57 files changed, 715 insertions, 467 deletions
diff --git a/drivers/acpi/sleep/proc.c b/drivers/acpi/sleep/proc.c
index 3839efd5eaea..1538355c266b 100644
--- a/drivers/acpi/sleep/proc.c
+++ b/drivers/acpi/sleep/proc.c
@@ -194,6 +194,23 @@ static int get_date_field(char **p, u32 * value)
        return result;
 }
+/* Read a possibly BCD register, always return binary */
+static u32 cmos_bcd_read(int offset, int rtc_control)
+{
+        u32 val = CMOS_READ(offset);
+        if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD)
+                BCD_TO_BIN(val);
+        return val;
+}
+/* Write binary value into possibly BCD register */
+static void cmos_bcd_write(u32 val, int offset, int rtc_control)
+{
+        if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD)
+                BIN_TO_BCD(val);
+        CMOS_WRITE(val, offset);
+}
 static ssize_t
 acpi_system_write_alarm(struct file *file,
                        const char __user * buffer, size_t count, loff_t * ppos)
@@ -258,35 +275,18 @@ acpi_system_write_alarm(struct file *file,
        spin_lock_irq(&rtc_lock);
        rtc_control = CMOS_READ(RTC_CONTROL);
-        if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD) {
-                BIN_TO_BCD(yr);
-                BIN_TO_BCD(mo);
-                BIN_TO_BCD(day);
-                BIN_TO_BCD(hr);
-                BIN_TO_BCD(min);
-                BIN_TO_BCD(sec);
-        }
        if (adjust) {
-                yr += CMOS_READ(RTC_YEAR);
+                yr += cmos_bcd_read(RTC_YEAR, rtc_control);
-                mo += CMOS_READ(RTC_MONTH);
+                mo += cmos_bcd_read(RTC_MONTH, rtc_control);
-                day += CMOS_READ(RTC_DAY_OF_MONTH);
+                day += cmos_bcd_read(RTC_DAY_OF_MONTH, rtc_control);
-                hr += CMOS_READ(RTC_HOURS);
+                hr += cmos_bcd_read(RTC_HOURS, rtc_control);
-                min += CMOS_READ(RTC_MINUTES);
+                min += cmos_bcd_read(RTC_MINUTES, rtc_control);
-                sec += CMOS_READ(RTC_SECONDS);
+                sec += cmos_bcd_read(RTC_SECONDS, rtc_control);
        }
        spin_unlock_irq(&rtc_lock);
-        if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD) {
-                BCD_TO_BIN(yr);
-                BCD_TO_BIN(mo);
-                BCD_TO_BIN(day);
-                BCD_TO_BIN(hr);
-                BCD_TO_BIN(min);
-                BCD_TO_BIN(sec);
-        }
        if (sec > 59) {
                min++;
                sec -= 60;
@@ -307,14 +307,6 @@ acpi_system_write_alarm(struct file *file,
                yr++;
                mo -= 12;
        }
-        if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD) {
-                BIN_TO_BCD(yr);
-                BIN_TO_BCD(mo);
-                BIN_TO_BCD(day);
-                BIN_TO_BCD(hr);
-                BIN_TO_BCD(min);
-                BIN_TO_BCD(sec);
-        }
        spin_lock_irq(&rtc_lock);
        /*
@@ -326,9 +318,9 @@ acpi_system_write_alarm(struct file *file,
        CMOS_READ(RTC_INTR_FLAGS);
        /* write the fields the rtc knows about */
-        CMOS_WRITE(hr, RTC_HOURS_ALARM);
+        cmos_bcd_write(hr, RTC_HOURS_ALARM, rtc_control);
-        CMOS_WRITE(min, RTC_MINUTES_ALARM);
+        cmos_bcd_write(min, RTC_MINUTES_ALARM, rtc_control);
-        CMOS_WRITE(sec, RTC_SECONDS_ALARM);
+        cmos_bcd_write(sec, RTC_SECONDS_ALARM, rtc_control);
        /*
         * If the system supports an enhanced alarm it will have non-zero
@@ -336,11 +328,11 @@ acpi_system_write_alarm(struct file *file,
         * to the RTC area of memory.
         */
        if (acpi_gbl_FADT.day_alarm)
-                CMOS_WRITE(day, acpi_gbl_FADT.day_alarm);
+                cmos_bcd_write(day, acpi_gbl_FADT.day_alarm, rtc_control);
        if (acpi_gbl_FADT.month_alarm)
-                CMOS_WRITE(mo, acpi_gbl_FADT.month_alarm);
+                cmos_bcd_write(mo, acpi_gbl_FADT.month_alarm, rtc_control);
        if (acpi_gbl_FADT.century)
-                CMOS_WRITE(yr / 100, acpi_gbl_FADT.century);
+                cmos_bcd_write(yr / 100, acpi_gbl_FADT.century, rtc_control);
        /* enable the rtc alarm interrupt */
        rtc_control |= RTC_AIE;
        CMOS_WRITE(rtc_control, RTC_CONTROL);
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 95229e77bffe..49cf4cf1a5a2 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -41,6 +41,7 @@
 #include <linux/interrupt.h>
 #include <linux/dma-mapping.h>
 #include <linux/device.h>
+#include <linux/dmi.h>
 #include <scsi/scsi_host.h>
 #include <scsi/scsi_cmnd.h>
 #include <linux/libata.h>
@@ -241,6 +242,7 @@ static void ahci_pmp_attach(struct ata_port *ap);
 static void ahci_pmp_detach(struct ata_port *ap);
 static void ahci_error_handler(struct ata_port *ap);
 static void ahci_vt8251_error_handler(struct ata_port *ap);
+static void ahci_p5wdh_error_handler(struct ata_port *ap);
 static void ahci_post_internal_cmd(struct ata_queued_cmd *qc);
 static int ahci_port_resume(struct ata_port *ap);
 static unsigned int ahci_fill_sg(struct ata_queued_cmd *qc, void *cmd_tbl);
@@ -339,6 +341,40 @@ static const struct ata_port_operations ahci_vt8251_ops = {
        .port_stop              = ahci_port_stop,
 };
+static const struct ata_port_operations ahci_p5wdh_ops = {
+        .check_status           = ahci_check_status,
+        .check_altstatus        = ahci_check_status,
+        .dev_select             = ata_noop_dev_select,
+        .tf_read                = ahci_tf_read,
+        .qc_defer               = sata_pmp_qc_defer_cmd_switch,
+        .qc_prep                = ahci_qc_prep,
+        .qc_issue               = ahci_qc_issue,
+        .irq_clear              = ahci_irq_clear,
+        .scr_read               = ahci_scr_read,
+        .scr_write              = ahci_scr_write,
+        .freeze                 = ahci_freeze,
+        .thaw                   = ahci_thaw,
+        .error_handler          = ahci_p5wdh_error_handler,
+        .post_internal_cmd      = ahci_post_internal_cmd,
+        .pmp_attach             = ahci_pmp_attach,
+        .pmp_detach             = ahci_pmp_detach,
+#ifdef CONFIG_PM
+        .port_suspend           = ahci_port_suspend,
+        .port_resume            = ahci_port_resume,
+#endif
+        .port_start             = ahci_port_start,
+        .port_stop              = ahci_port_stop,
+};
 #define AHCI_HFLAGS(flags)      .private_data   = (void *)(flags)
 static const struct ata_port_info ahci_port_info[] = {
@@ -1213,6 +1249,53 @@ static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class,
        return rc ?: -EAGAIN;
 }
+static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class,
+                                unsigned long deadline)
+{
+        struct ata_port *ap = link->ap;
+        struct ahci_port_priv *pp = ap->private_data;
+        u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG;
+        struct ata_taskfile tf;
+        int rc;
+        ahci_stop_engine(ap);
+        /* clear D2H reception area to properly wait for D2H FIS */
+        ata_tf_init(link->device, &tf);
+        tf.command = 0x80;
+        ata_tf_to_fis(&tf, 0, 0, d2h_fis);
+        rc = sata_link_hardreset(link, sata_ehc_deb_timing(&link->eh_context),
+                                 deadline);
+        ahci_start_engine(ap);
+        if (rc || ata_link_offline(link))
+                return rc;
+        /* spec mandates ">= 2ms" before checking status */
+        msleep(150);
+        /* The pseudo configuration device on SIMG4726 attached to
+         * ASUS P5W-DH Deluxe doesn't send signature FIS after
+         * hardreset if no device is attached to the first downstream
+         * port && the pseudo device locks up on SRST w/ PMP==0.  To
+         * work around this, wait for !BSY only briefly.  If BSY isn't
+         * cleared, perform CLO and proceed to IDENTIFY (achieved by
+         * ATA_LFLAG_NO_SRST and ATA_LFLAG_ASSUME_ATA).
+         *
+         * Wait for two seconds.  Devices attached to downstream port
+         * which can't process the following IDENTIFY after this will
+         * have to be reset again.  For most cases, this should
+         * suffice while making probing snappish enough.
+         */
+        rc = ata_wait_ready(ap, jiffies + 2 * HZ);
+        if (rc)
+                ahci_kick_engine(ap, 0);
+        return 0;
+}
 static void ahci_postreset(struct ata_link *link, unsigned int *class)
 {
        struct ata_port *ap = link->ap;
@@ -1670,6 +1753,19 @@ static void ahci_vt8251_error_handler(struct ata_port *ap)
                  ahci_postreset);
 }
+static void ahci_p5wdh_error_handler(struct ata_port *ap)
+{
+        if (!(ap->pflags & ATA_PFLAG_FROZEN)) {
+                /* restart engine */
+                ahci_stop_engine(ap);
+                ahci_start_engine(ap);
+        }
+        /* perform recovery */
+        ata_do_eh(ap, ata_std_prereset, ahci_softreset, ahci_p5wdh_hardreset,
+                  ahci_postreset);
+}
 static void ahci_post_internal_cmd(struct ata_queued_cmd *qc)
 {
        struct ata_port *ap = qc->ap;
@@ -1955,6 +2051,51 @@ static void ahci_print_info(struct ata_host *host)
                );
 }
+/* On ASUS P5W DH Deluxe, the second port of PCI device 00:1f.2 is
+ * hardwired to on-board SIMG 4726.  The chipset is ICH8 and doesn't
+ * support PMP and the 4726 either directly exports the device
+ * attached to the first downstream port or acts as a hardware storage
+ * controller and emulate a single ATA device (can be RAID 0/1 or some
+ * other configuration).
+ *
+ * When there's no device attached to the first downstream port of the
+ * 4726, "Config Disk" appears, which is a pseudo ATA device to
+ * configure the 4726.  However, ATA emulation of the device is very
+ * lame.  It doesn't send signature D2H Reg FIS after the initial
+ * hardreset, pukes on SRST w/ PMP==0 and has bunch of other issues.
+ *
+ * The following function works around the problem by always using
+ * hardreset on the port and not depending on receiving signature FIS
+ * afterward.  If signature FIS isn't received soon, ATA class is
+ * assumed without follow-up softreset.
+ */
+static void ahci_p5wdh_workaround(struct ata_host *host)
+{
+        static struct dmi_system_id sysids[] = {
+                {
+                        .ident = "P5W DH Deluxe",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR,
+                                          "ASUSTEK COMPUTER INC"),
+                                DMI_MATCH(DMI_PRODUCT_NAME, "P5W DH Deluxe"),
+                        },
+                },
+                { }
+        };
+        struct pci_dev *pdev = to_pci_dev(host->dev);
+        if (pdev->bus->number == 0 && pdev->devfn == PCI_DEVFN(0x1f, 2) &&
+            dmi_check_system(sysids)) {
+                struct ata_port *ap = host->ports[1];
+                dev_printk(KERN_INFO, &pdev->dev, "enabling ASUS P5W DH "
+                           "Deluxe on-board SIMG4726 workaround\n");
+                ap->ops = &ahci_p5wdh_ops;
+                ap->link.flags |= ATA_LFLAG_NO_SRST | ATA_LFLAG_ASSUME_ATA;
+        }
+}
 static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
        static int printed_version;
@@ -2024,6 +2165,9 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                        ap->ops = &ata_dummy_port_ops;
        }
+        /* apply workaround for ASUS P5W DH Deluxe mainboard */
+        ahci_p5wdh_workaround(host);
        /* initialize adapter */
        rc = ahci_configure_dma_masks(pdev, hpriv->cap & HOST_CAP_64);
        if (rc)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 2d147b51c978..081e3dfb64d4 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -68,7 +68,8 @@ const unsigned long sata_deb_timing_long[]		= { 100, 2000, 5000 };
 static unsigned int ata_dev_init_params(struct ata_device *dev,
                                        u16 heads, u16 sectors);
 static unsigned int ata_dev_set_xfermode(struct ata_device *dev);
-static unsigned int ata_dev_set_AN(struct ata_device *dev, u8 enable);
+static unsigned int ata_dev_set_feature(struct ata_device *dev,
+                                        u8 enable, u8 feature);
 static void ata_dev_xfermask(struct ata_device *dev);
 static unsigned long ata_dev_blacklisted(const struct ata_device *dev);
@@ -1799,13 +1800,7 @@ int ata_dev_read_id(struct ata_device *dev, unsigned int *p_class,
                 * SET_FEATURES spin-up subcommand before it will accept
                 * anything other than the original IDENTIFY command.
                 */
-                ata_tf_init(dev, &tf);
+                err_mask = ata_dev_set_feature(dev, SETFEATURES_SPINUP, 0);
-                tf.command = ATA_CMD_SET_FEATURES;
-                tf.feature = SETFEATURES_SPINUP;
-                tf.protocol = ATA_PROT_NODATA;
-                tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
-                err_mask = ata_exec_internal(dev, &tf, NULL,
-                                             DMA_NONE, NULL, 0, 0);
                if (err_mask && id[2] != 0x738c) {
                        rc = -EIO;
                        reason = "SPINUP failed";
@@ -2075,7 +2070,8 @@ int ata_dev_configure(struct ata_device *dev)
                        unsigned int err_mask;
                        /* issue SET feature command to turn this on */
-                        err_mask = ata_dev_set_AN(dev, SETFEATURES_SATA_ENABLE);
+                        err_mask = ata_dev_set_feature(dev,
+                                        SETFEATURES_SATA_ENABLE, SATA_AN);
                        if (err_mask)
                                ata_dev_printk(dev, KERN_ERR,
                                        "failed to enable ATAPI AN "
@@ -2886,6 +2882,13 @@ static int ata_dev_set_mode(struct ata_device *dev)
                        dev->pio_mode <= XFER_PIO_2)
                err_mask &= ~AC_ERR_DEV;
+        /* Early MWDMA devices do DMA but don't allow DMA mode setting.
+           Don't fail an MWDMA0 set IFF the device indicates it is in MWDMA0 */
+        if (dev->xfer_shift == ATA_SHIFT_MWDMA && 
+            dev->dma_mode == XFER_MW_DMA_0 &&
+            (dev->id[63] >> 8) & 1)
+                err_mask &= ~AC_ERR_DEV;
        if (err_mask) {
                ata_dev_printk(dev, KERN_ERR, "failed to set xfermode "
                               "(err_mask=0x%x)\n", err_mask);
@@ -3947,9 +3950,6 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "_NEC DV5800A",       NULL,           ATA_HORKAGE_NODMA },
        { "SAMSUNG CD-ROM SN-124", "N001",      ATA_HORKAGE_NODMA },
        { "Seagate STT20000A", NULL,            ATA_HORKAGE_NODMA },
-        { "IOMEGA  ZIP 250       ATAPI", NULL,  ATA_HORKAGE_NODMA }, /* temporary fix */
-        { "IOMEGA  ZIP 250       ATAPI       Floppy",
-                                NULL,           ATA_HORKAGE_NODMA },
        /* Odd clown on sil3726/4726 PMPs */
        { "Config  Disk",       NULL,           ATA_HORKAGE_NODMA |
                                                ATA_HORKAGE_SKIP_PM },
@@ -4007,7 +4007,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { }
 };
-int strn_pattern_cmp(const char *patt, const char *name, int wildchar)
+static int strn_pattern_cmp(const char *patt, const char *name, int wildchar)
 {
        const char *p;
        int len;
@@ -4181,15 +4181,14 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev)
        DPRINTK("EXIT, err_mask=%x\n", err_mask);
        return err_mask;
 }
 /**
- *      ata_dev_set_AN - Issue SET FEATURES - SATA FEATURES
+ *      ata_dev_set_feature - Issue SET FEATURES - SATA FEATURES
 *      @dev: Device to which command will be sent
 *      @enable: Whether to enable or disable the feature
+ *      @feature: The sector count represents the feature to set
 *
 *      Issue SET FEATURES - SATA FEATURES command to device @dev
- *      on port @ap with sector count set to indicate Asynchronous
+ *      on port @ap with sector count
- *      Notification feature
 *
 *      LOCKING:
 *      PCI/etc. bus probe sem.
@@ -4197,7 +4196,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev)
 *      RETURNS:
 *      0 on success, AC_ERR_* mask otherwise.
 */
-static unsigned int ata_dev_set_AN(struct ata_device *dev, u8 enable)
+static unsigned int ata_dev_set_feature(struct ata_device *dev, u8 enable,
+                                        u8 feature)
 {
        struct ata_taskfile tf;
        unsigned int err_mask;
@@ -4210,7 +4210,7 @@ static unsigned int ata_dev_set_AN(struct ata_device *dev, u8 enable)
        tf.feature = enable;
        tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
        tf.protocol = ATA_PROT_NODATA;
-        tf.nsect = SATA_AN;
+        tf.nsect = feature;
        err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0);
@@ -4689,8 +4689,8 @@ static int ata_sg_setup(struct ata_queued_cmd *qc)
                 * data in this function or read data in ata_sg_clean.
                 */
                offset = lsg->offset + lsg->length - qc->pad_len;
-                sg_set_page(psg, nth_page(sg_page(lsg), offset >> PAGE_SHIFT));
+                sg_set_page(psg, nth_page(sg_page(lsg), offset >> PAGE_SHIFT),
-                psg->offset = offset_in_page(offset);
+                                qc->pad_len, offset_in_page(offset));
                if (qc->tf.flags & ATA_TFLAG_WRITE) {
                        void *addr = kmap_atomic(sg_page(psg), KM_IRQ0);
@@ -6921,7 +6921,7 @@ int ata_host_activate(struct ata_host *host, int irq,
 *      LOCKING:
 *      Kernel thread context (may sleep).
 */
-void ata_port_detach(struct ata_port *ap)
+static void ata_port_detach(struct ata_port *ap)
 {
        unsigned long flags;
        struct ata_link *link;
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 93e2b545b439..8cb35bb87605 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2071,7 +2071,7 @@ int ata_eh_reset(struct ata_link *link, int classify,
        int try = 0;
        struct ata_device *dev;
        unsigned long deadline;
-        unsigned int action;
+        unsigned int tmp_action;
        ata_reset_fn_t reset;
        unsigned long flags;
        int rc;
@@ -2086,14 +2086,14 @@ int ata_eh_reset(struct ata_link *link, int classify,
        /* Determine which reset to use and record in ehc->i.action.
         * prereset() may examine and modify it.
         */
-        action = ehc->i.action;
-        ehc->i.action &= ~ATA_EH_RESET_MASK;
        if (softreset && (!hardreset || (!(link->flags & ATA_LFLAG_NO_SRST) &&
                                         !sata_set_spd_needed(link) &&
-                                         !(action & ATA_EH_HARDRESET))))
+                                         !(ehc->i.action & ATA_EH_HARDRESET))))
-                ehc->i.action |= ATA_EH_SOFTRESET;
+                tmp_action = ATA_EH_SOFTRESET;
        else
-                ehc->i.action |= ATA_EH_HARDRESET;
+                tmp_action = ATA_EH_HARDRESET;
+        ehc->i.action = (ehc->i.action & ~ATA_EH_RESET_MASK) | tmp_action;
        if (prereset) {
                rc = prereset(link, jiffies + ATA_EH_PRERESET_TIMEOUT);
diff --git a/drivers/ata/pata_icside.c b/drivers/ata/pata_icside.c
index be30923566c5..842fe08a3c13 100644
--- a/drivers/ata/pata_icside.c
+++ b/drivers/ata/pata_icside.c
@@ -332,12 +332,13 @@ static void ata_dummy_noret(struct ata_port *port)
 {
 }
-static void pata_icside_postreset(struct ata_port *ap, unsigned int *classes)
+static void pata_icside_postreset(struct ata_link *link, unsigned int *classes)
 {
+        struct ata_port *ap = link->ap;
        struct pata_icside_state *state = ap->host->private_data;
        if (classes[0] != ATA_DEV_NONE || classes[1] != ATA_DEV_NONE)
-                return ata_std_postreset(ap, classes);
+                return ata_std_postreset(link, classes);
        state->port[ap->port_no].disabled = 1;
@@ -395,29 +396,30 @@ static struct ata_port_operations pata_icside_port_ops = {
 static void __devinit
 pata_icside_setup_ioaddr(struct ata_port *ap, void __iomem *base,
-                         const struct portinfo *info)
+                         struct pata_icside_info *info,
+                         const struct portinfo *port)
 {
        struct ata_ioports *ioaddr = &ap->ioaddr;
-        void __iomem *cmd = base + info->dataoffset;
+        void __iomem *cmd = base + port->dataoffset;
        ioaddr->cmd_addr        = cmd;
-        ioaddr->data_addr       = cmd + (ATA_REG_DATA    << info->stepping);
+        ioaddr->data_addr       = cmd + (ATA_REG_DATA    << port->stepping);
-        ioaddr->error_addr      = cmd + (ATA_REG_ERR     << info->stepping);
+        ioaddr->error_addr      = cmd + (ATA_REG_ERR     << port->stepping);
-        ioaddr->feature_addr    = cmd + (ATA_REG_FEATURE << info->stepping);
+        ioaddr->feature_addr    = cmd + (ATA_REG_FEATURE << port->stepping);
-        ioaddr->nsect_addr      = cmd + (ATA_REG_NSECT   << info->stepping);
+        ioaddr->nsect_addr      = cmd + (ATA_REG_NSECT   << port->stepping);
-        ioaddr->lbal_addr       = cmd + (ATA_REG_LBAL    << info->stepping);
+        ioaddr->lbal_addr       = cmd + (ATA_REG_LBAL    << port->stepping);
-        ioaddr->lbam_addr       = cmd + (ATA_REG_LBAM    << info->stepping);
+        ioaddr->lbam_addr       = cmd + (ATA_REG_LBAM    << port->stepping);
-        ioaddr->lbah_addr       = cmd + (ATA_REG_LBAH    << info->stepping);
+        ioaddr->lbah_addr       = cmd + (ATA_REG_LBAH    << port->stepping);
-        ioaddr->device_addr     = cmd + (ATA_REG_DEVICE  << info->stepping);
+        ioaddr->device_addr     = cmd + (ATA_REG_DEVICE  << port->stepping);
-        ioaddr->status_addr     = cmd + (ATA_REG_STATUS  << info->stepping);
+        ioaddr->status_addr     = cmd + (ATA_REG_STATUS  << port->stepping);
-        ioaddr->command_addr    = cmd + (ATA_REG_CMD     << info->stepping);
+        ioaddr->command_addr    = cmd + (ATA_REG_CMD     << port->stepping);
-        ioaddr->ctl_addr        = base + info->ctrloffset;
+        ioaddr->ctl_addr        = base + port->ctrloffset;
        ioaddr->altstatus_addr  = ioaddr->ctl_addr;
        ata_port_desc(ap, "cmd 0x%lx ctl 0x%lx",
-                      info->raw_base + info->dataoffset,
+                      info->raw_base + port->dataoffset,
-                      info->raw_base + info->ctrloffset);
+                      info->raw_base + port->ctrloffset);
        if (info->raw_ioc_base)
                ata_port_desc(ap, "iocbase 0x%lx", info->raw_ioc_base);
@@ -441,7 +443,7 @@ static int __devinit pata_icside_register_v5(struct pata_icside_info *info)
        info->nr_ports = 1;
        info->port[0] = &pata_icside_portinfo_v5;
-        info->raw_base = ecard_resource_start(ec, ECARD_RES_MEMC);
+        info->raw_base = ecard_resource_start(info->ec, ECARD_RES_MEMC);
        return 0;
 }
@@ -522,7 +524,7 @@ static int __devinit pata_icside_add_ports(struct pata_icside_info *info)
                ap->flags |= ATA_FLAG_SLAVE_POSS;
                ap->ops = &pata_icside_port_ops;
-                pata_icside_setup_ioaddr(ap, info->base, info->port[i]);
+                pata_icside_setup_ioaddr(ap, info->base, info, info->port[i]);
        }
        return ata_host_activate(host, ec->irq, ata_interrupt, 0,
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index 2e0279fdd7aa..f1b422f7c749 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -365,9 +365,9 @@ static const struct pci_device_id nv_pci_tbl[] = {
        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA2), SWNCQ },
        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA), SWNCQ },
        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA2), SWNCQ },
-        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA), SWNCQ },
+        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA), GENERIC },
-        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA2), SWNCQ },
+        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA2), GENERIC },
-        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA3), SWNCQ },
+        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA3), GENERIC },
        { } /* terminate list */
 };
diff --git a/drivers/block/cryptoloop.c b/drivers/block/cryptoloop.c
index 1b58b010797f..241167878edf 100644
--- a/drivers/block/cryptoloop.c
+++ b/drivers/block/cryptoloop.c
@@ -150,13 +150,8 @@ cryptoloop_transfer(struct loop_device *lo, int cmd,
                u32 iv[4] = { 0, };
                iv[0] = cpu_to_le32(IV & 0xffffffff);
-                sg_set_page(&sg_in, in_page);
+                sg_set_page(&sg_in, in_page, sz, in_offs);
-                sg_in.offset = in_offs;
+                sg_set_page(&sg_out, out_page, sz, out_offs);
-                sg_in.length = sz;
-                sg_set_page(&sg_out, out_page);
-                sg_out.offset = out_offs;
-                sg_out.length = sz;
                desc.info = iv;
                err = encdecfunc(&desc, &sg_out, &sg_in, sz);
diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c
index 7276f7d207c2..fac4c6cd04f7 100644
--- a/drivers/block/sunvdc.c
+++ b/drivers/block/sunvdc.c
@@ -15,6 +15,7 @@
 #include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/list.h>
+#include <linux/scatterlist.h>
 #include <asm/vio.h>
 #include <asm/ldc.h>
diff --git a/drivers/block/ub.c b/drivers/block/ub.c
index 14143f2c484d..08e909dc7944 100644
--- a/drivers/block/ub.c
+++ b/drivers/block/ub.c
@@ -1428,9 +1428,9 @@ static void ub_state_sense(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
        scmd->state = UB_CMDST_INIT;
        scmd->nsg = 1;
        sg = &scmd->sgv[0];
-        sg_set_page(sg, virt_to_page(sc->top_sense));
+        sg_init_table(sg, UB_MAX_REQ_SG);
-        sg->offset = (unsigned long)sc->top_sense & (PAGE_SIZE-1);
+        sg_set_page(sg, virt_to_page(sc->top_sense), UB_SENSE_SIZE,
-        sg->length = UB_SENSE_SIZE;
+                        (unsigned long)sc->top_sense & (PAGE_SIZE-1));
        scmd->len = UB_SENSE_SIZE;
        scmd->lun = cmd->lun;
        scmd->done = ub_top_sense_done;
@@ -1864,9 +1864,8 @@ static int ub_sync_read_cap(struct ub_dev *sc, struct ub_lun *lun,
        cmd->state = UB_CMDST_INIT;
        cmd->nsg = 1;
        sg = &cmd->sgv[0];
-        sg_set_page(sg, virt_to_page(p));
+        sg_init_table(sg, UB_MAX_REQ_SG);
-        sg->offset = (unsigned long)p & (PAGE_SIZE-1);
+        sg_set_page(sg, virt_to_page(p), 8, (unsigned long)p & (PAGE_SIZE-1));
-        sg->length = 8;
        cmd->len = 8;
        cmd->lun = lun;
        cmd->done = ub_probe_done;
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index a901eee64ba5..3cf7129d83e6 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -4,7 +4,9 @@
 #include <linux/hdreg.h>
 #include <linux/virtio.h>
 #include <linux/virtio_blk.h>
-#include <linux/virtio_blk.h>
+#include <linux/scatterlist.h>
+#define VIRTIO_MAX_SG   (3+MAX_PHYS_SEGMENTS)
 static unsigned char virtblk_index = 'a';
 struct virtio_blk
@@ -23,7 +25,7 @@ struct virtio_blk
        mempool_t *pool;
        /* Scatterlist: can be too big for stack. */
-        struct scatterlist sg[3+MAX_PHYS_SEGMENTS];
+        struct scatterlist sg[VIRTIO_MAX_SG];
 };
 struct virtblk_req
@@ -94,8 +96,8 @@ static bool do_req(struct request_queue *q, struct virtio_blk *vblk,
        if (blk_barrier_rq(vbr->req))
                vbr->out_hdr.type |= VIRTIO_BLK_T_BARRIER;
-        /* We have to zero this, otherwise blk_rq_map_sg gets upset. */
+        /* This init could be done at vblk creation time */
-        memset(vblk->sg, 0, sizeof(vblk->sg));
+        sg_init_table(vblk->sg, VIRTIO_MAX_SG);
        sg_set_buf(&vblk->sg[0], &vbr->out_hdr, sizeof(vbr->out_hdr));
        num = blk_rq_map_sg(q, vbr->req, vblk->sg+1);
        sg_set_buf(&vblk->sg[num+1], &vbr->in_hdr, sizeof(vbr->in_hdr));
diff --git a/drivers/cdrom/viocd.c b/drivers/cdrom/viocd.c
index 880b5dce3a62..d8bb44b98a6a 100644
--- a/drivers/cdrom/viocd.c
+++ b/drivers/cdrom/viocd.c
@@ -41,9 +41,9 @@
 #include <linux/completion.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/scatterlist.h>
 #include <asm/vio.h>
-#include <asm/scatterlist.h>
 #include <asm/iseries/hv_types.h>
 #include <asm/iseries/hv_lp_event.h>
 #include <asm/iseries/vio.h>
@@ -258,6 +258,7 @@ static int send_request(struct request *req)
                cmd = viomajorsubtype_cdio | viocdwrite;
        }
+        sg_init_table(&sg, 1);
        if (blk_rq_map_sg(req->q, req, &sg) == 0) {
                printk(VIOCD_KERN_WARNING
                                "error setting up scatter/gather list\n");
diff --git a/drivers/ieee1394/dma.c b/drivers/ieee1394/dma.c
index 3051e312fdc8..f5f4983dfbf3 100644
--- a/drivers/ieee1394/dma.c
+++ b/drivers/ieee1394/dma.c
@@ -111,8 +111,8 @@ int dma_region_alloc(struct dma_region *dma, unsigned long n_bytes,
                unsigned long va =
                    (unsigned long)dma->kvirt + (i << PAGE_SHIFT);
-                sg_set_page(&dma->sglist[i], vmalloc_to_page((void *)va));
+                sg_set_page(&dma->sglist[i], vmalloc_to_page((void *)va),
-                dma->sglist[i].length = PAGE_SIZE;
+                                PAGE_SIZE, 0);
        }
        /* map sglist to the IOMMU */
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 14159ff29408..4e3128ff73c1 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -171,9 +171,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
                                if (vma_list &&
                                    !is_vm_hugetlb_page(vma_list[i + off]))
                                        umem->hugetlb = 0;
-                                sg_set_page(&chunk->page_list[i], page_list[i + off]);
+                                sg_set_page(&chunk->page_list[i], page_list[i + off], PAGE_SIZE, 0);
-                                chunk->page_list[i].offset = 0;
-                                chunk->page_list[i].length = PAGE_SIZE;
                        }
                        chunk->nmap = ib_dma_map_sg(context->device,
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index 007b38157fc4..1f4d27d7c16d 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -113,9 +113,7 @@ static int mthca_alloc_icm_pages(struct scatterlist *mem, int order, gfp_t gfp_m
        if (!page)
                return -ENOMEM;
-        sg_set_page(mem, page);
+        sg_set_page(mem, page, PAGE_SIZE << order, 0);
-        mem->length = PAGE_SIZE << order;
-        mem->offset = 0;
        return 0;
 }
@@ -481,9 +479,8 @@ int mthca_map_user_db(struct mthca_dev *dev, struct mthca_uar *uar,
        if (ret < 0)
                goto out;
-        sg_set_page(&db_tab->page[i].mem, pages[0]);
+        sg_set_page(&db_tab->page[i].mem, pages[0], MTHCA_ICM_PAGE_SIZE,
-        db_tab->page[i].mem.length = MTHCA_ICM_PAGE_SIZE;
+                        uaddr & ~PAGE_MASK);
-        db_tab->page[i].mem.offset = uaddr & ~PAGE_MASK;
        ret = pci_map_sg(dev->pdev, &db_tab->page[i].mem, 1, PCI_DMA_TODEVICE);
        if (ret < 0) {
diff --git a/drivers/isdn/sc/shmem.c b/drivers/isdn/sc/shmem.c
index 034d41a61ae1..e0331e0094f1 100644
--- a/drivers/isdn/sc/shmem.c
+++ b/drivers/isdn/sc/shmem.c
@@ -28,15 +28,15 @@ void memcpy_toshmem(int card, void *dest, const void *src, size_t n)
 {
        unsigned long flags;
        unsigned char ch;
+        unsigned long dest_rem = ((unsigned long) dest) % 0x4000;
-        if(!IS_VALID_CARD(card)) {
+        if (!IS_VALID_CARD(card)) {
                pr_debug("Invalid param: %d is not a valid card id\n", card);
                return;
        }
-        if(n > SRAM_PAGESIZE) {
+        if (n > SRAM_PAGESIZE)
                return;
-        }
        /*
         * determine the page to load from the address
@@ -50,8 +50,7 @@ void memcpy_toshmem(int card, void *dest, const void *src, size_t n)
        outb(((sc_adapter[card]->shmem_magic + ch * SRAM_PAGESIZE) >> 14) | 0x80,
                sc_adapter[card]->ioport[sc_adapter[card]->shmem_pgport]);
-        memcpy_toio(sc_adapter[card]->rambase +
+        memcpy_toio(sc_adapter[card]->rambase + dest_rem, src, n);
-                ((unsigned long) dest % 0x4000), src, n);
        spin_unlock_irqrestore(&sc_adapter[card]->lock, flags);
        pr_debug("%s: set page to %#x\n",sc_adapter[card]->devicename,
                ((sc_adapter[card]->shmem_magic + ch * SRAM_PAGESIZE)>>14)|0x80);
diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
index 35d19ae58de7..cb4c67025d52 100644
--- a/drivers/lguest/core.c
+++ b/drivers/lguest/core.c
@@ -128,9 +128,12 @@ static void unmap_switcher(void)
                __free_pages(switcher_page[i], 0);
 }
-/*L:305
+/*H:032
 * Dealing With Guest Memory.
 *
+ * Before we go too much further into the Host, we need to grok the routines
+ * we use to deal with Guest memory.
+ *
 * When the Guest gives us (what it thinks is) a physical address, we can use
 * the normal copy_from_user() & copy_to_user() on the corresponding place in
 * the memory region allocated by the Launcher.
diff --git a/drivers/lguest/hypercalls.c b/drivers/lguest/hypercalls.c
index 9d5184c7c14a..b478affe8f91 100644
--- a/drivers/lguest/hypercalls.c
+++ b/drivers/lguest/hypercalls.c
@@ -90,6 +90,7 @@ static void do_hcall(struct lguest *lg, struct hcall_args *args)
                lg->pending_notify = args->arg1;
                break;
        default:
+                /* It should be an architecture-specific hypercall. */
                if (lguest_arch_do_hcall(lg, args))
                        kill_guest(lg, "Bad hypercall %li\n", args->arg0);
        }
@@ -157,7 +158,6 @@ static void do_async_hcalls(struct lguest *lg)
 * Guest makes a hypercall, we end up here to set things up: */
 static void initialize(struct lguest *lg)
 {
        /* You can't do anything until you're initialized.  The Guest knows the
         * rules, so we're unforgiving here. */
        if (lg->hcall->arg0 != LHCALL_LGUEST_INIT) {
@@ -174,7 +174,8 @@ static void initialize(struct lguest *lg)
            || get_user(lg->noirq_end, &lg->lguest_data->noirq_end))
                kill_guest(lg, "bad guest page %p", lg->lguest_data);
-        /* We write the current time into the Guest's data page once now. */
+        /* We write the current time into the Guest's data page once so it can
+         * set its clock. */
        write_timestamp(lg);
        /* page_tables.c will also do some setup. */
@@ -182,8 +183,8 @@ static void initialize(struct lguest *lg)
        /* This is the one case where the above accesses might have been the
         * first write to a Guest page.  This may have caused a copy-on-write
-         * fault, but the Guest might be referring to the old (read-only)
+         * fault, but the old page might be (read-only) in the Guest
-         * page. */
+         * pagetable. */
        guest_pagetable_clear_all(lg);
 }
@@ -220,7 +221,7 @@ void do_hypercalls(struct lguest *lg)
                 * Normally it doesn't matter: the Guest will run again and
                 * update the trap number before we come back here.
                 *
-                 * However, if we are signalled or the Guest sends DMA to the
+                 * However, if we are signalled or the Guest sends I/O to the
                 * Launcher, the run_guest() loop will exit without running the
                 * Guest.  When it comes back it would try to re-run the
                 * hypercall. */
diff --git a/drivers/lguest/interrupts_and_traps.c b/drivers/lguest/interrupts_and_traps.c
index 82966982cb38..2b66f79c208b 100644
--- a/drivers/lguest/interrupts_and_traps.c
+++ b/drivers/lguest/interrupts_and_traps.c
@@ -92,8 +92,8 @@ static void set_guest_interrupt(struct lguest *lg, u32 lo, u32 hi, int has_err)
        /* Remember that we never let the Guest actually disable interrupts, so
         * the "Interrupt Flag" bit is always set.  We copy that bit from the
-         * Guest's "irq_enabled" field into the eflags word: the Guest copies
+         * Guest's "irq_enabled" field into the eflags word: we saw the Guest
-         * it back in "lguest_iret". */
+         * copy it back in "lguest_iret". */
        eflags = lg->regs->eflags;
        if (get_user(irq_enable, &lg->lguest_data->irq_enabled) == 0
            && !(irq_enable & X86_EFLAGS_IF))
@@ -124,7 +124,7 @@ static void set_guest_interrupt(struct lguest *lg, u32 lo, u32 hi, int has_err)
                        kill_guest(lg, "Disabling interrupts");
 }
-/*H:200
+/*H:205
 * Virtual Interrupts.
 *
 * maybe_do_interrupt() gets called before every entry to the Guest, to see if
@@ -256,19 +256,21 @@ int deliver_trap(struct lguest *lg, unsigned int num)
         * bogus one in): if we fail here, the Guest will be killed. */
        if (!idt_present(lg->arch.idt[num].a, lg->arch.idt[num].b))
                return 0;
-        set_guest_interrupt(lg, lg->arch.idt[num].a, lg->arch.idt[num].b, has_err(num));
+        set_guest_interrupt(lg, lg->arch.idt[num].a, lg->arch.idt[num].b,
+                            has_err(num));
        return 1;
 }
 /*H:250 Here's the hard part: returning to the Host every time a trap happens
 * and then calling deliver_trap() and re-entering the Guest is slow.
- * Particularly because Guest userspace system calls are traps (trap 128).
+ * Particularly because Guest userspace system calls are traps (usually trap
+ * 128).
 *
 * So we'd like to set up the IDT to tell the CPU to deliver traps directly
 * into the Guest.  This is possible, but the complexities cause the size of
 * this file to double!  However, 150 lines of code is worth writing for taking
 * system calls down from 1750ns to 270ns.  Plus, if lguest didn't do it, all
- * the other hypervisors would tease it.
+ * the other hypervisors would beat it up at lunchtime.
 *
 * This routine indicates if a particular trap number could be delivered
 * directly. */
@@ -331,7 +333,7 @@ void pin_stack_pages(struct lguest *lg)
 * change stacks on each context switch. */
 void guest_set_stack(struct lguest *lg, u32 seg, u32 esp, unsigned int pages)
 {
-        /* You are not allowd have a stack segment with privilege level 0: bad
+        /* You are not allowed have a stack segment with privilege level 0: bad
         * Guest! */
        if ((seg & 0x3) != GUEST_PL)
                kill_guest(lg, "bad stack segment %i", seg);
@@ -350,7 +352,7 @@ void guest_set_stack(struct lguest *lg, u32 seg, u32 esp, unsigned int pages)
 * part of the Host: page table handling. */
 /*H:235 This is the routine which actually checks the Guest's IDT entry and
- * transfers it into our entry in "struct lguest": */
+ * transfers it into the entry in "struct lguest": */
 static void set_trap(struct lguest *lg, struct desc_struct *trap,
                     unsigned int num, u32 lo, u32 hi)
 {
@@ -456,6 +458,18 @@ void copy_traps(const struct lguest *lg, struct desc_struct *idt,
        }
 }
+/*H:200
+ * The Guest Clock.
+ *
+ * There are two sources of virtual interrupts.  We saw one in lguest_user.c:
+ * the Launcher sending interrupts for virtual devices.  The other is the Guest
+ * timer interrupt.
+ *
+ * The Guest uses the LHCALL_SET_CLOCKEVENT hypercall to tell us how long to
+ * the next timer interrupt (in nanoseconds).  We use the high-resolution timer
+ * infrastructure to set a callback at that time.
+ *
+ * 0 means "turn off the clock". */
 void guest_set_clockevent(struct lguest *lg, unsigned long delta)
 {
        ktime_t expires;
@@ -466,20 +480,27 @@ void guest_set_clockevent(struct lguest *lg, unsigned long delta)
                return;
        }
+        /* We use wallclock time here, so the Guest might not be running for
+         * all the time between now and the timer interrupt it asked for.  This
+         * is almost always the right thing to do. */
        expires = ktime_add_ns(ktime_get_real(), delta);
        hrtimer_start(&lg->hrt, expires, HRTIMER_MODE_ABS);
 }
+/* This is the function called when the Guest's timer expires. */
 static enum hrtimer_restart clockdev_fn(struct hrtimer *timer)
 {
        struct lguest *lg = container_of(timer, struct lguest, hrt);
+        /* Remember the first interrupt is the timer interrupt. */
        set_bit(0, lg->irqs_pending);
+        /* If the Guest is actually stopped, we need to wake it up. */
        if (lg->halted)
                wake_up_process(lg->tsk);
        return HRTIMER_NORESTART;
 }
+/* This sets up the timer for this Guest. */
 void init_clockdev(struct lguest *lg)
 {
        hrtimer_init(&lg->hrt, CLOCK_REALTIME, HRTIMER_MODE_ABS);
diff --git a/drivers/lguest/lg.h b/drivers/lguest/lg.h
index d9144beca82c..86924891b5eb 100644
--- a/drivers/lguest/lg.h
+++ b/drivers/lguest/lg.h
@@ -74,9 +74,6 @@ struct lguest
        u32 pgdidx;
        struct pgdir pgdirs[4];
-        /* Cached wakeup: we hold a reference to this task. */
-        struct task_struct *wake;
        unsigned long noirq_start, noirq_end;
        unsigned long pending_notify; /* pfn from LHCALL_NOTIFY */
@@ -103,7 +100,7 @@ int lguest_address_ok(const struct lguest *lg,
 void __lgread(struct lguest *, void *, unsigned long, unsigned);
 void __lgwrite(struct lguest *, unsigned long, const void *, unsigned);
-/*L:306 Using memory-copy operations like that is usually inconvient, so we
+/*H:035 Using memory-copy operations like that is usually inconvient, so we
 * have the following helper macros which read and write a specific type (often
 * an unsigned long).
 *
@@ -191,7 +188,7 @@ void write_timestamp(struct lguest *lg);
 * Let's step aside for the moment, to study one important routine that's used
 * widely in the Host code.
 *
- * There are many cases where the Guest does something invalid, like pass crap
+ * There are many cases where the Guest can do something invalid, like pass crap
 * to a hypercall.  Since only the Guest kernel can make hypercalls, it's quite
 * acceptable to simply terminate the Guest and give the Launcher a nicely
 * formatted reason.  It's also simpler for the Guest itself, which doesn't
diff --git a/drivers/lguest/lguest_device.c b/drivers/lguest/lguest_device.c
index 71c64837b437..8904f72f97c6 100644
--- a/drivers/lguest/lguest_device.c
+++ b/drivers/lguest/lguest_device.c
@@ -53,7 +53,8 @@ struct lguest_device {
 * Device configurations
 *
 * The configuration information for a device consists of a series of fields.
- * The device will look for these fields during setup.
+ * We don't really care what they are: the Launcher set them up, and the driver
+ * will look at them during setup.
 *
 * For us these fields come immediately after that device's descriptor in the
 * lguest_devices page.
@@ -122,8 +123,8 @@ static void lg_set_status(struct virtio_device *vdev, u8 status)
 * The other piece of infrastructure virtio needs is a "virtqueue": a way of
 * the Guest device registering buffers for the other side to read from or
 * write into (ie. send and receive buffers).  Each device can have multiple
- * virtqueues: for example the console has one queue for sending and one for
+ * virtqueues: for example the console driver uses one queue for sending and
- * receiving.
+ * another for receiving.
 *
 * Fortunately for us, a very fast shared-memory-plus-descriptors virtqueue
 * already exists in virtio_ring.c.  We just need to connect it up.
@@ -158,7 +159,7 @@ static void lg_notify(struct virtqueue *vq)
 *
 * This is kind of an ugly duckling.  It'd be nicer to have a standard
 * representation of a virtqueue in the configuration space, but it seems that
- * everyone wants to do it differently.  The KVM guys want the Guest to
+ * everyone wants to do it differently.  The KVM coders want the Guest to
 * allocate its own pages and tell the Host where they are, but for lguest it's
 * simpler for the Host to simply tell us where the pages are.
 *
@@ -284,6 +285,8 @@ static void add_lguest_device(struct lguest_device_desc *d)
 {
        struct lguest_device *ldev;
+        /* Start with zeroed memory; Linux's device layer seems to count on
+         * it. */
        ldev = kzalloc(sizeof(*ldev), GFP_KERNEL);
        if (!ldev) {
                printk(KERN_EMERG "Cannot allocate lguest dev %u\n",
diff --git a/drivers/lguest/lguest_user.c b/drivers/lguest/lguest_user.c
index ee405b38383d..9d716fa42cad 100644
--- a/drivers/lguest/lguest_user.c
+++ b/drivers/lguest/lguest_user.c
@@ -8,20 +8,22 @@
 #include <linux/fs.h>
 #include "lg.h"
-/*L:315 To force the Guest to stop running and return to the Launcher, the
+/*L:055 When something happens, the Waker process needs a way to stop the
- * Waker sets writes LHREQ_BREAK and the value "1" to /dev/lguest.  The
+ * kernel running the Guest and return to the Launcher.  So the Waker writes
- * Launcher then writes LHREQ_BREAK and "0" to release the Waker. */
+ * LHREQ_BREAK and the value "1" to /dev/lguest to do this.  Once the Launcher
+ * has done whatever needs attention, it writes LHREQ_BREAK and "0" to release
+ * the Waker. */
 static int break_guest_out(struct lguest *lg, const unsigned long __user *input)
 {
        unsigned long on;
-        /* Fetch whether they're turning break on or off.. */
+        /* Fetch whether they're turning break on or off. */
        if (get_user(on, input) != 0)
                return -EFAULT;
        if (on) {
                lg->break_out = 1;
-                /* Pop it out (may be running on different CPU) */
+                /* Pop it out of the Guest (may be running on different CPU) */
                wake_up_process(lg->tsk);
                /* Wait for them to reset it */
                return wait_event_interruptible(lg->break_wq, !lg->break_out);
@@ -58,7 +60,7 @@ static ssize_t read(struct file *file, char __user *user, size_t size,loff_t*o)
        if (!lg)
                return -EINVAL;
-        /* If you're not the task which owns the guest, go away. */
+        /* If you're not the task which owns the Guest, go away. */
        if (current != lg->tsk)
                return -EPERM;
@@ -92,8 +94,8 @@ static ssize_t read(struct file *file, char __user *user, size_t size,loff_t*o)
 * base: The start of the Guest-physical memory inside the Launcher memory.
 *
 * pfnlimit: The highest (Guest-physical) page number the Guest should be
- * allowed to access.  The Launcher has to live in Guest memory, so it sets
+ * allowed to access.  The Guest memory lives inside the Launcher, so it sets
- * this to ensure the Guest can't reach it.
+ * this to ensure the Guest can only reach its own memory.
 *
 * pgdir: The (Guest-physical) address of the top of the initial Guest
 * pagetables (which are set up by the Launcher).
@@ -189,7 +191,7 @@ unlock:
 }
 /*L:010 The first operation the Launcher does must be a write.  All writes
- * start with a 32 bit number: for the first write this must be
+ * start with an unsigned long number: for the first write this must be
 * LHREQ_INITIALIZE to set up the Guest.  After that the Launcher can use
 * writes of other values to send interrupts. */
 static ssize_t write(struct file *file, const char __user *in,
@@ -275,8 +277,7 @@ static int close(struct inode *inode, struct file *file)
 * The Launcher is the Host userspace program which sets up, runs and services
 * the Guest.  In fact, many comments in the Drivers which refer to "the Host"
 * doing things are inaccurate: the Launcher does all the device handling for
- * the Guest.  The Guest can't tell what's done by the the Launcher and what by
+ * the Guest, but the Guest can't know that.
- * the Host.
 *
 * Just to confuse you: to the Host kernel, the Launcher *is* the Guest and we
 * shall see more of that later.
diff --git a/drivers/lguest/page_tables.c b/drivers/lguest/page_tables.c
index 2a45f0691c9b..fffabb327157 100644
--- a/drivers/lguest/page_tables.c
+++ b/drivers/lguest/page_tables.c
@@ -26,7 +26,8 @@
 *
 * We use two-level page tables for the Guest.  If you're not entirely
 * comfortable with virtual addresses, physical addresses and page tables then
- * I recommend you review lguest.c's "Page Table Handling" (with diagrams!).
+ * I recommend you review arch/x86/lguest/boot.c's "Page Table Handling" (with
+ * diagrams!).
 *
 * The Guest keeps page tables, but we maintain the actual ones here: these are
 * called "shadow" page tables.  Which is a very Guest-centric name: these are
@@ -36,11 +37,11 @@
 *
 * Anyway, this is the most complicated part of the Host code.  There are seven
 * parts to this:
- *  (i) Setting up a page table entry for the Guest when it faults,
+ *  (i) Looking up a page table entry when the Guest faults,
- *  (ii) Setting up the page table entry for the Guest stack,
+ *  (ii) Making sure the Guest stack is mapped,
- *  (iii) Setting up a page table entry when the Guest tells us it has changed,
+ *  (iii) Setting up a page table entry when the Guest tells us one has changed,
 *  (iv) Switching page tables,
- *  (v) Flushing (thowing away) page tables,
+ *  (v) Flushing (throwing away) page tables,
 *  (vi) Mapping the Switcher when the Guest is about to run,
 *  (vii) Setting up the page tables initially.
 :*/
@@ -57,16 +58,15 @@
 static DEFINE_PER_CPU(pte_t *, switcher_pte_pages);
 #define switcher_pte_page(cpu) per_cpu(switcher_pte_pages, cpu)
-/*H:320 With our shadow and Guest types established, we need to deal with
+/*H:320 The page table code is curly enough to need helper functions to keep it
- * them: the page table code is curly enough to need helper functions to keep
+ * clear and clean.
- * it clear and clean.
 *
 * There are two functions which return pointers to the shadow (aka "real")
 * page tables.
 *
 * spgd_addr() takes the virtual address and returns a pointer to the top-level
- * page directory entry for that address.  Since we keep track of several page
+ * page directory entry (PGD) for that address.  Since we keep track of several
- * tables, the "i" argument tells us which one we're interested in (it's
+ * page tables, the "i" argument tells us which one we're interested in (it's
 * usually the current one). */
 static pgd_t *spgd_addr(struct lguest *lg, u32 i, unsigned long vaddr)
 {
@@ -81,9 +81,9 @@ static pgd_t *spgd_addr(struct lguest *lg, u32 i, unsigned long vaddr)
        return &lg->pgdirs[i].pgdir[index];
 }
-/* This routine then takes the PGD entry given above, which contains the
+/* This routine then takes the page directory entry returned above, which
- * address of the PTE page.  It then returns a pointer to the PTE entry for the
+ * contains the address of the page table entry (PTE) page.  It then returns a
- * given address. */
+ * pointer to the PTE entry for the given address. */
 static pte_t *spte_addr(struct lguest *lg, pgd_t spgd, unsigned long vaddr)
 {
        pte_t *page = __va(pgd_pfn(spgd) << PAGE_SHIFT);
@@ -191,7 +191,7 @@ static void check_gpgd(struct lguest *lg, pgd_t gpgd)
 }
 /*H:330
- * (i) Setting up a page table entry for the Guest when it faults
+ * (i) Looking up a page table entry when the Guest faults.
 *
 * We saw this call in run_guest(): when we see a page fault in the Guest, we
 * come here.  That's because we only set up the shadow page tables lazily as
@@ -199,7 +199,7 @@ static void check_gpgd(struct lguest *lg, pgd_t gpgd)
 * and return to the Guest without it knowing.
 *
 * If we fixed up the fault (ie. we mapped the address), this routine returns
- * true. */
+ * true.  Otherwise, it was a real fault and we need to tell the Guest. */
 int demand_page(struct lguest *lg, unsigned long vaddr, int errcode)
 {
        pgd_t gpgd;
@@ -246,16 +246,16 @@ int demand_page(struct lguest *lg, unsigned long vaddr, int errcode)
        if ((errcode & 2) && !(pte_flags(gpte) & _PAGE_RW))
                return 0;
-        /* User access to a kernel page? (bit 3 == user access) */
+        /* User access to a kernel-only page? (bit 3 == user access) */
        if ((errcode & 4) && !(pte_flags(gpte) & _PAGE_USER))
                return 0;
        /* Check that the Guest PTE flags are OK, and the page number is below
         * the pfn_limit (ie. not mapping the Launcher binary). */
        check_gpte(lg, gpte);
        /* Add the _PAGE_ACCESSED and (for a write) _PAGE_DIRTY flag */
        gpte = pte_mkyoung(gpte);
        if (errcode & 2)
                gpte = pte_mkdirty(gpte);
@@ -272,23 +272,28 @@ int demand_page(struct lguest *lg, unsigned long vaddr, int errcode)
        else
                /* If this is a read, don't set the "writable" bit in the page
                 * table entry, even if the Guest says it's writable.  That way
-                 * we come back here when a write does actually ocur, so we can
+                 * we will come back here when a write does actually occur, so
-                 * update the Guest's _PAGE_DIRTY flag. */
+                 * we can update the Guest's _PAGE_DIRTY flag. */
                *spte = gpte_to_spte(lg, pte_wrprotect(gpte), 0);
        /* Finally, we write the Guest PTE entry back: we've set the
         * _PAGE_ACCESSED and maybe the _PAGE_DIRTY flags. */
        lgwrite(lg, gpte_ptr, pte_t, gpte);
-        /* We succeeded in mapping the page! */
+        /* The fault is fixed, the page table is populated, the mapping
+         * manipulated, the result returned and the code complete.  A small
+         * delay and a trace of alliteration are the only indications the Guest
+         * has that a page fault occurred at all. */
        return 1;
 }
-/*H:360 (ii) Setting up the page table entry for the Guest stack.
+/*H:360
+ * (ii) Making sure the Guest stack is mapped.
 *
- * Remember pin_stack_pages() which makes sure the stack is mapped?  It could
+ * Remember that direct traps into the Guest need a mapped Guest kernel stack.
- * simply call demand_page(), but as we've seen that logic is quite long, and
+ * pin_stack_pages() calls us here: we could simply call demand_page(), but as
- * usually the stack pages are already mapped anyway, so it's not required.
+ * we've seen that logic is quite long, and usually the stack pages are already
+ * mapped, so it's overkill.
 *
 * This is a quick version which answers the question: is this virtual address
 * mapped by the shadow page tables, and is it writable? */
@@ -297,7 +302,7 @@ static int page_writable(struct lguest *lg, unsigned long vaddr)
        pgd_t *spgd;
        unsigned long flags;
-        /* Look at the top level entry: is it present? */
+        /* Look at the current top level entry: is it present? */
        spgd = spgd_addr(lg, lg->pgdidx, vaddr);
        if (!(pgd_flags(*spgd) & _PAGE_PRESENT))
                return 0;
@@ -333,15 +338,14 @@ static void release_pgd(struct lguest *lg, pgd_t *spgd)
                        release_pte(ptepage[i]);
                /* Now we can free the page of PTEs */
                free_page((long)ptepage);
-                /* And zero out the PGD entry we we never release it twice. */
+                /* And zero out the PGD entry so we never release it twice. */
                *spgd = __pgd(0);
        }
 }
-/*H:440 (v) Flushing (thowing away) page tables,
+/*H:445 We saw flush_user_mappings() twice: once from the flush_user_mappings()
- *
+ * hypercall and once in new_pgdir() when we re-used a top-level pgdir page.
- * We saw flush_user_mappings() called when we re-used a top-level pgdir page.
+ * It simply releases every PTE page from 0 up to the Guest's kernel address. */
- * It simply releases every PTE page from 0 up to the kernel address. */
 static void flush_user_mappings(struct lguest *lg, int idx)
 {
        unsigned int i;
@@ -350,8 +354,10 @@ static void flush_user_mappings(struct lguest *lg, int idx)
                release_pgd(lg, lg->pgdirs[idx].pgdir + i);
 }
-/* The Guest also has a hypercall to do this manually: it's used when a large
+/*H:440 (v) Flushing (throwing away) page tables,
- * number of mappings have been changed. */
+ *
+ * The Guest has a hypercall to throw away the page tables: it's used when a
+ * large number of mappings have been changed. */
 void guest_pagetable_flush_user(struct lguest *lg)
 {
        /* Drop the userspace part of the current page table. */
@@ -423,8 +429,9 @@ static unsigned int new_pgdir(struct lguest *lg,
 /*H:430 (iv) Switching page tables
 *
- * This is what happens when the Guest changes page tables (ie. changes the
+ * Now we've seen all the page table setting and manipulation, let's see what
- * top-level pgdir).  This happens on almost every context switch. */
+ * what happens when the Guest changes page tables (ie. changes the top-level
+ * pgdir).  This occurs on almost every context switch. */
 void guest_new_pagetable(struct lguest *lg, unsigned long pgtable)
 {
        int newpgdir, repin = 0;
@@ -443,7 +450,8 @@ void guest_new_pagetable(struct lguest *lg, unsigned long pgtable)
 }
 /*H:470 Finally, a routine which throws away everything: all PGD entries in all
- * the shadow page tables.  This is used when we destroy the Guest. */
+ * the shadow page tables, including the Guest's kernel mappings.  This is used
+ * when we destroy the Guest. */
 static void release_all_pagetables(struct lguest *lg)
 {
        unsigned int i, j;
@@ -458,13 +466,22 @@ static void release_all_pagetables(struct lguest *lg)
 /* We also throw away everything when a Guest tells us it's changed a kernel
 * mapping.  Since kernel mappings are in every page table, it's easiest to
- * throw them all away.  This is amazingly slow, but thankfully rare. */
+ * throw them all away.  This traps the Guest in amber for a while as
+ * everything faults back in, but it's rare. */
 void guest_pagetable_clear_all(struct lguest *lg)
 {
        release_all_pagetables(lg);
        /* We need the Guest kernel stack mapped again. */
        pin_stack_pages(lg);
 }
+/*:*/
+/*M:009 Since we throw away all mappings when a kernel mapping changes, our
+ * performance sucks for guests using highmem.  In fact, a guest with
+ * PAGE_OFFSET 0xc0000000 (the default) and more than about 700MB of RAM is
+ * usually slower than a Guest with less memory.
+ *
+ * This, of course, cannot be fixed.  It would take some kind of... well, I
+ * don't know, but the term "puissant code-fu" comes to mind. :*/
 /*H:420 This is the routine which actually sets the page table entry for then
 * "idx"'th shadow page table.
@@ -483,7 +500,7 @@ void guest_pagetable_clear_all(struct lguest *lg)
 static void do_set_pte(struct lguest *lg, int idx,
                       unsigned long vaddr, pte_t gpte)
 {
-        /* Look up the matching shadow page directot entry. */
+        /* Look up the matching shadow page directory entry. */
        pgd_t *spgd = spgd_addr(lg, idx, vaddr);
        /* If the top level isn't present, there's no entry to update. */
@@ -500,7 +517,8 @@ static void do_set_pte(struct lguest *lg, int idx,
                        *spte = gpte_to_spte(lg, gpte,
                                             pte_flags(gpte) & _PAGE_DIRTY);
                } else
-                        /* Otherwise we can demand_page() it in later. */
+                        /* Otherwise kill it and we can demand_page() it in
+                         * later. */
                        *spte = __pte(0);
        }
 }
@@ -535,7 +553,7 @@ void guest_set_pte(struct lguest *lg,
 }
 /*H:400
- * (iii) Setting up a page table entry when the Guest tells us it has changed.
+ * (iii) Setting up a page table entry when the Guest tells us one has changed.
 *
 * Just like we did in interrupts_and_traps.c, it makes sense for us to deal
 * with the other side of page tables while we're here: what happens when the
@@ -612,9 +630,10 @@ void free_guest_pagetable(struct lguest *lg)
 /*H:480 (vi) Mapping the Switcher when the Guest is about to run.
 *
- * The Switcher and the two pages for this CPU need to be available to the
+ * The Switcher and the two pages for this CPU need to be visible in the
 * Guest (and not the pages for other CPUs).  We have the appropriate PTE pages
- * for each CPU already set up, we just need to hook them in. */
+ * for each CPU already set up, we just need to hook them in now we know which
+ * Guest is about to run on this CPU. */
 void map_switcher_in_guest(struct lguest *lg, struct lguest_pages *pages)
 {
        pte_t *switcher_pte_page = __get_cpu_var(switcher_pte_pages);
@@ -677,6 +696,18 @@ static __init void populate_switcher_pte_page(unsigned int cpu,
                           __pgprot(_PAGE_PRESENT|_PAGE_ACCESSED));
 }
+/* We've made it through the page table code.  Perhaps our tired brains are
+ * still processing the details, or perhaps we're simply glad it's over.
+ *
+ * If nothing else, note that all this complexity in juggling shadow page
+ * tables in sync with the Guest's page tables is for one reason: for most
+ * Guests this page table dance determines how bad performance will be.  This
+ * is why Xen uses exotic direct Guest pagetable manipulation, and why both
+ * Intel and AMD have implemented shadow page table support directly into
+ * hardware.
+ *
+ * There is just one file remaining in the Host. */
 /*H:510 At boot or module load time, init_pagetables() allocates and populates
 * the Switcher PTE page for each CPU. */
 __init int init_pagetables(struct page **switcher_page, unsigned int pages)
diff --git a/drivers/lguest/segments.c b/drivers/lguest/segments.c
index c2434ec99f7b..9e189cbec7dd 100644
--- a/drivers/lguest/segments.c
+++ b/drivers/lguest/segments.c
@@ -12,8 +12,6 @@
 #include "lg.h"
 /*H:600
- * We've almost completed the Host; there's just one file to go!
- *
 * Segments & The Global Descriptor Table
 *
 * (That title sounds like a bad Nerdcore group.  Not to suggest that there are
@@ -55,7 +53,7 @@ static int ignored_gdt(unsigned int num)
                || num == GDT_ENTRY_DOUBLEFAULT_TSS);
 }
-/*H:610 Once the GDT has been changed, we fix the new entries up a little.  We
+/*H:630 Once the Guest gave us new GDT entries, we fix them up a little.  We
 * don't care if they're invalid: the worst that can happen is a General
 * Protection Fault in the Switcher when it restores a Guest segment register
 * which tries to use that entry.  Then we kill the Guest for causing such a
@@ -84,25 +82,33 @@ static void fixup_gdt_table(struct lguest *lg, unsigned start, unsigned end)
        }
 }
-/* This routine is called at boot or modprobe time for each CPU to set up the
+/*H:610 Like the IDT, we never simply use the GDT the Guest gives us.  We keep
- * "constant" GDT entries for Guests running on that CPU. */
+ * a GDT for each CPU, and copy across the Guest's entries each time we want to
+ * run the Guest on that CPU.
+ *
+ * This routine is called at boot or modprobe time for each CPU to set up the
+ * constant GDT entries: the ones which are the same no matter what Guest we're
+ * running. */
 void setup_default_gdt_entries(struct lguest_ro_state *state)
 {
        struct desc_struct *gdt = state->guest_gdt;
        unsigned long tss = (unsigned long)&state->guest_tss;
-        /* The hypervisor segments are full 0-4G segments, privilege level 0 */
+        /* The Switcher segments are full 0-4G segments, privilege level 0 */
        gdt[GDT_ENTRY_LGUEST_CS] = FULL_EXEC_SEGMENT;
        gdt[GDT_ENTRY_LGUEST_DS] = FULL_SEGMENT;
-        /* The TSS segment refers to the TSS entry for this CPU, so we cannot
+        /* The TSS segment refers to the TSS entry for this particular CPU.
-         * copy it from the Guest.  Forgive the magic flags */
+         * Forgive the magic flags: the 0x8900 means the entry is Present, it's
+         * privilege level 0 Available 386 TSS system segment, and the 0x67
+         * means Saturn is eclipsed by Mercury in the twelfth house. */
        gdt[GDT_ENTRY_TSS].a = 0x00000067 | (tss << 16);
        gdt[GDT_ENTRY_TSS].b = 0x00008900 | (tss & 0xFF000000)
                | ((tss >> 16) & 0x000000FF);
 }
-/* This routine is called before the Guest is run for the first time. */
+/* This routine sets up the initial Guest GDT for booting.  All entries start
+ * as 0 (unusable). */
 void setup_guest_gdt(struct lguest *lg)
 {
        /* Start with full 0-4G segments... */
@@ -114,13 +120,8 @@ void setup_guest_gdt(struct lguest *lg)
        lg->arch.gdt[GDT_ENTRY_KERNEL_DS].b |= (GUEST_PL << 13);
 }
-/* Like the IDT, we never simply use the GDT the Guest gives us.  We set up the
+/*H:650 An optimization of copy_gdt(), for just the three "thead-local storage"
- * GDTs for each CPU, then we copy across the entries each time we want to run
+ * entries. */
- * a different Guest on that CPU. */
-/* A partial GDT load, for the three "thead-local storage" entries.  Otherwise
- * it's just like load_guest_gdt().  So much, in fact, it would probably be
- * neater to have a single hypercall to cover both. */
 void copy_gdt_tls(const struct lguest *lg, struct desc_struct *gdt)
 {
        unsigned int i;
@@ -129,7 +130,9 @@ void copy_gdt_tls(const struct lguest *lg, struct desc_struct *gdt)
                gdt[i] = lg->arch.gdt[i];
 }
-/* This is the full version */
+/*H:640 When the Guest is run on a different CPU, or the GDT entries have
+ * changed, copy_gdt() is called to copy the Guest's GDT entries across to this
+ * CPU's GDT. */
 void copy_gdt(const struct lguest *lg, struct desc_struct *gdt)
 {
        unsigned int i;
@@ -141,7 +144,8 @@ void copy_gdt(const struct lguest *lg, struct desc_struct *gdt)
                        gdt[i] = lg->arch.gdt[i];
 }
-/* This is where the Guest asks us to load a new GDT (LHCALL_LOAD_GDT). */
+/*H:620 This is where the Guest asks us to load a new GDT (LHCALL_LOAD_GDT).
+ * We copy it from the Guest and tweak the entries. */
 void load_guest_gdt(struct lguest *lg, unsigned long table, u32 num)
 {
        /* We assume the Guest has the same number of GDT entries as the
@@ -157,16 +161,22 @@ void load_guest_gdt(struct lguest *lg, unsigned long table, u32 num)
        lg->changed |= CHANGED_GDT;
 }
+/* This is the fast-track version for just changing the three TLS entries.
+ * Remember that this happens on every context switch, so it's worth
+ * optimizing.  But wouldn't it be neater to have a single hypercall to cover
+ * both cases? */
 void guest_load_tls(struct lguest *lg, unsigned long gtls)
 {
        struct desc_struct *tls = &lg->arch.gdt[GDT_ENTRY_TLS_MIN];
        __lgread(lg, tls, gtls, sizeof(*tls)*GDT_ENTRY_TLS_ENTRIES);
        fixup_gdt_table(lg, GDT_ENTRY_TLS_MIN, GDT_ENTRY_TLS_MAX+1);
+        /* Note that just the TLS entries have changed. */
        lg->changed |= CHANGED_GDT_TLS;
 }
+/*:*/
-/*
+/*H:660
 * With this, we have finished the Host.
 *
 * Five of the seven parts of our task are complete.  You have made it through
diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
index 9eed12d5a395..482aec2a9631 100644
--- a/drivers/lguest/x86/core.c
+++ b/drivers/lguest/x86/core.c
@@ -63,7 +63,7 @@ static struct lguest_pages *lguest_pages(unsigned int cpu)
 static DEFINE_PER_CPU(struct lguest *, last_guest);
 /*S:010
- * We are getting close to the Switcher.
+ * We approach the Switcher.
 *
 * Remember that each CPU has two pages which are visible to the Guest when it
 * runs on that CPU.  This has to contain the state for that Guest: we copy the
@@ -134,7 +134,7 @@ static void run_guest_once(struct lguest *lg, struct lguest_pages *pages)
         *
         * The lcall also pushes the old code segment (KERNEL_CS) onto the
         * stack, then the address of this call.  This stack layout happens to
-         * exactly match the stack of an interrupt... */
+         * exactly match the stack layout created by an interrupt... */
        asm volatile("pushf; lcall *lguest_entry"
                     /* This is how we tell GCC that %eax ("a") and %ebx ("b")
                      * are changed by this routine.  The "=" means output. */
@@ -151,40 +151,46 @@ static void run_guest_once(struct lguest *lg, struct lguest_pages *pages)
 }
 /*:*/
+/*M:002 There are hooks in the scheduler which we can register to tell when we
+ * get kicked off the CPU (preempt_notifier_register()).  This would allow us
+ * to lazily disable SYSENTER which would regain some performance, and should
+ * also simplify copy_in_guest_info().  Note that we'd still need to restore
+ * things when we exit to Launcher userspace, but that's fairly easy.
+ *
+ * The hooks were designed for KVM, but we can also put them to good use. :*/
 /*H:040 This is the i386-specific code to setup and run the Guest.  Interrupts
 * are disabled: we own the CPU. */
 void lguest_arch_run_guest(struct lguest *lg)
 {
-        /* Remember the awfully-named TS bit?  If the Guest has asked
+        /* Remember the awfully-named TS bit?  If the Guest has asked to set it
-         * to set it we set it now, so we can trap and pass that trap
+         * we set it now, so we can trap and pass that trap to the Guest if it
-         * to the Guest if it uses the FPU. */
+         * uses the FPU. */
        if (lg->ts)
                lguest_set_ts();
-        /* SYSENTER is an optimized way of doing system calls.  We
+        /* SYSENTER is an optimized way of doing system calls.  We can't allow
-         * can't allow it because it always jumps to privilege level 0.
+         * it because it always jumps to privilege level 0.  A normal Guest
-         * A normal Guest won't try it because we don't advertise it in
+         * won't try it because we don't advertise it in CPUID, but a malicious
-         * CPUID, but a malicious Guest (or malicious Guest userspace
+         * Guest (or malicious Guest userspace program) could, so we tell the
-         * program) could, so we tell the CPU to disable it before
+         * CPU to disable it before running the Guest. */
-         * running the Guest. */
        if (boot_cpu_has(X86_FEATURE_SEP))
                wrmsr(MSR_IA32_SYSENTER_CS, 0, 0);
-        /* Now we actually run the Guest.  It will pop back out when
+        /* Now we actually run the Guest.  It will return when something
-         * something interesting happens, and we can examine its
+         * interesting happens, and we can examine its registers to see what it
-         * registers to see what it was doing. */
+         * was doing. */
        run_guest_once(lg, lguest_pages(raw_smp_processor_id()));
-        /* The "regs" pointer contains two extra entries which are not
+        /* Note that the "regs" pointer contains two extra entries which are
-         * really registers: a trap number which says what interrupt or
+         * not really registers: a trap number which says what interrupt or
-         * trap made the switcher code come back, and an error code
+         * trap made the switcher code come back, and an error code which some
-         * which some traps set.  */
+         * traps set.  */
-        /* If the Guest page faulted, then the cr2 register will tell
+        /* If the Guest page faulted, then the cr2 register will tell us the
-         * us the bad virtual address.  We have to grab this now,
+         * bad virtual address.  We have to grab this now, because once we
-         * because once we re-enable interrupts an interrupt could
+         * re-enable interrupts an interrupt could fault and thus overwrite
-         * fault and thus overwrite cr2, or we could even move off to a
+         * cr2, or we could even move off to a different CPU. */
-         * different CPU. */
        if (lg->regs->trapnum == 14)
                lg->arch.last_pagefault = read_cr2();
        /* Similarly, if we took a trap because the Guest used the FPU,
@@ -197,14 +203,15 @@ void lguest_arch_run_guest(struct lguest *lg)
                wrmsr(MSR_IA32_SYSENTER_CS, __KERNEL_CS, 0);
 }
-/*H:130 Our Guest is usually so well behaved; it never tries to do things it
+/*H:130 Now we've examined the hypercall code; our Guest can make requests.
- * isn't allowed to.  Unfortunately, Linux's paravirtual infrastructure isn't
+ * Our Guest is usually so well behaved; it never tries to do things it isn't
- * quite complete, because it doesn't contain replacements for the Intel I/O
+ * allowed to, and uses hypercalls instead.  Unfortunately, Linux's paravirtual
- * instructions.  As a result, the Guest sometimes fumbles across one during
+ * infrastructure isn't quite complete, because it doesn't contain replacements
- * the boot process as it probes for various things which are usually attached
+ * for the Intel I/O instructions.  As a result, the Guest sometimes fumbles
- * to a PC.
+ * across one during the boot process as it probes for various things which are
+ * usually attached to a PC.
 *
- * When the Guest uses one of these instructions, we get trap #13 (General
+ * When the Guest uses one of these instructions, we get a trap (General
 * Protection Fault) and come here.  We see if it's one of those troublesome
 * instructions and skip over it.  We return true if we did. */
 static int emulate_insn(struct lguest *lg)
@@ -275,43 +282,43 @@ static int emulate_insn(struct lguest *lg)
 void lguest_arch_handle_trap(struct lguest *lg)
 {
        switch (lg->regs->trapnum) {
-        case 13: /* We've intercepted a GPF. */
+        case 13: /* We've intercepted a General Protection Fault. */
-                 /* Check if this was one of those annoying IN or OUT
+                /* Check if this was one of those annoying IN or OUT
-                  * instructions which we need to emulate.  If so, we
+                 * instructions which we need to emulate.  If so, we just go
-                  * just go back into the Guest after we've done it. */
+                 * back into the Guest after we've done it. */
                if (lg->regs->errcode == 0) {
                        if (emulate_insn(lg))
                                return;
                }
                break;
-        case 14: /* We've intercepted a page fault. */
+        case 14: /* We've intercepted a Page Fault. */
-                 /* The Guest accessed a virtual address that wasn't
+                /* The Guest accessed a virtual address that wasn't mapped.
-                  * mapped.  This happens a lot: we don't actually set
+                 * This happens a lot: we don't actually set up most of the
-                  * up most of the page tables for the Guest at all when
+                 * page tables for the Guest at all when we start: as it runs
-                  * we start: as it runs it asks for more and more, and
+                 * it asks for more and more, and we set them up as
-                  * we set them up as required. In this case, we don't
+                 * required. In this case, we don't even tell the Guest that
-                  * even tell the Guest that the fault happened.
+                 * the fault happened.
-                  *
+                 *
-                  * The errcode tells whether this was a read or a
+                 * The errcode tells whether this was a read or a write, and
-                  * write, and whether kernel or userspace code. */
+                 * whether kernel or userspace code. */
                if (demand_page(lg, lg->arch.last_pagefault, lg->regs->errcode))
                        return;
-                 /* OK, it's really not there (or not OK): the Guest
+                /* OK, it's really not there (or not OK): the Guest needs to
-                  * needs to know.  We write out the cr2 value so it
+                 * know.  We write out the cr2 value so it knows where the
-                  * knows where the fault occurred.
+                 * fault occurred.
-                  *
+                 *
-                  * Note that if the Guest were really messed up, this
+                 * Note that if the Guest were really messed up, this could
-                  * could happen before it's done the INITIALIZE
+                 * happen before it's done the LHCALL_LGUEST_INIT hypercall, so
-                  * hypercall, so lg->lguest_data will be NULL */
+                 * lg->lguest_data could be NULL */
                if (lg->lguest_data &&
                    put_user(lg->arch.last_pagefault, &lg->lguest_data->cr2))
                        kill_guest(lg, "Writing cr2");
                break;
        case 7: /* We've intercepted a Device Not Available fault. */
-                /* If the Guest doesn't want to know, we already
+                /* If the Guest doesn't want to know, we already restored the
-                 * restored the Floating Point Unit, so we just
+                 * Floating Point Unit, so we just continue without telling
-                 * continue without telling it. */
+                 * it. */
                if (!lg->ts)
                        return;
                break;
@@ -536,9 +543,6 @@ int lguest_arch_init_hypercalls(struct lguest *lg)
        return 0;
 }
-/* Now we've examined the hypercall code; our Guest can make requests.  There
- * is one other way we can do things for the Guest, as we see in
- * emulate_insn(). :*/
 /*L:030 lguest_arch_setup_regs()
 *
@@ -562,7 +566,7 @@ void lguest_arch_setup_regs(struct lguest *lg, unsigned long start)
         * is supposed to always be "1".  Bit 9 (0x200) controls whether
         * interrupts are enabled.  We always leave interrupts enabled while
         * running the Guest. */
-        regs->eflags = 0x202;
+        regs->eflags = X86_EFLAGS_IF | 0x2;
        /* The "Extended Instruction Pointer" register says where the Guest is
         * running. */
@@ -570,8 +574,8 @@ void lguest_arch_setup_regs(struct lguest *lg, unsigned long start)
        /* %esi points to our boot information, at physical address 0, so don't
         * touch it. */
        /* There are a couple of GDT entries the Guest expects when first
         * booting. */
        setup_guest_gdt(lg);
 }
diff --git a/drivers/lguest/x86/switcher_32.S b/drivers/lguest/x86/switcher_32.S
index 1010b90b11fc..0af8baaa0d4a 100644
--- a/drivers/lguest/x86/switcher_32.S
+++ b/drivers/lguest/x86/switcher_32.S
@@ -6,6 +6,37 @@
 * are feeling invigorated and refreshed then the next, more challenging stage
 * can be found in "make Guest". :*/
+/*M:012 Lguest is meant to be simple: my rule of thumb is that 1% more LOC must
+ * gain at least 1% more performance.  Since neither LOC nor performance can be
+ * measured beforehand, it generally means implementing a feature then deciding
+ * if it's worth it.  And once it's implemented, who can say no?
+ *
+ * This is why I haven't implemented this idea myself.  I want to, but I
+ * haven't.  You could, though.
+ *
+ * The main place where lguest performance sucks is Guest page faulting.  When
+ * a Guest userspace process hits an unmapped page we switch back to the Host,
+ * walk the page tables, find it's not mapped, switch back to the Guest page
+ * fault handler, which calls a hypercall to set the page table entry, then
+ * finally returns to userspace.  That's two round-trips.
+ *
+ * If we had a small walker in the Switcher, we could quickly check the Guest
+ * page table and if the page isn't mapped, immediately reflect the fault back
+ * into the Guest.  This means the Switcher would have to know the top of the
+ * Guest page table and the page fault handler address.
+ *
+ * For simplicity, the Guest should only handle the case where the privilege
+ * level of the fault is 3 and probably only not present or write faults.  It
+ * should also detect recursive faults, and hand the original fault to the
+ * Host (which is actually really easy).
+ *
+ * Two questions remain.  Would the performance gain outweigh the complexity?
+ * And who would write the verse documenting it? :*/
+/*M:011 Lguest64 handles NMI.  This gave me NMI envy (until I looked at their
+ * code).  It's worth doing though, since it would let us use oprofile in the
+ * Host when a Guest is running. :*/
 /*S:100
 * Welcome to the Switcher itself!
 *
@@ -88,7 +119,7 @@ ENTRY(switch_to_guest)
        // All saved and there's now five steps before us:
        // Stack, GDT, IDT, TSS
-        // And last of all the page tables are flipped.
+        // Then last of all the page tables are flipped.
        // Yet beware that our stack pointer must be
        // Always valid lest an NMI hits
@@ -103,25 +134,25 @@ ENTRY(switch_to_guest)
        lgdt    LGUEST_PAGES_guest_gdt_desc(%eax)
        // The Guest's IDT we did partially
-        // Move to the "struct lguest_pages" as well.
+        // Copy to "struct lguest_pages" as well.
        lidt    LGUEST_PAGES_guest_idt_desc(%eax)
        // The TSS entry which controls traps
        // Must be loaded up with "ltr" now:
+        // The GDT entry that TSS uses 
+        // Changes type when we load it: damn Intel!
        // For after we switch over our page tables
-        // It (as the rest) will be writable no more.
+        // That entry will be read-only: we'd crash.
-        // (The GDT entry TSS needs
-        // Changes type when we load it: damn Intel!)
        movl    $(GDT_ENTRY_TSS*8), %edx
        ltr     %dx
        // Look back now, before we take this last step!
        // The Host's TSS entry was also marked used;
-        // Let's clear it again, ere we return.
+        // Let's clear it again for our return.
        // The GDT descriptor of the Host
        // Points to the table after two "size" bytes
        movl    (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
-        // Clear the type field of "used" (byte 5, bit 2)
+        // Clear "used" from type field (byte 5, bit 2)
        andb    $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
        // Once our page table's switched, the Guest is live!
@@ -131,7 +162,7 @@ ENTRY(switch_to_guest)
        // The page table change did one tricky thing:
        // The Guest's register page has been mapped
-        // Writable onto our %esp (stack) --
+        // Writable under our %esp (stack) --
        // We can simply pop off all Guest regs.
        popl    %eax
        popl    %ebx
@@ -152,16 +183,15 @@ ENTRY(switch_to_guest)
        addl    $8, %esp
        // The last five stack slots hold return address
-        // And everything needed to change privilege
+        // And everything needed to switch privilege
-        // Into the Guest privilege level of 1,
+        // From Switcher's level 0 to Guest's 1,
        // And the stack where the Guest had last left it.
        // Interrupts are turned back on: we are Guest.
        iret
-// There are two paths where we switch to the Host
+// We treat two paths to switch back to the Host
+// Yet both must save Guest state and restore Host
 // So we put the routine in a macro.
-// We are on our way home, back to the Host
-// Interrupted out of the Guest, we come here.
 #define SWITCH_TO_HOST                                                  \
        /* We save the Guest state: all registers first                 \
         * Laid out just as "struct lguest_regs" defines */             \
@@ -194,7 +224,7 @@ ENTRY(switch_to_guest)
        movl    %esp, %eax;                                             \
        andl    $(~(1 << PAGE_SHIFT - 1)), %eax;                        \
        /* Save our trap number: the switch will obscure it             \
-         * (The Guest regs are not mapped here in the Host)             \
+         * (In the Host the Guest regs are not mapped here)             \
         * %ebx holds it safe for deliver_to_host */                    \
        movl    LGUEST_PAGES_regs_trapnum(%eax), %ebx;                  \
        /* The Host GDT, IDT and stack!                                 \
@@ -210,9 +240,9 @@ ENTRY(switch_to_guest)
        /* Switch to Host's GDT, IDT. */                                \
        lgdt    LGUEST_PAGES_host_gdt_desc(%eax);                       \
        lidt    LGUEST_PAGES_host_idt_desc(%eax);                       \
-        /* Restore the Host's stack where it's saved regs lie */        \
+        /* Restore the Host's stack where its saved regs lie */         \
        movl    LGUEST_PAGES_host_sp(%eax), %esp;                       \
-        /* Last the TSS: our Host is complete */                        \
+        /* Last the TSS: our Host is returned */                        \
        movl    $(GDT_ENTRY_TSS*8), %edx;                               \
        ltr     %dx;                                                    \
        /* Restore now the regs saved right at the first. */            \
@@ -222,14 +252,15 @@ ENTRY(switch_to_guest)
        popl    %ds;                                                    \
        popl    %es
-// Here's where we come when the Guest has just trapped:
+// The first path is trod when the Guest has trapped:
-// (Which trap we'll see has been pushed on the stack).
+// (Which trap it was has been pushed on the stack).
 // We need only switch back, and the Host will decode
 // Why we came home, and what needs to be done.
 return_to_host:
        SWITCH_TO_HOST
        iret
+// We are lead to the second path like so:
 // An interrupt, with some cause external
 // Has ajerked us rudely from the Guest's code
 // Again we must return home to the Host
@@ -238,7 +269,7 @@ deliver_to_host:
        // But now we must go home via that place
        // Where that interrupt was supposed to go
        // Had we not been ensconced, running the Guest.
-        // Here we see the cleverness of our stack:
+        // Here we see the trickness of run_guest_once():
        // The Host stack is formed like an interrupt
        // With EIP, CS and EFLAGS layered.
        // Interrupt handlers end with "iret"
@@ -263,7 +294,7 @@ deliver_to_host:
        xorw    %ax, %ax
        orl     %eax, %edx
        // Now the address of the handler's in %edx
-        // We call it now: its "iret" takes us home.
+        // We call it now: its "iret" drops us home.
        jmp     *%edx
 // Every interrupt can come to us here
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index ac54f697c508..1c159ac68c98 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -351,14 +351,10 @@ static int crypt_convert(struct crypt_config *cc,
                struct scatterlist sg_in, sg_out;
                sg_init_table(&sg_in, 1);
-                sg_set_page(&sg_in, bv_in->bv_page);
+                sg_set_page(&sg_in, bv_in->bv_page, 1 << SECTOR_SHIFT, bv_in->bv_offset + ctx->offset_in);
-                sg_in.offset = bv_in->bv_offset + ctx->offset_in;
-                sg_in.length = 1 << SECTOR_SHIFT;
                sg_init_table(&sg_out, 1);
-                sg_set_page(&sg_out, bv_out->bv_page);
+                sg_set_page(&sg_out, bv_out->bv_page, 1 << SECTOR_SHIFT, bv_out->bv_offset + ctx->offset_out);
-                sg_out.offset = bv_out->bv_offset + ctx->offset_out;
-                sg_out.length = 1 << SECTOR_SHIFT;
                ctx->offset_in += sg_in.length;
                if (ctx->offset_in >= bv_in->bv_len) {
diff --git a/drivers/media/common/saa7146_core.c b/drivers/media/common/saa7146_core.c
index 2b1f8b4be00a..cb034ead95ab 100644
--- a/drivers/media/common/saa7146_core.c
+++ b/drivers/media/common/saa7146_core.c
@@ -118,8 +118,7 @@ static struct scatterlist* vmalloc_to_sg(unsigned char *virt, int nr_pages)
                if (NULL == pg)
                        goto err;
                BUG_ON(PageHighMem(pg));
-                sg_set_page(&sglist[i], pg);
+                sg_set_page(&sglist[i], pg, PAGE_SIZE, 0);
-                sglist[i].length = PAGE_SIZE;
        }
        return sglist;
diff --git a/drivers/media/video/ivtv/ivtv-udma.c b/drivers/media/video/ivtv/ivtv-udma.c
index 912b424e5204..460db03b0ba0 100644
--- a/drivers/media/video/ivtv/ivtv-udma.c
+++ b/drivers/media/video/ivtv/ivtv-udma.c
@@ -49,8 +49,6 @@ int ivtv_udma_fill_sg_list (struct ivtv_user_dma *dma, struct ivtv_dma_page_info
                unsigned int len = (i == dma_page->page_count - 1) ?
                        dma_page->tail : PAGE_SIZE - offset;
-                dma->SGlist[map_offset].length = len;
-                dma->SGlist[map_offset].offset = offset;
                if (PageHighMem(dma->map[map_offset])) {
                        void *src;
@@ -63,10 +61,10 @@ int ivtv_udma_fill_sg_list (struct ivtv_user_dma *dma, struct ivtv_dma_page_info
                        memcpy(page_address(dma->bouncemap[map_offset]) + offset, src, len);
                        kunmap_atomic(src, KM_BOUNCE_READ);
                        local_irq_restore(flags);
-                        sg_set_page(&dma->SGlist[map_offset], dma->bouncemap[map_offset]);
+                        sg_set_page(&dma->SGlist[map_offset], dma->bouncemap[map_offset], len, offset);
                }
                else {
-                        sg_set_page(&dma->SGlist[map_offset], dma->map[map_offset]);
+                        sg_set_page(&dma->SGlist[map_offset], dma->map[map_offset], len, offset);
                }
                offset = 0;
                map_offset++;
diff --git a/drivers/media/video/videobuf-dma-sg.c b/drivers/media/video/videobuf-dma-sg.c
index 9ab94a749d81..44ee408e145f 100644
--- a/drivers/media/video/videobuf-dma-sg.c
+++ b/drivers/media/video/videobuf-dma-sg.c
@@ -67,8 +67,7 @@ videobuf_vmalloc_to_sg(unsigned char *virt, int nr_pages)
                if (NULL == pg)
                        goto err;
                BUG_ON(PageHighMem(pg));
-                sg_set_page(&sglist[i], pg);
+                sg_set_page(&sglist[i], pg, PAGE_SIZE, 0);
-                sglist[i].length = PAGE_SIZE;
        }
        return sglist;
@@ -95,16 +94,13 @@ videobuf_pages_to_sg(struct page **pages, int nr_pages, int offset)
        if (PageHighMem(pages[0]))
                /* DMA to highmem pages might not work */
                goto highmem;
-        sg_set_page(&sglist[0], pages[0]);
+        sg_set_page(&sglist[0], pages[0], PAGE_SIZE - offset, offset);
-        sglist[0].offset = offset;
-        sglist[0].length = PAGE_SIZE - offset;
        for (i = 1; i < nr_pages; i++) {
                if (NULL == pages[i])
                        goto nopage;
                if (PageHighMem(pages[i]))
                        goto highmem;
-                sg_set_page(&sglist[i], pages[i]);
+                sg_set_page(&sglist[i], pages[i], PAGE_SIZE, 0);
-                sglist[i].length = PAGE_SIZE;
        }
        return sglist;
diff --git a/drivers/message/i2o/i2o_block.c b/drivers/message/i2o/i2o_block.c
index d602ba6d5417..682406168de9 100644
--- a/drivers/message/i2o/i2o_block.c
+++ b/drivers/message/i2o/i2o_block.c
@@ -284,6 +284,7 @@ static inline struct i2o_block_request *i2o_block_request_alloc(void)
                return ERR_PTR(-ENOMEM);
        INIT_LIST_HEAD(&ireq->queue);
+        sg_init_table(ireq->sg_table, I2O_MAX_PHYS_SEGMENTS);
        return ireq;
 };
diff --git a/drivers/mmc/host/au1xmmc.c b/drivers/mmc/host/au1xmmc.c
index bcbb6d247bf7..c77fadc0dfa3 100644
--- a/drivers/mmc/host/au1xmmc.c
+++ b/drivers/mmc/host/au1xmmc.c
@@ -40,13 +40,13 @@
 #include <linux/mm.h>
 #include <linux/interrupt.h>
 #include <linux/dma-mapping.h>
+#include <scatterlist/scatterlist.h>
 #include <linux/mmc/host.h>
 #include <asm/io.h>
 #include <asm/mach-au1x00/au1000.h>
 #include <asm/mach-au1x00/au1xxx_dbdma.h>
 #include <asm/mach-au1x00/au1100_mmc.h>
-#include <asm/scatterlist.h>
 #include <au1xxx.h>
 #include "au1xmmc.h"
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index d0eb0a2abf4d..95244a7e7353 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -20,11 +20,11 @@
 #include <linux/mmc/host.h>
 #include <linux/amba/bus.h>
 #include <linux/clk.h>
+#include <linux/scatterlist.h>
 #include <asm/cacheflush.h>
 #include <asm/div64.h>
 #include <asm/io.h>
-#include <asm/scatterlist.h>
 #include <asm/sizes.h>
 #include <asm/mach/mmc.h>
@@ -167,7 +167,7 @@ mmci_data_irq(struct mmci_host *host, struct mmc_data *data,
                 * partially written to a page is properly coherent.
                 */
                if (host->sg_len && data->flags & MMC_DATA_READ)
-                        flush_dcache_page(host->sg_ptr->page);
+                        flush_dcache_page(sg_page(host->sg_ptr));
        }
        if (status & MCI_DATAEND) {
                mmci_stop_data(host);
@@ -319,7 +319,7 @@ static irqreturn_t mmci_pio_irq(int irq, void *dev_id)
                 * page, ensure that the data cache is coherent.
                 */
                if (status & MCI_RXACTIVE)
-                        flush_dcache_page(host->sg_ptr->page);
+                        flush_dcache_page(sg_page(host->sg_ptr));
                if (!mmci_next_sg(host))
                        break;
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index 0601e01aa2c2..a25ee71998a9 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -29,7 +29,6 @@
 #include <asm/dma.h>
 #include <asm/io.h>
-#include <asm/scatterlist.h>
 #include <asm/sizes.h>
 #include <asm/arch/pxa-regs.h>
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index d7c5b94d8c58..6b80bf77a4ef 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -17,8 +17,6 @@
 #include <linux/mmc/host.h>
-#include <asm/scatterlist.h>
 #include "sdhci.h"
 #define DRIVER_NAME "sdhci"
diff --git a/drivers/mmc/host/wbsd.c b/drivers/mmc/host/wbsd.c
index fa4c8c53cc7a..4d5f37421874 100644
--- a/drivers/mmc/host/wbsd.c
+++ b/drivers/mmc/host/wbsd.c
@@ -33,10 +33,10 @@
 #include <linux/pnp.h>
 #include <linux/highmem.h>
 #include <linux/mmc/host.h>
+#include <linux/scatterlist.h>
 #include <asm/io.h>
 #include <asm/dma.h>
-#include <asm/scatterlist.h>
 #include "wbsd.h"
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 6909becb10f6..6937ef0e7275 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -188,6 +188,7 @@ struct bond_parm_tbl arp_validate_tbl[] = {
 /*-------------------------- Forward declarations ---------------------------*/
 static void bond_send_gratuitous_arp(struct bonding *bond);
+static void bond_deinit(struct net_device *bond_dev);
 /*---------------------------- General routines -----------------------------*/
@@ -3681,7 +3682,7 @@ static int bond_open(struct net_device *bond_dev)
        }
        if (bond->params.mode == BOND_MODE_8023AD) {
-                INIT_DELAYED_WORK(&bond->ad_work, bond_alb_monitor);
+                INIT_DELAYED_WORK(&bond->ad_work, bond_3ad_state_machine_handler);
                queue_delayed_work(bond->wq, &bond->ad_work, 0);
                /* register to receive LACPDUs */
                bond_register_lacpdu(bond);
@@ -4449,7 +4450,7 @@ static int bond_init(struct net_device *bond_dev, struct bond_params *params)
 /* De-initialize device specific data.
 * Caller must hold rtnl_lock.
 */
-void bond_deinit(struct net_device *bond_dev)
+static void bond_deinit(struct net_device *bond_dev)
 {
        struct bonding *bond = bond_dev->priv;
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index d1ed14bf1ccb..61c1b4536d34 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -302,7 +302,6 @@ int bond_dev_queue_xmit(struct bonding *bond, struct sk_buff *skb, struct net_de
 int bond_create(char *name, struct bond_params *params, struct bonding **newbond);
 void bond_destroy(struct bonding *bond);
 int  bond_release_and_destroy(struct net_device *bond_dev, struct net_device *slave_dev);
-void bond_deinit(struct net_device *bond_dev);
 int bond_create_sysfs(void);
 void bond_destroy_sysfs(void);
 void bond_destroy_sysfs_entry(struct bonding *bond);
diff --git a/drivers/net/cpmac.c b/drivers/net/cpmac.c
index 57541d2d9e1e..6fd95a2c8cec 100644
--- a/drivers/net/cpmac.c
+++ b/drivers/net/cpmac.c
@@ -34,6 +34,7 @@
 #include <linux/skbuff.h>
 #include <linux/mii.h>
 #include <linux/phy.h>
+#include <linux/phy_fixed.h>
 #include <linux/platform_device.h>
 #include <linux/dma-mapping.h>
 #include <asm/gpio.h>
@@ -53,12 +54,6 @@ MODULE_PARM_DESC(debug_level, "Number of NETIF_MSG bits to enable");
 MODULE_PARM_DESC(dumb_switch, "Assume switch is not connected to MDIO bus");
 #define CPMAC_VERSION "0.5.0"
-/* stolen from net/ieee80211.h */
-#ifndef MAC_FMT
-#define MAC_FMT "%02x:%02x:%02x:%02x:%02x:%02x"
-#define MAC_ARG(x) ((u8*)(x))[0], ((u8*)(x))[1], ((u8*)(x))[2], \
-                   ((u8*)(x))[3], ((u8*)(x))[4], ((u8*)(x))[5]
-#endif
 /* frame size + 802.1q tag */
 #define CPMAC_SKB_SIZE          (ETH_FRAME_LEN + 4)
 #define CPMAC_QUEUES    8
@@ -211,6 +206,7 @@ struct cpmac_priv {
        struct net_device *dev;
        struct work_struct reset_work;
        struct platform_device *pdev;
+        struct napi_struct napi;
 };
 static irqreturn_t cpmac_irq(int, void *);
@@ -362,47 +358,48 @@ static void cpmac_set_multicast_list(struct net_device *dev)
        }
 }
-static struct sk_buff *cpmac_rx_one(struct net_device *dev,
+static struct sk_buff *cpmac_rx_one(struct cpmac_priv *priv,
-                                    struct cpmac_priv *priv,
                                    struct cpmac_desc *desc)
 {
        struct sk_buff *skb, *result = NULL;
        if (unlikely(netif_msg_hw(priv)))
-                cpmac_dump_desc(dev, desc);
+                cpmac_dump_desc(priv->dev, desc);
        cpmac_write(priv->regs, CPMAC_RX_ACK(0), (u32)desc->mapping);
        if (unlikely(!desc->datalen)) {
                if (netif_msg_rx_err(priv) && net_ratelimit())
                        printk(KERN_WARNING "%s: rx: spurious interrupt\n",
-                               dev->name);
+                               priv->dev->name);
                return NULL;
        }
-        skb = netdev_alloc_skb(dev, CPMAC_SKB_SIZE);
+        skb = netdev_alloc_skb(priv->dev, CPMAC_SKB_SIZE);
        if (likely(skb)) {
                skb_reserve(skb, 2);
                skb_put(desc->skb, desc->datalen);
-                desc->skb->protocol = eth_type_trans(desc->skb, dev);
+                desc->skb->protocol = eth_type_trans(desc->skb, priv->dev);
                desc->skb->ip_summed = CHECKSUM_NONE;
-                dev->stats.rx_packets++;
+                priv->dev->stats.rx_packets++;
-                dev->stats.rx_bytes += desc->datalen;
+                priv->dev->stats.rx_bytes += desc->datalen;
                result = desc->skb;
-                dma_unmap_single(&dev->dev, desc->data_mapping, CPMAC_SKB_SIZE,
+                dma_unmap_single(&priv->dev->dev, desc->data_mapping,
-                                 DMA_FROM_DEVICE);
+                                 CPMAC_SKB_SIZE, DMA_FROM_DEVICE);
                desc->skb = skb;
-                desc->data_mapping = dma_map_single(&dev->dev, skb->data,
+                desc->data_mapping = dma_map_single(&priv->dev->dev, skb->data,
                                                    CPMAC_SKB_SIZE,
                                                    DMA_FROM_DEVICE);
                desc->hw_data = (u32)desc->data_mapping;
                if (unlikely(netif_msg_pktdata(priv))) {
-                        printk(KERN_DEBUG "%s: received packet:\n", dev->name);
+                        printk(KERN_DEBUG "%s: received packet:\n",
-                        cpmac_dump_skb(dev, result);
+                               priv->dev->name);
+                        cpmac_dump_skb(priv->dev, result);
                }
        } else {
                if (netif_msg_rx_err(priv) && net_ratelimit())
                        printk(KERN_WARNING
-                               "%s: low on skbs, dropping packet\n", dev->name);
+                               "%s: low on skbs, dropping packet\n",
-                dev->stats.rx_dropped++;
+                               priv->dev->name);
+                priv->dev->stats.rx_dropped++;
        }
        desc->buflen = CPMAC_SKB_SIZE;
@@ -411,25 +408,25 @@ static struct sk_buff *cpmac_rx_one(struct net_device *dev,
        return result;
 }
-static int cpmac_poll(struct net_device *dev, int *budget)
+static int cpmac_poll(struct napi_struct *napi, int budget)
 {
        struct sk_buff *skb;
        struct cpmac_desc *desc;
-        int received = 0, quota = min(dev->quota, *budget);
+        int received = 0;
-        struct cpmac_priv *priv = netdev_priv(dev);
+        struct cpmac_priv *priv = container_of(napi, struct cpmac_priv, napi);
        spin_lock(&priv->rx_lock);
        if (unlikely(!priv->rx_head)) {
                if (netif_msg_rx_err(priv) && net_ratelimit())
                        printk(KERN_WARNING "%s: rx: polling, but no queue\n",
-                               dev->name);
+                               priv->dev->name);
-                netif_rx_complete(dev);
+                netif_rx_complete(priv->dev, napi);
                return 0;
        }
        desc = priv->rx_head;
-        while ((received < quota) && ((desc->dataflags & CPMAC_OWN) == 0)) {
+        while (((desc->dataflags & CPMAC_OWN) == 0) && (received < budget)) {
-                skb = cpmac_rx_one(dev, priv, desc);
+                skb = cpmac_rx_one(priv, desc);
                if (likely(skb)) {
                        netif_receive_skb(skb);
                        received++;
@@ -439,13 +436,11 @@ static int cpmac_poll(struct net_device *dev, int *budget)
        priv->rx_head = desc;
        spin_unlock(&priv->rx_lock);
-        *budget -= received;
-        dev->quota -= received;
        if (unlikely(netif_msg_rx_status(priv)))
-                printk(KERN_DEBUG "%s: poll processed %d packets\n", dev->name,
+                printk(KERN_DEBUG "%s: poll processed %d packets\n",
-                       received);
+                       priv->dev->name, received);
        if (desc->dataflags & CPMAC_OWN) {
-                netif_rx_complete(dev);
+                netif_rx_complete(priv->dev, napi);
                cpmac_write(priv->regs, CPMAC_RX_PTR(0), (u32)desc->mapping);
                cpmac_write(priv->regs, CPMAC_RX_INT_ENABLE, 1);
                return 0;
@@ -655,6 +650,7 @@ static void cpmac_hw_error(struct work_struct *work)
        spin_unlock(&priv->rx_lock);
        cpmac_clear_tx(priv->dev);
        cpmac_hw_start(priv->dev);
+        napi_enable(&priv->napi);
        netif_start_queue(priv->dev);
 }
@@ -681,8 +677,10 @@ static irqreturn_t cpmac_irq(int irq, void *dev_id)
        if (status & MAC_INT_RX) {
                queue = (status >> 8) & 7;
-                netif_rx_schedule(dev);
+                if (netif_rx_schedule_prep(dev, &priv->napi)) {
-                cpmac_write(priv->regs, CPMAC_RX_INT_CLEAR, 1 << queue);
+                        cpmac_write(priv->regs, CPMAC_RX_INT_CLEAR, 1 << queue);
+                        __netif_rx_schedule(dev, &priv->napi);
+                }
        }
        cpmac_write(priv->regs, CPMAC_MAC_EOI_VECTOR, 0);
@@ -692,6 +690,7 @@ static irqreturn_t cpmac_irq(int irq, void *dev_id)
                        printk(KERN_ERR "%s: hw error, resetting...\n",
                               dev->name);
                netif_stop_queue(dev);
+                napi_disable(&priv->napi);
                cpmac_hw_stop(dev);
                schedule_work(&priv->reset_work);
                if (unlikely(netif_msg_hw(priv)))
@@ -849,6 +848,15 @@ static void cpmac_adjust_link(struct net_device *dev)
        spin_unlock(&priv->lock);
 }
+static int cpmac_link_update(struct net_device *dev,
+                             struct fixed_phy_status *status)
+{
+        status->link = 1;
+        status->speed = 100;
+        status->duplex = 1;
+        return 0;
+}
 static int cpmac_open(struct net_device *dev)
 {
        int i, size, res;
@@ -857,15 +865,6 @@ static int cpmac_open(struct net_device *dev)
        struct cpmac_desc *desc;
        struct sk_buff *skb;
-        priv->phy = phy_connect(dev, priv->phy_name, &cpmac_adjust_link,
-                                0, PHY_INTERFACE_MODE_MII);
-        if (IS_ERR(priv->phy)) {
-                if (netif_msg_drv(priv))
-                        printk(KERN_ERR "%s: Could not attach to PHY\n",
-                               dev->name);
-                return PTR_ERR(priv->phy);
-        }
        mem = platform_get_resource_byname(priv->pdev, IORESOURCE_MEM, "regs");
        if (!request_mem_region(mem->start, mem->end - mem->start, dev->name)) {
                if (netif_msg_drv(priv))
@@ -927,6 +926,7 @@ static int cpmac_open(struct net_device *dev)
        INIT_WORK(&priv->reset_work, cpmac_hw_error);
        cpmac_hw_start(dev);
+        napi_enable(&priv->napi);
        priv->phy->state = PHY_CHANGELINK;
        phy_start(priv->phy);
@@ -951,8 +951,6 @@ fail_remap:
        release_mem_region(mem->start, mem->end - mem->start);
 fail_reserve:
-        phy_disconnect(priv->phy);
        return res;
 }
@@ -965,9 +963,8 @@ static int cpmac_stop(struct net_device *dev)
        netif_stop_queue(dev);
        cancel_work_sync(&priv->reset_work);
+        napi_disable(&priv->napi);
        phy_stop(priv->phy);
-        phy_disconnect(priv->phy);
-        priv->phy = NULL;
        cpmac_hw_stop(dev);
@@ -1001,11 +998,13 @@ static int external_switch;
 static int __devinit cpmac_probe(struct platform_device *pdev)
 {
-        int rc, phy_id;
+        int rc, phy_id, i;
        struct resource *mem;
        struct cpmac_priv *priv;
        struct net_device *dev;
        struct plat_cpmac_data *pdata;
+        struct fixed_info *fixed_phy;
+        DECLARE_MAC_BUF(mac);
        pdata = pdev->dev.platform_data;
@@ -1053,21 +1052,51 @@ static int __devinit cpmac_probe(struct platform_device *pdev)
        dev->set_multicast_list = cpmac_set_multicast_list;
        dev->tx_timeout         = cpmac_tx_timeout;
        dev->ethtool_ops        = &cpmac_ethtool_ops;
-        dev->poll = cpmac_poll;
-        dev->weight = 64;
        dev->features |= NETIF_F_MULTI_QUEUE;
+        netif_napi_add(dev, &priv->napi, cpmac_poll, 64);
        spin_lock_init(&priv->lock);
        spin_lock_init(&priv->rx_lock);
        priv->dev = dev;
        priv->ring_size = 64;
        priv->msg_enable = netif_msg_init(debug_level, 0xff);
        memcpy(dev->dev_addr, pdata->dev_addr, sizeof(dev->dev_addr));
        if (phy_id == 31) {
-                snprintf(priv->phy_name, BUS_ID_SIZE, PHY_ID_FMT,
+                snprintf(priv->phy_name, BUS_ID_SIZE, PHY_ID_FMT, cpmac_mii.id,
-                         cpmac_mii.id, phy_id);
+                         phy_id);
-        } else
+        } else {
-                snprintf(priv->phy_name, BUS_ID_SIZE, "fixed@%d:%d", 100, 1);
+                /* Let's try to get a free fixed phy... */
+                for (i = 0; i < MAX_PHY_AMNT; i++) {
+                        fixed_phy = fixed_mdio_get_phydev(i);
+                        if (!fixed_phy)
+                                continue;
+                        if (!fixed_phy->phydev->attached_dev) {
+                                strncpy(priv->phy_name,
+                                        fixed_phy->phydev->dev.bus_id,
+                                        BUS_ID_SIZE);
+                                fixed_mdio_set_link_update(fixed_phy->phydev,
+                                                           &cpmac_link_update);
+                                goto phy_found;
+                        }
+                }
+                if (netif_msg_drv(priv))
+                        printk(KERN_ERR "%s: Could not find fixed PHY\n",
+                               dev->name);
+                rc = -ENODEV;
+                goto fail;
+        }
+phy_found:
+        priv->phy = phy_connect(dev, priv->phy_name, &cpmac_adjust_link, 0,
+                                PHY_INTERFACE_MODE_MII);
+        if (IS_ERR(priv->phy)) {
+                if (netif_msg_drv(priv))
+                        printk(KERN_ERR "%s: Could not attach to PHY\n",
+                               dev->name);
+                return PTR_ERR(priv->phy);
+        }
        if ((rc = register_netdev(dev))) {
                printk(KERN_ERR "cpmac: error %i registering device %s\n", rc,
@@ -1077,9 +1106,9 @@ static int __devinit cpmac_probe(struct platform_device *pdev)
        if (netif_msg_probe(priv)) {
                printk(KERN_INFO
-                       "cpmac: device %s (regs: %p, irq: %d, phy: %s, mac: "
+                       "cpmac: device %s (regs: %p, irq: %d, phy: %s, "
-                       MAC_FMT ")\n", dev->name, (void *)mem->start, dev->irq,
+                       "mac: %s)\n", dev->name, (void *)mem->start, dev->irq,
-                       priv->phy_name, MAC_ARG(dev->dev_addr));
+                       priv->phy_name, print_mac(mac, dev->dev_addr));
        }
        return 0;
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index b557bb44a36f..4b4b74e47a67 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -40,7 +40,7 @@
 #include <asm/io.h>
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0078"
+#define DRV_VERSION     "EHEA_0079"
 /* eHEA capability flags */
 #define DLPAR_PORT_ADD_REM 1
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 2809c99906e0..0a7e78925540 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -2329,7 +2329,7 @@ static void port_napi_disable(struct ehea_port *port)
 {
        int i;
-        for (i = 0; i < port->num_def_qps; i++)
+        for (i = 0; i < port->num_def_qps + port->num_add_tx_qps; i++)
                napi_disable(&port->port_res[i].napi);
 }
@@ -2337,7 +2337,7 @@ static void port_napi_enable(struct ehea_port *port)
 {
        int i;
-        for (i = 0; i < port->num_def_qps; i++)
+        for (i = 0; i < port->num_def_qps + port->num_add_tx_qps; i++)
                napi_enable(&port->port_res[i].napi);
 }
@@ -2373,8 +2373,6 @@ static int ehea_down(struct net_device *dev)
        ehea_drop_multicast_list(dev);
        ehea_free_interrupts(dev);
-        port_napi_disable(port);
        port->state = EHEA_PORT_DOWN;
        ret = ehea_clean_all_portres(port);
@@ -2396,6 +2394,7 @@ static int ehea_stop(struct net_device *dev)
        flush_scheduled_work();
        down(&port->port_lock);
        netif_stop_queue(dev);
+        port_napi_disable(port);
        ret = ehea_down(dev);
        up(&port->port_lock);
        return ret;
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 70ddf1acfd88..92ce2e38f0d5 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -5597,6 +5597,22 @@ static struct pci_device_id pci_tbl[] = {
                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_31),
                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
        },
+        {       /* MCP77 Ethernet Controller */
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_32),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
+        },
+        {       /* MCP77 Ethernet Controller */
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_33),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
+        },
+        {       /* MCP77 Ethernet Controller */
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_34),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
+        },
+        {       /* MCP77 Ethernet Controller */
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_35),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
+        },
        {0,},
 };
diff --git a/drivers/net/ipg.c b/drivers/net/ipg.c
index 68887235d7e9..dbd23bb65d1e 100644
--- a/drivers/net/ipg.c
+++ b/drivers/net/ipg.c
@@ -55,6 +55,26 @@ MODULE_DESCRIPTION("IC Plus IP1000 Gigabit Ethernet Adapter Linux Driver "
                   DrvVer);
 MODULE_LICENSE("GPL");
+//variable record -- index by leading revision/length
+//Revision/Length(=N*4), Address1, Data1, Address2, Data2,...,AddressN,DataN
+static unsigned short DefaultPhyParam[] = {
+        // 11/12/03 IP1000A v1-3 rev=0x40
+        /*--------------------------------------------------------------------------
+        (0x4000|(15*4)), 31, 0x0001, 27, 0x01e0, 31, 0x0002, 22, 0x85bd, 24, 0xfff2,
+                                 27, 0x0c10, 28, 0x0c10, 29, 0x2c10, 31, 0x0003, 23, 0x92f6,
+                                 31, 0x0000, 23, 0x003d, 30, 0x00de, 20, 0x20e7,  9, 0x0700,
+          --------------------------------------------------------------------------*/
+        // 12/17/03 IP1000A v1-4 rev=0x40
+        (0x4000 | (07 * 4)), 31, 0x0001, 27, 0x01e0, 31, 0x0002, 27, 0xeb8e, 31,
+            0x0000,
+        30, 0x005e, 9, 0x0700,
+        // 01/09/04 IP1000A v1-5 rev=0x41
+        (0x4100 | (07 * 4)), 31, 0x0001, 27, 0x01e0, 31, 0x0002, 27, 0xeb8e, 31,
+            0x0000,
+        30, 0x005e, 9, 0x0700,
+        0x0000
+};
 static const char *ipg_brand_name[] = {
        "IC PLUS IP1000 1000/100/10 based NIC",
        "Sundance Technology ST2021 based NIC",
@@ -990,7 +1010,7 @@ static void ipg_nic_txcleanup(struct net_device *dev)
 }
 /* Provides statistical information about the IPG NIC. */
-struct net_device_stats *ipg_nic_get_stats(struct net_device *dev)
+static struct net_device_stats *ipg_nic_get_stats(struct net_device *dev)
 {
        struct ipg_nic_private *sp = netdev_priv(dev);
        void __iomem *ioaddr = sp->ioaddr;
diff --git a/drivers/net/ipg.h b/drivers/net/ipg.h
index e418b9035cac..d5d092c9d0af 100644
--- a/drivers/net/ipg.h
+++ b/drivers/net/ipg.h
@@ -833,24 +833,4 @@ struct ipg_nic_private {
        struct delayed_work task;
 };
-//variable record -- index by leading revision/length
-//Revision/Length(=N*4), Address1, Data1, Address2, Data2,...,AddressN,DataN
-unsigned short DefaultPhyParam[] = {
-        // 11/12/03 IP1000A v1-3 rev=0x40
-        /*--------------------------------------------------------------------------
-        (0x4000|(15*4)), 31, 0x0001, 27, 0x01e0, 31, 0x0002, 22, 0x85bd, 24, 0xfff2,
-                                 27, 0x0c10, 28, 0x0c10, 29, 0x2c10, 31, 0x0003, 23, 0x92f6,
-                                 31, 0x0000, 23, 0x003d, 30, 0x00de, 20, 0x20e7,  9, 0x0700,
-          --------------------------------------------------------------------------*/
-        // 12/17/03 IP1000A v1-4 rev=0x40
-        (0x4000 | (07 * 4)), 31, 0x0001, 27, 0x01e0, 31, 0x0002, 27, 0xeb8e, 31,
-            0x0000,
-        30, 0x005e, 9, 0x0700,
-        // 01/09/04 IP1000A v1-5 rev=0x41
-        (0x4100 | (07 * 4)), 31, 0x0001, 27, 0x01e0, 31, 0x0002, 27, 0xeb8e, 31,
-            0x0000,
-        30, 0x005e, 9, 0x0700,
-        0x0000
-};
 #endif                          /* __LINUX_IPG_H */
diff --git a/drivers/net/mlx4/icm.c b/drivers/net/mlx4/icm.c
index 887633b207d9..2a5bef6388fe 100644
--- a/drivers/net/mlx4/icm.c
+++ b/drivers/net/mlx4/icm.c
@@ -101,9 +101,7 @@ static int mlx4_alloc_icm_pages(struct scatterlist *mem, int order, gfp_t gfp_ma
        if (!page)
                return -ENOMEM;
-        sg_set_page(mem, page);
+        sg_set_page(mem, page, PAGE_SIZE << order, 0);
-        mem->length = PAGE_SIZE << order;
-        mem->offset = 0;
        return 0;
 }
diff --git a/drivers/net/natsemi.c b/drivers/net/natsemi.c
index 953117152bbd..87cde062fd63 100644
--- a/drivers/net/natsemi.c
+++ b/drivers/net/natsemi.c
@@ -864,6 +864,7 @@ static int __devinit natsemi_probe1 (struct pci_dev *pdev,
        np = netdev_priv(dev);
        netif_napi_add(dev, &np->napi, natsemi_poll, 64);
+        np->dev = dev;
        np->pci_dev = pdev;
        pci_set_drvdata(pdev, dev);
diff --git a/drivers/net/rrunner.c b/drivers/net/rrunner.c
index 19152f54ef2b..b822859c8de3 100644
--- a/drivers/net/rrunner.c
+++ b/drivers/net/rrunner.c
@@ -79,12 +79,10 @@ static char version[] __devinitdata = "rrunner.c: v0.50 11/11/2002  Jes Sorensen
 */
 /*
- * These are checked at init time to see if they are at least 256KB
+ * sysctl_[wr]mem_max are checked at init time to see if they are at
- * and increased to 256KB if they are not. This is done to avoid ending
+ * least 256KB and increased to 256KB if they are not. This is done to
- * up with socket buffers smaller than the MTU size,
+ * avoid ending up with socket buffers smaller than the MTU size,
 */
-extern __u32 sysctl_wmem_max;
-extern __u32 sysctl_rmem_max;
 static int __devinit rr_init_one(struct pci_dev *pdev,
        const struct pci_device_id *ent)
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index cd991a0f75bb..1ebe3259be0d 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -512,11 +512,19 @@ static int rndis_bind(struct usbnet *dev, struct usb_interface *intf)
        }
        tmp = le32_to_cpu(u.init_c->max_transfer_size);
        if (tmp < dev->hard_mtu) {
-                dev_err(&intf->dev,
+                if (tmp <= net->hard_header_len) {
-                        "dev can't take %u byte packets (max %u)\n",
+                        dev_err(&intf->dev,
-                        dev->hard_mtu, tmp);
+                                "dev can't take %u byte packets (max %u)\n",
-                retval = -EINVAL;
+                                dev->hard_mtu, tmp);
-                goto fail_and_release;
+                        retval = -EINVAL;
+                        goto fail_and_release;
+                }
+                dev->hard_mtu = tmp;
+                net->mtu = dev->hard_mtu - net->hard_header_len;
+                dev_warn(&intf->dev,
+                         "dev can't take %u byte packets (max %u), "
+                         "adjusting MTU to %u\n",
+                         dev->hard_mtu, tmp, net->mtu);
        }
        /* REVISIT:  peripheral "alignment" request is ignored ... */
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index fd5d0c1570df..00118499018b 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -562,8 +562,6 @@ zfcp_sg_list_alloc(struct zfcp_sg_list *sg_list, size_t size)
        sg_init_table(sg_list->sg, sg_list->count);
        for (i = 0, sg = sg_list->sg; i < sg_list->count; i++, sg++) {
-                sg->length = min(size, PAGE_SIZE);
-                sg->offset = 0;
                address = (void *) get_zeroed_page(GFP_KERNEL);
                if (address == NULL) {
                        sg_list->count = i;
@@ -571,7 +569,7 @@ zfcp_sg_list_alloc(struct zfcp_sg_list *sg_list, size_t size)
                        retval = -ENOMEM;
                        goto out;
                }
-                zfcp_address_to_sg(address, sg);
+                zfcp_address_to_sg(address, sg, min(size, PAGE_SIZE));
                size -= sg->length;
        }
@@ -1518,13 +1516,13 @@ zfcp_gid_pn_buffers_alloc(struct zfcp_gid_pn_data **gid_pn, mempool_t *pool)
                return -ENOMEM;
        memset(data, 0, sizeof(*data));
+        sg_init_table(&data->req , 1);
+        sg_init_table(&data->resp , 1);
        data->ct.req = &data->req;
        data->ct.resp = &data->resp;
        data->ct.req_count = data->ct.resp_count = 1;
-        zfcp_address_to_sg(&data->ct_iu_req, &data->req);
+        zfcp_address_to_sg(&data->ct_iu_req, &data->req, sizeof(struct ct_iu_gid_pn_req));
-        zfcp_address_to_sg(&data->ct_iu_resp, &data->resp);
+        zfcp_address_to_sg(&data->ct_iu_resp, &data->resp, sizeof(struct ct_iu_gid_pn_resp));
-        data->req.length = sizeof(struct ct_iu_gid_pn_req);
-        data->resp.length = sizeof(struct ct_iu_gid_pn_resp);
        *gid_pn = data;
        return 0;
diff --git a/drivers/s390/scsi/zfcp_def.h b/drivers/s390/scsi/zfcp_def.h
index 326e7ee232cb..0754542978b6 100644
--- a/drivers/s390/scsi/zfcp_def.h
+++ b/drivers/s390/scsi/zfcp_def.h
@@ -74,8 +74,7 @@ zfcp_sg_to_address(struct scatterlist *list)
 static inline void
 zfcp_address_to_sg(void *address, struct scatterlist *list)
 {
-        sg_set_page(list, virt_to_page(address));
+        sg_set_buf(list, address, 0);
-        list->offset = ((unsigned long) address) & (PAGE_SIZE - 1);
 }
 #define REQUEST_LIST_SIZE 128
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index 9438d0b28799..5552b755c08a 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -322,9 +322,9 @@ zfcp_erp_adisc(struct zfcp_port *port)
        if (address == NULL)
                goto nomem;
-        zfcp_address_to_sg(address, send_els->req);
+        zfcp_address_to_sg(address, send_els->req, sizeof(struct zfcp_ls_adisc));
        address += PAGE_SIZE >> 1;
-        zfcp_address_to_sg(address, send_els->resp);
+        zfcp_address_to_sg(address, send_els->resp, sizeof(struct zfcp_ls_adisc_acc));
        send_els->req_count = send_els->resp_count = 1;
        send_els->adapter = adapter;
@@ -336,9 +336,6 @@ zfcp_erp_adisc(struct zfcp_port *port)
        adisc = zfcp_sg_to_address(send_els->req);
        send_els->ls_code = adisc->code = ZFCP_LS_ADISC;
-        send_els->req->length = sizeof(struct zfcp_ls_adisc);
-        send_els->resp->length = sizeof(struct zfcp_ls_adisc_acc);
        /* acc. to FC-FS, hard_nport_id in ADISC should not be set for ports
           without FC-AL-2 capability, so we don't set it */
        adisc->wwpn = fc_host_port_name(adapter->scsi_host);
diff --git a/drivers/scsi/atari_NCR5380.c b/drivers/scsi/atari_NCR5380.c
index d1780980fb20..a9680b5e8ac6 100644
--- a/drivers/scsi/atari_NCR5380.c
+++ b/drivers/scsi/atari_NCR5380.c
@@ -477,10 +477,9 @@ static void merge_contiguous_buffers(Scsi_Cmnd *cmd)
        for (endaddr = virt_to_phys(cmd->SCp.ptr + cmd->SCp.this_residual - 1) + 1;
             cmd->SCp.buffers_residual &&
-             virt_to_phys(page_address(cmd->SCp.buffer[1].page) +
+             virt_to_phys(sg_virt(&cmd->SCp.buffer[1])) == endaddr;) {
-                          cmd->SCp.buffer[1].offset) == endaddr;) {
                MER_PRINTK("VTOP(%p) == %08lx -> merging\n",
-                           page_address(cmd->SCp.buffer[1].page), endaddr);
+                           page_address(sg_page(&cmd->SCp.buffer[1])), endaddr);
 #if (NDEBUG & NDEBUG_MERGING)
                ++cnt;
 #endif
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 439b97a6a269..0841df01bc19 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -2890,7 +2890,7 @@ static struct ipr_sglist *ipr_alloc_ucode_buffer(int buf_len)
                        return NULL;
                }
-                sg_set_page(&scatterlist[i], page);
+                sg_set_page(&scatterlist[i], page, 0, 0);
        }
        return sglist;
diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
index 6ce4109efdf3..097a136398cb 100644
--- a/drivers/scsi/iscsi_tcp.c
+++ b/drivers/scsi/iscsi_tcp.c
@@ -79,9 +79,7 @@ static inline void
 iscsi_buf_init_sg(struct iscsi_buf *ibuf, struct scatterlist *sg)
 {
        sg_init_table(&ibuf->sg, 1);
-        sg_set_page(&ibuf->sg, sg_page(sg));
+        sg_set_page(&ibuf->sg, sg_page(sg), sg->length, sg->offset);
-        ibuf->sg.offset = sg->offset;
-        ibuf->sg.length = sg->length;
        /*
         * Fastpath: sg element fits into single page
         */
diff --git a/drivers/scsi/osst.c b/drivers/scsi/osst.c
index 1c5c4b68f20f..4652ad22516b 100644
--- a/drivers/scsi/osst.c
+++ b/drivers/scsi/osst.c
@@ -5256,8 +5256,7 @@ static int enlarge_buffer(struct osst_buffer *STbuffer, int need_dma)
                STbuffer->sg[0].offset = 0;
                if (page != NULL) {
-                    sg_set_page(&STbuffer->sg[0], page);
+                    sg_set_page(&STbuffer->sg[0], page, b_size, 0);
-                    STbuffer->sg[0].length = b_size;
                    STbuffer->b_data = page_address(page);
                    break;
                }
@@ -5285,8 +5284,7 @@ static int enlarge_buffer(struct osst_buffer *STbuffer, int need_dma)
                        normalize_buffer(STbuffer);
                        return 0;
                }
-                sg_set_page(&STbuffer->sg[segs], page);
+                sg_set_page(&STbuffer->sg[segs], page, (OS_FRAME_SIZE - got <= PAGE_SIZE / 2) ? (OS_FRAME_SIZE - got) : b_size, 0);
-                STbuffer->sg[segs].length = (OS_FRAME_SIZE - got <= PAGE_SIZE / 2) ? (OS_FRAME_SIZE - got) : b_size;
                got += STbuffer->sg[segs].length;
                STbuffer->buffer_size = got;
                STbuffer->sg_segs = ++segs;
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index cc1971002846..b5fa4f091387 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1717,16 +1717,12 @@ st_map_user_pages(struct scatterlist *sgl, const unsigned int max_pages,
                   goto out_unlock; */
        }
-        sg_set_page(sgl, pages[0]);
+        sg_set_page(sgl, pages[0], 0, uaddr & ~PAGE_MASK);
-        sgl[0].offset = uaddr & ~PAGE_MASK;
        if (nr_pages > 1) {
                sgl[0].length = PAGE_SIZE - sgl[0].offset;
                count -= sgl[0].length;
-                for (i=1; i < nr_pages ; i++) {
+                for (i=1; i < nr_pages ; i++)
-                        sg_set_page(&sgl[i], pages[i]);
+                        sg_set_page(&sgl[i], pages[i], count < PAGE_SIZE ? count : PAGE_SIZE, 0);
-                        sgl[i].length = count < PAGE_SIZE ? count : PAGE_SIZE;
-                        count -= PAGE_SIZE;
-                }
        }
        else {
                sgl[0].length = count;
@@ -1854,8 +1850,7 @@ sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size)
                                scatter_elem_sz_prev = ret_sz;
                        }
                }
-                sg_set_page(sg, p);
+                sg_set_page(sg, p, (ret_sz > num) ? num : ret_sz, 0);
-                sg->length = (ret_sz > num) ? num : ret_sz;
                SCSI_LOG_TIMEOUT(5, printk("sg_build_indirect: k=%d, num=%d, "
                                 "ret_sz=%d\n", k, num, ret_sz));
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index ce69b9efc102..98dfd6ea209c 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -3797,13 +3797,11 @@ static void buf_to_sg(struct st_buffer *STbp, unsigned int length)
        sg = &(STbp->sg[0]);
        frp = STbp->frp;
        for (i=count=0; count < length; i++) {
-                sg_set_page(&sg[i], frp[i].page);
                if (length - count > frp[i].length)
-                        sg[i].length = frp[i].length;
+                        sg_set_page(&sg[i], frp[i].page, frp[i].length, 0);
                else
-                        sg[i].length = length - count;
+                        sg_set_page(&sg[i], frp[i].page, length - count, 0);
                count += sg[i].length;
-                sg[i].offset = 0;
        }
        STbp->sg_segs = i;
        STbp->frp_sg_current = length;
@@ -4446,15 +4444,13 @@ static int sgl_map_user_pages(struct scatterlist *sgl, const unsigned int max_pa
        }
        /* Populate the scatter/gather list */
-        sg_set_page(&sgl[0], pages[0]);
+        sg_set_page(&sgl[0], pages[0], 0, uaddr & ~PAGE_MASK);
-        sgl[0].offset = uaddr & ~PAGE_MASK;
        if (nr_pages > 1) {
                sgl[0].length = PAGE_SIZE - sgl[0].offset;
                count -= sgl[0].length;
                for (i=1; i < nr_pages ; i++) {
-                        sg_set_page(&sgl[i], pages[i]);;
+                        sg_set_page(&sgl[i], pages[i],
-                        sgl[i].offset = 0;
+                                    count < PAGE_SIZE ? count : PAGE_SIZE, 0);;
-                        sgl[i].length = count < PAGE_SIZE ? count : PAGE_SIZE;
                        count -= PAGE_SIZE;
                }
        }
diff --git a/drivers/scsi/sun3x_esp.c b/drivers/scsi/sun3x_esp.c
index 80fb3f88af2e..1bc41907a038 100644
--- a/drivers/scsi/sun3x_esp.c
+++ b/drivers/scsi/sun3x_esp.c
@@ -332,8 +332,8 @@ static void dma_mmu_get_scsi_sgl (struct NCR_ESP *esp, Scsi_Cmnd *sp)
    struct scatterlist *sg = sp->SCp.buffer;
    while (sz >= 0) {
-            sg[sz].dma_address = dvma_map((unsigned long)page_address(sg[sz].page) +
+            sg[sz].dma_address = dvma_map((unsigned long)sg_virt(&sg[sz]),
-                                           sg[sz].offset, sg[sz].length);
+                                          sg[sz].length);
            sz--;
    }
    sp->SCp.ptr=(char *)((unsigned long)sp->SCp.buffer->dma_address);