_phy_ops;
 extern struct efx_phy_operations falcon_sft9001_phy_ops;
 extern void tenxpress_phy_blink(struct efx_nic *efx, bool blink);
-extern void tenxpress_crc_err(struct efx_nic *efx);
 /****************************************************************************
 * Exported functions from the driver for XFP optical PHYs
diff --git a/drivers/net/sfc/selftest.c b/drivers/net/sfc/selftest.c
index dba0d64d50cd..0a598084c513 100644
--- a/drivers/net/sfc/selftest.c
+++ b/drivers/net/sfc/selftest.c
@@ -665,6 +665,7 @@ int efx_selftest(struct efx_nic *efx, struct efx_self_tests *tests,
 {
        enum efx_loopback_mode loopback_mode = efx->loopback_mode;
        int phy_mode = efx->phy_mode;
+        enum reset_type reset_method = RESET_TYPE_INVISIBLE;
        struct ethtool_cmd ecmd;
        struct efx_channel *channel;
        int rc_test = 0, rc_reset = 0, rc;
@@ -718,21 +719,21 @@ int efx_selftest(struct efx_nic *efx, struct efx_self_tests *tests,
        mutex_unlock(&efx->mac_lock);
        /* free up all consumers of SRAM (including all the queues) */
-        efx_reset_down(efx, &ecmd);
+        efx_reset_down(efx, reset_method, &ecmd);
        rc = efx_test_chip(efx, tests);
        if (rc && !rc_test)
                rc_test = rc;
        /* reset the chip to recover from the register test */
-        rc_reset = falcon_reset_hw(efx, RESET_TYPE_ALL);
+        rc_reset = falcon_reset_hw(efx, reset_method);
        /* Ensure that the phy is powered and out of loopback
         * for the bist and loopback tests */
        efx->phy_mode &= ~PHY_MODE_LOW_POWER;
        efx->loopback_mode = LOOPBACK_NONE;
-        rc = efx_reset_up(efx, &ecmd, rc_reset == 0);
+        rc = efx_reset_up(efx, reset_method, &ecmd, rc_reset == 0);
        if (rc && !rc_reset)
                rc_reset = rc;
diff --git a/drivers/net/sfc/sfe4001.c b/drivers/net/sfc/sfe4001.c
index 16b80acb9992..cb25ae5b257a 100644
--- a/drivers/net/sfc/sfe4001.c
+++ b/drivers/net/sfc/sfe4001.c
@@ -186,19 +186,22 @@ static int sfn4111t_reset(struct efx_nic *efx)
 {
        efx_oword_t reg;
-        /* GPIO pins are also used for I2C, so block that temporarily */
+        /* GPIO 3 and the GPIO register are shared with I2C, so block that */
        mutex_lock(&efx->i2c_adap.bus_lock);
+        /* Pull RST_N (GPIO 2) low then let it up again, setting the
+         * FLASH_CFG_1 strap (GPIO 3) appropriately.  Only change the
+         * output enables; the output levels should always be 0 (low)
+         * and we rely on external pull-ups. */
        falcon_read(efx, &reg, GPIO_CTL_REG_KER);
        EFX_SET_OWORD_FIELD(reg, GPIO2_OEN, true);
-        EFX_SET_OWORD_FIELD(reg, GPIO2_OUT, false);
        falcon_write(efx, &reg, GPIO_CTL_REG_KER);
        msleep(1000);
-        EFX_SET_OWORD_FIELD(reg, GPIO2_OUT, true);
+        EFX_SET_OWORD_FIELD(reg, GPIO2_OEN, false);
-        EFX_SET_OWORD_FIELD(reg, GPIO3_OEN, true);
+        EFX_SET_OWORD_FIELD(reg, GPIO3_OEN,
-        EFX_SET_OWORD_FIELD(reg, GPIO3_OUT,
+                            !!(efx->phy_mode & PHY_MODE_SPECIAL));
-                            !(efx->phy_mode & PHY_MODE_SPECIAL));
        falcon_write(efx, &reg, GPIO_CTL_REG_KER);
+        msleep(1);
        mutex_unlock(&efx->i2c_adap.bus_lock);
@@ -232,12 +235,18 @@ static ssize_t set_phy_flash_cfg(struct device *dev,
        } else if (efx->state != STATE_RUNNING || netif_running(efx->net_dev)) {
                err = -EBUSY;
        } else {
+                /* Reset the PHY, reconfigure the MAC and enable/disable
+                 * MAC stats accordingly. */
                efx->phy_mode = new_mode;
+                if (new_mode & PHY_MODE_SPECIAL)
+                        efx_stats_disable(efx);
                if (efx->board_info.type == EFX_BOARD_SFE4001)
                        err = sfe4001_poweron(efx);
                else
                        err = sfn4111t_reset(efx);
                efx_reconfigure_port(efx);
+                if (!(new_mode & PHY_MODE_SPECIAL))
+                        efx_stats_enable(efx);
        }
        rtnl_unlock();
@@ -326,6 +335,11 @@ int sfe4001_init(struct efx_nic *efx)
        efx->board_info.monitor = sfe4001_check_hw;
        efx->board_info.fini = sfe4001_fini;
+        if (efx->phy_mode & PHY_MODE_SPECIAL) {
+                /* PHY won't generate a 156.25 MHz clock and MAC stats fetch
+                 * will fail. */
+                efx_stats_disable(efx);
+        }
        rc = sfe4001_poweron(efx);
        if (rc)
                goto fail_ioexp;
@@ -372,17 +386,25 @@ static void sfn4111t_fini(struct efx_nic *efx)
        i2c_unregister_device(efx->board_info.hwmon_client);
 }
-static struct i2c_board_info sfn4111t_hwmon_info = {
+static struct i2c_board_info sfn4111t_a0_hwmon_info = {
        I2C_BOARD_INFO("max6647", 0x4e),
        .irq            = -1,
 };
+static struct i2c_board_info sfn4111t_r5_hwmon_info = {
+        I2C_BOARD_INFO("max6646", 0x4d),
+        .irq            = -1,
+};
 int sfn4111t_init(struct efx_nic *efx)
 {
        int rc;
        efx->board_info.hwmon_client =
-                i2c_new_device(&efx->i2c_adap, &sfn4111t_hwmon_info);
+                i2c_new_device(&efx->i2c_adap,
+                               (efx->board_info.minor < 5) ?
+                               &sfn4111t_a0_hwmon_info :
+                               &sfn4111t_r5_hwmon_info);
        if (!efx->board_info.hwmon_client)
                return -EIO;
@@ -394,8 +416,10 @@ int sfn4111t_init(struct efx_nic *efx)
        if (rc)
                goto fail_hwmon;
-        if (efx->phy_mode & PHY_MODE_SPECIAL)
+        if (efx->phy_mode & PHY_MODE_SPECIAL) {
+                efx_stats_disable(efx);
                sfn4111t_reset(efx);
+        }
        return 0;
diff --git a/drivers/net/sfc/tenxpress.c b/drivers/net/sfc/tenxpress.c
index 9ecb77da9545..f0efd246962c 100644
--- a/drivers/net/sfc/tenxpress.c
+++ b/drivers/net/sfc/tenxpress.c
@@ -67,6 +67,8 @@
 #define PMA_PMD_EXT_CLK312_WIDTH 1
 #define PMA_PMD_EXT_LPOWER_LBN  12
 #define PMA_PMD_EXT_LPOWER_WIDTH 1
+#define PMA_PMD_EXT_ROBUST_LBN  14
+#define PMA_PMD_EXT_ROBUST_WIDTH 1
 #define PMA_PMD_EXT_SSR_LBN     15
 #define PMA_PMD_EXT_SSR_WIDTH   1
@@ -177,35 +179,24 @@
 #define C22EXT_STATUS_LINK_LBN  2
 #define C22EXT_STATUS_LINK_WIDTH 1
-#define C22EXT_MSTSLV_REG       49162
+#define C22EXT_MSTSLV_CTRL                      49161
-#define C22EXT_MSTSLV_1000_HD_LBN 10
+#define C22EXT_MSTSLV_CTRL_ADV_1000_HD_LBN      8
-#define C22EXT_MSTSLV_1000_HD_WIDTH 1
+#define C22EXT_MSTSLV_CTRL_ADV_1000_FD_LBN      9
-#define C22EXT_MSTSLV_1000_FD_LBN 11
-#define C22EXT_MSTSLV_1000_FD_WIDTH 1
+#define C22EXT_MSTSLV_STATUS                    49162
+#define C22EXT_MSTSLV_STATUS_LP_1000_HD_LBN     10
+#define C22EXT_MSTSLV_STATUS_LP_1000_FD_LBN     11
 /* Time to wait between powering down the LNPGA and turning off the power
 * rails */
 #define LNPGA_PDOWN_WAIT        (HZ / 5)
-static int crc_error_reset_threshold = 100;
-module_param(crc_error_reset_threshold, int, 0644);
-MODULE_PARM_DESC(crc_error_reset_threshold,
-                 "Max number of CRC errors before XAUI reset");
 struct tenxpress_phy_data {
        enum efx_loopback_mode loopback_mode;
-        atomic_t bad_crc_count;
        enum efx_phy_mode phy_mode;
        int bad_lp_tries;
 };
-void tenxpress_crc_err(struct efx_nic *efx)
-{
-        struct tenxpress_phy_data *phy_data = efx->phy_data;
-        if (phy_data != NULL)
-                atomic_inc(&phy_data->bad_crc_count);
-}
 static ssize_t show_phy_short_reach(struct device *dev,
                                    struct device_attribute *attr, char *buf)
 {
@@ -284,7 +275,9 @@ static int tenxpress_init(struct efx_nic *efx)
                                         PMA_PMD_XCONTROL_REG);
                reg |= ((1 << PMA_PMD_EXT_GMII_EN_LBN) |
                        (1 << PMA_PMD_EXT_CLK_OUT_LBN) |
-                        (1 << PMA_PMD_EXT_CLK312_LBN));
+                        (1 << PMA_PMD_EXT_CLK312_LBN) |
+                        (1 << PMA_PMD_EXT_ROBUST_LBN));
                mdio_clause45_write(efx, phy_id, MDIO_MMD_PMAPMD,
                                    PMA_PMD_XCONTROL_REG, reg);
                mdio_clause45_set_flag(efx, phy_id, MDIO_MMD_C22EXT,
@@ -346,6 +339,7 @@ static int tenxpress_phy_init(struct efx_nic *efx)
        rc = tenxpress_init(efx);
        if (rc < 0)
                goto fail;
+        mdio_clause45_set_pause(efx);
        if (efx->phy_type == PHY_TYPE_SFT9001B) {
                rc = device_create_file(&efx->pci_dev->dev,
@@ -376,8 +370,8 @@ static int tenxpress_special_reset(struct efx_nic *efx)
        /* The XGMAC clock is driven from the SFC7101/SFT9001 312MHz clock, so
         * a special software reset can glitch the XGMAC sufficiently for stats
-         * requests to fail. Since we don't often special_reset, just lock. */
+         * requests to fail. */
-        spin_lock(&efx->stats_lock);
+        efx_stats_disable(efx);
        /* Initiate reset */
        reg = mdio_clause45_read(efx, efx->mii.phy_id,
@@ -392,17 +386,17 @@ static int tenxpress_special_reset(struct efx_nic *efx)
        rc = mdio_clause45_wait_reset_mmds(efx,
                                           TENXPRESS_REQUIRED_DEVS);
        if (rc < 0)
-                goto unlock;
+                goto out;
        /* Try and reconfigure the device */
        rc = tenxpress_init(efx);
        if (rc < 0)
-                goto unlock;
+                goto out;
        /* Wait for the XGXS state machine to churn */
        mdelay(10);
-unlock:
+out:
-        spin_unlock(&efx->stats_lock);
+        efx_stats_enable(efx);
        return rc;
 }
@@ -520,7 +514,7 @@ static void tenxpress_phy_reconfigure(struct efx_nic *efx)
 {
        struct tenxpress_phy_data *phy_data = efx->phy_data;
        struct ethtool_cmd ecmd;
-        bool phy_mode_change, loop_reset, loop_toggle, loopback;
+        bool phy_mode_change, loop_reset;
        if (efx->phy_mode & (PHY_MODE_OFF | PHY_MODE_SPECIAL)) {
                phy_data->phy_mode = efx->phy_mode;
@@ -531,12 +525,10 @@ static void tenxpress_phy_reconfigure(struct efx_nic *efx)
        phy_mode_change = (efx->phy_mode == PHY_MODE_NORMAL &&
                           phy_data->phy_mode != PHY_MODE_NORMAL);
-        loopback = LOOPBACK_MASK(efx) & efx->phy_op->loopbacks;
-        loop_toggle = LOOPBACK_CHANGED(phy_data, efx, efx->phy_op->loopbacks);
        loop_reset = (LOOPBACK_OUT_OF(phy_data, efx, efx->phy_op->loopbacks) ||
                      LOOPBACK_CHANGED(phy_data, efx, 1 << LOOPBACK_GPHY));
-        if (loop_reset || loop_toggle || loopback || phy_mode_change) {
+        if (loop_reset || phy_mode_change) {
                int rc;
                efx->phy_op->get_settings(efx, &ecmd);
@@ -551,20 +543,6 @@ static void tenxpress_phy_reconfigure(struct efx_nic *efx)
                                falcon_reset_xaui(efx);
                }
-                if (efx->phy_type != PHY_TYPE_SFX7101) {
-                        /* Only change autoneg once, on coming out or
-                         * going into loopback */
-                        if (loop_toggle)
-                                ecmd.autoneg = !loopback;
-                        if (loopback) {
-                                ecmd.duplex = DUPLEX_FULL;
-                                if (efx->loopback_mode == LOOPBACK_GPHY)
-                                        ecmd.speed = SPEED_1000;
-                                else
-                                        ecmd.speed = SPEED_10000;
-                        }
-                }
                rc = efx->phy_op->set_settings(efx, &ecmd);
                WARN_ON(rc);
        }
@@ -623,13 +601,6 @@ static void tenxpress_phy_poll(struct efx_nic *efx)
        if (phy_data->phy_mode != PHY_MODE_NORMAL)
                return;
-        if (EFX_WORKAROUND_10750(efx) &&
-            atomic_read(&phy_data->bad_crc_count) > crc_error_reset_threshold) {
-                EFX_ERR(efx, "Resetting XAUI due to too many CRC errors\n");
-                falcon_reset_xaui(efx);
-                atomic_set(&phy_data->bad_crc_count, 0);
-        }
 }
 static void tenxpress_phy_fini(struct efx_nic *efx)
@@ -772,107 +743,76 @@ reset:
        return rc;
 }
-static u32 tenxpress_get_xnp_lpa(struct efx_nic *efx)
+static void
+tenxpress_get_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
 {
-        int phy = efx->mii.phy_id;
+        int phy_id = efx->mii.phy_id;
-        u32 lpa = 0;
+        u32 adv = 0, lpa = 0;
        int reg;
        if (efx->phy_type != PHY_TYPE_SFX7101) {
-                reg = mdio_clause45_read(efx, phy, MDIO_MMD_C22EXT,
+                reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_C22EXT,
-                                         C22EXT_MSTSLV_REG);
+                                         C22EXT_MSTSLV_CTRL);
-                if (reg & (1 << C22EXT_MSTSLV_1000_HD_LBN))
+                if (reg & (1 << C22EXT_MSTSLV_CTRL_ADV_1000_FD_LBN))
+                        adv |= ADVERTISED_1000baseT_Full;
+                reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_C22EXT,
+                                         C22EXT_MSTSLV_STATUS);
+                if (reg & (1 << C22EXT_MSTSLV_STATUS_LP_1000_HD_LBN))
                        lpa |= ADVERTISED_1000baseT_Half;
-                if (reg & (1 << C22EXT_MSTSLV_1000_FD_LBN))
+                if (reg & (1 << C22EXT_MSTSLV_STATUS_LP_1000_FD_LBN))
                        lpa |= ADVERTISED_1000baseT_Full;
        }
-        reg = mdio_clause45_read(efx, phy, MDIO_MMD_AN, MDIO_AN_10GBT_STATUS);
+        reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_AN,
+                                 MDIO_AN_10GBT_CTRL);
+        if (reg & (1 << MDIO_AN_10GBT_CTRL_ADV_10G_LBN))
+                adv |= ADVERTISED_10000baseT_Full;
+        reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_AN,
+                                 MDIO_AN_10GBT_STATUS);
        if (reg & (1 << MDIO_AN_10GBT_STATUS_LP_10G_LBN))
                lpa |= ADVERTISED_10000baseT_Full;
-        return lpa;
-}
-static void sfx7101_get_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
+        mdio_clause45_get_settings_ext(efx, ecmd, adv, lpa);
-{
-        mdio_clause45_get_settings_ext(efx, ecmd, ADVERTISED_10000baseT_Full,
+        if (efx->phy_type != PHY_TYPE_SFX7101)
-                                       tenxpress_get_xnp_lpa(efx));
+                ecmd->supported |= (SUPPORTED_100baseT_Full |
-        ecmd->supported |= SUPPORTED_10000baseT_Full;
+                                    SUPPORTED_1000baseT_Full);
-        ecmd->advertising |= ADVERTISED_10000baseT_Full;
+        /* In loopback, the PHY automatically brings up the correct interface,
+         * but doesn't advertise the correct speed. So override it */
+        if (efx->loopback_mode == LOOPBACK_GPHY)
+                ecmd->speed = SPEED_1000;
+        else if (LOOPBACK_MASK(efx) & efx->phy_op->loopbacks)
+                ecmd->speed = SPEED_10000;
 }
-static void sft9001_get_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
+static int tenxpress_set_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
 {
-        int phy_id = efx->mii.phy_id;
+        if (!ecmd->autoneg)
-        u32 xnp_adv = 0;
+                return -EINVAL;
-        int reg;
-        reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_PMAPMD,
-                                 PMA_PMD_SPEED_ENABLE_REG);
-        if (EFX_WORKAROUND_13204(efx) && (reg & (1 << PMA_PMD_100TX_ADV_LBN)))
-                xnp_adv |= ADVERTISED_100baseT_Full;
-        if (reg & (1 << PMA_PMD_1000T_ADV_LBN))
-                xnp_adv |= ADVERTISED_1000baseT_Full;
-        if (reg & (1 << PMA_PMD_10000T_ADV_LBN))
-                xnp_adv |= ADVERTISED_10000baseT_Full;
-        mdio_clause45_get_settings_ext(efx, ecmd, xnp_adv,
-                                       tenxpress_get_xnp_lpa(efx));
-        ecmd->supported |= (SUPPORTED_100baseT_Half |
-                            SUPPORTED_100baseT_Full |
-                            SUPPORTED_1000baseT_Full);
-        /* Use the vendor defined C22ext register for duplex settings */
+        return mdio_clause45_set_settings(efx, ecmd);
-        if (ecmd->speed != SPEED_10000 && !ecmd->autoneg) {
-                reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_C22EXT,
-                                         GPHY_XCONTROL_REG);
-                ecmd->duplex = (reg & (1 << GPHY_DUPLEX_LBN) ?
-                                DUPLEX_FULL : DUPLEX_HALF);
-        }
 }
-static int sft9001_set_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
+static void sfx7101_set_npage_adv(struct efx_nic *efx, u32 advertising)
 {
-        int phy_id = efx->mii.phy_id;
+        mdio_clause45_set_flag(efx, efx->mii.phy_id, MDIO_MMD_AN,
-        int rc;
+                               MDIO_AN_10GBT_CTRL,
+                               MDIO_AN_10GBT_CTRL_ADV_10G_LBN,
-        rc = mdio_clause45_set_settings(efx, ecmd);
+                               advertising & ADVERTISED_10000baseT_Full);
-        if (rc)
-                return rc;
-        if (ecmd->speed != SPEED_10000 && !ecmd->autoneg)
-                mdio_clause45_set_flag(efx, phy_id, MDIO_MMD_C22EXT,
-                                       GPHY_XCONTROL_REG, GPHY_DUPLEX_LBN,
-                                       ecmd->duplex == DUPLEX_FULL);
-        return rc;
 }
-static bool sft9001_set_xnp_advertise(struct efx_nic *efx, u32 advertising)
+static void sft9001_set_npage_adv(struct efx_nic *efx, u32 advertising)
 {
-        int phy = efx->mii.phy_id;
+        int phy_id = efx->mii.phy_id;
-        int reg = mdio_clause45_read(efx, phy, MDIO_MMD_PMAPMD,
-                                     PMA_PMD_SPEED_ENABLE_REG);
+        mdio_clause45_set_flag(efx, phy_id, MDIO_MMD_C22EXT,
-        bool enabled;
+                               C22EXT_MSTSLV_CTRL,
+                               C22EXT_MSTSLV_CTRL_ADV_1000_FD_LBN,
-        reg &= ~((1 << 2) | (1 << 3));
+                               advertising & ADVERTISED_1000baseT_Full);
-        if (EFX_WORKAROUND_13204(efx) &&
+        mdio_clause45_set_flag(efx, phy_id, MDIO_MMD_AN,
-            (advertising & ADVERTISED_100baseT_Full))
+                               MDIO_AN_10GBT_CTRL,
-                reg |= 1 << PMA_PMD_100TX_ADV_LBN;
+                               MDIO_AN_10GBT_CTRL_ADV_10G_LBN,
-        if (advertising & ADVERTISED_1000baseT_Full)
+                               advertising & ADVERTISED_10000baseT_Full);
-                reg |= 1 << PMA_PMD_1000T_ADV_LBN;
-        if (advertising & ADVERTISED_10000baseT_Full)
-                reg |= 1 << PMA_PMD_10000T_ADV_LBN;
-        mdio_clause45_write(efx, phy, MDIO_MMD_PMAPMD,
-                            PMA_PMD_SPEED_ENABLE_REG, reg);
-        enabled = (advertising &
-                   (ADVERTISED_1000baseT_Half |
-                    ADVERTISED_1000baseT_Full |
-                    ADVERTISED_10000baseT_Full));
-        if (EFX_WORKAROUND_13204(efx))
-                enabled |= (advertising & ADVERTISED_100baseT_Full);
-        return enabled;
 }
 struct efx_phy_operations falcon_sfx7101_phy_ops = {
@@ -882,8 +822,9 @@ struct efx_phy_operations falcon_sfx7101_phy_ops = {
        .poll             = tenxpress_phy_poll,
        .fini             = tenxpress_phy_fini,
        .clear_interrupt  = efx_port_dummy_op_void,
-        .get_settings     = sfx7101_get_settings,
+        .get_settings     = tenxpress_get_settings,
-        .set_settings     = mdio_clause45_set_settings,
+        .set_settings     = tenxpress_set_settings,
+        .set_npage_adv    = sfx7101_set_npage_adv,
        .num_tests        = ARRAY_SIZE(sfx7101_test_names),
        .test_names       = sfx7101_test_names,
        .run_tests        = sfx7101_run_tests,
@@ -898,9 +839,9 @@ struct efx_phy_operations falcon_sft9001_phy_ops = {
        .poll             = tenxpress_phy_poll,
        .fini             = tenxpress_phy_fini,
        .clear_interrupt  = efx_port_dummy_op_void,
-        .get_settings     = sft9001_get_settings,
+        .get_settings     = tenxpress_get_settings,
-        .set_settings     = sft9001_set_settings,
+        .set_settings     = tenxpress_set_settings,
-        .set_xnp_advertise = sft9001_set_xnp_advertise,
+        .set_npage_adv    = sft9001_set_npage_adv,
        .num_tests        = ARRAY_SIZE(sft9001_test_names),
        .test_names       = sft9001_test_names,
        .run_tests        = sft9001_run_tests,
diff --git a/drivers/net/sfc/workarounds.h b/drivers/net/sfc/workarounds.h
index 82e03e1d7371..78de68f4a95b 100644
--- a/drivers/net/sfc/workarounds.h
+++ b/drivers/net/sfc/workarounds.h
@@ -18,8 +18,8 @@
 #define EFX_WORKAROUND_ALWAYS(efx) 1
 #define EFX_WORKAROUND_FALCON_A(efx) (falcon_rev(efx) <= FALCON_REV_A1)
 #define EFX_WORKAROUND_10G(efx) EFX_IS10G(efx)
-#define EFX_WORKAROUND_SFX7101(efx) ((efx)->phy_type == PHY_TYPE_SFX7101)
+#define EFX_WORKAROUND_SFT9001(efx) ((efx)->phy_type == PHY_TYPE_SFT9001A || \
-#define EFX_WORKAROUND_SFT9001A(efx) ((efx)->phy_type == PHY_TYPE_SFT9001A)
+                                     (efx)->phy_type == PHY_TYPE_SFT9001B)
 /* XAUI resets if link not detected */
 #define EFX_WORKAROUND_5147 EFX_WORKAROUND_ALWAYS
@@ -29,8 +29,6 @@
 #define EFX_WORKAROUND_7884 EFX_WORKAROUND_10G
 /* TX pkt parser problem with <= 16 byte TXes */
 #define EFX_WORKAROUND_9141 EFX_WORKAROUND_ALWAYS
-/* Low rate CRC errors require XAUI reset */
-#define EFX_WORKAROUND_10750 EFX_WORKAROUND_SFX7101
 /* TX_EV_PKT_ERR can be caused by a dangling TX descriptor
 * or a PCIe error (bug 11028) */
 #define EFX_WORKAROUND_10727 EFX_WORKAROUND_ALWAYS
@@ -55,8 +53,8 @@
 #define EFX_WORKAROUND_8071 EFX_WORKAROUND_FALCON_A
 /* Need to send XNP pages for 100BaseT */
-#define EFX_WORKAROUND_13204 EFX_WORKAROUND_SFT9001A
+#define EFX_WORKAROUND_13204 EFX_WORKAROUND_SFT9001
-/* Need to keep AN enabled */
+/* Don't restart AN in near-side loopback */
-#define EFX_WORKAROUND_13963 EFX_WORKAROUND_SFT9001A
+#define EFX_WORKAROUND_15195 EFX_WORKAROUND_SFT9001
 #endif /* EFX_WORKAROUNDS_H */
diff --git a/drivers/net/skfp/skfddi.c b/drivers/net/skfp/skfddi.c
index 607efeaf0bc5..9a00e5566af7 100644
--- a/drivers/net/skfp/skfddi.c
+++ b/drivers/net/skfp/skfddi.c
@@ -1003,9 +1003,9 @@ static int skfp_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                break;
        case SKFP_CLR_STATS:    /* Zero out the driver statistics */
                if (!capable(CAP_NET_ADMIN)) {
-                        memset(&lp->MacStat, 0, sizeof(lp->MacStat));
-                } else {
                        status = -EPERM;
+                } else {
+                        memset(&lp->MacStat, 0, sizeof(lp->MacStat));
                }
                break;
        default:
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 3668e81e474d..994703cc0db3 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1403,9 +1403,6 @@ static int sky2_up(struct net_device *dev)
        }
-        if (netif_msg_ifup(sky2))
-                printk(KERN_INFO PFX "%s: enabling interface\n", dev->name);
        netif_carrier_off(dev);
        /* must be power of 2 */
@@ -1484,6 +1481,9 @@ static int sky2_up(struct net_device *dev)
        sky2_write32(hw, B0_IMSK, imask);
        sky2_set_multicast(dev);
+        if (netif_msg_ifup(sky2))
+                printk(KERN_INFO PFX "%s: enabling interface\n", dev->name);
        return 0;
 err_out:
diff --git a/drivers/net/smc911x.c b/drivers/net/smc911x.c
index bf3aa2a1effe..223cde0d43be 100644
--- a/drivers/net/smc911x.c
+++ b/drivers/net/smc911x.c
@@ -220,9 +220,9 @@ static void smc911x_reset(struct net_device *dev)
        /* make sure EEPROM has finished loading before setting GPIO_CFG */
        timeout=1000;
-        while ( timeout-- && (SMC_GET_E2P_CMD(lp) & E2P_CMD_EPC_BUSY_)) {
+        while (--timeout && (SMC_GET_E2P_CMD(lp) & E2P_CMD_EPC_BUSY_))
                udelay(10);
-        }
        if (timeout == 0){
                PRINTK("%s: smc911x_reset timeout waiting for EEPROM busy\n", dev->name);
                return;
diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
index f513bdf1c887..783c1a7b869e 100644
--- a/drivers/net/smsc911x.c
+++ b/drivers/net/smsc911x.c
@@ -953,7 +953,7 @@ smsc911x_rx_fastforward(struct smsc911x_data *pdata, unsigned int pktbytes)
                do {
                        udelay(1);
                        val = smsc911x_reg_read(pdata, RX_DP_CTRL);
-                } while (timeout-- && (val & RX_DP_CTRL_RX_FFWD_));
+                } while (--timeout && (val & RX_DP_CTRL_RX_FFWD_));
                if (unlikely(timeout == 0))
                        SMSC_WARNING(HW, "Timed out waiting for "
diff --git a/drivers/net/smsc9420.c b/drivers/net/smsc9420.c
index c14a4c6452c7..a1e4b3895b33 100644
--- a/drivers/net/smsc9420.c
+++ b/drivers/net/smsc9420.c
@@ -498,7 +498,7 @@ static void smsc9420_check_mac_address(struct net_device *dev)
 static void smsc9420_stop_tx(struct smsc9420_pdata *pd)
 {
        u32 dmac_control, mac_cr, dma_intr_ena;
-        int timeOut = 1000;
+        int timeout = 1000;
        /* disable TX DMAC */
        dmac_control = smsc9420_reg_read(pd, DMAC_CONTROL);
@@ -506,13 +506,13 @@ static void smsc9420_stop_tx(struct smsc9420_pdata *pd)
        smsc9420_reg_write(pd, DMAC_CONTROL, dmac_control);
        /* Wait max 10ms for transmit process to stop */
-        while (timeOut--) {
+        while (--timeout) {
                if (smsc9420_reg_read(pd, DMAC_STATUS) & DMAC_STS_TS_)
                        break;
                udelay(10);
        }
-        if (!timeOut)
+        if (!timeout)
                smsc_warn(IFDOWN, "TX DMAC failed to stop");
        /* ACK Tx DMAC stop bit */
@@ -596,7 +596,7 @@ static void smsc9420_free_rx_ring(struct smsc9420_pdata *pd)
 static void smsc9420_stop_rx(struct smsc9420_pdata *pd)
 {
-        int timeOut = 1000;
+        int timeout = 1000;
        u32 mac_cr, dmac_control, dma_intr_ena;
        /* mask RX DMAC interrupts */
@@ -617,13 +617,13 @@ static void smsc9420_stop_rx(struct smsc9420_pdata *pd)
        smsc9420_pci_flush_write(pd);
        /* wait up to 10ms for receive to stop */
-        while (timeOut--) {
+        while (--timeout) {
                if (smsc9420_reg_read(pd, DMAC_STATUS) & DMAC_STS_RS_)
                        break;
                udelay(10);
        }
-        if (!timeOut)
+        if (!timeout)
                smsc_warn(IFDOWN, "RX DMAC did not stop! timeout.");
        /* ACK the Rx DMAC stop bit */
@@ -1378,6 +1378,7 @@ static int smsc9420_open(struct net_device *dev)
        /* test the IRQ connection to the ISR */
        smsc_dbg(IFUP, "Testing ISR using IRQ %d", dev->irq);
+        pd->software_irq_signal = false;
        spin_lock_irqsave(&pd->int_lock, flags);
        /* configure interrupt deassertion timer and enable interrupts */
@@ -1393,8 +1394,6 @@ static int smsc9420_open(struct net_device *dev)
        smsc9420_pci_flush_write(pd);
        timeout = 1000;
-        pd->software_irq_signal = false;
-        smp_wmb();
        while (timeout--) {
                if (pd->software_irq_signal)
                        break;
diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
index 86c765d83de1..b17efa9cc530 100644
--- a/drivers/net/sungem.c
+++ b/drivers/net/sungem.c
@@ -148,7 +148,7 @@ static u16 __phy_read(struct gem *gp, int phy_addr, int reg)
        cmd |= (MIF_FRAME_TAMSB);
        writel(cmd, gp->regs + MIF_FRAME);
-        while (limit--) {
+        while (--limit) {
                cmd = readl(gp->regs + MIF_FRAME);
                if (cmd & MIF_FRAME_TALSB)
                        break;
diff --git a/drivers/net/sungem_phy.c b/drivers/net/sungem_phy.c
index 61843fd57525..78f8cee5fd74 100644
--- a/drivers/net/sungem_phy.c
+++ b/drivers/net/sungem_phy.c
@@ -79,7 +79,7 @@ static int reset_one_mii_phy(struct mii_phy* phy, int phy_id)
        udelay(100);
-        while (limit--) {
+        while (--limit) {
                val = __phy_read(phy, phy_id, MII_BMCR);
                if ((val & BMCR_RESET) == 0)
                        break;
diff --git a/drivers/net/sunqe.c b/drivers/net/sunqe.c
index 6e8f377355fe..fe0c3f244562 100644
--- a/drivers/net/sunqe.c
+++ b/drivers/net/sunqe.c
@@ -227,7 +227,7 @@ static int qe_init(struct sunqe *qep, int from_irq)
        if (!(sbus_readb(mregs + MREGS_PHYCONFIG) & MREGS_PHYCONFIG_LTESTDIS)) {
                int tries = 50;
-                while (tries--) {
+                while (--tries) {
                        u8 tmp;
                        mdelay(5);
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 5e2dbaee125b..8b3f84685387 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -7535,11 +7535,58 @@ static int tg3_test_msi(struct tg3 *tp)
        return err;
 }
+static int tg3_request_firmware(struct tg3 *tp)
+{
+        const __be32 *fw_data;
+        if (request_firmware(&tp->fw, tp->fw_needed, &tp->pdev->dev)) {
+                printk(KERN_ERR "%s: Failed to load firmware \"%s\"\n",
+                       tp->dev->name, tp->fw_needed);
+                return -ENOENT;
+        }
+        fw_data = (void *)tp->fw->data;
+        /* Firmware blob starts with version numbers, followed by
+         * start address and _full_ length including BSS sections
+         * (which must be longer than the actual data, of course
+         */
+        tp->fw_len = be32_to_cpu(fw_data[2]);   /* includes bss */
+        if (tp->fw_len < (tp->fw->size - 12)) {
+                printk(KERN_ERR "%s: bogus length %d in \"%s\"\n",
+                       tp->dev->name, tp->fw_len, tp->fw_needed);
+                release_firmware(tp->fw);
+                tp->fw = NULL;
+                return -EINVAL;
+        }
+        /* We no longer need firmware; we have it. */
+        tp->fw_needed = NULL;
+        return 0;
+}
 static int tg3_open(struct net_device *dev)
 {
        struct tg3 *tp = netdev_priv(dev);
        int err;
+        if (tp->fw_needed) {
+                err = tg3_request_firmware(tp);
+                if (tp->pci_chip_rev_id == CHIPREV_ID_5701_A0) {
+                        if (err)
+                                return err;
+                } else if (err) {
+                        printk(KERN_WARNING "%s: TSO capability disabled.\n",
+                               tp->dev->name);
+                        tp->tg3_flags2 &= ~TG3_FLG2_TSO_CAPABLE;
+                } else if (!(tp->tg3_flags2 & TG3_FLG2_TSO_CAPABLE)) {
+                        printk(KERN_NOTICE "%s: TSO capability restored.\n",
+                               tp->dev->name);
+                        tp->tg3_flags2 |= TG3_FLG2_TSO_CAPABLE;
+                }
+        }
        netif_carrier_off(tp->dev);
        err = tg3_set_power_state(tp, PCI_D0);
@@ -12934,7 +12981,6 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
        struct net_device *dev;
        struct tg3 *tp;
        int err, pm_cap;
-        const char *fw_name = NULL;
        char str[40];
        u64 dma_mask, persist_dma_mask;
@@ -13091,7 +13137,7 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
        tg3_init_bufmgr_config(tp);
        if (tp->pci_chip_rev_id == CHIPREV_ID_5701_A0)
-                fw_name = FIRMWARE_TG3;
+                tp->fw_needed = FIRMWARE_TG3;
        if (tp->tg3_flags2 & TG3_FLG2_HW_TSO) {
                tp->tg3_flags2 |= TG3_FLG2_TSO_CAPABLE;
@@ -13104,37 +13150,10 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
                tp->tg3_flags2 &= ~TG3_FLG2_TSO_CAPABLE;
        } else {
                tp->tg3_flags2 |= TG3_FLG2_TSO_CAPABLE | TG3_FLG2_TSO_BUG;
-        }
-        if (tp->tg3_flags2 & TG3_FLG2_TSO_CAPABLE) {
                if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5705)
-                        fw_name = FIRMWARE_TG3TSO5;
+                        tp->fw_needed = FIRMWARE_TG3TSO5;
                else
-                        fw_name = FIRMWARE_TG3TSO;
+                        tp->fw_needed = FIRMWARE_TG3TSO;
-        }
-        if (fw_name) {
-                const __be32 *fw_data;
-                err = request_firmware(&tp->fw, fw_name, &tp->pdev->dev);
-                if (err) {
-                        printk(KERN_ERR "tg3: Failed to load firmware \"%s\"\n",
-                               fw_name);
-                        goto err_out_iounmap;
-                }
-                fw_data = (void *)tp->fw->data;
-                /* Firmware blob starts with version numbers, followed by
-                   start address and _full_ length including BSS sections
-                   (which must be longer than the actual data, of course */
-                tp->fw_len = be32_to_cpu(fw_data[2]);   /* includes bss */
-                if (tp->fw_len < (tp->fw->size - 12)) {
-                        printk(KERN_ERR "tg3: bogus length %d in \"%s\"\n",
-                               tp->fw_len, fw_name);
-                        err = -EINVAL;
-                        goto err_out_fw;
-                }
        }
        /* TSO is on by default on chips that support hardware TSO.
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index ae5da603c6af..508def3e077f 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2764,6 +2764,7 @@ struct tg3 {
        struct ethtool_coalesce         coal;
        /* firmware info */
+        const char                      *fw_needed;
        const struct firmware           *fw;
        u32                             fw_len; /* includes BSS */
 };
diff --git a/drivers/net/tsi108_eth.c b/drivers/net/tsi108_eth.c
index 75461dbd4876..a9fd2b2ccaf6 100644
--- a/drivers/net/tsi108_eth.c
+++ b/drivers/net/tsi108_eth.c
@@ -1237,7 +1237,7 @@ static void tsi108_init_phy(struct net_device *dev)
        spin_lock_irqsave(&phy_lock, flags);
        tsi108_write_mii(data, MII_BMCR, BMCR_RESET);
-        while (i--){
+        while (--i) {
                if(!(tsi108_read_mii(data, MII_BMCR) & BMCR_RESET))
                        break;
                udelay(10);
diff --git a/drivers/net/tulip/21142.c b/drivers/net/tulip/21142.c
index 1210fb3748a7..db7d5e11855d 100644
--- a/drivers/net/tulip/21142.c
+++ b/drivers/net/tulip/21142.c
@@ -9,6 +9,11 @@
        Please refer to Documentation/DocBook/tulip-user.{pdf,ps,html}
        for more information on this driver.
+        DC21143 manual "21143 PCI/CardBus 10/100Mb/s Ethernet LAN Controller
+        Hardware Reference Manual" is currently available at :
+        http://developer.intel.com/design/network/manuals/278074.htm
        Please submit bugs to http://bugzilla.kernel.org/ .
 */
@@ -32,7 +37,11 @@ void t21142_media_task(struct work_struct *work)
        int csr12 = ioread32(ioaddr + CSR12);
        int next_tick = 60*HZ;
        int new_csr6 = 0;
+        int csr14 = ioread32(ioaddr + CSR14);
+        /* CSR12[LS10,LS100] are not reliable during autonegotiation */
+        if ((csr14 & 0x80) && (csr12 & 0x7000) != 0x5000)
+                csr12 |= 6;
        if (tulip_debug > 2)
                printk(KERN_INFO"%s: 21143 negotiation status %8.8x, %s.\n",
                           dev->name, csr12, medianame[dev->if_port]);
@@ -76,7 +85,7 @@ void t21142_media_task(struct work_struct *work)
                        new_csr6 = 0x83860000;
                        dev->if_port = 3;
                        iowrite32(0, ioaddr + CSR13);
-                        iowrite32(0x0003FF7F, ioaddr + CSR14);
+                        iowrite32(0x0003FFFF, ioaddr + CSR14);
                        iowrite16(8, ioaddr + CSR15);
                        iowrite32(1, ioaddr + CSR13);
                }
@@ -132,10 +141,14 @@ void t21142_lnk_change(struct net_device *dev, int csr5)
        struct tulip_private *tp = netdev_priv(dev);
        void __iomem *ioaddr = tp->base_addr;
        int csr12 = ioread32(ioaddr + CSR12);
+        int csr14 = ioread32(ioaddr + CSR14);
+        /* CSR12[LS10,LS100] are not reliable during autonegotiation */
+        if ((csr14 & 0x80) && (csr12 & 0x7000) != 0x5000)
+                csr12 |= 6;
        if (tulip_debug > 1)
                printk(KERN_INFO"%s: 21143 link status interrupt %8.8x, CSR5 %x, "
-                           "%8.8x.\n", dev->name, csr12, csr5, ioread32(ioaddr + CSR14));
+                           "%8.8x.\n", dev->name, csr12, csr5, csr14);
        /* If NWay finished and we have a negotiated partner capability. */
        if (tp->nway  &&  !tp->nwayset  &&  (csr12 & 0x7000) == 0x5000) {
@@ -143,7 +156,9 @@ void t21142_lnk_change(struct net_device *dev, int csr5)
                int negotiated = tp->sym_advertise & (csr12 >> 16);
                tp->lpar = csr12 >> 16;
                tp->nwayset = 1;
-                if (negotiated & 0x0100)                dev->if_port = 5;
+                /* If partner cannot negotiate, it is 10Mbps Half Duplex */
+                if (!(csr12 & 0x8000))          dev->if_port = 0;
+                else if (negotiated & 0x0100)   dev->if_port = 5;
                else if (negotiated & 0x0080)   dev->if_port = 3;
                else if (negotiated & 0x0040)   dev->if_port = 4;
                else if (negotiated & 0x0020)   dev->if_port = 0;
@@ -214,7 +229,7 @@ void t21142_lnk_change(struct net_device *dev, int csr5)
                        tp->timer.expires = RUN_AT(3*HZ);
                        add_timer(&tp->timer);
                } else if (dev->if_port == 5)
-                        iowrite32(ioread32(ioaddr + CSR14) & ~0x080, ioaddr + CSR14);
+                        iowrite32(csr14 & ~0x080, ioaddr + CSR14);
        } else if (dev->if_port == 0  ||  dev->if_port == 4) {
                if ((csr12 & 4) == 0)
                        printk(KERN_INFO"%s: 21143 10baseT link beat good.\n",
diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index d5d53b633cf8..0bf2114738be 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -392,7 +392,7 @@ static void de_rx (struct de_private *de)
        unsigned drop = 0;
        int rc;
-        while (rx_work--) {
+        while (--rx_work) {
                u32 status, len;
                dma_addr_t mapping;
                struct sk_buff *skb, *copy_skb;
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 11441225bf41..e87986867ba5 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -1536,6 +1536,11 @@ static void adjust_link(struct net_device *dev)
 static int init_phy(struct net_device *dev)
 {
        struct ucc_geth_private *priv = netdev_priv(dev);
+        struct device_node *np = priv->node;
+        struct device_node *phy, *mdio;
+        const phandle *ph;
+        char bus_name[MII_BUS_ID_SIZE];
+        const unsigned int *id;
        struct phy_device *phydev;
        char phy_id[BUS_ID_SIZE];
@@ -1543,8 +1548,18 @@ static int init_phy(struct net_device *dev)
        priv->oldspeed = 0;
        priv->oldduplex = -1;
-        snprintf(phy_id, sizeof(phy_id), PHY_ID_FMT, priv->ug_info->mdio_bus,
+        ph = of_get_property(np, "phy-handle", NULL);
-                 priv->ug_info->phy_address);
+        phy = of_find_node_by_phandle(*ph);
+        mdio = of_get_parent(phy);
+        id = of_get_property(phy, "reg", NULL);
+        of_node_put(phy);
+        of_node_put(mdio);
+        uec_mdio_bus_name(bus_name, mdio);
+        snprintf(phy_id, sizeof(phy_id), "%s:%02x",
+                                bus_name, *id);
        phydev = phy_connect(dev, phy_id, &adjust_link, 0, priv->phy_interface);
@@ -3748,6 +3763,7 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
        ugeth->ug_info = ug_info;
        ugeth->dev = dev;
+        ugeth->node = np;
        return 0;
 }
diff --git a/drivers/net/ucc_geth.h b/drivers/net/ucc_geth.h
index 8f699cb773ee..16cbe42ba43c 100644
--- a/drivers/net/ucc_geth.h
+++ b/drivers/net/ucc_geth.h
@@ -1186,6 +1186,8 @@ struct ucc_geth_private {
        int oldspeed;
        int oldduplex;
        int oldlink;
+        struct device_node *node;
 };
 void uec_set_ethtool_ops(struct net_device *netdev);
diff --git a/drivers/net/ucc_geth_mii.c b/drivers/net/ucc_geth_mii.c
index c001d261366b..54635911305c 100644
--- a/drivers/net/ucc_geth_mii.c
+++ b/drivers/net/ucc_geth_mii.c
@@ -156,7 +156,7 @@ static int uec_mdio_probe(struct of_device *ofdev, const struct of_device_id *ma
        if (err)
                goto reg_map_fail;
-        snprintf(new_bus->id, MII_BUS_ID_SIZE, "%x", res.start);
+        uec_mdio_bus_name(new_bus->id, np);
        new_bus->irq = kmalloc(32 * sizeof(int), GFP_KERNEL);
@@ -283,3 +283,13 @@ void uec_mdio_exit(void)
 {
        of_unregister_platform_driver(&uec_mdio_driver);
 }
+void uec_mdio_bus_name(char *name, struct device_node *np)
+{
+        const u32 *reg;
+        reg = of_get_property(np, "reg", NULL);
+        snprintf(name, MII_BUS_ID_SIZE, "%s@%x", np->name, reg ? *reg : 0);
+}
diff --git a/drivers/net/ucc_geth_mii.h b/drivers/net/ucc_geth_mii.h
index 1e45b2028a50..840cf80235b7 100644
--- a/drivers/net/ucc_geth_mii.h
+++ b/drivers/net/ucc_geth_mii.h
@@ -97,4 +97,5 @@ int uec_mdio_read(struct mii_bus *bus, int mii_id, int regnum);
 int uec_mdio_write(struct mii_bus *bus, int mii_id, int regnum, u16 value);
 int __init uec_mdio_init(void);
 void uec_mdio_exit(void);
+void uec_mdio_bus_name(char *name, struct device_node *np);
 #endif                          /* __UEC_MII_H */
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 0d0fa91c0251..fe98acaead97 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -455,6 +455,7 @@ static const struct usb_device_id hso_ids[] = {
        {icon321_port_device(0x0af0, 0xd033)},  /* Icon-322 */
        {USB_DEVICE(0x0af0, 0x7301)},           /* GE40x */
        {USB_DEVICE(0x0af0, 0x7361)},           /* GE40x */
+        {USB_DEVICE(0x0af0, 0x7381)},           /* GE40x */
        {USB_DEVICE(0x0af0, 0x7401)},           /* GI 0401 */
        {USB_DEVICE(0x0af0, 0x7501)},           /* GTM 382 */
        {USB_DEVICE(0x0af0, 0x7601)},           /* GE40x */
@@ -462,7 +463,8 @@ static const struct usb_device_id hso_ids[] = {
        {USB_DEVICE(0x0af0, 0x7801)},
        {USB_DEVICE(0x0af0, 0x7901)},
        {USB_DEVICE(0x0af0, 0x7361)},
-        {icon321_port_device(0x0af0, 0xd051)},
+        {USB_DEVICE(0x0af0, 0xd057)},
+        {USB_DEVICE(0x0af0, 0xd055)},
        {}
 };
 MODULE_DEVICE_TABLE(usb, hso_ids);
diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c
index 5385d66b306e..ced8f36ebd01 100644
--- a/drivers/net/usb/mcs7830.c
+++ b/drivers/net/usb/mcs7830.c
@@ -94,10 +94,18 @@ static int mcs7830_get_reg(struct usbnet *dev, u16 index, u16 size, void *data)
 {
        struct usb_device *xdev = dev->udev;
        int ret;
+        void *buffer;
+        buffer = kmalloc(size, GFP_NOIO);
+        if (buffer == NULL)
+                return -ENOMEM;
        ret = usb_control_msg(xdev, usb_rcvctrlpipe(xdev, 0), MCS7830_RD_BREQ,
-                              MCS7830_RD_BMREQ, 0x0000, index, data,
+                              MCS7830_RD_BMREQ, 0x0000, index, buffer,
                              size, MCS7830_CTRL_TIMEOUT);
+        memcpy(data, buffer, size);
+        kfree(buffer);
        return ret;
 }
@@ -105,10 +113,18 @@ static int mcs7830_set_reg(struct usbnet *dev, u16 index, u16 size, void *data)
 {
        struct usb_device *xdev = dev->udev;
        int ret;
+        void *buffer;
+        buffer = kmalloc(size, GFP_NOIO);
+        if (buffer == NULL)
+                return -ENOMEM;
+        memcpy(buffer, data, size);
        ret = usb_control_msg(xdev, usb_sndctrlpipe(xdev, 0), MCS7830_WR_BREQ,
-                              MCS7830_WR_BMREQ, 0x0000, index, data,
+                              MCS7830_WR_BMREQ, 0x0000, index, buffer,
                              size, MCS7830_CTRL_TIMEOUT);
+        kfree(buffer);
        return ret;
 }
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index a75f91dc3153..c5691fdb7079 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -1302,7 +1302,7 @@ static void velocity_free_rd_ring(struct velocity_info *vptr)
 static int velocity_init_td_ring(struct velocity_info *vptr)
 {
        dma_addr_t curr;
-        unsigned int j;
+        int j;
        /* Init the TD ring entries */
        for (j = 0; j < vptr->tx.numq; j++) {
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 43f6523c40be..c68808336c8c 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -24,6 +24,7 @@
 #include <linux/virtio.h>
 #include <linux/virtio_net.h>
 #include <linux/scatterlist.h>
+#include <linux/if_vlan.h>
 static int napi_weight = 128;
 module_param(napi_weight, int, 0444);
@@ -33,7 +34,7 @@ module_param(csum, bool, 0444);
 module_param(gso, bool, 0444);
 /* FIXME: MTU in config. */
-#define MAX_PACKET_LEN (ETH_HLEN+ETH_DATA_LEN)
+#define MAX_PACKET_LEN (ETH_HLEN + VLAN_HLEN + ETH_DATA_LEN)
 #define GOOD_COPY_LEN   128
 struct virtnet_info
@@ -286,7 +287,7 @@ static void try_fill_recv_maxbufs(struct virtnet_info *vi)
                skb_put(skb, MAX_PACKET_LEN);
                hdr = skb_vnet_hdr(skb);
-                sg_init_one(sg, hdr, sizeof(*hdr));
+                sg_set_buf(sg, hdr, sizeof(*hdr));
                if (vi->big_packets) {
                        for (i = 0; i < MAX_SKB_FRAGS; i++) {
@@ -487,9 +488,9 @@ static int xmit_skb(struct virtnet_info *vi, struct sk_buff *skb)
        /* Encode metadata header at front. */
        if (vi->mergeable_rx_bufs)
-                sg_init_one(sg, mhdr, sizeof(*mhdr));
+                sg_set_buf(sg, mhdr, sizeof(*mhdr));
        else
-                sg_init_one(sg, hdr, sizeof(*hdr));
+                sg_set_buf(sg, hdr, sizeof(*hdr));
        num = skb_to_sgvec(skb, sg+1, 0, skb->len) + 1;
diff --git a/drivers/net/wimax/i2400m/control.c b/drivers/net/wimax/i2400m/control.c
index d3d37fed6893..15d9f51b292c 100644
--- a/drivers/net/wimax/i2400m/control.c
+++ b/drivers/net/wimax/i2400m/control.c
@@ -609,7 +609,7 @@ void i2400m_msg_to_dev_cancel_wait(struct i2400m *i2400m, int code)
        spin_lock_irqsave(&i2400m->rx_lock, flags);
        ack_skb = i2400m->ack_skb;
        if (ack_skb && !IS_ERR(ack_skb))
-                kfree(ack_skb);
+                kfree_skb(ack_skb);
        i2400m->ack_skb = ERR_PTR(code);
        spin_unlock_irqrestore(&i2400m->rx_lock, flags);
 }
diff --git a/drivers/net/wimax/i2400m/debugfs.c b/drivers/net/wimax/i2400m/debugfs.c
index 626632985977..9b81af3f80a9 100644
--- a/drivers/net/wimax/i2400m/debugfs.c
+++ b/drivers/net/wimax/i2400m/debugfs.c
@@ -234,20 +234,6 @@ struct dentry *debugfs_create_i2400m_reset(
                                   &fops_i2400m_reset);
 }
-/*
- * Debug levels control; see debug.h
- */
-struct d_level D_LEVEL[] = {
-        D_SUBMODULE_DEFINE(control),
-        D_SUBMODULE_DEFINE(driver),
-        D_SUBMODULE_DEFINE(debugfs),
-        D_SUBMODULE_DEFINE(fw),
-        D_SUBMODULE_DEFINE(netdev),
-        D_SUBMODULE_DEFINE(rfkill),
-        D_SUBMODULE_DEFINE(rx),
-        D_SUBMODULE_DEFINE(tx),
-};
-size_t D_LEVEL_SIZE = ARRAY_SIZE(D_LEVEL);
 #define __debugfs_register(prefix, name, parent)                        \
 do {                                                                    \
diff --git a/drivers/net/wimax/i2400m/driver.c b/drivers/net/wimax/i2400m/driver.c
index 5f98047e18cf..e80a0b65a754 100644
--- a/drivers/net/wimax/i2400m/driver.c
+++ b/drivers/net/wimax/i2400m/driver.c
@@ -707,6 +707,22 @@ void i2400m_release(struct i2400m *i2400m)
 EXPORT_SYMBOL_GPL(i2400m_release);
+/*
+ * Debug levels control; see debug.h
+ */
+struct d_level D_LEVEL[] = {
+        D_SUBMODULE_DEFINE(control),
+        D_SUBMODULE_DEFINE(driver),
+        D_SUBMODULE_DEFINE(debugfs),
+        D_SUBMODULE_DEFINE(fw),
+        D_SUBMODULE_DEFINE(netdev),
+        D_SUBMODULE_DEFINE(rfkill),
+        D_SUBMODULE_DEFINE(rx),
+        D_SUBMODULE_DEFINE(tx),
+};
+size_t D_LEVEL_SIZE = ARRAY_SIZE(D_LEVEL);
 static
 int __init i2400m_driver_init(void)
 {
diff --git a/drivers/net/wimax/i2400m/usb-rx.c b/drivers/net/wimax/i2400m/usb-rx.c
index 074cc1f89853..a314799967cf 100644
--- a/drivers/net/wimax/i2400m/usb-rx.c
+++ b/drivers/net/wimax/i2400m/usb-rx.c
@@ -184,6 +184,8 @@ void i2400mu_rx_size_maybe_shrink(struct i2400mu *i2400mu)
 *   NOTE: this function might realloc the skb (if it is too small),
 *   so always update with the one returned.
 *   ERR_PTR() is < 0 on error.
+ *   Will return NULL if it cannot reallocate -- this can be
+ *   considered a transient retryable error.
 */
 static
 struct sk_buff *i2400mu_rx(struct i2400mu *i2400mu, struct sk_buff *rx_skb)
@@ -243,8 +245,8 @@ retry:
                        if (printk_ratelimit())
                                dev_err(dev, "RX: Can't reallocate skb to %d; "
                                        "RX dropped\n", rx_size);
-                        kfree(rx_skb);
+                        kfree_skb(rx_skb);
-                        result = 0;
+                        rx_skb = NULL;
                        goto out;       /* drop it...*/
                }
                kfree_skb(rx_skb);
@@ -344,7 +346,8 @@ int i2400mu_rxd(void *_i2400mu)
                if (IS_ERR(rx_skb))
                        goto out;
                atomic_dec(&i2400mu->rx_pending_count);
-                if (rx_skb->len == 0) { /* some ignorable condition */
+                if (rx_skb == NULL || rx_skb->len == 0) {
+                        /* some "ignorable" condition */
                        kfree_skb(rx_skb);
                        continue;
                }
diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index 8ef87356e083..a533ed60bb4d 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -1028,6 +1028,8 @@ ath5k_setup_bands(struct ieee80211_hw *hw)
 * it's done by reseting the chip.  To accomplish this we must
 * first cleanup any pending DMA, then restart stuff after a la
 * ath5k_init.
+ *
+ * Called with sc->lock.
 */
 static int
 ath5k_chan_set(struct ath5k_softc *sc, struct ieee80211_channel *chan)
@@ -2814,11 +2816,17 @@ ath5k_config(struct ieee80211_hw *hw, u32 changed)
 {
        struct ath5k_softc *sc = hw->priv;
        struct ieee80211_conf *conf = &hw->conf;
+        int ret;
+        mutex_lock(&sc->lock);
        sc->bintval = conf->beacon_int;
        sc->power_level = conf->power_level;
-        return ath5k_chan_set(sc, conf->channel);
+        ret = ath5k_chan_set(sc, conf->channel);
+        mutex_unlock(&sc->lock);
+        return ret;
 }
 static int
diff --git a/drivers/net/wireless/ath9k/rc.c b/drivers/net/wireless/ath9k/rc.c
index 04ab457a8faa..1b71b934bb5e 100644
--- a/drivers/net/wireless/ath9k/rc.c
+++ b/drivers/net/wireless/ath9k/rc.c
@@ -490,7 +490,7 @@ static inline int ath_rc_get_nextvalid_txrate(struct ath_rate_table *rate_table,
 static int ath_rc_valid_phyrate(u32 phy, u32 capflag, int ignore_cw)
 {
-        if (WLAN_RC_PHY_HT(phy) & !(capflag & WLAN_RC_HT_FLAG))
+        if (WLAN_RC_PHY_HT(phy) && !(capflag & WLAN_RC_HT_FLAG))
                return 0;
        if (WLAN_RC_PHY_DS(phy) && !(capflag & WLAN_RC_DS_FLAG))
                return 0;
diff --git a/drivers/net/wireless/ath9k/regd_common.h b/drivers/net/wireless/ath9k/regd_common.h
index 9112c030b1e8..6df1b3b77c25 100644
--- a/drivers/net/wireless/ath9k/regd_common.h
+++ b/drivers/net/wireless/ath9k/regd_common.h
@@ -228,7 +228,7 @@ enum {
 };
 #define REG_DOMAIN_2GHZ_MASK    (REQ_MASK & \
-        (!(ADHOC_NO_11A | DISALLOW_ADHOC_11A | DISALLOW_ADHOC_11A_TURB)))
+        (~(ADHOC_NO_11A | DISALLOW_ADHOC_11A | DISALLOW_ADHOC_11A_TURB)))
 #define REG_DOMAIN_5GHZ_MASK    REQ_MASK
 static struct reg_dmn_pair_mapping regDomainPairs[] = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
index 9b60a0c5de5f..21c841847d88 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
@@ -638,12 +638,16 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
        s8 scale_action = 0;
        unsigned long flags;
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        u16 fc, rate_mask;
+        u16 fc;
+        u16 rate_mask = 0;
        struct iwl3945_priv *priv = (struct iwl3945_priv *)priv_r;
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
        IWL_DEBUG_RATE("enter\n");
+        if (sta)
+                rate_mask = sta->supp_rates[sband->band];
        /* Send management frames and broadcast/multicast data using lowest
         * rate. */
        fc = le16_to_cpu(hdr->frame_control);
@@ -651,11 +655,15 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
            is_multicast_ether_addr(hdr->addr1) ||
            !sta || !priv_sta) {
                IWL_DEBUG_RATE("leave: No STA priv data to update!\n");
-                info->control.rates[0].idx = rate_lowest_index(sband, sta);
+                if (!rate_mask)
+                        info->control.rates[0].idx =
+                                        rate_lowest_index(sband, NULL);
+                else
+                        info->control.rates[0].idx =
+                                        rate_lowest_index(sband, sta);
                return;
        }
-        rate_mask = sta->supp_rates[sband->band];
        index = min(rs_sta->last_txrate_idx & 0xffff, IWL_RATE_COUNT - 1);
        if (sband->band == IEEE80211_BAND_5GHZ)
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index f3f17929ca0b..27f50471aed8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -944,7 +944,8 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
        }
        /* See if there's a better rate or modulation mode to try. */
-        rs_rate_scale_perform(priv, hdr, sta, lq_sta);
+        if (sta && sta->supp_rates[sband->band])
+                rs_rate_scale_perform(priv, hdr, sta, lq_sta);
 out:
        return;
 }
@@ -2101,14 +2102,23 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta, void *priv_sta,
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
        struct iwl_lq_sta *lq_sta = priv_sta;
        int rate_idx;
+        u64 mask_bit = 0;
        IWL_DEBUG_RATE_LIMIT("rate scale calculate new rate for skb\n");
+        if (sta)
+                mask_bit = sta->supp_rates[sband->band];
        /* Send management frames and broadcast/multicast data using lowest
         * rate. */
        if (!ieee80211_is_data(hdr->frame_control) ||
            is_multicast_ether_addr(hdr->addr1) || !sta || !lq_sta) {
-                info->control.rates[0].idx = rate_lowest_index(sband, sta);
+                if (!mask_bit)
+                        info->control.rates[0].idx =
+                                        rate_lowest_index(sband, NULL);
+                else
+                        info->control.rates[0].idx =
+                                        rate_lowest_index(sband, sta);
                return;
        }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 5da6b35cd26d..c01ea48da5fe 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1719,6 +1719,10 @@ static int iwl_read_ucode(struct iwl_priv *priv)
        priv->ucode_data_backup.len = data_size;
        iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_data_backup);
+        if (!priv->ucode_code.v_addr || !priv->ucode_data.v_addr ||
+            !priv->ucode_data_backup.v_addr)
+                goto err_pci_alloc;
        /* Initialization instructions and data */
        if (init_size && init_data_size) {
                priv->ucode_init.len = init_size;
@@ -2482,7 +2486,7 @@ static int iwl_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                dev_kfree_skb_any(skb);
        IWL_DEBUG_MACDUMP("leave\n");
-        return 0;
+        return NETDEV_TX_OK;
 }
 static int iwl_mac_add_interface(struct ieee80211_hw *hw,
@@ -4038,6 +4042,7 @@ static int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state)
                priv->is_open = 1;
        }
+        pci_save_state(pdev);
        pci_set_power_state(pdev, PCI_D3hot);
        return 0;
@@ -4048,6 +4053,7 @@ static int iwl_pci_resume(struct pci_dev *pdev)
        struct iwl_priv *priv = pci_get_drvdata(pdev);
        pci_set_power_state(pdev, PCI_D0);
+        pci_restore_state(pdev);
        if (priv->is_open)
                iwl_mac_start(priv->hw);
diff --git a/drivers/net/wireless/iwlwifi/iwl-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
index 8c71ad4f88c5..4b35b30e493e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
@@ -224,7 +224,7 @@ int iwl_send_cmd_sync(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                IWL_ERROR("Error: Response NULL in '%s'\n",
                          get_cmd_string(cmd->id));
                ret = -EIO;
-                goto out;
+                goto cancel;
        }
        ret = 0;
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 412f66bac1af..70a8b21ca39b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -480,6 +480,9 @@ void iwl_clear_stations_table(struct iwl_priv *priv)
        priv->num_stations = 0;
        memset(priv->stations, 0, sizeof(priv->stations));
+        /* clean ucode key table bit map */
+        priv->ucode_key_table = 0;
        spin_unlock_irqrestore(&priv->sta_lock, flags);
 }
 EXPORT_SYMBOL(iwl_clear_stations_table);
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index d64580805d6e..5b44d322b99f 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -745,7 +745,7 @@ static int iwl3945_send_cmd_sync(struct iwl3945_priv *priv, struct iwl3945_host_
                IWL_ERROR("Error: Response NULL in '%s'\n",
                          get_cmd_string(cmd->id));
                ret = -EIO;
-                goto out;
+                goto cancel;
        }
        ret = 0;
@@ -6538,7 +6538,7 @@ static int iwl3945_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                dev_kfree_skb_any(skb);
        IWL_DEBUG_MAC80211("leave\n");
-        return 0;
+        return NETDEV_TX_OK;
 }
 static int iwl3945_mac_add_interface(struct ieee80211_hw *hw,
@@ -8143,6 +8143,7 @@ static int iwl3945_pci_suspend(struct pci_dev *pdev, pm_message_t state)
                priv->is_open = 1;
        }
+        pci_save_state(pdev);
        pci_set_power_state(pdev, PCI_D3hot);
        return 0;
@@ -8153,6 +8154,7 @@ static int iwl3945_pci_resume(struct pci_dev *pdev)
        struct iwl3945_priv *priv = pci_get_drvdata(pdev);
        pci_set_power_state(pdev, PCI_D0);
+        pci_restore_state(pdev);
        if (priv->is_open)
                iwl3945_mac_start(priv->hw);
diff --git a/drivers/net/wireless/libertas/hostcmd.h b/drivers/net/wireless/libertas/hostcmd.h
index e173b1b46c23..f6a79a653b7b 100644
--- a/drivers/net/wireless/libertas/hostcmd.h
+++ b/drivers/net/wireless/libertas/hostcmd.h
@@ -32,7 +32,7 @@ struct txpd {
        u8 pktdelay_2ms;
        /* reserved */
        u8 reserved1;
-};
+} __attribute__ ((packed));
 /* RxPD Descriptor */
 struct rxpd {
@@ -63,7 +63,7 @@ struct rxpd {
        /* Pkt Priority */
        u8 priority;
        u8 reserved[3];
-};
+} __attribute__ ((packed));
 struct cmd_header {
        __le16 command;
@@ -97,7 +97,7 @@ struct enc_key {
 struct lbs_offset_value {
        u32 offset;
        u32 value;
-};
+} __attribute__ ((packed));
 /* Define general data structure */
 /* cmd_DS_GEN */
@@ -107,7 +107,7 @@ struct cmd_ds_gen {
        __le16 seqnum;
        __le16 result;
        void *cmdresp[0];
-};
+} __attribute__ ((packed));
 #define S_DS_GEN sizeof(struct cmd_ds_gen)
@@ -163,7 +163,7 @@ struct cmd_ds_802_11_subscribe_event {
         * bump this up a bit.
         */
        uint8_t tlv[128];
-};
+} __attribute__ ((packed));
 /*
 * This scan handle Country Information IE(802.11d compliant)
@@ -180,7 +180,7 @@ struct cmd_ds_802_11_scan {
        mrvlietypes_chanlistparamset_t ChanListParamSet;
        mrvlietypes_ratesparamset_t OpRateSet;
 #endif
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_scan_rsp {
        struct cmd_header hdr;
@@ -188,7 +188,7 @@ struct cmd_ds_802_11_scan_rsp {
        __le16 bssdescriptsize;
        uint8_t nr_sets;
        uint8_t bssdesc_and_tlvbuffer[0];
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_get_log {
        struct cmd_header hdr;
@@ -206,33 +206,33 @@ struct cmd_ds_802_11_get_log {
        __le32 fcserror;
        __le32 txframe;
        __le32 wepundecryptable;
-};
+} __attribute__ ((packed));
 struct cmd_ds_mac_control {
        struct cmd_header hdr;
        __le16 action;
        u16 reserved;
-};
+} __attribute__ ((packed));
 struct cmd_ds_mac_multicast_adr {
        struct cmd_header hdr;
        __le16 action;
        __le16 nr_of_adrs;
        u8 maclist[ETH_ALEN * MRVDRV_MAX_MULTICAST_LIST_SIZE];
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_authenticate {
        u8 macaddr[ETH_ALEN];
        u8 authtype;
        u8 reserved[10];
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_deauthenticate {
        struct cmd_header hdr;
        u8 macaddr[ETH_ALEN];
        __le16 reasoncode;
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_associate {
        u8 peerstaaddr[6];
@@ -251,7 +251,7 @@ struct cmd_ds_802_11_associate {
 struct cmd_ds_802_11_associate_rsp {
        struct ieeetypes_assocrsp assocRsp;
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_set_wep {
        struct cmd_header hdr;
@@ -265,7 +265,7 @@ struct cmd_ds_802_11_set_wep {
        /* 40, 128bit or TXWEP */
        uint8_t keytype[4];
        uint8_t keymaterial[4][16];
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_3_get_stat {
        __le32 xmitok;
@@ -274,7 +274,7 @@ struct cmd_ds_802_3_get_stat {
        __le32 rcverror;
        __le32 rcvnobuffer;
        __le32 rcvcrcerror;
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_get_stat {
        __le32 txfragmentcnt;
@@ -294,7 +294,7 @@ struct cmd_ds_802_11_get_stat {
        __le32 txbeacon;
        __le32 rxbeacon;
        __le32 wepundecryptable;
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_snmp_mib {
        struct cmd_header hdr;
@@ -303,58 +303,58 @@ struct cmd_ds_802_11_snmp_mib {
        __le16 oid;
        __le16 bufsize;
        u8 value[128];
-};
+} __attribute__ ((packed));
 struct cmd_ds_mac_reg_map {
        __le16 buffersize;
        u8 regmap[128];
        __le16 reserved;
-};
+} __attribute__ ((packed));
 struct cmd_ds_bbp_reg_map {
        __le16 buffersize;
        u8 regmap[128];
        __le16 reserved;
-};
+} __attribute__ ((packed));
 struct cmd_ds_rf_reg_map {
        __le16 buffersize;
        u8 regmap[64];
        __le16 reserved;
-};
+} __attribute__ ((packed));
 struct cmd_ds_mac_reg_access {
        __le16 action;
        __le16 offset;
        __le32 value;
-};
+} __attribute__ ((packed));
 struct cmd_ds_bbp_reg_access {
        __le16 action;
        __le16 offset;
        u8 value;
        u8 reserved[3];
-};
+} __attribute__ ((packed));
 struct cmd_ds_rf_reg_access {
        __le16 action;
        __le16 offset;
        u8 value;
        u8 reserved[3];
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_radio_control {
        struct cmd_header hdr;
        __le16 action;
        __le16 control;
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_beacon_control {
        __le16 action;
        __le16 beacon_enable;
        __le16 beacon_period;
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_sleep_params {
        struct cmd_header hdr;
@@ -379,7 +379,7 @@ struct cmd_ds_802_11_sleep_params {
        /* reserved field, should be set to zero */
        __le16 reserved;
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_inactivity_timeout {
        struct cmd_header hdr;
@@ -389,7 +389,7 @@ struct cmd_ds_802_11_inactivity_timeout {
        /* Inactivity timeout in msec */
        __le16 timeout;
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_rf_channel {
        struct cmd_header hdr;
@@ -399,7 +399,7 @@ struct cmd_ds_802_11_rf_channel {
        __le16 rftype;      /* unused */
        __le16 reserved;    /* unused */
        u8 channellist[32]; /* unused */
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_rssi {
        /* weighting factor */
@@ -408,21 +408,21 @@ struct cmd_ds_802_11_rssi {
        __le16 reserved_0;
        __le16 reserved_1;
        __le16 reserved_2;
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_rssi_rsp {
        __le16 SNR;
        __le16 noisefloor;
        __le16 avgSNR;
        __le16 avgnoisefloor;
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_mac_address {
        struct cmd_header hdr;
        __le16 action;
        u8 macadd[ETH_ALEN];
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_rf_tx_power {
        struct cmd_header hdr;
@@ -431,7 +431,7 @@ struct cmd_ds_802_11_rf_tx_power {
        __le16 curlevel;
        s8 maxlevel;
        s8 minlevel;
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_rf_antenna {
        __le16 action;
@@ -439,33 +439,33 @@ struct cmd_ds_802_11_rf_antenna {
        /* Number of antennas or 0xffff(diversity) */
        __le16 antennamode;
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_monitor_mode {
        __le16 action;
        __le16 mode;
-};
+} __attribute__ ((packed));
 struct cmd_ds_set_boot2_ver {
        struct cmd_header hdr;
        __le16 action;
        __le16 version;
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_fw_wake_method {
        struct cmd_header hdr;
        __le16 action;
        __le16 method;
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_sleep_period {
        struct cmd_header hdr;
        __le16 action;
        __le16 period;
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_ps_mode {
        __le16 action;
@@ -473,7 +473,7 @@ struct cmd_ds_802_11_ps_mode {
        __le16 multipledtim;
        __le16 reserved;
        __le16 locallisteninterval;
-};
+} __attribute__ ((packed));
 struct cmd_confirm_sleep {
        struct cmd_header hdr;
@@ -483,7 +483,7 @@ struct cmd_confirm_sleep {
        __le16 multipledtim;
        __le16 reserved;
        __le16 locallisteninterval;
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_data_rate {
        struct cmd_header hdr;
@@ -491,14 +491,14 @@ struct cmd_ds_802_11_data_rate {
        __le16 action;
        __le16 reserved;
        u8 rates[MAX_RATES];
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_rate_adapt_rateset {
        struct cmd_header hdr;
        __le16 action;
        __le16 enablehwauto;
        __le16 bitmap;
-};
+} __attribute__ ((packed));
 struct cmd_ds_802_11_ad_hoc_start {
        struct cmd_header hdr;
@@ -520,7 +520,7 @@ struct cmd_ds_802_11_ad_hoc_result {
        u8 pad[3];
        u8 bssid[ETH_ALEN];
-};
+} __attribute__ ((packed));
 struct adhoc_bssdesc {
        u8 bssid[ETH_ALEN];
@@ -578,7 +578,7 @@ struct MrvlIEtype_keyParamSet {
        /* key material of size keylen */
        u8 key[32];
-};
+} __attribute__ ((packed));
 #define MAX_WOL_RULES           16
@@ -590,7 +590,7 @@ struct host_wol_rule {
        __le16 reserve;
        __be32 sig_mask;
        __be32 signature;
-};
+} __attribute__ ((packed));
 struct wol_config {
        uint8_t action;
@@ -598,8 +598,7 @@ struct wol_config {
        uint8_t no_rules_in_cmd;
        uint8_t result;
        struct host_wol_rule rule[MAX_WOL_RULES];
-};
+} __attribute__ ((packed));
 struct cmd_ds_host_sleep {
        struct cmd_header hdr;
diff --git a/drivers/net/wireless/orinoco/orinoco.c b/drivers/net/wireless/orinoco/orinoco.c
index c3bb85e0251e..45a04faa7818 100644
--- a/drivers/net/wireless/orinoco/orinoco.c
+++ b/drivers/net/wireless/orinoco/orinoco.c
@@ -1673,7 +1673,7 @@ static void print_linkstatus(struct net_device *dev, u16 status)
                s = "UNKNOWN";
        }
        
-        printk(KERN_INFO "%s: New link status: %s (%04x)\n",
+        printk(KERN_DEBUG "%s: New link status: %s (%04x)\n",
               dev->name, s, status);
 }
@@ -5068,33 +5068,30 @@ static int orinoco_ioctl_set_genie(struct net_device *dev,
        struct orinoco_private *priv = netdev_priv(dev);
        u8 *buf;
        unsigned long flags;
-        int err = 0;
        /* cut off at IEEE80211_MAX_DATA_LEN */
        if ((wrqu->data.length > IEEE80211_MAX_DATA_LEN) ||
            (wrqu->data.length && (extra == NULL)))
                return -EINVAL;
-        if (orinoco_lock(priv, &flags) != 0)
-                return -EBUSY;
        if (wrqu->data.length) {
                buf = kmalloc(wrqu->data.length, GFP_KERNEL);
-                if (buf == NULL) {
+                if (buf == NULL)
-                        err = -ENOMEM;
+                        return -ENOMEM;
-                        goto out;
-                }
                memcpy(buf, extra, wrqu->data.length);
-                kfree(priv->wpa_ie);
+        } else
-                priv->wpa_ie = buf;
+                buf = NULL;
-                priv->wpa_ie_len = wrqu->data.length;
-        } else {
+        if (orinoco_lock(priv, &flags) != 0) {
-                kfree(priv->wpa_ie);
+                kfree(buf);
-                priv->wpa_ie = NULL;
+                return -EBUSY;
-                priv->wpa_ie_len = 0;
        }
+        kfree(priv->wpa_ie);
+        priv->wpa_ie = buf;
+        priv->wpa_ie_len = wrqu->data.length;
        if (priv->wpa_ie) {
                /* Looks like wl_lkm wants to check the auth alg, and
                 * somehow pass it to the firmware.
@@ -5103,9 +5100,8 @@ static int orinoco_ioctl_set_genie(struct net_device *dev,
                 */
        }
-out:
        orinoco_unlock(priv, &flags);
-        return err;
+        return 0;
 }
 static int orinoco_ioctl_get_genie(struct net_device *dev,
diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index c6a370fa9bcb..34561e6e816b 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -451,8 +451,8 @@ static int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
                        }
                        if (err)
                                goto err;
+                        }
-                }
+                        break;
                case PDR_PRISM_ZIF_TX_IQ_CALIBRATION:
                        priv->iq_autocal = kmalloc(data_len, GFP_KERNEL);
                        if (!priv->iq_autocal) {
@@ -745,7 +745,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(entry);
                struct p54_hdr *entry_hdr;
                struct p54_tx_data *entry_data;
-                int pad = 0;
+                unsigned int pad = 0, frame_len;
                range = (void *)info->rate_driver_data;
                if (range->start_addr != addr) {
@@ -768,6 +768,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
                __skb_unlink(entry, &priv->tx_queue);
                spin_unlock_irqrestore(&priv->tx_queue.lock, flags);
+                frame_len = entry->len;
                entry_hdr = (struct p54_hdr *) entry->data;
                entry_data = (struct p54_tx_data *) entry_hdr->data;
                priv->tx_stats[entry_data->hw_queue].len--;
@@ -814,15 +815,28 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
                info->status.ack_signal = p54_rssi_to_dbm(dev,
                                (int)payload->ack_rssi);
-                if (entry_data->key_type == P54_CRYPTO_TKIPMICHAEL) {
+                /* Undo all changes to the frame. */
+                switch (entry_data->key_type) {
+                case P54_CRYPTO_TKIPMICHAEL: {
                        u8 *iv = (u8 *)(entry_data->align + pad +
-                                        entry_data->crypt_offset);
+                                        entry_data->crypt_offset);
                        /* Restore the original TKIP IV. */
                        iv[2] = iv[0];
                        iv[0] = iv[1];
                        iv[1] = (iv[0] | 0x20) & 0x7f;  /* WEPSeed - 8.3.2.2 */
+                        frame_len -= 12; /* remove TKIP_MMIC + TKIP_ICV */
+                        break;
+                        }
+                case P54_CRYPTO_AESCCMP:
+                        frame_len -= 8; /* remove CCMP_MIC */
+                        break;
+                case P54_CRYPTO_WEP:
+                        frame_len -= 4; /* remove WEP_ICV */
+                        break;
                }
+                skb_trim(entry, frame_len);
                skb_pull(entry, sizeof(*hdr) + pad + sizeof(*entry_data));
                ieee80211_tx_status_irqsafe(dev, entry);
                goto out;
@@ -1147,7 +1161,7 @@ static int p54_set_tim(struct ieee80211_hw *dev, struct ieee80211_sta *sta,
        skb = p54_alloc_skb(dev, P54_HDR_FLAG_CONTROL_OPSET,
                      sizeof(struct p54_hdr) + sizeof(*tim),
-                      P54_CONTROL_TYPE_TIM, GFP_KERNEL);
+                      P54_CONTROL_TYPE_TIM, GFP_ATOMIC);
        if (!skb)
                return -ENOMEM;
@@ -1610,7 +1624,7 @@ static int p54_scan(struct ieee80211_hw *dev, u16 mode, u16 dwell)
 err:
        printk(KERN_ERR "%s: frequency change failed\n", wiphy_name(dev->wiphy));
-        kfree_skb(skb);
+        p54_free_skb(dev, skb);
        return -EINVAL;
 }
@@ -2077,7 +2091,7 @@ static int p54_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
                        algo = P54_CRYPTO_AESCCMP;
                        break;
                default:
-                        return -EINVAL;
+                        return -EOPNOTSUPP;
                }
        }
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 6a6a72f6f82c..5de2ebfb28c7 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -144,11 +144,8 @@ static void p54u_tx_cb(struct urb *urb)
        struct sk_buff *skb = urb->context;
        struct ieee80211_hw *dev = (struct ieee80211_hw *)
                usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
-        struct p54u_priv *priv = dev->priv;
-        skb_pull(skb, priv->common.tx_hdr_len);
+        p54_free_skb(dev, skb);
-        if (FREE_AFTER_TX(skb))
-                p54_free_skb(dev, skb);
 }
 static void p54u_tx_dummy_cb(struct urb *urb) { }
@@ -230,7 +227,10 @@ static void p54u_tx_3887(struct ieee80211_hw *dev, struct sk_buff *skb)
                          p54u_tx_dummy_cb, dev);
        usb_fill_bulk_urb(data_urb, priv->udev,
                          usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
-                          skb->data, skb->len, p54u_tx_cb, skb);
+                          skb->data, skb->len, FREE_AFTER_TX(skb) ?
+                          p54u_tx_cb : p54u_tx_dummy_cb, skb);
+        addr_urb->transfer_flags |= URB_ZERO_PACKET;
+        data_urb->transfer_flags |= URB_ZERO_PACKET;
        usb_anchor_urb(addr_urb, &priv->submitted);
        err = usb_submit_urb(addr_urb, GFP_ATOMIC);
@@ -239,7 +239,7 @@ static void p54u_tx_3887(struct ieee80211_hw *dev, struct sk_buff *skb)
                goto out;
        }
-        usb_anchor_urb(addr_urb, &priv->submitted);
+        usb_anchor_urb(data_urb, &priv->submitted);
        err = usb_submit_urb(data_urb, GFP_ATOMIC);
        if (err)
                usb_unanchor_urb(data_urb);
@@ -269,28 +269,24 @@ static void p54u_tx_lm87(struct ieee80211_hw *dev, struct sk_buff *skb)
 {
        struct p54u_priv *priv = dev->priv;
        struct urb *data_urb;
-        struct lm87_tx_hdr *hdr;
+        struct lm87_tx_hdr *hdr = (void *)skb->data - sizeof(*hdr);
-        __le32 checksum;
-        __le32 addr = ((struct p54_hdr *)skb->data)->req_id;
        data_urb = usb_alloc_urb(0, GFP_ATOMIC);
        if (!data_urb)
                return;
-        checksum = p54u_lm87_chksum((__le32 *)skb->data, skb->len);
+        hdr->chksum = p54u_lm87_chksum((__le32 *)skb->data, skb->len);
-        hdr = (struct lm87_tx_hdr *)skb_push(skb, sizeof(*hdr));
+        hdr->device_addr = ((struct p54_hdr *)skb->data)->req_id;
-        hdr->chksum = checksum;
-        hdr->device_addr = addr;
        usb_fill_bulk_urb(data_urb, priv->udev,
                          usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
-                          skb->data, skb->len, p54u_tx_cb, skb);
+                          hdr, skb->len + sizeof(*hdr),  FREE_AFTER_TX(skb) ?
+                          p54u_tx_cb : p54u_tx_dummy_cb, skb);
        data_urb->transfer_flags |= URB_ZERO_PACKET;
        usb_anchor_urb(data_urb, &priv->submitted);
        if (usb_submit_urb(data_urb, GFP_ATOMIC)) {
                usb_unanchor_urb(data_urb);
-                skb_pull(skb, sizeof(*hdr));
                p54_free_skb(dev, skb);
        }
        usb_free_urb(data_urb);
@@ -300,11 +296,9 @@ static void p54u_tx_net2280(struct ieee80211_hw *dev, struct sk_buff *skb)
 {
        struct p54u_priv *priv = dev->priv;
        struct urb *int_urb, *data_urb;
-        struct net2280_tx_hdr *hdr;
+        struct net2280_tx_hdr *hdr = (void *)skb->data - sizeof(*hdr);
        struct net2280_reg_write *reg;
        int err = 0;
-        __le32 addr = ((struct p54_hdr *) skb->data)->req_id;
-        __le16 len = cpu_to_le16(skb->len);
        reg = kmalloc(sizeof(*reg), GFP_ATOMIC);
        if (!reg)
@@ -327,10 +321,9 @@ static void p54u_tx_net2280(struct ieee80211_hw *dev, struct sk_buff *skb)
        reg->addr = cpu_to_le32(P54U_DEV_BASE);
        reg->val = cpu_to_le32(ISL38XX_DEV_INT_DATA);
-        hdr = (void *)skb_push(skb, sizeof(*hdr));
        memset(hdr, 0, sizeof(*hdr));
-        hdr->len = len;
+        hdr->len = cpu_to_le16(skb->len);
-        hdr->device_addr = addr;
+        hdr->device_addr = ((struct p54_hdr *) skb->data)->req_id;
        usb_fill_bulk_urb(int_urb, priv->udev,
                usb_sndbulkpipe(priv->udev, P54U_PIPE_DEV), reg, sizeof(*reg),
@@ -341,11 +334,13 @@ static void p54u_tx_net2280(struct ieee80211_hw *dev, struct sk_buff *skb)
         * free what's inside the transfer_buffer after the callback routine
         * has completed.
         */
-        int_urb->transfer_flags |= URB_FREE_BUFFER;
+        int_urb->transfer_flags |= URB_FREE_BUFFER | URB_ZERO_PACKET;
        usb_fill_bulk_urb(data_urb, priv->udev,
                          usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
-                          skb->data, skb->len, p54u_tx_cb, skb);
+                          hdr, skb->len + sizeof(*hdr), FREE_AFTER_TX(skb) ?
+                          p54u_tx_cb : p54u_tx_dummy_cb, skb);
+        data_urb->transfer_flags |= URB_ZERO_PACKET;
        usb_anchor_urb(int_urb, &priv->submitted);
        err = usb_submit_urb(int_urb, GFP_ATOMIC);
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 607ce9f61b54..ed93ac41297f 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -1649,9 +1649,7 @@ static char *rndis_translate_scan(struct net_device *dev,
                                  char *end_buf,
                                  struct ndis_80211_bssid_ex *bssid)
 {
-#ifdef DEBUG
        struct usbnet *usbdev = netdev_priv(dev);
-#endif
        u8 *ie;
        char *current_val;
        int bssid_len, ie_len, i;
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 746a8f36b931..0709decec9c2 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -154,6 +154,7 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(entry->skb);
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)entry->skb->data;
+        struct ieee80211_tx_rate *txrate = &tx_info->control.rates[0];
        struct ieee80211_rate *rate =
            ieee80211_get_tx_rate(rt2x00dev->hw, tx_info);
        const struct rt2x00_rate *hwrate;
@@ -313,7 +314,7 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
                 * When preamble is enabled we should set the
                 * preamble bit for the signal.
                 */
-                if (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
+                if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
                        txdesc->signal |= 0x08;
        }
 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00rfkill.c b/drivers/net/wireless/rt2x00/rt2x00rfkill.c
index c3f53a92180a..3298cae1e12d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00rfkill.c
+++ b/drivers/net/wireless/rt2x00/rt2x00rfkill.c
@@ -162,7 +162,7 @@ void rt2x00rfkill_allocate(struct rt2x00_dev *rt2x00dev)
 void rt2x00rfkill_free(struct rt2x00_dev *rt2x00dev)
 {
-        if (!test_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->flags))
+        if (!test_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->rfkill_state))
                return;
        cancel_delayed_work_sync(&rt2x00dev->rfkill_work);
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index 6ad6bac37706..22bc07ef2f37 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -273,6 +273,7 @@ static int rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
        usb_fill_bulk_urb(urb, priv->udev, usb_sndbulkpipe(priv->udev, ep),
                          buf, skb->len, rtl8187_tx_cb, skb);
+        urb->transfer_flags |= URB_ZERO_PACKET;
        usb_anchor_urb(urb, &priv->anchored);
        rc = usb_submit_urb(urb, GFP_ATOMIC);
        if (rc < 0) {
diff --git a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
index 4e75e8e7fa90..78df281b297a 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
@@ -285,7 +285,10 @@ static void rtl8225_rf_set_tx_power(struct ieee80211_hw *dev, int channel)
        ofdm_power = priv->channels[channel - 1].hw_value >> 4;
        cck_power = min(cck_power, (u8)11);
-        ofdm_power = min(ofdm_power, (u8)35);
+        if (ofdm_power > (u8)15)
+                ofdm_power = 25;
+        else
+                ofdm_power += 10;
        rtl818x_iowrite8(priv, &priv->map->TX_GAIN_CCK,
                         rtl8225_tx_gain_cck_ofdm[cck_power / 6] >> 1);
@@ -536,7 +539,10 @@ static void rtl8225z2_rf_set_tx_power(struct ieee80211_hw *dev, int channel)
        cck_power += priv->txpwr_base & 0xF;
        cck_power = min(cck_power, (u8)35);
-        ofdm_power = min(ofdm_power, (u8)15);
+        if (ofdm_power > (u8)15)
+                ofdm_power = 25;
+        else
+                ofdm_power += 10;
        ofdm_power += priv->txpwr_base >> 4;
        ofdm_power = min(ofdm_power, (u8)35);
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index b5db57d2fcf5..17527f765b39 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -84,6 +84,7 @@ static struct usb_device_id usb_ids[] = {
        { USB_DEVICE(0x0586, 0x340a), .driver_info = DEVICE_ZD1211B },
        { USB_DEVICE(0x0471, 0x1237), .driver_info = DEVICE_ZD1211B },
        { USB_DEVICE(0x07fa, 0x1196), .driver_info = DEVICE_ZD1211B },
+        { USB_DEVICE(0x0df6, 0x0036), .driver_info = DEVICE_ZD1211B },
        /* "Driverless" devices that need ejecting */
        { USB_DEVICE(0x0ace, 0x2011), .driver_info = DEVICE_INSTALLER },
        { USB_DEVICE(0x0ace, 0x20ff), .driver_info = DEVICE_INSTALLER },
diff --git a/drivers/oprofile/cpu_buffer.c b/drivers/oprofile/cpu_buffer.c
index 2e03b6d796d3..e76d715e4342 100644
--- a/drivers/oprofile/cpu_buffer.c
+++ b/drivers/oprofile/cpu_buffer.c
@@ -393,16 +393,21 @@ oprofile_write_reserve(struct op_entry *entry, struct pt_regs * const regs,
        return;
 fail:
+        entry->event = NULL;
        cpu_buf->sample_lost_overflow++;
 }
 int oprofile_add_data(struct op_entry *entry, unsigned long val)
 {
+        if (!entry->event)
+                return 0;
        return op_cpu_buffer_add_data(entry, val);
 }
 int oprofile_write_commit(struct op_entry *entry)
 {
+        if (!entry->event)
+                return -EINVAL;
        return op_cpu_buffer_write_commit(entry);
 }
diff --git a/drivers/oprofile/cpu_buffer.h b/drivers/oprofile/cpu_buffer.h
index 63f81c44846a..272995d20293 100644
--- a/drivers/oprofile/cpu_buffer.h
+++ b/drivers/oprofile/cpu_buffer.h
@@ -66,6 +66,13 @@ static inline void op_cpu_buffer_reset(int cpu)
        cpu_buf->last_task = NULL;
 }
+/*
+ * op_cpu_buffer_add_data() and op_cpu_buffer_write_commit() may be
+ * called only if op_cpu_buffer_write_reserve() did not return NULL or
+ * entry->event != NULL, otherwise entry->size or entry->event will be
+ * used uninitialized.
+ */
 struct op_sample
 *op_cpu_buffer_write_reserve(struct op_entry *entry, unsigned long size);
 int op_cpu_buffer_write_commit(struct op_entry *entry);
diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c
index 3fac8f81d59d..a70cf16ee1ad 100644
--- a/drivers/parisc/sba_iommu.c
+++ b/drivers/parisc/sba_iommu.c
@@ -668,7 +668,7 @@ sba_mark_invalid(struct ioc *ioc, dma_addr_t iova, size_t byte_cnt)
 * @dev: instance of PCI owned by the driver that's asking
 * @mask:  number of address bits this PCI device can handle
 *
- * See Documentation/DMA-mapping.txt
+ * See Documentation/PCI/PCI-DMA-mapping.txt
 */
 static int sba_dma_supported( struct device *dev, u64 mask)
 {
@@ -680,8 +680,8 @@ static int sba_dma_supported( struct device *dev, u64 mask)
                return(0);
        }
-        /* Documentation/DMA-mapping.txt tells drivers to try 64-bit first,
+        /* Documentation/PCI/PCI-DMA-mapping.txt tells drivers to try 64-bit
-         * then fall back to 32-bit if that fails.
+         * first, then fall back to 32-bit if that fails.
         * We are just "encouraging" 32-bit DMA masks here since we can
         * never allow IOMMU bypass unless we add special support for ZX1.
         */
@@ -706,7 +706,7 @@ static int sba_dma_supported( struct device *dev, u64 mask)
 * @size:  number of bytes to map in driver buffer.
 * @direction:  R/W or both.
 *
- * See Documentation/DMA-mapping.txt
+ * See Documentation/PCI/PCI-DMA-mapping.txt
 */
 static dma_addr_t
 sba_map_single(struct device *dev, void *addr, size_t size,
@@ -785,7 +785,7 @@ sba_map_single(struct device *dev, void *addr, size_t size,
 * @size:  number of bytes mapped in driver buffer.
 * @direction:  R/W or both.
 *
- * See Documentation/DMA-mapping.txt
+ * See Documentation/PCI/PCI-DMA-mapping.txt
 */
 static void
 sba_unmap_single(struct device *dev, dma_addr_t iova, size_t size,
@@ -861,7 +861,7 @@ sba_unmap_single(struct device *dev, dma_addr_t iova, size_t size,
 * @size:  number of bytes mapped in driver buffer.
 * @dma_handle:  IOVA of new buffer.
 *
- * See Documentation/DMA-mapping.txt
+ * See Documentation/PCI/PCI-DMA-mapping.txt
 */
 static void *sba_alloc_consistent(struct device *hwdev, size_t size,
                                        dma_addr_t *dma_handle, gfp_t gfp)
@@ -892,7 +892,7 @@ static void *sba_alloc_consistent(struct device *hwdev, size_t size,
 * @vaddr:  virtual address IOVA of "consistent" buffer.
 * @dma_handler:  IO virtual address of "consistent" buffer.
 *
- * See Documentation/DMA-mapping.txt
+ * See Documentation/PCI/PCI-DMA-mapping.txt
 */
 static void
 sba_free_consistent(struct device *hwdev, size_t size, void *vaddr,
@@ -927,7 +927,7 @@ int dump_run_sg = 0;
 * @nents:  number of entries in list
 * @direction:  R/W or both.
 *
- * See Documentation/DMA-mapping.txt
+ * See Documentation/PCI/PCI-DMA-mapping.txt
 */
 static int
 sba_map_sg(struct device *dev, struct scatterlist *sglist, int nents,
@@ -1011,7 +1011,7 @@ sba_map_sg(struct device *dev, struct scatterlist *sglist, int nents,
 * @nents:  number of entries in list
 * @direction:  R/W or both.
 *
- * See Documentation/DMA-mapping.txt
+ * See Documentation/PCI/PCI-DMA-mapping.txt
 */
 static void 
 sba_unmap_sg(struct device *dev, struct scatterlist *sglist, int nents,
diff --git a/drivers/pci/hotplug/Makefile b/drivers/pci/hotplug/Makefile
index e31fb91652ce..2aa117c8cd87 100644
--- a/drivers/pci/hotplug/Makefile
+++ b/drivers/pci/hotplug/Makefile
@@ -5,11 +5,15 @@
 obj-$(CONFIG_HOTPLUG_PCI)               += pci_hotplug.o
 obj-$(CONFIG_HOTPLUG_PCI_COMPAQ)        += cpqphp.o
 obj-$(CONFIG_HOTPLUG_PCI_IBM)           += ibmphp.o
+# pciehp should be linked before acpiphp in order to allow the native driver
+# to attempt to bind first. We can then fall back to generic support.
+obj-$(CONFIG_HOTPLUG_PCI_PCIE)          += pciehp.o
 obj-$(CONFIG_HOTPLUG_PCI_ACPI)          += acpiphp.o
 obj-$(CONFIG_HOTPLUG_PCI_ACPI_IBM)      += acpiphp_ibm.o
 obj-$(CONFIG_HOTPLUG_PCI_CPCI_ZT5550)   += cpcihp_zt5550.o
 obj-$(CONFIG_HOTPLUG_PCI_CPCI_GENERIC)  += cpcihp_generic.o
-obj-$(CONFIG_HOTPLUG_PCI_PCIE)          += pciehp.o
 obj-$(CONFIG_HOTPLUG_PCI_SHPC)          += shpchp.o
 obj-$(CONFIG_HOTPLUG_PCI_RPA)           += rpaphp.o
 obj-$(CONFIG_HOTPLUG_PCI_RPA_DLPAR)     += rpadlpar_io.o
diff --git a/drivers/pci/hotplug/fakephp.c b/drivers/pci/hotplug/fakephp.c
index b0e7de9e536d..d8649e127298 100644
--- a/drivers/pci/hotplug/fakephp.c
+++ b/drivers/pci/hotplug/fakephp.c
@@ -195,13 +195,13 @@ static void remove_slot_worker(struct work_struct *work)
 * Tries hard not to re-enable already existing devices;
 * also handles scanning of subfunctions.
 */
-static void pci_rescan_slot(struct pci_dev *temp)
+static int pci_rescan_slot(struct pci_dev *temp)
 {
        struct pci_bus *bus = temp->bus;
        struct pci_dev *dev;
        int func;
-        int retval;
        u8 hdr_type;
+        int count = 0;
        if (!pci_read_config_byte(temp, PCI_HEADER_TYPE, &hdr_type)) {
                temp->hdr_type = hdr_type & 0x7f;
@@ -213,17 +213,12 @@ static void pci_rescan_slot(struct pci_dev *temp)
                                dbg("New device on %s function %x:%x\n",
                                        bus->name, temp->devfn >> 3,
                                        temp->devfn & 7);
-                                retval = pci_bus_add_device(dev);
+                                count++;
-                                if (retval)
-                                        dev_err(&dev->dev, "error adding "
-                                                "device, continuing.\n");
-                                else
-                                        add_slot(dev);
                        }
                }
                /* multifunction device? */
                if (!(hdr_type & 0x80))
-                        return;
+                        return count;
                /* continue scanning for other functions */
                for (func = 1, temp->devfn++; func < 8; func++, temp->devfn++) {
@@ -239,16 +234,13 @@ static void pci_rescan_slot(struct pci_dev *temp)
                                        dbg("New device on %s function %x:%x\n",
                                                bus->name, temp->devfn >> 3,
                                                temp->devfn & 7);
-                                        retval = pci_bus_add_device(dev);
+                                        count++;
-                                        if (retval)
-                                                dev_err(&dev->dev, "error adding "
-                                                        "device, continuing.\n");
-                                        else
-                                                add_slot(dev);
                                }
                        }
                }
        }
+        return count;
 }
@@ -262,6 +254,8 @@ static void pci_rescan_bus(const struct pci_bus *bus)
 {
        unsigned int devfn;
        struct pci_dev *dev;
+        int retval;
+        int found = 0;
        dev = alloc_pci_dev();
        if (!dev)
                return;
@@ -270,7 +264,23 @@ static void pci_rescan_bus(const struct pci_bus *bus)
        dev->sysdata = bus->sysdata;
        for (devfn = 0; devfn < 0x100; devfn += 8) {
                dev->devfn = devfn;
-                pci_rescan_slot(dev);
+                found += pci_rescan_slot(dev);
+        }
+        if (found) {
+                pci_bus_assign_resources(bus);
+                list_for_each_entry(dev, &bus->devices, bus_list) {
+                        /* Skip already-added devices */
+                        if (dev->is_added)
+                                        continue;
+                        retval = pci_bus_add_device(dev);
+                        if (retval)
+                                dev_err(&dev->dev,
+                                        "Error adding device, continuing\n");
+                        else
+                                add_slot(dev);
+                }
+                pci_bus_add_devices(bus);
        }
        kfree(dev);
 }
diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index 5482d4ed8256..c2485542f543 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -126,8 +126,10 @@ static int set_lock_status(struct hotplug_slot *hotplug_slot, u8 status)
        mutex_lock(&slot->ctrl->crit_sect);
        /* has it been >1 sec since our last toggle? */
-        if ((get_seconds() - slot->last_emi_toggle) < 1)
+        if ((get_seconds() - slot->last_emi_toggle) < 1) {
+                mutex_unlock(&slot->ctrl->crit_sect);
                return -EINVAL;
+        }
        /* see what our current state is */
        retval = get_lock_status(hotplug_slot, &value);
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index b4a90badd0a6..44f15ff70c1d 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -103,6 +103,16 @@ static void msix_set_enable(struct pci_dev *dev, int enable)
        }
 }
+/*
+ * Essentially, this is ((1 << (1 << x)) - 1), but without the
+ * undefinedness of a << 32.
+ */
+static inline __attribute_const__ u32 msi_mask(unsigned x)
+{
+        static const u32 mask[] = { 1, 2, 4, 0xf, 0xff, 0xffff, 0xffffffff };
+        return mask[x];
+}
 static void msix_flush_writes(struct irq_desc *desc)
 {
        struct msi_desc *entry;
@@ -398,21 +408,18 @@ static int msi_capability_init(struct pci_dev *dev)
        entry->msi_attrib.masked = 1;
        entry->msi_attrib.default_irq = dev->irq;       /* Save IOAPIC IRQ */
        entry->msi_attrib.pos = pos;
-        if (entry->msi_attrib.maskbit) {
-                entry->mask_base = (void __iomem *)(long)msi_mask_bits_reg(pos,
-                                entry->msi_attrib.is_64);
-        }
        entry->dev = dev;
        if (entry->msi_attrib.maskbit) {
-                unsigned int maskbits, temp;
+                unsigned int base, maskbits, temp;
+                base = msi_mask_bits_reg(pos, entry->msi_attrib.is_64);
+                entry->mask_base = (void __iomem *)(long)base;
                /* All MSIs are unmasked by default, Mask them all */
-                pci_read_config_dword(dev,
+                pci_read_config_dword(dev, base, &maskbits);
-                        msi_mask_bits_reg(pos, entry->msi_attrib.is_64),
+                temp = msi_mask((control & PCI_MSI_FLAGS_QMASK) >> 1);
-                        &maskbits);
-                temp = (1 << multi_msi_capable(control));
-                temp = ((temp - 1) & ~temp);
                maskbits |= temp;
-                pci_write_config_dword(dev, entry->msi_attrib.is_64, maskbits);
+                pci_write_config_dword(dev, base, maskbits);
                entry->msi_attrib.maskbits_mask = temp;
        }
        list_add_tail(&entry->list, &dev->msi_list);
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index c697f2680856..ab1d615425a8 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -355,17 +355,28 @@ static int pci_legacy_suspend(struct device *dev, pm_message_t state)
        int i = 0;
        if (drv && drv->suspend) {
+                pci_dev->state_saved = false;
                i = drv->suspend(pci_dev, state);
                suspend_report_result(drv->suspend, i);
-        } else {
+                if (i)
-                pci_save_state(pci_dev);
+                        return i;
-                /*
-                 * This is for compatibility with existing code with legacy PM
+                if (pci_dev->state_saved)
-                 * support.
+                        goto Fixup;
-                 */
-                pci_pm_set_unknown_state(pci_dev);
+                if (WARN_ON_ONCE(pci_dev->current_state != PCI_D0))
+                        goto Fixup;
        }
+        pci_save_state(pci_dev);
+        pci_dev->state_saved = true;
+        /*
+         * This is for compatibility with existing code with legacy PM support.
+         */
+        pci_pm_set_unknown_state(pci_dev);
+ Fixup:
        pci_fixup_device(pci_fixup_suspend, pci_dev);
        return i;
@@ -386,81 +397,35 @@ static int pci_legacy_suspend_late(struct device *dev, pm_message_t state)
 static int pci_legacy_resume_early(struct device *dev)
 {
-        int error = 0;
        struct pci_dev * pci_dev = to_pci_dev(dev);
        struct pci_driver * drv = pci_dev->driver;
-        pci_fixup_device(pci_fixup_resume_early, pci_dev);
+        return drv && drv->resume_early ?
+                        drv->resume_early(pci_dev) : 0;
-        if (drv && drv->resume_early)
-                error = drv->resume_early(pci_dev);
-        return error;
 }
 static int pci_legacy_resume(struct device *dev)
 {
-        int error;
        struct pci_dev * pci_dev = to_pci_dev(dev);
        struct pci_driver * drv = pci_dev->driver;
        pci_fixup_device(pci_fixup_resume, pci_dev);
-        if (drv && drv->resume) {
+        return drv && drv->resume ?
-                error = drv->resume(pci_dev);
+                        drv->resume(pci_dev) : pci_pm_reenable_device(pci_dev);
-        } else {
-                /* restore the PCI config space */
-                pci_restore_state(pci_dev);
-                error = pci_pm_reenable_device(pci_dev);
-        }
-        return error;
 }
 /* Auxiliary functions used by the new power management framework */
-static int pci_restore_standard_config(struct pci_dev *pci_dev)
-{
-        struct pci_dev *parent = pci_dev->bus->self;
-        int error = 0;
-        /* Check if the device's bus is operational */
-        if (!parent || parent->current_state == PCI_D0) {
-                pci_restore_state(pci_dev);
-                pci_update_current_state(pci_dev, PCI_D0);
-        } else {
-                dev_warn(&pci_dev->dev, "unable to restore config, "
-                        "bridge %s in low power state D%d\n", pci_name(parent),
-                        parent->current_state);
-                pci_dev->current_state = PCI_UNKNOWN;
-                error = -EAGAIN;
-        }
-        return error;
-}
-static bool pci_is_bridge(struct pci_dev *pci_dev)
-{
-        return !!(pci_dev->subordinate);
-}
 static void pci_pm_default_resume_noirq(struct pci_dev *pci_dev)
 {
-        if (pci_restore_standard_config(pci_dev))
+        pci_restore_standard_config(pci_dev);
-                pci_fixup_device(pci_fixup_resume_early, pci_dev);
+        pci_dev->state_saved = false;
+        pci_fixup_device(pci_fixup_resume_early, pci_dev);
 }
 static int pci_pm_default_resume(struct pci_dev *pci_dev)
 {
-        /*
-         * pci_restore_standard_config() should have been called once already,
-         * but it would have failed if the device's parent bridge had not been
-         * in power state D0 at that time.  Check it and try again if necessary.
-         */
-        if (pci_dev->current_state == PCI_UNKNOWN) {
-                int error = pci_restore_standard_config(pci_dev);
-                if (error)
-                        return error;
-        }
        pci_fixup_device(pci_fixup_resume, pci_dev);
        if (!pci_is_bridge(pci_dev))
@@ -575,11 +540,11 @@ static int pci_pm_resume_noirq(struct device *dev)
        struct device_driver *drv = dev->driver;
        int error = 0;
+        pci_pm_default_resume_noirq(pci_dev);
        if (pci_has_legacy_pm_support(pci_dev))
                return pci_legacy_resume_early(dev);
-        pci_pm_default_resume_noirq(pci_dev);
        if (drv && drv->pm && drv->pm->resume_noirq)
                error = drv->pm->resume_noirq(dev);
@@ -592,6 +557,13 @@ static int pci_pm_resume(struct device *dev)
        struct device_driver *drv = dev->driver;
        int error = 0;
+        /*
+         * This is necessary for the suspend error path in which resume is
+         * called without restoring the standard config registers of the device.
+         */
+        if (pci_dev->state_saved)
+                pci_restore_standard_config(pci_dev);
        if (pci_has_legacy_pm_support(pci_dev))
                return pci_legacy_resume(dev);
@@ -697,7 +669,10 @@ static int pci_pm_poweroff(struct device *dev)
        if (pci_has_legacy_pm_support(pci_dev))
                return pci_legacy_suspend(dev, PMSG_HIBERNATE);
-        if (drv && drv->pm && drv->pm->poweroff) {
+        if (!drv || !drv->pm)
+                return 0;
+        if (drv->pm->poweroff) {
                error = drv->pm->poweroff(dev);
                suspend_report_result(drv->pm->poweroff, error);
        }
@@ -730,11 +705,11 @@ static int pci_pm_restore_noirq(struct device *dev)
        struct device_driver *drv = dev->driver;
        int error = 0;
+        pci_pm_default_resume_noirq(pci_dev);
        if (pci_has_legacy_pm_support(pci_dev))
                return pci_legacy_resume_early(dev);
-        pci_pm_default_resume_noirq(pci_dev);
        if (drv && drv->pm && drv->pm->restore_noirq)
                error = drv->pm->restore_noirq(dev);
@@ -747,6 +722,13 @@ static int pci_pm_restore(struct device *dev)
        struct device_driver *drv = dev->driver;
        int error = 0;
+        /*
+         * This is necessary for the hibernation error path in which restore is
+         * called without restoring the standard config registers of the device.
+         */
+        if (pci_dev->state_saved)
+                pci_restore_standard_config(pci_dev);
        if (pci_has_legacy_pm_support(pci_dev))
                return pci_legacy_resume(dev);
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index e491fdedf705..48807556b47a 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -22,7 +22,7 @@
 #include <asm/dma.h>    /* isa_dma_bridge_buggy */
 #include "pci.h"
-unsigned int pci_pm_d3_delay = 10;
+unsigned int pci_pm_d3_delay = PCI_PM_D3_WAIT;
 #ifdef CONFIG_PCI_DOMAINS
 int pci_domains_supported = 1;
@@ -426,6 +426,7 @@ static inline int platform_pci_sleep_wake(struct pci_dev *dev, bool enable)
 *                           given PCI device
 * @dev: PCI device to handle.
 * @state: PCI power state (D0, D1, D2, D3hot) to put the device into.
+ * @wait: If 'true', wait for the device to change its power state
 *
 * RETURN VALUE:
 * -EINVAL if the requested state is invalid.
@@ -435,7 +436,7 @@ static inline int platform_pci_sleep_wake(struct pci_dev *dev, bool enable)
 * 0 if device's power state has been successfully changed.
 */
 static int
-pci_raw_set_power_state(struct pci_dev *dev, pci_power_t state)
+pci_raw_set_power_state(struct pci_dev *dev, pci_power_t state, bool wait)
 {
        u16 pmcsr;
        bool need_restore = false;
@@ -480,8 +481,10 @@ pci_raw_set_power_state(struct pci_dev *dev, pci_power_t state)
                break;
        case PCI_UNKNOWN: /* Boot-up */
                if ((pmcsr & PCI_PM_CTRL_STATE_MASK) == PCI_D3hot
-                 && !(pmcsr & PCI_PM_CTRL_NO_SOFT_RESET))
+                 && !(pmcsr & PCI_PM_CTRL_NO_SOFT_RESET)) {
                        need_restore = true;
+                        wait = true;
+                }
                /* Fall-through: force to D0 */
        default:
                pmcsr = 0;
@@ -491,12 +494,15 @@ pci_raw_set_power_state(struct pci_dev *dev, pci_power_t state)
        /* enter specified state */
        pci_write_config_word(dev, dev->pm_cap + PCI_PM_CTRL, pmcsr);
+        if (!wait)
+                return 0;
        /* Mandatory power management transition delays */
        /* see PCI PM 1.1 5.6.1 table 18 */
        if (state == PCI_D3hot || dev->current_state == PCI_D3hot)
                msleep(pci_pm_d3_delay);
        else if (state == PCI_D2 || dev->current_state == PCI_D2)
-                udelay(200);
+                udelay(PCI_PM_D2_DELAY);
        dev->current_state = state;
@@ -515,7 +521,7 @@ pci_raw_set_power_state(struct pci_dev *dev, pci_power_t state)
        if (need_restore)
                pci_restore_bars(dev);
-        if (dev->bus->self)
+        if (wait && dev->bus->self)
                pcie_aspm_pm_state_change(dev->bus->self);
        return 0;
@@ -585,7 +591,7 @@ int pci_set_power_state(struct pci_dev *dev, pci_power_t state)
        if (state == PCI_D3hot && (dev->dev_flags & PCI_DEV_FLAGS_NO_D3))
                return 0;
-        error = pci_raw_set_power_state(dev, state);
+        error = pci_raw_set_power_state(dev, state, true);
        if (state > PCI_D0 && platform_pci_power_manageable(dev)) {
                /* Allow the platform to finalize the transition */
@@ -730,6 +736,7 @@ pci_save_state(struct pci_dev *dev)
        /* XXX: 100% dword access ok here? */
        for (i = 0; i < 16; i++)
                pci_read_config_dword(dev, i * 4,&dev->saved_config_space[i]);
+        dev->state_saved = true;
        if ((i = pci_save_pcie_state(dev)) != 0)
                return i;
        if ((i = pci_save_pcix_state(dev)) != 0)
@@ -1374,6 +1381,50 @@ void pci_allocate_cap_save_buffers(struct pci_dev *dev)
 }
 /**
+ * pci_restore_standard_config - restore standard config registers of PCI device
+ * @dev: PCI device to handle
+ *
+ * This function assumes that the device's configuration space is accessible.
+ * If the device needs to be powered up, the function will wait for it to
+ * change the state.
+ */
+int pci_restore_standard_config(struct pci_dev *dev)
+{
+        pci_power_t prev_state;
+        int error;
+        pci_update_current_state(dev, PCI_D0);
+        prev_state = dev->current_state;
+        if (prev_state == PCI_D0)
+                goto Restore;
+        error = pci_raw_set_power_state(dev, PCI_D0, false);
+        if (error)
+                return error;
+        /*
+         * This assumes that we won't get a bus in B2 or B3 from the BIOS, but
+         * we've made this assumption forever and it appears to be universally
+         * satisfied.
+         */
+        switch(prev_state) {
+        case PCI_D3cold:
+        case PCI_D3hot:
+                mdelay(pci_pm_d3_delay);
+                break;
+        case PCI_D2:
+                udelay(PCI_PM_D2_DELAY);
+                break;
+        }
+        dev->current_state = PCI_D0;
+ Restore:
+        return pci_restore_state(dev);
+}
+/**
 * pci_enable_ari - enable ARI forwarding if hardware support it
 * @dev: the PCI device
 */
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 1351bb4addde..26ddf78ac300 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -49,6 +49,12 @@ extern void pci_disable_enabled_device(struct pci_dev *dev);
 extern void pci_pm_init(struct pci_dev *dev);
 extern void platform_pci_wakeup_init(struct pci_dev *dev);
 extern void pci_allocate_cap_save_buffers(struct pci_dev *dev);
+extern int pci_restore_standard_config(struct pci_dev *dev);
+static inline bool pci_is_bridge(struct pci_dev *pci_dev)
+{
+        return !!(pci_dev->subordinate);
+}
 extern int pci_user_read_config_byte(struct pci_dev *dev, int where, u8 *val);
 extern int pci_user_read_config_word(struct pci_dev *dev, int where, u16 *val);
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 1a266d4ab5f1..94363115a42a 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -42,6 +42,7 @@ config ASUS_LAPTOP
        depends on LEDS_CLASS
        depends on NEW_LEDS
        depends on BACKLIGHT_CLASS_DEVICE
+        depends on INPUT
        ---help---
          This is the new Linux driver for Asus laptops. It may also support some
          MEDION, JVC or VICTOR laptops. It makes all the extra buttons generate
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index 8fb8b3591048..56af6cf385b0 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -46,6 +46,7 @@
 #include <acpi/acpi_drivers.h>
 #include <acpi/acpi_bus.h>
 #include <asm/uaccess.h>
+#include <linux/input.h>
 #define ASUS_LAPTOP_VERSION "0.42"
@@ -181,6 +182,8 @@ struct asus_hotk {
        u8 light_level;         //light sensor level
        u8 light_switch;        //light sensor switch value
        u16 event_count[128];   //count for each event TODO make this better
+        struct input_dev *inputdev;
+        u16 *keycode_map;
 };
 /*
@@ -250,6 +253,37 @@ ASUS_LED(rled, "record");
 ASUS_LED(pled, "phone");
 ASUS_LED(gled, "gaming");
+struct key_entry {
+        char type;
+        u8 code;
+        u16 keycode;
+};
+enum { KE_KEY, KE_END };
+static struct key_entry asus_keymap[] = {
+        {KE_KEY, 0x30, KEY_VOLUMEUP},
+        {KE_KEY, 0x31, KEY_VOLUMEDOWN},
+        {KE_KEY, 0x32, KEY_MUTE},
+        {KE_KEY, 0x33, KEY_SWITCHVIDEOMODE},
+        {KE_KEY, 0x34, KEY_SWITCHVIDEOMODE},
+        {KE_KEY, 0x40, KEY_PREVIOUSSONG},
+        {KE_KEY, 0x41, KEY_NEXTSONG},
+        {KE_KEY, 0x43, KEY_STOP},
+        {KE_KEY, 0x45, KEY_PLAYPAUSE},
+        {KE_KEY, 0x50, KEY_EMAIL},
+        {KE_KEY, 0x51, KEY_WWW},
+        {KE_KEY, 0x5C, BTN_EXTRA},  /* Performance */
+        {KE_KEY, 0x5D, KEY_WLAN},
+        {KE_KEY, 0x61, KEY_SWITCHVIDEOMODE},
+        {KE_KEY, 0x6B, BTN_TOUCH}, /* Lock Mouse */
+        {KE_KEY, 0x82, KEY_CAMERA},
+        {KE_KEY, 0x8A, KEY_TV},
+        {KE_KEY, 0x95, KEY_MEDIA},
+        {KE_KEY, 0x99, KEY_PHONE},
+        {KE_END, 0},
+};
 /*
 * This function evaluates an ACPI method, given an int as parameter, the
 * method is searched within the scope of the handle, can be NULL. The output
@@ -720,8 +754,68 @@ static ssize_t store_gps(struct device *dev, struct device_attribute *attr,
        return store_status(buf, count, NULL, GPS_ON);
 }
+/*
+ * Hotkey functions
+ */
+static struct key_entry *asus_get_entry_by_scancode(int code)
+{
+        struct key_entry *key;
+        for (key = asus_keymap; key->type != KE_END; key++)
+                if (code == key->code)
+                        return key;
+        return NULL;
+}
+static struct key_entry *asus_get_entry_by_keycode(int code)
+{
+        struct key_entry *key;
+        for (key = asus_keymap; key->type != KE_END; key++)
+                if (code == key->keycode && key->type == KE_KEY)
+                        return key;
+        return NULL;
+}
+static int asus_getkeycode(struct input_dev *dev, int scancode, int *keycode)
+{
+        struct key_entry *key = asus_get_entry_by_scancode(scancode);
+        if (key && key->type == KE_KEY) {
+                *keycode = key->keycode;
+                return 0;
+        }
+        return -EINVAL;
+}
+static int asus_setkeycode(struct input_dev *dev, int scancode, int keycode)
+{
+        struct key_entry *key;
+        int old_keycode;
+        if (keycode < 0 || keycode > KEY_MAX)
+                return -EINVAL;
+        key = asus_get_entry_by_scancode(scancode);
+        if (key && key->type == KE_KEY) {
+                old_keycode = key->keycode;
+                key->keycode = keycode;
+                set_bit(keycode, dev->keybit);
+                if (!asus_get_entry_by_keycode(old_keycode))
+                        clear_bit(old_keycode, dev->keybit);
+                return 0;
+        }
+        return -EINVAL;
+}
 static void asus_hotk_notify(acpi_handle handle, u32 event, void *data)
 {
+        static struct key_entry *key;
        /* TODO Find a better way to handle events count. */
        if (!hotk)
                return;
@@ -738,10 +832,24 @@ static void asus_hotk_notify(acpi_handle handle, u32 event, void *data)
                lcd_blank(FB_BLANK_POWERDOWN);
        }
-        acpi_bus_generate_proc_event(hotk->device, event,
+        acpi_bus_generate_netlink_event(hotk->device->pnp.device_class,
-                                hotk->event_count[event % 128]++);
+                                        dev_name(&hotk->device->dev), event,
+                                        hotk->event_count[event % 128]++);
-        return;
+        if (hotk->inputdev) {
+                key = asus_get_entry_by_scancode(event);
+                if (!key)
+                        return ;
+                switch (key->type) {
+                case KE_KEY:
+                        input_report_key(hotk->inputdev, key->keycode, 1);
+                        input_sync(hotk->inputdev);
+                        input_report_key(hotk->inputdev, key->keycode, 0);
+                        input_sync(hotk->inputdev);
+                        break;
+                }
+        }
 }
 #define ASUS_CREATE_DEVICE_ATTR(_name)                                  \
@@ -959,6 +1067,38 @@ static int asus_hotk_get_info(void)
        return AE_OK;
 }
+static int asus_input_init(void)
+{
+        const struct key_entry *key;
+        int result;
+        hotk->inputdev = input_allocate_device();
+        if (!hotk->inputdev) {
+                printk(ASUS_INFO "Unable to allocate input device\n");
+                return 0;
+        }
+        hotk->inputdev->name = "Asus Laptop extra buttons";
+        hotk->inputdev->phys = ASUS_HOTK_FILE "/input0";
+        hotk->inputdev->id.bustype = BUS_HOST;
+        hotk->inputdev->getkeycode = asus_getkeycode;
+        hotk->inputdev->setkeycode = asus_setkeycode;
+        for (key = asus_keymap; key->type != KE_END; key++) {
+                switch (key->type) {
+                case KE_KEY:
+                        set_bit(EV_KEY, hotk->inputdev->evbit);
+                        set_bit(key->keycode, hotk->inputdev->keybit);
+                        break;
+                }
+        }
+        result = input_register_device(hotk->inputdev);
+        if (result) {
+                printk(ASUS_INFO "Unable to register input device\n");
+                input_free_device(hotk->inputdev);
+        }
+        return result;
+}
 static int asus_hotk_check(void)
 {
        int result = 0;
@@ -1044,7 +1184,7 @@ static int asus_hotk_add(struct acpi_device *device)
        /* GPS is on by default */
        write_status(NULL, 1, GPS_ON);
-      end:
+end:
        if (result) {
                kfree(hotk->name);
                kfree(hotk);
@@ -1091,10 +1231,17 @@ static void asus_led_exit(void)
        ASUS_LED_UNREGISTER(gled);
 }
+static void asus_input_exit(void)
+{
+        if (hotk->inputdev)
+                input_unregister_device(hotk->inputdev);
+}
 static void __exit asus_laptop_exit(void)
 {
        asus_backlight_exit();
        asus_led_exit();
+        asus_input_exit();
        acpi_bus_unregister_driver(&asus_hotk_driver);
        sysfs_remove_group(&asuspf_device->dev.kobj, &asuspf_attribute_group);
@@ -1216,6 +1363,10 @@ static int __init asus_laptop_init(void)
                printk(ASUS_INFO "Brightness ignored, must be controlled by "
                       "ACPI video driver\n");
+        result = asus_input_init();
+        if (result)
+                goto fail_input;
        result = asus_led_init(dev);
        if (result)
                goto fail_led;
@@ -1242,22 +1393,25 @@ static int __init asus_laptop_init(void)
        return 0;
-      fail_sysfs:
+fail_sysfs:
        platform_device_del(asuspf_device);
-      fail_platform_device2:
+fail_platform_device2:
        platform_device_put(asuspf_device);
-      fail_platform_device1:
+fail_platform_device1:
        platform_driver_unregister(&asuspf_driver);
-      fail_platform_driver:
+fail_platform_driver:
        asus_led_exit();
-      fail_led:
+fail_led:
+        asus_input_exit();
+fail_input:
        asus_backlight_exit();
-      fail_backlight:
+fail_backlight:
        return result;
 }
diff --git a/drivers/platform/x86/asus_acpi.c b/drivers/platform/x86/asus_acpi.c
index 1e74988c7b2d..d63f26e666a4 100644
--- a/drivers/platform/x86/asus_acpi.c
+++ b/drivers/platform/x86/asus_acpi.c
@@ -143,6 +143,7 @@ struct asus_hotk {
                                                         S1300N, S5200N*/
                A4S,            /* Z81sp */
                F3Sa,           /* (Centrino) */
+                R1F,
                END_MODEL
        } model;                /* Models currently supported */
        u16 event_count[128];   /* Count for each event TODO make this better */
@@ -420,7 +421,18 @@ static struct model_data model_conf[END_MODEL] = {
                .display_get    = "\\ADVG",
                .display_set    = "SDSP",
        },
+        {
+                .name = "R1F",
+                .mt_bt_switch = "BLED",
+                .mt_mled = "MLED",
+                .mt_wled = "WLED",
+                .mt_lcd_switch = "\\Q10",
+                .lcd_status = "\\GP06",
+                .brightness_set = "SPLV",
+                .brightness_get = "GPLV",
+                .display_set = "SDSP",
+                .display_get = "\\INFB"
+        }
 };
 /* procdir we use */
@@ -1165,6 +1177,8 @@ static int asus_model_match(char *model)
                return W3V;
        else if (strncmp(model, "W5A", 3) == 0)
                return W5A;
+        else if (strncmp(model, "R1F", 3) == 0)
+                return R1F;
        else if (strncmp(model, "A4S", 3) == 0)
                return A4S;
        else if (strncmp(model, "F3Sa", 4) == 0)
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index 8fb983f5629e..786ed8661cb0 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -30,6 +30,7 @@
 #include <linux/uaccess.h>
 #include <linux/input.h>
 #include <linux/rfkill.h>
+#include <linux/pci.h>
 #define EEEPC_LAPTOP_VERSION    "0.1"
@@ -161,6 +162,10 @@ static struct key_entry eeepc_keymap[] = {
        {KE_KEY, 0x13, KEY_MUTE },
        {KE_KEY, 0x14, KEY_VOLUMEDOWN },
        {KE_KEY, 0x15, KEY_VOLUMEUP },
+        {KE_KEY, 0x1a, KEY_COFFEE },
+        {KE_KEY, 0x1b, KEY_ZOOM },
+        {KE_KEY, 0x1c, KEY_PROG2 },
+        {KE_KEY, 0x1d, KEY_PROG3 },
        {KE_KEY, 0x30, KEY_SWITCHVIDEOMODE },
        {KE_KEY, 0x31, KEY_SWITCHVIDEOMODE },
        {KE_KEY, 0x32, KEY_SWITCHVIDEOMODE },
@@ -514,6 +519,41 @@ static void notify_brn(void)
                bd->props.brightness = read_brightness(bd);
 }
+static void eeepc_rfkill_notify(acpi_handle handle, u32 event, void *data)
+{
+        struct pci_dev *dev;
+        struct pci_bus *bus = pci_find_bus(0, 1);
+        if (event != ACPI_NOTIFY_BUS_CHECK)
+                return;
+        if (!bus) {
+                printk(EEEPC_WARNING "Unable to find PCI bus 1?\n");
+                return;
+        }
+        if (get_acpi(CM_ASL_WLAN) == 1) {
+                dev = pci_get_slot(bus, 0);
+                if (dev) {
+                        /* Device already present */
+                        pci_dev_put(dev);
+                        return;
+                }
+                dev = pci_scan_single_device(bus, 0);
+                if (dev) {
+                        pci_bus_assign_resources(bus);
+                        if (pci_bus_add_device(dev))
+                                printk(EEEPC_ERR "Unable to hotplug wifi\n");
+                }
+        } else {
+                dev = pci_get_slot(bus, 0);
+                if (dev) {
+                        pci_remove_bus_device(dev);
+                        pci_dev_put(dev);
+                }
+        }
+}
 static void eeepc_hotk_notify(acpi_handle handle, u32 event, void *data)
 {
        static struct key_entry *key;
@@ -521,8 +561,9 @@ static void eeepc_hotk_notify(acpi_handle handle, u32 event, void *data)
                return;
        if (event >= NOTIFY_BRN_MIN && event <= NOTIFY_BRN_MAX)
                notify_brn();
-        acpi_bus_generate_proc_event(ehotk->device, event,
+        acpi_bus_generate_netlink_event(ehotk->device->pnp.device_class,
-                                     ehotk->event_count[event % 128]++);
+                                        dev_name(&ehotk->device->dev), event,
+                                        ehotk->event_count[event % 128]++);
        if (ehotk->inputdev) {
                key = eepc_get_entry_by_scancode(event);
                if (key) {
@@ -540,6 +581,45 @@ static void eeepc_hotk_notify(acpi_handle handle, u32 event, void *data)
        }
 }
+static int eeepc_register_rfkill_notifier(char *node)
+{
+        acpi_status status = AE_OK;
+        acpi_handle handle;
+        status = acpi_get_handle(NULL, node, &handle);
+        if (ACPI_SUCCESS(status)) {
+                status = acpi_install_notify_handler(handle,
+                                                     ACPI_SYSTEM_NOTIFY,
+                                                     eeepc_rfkill_notify,
+                                                     NULL);
+                if (ACPI_FAILURE(status))
+                        printk(EEEPC_WARNING
+                               "Failed to register notify on %s\n", node);
+        } else
+                return -ENODEV;
+        return 0;
+}
+static void eeepc_unregister_rfkill_notifier(char *node)
+{
+        acpi_status status = AE_OK;
+        acpi_handle handle;
+        status = acpi_get_handle(NULL, node, &handle);
+        if (ACPI_SUCCESS(status)) {
+                status = acpi_remove_notify_handler(handle,
+                                                     ACPI_SYSTEM_NOTIFY,
+                                                     eeepc_rfkill_notify);
+                if (ACPI_FAILURE(status))
+                        printk(EEEPC_ERR
+                               "Error removing rfkill notify handler %s\n",
+                                node);
+        }
+}
 static int eeepc_hotk_add(struct acpi_device *device)
 {
        acpi_status status = AE_OK;
@@ -559,7 +639,7 @@ static int eeepc_hotk_add(struct acpi_device *device)
        ehotk->device = device;
        result = eeepc_hotk_check();
        if (result)
-                goto end;
+                goto ehotk_fail;
        status = acpi_install_notify_handler(ehotk->handle, ACPI_SYSTEM_NOTIFY,
                                             eeepc_hotk_notify, ehotk);
        if (ACPI_FAILURE(status))
@@ -570,18 +650,25 @@ static int eeepc_hotk_add(struct acpi_device *device)
                                                           RFKILL_TYPE_WLAN);
                if (!ehotk->eeepc_wlan_rfkill)
-                        goto end;
+                        goto wlan_fail;
                ehotk->eeepc_wlan_rfkill->name = "eeepc-wlan";
                ehotk->eeepc_wlan_rfkill->toggle_radio = eeepc_wlan_rfkill_set;
                ehotk->eeepc_wlan_rfkill->get_state = eeepc_wlan_rfkill_state;
-                if (get_acpi(CM_ASL_WLAN) == 1)
+                if (get_acpi(CM_ASL_WLAN) == 1) {
                        ehotk->eeepc_wlan_rfkill->state =
                                RFKILL_STATE_UNBLOCKED;
-                else
+                        rfkill_set_default(RFKILL_TYPE_WLAN,
+                                           RFKILL_STATE_UNBLOCKED);
+                } else {
                        ehotk->eeepc_wlan_rfkill->state =
                                RFKILL_STATE_SOFT_BLOCKED;
-                rfkill_register(ehotk->eeepc_wlan_rfkill);
+                        rfkill_set_default(RFKILL_TYPE_WLAN,
+                                           RFKILL_STATE_SOFT_BLOCKED);
+                }
+                result = rfkill_register(ehotk->eeepc_wlan_rfkill);
+                if (result)
+                        goto wlan_fail;
        }
        if (get_acpi(CM_ASL_BLUETOOTH) != -1) {
@@ -589,27 +676,47 @@ static int eeepc_hotk_add(struct acpi_device *device)
                        rfkill_allocate(&device->dev, RFKILL_TYPE_BLUETOOTH);
                if (!ehotk->eeepc_bluetooth_rfkill)
-                        goto end;
+                        goto bluetooth_fail;
                ehotk->eeepc_bluetooth_rfkill->name = "eeepc-bluetooth";
                ehotk->eeepc_bluetooth_rfkill->toggle_radio =
                        eeepc_bluetooth_rfkill_set;
                ehotk->eeepc_bluetooth_rfkill->get_state =
                        eeepc_bluetooth_rfkill_state;
-                if (get_acpi(CM_ASL_BLUETOOTH) == 1)
+                if (get_acpi(CM_ASL_BLUETOOTH) == 1) {
                        ehotk->eeepc_bluetooth_rfkill->state =
                                RFKILL_STATE_UNBLOCKED;
-                else
+                        rfkill_set_default(RFKILL_TYPE_BLUETOOTH,
+                                           RFKILL_STATE_UNBLOCKED);
+                } else {
                        ehotk->eeepc_bluetooth_rfkill->state =
                                RFKILL_STATE_SOFT_BLOCKED;
-                rfkill_register(ehotk->eeepc_bluetooth_rfkill);
+                        rfkill_set_default(RFKILL_TYPE_BLUETOOTH,
-        }
+                                           RFKILL_STATE_SOFT_BLOCKED);
+                }
- end:
+                result = rfkill_register(ehotk->eeepc_bluetooth_rfkill);
-        if (result) {
+                if (result)
-                kfree(ehotk);
+                        goto bluetooth_fail;
-                ehotk = NULL;
        }
+        eeepc_register_rfkill_notifier("\\_SB.PCI0.P0P6");
+        eeepc_register_rfkill_notifier("\\_SB.PCI0.P0P7");
+        return 0;
+ bluetooth_fail:
+        if (ehotk->eeepc_bluetooth_rfkill)
+                rfkill_free(ehotk->eeepc_bluetooth_rfkill);
+        rfkill_unregister(ehotk->eeepc_wlan_rfkill);
+        ehotk->eeepc_wlan_rfkill = NULL;
+ wlan_fail:
+        if (ehotk->eeepc_wlan_rfkill)
+                rfkill_free(ehotk->eeepc_wlan_rfkill);
+ ehotk_fail:
+        kfree(ehotk);
+        ehotk = NULL;
        return result;
 }
@@ -623,6 +730,10 @@ static int eeepc_hotk_remove(struct acpi_device *device, int type)
                                            eeepc_hotk_notify);
        if (ACPI_FAILURE(status))
                printk(EEEPC_ERR "Error removing notify handler\n");
+        eeepc_unregister_rfkill_notifier("\\_SB.PCI0.P0P6");
+        eeepc_unregister_rfkill_notifier("\\_SB.PCI0.P0P7");
        kfree(ehotk);
        return 0;
 }
@@ -738,13 +849,21 @@ static void eeepc_backlight_exit(void)
 {
        if (eeepc_backlight_device)
                backlight_device_unregister(eeepc_backlight_device);
-        if (ehotk->inputdev)
+        eeepc_backlight_device = NULL;
-                input_unregister_device(ehotk->inputdev);
+}
+static void eeepc_rfkill_exit(void)
+{
        if (ehotk->eeepc_wlan_rfkill)
                rfkill_unregister(ehotk->eeepc_wlan_rfkill);
        if (ehotk->eeepc_bluetooth_rfkill)
                rfkill_unregister(ehotk->eeepc_bluetooth_rfkill);
-        eeepc_backlight_device = NULL;
+}
+static void eeepc_input_exit(void)
+{
+        if (ehotk->inputdev)
+                input_unregister_device(ehotk->inputdev);
 }
 static void eeepc_hwmon_exit(void)
@@ -763,6 +882,8 @@ static void eeepc_hwmon_exit(void)
 static void __exit eeepc_laptop_exit(void)
 {
        eeepc_backlight_exit();
+        eeepc_rfkill_exit();
+        eeepc_input_exit();
        eeepc_hwmon_exit();
        acpi_bus_unregister_driver(&eeepc_hotk_driver);
        sysfs_remove_group(&platform_device->dev.kobj,
@@ -866,6 +987,8 @@ fail_platform_driver:
 fail_hwmon:
        eeepc_backlight_exit();
 fail_backlight:
+        eeepc_input_exit();
+        eeepc_rfkill_exit();
        return result;
 }
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index 7c789f0a94d7..f41135f2fb29 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -382,6 +382,11 @@ static int __init hp_wmi_input_setup(void)
                case KE_SW:
                        set_bit(EV_SW, hp_wmi_input_dev->evbit);
                        set_bit(key->keycode, hp_wmi_input_dev->swbit);
+                        /* Set initial dock state */
+                        input_report_switch(hp_wmi_input_dev, key->keycode,
+                                            hp_wmi_dock_state());
+                        input_sync(hp_wmi_input_dev);
                        break;
                }
        }
@@ -441,6 +446,7 @@ static int __init hp_wmi_bios_setup(struct platform_device *device)
                bluetooth_rfkill->toggle_radio = hp_wmi_bluetooth_set;
                bluetooth_rfkill->user_claim_unsupported = 1;
                err = rfkill_register(bluetooth_rfkill);
+                if (err)
                        goto register_bluetooth_error;
        }
@@ -457,9 +463,11 @@ static int __init hp_wmi_bios_setup(struct platform_device *device)
        return 0;
 register_wwan_err:
-        rfkill_unregister(bluetooth_rfkill);
+        if (bluetooth_rfkill)
+                rfkill_unregister(bluetooth_rfkill);
 register_bluetooth_error:
-        rfkill_unregister(wifi_rfkill);
+        if (wifi_rfkill)
+                rfkill_unregister(wifi_rfkill);
 add_sysfs_error:
        cleanup_sysfs(device);
        return err;
diff --git a/drivers/power/pda_power.c b/drivers/power/pda_power.c
index d30bb766fcef..b56a704409d2 100644
--- a/drivers/power/pda_power.c
+++ b/drivers/power/pda_power.c
@@ -20,7 +20,7 @@
 static inline unsigned int get_irq_flags(struct resource *res)
 {
-        unsigned int flags = IRQF_DISABLED | IRQF_SHARED;
+        unsigned int flags = IRQF_SAMPLE_RANDOM | IRQF_SHARED;
        flags |= res->flags & IRQF_TRIGGER_MASK;
diff --git a/drivers/regulator/bq24022.c b/drivers/regulator/bq24022.c
index 366565aba865..c175e38a4cd5 100644
--- a/drivers/regulator/bq24022.c
+++ b/drivers/regulator/bq24022.c
@@ -152,11 +152,7 @@ static void __exit bq24022_exit(void)
        platform_driver_unregister(&bq24022_driver);
 }
-/*
+module_init(bq24022_init);
- * make sure this is probed before gpio_vbus and pda_power,
- * but after asic3 or other GPIO expander drivers.
- */
-subsys_initcall(bq24022_init);
 module_exit(bq24022_exit);
 MODULE_AUTHOR("Philipp Zabel");
diff --git a/drivers/regulator/wm8350-regulator.c b/drivers/regulator/wm8350-regulator.c
index 7aa35248181b..5056e23e4414 100644
--- a/drivers/regulator/wm8350-regulator.c
+++ b/drivers/regulator/wm8350-regulator.c
@@ -1435,7 +1435,7 @@ int wm8350_register_led(struct wm8350 *wm8350, int lednum, int dcdc, int isink,
        struct platform_device *pdev;
        int ret;
-        if (lednum > ARRAY_SIZE(wm8350->pmic.led) || lednum < 0) {
+        if (lednum >= ARRAY_SIZE(wm8350->pmic.led) || lednum < 0) {
                dev_err(wm8350->dev, "Invalid LED index %d\n", lednum);
                return -ENODEV;
        }
diff --git a/drivers/regulator/wm8400-regulator.c b/drivers/regulator/wm8400-regulator.c
index 48b372e038a8..56e23d44ba59 100644
--- a/drivers/regulator/wm8400-regulator.c
+++ b/drivers/regulator/wm8400-regulator.c
@@ -289,7 +289,7 @@ static struct regulator_desc regulators[] = {
        },
 };
-static int __init wm8400_regulator_probe(struct platform_device *pdev)
+static int __devinit wm8400_regulator_probe(struct platform_device *pdev)
 {
        struct regulator_dev *rdev;
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index cced4d108319..81450fbd8b12 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -241,6 +241,12 @@ config RTC_DRV_M41T80_WDT
          If you say Y here you will get support for the
          watchdog timer in the ST M41T60 and M41T80 RTC chips series.
+config RTC_DRV_DM355EVM
+        tristate "TI DaVinci DM355 EVM RTC"
+        depends on MFD_DM355EVM_MSP
+        help
+          Supports the RTC firmware in the MSP430 on the DM355 EVM.
 config RTC_DRV_TWL92330
        boolean "TI TWL92330/Menelaus"
        depends on MENELAUS
diff --git a/drivers/rtc/Makefile b/drivers/rtc/Makefile
index 6e28021abb9d..0e697aa51caa 100644
--- a/drivers/rtc/Makefile
+++ b/drivers/rtc/Makefile
@@ -23,6 +23,7 @@ obj-$(CONFIG_RTC_DRV_AT91SAM9)	+= rtc-at91sam9.o
 obj-$(CONFIG_RTC_DRV_AU1XXX)    += rtc-au1xxx.o
 obj-$(CONFIG_RTC_DRV_BFIN)      += rtc-bfin.o
 obj-$(CONFIG_RTC_DRV_CMOS)      += rtc-cmos.o
+obj-$(CONFIG_RTC_DRV_DM355EVM)  += rtc-dm355evm.o
 obj-$(CONFIG_RTC_DRV_DS1216)    += rtc-ds1216.o
 obj-$(CONFIG_RTC_DRV_DS1286)    += rtc-ds1286.o
 obj-$(CONFIG_RTC_DRV_DS1302)    += rtc-ds1302.o
diff --git a/drivers/rtc/rtc-dm355evm.c b/drivers/rtc/rtc-dm355evm.c
new file mode 100644
index 000000000000..58d4e18530da
--- /dev/null
+++ b/drivers/rtc/rtc-dm355evm.c
@@ -0,0 +1,175 @@
+/*
+ * rtc-dm355evm.c - access battery-backed counter in MSP430 firmware
+ *
+ * Copyright (c) 2008 by David Brownell
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/rtc.h>
+#include <linux/platform_device.h>
+#include <linux/i2c/dm355evm_msp.h>
+/*
+ * The MSP430 firmware on the DM355 EVM uses a watch crystal to feed
+ * a 1 Hz counter.  When a backup battery is supplied, that makes a
+ * reasonable RTC for applications where alarms and non-NTP drift
+ * compensation aren't important.
+ *
+ * The only real glitch is the inability to read or write all four
+ * counter bytes atomically:  the count may increment in the middle
+ * of an operation, causing trouble when the LSB rolls over.
+ *
+ * This driver was tested with firmware revision A4.
+ */
+union evm_time {
+        u8      bytes[4];
+        u32     value;
+};
+static int dm355evm_rtc_read_time(struct device *dev, struct rtc_time *tm)
+{
+        union evm_time  time;
+        int             status;
+        int             tries = 0;
+        do {
+                /*
+                 * Read LSB(0) to MSB(3) bytes.  Defend against the counter
+                 * rolling over by re-reading until the value is stable,
+                 * and assuming the four reads take at most a few seconds.
+                 */
+                status = dm355evm_msp_read(DM355EVM_MSP_RTC_0);
+                if (status < 0)
+                        return status;
+                if (tries && time.bytes[0] == status)
+                        break;
+                time.bytes[0] = status;
+                status = dm355evm_msp_read(DM355EVM_MSP_RTC_1);
+                if (status < 0)
+                        return status;
+                if (tries && time.bytes[1] == status)
+                        break;
+                time.bytes[1] = status;
+                status = dm355evm_msp_read(DM355EVM_MSP_RTC_2);
+                if (status < 0)
+                        return status;
+                if (tries && time.bytes[2] == status)
+                        break;
+                time.bytes[2] = status;
+                status = dm355evm_msp_read(DM355EVM_MSP_RTC_3);
+                if (status < 0)
+                        return status;
+                if (tries && time.bytes[3] == status)
+                        break;
+                time.bytes[3] = status;
+        } while (++tries < 5);
+        dev_dbg(dev, "read timestamp %08x\n", time.value);
+        rtc_time_to_tm(le32_to_cpu(time.value), tm);
+        return 0;
+}
+static int dm355evm_rtc_set_time(struct device *dev, struct rtc_time *tm)
+{
+        union evm_time  time;
+        unsigned long   value;
+        int             status;
+        rtc_tm_to_time(tm, &value);
+        time.value = cpu_to_le32(value);
+        dev_dbg(dev, "write timestamp %08x\n", time.value);
+        /*
+         * REVISIT handle non-atomic writes ... maybe just retry until
+         * byte[1] sticks (no rollover)?
+         */
+        status = dm355evm_msp_write(time.bytes[0], DM355EVM_MSP_RTC_0);
+        if (status < 0)
+                return status;
+        status = dm355evm_msp_write(time.bytes[1], DM355EVM_MSP_RTC_1);
+        if (status < 0)
+                return status;
+        status = dm355evm_msp_write(time.bytes[2], DM355EVM_MSP_RTC_2);
+        if (status < 0)
+                return status;
+        status = dm355evm_msp_write(time.bytes[3], DM355EVM_MSP_RTC_3);
+        if (status < 0)
+                return status;
+        return 0;
+}
+static struct rtc_class_ops dm355evm_rtc_ops = {
+        .read_time      = dm355evm_rtc_read_time,
+        .set_time       = dm355evm_rtc_set_time,
+};
+/*----------------------------------------------------------------------*/
+static int __devinit dm355evm_rtc_probe(struct platform_device *pdev)
+{
+        struct rtc_device *rtc;
+        rtc = rtc_device_register(pdev->name,
+                                  &pdev->dev, &dm355evm_rtc_ops, THIS_MODULE);
+        if (IS_ERR(rtc)) {
+                dev_err(&pdev->dev, "can't register RTC device, err %ld\n",
+                        PTR_ERR(rtc));
+                return PTR_ERR(rtc);
+        }
+        platform_set_drvdata(pdev, rtc);
+        return 0;
+}
+static int __devexit dm355evm_rtc_remove(struct platform_device *pdev)
+{
+        struct rtc_device *rtc = platform_get_drvdata(pdev);
+        rtc_device_unregister(rtc);
+        platform_set_drvdata(pdev, NULL);
+        return 0;
+}
+/*
+ * I2C is used to talk to the MSP430, but this platform device is
+ * exposed by an MFD driver that manages I2C communications.
+ */
+static struct platform_driver rtc_dm355evm_driver = {
+        .probe          = dm355evm_rtc_probe,
+        .remove         = __devexit_p(dm355evm_rtc_remove),
+        .driver         = {
+                .owner  = THIS_MODULE,
+                .name   = "rtc-dm355evm",
+        },
+};
+static int __init dm355evm_rtc_init(void)
+{
+        return platform_driver_register(&rtc_dm355evm_driver);
+}
+module_init(dm355evm_rtc_init);
+static void __exit dm355evm_rtc_exit(void)
+{
+        platform_driver_unregister(&rtc_dm355evm_driver);
+}
+module_exit(dm355evm_rtc_exit);
+MODULE_LICENSE("GPL");
diff --git a/drivers/rtc/rtc-ds1390.c b/drivers/rtc/rtc-ds1390.c
index e54b5c619bdf..e01b955db077 100644
--- a/drivers/rtc/rtc-ds1390.c
+++ b/drivers/rtc/rtc-ds1390.c
@@ -122,7 +122,6 @@ static const struct rtc_class_ops ds1390_rtc_ops = {
 static int __devinit ds1390_probe(struct spi_device *spi)
 {
-        struct rtc_device *rtc;
        unsigned char tmp;
        struct ds1390 *chip;
        int res;
diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c
index acca6678cb2b..49c3bfa1afd7 100644
--- a/drivers/s390/net/lcs.c
+++ b/drivers/s390/net/lcs.c
@@ -70,7 +70,9 @@ static char debug_buffer[255];
 static void lcs_tasklet(unsigned long);
 static void lcs_start_kernel_thread(struct work_struct *);
 static void lcs_get_frames_cb(struct lcs_channel *, struct lcs_buffer *);
+#ifdef CONFIG_IP_MULTICAST
 static int lcs_send_delipm(struct lcs_card *, struct lcs_ipm_list *);
+#endif /* CONFIG_IP_MULTICAST */
 static int lcs_recovery(void *ptr);
 /**
@@ -1285,6 +1287,8 @@ out:
        lcs_clear_thread_running_bit(card, LCS_SET_MC_THREAD);
        return 0;
 }
+#endif /* CONFIG_IP_MULTICAST */
 /**
 * function called by net device to
 * handle multicast address relevant things
@@ -1292,6 +1296,7 @@ out:
 static void
 lcs_set_multicast_list(struct net_device *dev)
 {
+#ifdef CONFIG_IP_MULTICAST
        struct lcs_card *card;
        LCS_DBF_TEXT(4, trace, "setmulti");
@@ -1299,9 +1304,8 @@ lcs_set_multicast_list(struct net_device *dev)
        if (!lcs_set_thread_start_bit(card, LCS_SET_MC_THREAD))
                schedule_work(&card->kernel_thread_starter);
-}
 #endif /* CONFIG_IP_MULTICAST */
+}
 static long
 lcs_check_irb_error(struct ccw_device *cdev, struct irb *irb)
diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
index 91ef669d98f6..a1a511bdec8c 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc.c
+++ b/drivers/scsi/ibmvscsi/ibmvfc.c
@@ -1322,7 +1322,9 @@ static int ibmvfc_map_sg_data(struct scsi_cmnd *scmd,
                                               &evt->ext_list_token);
                if (!evt->ext_list) {
-                        scmd_printk(KERN_ERR, scmd, "Can't allocate memory for scatterlist\n");
+                        scsi_dma_unmap(scmd);
+                        if (vhost->log_level > IBMVFC_DEFAULT_LOG_LEVEL)
+                                scmd_printk(KERN_ERR, scmd, "Can't allocate memory for scatterlist\n");
                        return -ENOMEM;
                }
        }
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 7225b6e2029e..257c24115de9 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -1981,6 +1981,7 @@ void iscsi_pool_free(struct iscsi_pool *q)
                kfree(q->pool[i]);
        if (q->pool)
                kfree(q->pool);
+        kfree(q->queue);
 }
 EXPORT_SYMBOL_GPL(iscsi_pool_free);
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index c7acef50d5da..33a3c13fd893 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -1016,6 +1016,9 @@ qla2x00_dev_loss_tmo_callbk(struct fc_rport *rport)
        struct Scsi_Host *host = rport_to_shost(rport);
        fc_port_t *fcport = *(fc_port_t **)rport->dd_data;
+        if (!fcport)
+                return;
        qla2x00_abort_fcport_cmds(fcport);
        /*
@@ -1033,6 +1036,9 @@ qla2x00_terminate_rport_io(struct fc_rport *rport)
 {
        fc_port_t *fcport = *(fc_port_t **)rport->dd_data;
+        if (!fcport)
+                return;
        /*
         * At this point all fcport's software-states are cleared.  Perform any
         * final cleanup of firmware resources (PCBs and XCBs).
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index ba4913353752..a336b4bc81a7 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -34,6 +34,7 @@ extern void qla24xx_update_fw_options(scsi_qla_host_t *);
 extern void qla81xx_update_fw_options(scsi_qla_host_t *);
 extern int qla2x00_load_risc(struct scsi_qla_host *, uint32_t *);
 extern int qla24xx_load_risc(scsi_qla_host_t *, uint32_t *);
+extern int qla81xx_load_risc(scsi_qla_host_t *, uint32_t *);
 extern int qla2x00_loop_resync(scsi_qla_host_t *);
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 9ad4d0968e5c..f6368a1d3021 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -3562,6 +3562,9 @@ qla24xx_reset_adapter(scsi_qla_host_t *vha)
        WRT_REG_DWORD(&reg->hccr, HCCRX_REL_RISC_PAUSE);
        RD_REG_DWORD(&reg->hccr);
        spin_unlock_irqrestore(&ha->hardware_lock, flags);
+        if (IS_NOPOLLING_TYPE(ha))
+                ha->isp_ops->enable_intrs(ha);
 }
 /* On sparc systems, obtain port and node WWN from firmware
@@ -3847,6 +3850,10 @@ qla24xx_load_risc_flash(scsi_qla_host_t *vha, uint32_t *srisc_addr)
        uint32_t i;
        struct qla_hw_data *ha = vha->hw;
        struct req_que *req = ha->req_q_map[0];
+        qla_printk(KERN_INFO, ha,
+            "FW: Loading from flash (%x)...\n", ha->flt_region_fw);
        rval = QLA_SUCCESS;
        segments = FA_RISC_CODE_SEGMENTS;
@@ -4022,8 +4029,8 @@ fail_fw_integrity:
        return QLA_FUNCTION_FAILED;
 }
-int
+static int
-qla24xx_load_risc(scsi_qla_host_t *vha, uint32_t *srisc_addr)
+qla24xx_load_risc_blob(scsi_qla_host_t *vha, uint32_t *srisc_addr)
 {
        int     rval;
        int     segments, fragment;
@@ -4043,12 +4050,12 @@ qla24xx_load_risc(scsi_qla_host_t *vha, uint32_t *srisc_addr)
                qla_printk(KERN_ERR, ha, "Firmware images can be retrieved "
                    "from: " QLA_FW_URL ".\n");
-                /* Try to load RISC code from flash. */
+                return QLA_FUNCTION_FAILED;
-                qla_printk(KERN_ERR, ha, "Attempting to load (potentially "
-                    "outdated) firmware from flash.\n");
-                return qla24xx_load_risc_flash(vha, srisc_addr);
        }
+        qla_printk(KERN_INFO, ha,
+            "FW: Loading via request-firmware...\n");
        rval = QLA_SUCCESS;
        segments = FA_RISC_CODE_SEGMENTS;
@@ -4133,6 +4140,40 @@ fail_fw_integrity:
        return QLA_FUNCTION_FAILED;
 }
+int
+qla24xx_load_risc(scsi_qla_host_t *vha, uint32_t *srisc_addr)
+{
+        int rval;
+        /*
+         * FW Load priority:
+         * 1) Firmware via request-firmware interface (.bin file).
+         * 2) Firmware residing in flash.
+         */
+        rval = qla24xx_load_risc_blob(vha, srisc_addr);
+        if (rval == QLA_SUCCESS)
+                return rval;
+        return qla24xx_load_risc_flash(vha, srisc_addr);
+}
+int
+qla81xx_load_risc(scsi_qla_host_t *vha, uint32_t *srisc_addr)
+{
+        int rval;
+        /*
+         * FW Load priority:
+         * 1) Firmware residing in flash.
+         * 2) Firmware via request-firmware interface (.bin file).
+         */
+        rval = qla24xx_load_risc_flash(vha, srisc_addr);
+        if (rval == QLA_SUCCESS)
+                return rval;
+        return qla24xx_load_risc_blob(vha, srisc_addr);
+}
 void
 qla2x00_try_to_stop_firmware(scsi_qla_host_t *vha)
 {
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 789fc576f222..e28ad81baf1e 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -1868,6 +1868,7 @@ qla24xx_disable_msix(struct qla_hw_data *ha)
 static int
 qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
 {
+#define MIN_MSIX_COUNT  2
        int i, ret;
        struct msix_entry *entries;
        struct qla_msix_entry *qentry;
@@ -1883,12 +1884,16 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
        ret = pci_enable_msix(ha->pdev, entries, ha->msix_count);
        if (ret) {
+                if (ret < MIN_MSIX_COUNT)
+                        goto msix_failed;
                qla_printk(KERN_WARNING, ha,
                        "MSI-X: Failed to enable support -- %d/%d\n"
                        " Retry with %d vectors\n", ha->msix_count, ret, ret);
                ha->msix_count = ret;
                ret = pci_enable_msix(ha->pdev, entries, ha->msix_count);
                if (ret) {
+msix_failed:
                        qla_printk(KERN_WARNING, ha, "MSI-X: Failed to enable"
                                " support, giving up -- %d/%d\n",
                                ha->msix_count, ret);
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index db4df45234a5..f94ffbb98e95 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -58,14 +58,11 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
         * seconds. This is to serialize actual issuing of mailbox cmds during
         * non ISP abort time.
         */
-        if (!abort_active) {
+        if (!wait_for_completion_timeout(&ha->mbx_cmd_comp, mcp->tov * HZ)) {
-                if (!wait_for_completion_timeout(&ha->mbx_cmd_comp,
+                /* Timeout occurred. Return error. */
-                    mcp->tov * HZ)) {
+                DEBUG2_3_11(printk("%s(%ld): cmd access timeout. "
-                        /* Timeout occurred. Return error. */
+                    "Exiting.\n", __func__, base_vha->host_no));
-                        DEBUG2_3_11(printk("%s(%ld): cmd access timeout. "
+                return QLA_FUNCTION_TIMEOUT;
-                            "Exiting.\n", __func__, base_vha->host_no));
-                        return QLA_FUNCTION_TIMEOUT;
-                }
        }
        ha->flags.mbox_busy = 1;
@@ -265,8 +262,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
        }
        /* Allow next mbx cmd to come in. */
-        if (!abort_active)
+        complete(&ha->mbx_cmd_comp);
-                complete(&ha->mbx_cmd_comp);
        if (rval) {
                DEBUG2_3_11(printk("%s(%ld): **** FAILED. mbx0=%x, mbx1=%x, "
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index cf32653fe01a..c11f872d3e10 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -65,8 +65,6 @@ MODULE_PARM_DESC(ql2xextended_error_logging,
 static void qla2x00_free_device(scsi_qla_host_t *);
-static void qla2x00_config_dma_addressing(scsi_qla_host_t *ha);
 int ql2xfdmienable=1;
 module_param(ql2xfdmienable, int, S_IRUGO|S_IRUSR);
 MODULE_PARM_DESC(ql2xfdmienable,
@@ -800,6 +798,7 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
                if (ha->isp_ops->abort_command(vha, sp, req)) {
                        DEBUG2(printk("%s(%ld): abort_command "
                        "mbx failed.\n", __func__, vha->host_no));
+                        ret = FAILED;
                } else {
                        DEBUG3(printk("%s(%ld): abort_command "
                        "mbx success.\n", __func__, vha->host_no));
@@ -1241,9 +1240,8 @@ qla2x00_change_queue_type(struct scsi_device *sdev, int tag_type)
 * supported addressing method.
 */
 static void
-qla2x00_config_dma_addressing(scsi_qla_host_t *vha)
+qla2x00_config_dma_addressing(struct qla_hw_data *ha)
 {
-        struct qla_hw_data *ha = vha->hw;
        /* Assume a 32bit DMA mask. */
        ha->flags.enable_64bit_addressing = 0;
@@ -1480,7 +1478,7 @@ static struct isp_operations qla81xx_isp_ops = {
        .reset_adapter          = qla24xx_reset_adapter,
        .nvram_config           = qla81xx_nvram_config,
        .update_fw_options      = qla81xx_update_fw_options,
-        .load_risc              = qla24xx_load_risc,
+        .load_risc              = qla81xx_load_risc,
        .pci_info_str           = qla24xx_pci_info_str,
        .fw_version_str         = qla24xx_fw_version_str,
        .intr_handler           = qla24xx_intr_handler,
@@ -1869,6 +1867,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
        set_bit(0, (unsigned long *) ha->vp_idx_map);
+        qla2x00_config_dma_addressing(ha);
        ret = qla2x00_mem_alloc(ha, req_length, rsp_length, &req, &rsp);
        if (!ret) {
                qla_printk(KERN_WARNING, ha,
@@ -1888,13 +1887,13 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
                    "[ERROR] Failed to allocate memory for scsi_host\n");
                ret = -ENOMEM;
+                qla2x00_mem_free(ha);
+                qla2x00_free_que(ha, req, rsp);
                goto probe_hw_failed;
        }
        pci_set_drvdata(pdev, base_vha);
-        qla2x00_config_dma_addressing(base_vha);
        host = base_vha->host;
        base_vha->req_ques[0] = req->id;
        host->can_queue = req->length + 128;
@@ -1917,14 +1916,13 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
        /* Set up the irqs */
        ret = qla2x00_request_irqs(ha, rsp);
        if (ret)
-                goto probe_failed;
+                goto probe_init_failed;
        /* Alloc arrays of request and response ring ptrs */
        if (!qla2x00_alloc_queues(ha)) {
                qla_printk(KERN_WARNING, ha,
                "[ERROR] Failed to allocate memory for queue"
                " pointers\n");
-                goto probe_failed;
+                goto probe_init_failed;
        }
        ha->rsp_q_map[0] = rsp;
        ha->req_q_map[0] = req;
@@ -1997,6 +1995,10 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
        return 0;
+probe_init_failed:
+        qla2x00_free_que(ha, req, rsp);
+        ha->max_queues = 0;
 probe_failed:
        qla2x00_free_device(base_vha);
diff --git a/drivers/scsi/qla2xxx/qla_sup.c b/drivers/scsi/qla2xxx/qla_sup.c
index 303f8ee11f25..9c3b694c049d 100644
--- a/drivers/scsi/qla2xxx/qla_sup.c
+++ b/drivers/scsi/qla2xxx/qla_sup.c
@@ -944,9 +944,9 @@ qla24xx_unprotect_flash(struct qla_hw_data *ha)
        if (!ha->fdt_wrt_disable)
                return;
-        /* Disable flash write-protection. */
+        /* Disable flash write-protection, first clear SR protection bit */
        qla24xx_write_flash_dword(ha, flash_conf_addr(ha, 0x101), 0);
-        /* Some flash parts need an additional zero-write to clear bits.*/
+        /* Then write zero again to clear remaining SR bits.*/
        qla24xx_write_flash_dword(ha, flash_conf_addr(ha, 0x101), 0);
 }
@@ -980,12 +980,11 @@ qla24xx_write_flash_data(scsi_qla_host_t *vha, uint32_t *dwptr, uint32_t faddr,
    uint32_t dwords)
 {
        int ret;
-        uint32_t liter, miter;
+        uint32_t liter;
        uint32_t sec_mask, rest_addr;
-        uint32_t fdata, findex;
+        uint32_t fdata;
        dma_addr_t optrom_dma;
        void *optrom = NULL;
-        uint32_t *s, *d;
        struct qla_hw_data *ha = vha->hw;
        ret = QLA_SUCCESS;
@@ -1003,17 +1002,15 @@ qla24xx_write_flash_data(scsi_qla_host_t *vha, uint32_t *dwptr, uint32_t faddr,
        }
        rest_addr = (ha->fdt_block_size >> 2) - 1;
-        sec_mask = (ha->optrom_size >> 2) - (ha->fdt_block_size >> 2);
+        sec_mask = ~rest_addr;
        qla24xx_unprotect_flash(ha);
        for (liter = 0; liter < dwords; liter++, faddr++, dwptr++) {
+                fdata = (faddr & sec_mask) << 2;
-                findex = faddr;
-                fdata = (findex & sec_mask) << 2;
                /* Are we at the beginning of a sector? */
-                if ((findex & rest_addr) == 0) {
+                if ((faddr & rest_addr) == 0) {
                        /* Do sector unprotect. */
                        if (ha->fdt_unprotect_sec_cmd)
                                qla24xx_write_flash_dword(ha,
@@ -1024,7 +1021,7 @@ qla24xx_write_flash_data(scsi_qla_host_t *vha, uint32_t *dwptr, uint32_t faddr,
                            (fdata & 0xff00) |((fdata << 16) &
                            0xff0000) | ((fdata >> 16) & 0xff));
                        if (ret != QLA_SUCCESS) {
-                                DEBUG9(qla_printk("Unable to flash sector: "
+                                DEBUG9(qla_printk("Unable to erase sector: "
                                    "address=%x.\n", faddr));
                                break;
                        }
@@ -1033,9 +1030,7 @@ qla24xx_write_flash_data(scsi_qla_host_t *vha, uint32_t *dwptr, uint32_t faddr,
                /* Go with burst-write. */
                if (optrom && (liter + OPTROM_BURST_DWORDS) <= dwords) {
                        /* Copy data to DMA'ble buffer. */
-                        for (miter = 0, s = optrom, d = dwptr;
+                        memcpy(optrom, dwptr, OPTROM_BURST_SIZE);
-                            miter < OPTROM_BURST_DWORDS; miter++, s++, d++)
-                                *s = cpu_to_le32(*d);
                        ret = qla2x00_load_ram(vha, optrom_dma,
                            flash_data_addr(ha, faddr),
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index 808bab6ef06b..cfa4c11a4797 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,7 +7,7 @@
 /*
 * Driver version
 */
-#define QLA2XXX_VERSION      "8.03.00-k1"
+#define QLA2XXX_VERSION      "8.03.00-k2"
 #define QLA_DRIVER_MAJOR_VER    8
 #define QLA_DRIVER_MINOR_VER    3
diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
index d6be0762eb91..b586f27c3bd4 100644
--- a/drivers/scsi/qla4xxx/ql4_def.h
+++ b/drivers/scsi/qla4xxx/ql4_def.h
@@ -244,6 +244,7 @@ struct ddb_entry {
        uint8_t ip_addr[ISCSI_IPADDR_SIZE];
        uint8_t iscsi_name[ISCSI_NAME_SIZE];    /* 72 x48 */
        uint8_t iscsi_alias[0x20];
+        uint8_t isid[6];
 };
 /*
diff --git a/drivers/scsi/qla4xxx/ql4_init.c b/drivers/scsi/qla4xxx/ql4_init.c
index 109c5f5985ec..af8c3233e8ae 100644
--- a/drivers/scsi/qla4xxx/ql4_init.c
+++ b/drivers/scsi/qla4xxx/ql4_init.c
@@ -342,8 +342,12 @@ static struct ddb_entry* qla4xxx_get_ddb_entry(struct scsi_qla_host *ha,
        DEBUG2(printk("scsi%ld: %s: Looking for ddb[%d]\n", ha->host_no,
                      __func__, fw_ddb_index));
        list_for_each_entry(ddb_entry, &ha->ddb_list, list) {
-                if (memcmp(ddb_entry->iscsi_name, fw_ddb_entry->iscsi_name,
+                if ((memcmp(ddb_entry->iscsi_name, fw_ddb_entry->iscsi_name,
-                           ISCSI_NAME_SIZE) == 0) {
+                           ISCSI_NAME_SIZE) == 0) &&
+                        (ddb_entry->tpgt ==
+                                le32_to_cpu(fw_ddb_entry->tgt_portal_grp)) &&
+                        (memcmp(ddb_entry->isid, fw_ddb_entry->isid,
+                                sizeof(ddb_entry->isid)) == 0)) {
                        found++;
                        break;
                }
@@ -430,6 +434,8 @@ static int qla4xxx_update_ddb_entry(struct scsi_qla_host *ha,
        ddb_entry->port = le16_to_cpu(fw_ddb_entry->port);
        ddb_entry->tpgt = le32_to_cpu(fw_ddb_entry->tgt_portal_grp);
+        memcpy(ddb_entry->isid, fw_ddb_entry->isid, sizeof(ddb_entry->isid));
        memcpy(&ddb_entry->iscsi_name[0], &fw_ddb_entry->iscsi_name[0],
               min(sizeof(ddb_entry->iscsi_name),
                   sizeof(fw_ddb_entry->iscsi_name)));
diff --git a/drivers/serial/8250_pci.c b/drivers/serial/8250_pci.c
index 2a3671233b15..536d8e510f66 100644
--- a/drivers/serial/8250_pci.c
+++ b/drivers/serial/8250_pci.c
@@ -806,6 +806,8 @@ pci_default_setup(struct serial_private *priv,
 #define PCI_SUBDEVICE_ID_OCTPRO422      0x0208
 #define PCI_SUBDEVICE_ID_POCTAL232      0x0308
 #define PCI_SUBDEVICE_ID_POCTAL422      0x0408
+#define PCI_VENDOR_ID_ADVANTECH         0x13fe
+#define PCI_DEVICE_ID_ADVANTECH_PCI3620 0x3620
 /* Unknown vendors/cards - this should not be in linux/pci_ids.h */
 #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584
@@ -2152,6 +2154,10 @@ static int pciserial_resume_one(struct pci_dev *dev)
 #endif
 static struct pci_device_id serial_pci_tbl[] = {
+        /* Advantech use PCI_DEVICE_ID_ADVANTECH_PCI3620 (0x3620) as 'PCI_SUBVENDOR_ID' */
+        {       PCI_VENDOR_ID_ADVANTECH, PCI_DEVICE_ID_ADVANTECH_PCI3620,
+                PCI_DEVICE_ID_ADVANTECH_PCI3620, 0x0001, 0, 0,
+                pbn_b2_8_921600 },
        {       PCI_VENDOR_ID_V3, PCI_DEVICE_ID_V3_V960,
                PCI_SUBVENDOR_ID_CONNECT_TECH,
                PCI_SUBDEVICE_ID_CONNECT_TECH_BH8_232, 0, 0,
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index 3e525e38a5d9..7d7f576da202 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -982,7 +982,7 @@ config SERIAL_SH_SCI_CONSOLE
 config SERIAL_PNX8XXX
        bool "Enable PNX8XXX SoCs' UART Support"
-        depends on MIPS && SOC_PNX8550
+        depends on MIPS && (SOC_PNX8550 || SOC_PNX833X)
        select SERIAL_CORE
        help
          If you have a MIPS-based Philips SoC such as PNX8550 or PNX8330
diff --git a/drivers/serial/jsm/jsm_driver.c b/drivers/serial/jsm/jsm_driver.c
index 338cf8a08b43..92187e28608a 100644
--- a/drivers/serial/jsm/jsm_driver.c
+++ b/drivers/serial/jsm/jsm_driver.c
@@ -180,7 +180,7 @@ static int jsm_probe_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        return rc;
 }
-static void jsm_remove_one(struct pci_dev *pdev)
+static void __devexit jsm_remove_one(struct pci_dev *pdev)
 {
        struct jsm_board *brd = pci_get_drvdata(pdev);
        int i = 0;
diff --git a/drivers/serial/jsm/jsm_tty.c b/drivers/serial/jsm/jsm_tty.c
index 3547558d2caf..324c74d2f666 100644
--- a/drivers/serial/jsm/jsm_tty.c
+++ b/drivers/serial/jsm/jsm_tty.c
@@ -161,6 +161,11 @@ static void jsm_tty_stop_rx(struct uart_port *port)
        channel->ch_bd->bd_ops->disable_receiver(channel);
 }
+static void jsm_tty_enable_ms(struct uart_port *port)
+{
+        /* Nothing needed */
+}
 static void jsm_tty_break(struct uart_port *port, int break_state)
 {
        unsigned long lock_flags;
@@ -345,6 +350,7 @@ static struct uart_ops jsm_ops = {
        .start_tx       = jsm_tty_start_tx,
        .send_xchar     = jsm_tty_send_xchar,
        .stop_rx        = jsm_tty_stop_rx,
+        .enable_ms      = jsm_tty_enable_ms,
        .break_ctl      = jsm_tty_break,
        .startup        = jsm_tty_open,
        .shutdown       = jsm_tty_close,
diff --git a/drivers/serial/mcf.c b/drivers/serial/mcf.c
index b2001c5b145c..56841fe5f483 100644
--- a/drivers/serial/mcf.c
+++ b/drivers/serial/mcf.c
@@ -212,10 +212,18 @@ static void mcf_set_termios(struct uart_port *port, struct ktermios *termios,
 {
        unsigned long flags;
        unsigned int baud, baudclk;
+#if defined(CONFIG_M5272)
+        unsigned int baudfr;
+#endif
        unsigned char mr1, mr2;
        baud = uart_get_baud_rate(port, termios, old, 0, 230400);
+#if defined(CONFIG_M5272)
+        baudclk = (MCF_BUSCLK / baud) / 32;
+        baudfr = (((MCF_BUSCLK / baud) + 1) / 2) % 16;
+#else
        baudclk = ((MCF_BUSCLK / baud) + 16) / 32;
+#endif
        mr1 = MCFUART_MR1_RXIRQRDY | MCFUART_MR1_RXERRCHAR;
        mr2 = 0;
@@ -262,6 +270,9 @@ static void mcf_set_termios(struct uart_port *port, struct ktermios *termios,
        writeb(mr2, port->membase + MCFUART_UMR);
        writeb((baudclk & 0xff00) >> 8, port->membase + MCFUART_UBG1);
        writeb((baudclk & 0xff), port->membase + MCFUART_UBG2);
+#if defined(CONFIG_M5272)
+        writeb((baudfr & 0x0f), port->membase + MCFUART_UFPD);
+#endif
        writeb(MCFUART_UCSR_RXCLKTIMER | MCFUART_UCSR_TXCLKTIMER,
                port->membase + MCFUART_UCSR);
        writeb(MCFUART_UCR_RXENABLE | MCFUART_UCR_TXENABLE,
diff --git a/drivers/serial/sh-sci.h b/drivers/serial/sh-sci.h
index 38c600c0dbbf..3599828b9766 100644
--- a/drivers/serial/sh-sci.h
+++ b/drivers/serial/sh-sci.h
@@ -32,7 +32,9 @@
 #elif defined(CONFIG_CPU_SUBTYPE_SH7720) || \
      defined(CONFIG_CPU_SUBTYPE_SH7721)
 # define SCSCR_INIT(port)  0x0030 /* TIE=0,RIE=0,TE=1,RE=1 */
-#define SCIF_ORER    0x0200   /* overrun error bit */
+# define PORT_PTCR         0xA405011EUL
+# define PORT_PVCR         0xA4050122UL
+# define SCIF_ORER         0x0200   /* overrun error bit */
 #elif defined(CONFIG_SH_RTS7751R2D)
 # define SCSPTR1 0xFFE0001C /* 8 bit SCIF */
 # define SCSPTR2 0xFFE80020 /* 16 bit SCIF */
@@ -393,6 +395,7 @@ SCIx_FNS(SCSCR,  0x08, 16, 0x08, 16)
 SCIx_FNS(SCxTDR, 0x20,  8, 0x0c,  8)
 SCIx_FNS(SCxSR,  0x14, 16, 0x10, 16)
 SCIx_FNS(SCxRDR, 0x24,  8, 0x14,  8)
+SCIx_FNS(SCSPTR, 0,     0,    0,  0)
 SCIF_FNS(SCTDSR, 0x0c,  8)
 SCIF_FNS(SCFER,  0x10, 16)
 SCIF_FNS(SCFCR,  0x18, 16)
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 4a6fe01831a8..83a185d52961 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -230,17 +230,6 @@ config SPI_XILINX
 #
 comment "SPI Protocol Masters"
-config SPI_AT25
-        tristate "SPI EEPROMs from most vendors"
-        depends on SYSFS
-        help
-          Enable this driver to get read/write support to most SPI EEPROMs,
-          after you configure the board init code to know about each eeprom
-          on your target board.
-          This driver can also be built as a module.  If so, the module
-          will be called at25.
 config SPI_SPIDEV
        tristate "User mode SPI device driver support"
        depends on EXPERIMENTAL
diff --git a/drivers/spi/Makefile b/drivers/spi/Makefile
index 5e9f521b8844..5d0451936d86 100644
--- a/drivers/spi/Makefile
+++ b/drivers/spi/Makefile
@@ -33,7 +33,6 @@ obj-$(CONFIG_SPI_SH_SCI)		+= spi_sh_sci.o
 #       ... add above this line ...
 # SPI protocol drivers (device/link on bus)
-obj-$(CONFIG_SPI_AT25)          += at25.o
 obj-$(CONFIG_SPI_SPIDEV)        += spidev.o
 obj-$(CONFIG_SPI_TLE62X0)       += tle62x0.o
 #       ... add above this line ...
diff --git a/drivers/staging/agnx/agnx.h b/drivers/staging/agnx/agnx.h
index a75b0db3726c..20f36da62475 100644
--- a/drivers/staging/agnx/agnx.h
+++ b/drivers/staging/agnx/agnx.h
@@ -1,6 +1,8 @@
 #ifndef AGNX_H_
 #define AGNX_H_
+#include <linux/io.h>
 #include "xmit.h"
 #define PFX                             KBUILD_MODNAME ": "
diff --git a/drivers/staging/altpciechdma/altpciechdma.c b/drivers/staging/altpciechdma/altpciechdma.c
index 8e2b4ca0651d..f516140ca976 100644
--- a/drivers/staging/altpciechdma/altpciechdma.c
+++ b/drivers/staging/altpciechdma/altpciechdma.c
@@ -531,7 +531,7 @@ static int __devinit dma_test(struct ape_dev *ape, struct pci_dev *dev)
        goto fail;
        /* allocate and map coherently-cached memory for a DMA-able buffer */
-        /* @see 2.6.26.2/Documentation/DMA-mapping.txt line 318 */
+        /* @see Documentation/PCI/PCI-DMA-mapping.txt, near line 318 */
        buffer_virt = (u8 *)pci_alloc_consistent(dev, PAGE_SIZE * 4, &buffer_bus);
        if (!buffer_virt) {
                printk(KERN_DEBUG "Could not allocate coherent DMA buffer.\n");
@@ -846,7 +846,7 @@ static int __devinit probe(struct pci_dev *dev, const struct pci_device_id *id)
 #if 1 // @todo For now, disable 64-bit, because I do not understand the implications (DAC!)
        /* query for DMA transfer */
-        /* @see Documentation/DMA-mapping.txt */
+        /* @see Documentation/PCI/PCI-DMA-mapping.txt */
        if (!pci_set_dma_mask(dev, DMA_64BIT_MASK)) {
                pci_set_consistent_dma_mask(dev, DMA_64BIT_MASK);
                /* use 64-bit DMA */
diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
index 6a4ceacb33f5..758131cad08a 100644
--- a/drivers/staging/android/binder.c
+++ b/drivers/staging/android/binder.c
@@ -319,6 +319,7 @@ int task_get_unused_fd_flags(struct task_struct *tsk, int flags)
        int fd, error;
        struct fdtable *fdt;
        unsigned long rlim_cur;
+        unsigned long irqs;
        if (files == NULL)
                return -ESRCH;
@@ -335,12 +336,11 @@ repeat:
         * N.B. For clone tasks sharing a files structure, this test
         * will limit the total number of files that can be opened.
         */
-        rcu_read_lock();
+        rlim_cur = 0;
-        if (tsk->signal)
+        if (lock_task_sighand(tsk, &irqs)) {
                rlim_cur = tsk->signal->rlim[RLIMIT_NOFILE].rlim_cur;
-        else
+                unlock_task_sighand(tsk, &irqs);
-                rlim_cur = 0;
+        }
-        rcu_read_unlock();
        if (fd >= rlim_cur)
                goto out;
@@ -2649,14 +2649,14 @@ static void binder_vma_open(struct vm_area_struct *vma)
 {
        struct binder_proc *proc = vma->vm_private_data;
        if (binder_debug_mask & BINDER_DEBUG_OPEN_CLOSE)
-                printk(KERN_INFO "binder: %d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", proc->pid, vma->vm_start, vma->vm_end, (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, vma->vm_page_prot.pgprot);
+                printk(KERN_INFO "binder: %d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", proc->pid, vma->vm_start, vma->vm_end, (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, pgprot_val(vma->vm_page_prot));
        dump_stack();
 }
 static void binder_vma_close(struct vm_area_struct *vma)
 {
        struct binder_proc *proc = vma->vm_private_data;
        if (binder_debug_mask & BINDER_DEBUG_OPEN_CLOSE)
-                printk(KERN_INFO "binder: %d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", proc->pid, vma->vm_start, vma->vm_end, (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, vma->vm_page_prot.pgprot);
+                printk(KERN_INFO "binder: %d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", proc->pid, vma->vm_start, vma->vm_end, (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, pgprot_val(vma->vm_page_prot));
        proc->vma = NULL;
 }
@@ -2677,7 +2677,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
                vma->vm_end = vma->vm_start + SZ_4M;
        if (binder_debug_mask & BINDER_DEBUG_OPEN_CLOSE)
-                printk(KERN_INFO "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n", proc->pid, vma->vm_start, vma->vm_end, (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, vma->vm_page_prot.pgprot);
+                printk(KERN_INFO "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n", proc->pid, vma->vm_start, vma->vm_end, (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, pgprot_val(vma->vm_page_prot));
        if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) {
                ret = -EPERM;
diff --git a/drivers/staging/android/lowmemorykiller.txt b/drivers/staging/android/lowmemorykiller.txt
new file mode 100644
index 000000000000..bd5c0c028968
--- /dev/null
+++ b/drivers/staging/android/lowmemorykiller.txt
@@ -0,0 +1,16 @@
+The lowmemorykiller driver lets user-space specify a set of memory thresholds
+where processes with a range of oom_adj values will get killed. Specify the
+minimum oom_adj values in /sys/module/lowmemorykiller/parameters/adj and the
+number of free pages in /sys/module/lowmemorykiller/parameters/minfree. Both
+files take a comma separated list of numbers in ascending order.
+For example, write "0,8" to /sys/module/lowmemorykiller/parameters/adj and
+"1024,4096" to /sys/module/lowmemorykiller/parameters/minfree to kill processes
+with a oom_adj value of 8 or higher when the free memory drops below 4096 pages
+and kill processes with a oom_adj value of 0 or higher when the free memory
+drops below 1024 pages.
+The driver considers memory used for caches to be free, but if a large
+percentage of the cached memory is locked this can be very inaccurate
+and processes may not get killed until the normal oom killer is triggered.
diff --git a/drivers/staging/android/timed_gpio.c b/drivers/staging/android/timed_gpio.c
index bea68c9fc942..903270cbbe02 100644
--- a/drivers/staging/android/timed_gpio.c
+++ b/drivers/staging/android/timed_gpio.c
@@ -18,7 +18,7 @@
 #include <linux/platform_device.h>
 #include <linux/hrtimer.h>
 #include <linux/err.h>
-#include <asm/arch/gpio.h>
+#include <linux/gpio.h>
 #include "timed_gpio.h"
@@ -49,7 +49,8 @@ static ssize_t gpio_enable_show(struct device *dev, struct device_attribute *att
        if (hrtimer_active(&gpio_data->timer)) {
                ktime_t r = hrtimer_get_remaining(&gpio_data->timer);
-                remaining = r.tv.sec * 1000 + r.tv.nsec / 1000000;
+                struct timeval t = ktime_to_timeval(r);
+                remaining = t.tv_sec * 1000 + t.tv_usec;
        } else
                remaining = 0;
diff --git a/drivers/staging/comedi/Kconfig b/drivers/staging/comedi/Kconfig
index b501bfb9c754..b47ca1e7e383 100644
--- a/drivers/staging/comedi/Kconfig
+++ b/drivers/staging/comedi/Kconfig
@@ -1,6 +1,7 @@
 config COMEDI
        tristate "Data Acquision support (comedi)"
        default N
+        depends on m
        ---help---
          Enable support a wide range of data acquision devices
          for Linux.
diff --git a/drivers/staging/meilhaus/Kconfig b/drivers/staging/meilhaus/Kconfig
index 6def83fa2c96..923af22a4686 100644
--- a/drivers/staging/meilhaus/Kconfig
+++ b/drivers/staging/meilhaus/Kconfig
@@ -4,6 +4,7 @@
 menuconfig MEILHAUS
        tristate "Meilhaus support"
+        depends on m
        ---help---
          If you have a Meilhaus card, say Y (or M) here.
@@ -18,7 +19,7 @@ if MEILHAUS
 config ME0600
        tristate "Meilhaus ME-600 support"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This driver supports the Meilhaus ME-600 family of boards
          that do data collection and multipurpose I/O.
@@ -29,7 +30,7 @@ config ME0600
 config ME0900
        tristate "Meilhaus ME-900 support"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This driver supports the Meilhaus ME-900 family of boards
          that do data collection and multipurpose I/O.
@@ -40,7 +41,7 @@ config ME0900
 config ME1000
        tristate "Meilhaus ME-1000 support"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This driver supports the Meilhaus ME-1000 family of boards
          that do data collection and multipurpose I/O.
@@ -51,7 +52,7 @@ config ME1000
 config ME1400
        tristate "Meilhaus ME-1400 support"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This driver supports the Meilhaus ME-1400 family of boards
          that do data collection and multipurpose I/O.
@@ -62,7 +63,7 @@ config ME1400
 config ME1600
        tristate "Meilhaus ME-1600 support"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This driver supports the Meilhaus ME-1600 family of boards
          that do data collection and multipurpose I/O.
@@ -73,7 +74,7 @@ config ME1600
 config ME4600
        tristate "Meilhaus ME-4600 support"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This driver supports the Meilhaus ME-4600 family of boards
          that do data collection and multipurpose I/O.
@@ -84,7 +85,7 @@ config ME4600
 config ME6000
        tristate "Meilhaus ME-6000 support"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This driver supports the Meilhaus ME-6000 family of boards
          that do data collection and multipurpose I/O.
@@ -95,7 +96,7 @@ config ME6000
 config ME8100
        tristate "Meilhaus ME-8100 support"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This driver supports the Meilhaus ME-8100 family of boards
          that do data collection and multipurpose I/O.
@@ -106,7 +107,7 @@ config ME8100
 config ME8200
        tristate "Meilhaus ME-8200 support"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This driver supports the Meilhaus ME-8200 family of boards
          that do data collection and multipurpose I/O.
@@ -117,7 +118,7 @@ config ME8200
 config MEDUMMY
        tristate "Meilhaus dummy driver"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This provides a dummy driver for the Meilhaus driver package
diff --git a/drivers/staging/poch/poch.c b/drivers/staging/poch/poch.c
index ec343ef53a85..0d111ddfabb2 100644
--- a/drivers/staging/poch/poch.c
+++ b/drivers/staging/poch/poch.c
@@ -1026,7 +1026,7 @@ static int poch_ioctl(struct inode *inode, struct file *filp,
                }
                break;
        case POCH_IOC_GET_COUNTERS:
-                if (access_ok(VERIFY_WRITE, argp, sizeof(struct poch_counters)))
+                if (!access_ok(VERIFY_WRITE, argp, sizeof(struct poch_counters)))
                        return -EFAULT;
                spin_lock_irq(&channel->counters_lock);
diff --git a/drivers/staging/usbip/usbip_common.c b/drivers/staging/usbip/usbip_common.c
index 72e209276ea7..22f93dd0ba03 100644
--- a/drivers/staging/usbip/usbip_common.c
+++ b/drivers/staging/usbip/usbip_common.c
@@ -406,8 +406,20 @@ void usbip_start_threads(struct usbip_device *ud)
        /*
         * threads are invoked per one device (per one connection).
         */
-        kernel_thread(usbip_thread, (void *)&ud->tcp_rx, 0);
+        int retval;
-        kernel_thread(usbip_thread, (void *)&ud->tcp_tx, 0);
+        retval = kernel_thread(usbip_thread, (void *)&ud->tcp_rx, 0);
+        if (retval < 0) {
+                printk(KERN_ERR "Creating tcp_rx thread for ud %p failed.\n",
+                                ud);
+                return;
+        }
+        retval = kernel_thread(usbip_thread, (void *)&ud->tcp_tx, 0);
+        if (retval < 0) {
+                printk(KERN_ERR "Creating tcp_tx thread for ud %p failed.\n",
+                                ud);
+                return;
+        }
        /* confirm threads are starting */
        wait_for_completion(&ud->tcp_rx.thread_done);
diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index 8b7c419b876e..8bcde8cde554 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -13,6 +13,7 @@ obj-$(CONFIG_USB_EHCI_HCD)	+= host/
 obj-$(CONFIG_USB_ISP116X_HCD)   += host/
 obj-$(CONFIG_USB_OHCI_HCD)      += host/
 obj-$(CONFIG_USB_UHCI_HCD)      += host/
+obj-$(CONFIG_USB_FHCI_HCD)      += host/
 obj-$(CONFIG_USB_SL811_HCD)     += host/
 obj-$(CONFIG_USB_U132_HCD)      += host/
 obj-$(CONFIG_USB_R8A66597_HCD)  += host/
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 00b47ea24f86..97ba4a985edc 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1349,6 +1349,12 @@ static struct usb_device_id acm_ids[] = {
        { USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */
        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
        },
+        { USB_DEVICE(0x0e8d, 0x3329), /* i-blue 747, Qstarz BT-Q1000, Holux M-241 */
+        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+        },
+        { USB_DEVICE(0x0e8d, 0x3329), /* MediaTek Inc GPS */
+        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+        },
        { USB_DEVICE(0x0482, 0x0203), /* KYOCERA AH-K3001V */
        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
        },
@@ -1370,6 +1376,9 @@ static struct usb_device_id acm_ids[] = {
        { USB_DEVICE(0x0572, 0x1321), /* Conexant USB MODEM CX93010 */
        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
        },
+        { USB_DEVICE(0x0572, 0x1324), /* Conexant USB MODEM RD02-D400 */
+        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+        },
        /* control interfaces with various AT-command sets */
        { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
index b5775af3ba26..3f3ee1351930 100644
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -226,6 +226,7 @@ static const struct quirk_printer_struct quirk_printers[] = {
        { 0x0409, 0xf0be, USBLP_QUIRK_BIDIR }, /* NEC Picty920 (HP OEM) */
        { 0x0409, 0xf1be, USBLP_QUIRK_BIDIR }, /* NEC Picty800 (HP OEM) */
        { 0x0482, 0x0010, USBLP_QUIRK_BIDIR }, /* Kyocera Mita FS 820, by zut <kernel@zut.de> */
+        { 0x04f9, 0x000d, USBLP_QUIRK_BIDIR }, /* Brother Industries, Ltd HL-1440 Laser Printer */
        { 0x04b8, 0x0202, USBLP_QUIRK_BAD_CLASS }, /* Seiko Epson Receipt Printer M129C */
        { 0, 0 }
 };
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 26fece124e0e..7513bb083c15 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1700,7 +1700,7 @@ const struct file_operations usbdev_file_operations = {
        .release =      usbdev_release,
 };
-void usb_fs_classdev_common_remove(struct usb_device *udev)
+static void usbdev_remove(struct usb_device *udev)
 {
        struct dev_state *ps;
        struct siginfo sinfo;
@@ -1742,10 +1742,15 @@ static void usb_classdev_remove(struct usb_device *dev)
 {
        if (dev->usb_classdev)
                device_unregister(dev->usb_classdev);
-        usb_fs_classdev_common_remove(dev);
 }
-static int usb_classdev_notify(struct notifier_block *self,
+#else
+#define usb_classdev_add(dev)           0
+#define usb_classdev_remove(dev)        do {} while (0)
+#endif
+static int usbdev_notify(struct notifier_block *self,
                               unsigned long action, void *dev)
 {
        switch (action) {
@@ -1755,15 +1760,15 @@ static int usb_classdev_notify(struct notifier_block *self,
                break;
        case USB_DEVICE_REMOVE:
                usb_classdev_remove(dev);
+                usbdev_remove(dev);
                break;
        }
        return NOTIFY_OK;
 }
 static struct notifier_block usbdev_nb = {
-        .notifier_call =        usb_classdev_notify,
+        .notifier_call =        usbdev_notify,
 };
-#endif
 static struct cdev usb_device_cdev;
@@ -1798,9 +1803,8 @@ int __init usb_devio_init(void)
         * to /sys/dev
         */
        usb_classdev_class->dev_kobj = NULL;
-        usb_register_notify(&usbdev_nb);
 #endif
+        usb_register_notify(&usbdev_nb);
 out:
        return retval;
@@ -1811,8 +1815,8 @@ error_cdev:
 void usb_devio_cleanup(void)
 {
-#ifdef CONFIG_USB_DEVICE_CLASS
        usb_unregister_notify(&usbdev_nb);
+#ifdef CONFIG_USB_DEVICE_CLASS
        class_destroy(usb_classdev_class);
 #endif
        cdev_del(&usb_device_cdev);
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index 98760553bc95..d0a21a5f8201 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -284,7 +284,7 @@ static int usb_unbind_interface(struct device *dev)
         * supports "soft" unbinding.
         */
        if (!driver->soft_unbind)
-                usb_disable_interface(udev, intf);
+                usb_disable_interface(udev, intf, false);
        driver->disconnect(intf);
        usb_cancel_queued_reset(intf);
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index 507741ed4482..c54fc40458b1 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -128,7 +128,6 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
        }
        pci_set_master(dev);
-        device_set_wakeup_enable(&dev->dev, 1);
        retval = usb_add_hcd(hcd, dev->irq, IRQF_DISABLED | IRQF_SHARED);
        if (retval != 0)
@@ -201,6 +200,7 @@ int usb_hcd_pci_suspend(struct pci_dev *dev, pm_message_t message)
        struct usb_hcd          *hcd = pci_get_drvdata(dev);
        int                     retval = 0;
        int                     wake, w;
+        int                     has_pci_pm;
        /* Root hub suspend should have stopped all downstream traffic,
         * and all bus master traffic.  And done so for both the interface
@@ -230,6 +230,15 @@ int usb_hcd_pci_suspend(struct pci_dev *dev, pm_message_t message)
        synchronize_irq(dev->irq);
+        /* Downstream ports from this root hub should already be quiesced, so
+         * there will be no DMA activity.  Now we can shut down the upstream
+         * link (except maybe for PME# resume signaling) and enter some PCI
+         * low power state, if the hardware allows.
+         */
+        pci_disable_device(dev);
+        pci_save_state(dev);
        /* Don't fail on error to enable wakeup.  We rely on pci code
         * to reject requests the hardware can't implement, rather
         * than coding the same thing.
@@ -241,35 +250,6 @@ int usb_hcd_pci_suspend(struct pci_dev *dev, pm_message_t message)
                wake = w;
        dev_dbg(&dev->dev, "wakeup: %d\n", wake);
-        /* Downstream ports from this root hub should already be quiesced, so
-         * there will be no DMA activity.  Now we can shut down the upstream
-         * link (except maybe for PME# resume signaling) and enter some PCI
-         * low power state, if the hardware allows.
-         */
-        pci_disable_device(dev);
- done:
-        return retval;
-}
-EXPORT_SYMBOL_GPL(usb_hcd_pci_suspend);
-/**
- * usb_hcd_pci_suspend_late - suspend a PCI-based HCD after IRQs are disabled
- * @dev: USB Host Controller being suspended
- * @message: Power Management message describing this state transition
- *
- * Store this function in the HCD's struct pci_driver as .suspend_late.
- */
-int usb_hcd_pci_suspend_late(struct pci_dev *dev, pm_message_t message)
-{
-        int                     retval = 0;
-        int                     has_pci_pm;
-        /* We might already be suspended (runtime PM -- not yet written) */
-        if (dev->current_state != PCI_D0)
-                goto done;
-        pci_save_state(dev);
        /* Don't change state if we don't need to */
        if (message.event == PM_EVENT_FREEZE ||
                        message.event == PM_EVENT_PRETHAW) {
@@ -315,7 +295,7 @@ int usb_hcd_pci_suspend_late(struct pci_dev *dev, pm_message_t message)
 done:
        return retval;
 }
-EXPORT_SYMBOL_GPL(usb_hcd_pci_suspend_late);
+EXPORT_SYMBOL_GPL(usb_hcd_pci_suspend);
 /**
 * usb_hcd_pci_resume_early - resume a PCI-based HCD before IRQs are enabled
@@ -325,65 +305,8 @@ EXPORT_SYMBOL_GPL(usb_hcd_pci_suspend_late);
 */
 int usb_hcd_pci_resume_early(struct pci_dev *dev)
 {
-        int             retval = 0;
+        pci_restore_state(dev);
-        pci_power_t     state = dev->current_state;
+        return 0;
-#ifdef CONFIG_PPC_PMAC
-        /* Reenable ASIC clocks for USB */
-        if (machine_is(powermac)) {
-                struct device_node *of_node;
-                of_node = pci_device_to_OF_node(dev);
-                if (of_node)
-                        pmac_call_feature(PMAC_FTR_USB_ENABLE,
-                                                of_node, 0, 1);
-        }
-#endif
-        /* NOTE:  chip docs cover clean "real suspend" cases (what Linux
-         * calls "standby", "suspend to RAM", and so on).  There are also
-         * dirty cases when swsusp fakes a suspend in "shutdown" mode.
-         */
-        if (state != PCI_D0) {
-#ifdef  DEBUG
-                int     pci_pm;
-                u16     pmcr;
-                pci_pm = pci_find_capability(dev, PCI_CAP_ID_PM);
-                pci_read_config_word(dev, pci_pm + PCI_PM_CTRL, &pmcr);
-                pmcr &= PCI_PM_CTRL_STATE_MASK;
-                if (pmcr) {
-                        /* Clean case:  power to USB and to HC registers was
-                         * maintained; remote wakeup is easy.
-                         */
-                        dev_dbg(&dev->dev, "resume from PCI D%d\n", pmcr);
-                } else {
-                        /* Clean:  HC lost Vcc power, D0 uninitialized
-                         *   + Vaux may have preserved port and transceiver
-                         *     state ... for remote wakeup from D3cold
-                         *   + or not; HCD must reinit + re-enumerate
-                         *
-                         * Dirty: D0 semi-initialized cases with swsusp
-                         *   + after BIOS init
-                         *   + after Linux init (HCD statically linked)
-                         */
-                        dev_dbg(&dev->dev, "resume from previous PCI D%d\n",
-                                        state);
-                }
-#endif
-                retval = pci_set_power_state(dev, PCI_D0);
-        } else {
-                /* Same basic cases: clean (powered/not), dirty */
-                dev_dbg(&dev->dev, "PCI legacy resume\n");
-        }
-        if (retval < 0)
-                dev_err(&dev->dev, "can't resume: %d\n", retval);
-        else
-                pci_restore_state(dev);
-        return retval;
 }
 EXPORT_SYMBOL_GPL(usb_hcd_pci_resume_early);
@@ -398,6 +321,18 @@ int usb_hcd_pci_resume(struct pci_dev *dev)
        struct usb_hcd          *hcd;
        int                     retval;
+#ifdef CONFIG_PPC_PMAC
+        /* Reenable ASIC clocks for USB */
+        if (machine_is(powermac)) {
+                struct device_node *of_node;
+                of_node = pci_device_to_OF_node(dev);
+                if (of_node)
+                        pmac_call_feature(PMAC_FTR_USB_ENABLE,
+                                                of_node, 0, 1);
+        }
+#endif
        hcd = pci_get_drvdata(dev);
        if (hcd->state != HC_STATE_SUSPENDED) {
                dev_dbg(hcd->self.controller,
@@ -405,6 +340,8 @@ int usb_hcd_pci_resume(struct pci_dev *dev)
                return 0;
        }
+        pci_enable_wake(dev, PCI_D0, false);
        retval = pci_enable_device(dev);
        if (retval < 0) {
                dev_err(&dev->dev, "can't re-enable after resume, %d!\n",
diff --git a/drivers/usb/core/hcd.h b/drivers/usb/core/hcd.h
index 572d2cf46e8d..5b94a56bec23 100644
--- a/drivers/usb/core/hcd.h
+++ b/drivers/usb/core/hcd.h
@@ -257,7 +257,6 @@ extern void usb_hcd_pci_remove(struct pci_dev *dev);
 #ifdef CONFIG_PM
 extern int usb_hcd_pci_suspend(struct pci_dev *dev, pm_message_t msg);
-extern int usb_hcd_pci_suspend_late(struct pci_dev *dev, pm_message_t msg);
 extern int usb_hcd_pci_resume_early(struct pci_dev *dev);
 extern int usb_hcd_pci_resume(struct pci_dev *dev);
 #endif /* CONFIG_PM */
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 94d5ee263c20..cd50d86029e7 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2382,8 +2382,8 @@ static int hub_port_debounce(struct usb_hub *hub, int port1)
 void usb_ep0_reinit(struct usb_device *udev)
 {
-        usb_disable_endpoint(udev, 0 + USB_DIR_IN);
+        usb_disable_endpoint(udev, 0 + USB_DIR_IN, true);
-        usb_disable_endpoint(udev, 0 + USB_DIR_OUT);
+        usb_disable_endpoint(udev, 0 + USB_DIR_OUT, true);
        usb_enable_endpoint(udev, &udev->ep0, true);
 }
 EXPORT_SYMBOL_GPL(usb_ep0_reinit);
diff --git a/drivers/usb/core/inode.c b/drivers/usb/core/inode.c
index 2a129cb7bb56..dff5760a37f6 100644
--- a/drivers/usb/core/inode.c
+++ b/drivers/usb/core/inode.c
@@ -717,7 +717,6 @@ static void usbfs_remove_device(struct usb_device *dev)
                fs_remove_file (dev->usbfs_dentry);
                dev->usbfs_dentry = NULL;
        }
-        usb_fs_classdev_common_remove(dev);
 }
 static int usbfs_notify(struct notifier_block *self, unsigned long action, void *dev)
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index de51667dd64d..31fb204f44c6 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1039,14 +1039,15 @@ static void remove_intf_ep_devs(struct usb_interface *intf)
 * @dev: the device whose endpoint is being disabled
 * @epaddr: the endpoint's address.  Endpoint number for output,
 *      endpoint number + USB_DIR_IN for input
+ * @reset_hardware: flag to erase any endpoint state stored in the
+ *      controller hardware
 *
- * Deallocates hcd/hardware state for this endpoint ... and nukes all
+ * Disables the endpoint for URB submission and nukes all pending URBs.
- * pending urbs.
+ * If @reset_hardware is set then also deallocates hcd/hardware state
- *
+ * for the endpoint.
- * If the HCD hasn't registered a disable() function, this sets the
- * endpoint's maxpacket size to 0 to prevent further submissions.
 */
-void usb_disable_endpoint(struct usb_device *dev, unsigned int epaddr)
+void usb_disable_endpoint(struct usb_device *dev, unsigned int epaddr,
+                bool reset_hardware)
 {
        unsigned int epnum = epaddr & USB_ENDPOINT_NUMBER_MASK;
        struct usb_host_endpoint *ep;
@@ -1056,15 +1057,18 @@ void usb_disable_endpoint(struct usb_device *dev, unsigned int epaddr)
        if (usb_endpoint_out(epaddr)) {
                ep = dev->ep_out[epnum];
-                dev->ep_out[epnum] = NULL;
+                if (reset_hardware)
+                        dev->ep_out[epnum] = NULL;
        } else {
                ep = dev->ep_in[epnum];
-                dev->ep_in[epnum] = NULL;
+                if (reset_hardware)
+                        dev->ep_in[epnum] = NULL;
        }
        if (ep) {
                ep->enabled = 0;
                usb_hcd_flush_endpoint(dev, ep);
-                usb_hcd_disable_endpoint(dev, ep);
+                if (reset_hardware)
+                        usb_hcd_disable_endpoint(dev, ep);
        }
 }
@@ -1072,17 +1076,21 @@ void usb_disable_endpoint(struct usb_device *dev, unsigned int epaddr)
 * usb_disable_interface -- Disable all endpoints for an interface
 * @dev: the device whose interface is being disabled
 * @intf: pointer to the interface descriptor
+ * @reset_hardware: flag to erase any endpoint state stored in the
+ *      controller hardware
 *
 * Disables all the endpoints for the interface's current altsetting.
 */
-void usb_disable_interface(struct usb_device *dev, struct usb_interface *intf)
+void usb_disable_interface(struct usb_device *dev, struct usb_interface *intf,
+                bool reset_hardware)
 {
        struct usb_host_interface *alt = intf->cur_altsetting;
        int i;
        for (i = 0; i < alt->desc.bNumEndpoints; ++i) {
                usb_disable_endpoint(dev,
-                                alt->endpoint[i].desc.bEndpointAddress);
+                                alt->endpoint[i].desc.bEndpointAddress,
+                                reset_hardware);
        }
 }
@@ -1103,8 +1111,8 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
        dev_dbg(&dev->dev, "%s nuking %s URBs\n", __func__,
                skip_ep0 ? "non-ep0" : "all");
        for (i = skip_ep0; i < 16; ++i) {
-                usb_disable_endpoint(dev, i);
+                usb_disable_endpoint(dev, i, true);
-                usb_disable_endpoint(dev, i + USB_DIR_IN);
+                usb_disable_endpoint(dev, i + USB_DIR_IN, true);
        }
        dev->toggle[0] = dev->toggle[1] = 0;
@@ -1274,7 +1282,7 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate)
                remove_intf_ep_devs(iface);
                usb_remove_sysfs_intf_files(iface);
        }
-        usb_disable_interface(dev, iface);
+        usb_disable_interface(dev, iface, true);
        iface->cur_altsetting = alt;
@@ -1353,8 +1361,8 @@ int usb_reset_configuration(struct usb_device *dev)
         */
        for (i = 1; i < 16; ++i) {
-                usb_disable_endpoint(dev, i);
+                usb_disable_endpoint(dev, i, true);
-                usb_disable_endpoint(dev, i + USB_DIR_IN);
+                usb_disable_endpoint(dev, i + USB_DIR_IN, true);
        }
        config = dev->actconfig;
diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
index 386177867a8a..79d8a9ea559b 100644
--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
@@ -15,9 +15,10 @@ extern void usb_enable_endpoint(struct usb_device *dev,
                struct usb_host_endpoint *ep, bool reset_toggle);
 extern void usb_enable_interface(struct usb_device *dev,
                struct usb_interface *intf, bool reset_toggles);
-extern void usb_disable_endpoint(struct usb_device *dev, unsigned int epaddr);
+extern void usb_disable_endpoint(struct usb_device *dev, unsigned int epaddr,
+                bool reset_hardware);
 extern void usb_disable_interface(struct usb_device *dev,
-                struct usb_interface *intf);
+                struct usb_interface *intf, bool reset_hardware);
 extern void usb_release_interface_cache(struct kref *ref);
 extern void usb_disable_device(struct usb_device *dev, int skip_ep0);
 extern int usb_deauthorize_device(struct usb_device *);
@@ -151,7 +152,6 @@ extern struct usb_driver usbfs_driver;
 extern const struct file_operations usbfs_devices_fops;
 extern const struct file_operations usbdev_file_operations;
 extern void usbfs_conn_disc_event(void);
-extern void usb_fs_classdev_common_remove(struct usb_device *udev);
 extern int usb_devio_init(void);
 extern void usb_devio_cleanup(void);
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index f2da0269e1b1..5d11c291f1ad 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -683,6 +683,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
        struct usb_request              *req = cdev->req;
        int                             value = -EOPNOTSUPP;
        u16                             w_index = le16_to_cpu(ctrl->wIndex);
+        u8                              intf = w_index & 0xFF;
        u16                             w_value = le16_to_cpu(ctrl->wValue);
        u16                             w_length = le16_to_cpu(ctrl->wLength);
        struct usb_function             *f = NULL;
@@ -769,10 +770,10 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
                        goto unknown;
                if (!cdev->config || w_index >= MAX_CONFIG_INTERFACES)
                        break;
-                f = cdev->config->interface[w_index];
+                f = cdev->config->interface[intf];
                if (!f)
                        break;
-                if (w_value && !f->get_alt)
+                if (w_value && !f->set_alt)
                        break;
                value = f->set_alt(f, w_index, w_value);
                break;
@@ -781,7 +782,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
                        goto unknown;
                if (!cdev->config || w_index >= MAX_CONFIG_INTERFACES)
                        break;
-                f = cdev->config->interface[w_index];
+                f = cdev->config->interface[intf];
                if (!f)
                        break;
                /* lots of interfaces only need altsetting zero... */
@@ -808,7 +809,7 @@ unknown:
                 */
                if ((ctrl->bRequestType & USB_RECIP_MASK)
                                == USB_RECIP_INTERFACE) {
-                        f = cdev->config->interface[w_index];
+                        f = cdev->config->interface[intf];
                        if (f && f->setup)
                                value = f->setup(f, ctrl);
                        else
diff --git a/drivers/usb/gadget/imx_udc.c b/drivers/usb/gadget/imx_udc.c
index cde8fdf15d5b..77c5d0a8a06e 100644
--- a/drivers/usb/gadget/imx_udc.c
+++ b/drivers/usb/gadget/imx_udc.c
@@ -297,7 +297,7 @@ void imx_ep_stall(struct imx_ep_struct *imx_ep)
                for (i = 0; i < 100; i ++) {
                        temp = __raw_readl(imx_usb->base + USB_EP_STAT(EP_NO(imx_ep)));
-                        if (!temp & EPSTAT_STALL)
+                        if (!(temp & EPSTAT_STALL))
                                break;
                        udelay(20);
                }
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index 2b476b6b3d4d..2c63bfb1f8d9 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -140,6 +140,7 @@ config USB_OHCI_HCD
        tristate "OHCI HCD support"
        depends on USB && USB_ARCH_HAS_OHCI
        select ISP1301_OMAP if MACH_OMAP_H2 || MACH_OMAP_H3
+        select USB_OTG_UTILS if ARCH_OMAP
        ---help---
          The Open Host Controller Interface (OHCI) is a standard for accessing
          USB 1.1 host controller hardware.  It does more in hardware than Intel's
@@ -238,6 +239,23 @@ config USB_UHCI_HCD
          To compile this driver as a module, choose M here: the
          module will be called uhci-hcd.
+config USB_FHCI_HCD
+        tristate "Freescale QE USB Host Controller support"
+        depends on USB && OF_GPIO && QE_GPIO && QUICC_ENGINE
+        select FSL_GTM
+        select QE_USB
+        help
+          This driver enables support for Freescale QE USB Host Controller
+          (as found on MPC8360 and MPC8323 processors), the driver supports
+          Full and Low Speed USB.
+config FHCI_DEBUG
+        bool "Freescale QE USB Host Controller debug support"
+        depends on USB_FHCI_HCD && DEBUG_FS
+        help
+          Say "y" to see some FHCI debug information and statistics
+          throught debugfs.
 config USB_U132_HCD
        tristate "Elan U132 Adapter Host Controller"
        depends on USB && USB_FTDI_ELAN
diff --git a/drivers/usb/host/Makefile b/drivers/usb/host/Makefile
index e5f3f20787e4..f163571e33d8 100644
--- a/drivers/usb/host/Makefile
+++ b/drivers/usb/host/Makefile
@@ -7,6 +7,11 @@ ifeq ($(CONFIG_USB_DEBUG),y)
 endif
 isp1760-objs := isp1760-hcd.o isp1760-if.o
+fhci-objs := fhci-hcd.o fhci-hub.o fhci-q.o fhci-mem.o \
+             fhci-tds.o fhci-sched.o
+ifeq ($(CONFIG_FHCI_DEBUG),y)
+fhci-objs += fhci-dbg.o
+endif
 obj-$(CONFIG_USB_WHCI_HCD)      += whci/
@@ -17,6 +22,7 @@ obj-$(CONFIG_USB_OXU210HP_HCD)	+= oxu210hp-hcd.o
 obj-$(CONFIG_USB_ISP116X_HCD)   += isp116x-hcd.o
 obj-$(CONFIG_USB_OHCI_HCD)      += ohci-hcd.o
 obj-$(CONFIG_USB_UHCI_HCD)      += uhci-hcd.o
+obj-$(CONFIG_USB_FHCI_HCD)      += fhci.o
 obj-$(CONFIG_USB_SL811_HCD)     += sl811-hcd.o
 obj-$(CONFIG_USB_SL811_CS)      += sl811_cs.o
 obj-$(CONFIG_USB_U132_HCD)      += u132-hcd.o
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index bdc6e86e1f8b..bb21fb0a4969 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -230,7 +230,7 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                pci_read_config_word(pdev, 0x62, &port_wake);
                if (port_wake & 0x0001) {
                        dev_warn(&pdev->dev, "Enabling legacy PCI PM\n");
-                        device_init_wakeup(&pdev->dev, 1);
+                        device_set_wakeup_capable(&pdev->dev, 1);
                }
        }
@@ -432,7 +432,6 @@ static struct pci_driver ehci_pci_driver = {
 #ifdef  CONFIG_PM
        .suspend =      usb_hcd_pci_suspend,
-        .suspend_late = usb_hcd_pci_suspend_late,
        .resume_early = usb_hcd_pci_resume_early,
        .resume =       usb_hcd_pci_resume,
 #endif
diff --git a/drivers/usb/host/fhci-dbg.c b/drivers/usb/host/fhci-dbg.c
new file mode 100644
index 000000000000..34e14edf390b
--- /dev/null
+++ b/drivers/usb/host/fhci-dbg.c
@@ -0,0 +1,139 @@
+/*
+ * Freescale QUICC Engine USB Host Controller Driver
+ *
+ * Copyright (c) Freescale Semicondutor, Inc. 2006.
+ *               Shlomi Gridish <gridish@freescale.com>
+ *               Jerry Huang <Chang-Ming.Huang@freescale.com>
+ * Copyright (c) Logic Product Development, Inc. 2007
+ *               Peter Barada <peterb@logicpd.com>
+ * Copyright (c) MontaVista Software, Inc. 2008.
+ *               Anton Vorontsov <avorontsov@ru.mvista.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+#include <linux/usb.h>
+#include "../core/hcd.h"
+#include "fhci.h"
+void fhci_dbg_isr(struct fhci_hcd *fhci, int usb_er)
+{
+        int i;
+        if (usb_er == -1) {
+                fhci->usb_irq_stat[12]++;
+                return;
+        }
+        for (i = 0; i < 12; ++i) {
+                if (usb_er & (1 << i))
+                        fhci->usb_irq_stat[i]++;
+        }
+}
+static int fhci_dfs_regs_show(struct seq_file *s, void *v)
+{
+        struct fhci_hcd *fhci = s->private;
+        struct fhci_regs __iomem *regs = fhci->regs;
+        seq_printf(s,
+                "mode: 0x%x\n" "addr: 0x%x\n"
+                "command: 0x%x\n" "ep0: 0x%x\n"
+                "event: 0x%x\n" "mask: 0x%x\n"
+                "status: 0x%x\n" "SOF timer: %d\n"
+                "frame number: %d\n"
+                "lines status: 0x%x\n",
+                in_8(&regs->usb_mod), in_8(&regs->usb_addr),
+                in_8(&regs->usb_comm), in_be16(&regs->usb_ep[0]),
+                in_be16(&regs->usb_event), in_be16(&regs->usb_mask),
+                in_8(&regs->usb_status), in_be16(&regs->usb_sof_tmr),
+                in_be16(&regs->usb_frame_num),
+                fhci_ioports_check_bus_state(fhci));
+        return 0;
+}
+static int fhci_dfs_irq_stat_show(struct seq_file *s, void *v)
+{
+        struct fhci_hcd *fhci = s->private;
+        int *usb_irq_stat = fhci->usb_irq_stat;
+        seq_printf(s,
+                "RXB: %d\n" "TXB: %d\n" "BSY: %d\n"
+                "SOF: %d\n" "TXE0: %d\n" "TXE1: %d\n"
+                "TXE2: %d\n" "TXE3: %d\n" "IDLE: %d\n"
+                "RESET: %d\n" "SFT: %d\n" "MSF: %d\n"
+                "IDLE_ONLY: %d\n",
+                usb_irq_stat[0], usb_irq_stat[1], usb_irq_stat[2],
+                usb_irq_stat[3], usb_irq_stat[4], usb_irq_stat[5],
+                usb_irq_stat[6], usb_irq_stat[7], usb_irq_stat[8],
+                usb_irq_stat[9], usb_irq_stat[10], usb_irq_stat[11],
+                usb_irq_stat[12]);
+        return 0;
+}
+static int fhci_dfs_regs_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, fhci_dfs_regs_show, inode->i_private);
+}
+static int fhci_dfs_irq_stat_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, fhci_dfs_irq_stat_show, inode->i_private);
+}
+static const struct file_operations fhci_dfs_regs_fops = {
+        .open = fhci_dfs_regs_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+};
+static const struct file_operations fhci_dfs_irq_stat_fops = {
+        .open = fhci_dfs_irq_stat_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+};
+void fhci_dfs_create(struct fhci_hcd *fhci)
+{
+        struct device *dev = fhci_to_hcd(fhci)->self.controller;
+        fhci->dfs_root = debugfs_create_dir(dev->bus_id, NULL);
+        if (!fhci->dfs_root) {
+                WARN_ON(1);
+                return;
+        }
+        fhci->dfs_regs = debugfs_create_file("regs", S_IFREG | S_IRUGO,
+                fhci->dfs_root, fhci, &fhci_dfs_regs_fops);
+        fhci->dfs_irq_stat = debugfs_create_file("irq_stat",
+                S_IFREG | S_IRUGO, fhci->dfs_root, fhci,
+                &fhci_dfs_irq_stat_fops);
+        WARN_ON(!fhci->dfs_regs || !fhci->dfs_irq_stat);
+}
+void fhci_dfs_destroy(struct fhci_hcd *fhci)
+{
+        if (!fhci->dfs_root)
+                return;
+        if (fhci->dfs_irq_stat)
+                debugfs_remove(fhci->dfs_irq_stat);
+        if (fhci->dfs_regs)
+                debugfs_remove(fhci->dfs_regs);
+        debugfs_remove(fhci->dfs_root);
+}
diff --git a/drivers/usb/host/fhci-hcd.c b/drivers/usb/host/fhci-hcd.c
new file mode 100644
index 000000000000..ba622cc8a9ba
--- /dev/null
+++ b/drivers/usb/host/fhci-hcd.c
@@ -0,0 +1,836 @@
+/*
+ * Freescale QUICC Engine USB Host Controller Driver
+ *
+ * Copyright (c) Freescale Semicondutor, Inc. 2006.
+ *               Shlomi Gridish <gridish@freescale.com>
+ *               Jerry Huang <Chang-Ming.Huang@freescale.com>
+ * Copyright (c) Logic Product Development, Inc. 2007
+ *               Peter Barada <peterb@logicpd.com>
+ * Copyright (c) MontaVista Software, Inc. 2008.
+ *               Anton Vorontsov <avorontsov@ru.mvista.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/spinlock.h>
+#include <linux/kernel.h>
+#include <linux/delay.h>
+#include <linux/errno.h>
+#include <linux/list.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/usb.h>
+#include <linux/of_platform.h>
+#include <linux/of_gpio.h>
+#include <asm/qe.h>
+#include <asm/fsl_gtm.h>
+#include "../core/hcd.h"
+#include "fhci.h"
+void fhci_start_sof_timer(struct fhci_hcd *fhci)
+{
+        fhci_dbg(fhci, "-> %s\n", __func__);
+        /* clear frame_n */
+        out_be16(&fhci->pram->frame_num, 0);
+        out_be16(&fhci->regs->usb_sof_tmr, 0);
+        setbits8(&fhci->regs->usb_mod, USB_MODE_SFTE);
+        fhci_dbg(fhci, "<- %s\n", __func__);
+}
+void fhci_stop_sof_timer(struct fhci_hcd *fhci)
+{
+        fhci_dbg(fhci, "-> %s\n", __func__);
+        clrbits8(&fhci->regs->usb_mod, USB_MODE_SFTE);
+        gtm_stop_timer16(fhci->timer);
+        fhci_dbg(fhci, "<- %s\n", __func__);
+}
+u16 fhci_get_sof_timer_count(struct fhci_usb *usb)
+{
+        return be16_to_cpu(in_be16(&usb->fhci->regs->usb_sof_tmr) / 12);
+}
+/* initialize the endpoint zero */
+static u32 endpoint_zero_init(struct fhci_usb *usb,
+                              enum fhci_mem_alloc data_mem,
+                              u32 ring_len)
+{
+        u32 rc;
+        rc = fhci_create_ep(usb, data_mem, ring_len);
+        if (rc)
+                return rc;
+        /* inilialize endpoint registers */
+        fhci_init_ep_registers(usb, usb->ep0, data_mem);
+        return 0;
+}
+/* enable the USB interrupts */
+void fhci_usb_enable_interrupt(struct fhci_usb *usb)
+{
+        struct fhci_hcd *fhci = usb->fhci;
+        if (usb->intr_nesting_cnt == 1) {
+                /* initialize the USB interrupt */
+                enable_irq(fhci_to_hcd(fhci)->irq);
+                /* initialize the event register and mask register */
+                out_be16(&usb->fhci->regs->usb_event, 0xffff);
+                out_be16(&usb->fhci->regs->usb_mask, usb->saved_msk);
+                /* enable the timer interrupts */
+                enable_irq(fhci->timer->irq);
+        } else if (usb->intr_nesting_cnt > 1)
+                fhci_info(fhci, "unbalanced USB interrupts nesting\n");
+        usb->intr_nesting_cnt--;
+}
+/* diable the usb interrupt */
+void fhci_usb_disable_interrupt(struct fhci_usb *usb)
+{
+        struct fhci_hcd *fhci = usb->fhci;
+        if (usb->intr_nesting_cnt == 0) {
+                /* diable the timer interrupt */
+                disable_irq_nosync(fhci->timer->irq);
+                /* disable the usb interrupt */
+                disable_irq_nosync(fhci_to_hcd(fhci)->irq);
+                out_be16(&usb->fhci->regs->usb_mask, 0);
+        }
+        usb->intr_nesting_cnt++;
+}
+/* enable the USB controller */
+static u32 fhci_usb_enable(struct fhci_hcd *fhci)
+{
+        struct fhci_usb *usb = fhci->usb_lld;
+        out_be16(&usb->fhci->regs->usb_event, 0xffff);
+        out_be16(&usb->fhci->regs->usb_mask, usb->saved_msk);
+        setbits8(&usb->fhci->regs->usb_mod, USB_MODE_EN);
+        mdelay(100);
+        return 0;
+}
+/* disable the USB controller */
+static u32 fhci_usb_disable(struct fhci_hcd *fhci)
+{
+        struct fhci_usb *usb = fhci->usb_lld;
+        fhci_usb_disable_interrupt(usb);
+        fhci_port_disable(fhci);
+        /* disable the usb controller */
+        if (usb->port_status == FHCI_PORT_FULL ||
+                        usb->port_status == FHCI_PORT_LOW)
+                fhci_device_disconnected_interrupt(fhci);
+        clrbits8(&usb->fhci->regs->usb_mod, USB_MODE_EN);
+        return 0;
+}
+/* check the bus state by polling the QE bit on the IO ports */
+int fhci_ioports_check_bus_state(struct fhci_hcd *fhci)
+{
+        u8 bits = 0;
+        /* check USBOE,if transmitting,exit */
+        if (!gpio_get_value(fhci->gpios[GPIO_USBOE]))
+                return -1;
+        /* check USBRP */
+        if (gpio_get_value(fhci->gpios[GPIO_USBRP]))
+                bits |= 0x2;
+        /* check USBRN */
+        if (gpio_get_value(fhci->gpios[GPIO_USBRN]))
+                bits |= 0x1;
+        return bits;
+}
+static void fhci_mem_free(struct fhci_hcd *fhci)
+{
+        struct ed *ed;
+        struct ed *next_ed;
+        struct td *td;
+        struct td *next_td;
+        list_for_each_entry_safe(ed, next_ed, &fhci->empty_eds, node) {
+                list_del(&ed->node);
+                kfree(ed);
+        }
+        list_for_each_entry_safe(td, next_td, &fhci->empty_tds, node) {
+                list_del(&td->node);
+                kfree(td);
+        }
+        kfree(fhci->vroot_hub);
+        fhci->vroot_hub = NULL;
+        kfree(fhci->hc_list);
+        fhci->hc_list = NULL;
+}
+static int fhci_mem_init(struct fhci_hcd *fhci)
+{
+        int i;
+        fhci->hc_list = kzalloc(sizeof(*fhci->hc_list), GFP_KERNEL);
+        if (!fhci->hc_list)
+                goto err;
+        INIT_LIST_HEAD(&fhci->hc_list->ctrl_list);
+        INIT_LIST_HEAD(&fhci->hc_list->bulk_list);
+        INIT_LIST_HEAD(&fhci->hc_list->iso_list);
+        INIT_LIST_HEAD(&fhci->hc_list->intr_list);
+        INIT_LIST_HEAD(&fhci->hc_list->done_list);
+        fhci->vroot_hub = kzalloc(sizeof(*fhci->vroot_hub), GFP_KERNEL);
+        if (!fhci->vroot_hub)
+                goto err;
+        INIT_LIST_HEAD(&fhci->empty_eds);
+        INIT_LIST_HEAD(&fhci->empty_tds);
+        /* initialize work queue to handle done list */
+        fhci_tasklet.data = (unsigned long)fhci;
+        fhci->process_done_task = &fhci_tasklet;
+        for (i = 0; i < MAX_TDS; i++) {
+                struct td *td;
+                td = kmalloc(sizeof(*td), GFP_KERNEL);
+                if (!td)
+                        goto err;
+                fhci_recycle_empty_td(fhci, td);
+        }
+        for (i = 0; i < MAX_EDS; i++) {
+                struct ed *ed;
+                ed = kmalloc(sizeof(*ed), GFP_KERNEL);
+                if (!ed)
+                        goto err;
+                fhci_recycle_empty_ed(fhci, ed);
+        }
+        fhci->active_urbs = 0;
+        return 0;
+err:
+        fhci_mem_free(fhci);
+        return -ENOMEM;
+}
+/* destroy the fhci_usb structure */
+static void fhci_usb_free(void *lld)
+{
+        struct fhci_usb *usb = lld;
+        struct fhci_hcd *fhci = usb->fhci;
+        if (usb) {
+                fhci_config_transceiver(fhci, FHCI_PORT_POWER_OFF);
+                fhci_ep0_free(usb);
+                kfree(usb->actual_frame);
+                kfree(usb);
+        }
+}
+/* initialize the USB */
+static int fhci_usb_init(struct fhci_hcd *fhci)
+{
+        struct fhci_usb *usb = fhci->usb_lld;
+        memset_io(usb->fhci->pram, 0, FHCI_PRAM_SIZE);
+        usb->port_status = FHCI_PORT_DISABLED;
+        usb->max_frame_usage = FRAME_TIME_USAGE;
+        usb->sw_transaction_time = SW_FIX_TIME_BETWEEN_TRANSACTION;
+        usb->actual_frame = kzalloc(sizeof(*usb->actual_frame), GFP_KERNEL);
+        if (!usb->actual_frame) {
+                fhci_usb_free(usb);
+                return -ENOMEM;
+        }
+        INIT_LIST_HEAD(&usb->actual_frame->tds_list);
+        /* initializing registers on chip, clear frame number */
+        out_be16(&fhci->pram->frame_num, 0);
+        /* clear rx state */
+        out_be32(&fhci->pram->rx_state, 0);
+        /* set mask register */
+        usb->saved_msk = (USB_E_TXB_MASK |
+                          USB_E_TXE1_MASK |
+                          USB_E_IDLE_MASK |
+                          USB_E_RESET_MASK | USB_E_SFT_MASK | USB_E_MSF_MASK);
+        out_8(&usb->fhci->regs->usb_mod, USB_MODE_HOST | USB_MODE_EN);
+        /* clearing the mask register */
+        out_be16(&usb->fhci->regs->usb_mask, 0);
+        /* initialing the event register */
+        out_be16(&usb->fhci->regs->usb_event, 0xffff);
+        if (endpoint_zero_init(usb, DEFAULT_DATA_MEM, DEFAULT_RING_LEN) != 0) {
+                fhci_usb_free(usb);
+                return -EINVAL;
+        }
+        return 0;
+}
+/* initialize the fhci_usb struct and the corresponding data staruct */
+static struct fhci_usb *fhci_create_lld(struct fhci_hcd *fhci)
+{
+        struct fhci_usb *usb;
+        /* allocate memory for SCC data structure */
+        usb = kzalloc(sizeof(*usb), GFP_KERNEL);
+        if (!usb) {
+                fhci_err(fhci, "no memory for SCC data struct\n");
+                return NULL;
+        }
+        usb->fhci = fhci;
+        usb->hc_list = fhci->hc_list;
+        usb->vroot_hub = fhci->vroot_hub;
+        usb->transfer_confirm = fhci_transfer_confirm_callback;
+        return usb;
+}
+static int fhci_start(struct usb_hcd *hcd)
+{
+        int ret;
+        struct fhci_hcd *fhci = hcd_to_fhci(hcd);
+        ret = fhci_mem_init(fhci);
+        if (ret) {
+                fhci_err(fhci, "failed to allocate memory\n");
+                goto err;
+        }
+        fhci->usb_lld = fhci_create_lld(fhci);
+        if (!fhci->usb_lld) {
+                fhci_err(fhci, "low level driver config failed\n");
+                ret = -ENOMEM;
+                goto err;
+        }
+        ret = fhci_usb_init(fhci);
+        if (ret) {
+                fhci_err(fhci, "low level driver initialize failed\n");
+                goto err;
+        }
+        spin_lock_init(&fhci->lock);
+        /* connect the virtual root hub */
+        fhci->vroot_hub->dev_num = 1;   /* this field may be needed to fix */
+        fhci->vroot_hub->hub.wHubStatus = 0;
+        fhci->vroot_hub->hub.wHubChange = 0;
+        fhci->vroot_hub->port.wPortStatus = 0;
+        fhci->vroot_hub->port.wPortChange = 0;
+        hcd->state = HC_STATE_RUNNING;
+        /*
+         * From here on, khubd concurrently accesses the root
+         * hub; drivers will be talking to enumerated devices.
+         * (On restart paths, khubd already knows about the root
+         * hub and could find work as soon as we wrote FLAG_CF.)
+         *
+         * Before this point the HC was idle/ready.  After, khubd
+         * and device drivers may start it running.
+         */
+        fhci_usb_enable(fhci);
+        return 0;
+err:
+        fhci_mem_free(fhci);
+        return ret;
+}
+static void fhci_stop(struct usb_hcd *hcd)
+{
+        struct fhci_hcd *fhci = hcd_to_fhci(hcd);
+        fhci_usb_disable_interrupt(fhci->usb_lld);
+        fhci_usb_disable(fhci);
+        fhci_usb_free(fhci->usb_lld);
+        fhci->usb_lld = NULL;
+        fhci_mem_free(fhci);
+}
+static int fhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
+                            gfp_t mem_flags)
+{
+        struct fhci_hcd *fhci = hcd_to_fhci(hcd);
+        u32 pipe = urb->pipe;
+        int ret;
+        int i;
+        int size = 0;
+        struct urb_priv *urb_priv;
+        unsigned long flags;
+        switch (usb_pipetype(pipe)) {
+        case PIPE_CONTROL:
+                /* 1 td fro setup,1 for ack */
+                size = 2;
+        case PIPE_BULK:
+                /* one td for every 4096 bytes(can be upto 8k) */
+                size += urb->transfer_buffer_length / 4096;
+                /* ...add for any remaining bytes... */
+                if ((urb->transfer_buffer_length % 4096) != 0)
+                        size++;
+                /* ..and maybe a zero length packet to wrap it up */
+                if (size == 0)
+                        size++;
+                else if ((urb->transfer_flags & URB_ZERO_PACKET) != 0
+                         && (urb->transfer_buffer_length
+                             % usb_maxpacket(urb->dev, pipe,
+                                             usb_pipeout(pipe))) != 0)
+                        size++;
+                break;
+        case PIPE_ISOCHRONOUS:
+                size = urb->number_of_packets;
+                if (size <= 0)
+                        return -EINVAL;
+                for (i = 0; i < urb->number_of_packets; i++) {
+                        urb->iso_frame_desc[i].actual_length = 0;
+                        urb->iso_frame_desc[i].status = (u32) (-EXDEV);
+                }
+                break;
+        case PIPE_INTERRUPT:
+                size = 1;
+        }
+        /* allocate the private part of the URB */
+        urb_priv = kzalloc(sizeof(*urb_priv), mem_flags);
+        if (!urb_priv)
+                return -ENOMEM;
+        /* allocate the private part of the URB */
+        urb_priv->tds = kzalloc(size * sizeof(struct td), mem_flags);
+        if (!urb_priv->tds) {
+                kfree(urb_priv);
+                return -ENOMEM;
+        }
+        spin_lock_irqsave(&fhci->lock, flags);
+        ret = usb_hcd_link_urb_to_ep(hcd, urb);
+        if (ret)
+                goto err;
+        /* fill the private part of the URB */
+        urb_priv->num_of_tds = size;
+        urb->status = -EINPROGRESS;
+        urb->actual_length = 0;
+        urb->error_count = 0;
+        urb->hcpriv = urb_priv;
+        fhci_queue_urb(fhci, urb);
+err:
+        if (ret) {
+                kfree(urb_priv->tds);
+                kfree(urb_priv);
+        }
+        spin_unlock_irqrestore(&fhci->lock, flags);
+        return ret;
+}
+/* dequeue FHCI URB */
+static int fhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
+{
+        struct fhci_hcd *fhci = hcd_to_fhci(hcd);
+        struct fhci_usb *usb = fhci->usb_lld;
+        int ret = -EINVAL;
+        unsigned long flags;
+        if (!urb || !urb->dev || !urb->dev->bus)
+                goto out;
+        spin_lock_irqsave(&fhci->lock, flags);
+        ret = usb_hcd_check_unlink_urb(hcd, urb, status);
+        if (ret)
+                goto out2;
+        if (usb->port_status != FHCI_PORT_DISABLED) {
+                struct urb_priv *urb_priv;
+                /*
+                 * flag the urb's data for deletion in some upcoming
+                 * SF interrupt's delete list processing
+                 */
+                urb_priv = urb->hcpriv;
+                if (!urb_priv || (urb_priv->state == URB_DEL))
+                        goto out2;
+                urb_priv->state = URB_DEL;
+                /* already pending? */
+                urb_priv->ed->state = FHCI_ED_URB_DEL;
+        } else {
+                fhci_urb_complete_free(fhci, urb);
+        }
+out2:
+        spin_unlock_irqrestore(&fhci->lock, flags);
+out:
+        return ret;
+}
+static void fhci_endpoint_disable(struct usb_hcd *hcd,
+                                  struct usb_host_endpoint *ep)
+{
+        struct fhci_hcd *fhci;
+        struct ed *ed;
+        unsigned long flags;
+        fhci = hcd_to_fhci(hcd);
+        spin_lock_irqsave(&fhci->lock, flags);
+        ed = ep->hcpriv;
+        if (ed) {
+                while (ed->td_head != NULL) {
+                        struct td *td = fhci_remove_td_from_ed(ed);
+                        fhci_urb_complete_free(fhci, td->urb);
+                }
+                fhci_recycle_empty_ed(fhci, ed);
+                ep->hcpriv = NULL;
+        }
+        spin_unlock_irqrestore(&fhci->lock, flags);
+}
+static int fhci_get_frame_number(struct usb_hcd *hcd)
+{
+        struct fhci_hcd *fhci = hcd_to_fhci(hcd);
+        return get_frame_num(fhci);
+}
+static const struct hc_driver fhci_driver = {
+        .description = "fsl,usb-fhci",
+        .product_desc = "FHCI HOST Controller",
+        .hcd_priv_size = sizeof(struct fhci_hcd),
+        /* generic hardware linkage */
+        .irq = fhci_irq,
+        .flags = HCD_USB11 | HCD_MEMORY,
+        /* basic lifecycle operation */
+        .start = fhci_start,
+        .stop = fhci_stop,
+        /* managing i/o requests and associated device resources */
+        .urb_enqueue = fhci_urb_enqueue,
+        .urb_dequeue = fhci_urb_dequeue,
+        .endpoint_disable = fhci_endpoint_disable,
+        /* scheduling support */
+        .get_frame_number = fhci_get_frame_number,
+        /* root hub support */
+        .hub_status_data = fhci_hub_status_data,
+        .hub_control = fhci_hub_control,
+};
+static int __devinit of_fhci_probe(struct of_device *ofdev,
+                                   const struct of_device_id *ofid)
+{
+        struct device *dev = &ofdev->dev;
+        struct device_node *node = ofdev->node;
+        struct usb_hcd *hcd;
+        struct fhci_hcd *fhci;
+        struct resource usb_regs;
+        unsigned long pram_addr;
+        unsigned int usb_irq;
+        const char *sprop;
+        const u32 *iprop;
+        int size;
+        int ret;
+        int i;
+        int j;
+        if (usb_disabled())
+                return -ENODEV;
+        sprop = of_get_property(node, "mode", NULL);
+        if (sprop && strcmp(sprop, "host"))
+                return -ENODEV;
+        hcd = usb_create_hcd(&fhci_driver, dev, dev->bus_id);
+        if (!hcd) {
+                dev_err(dev, "could not create hcd\n");
+                return -ENOMEM;
+        }
+        fhci = hcd_to_fhci(hcd);
+        hcd->self.controller = dev;
+        dev_set_drvdata(dev, hcd);
+        iprop = of_get_property(node, "hub-power-budget", &size);
+        if (iprop && size == sizeof(*iprop))
+                hcd->power_budget = *iprop;
+        /* FHCI registers. */
+        ret = of_address_to_resource(node, 0, &usb_regs);
+        if (ret) {
+                dev_err(dev, "could not get regs\n");
+                goto err_regs;
+        }
+        hcd->regs = ioremap(usb_regs.start, usb_regs.end - usb_regs.start + 1);
+        if (!hcd->regs) {
+                dev_err(dev, "could not ioremap regs\n");
+                ret = -ENOMEM;
+                goto err_regs;
+        }
+        fhci->regs = hcd->regs;
+        /* Parameter RAM. */
+        iprop = of_get_property(node, "reg", &size);
+        if (!iprop || size < sizeof(*iprop) * 4) {
+                dev_err(dev, "can't get pram offset\n");
+                ret = -EINVAL;
+                goto err_pram;
+        }
+        pram_addr = cpm_muram_alloc_fixed(iprop[2], FHCI_PRAM_SIZE);
+        if (IS_ERR_VALUE(pram_addr)) {
+                dev_err(dev, "failed to allocate usb pram\n");
+                ret = -ENOMEM;
+                goto err_pram;
+        }
+        fhci->pram = cpm_muram_addr(pram_addr);
+        /* GPIOs and pins */
+        for (i = 0; i < NUM_GPIOS; i++) {
+                int gpio;
+                enum of_gpio_flags flags;
+                gpio = of_get_gpio_flags(node, i, &flags);
+                fhci->gpios[i] = gpio;
+                fhci->alow_gpios[i] = flags & OF_GPIO_ACTIVE_LOW;
+                if (!gpio_is_valid(gpio)) {
+                        if (i < GPIO_SPEED) {
+                                dev_err(dev, "incorrect GPIO%d: %d\n",
+                                        i, gpio);
+                                goto err_gpios;
+                        } else {
+                                dev_info(dev, "assuming board doesn't have "
+                                        "%s gpio\n", i == GPIO_SPEED ?
+                                        "speed" : "power");
+                                continue;
+                        }
+                }
+                ret = gpio_request(gpio, dev->bus_id);
+                if (ret) {
+                        dev_err(dev, "failed to request gpio %d", i);
+                        goto err_gpios;
+                }
+                if (i >= GPIO_SPEED) {
+                        ret = gpio_direction_output(gpio, 0);
+                        if (ret) {
+                                dev_err(dev, "failed to set gpio %d as "
+                                        "an output\n", i);
+                                i++;
+                                goto err_gpios;
+                        }
+                }
+        }
+        for (j = 0; j < NUM_PINS; j++) {
+                fhci->pins[j] = qe_pin_request(ofdev->node, j);
+                if (IS_ERR(fhci->pins[j])) {
+                        ret = PTR_ERR(fhci->pins[j]);
+                        dev_err(dev, "can't get pin %d: %d\n", j, ret);
+                        goto err_pins;
+                }
+        }
+        /* Frame limit timer and its interrupt. */
+        fhci->timer = gtm_get_timer16();
+        if (IS_ERR(fhci->timer)) {
+                ret = PTR_ERR(fhci->timer);
+                dev_err(dev, "failed to request qe timer: %i", ret);
+                goto err_get_timer;
+        }
+        ret = request_irq(fhci->timer->irq, fhci_frame_limit_timer_irq,
+                          IRQF_DISABLED, "qe timer (usb)", hcd);
+        if (ret) {
+                dev_err(dev, "failed to request timer irq");
+                goto err_timer_irq;
+        }
+        /* USB Host interrupt. */
+        usb_irq = irq_of_parse_and_map(node, 0);
+        if (usb_irq == NO_IRQ) {
+                dev_err(dev, "could not get usb irq\n");
+                ret = -EINVAL;
+                goto err_usb_irq;
+        }
+        /* Clocks. */
+        sprop = of_get_property(node, "fsl,fullspeed-clock", NULL);
+        if (sprop) {
+                fhci->fullspeed_clk = qe_clock_source(sprop);
+                if (fhci->fullspeed_clk == QE_CLK_DUMMY) {
+                        dev_err(dev, "wrong fullspeed-clock\n");
+                        ret = -EINVAL;
+                        goto err_clocks;
+                }
+        }
+        sprop = of_get_property(node, "fsl,lowspeed-clock", NULL);
+        if (sprop) {
+                fhci->lowspeed_clk = qe_clock_source(sprop);
+                if (fhci->lowspeed_clk == QE_CLK_DUMMY) {
+                        dev_err(dev, "wrong lowspeed-clock\n");
+                        ret = -EINVAL;
+                        goto err_clocks;
+                }
+        }
+        if (fhci->fullspeed_clk == QE_CLK_NONE &&
+                        fhci->lowspeed_clk == QE_CLK_NONE) {
+                dev_err(dev, "no clocks specified\n");
+                ret = -EINVAL;
+                goto err_clocks;
+        }
+        dev_info(dev, "at 0x%p, irq %d\n", hcd->regs, usb_irq);
+        fhci_config_transceiver(fhci, FHCI_PORT_POWER_OFF);
+        /* Start with full-speed, if possible. */
+        if (fhci->fullspeed_clk != QE_CLK_NONE) {
+                fhci_config_transceiver(fhci, FHCI_PORT_FULL);
+                qe_usb_clock_set(fhci->fullspeed_clk, USB_CLOCK);
+        } else {
+                fhci_config_transceiver(fhci, FHCI_PORT_LOW);
+                qe_usb_clock_set(fhci->lowspeed_clk, USB_CLOCK >> 3);
+        }
+        /* Clear and disable any pending interrupts. */
+        out_be16(&fhci->regs->usb_event, 0xffff);
+        out_be16(&fhci->regs->usb_mask, 0);
+        ret = usb_add_hcd(hcd, usb_irq, IRQF_DISABLED);
+        if (ret < 0)
+                goto err_add_hcd;
+        fhci_dfs_create(fhci);
+        return 0;
+err_add_hcd:
+err_clocks:
+        irq_dispose_mapping(usb_irq);
+err_usb_irq:
+        free_irq(fhci->timer->irq, hcd);
+err_timer_irq:
+        gtm_put_timer16(fhci->timer);
+err_get_timer:
+err_pins:
+        while (--j >= 0)
+                qe_pin_free(fhci->pins[j]);
+err_gpios:
+        while (--i >= 0) {
+                if (gpio_is_valid(fhci->gpios[i]))
+                        gpio_free(fhci->gpios[i]);
+        }
+        cpm_muram_free(pram_addr);
+err_pram:
+        iounmap(hcd->regs);
+err_regs:
+        usb_put_hcd(hcd);
+        return ret;
+}
+static int __devexit fhci_remove(struct device *dev)
+{
+        struct usb_hcd *hcd = dev_get_drvdata(dev);
+        struct fhci_hcd *fhci = hcd_to_fhci(hcd);
+        int i;
+        int j;
+        usb_remove_hcd(hcd);
+        free_irq(fhci->timer->irq, hcd);
+        gtm_put_timer16(fhci->timer);
+        cpm_muram_free(cpm_muram_offset(fhci->pram));
+        for (i = 0; i < NUM_GPIOS; i++) {
+                if (!gpio_is_valid(fhci->gpios[i]))
+                        continue;
+                gpio_free(fhci->gpios[i]);
+        }
+        for (j = 0; j < NUM_PINS; j++)
+                qe_pin_free(fhci->pins[j]);
+        fhci_dfs_destroy(fhci);
+        usb_put_hcd(hcd);
+        return 0;
+}
+static int __devexit of_fhci_remove(struct of_device *ofdev)
+{
+        return fhci_remove(&ofdev->dev);
+}
+static struct of_device_id of_fhci_match[] = {
+        { .compatible = "fsl,mpc8323-qe-usb", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, of_fhci_match);
+static struct of_platform_driver of_fhci_driver = {
+        .name           = "fsl,usb-fhci",
+        .match_table    = of_fhci_match,
+        .probe          = of_fhci_probe,
+        .remove         = __devexit_p(of_fhci_remove),
+};
+static int __init fhci_module_init(void)
+{
+        return of_register_platform_driver(&of_fhci_driver);
+}
+module_init(fhci_module_init);
+static void __exit fhci_module_exit(void)
+{
+        of_unregister_platform_driver(&of_fhci_driver);
+}
+module_exit(fhci_module_exit);
+MODULE_DESCRIPTION("USB Freescale Host Controller Interface Driver");
+MODULE_AUTHOR("Shlomi Gridish <gridish@freescale.com>, "
+              "Jerry Huang <Chang-Ming.Huang@freescale.com>, "
+              "Anton Vorontsov <avorontsov@ru.mvista.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/usb/host/fhci-hub.c b/drivers/usb/host/fhci-hub.c
new file mode 100644
index 000000000000..0cfaedc3e124
--- /dev/null
+++ b/drivers/usb/host/fhci-hub.c
@@ -0,0 +1,345 @@
+/*
+ * Freescale QUICC Engine USB Host Controller Driver
+ *
+ * Copyright (c) Freescale Semicondutor, Inc. 2006.
+ *               Shlomi Gridish <gridish@freescale.com>
+ *               Jerry Huang <Chang-Ming.Huang@freescale.com>
+ * Copyright (c) Logic Product Development, Inc. 2007
+ *               Peter Barada <peterb@logicpd.com>
+ * Copyright (c) MontaVista Software, Inc. 2008.
+ *               Anton Vorontsov <avorontsov@ru.mvista.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/spinlock.h>
+#include <linux/delay.h>
+#include <linux/errno.h>
+#include <linux/io.h>
+#include <linux/usb.h>
+#include <linux/gpio.h>
+#include <asm/qe.h>
+#include "../core/hcd.h"
+#include "fhci.h"
+/* virtual root hub specific descriptor */
+static u8 root_hub_des[] = {
+        0x09, /* blength */
+        0x29, /* bDescriptorType;hub-descriptor */
+        0x01, /* bNbrPorts */
+        0x00, /* wHubCharacteristics */
+        0x00,
+        0x01, /* bPwrOn2pwrGood;2ms */
+        0x00, /* bHubContrCurrent;0mA */
+        0x00, /* DeviceRemoveable */
+        0xff, /* PortPwrCtrlMask */
+};
+static void fhci_gpio_set_value(struct fhci_hcd *fhci, int gpio_nr, bool on)
+{
+        int gpio = fhci->gpios[gpio_nr];
+        bool alow = fhci->alow_gpios[gpio_nr];
+        if (!gpio_is_valid(gpio))
+                return;
+        gpio_set_value(gpio, on ^ alow);
+        mdelay(5);
+}
+void fhci_config_transceiver(struct fhci_hcd *fhci,
+                             enum fhci_port_status status)
+{
+        fhci_dbg(fhci, "-> %s: %d\n", __func__, status);
+        switch (status) {
+        case FHCI_PORT_POWER_OFF:
+                fhci_gpio_set_value(fhci, GPIO_POWER, false);
+                break;
+        case FHCI_PORT_DISABLED:
+        case FHCI_PORT_WAITING:
+                fhci_gpio_set_value(fhci, GPIO_POWER, true);
+                break;
+        case FHCI_PORT_LOW:
+                fhci_gpio_set_value(fhci, GPIO_SPEED, false);
+                break;
+        case FHCI_PORT_FULL:
+                fhci_gpio_set_value(fhci, GPIO_SPEED, true);
+                break;
+        default:
+                WARN_ON(1);
+                break;
+        }
+        fhci_dbg(fhci, "<- %s: %d\n", __func__, status);
+}
+/* disable the USB port by clearing the EN bit in the USBMOD register */
+void fhci_port_disable(struct fhci_hcd *fhci)
+{
+        struct fhci_usb *usb = (struct fhci_usb *)fhci->usb_lld;
+        enum fhci_port_status port_status;
+        fhci_dbg(fhci, "-> %s\n", __func__);
+        fhci_stop_sof_timer(fhci);
+        fhci_flush_all_transmissions(usb);
+        fhci_usb_disable_interrupt((struct fhci_usb *)fhci->usb_lld);
+        port_status = usb->port_status;
+        usb->port_status = FHCI_PORT_DISABLED;
+        /* Enable IDLE since we want to know if something comes along */
+        usb->saved_msk |= USB_E_IDLE_MASK;
+        out_be16(&usb->fhci->regs->usb_mask, usb->saved_msk);
+        /* check if during the disconnection process attached new device */
+        if (port_status == FHCI_PORT_WAITING)
+                fhci_device_connected_interrupt(fhci);
+        usb->vroot_hub->port.wPortStatus &= ~USB_PORT_STAT_ENABLE;
+        usb->vroot_hub->port.wPortChange |= USB_PORT_STAT_C_ENABLE;
+        fhci_usb_enable_interrupt((struct fhci_usb *)fhci->usb_lld);
+        fhci_dbg(fhci, "<- %s\n", __func__);
+}
+/* enable the USB port by setting the EN bit in the USBMOD register */
+void fhci_port_enable(void *lld)
+{
+        struct fhci_usb *usb = (struct fhci_usb *)lld;
+        struct fhci_hcd *fhci = usb->fhci;
+        fhci_dbg(fhci, "-> %s\n", __func__);
+        fhci_config_transceiver(fhci, usb->port_status);
+        if ((usb->port_status != FHCI_PORT_FULL) &&
+                        (usb->port_status != FHCI_PORT_LOW))
+                fhci_start_sof_timer(fhci);
+        usb->vroot_hub->port.wPortStatus |= USB_PORT_STAT_ENABLE;
+        usb->vroot_hub->port.wPortChange |= USB_PORT_STAT_C_ENABLE;
+        fhci_dbg(fhci, "<- %s\n", __func__);
+}
+void fhci_io_port_generate_reset(struct fhci_hcd *fhci)
+{
+        fhci_dbg(fhci, "-> %s\n", __func__);
+        gpio_direction_output(fhci->gpios[GPIO_USBOE], 0);
+        gpio_direction_output(fhci->gpios[GPIO_USBTP], 0);
+        gpio_direction_output(fhci->gpios[GPIO_USBTN], 0);
+        mdelay(5);
+        qe_pin_set_dedicated(fhci->pins[PIN_USBOE]);
+        qe_pin_set_dedicated(fhci->pins[PIN_USBTP]);
+        qe_pin_set_dedicated(fhci->pins[PIN_USBTN]);
+        fhci_dbg(fhci, "<- %s\n", __func__);
+}
+/* generate the RESET condition on the bus */
+void fhci_port_reset(void *lld)
+{
+        struct fhci_usb *usb = (struct fhci_usb *)lld;
+        struct fhci_hcd *fhci = usb->fhci;
+        u8 mode;
+        u16 mask;
+        fhci_dbg(fhci, "-> %s\n", __func__);
+        fhci_stop_sof_timer(fhci);
+        /* disable the USB controller */
+        mode = in_8(&fhci->regs->usb_mod);
+        out_8(&fhci->regs->usb_mod, mode & (~USB_MODE_EN));
+        /* disable idle interrupts */
+        mask = in_be16(&fhci->regs->usb_mask);
+        out_be16(&fhci->regs->usb_mask, mask & (~USB_E_IDLE_MASK));
+        fhci_io_port_generate_reset(fhci);
+        /* enable interrupt on this endpoint */
+        out_be16(&fhci->regs->usb_mask, mask);
+        /* enable the USB controller */
+        mode = in_8(&fhci->regs->usb_mod);
+        out_8(&fhci->regs->usb_mod, mode | USB_MODE_EN);
+        fhci_start_sof_timer(fhci);
+        fhci_dbg(fhci, "<- %s\n", __func__);
+}
+int fhci_hub_status_data(struct usb_hcd *hcd, char *buf)
+{
+        struct fhci_hcd *fhci = hcd_to_fhci(hcd);
+        int ret = 0;
+        unsigned long flags;
+        fhci_dbg(fhci, "-> %s\n", __func__);
+        spin_lock_irqsave(&fhci->lock, flags);
+        if (fhci->vroot_hub->port.wPortChange & (USB_PORT_STAT_C_CONNECTION |
+                        USB_PORT_STAT_C_ENABLE | USB_PORT_STAT_C_SUSPEND |
+                        USB_PORT_STAT_C_RESET | USB_PORT_STAT_C_OVERCURRENT)) {
+                *buf = 1 << 1;
+                ret = 1;
+                fhci_dbg(fhci, "-- %s\n", __func__);
+        }
+        spin_unlock_irqrestore(&fhci->lock, flags);
+        fhci_dbg(fhci, "<- %s\n", __func__);
+        return ret;
+}
+int fhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+                            u16 wIndex, char *buf, u16 wLength)
+{
+        struct fhci_hcd *fhci = hcd_to_fhci(hcd);
+        int retval = 0;
+        int len = 0;
+        struct usb_hub_status *hub_status;
+        struct usb_port_status *port_status;
+        unsigned long flags;
+        spin_lock_irqsave(&fhci->lock, flags);
+        fhci_dbg(fhci, "-> %s\n", __func__);
+        switch (typeReq) {
+        case ClearHubFeature:
+                switch (wValue) {
+                case C_HUB_LOCAL_POWER:
+                case C_HUB_OVER_CURRENT:
+                        break;
+                default:
+                        goto error;
+                }
+                break;
+        case ClearPortFeature:
+                fhci->vroot_hub->feature &= (1 << wValue);
+                switch (wValue) {
+                case USB_PORT_FEAT_ENABLE:
+                        fhci->vroot_hub->port.wPortStatus &=
+                            ~USB_PORT_STAT_ENABLE;
+                        fhci_port_disable(fhci);
+                        break;
+                case USB_PORT_FEAT_C_ENABLE:
+                        fhci->vroot_hub->port.wPortChange &=
+                            ~USB_PORT_STAT_C_ENABLE;
+                        break;
+                case USB_PORT_FEAT_SUSPEND:
+                        fhci->vroot_hub->port.wPortStatus &=
+                            ~USB_PORT_STAT_SUSPEND;
+                        fhci_stop_sof_timer(fhci);
+                        break;
+                case USB_PORT_FEAT_C_SUSPEND:
+                        fhci->vroot_hub->port.wPortChange &=
+                            ~USB_PORT_STAT_C_SUSPEND;
+                        break;
+                case USB_PORT_FEAT_POWER:
+                        fhci->vroot_hub->port.wPortStatus &=
+                            ~USB_PORT_STAT_POWER;
+                        fhci_config_transceiver(fhci, FHCI_PORT_POWER_OFF);
+                        break;
+                case USB_PORT_FEAT_C_CONNECTION:
+                        fhci->vroot_hub->port.wPortChange &=
+                            ~USB_PORT_STAT_C_CONNECTION;
+                        break;
+                case USB_PORT_FEAT_C_OVER_CURRENT:
+                        fhci->vroot_hub->port.wPortChange &=
+                            ~USB_PORT_STAT_C_OVERCURRENT;
+                        break;
+                case USB_PORT_FEAT_C_RESET:
+                        fhci->vroot_hub->port.wPortChange &=
+                            ~USB_PORT_STAT_C_RESET;
+                        break;
+                default:
+                        goto error;
+                }
+                break;
+        case GetHubDescriptor:
+                memcpy(buf, root_hub_des, sizeof(root_hub_des));
+                buf[3] = 0x11; /* per-port power, no ovrcrnt */
+                len = (buf[0] < wLength) ? buf[0] : wLength;
+                break;
+        case GetHubStatus:
+                hub_status = (struct usb_hub_status *)buf;
+                hub_status->wHubStatus =
+                    cpu_to_le16(fhci->vroot_hub->hub.wHubStatus);
+                hub_status->wHubChange =
+                    cpu_to_le16(fhci->vroot_hub->hub.wHubChange);
+                len = 4;
+                break;
+        case GetPortStatus:
+                port_status = (struct usb_port_status *)buf;
+                port_status->wPortStatus =
+                    cpu_to_le16(fhci->vroot_hub->port.wPortStatus);
+                port_status->wPortChange =
+                    cpu_to_le16(fhci->vroot_hub->port.wPortChange);
+                len = 4;
+                break;
+        case SetHubFeature:
+                switch (wValue) {
+                case C_HUB_OVER_CURRENT:
+                case C_HUB_LOCAL_POWER:
+                        break;
+                default:
+                        goto error;
+                }
+                break;
+        case SetPortFeature:
+                fhci->vroot_hub->feature |= (1 << wValue);
+                switch (wValue) {
+                case USB_PORT_FEAT_ENABLE:
+                        fhci->vroot_hub->port.wPortStatus |=
+                            USB_PORT_STAT_ENABLE;
+                        fhci_port_enable(fhci->usb_lld);
+                        break;
+                case USB_PORT_FEAT_SUSPEND:
+                        fhci->vroot_hub->port.wPortStatus |=
+                            USB_PORT_STAT_SUSPEND;
+                        fhci_stop_sof_timer(fhci);
+                        break;
+                case USB_PORT_FEAT_RESET:
+                        fhci->vroot_hub->port.wPortStatus |=
+                            USB_PORT_STAT_RESET;
+                        fhci_port_reset(fhci->usb_lld);
+                        fhci->vroot_hub->port.wPortStatus |=
+                            USB_PORT_STAT_ENABLE;
+                        fhci->vroot_hub->port.wPortStatus &=
+                            ~USB_PORT_STAT_RESET;
+                        break;
+                case USB_PORT_FEAT_POWER:
+                        fhci->vroot_hub->port.wPortStatus |=
+                            USB_PORT_STAT_POWER;
+                        fhci_config_transceiver(fhci, FHCI_PORT_WAITING);
+                        break;
+                default:
+                        goto error;
+                }
+                break;
+        default:
+error:
+                retval = -EPIPE;
+        }
+        fhci_dbg(fhci, "<- %s\n", __func__);
+        spin_unlock_irqrestore(&fhci->lock, flags);
+        return retval;
+}
diff --git a/drivers/usb/host/fhci-mem.c b/drivers/usb/host/fhci-mem.c
new file mode 100644
index 000000000000..2c0736c99712
--- /dev/null
+++ b/drivers/usb/host/fhci-mem.c
@@ -0,0 +1,113 @@
+/*
+ * Freescale QUICC Engine USB Host Controller Driver
+ *
+ * Copyright (c) Freescale Semicondutor, Inc. 2006.
+ *               Shlomi Gridish <gridish@freescale.com>
+ *               Jerry Huang <Chang-Ming.Huang@freescale.com>
+ * Copyright (c) Logic Product Development, Inc. 2007
+ *               Peter Barada <peterb@logicpd.com>
+ * Copyright (c) MontaVista Software, Inc. 2008.
+ *               Anton Vorontsov <avorontsov@ru.mvista.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/delay.h>
+#include <linux/list.h>
+#include <linux/usb.h>
+#include "../core/hcd.h"
+#include "fhci.h"
+static void init_td(struct td *td)
+{
+        memset(td, 0, sizeof(*td));
+        INIT_LIST_HEAD(&td->node);
+        INIT_LIST_HEAD(&td->frame_lh);
+}
+static void init_ed(struct ed *ed)
+{
+        memset(ed, 0, sizeof(*ed));
+        INIT_LIST_HEAD(&ed->td_list);
+        INIT_LIST_HEAD(&ed->node);
+}
+static struct td *get_empty_td(struct fhci_hcd *fhci)
+{
+        struct td *td;
+        if (!list_empty(&fhci->empty_tds)) {
+                td = list_entry(fhci->empty_tds.next, struct td, node);
+                list_del(fhci->empty_tds.next);
+        } else {
+                td = kmalloc(sizeof(*td), GFP_ATOMIC);
+                if (!td)
+                        fhci_err(fhci, "No memory to allocate to TD\n");
+                else
+                        init_td(td);
+        }
+        return td;
+}
+void fhci_recycle_empty_td(struct fhci_hcd *fhci, struct td *td)
+{
+        init_td(td);
+        list_add(&td->node, &fhci->empty_tds);
+}
+struct ed *fhci_get_empty_ed(struct fhci_hcd *fhci)
+{
+        struct ed *ed;
+        if (!list_empty(&fhci->empty_eds)) {
+                ed = list_entry(fhci->empty_eds.next, struct ed, node);
+                list_del(fhci->empty_eds.next);
+        } else {
+                ed = kmalloc(sizeof(*ed), GFP_ATOMIC);
+                if (!ed)
+                        fhci_err(fhci, "No memory to allocate to ED\n");
+                else
+                        init_ed(ed);
+        }
+        return ed;
+}
+void fhci_recycle_empty_ed(struct fhci_hcd *fhci, struct ed *ed)
+{
+        init_ed(ed);
+        list_add(&ed->node, &fhci->empty_eds);
+}
+struct td *fhci_td_fill(struct fhci_hcd *fhci, struct urb *urb,
+                        struct urb_priv *urb_priv, struct ed *ed, u16 index,
+                        enum fhci_ta_type type, int toggle, u8 *data, u32 len,
+                        u16 interval, u16 start_frame, bool ioc)
+{
+        struct td *td = get_empty_td(fhci);
+        if (!td)
+                return NULL;
+        td->urb = urb;
+        td->ed = ed;
+        td->type = type;
+        td->toggle = toggle;
+        td->data = data;
+        td->len = len;
+        td->iso_index = index;
+        td->interval = interval;
+        td->start_frame = start_frame;
+        td->ioc = ioc;
+        td->status = USB_TD_OK;
+        urb_priv->tds[index] = td;
+        return td;
+}
diff --git a/drivers/usb/host/fhci-q.c b/drivers/usb/host/fhci-q.c
new file mode 100644
index 000000000000..b0a1446ba292
--- /dev/null
+++ b/drivers/usb/host/fhci-q.c
@@ -0,0 +1,284 @@
+/*
+ * Freescale QUICC Engine USB Host Controller Driver
+ *
+ * Copyright (c) Freescale Semicondutor, Inc. 2006.
+ *               Shlomi Gridish <gridish@freescale.com>
+ *               Jerry Huang <Chang-Ming.Huang@freescale.com>
+ * Copyright (c) Logic Product Development, Inc. 2007
+ *               Peter Barada <peterb@logicpd.com>
+ * Copyright (c) MontaVista Software, Inc. 2008.
+ *               Anton Vorontsov <avorontsov@ru.mvista.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/spinlock.h>
+#include <linux/errno.h>
+#include <linux/list.h>
+#include <linux/usb.h>
+#include "../core/hcd.h"
+#include "fhci.h"
+/* maps the hardware error code to the USB error code */
+static int status_to_error(u32 status)
+{
+        if (status == USB_TD_OK)
+                return 0;
+        else if (status & USB_TD_RX_ER_CRC)
+                return -EILSEQ;
+        else if (status & USB_TD_RX_ER_NONOCT)
+                return -EPROTO;
+        else if (status & USB_TD_RX_ER_OVERUN)
+                return -ECOMM;
+        else if (status & USB_TD_RX_ER_BITSTUFF)
+                return -EPROTO;
+        else if (status & USB_TD_RX_ER_PID)
+                return -EILSEQ;
+        else if (status & (USB_TD_TX_ER_NAK | USB_TD_TX_ER_TIMEOUT))
+                return -ETIMEDOUT;
+        else if (status & USB_TD_TX_ER_STALL)
+                return -EPIPE;
+        else if (status & USB_TD_TX_ER_UNDERUN)
+                return -ENOSR;
+        else if (status & USB_TD_RX_DATA_UNDERUN)
+                return -EREMOTEIO;
+        else if (status & USB_TD_RX_DATA_OVERUN)
+                return -EOVERFLOW;
+        else
+                return -EINVAL;
+}
+void fhci_add_td_to_frame(struct fhci_time_frame *frame, struct td *td)
+{
+        list_add_tail(&td->frame_lh, &frame->tds_list);
+}
+void fhci_add_tds_to_ed(struct ed *ed, struct td **td_list, int number)
+{
+        int i;
+        for (i = 0; i < number; i++) {
+                struct td *td = td_list[i];
+                list_add_tail(&td->node, &ed->td_list);
+        }
+        if (ed->td_head == NULL)
+                ed->td_head = td_list[0];
+}
+static struct td *peek_td_from_ed(struct ed *ed)
+{
+        struct td *td;
+        if (!list_empty(&ed->td_list))
+                td = list_entry(ed->td_list.next, struct td, node);
+        else
+                td = NULL;
+        return td;
+}
+struct td *fhci_remove_td_from_frame(struct fhci_time_frame *frame)
+{
+        struct td *td;
+        if (!list_empty(&frame->tds_list)) {
+                td = list_entry(frame->tds_list.next, struct td, frame_lh);
+                list_del_init(frame->tds_list.next);
+        } else
+                td = NULL;
+        return td;
+}
+struct td *fhci_peek_td_from_frame(struct fhci_time_frame *frame)
+{
+        struct td *td;
+        if (!list_empty(&frame->tds_list))
+                td = list_entry(frame->tds_list.next, struct td, frame_lh);
+        else
+                td = NULL;
+        return td;
+}
+struct td *fhci_remove_td_from_ed(struct ed *ed)
+{
+        struct td *td;
+        if (!list_empty(&ed->td_list)) {
+                td = list_entry(ed->td_list.next, struct td, node);
+                list_del_init(ed->td_list.next);
+                /* if this TD was the ED's head, find next TD */
+                if (!list_empty(&ed->td_list))
+                        ed->td_head = list_entry(ed->td_list.next, struct td,
+                                                 node);
+                else
+                        ed->td_head = NULL;
+        } else
+                td = NULL;
+        return td;
+}
+struct td *fhci_remove_td_from_done_list(struct fhci_controller_list *p_list)
+{
+        struct td *td;
+        if (!list_empty(&p_list->done_list)) {
+                td = list_entry(p_list->done_list.next, struct td, node);
+                list_del_init(p_list->done_list.next);
+        } else
+                td = NULL;
+        return td;
+}
+void fhci_move_td_from_ed_to_done_list(struct fhci_usb *usb, struct ed *ed)
+{
+        struct td *td;
+        td = ed->td_head;
+        list_del_init(&td->node);
+        /* If this TD was the ED's head,find next TD */
+        if (!list_empty(&ed->td_list))
+                ed->td_head = list_entry(ed->td_list.next, struct td, node);
+        else {
+                ed->td_head = NULL;
+                ed->state = FHCI_ED_SKIP;
+        }
+        ed->toggle_carry = td->toggle;
+        list_add_tail(&td->node, &usb->hc_list->done_list);
+        if (td->ioc)
+                usb->transfer_confirm(usb->fhci);
+}
+/* free done FHCI URB resource such as ED and TD */
+static void free_urb_priv(struct fhci_hcd *fhci, struct urb *urb)
+{
+        int i;
+        struct urb_priv *urb_priv = urb->hcpriv;
+        struct ed *ed = urb_priv->ed;
+        for (i = 0; i < urb_priv->num_of_tds; i++) {
+                list_del_init(&urb_priv->tds[i]->node);
+                fhci_recycle_empty_td(fhci, urb_priv->tds[i]);
+        }
+        /* if this TD was the ED's head,find the next TD */
+        if (!list_empty(&ed->td_list))
+                ed->td_head = list_entry(ed->td_list.next, struct td, node);
+        else
+                ed->td_head = NULL;
+        kfree(urb_priv->tds);
+        kfree(urb_priv);
+        urb->hcpriv = NULL;
+        /* if this TD was the ED's head,find next TD */
+        if (ed->td_head == NULL)
+                list_del_init(&ed->node);
+        fhci->active_urbs--;
+}
+/* this routine called to complete and free done URB */
+void fhci_urb_complete_free(struct fhci_hcd *fhci, struct urb *urb)
+{
+        free_urb_priv(fhci, urb);
+        if (urb->status == -EINPROGRESS) {
+                if (urb->actual_length != urb->transfer_buffer_length &&
+                                urb->transfer_flags & URB_SHORT_NOT_OK)
+                        urb->status = -EREMOTEIO;
+                else
+                        urb->status = 0;
+        }
+        usb_hcd_unlink_urb_from_ep(fhci_to_hcd(fhci), urb);
+        spin_unlock(&fhci->lock);
+        usb_hcd_giveback_urb(fhci_to_hcd(fhci), urb, urb->status);
+        spin_lock(&fhci->lock);
+}
+/*
+ * caculate transfer length/stats and update the urb
+ * Precondition: irqsafe(only for urb-?status locking)
+ */
+void fhci_done_td(struct urb *urb, struct td *td)
+{
+        struct ed *ed = td->ed;
+        u32 cc = td->status;
+        /* ISO...drivers see per-TD length/status */
+        if (ed->mode == FHCI_TF_ISO) {
+                u32 len;
+                if (!(urb->transfer_flags & URB_SHORT_NOT_OK &&
+                                cc == USB_TD_RX_DATA_UNDERUN))
+                        cc = USB_TD_OK;
+                if (usb_pipeout(urb->pipe))
+                        len = urb->iso_frame_desc[td->iso_index].length;
+                else
+                        len = td->actual_len;
+                urb->actual_length += len;
+                urb->iso_frame_desc[td->iso_index].actual_length = len;
+                urb->iso_frame_desc[td->iso_index].status =
+                        status_to_error(cc);
+        }
+        /* BULK,INT,CONTROL... drivers see aggregate length/status,
+         * except that "setup" bytes aren't counted and "short" transfers
+         * might not be reported as errors.
+         */
+        else {
+                if (td->error_cnt >= 3)
+                        urb->error_count = 3;
+                /* control endpoint only have soft stalls */
+                /* update packet status if needed(short may be ok) */
+                if (!(urb->transfer_flags & URB_SHORT_NOT_OK) &&
+                                cc == USB_TD_RX_DATA_UNDERUN) {
+                        ed->state = FHCI_ED_OPER;
+                        cc = USB_TD_OK;
+                }
+                if (cc != USB_TD_OK) {
+                        if (urb->status == -EINPROGRESS)
+                                urb->status = status_to_error(cc);
+                }
+                /* count all non-empty packets except control SETUP packet */
+                if (td->type != FHCI_TA_SETUP || td->iso_index != 0)
+                        urb->actual_length += td->actual_len;
+        }
+}
+/* there are some pedning request to unlink */
+void fhci_del_ed_list(struct fhci_hcd *fhci, struct ed *ed)
+{
+        struct td *td = peek_td_from_ed(ed);
+        struct urb *urb = td->urb;
+        struct urb_priv *urb_priv = urb->hcpriv;
+        if (urb_priv->state == URB_DEL) {
+                td = fhci_remove_td_from_ed(ed);
+                /* HC may have partly processed this TD */
+                if (td->status != USB_TD_INPROGRESS)
+                        fhci_done_td(urb, td);
+                /* URB is done;clean up */
+                if (++(urb_priv->tds_cnt) == urb_priv->num_of_tds)
+                        fhci_urb_complete_free(fhci, urb);
+        }
+}
diff --git a/drivers/usb/host/fhci-sched.c b/drivers/usb/host/fhci-sched.c
new file mode 100644
index 000000000000..bb63b68ddb77
--- /dev/null
+++ b/drivers/usb/host/fhci-sched.c
@@ -0,0 +1,888 @@
+/*
+ * Freescale QUICC Engine USB Host Controller Driver
+ *
+ * Copyright (c) Freescale Semicondutor, Inc. 2006.
+ *               Shlomi Gridish <gridish@freescale.com>
+ *               Jerry Huang <Chang-Ming.Huang@freescale.com>
+ * Copyright (c) Logic Product Development, Inc. 2007
+ *               Peter Barada <peterb@logicpd.com>
+ * Copyright (c) MontaVista Software, Inc. 2008.
+ *               Anton Vorontsov <avorontsov@ru.mvista.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/spinlock.h>
+#include <linux/delay.h>
+#include <linux/errno.h>
+#include <linux/list.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/usb.h>
+#include <asm/qe.h>
+#include <asm/fsl_gtm.h>
+#include "../core/hcd.h"
+#include "fhci.h"
+static void recycle_frame(struct fhci_usb *usb, struct packet *pkt)
+{
+        pkt->data = NULL;
+        pkt->len = 0;
+        pkt->status = USB_TD_OK;
+        pkt->info = 0;
+        pkt->priv_data = NULL;
+        cq_put(usb->ep0->empty_frame_Q, pkt);
+}
+/* confirm submitted packet */
+void fhci_transaction_confirm(struct fhci_usb *usb, struct packet *pkt)
+{
+        struct td *td;
+        struct packet *td_pkt;
+        struct ed *ed;
+        u32 trans_len;
+        bool td_done = false;
+        td = fhci_remove_td_from_frame(usb->actual_frame);
+        td_pkt = td->pkt;
+        trans_len = pkt->len;
+        td->status = pkt->status;
+        if (td->type == FHCI_TA_IN && td_pkt->info & PKT_DUMMY_PACKET) {
+                if ((td->data + td->actual_len) && trans_len)
+                        memcpy(td->data + td->actual_len, pkt->data,
+                               trans_len);
+                cq_put(usb->ep0->dummy_packets_Q, pkt->data);
+        }
+        recycle_frame(usb, pkt);
+        ed = td->ed;
+        if (ed->mode == FHCI_TF_ISO) {
+                if (ed->td_list.next->next != &ed->td_list) {
+                        struct td *td_next =
+                            list_entry(ed->td_list.next->next, struct td,
+                                       node);
+                        td_next->start_frame = usb->actual_frame->frame_num;
+                }
+                td->actual_len = trans_len;
+                td_done = true;
+        } else if ((td->status & USB_TD_ERROR) &&
+                        !(td->status & USB_TD_TX_ER_NAK)) {
+                /*
+                 * There was an error on the transaction (but not NAK).
+                 * If it is fatal error (data underrun, stall, bad pid or 3
+                 * errors exceeded), mark this TD as done.
+                 */
+                if ((td->status & USB_TD_RX_DATA_UNDERUN) ||
+                                (td->status & USB_TD_TX_ER_STALL) ||
+                                (td->status & USB_TD_RX_ER_PID) ||
+                                (++td->error_cnt >= 3)) {
+                        ed->state = FHCI_ED_HALTED;
+                        td_done = true;
+                        if (td->status & USB_TD_RX_DATA_UNDERUN) {
+                                fhci_dbg(usb->fhci, "td err fu\n");
+                                td->toggle = !td->toggle;
+                                td->actual_len += trans_len;
+                        } else {
+                                fhci_dbg(usb->fhci, "td err f!u\n");
+                        }
+                } else {
+                        fhci_dbg(usb->fhci, "td err !f\n");
+                        /* it is not a fatal error -retry this transaction */
+                        td->nak_cnt = 0;
+                        td->error_cnt++;
+                        td->status = USB_TD_OK;
+                }
+        } else if (td->status & USB_TD_TX_ER_NAK) {
+                /* there was a NAK response */
+                fhci_vdbg(usb->fhci, "td nack\n");
+                td->nak_cnt++;
+                td->error_cnt = 0;
+                td->status = USB_TD_OK;
+        } else {
+                /* there was no error on transaction */
+                td->error_cnt = 0;
+                td->nak_cnt = 0;
+                td->toggle = !td->toggle;
+                td->actual_len += trans_len;
+                if (td->len == td->actual_len)
+                        td_done = true;
+        }
+        if (td_done)
+                fhci_move_td_from_ed_to_done_list(usb, ed);
+}
+/*
+ * Flush all transmitted packets from BDs
+ * This routine is called when disabling the USB port to flush all
+ * transmissions that are allready scheduled in the BDs
+ */
+void fhci_flush_all_transmissions(struct fhci_usb *usb)
+{
+        u8 mode;
+        struct td *td;
+        mode = in_8(&usb->fhci->regs->usb_mod);
+        clrbits8(&usb->fhci->regs->usb_mod, USB_MODE_EN);
+        fhci_flush_bds(usb);
+        while ((td = fhci_peek_td_from_frame(usb->actual_frame)) != NULL) {
+                struct packet *pkt = td->pkt;
+                pkt->status = USB_TD_TX_ER_TIMEOUT;
+                fhci_transaction_confirm(usb, pkt);
+        }
+        usb->actual_frame->frame_status = FRAME_END_TRANSMISSION;
+        /* reset the event register */
+        out_be16(&usb->fhci->regs->usb_event, 0xffff);
+        /* enable the USB controller */
+        out_8(&usb->fhci->regs->usb_mod, mode | USB_MODE_EN);
+}
+/*
+ * This function forms the packet and transmit the packet. This function
+ * will handle all endpoint type:ISO,interrupt,control and bulk
+ */
+static int add_packet(struct fhci_usb *usb, struct ed *ed, struct td *td)
+{
+        u32 fw_transaction_time, len = 0;
+        struct packet *pkt;
+        u8 *data = NULL;
+        /* calcalate data address,len and toggle and then add the transaction */
+        if (td->toggle == USB_TD_TOGGLE_CARRY)
+                td->toggle = ed->toggle_carry;
+        switch (ed->mode) {
+        case FHCI_TF_ISO:
+                len = td->len;
+                if (td->type != FHCI_TA_IN)
+                        data = td->data;
+                break;
+        case FHCI_TF_CTRL:
+        case FHCI_TF_BULK:
+                len = min(td->len - td->actual_len, ed->max_pkt_size);
+                if (!((td->type == FHCI_TA_IN) &&
+                      ((len + td->actual_len) == td->len)))
+                        data = td->data + td->actual_len;
+                break;
+        case FHCI_TF_INTR:
+                len = min(td->len, ed->max_pkt_size);
+                if (!((td->type == FHCI_TA_IN) &&
+                      ((td->len + CRC_SIZE) >= ed->max_pkt_size)))
+                        data = td->data;
+                break;
+        default:
+                break;
+        }
+        if (usb->port_status == FHCI_PORT_FULL)
+                fw_transaction_time = (((len + PROTOCOL_OVERHEAD) * 11) >> 4);
+        else
+                fw_transaction_time = ((len + PROTOCOL_OVERHEAD) * 6);
+        /* check if there's enough space in this frame to submit this TD */
+        if (usb->actual_frame->total_bytes + len + PROTOCOL_OVERHEAD >=
+                        usb->max_bytes_per_frame) {
+                fhci_vdbg(usb->fhci, "not enough space in this frame: "
+                          "%d %d %d\n", usb->actual_frame->total_bytes, len,
+                          usb->max_bytes_per_frame);
+                return -1;
+        }
+        /* check if there's enough time in this frame to submit this TD */
+        if (usb->actual_frame->frame_status != FRAME_IS_PREPARED &&
+            (usb->actual_frame->frame_status & FRAME_END_TRANSMISSION ||
+             (fw_transaction_time + usb->sw_transaction_time >=
+              1000 - fhci_get_sof_timer_count(usb)))) {
+                fhci_dbg(usb->fhci, "not enough time in this frame\n");
+                return -1;
+        }
+        /* update frame object fields before transmitting */
+        pkt = cq_get(usb->ep0->empty_frame_Q);
+        if (!pkt) {
+                fhci_dbg(usb->fhci, "there is no empty frame\n");
+                return -1;
+        }
+        td->pkt = pkt;
+        pkt->info = 0;
+        if (data == NULL) {
+                data = cq_get(usb->ep0->dummy_packets_Q);
+                BUG_ON(!data);
+                pkt->info = PKT_DUMMY_PACKET;
+        }
+        pkt->data = data;
+        pkt->len = len;
+        pkt->status = USB_TD_OK;
+        /* update TD status field before transmitting */
+        td->status = USB_TD_INPROGRESS;
+        /* update actual frame time object with the actual transmission */
+        usb->actual_frame->total_bytes += (len + PROTOCOL_OVERHEAD);
+        fhci_add_td_to_frame(usb->actual_frame, td);
+        if (usb->port_status != FHCI_PORT_FULL &&
+                        usb->port_status != FHCI_PORT_LOW) {
+                pkt->status = USB_TD_TX_ER_TIMEOUT;
+                pkt->len = 0;
+                fhci_transaction_confirm(usb, pkt);
+        } else if (fhci_host_transaction(usb, pkt, td->type, ed->dev_addr,
+                        ed->ep_addr, ed->mode, ed->speed, td->toggle)) {
+                /* remove TD from actual frame */
+                list_del_init(&td->frame_lh);
+                td->status = USB_TD_OK;
+                if (pkt->info & PKT_DUMMY_PACKET)
+                        cq_put(usb->ep0->dummy_packets_Q, pkt->data);
+                recycle_frame(usb, pkt);
+                usb->actual_frame->total_bytes -= (len + PROTOCOL_OVERHEAD);
+                fhci_err(usb->fhci, "host transaction failed\n");
+                return -1;
+        }
+        return len;
+}
+static void move_head_to_tail(struct list_head *list)
+{
+        struct list_head *node = list->next;
+        if (!list_empty(list)) {
+                list_del(node);
+                list_add_tail(node, list);
+        }
+}
+/*
+ * This function goes through the endpoint list and schedules the
+ * transactions within this list
+ */
+static int scan_ed_list(struct fhci_usb *usb,
+                        struct list_head *list, enum fhci_tf_mode list_type)
+{
+        static const int frame_part[4] = {
+                [FHCI_TF_CTRL] = MAX_BYTES_PER_FRAME,
+                [FHCI_TF_ISO] = (MAX_BYTES_PER_FRAME *
+                                 MAX_PERIODIC_FRAME_USAGE) / 100,
+                [FHCI_TF_BULK] = MAX_BYTES_PER_FRAME,
+                [FHCI_TF_INTR] = (MAX_BYTES_PER_FRAME *
+                                  MAX_PERIODIC_FRAME_USAGE) / 100
+        };
+        struct ed *ed;
+        struct td *td;
+        int ans = 1;
+        u32 save_transaction_time = usb->sw_transaction_time;
+        list_for_each_entry(ed, list, node) {
+                td = ed->td_head;
+                if (!td || (td && td->status == USB_TD_INPROGRESS))
+                        continue;
+                if (ed->state != FHCI_ED_OPER) {
+                        if (ed->state == FHCI_ED_URB_DEL) {
+                                td->status = USB_TD_OK;
+                                fhci_move_td_from_ed_to_done_list(usb, ed);
+                                ed->state = FHCI_ED_SKIP;
+                        }
+                        continue;
+                }
+                /*
+                 * if it isn't interrupt pipe or it is not iso pipe and the
+                 * interval time passed
+                 */
+                if ((list_type == FHCI_TF_INTR || list_type == FHCI_TF_ISO) &&
+                                (((usb->actual_frame->frame_num -
+                                   td->start_frame) & 0x7ff) < td->interval))
+                        continue;
+                if (add_packet(usb, ed, td) < 0)
+                        continue;
+                /* update time stamps in the TD */
+                td->start_frame = usb->actual_frame->frame_num;
+                usb->sw_transaction_time += save_transaction_time;
+                if (usb->actual_frame->total_bytes >=
+                                        usb->max_bytes_per_frame) {
+                        usb->actual_frame->frame_status =
+                                FRAME_DATA_END_TRANSMISSION;
+                        fhci_push_dummy_bd(usb->ep0);
+                        ans = 0;
+                        break;
+                }
+                if (usb->actual_frame->total_bytes >= frame_part[list_type])
+                        break;
+        }
+        /* be fair to each ED(move list head around) */
+        move_head_to_tail(list);
+        usb->sw_transaction_time = save_transaction_time;
+        return ans;
+}
+static u32 rotate_frames(struct fhci_usb *usb)
+{
+        struct fhci_hcd *fhci = usb->fhci;
+        if (!list_empty(&usb->actual_frame->tds_list)) {
+                if ((((in_be16(&fhci->pram->frame_num) & 0x07ff) -
+                      usb->actual_frame->frame_num) & 0x7ff) > 5)
+                        fhci_flush_actual_frame(usb);
+                else
+                        return -EINVAL;
+        }
+        usb->actual_frame->frame_status = FRAME_IS_PREPARED;
+        usb->actual_frame->frame_num = in_be16(&fhci->pram->frame_num) & 0x7ff;
+        usb->actual_frame->total_bytes = 0;
+        return 0;
+}
+/*
+ * This function schedule the USB transaction and will process the
+ * endpoint in the following order: iso, interrupt, control and bulk.
+ */
+void fhci_schedule_transactions(struct fhci_usb *usb)
+{
+        int left = 1;
+        if (usb->actual_frame->frame_status & FRAME_END_TRANSMISSION)
+                if (rotate_frames(usb) != 0)
+                        return;
+        if (usb->actual_frame->frame_status & FRAME_END_TRANSMISSION)
+                return;
+        if (usb->actual_frame->total_bytes == 0) {
+                /*
+                 * schedule the next available ISO transfer
+                 *or next stage of the ISO transfer
+                 */
+                scan_ed_list(usb, &usb->hc_list->iso_list, FHCI_TF_ISO);
+                /*
+                 * schedule the next available interrupt transfer or
+                 * the next stage of the interrupt transfer
+                 */
+                scan_ed_list(usb, &usb->hc_list->intr_list, FHCI_TF_INTR);
+                /*
+                 * schedule the next available control transfer
+                 * or the next stage of the control transfer
+                 */
+                left = scan_ed_list(usb, &usb->hc_list->ctrl_list,
+                                    FHCI_TF_CTRL);
+        }
+        /*
+         * schedule the next available bulk transfer or the next stage of the
+         * bulk transfer
+         */
+        if (left > 0)
+                scan_ed_list(usb, &usb->hc_list->bulk_list, FHCI_TF_BULK);
+}
+/* Handles SOF interrupt */
+static void sof_interrupt(struct fhci_hcd *fhci)
+{
+        struct fhci_usb *usb = fhci->usb_lld;
+        if ((usb->port_status == FHCI_PORT_DISABLED) &&
+            (usb->vroot_hub->port.wPortStatus & USB_PORT_STAT_CONNECTION) &&
+            !(usb->vroot_hub->port.wPortChange & USB_PORT_STAT_C_CONNECTION)) {
+                if (usb->vroot_hub->port.wPortStatus & USB_PORT_STAT_LOW_SPEED)
+                        usb->port_status = FHCI_PORT_LOW;
+                else
+                        usb->port_status = FHCI_PORT_FULL;
+                /* Disable IDLE */
+                usb->saved_msk &= ~USB_E_IDLE_MASK;
+                out_be16(&usb->fhci->regs->usb_mask, usb->saved_msk);
+        }
+        gtm_set_exact_timer16(fhci->timer, usb->max_frame_usage, false);
+        fhci_host_transmit_actual_frame(usb);
+        usb->actual_frame->frame_status = FRAME_IS_TRANSMITTED;
+        fhci_schedule_transactions(usb);
+}
+/* Handles device disconnected interrupt on port */
+void fhci_device_disconnected_interrupt(struct fhci_hcd *fhci)
+{
+        struct fhci_usb *usb = fhci->usb_lld;
+        fhci_dbg(fhci, "-> %s\n", __func__);
+        fhci_usb_disable_interrupt(usb);
+        clrbits8(&usb->fhci->regs->usb_mod, USB_MODE_LSS);
+        usb->port_status = FHCI_PORT_DISABLED;
+        fhci_stop_sof_timer(fhci);
+        /* Enable IDLE since we want to know if something comes along */
+        usb->saved_msk |= USB_E_IDLE_MASK;
+        out_be16(&usb->fhci->regs->usb_mask, usb->saved_msk);
+        usb->vroot_hub->port.wPortStatus &= ~USB_PORT_STAT_CONNECTION;
+        usb->vroot_hub->port.wPortChange |= USB_PORT_STAT_C_CONNECTION;
+        usb->max_bytes_per_frame = 0;
+        fhci_usb_enable_interrupt(usb);
+        fhci_dbg(fhci, "<- %s\n", __func__);
+}
+/* detect a new device connected on the USB port */
+void fhci_device_connected_interrupt(struct fhci_hcd *fhci)
+{
+        struct fhci_usb *usb = fhci->usb_lld;
+        int state;
+        int ret;
+        fhci_dbg(fhci, "-> %s\n", __func__);
+        fhci_usb_disable_interrupt(usb);
+        state = fhci_ioports_check_bus_state(fhci);
+        /* low-speed device was connected to the USB port */
+        if (state == 1) {
+                ret = qe_usb_clock_set(fhci->lowspeed_clk, USB_CLOCK >> 3);
+                if (ret) {
+                        fhci_warn(fhci, "Low-Speed device is not supported, "
+                                  "try use BRGx\n");
+                        goto out;
+                }
+                usb->port_status = FHCI_PORT_LOW;
+                setbits8(&usb->fhci->regs->usb_mod, USB_MODE_LSS);
+                usb->vroot_hub->port.wPortStatus |=
+                    (USB_PORT_STAT_LOW_SPEED |
+                     USB_PORT_STAT_CONNECTION);
+                usb->vroot_hub->port.wPortChange |=
+                    USB_PORT_STAT_C_CONNECTION;
+                usb->max_bytes_per_frame =
+                    (MAX_BYTES_PER_FRAME >> 3) - 7;
+                fhci_port_enable(usb);
+        } else if (state == 2) {
+                ret = qe_usb_clock_set(fhci->fullspeed_clk, USB_CLOCK);
+                if (ret) {
+                        fhci_warn(fhci, "Full-Speed device is not supported, "
+                                  "try use CLKx\n");
+                        goto out;
+                }
+                usb->port_status = FHCI_PORT_FULL;
+                clrbits8(&usb->fhci->regs->usb_mod, USB_MODE_LSS);
+                usb->vroot_hub->port.wPortStatus &=
+                    ~USB_PORT_STAT_LOW_SPEED;
+                usb->vroot_hub->port.wPortStatus |=
+                    USB_PORT_STAT_CONNECTION;
+                usb->vroot_hub->port.wPortChange |=
+                    USB_PORT_STAT_C_CONNECTION;
+                usb->max_bytes_per_frame = (MAX_BYTES_PER_FRAME - 15);
+                fhci_port_enable(usb);
+        }
+out:
+        fhci_usb_enable_interrupt(usb);
+        fhci_dbg(fhci, "<- %s\n", __func__);
+}
+irqreturn_t fhci_frame_limit_timer_irq(int irq, void *_hcd)
+{
+        struct usb_hcd *hcd = _hcd;
+        struct fhci_hcd *fhci = hcd_to_fhci(hcd);
+        struct fhci_usb *usb = fhci->usb_lld;
+        spin_lock(&fhci->lock);
+        gtm_set_exact_timer16(fhci->timer, 1000, false);
+        if (usb->actual_frame->frame_status == FRAME_IS_TRANSMITTED) {
+                usb->actual_frame->frame_status = FRAME_TIMER_END_TRANSMISSION;
+                fhci_push_dummy_bd(usb->ep0);
+        }
+        fhci_schedule_transactions(usb);
+        spin_unlock(&fhci->lock);
+        return IRQ_HANDLED;
+}
+/* Cancel transmission on the USB endpoint */
+static void abort_transmission(struct fhci_usb *usb)
+{
+        fhci_dbg(usb->fhci, "-> %s\n", __func__);
+        /* issue stop Tx command */
+        qe_issue_cmd(QE_USB_STOP_TX, QE_CR_SUBBLOCK_USB, EP_ZERO, 0);
+        /* flush Tx FIFOs */
+        out_8(&usb->fhci->regs->usb_comm, USB_CMD_FLUSH_FIFO | EP_ZERO);
+        udelay(1000);
+        /* reset Tx BDs */
+        fhci_flush_bds(usb);
+        /* issue restart Tx command */
+        qe_issue_cmd(QE_USB_RESTART_TX, QE_CR_SUBBLOCK_USB, EP_ZERO, 0);
+        fhci_dbg(usb->fhci, "<- %s\n", __func__);
+}
+irqreturn_t fhci_irq(struct usb_hcd *hcd)
+{
+        struct fhci_hcd *fhci = hcd_to_fhci(hcd);
+        struct fhci_usb *usb;
+        u16 usb_er = 0;
+        unsigned long flags;
+        spin_lock_irqsave(&fhci->lock, flags);
+        usb = fhci->usb_lld;
+        usb_er |= in_be16(&usb->fhci->regs->usb_event) &
+                  in_be16(&usb->fhci->regs->usb_mask);
+        /* clear event bits for next time */
+        out_be16(&usb->fhci->regs->usb_event, usb_er);
+        fhci_dbg_isr(fhci, usb_er);
+        if (usb_er & USB_E_RESET_MASK) {
+                if ((usb->port_status == FHCI_PORT_FULL) ||
+                                (usb->port_status == FHCI_PORT_LOW)) {
+                        fhci_device_disconnected_interrupt(fhci);
+                        usb_er &= ~USB_E_IDLE_MASK;
+                } else if (usb->port_status == FHCI_PORT_WAITING) {
+                        usb->port_status = FHCI_PORT_DISCONNECTING;
+                        /* Turn on IDLE since we want to disconnect */
+                        usb->saved_msk |= USB_E_IDLE_MASK;
+                        out_be16(&usb->fhci->regs->usb_event,
+                                 usb->saved_msk);
+                } else if (usb->port_status == FHCI_PORT_DISABLED) {
+                        if (fhci_ioports_check_bus_state(fhci) == 1 &&
+                                        usb->port_status != FHCI_PORT_LOW &&
+                                        usb->port_status != FHCI_PORT_FULL)
+                                fhci_device_connected_interrupt(fhci);
+                }
+                usb_er &= ~USB_E_RESET_MASK;
+        }
+        if (usb_er & USB_E_MSF_MASK) {
+                abort_transmission(fhci->usb_lld);
+                usb_er &= ~USB_E_MSF_MASK;
+        }
+        if (usb_er & (USB_E_SOF_MASK | USB_E_SFT_MASK)) {
+                sof_interrupt(fhci);
+                usb_er &= ~(USB_E_SOF_MASK | USB_E_SFT_MASK);
+        }
+        if (usb_er & USB_E_TXB_MASK) {
+                fhci_tx_conf_interrupt(fhci->usb_lld);
+                usb_er &= ~USB_E_TXB_MASK;
+        }
+        if (usb_er & USB_E_TXE1_MASK) {
+                fhci_tx_conf_interrupt(fhci->usb_lld);
+                usb_er &= ~USB_E_TXE1_MASK;
+        }
+        if (usb_er & USB_E_IDLE_MASK) {
+                if (usb->port_status == FHCI_PORT_DISABLED &&
+                                usb->port_status != FHCI_PORT_LOW &&
+                                usb->port_status != FHCI_PORT_FULL) {
+                        usb_er &= ~USB_E_RESET_MASK;
+                        fhci_device_connected_interrupt(fhci);
+                } else if (usb->port_status ==
+                                FHCI_PORT_DISCONNECTING) {
+                        /* XXX usb->port_status = FHCI_PORT_WAITING; */
+                        /* Disable IDLE */
+                        usb->saved_msk &= ~USB_E_IDLE_MASK;
+                        out_be16(&usb->fhci->regs->usb_mask,
+                                 usb->saved_msk);
+                } else {
+                        fhci_dbg_isr(fhci, -1);
+                }
+                usb_er &= ~USB_E_IDLE_MASK;
+        }
+        spin_unlock_irqrestore(&fhci->lock, flags);
+        return IRQ_HANDLED;
+}
+/*
+ * Process normal completions(error or sucess) and clean the schedule.
+ *
+ * This is the main path for handing urbs back to drivers. The only other patth
+ * is process_del_list(),which unlinks URBs by scanning EDs,instead of scanning
+ * the (re-reversed) done list as this does.
+ */
+static void process_done_list(unsigned long data)
+{
+        struct urb *urb;
+        struct ed *ed;
+        struct td *td;
+        struct urb_priv *urb_priv;
+        struct fhci_hcd *fhci = (struct fhci_hcd *)data;
+        disable_irq(fhci->timer->irq);
+        disable_irq(fhci_to_hcd(fhci)->irq);
+        spin_lock(&fhci->lock);
+        td = fhci_remove_td_from_done_list(fhci->hc_list);
+        while (td != NULL) {
+                urb = td->urb;
+                urb_priv = urb->hcpriv;
+                ed = td->ed;
+                /* update URB's length and status from TD */
+                fhci_done_td(urb, td);
+                urb_priv->tds_cnt++;
+                /*
+                 * if all this urb's TDs are done, call complete()
+                 * Interrupt transfers are the onley special case:
+                 * they are reissued,until "deleted" by usb_unlink_urb
+                 * (real work done in a SOF intr, by process_del_list)
+                 */
+                if (urb_priv->tds_cnt == urb_priv->num_of_tds) {
+                        fhci_urb_complete_free(fhci, urb);
+                } else if (urb_priv->state == URB_DEL &&
+                                ed->state == FHCI_ED_SKIP) {
+                        fhci_del_ed_list(fhci, ed);
+                        ed->state = FHCI_ED_OPER;
+                } else if (ed->state == FHCI_ED_HALTED) {
+                        urb_priv->state = URB_DEL;
+                        ed->state = FHCI_ED_URB_DEL;
+                        fhci_del_ed_list(fhci, ed);
+                        ed->state = FHCI_ED_OPER;
+                }
+                td = fhci_remove_td_from_done_list(fhci->hc_list);
+        }
+        spin_unlock(&fhci->lock);
+        enable_irq(fhci->timer->irq);
+        enable_irq(fhci_to_hcd(fhci)->irq);
+}
+DECLARE_TASKLET(fhci_tasklet, process_done_list, 0);
+/* transfer complted callback */
+u32 fhci_transfer_confirm_callback(struct fhci_hcd *fhci)
+{
+        if (!fhci->process_done_task->state)
+                tasklet_schedule(fhci->process_done_task);
+        return 0;
+}
+/*
+ * adds urb to the endpoint descriptor list
+ * arguments:
+ * fhci         data structure for the Low level host controller
+ * ep           USB Host endpoint data structure
+ * urb          USB request block data structure
+ */
+void fhci_queue_urb(struct fhci_hcd *fhci, struct urb *urb)
+{
+        struct ed *ed = urb->ep->hcpriv;
+        struct urb_priv *urb_priv = urb->hcpriv;
+        u32 data_len = urb->transfer_buffer_length;
+        int urb_state = 0;
+        int toggle = 0;
+        struct td *td;
+        u8 *data;
+        u16 cnt = 0;
+        if (ed == NULL) {
+                ed = fhci_get_empty_ed(fhci);
+                ed->dev_addr = usb_pipedevice(urb->pipe);
+                ed->ep_addr = usb_pipeendpoint(urb->pipe);
+                switch (usb_pipetype(urb->pipe)) {
+                case PIPE_CONTROL:
+                        ed->mode = FHCI_TF_CTRL;
+                        break;
+                case PIPE_BULK:
+                        ed->mode = FHCI_TF_BULK;
+                        break;
+                case PIPE_INTERRUPT:
+                        ed->mode = FHCI_TF_INTR;
+                        break;
+                case PIPE_ISOCHRONOUS:
+                        ed->mode = FHCI_TF_ISO;
+                        break;
+                default:
+                        break;
+                }
+                ed->speed = (urb->dev->speed == USB_SPEED_LOW) ?
+                        FHCI_LOW_SPEED : FHCI_FULL_SPEED;
+                ed->max_pkt_size = usb_maxpacket(urb->dev,
+                        urb->pipe, usb_pipeout(urb->pipe));
+                urb->ep->hcpriv = ed;
+                fhci_dbg(fhci, "new ep speed=%d max_pkt_size=%d\n",
+                         ed->speed, ed->max_pkt_size);
+        }
+        /* for ISO transfer calculate start frame index */
+        if (ed->mode == FHCI_TF_ISO && urb->transfer_flags & URB_ISO_ASAP)
+                urb->start_frame = ed->td_head ? ed->last_iso + 1 :
+                                                 get_frame_num(fhci);
+        /*
+         * OHCI handles the DATA toggle itself,we just use the USB
+         * toggle bits
+         */
+        if (usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe),
+                          usb_pipeout(urb->pipe)))
+                toggle = USB_TD_TOGGLE_CARRY;
+        else {
+                toggle = USB_TD_TOGGLE_DATA0;
+                usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
+                              usb_pipeout(urb->pipe), 1);
+        }
+        urb_priv->tds_cnt = 0;
+        urb_priv->ed = ed;
+        if (data_len > 0)
+                data = urb->transfer_buffer;
+        else
+                data = NULL;
+        switch (ed->mode) {
+        case FHCI_TF_BULK:
+                if (urb->transfer_flags & URB_ZERO_PACKET &&
+                                urb->transfer_buffer_length > 0 &&
+                                ((urb->transfer_buffer_length %
+                                usb_maxpacket(urb->dev, urb->pipe,
+                                usb_pipeout(urb->pipe))) == 0))
+                        urb_state = US_BULK0;
+                while (data_len > 4096) {
+                        td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt,
+                                usb_pipeout(urb->pipe) ? FHCI_TA_OUT :
+                                                         FHCI_TA_IN,
+                                cnt ? USB_TD_TOGGLE_CARRY :
+                                      toggle,
+                                data, 4096, 0, 0, true);
+                        data += 4096;
+                        data_len -= 4096;
+                        cnt++;
+                }
+                td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt,
+                        usb_pipeout(urb->pipe) ? FHCI_TA_OUT : FHCI_TA_IN,
+                        cnt ? USB_TD_TOGGLE_CARRY : toggle,
+                        data, data_len, 0, 0, true);
+                cnt++;
+                if (urb->transfer_flags & URB_ZERO_PACKET &&
+                                cnt < urb_priv->num_of_tds) {
+                        td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt,
+                                usb_pipeout(urb->pipe) ? FHCI_TA_OUT :
+                                                         FHCI_TA_IN,
+                                USB_TD_TOGGLE_CARRY, NULL, 0, 0, 0, true);
+                        cnt++;
+                }
+                break;
+        case FHCI_TF_INTR:
+                urb->start_frame = get_frame_num(fhci) + 1;
+                td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt++,
+                        usb_pipeout(urb->pipe) ? FHCI_TA_OUT : FHCI_TA_IN,
+                        USB_TD_TOGGLE_DATA0, data, data_len,
+                        urb->interval, urb->start_frame, true);
+                break;
+        case FHCI_TF_CTRL:
+                ed->dev_addr = usb_pipedevice(urb->pipe);
+                ed->max_pkt_size = usb_maxpacket(urb->dev, urb->pipe,
+                        usb_pipeout(urb->pipe));
+                td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt++, FHCI_TA_SETUP,
+                        USB_TD_TOGGLE_DATA0, urb->setup_packet, 8, 0, 0, true);
+                if (data_len > 0) {
+                        td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt++,
+                                usb_pipeout(urb->pipe) ? FHCI_TA_OUT :
+                                                         FHCI_TA_IN,
+                                USB_TD_TOGGLE_DATA1, data, data_len, 0, 0,
+                                true);
+                }
+                td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt++,
+                        usb_pipeout(urb->pipe) ? FHCI_TA_IN : FHCI_TA_OUT,
+                        USB_TD_TOGGLE_DATA1, data, 0, 0, 0, true);
+                urb_state = US_CTRL_SETUP;
+                break;
+        case FHCI_TF_ISO:
+                for (cnt = 0; cnt < urb->number_of_packets; cnt++) {
+                        u16 frame = urb->start_frame;
+                        /*
+                         * FIXME scheduling should handle frame counter
+                         * roll-around ... exotic case (and OHCI has
+                         * a 2^16 iso range, vs other HCs max of 2^10)
+                         */
+                        frame += cnt * urb->interval;
+                        frame &= 0x07ff;
+                        td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt,
+                                usb_pipeout(urb->pipe) ? FHCI_TA_OUT :
+                                                         FHCI_TA_IN,
+                                USB_TD_TOGGLE_DATA0,
+                                data + urb->iso_frame_desc[cnt].offset,
+                                urb->iso_frame_desc[cnt].length,
+                                urb->interval, frame, true);
+                }
+                break;
+        default:
+                break;
+        }
+        /*
+         * set the state of URB
+         * control pipe:3 states -- setup,data,status
+         * interrupt and bulk pipe:1 state -- data
+         */
+        urb->pipe &= ~0x1f;
+        urb->pipe |= urb_state & 0x1f;
+        urb_priv->state = URB_INPROGRESS;
+        if (!ed->td_head) {
+                ed->state = FHCI_ED_OPER;
+                switch (ed->mode) {
+                case FHCI_TF_CTRL:
+                        list_add(&ed->node, &fhci->hc_list->ctrl_list);
+                        break;
+                case FHCI_TF_BULK:
+                        list_add(&ed->node, &fhci->hc_list->bulk_list);
+                        break;
+                case FHCI_TF_INTR:
+                        list_add(&ed->node, &fhci->hc_list->intr_list);
+                        break;
+                case FHCI_TF_ISO:
+                        list_add(&ed->node, &fhci->hc_list->iso_list);
+                        break;
+                default:
+                        break;
+                }
+        }
+        fhci_add_tds_to_ed(ed, urb_priv->tds, urb_priv->num_of_tds);
+        fhci->active_urbs++;
+}
diff --git a/drivers/usb/host/fhci-tds.c b/drivers/usb/host/fhci-tds.c
new file mode 100644
index 000000000000..b40332290319
--- /dev/null
+++ b/drivers/usb/host/fhci-tds.c
@@ -0,0 +1,626 @@
+/*
+ * Freescale QUICC Engine USB Host Controller Driver
+ *
+ * Copyright (c) Freescale Semicondutor, Inc. 2006.
+ *               Shlomi Gridish <gridish@freescale.com>
+ *               Jerry Huang <Chang-Ming.Huang@freescale.com>
+ * Copyright (c) Logic Product Development, Inc. 2007
+ *               Peter Barada <peterb@logicpd.com>
+ * Copyright (c) MontaVista Software, Inc. 2008.
+ *               Anton Vorontsov <avorontsov@ru.mvista.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/list.h>
+#include <linux/io.h>
+#include <linux/usb.h>
+#include "../core/hcd.h"
+#include "fhci.h"
+#define DUMMY_BD_BUFFER  0xdeadbeef
+#define DUMMY2_BD_BUFFER 0xbaadf00d
+/* Transaction Descriptors bits */
+#define TD_R            0x8000 /* ready bit */
+#define TD_W            0x2000 /* wrap bit */
+#define TD_I            0x1000 /* interrupt on completion */
+#define TD_L            0x0800 /* last */
+#define TD_TC           0x0400 /* transmit CRC */
+#define TD_CNF          0x0200 /* CNF - Must be always 1 */
+#define TD_LSP          0x0100 /* Low-speed transaction */
+#define TD_PID          0x00c0 /* packet id */
+#define TD_RXER         0x0020 /* Rx error or not */
+#define TD_NAK          0x0010 /* No ack. */
+#define TD_STAL         0x0008 /* Stall recieved */
+#define TD_TO           0x0004 /* time out */
+#define TD_UN           0x0002 /* underrun */
+#define TD_NO           0x0010 /* Rx Non Octet Aligned Packet */
+#define TD_AB           0x0008 /* Frame Aborted */
+#define TD_CR           0x0004 /* CRC Error */
+#define TD_OV           0x0002 /* Overrun */
+#define TD_BOV          0x0001 /* Buffer Overrun */
+#define TD_ERRORS       (TD_NAK | TD_STAL | TD_TO | TD_UN | \
+                         TD_NO | TD_AB | TD_CR | TD_OV | TD_BOV)
+#define TD_PID_DATA0    0x0080 /* Data 0 toggle */
+#define TD_PID_DATA1    0x00c0 /* Data 1 toggle */
+#define TD_PID_TOGGLE   0x00c0 /* Data 0/1 toggle mask */
+#define TD_TOK_SETUP    0x0000
+#define TD_TOK_OUT      0x4000
+#define TD_TOK_IN       0x8000
+#define TD_ISO          0x1000
+#define TD_ENDP         0x0780
+#define TD_ADDR         0x007f
+#define TD_ENDP_SHIFT 7
+struct usb_td {
+        __be16 status;
+        __be16 length;
+        __be32 buf_ptr;
+        __be16 extra;
+        __be16 reserved;
+};
+static struct usb_td __iomem *next_bd(struct usb_td __iomem *base,
+                                      struct usb_td __iomem *td,
+                                      u16 status)
+{
+        if (status & TD_W)
+                return base;
+        else
+                return ++td;
+}
+void fhci_push_dummy_bd(struct endpoint *ep)
+{
+        if (ep->already_pushed_dummy_bd == false) {
+                u16 td_status = in_be16(&ep->empty_td->status);
+                out_be32(&ep->empty_td->buf_ptr, DUMMY_BD_BUFFER);
+                /* get the next TD in the ring */
+                ep->empty_td = next_bd(ep->td_base, ep->empty_td, td_status);
+                ep->already_pushed_dummy_bd = true;
+        }
+}
+/* destroy an USB endpoint */
+void fhci_ep0_free(struct fhci_usb *usb)
+{
+        struct endpoint *ep;
+        int size;
+        ep = usb->ep0;
+        if (ep) {
+                if (ep->td_base)
+                        cpm_muram_free(cpm_muram_offset(ep->td_base));
+                if (ep->conf_frame_Q) {
+                        size = cq_howmany(ep->conf_frame_Q);
+                        for (; size; size--) {
+                                struct packet *pkt = cq_get(ep->conf_frame_Q);
+                                kfree(pkt);
+                        }
+                        cq_delete(ep->conf_frame_Q);
+                }
+                if (ep->empty_frame_Q) {
+                        size = cq_howmany(ep->empty_frame_Q);
+                        for (; size; size--) {
+                                struct packet *pkt = cq_get(ep->empty_frame_Q);
+                                kfree(pkt);
+                        }
+                        cq_delete(ep->empty_frame_Q);
+                }
+                if (ep->dummy_packets_Q) {
+                        size = cq_howmany(ep->dummy_packets_Q);
+                        for (; size; size--) {
+                                u8 *buff = cq_get(ep->dummy_packets_Q);
+                                kfree(buff);
+                        }
+                        cq_delete(ep->dummy_packets_Q);
+                }
+                kfree(ep);
+                usb->ep0 = NULL;
+        }
+}
+/*
+ * create the endpoint structure
+ *
+ * arguments:
+ * usb          A pointer to the data structure of the USB
+ * data_mem     The data memory partition(BUS)
+ * ring_len     TD ring length
+ */
+u32 fhci_create_ep(struct fhci_usb *usb, enum fhci_mem_alloc data_mem,
+                           u32 ring_len)
+{
+        struct endpoint *ep;
+        struct usb_td __iomem *td;
+        unsigned long ep_offset;
+        char *err_for = "enpoint PRAM";
+        int ep_mem_size;
+        u32 i;
+        /* we need at least 3 TDs in the ring */
+        if (!(ring_len > 2)) {
+                fhci_err(usb->fhci, "illegal TD ring length parameters\n");
+                return -EINVAL;
+        }
+        ep = kzalloc(sizeof(*ep), GFP_KERNEL);
+        if (!ep)
+                return -ENOMEM;
+        ep_mem_size = ring_len * sizeof(*td) + sizeof(struct fhci_ep_pram);
+        ep_offset = cpm_muram_alloc(ep_mem_size, 32);
+        if (IS_ERR_VALUE(ep_offset))
+                goto err;
+        ep->td_base = cpm_muram_addr(ep_offset);
+        /* zero all queue pointers */
+        ep->conf_frame_Q = cq_new(ring_len + 2);
+        ep->empty_frame_Q = cq_new(ring_len + 2);
+        ep->dummy_packets_Q = cq_new(ring_len + 2);
+        if (!ep->conf_frame_Q || !ep->empty_frame_Q || !ep->dummy_packets_Q) {
+                err_for = "frame_queues";
+                goto err;
+        }
+        for (i = 0; i < (ring_len + 1); i++) {
+                struct packet *pkt;
+                u8 *buff;
+                pkt = kmalloc(sizeof(*pkt), GFP_KERNEL);
+                if (!pkt) {
+                        err_for = "frame";
+                        goto err;
+                }
+                buff = kmalloc(1028 * sizeof(*buff), GFP_KERNEL);
+                if (!buff) {
+                        kfree(pkt);
+                        err_for = "buffer";
+                        goto err;
+                }
+                cq_put(ep->empty_frame_Q, pkt);
+                cq_put(ep->dummy_packets_Q, buff);
+        }
+        /* we put the endpoint parameter RAM right behind the TD ring */
+        ep->ep_pram_ptr = (void __iomem *)ep->td_base + sizeof(*td) * ring_len;
+        ep->conf_td = ep->td_base;
+        ep->empty_td = ep->td_base;
+        ep->already_pushed_dummy_bd = false;
+        /* initialize tds */
+        td = ep->td_base;
+        for (i = 0; i < ring_len; i++) {
+                out_be32(&td->buf_ptr, 0);
+                out_be16(&td->status, 0);
+                out_be16(&td->length, 0);
+                out_be16(&td->extra, 0);
+                td++;
+        }
+        td--;
+        out_be16(&td->status, TD_W); /* for last TD set Wrap bit */
+        out_be16(&td->length, 0);
+        /* endpoint structure has been created */
+        usb->ep0 = ep;
+        return 0;
+err:
+        fhci_ep0_free(usb);
+        kfree(ep);
+        fhci_err(usb->fhci, "no memory for the %s\n", err_for);
+        return -ENOMEM;
+}
+/*
+ * initialize the endpoint register according to the given parameters
+ *
+ * artuments:
+ * usb          A pointer to the data strucutre of the USB
+ * ep           A pointer to the endpoint structre
+ * data_mem     The data memory partition(BUS)
+ */
+void fhci_init_ep_registers(struct fhci_usb *usb, struct endpoint *ep,
+                            enum fhci_mem_alloc data_mem)
+{
+        u8 rt;
+        /* set the endpoint registers according to the endpoint */
+        out_be16(&usb->fhci->regs->usb_ep[0],
+                 USB_TRANS_CTR | USB_EP_MF | USB_EP_RTE);
+        out_be16(&usb->fhci->pram->ep_ptr[0],
+                 cpm_muram_offset(ep->ep_pram_ptr));
+        rt = (BUS_MODE_BO_BE | BUS_MODE_GBL);
+#ifdef MULTI_DATA_BUS
+        if (data_mem == MEM_SECONDARY)
+                rt |= BUS_MODE_DTB;
+#endif
+        out_8(&ep->ep_pram_ptr->rx_func_code, rt);
+        out_8(&ep->ep_pram_ptr->tx_func_code, rt);
+        out_be16(&ep->ep_pram_ptr->rx_buff_len, 1028);
+        out_be16(&ep->ep_pram_ptr->rx_base, 0);
+        out_be16(&ep->ep_pram_ptr->tx_base, cpm_muram_offset(ep->td_base));
+        out_be16(&ep->ep_pram_ptr->rx_bd_ptr, 0);
+        out_be16(&ep->ep_pram_ptr->tx_bd_ptr, cpm_muram_offset(ep->td_base));
+        out_be32(&ep->ep_pram_ptr->tx_state, 0);
+}
+/*
+ * Collect the submitted frames and inform the application about them
+ * It is also prepearing the TDs for new frames. If the Tx interrupts
+ * are diabled, the application should call that routine to get
+ * confirmation about the submitted frames. Otherwise, the routine is
+ * called frome the interrupt service routine during the Tx interrupt.
+ * In that case the application is informed by calling the application
+ * specific 'fhci_transaction_confirm' routine
+ */
+static void fhci_td_transaction_confirm(struct fhci_usb *usb)
+{
+        struct endpoint *ep = usb->ep0;
+        struct packet *pkt;
+        struct usb_td __iomem *td;
+        u16 extra_data;
+        u16 td_status;
+        u16 td_length;
+        u32 buf;
+        /*
+         * collect transmitted BDs from the chip. The routine clears all BDs
+         * with R bit = 0 and the pointer to data buffer is not NULL, that is
+         * BDs which point to the transmitted data buffer
+         */
+        while (1) {
+                td = ep->conf_td;
+                td_status = in_be16(&td->status);
+                td_length = in_be16(&td->length);
+                buf = in_be32(&td->buf_ptr);
+                extra_data = in_be16(&td->extra);
+                /* check if the TD is empty */
+                if (!(!(td_status & TD_R) && ((td_status & ~TD_W) || buf)))
+                        break;
+                /* check if it is a dummy buffer */
+                else if ((buf == DUMMY_BD_BUFFER) && !(td_status & ~TD_W))
+                        break;
+                /* mark TD as empty */
+                clrbits16(&td->status, ~TD_W);
+                out_be16(&td->length, 0);
+                out_be32(&td->buf_ptr, 0);
+                out_be16(&td->extra, 0);
+                /* advance the TD pointer */
+                ep->conf_td = next_bd(ep->td_base, ep->conf_td, td_status);
+                /* check if it is a dummy buffer(type2) */
+                if ((buf == DUMMY2_BD_BUFFER) && !(td_status & ~TD_W))
+                        continue;
+                pkt = cq_get(ep->conf_frame_Q);
+                if (!pkt)
+                        fhci_err(usb->fhci, "no frame to confirm\n");
+                if (td_status & TD_ERRORS) {
+                        if (td_status & TD_RXER) {
+                                if (td_status & TD_CR)
+                                        pkt->status = USB_TD_RX_ER_CRC;
+                                else if (td_status & TD_AB)
+                                        pkt->status = USB_TD_RX_ER_BITSTUFF;
+                                else if (td_status & TD_OV)
+                                        pkt->status = USB_TD_RX_ER_OVERUN;
+                                else if (td_status & TD_BOV)
+                                        pkt->status = USB_TD_RX_DATA_OVERUN;
+                                else if (td_status & TD_NO)
+                                        pkt->status = USB_TD_RX_ER_NONOCT;
+                                else
+                                        fhci_err(usb->fhci, "illegal error "
+                                                 "occured\n");
+                        } else if (td_status & TD_NAK)
+                                pkt->status = USB_TD_TX_ER_NAK;
+                        else if (td_status & TD_TO)
+                                pkt->status = USB_TD_TX_ER_TIMEOUT;
+                        else if (td_status & TD_UN)
+                                pkt->status = USB_TD_TX_ER_UNDERUN;
+                        else if (td_status & TD_STAL)
+                                pkt->status = USB_TD_TX_ER_STALL;
+                        else
+                                fhci_err(usb->fhci, "illegal error occured\n");
+                } else if ((extra_data & TD_TOK_IN) &&
+                                pkt->len > td_length - CRC_SIZE) {
+                        pkt->status = USB_TD_RX_DATA_UNDERUN;
+                }
+                if (extra_data & TD_TOK_IN)
+                        pkt->len = td_length - CRC_SIZE;
+                else if (pkt->info & PKT_ZLP)
+                        pkt->len = 0;
+                else
+                        pkt->len = td_length;
+                fhci_transaction_confirm(usb, pkt);
+        }
+}
+/*
+ * Submitting a data frame to a specified endpoint of a USB device
+ * The frame is put in the driver's transmit queue for this endpoint
+ *
+ * Arguments:
+ * usb          A pointer to the USB structure
+ * pkt          A pointer to the user frame structure
+ * trans_type   Transaction tyep - IN,OUT or SETUP
+ * dest_addr    Device address - 0~127
+ * dest_ep      Endpoint number of the device - 0~16
+ * trans_mode   Pipe type - ISO,Interrupt,bulk or control
+ * dest_speed   USB speed - Low speed or FULL speed
+ * data_toggle  Data sequence toggle - 0 or 1
+ */
+u32 fhci_host_transaction(struct fhci_usb *usb,
+                          struct packet *pkt,
+                          enum fhci_ta_type trans_type,
+                          u8 dest_addr,
+                          u8 dest_ep,
+                          enum fhci_tf_mode trans_mode,
+                          enum fhci_speed dest_speed, u8 data_toggle)
+{
+        struct endpoint *ep = usb->ep0;
+        struct usb_td __iomem *td;
+        u16 extra_data;
+        u16 td_status;
+        fhci_usb_disable_interrupt(usb);
+        /* start from the next BD that should be filled */
+        td = ep->empty_td;
+        td_status = in_be16(&td->status);
+        if (td_status & TD_R && in_be16(&td->length)) {
+                /* if the TD is not free */
+                fhci_usb_enable_interrupt(usb);
+                return -1;
+        }
+        /* get the next TD in the ring */
+        ep->empty_td = next_bd(ep->td_base, ep->empty_td, td_status);
+        fhci_usb_enable_interrupt(usb);
+        pkt->priv_data = td;
+        out_be32(&td->buf_ptr, virt_to_phys(pkt->data));
+        /* sets up transaction parameters - addr,endp,dir,and type */
+        extra_data = (dest_ep << TD_ENDP_SHIFT) | dest_addr;
+        switch (trans_type) {
+        case FHCI_TA_IN:
+                extra_data |= TD_TOK_IN;
+                break;
+        case FHCI_TA_OUT:
+                extra_data |= TD_TOK_OUT;
+                break;
+        case FHCI_TA_SETUP:
+                extra_data |= TD_TOK_SETUP;
+                break;
+        }
+        if (trans_mode == FHCI_TF_ISO)
+                extra_data |= TD_ISO;
+        out_be16(&td->extra, extra_data);
+        /* sets up the buffer descriptor */
+        td_status = ((td_status & TD_W) | TD_R | TD_L | TD_I | TD_CNF);
+        if (!(pkt->info & PKT_NO_CRC))
+                td_status |= TD_TC;
+        switch (trans_type) {
+        case FHCI_TA_IN:
+                if (data_toggle)
+                        pkt->info |= PKT_PID_DATA1;
+                else
+                        pkt->info |= PKT_PID_DATA0;
+                break;
+        default:
+                if (data_toggle) {
+                        td_status |= TD_PID_DATA1;
+                        pkt->info |= PKT_PID_DATA1;
+                } else {
+                        td_status |= TD_PID_DATA0;
+                        pkt->info |= PKT_PID_DATA0;
+                }
+                break;
+        }
+        if ((dest_speed == FHCI_LOW_SPEED) &&
+            (usb->port_status == FHCI_PORT_FULL))
+                td_status |= TD_LSP;
+        out_be16(&td->status, td_status);
+        /* set up buffer length */
+        if (trans_type == FHCI_TA_IN)
+                out_be16(&td->length, pkt->len + CRC_SIZE);
+        else
+                out_be16(&td->length, pkt->len);
+        /* put the frame to the confirmation queue */
+        cq_put(ep->conf_frame_Q, pkt);
+        if (cq_howmany(ep->conf_frame_Q) == 1)
+                out_8(&usb->fhci->regs->usb_comm, USB_CMD_STR_FIFO);
+        return 0;
+}
+/* Reset the Tx BD ring */
+void fhci_flush_bds(struct fhci_usb *usb)
+{
+        u16 extra_data;
+        u16 td_status;
+        u32 buf;
+        struct usb_td __iomem *td;
+        struct endpoint *ep = usb->ep0;
+        td = ep->td_base;
+        while (1) {
+                td_status = in_be16(&td->status);
+                buf = in_be32(&td->buf_ptr);
+                extra_data = in_be16(&td->extra);
+                /* if the TD is not empty - we'll confirm it as Timeout */
+                if (td_status & TD_R)
+                        out_be16(&td->status, (td_status & ~TD_R) | TD_TO);
+                /* if this TD is dummy - let's skip this TD */
+                else if (in_be32(&td->buf_ptr) == DUMMY_BD_BUFFER)
+                        out_be32(&td->buf_ptr, DUMMY2_BD_BUFFER);
+                /* if this is the last TD - break */
+                if (td_status & TD_W)
+                        break;
+                td++;
+        }
+        fhci_td_transaction_confirm(usb);
+        td = ep->td_base;
+        do {
+                out_be16(&td->status, 0);
+                out_be16(&td->length, 0);
+                out_be32(&td->buf_ptr, 0);
+                out_be16(&td->extra, 0);
+                td++;
+        } while (!(in_be16(&td->status) & TD_W));
+        out_be16(&td->status, TD_W); /* for last TD set Wrap bit */
+        out_be16(&td->length, 0);
+        out_be32(&td->buf_ptr, 0);
+        out_be16(&td->extra, 0);
+        out_be16(&ep->ep_pram_ptr->tx_bd_ptr,
+                 in_be16(&ep->ep_pram_ptr->tx_base));
+        out_be32(&ep->ep_pram_ptr->tx_state, 0);
+        out_be16(&ep->ep_pram_ptr->tx_cnt, 0);
+        ep->empty_td = ep->td_base;
+        ep->conf_td = ep->td_base;
+}
+/*
+ * Flush all transmitted packets from TDs in the actual frame.
+ * This routine is called when something wrong with the controller and
+ * we want to get rid of the actual frame and start again next frame
+ */
+void fhci_flush_actual_frame(struct fhci_usb *usb)
+{
+        u8 mode;
+        u16 tb_ptr;
+        u16 extra_data;
+        u16 td_status;
+        u32 buf_ptr;
+        struct usb_td __iomem *td;
+        struct endpoint *ep = usb->ep0;
+        /* disable the USB controller */
+        mode = in_8(&usb->fhci->regs->usb_mod);
+        out_8(&usb->fhci->regs->usb_mod, mode & ~USB_MODE_EN);
+        tb_ptr = in_be16(&ep->ep_pram_ptr->tx_bd_ptr);
+        td = cpm_muram_addr(tb_ptr);
+        td_status = in_be16(&td->status);
+        buf_ptr = in_be32(&td->buf_ptr);
+        extra_data = in_be16(&td->extra);
+        do {
+                if (td_status & TD_R) {
+                        out_be16(&td->status, (td_status & ~TD_R) | TD_TO);
+                } else {
+                        out_be32(&td->buf_ptr, 0);
+                        ep->already_pushed_dummy_bd = false;
+                        break;
+                }
+                /* advance the TD pointer */
+                td = next_bd(ep->td_base, td, td_status);
+                td_status = in_be16(&td->status);
+                buf_ptr = in_be32(&td->buf_ptr);
+                extra_data = in_be16(&td->extra);
+        } while ((td_status & TD_R) || buf_ptr);
+        fhci_td_transaction_confirm(usb);
+        out_be16(&ep->ep_pram_ptr->tx_bd_ptr,
+                 in_be16(&ep->ep_pram_ptr->tx_base));
+        out_be32(&ep->ep_pram_ptr->tx_state, 0);
+        out_be16(&ep->ep_pram_ptr->tx_cnt, 0);
+        ep->empty_td = ep->td_base;
+        ep->conf_td = ep->td_base;
+        usb->actual_frame->frame_status = FRAME_TIMER_END_TRANSMISSION;
+        /* reset the event register */
+        out_be16(&usb->fhci->regs->usb_event, 0xffff);
+        /* enable the USB controller */
+        out_8(&usb->fhci->regs->usb_mod, mode | USB_MODE_EN);
+}
+/* handles Tx confirm and Tx error interrupt */
+void fhci_tx_conf_interrupt(struct fhci_usb *usb)
+{
+        fhci_td_transaction_confirm(usb);
+        /*
+         * Schedule another transaction to this frame only if we have
+         * already confirmed all transaction in the frame.
+         */
+        if (((fhci_get_sof_timer_count(usb) < usb->max_frame_usage) ||
+             (usb->actual_frame->frame_status & FRAME_END_TRANSMISSION)) &&
+            (list_empty(&usb->actual_frame->tds_list)))
+                fhci_schedule_transactions(usb);
+}
+void fhci_host_transmit_actual_frame(struct fhci_usb *usb)
+{
+        u16 tb_ptr;
+        u16 td_status;
+        struct usb_td __iomem *td;
+        struct endpoint *ep = usb->ep0;
+        tb_ptr = in_be16(&ep->ep_pram_ptr->tx_bd_ptr);
+        td = cpm_muram_addr(tb_ptr);
+        if (in_be32(&td->buf_ptr) == DUMMY_BD_BUFFER) {
+                struct usb_td __iomem *old_td = td;
+                ep->already_pushed_dummy_bd = false;
+                td_status = in_be16(&td->status);
+                /* gets the next TD in the ring */
+                td = next_bd(ep->td_base, td, td_status);
+                tb_ptr = cpm_muram_offset(td);
+                out_be16(&ep->ep_pram_ptr->tx_bd_ptr, tb_ptr);
+                /* start transmit only if we have something in the TDs */
+                if (in_be16(&td->status) & TD_R)
+                        out_8(&usb->fhci->regs->usb_comm, USB_CMD_STR_FIFO);
+                if (in_be32(&ep->conf_td->buf_ptr) == DUMMY_BD_BUFFER) {
+                        out_be32(&old_td->buf_ptr, 0);
+                        ep->conf_td = next_bd(ep->td_base, ep->conf_td,
+                                              td_status);
+                } else {
+                        out_be32(&old_td->buf_ptr, DUMMY2_BD_BUFFER);
+                }
+        }
+}
diff --git a/drivers/usb/host/fhci.h b/drivers/usb/host/fhci.h
new file mode 100644
index 000000000000..7116284ed21a
--- /dev/null
+++ b/drivers/usb/host/fhci.h
@@ -0,0 +1,607 @@
+/*
+ * Freescale QUICC Engine USB Host Controller Driver
+ *
+ * Copyright (c) Freescale Semicondutor, Inc. 2006.
+ *               Shlomi Gridish <gridish@freescale.com>
+ *               Jerry Huang <Chang-Ming.Huang@freescale.com>
+ * Copyright (c) Logic Product Development, Inc. 2007
+ *               Peter Barada <peterb@logicpd.com>
+ * Copyright (c) MontaVista Software, Inc. 2008.
+ *               Anton Vorontsov <avorontsov@ru.mvista.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#ifndef __FHCI_H
+#define __FHCI_H
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+#include <linux/kfifo.h>
+#include <linux/io.h>
+#include <linux/usb.h>
+#include <asm/qe.h>
+#include "../core/hcd.h"
+#define USB_CLOCK       48000000
+#define FHCI_PRAM_SIZE 0x100
+#define MAX_EDS         32
+#define MAX_TDS         32
+/* CRC16 field size */
+#define CRC_SIZE 2
+/* USB protocol overhead for each frame transmitted from the host */
+#define PROTOCOL_OVERHEAD 7
+/* Packet structure, info field */
+#define PKT_PID_DATA0           0x80000000 /* PID - Data toggle zero */
+#define PKT_PID_DATA1           0x40000000 /* PID - Data toggle one  */
+#define PKT_PID_SETUP           0x20000000 /* PID - Setup bit */
+#define PKT_SETUP_STATUS        0x10000000 /* Setup status bit */
+#define PKT_SETADDR_STATUS      0x08000000 /* Set address status bit */
+#define PKT_SET_HOST_LAST       0x04000000 /* Last data packet */
+#define PKT_HOST_DATA           0x02000000 /* Data packet */
+#define PKT_FIRST_IN_FRAME      0x01000000 /* First packet in the frame */
+#define PKT_TOKEN_FRAME         0x00800000 /* Token packet */
+#define PKT_ZLP                 0x00400000 /* Zero length packet */
+#define PKT_IN_TOKEN_FRAME      0x00200000 /* IN token packet */
+#define PKT_OUT_TOKEN_FRAME     0x00100000 /* OUT token packet */
+#define PKT_SETUP_TOKEN_FRAME   0x00080000 /* SETUP token packet */
+#define PKT_STALL_FRAME         0x00040000 /* STALL packet */
+#define PKT_NACK_FRAME          0x00020000 /* NACK packet */
+#define PKT_NO_PID              0x00010000 /* No PID */
+#define PKT_NO_CRC              0x00008000 /* don't append CRC */
+#define PKT_HOST_COMMAND        0x00004000 /* Host command packet */
+#define PKT_DUMMY_PACKET        0x00002000 /* Dummy packet, used for mmm */
+#define PKT_LOW_SPEED_PACKET    0x00001000 /* Low-Speed packet */
+#define TRANS_OK                (0)
+#define TRANS_INPROGRESS        (-1)
+#define TRANS_DISCARD           (-2)
+#define TRANS_FAIL              (-3)
+#define PS_INT          0
+#define PS_DISCONNECTED 1
+#define PS_CONNECTED    2
+#define PS_READY        3
+#define PS_MISSING      4
+/* Transfer Descriptor status field */
+#define USB_TD_OK               0x00000000 /* TD transmited or received ok */
+#define USB_TD_INPROGRESS       0x80000000 /* TD is being transmitted */
+#define USB_TD_RX_ER_NONOCT     0x40000000 /* Tx Non Octet Aligned Packet */
+#define USB_TD_RX_ER_BITSTUFF   0x20000000 /* Frame Aborted-Received pkt */
+#define USB_TD_RX_ER_CRC        0x10000000 /* CRC error */
+#define USB_TD_RX_ER_OVERUN     0x08000000 /* Over - run occured */
+#define USB_TD_RX_ER_PID        0x04000000 /* wrong PID received */
+#define USB_TD_RX_DATA_UNDERUN  0x02000000 /* shorter than expected */
+#define USB_TD_RX_DATA_OVERUN   0x01000000 /* longer than expected */
+#define USB_TD_TX_ER_NAK        0x00800000 /* NAK handshake */
+#define USB_TD_TX_ER_STALL      0x00400000 /* STALL handshake */
+#define USB_TD_TX_ER_TIMEOUT    0x00200000 /* transmit time out */
+#define USB_TD_TX_ER_UNDERUN    0x00100000 /* transmit underrun */
+#define USB_TD_ERROR (USB_TD_RX_ER_NONOCT | USB_TD_RX_ER_BITSTUFF | \
+                USB_TD_RX_ER_CRC | USB_TD_RX_ER_OVERUN | USB_TD_RX_ER_PID | \
+                USB_TD_RX_DATA_UNDERUN | USB_TD_RX_DATA_OVERUN | \
+                USB_TD_TX_ER_NAK | USB_TD_TX_ER_STALL | \
+                USB_TD_TX_ER_TIMEOUT | USB_TD_TX_ER_UNDERUN)
+/* Transfer Descriptor toggle field */
+#define USB_TD_TOGGLE_DATA0     0
+#define USB_TD_TOGGLE_DATA1     1
+#define USB_TD_TOGGLE_CARRY     2
+/* #define MULTI_DATA_BUS */
+/* Bus mode register RBMR/TBMR */
+#define BUS_MODE_GBL    0x20    /* Global snooping */
+#define BUS_MODE_BO     0x18    /* Byte ordering */
+#define BUS_MODE_BO_BE  0x10    /* Byte ordering - Big-endian */
+#define BUS_MODE_DTB    0x02    /* Data bus */
+/* FHCI QE USB Register Description */
+/* USB Mode Register bit define */
+#define USB_MODE_EN             0x01
+#define USB_MODE_HOST           0x02
+#define USB_MODE_TEST           0x04
+#define USB_MODE_SFTE           0x08
+#define USB_MODE_RESUME         0x40
+#define USB_MODE_LSS            0x80
+/* USB Slave Address Register Mask */
+#define USB_SLVADDR_MASK        0x7F
+/* USB Endpoint register define */
+#define USB_EPNUM_MASK          0xF000
+#define USB_EPNUM_SHIFT         12
+#define USB_TRANS_MODE_SHIFT    8
+#define USB_TRANS_CTR           0x0000
+#define USB_TRANS_INT           0x0100
+#define USB_TRANS_BULK          0x0200
+#define USB_TRANS_ISO           0x0300
+#define USB_EP_MF               0x0020
+#define USB_EP_RTE              0x0010
+#define USB_THS_SHIFT           2
+#define USB_THS_MASK            0x000c
+#define USB_THS_NORMAL          0x0
+#define USB_THS_IGNORE_IN       0x0004
+#define USB_THS_NACK            0x0008
+#define USB_THS_STALL           0x000c
+#define USB_RHS_SHIFT           0
+#define USB_RHS_MASK            0x0003
+#define USB_RHS_NORMAL          0x0
+#define USB_RHS_IGNORE_OUT      0x0001
+#define USB_RHS_NACK            0x0002
+#define USB_RHS_STALL           0x0003
+#define USB_RTHS_MASK           0x000f
+/* USB Command Register define */
+#define USB_CMD_STR_FIFO        0x80
+#define USB_CMD_FLUSH_FIFO      0x40
+#define USB_CMD_ISFT            0x20
+#define USB_CMD_DSFT            0x10
+#define USB_CMD_EP_MASK         0x03
+/* USB Event and Mask Register define */
+#define USB_E_MSF_MASK          0x0800
+#define USB_E_SFT_MASK          0x0400
+#define USB_E_RESET_MASK        0x0200
+#define USB_E_IDLE_MASK         0x0100
+#define USB_E_TXE4_MASK         0x0080
+#define USB_E_TXE3_MASK         0x0040
+#define USB_E_TXE2_MASK         0x0020
+#define USB_E_TXE1_MASK         0x0010
+#define USB_E_SOF_MASK          0x0008
+#define USB_E_BSY_MASK          0x0004
+#define USB_E_TXB_MASK          0x0002
+#define USB_E_RXB_MASK          0x0001
+/* Freescale USB Host controller registers */
+struct fhci_regs {
+        u8 usb_mod;             /* mode register */
+        u8 usb_addr;            /* address register */
+        u8 usb_comm;            /* command register */
+        u8 reserved1[1];
+        __be16 usb_ep[4];       /* endpoint register */
+        u8 reserved2[4];
+        __be16 usb_event;       /* event register */
+        u8 reserved3[2];
+        __be16 usb_mask;        /* mask register */
+        u8 reserved4[1];
+        u8 usb_status;          /* status register */
+        __be16 usb_sof_tmr;     /* Start Of Frame timer */
+        u8 reserved5[2];
+        __be16 usb_frame_num;   /* frame number register */
+        u8 reserved6[1];
+};
+/* Freescale USB HOST */
+struct fhci_pram {
+        __be16 ep_ptr[4];       /* Endpoint porter reg */
+        __be32 rx_state;        /* Rx internal state */
+        __be32 rx_ptr;          /* Rx internal data pointer */
+        __be16 frame_num;       /* Frame number */
+        __be16 rx_cnt;          /* Rx byte count */
+        __be32 rx_temp;         /* Rx temp */
+        __be32 rx_data_temp;    /* Rx data temp */
+        __be16 rx_u_ptr;        /* Rx microcode return address temp */
+        u8 reserved1[2];        /* reserved area */
+        __be32 sof_tbl;         /* SOF lookup table pointer */
+        u8 sof_u_crc_temp;      /* SOF micorcode CRC5 temp reg */
+        u8 reserved2[0xdb];
+};
+/* Freescale USB Endpoint*/
+struct fhci_ep_pram {
+        __be16 rx_base;         /* Rx BD base address */
+        __be16 tx_base;         /* Tx BD base address */
+        u8 rx_func_code;        /* Rx function code */
+        u8 tx_func_code;        /* Tx function code */
+        __be16 rx_buff_len;     /* Rx buffer length */
+        __be16 rx_bd_ptr;       /* Rx BD pointer */
+        __be16 tx_bd_ptr;       /* Tx BD pointer */
+        __be32 tx_state;        /* Tx internal state */
+        __be32 tx_ptr;          /* Tx internal data pointer */
+        __be16 tx_crc;          /* temp transmit CRC */
+        __be16 tx_cnt;          /* Tx byte count */
+        __be32 tx_temp;         /* Tx temp */
+        __be16 tx_u_ptr;        /* Tx microcode return address temp */
+        __be16 reserved;
+};
+struct fhci_controller_list {
+        struct list_head ctrl_list;     /* control endpoints */
+        struct list_head bulk_list;     /* bulk endpoints */
+        struct list_head iso_list;      /* isochronous endpoints */
+        struct list_head intr_list;     /* interruput endpoints */
+        struct list_head done_list;     /* done transfers */
+};
+struct virtual_root_hub {
+        int dev_num;    /* USB address of the root hub */
+        u32 feature;    /* indicates what feature has been set */
+        struct usb_hub_status hub;
+        struct usb_port_status port;
+};
+enum fhci_gpios {
+        GPIO_USBOE = 0,
+        GPIO_USBTP,
+        GPIO_USBTN,
+        GPIO_USBRP,
+        GPIO_USBRN,
+        /* these are optional */
+        GPIO_SPEED,
+        GPIO_POWER,
+        NUM_GPIOS,
+};
+enum fhci_pins {
+        PIN_USBOE = 0,
+        PIN_USBTP,
+        PIN_USBTN,
+        NUM_PINS,
+};
+struct fhci_hcd {
+        enum qe_clock fullspeed_clk;
+        enum qe_clock lowspeed_clk;
+        struct qe_pin *pins[NUM_PINS];
+        int gpios[NUM_GPIOS];
+        bool alow_gpios[NUM_GPIOS];
+        struct fhci_regs __iomem *regs; /* I/O memory used to communicate */
+        struct fhci_pram __iomem *pram; /* Parameter RAM */
+        struct gtm_timer *timer;
+        spinlock_t lock;
+        struct fhci_usb *usb_lld; /* Low-level driver */
+        struct virtual_root_hub *vroot_hub; /* the virtual root hub */
+        int active_urbs;
+        struct fhci_controller_list *hc_list;
+        struct tasklet_struct *process_done_task; /* tasklet for done list */
+        struct list_head empty_eds;
+        struct list_head empty_tds;
+#ifdef CONFIG_FHCI_DEBUG
+        int usb_irq_stat[13];
+        struct dentry *dfs_root;
+        struct dentry *dfs_regs;
+        struct dentry *dfs_irq_stat;
+#endif
+};
+#define USB_FRAME_USAGE 90
+#define FRAME_TIME_USAGE (USB_FRAME_USAGE*10)   /* frame time usage */
+#define SW_FIX_TIME_BETWEEN_TRANSACTION 150     /* SW */
+#define MAX_BYTES_PER_FRAME (USB_FRAME_USAGE*15)
+#define MAX_PERIODIC_FRAME_USAGE 90
+/* transaction type */
+enum fhci_ta_type {
+        FHCI_TA_IN = 0, /* input transaction */
+        FHCI_TA_OUT,    /* output transaction */
+        FHCI_TA_SETUP,  /* setup transaction */
+};
+/* transfer mode */
+enum fhci_tf_mode {
+        FHCI_TF_CTRL = 0,
+        FHCI_TF_ISO,
+        FHCI_TF_BULK,
+        FHCI_TF_INTR,
+};
+enum fhci_speed {
+        FHCI_FULL_SPEED,
+        FHCI_LOW_SPEED,
+};
+/* endpoint state */
+enum fhci_ed_state {
+        FHCI_ED_NEW = 0, /* pipe is new */
+        FHCI_ED_OPER,    /* pipe is operating */
+        FHCI_ED_URB_DEL, /* pipe is in hold because urb is being deleted */
+        FHCI_ED_SKIP,    /* skip this pipe */
+        FHCI_ED_HALTED,  /* pipe is halted */
+};
+enum fhci_port_status {
+        FHCI_PORT_POWER_OFF = 0,
+        FHCI_PORT_DISABLED,
+        FHCI_PORT_DISCONNECTING,
+        FHCI_PORT_WAITING,      /* waiting for connection */
+        FHCI_PORT_FULL,         /* full speed connected */
+        FHCI_PORT_LOW,          /* low speed connected */
+};
+enum fhci_mem_alloc {
+        MEM_CACHABLE_SYS = 0x00000001,  /* primary DDR,cachable */
+        MEM_NOCACHE_SYS = 0x00000004,   /* primary DDR,non-cachable */
+        MEM_SECONDARY = 0x00000002,     /* either secondary DDR or SDRAM */
+        MEM_PRAM = 0x00000008,          /* multi-user RAM identifier */
+};
+/* USB default parameters*/
+#define DEFAULT_RING_LEN        8
+#define DEFAULT_DATA_MEM        MEM_CACHABLE_SYS
+struct ed {
+        u8 dev_addr;            /* device address */
+        u8 ep_addr;             /* endpoint address */
+        enum fhci_tf_mode mode; /* USB transfer mode */
+        enum fhci_speed speed;
+        unsigned int max_pkt_size;
+        enum fhci_ed_state state;
+        struct list_head td_list; /* a list of all queued TD to this pipe */
+        struct list_head node;
+        /* read only parameters, should be cleared upon initialization */
+        u8 toggle_carry;        /* toggle carry from the last TD submitted */
+        u32 last_iso;           /* time stamp of last queued ISO transfer */
+        struct td *td_head;     /* a pointer to the current TD handled */
+};
+struct td {
+        void *data;              /* a pointer to the data buffer */
+        unsigned int len;        /* length of the data to be submitted */
+        unsigned int actual_len; /* actual bytes transfered on this td */
+        enum fhci_ta_type type;  /* transaction type */
+        u8 toggle;               /* toggle for next trans. within this TD */
+        u16 iso_index;           /* ISO transaction index */
+        u16 start_frame;         /* start frame time stamp */
+        u16 interval;            /* interval between trans. (for ISO/Intr) */
+        u32 status;              /* status of the TD */
+        struct ed *ed;           /* a handle to the corresponding ED */
+        struct urb *urb;         /* a handle to the corresponding URB */
+        bool ioc;                /* Inform On Completion */
+        struct list_head node;
+        /* read only parameters should be cleared upon initialization */
+        struct packet *pkt;
+        int nak_cnt;
+        int error_cnt;
+        struct list_head frame_lh;
+};
+struct packet {
+        u8 *data;       /* packet data */
+        u32 len;        /* packet length */
+        u32 status;     /* status of the packet - equivalent to the status
+                         * field for the corresponding structure td */
+        u32 info;       /* packet information */
+        void __iomem *priv_data; /* private data of the driver (TDs or BDs) */
+};
+/* struct for each URB */
+#define URB_INPROGRESS  0
+#define URB_DEL         1
+/* URB states (state field) */
+#define US_BULK         0
+#define US_BULK0        1
+/* three setup states */
+#define US_CTRL_SETUP   2
+#define US_CTRL_DATA    1
+#define US_CTRL_ACK     0
+#define EP_ZERO 0
+struct urb_priv {
+        int num_of_tds;
+        int tds_cnt;
+        int state;
+        struct td **tds;
+        struct ed *ed;
+        struct timer_list time_out;
+};
+struct endpoint {
+        /* Pointer to ep parameter RAM */
+        struct fhci_ep_pram __iomem *ep_pram_ptr;
+        /* Host transactions */
+        struct usb_td __iomem *td_base; /* first TD in the ring */
+        struct usb_td __iomem *conf_td; /* next TD for confirm after transac */
+        struct usb_td __iomem *empty_td;/* next TD for new transaction req. */
+        struct kfifo *empty_frame_Q;  /* Empty frames list to use */
+        struct kfifo *conf_frame_Q;   /* frames passed to TDs,waiting for tx */
+        struct kfifo *dummy_packets_Q;/* dummy packets for the CRC overun */
+        bool already_pushed_dummy_bd;
+};
+/* struct for each 1mSec frame time */
+#define FRAME_IS_TRANSMITTED            0x00
+#define FRAME_TIMER_END_TRANSMISSION    0x01
+#define FRAME_DATA_END_TRANSMISSION     0x02
+#define FRAME_END_TRANSMISSION          0x03
+#define FRAME_IS_PREPARED               0x04
+struct fhci_time_frame {
+        u16 frame_num;   /* frame number */
+        u16 total_bytes; /* total bytes submitted within this frame */
+        u8 frame_status; /* flag that indicates to stop fill this frame */
+        struct list_head tds_list; /* all tds of this frame */
+};
+/* internal driver structure*/
+struct fhci_usb {
+        u16 saved_msk;           /* saving of the USB mask register */
+        struct endpoint *ep0;    /* pointer for endpoint0 structure */
+        int intr_nesting_cnt;    /* interrupt nesting counter */
+        u16 max_frame_usage;     /* max frame time usage,in micro-sec */
+        u16 max_bytes_per_frame; /* max byte can be tx in one time frame */
+        u32 sw_transaction_time; /* sw complete trans time,in micro-sec */
+        struct fhci_time_frame *actual_frame;
+        struct fhci_controller_list *hc_list;   /* main structure for hc */
+        struct virtual_root_hub *vroot_hub;
+        enum fhci_port_status port_status;      /* v_rh port status */
+        u32 (*transfer_confirm)(struct fhci_hcd *fhci);
+        struct fhci_hcd *fhci;
+};
+/*
+ * Various helpers and prototypes below.
+ */
+static inline u16 get_frame_num(struct fhci_hcd *fhci)
+{
+        return in_be16(&fhci->pram->frame_num) & 0x07ff;
+}
+#define fhci_dbg(fhci, fmt, args...) \
+                dev_dbg(fhci_to_hcd(fhci)->self.controller, fmt, ##args)
+#define fhci_vdbg(fhci, fmt, args...) \
+                dev_vdbg(fhci_to_hcd(fhci)->self.controller, fmt, ##args)
+#define fhci_err(fhci, fmt, args...) \
+                dev_err(fhci_to_hcd(fhci)->self.controller, fmt, ##args)
+#define fhci_info(fhci, fmt, args...) \
+                dev_info(fhci_to_hcd(fhci)->self.controller, fmt, ##args)
+#define fhci_warn(fhci, fmt, args...) \
+                dev_warn(fhci_to_hcd(fhci)->self.controller, fmt, ##args)
+static inline struct fhci_hcd *hcd_to_fhci(struct usb_hcd *hcd)
+{
+        return (struct fhci_hcd *)hcd->hcd_priv;
+}
+static inline struct usb_hcd *fhci_to_hcd(struct fhci_hcd *fhci)
+{
+        return container_of((void *)fhci, struct usb_hcd, hcd_priv);
+}
+/* fifo of pointers */
+static inline struct kfifo *cq_new(int size)
+{
+        return kfifo_alloc(size * sizeof(void *), GFP_KERNEL, NULL);
+}
+static inline void cq_delete(struct kfifo *kfifo)
+{
+        kfifo_free(kfifo);
+}
+static inline unsigned int cq_howmany(struct kfifo *kfifo)
+{
+        return __kfifo_len(kfifo) / sizeof(void *);
+}
+static inline int cq_put(struct kfifo *kfifo, void *p)
+{
+        return __kfifo_put(kfifo, (void *)&p, sizeof(p));
+}
+static inline void *cq_get(struct kfifo *kfifo)
+{
+        void *p = NULL;
+        __kfifo_get(kfifo, (void *)&p, sizeof(p));
+        return p;
+}
+/* fhci-hcd.c */
+void fhci_start_sof_timer(struct fhci_hcd *fhci);
+void fhci_stop_sof_timer(struct fhci_hcd *fhci);
+u16 fhci_get_sof_timer_count(struct fhci_usb *usb);
+void fhci_usb_enable_interrupt(struct fhci_usb *usb);
+void fhci_usb_disable_interrupt(struct fhci_usb *usb);
+int fhci_ioports_check_bus_state(struct fhci_hcd *fhci);
+/* fhci-mem.c */
+void fhci_recycle_empty_td(struct fhci_hcd *fhci, struct td *td);
+void fhci_recycle_empty_ed(struct fhci_hcd *fhci, struct ed *ed);
+struct ed *fhci_get_empty_ed(struct fhci_hcd *fhci);
+struct td *fhci_td_fill(struct fhci_hcd *fhci, struct urb *urb,
+                        struct urb_priv *urb_priv, struct ed *ed, u16 index,
+                        enum fhci_ta_type type, int toggle, u8 *data, u32 len,
+                        u16 interval, u16 start_frame, bool ioc);
+void fhci_add_tds_to_ed(struct ed *ed, struct td **td_list, int number);
+/* fhci-hub.c */
+void fhci_config_transceiver(struct fhci_hcd *fhci,
+                        enum fhci_port_status status);
+void fhci_port_disable(struct fhci_hcd *fhci);
+void fhci_port_enable(void *lld);
+void fhci_io_port_generate_reset(struct fhci_hcd *fhci);
+void fhci_port_reset(void *lld);
+int fhci_hub_status_data(struct usb_hcd *hcd, char *buf);
+int fhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+                     u16 wIndex, char *buf, u16 wLength);
+/* fhci-tds.c */
+void fhci_flush_bds(struct fhci_usb *usb);
+void fhci_flush_actual_frame(struct fhci_usb *usb);
+u32 fhci_host_transaction(struct fhci_usb *usb, struct packet *pkt,
+                          enum fhci_ta_type trans_type, u8 dest_addr,
+                          u8 dest_ep, enum fhci_tf_mode trans_mode,
+                          enum fhci_speed dest_speed, u8 data_toggle);
+void fhci_host_transmit_actual_frame(struct fhci_usb *usb);
+void fhci_tx_conf_interrupt(struct fhci_usb *usb);
+void fhci_push_dummy_bd(struct endpoint *ep);
+u32 fhci_create_ep(struct fhci_usb *usb, enum fhci_mem_alloc data_mem,
+                   u32 ring_len);
+void fhci_init_ep_registers(struct fhci_usb *usb,
+                            struct endpoint *ep,
+                            enum fhci_mem_alloc data_mem);
+void fhci_ep0_free(struct fhci_usb *usb);
+/* fhci-sched.c */
+extern struct tasklet_struct fhci_tasklet;
+void fhci_transaction_confirm(struct fhci_usb *usb, struct packet *pkt);
+void fhci_flush_all_transmissions(struct fhci_usb *usb);
+void fhci_schedule_transactions(struct fhci_usb *usb);
+void fhci_device_connected_interrupt(struct fhci_hcd *fhci);
+void fhci_device_disconnected_interrupt(struct fhci_hcd *fhci);
+void fhci_queue_urb(struct fhci_hcd *fhci, struct urb *urb);
+u32 fhci_transfer_confirm_callback(struct fhci_hcd *fhci);
+irqreturn_t fhci_irq(struct usb_hcd *hcd);
+irqreturn_t fhci_frame_limit_timer_irq(int irq, void *_hcd);
+/* fhci-q.h */
+void fhci_urb_complete_free(struct fhci_hcd *fhci, struct urb *urb);
+struct td *fhci_remove_td_from_ed(struct ed *ed);
+struct td *fhci_remove_td_from_frame(struct fhci_time_frame *frame);
+void fhci_move_td_from_ed_to_done_list(struct fhci_usb *usb, struct ed *ed);
+struct td *fhci_peek_td_from_frame(struct fhci_time_frame *frame);
+void fhci_add_td_to_frame(struct fhci_time_frame *frame, struct td *td);
+struct td *fhci_remove_td_from_done_list(struct fhci_controller_list *p_list);
+void fhci_done_td(struct urb *urb, struct td *td);
+void fhci_del_ed_list(struct fhci_hcd *fhci, struct ed *ed);
+#ifdef CONFIG_FHCI_DEBUG
+void fhci_dbg_isr(struct fhci_hcd *fhci, int usb_er);
+void fhci_dfs_destroy(struct fhci_hcd *fhci);
+void fhci_dfs_create(struct fhci_hcd *fhci);
+#else
+static inline void fhci_dbg_isr(struct fhci_hcd *fhci, int usb_er) {}
+static inline void fhci_dfs_destroy(struct fhci_hcd *fhci) {}
+static inline void fhci_dfs_create(struct fhci_hcd *fhci) {}
+#endif /* CONFIG_FHCI_DEBUG */
+#endif /* __FHCI_H */
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 65a9609f4ad6..5cf5f1eca4f4 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -593,12 +593,10 @@ static int ohci_run (struct ohci_hcd *ohci)
         * to be checked in case boot firmware (BIOS/SMM/...) has set up
         * wakeup in a way the bus isn't aware of (e.g., legacy PCI PM).
         * If the bus glue detected wakeup capability then it should
-         * already be enabled.  Either way, if wakeup should be enabled
+         * already be enabled; if so we'll just enable it again.
-         * but isn't, we'll enable it now.
         */
-        if ((ohci->hc_control & OHCI_CTRL_RWC) != 0
+        if ((ohci->hc_control & OHCI_CTRL_RWC) != 0)
-                        && !device_can_wakeup(hcd->self.controller))
+                device_set_wakeup_capable(hcd->self.controller, 1);
-                device_init_wakeup(hcd->self.controller, 1);
        switch (ohci->hc_control & OHCI_CTRL_HCFS) {
        case OHCI_USB_OPER:
diff --git a/drivers/usb/host/ohci-omap.c b/drivers/usb/host/ohci-omap.c
index 4bbddb73abd9..f3aaba35e912 100644
--- a/drivers/usb/host/ohci-omap.c
+++ b/drivers/usb/host/ohci-omap.c
@@ -315,14 +315,14 @@ static int usb_hcd_omap_probe (const struct hc_driver *driver,
                return -ENODEV;
        }
-        usb_host_ck = clk_get(0, "usb_hhc_ck");
+        usb_host_ck = clk_get(&pdev->dev, "usb_hhc_ck");
        if (IS_ERR(usb_host_ck))
                return PTR_ERR(usb_host_ck);
        if (!cpu_is_omap15xx())
-                usb_dc_ck = clk_get(0, "usb_dc_ck");
+                usb_dc_ck = clk_get(&pdev->dev, "usb_dc_ck");
        else
-                usb_dc_ck = clk_get(0, "lb_ck");
+                usb_dc_ck = clk_get(&pdev->dev, "lb_ck");
        if (IS_ERR(usb_dc_ck)) {
                clk_put(usb_host_ck);
diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
index 8b28ae7865ba..5d625c3fd423 100644
--- a/drivers/usb/host/ohci-pci.c
+++ b/drivers/usb/host/ohci-pci.c
@@ -487,7 +487,6 @@ static struct pci_driver ohci_pci_driver = {
 #ifdef  CONFIG_PM
        .suspend =      usb_hcd_pci_suspend,
-        .suspend_late = usb_hcd_pci_suspend_late,
        .resume_early = usb_hcd_pci_resume_early,
        .resume =       usb_hcd_pci_resume,
 #endif
diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
index 4e221060f58c..944f7e0ca4df 100644
--- a/drivers/usb/host/uhci-hcd.c
+++ b/drivers/usb/host/uhci-hcd.c
@@ -942,7 +942,6 @@ static struct pci_driver uhci_pci_driver = {
 #ifdef  CONFIG_PM
        .suspend =      usb_hcd_pci_suspend,
-        .suspend_late = usb_hcd_pci_suspend_late,
        .resume_early = usb_hcd_pci_resume_early,
        .resume =       usb_hcd_pci_resume,
 #endif  /* PM */
diff --git a/drivers/usb/host/whci/asl.c b/drivers/usb/host/whci/asl.c
index 577c0d29849d..2291c5f5af51 100644
--- a/drivers/usb/host/whci/asl.c
+++ b/drivers/usb/host/whci/asl.c
@@ -170,12 +170,17 @@ void asl_stop(struct whc *whc)
 void asl_update(struct whc *whc, uint32_t wusbcmd)
 {
        struct wusbhc *wusbhc = &whc->wusbhc;
+        long t;
        mutex_lock(&wusbhc->mutex);
        if (wusbhc->active) {
                whc_write_wusbcmd(whc, wusbcmd, wusbcmd);
-                wait_event(whc->async_list_wq,
+                t = wait_event_timeout(
-                           (le_readl(whc->base + WUSBCMD) & WUSBCMD_ASYNC_UPDATED) == 0);
+                        whc->async_list_wq,
+                        (le_readl(whc->base + WUSBCMD) & WUSBCMD_ASYNC_UPDATED) == 0,
+                        msecs_to_jiffies(1000));
+                if (t == 0)
+                        whc_hw_error(whc, "ASL update timeout");
        }
        mutex_unlock(&wusbhc->mutex);
 }
diff --git a/drivers/usb/host/whci/hw.c b/drivers/usb/host/whci/hw.c
index d498e7203217..6afa2e379160 100644
--- a/drivers/usb/host/whci/hw.c
+++ b/drivers/usb/host/whci/hw.c
@@ -87,3 +87,18 @@ out:
        return ret;
 }
+/**
+ * whc_hw_error - recover from a hardware error
+ * @whc:    the WHCI HC that broke.
+ * @reason: a description of the failure.
+ *
+ * Recover from broken hardware with a full reset.
+ */
+void whc_hw_error(struct whc *whc, const char *reason)
+{
+        struct wusbhc *wusbhc = &whc->wusbhc;
+        dev_err(&whc->umc->dev, "hardware error: %s\n", reason);
+        wusbhc_reset_all(wusbhc);
+}
diff --git a/drivers/usb/host/whci/pzl.c b/drivers/usb/host/whci/pzl.c
index 2ae5abf69a6a..7dc85a0bee7c 100644
--- a/drivers/usb/host/whci/pzl.c
+++ b/drivers/usb/host/whci/pzl.c
@@ -183,12 +183,17 @@ void pzl_stop(struct whc *whc)
 void pzl_update(struct whc *whc, uint32_t wusbcmd)
 {
        struct wusbhc *wusbhc = &whc->wusbhc;
+        long t;
        mutex_lock(&wusbhc->mutex);
        if (wusbhc->active) {
                whc_write_wusbcmd(whc, wusbcmd, wusbcmd);
-                wait_event(whc->periodic_list_wq,
+                t = wait_event_timeout(
-                           (le_readl(whc->base + WUSBCMD) & WUSBCMD_PERIODIC_UPDATED) == 0);
+                        whc->periodic_list_wq,
+                        (le_readl(whc->base + WUSBCMD) & WUSBCMD_PERIODIC_UPDATED) == 0,
+                        msecs_to_jiffies(1000));
+                if (t == 0)
+                        whc_hw_error(whc, "PZL update timeout");
        }
        mutex_unlock(&wusbhc->mutex);
 }
diff --git a/drivers/usb/host/whci/whcd.h b/drivers/usb/host/whci/whcd.h
index 0f3540f04f53..d3543a181dc9 100644
--- a/drivers/usb/host/whci/whcd.h
+++ b/drivers/usb/host/whci/whcd.h
@@ -137,6 +137,7 @@ void whc_clean_up(struct whc *whc);
 /* hw.c */
 void whc_write_wusbcmd(struct whc *whc, u32 mask, u32 val);
 int whc_do_gencmd(struct whc *whc, u32 cmd, u32 params, void *addr, size_t len);
+void whc_hw_error(struct whc *whc, const char *reason);
 /* wusb.c */
 int whc_wusbhc_start(struct wusbhc *wusbhc);
diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
index 189a9db03509..ad4fb15b5dcb 100644
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -57,7 +57,6 @@
 #define USB_DEVICE_ID_LD_MACHINETEST    0x2040  /* USB Product ID of Machine Test System */
 #define USB_VENDOR_ID_VERNIER           0x08f7
-#define USB_DEVICE_ID_VERNIER_LABPRO    0x0001
 #define USB_DEVICE_ID_VERNIER_GOTEMP    0x0002
 #define USB_DEVICE_ID_VERNIER_SKIP      0x0003
 #define USB_DEVICE_ID_VERNIER_CYCLOPS   0x0004
@@ -85,7 +84,6 @@ static struct usb_device_id ld_usb_table [] = {
        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_NETWORKANALYSER) },
        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POWERCONTROL) },
        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MACHINETEST) },
-        { USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_LABPRO) },
        { USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_GOTEMP) },
        { USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_SKIP) },
        { USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_CYCLOPS) },
diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
index e06810aef2df..4cf27c72423e 100644
--- a/drivers/usb/mon/mon_bin.c
+++ b/drivers/usb/mon/mon_bin.c
@@ -37,6 +37,7 @@
 #define MON_IOCX_GET   _IOW(MON_IOC_MAGIC, 6, struct mon_bin_get)
 #define MON_IOCX_MFETCH _IOWR(MON_IOC_MAGIC, 7, struct mon_bin_mfetch)
 #define MON_IOCH_MFLUSH _IO(MON_IOC_MAGIC, 8)
 #ifdef CONFIG_COMPAT
 #define MON_IOCX_GET32 _IOW(MON_IOC_MAGIC, 6, struct mon_bin_get32)
 #define MON_IOCX_MFETCH32 _IOWR(MON_IOC_MAGIC, 7, struct mon_bin_mfetch32)
@@ -921,21 +922,6 @@ static int mon_bin_ioctl(struct inode *inode, struct file *file,
                }
                break;
-#ifdef CONFIG_COMPAT
-        case MON_IOCX_GET32: {
-                struct mon_bin_get32 getb;
-                if (copy_from_user(&getb, (void __user *)arg,
-                                            sizeof(struct mon_bin_get32)))
-                        return -EFAULT;
-                ret = mon_bin_get_event(file, rp,
-                    compat_ptr(getb.hdr32), compat_ptr(getb.data32),
-                    getb.alloc32);
-                }
-                break;
-#endif
        case MON_IOCX_MFETCH:
                {
                struct mon_bin_mfetch mfetch;
@@ -962,7 +948,57 @@ static int mon_bin_ioctl(struct inode *inode, struct file *file,
                }
                break;
+        case MON_IOCG_STATS: {
+                struct mon_bin_stats __user *sp;
+                unsigned int nevents;
+                unsigned int ndropped;
+                spin_lock_irqsave(&rp->b_lock, flags);
+                ndropped = rp->cnt_lost;
+                rp->cnt_lost = 0;
+                spin_unlock_irqrestore(&rp->b_lock, flags);
+                nevents = mon_bin_queued(rp);
+                sp = (struct mon_bin_stats __user *)arg;
+                if (put_user(rp->cnt_lost, &sp->dropped))
+                        return -EFAULT;
+                if (put_user(nevents, &sp->queued))
+                        return -EFAULT;
+                }
+                break;
+        default:
+                return -ENOTTY;
+        }
+        return ret;
+}
 #ifdef CONFIG_COMPAT
+static long mon_bin_compat_ioctl(struct file *file,
+    unsigned int cmd, unsigned long arg)
+{
+        struct mon_reader_bin *rp = file->private_data;
+        int ret;
+        switch (cmd) {
+        case MON_IOCX_GET32: {
+                struct mon_bin_get32 getb;
+                if (copy_from_user(&getb, (void __user *)arg,
+                                            sizeof(struct mon_bin_get32)))
+                        return -EFAULT;
+                ret = mon_bin_get_event(file, rp,
+                    compat_ptr(getb.hdr32), compat_ptr(getb.data32),
+                    getb.alloc32);
+                if (ret < 0)
+                        return ret;
+                }
+                return 0;
        case MON_IOCX_MFETCH32:
                {
                struct mon_bin_mfetch32 mfetch;
@@ -986,37 +1022,25 @@ static int mon_bin_ioctl(struct inode *inode, struct file *file,
                        return ret;
                if (put_user(ret, &uptr->nfetch32))
                        return -EFAULT;
-                ret = 0;
                }
-                break;
+                return 0;
-#endif
-        case MON_IOCG_STATS: {
-                struct mon_bin_stats __user *sp;
-                unsigned int nevents;
-                unsigned int ndropped;
-                spin_lock_irqsave(&rp->b_lock, flags);
-                ndropped = rp->cnt_lost;
-                rp->cnt_lost = 0;
-                spin_unlock_irqrestore(&rp->b_lock, flags);
-                nevents = mon_bin_queued(rp);
-                sp = (struct mon_bin_stats __user *)arg;
+        case MON_IOCG_STATS:
-                if (put_user(rp->cnt_lost, &sp->dropped))
+                return mon_bin_ioctl(NULL, file, cmd,
-                        return -EFAULT;
+                                            (unsigned long) compat_ptr(arg));
-                if (put_user(nevents, &sp->queued))
-                        return -EFAULT;
-                }
+        case MON_IOCQ_URB_LEN:
-                break;
+        case MON_IOCQ_RING_SIZE:
+        case MON_IOCT_RING_SIZE:
+        case MON_IOCH_MFLUSH:
+                return mon_bin_ioctl(NULL, file, cmd, arg);
        default:
-                return -ENOTTY;
+                ;
        }
+        return -ENOTTY;
-        return ret;
 }
+#endif /* CONFIG_COMPAT */
 static unsigned int
 mon_bin_poll(struct file *file, struct poll_table_struct *wait)
@@ -1094,6 +1118,9 @@ static const struct file_operations mon_fops_binary = {
        /* .write =     mon_text_write, */
        .poll =         mon_bin_poll,
        .ioctl =        mon_bin_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = mon_bin_compat_ioctl,
+#endif
        .release =      mon_bin_release,
        .mmap =         mon_bin_mmap,
 };
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 5af7379cd9a3..9985db08e7db 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -11,6 +11,7 @@ config USB_MUSB_HDRC
        depends on (USB || USB_GADGET) && HAVE_CLK
        depends on !SUPERH
        select TWL4030_USB if MACH_OMAP_3430SDP
+        select USB_OTG_UTILS
        tristate 'Inventra Highspeed Dual Role Controller (TI, ADI, ...)'
        help
          Say Y here if your system has a dual role high speed USB
@@ -49,7 +50,7 @@ comment "OMAP 343x high speed USB support"
        depends on USB_MUSB_HDRC && ARCH_OMAP34XX
 comment "Blackfin high speed USB Support"
-        depends on USB_MUSB_HDRC && (BF54x && !BF544) || (BF52x && !BF522 && !BF523)
+        depends on USB_MUSB_HDRC && ((BF54x && !BF544) || (BF52x && !BF522 && !BF523))
 config USB_TUSB6010
        boolean "TUSB 6010 support"
diff --git a/drivers/usb/musb/cppi_dma.c b/drivers/usb/musb/cppi_dma.c
index 5ad6d0893cbe..569ef0fed0f6 100644
--- a/drivers/usb/musb/cppi_dma.c
+++ b/drivers/usb/musb/cppi_dma.c
@@ -9,6 +9,7 @@
 #include <linux/usb.h>
 #include "musb_core.h"
+#include "musb_debug.h"
 #include "cppi_dma.h"
@@ -423,6 +424,7 @@ cppi_rndis_update(struct cppi_channel *c, int is_rx,
        }
 }
+#ifdef CONFIG_USB_MUSB_DEBUG
 static void cppi_dump_rxbd(const char *tag, struct cppi_descriptor *bd)
 {
        pr_debug("RXBD/%s %08x: "
@@ -431,10 +433,11 @@ static void cppi_dump_rxbd(const char *tag, struct cppi_descriptor *bd)
                        bd->hw_next, bd->hw_bufp, bd->hw_off_len,
                        bd->hw_options);
 }
+#endif
 static void cppi_dump_rxq(int level, const char *tag, struct cppi_channel *rx)
 {
-#if MUSB_DEBUG > 0
+#ifdef CONFIG_USB_MUSB_DEBUG
        struct cppi_descriptor  *bd;
        if (!_dbg_level(level))
@@ -881,12 +884,14 @@ cppi_next_rx_segment(struct musb *musb, struct cppi_channel *rx, int onepacket)
        bd->hw_options |= CPPI_SOP_SET;
        tail->hw_options |= CPPI_EOP_SET;
-        if (debug >= 5) {
+#ifdef CONFIG_USB_MUSB_DEBUG
+        if (_dbg_level(5)) {
                struct cppi_descriptor  *d;
                for (d = rx->head; d; d = d->next)
                        cppi_dump_rxbd("S", d);
        }
+#endif
        /* in case the preceding transfer left some state... */
        tail = rx->last_processed;
@@ -990,6 +995,7 @@ static int cppi_channel_program(struct dma_channel *ch,
        cppi_ch->offset = 0;
        cppi_ch->maxpacket = maxpacket;
        cppi_ch->buf_len = len;
+        cppi_ch->channel.actual_len = 0;
        /* TX channel? or RX? */
        if (cppi_ch->transmit)
diff --git a/drivers/usb/musb/davinci.c b/drivers/usb/musb/davinci.c
index 0d566dc5ce06..5a8fd5d57a11 100644
--- a/drivers/usb/musb/davinci.c
+++ b/drivers/usb/musb/davinci.c
@@ -32,9 +32,10 @@
 #include <linux/io.h>
 #include <linux/gpio.h>
-#include <mach/arch/hardware.h>
+#include <mach/hardware.h>
-#include <mach/arch/memory.h>
+#include <mach/memory.h>
-#include <mach/arch/gpio.h>
+#include <mach/gpio.h>
 #include <asm/mach-types.h>
 #include "musb_core.h"
@@ -370,12 +371,6 @@ int musb_platform_set_mode(struct musb *musb, u8 mode)
        return -EIO;
 }
-int musb_platform_set_mode(struct musb *musb, u8 mode)
-{
-       /* EVM can't do this (right?) */
-       return -EIO;
-}
 int __init musb_platform_init(struct musb *musb)
 {
        void __iomem    *tibase = musb->ctrl_base;
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 6c7faacfb535..2cc34fa05b73 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1824,8 +1824,9 @@ static void musb_free(struct musb *musb)
        musb_gadget_cleanup(musb);
 #endif
-        if (musb->nIrq >= 0 && musb->irq_wake) {
+        if (musb->nIrq >= 0) {
-                disable_irq_wake(musb->nIrq);
+                if (musb->irq_wake)
+                        disable_irq_wake(musb->nIrq);
                free_irq(musb->nIrq, musb);
        }
        if (is_dma_capable() && musb->dma_controller) {
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 6197daeab8f9..4ea305387981 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -874,10 +874,10 @@ static int musb_gadget_enable(struct usb_ep *ep,
                status = -EBUSY;
                goto fail;
        }
-        musb_ep->type = desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK;
+        musb_ep->type = usb_endpoint_type(desc);
        /* check direction and (later) maxpacket size against endpoint */
-        if ((desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK) != epnum)
+        if (usb_endpoint_num(desc) != epnum)
                goto fail;
        /* REVISIT this rules out high bandwidth periodic transfers */
@@ -890,7 +890,7 @@ static int musb_gadget_enable(struct usb_ep *ep,
         * packet size (or fail), set the mode, clear the fifo
         */
        musb_ep_select(mbase, epnum);
-        if (desc->bEndpointAddress & USB_DIR_IN) {
+        if (usb_endpoint_dir_in(desc)) {
                u16 int_txe = musb_readw(mbase, MUSB_INTRTXE);
                if (hw_ep->is_shared_fifo)
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 99fa61234876..a035ceccf950 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -1847,8 +1847,8 @@ static int musb_urb_enqueue(
                goto done;
        }
-        qh->epnum = epd->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
+        qh->epnum = usb_endpoint_num(epd);
-        qh->type = epd->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK;
+        qh->type = usb_endpoint_type(epd);
        /* NOTE: urb->dev->devnum is wrong during SET_ADDRESS */
        qh->addr_reg = (u8) usb_pipedevice(urb->pipe);
diff --git a/drivers/usb/musb/tusb6010_omap.c b/drivers/usb/musb/tusb6010_omap.c
index 52f7f29cebda..7e073a0d7ac9 100644
--- a/drivers/usb/musb/tusb6010_omap.c
+++ b/drivers/usb/musb/tusb6010_omap.c
@@ -15,8 +15,8 @@
 #include <linux/usb.h>
 #include <linux/platform_device.h>
 #include <linux/dma-mapping.h>
-#include <asm/arch/dma.h>
+#include <mach/dma.h>
-#include <asm/arch/mux.h>
+#include <mach/mux.h>
 #include "musb_core.h"
diff --git a/drivers/usb/otg/Kconfig b/drivers/usb/otg/Kconfig
index 8e8dbdb9b39b..ee55b449ffde 100644
--- a/drivers/usb/otg/Kconfig
+++ b/drivers/usb/otg/Kconfig
@@ -6,14 +6,14 @@
 comment "OTG and related infrastructure"
-if USB || USB_GADGET
 config USB_OTG_UTILS
        bool
        help
          Select this to make sure the build includes objects from
          the OTG infrastructure directory.
+if USB || USB_GADGET
 #
 # USB Transceiver Drivers
 #
diff --git a/drivers/usb/serial/cp2101.c b/drivers/usb/serial/cp2101.c
index cfaf1f085535..027f4b7dde86 100644
--- a/drivers/usb/serial/cp2101.c
+++ b/drivers/usb/serial/cp2101.c
@@ -85,6 +85,8 @@ static struct usb_device_id id_table [] = {
        { USB_DEVICE(0x10C4, 0x81E2) }, /* Lipowsky Industrie Elektronik GmbH, Baby-LIN */
        { USB_DEVICE(0x10C4, 0x81E7) }, /* Aerocomm Radio */
        { USB_DEVICE(0x10C4, 0x8218) }, /* Lipowsky Industrie Elektronik GmbH, HARP-1 */
+        { USB_DEVICE(0x10C4, 0x822B) }, /* Modem EDGE(GSM) Comander 2 */
+        { USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demostration module */
        { USB_DEVICE(0x10c4, 0x8293) }, /* Telegesys ETRX2USB */
        { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
        { USB_DEVICE(0x10C4, 0x83A8) }, /* Amber Wireless AMB2560 */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index c70a8f667d85..75597337583e 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -660,6 +660,8 @@ static struct usb_device_id id_table_combined [] = {
        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO4x4_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DGQG_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DUSB_PID) },
+        { USB_DEVICE(ALTI2_VID, ALTI2_N3_PID) },
+        { USB_DEVICE(FTDI_VID, DIEBOLD_BCS_SE923_PID) },
        { },                                    /* Optional parameter entry */
        { }                                     /* Terminating entry */
 };
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index 373ee09975bb..1b62eff475d2 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -854,6 +854,10 @@
 #define FTDI_DOMINTELL_DGQG_PID 0xEF50  /* Master */
 #define FTDI_DOMINTELL_DUSB_PID 0xEF51  /* DUSB01 module */
+/* Alti-2 products  http://www.alti-2.com */
+#define ALTI2_VID       0x1BC9
+#define ALTI2_N3_PID    0x6001  /* Neptune 3 */
 /* Commands */
 #define FTDI_SIO_RESET          0 /* Reset the port */
 #define FTDI_SIO_MODEM_CTRL     1 /* Set the modem control register */
@@ -881,6 +885,11 @@
 #define RATOC_PRODUCT_ID_USB60F 0xb020
 /*
+ * DIEBOLD BCS SE923
+ */
+#define DIEBOLD_BCS_SE923_PID   0xfb99
+/*
 *   BmRequestType:  1100 0000b
 *   bRequest:       FTDI_E2_READ
 *   wValue:         0
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 5ed183477aaf..6c89da9c6fea 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -158,6 +158,13 @@ static int  option_send_setup(struct tty_struct *tty, struct usb_serial_port *po
 #define HUAWEI_PRODUCT_E143E                    0x143E
 #define HUAWEI_PRODUCT_E143F                    0x143F
+#define QUANTA_VENDOR_ID                        0x0408
+#define QUANTA_PRODUCT_Q101                     0xEA02
+#define QUANTA_PRODUCT_Q111                     0xEA03
+#define QUANTA_PRODUCT_GLX                      0xEA04
+#define QUANTA_PRODUCT_GKE                      0xEA05
+#define QUANTA_PRODUCT_GLE                      0xEA06
 #define NOVATELWIRELESS_VENDOR_ID               0x1410
 /* YISO PRODUCTS */
@@ -224,7 +231,7 @@ static int  option_send_setup(struct tty_struct *tty, struct usb_serial_port *po
 #define ONDA_VENDOR_ID                          0x19d2
 #define ONDA_PRODUCT_MSA501HS                   0x0001
 #define ONDA_PRODUCT_ET502HS                    0x0002
-#define ONDA_PRODUCT_MT503HS                    0x0200
+#define ONDA_PRODUCT_MT503HS                    0x2000
 #define BANDRICH_VENDOR_ID                      0x1A8D
 #define BANDRICH_PRODUCT_C100_1                 0x1002
@@ -298,6 +305,11 @@ static struct usb_device_id option_ids[] = {
        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_MODEM_GT) },
        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_MODEM_EX) },
        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_KOI_MODEM) },
+        { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_Q101) },
+        { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_Q111) },
+        { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GLX) },
+        { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GKE) },
+        { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GLE) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E220, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E220BIS, 0xff, 0xff, 0xff) },
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 3cf41df302d7..baf591137b80 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -184,6 +184,7 @@ static struct usb_device_id ti_id_table_3410[7+TI_EXTRA_VID_PID_COUNT+1] = {
        { USB_DEVICE(MTS_VENDOR_ID, MTS_CDMA_PRODUCT_ID) },
        { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_PRODUCT_ID) },
        { USB_DEVICE(MTS_VENDOR_ID, MTS_EDGE_PRODUCT_ID) },
+        { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
 };
 static struct usb_device_id ti_id_table_5052[4+TI_EXTRA_VID_PID_COUNT+1] = {
@@ -191,6 +192,7 @@ static struct usb_device_id ti_id_table_5052[4+TI_EXTRA_VID_PID_COUNT+1] = {
        { USB_DEVICE(TI_VENDOR_ID, TI_5152_BOOT_PRODUCT_ID) },
        { USB_DEVICE(TI_VENDOR_ID, TI_5052_EEPROM_PRODUCT_ID) },
        { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
+        { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
 };
 static struct usb_device_id ti_id_table_combined[6+2*TI_EXTRA_VID_PID_COUNT+1] = {
@@ -205,6 +207,7 @@ static struct usb_device_id ti_id_table_combined[6+2*TI_EXTRA_VID_PID_COUNT+1] =
        { USB_DEVICE(TI_VENDOR_ID, TI_5152_BOOT_PRODUCT_ID) },
        { USB_DEVICE(TI_VENDOR_ID, TI_5052_EEPROM_PRODUCT_ID) },
        { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
+        { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
        { }
 };
diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h
index 7e4752fbf232..b7ea5dbadee5 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.h
+++ b/drivers/usb/serial/ti_usb_3410_5052.h
@@ -27,7 +27,9 @@
 /* Vendor and product ids */
 #define TI_VENDOR_ID                    0x0451
+#define IBM_VENDOR_ID                   0x04b3
 #define TI_3410_PRODUCT_ID              0x3410
+#define IBM_4543_PRODUCT_ID             0x4543
 #define TI_3410_EZ430_ID                0xF430  /* TI ez430 development tool */
 #define TI_5052_BOOT_PRODUCT_ID         0x5052  /* no EEPROM, no firmware */
 #define TI_5152_BOOT_PRODUCT_ID         0x5152  /* no EEPROM, no firmware */
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index a7f9513fa19d..69269f739563 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -995,6 +995,16 @@ UNUSUAL_DEV(  0x071b, 0x3203, 0x0000, 0x0000,
                US_SC_DEVICE, US_PR_DEVICE, NULL,
                US_FL_NO_WP_DETECT | US_FL_MAX_SECTORS_64),
+/* Reported by Jean-Baptiste Onofre <jb@nanthrax.net>
+ * Support the following product :
+ *    "Dane-Elec MediaTouch"
+ */
+UNUSUAL_DEV(  0x071b, 0x32bb, 0x0000, 0x0000,
+                "RockChip",
+                "MTP",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_NO_WP_DETECT | US_FL_MAX_SECTORS_64),
 /* Reported by Massimiliano Ghilardi <massimiliano.ghilardi@gmail.com>
 * This USB MP3/AVI player device fails and disconnects if more than 128
 * sectors (64kB) are read/written in a single command, and may be present
@@ -1251,6 +1261,13 @@ UNUSUAL_DEV( 0x0840, 0x0084, 0x0001, 0x0001,
                US_SC_DEVICE, US_PR_DEVICE, NULL,
                US_FL_FIX_CAPACITY),
+/* Reported by Martijn Hijdra <martijn.hijdra@gmail.com> */
+UNUSUAL_DEV( 0x0840, 0x0085, 0x0001, 0x0001,
+                "Argosy",
+                "Storage",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_FIX_CAPACITY),
 /* Entry and supporting patch by Theodore Kilgore <kilgota@auburn.edu>.
 * Flag will support Bulk devices which use a standards-violating 32-byte
 * Command Block Wrapper. Here, the "DC2MEGA" cameras (several brands) with
@@ -1589,6 +1606,13 @@ UNUSUAL_DEV(  0x0fce, 0xd008, 0x0000, 0x0000,
                US_SC_DEVICE, US_PR_DEVICE, NULL,
                US_FL_NO_WP_DETECT ),
+/* Reported by The Solutor <thesolutor@gmail.com> */
+UNUSUAL_DEV(  0x0fce, 0xd0e1, 0x0000, 0x0000,
+                "Sony Ericsson",
+                "MD400",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_IGNORE_DEVICE),
 /* Reported by Jan Mate <mate@fiit.stuba.sk>
 * and by Soeren Sonnenburg <kernel@nn7.de> */
 UNUSUAL_DEV(  0x0fce, 0xe030, 0x0000, 0x0000,
@@ -2031,15 +2055,11 @@ UNUSUAL_DEV(  0x1652, 0x6600, 0x0201, 0x0201,
                US_SC_DEVICE, US_PR_DEVICE, NULL,
                US_FL_IGNORE_RESIDUE ),
-/* Reported by Mauro Andreolini <andreoli@weblab.ing.unimo.it>
+UNUSUAL_DEV( 0x2116, 0x0320, 0x0001, 0x0001,
- * This entry is needed to bypass the ZeroCD mechanism
+                "ST",
- * and to properly load as a modem device.
+                "2A",
- */
-UNUSUAL_DEV(  0x19d2, 0x2000, 0x0000, 0x0000,
-                "Onda ET502HS",
-                "USB MMC Storage",
                US_SC_DEVICE, US_PR_DEVICE, NULL,
-                US_FL_IGNORE_DEVICE),
+                US_FL_FIX_CAPACITY),
 /* patch submitted by Davide Perini <perini.davide@dpsoftware.org>
 * and Renato Perini <rperini@email.it>
diff --git a/drivers/usb/wusbcore/devconnect.c b/drivers/usb/wusbcore/devconnect.c
index e2e7e4bc8463..8e18141bb2e0 100644
--- a/drivers/usb/wusbcore/devconnect.c
+++ b/drivers/usb/wusbcore/devconnect.c
@@ -386,6 +386,7 @@ static void __wusbhc_dev_disconnect(struct wusbhc *wusbhc,
                          | USB_PORT_STAT_LOW_SPEED | USB_PORT_STAT_HIGH_SPEED);
        port->change |= USB_PORT_STAT_C_CONNECTION | USB_PORT_STAT_C_ENABLE;
        if (wusb_dev) {
+                dev_dbg(wusbhc->dev, "disconnecting device from port %d\n", wusb_dev->port_idx);
                if (!list_empty(&wusb_dev->cack_node))
                        list_del_init(&wusb_dev->cack_node);
                /* For the one in cack_add() */
diff --git a/drivers/usb/wusbcore/rh.c b/drivers/usb/wusbcore/rh.c
index 3937bf6f8cef..9fe4246cecb9 100644
--- a/drivers/usb/wusbcore/rh.c
+++ b/drivers/usb/wusbcore/rh.c
@@ -100,6 +100,9 @@ static int wusbhc_rh_port_reset(struct wusbhc *wusbhc, u8 port_idx)
        struct wusb_port *port = wusb_port_by_idx(wusbhc, port_idx);
        struct wusb_dev *wusb_dev = port->wusb_dev;
+        if (wusb_dev == NULL)
+                return -ENOTCONN;
        port->status |= USB_PORT_STAT_RESET;
        port->change |= USB_PORT_STAT_C_RESET;
diff --git a/drivers/uwb/allocator.c b/drivers/uwb/allocator.c
index c8185e6b0cd5..c13cec7dcbc5 100644
--- a/drivers/uwb/allocator.c
+++ b/drivers/uwb/allocator.c
@@ -15,7 +15,6 @@
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
-#include <linux/version.h>
 #include <linux/kernel.h>
 #include <linux/uwb.h>
diff --git a/drivers/uwb/drp.c b/drivers/uwb/drp.c
index 2b4f9406789d..4f5ca99a04b9 100644
--- a/drivers/uwb/drp.c
+++ b/drivers/uwb/drp.c
@@ -66,14 +66,14 @@ static void uwb_rc_set_drp_cmd_done(struct uwb_rc *rc, void *arg,
        } else
                dev_err(&rc->uwb_dev.dev, "SET-DRP-IE: timeout\n");
-        spin_lock(&rc->rsvs_lock);
+        spin_lock_bh(&rc->rsvs_lock);
        if (rc->set_drp_ie_pending > 1) {
                rc->set_drp_ie_pending = 0;
                uwb_rsv_queue_update(rc);       
        } else {
                rc->set_drp_ie_pending = 0;     
        }
-        spin_unlock(&rc->rsvs_lock);
+        spin_unlock_bh(&rc->rsvs_lock);
 }
 /**
diff --git a/drivers/uwb/rsv.c b/drivers/uwb/rsv.c
index ec6eecb32f30..6b76f4bb4cc7 100644
--- a/drivers/uwb/rsv.c
+++ b/drivers/uwb/rsv.c
@@ -114,7 +114,8 @@ void uwb_rsv_dump(char *text, struct uwb_rsv *rsv)
                devaddr = rsv->target.devaddr;
        uwb_dev_addr_print(target, sizeof(target), &devaddr);
-        dev_dbg(dev, "rsv %s -> %s: %s\n", owner, target, uwb_rsv_state_str(rsv->state));
+        dev_dbg(dev, "rsv %s %s -> %s: %s\n",
+                text, owner, target, uwb_rsv_state_str(rsv->state));
 }
 static void uwb_rsv_release(struct kref *kref)
@@ -511,8 +512,7 @@ void uwb_rsv_remove(struct uwb_rsv *rsv)
        if (uwb_rsv_is_owner(rsv))
                uwb_rsv_put_stream(rsv);
-        
-        del_timer_sync(&rsv->timer);
        uwb_dev_put(rsv->owner);
        if (rsv->target.type == UWB_RSV_TARGET_DEV)
                uwb_dev_put(rsv->target.dev);
@@ -870,7 +870,7 @@ void uwb_rsv_queue_update(struct uwb_rc *rc)
 */
 void uwb_rsv_sched_update(struct uwb_rc *rc)
 {
-        spin_lock(&rc->rsvs_lock);
+        spin_lock_bh(&rc->rsvs_lock);
        if (!delayed_work_pending(&rc->rsv_update_work)) {
                if (rc->set_drp_ie_pending > 0) {
                        rc->set_drp_ie_pending++;
@@ -879,7 +879,7 @@ void uwb_rsv_sched_update(struct uwb_rc *rc)
                uwb_rsv_queue_update(rc);
        }
 unlock:
-        spin_unlock(&rc->rsvs_lock);
+        spin_unlock_bh(&rc->rsvs_lock);
 }
 /*
@@ -943,13 +943,22 @@ void uwb_rsv_remove_all(struct uwb_rc *rc)
        mutex_lock(&rc->rsvs_mutex);
        list_for_each_entry_safe(rsv, t, &rc->reservations, rc_node) {
-                uwb_rsv_remove(rsv);
+                if (rsv->state != UWB_RSV_STATE_NONE)
+                        uwb_rsv_set_state(rsv, UWB_RSV_STATE_NONE);
+                del_timer_sync(&rsv->timer);
        }
        /* Cancel any postponed update. */
        rc->set_drp_ie_pending = 0;
        mutex_unlock(&rc->rsvs_mutex);
        cancel_delayed_work_sync(&rc->rsv_update_work);
+        flush_workqueue(rc->rsv_workq);
+        mutex_lock(&rc->rsvs_mutex);
+        list_for_each_entry_safe(rsv, t, &rc->reservations, rc_node) {
+                uwb_rsv_remove(rsv);
+        }
+        mutex_unlock(&rc->rsvs_mutex);
 }
 void uwb_rsv_init(struct uwb_rc *rc)
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 6372f8b17b45..f0267706cb45 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -41,7 +41,7 @@ menuconfig FB
          You need an utility program called fbset to make full use of frame
          buffer devices. Please read <file:Documentation/fb/framebuffer.txt>
          and the Framebuffer-HOWTO at
-          <http://www.tahallah.demon.co.uk/programming/prog.html> for more
+          <http://www.munted.org.uk/programming/Framebuffer-HOWTO-1.2.html> for more
          information.
          Say Y here and to the driver for your graphics board below if you
@@ -2123,6 +2123,18 @@ config FB_PRE_INIT_FB
          Select this option if display contents should be inherited as set by
          the bootloader.
+config FB_MX3
+       tristate "MX3 Framebuffer support"
+       depends on FB && MX3_IPU
+       select FB_CFB_FILLRECT
+       select FB_CFB_COPYAREA
+       select FB_CFB_IMAGEBLIT
+       default y
+       help
+         This is a framebuffer device for the i.MX31 LCD Controller. So
+         far only synchronous displays are supported. If you plan to use
+         an LCD display with your i.MX31 system, say Y here.
 source "drivers/video/omap/Kconfig"
 source "drivers/video/backlight/Kconfig"
diff --git a/drivers/video/Makefile b/drivers/video/Makefile
index be2b657546ef..2a998ca6181d 100644
--- a/drivers/video/Makefile
+++ b/drivers/video/Makefile
@@ -132,6 +132,7 @@ obj-$(CONFIG_FB_VGA16)            += vga16fb.o
 obj-$(CONFIG_FB_OF)               += offb.o
 obj-$(CONFIG_FB_BF54X_LQ043)      += bf54x-lq043fb.o
 obj-$(CONFIG_FB_BFIN_T350MCQB)    += bfin-t350mcqb-fb.o
+obj-$(CONFIG_FB_MX3)              += mx3fb.o
 # the test framebuffer is last
 obj-$(CONFIG_FB_VIRTUAL)          += vfb.o
diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
index db16112cf197..fb2b0f5b23bd 100644
--- a/drivers/video/aty/aty128fb.c
+++ b/drivers/video/aty/aty128fb.c
@@ -1475,7 +1475,7 @@ static int aty128fb_set_par(struct fb_info *info)
        aty128_set_pll(&par->pll, par);
        aty128_set_fifo(&par->fifo_reg, par);
-        config = aty_ld_le32(CONFIG_CNTL) & ~3;
+        config = aty_ld_le32(CNFG_CNTL) & ~3;
 #if defined(__BIG_ENDIAN)
        if (par->crtc.bpp == 32)
@@ -1484,7 +1484,7 @@ static int aty128fb_set_par(struct fb_info *info)
                config |= 1;    /* make aperture do 16 bit swapping */
 #endif
-        aty_st_le32(CONFIG_CNTL, config);
+        aty_st_le32(CNFG_CNTL, config);
        aty_st_8(CRTC_EXT_CNTL + 1, 0); /* turn the video back on */
        info->fix.line_length = (par->crtc.vxres * par->crtc.bpp) >> 3;
@@ -1875,7 +1875,7 @@ static int __devinit aty128_init(struct pci_dev *pdev, const struct pci_device_i
        u32 dac;
        /* Get the chip revision */
-        chip_rev = (aty_ld_le32(CONFIG_CNTL) >> 16) & 0x1F;
+        chip_rev = (aty_ld_le32(CNFG_CNTL) >> 16) & 0x1F;
        strcpy(video_card, "Rage128 XX ");
        video_card[8] = ent->device >> 8;
@@ -2057,7 +2057,7 @@ static int __devinit aty128_probe(struct pci_dev *pdev, const struct pci_device_
        /* Grab memory size from the card */
        // How does this relate to the resource length from the PCI hardware?
-        par->vram_size = aty_ld_le32(CONFIG_MEMSIZE) & 0x03FFFFFF;
+        par->vram_size = aty_ld_le32(CNFG_MEMSIZE) & 0x03FFFFFF;
        /* Virtualize the framebuffer */
        info->screen_base = ioremap(fb_addr, par->vram_size);
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index cc6b470073da..1d6e16d346a5 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -135,7 +135,7 @@
 #if defined(CONFIG_PM) || defined(CONFIG_PMAC_BACKLIGHT) || \
 defined (CONFIG_FB_ATY_GENERIC_LCD) || defined(CONFIG_FB_ATY_BACKLIGHT)
 static const u32 lt_lcd_regs[] = {
-        CONFIG_PANEL_LG,
+        CNFG_PANEL_LG,
        LCD_GEN_CNTL_LG,
        DSTN_CONTROL_LG,
        HFB_PITCH_ADDR_LG,
@@ -446,7 +446,7 @@ static int __devinit correct_chipset(struct atyfb_par *par)
        par->pll_limits.ecp_max = aty_chips[i].ecp_max;
        par->features = aty_chips[i].features;
-        chip_id = aty_ld_le32(CONFIG_CHIP_ID, par);
+        chip_id = aty_ld_le32(CNFG_CHIP_ID, par);
        type = chip_id & CFG_CHIP_TYPE;
        rev = (chip_id & CFG_CHIP_REV) >> 24;
@@ -629,7 +629,7 @@ static void aty_get_crtc(const struct atyfb_par *par, struct crtc *crtc)
                    crtc->lcd_index = aty_ld_le32(LCD_INDEX, par);
                    aty_st_le32(LCD_INDEX, crtc->lcd_index, par);
                }
-                crtc->lcd_config_panel = aty_ld_lcd(CONFIG_PANEL, par);
+                crtc->lcd_config_panel = aty_ld_lcd(CNFG_PANEL, par);
                crtc->lcd_gen_cntl = aty_ld_lcd(LCD_GEN_CNTL, par);
@@ -676,7 +676,7 @@ static void aty_set_crtc(const struct atyfb_par *par, const struct crtc *crtc)
                aty_st_le32(CRTC_GEN_CNTL, crtc->gen_cntl & ~(CRTC_EXT_DISP_EN | CRTC_EN), par);
                /* update non-shadow registers first */
-                aty_st_lcd(CONFIG_PANEL, crtc->lcd_config_panel, par);
+                aty_st_lcd(CNFG_PANEL, crtc->lcd_config_panel, par);
                aty_st_lcd(LCD_GEN_CNTL, crtc->lcd_gen_cntl &
                        ~(CRTC_RW_SELECT | SHADOW_EN | SHADOW_RW_EN), par);
@@ -858,7 +858,7 @@ static int aty_var_to_crtc(const struct fb_info *info,
                if (!M64_HAS(MOBIL_BUS))
                        crtc->lcd_index |= CRTC2_DISPLAY_DIS;
-                crtc->lcd_config_panel = aty_ld_lcd(CONFIG_PANEL, par) | 0x4000;
+                crtc->lcd_config_panel = aty_ld_lcd(CNFG_PANEL, par) | 0x4000;
                crtc->lcd_gen_cntl = aty_ld_lcd(LCD_GEN_CNTL, par) & ~CRTC_RW_SELECT;
                crtc->lcd_gen_cntl &=
@@ -2254,7 +2254,7 @@ static int __devinit aty_init(struct fb_info *info)
        if (!M64_HAS(INTEGRATED)) {
                u32 stat0;
                u8 dac_type, dac_subtype, clk_type;
-                stat0 = aty_ld_le32(CONFIG_STAT0, par);
+                stat0 = aty_ld_le32(CNFG_STAT0, par);
                par->bus_type = (stat0 >> 0) & 0x07;
                par->ram_type = (stat0 >> 3) & 0x07;
                ramname = aty_gx_ram[par->ram_type];
@@ -2324,7 +2324,7 @@ static int __devinit aty_init(struct fb_info *info)
                par->dac_ops = &aty_dac_ct;
                par->pll_ops = &aty_pll_ct;
                par->bus_type = PCI;
-                par->ram_type = (aty_ld_le32(CONFIG_STAT0, par) & 0x07);
+                par->ram_type = (aty_ld_le32(CNFG_STAT0, par) & 0x07);
                ramname = aty_ct_ram[par->ram_type];
                /* for many chips, the mclk is 67 MHz for SDRAM, 63 MHz otherwise */
                if (par->pll_limits.mclk == 67 && par->ram_type < SDRAM)
@@ -2433,7 +2433,7 @@ static int __devinit aty_init(struct fb_info *info)
                }
        if (M64_HAS(MAGIC_VRAM_SIZE)) {
-                if (aty_ld_le32(CONFIG_STAT1, par) & 0x40000000)
+                if (aty_ld_le32(CNFG_STAT1, par) & 0x40000000)
                        info->fix.smem_len += 0x400000;
        }
@@ -2946,7 +2946,7 @@ static int __devinit atyfb_setup_sparc(struct pci_dev *pdev,
                 * Fix PROMs idea of MEM_CNTL settings...
                 */
                mem = aty_ld_le32(MEM_CNTL, par);
-                chip_id = aty_ld_le32(CONFIG_CHIP_ID, par);
+                chip_id = aty_ld_le32(CNFG_CHIP_ID, par);
                if (((chip_id & CFG_CHIP_TYPE) == VT_CHIP_ID) && !((chip_id >> 24) & 1)) {
                        switch (mem & 0x0f) {
                        case 3:
@@ -2964,7 +2964,7 @@ static int __devinit atyfb_setup_sparc(struct pci_dev *pdev,
                        default:
                                break;
                        }
-                        if ((aty_ld_le32(CONFIG_STAT0, par) & 7) >= SDRAM)
+                        if ((aty_ld_le32(CNFG_STAT0, par) & 7) >= SDRAM)
                                mem &= ~(0x00700000);
                }
                mem &= ~(0xcf80e000);   /* Turn off all undocumented bits. */
@@ -3572,7 +3572,7 @@ static int __init atyfb_atari_probe(void)
                }
                /* Fake pci_id for correct_chipset() */
-                switch (aty_ld_le32(CONFIG_CHIP_ID, par) & CFG_CHIP_TYPE) {
+                switch (aty_ld_le32(CNFG_CHIP_ID, par) & CFG_CHIP_TYPE) {
                case 0x00d7:
                        par->pci_id = PCI_CHIP_MACH64GX;
                        break;
diff --git a/drivers/video/aty/mach64_ct.c b/drivers/video/aty/mach64_ct.c
index c50c7cf26fe9..2745b8539485 100644
--- a/drivers/video/aty/mach64_ct.c
+++ b/drivers/video/aty/mach64_ct.c
@@ -8,6 +8,9 @@
 #include <asm/io.h>
 #include <video/mach64.h>
 #include "atyfb.h"
+#ifdef CONFIG_PPC
+#include <asm/machdep.h>
+#endif
 #undef DEBUG
@@ -536,6 +539,14 @@ static int __devinit aty_init_pll_ct(const struct fb_info *info,
        pll->ct.xclk_post_div_real = postdividers[xpost_div];
        pll->ct.mclk_fb_div = q * pll->ct.xclk_post_div_real / 8;
+#ifdef CONFIG_PPC
+        if (machine_is(powermac)) {
+                /* Override PLL_EXT_CNTL & 0x07. */
+                pll->ct.xclk_post_div = xpost_div;
+                pll->ct.xclk_ref_div = 1;
+        }
+#endif
 #ifdef DEBUG
        pllmclk = (1000000 * pll->ct.mclk_fb_mult * pll->ct.mclk_fb_div) /
                        (par->ref_clk_per * pll->ct.pll_ref_div);
diff --git a/drivers/video/aty/radeon_base.c b/drivers/video/aty/radeon_base.c
index d0f1a7fc2c9d..16bb7e3c0310 100644
--- a/drivers/video/aty/radeon_base.c
+++ b/drivers/video/aty/radeon_base.c
@@ -1936,8 +1936,8 @@ static void fixup_memory_mappings(struct radeonfb_info *rinfo)
        OUTREG(CRTC_GEN_CNTL, save_crtc_gen_cntl | CRTC_DISP_REQ_EN_B);
        mdelay(100);
-        aper_base = INREG(CONFIG_APER_0_BASE);
+        aper_base = INREG(CNFG_APER_0_BASE);
-        aper_size = INREG(CONFIG_APER_SIZE);
+        aper_size = INREG(CNFG_APER_SIZE);
 #ifdef SET_MC_FB_FROM_APERTURE
        /* Set framebuffer to be at the same address as set in PCI BAR */
@@ -2024,11 +2024,11 @@ static void radeon_identify_vram(struct radeonfb_info *rinfo)
                     ~CRTC_H_CUTOFF_ACTIVE_EN);
          }
        } else {
-          tmp = INREG(CONFIG_MEMSIZE);
+          tmp = INREG(CNFG_MEMSIZE);
        }
        /* mem size is bits [28:0], mask off the rest */
-        rinfo->video_ram = tmp & CONFIG_MEMSIZE_MASK;
+        rinfo->video_ram = tmp & CNFG_MEMSIZE_MASK;
        /*
         * Hack to get around some busted production M6's
@@ -2228,7 +2228,7 @@ static int __devinit radeonfb_pci_register (struct pci_dev *pdev,
         */
        rinfo->errata = 0;
        if (rinfo->family == CHIP_FAMILY_R300 &&
-            (INREG(CONFIG_CNTL) & CFG_ATI_REV_ID_MASK)
+            (INREG(CNFG_CNTL) & CFG_ATI_REV_ID_MASK)
            == CFG_ATI_REV_A11)
                rinfo->errata |= CHIP_ERRATA_R300_CG;
diff --git a/drivers/video/aty/radeon_i2c.c b/drivers/video/aty/radeon_i2c.c
index 2c5567175dca..359fc64e761a 100644
--- a/drivers/video/aty/radeon_i2c.c
+++ b/drivers/video/aty/radeon_i2c.c
@@ -72,7 +72,6 @@ static int radeon_setup_i2c_bus(struct radeon_i2c_chan *chan, const char *name)
        snprintf(chan->adapter.name, sizeof(chan->adapter.name),
                 "radeonfb %s", name);
        chan->adapter.owner             = THIS_MODULE;
-        chan->adapter.id                = I2C_HW_B_RADEON;
        chan->adapter.algo_data         = &chan->algo;
        chan->adapter.dev.parent        = &chan->rinfo->pdev->dev;
        chan->algo.setsda               = radeon_gpio_setsda;
diff --git a/drivers/video/aty/radeon_pm.c b/drivers/video/aty/radeon_pm.c
index 675abdafc2d8..c4ac2a032fcb 100644
--- a/drivers/video/aty/radeon_pm.c
+++ b/drivers/video/aty/radeon_pm.c
@@ -333,7 +333,7 @@ static void radeon_pm_enable_dynamic_mode(struct radeonfb_info *rinfo)
        if (!rinfo->has_CRTC2) {
                tmp = INPLL(pllSCLK_CNTL);
-                if ((INREG(CONFIG_CNTL) & CFG_ATI_REV_ID_MASK) > CFG_ATI_REV_A13)
+                if ((INREG(CNFG_CNTL) & CFG_ATI_REV_ID_MASK) > CFG_ATI_REV_A13)
                    tmp &= ~(SCLK_CNTL__FORCE_CP        | SCLK_CNTL__FORCE_RB);
                tmp &= ~(SCLK_CNTL__FORCE_HDP           | SCLK_CNTL__FORCE_DISP1 |
                         SCLK_CNTL__FORCE_TOP           | SCLK_CNTL__FORCE_SE   |
@@ -468,9 +468,9 @@ static void radeon_pm_enable_dynamic_mode(struct radeonfb_info *rinfo)
        /*RAGE_6::A11 A12 A12N1 A13, RV250::A11 A12, R300*/
        if ((rinfo->family == CHIP_FAMILY_RV250 &&
-             ((INREG(CONFIG_CNTL) & CFG_ATI_REV_ID_MASK) < CFG_ATI_REV_A13)) ||
+             ((INREG(CNFG_CNTL) & CFG_ATI_REV_ID_MASK) < CFG_ATI_REV_A13)) ||
            ((rinfo->family == CHIP_FAMILY_RV100) &&
-             ((INREG(CONFIG_CNTL) & CFG_ATI_REV_ID_MASK) <= CFG_ATI_REV_A13))) {
+             ((INREG(CNFG_CNTL) & CFG_ATI_REV_ID_MASK) <= CFG_ATI_REV_A13))) {
                tmp |= SCLK_CNTL__FORCE_CP;
                tmp |= SCLK_CNTL__FORCE_VIP;
        }
@@ -486,7 +486,7 @@ static void radeon_pm_enable_dynamic_mode(struct radeonfb_info *rinfo)
                /* RV200::A11 A12 RV250::A11 A12 */
                if (((rinfo->family == CHIP_FAMILY_RV200) ||
                     (rinfo->family == CHIP_FAMILY_RV250)) &&
-                    ((INREG(CONFIG_CNTL) & CFG_ATI_REV_ID_MASK) < CFG_ATI_REV_A13))
+                    ((INREG(CNFG_CNTL) & CFG_ATI_REV_ID_MASK) < CFG_ATI_REV_A13))
                        tmp |= SCLK_MORE_CNTL__FORCEON;
                OUTPLL(pllSCLK_MORE_CNTL, tmp);
@@ -497,7 +497,7 @@ static void radeon_pm_enable_dynamic_mode(struct radeonfb_info *rinfo)
        /* RV200::A11 A12, RV250::A11 A12 */
        if (((rinfo->family == CHIP_FAMILY_RV200) ||
             (rinfo->family == CHIP_FAMILY_RV250)) &&
-            ((INREG(CONFIG_CNTL) & CFG_ATI_REV_ID_MASK) < CFG_ATI_REV_A13)) {
+            ((INREG(CNFG_CNTL) & CFG_ATI_REV_ID_MASK) < CFG_ATI_REV_A13)) {
                tmp = INPLL(pllPLL_PWRMGT_CNTL);
                tmp |= PLL_PWRMGT_CNTL__TCL_BYPASS_DISABLE;
                OUTPLL(pllPLL_PWRMGT_CNTL, tmp);
@@ -702,7 +702,7 @@ static void radeon_pm_restore_regs(struct radeonfb_info *rinfo)
        OUTREG(DISPLAY_BASE_ADDR, rinfo->save_regs[31]);
        OUTREG(MC_AGP_LOCATION, rinfo->save_regs[32]);
        OUTREG(CRTC2_DISPLAY_BASE_ADDR, rinfo->save_regs[33]);
-        OUTREG(CONFIG_MEMSIZE, rinfo->video_ram);
+        OUTREG(CNFG_MEMSIZE, rinfo->video_ram);
        OUTREG(DISP_MISC_CNTL, rinfo->save_regs[9]);
        OUTREG(DISP_PWR_MAN, rinfo->save_regs[10]);
@@ -1723,7 +1723,7 @@ static void radeon_reinitialize_M10(struct radeonfb_info *rinfo)
        OUTREG(CRTC2_DISPLAY_BASE_ADDR, rinfo->save_regs[33]);
        OUTREG(MC_FB_LOCATION, rinfo->save_regs[30]);
        OUTREG(OV0_BASE_ADDR, rinfo->save_regs[80]);
-        OUTREG(CONFIG_MEMSIZE, rinfo->video_ram);
+        OUTREG(CNFG_MEMSIZE, rinfo->video_ram);
        OUTREG(BUS_CNTL, rinfo->save_regs[36]);
        OUTREG(BUS_CNTL1, rinfo->save_regs[14]);
        OUTREG(MPP_TB_CONFIG, rinfo->save_regs[37]);
@@ -1961,7 +1961,7 @@ static void radeon_pm_m9p_reconfigure_mc(struct radeonfb_info *rinfo)
        OUTMC(rinfo, ixMC_CHP_IO_CNTL_B1, rinfo->save_regs[68] /*0x141555ff*/);
        OUTMC(rinfo, ixMC_IMP_CNTL_0, rinfo->save_regs[71] /*0x00009249*/);
        OUTREG(MC_IND_INDEX, 0);
-        OUTREG(CONFIG_MEMSIZE, rinfo->video_ram);
+        OUTREG(CNFG_MEMSIZE, rinfo->video_ram);
        mdelay(20);
 }
@@ -2361,7 +2361,7 @@ static void radeon_reinitialize_QW(struct radeonfb_info *rinfo)
        OUTMC(rinfo, ixMC_IMP_CNTL_0, 0x00009249);
        OUTREG(MC_IND_INDEX, 0);
-        OUTREG(CONFIG_MEMSIZE, rinfo->video_ram);
+        OUTREG(CNFG_MEMSIZE, rinfo->video_ram);
        radeon_pm_full_reset_sdram(rinfo);
diff --git a/drivers/video/backlight/Makefile b/drivers/video/backlight/Makefile
index 363b3cb2f01b..63d759498165 100644
--- a/drivers/video/backlight/Makefile
+++ b/drivers/video/backlight/Makefile
@@ -18,7 +18,7 @@ obj-$(CONFIG_BACKLIGHT_OMAP1)	+= omap1_bl.o
 obj-$(CONFIG_BACKLIGHT_PROGEAR) += progear_bl.o
 obj-$(CONFIG_BACKLIGHT_CARILLO_RANCH) += cr_bllcd.o
 obj-$(CONFIG_BACKLIGHT_PWM)     += pwm_bl.o
-obj-$(CONFIG_BACKLIGHT_DA903X)  += da903x.o
+obj-$(CONFIG_BACKLIGHT_DA903X)  += da903x_bl.o
 obj-$(CONFIG_BACKLIGHT_MBP_NVIDIA) += mbp_nvidia_bl.o
 obj-$(CONFIG_BACKLIGHT_TOSA)    += tosa_bl.o
 obj-$(CONFIG_BACKLIGHT_SAHARA)  += kb3886_bl.o
diff --git a/drivers/video/backlight/da903x.c b/drivers/video/backlight/da903x_bl.c
index 93bb4340cc64..93bb4340cc64 100644
--- a/drivers/video/backlight/da903x.c
+++ b/drivers/video/backlight/da903x_bl.c
diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c
index 91b78e691505..f53b9f1d6aba 100644
--- a/drivers/video/fbcmap.c
+++ b/drivers/video/fbcmap.c
@@ -250,10 +250,6 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
        int rc, size = cmap->len * sizeof(u16);
        struct fb_cmap umap;
-        if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
-                                !info->fbops->fb_setcmap))
-                return -EINVAL;
        memset(&umap, 0, sizeof(struct fb_cmap));
        rc = fb_alloc_cmap(&umap, cmap->len, cmap->transp != NULL);
        if (rc)
@@ -262,11 +258,23 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
            copy_from_user(umap.green, cmap->green, size) ||
            copy_from_user(umap.blue, cmap->blue, size) ||
            (cmap->transp && copy_from_user(umap.transp, cmap->transp, size))) {
-                fb_dealloc_cmap(&umap);
+                rc = -EFAULT;
-                return -EFAULT;
+                goto out;
        }
        umap.start = cmap->start;
+        if (!lock_fb_info(info)) {
+                rc = -ENODEV;
+                goto out;
+        }
+        if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
+                                !info->fbops->fb_setcmap)) {
+                rc = -EINVAL;
+                goto out1;
+        }
        rc = fb_set_cmap(&umap, info);
+out1:
+        unlock_fb_info(info);
+out:
        fb_dealloc_cmap(&umap);
        return rc;
 }
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 756efeb91abc..cfd9dce1ce0b 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -1013,132 +1013,139 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
        struct fb_var_screeninfo var;
        struct fb_fix_screeninfo fix;
        struct fb_con2fbmap con2fb;
+        struct fb_cmap cmap_from;
        struct fb_cmap_user cmap;
        struct fb_event event;
        void __user *argp = (void __user *)arg;
        long ret = 0;
-        fb = info->fbops;
-        if (!fb)
-                return -ENODEV;
        switch (cmd) {
        case FBIOGET_VSCREENINFO:
-                ret = copy_to_user(argp, &info->var,
+                if (!lock_fb_info(info))
-                                    sizeof(var)) ? -EFAULT : 0;
+                        return -ENODEV;
+                var = info->var;
+                unlock_fb_info(info);
+                ret = copy_to_user(argp, &var, sizeof(var)) ? -EFAULT : 0;
                break;
        case FBIOPUT_VSCREENINFO:
-                if (copy_from_user(&var, argp, sizeof(var))) {
+                if (copy_from_user(&var, argp, sizeof(var)))
-                        ret =  -EFAULT;
+                        return -EFAULT;
-                        break;
+                if (!lock_fb_info(info))
-                }
+                        return -ENODEV;
                acquire_console_sem();
                info->flags |= FBINFO_MISC_USEREVENT;
                ret = fb_set_var(info, &var);
                info->flags &= ~FBINFO_MISC_USEREVENT;
                release_console_sem();
-                if (ret == 0 && copy_to_user(argp, &var, sizeof(var)))
+                unlock_fb_info(info);
+                if (!ret && copy_to_user(argp, &var, sizeof(var)))
                        ret = -EFAULT;
                break;
        case FBIOGET_FSCREENINFO:
-                ret = copy_to_user(argp, &info->fix,
+                if (!lock_fb_info(info))
-                                    sizeof(fix)) ? -EFAULT : 0;
+                        return -ENODEV;
+                fix = info->fix;
+                unlock_fb_info(info);
+                ret = copy_to_user(argp, &fix, sizeof(fix)) ? -EFAULT : 0;
                break;
        case FBIOPUTCMAP:
                if (copy_from_user(&cmap, argp, sizeof(cmap)))
-                        ret = -EFAULT;
+                        return -EFAULT;
-                else
+                ret = fb_set_user_cmap(&cmap, info);
-                        ret = fb_set_user_cmap(&cmap, info);
                break;
        case FBIOGETCMAP:
                if (copy_from_user(&cmap, argp, sizeof(cmap)))
-                        ret = -EFAULT;
+                        return -EFAULT;
-                else
+                if (!lock_fb_info(info))
-                        ret = fb_cmap_to_user(&info->cmap, &cmap);
+                        return -ENODEV;
+                cmap_from = info->cmap;
+                unlock_fb_info(info);
+                ret = fb_cmap_to_user(&cmap_from, &cmap);
                break;
        case FBIOPAN_DISPLAY:
-                if (copy_from_user(&var, argp, sizeof(var))) {
+                if (copy_from_user(&var, argp, sizeof(var)))
-                        ret = -EFAULT;
+                        return -EFAULT;
-                        break;
+                if (!lock_fb_info(info))
-                }
+                        return -ENODEV;
                acquire_console_sem();
                ret = fb_pan_display(info, &var);
                release_console_sem();
+                unlock_fb_info(info);
                if (ret == 0 && copy_to_user(argp, &var, sizeof(var)))
-                        ret = -EFAULT;
+                        return -EFAULT;
                break;
        case FBIO_CURSOR:
                ret = -EINVAL;
                break;
        case FBIOGET_CON2FBMAP:
                if (copy_from_user(&con2fb, argp, sizeof(con2fb)))
-                        ret = -EFAULT;
+                        return -EFAULT;
-                else if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
+                if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
-                        ret = -EINVAL;
+                        return -EINVAL;
-                else {
+                con2fb.framebuffer = -1;
-                        con2fb.framebuffer = -1;
+                event.data = &con2fb;
-                        event.info = info;
-                        event.data = &con2fb;
+                if (!lock_fb_info(info))
-                        fb_notifier_call_chain(FB_EVENT_GET_CONSOLE_MAP,
+                        return -ENODEV;
-                                                                &event);
+                event.info = info;
-                        ret = copy_to_user(argp, &con2fb,
+                fb_notifier_call_chain(FB_EVENT_GET_CONSOLE_MAP, &event);
-                                    sizeof(con2fb)) ? -EFAULT : 0;
+                unlock_fb_info(info);
-                }
+                ret = copy_to_user(argp, &con2fb, sizeof(con2fb)) ? -EFAULT : 0;
                break;
        case FBIOPUT_CON2FBMAP:
-                if (copy_from_user(&con2fb, argp, sizeof(con2fb))) {
+                if (copy_from_user(&con2fb, argp, sizeof(con2fb)))
-                        ret = -EFAULT;
+                        return -EFAULT;
-                        break;
+                if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
-                }
+                        return -EINVAL;
-                if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES) {
+                if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
-                        ret = -EINVAL;
+                        return -EINVAL;
-                        break;
-                }
-                if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX) {
-                        ret = -EINVAL;
-                        break;
-                }
                if (!registered_fb[con2fb.framebuffer])
                        request_module("fb%d", con2fb.framebuffer);
                if (!registered_fb[con2fb.framebuffer]) {
                        ret = -EINVAL;
                        break;
                }
-                event.info = info;
                event.data = &con2fb;
+                if (!lock_fb_info(info))
+                        return -ENODEV;
+                event.info = info;
                ret = fb_notifier_call_chain(FB_EVENT_SET_CONSOLE_MAP,
                                              &event);
+                unlock_fb_info(info);
                break;
        case FBIOBLANK:
+                if (!lock_fb_info(info))
+                        return -ENODEV;
                acquire_console_sem();
                info->flags |= FBINFO_MISC_USEREVENT;
                ret = fb_blank(info, arg);
                info->flags &= ~FBINFO_MISC_USEREVENT;
                release_console_sem();
-                break;;
+                unlock_fb_info(info);
+                break;
        default:
-                if (fb->fb_ioctl == NULL)
+                if (!lock_fb_info(info))
-                        ret = -ENOTTY;
+                        return -ENODEV;
-                else
+                fb = info->fbops;
+                if (fb->fb_ioctl)
                        ret = fb->fb_ioctl(info, cmd, arg);
+                else
+                        ret = -ENOTTY;
+                unlock_fb_info(info);
        }
        return ret;
 }
 static long fb_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
-__acquires(&info->lock)
-__releases(&info->lock)
 {
        struct inode *inode = file->f_path.dentry->d_inode;
        int fbidx = iminor(inode);
-        struct fb_info *info;
+        struct fb_info *info = registered_fb[fbidx];
-        long ret;
-        info = registered_fb[fbidx];
+        return do_fb_ioctl(info, cmd, arg);
-        mutex_lock(&info->lock);
-        ret = do_fb_ioctl(info, cmd, arg);
-        mutex_unlock(&info->lock);
-        return ret;
 }
 #ifdef CONFIG_COMPAT
@@ -1257,8 +1264,6 @@ static int fb_get_fscreeninfo(struct fb_info *info, unsigned int cmd,
 static long fb_compat_ioctl(struct file *file, unsigned int cmd,
                            unsigned long arg)
-__acquires(&info->lock)
-__releases(&info->lock)
 {
        struct inode *inode = file->f_path.dentry->d_inode;
        int fbidx = iminor(inode);
@@ -1266,7 +1271,6 @@ __releases(&info->lock)
        struct fb_ops *fb = info->fbops;
        long ret = -ENOIOCTLCMD;
-        mutex_lock(&info->lock);
        switch(cmd) {
        case FBIOGET_VSCREENINFO:
        case FBIOPUT_VSCREENINFO:
@@ -1292,7 +1296,6 @@ __releases(&info->lock)
                        ret = fb->fb_compat_ioctl(info, cmd, arg);
                break;
        }
-        mutex_unlock(&info->lock);
        return ret;
 }
 #endif
diff --git a/drivers/video/i810/i810-i2c.c b/drivers/video/i810/i810-i2c.c
index 7787c3322ffb..9dd55e5324a1 100644
--- a/drivers/video/i810/i810-i2c.c
+++ b/drivers/video/i810/i810-i2c.c
@@ -90,7 +90,6 @@ static int i810_setup_i2c_bus(struct i810fb_i2c_chan *chan, const char *name)
        chan->adapter.owner             = THIS_MODULE;
        chan->adapter.algo_data         = &chan->algo;
        chan->adapter.dev.parent        = &chan->par->dev->dev;
-        chan->adapter.id                = I2C_HW_B_I810;
        chan->algo.setsda               = i810i2c_setsda;
        chan->algo.setscl               = i810i2c_setscl;
        chan->algo.getsda               = i810i2c_getsda;
diff --git a/drivers/video/intelfb/intelfb_i2c.c b/drivers/video/intelfb/intelfb_i2c.c
index 5d896b81f4e0..b3065492bb20 100644
--- a/drivers/video/intelfb/intelfb_i2c.c
+++ b/drivers/video/intelfb/intelfb_i2c.c
@@ -111,7 +111,6 @@ static int intelfb_setup_i2c_bus(struct intelfb_info *dinfo,
                 "intelfb %s", name);
        chan->adapter.class             = class;
        chan->adapter.owner             = THIS_MODULE;
-        chan->adapter.id                = I2C_HW_B_INTELFB;
        chan->adapter.algo_data         = &chan->algo;
        chan->adapter.dev.parent        = &chan->dinfo->pdev->dev;
        chan->algo.setsda               = intelfb_gpio_setsda;
diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c
new file mode 100644
index 000000000000..8a75d05f4334
--- /dev/null
+++ b/drivers/video/mx3fb.c
@@ -0,0 +1,1555 @@
+/*
+ * Copyright (C) 2008
+ * Guennadi Liakhovetski, DENX Software Engineering, <lg@denx.de>
+ *
+ * Copyright 2004-2007 Freescale Semiconductor, Inc. All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/platform_device.h>
+#include <linux/sched.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+#include <linux/interrupt.h>
+#include <linux/slab.h>
+#include <linux/fb.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/dma-mapping.h>
+#include <linux/dmaengine.h>
+#include <linux/console.h>
+#include <linux/clk.h>
+#include <linux/mutex.h>
+#include <mach/hardware.h>
+#include <mach/ipu.h>
+#include <mach/mx3fb.h>
+#include <asm/io.h>
+#include <asm/uaccess.h>
+#define MX3FB_NAME             "mx3_sdc_fb"
+#define MX3FB_REG_OFFSET       0xB4
+/* SDC Registers */
+#define SDC_COM_CONF           (0xB4 - MX3FB_REG_OFFSET)
+#define SDC_GW_CTRL            (0xB8 - MX3FB_REG_OFFSET)
+#define SDC_FG_POS             (0xBC - MX3FB_REG_OFFSET)
+#define SDC_BG_POS             (0xC0 - MX3FB_REG_OFFSET)
+#define SDC_CUR_POS            (0xC4 - MX3FB_REG_OFFSET)
+#define SDC_PWM_CTRL           (0xC8 - MX3FB_REG_OFFSET)
+#define SDC_CUR_MAP            (0xCC - MX3FB_REG_OFFSET)
+#define SDC_HOR_CONF           (0xD0 - MX3FB_REG_OFFSET)
+#define SDC_VER_CONF           (0xD4 - MX3FB_REG_OFFSET)
+#define SDC_SHARP_CONF_1       (0xD8 - MX3FB_REG_OFFSET)
+#define SDC_SHARP_CONF_2       (0xDC - MX3FB_REG_OFFSET)
+/* Register bits */
+#define SDC_COM_TFT_COLOR      0x00000001UL
+#define SDC_COM_FG_EN          0x00000010UL
+#define SDC_COM_GWSEL          0x00000020UL
+#define SDC_COM_GLB_A          0x00000040UL
+#define SDC_COM_KEY_COLOR_G    0x00000080UL
+#define SDC_COM_BG_EN          0x00000200UL
+#define SDC_COM_SHARP          0x00001000UL
+#define SDC_V_SYNC_WIDTH_L     0x00000001UL
+/* Display Interface registers */
+#define DI_DISP_IF_CONF                (0x0124 - MX3FB_REG_OFFSET)
+#define DI_DISP_SIG_POL                (0x0128 - MX3FB_REG_OFFSET)
+#define DI_SER_DISP1_CONF      (0x012C - MX3FB_REG_OFFSET)
+#define DI_SER_DISP2_CONF      (0x0130 - MX3FB_REG_OFFSET)
+#define DI_HSP_CLK_PER         (0x0134 - MX3FB_REG_OFFSET)
+#define DI_DISP0_TIME_CONF_1   (0x0138 - MX3FB_REG_OFFSET)
+#define DI_DISP0_TIME_CONF_2   (0x013C - MX3FB_REG_OFFSET)
+#define DI_DISP0_TIME_CONF_3   (0x0140 - MX3FB_REG_OFFSET)
+#define DI_DISP1_TIME_CONF_1   (0x0144 - MX3FB_REG_OFFSET)
+#define DI_DISP1_TIME_CONF_2   (0x0148 - MX3FB_REG_OFFSET)
+#define DI_DISP1_TIME_CONF_3   (0x014C - MX3FB_REG_OFFSET)
+#define DI_DISP2_TIME_CONF_1   (0x0150 - MX3FB_REG_OFFSET)
+#define DI_DISP2_TIME_CONF_2   (0x0154 - MX3FB_REG_OFFSET)
+#define DI_DISP2_TIME_CONF_3   (0x0158 - MX3FB_REG_OFFSET)
+#define DI_DISP3_TIME_CONF     (0x015C - MX3FB_REG_OFFSET)
+#define DI_DISP0_DB0_MAP       (0x0160 - MX3FB_REG_OFFSET)
+#define DI_DISP0_DB1_MAP       (0x0164 - MX3FB_REG_OFFSET)
+#define DI_DISP0_DB2_MAP       (0x0168 - MX3FB_REG_OFFSET)
+#define DI_DISP0_CB0_MAP       (0x016C - MX3FB_REG_OFFSET)
+#define DI_DISP0_CB1_MAP       (0x0170 - MX3FB_REG_OFFSET)
+#define DI_DISP0_CB2_MAP       (0x0174 - MX3FB_REG_OFFSET)
+#define DI_DISP1_DB0_MAP       (0x0178 - MX3FB_REG_OFFSET)
+#define DI_DISP1_DB1_MAP       (0x017C - MX3FB_REG_OFFSET)
+#define DI_DISP1_DB2_MAP       (0x0180 - MX3FB_REG_OFFSET)
+#define DI_DISP1_CB0_MAP       (0x0184 - MX3FB_REG_OFFSET)
+#define DI_DISP1_CB1_MAP       (0x0188 - MX3FB_REG_OFFSET)
+#define DI_DISP1_CB2_MAP       (0x018C - MX3FB_REG_OFFSET)
+#define DI_DISP2_DB0_MAP       (0x0190 - MX3FB_REG_OFFSET)
+#define DI_DISP2_DB1_MAP       (0x0194 - MX3FB_REG_OFFSET)
+#define DI_DISP2_DB2_MAP       (0x0198 - MX3FB_REG_OFFSET)
+#define DI_DISP2_CB0_MAP       (0x019C - MX3FB_REG_OFFSET)
+#define DI_DISP2_CB1_MAP       (0x01A0 - MX3FB_REG_OFFSET)
+#define DI_DISP2_CB2_MAP       (0x01A4 - MX3FB_REG_OFFSET)
+#define DI_DISP3_B0_MAP                (0x01A8 - MX3FB_REG_OFFSET)
+#define DI_DISP3_B1_MAP                (0x01AC - MX3FB_REG_OFFSET)
+#define DI_DISP3_B2_MAP                (0x01B0 - MX3FB_REG_OFFSET)
+#define DI_DISP_ACC_CC         (0x01B4 - MX3FB_REG_OFFSET)
+#define DI_DISP_LLA_CONF       (0x01B8 - MX3FB_REG_OFFSET)
+#define DI_DISP_LLA_DATA       (0x01BC - MX3FB_REG_OFFSET)
+/* DI_DISP_SIG_POL bits */
+#define DI_D3_VSYNC_POL_SHIFT          28
+#define DI_D3_HSYNC_POL_SHIFT          27
+#define DI_D3_DRDY_SHARP_POL_SHIFT     26
+#define DI_D3_CLK_POL_SHIFT            25
+#define DI_D3_DATA_POL_SHIFT           24
+/* DI_DISP_IF_CONF bits */
+#define DI_D3_CLK_IDLE_SHIFT           26
+#define DI_D3_CLK_SEL_SHIFT            25
+#define DI_D3_DATAMSK_SHIFT            24
+enum ipu_panel {
+       IPU_PANEL_SHARP_TFT,
+       IPU_PANEL_TFT,
+};
+struct ipu_di_signal_cfg {
+       unsigned datamask_en:1;
+       unsigned clksel_en:1;
+       unsigned clkidle_en:1;
+       unsigned data_pol:1;    /* true = inverted */
+       unsigned clk_pol:1;     /* true = rising edge */
+       unsigned enable_pol:1;
+       unsigned Hsync_pol:1;   /* true = active high */
+       unsigned Vsync_pol:1;
+};
+static const struct fb_videomode mx3fb_modedb[] = {
+       {
+               /* 240x320 @ 60 Hz */
+               .name           = "Sharp-QVGA",
+               .refresh        = 60,
+               .xres           = 240,
+               .yres           = 320,
+               .pixclock       = 185925,
+               .left_margin    = 9,
+               .right_margin   = 16,
+               .upper_margin   = 7,
+               .lower_margin   = 9,
+               .hsync_len      = 1,
+               .vsync_len      = 1,
+               .sync           = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_SHARP_MODE |
+                                 FB_SYNC_CLK_INVERT | FB_SYNC_DATA_INVERT |
+                                 FB_SYNC_CLK_IDLE_EN,
+               .vmode          = FB_VMODE_NONINTERLACED,
+               .flag           = 0,
+       }, {
+               /* 240x33 @ 60 Hz */
+               .name           = "Sharp-CLI",
+               .refresh        = 60,
+               .xres           = 240,
+               .yres           = 33,
+               .pixclock       = 185925,
+               .left_margin    = 9,
+               .right_margin   = 16,
+               .upper_margin   = 7,
+               .lower_margin   = 9 + 287,
+               .hsync_len      = 1,
+               .vsync_len      = 1,
+               .sync           = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_SHARP_MODE |
+                                 FB_SYNC_CLK_INVERT | FB_SYNC_DATA_INVERT |
+                                 FB_SYNC_CLK_IDLE_EN,
+               .vmode          = FB_VMODE_NONINTERLACED,
+               .flag           = 0,
+       }, {
+               /* 640x480 @ 60 Hz */
+               .name           = "NEC-VGA",
+               .refresh        = 60,
+               .xres           = 640,
+               .yres           = 480,
+               .pixclock       = 38255,
+               .left_margin    = 144,
+               .right_margin   = 0,
+               .upper_margin   = 34,
+               .lower_margin   = 40,
+               .hsync_len      = 1,
+               .vsync_len      = 1,
+               .sync           = FB_SYNC_VERT_HIGH_ACT | FB_SYNC_OE_ACT_HIGH,
+               .vmode          = FB_VMODE_NONINTERLACED,
+               .flag           = 0,
+       }, {
+               /* NTSC TV output */
+               .name           = "TV-NTSC",
+               .refresh        = 60,
+               .xres           = 640,
+               .yres           = 480,
+               .pixclock       = 37538,
+               .left_margin    = 38,
+               .right_margin   = 858 - 640 - 38 - 3,
+               .upper_margin   = 36,
+               .lower_margin   = 518 - 480 - 36 - 1,
+               .hsync_len      = 3,
+               .vsync_len      = 1,
+               .sync           = 0,
+               .vmode          = FB_VMODE_NONINTERLACED,
+               .flag           = 0,
+       }, {
+               /* PAL TV output */
+               .name           = "TV-PAL",
+               .refresh        = 50,
+               .xres           = 640,
+               .yres           = 480,
+               .pixclock       = 37538,
+               .left_margin    = 38,
+               .right_margin   = 960 - 640 - 38 - 32,
+               .upper_margin   = 32,
+               .lower_margin   = 555 - 480 - 32 - 3,
+               .hsync_len      = 32,
+               .vsync_len      = 3,
+               .sync           = 0,
+               .vmode          = FB_VMODE_NONINTERLACED,
+               .flag           = 0,
+       }, {
+               /* TV output VGA mode, 640x480 @ 65 Hz */
+               .name           = "TV-VGA",
+               .refresh        = 60,
+               .xres           = 640,
+               .yres           = 480,
+               .pixclock       = 40574,
+               .left_margin    = 35,
+               .right_margin   = 45,
+               .upper_margin   = 9,
+               .lower_margin   = 1,
+               .hsync_len      = 46,
+               .vsync_len      = 5,
+               .sync           = 0,
+               .vmode          = FB_VMODE_NONINTERLACED,
+               .flag           = 0,
+       },
+};
+struct mx3fb_data {
+       struct fb_info          *fbi;
+       int                     backlight_level;
+       void __iomem            *reg_base;
+       spinlock_t              lock;
+       struct device           *dev;
+       uint32_t                h_start_width;
+       uint32_t                v_start_width;
+};
+struct dma_chan_request {
+       struct mx3fb_data       *mx3fb;
+       enum ipu_channel        id;
+};
+/* MX3 specific framebuffer information. */
+struct mx3fb_info {
+       int                             blank;
+       enum ipu_channel                ipu_ch;
+       uint32_t                        cur_ipu_buf;
+       u32                             pseudo_palette[16];
+       struct completion               flip_cmpl;
+       struct mutex                    mutex;  /* Protects fb-ops */
+       struct mx3fb_data               *mx3fb;
+       struct idmac_channel            *idmac_channel;
+       struct dma_async_tx_descriptor  *txd;
+       dma_cookie_t                    cookie;
+       struct scatterlist              sg[2];
+       u32                             sync;   /* preserve var->sync flags */
+};
+static void mx3fb_dma_done(void *);
+/* Used fb-mode and bpp. Can be set on kernel command line, therefore file-static. */
+static const char *fb_mode;
+static unsigned long default_bpp = 16;
+static u32 mx3fb_read_reg(struct mx3fb_data *mx3fb, unsigned long reg)
+{
+       return __raw_readl(mx3fb->reg_base + reg);
+}
+static void mx3fb_write_reg(struct mx3fb_data *mx3fb, u32 value, unsigned long reg)
+{
+       __raw_writel(value, mx3fb->reg_base + reg);
+}
+static const uint32_t di_mappings[] = {
+       0x1600AAAA, 0x00E05555, 0x00070000, 3,  /* RGB888 */
+       0x0005000F, 0x000B000F, 0x0011000F, 1,  /* RGB666 */
+       0x0011000F, 0x000B000F, 0x0005000F, 1,  /* BGR666 */
+       0x0004003F, 0x000A000F, 0x000F003F, 1   /* RGB565 */
+};
+static void sdc_fb_init(struct mx3fb_info *fbi)
+{
+       struct mx3fb_data *mx3fb = fbi->mx3fb;
+       uint32_t reg;
+       reg = mx3fb_read_reg(mx3fb, SDC_COM_CONF);
+       mx3fb_write_reg(mx3fb, reg | SDC_COM_BG_EN, SDC_COM_CONF);
+}
+/* Returns enabled flag before uninit */
+static uint32_t sdc_fb_uninit(struct mx3fb_info *fbi)
+{
+       struct mx3fb_data *mx3fb = fbi->mx3fb;
+       uint32_t reg;
+       reg = mx3fb_read_reg(mx3fb, SDC_COM_CONF);
+       mx3fb_write_reg(mx3fb, reg & ~SDC_COM_BG_EN, SDC_COM_CONF);
+       return reg & SDC_COM_BG_EN;
+}
+static void sdc_enable_channel(struct mx3fb_info *mx3_fbi)
+{
+       struct mx3fb_data *mx3fb = mx3_fbi->mx3fb;
+       struct idmac_channel *ichan = mx3_fbi->idmac_channel;
+       struct dma_chan *dma_chan = &ichan->dma_chan;
+       unsigned long flags;
+       dma_cookie_t cookie;
+       dev_dbg(mx3fb->dev, "mx3fbi %p, desc %p, sg %p\n", mx3_fbi,
+               to_tx_desc(mx3_fbi->txd), to_tx_desc(mx3_fbi->txd)->sg);
+       /* This enables the channel */
+       if (mx3_fbi->cookie < 0) {
+               mx3_fbi->txd = dma_chan->device->device_prep_slave_sg(dma_chan,
+                     &mx3_fbi->sg[0], 1, DMA_TO_DEVICE, DMA_PREP_INTERRUPT);
+               if (!mx3_fbi->txd) {
+                       dev_err(mx3fb->dev, "Cannot allocate descriptor on %d\n",
+                               dma_chan->chan_id);
+                       return;
+               }
+               mx3_fbi->txd->callback_param    = mx3_fbi->txd;
+               mx3_fbi->txd->callback          = mx3fb_dma_done;
+               cookie = mx3_fbi->txd->tx_submit(mx3_fbi->txd);
+               dev_dbg(mx3fb->dev, "%d: Submit %p #%d [%c]\n", __LINE__,
+                      mx3_fbi->txd, cookie, list_empty(&ichan->queue) ? '-' : '+');
+       } else {
+               if (!mx3_fbi->txd || !mx3_fbi->txd->tx_submit) {
+                       dev_err(mx3fb->dev, "Cannot enable channel %d\n",
+                               dma_chan->chan_id);
+                       return;
+               }
+               /* Just re-activate the same buffer */
+               dma_async_issue_pending(dma_chan);
+               cookie = mx3_fbi->cookie;
+               dev_dbg(mx3fb->dev, "%d: Re-submit %p #%d [%c]\n", __LINE__,
+                      mx3_fbi->txd, cookie, list_empty(&ichan->queue) ? '-' : '+');
+       }
+       if (cookie >= 0) {
+               spin_lock_irqsave(&mx3fb->lock, flags);
+               sdc_fb_init(mx3_fbi);
+               mx3_fbi->cookie = cookie;
+               spin_unlock_irqrestore(&mx3fb->lock, flags);
+       }
+       /*
+        * Attention! Without this msleep the channel keeps generating
+        * interrupts. Next sdc_set_brightness() is going to be called
+        * from mx3fb_blank().
+        */
+       msleep(2);
+}
+static void sdc_disable_channel(struct mx3fb_info *mx3_fbi)
+{
+       struct mx3fb_data *mx3fb = mx3_fbi->mx3fb;
+       uint32_t enabled;
+       unsigned long flags;
+       spin_lock_irqsave(&mx3fb->lock, flags);
+       enabled = sdc_fb_uninit(mx3_fbi);
+       spin_unlock_irqrestore(&mx3fb->lock, flags);
+       mx3_fbi->txd->chan->device->device_terminate_all(mx3_fbi->txd->chan);
+       mx3_fbi->txd = NULL;
+       mx3_fbi->cookie = -EINVAL;
+}
+/**
+ * sdc_set_window_pos() - set window position of the respective plane.
+ * @mx3fb:     mx3fb context.
+ * @channel:   IPU DMAC channel ID.
+ * @x_pos:     X coordinate relative to the top left corner to place window at.
+ * @y_pos:     Y coordinate relative to the top left corner to place window at.
+ * @return:    0 on success or negative error code on failure.
+ */
+static int sdc_set_window_pos(struct mx3fb_data *mx3fb, enum ipu_channel channel,
+                             int16_t x_pos, int16_t y_pos)
+{
+       x_pos += mx3fb->h_start_width;
+       y_pos += mx3fb->v_start_width;
+       if (channel != IDMAC_SDC_0)
+               return -EINVAL;
+       mx3fb_write_reg(mx3fb, (x_pos << 16) | y_pos, SDC_BG_POS);
+       return 0;
+}
+/**
+ * sdc_init_panel() - initialize a synchronous LCD panel.
+ * @mx3fb:             mx3fb context.
+ * @panel:             panel type.
+ * @pixel_clk:         desired pixel clock frequency in Hz.
+ * @width:             width of panel in pixels.
+ * @height:            height of panel in pixels.
+ * @pixel_fmt:         pixel format of buffer as FOURCC ASCII code.
+ * @h_start_width:     number of pixel clocks between the HSYNC signal pulse
+ *                     and the start of valid data.
+ * @h_sync_width:      width of the HSYNC signal in units of pixel clocks.
+ * @h_end_width:       number of pixel clocks between the end of valid data
+ *                     and the HSYNC signal for next line.
+ * @v_start_width:     number of lines between the VSYNC signal pulse and the
+ *                     start of valid data.
+ * @v_sync_width:      width of the VSYNC signal in units of lines
+ * @v_end_width:       number of lines between the end of valid data and the
+ *                     VSYNC signal for next frame.
+ * @sig:               bitfield of signal polarities for LCD interface.
+ * @return:            0 on success or negative error code on failure.
+ */
+static int sdc_init_panel(struct mx3fb_data *mx3fb, enum ipu_panel panel,
+                         uint32_t pixel_clk,
+                         uint16_t width, uint16_t height,
+                         enum pixel_fmt pixel_fmt,
+                         uint16_t h_start_width, uint16_t h_sync_width,
+                         uint16_t h_end_width, uint16_t v_start_width,
+                         uint16_t v_sync_width, uint16_t v_end_width,
+                         struct ipu_di_signal_cfg sig)
+{
+       unsigned long lock_flags;
+       uint32_t reg;
+       uint32_t old_conf;
+       uint32_t div;
+       struct clk *ipu_clk;
+       dev_dbg(mx3fb->dev, "panel size = %d x %d", width, height);
+       if (v_sync_width == 0 || h_sync_width == 0)
+               return -EINVAL;
+       /* Init panel size and blanking periods */
+       reg = ((uint32_t) (h_sync_width - 1) << 26) |
+               ((uint32_t) (width + h_start_width + h_end_width - 1) << 16);
+       mx3fb_write_reg(mx3fb, reg, SDC_HOR_CONF);
+#ifdef DEBUG
+       printk(KERN_CONT " hor_conf %x,", reg);
+#endif
+       reg = ((uint32_t) (v_sync_width - 1) << 26) | SDC_V_SYNC_WIDTH_L |
+           ((uint32_t) (height + v_start_width + v_end_width - 1) << 16);
+       mx3fb_write_reg(mx3fb, reg, SDC_VER_CONF);
+#ifdef DEBUG
+       printk(KERN_CONT " ver_conf %x\n", reg);
+#endif
+       mx3fb->h_start_width = h_start_width;
+       mx3fb->v_start_width = v_start_width;
+       switch (panel) {
+       case IPU_PANEL_SHARP_TFT:
+               mx3fb_write_reg(mx3fb, 0x00FD0102L, SDC_SHARP_CONF_1);
+               mx3fb_write_reg(mx3fb, 0x00F500F4L, SDC_SHARP_CONF_2);
+               mx3fb_write_reg(mx3fb, SDC_COM_SHARP | SDC_COM_TFT_COLOR, SDC_COM_CONF);
+               break;
+       case IPU_PANEL_TFT:
+               mx3fb_write_reg(mx3fb, SDC_COM_TFT_COLOR, SDC_COM_CONF);
+               break;
+       default:
+               return -EINVAL;
+       }
+       /* Init clocking */
+       /*
+        * Calculate divider: fractional part is 4 bits so simply multiple by
+        * 24 to get fractional part, as long as we stay under ~250MHz and on
+        * i.MX31 it (HSP_CLK) is <= 178MHz. Currently 128.267MHz
+        */
+       dev_dbg(mx3fb->dev, "pixel clk = %d\n", pixel_clk);
+       ipu_clk = clk_get(mx3fb->dev, "ipu_clk");
+       div = clk_get_rate(ipu_clk) * 16 / pixel_clk;
+       clk_put(ipu_clk);
+       if (div < 0x40) {       /* Divider less than 4 */
+               dev_dbg(mx3fb->dev,
+                       "InitPanel() - Pixel clock divider less than 4\n");
+               div = 0x40;
+       }
+       spin_lock_irqsave(&mx3fb->lock, lock_flags);
+       /*
+        * DISP3_IF_CLK_DOWN_WR is half the divider value and 2 fraction bits
+        * fewer. Subtract 1 extra from DISP3_IF_CLK_DOWN_WR based on timing
+        * debug. DISP3_IF_CLK_UP_WR is 0
+        */
+       mx3fb_write_reg(mx3fb, (((div / 8) - 1) << 22) | div, DI_DISP3_TIME_CONF);
+       /* DI settings */
+       old_conf = mx3fb_read_reg(mx3fb, DI_DISP_IF_CONF) & 0x78FFFFFF;
+       old_conf |= sig.datamask_en << DI_D3_DATAMSK_SHIFT |
+           sig.clksel_en << DI_D3_CLK_SEL_SHIFT |
+           sig.clkidle_en << DI_D3_CLK_IDLE_SHIFT;
+       mx3fb_write_reg(mx3fb, old_conf, DI_DISP_IF_CONF);
+       old_conf = mx3fb_read_reg(mx3fb, DI_DISP_SIG_POL) & 0xE0FFFFFF;
+       old_conf |= sig.data_pol << DI_D3_DATA_POL_SHIFT |
+           sig.clk_pol << DI_D3_CLK_POL_SHIFT |
+           sig.enable_pol << DI_D3_DRDY_SHARP_POL_SHIFT |
+           sig.Hsync_pol << DI_D3_HSYNC_POL_SHIFT |
+           sig.Vsync_pol << DI_D3_VSYNC_POL_SHIFT;
+       mx3fb_write_reg(mx3fb, old_conf, DI_DISP_SIG_POL);
+       switch (pixel_fmt) {
+       case IPU_PIX_FMT_RGB24:
+               mx3fb_write_reg(mx3fb, di_mappings[0], DI_DISP3_B0_MAP);
+               mx3fb_write_reg(mx3fb, di_mappings[1], DI_DISP3_B1_MAP);
+               mx3fb_write_reg(mx3fb, di_mappings[2], DI_DISP3_B2_MAP);
+               mx3fb_write_reg(mx3fb, mx3fb_read_reg(mx3fb, DI_DISP_ACC_CC) |
+                            ((di_mappings[3] - 1) << 12), DI_DISP_ACC_CC);
+               break;
+       case IPU_PIX_FMT_RGB666:
+               mx3fb_write_reg(mx3fb, di_mappings[4], DI_DISP3_B0_MAP);
+               mx3fb_write_reg(mx3fb, di_mappings[5], DI_DISP3_B1_MAP);
+               mx3fb_write_reg(mx3fb, di_mappings[6], DI_DISP3_B2_MAP);
+               mx3fb_write_reg(mx3fb, mx3fb_read_reg(mx3fb, DI_DISP_ACC_CC) |
+                            ((di_mappings[7] - 1) << 12), DI_DISP_ACC_CC);
+               break;
+       case IPU_PIX_FMT_BGR666:
+               mx3fb_write_reg(mx3fb, di_mappings[8], DI_DISP3_B0_MAP);
+               mx3fb_write_reg(mx3fb, di_mappings[9], DI_DISP3_B1_MAP);
+               mx3fb_write_reg(mx3fb, di_mappings[10], DI_DISP3_B2_MAP);
+               mx3fb_write_reg(mx3fb, mx3fb_read_reg(mx3fb, DI_DISP_ACC_CC) |
+                            ((di_mappings[11] - 1) << 12), DI_DISP_ACC_CC);
+               break;
+       default:
+               mx3fb_write_reg(mx3fb, di_mappings[12], DI_DISP3_B0_MAP);
+               mx3fb_write_reg(mx3fb, di_mappings[13], DI_DISP3_B1_MAP);
+               mx3fb_write_reg(mx3fb, di_mappings[14], DI_DISP3_B2_MAP);
+               mx3fb_write_reg(mx3fb, mx3fb_read_reg(mx3fb, DI_DISP_ACC_CC) |
+                            ((di_mappings[15] - 1) << 12), DI_DISP_ACC_CC);
+               break;
+       }
+       spin_unlock_irqrestore(&mx3fb->lock, lock_flags);
+       dev_dbg(mx3fb->dev, "DI_DISP_IF_CONF = 0x%08X\n",
+               mx3fb_read_reg(mx3fb, DI_DISP_IF_CONF));
+       dev_dbg(mx3fb->dev, "DI_DISP_SIG_POL = 0x%08X\n",
+               mx3fb_read_reg(mx3fb, DI_DISP_SIG_POL));
+       dev_dbg(mx3fb->dev, "DI_DISP3_TIME_CONF = 0x%08X\n",
+               mx3fb_read_reg(mx3fb, DI_DISP3_TIME_CONF));
+       return 0;
+}
+/**
+ * sdc_set_color_key() - set the transparent color key for SDC graphic plane.
+ * @mx3fb:     mx3fb context.
+ * @channel:   IPU DMAC channel ID.
+ * @enable:    boolean to enable or disable color keyl.
+ * @color_key: 24-bit RGB color to use as transparent color key.
+ * @return:    0 on success or negative error code on failure.
+ */
+static int sdc_set_color_key(struct mx3fb_data *mx3fb, enum ipu_channel channel,
+                            bool enable, uint32_t color_key)
+{
+       uint32_t reg, sdc_conf;
+       unsigned long lock_flags;
+       spin_lock_irqsave(&mx3fb->lock, lock_flags);
+       sdc_conf = mx3fb_read_reg(mx3fb, SDC_COM_CONF);
+       if (channel == IDMAC_SDC_0)
+               sdc_conf &= ~SDC_COM_GWSEL;
+       else
+               sdc_conf |= SDC_COM_GWSEL;
+       if (enable) {
+               reg = mx3fb_read_reg(mx3fb, SDC_GW_CTRL) & 0xFF000000L;
+               mx3fb_write_reg(mx3fb, reg | (color_key & 0x00FFFFFFL),
+                            SDC_GW_CTRL);
+               sdc_conf |= SDC_COM_KEY_COLOR_G;
+       } else {
+               sdc_conf &= ~SDC_COM_KEY_COLOR_G;
+       }
+       mx3fb_write_reg(mx3fb, sdc_conf, SDC_COM_CONF);
+       spin_unlock_irqrestore(&mx3fb->lock, lock_flags);
+       return 0;
+}
+/**
+ * sdc_set_global_alpha() - set global alpha blending modes.
+ * @mx3fb:     mx3fb context.
+ * @enable:    boolean to enable or disable global alpha blending. If disabled,
+ *             per pixel blending is used.
+ * @alpha:     global alpha value.
+ * @return:    0 on success or negative error code on failure.
+ */
+static int sdc_set_global_alpha(struct mx3fb_data *mx3fb, bool enable, uint8_t alpha)
+{
+       uint32_t reg;
+       unsigned long lock_flags;
+       spin_lock_irqsave(&mx3fb->lock, lock_flags);
+       if (enable) {
+               reg = mx3fb_read_reg(mx3fb, SDC_GW_CTRL) & 0x00FFFFFFL;
+               mx3fb_write_reg(mx3fb, reg | ((uint32_t) alpha << 24), SDC_GW_CTRL);
+               reg = mx3fb_read_reg(mx3fb, SDC_COM_CONF);
+               mx3fb_write_reg(mx3fb, reg | SDC_COM_GLB_A, SDC_COM_CONF);
+       } else {
+               reg = mx3fb_read_reg(mx3fb, SDC_COM_CONF);
+               mx3fb_write_reg(mx3fb, reg & ~SDC_COM_GLB_A, SDC_COM_CONF);
+       }
+       spin_unlock_irqrestore(&mx3fb->lock, lock_flags);
+       return 0;
+}
+static void sdc_set_brightness(struct mx3fb_data *mx3fb, uint8_t value)
+{
+       /* This might be board-specific */
+       mx3fb_write_reg(mx3fb, 0x03000000UL | value << 16, SDC_PWM_CTRL);
+       return;
+}
+static uint32_t bpp_to_pixfmt(int bpp)
+{
+       uint32_t pixfmt = 0;
+       switch (bpp) {
+       case 24:
+               pixfmt = IPU_PIX_FMT_BGR24;
+               break;
+       case 32:
+               pixfmt = IPU_PIX_FMT_BGR32;
+               break;
+       case 16:
+               pixfmt = IPU_PIX_FMT_RGB565;
+               break;
+       }
+       return pixfmt;
+}
+static int mx3fb_blank(int blank, struct fb_info *fbi);
+static int mx3fb_map_video_memory(struct fb_info *fbi);
+static int mx3fb_unmap_video_memory(struct fb_info *fbi);
+/**
+ * mx3fb_set_fix() - set fixed framebuffer parameters from variable settings.
+ * @info:      framebuffer information pointer
+ * @return:    0 on success or negative error code on failure.
+ */
+static int mx3fb_set_fix(struct fb_info *fbi)
+{
+       struct fb_fix_screeninfo *fix = &fbi->fix;
+       struct fb_var_screeninfo *var = &fbi->var;
+       strncpy(fix->id, "DISP3 BG", 8);
+       fix->line_length = var->xres_virtual * var->bits_per_pixel / 8;
+       fix->type = FB_TYPE_PACKED_PIXELS;
+       fix->accel = FB_ACCEL_NONE;
+       fix->visual = FB_VISUAL_TRUECOLOR;
+       fix->xpanstep = 1;
+       fix->ypanstep = 1;
+       return 0;
+}
+static void mx3fb_dma_done(void *arg)
+{
+       struct idmac_tx_desc *tx_desc = to_tx_desc(arg);
+       struct dma_chan *chan = tx_desc->txd.chan;
+       struct idmac_channel *ichannel = to_idmac_chan(chan);
+       struct mx3fb_data *mx3fb = ichannel->client;
+       struct mx3fb_info *mx3_fbi = mx3fb->fbi->par;
+       dev_dbg(mx3fb->dev, "irq %d callback\n", ichannel->eof_irq);
+       /* We only need one interrupt, it will be re-enabled as needed */
+       disable_irq(ichannel->eof_irq);
+       complete(&mx3_fbi->flip_cmpl);
+}
+/**
+ * mx3fb_set_par() - set framebuffer parameters and change the operating mode.
+ * @fbi:       framebuffer information pointer.
+ * @return:    0 on success or negative error code on failure.
+ */
+static int mx3fb_set_par(struct fb_info *fbi)
+{
+       u32 mem_len;
+       struct ipu_di_signal_cfg sig_cfg;
+       enum ipu_panel mode = IPU_PANEL_TFT;
+       struct mx3fb_info *mx3_fbi = fbi->par;
+       struct mx3fb_data *mx3fb = mx3_fbi->mx3fb;
+       struct idmac_channel *ichan = mx3_fbi->idmac_channel;
+       struct idmac_video_param *video = &ichan->params.video;
+       struct scatterlist *sg = mx3_fbi->sg;
+       size_t screen_size;
+       dev_dbg(mx3fb->dev, "%s [%c]\n", __func__, list_empty(&ichan->queue) ? '-' : '+');
+       mutex_lock(&mx3_fbi->mutex);
+       /* Total cleanup */
+       if (mx3_fbi->txd)
+               sdc_disable_channel(mx3_fbi);
+       mx3fb_set_fix(fbi);
+       mem_len = fbi->var.yres_virtual * fbi->fix.line_length;
+       if (mem_len > fbi->fix.smem_len) {
+               if (fbi->fix.smem_start)
+                       mx3fb_unmap_video_memory(fbi);
+               fbi->fix.smem_len = mem_len;
+               if (mx3fb_map_video_memory(fbi) < 0) {
+                       mutex_unlock(&mx3_fbi->mutex);
+                       return -ENOMEM;
+               }
+       }
+       screen_size = fbi->fix.line_length * fbi->var.yres;
+       sg_init_table(&sg[0], 1);
+       sg_init_table(&sg[1], 1);
+       sg_dma_address(&sg[0])  = fbi->fix.smem_start;
+       sg_set_page(&sg[0], virt_to_page(fbi->screen_base),
+                   fbi->fix.smem_len,
+                   offset_in_page(fbi->screen_base));
+       if (mx3_fbi->ipu_ch == IDMAC_SDC_0) {
+               memset(&sig_cfg, 0, sizeof(sig_cfg));
+               if (fbi->var.sync & FB_SYNC_HOR_HIGH_ACT)
+                       sig_cfg.Hsync_pol = true;
+               if (fbi->var.sync & FB_SYNC_VERT_HIGH_ACT)
+                       sig_cfg.Vsync_pol = true;
+               if (fbi->var.sync & FB_SYNC_CLK_INVERT)
+                       sig_cfg.clk_pol = true;
+               if (fbi->var.sync & FB_SYNC_DATA_INVERT)
+                       sig_cfg.data_pol = true;
+               if (fbi->var.sync & FB_SYNC_OE_ACT_HIGH)
+                       sig_cfg.enable_pol = true;
+               if (fbi->var.sync & FB_SYNC_CLK_IDLE_EN)
+                       sig_cfg.clkidle_en = true;
+               if (fbi->var.sync & FB_SYNC_CLK_SEL_EN)
+                       sig_cfg.clksel_en = true;
+               if (fbi->var.sync & FB_SYNC_SHARP_MODE)
+                       mode = IPU_PANEL_SHARP_TFT;
+               dev_dbg(fbi->device, "pixclock = %ul Hz\n",
+                       (u32) (PICOS2KHZ(fbi->var.pixclock) * 1000UL));
+               if (sdc_init_panel(mx3fb, mode,
+                                  (PICOS2KHZ(fbi->var.pixclock)) * 1000UL,
+                                  fbi->var.xres, fbi->var.yres,
+                                  (fbi->var.sync & FB_SYNC_SWAP_RGB) ?
+                                  IPU_PIX_FMT_BGR666 : IPU_PIX_FMT_RGB666,
+                                  fbi->var.left_margin,
+                                  fbi->var.hsync_len,
+                                  fbi->var.right_margin +
+                                  fbi->var.hsync_len,
+                                  fbi->var.upper_margin,
+                                  fbi->var.vsync_len,
+                                  fbi->var.lower_margin +
+                                  fbi->var.vsync_len, sig_cfg) != 0) {
+                       mutex_unlock(&mx3_fbi->mutex);
+                       dev_err(fbi->device,
+                               "mx3fb: Error initializing panel.\n");
+                       return -EINVAL;
+               }
+       }
+       sdc_set_window_pos(mx3fb, mx3_fbi->ipu_ch, 0, 0);
+       mx3_fbi->cur_ipu_buf    = 0;
+       video->out_pixel_fmt    = bpp_to_pixfmt(fbi->var.bits_per_pixel);
+       video->out_width        = fbi->var.xres;
+       video->out_height       = fbi->var.yres;
+       video->out_stride       = fbi->var.xres_virtual;
+       if (mx3_fbi->blank == FB_BLANK_UNBLANK)
+               sdc_enable_channel(mx3_fbi);
+       mutex_unlock(&mx3_fbi->mutex);
+       return 0;
+}
+/**
+ * mx3fb_check_var() - check and adjust framebuffer variable parameters.
+ * @var:       framebuffer variable parameters
+ * @fbi:       framebuffer information pointer
+ */
+static int mx3fb_check_var(struct fb_var_screeninfo *var, struct fb_info *fbi)
+{
+       struct mx3fb_info *mx3_fbi = fbi->par;
+       u32 vtotal;
+       u32 htotal;
+       dev_dbg(fbi->device, "%s\n", __func__);
+       if (var->xres_virtual < var->xres)
+               var->xres_virtual = var->xres;
+       if (var->yres_virtual < var->yres)
+               var->yres_virtual = var->yres;
+       if ((var->bits_per_pixel != 32) && (var->bits_per_pixel != 24) &&
+           (var->bits_per_pixel != 16))
+               var->bits_per_pixel = default_bpp;
+       switch (var->bits_per_pixel) {
+       case 16:
+               var->red.length = 5;
+               var->red.offset = 11;
+               var->red.msb_right = 0;
+               var->green.length = 6;
+               var->green.offset = 5;
+               var->green.msb_right = 0;
+               var->blue.length = 5;
+               var->blue.offset = 0;
+               var->blue.msb_right = 0;
+               var->transp.length = 0;
+               var->transp.offset = 0;
+               var->transp.msb_right = 0;
+               break;
+       case 24:
+               var->red.length = 8;
+               var->red.offset = 16;
+               var->red.msb_right = 0;
+               var->green.length = 8;
+               var->green.offset = 8;
+               var->green.msb_right = 0;
+               var->blue.length = 8;
+               var->blue.offset = 0;
+               var->blue.msb_right = 0;
+               var->transp.length = 0;
+               var->transp.offset = 0;
+               var->transp.msb_right = 0;
+               break;
+       case 32:
+               var->red.length = 8;
+               var->red.offset = 16;
+               var->red.msb_right = 0;
+               var->green.length = 8;
+               var->green.offset = 8;
+               var->green.msb_right = 0;
+               var->blue.length = 8;
+               var->blue.offset = 0;
+               var->blue.msb_right = 0;
+               var->transp.length = 8;
+               var->transp.offset = 24;
+               var->transp.msb_right = 0;
+               break;
+       }
+       if (var->pixclock < 1000) {
+               htotal = var->xres + var->right_margin + var->hsync_len +
+                   var->left_margin;
+               vtotal = var->yres + var->lower_margin + var->vsync_len +
+                   var->upper_margin;
+               var->pixclock = (vtotal * htotal * 6UL) / 100UL;
+               var->pixclock = KHZ2PICOS(var->pixclock);
+               dev_dbg(fbi->device, "pixclock set for 60Hz refresh = %u ps\n",
+                       var->pixclock);
+       }
+       var->height = -1;
+       var->width = -1;
+       var->grayscale = 0;
+       /* Preserve sync flags */
+       var->sync |= mx3_fbi->sync;
+       mx3_fbi->sync |= var->sync;
+       return 0;
+}
+static u32 chan_to_field(unsigned int chan, struct fb_bitfield *bf)
+{
+       chan &= 0xffff;
+       chan >>= 16 - bf->length;
+       return chan << bf->offset;
+}
+static int mx3fb_setcolreg(unsigned int regno, unsigned int red,
+                          unsigned int green, unsigned int blue,
+                          unsigned int trans, struct fb_info *fbi)
+{
+       struct mx3fb_info *mx3_fbi = fbi->par;
+       u32 val;
+       int ret = 1;
+       dev_dbg(fbi->device, "%s\n", __func__);
+       mutex_lock(&mx3_fbi->mutex);
+       /*
+        * If greyscale is true, then we convert the RGB value
+        * to greyscale no matter what visual we are using.
+        */
+       if (fbi->var.grayscale)
+               red = green = blue = (19595 * red + 38470 * green +
+                                     7471 * blue) >> 16;
+       switch (fbi->fix.visual) {
+       case FB_VISUAL_TRUECOLOR:
+               /*
+                * 16-bit True Colour.  We encode the RGB value
+                * according to the RGB bitfield information.
+                */
+               if (regno < 16) {
+                       u32 *pal = fbi->pseudo_palette;
+                       val = chan_to_field(red, &fbi->var.red);
+                       val |= chan_to_field(green, &fbi->var.green);
+                       val |= chan_to_field(blue, &fbi->var.blue);
+                       pal[regno] = val;
+                       ret = 0;
+               }
+               break;
+       case FB_VISUAL_STATIC_PSEUDOCOLOR:
+       case FB_VISUAL_PSEUDOCOLOR:
+               break;
+       }
+       mutex_unlock(&mx3_fbi->mutex);
+       return ret;
+}
+/**
+ * mx3fb_blank() - blank the display.
+ */
+static int mx3fb_blank(int blank, struct fb_info *fbi)
+{
+       struct mx3fb_info *mx3_fbi = fbi->par;
+       struct mx3fb_data *mx3fb = mx3_fbi->mx3fb;
+       dev_dbg(fbi->device, "%s\n", __func__);
+       dev_dbg(fbi->device, "blank = %d\n", blank);
+       if (mx3_fbi->blank == blank)
+               return 0;
+       mutex_lock(&mx3_fbi->mutex);
+       mx3_fbi->blank = blank;
+       switch (blank) {
+       case FB_BLANK_POWERDOWN:
+       case FB_BLANK_VSYNC_SUSPEND:
+       case FB_BLANK_HSYNC_SUSPEND:
+       case FB_BLANK_NORMAL:
+               sdc_disable_channel(mx3_fbi);
+               sdc_set_brightness(mx3fb, 0);
+               break;
+       case FB_BLANK_UNBLANK:
+               sdc_enable_channel(mx3_fbi);
+               sdc_set_brightness(mx3fb, mx3fb->backlight_level);
+               break;
+       }
+       mutex_unlock(&mx3_fbi->mutex);
+       return 0;
+}
+/**
+ * mx3fb_pan_display() - pan or wrap the display
+ * @var:       variable screen buffer information.
+ * @info:      framebuffer information pointer.
+ *
+ * We look only at xoffset, yoffset and the FB_VMODE_YWRAP flag
+ */
+static int mx3fb_pan_display(struct fb_var_screeninfo *var,
+                            struct fb_info *fbi)
+{
+       struct mx3fb_info *mx3_fbi = fbi->par;
+       u32 y_bottom;
+       unsigned long base;
+       off_t offset;
+       dma_cookie_t cookie;
+       struct scatterlist *sg = mx3_fbi->sg;
+       struct dma_chan *dma_chan = &mx3_fbi->idmac_channel->dma_chan;
+       struct dma_async_tx_descriptor *txd;
+       int ret;
+       dev_dbg(fbi->device, "%s [%c]\n", __func__,
+               list_empty(&mx3_fbi->idmac_channel->queue) ? '-' : '+');
+       if (var->xoffset > 0) {
+               dev_dbg(fbi->device, "x panning not supported\n");
+               return -EINVAL;
+       }
+       if (fbi->var.xoffset == var->xoffset &&
+           fbi->var.yoffset == var->yoffset)
+               return 0;       /* No change, do nothing */
+       y_bottom = var->yoffset;
+       if (!(var->vmode & FB_VMODE_YWRAP))
+               y_bottom += var->yres;
+       if (y_bottom > fbi->var.yres_virtual)
+               return -EINVAL;
+       mutex_lock(&mx3_fbi->mutex);
+       offset = (var->yoffset * var->xres_virtual + var->xoffset) *
+               (var->bits_per_pixel / 8);
+       base = fbi->fix.smem_start + offset;
+       dev_dbg(fbi->device, "Updating SDC BG buf %d address=0x%08lX\n",
+               mx3_fbi->cur_ipu_buf, base);
+       /*
+        * We enable the End of Frame interrupt, which will free a tx-descriptor,
+        * which we will need for the next device_prep_slave_sg(). The
+        * IRQ-handler will disable the IRQ again.
+        */
+       init_completion(&mx3_fbi->flip_cmpl);
+       enable_irq(mx3_fbi->idmac_channel->eof_irq);
+       ret = wait_for_completion_timeout(&mx3_fbi->flip_cmpl, HZ / 10);
+       if (ret <= 0) {
+               mutex_unlock(&mx3_fbi->mutex);
+               dev_info(fbi->device, "Panning failed due to %s\n", ret < 0 ?
+                        "user interrupt" : "timeout");
+               return ret ? : -ETIMEDOUT;
+       }
+       mx3_fbi->cur_ipu_buf = !mx3_fbi->cur_ipu_buf;
+       sg_dma_address(&sg[mx3_fbi->cur_ipu_buf]) = base;
+       sg_set_page(&sg[mx3_fbi->cur_ipu_buf],
+                   virt_to_page(fbi->screen_base + offset), fbi->fix.smem_len,
+                   offset_in_page(fbi->screen_base + offset));
+       txd = dma_chan->device->device_prep_slave_sg(dma_chan, sg +
+               mx3_fbi->cur_ipu_buf, 1, DMA_TO_DEVICE, DMA_PREP_INTERRUPT);
+       if (!txd) {
+               dev_err(fbi->device,
+                       "Error preparing a DMA transaction descriptor.\n");
+               mutex_unlock(&mx3_fbi->mutex);
+               return -EIO;
+       }
+       txd->callback_param     = txd;
+       txd->callback           = mx3fb_dma_done;
+       /*
+        * Emulate original mx3fb behaviour: each new call to idmac_tx_submit()
+        * should switch to another buffer
+        */
+       cookie = txd->tx_submit(txd);
+       dev_dbg(fbi->device, "%d: Submit %p #%d\n", __LINE__, txd, cookie);
+       if (cookie < 0) {
+               dev_err(fbi->device,
+                       "Error updating SDC buf %d to address=0x%08lX\n",
+                       mx3_fbi->cur_ipu_buf, base);
+               mutex_unlock(&mx3_fbi->mutex);
+               return -EIO;
+       }
+       if (mx3_fbi->txd)
+               async_tx_ack(mx3_fbi->txd);
+       mx3_fbi->txd = txd;
+       fbi->var.xoffset = var->xoffset;
+       fbi->var.yoffset = var->yoffset;
+       if (var->vmode & FB_VMODE_YWRAP)
+               fbi->var.vmode |= FB_VMODE_YWRAP;
+       else
+               fbi->var.vmode &= ~FB_VMODE_YWRAP;
+       mutex_unlock(&mx3_fbi->mutex);
+       dev_dbg(fbi->device, "Update complete\n");
+       return 0;
+}
+/*
+ * This structure contains the pointers to the control functions that are
+ * invoked by the core framebuffer driver to perform operations like
+ * blitting, rectangle filling, copy regions and cursor definition.
+ */
+static struct fb_ops mx3fb_ops = {
+       .owner = THIS_MODULE,
+       .fb_set_par = mx3fb_set_par,
+       .fb_check_var = mx3fb_check_var,
+       .fb_setcolreg = mx3fb_setcolreg,
+       .fb_pan_display = mx3fb_pan_display,
+       .fb_fillrect = cfb_fillrect,
+       .fb_copyarea = cfb_copyarea,
+       .fb_imageblit = cfb_imageblit,
+       .fb_blank = mx3fb_blank,
+};
+#ifdef CONFIG_PM
+/*
+ * Power management hooks.      Note that we won't be called from IRQ context,
+ * unlike the blank functions above, so we may sleep.
+ */
+/*
+ * Suspends the framebuffer and blanks the screen. Power management support
+ */
+static int mx3fb_suspend(struct platform_device *pdev, pm_message_t state)
+{
+       struct mx3fb_data *drv_data = platform_get_drvdata(pdev);
+       struct mx3fb_info *mx3_fbi = drv_data->fbi->par;
+       acquire_console_sem();
+       fb_set_suspend(drv_data->fbi, 1);
+       release_console_sem();
+       if (mx3_fbi->blank == FB_BLANK_UNBLANK) {
+               sdc_disable_channel(mx3_fbi);
+               sdc_set_brightness(mx3fb, 0);
+       }
+       return 0;
+}
+/*
+ * Resumes the framebuffer and unblanks the screen. Power management support
+ */
+static int mx3fb_resume(struct platform_device *pdev)
+{
+       struct mx3fb_data *drv_data = platform_get_drvdata(pdev);
+       struct mx3fb_info *mx3_fbi = drv_data->fbi->par;
+       if (mx3_fbi->blank == FB_BLANK_UNBLANK) {
+               sdc_enable_channel(mx3_fbi);
+               sdc_set_brightness(mx3fb, drv_data->backlight_level);
+       }
+       acquire_console_sem();
+       fb_set_suspend(drv_data->fbi, 0);
+       release_console_sem();
+       return 0;
+}
+#else
+#define mx3fb_suspend   NULL
+#define mx3fb_resume    NULL
+#endif
+/*
+ * Main framebuffer functions
+ */
+/**
+ * mx3fb_map_video_memory() - allocates the DRAM memory for the frame buffer.
+ * @fbi:       framebuffer information pointer
+ * @return:    Error code indicating success or failure
+ *
+ * This buffer is remapped into a non-cached, non-buffered, memory region to
+ * allow palette and pixel writes to occur without flushing the cache. Once this
+ * area is remapped, all virtual memory access to the video memory should occur
+ * at the new region.
+ */
+static int mx3fb_map_video_memory(struct fb_info *fbi)
+{
+       int retval = 0;
+       dma_addr_t addr;
+       fbi->screen_base = dma_alloc_writecombine(fbi->device,
+                                                 fbi->fix.smem_len,
+                                                 &addr, GFP_DMA);
+       if (!fbi->screen_base) {
+               dev_err(fbi->device, "Cannot allocate %u bytes framebuffer memory\n",
+                       fbi->fix.smem_len);
+               retval = -EBUSY;
+               goto err0;
+       }
+       fbi->fix.smem_start = addr;
+       dev_dbg(fbi->device, "allocated fb @ p=0x%08x, v=0x%p, size=%d.\n",
+               (uint32_t) fbi->fix.smem_start, fbi->screen_base, fbi->fix.smem_len);
+       fbi->screen_size = fbi->fix.smem_len;
+       /* Clear the screen */
+       memset((char *)fbi->screen_base, 0, fbi->fix.smem_len);
+       return 0;
+err0:
+       fbi->fix.smem_len = 0;
+       fbi->fix.smem_start = 0;
+       fbi->screen_base = NULL;
+       return retval;
+}
+/**
+ * mx3fb_unmap_video_memory() - de-allocate frame buffer memory.
+ * @fbi:       framebuffer information pointer
+ * @return:    error code indicating success or failure
+ */
+static int mx3fb_unmap_video_memory(struct fb_info *fbi)
+{
+       dma_free_writecombine(fbi->device, fbi->fix.smem_len,
+                             fbi->screen_base, fbi->fix.smem_start);
+       fbi->screen_base = 0;
+       fbi->fix.smem_start = 0;
+       fbi->fix.smem_len = 0;
+       return 0;
+}
+/**
+ * mx3fb_init_fbinfo() - initialize framebuffer information object.
+ * @return:    initialized framebuffer structure.
+ */
+static struct fb_info *mx3fb_init_fbinfo(struct device *dev, struct fb_ops *ops)
+{
+       struct fb_info *fbi;
+       struct mx3fb_info *mx3fbi;
+       int ret;
+       /* Allocate sufficient memory for the fb structure */
+       fbi = framebuffer_alloc(sizeof(struct mx3fb_info), dev);
+       if (!fbi)
+               return NULL;
+       mx3fbi                  = fbi->par;
+       mx3fbi->cookie          = -EINVAL;
+       mx3fbi->cur_ipu_buf     = 0;
+       fbi->var.activate       = FB_ACTIVATE_NOW;
+       fbi->fbops              = ops;
+       fbi->flags              = FBINFO_FLAG_DEFAULT;
+       fbi->pseudo_palette     = mx3fbi->pseudo_palette;
+       mutex_init(&mx3fbi->mutex);
+       /* Allocate colormap */
+       ret = fb_alloc_cmap(&fbi->cmap, 16, 0);
+       if (ret < 0) {
+               framebuffer_release(fbi);
+               return NULL;
+       }
+       return fbi;
+}
+static int init_fb_chan(struct mx3fb_data *mx3fb, struct idmac_channel *ichan)
+{
+       struct device *dev = mx3fb->dev;
+       struct mx3fb_platform_data *mx3fb_pdata = dev->platform_data;
+       const char *name = mx3fb_pdata->name;
+       unsigned int irq;
+       struct fb_info *fbi;
+       struct mx3fb_info *mx3fbi;
+       const struct fb_videomode *mode;
+       int ret, num_modes;
+       ichan->client = mx3fb;
+       irq = ichan->eof_irq;
+       if (ichan->dma_chan.chan_id != IDMAC_SDC_0)
+               return -EINVAL;
+       fbi = mx3fb_init_fbinfo(dev, &mx3fb_ops);
+       if (!fbi)
+               return -ENOMEM;
+       if (!fb_mode)
+               fb_mode = name;
+       if (!fb_mode) {
+               ret = -EINVAL;
+               goto emode;
+       }
+       if (mx3fb_pdata->mode && mx3fb_pdata->num_modes) {
+               mode = mx3fb_pdata->mode;
+               num_modes = mx3fb_pdata->num_modes;
+       } else {
+               mode = mx3fb_modedb;
+               num_modes = ARRAY_SIZE(mx3fb_modedb);
+       }
+       if (!fb_find_mode(&fbi->var, fbi, fb_mode, mode,
+                         num_modes, NULL, default_bpp)) {
+               ret = -EBUSY;
+               goto emode;
+       }
+       fb_videomode_to_modelist(mode, num_modes, &fbi->modelist);
+       /* Default Y virtual size is 2x panel size */
+       fbi->var.yres_virtual = fbi->var.yres * 2;
+       mx3fb->fbi = fbi;
+       /* set Display Interface clock period */
+       mx3fb_write_reg(mx3fb, 0x00100010L, DI_HSP_CLK_PER);
+       /* Might need to trigger HSP clock change - see 44.3.3.8.5 */
+       sdc_set_brightness(mx3fb, 255);
+       sdc_set_global_alpha(mx3fb, true, 0xFF);
+       sdc_set_color_key(mx3fb, IDMAC_SDC_0, false, 0);
+       mx3fbi                  = fbi->par;
+       mx3fbi->idmac_channel   = ichan;
+       mx3fbi->ipu_ch          = ichan->dma_chan.chan_id;
+       mx3fbi->mx3fb           = mx3fb;
+       mx3fbi->blank           = FB_BLANK_NORMAL;
+       init_completion(&mx3fbi->flip_cmpl);
+       disable_irq(ichan->eof_irq);
+       dev_dbg(mx3fb->dev, "disabling irq %d\n", ichan->eof_irq);
+       ret = mx3fb_set_par(fbi);
+       if (ret < 0)
+               goto esetpar;
+       mx3fb_blank(FB_BLANK_UNBLANK, fbi);
+       dev_info(dev, "mx3fb: fb registered, using mode %s\n", fb_mode);
+       ret = register_framebuffer(fbi);
+       if (ret < 0)
+               goto erfb;
+       return 0;
+erfb:
+esetpar:
+emode:
+       fb_dealloc_cmap(&fbi->cmap);
+       framebuffer_release(fbi);
+       return ret;
+}
+static bool chan_filter(struct dma_chan *chan, void *arg)
+{
+       struct dma_chan_request *rq = arg;
+       struct device *dev;
+       struct mx3fb_platform_data *mx3fb_pdata;
+       if (!rq)
+               return false;
+       dev = rq->mx3fb->dev;
+       mx3fb_pdata = dev->platform_data;
+       return rq->id == chan->chan_id &&
+               mx3fb_pdata->dma_dev == chan->device->dev;
+}
+static void release_fbi(struct fb_info *fbi)
+{
+       mx3fb_unmap_video_memory(fbi);
+       fb_dealloc_cmap(&fbi->cmap);
+       unregister_framebuffer(fbi);
+       framebuffer_release(fbi);
+}
+static int mx3fb_probe(struct platform_device *pdev)
+{
+       struct device *dev = &pdev->dev;
+       int ret;
+       struct resource *sdc_reg;
+       struct mx3fb_data *mx3fb;
+       dma_cap_mask_t mask;
+       struct dma_chan *chan;
+       struct dma_chan_request rq;
+       /*
+        * Display Interface (DI) and Synchronous Display Controller (SDC)
+        * registers
+        */
+       sdc_reg = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+       if (!sdc_reg)
+               return -EINVAL;
+       mx3fb = kzalloc(sizeof(*mx3fb), GFP_KERNEL);
+       if (!mx3fb)
+               return -ENOMEM;
+       spin_lock_init(&mx3fb->lock);
+       mx3fb->reg_base = ioremap(sdc_reg->start, resource_size(sdc_reg));
+       if (!mx3fb->reg_base) {
+               ret = -ENOMEM;
+               goto eremap;
+       }
+       pr_debug("Remapped %x to %x at %p\n", sdc_reg->start, sdc_reg->end,
+                mx3fb->reg_base);
+       /* IDMAC interface */
+       dmaengine_get();
+       mx3fb->dev = dev;
+       platform_set_drvdata(pdev, mx3fb);
+       rq.mx3fb = mx3fb;
+       dma_cap_zero(mask);
+       dma_cap_set(DMA_SLAVE, mask);
+       dma_cap_set(DMA_PRIVATE, mask);
+       rq.id = IDMAC_SDC_0;
+       chan = dma_request_channel(mask, chan_filter, &rq);
+       if (!chan) {
+               ret = -EBUSY;
+               goto ersdc0;
+       }
+       ret = init_fb_chan(mx3fb, to_idmac_chan(chan));
+       if (ret < 0)
+               goto eisdc0;
+       mx3fb->backlight_level = 255;
+       return 0;
+eisdc0:
+       dma_release_channel(chan);
+ersdc0:
+       dmaengine_put();
+       iounmap(mx3fb->reg_base);
+eremap:
+       kfree(mx3fb);
+       dev_err(dev, "mx3fb: failed to register fb\n");
+       return ret;
+}
+static int mx3fb_remove(struct platform_device *dev)
+{
+       struct mx3fb_data *mx3fb = platform_get_drvdata(dev);
+       struct fb_info *fbi = mx3fb->fbi;
+       struct mx3fb_info *mx3_fbi = fbi->par;
+       struct dma_chan *chan;
+       chan = &mx3_fbi->idmac_channel->dma_chan;
+       release_fbi(fbi);
+       dma_release_channel(chan);
+       dmaengine_put();
+       iounmap(mx3fb->reg_base);
+       kfree(mx3fb);
+       return 0;
+}
+static struct platform_driver mx3fb_driver = {
+       .driver = {
+                  .name = MX3FB_NAME,
+       },
+       .probe = mx3fb_probe,
+       .remove = mx3fb_remove,
+       .suspend = mx3fb_suspend,
+       .resume = mx3fb_resume,
+};
+/*
+ * Parse user specified options (`video=mx3fb:')
+ * example:
+ *     video=mx3fb:bpp=16
+ */
+static int mx3fb_setup(void)
+{
+#ifndef MODULE
+       char *opt, *options = NULL;
+       if (fb_get_options("mx3fb", &options))
+               return -ENODEV;
+       if (!options || !*options)
+               return 0;
+       while ((opt = strsep(&options, ",")) != NULL) {
+               if (!*opt)
+                       continue;
+               if (!strncmp(opt, "bpp=", 4))
+                       default_bpp = simple_strtoul(opt + 4, NULL, 0);
+               else
+                       fb_mode = opt;
+       }
+#endif
+       return 0;
+}
+static int __init mx3fb_init(void)
+{
+       int ret = mx3fb_setup();
+       if (ret < 0)
+               return ret;
+       ret = platform_driver_register(&mx3fb_driver);
+       return ret;
+}
+static void __exit mx3fb_exit(void)
+{
+       platform_driver_unregister(&mx3fb_driver);
+}
+module_init(mx3fb_init);
+module_exit(mx3fb_exit);
+MODULE_AUTHOR("Freescale Semiconductor, Inc.");
+MODULE_DESCRIPTION("MX3 framebuffer driver");
+MODULE_ALIAS("platform:" MX3FB_NAME);
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/video/nvidia/nv_i2c.c b/drivers/video/nvidia/nv_i2c.c
index 6fd7cb8f9b8e..6aaddb4f6788 100644
--- a/drivers/video/nvidia/nv_i2c.c
+++ b/drivers/video/nvidia/nv_i2c.c
@@ -87,7 +87,6 @@ static int nvidia_setup_i2c_bus(struct nvidia_i2c_chan *chan, const char *name,
        strcpy(chan->adapter.name, name);
        chan->adapter.owner = THIS_MODULE;
-        chan->adapter.id = I2C_HW_B_NVIDIA;
        chan->adapter.class = i2c_class;
        chan->adapter.algo_data = &chan->algo;
        chan->adapter.dev.parent = &chan->par->pci_dev->dev;
diff --git a/drivers/video/omap/lcdc.c b/drivers/video/omap/lcdc.c
index 6e2ea7518761..ab3949256677 100644
--- a/drivers/video/omap/lcdc.c
+++ b/drivers/video/omap/lcdc.c
@@ -800,14 +800,14 @@ static int omap_lcdc_init(struct omapfb_device *fbdev, int ext_mode,
        /* FIXME:
         * According to errata some platforms have a clock rate limitiation
         */
-        lcdc.lcd_ck = clk_get(NULL, "lcd_ck");
+        lcdc.lcd_ck = clk_get(fbdev->dev, "lcd_ck");
        if (IS_ERR(lcdc.lcd_ck)) {
                dev_err(fbdev->dev, "unable to access LCD clock\n");
                r = PTR_ERR(lcdc.lcd_ck);
                goto fail0;
        }
-        tc_ck = clk_get(NULL, "tc_ck");
+        tc_ck = clk_get(fbdev->dev, "tc_ck");
        if (IS_ERR(tc_ck)) {
                dev_err(fbdev->dev, "unable to access TC clock\n");
                r = PTR_ERR(tc_ck);
diff --git a/drivers/video/savage/savagefb-i2c.c b/drivers/video/savage/savagefb-i2c.c
index 783d4adffb93..574b29e9f8f2 100644
--- a/drivers/video/savage/savagefb-i2c.c
+++ b/drivers/video/savage/savagefb-i2c.c
@@ -137,7 +137,6 @@ static int savage_setup_i2c_bus(struct savagefb_i2c_chan *chan,
        if (chan->par) {
                strcpy(chan->adapter.name, name);
                chan->adapter.owner             = THIS_MODULE;
-                chan->adapter.id                = I2C_HW_B_SAVAGE;
                chan->adapter.algo_data         = &chan->algo;
                chan->adapter.dev.parent        = &chan->par->pcidev->dev;
                chan->algo.udelay               = 10;
diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c
index bef6b45e8a5c..330aacbdec1f 100644
--- a/drivers/virtio/virtio_pci.c
+++ b/drivers/virtio/virtio_pci.c
@@ -192,7 +192,7 @@ static irqreturn_t vp_interrupt(int irq, void *opaque)
                drv = container_of(vp_dev->vdev.dev.driver,
                                   struct virtio_driver, driver);
-                if (drv->config_changed)
+                if (drv && drv->config_changed)
                        drv->config_changed(&vp_dev->vdev);
        }
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 3efa12f9ee50..09a3d5522b43 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -187,10 +187,10 @@ config EP93XX_WATCHDOG
 config OMAP_WATCHDOG
        tristate "OMAP Watchdog"
-        depends on ARCH_OMAP16XX || ARCH_OMAP24XX
+        depends on ARCH_OMAP16XX || ARCH_OMAP24XX || ARCH_OMAP34XX
        help
-          Support for TI OMAP1610/OMAP1710/OMAP2420 watchdog.  Say 'Y' here to
+          Support for TI OMAP1610/OMAP1710/OMAP2420/OMAP3430 watchdog.  Say 'Y'
-          enable the OMAP1610/OMAP1710 watchdog timer.
+          here to enable the OMAP1610/OMAP1710/OMAP2420/OMAP3430 watchdog timer.
 config PNX4008_WATCHDOG
        tristate "PNX4008 Watchdog"
diff --git a/drivers/watchdog/at91rm9200_wdt.c b/drivers/watchdog/at91rm9200_wdt.c
index 993e5f52afef..5531691f46ea 100644
--- a/drivers/watchdog/at91rm9200_wdt.c
+++ b/drivers/watchdog/at91rm9200_wdt.c
@@ -13,6 +13,7 @@
 #include <linux/errno.h>
 #include <linux/fs.h>
 #include <linux/init.h>
+#include <linux/io.h>
 #include <linux/kernel.h>
 #include <linux/miscdevice.h>
 #include <linux/module.h>
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 8dc7109d61b7..efa4b363ce72 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -298,6 +298,14 @@ static int decrease_reservation(unsigned long nr_pages)
                frame_list[i] = pfn_to_mfn(pfn);
                scrub_page(page);
+                if (!PageHighMem(page)) {
+                        ret = HYPERVISOR_update_va_mapping(
+                                (unsigned long)__va(pfn << PAGE_SHIFT),
+                                __pte_ma(0), 0);
+                        BUG_ON(ret);
+                }
        }
        /* Ensure that ballooned highmem pages don't have kmaps. */
@@ -490,7 +498,7 @@ static ssize_t store_target_kb(struct sys_device *dev,
        if (!capable(CAP_SYS_ADMIN))
                return -EPERM;
-        target_bytes = memparse(buf, &endchar);
+        target_bytes = simple_strtoull(buf, &endchar, 0) * 1024;
        balloon_set_new_target(target_bytes >> PAGE_SHIFT);
@@ -500,8 +508,39 @@ static ssize_t store_target_kb(struct sys_device *dev,
 static SYSDEV_ATTR(target_kb, S_IRUGO | S_IWUSR,
                   show_target_kb, store_target_kb);
+static ssize_t show_target(struct sys_device *dev, struct sysdev_attribute *attr,
+                              char *buf)
+{
+        return sprintf(buf, "%llu\n",
+                       (u64)balloon_stats.target_pages << PAGE_SHIFT);
+}
+static ssize_t store_target(struct sys_device *dev,
+                            struct sysdev_attribute *attr,
+                            const char *buf,
+                            size_t count)
+{
+        char *endchar;
+        unsigned long long target_bytes;
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+        target_bytes = memparse(buf, &endchar);
+        balloon_set_new_target(target_bytes >> PAGE_SHIFT);
+        return count;
+}
+static SYSDEV_ATTR(target, S_IRUGO | S_IWUSR,
+                   show_target, store_target);
 static struct sysdev_attribute *balloon_attrs[] = {
        &attr_target_kb,
+        &attr_target,
 };
 static struct attribute *balloon_info_attrs[] = {
diff --git a/drivers/xen/xenfs/xenbus.c b/drivers/xen/xenfs/xenbus.c
index 875a4c59c594..a9592d981b10 100644
--- a/drivers/xen/xenfs/xenbus.c
+++ b/drivers/xen/xenfs/xenbus.c
@@ -291,7 +291,7 @@ static void watch_fired(struct xenbus_watch *watch,
 static int xenbus_write_transaction(unsigned msg_type,
                                    struct xenbus_file_priv *u)
 {
-        int rc, ret;
+        int rc;
        void *reply;
        struct xenbus_transaction_holder *trans = NULL;
        LIST_HEAD(staging_q);
@@ -326,15 +326,14 @@ static int xenbus_write_transaction(unsigned msg_type,
        }
        mutex_lock(&u->reply_mutex);
-        ret = queue_reply(&staging_q, &u->u.msg, sizeof(u->u.msg));
+        rc = queue_reply(&staging_q, &u->u.msg, sizeof(u->u.msg));
-        if (!ret)
+        if (!rc)
-                ret = queue_reply(&staging_q, reply, u->u.msg.len);
+                rc = queue_reply(&staging_q, reply, u->u.msg.len);
-        if (!ret) {
+        if (!rc) {
                list_splice_tail(&staging_q, &u->read_buffers);
                wake_up(&u->read_waitq);
        } else {
                queue_cleanup(&staging_q);
-                rc = ret;
        }
        mutex_unlock(&u->reply_mutex);