478 files changed, 33181 insertions, 16133 deletions

diff --git a/drivers/Kconfig b/drivers/Kconfig
index cecab0acc3fe..46d655fab115 100644
--- a/drivers/Kconfig
+++ b/drivers/Kconfig
@@ -48,6 +48,8 @@ source "drivers/hwmon/Kconfig"
 
 source "drivers/misc/Kconfig"
 
+source "drivers/mfd/Kconfig"
+
 source "drivers/media/Kconfig"
 
 source "drivers/video/Kconfig"
diff --git a/drivers/Makefile b/drivers/Makefile
index 126a851d5653..9663132ed825 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -26,7 +26,7 @@ obj-$(CONFIG_FB_INTEL)          += video/intelfb/
 obj-$(CONFIG_SERIO)             += input/serio/
 obj-y                           += serial/
 obj-$(CONFIG_PARPORT)           += parport/
-obj-y                           += base/ block/ misc/ net/ media/
+obj-y                           += base/ block/ misc/ mfd/ net/ media/
 obj-$(CONFIG_NUBUS)             += nubus/
 obj-$(CONFIG_ATM)               += atm/
 obj-$(CONFIG_PPC_PMAC)          += macintosh/
diff --git a/drivers/acorn/block/fd1772.c b/drivers/acorn/block/fd1772.c
index 3cd2e968e96c..c0a37d98b4f3 100644
--- a/drivers/acorn/block/fd1772.c
+++ b/drivers/acorn/block/fd1772.c
@@ -1283,8 +1283,7 @@ static void do_fd_request(request_queue_t* q)
         if (fdc_busy) return;
         save_flags(flags);
         cli();
-        while (fdc_busy)
-                sleep_on(&fdc_wait);
+        wait_event(fdc_wait, !fdc_busy);
         fdc_busy = 1;
         ENABLE_IRQ();
         restore_flags(flags);
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 986410e7b483..ba13896cae40 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -133,9 +133,10 @@ config ACPI_HOTKEY
         depends on ACPI_INTERPRETER
         depends on EXPERIMENTAL
         depends on !IA64_SGI_SN
-        default m
+        default n
         help
-        ACPI generic hotkey
+          Experimental consolidated hotkey driver.
+          If you are unsure, say N.
 
 config ACPI_FAN
         tristate "Fan"
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index 0f45d45f05a0..8162fd0c21a7 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -26,6 +26,9 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/types.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
 #include <acpi/acpi_bus.h>
 #include <acpi/acpi_drivers.h>
 
@@ -33,6 +36,9 @@
 #define ACPI_BUTTON_COMPONENT           0x00080000
 #define ACPI_BUTTON_DRIVER_NAME         "ACPI Button Driver"
 #define ACPI_BUTTON_CLASS               "button"
+#define ACPI_BUTTON_FILE_INFO           "info"
+#define ACPI_BUTTON_FILE_STATE          "state"
+#define ACPI_BUTTON_TYPE_UNKNOWN        0x00
 #define ACPI_BUTTON_NOTIFY_STATUS       0x80
 
 #define ACPI_BUTTON_SUBCLASS_POWER      "power"
@@ -64,6 +70,8 @@ MODULE_LICENSE("GPL");
 
 static int acpi_button_add (struct acpi_device *device);
 static int acpi_button_remove (struct acpi_device *device, int type);
+static int acpi_button_info_open_fs(struct inode *inode, struct file *file);
+static int acpi_button_state_open_fs(struct inode *inode, struct file *file);
 
 static struct acpi_driver acpi_button_driver = {
         .name =         ACPI_BUTTON_DRIVER_NAME,
@@ -82,6 +90,179 @@ struct acpi_button {
         unsigned long           pushed;
 };
 
+static struct file_operations acpi_button_info_fops = {
+        .open           = acpi_button_info_open_fs,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static struct file_operations acpi_button_state_fops = {
+        .open           = acpi_button_state_open_fs,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+/* --------------------------------------------------------------------------
+                              FS Interface (/proc)
+   -------------------------------------------------------------------------- */
+
+static struct proc_dir_entry    *acpi_button_dir;
+
+static int acpi_button_info_seq_show(struct seq_file *seq, void *offset)
+{
+        struct acpi_button      *button = (struct acpi_button *) seq->private;
+
+        ACPI_FUNCTION_TRACE("acpi_button_info_seq_show");
+
+        if (!button || !button->device)
+                return_VALUE(0);
+
+        seq_printf(seq, "type:                    %s\n", 
+                acpi_device_name(button->device));
+
+        return_VALUE(0);
+}
+
+static int acpi_button_info_open_fs(struct inode *inode, struct file *file)
+{
+        return single_open(file, acpi_button_info_seq_show, PDE(inode)->data);
+}
+        
+static int acpi_button_state_seq_show(struct seq_file *seq, void *offset)
+{
+        struct acpi_button      *button = (struct acpi_button *) seq->private;
+        acpi_status             status;
+        unsigned long           state;
+
+        ACPI_FUNCTION_TRACE("acpi_button_state_seq_show");
+
+        if (!button || !button->device)
+                return_VALUE(0);
+
+        status = acpi_evaluate_integer(button->handle,"_LID",NULL,&state);
+        if (ACPI_FAILURE(status)) {
+                seq_printf(seq, "state:      unsupported\n");
+        }
+        else{
+                seq_printf(seq, "state:      %s\n", (state ? "open" : "closed")); 
+        }
+
+        return_VALUE(0);
+}
+
+static int acpi_button_state_open_fs(struct inode *inode, struct file *file)
+{
+        return single_open(file, acpi_button_state_seq_show, PDE(inode)->data);
+}
+
+static struct proc_dir_entry *acpi_power_dir;
+static struct proc_dir_entry *acpi_sleep_dir;
+static struct proc_dir_entry *acpi_lid_dir;
+
+static int
+acpi_button_add_fs (
+        struct acpi_device      *device)
+{
+        struct proc_dir_entry   *entry = NULL;
+        struct acpi_button      *button = NULL;
+
+        ACPI_FUNCTION_TRACE("acpi_button_add_fs");
+
+        if (!device || !acpi_driver_data(device))
+                return_VALUE(-EINVAL);
+
+        button = acpi_driver_data(device);
+
+        switch (button->type) {
+        case ACPI_BUTTON_TYPE_POWER:
+        case ACPI_BUTTON_TYPE_POWERF:
+                if (!acpi_power_dir)
+                        acpi_power_dir = proc_mkdir(ACPI_BUTTON_SUBCLASS_POWER, 
+                                acpi_button_dir);
+                entry = acpi_power_dir;
+                break;
+        case ACPI_BUTTON_TYPE_SLEEP:
+        case ACPI_BUTTON_TYPE_SLEEPF:
+                if (!acpi_sleep_dir)
+                        acpi_sleep_dir = proc_mkdir(ACPI_BUTTON_SUBCLASS_SLEEP, 
+                                acpi_button_dir);
+                entry = acpi_sleep_dir;
+                break;
+        case ACPI_BUTTON_TYPE_LID:
+                if (!acpi_lid_dir)
+                        acpi_lid_dir = proc_mkdir(ACPI_BUTTON_SUBCLASS_LID, 
+                                acpi_button_dir);
+                entry = acpi_lid_dir;
+                break;
+        }
+
+        if (!entry)
+                return_VALUE(-ENODEV);
+        entry->owner = THIS_MODULE;
+
+        acpi_device_dir(device) = proc_mkdir(acpi_device_bid(device), entry);
+        if (!acpi_device_dir(device))
+                return_VALUE(-ENODEV);
+        acpi_device_dir(device)->owner = THIS_MODULE;
+
+        /* 'info' [R] */
+        entry = create_proc_entry(ACPI_BUTTON_FILE_INFO,
+                S_IRUGO, acpi_device_dir(device));
+        if (!entry)
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                        "Unable to create '%s' fs entry\n",
+                        ACPI_BUTTON_FILE_INFO));
+        else {
+                entry->proc_fops = &acpi_button_info_fops;
+                entry->data = acpi_driver_data(device);
+                entry->owner = THIS_MODULE;
+        }
+
+        /* show lid state [R] */
+        if (button->type == ACPI_BUTTON_TYPE_LID) {
+                entry = create_proc_entry(ACPI_BUTTON_FILE_STATE,
+                        S_IRUGO, acpi_device_dir(device));
+                if (!entry)
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                "Unable to create '%s' fs entry\n",
+                                ACPI_BUTTON_FILE_INFO));
+                else {
+                        entry->proc_fops = &acpi_button_state_fops;
+                        entry->data = acpi_driver_data(device);
+                        entry->owner = THIS_MODULE;
+                }
+        }
+
+        return_VALUE(0);
+}
+
+
+static int
+acpi_button_remove_fs (
+        struct acpi_device      *device)
+{
+        struct acpi_button      *button = NULL;
+
+        ACPI_FUNCTION_TRACE("acpi_button_remove_fs");
+
+        button = acpi_driver_data(device);
+        if (acpi_device_dir(device)) {
+                if (button->type == ACPI_BUTTON_TYPE_LID)
+                        remove_proc_entry(ACPI_BUTTON_FILE_STATE,
+                                             acpi_device_dir(device));
+                remove_proc_entry(ACPI_BUTTON_FILE_INFO,
+                                     acpi_device_dir(device));
+
+                remove_proc_entry(acpi_device_bid(device),
+                                     acpi_device_dir(device)->parent);
+                acpi_device_dir(device) = NULL;
+        }
+
+        return_VALUE(0);
+}
+
+
 /* --------------------------------------------------------------------------
                                 Driver Interface
    -------------------------------------------------------------------------- */
@@ -121,7 +302,8 @@ acpi_button_notify_fixed (
         
         ACPI_FUNCTION_TRACE("acpi_button_notify_fixed");
 
-        BUG_ON(!button);
+        if (!button)
+                return_ACPI_STATUS(AE_BAD_PARAMETER);
 
         acpi_button_notify(button->handle, ACPI_BUTTON_NOTIFY_STATUS, button);
 
@@ -197,6 +379,10 @@ acpi_button_add (
                 goto end;
         }
 
+        result = acpi_button_add_fs(device);
+        if (result)
+                goto end;
+
         switch (button->type) {
         case ACPI_BUTTON_TYPE_POWERF:
                 status = acpi_install_fixed_event_handler (
@@ -240,6 +426,7 @@ acpi_button_add (
 
 end:
         if (result) {
+                acpi_button_remove_fs(device);
                 kfree(button);
         }
 
@@ -280,6 +467,8 @@ acpi_button_remove (struct acpi_device *device, int type)
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
                         "Error removing notify handler\n"));
 
+        acpi_button_remove_fs(device);  
+
         kfree(button);
 
         return_VALUE(0);
@@ -293,14 +482,20 @@ acpi_button_init (void)
 
         ACPI_FUNCTION_TRACE("acpi_button_init");
 
+        acpi_button_dir = proc_mkdir(ACPI_BUTTON_CLASS, acpi_root_dir);
+        if (!acpi_button_dir)
+                return_VALUE(-ENODEV);
+        acpi_button_dir->owner = THIS_MODULE;
         result = acpi_bus_register_driver(&acpi_button_driver);
         if (result < 0) {
+                remove_proc_entry(ACPI_BUTTON_CLASS, acpi_root_dir);
                 return_VALUE(-ENODEV);
         }
 
         return_VALUE(0);
 }
 
+
 static void __exit
 acpi_button_exit (void)
 {
@@ -308,8 +503,17 @@ acpi_button_exit (void)
 
         acpi_bus_unregister_driver(&acpi_button_driver);
 
+        if (acpi_power_dir) 
+                remove_proc_entry(ACPI_BUTTON_SUBCLASS_POWER, acpi_button_dir);
+        if (acpi_sleep_dir)
+                remove_proc_entry(ACPI_BUTTON_SUBCLASS_SLEEP, acpi_button_dir);
+        if (acpi_lid_dir)
+                remove_proc_entry(ACPI_BUTTON_SUBCLASS_LID, acpi_button_dir);
+        remove_proc_entry(ACPI_BUTTON_CLASS, acpi_root_dir);
+
         return_VOID;
 }
 
+
 module_init(acpi_button_init);
 module_exit(acpi_button_exit);
diff --git a/drivers/acpi/dispatcher/dswload.c b/drivers/acpi/dispatcher/dswload.c
index 1ac197ccfc80..d11620018421 100644
--- a/drivers/acpi/dispatcher/dswload.c
+++ b/drivers/acpi/dispatcher/dswload.c
@@ -491,12 +491,6 @@ acpi_ds_load2_begin_op (
                 if ((!(walk_state->op_info->flags & AML_NSOPCODE) &&
                           (walk_state->opcode != AML_INT_NAMEPATH_OP)) ||
                         (!(walk_state->op_info->flags & AML_NAMED))) {
-                        if ((walk_state->op_info->class == AML_CLASS_EXECUTE) ||
-                                (walk_state->op_info->class == AML_CLASS_CONTROL)) {
-                                ACPI_REPORT_WARNING ((
-                                        "Encountered executable code at module level, [%s]\n",
-                                        acpi_ps_get_opcode_name (walk_state->opcode)));
-                        }
                         return_ACPI_STATUS (AE_OK);
                 }
 
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 2dadb7f63269..1ac5731d45e5 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -76,13 +76,14 @@ static int acpi_ec_remove (struct acpi_device *device, int type);
 static int acpi_ec_start (struct acpi_device *device);
 static int acpi_ec_stop (struct acpi_device *device, int type);
 static int acpi_ec_burst_add ( struct acpi_device *device);
+static int acpi_ec_polling_add ( struct acpi_device     *device);
 
 static struct acpi_driver acpi_ec_driver = {
         .name =         ACPI_EC_DRIVER_NAME,
         .class =        ACPI_EC_CLASS,
         .ids =          ACPI_EC_HID,
         .ops =          {
-                                .add =          acpi_ec_burst_add,
+                                .add =          acpi_ec_polling_add,
                                 .remove =       acpi_ec_remove,
                                 .start =        acpi_ec_start,
                                 .stop =         acpi_ec_stop,
@@ -164,7 +165,7 @@ static union acpi_ec	*ec_ecdt;
 
 /* External interfaces use first EC only, so remember */
 static struct acpi_device *first_ec;
-static int acpi_ec_polling_mode;
+static int acpi_ec_polling_mode = EC_POLLING;
 
 /* --------------------------------------------------------------------------
                              Transaction Management
@@ -1710,11 +1711,24 @@ static int __init acpi_fake_ecdt_setup(char *str)
         acpi_fake_ecdt_enabled = 1;
         return 0;
 }
+
 __setup("acpi_fake_ecdt", acpi_fake_ecdt_setup);
 static int __init acpi_ec_set_polling_mode(char *str)
 {
-        acpi_ec_polling_mode = EC_POLLING;
-        acpi_ec_driver.ops.add = acpi_ec_polling_add;
+        int burst;
+
+        if (!get_option(&str, &burst))
+                return 0;
+
+        if (burst) {
+                acpi_ec_polling_mode = EC_BURST;
+                acpi_ec_driver.ops.add = acpi_ec_burst_add;
+        } else {
+                acpi_ec_polling_mode = EC_POLLING;
+                acpi_ec_driver.ops.add = acpi_ec_polling_add;
+        }
+        printk(KERN_INFO PREFIX "EC %s mode.\n",
+                burst ? "burst": "polling");
         return 0;
 }
-__setup("ec_polling", acpi_ec_set_polling_mode);
+__setup("ec_burst=", acpi_ec_set_polling_mode);
diff --git a/drivers/acpi/hotkey.c b/drivers/acpi/hotkey.c
index babdf762eadb..1f76a40badec 100644
--- a/drivers/acpi/hotkey.c
+++ b/drivers/acpi/hotkey.c
@@ -1,5 +1,5 @@
-/* 
- *  hotkey.c - ACPI Hotkey Driver ($Revision:$)
+/*
+ *  hotkey.c - ACPI Hotkey Driver ($Revision: 0.2 $)
  *
  *  Copyright (C) 2004 Luming Yu <luming.yu@intel.com>
  *
@@ -51,17 +51,18 @@
 #define ACPI_HOTKEY_POLLING 0x2
 #define ACPI_UNDEFINED_EVENT    0xf
 
-#define MAX_CONFIG_RECORD_LEN   80
-#define MAX_NAME_PATH_LEN   80
-#define MAX_CALL_PARM       80
+#define RESULT_STR_LEN      80
 
-#define IS_EVENT(e)       0xff  /* ((e) & 0x40000000)  */
-#define IS_POLL(e)      0xff    /* (~((e) & 0x40000000))  */
+#define ACTION_METHOD   0
+#define POLL_METHOD     1
 
+#define IS_EVENT(e)             ((e) <= 10000 && (e) >0)
+#define IS_POLL(e)              ((e) > 10000)
+#define IS_OTHERS(e)            ((e)<=0 || (e)>=20000)
 #define _COMPONENT              ACPI_HOTKEY_COMPONENT
 ACPI_MODULE_NAME("acpi_hotkey")
 
-    MODULE_AUTHOR("luming.yu@intel.com");
+MODULE_AUTHOR("luming.yu@intel.com");
 MODULE_DESCRIPTION(ACPI_HOTK_NAME);
 MODULE_LICENSE("GPL");
 
@@ -114,7 +115,7 @@ struct acpi_event_hotkey {
         char *action_method;    /* action method */
 };
 
-/* 
+/*
  * There are two ways to poll status
  * 1. directy call read_xxx method, without any arguments passed in
  * 2. call write_xxx method, with arguments passed in, you need
@@ -131,7 +132,7 @@ struct acpi_polling_hotkey {
         char *poll_method;      /* poll method */
         acpi_handle action_handle;      /* acpi handle attached action method */
         char *action_method;    /* action method */
-        void *poll_result;      /* polling_result */
+        union acpi_object *poll_result; /* polling_result */
         struct proc_dir_entry *proc;
 };
 
@@ -162,20 +163,25 @@ static struct acpi_driver hotkey_driver = {
                 },
 };
 
+static void free_hotkey_device(union acpi_hotkey *key);
+static void free_hotkey_buffer(union acpi_hotkey *key);
+static void free_poll_hotkey_buffer(union acpi_hotkey *key);
 static int hotkey_open_config(struct inode *inode, struct file *file);
+static int hotkey_poll_open_config(struct inode *inode, struct file *file);
 static ssize_t hotkey_write_config(struct file *file,
                                    const char __user * buffer,
                                    size_t count, loff_t * data);
-static ssize_t hotkey_write_poll_config(struct file *file,
-                                        const char __user * buffer,
-                                        size_t count, loff_t * data);
 static int hotkey_info_open_fs(struct inode *inode, struct file *file);
 static int hotkey_action_open_fs(struct inode *inode, struct file *file);
 static ssize_t hotkey_execute_aml_method(struct file *file,
                                          const char __user * buffer,
                                          size_t count, loff_t * data);
 static int hotkey_config_seq_show(struct seq_file *seq, void *offset);
+static int hotkey_poll_config_seq_show(struct seq_file *seq, void *offset);
 static int hotkey_polling_open_fs(struct inode *inode, struct file *file);
+static union acpi_hotkey *get_hotkey_by_event(struct
+                              acpi_hotkey_list
+                              *hotkey_list, int event);
 
 /* event based config */
 static struct file_operations hotkey_config_fops = {
@@ -188,9 +194,9 @@ static struct file_operations hotkey_config_fops = {
 
 /* polling based config */
 static struct file_operations hotkey_poll_config_fops = {
-        .open = hotkey_open_config,
+        .open = hotkey_poll_open_config,
         .read = seq_read,
-        .write = hotkey_write_poll_config,
+        .write = hotkey_write_config,
         .llseek = seq_lseek,
         .release = single_release,
 };
@@ -227,7 +233,7 @@ static int hotkey_info_seq_show(struct seq_file *seq, void *offset)
 {
         ACPI_FUNCTION_TRACE("hotkey_info_seq_show");
 
-        seq_printf(seq, "Hotkey generic driver ver: %s", HOTKEY_ACPI_VERSION);
+        seq_printf(seq, "Hotkey generic driver ver: %s\n", HOTKEY_ACPI_VERSION);
 
         return_VALUE(0);
 }
@@ -239,27 +245,35 @@ static int hotkey_info_open_fs(struct inode *inode, struct file *file)
 
 static char *format_result(union acpi_object *object)
 {
-        char *buf = (char *)kmalloc(sizeof(union acpi_object), GFP_KERNEL);
-
-        memset(buf, 0, sizeof(union acpi_object));
+        char *buf = NULL;
+        
+        buf = (char *)kmalloc(RESULT_STR_LEN, GFP_KERNEL);
+        if (buf)
+                memset(buf, 0, RESULT_STR_LEN);
+        else
+                goto do_fail;
 
         /* Now, just support integer type */
         if (object->type == ACPI_TYPE_INTEGER)
-                sprintf(buf, "%d", (u32) object->integer.value);
-
-        return buf;
+                sprintf(buf, "%d\n", (u32) object->integer.value);
+do_fail:
+        return (buf);
 }
 
 static int hotkey_polling_seq_show(struct seq_file *seq, void *offset)
 {
         struct acpi_polling_hotkey *poll_hotkey =
             (struct acpi_polling_hotkey *)seq->private;
+        char *buf;
 
         ACPI_FUNCTION_TRACE("hotkey_polling_seq_show");
 
-        if (poll_hotkey->poll_result)
-                seq_printf(seq, "%s", format_result(poll_hotkey->poll_result));
-
+        if (poll_hotkey->poll_result){
+                buf = format_result(poll_hotkey->poll_result);
+                if(buf)
+                        seq_printf(seq, "%s", buf);
+                kfree(buf);
+        }
         return_VALUE(0);
 }
 
@@ -276,19 +290,19 @@ static int hotkey_action_open_fs(struct inode *inode, struct file *file)
 /* Mapping external hotkey number to standardized hotkey event num */
 static int hotkey_get_internal_event(int event, struct acpi_hotkey_list *list)
 {
-        struct list_head *entries, *next;
-        int val = 0;
+        struct list_head *entries;
+        int val = -1;
 
         ACPI_FUNCTION_TRACE("hotkey_get_internal_event");
 
-        list_for_each_safe(entries, next, list->entries) {
+        list_for_each(entries, list->entries) {
                 union acpi_hotkey *key =
                     container_of(entries, union acpi_hotkey, entries);
                 if (key->link.hotkey_type == ACPI_HOTKEY_EVENT
-                    && key->event_hotkey.external_hotkey_num == event)
+                    && key->event_hotkey.external_hotkey_num == event){
                         val = key->link.hotkey_standard_num;
-                else
-                        val = -1;
+                        break;
+                }
         }
 
         return_VALUE(val);
@@ -306,7 +320,7 @@ acpi_hotkey_notify_handler(acpi_handle handle, u32 event, void *data)
                 return_VOID;
 
         internal_event = hotkey_get_internal_event(event, &global_hotkey_list);
-        acpi_bus_generate_event(device, event, 0);
+        acpi_bus_generate_event(device, internal_event, 0);
 
         return_VOID;
 }
@@ -329,13 +343,17 @@ static int auto_hotkey_remove(struct acpi_device *device, int type)
 static int create_polling_proc(union acpi_hotkey *device)
 {
         struct proc_dir_entry *proc;
+        char  proc_name[80];
         mode_t mode;
 
         ACPI_FUNCTION_TRACE("create_polling_proc");
         mode = S_IFREG | S_IRUGO | S_IWUGO;
 
-        proc = create_proc_entry(device->poll_hotkey.action_method,
-                                 mode, hotkey_proc_dir);
+        sprintf(proc_name, "%d", device->link.hotkey_standard_num);
+        /*
+        strcat(proc_name, device->poll_hotkey.poll_method);
+        */
+        proc = create_proc_entry(proc_name, mode, hotkey_proc_dir);
 
         if (!proc) {
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
@@ -353,23 +371,6 @@ static int create_polling_proc(union acpi_hotkey *device)
         return_VALUE(0);
 }
 
-static int is_valid_acpi_path(const char *pathname)
-{
-        acpi_handle handle;
-        acpi_status status;
-        ACPI_FUNCTION_TRACE("is_valid_acpi_path");
-
-        status = acpi_get_handle(NULL, (char *)pathname, &handle);
-        return_VALUE(!ACPI_FAILURE(status));
-}
-
-static int is_valid_hotkey(union acpi_hotkey *device)
-{
-        ACPI_FUNCTION_TRACE("is_valid_hotkey");
-        /* Implement valid check */
-        return_VALUE(1);
-}
-
 static int hotkey_add(union acpi_hotkey *device)
 {
         int status = 0;
@@ -378,15 +379,11 @@ static int hotkey_add(union acpi_hotkey *device)
         ACPI_FUNCTION_TRACE("hotkey_add");
 
         if (device->link.hotkey_type == ACPI_HOTKEY_EVENT) {
-                status =
-                    acpi_bus_get_device(device->event_hotkey.bus_handle, &dev);
-                if (status)
-                        return_VALUE(status);
-
+                acpi_bus_get_device(device->event_hotkey.bus_handle, &dev);
                 status = acpi_install_notify_handler(dev->handle,
-                                                     ACPI_SYSTEM_NOTIFY,
+                                                     ACPI_DEVICE_NOTIFY,
                                                      acpi_hotkey_notify_handler,
-                                                     device);
+                                                     dev);
         } else                  /* Add polling hotkey */
                 create_polling_proc(device);
 
@@ -409,84 +406,143 @@ static int hotkey_remove(union acpi_hotkey *device)
                 if (key->link.hotkey_standard_num ==
                     device->link.hotkey_standard_num) {
                         list_del(&key->link.entries);
-                        remove_proc_entry(key->poll_hotkey.action_method,
-                                          hotkey_proc_dir);
+                        free_hotkey_device(key);
                         global_hotkey_list.count--;
                         break;
                 }
         }
+        kfree(device);
         return_VALUE(0);
 }
 
-static void hotkey_update(union acpi_hotkey *key)
+static int  hotkey_update(union acpi_hotkey *key)
 {
-        struct list_head *entries, *next;
+        struct list_head *entries;
 
         ACPI_FUNCTION_TRACE("hotkey_update");
 
-        list_for_each_safe(entries, next, global_hotkey_list.entries) {
-                union acpi_hotkey *key =
+        list_for_each(entries, global_hotkey_list.entries) {
+                union acpi_hotkey *tmp=
                     container_of(entries, union acpi_hotkey, entries);
-                if (key->link.hotkey_standard_num ==
+                if (tmp->link.hotkey_standard_num ==
                     key->link.hotkey_standard_num) {
-                        key->event_hotkey.bus_handle =
-                            key->event_hotkey.bus_handle;
-                        key->event_hotkey.external_hotkey_num =
-                            key->event_hotkey.external_hotkey_num;
-                        key->event_hotkey.action_handle =
-                            key->event_hotkey.action_handle;
-                        key->event_hotkey.action_method =
-                            key->event_hotkey.action_method;
+                        if (key->link.hotkey_type == ACPI_HOTKEY_EVENT) {
+                                free_hotkey_buffer(tmp);
+                                tmp->event_hotkey.bus_handle =
+                                        key->event_hotkey.bus_handle;
+                                tmp->event_hotkey.external_hotkey_num =
+                                        key->event_hotkey.external_hotkey_num;
+                                tmp->event_hotkey.action_handle =
+                                        key->event_hotkey.action_handle;
+                                tmp->event_hotkey.action_method =
+                                        key->event_hotkey.action_method;
+                                kfree(key);
+                        } else {
+                                /*
+                                char  proc_name[80];
+
+                                sprintf(proc_name, "%d", tmp->link.hotkey_standard_num);
+                                strcat(proc_name, tmp->poll_hotkey.poll_method);
+                                remove_proc_entry(proc_name,hotkey_proc_dir);
+                                */
+                                free_poll_hotkey_buffer(tmp);
+                                tmp->poll_hotkey.poll_handle =
+                                        key->poll_hotkey.poll_handle;
+                                tmp->poll_hotkey.poll_method =
+                                        key->poll_hotkey.poll_method;
+                                tmp->poll_hotkey.action_handle =
+                                        key->poll_hotkey.action_handle;
+                                tmp->poll_hotkey.action_method =
+                                        key->poll_hotkey.action_method;
+                                tmp->poll_hotkey.poll_result =
+                                        key->poll_hotkey.poll_result;
+                                /*
+                                create_polling_proc(tmp);
+                                */
+                                kfree(key);
+                        }
+                        return_VALUE(0);
                         break;
                 }
         }
 
-        return_VOID;
+        return_VALUE(-ENODEV);
 }
 
 static void free_hotkey_device(union acpi_hotkey *key)
 {
         struct acpi_device *dev;
-        int status;
 
         ACPI_FUNCTION_TRACE("free_hotkey_device");
 
         if (key->link.hotkey_type == ACPI_HOTKEY_EVENT) {
-                status =
-                    acpi_bus_get_device(key->event_hotkey.bus_handle, &dev);
+                acpi_bus_get_device(key->event_hotkey.bus_handle, &dev);
                 if (dev->handle)
                         acpi_remove_notify_handler(dev->handle,
-                                                   ACPI_SYSTEM_NOTIFY,
+                                                   ACPI_DEVICE_NOTIFY,
                                                    acpi_hotkey_notify_handler);
-        } else
-                remove_proc_entry(key->poll_hotkey.action_method,
-                                  hotkey_proc_dir);
+                free_hotkey_buffer(key);
+        } else {
+                char  proc_name[80];
+
+                sprintf(proc_name, "%d", key->link.hotkey_standard_num);
+                /*
+                strcat(proc_name, key->poll_hotkey.poll_method);
+                */
+                remove_proc_entry(proc_name,hotkey_proc_dir);
+                free_poll_hotkey_buffer(key);
+        }
         kfree(key);
         return_VOID;
 }
 
+static void
+free_hotkey_buffer(union acpi_hotkey *key)
+{
+        kfree(key->event_hotkey.action_method);
+}
+
+static void
+free_poll_hotkey_buffer(union acpi_hotkey *key)
+{
+        kfree(key->poll_hotkey.action_method);
+        kfree(key->poll_hotkey.poll_method);
+        kfree(key->poll_hotkey.poll_result);
+}
 static int
 init_hotkey_device(union acpi_hotkey *key, char *bus_str, char *action_str,
                    char *method, int std_num, int external_num)
 {
+        acpi_handle     tmp_handle;
+        acpi_status status = AE_OK;
+
         ACPI_FUNCTION_TRACE("init_hotkey_device");
 
+        if(std_num < 0 || IS_POLL(std_num) || !key )
+                goto do_fail;
+
+        if(!bus_str || !action_str || !method)
+                goto do_fail;
+
         key->link.hotkey_type = ACPI_HOTKEY_EVENT;
         key->link.hotkey_standard_num = std_num;
         key->event_hotkey.flag = 0;
-        if (is_valid_acpi_path(bus_str))
-                acpi_get_handle((acpi_handle) 0,
-                                bus_str, &(key->event_hotkey.bus_handle));
-        else
-                return_VALUE(-ENODEV);
-        key->event_hotkey.external_hotkey_num = external_num;
-        if (is_valid_acpi_path(action_str))
-                acpi_get_handle((acpi_handle) 0,
-                                action_str, &(key->event_hotkey.action_handle));
-        key->event_hotkey.action_method = kmalloc(sizeof(method), GFP_KERNEL);
-        strcpy(key->event_hotkey.action_method, method);
+        key->event_hotkey.action_method = method;
 
-        return_VALUE(!is_valid_hotkey(key));
+        status = acpi_get_handle(NULL,bus_str, &(key->event_hotkey.bus_handle));
+        if(ACPI_FAILURE(status))
+                goto do_fail;
+        key->event_hotkey.external_hotkey_num = external_num;
+        status = acpi_get_handle(NULL,action_str, &(key->event_hotkey.action_handle));
+        if(ACPI_FAILURE(status))
+                goto do_fail;
+        status = acpi_get_handle(key->event_hotkey.action_handle,
+                                method, &tmp_handle);
+        if (ACPI_FAILURE(status))
+                goto do_fail;
+        return_VALUE(AE_OK);
+do_fail:
+        return_VALUE(-ENODEV);
 }
 
 static int
@@ -495,34 +551,46 @@ init_poll_hotkey_device(union acpi_hotkey *key,
                         char *poll_method,
                         char *action_str, char *action_method, int std_num)
 {
+        acpi_status status = AE_OK;
+        acpi_handle     tmp_handle;
+
         ACPI_FUNCTION_TRACE("init_poll_hotkey_device");
 
+        if(std_num < 0 || IS_EVENT(std_num) || !key)
+                goto do_fail;
+
+        if(!poll_str || !poll_method || !action_str || !action_method)
+                goto do_fail;
+
         key->link.hotkey_type = ACPI_HOTKEY_POLLING;
         key->link.hotkey_standard_num = std_num;
         key->poll_hotkey.flag = 0;
-        if (is_valid_acpi_path(poll_str))
-                acpi_get_handle((acpi_handle) 0,
-                                poll_str, &(key->poll_hotkey.poll_handle));
-        else
-                return_VALUE(-ENODEV);
         key->poll_hotkey.poll_method = poll_method;
-        if (is_valid_acpi_path(action_str))
-                acpi_get_handle((acpi_handle) 0,
-                                action_str, &(key->poll_hotkey.action_handle));
-        key->poll_hotkey.action_method =
-            kmalloc(sizeof(action_method), GFP_KERNEL);
-        strcpy(key->poll_hotkey.action_method, action_method);
+        key->poll_hotkey.action_method = action_method;
+
+        status = acpi_get_handle(NULL,poll_str, &(key->poll_hotkey.poll_handle));
+        if(ACPI_FAILURE(status))
+                goto do_fail;
+        status = acpi_get_handle(key->poll_hotkey.poll_handle,
+                                poll_method, &tmp_handle);
+        if (ACPI_FAILURE(status))
+                goto do_fail;
+        status = acpi_get_handle(NULL,action_str, &(key->poll_hotkey.action_handle));
+        if (ACPI_FAILURE(status))
+                goto do_fail;
+        status = acpi_get_handle(key->poll_hotkey.action_handle,
+                                action_method, &tmp_handle);
+        if (ACPI_FAILURE(status))
+                goto do_fail;
         key->poll_hotkey.poll_result =
             (union acpi_object *)kmalloc(sizeof(union acpi_object), GFP_KERNEL);
-        return_VALUE(is_valid_hotkey(key));
+        if(!key->poll_hotkey.poll_result)
+                goto do_fail;
+        return_VALUE(AE_OK);
+do_fail:
+        return_VALUE(-ENODEV);
 }
 
-static int check_hotkey_valid(union acpi_hotkey *key,
-                              struct acpi_hotkey_list *list)
-{
-        ACPI_FUNCTION_TRACE("check_hotkey_valid");
-        return_VALUE(0);
-}
 
 static int hotkey_open_config(struct inode *inode, struct file *file)
 {
@@ -531,10 +599,17 @@ static int hotkey_open_config(struct inode *inode, struct file *file)
                      (file, hotkey_config_seq_show, PDE(inode)->data));
 }
 
+static int hotkey_poll_open_config(struct inode *inode, struct file *file)
+{
+        ACPI_FUNCTION_TRACE("hotkey_poll_open_config");
+        return_VALUE(single_open
+                     (file, hotkey_poll_config_seq_show, PDE(inode)->data));
+}
+
 static int hotkey_config_seq_show(struct seq_file *seq, void *offset)
 {
         struct acpi_hotkey_list *hotkey_list = &global_hotkey_list;
-        struct list_head *entries, *next;
+        struct list_head *entries;
         char bus_name[ACPI_PATHNAME_MAX] = { 0 };
         char action_name[ACPI_PATHNAME_MAX] = { 0 };
         struct acpi_buffer bus = { ACPI_PATHNAME_MAX, bus_name };
@@ -542,10 +617,7 @@ static int hotkey_config_seq_show(struct seq_file *seq, void *offset)
 
         ACPI_FUNCTION_TRACE(("hotkey_config_seq_show"));
 
-        if (!hotkey_list)
-                goto end;
-
-        list_for_each_safe(entries, next, hotkey_list->entries) {
+        list_for_each(entries, hotkey_list->entries) {
                 union acpi_hotkey *key =
                     container_of(entries, union acpi_hotkey, entries);
                 if (key->link.hotkey_type == ACPI_HOTKEY_EVENT) {
@@ -553,18 +625,37 @@ static int hotkey_config_seq_show(struct seq_file *seq, void *offset)
                                       ACPI_NAME_TYPE_MAX, &bus);
                         acpi_get_name(key->event_hotkey.action_handle,
                                       ACPI_NAME_TYPE_MAX, &act);
-                        seq_printf(seq, "%s:%s:%s:%d:%d", bus_name,
+                        seq_printf(seq, "%s:%s:%s:%d:%d\n", bus_name,
                                    action_name,
                                    key->event_hotkey.action_method,
                                    key->link.hotkey_standard_num,
                                    key->event_hotkey.external_hotkey_num);
-                } /* ACPI_HOTKEY_POLLING */
-                else {
+                }
+        }
+        seq_puts(seq, "\n");
+        return_VALUE(0);
+}
+
+static int hotkey_poll_config_seq_show(struct seq_file *seq, void *offset)
+{
+        struct acpi_hotkey_list *hotkey_list = &global_hotkey_list;
+        struct list_head *entries;
+        char bus_name[ACPI_PATHNAME_MAX] = { 0 };
+        char action_name[ACPI_PATHNAME_MAX] = { 0 };
+        struct acpi_buffer bus = { ACPI_PATHNAME_MAX, bus_name };
+        struct acpi_buffer act = { ACPI_PATHNAME_MAX, action_name };
+
+        ACPI_FUNCTION_TRACE(("hotkey_config_seq_show"));
+
+        list_for_each(entries, hotkey_list->entries) {
+                union acpi_hotkey *key =
+                    container_of(entries, union acpi_hotkey, entries);
+                if (key->link.hotkey_type == ACPI_HOTKEY_POLLING) {
                         acpi_get_name(key->poll_hotkey.poll_handle,
                                       ACPI_NAME_TYPE_MAX, &bus);
                         acpi_get_name(key->poll_hotkey.action_handle,
                                       ACPI_NAME_TYPE_MAX, &act);
-                        seq_printf(seq, "%s:%s:%s:%s:%d", bus_name,
+                        seq_printf(seq, "%s:%s:%s:%s:%d\n", bus_name,
                                    key->poll_hotkey.poll_method,
                                    action_name,
                                    key->poll_hotkey.action_method,
@@ -572,49 +663,83 @@ static int hotkey_config_seq_show(struct seq_file *seq, void *offset)
                 }
         }
         seq_puts(seq, "\n");
-      end:
         return_VALUE(0);
 }
 
 static int
 get_parms(char *config_record,
           int *cmd,
-          char *bus_handle,
-          char *bus_method,
-          char *action_handle,
-          char *method, int *internal_event_num, int *external_event_num)
+          char **bus_handle,
+          char **bus_method,
+          char **action_handle,
+          char **method, int *internal_event_num, int *external_event_num)
 {
-        char *tmp, *tmp1;
+        char *tmp, *tmp1, count;
         ACPI_FUNCTION_TRACE(("get_parms"));
 
         sscanf(config_record, "%d", cmd);
 
+        if(*cmd == 1){
+                if(sscanf(config_record, "%d:%d", cmd, internal_event_num)!=2)
+                        goto do_fail;
+                else
+                        return (6);
+        }
         tmp = strchr(config_record, ':');
+        if (!tmp)
+                goto do_fail;
         tmp++;
         tmp1 = strchr(tmp, ':');
-        strncpy(bus_handle, tmp, tmp1 - tmp);
-        bus_handle[tmp1 - tmp] = 0;
+        if (!tmp1)
+                goto do_fail;
+
+        count = tmp1 - tmp;
+        *bus_handle = (char *) kmalloc(count+1, GFP_KERNEL);
+        if(!*bus_handle)
+                goto do_fail;
+        strncpy(*bus_handle, tmp, count);
+        *(*bus_handle + count) = 0;
 
         tmp = tmp1;
         tmp++;
         tmp1 = strchr(tmp, ':');
-        strncpy(bus_method, tmp, tmp1 - tmp);
-        bus_method[tmp1 - tmp] = 0;
+        if (!tmp1)
+                goto do_fail;
+        count = tmp1 - tmp;
+        *bus_method = (char *) kmalloc(count+1, GFP_KERNEL);
+        if(!*bus_method)
+                goto do_fail;
+        strncpy(*bus_method, tmp, count);
+        *(*bus_method + count) = 0;
 
         tmp = tmp1;
         tmp++;
         tmp1 = strchr(tmp, ':');
-        strncpy(action_handle, tmp, tmp1 - tmp);
-        action_handle[tmp1 - tmp] = 0;
+        if (!tmp1)
+                goto do_fail;
+        count = tmp1 - tmp;
+        *action_handle = (char *) kmalloc(count+1, GFP_KERNEL);
+        strncpy(*action_handle, tmp, count);
+        *(*action_handle + count) = 0;
 
         tmp = tmp1;
         tmp++;
         tmp1 = strchr(tmp, ':');
-        strncpy(method, tmp, tmp1 - tmp);
-        method[tmp1 - tmp] = 0;
+        if (!tmp1)
+                goto do_fail;
+        count = tmp1 - tmp;
+        *method = (char *) kmalloc(count+1, GFP_KERNEL);
+        if(!*method)
+                goto do_fail;
+        strncpy(*method, tmp, count);
+        *(*method + count) = 0;
+
+        if(sscanf(tmp1 + 1, "%d:%d", internal_event_num, external_event_num)<=0)
+                goto do_fail;
 
-        sscanf(tmp1 + 1, "%d:%d", internal_event_num, external_event_num);
         return_VALUE(6);
+do_fail:
+        return_VALUE(-1);
 }
 
 /*  count is length for one input record */
@@ -622,135 +747,117 @@ static ssize_t hotkey_write_config(struct file *file,
                                    const char __user * buffer,
                                    size_t count, loff_t * data)
 {
-        struct acpi_hotkey_list *hotkey_list = &global_hotkey_list;
-        char config_record[MAX_CONFIG_RECORD_LEN];
-        char bus_handle[MAX_NAME_PATH_LEN];
-        char bus_method[MAX_NAME_PATH_LEN];
-        char action_handle[MAX_NAME_PATH_LEN];
-        char method[20];
+        char *config_record = NULL;
+        char *bus_handle = NULL;
+        char *bus_method = NULL;
+        char *action_handle = NULL;
+        char *method = NULL;
         int cmd, internal_event_num, external_event_num;
         int ret = 0;
         union acpi_hotkey *key = NULL;
 
         ACPI_FUNCTION_TRACE(("hotkey_write_config"));
 
-        if (!hotkey_list || count > MAX_CONFIG_RECORD_LEN) {
-                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid arguments\n"));
-                return_VALUE(-EINVAL);
-        }
+        config_record = (char *) kmalloc(count+1, GFP_KERNEL);
+        if(!config_record)
+                return_VALUE(-ENOMEM);
 
         if (copy_from_user(config_record, buffer, count)) {
+                kfree(config_record);
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid data \n"));
                 return_VALUE(-EINVAL);
         }
-        config_record[count] = '\0';
+        config_record[count] = 0;
 
         ret = get_parms(config_record,
                         &cmd,
-                        bus_handle,
-                        bus_method,
-                        action_handle,
-                        method, &internal_event_num, &external_event_num);
+                        &bus_handle,
+                        &bus_method,
+                        &action_handle,
+                        &method, &internal_event_num, &external_event_num);
+
+        kfree(config_record);
+        if(IS_OTHERS(internal_event_num))
+                goto do_fail;
         if (ret != 6) {
+do_fail:        
+                kfree(bus_handle);
+                kfree(bus_method);
+                kfree(action_handle);
+                kfree(method);
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
                                   "Invalid data format ret=%d\n", ret));
                 return_VALUE(-EINVAL);
         }
 
         key = kmalloc(sizeof(union acpi_hotkey), GFP_KERNEL);
-        ret = init_hotkey_device(key, bus_handle, action_handle, method,
+        if(!key)
+                goto do_fail;
+        memset(key, 0, sizeof(union acpi_hotkey));
+        if(cmd == 1) {
+                union acpi_hotkey *tmp = NULL;
+                tmp = get_hotkey_by_event(&global_hotkey_list,
+                                internal_event_num);
+                if(!tmp)
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid key"));
+                else
+                        memcpy(key, tmp, sizeof(union acpi_hotkey));
+                goto cont_cmd;
+        }
+        if (IS_EVENT(internal_event_num)) {
+                kfree(bus_method);
+                ret = init_hotkey_device(key, bus_handle, action_handle, method,
                                  internal_event_num, external_event_num);
-
-        if (ret || check_hotkey_valid(key, hotkey_list)) {
+        } else
+                ret = init_poll_hotkey_device(key, bus_handle, bus_method,
+                                      action_handle, method,
+                                      internal_event_num);
+        if (ret) {
+                kfree(bus_handle);
+                kfree(action_handle);
+                if(IS_EVENT(internal_event_num))
+                        free_hotkey_buffer(key);
+                else
+                        free_poll_hotkey_buffer(key);
                 kfree(key);
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid hotkey \n"));
                 return_VALUE(-EINVAL);
         }
-        switch (cmd) {
-        case 0:
-                hotkey_add(key);
-                break;
-        case 1:
-                hotkey_remove(key);
-                free_hotkey_device(key);
-                break;
-        case 2:
-                hotkey_update(key);
-                break;
-        default:
-                break;
-        }
-        return_VALUE(count);
-}
-
-/*  count is length for one input record */
-static ssize_t hotkey_write_poll_config(struct file *file,
-                                        const char __user * buffer,
-                                        size_t count, loff_t * data)
-{
-        struct seq_file *m = (struct seq_file *)file->private_data;
-        struct acpi_hotkey_list *hotkey_list =
-            (struct acpi_hotkey_list *)m->private;
-
-        char config_record[MAX_CONFIG_RECORD_LEN];
-        char polling_handle[MAX_NAME_PATH_LEN];
-        char action_handle[MAX_NAME_PATH_LEN];
-        char poll_method[20], action_method[20];
-        int ret, internal_event_num, cmd, external_event_num;
-        union acpi_hotkey *key = NULL;
-
-        ACPI_FUNCTION_TRACE("hotkey_write_poll_config");
-
-        if (!hotkey_list || count > MAX_CONFIG_RECORD_LEN) {
-                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid arguments\n"));
-                return_VALUE(-EINVAL);
-        }
-
-        if (copy_from_user(config_record, buffer, count)) {
-                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid data \n"));
-                return_VALUE(-EINVAL);
-        }
-        config_record[count] = '\0';
 
-        ret = get_parms(config_record,
-                        &cmd,
-                        polling_handle,
-                        poll_method,
-                        action_handle,
-                        action_method,
-                        &internal_event_num, &external_event_num);
-
-        if (ret != 6) {
-                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid data format\n"));
-                return_VALUE(-EINVAL);
-        }
+cont_cmd:
+        kfree(bus_handle);
+        kfree(action_handle);
 
-        key = kmalloc(sizeof(union acpi_hotkey), GFP_KERNEL);
-        ret = init_poll_hotkey_device(key, polling_handle, poll_method,
-                                      action_handle, action_method,
-                                      internal_event_num);
-        if (ret || check_hotkey_valid(key, hotkey_list)) {
-                kfree(key);
-                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid hotkey \n"));
-                return_VALUE(-EINVAL);
-        }
         switch (cmd) {
         case 0:
-                hotkey_add(key);
+                if(get_hotkey_by_event(&global_hotkey_list,key->link.hotkey_standard_num))
+                        goto fail_out;
+                else
+                        hotkey_add(key);
                 break;
         case 1:
                 hotkey_remove(key);
                 break;
         case 2:
-                hotkey_update(key);
+                if(hotkey_update(key))
+                        goto fail_out;
                 break;
         default:
+                goto fail_out;
                 break;
         }
         return_VALUE(count);
+fail_out:
+        if(IS_EVENT(internal_event_num))
+                free_hotkey_buffer(key);
+        else
+                free_poll_hotkey_buffer(key);
+        kfree(key);
+        ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "invalid key\n"));
+        return_VALUE(-EINVAL);
 }
 
-/*  
+/*
  * This function evaluates an ACPI method, given an int as parameter, the
  * method is searched within the scope of the handle, can be NULL. The output
  * of the method is written is output, which can also be NULL
@@ -775,7 +882,7 @@ static int write_acpi_int(acpi_handle handle, const char *method, int val,
         return_VALUE(status == AE_OK);
 }
 
-static int read_acpi_int(acpi_handle handle, const char *method, int *val)
+static int read_acpi_int(acpi_handle handle, const char *method, union acpi_object *val)
 {
         struct acpi_buffer output;
         union acpi_object out_obj;
@@ -786,62 +893,32 @@ static int read_acpi_int(acpi_handle handle, const char *method, int *val)
         output.pointer = &out_obj;
 
         status = acpi_evaluate_object(handle, (char *)method, NULL, &output);
-        *val = out_obj.integer.value;
+        if(val){
+                val->integer.value = out_obj.integer.value;
+                val->type = out_obj.type;
+        } else
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "null val pointer"));
         return_VALUE((status == AE_OK)
                      && (out_obj.type == ACPI_TYPE_INTEGER));
 }
 
-static acpi_handle
-get_handle_from_hotkeylist(struct acpi_hotkey_list *hotkey_list, int event_num)
+static union acpi_hotkey *get_hotkey_by_event(struct
+                              acpi_hotkey_list
+                              *hotkey_list, int event)
 {
-        struct list_head *entries, *next;
-
-        list_for_each_safe(entries, next, hotkey_list->entries) {
-                union acpi_hotkey *key =
-                    container_of(entries, union acpi_hotkey, entries);
-                if (key->link.hotkey_type == ACPI_HOTKEY_EVENT
-                    && key->link.hotkey_standard_num == event_num) {
-                        return (key->event_hotkey.action_handle);
-                }
-        }
-        return (NULL);
-}
-
-static
-char *get_method_from_hotkeylist(struct acpi_hotkey_list *hotkey_list,
-                                 int event_num)
-{
-        struct list_head *entries, *next;
-
-        list_for_each_safe(entries, next, hotkey_list->entries) {
-                union acpi_hotkey *key =
-                    container_of(entries, union acpi_hotkey, entries);
-
-                if (key->link.hotkey_type == ACPI_HOTKEY_EVENT &&
-                    key->link.hotkey_standard_num == event_num)
-                        return (key->event_hotkey.action_method);
-        }
-        return (NULL);
-}
-
-static struct acpi_polling_hotkey *get_hotkey_by_event(struct
-                                                       acpi_hotkey_list
-                                                       *hotkey_list, int event)
-{
-        struct list_head *entries, *next;
+        struct list_head *entries;
 
-        list_for_each_safe(entries, next, hotkey_list->entries) {
+        list_for_each(entries, hotkey_list->entries) {
                 union acpi_hotkey *key =
                     container_of(entries, union acpi_hotkey, entries);
-                if (key->link.hotkey_type == ACPI_HOTKEY_POLLING
-                    && key->link.hotkey_standard_num == event) {
-                        return (&key->poll_hotkey);
+                if (key->link.hotkey_standard_num == event) {
+                        return(key);
                 }
         }
-        return (NULL);
+        return(NULL);
 }
 
-/*  
+/*
  * user call AML method interface:
  * Call convention:
  * echo "event_num: arg type : value"
@@ -854,48 +931,56 @@ static ssize_t hotkey_execute_aml_method(struct file *file,
                                          size_t count, loff_t * data)
 {
         struct acpi_hotkey_list *hotkey_list = &global_hotkey_list;
-        char arg[MAX_CALL_PARM];
-        int event, type, value;
-
-        char *method;
-        acpi_handle handle;
+        char *arg;
+        int event,method_type,type, value;
+        union acpi_hotkey *key;
 
         ACPI_FUNCTION_TRACE("hotkey_execte_aml_method");
 
-        if (!hotkey_list || count > MAX_CALL_PARM) {
-                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid argument 1"));
-                return_VALUE(-EINVAL);
-        }
+        arg = (char *) kmalloc(count+1, GFP_KERNEL);
+        if(!arg)
+                return_VALUE(-ENOMEM);
+        arg[count]=0;
 
         if (copy_from_user(arg, buffer, count)) {
+                kfree(arg);
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid argument 2"));
                 return_VALUE(-EINVAL);
         }
 
-        arg[count] = '\0';
-
-        if (sscanf(arg, "%d:%d:%d", &event, &type, &value) != 3) {
+        if (sscanf(arg, "%d:%d:%d:%d", &event, &method_type, &type, &value) != 4) {
+                kfree(arg);
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid argument 3"));
                 return_VALUE(-EINVAL);
         }
-
+        kfree(arg);
         if (type == ACPI_TYPE_INTEGER) {
-                handle = get_handle_from_hotkeylist(hotkey_list, event);
-                method = (char *)get_method_from_hotkeylist(hotkey_list, event);
+                key = get_hotkey_by_event(hotkey_list, event);
+                if(!key)
+                        goto do_fail;
                 if (IS_EVENT(event))
-                        write_acpi_int(handle, method, value, NULL);
+                        write_acpi_int(key->event_hotkey.action_handle,
+                                        key->event_hotkey.action_method, value, NULL);
                 else if (IS_POLL(event)) {
-                        struct acpi_polling_hotkey *key;
-                        key = (struct acpi_polling_hotkey *)
-                            get_hotkey_by_event(hotkey_list, event);
-                        read_acpi_int(handle, method, key->poll_result);
+                        if ( method_type == POLL_METHOD )
+                                read_acpi_int(key->poll_hotkey.poll_handle,
+                                        key->poll_hotkey.poll_method,
+                                        key->poll_hotkey.poll_result);
+                        else if ( method_type == ACTION_METHOD )
+                                write_acpi_int(key->poll_hotkey.action_handle,
+                                        key->poll_hotkey.action_method, value, NULL);
+                        else
+                                goto do_fail;
+
                 }
         } else {
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Not supported"));
                 return_VALUE(-EINVAL);
         }
-
         return_VALUE(count);
+do_fail:
+        return_VALUE(-EINVAL);
+
 }
 
 static int __init hotkey_init(void)
@@ -928,7 +1013,7 @@ static int __init hotkey_init(void)
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
                                   "Hotkey: Unable to create %s entry\n",
                                   HOTKEY_EV_CONFIG));
-                return (-ENODEV);
+                goto do_fail1;
         } else {
                 hotkey_config->proc_fops = &hotkey_config_fops;
                 hotkey_config->data = &global_hotkey_list;
@@ -943,7 +1028,8 @@ static int __init hotkey_init(void)
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
                                   "Hotkey: Unable to create %s entry\n",
                                   HOTKEY_EV_CONFIG));
-                return (-ENODEV);
+
+                goto do_fail2;
         } else {
                 hotkey_poll_config->proc_fops = &hotkey_poll_config_fops;
                 hotkey_poll_config->data = &global_hotkey_list;
@@ -957,7 +1043,7 @@ static int __init hotkey_init(void)
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
                                   "Hotkey: Unable to create %s entry\n",
                                   HOTKEY_ACTION));
-                return (-ENODEV);
+                goto do_fail3;
         } else {
                 hotkey_action->proc_fops = &hotkey_action_fops;
                 hotkey_action->owner = THIS_MODULE;
@@ -970,7 +1056,7 @@ static int __init hotkey_init(void)
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
                                   "Hotkey: Unable to create %s entry\n",
                                   HOTKEY_INFO));
-                return (-ENODEV);
+                goto do_fail4;
         } else {
                 hotkey_info->proc_fops = &hotkey_info_fops;
                 hotkey_info->owner = THIS_MODULE;
@@ -979,23 +1065,33 @@ static int __init hotkey_init(void)
         }
 
         result = acpi_bus_register_driver(&hotkey_driver);
-        if (result < 0) {
-                remove_proc_entry(HOTKEY_PROC, acpi_root_dir);
-                return (-ENODEV);
-        }
+        if (result < 0)
+                goto do_fail5;
         global_hotkey_list.count = 0;
         global_hotkey_list.entries = &hotkey_entries;
 
         INIT_LIST_HEAD(&hotkey_entries);
 
         return (0);
+
+do_fail5:
+        remove_proc_entry(HOTKEY_INFO, hotkey_proc_dir);
+do_fail4:
+        remove_proc_entry(HOTKEY_ACTION, hotkey_proc_dir);
+do_fail3:
+        remove_proc_entry(HOTKEY_PL_CONFIG, hotkey_proc_dir);
+do_fail2:
+        remove_proc_entry(HOTKEY_EV_CONFIG, hotkey_proc_dir);
+do_fail1:
+        remove_proc_entry(HOTKEY_PROC, acpi_root_dir);
+        return (-ENODEV);
 }
 
 static void __exit hotkey_exit(void)
 {
         struct list_head *entries, *next;
 
-        ACPI_FUNCTION_TRACE("hotkey_remove");
+        ACPI_FUNCTION_TRACE("hotkey_exit");
 
         list_for_each_safe(entries, next, global_hotkey_list.entries) {
                 union acpi_hotkey *key =
diff --git a/drivers/acpi/motherboard.c b/drivers/acpi/motherboard.c
index 2934475d67d6..61ea70742d49 100644
--- a/drivers/acpi/motherboard.c
+++ b/drivers/acpi/motherboard.c
@@ -43,7 +43,7 @@ ACPI_MODULE_NAME		("acpi_motherboard")
  */
 #define IS_RESERVED_ADDR(base, len) \
         (((len) > 0) && ((base) > 0) && ((base) + (len) < IO_SPACE_LIMIT) \
-        && ((base) + (len) > 0x1000))
+        && ((base) + (len) > PCIBIOS_MIN_IO))
 
 /*
  * Clearing the flag (IORESOURCE_BUSY) allows drivers to use
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index bdd9f37f8101..0d11d6e6abd6 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -71,7 +71,7 @@ EXPORT_SYMBOL(acpi_in_debugger);
 extern char line_buf[80];
 #endif /*ENABLE_DEBUGGER*/
 
-int acpi_specific_hotkey_enabled;
+int acpi_specific_hotkey_enabled = TRUE;
 EXPORT_SYMBOL(acpi_specific_hotkey_enabled);
 
 static unsigned int acpi_irq_irq;
@@ -145,10 +145,14 @@ acpi_os_vprintf(const char *fmt, va_list args)
 #endif
 }
 
+extern int acpi_in_resume;
 void *
 acpi_os_allocate(acpi_size size)
 {
-        return kmalloc(size, GFP_KERNEL);
+        if (acpi_in_resume)
+                return kmalloc(size, GFP_ATOMIC);
+        else
+                return kmalloc(size, GFP_KERNEL);
 }
 
 void
@@ -1158,11 +1162,11 @@ __setup("acpi_wake_gpes_always_on", acpi_wake_gpes_always_on_setup);
 int __init
 acpi_hotkey_setup(char *str)
 {
-        acpi_specific_hotkey_enabled = TRUE;
+        acpi_specific_hotkey_enabled = FALSE;
         return 1;
 }
 
-__setup("acpi_specific_hotkey", acpi_hotkey_setup);
+__setup("acpi_generic_hotkey", acpi_hotkey_setup);
 
 /*
  * max_cstate is defined in the base kernel so modules can
diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
index d9a9b86ecb28..834c2ceff1aa 100644
--- a/drivers/acpi/pci_link.c
+++ b/drivers/acpi/pci_link.c
@@ -692,7 +692,18 @@ acpi_pci_link_free_irq(acpi_handle handle)
                 return_VALUE(-1);
         }
 
+#ifdef  FUTURE_USE
+        /*
+         * The Link reference count allows us to _DISable an unused link
+         * and suspend time, and set it again  on resume.
+         * However, 2.6.12 still has irq_router.resume
+         * which blindly restores the link state.
+         * So we disable the reference count method
+         * to prevent duplicate acpi_pci_link_set()
+         * which would harm some systems
+         */
         link->refcnt --;
+#endif
         ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                 "Link %s is dereferenced\n", acpi_device_bid(link->device)));
 
@@ -787,6 +798,11 @@ acpi_pci_link_resume(
                 return_VALUE(0);
 }
 
+/*
+ * FIXME: this is a workaround to avoid nasty warning.  It will be removed
+ * after every device calls pci_disable_device in .resume.
+ */
+int acpi_in_resume;
 static int
 irqrouter_resume(
         struct sys_device *dev)
@@ -796,6 +812,7 @@ irqrouter_resume(
 
         ACPI_FUNCTION_TRACE("irqrouter_resume");
 
+        acpi_in_resume = 1;
         list_for_each(node, &acpi_link.entries) {
                 link = list_entry(node, struct acpi_pci_link, node);
                 if (!link) {
@@ -805,6 +822,7 @@ irqrouter_resume(
                 }
                 acpi_pci_link_resume(link);
         }
+        acpi_in_resume = 0;
         return_VALUE(0);
 }
 
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index af271d994f15..2c04740c6543 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -86,12 +86,11 @@ static int set_max_cstate(struct dmi_system_id *id)
         if (max_cstate > ACPI_PROCESSOR_MAX_POWER)
                 return 0;
 
-        printk(KERN_NOTICE PREFIX "%s detected - %s disabled."
+        printk(KERN_NOTICE PREFIX "%s detected - limiting to C%ld max_cstate."
                 " Override with \"processor.max_cstate=%d\"\n", id->ident,
-                ((int)id->driver_data == 1)? "C2,C3":"C3",
-               ACPI_PROCESSOR_MAX_POWER + 1);
+                (long)id->driver_data, ACPI_PROCESSOR_MAX_POWER + 1);
 
-        max_cstate = (int)id->driver_data;
+        max_cstate = (long)id->driver_data;
 
         return 0;
 }
diff --git a/drivers/acpi/sleep/poweroff.c b/drivers/acpi/sleep/poweroff.c
index 186b182c5825..f93d2ee54800 100644
--- a/drivers/acpi/sleep/poweroff.c
+++ b/drivers/acpi/sleep/poweroff.c
@@ -55,7 +55,11 @@ void acpi_power_off(void)
 
 static int acpi_shutdown(struct sys_device *x)
 {
-        return acpi_sleep_prepare(ACPI_STATE_S5);
+        if (system_state == SYSTEM_POWER_OFF) {
+                /* Prepare if we are going to power off the system */
+                return acpi_sleep_prepare(ACPI_STATE_S5);
+        }
+        return 0;
 }
 
 static struct sysdev_class acpi_sysclass = {
diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
index 73c6b85299c1..d74a7c5e75dd 100644
--- a/drivers/atm/ambassador.c
+++ b/drivers/atm/ambassador.c
@@ -513,7 +513,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
           
           // VC layer stats
           atomic_inc(&atm_vcc->stats->rx);
-          do_gettimeofday(&skb->stamp);
+          __net_timestamp(skb);
           // end of our responsability
           atm_vcc->push (atm_vcc, skb);
           return;
diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c
index f2f01cb82cb4..57f1810fdccd 100644
--- a/drivers/atm/atmtcp.c
+++ b/drivers/atm/atmtcp.c
@@ -325,7 +325,7 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
                 result = -ENOBUFS;
                 goto done;
         }
-        do_gettimeofday(&new_skb->stamp);
+        __net_timestamp(new_skb);
         memcpy(skb_put(new_skb,skb->len),skb->data,skb->len);
         out_vcc->push(out_vcc,new_skb);
         atomic_inc(&vcc->stats->tx);
diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
index 10da36934769..c13c4d736ef5 100644
--- a/drivers/atm/eni.c
+++ b/drivers/atm/eni.c
@@ -537,7 +537,7 @@ static int rx_aal0(struct atm_vcc *vcc)
                 return 0;
         }
         skb_put(skb,length);
-        skb->stamp = eni_vcc->timestamp;
+        skb_set_timestamp(skb, &eni_vcc->timestamp);
         DPRINTK("got len %ld\n",length);
         if (do_rx_dma(vcc,skb,1,length >> 2,length >> 2)) return 1;
         eni_vcc->rxing++;
diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
index b078fa548ebf..58219744f5db 100644
--- a/drivers/atm/firestream.c
+++ b/drivers/atm/firestream.c
@@ -815,7 +815,7 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
                                 skb_put (skb, qe->p1 & 0xffff); 
                                 ATM_SKB(skb)->vcc = atm_vcc;
                                 atomic_inc(&atm_vcc->stats->rx);
-                                do_gettimeofday(&skb->stamp);
+                                __net_timestamp(skb);
                                 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
                                 atm_vcc->push (atm_vcc, skb);
                                 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-d: %p\n", pe);
diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
index 5f702199543a..2bf723a7b6e6 100644
--- a/drivers/atm/fore200e.c
+++ b/drivers/atm/fore200e.c
@@ -1176,7 +1176,7 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
         return -ENOMEM;
     } 
 
-    do_gettimeofday(&skb->stamp);
+    __net_timestamp(skb);
     
 #ifdef FORE200E_52BYTE_AAL0_SDU
     if (cell_header) {
diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index 28250c9b32d6..fde9334059af 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -1886,7 +1886,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
                 if (rx_skb_reserve > 0)
                         skb_reserve(skb, rx_skb_reserve);
 
-                do_gettimeofday(&skb->stamp);
+                __net_timestamp(skb);
 
                 for (iov = he_vcc->iov_head;
                                 iov < he_vcc->iov_tail; ++iov) {
diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
index 924a2c8988bd..0cded0468003 100644
--- a/drivers/atm/horizon.c
+++ b/drivers/atm/horizon.c
@@ -1034,7 +1034,7 @@ static void rx_schedule (hrz_dev * dev, int irq) {
           struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
           // VC layer stats
           atomic_inc(&vcc->stats->rx);
-          do_gettimeofday(&skb->stamp);
+          __net_timestamp(skb);
           // end of our responsability
           vcc->push (vcc, skb);
         }
diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
index 30b7e990ed0b..b4a76cade646 100644
--- a/drivers/atm/idt77252.c
+++ b/drivers/atm/idt77252.c
@@ -1101,7 +1101,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
                                cell, ATM_CELL_PAYLOAD);
 
                         ATM_SKB(sb)->vcc = vcc;
-                        do_gettimeofday(&sb->stamp);
+                        __net_timestamp(sb);
                         vcc->push(vcc, sb);
                         atomic_inc(&vcc->stats->rx);
 
@@ -1179,7 +1179,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
 
                         skb_trim(skb, len);
                         ATM_SKB(skb)->vcc = vcc;
-                        do_gettimeofday(&skb->stamp);
+                        __net_timestamp(skb);
 
                         vcc->push(vcc, skb);
                         atomic_inc(&vcc->stats->rx);
@@ -1201,7 +1201,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
 
                 skb_trim(skb, len);
                 ATM_SKB(skb)->vcc = vcc;
-                do_gettimeofday(&skb->stamp);
+                __net_timestamp(skb);
 
                 vcc->push(vcc, skb);
                 atomic_inc(&vcc->stats->rx);
@@ -1340,7 +1340,7 @@ idt77252_rx_raw(struct idt77252_dev *card)
                        ATM_CELL_PAYLOAD);
 
                 ATM_SKB(sb)->vcc = vcc;
-                do_gettimeofday(&sb->stamp);
+                __net_timestamp(sb);
                 vcc->push(vcc, sb);
                 atomic_inc(&vcc->stats->rx);
 
diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
index ffe3afa723b8..51ec14787293 100644
--- a/drivers/atm/lanai.c
+++ b/drivers/atm/lanai.c
@@ -1427,7 +1427,7 @@ static void vcc_rx_aal5(struct lanai_vcc *lvcc, int endptr)
         skb_put(skb, size);
         vcc_rx_memcpy(skb->data, lvcc, size);
         ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
-        do_gettimeofday(&skb->stamp);
+        __net_timestamp(skb);
         lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
         atomic_inc(&lvcc->rx.atmvcc->stats->rx);
     out:
diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
index b2a7b754fd14..c57e20dcb0f8 100644
--- a/drivers/atm/nicstar.c
+++ b/drivers/atm/nicstar.c
@@ -214,8 +214,7 @@ static int __devinit ns_init_card(int i, struct pci_dev *pcidev);
 static void __devinit ns_init_card_error(ns_dev *card, int error);
 static scq_info *get_scq(int size, u32 scd);
 static void free_scq(scq_info *scq, struct atm_vcc *vcc);
-static void push_rxbufs(ns_dev *card, u32 type, u32 handle1, u32 addr1,
-                       u32 handle2, u32 addr2);
+static void push_rxbufs(ns_dev *, struct sk_buff *);
 static irqreturn_t ns_irq_handler(int irq, void *dev_id, struct pt_regs *regs);
 static int ns_open(struct atm_vcc *vcc);
 static void ns_close(struct atm_vcc *vcc);
@@ -766,6 +765,7 @@ static int __devinit ns_init_card(int i, struct pci_dev *pcidev)
          ns_init_card_error(card, error);
          return error;
       }
+      NS_SKB_CB(hb)->buf_type = BUF_NONE;
       skb_queue_tail(&card->hbpool.queue, hb);
       card->hbpool.count++;
    }
@@ -786,9 +786,10 @@ static int __devinit ns_init_card(int i, struct pci_dev *pcidev)
          ns_init_card_error(card, error);
          return error;
       }
+      NS_SKB_CB(lb)->buf_type = BUF_LG;
       skb_queue_tail(&card->lbpool.queue, lb);
       skb_reserve(lb, NS_SMBUFSIZE);
-      push_rxbufs(card, BUF_LG, (u32) lb, (u32) virt_to_bus(lb->data), 0, 0);
+      push_rxbufs(card, lb);
       /* Due to the implementation of push_rxbufs() this is 1, not 0 */
       if (j == 1)
       {
@@ -822,9 +823,10 @@ static int __devinit ns_init_card(int i, struct pci_dev *pcidev)
          ns_init_card_error(card, error);
          return error;
       }
+      NS_SKB_CB(sb)->buf_type = BUF_SM;
       skb_queue_tail(&card->sbpool.queue, sb);
       skb_reserve(sb, NS_AAL0_HEADER);
-      push_rxbufs(card, BUF_SM, (u32) sb, (u32) virt_to_bus(sb->data), 0, 0);
+      push_rxbufs(card, sb);
    }
    /* Test for strange behaviour which leads to crashes */
    if ((bcount = ns_stat_sfbqc_get(readl(card->membase + STAT))) < card->sbnr.min)
@@ -852,6 +854,7 @@ static int __devinit ns_init_card(int i, struct pci_dev *pcidev)
          ns_init_card_error(card, error);
          return error;
       }
+      NS_SKB_CB(iovb)->buf_type = BUF_NONE;
       skb_queue_tail(&card->iovpool.queue, iovb);
       card->iovpool.count++;
    }
@@ -1078,12 +1081,18 @@ static void free_scq(scq_info *scq, struct atm_vcc *vcc)
 
 /* The handles passed must be pointers to the sk_buff containing the small
    or large buffer(s) cast to u32. */
-static void push_rxbufs(ns_dev *card, u32 type, u32 handle1, u32 addr1,
-                       u32 handle2, u32 addr2)
+static void push_rxbufs(ns_dev *card, struct sk_buff *skb)
 {
+   struct ns_skb_cb *cb = NS_SKB_CB(skb);
+   u32 handle1, addr1;
+   u32 handle2, addr2;
    u32 stat;
    unsigned long flags;
    
+   /* *BARF* */
+   handle2 = addr2 = 0;
+   handle1 = (u32)skb;
+   addr1 = (u32)virt_to_bus(skb->data);
 
 #ifdef GENERAL_DEBUG
    if (!addr1)
@@ -1093,7 +1102,7 @@ static void push_rxbufs(ns_dev *card, u32 type, u32 handle1, u32 addr1,
    stat = readl(card->membase + STAT);
    card->sbfqc = ns_stat_sfbqc_get(stat);
    card->lbfqc = ns_stat_lfbqc_get(stat);
-   if (type == BUF_SM)
+   if (cb->buf_type == BUF_SM)
    {
       if (!addr2)
       {
@@ -1111,7 +1120,7 @@ static void push_rxbufs(ns_dev *card, u32 type, u32 handle1, u32 addr1,
          }
       }      
    }
-   else /* type == BUF_LG */
+   else /* buf_type == BUF_LG */
    {
       if (!addr2)
       {
@@ -1132,26 +1141,26 @@ static void push_rxbufs(ns_dev *card, u32 type, u32 handle1, u32 addr1,
 
    if (addr2)
    {
-      if (type == BUF_SM)
+      if (cb->buf_type == BUF_SM)
       {
          if (card->sbfqc >= card->sbnr.max)
          {
-            skb_unlink((struct sk_buff *) handle1);
+            skb_unlink((struct sk_buff *) handle1, &card->sbpool.queue);
             dev_kfree_skb_any((struct sk_buff *) handle1);
-            skb_unlink((struct sk_buff *) handle2);
+            skb_unlink((struct sk_buff *) handle2, &card->sbpool.queue);
             dev_kfree_skb_any((struct sk_buff *) handle2);
             return;
          }
          else
             card->sbfqc += 2;
       }
-      else /* (type == BUF_LG) */
+      else /* (buf_type == BUF_LG) */
       {
          if (card->lbfqc >= card->lbnr.max)
          {
-            skb_unlink((struct sk_buff *) handle1);
+            skb_unlink((struct sk_buff *) handle1, &card->lbpool.queue);
             dev_kfree_skb_any((struct sk_buff *) handle1);
-            skb_unlink((struct sk_buff *) handle2);
+            skb_unlink((struct sk_buff *) handle2, &card->lbpool.queue);
             dev_kfree_skb_any((struct sk_buff *) handle2);
             return;
          }
@@ -1166,12 +1175,12 @@ static void push_rxbufs(ns_dev *card, u32 type, u32 handle1, u32 addr1,
       writel(handle2, card->membase + DR2);
       writel(addr1, card->membase + DR1);
       writel(handle1, card->membase + DR0);
-      writel(NS_CMD_WRITE_FREEBUFQ | (u32) type, card->membase + CMD);
+      writel(NS_CMD_WRITE_FREEBUFQ | cb->buf_type, card->membase + CMD);
  
       spin_unlock_irqrestore(&card->res_lock, flags);
 
       XPRINTK("nicstar%d: Pushing %s buffers at 0x%x and 0x%x.\n", card->index,
-              (type == BUF_SM ? "small" : "large"), addr1, addr2);
+              (cb->buf_type == BUF_SM ? "small" : "large"), addr1, addr2);
    }
 
    if (!card->efbie && card->sbfqc >= card->sbnr.min &&
@@ -1322,9 +1331,10 @@ static irqreturn_t ns_irq_handler(int irq, void *dev_id, struct pt_regs *regs)
             card->efbie = 0;
             break;
          }
+         NS_SKB_CB(sb)->buf_type = BUF_SM;
          skb_queue_tail(&card->sbpool.queue, sb);
          skb_reserve(sb, NS_AAL0_HEADER);
-         push_rxbufs(card, BUF_SM, (u32) sb, (u32) virt_to_bus(sb->data), 0, 0);
+         push_rxbufs(card, sb);
       }
       card->sbfqc = i;
       process_rsq(card);
@@ -1348,9 +1358,10 @@ static irqreturn_t ns_irq_handler(int irq, void *dev_id, struct pt_regs *regs)
             card->efbie = 0;
             break;
          }
+         NS_SKB_CB(lb)->buf_type = BUF_LG;
          skb_queue_tail(&card->lbpool.queue, lb);
          skb_reserve(lb, NS_SMBUFSIZE);
-         push_rxbufs(card, BUF_LG, (u32) lb, (u32) virt_to_bus(lb->data), 0, 0);
+         push_rxbufs(card, lb);
       }
       card->lbfqc = i;
       process_rsq(card);
@@ -2202,7 +2213,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
          memcpy(sb->tail, cell, ATM_CELL_PAYLOAD);
          skb_put(sb, ATM_CELL_PAYLOAD);
          ATM_SKB(sb)->vcc = vcc;
-         do_gettimeofday(&sb->stamp);
+         __net_timestamp(sb);
          vcc->push(vcc, sb);
          atomic_inc(&vcc->stats->rx);
          cell += ATM_CELL_PAYLOAD;
@@ -2227,6 +2238,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
             recycle_rx_buf(card, skb);
             return;
          }
+         NS_SKB_CB(iovb)->buf_type = BUF_NONE;
       }
       else
          if (--card->iovpool.count < card->iovnr.min)
@@ -2234,6 +2246,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
             struct sk_buff *new_iovb;
             if ((new_iovb = alloc_skb(NS_IOVBUFSIZE, GFP_ATOMIC)) != NULL)
             {
+               NS_SKB_CB(iovb)->buf_type = BUF_NONE;
                skb_queue_tail(&card->iovpool.queue, new_iovb);
                card->iovpool.count++;
             }
@@ -2264,7 +2277,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
 
    if (NS_SKB(iovb)->iovcnt == 1)
    {
-      if (skb->list != &card->sbpool.queue)
+      if (NS_SKB_CB(skb)->buf_type != BUF_SM)
       {
          printk("nicstar%d: Expected a small buffer, and this is not one.\n",
                 card->index);
@@ -2278,7 +2291,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
    }
    else /* NS_SKB(iovb)->iovcnt >= 2 */
    {
-      if (skb->list != &card->lbpool.queue)
+      if (NS_SKB_CB(skb)->buf_type != BUF_LG)
       {
          printk("nicstar%d: Expected a large buffer, and this is not one.\n",
                 card->index);
@@ -2322,8 +2335,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
          /* skb points to a small buffer */
          if (!atm_charge(vcc, skb->truesize))
          {
-            push_rxbufs(card, BUF_SM, (u32) skb, (u32) virt_to_bus(skb->data),
-                        0, 0);
+            push_rxbufs(card, skb);
             atomic_inc(&vcc->stats->rx_drop);
          }
          else
@@ -2334,7 +2346,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
             skb->destructor = ns_sb_destructor;
 #endif /* NS_USE_DESTRUCTORS */
             ATM_SKB(skb)->vcc = vcc;
-            do_gettimeofday(&skb->stamp);
+            __net_timestamp(skb);
             vcc->push(vcc, skb);
             atomic_inc(&vcc->stats->rx);
          }
@@ -2350,8 +2362,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
          {
             if (!atm_charge(vcc, sb->truesize))
             {
-               push_rxbufs(card, BUF_SM, (u32) sb, (u32) virt_to_bus(sb->data),
-                           0, 0);
+               push_rxbufs(card, sb);
                atomic_inc(&vcc->stats->rx_drop);
             }
             else
@@ -2362,21 +2373,19 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
                sb->destructor = ns_sb_destructor;
 #endif /* NS_USE_DESTRUCTORS */
                ATM_SKB(sb)->vcc = vcc;
-               do_gettimeofday(&sb->stamp);
+               __net_timestamp(sb);
                vcc->push(vcc, sb);
                atomic_inc(&vcc->stats->rx);
             }
 
-            push_rxbufs(card, BUF_LG, (u32) skb,
-                           (u32) virt_to_bus(skb->data), 0, 0);
+            push_rxbufs(card, skb);
 
          }
          else                   /* len > NS_SMBUFSIZE, the usual case */
          {
             if (!atm_charge(vcc, skb->truesize))
             {
-               push_rxbufs(card, BUF_LG, (u32) skb,
-                           (u32) virt_to_bus(skb->data), 0, 0);
+               push_rxbufs(card, skb);
                atomic_inc(&vcc->stats->rx_drop);
             }
             else
@@ -2389,13 +2398,12 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
                memcpy(skb->data, sb->data, NS_SMBUFSIZE);
                skb_put(skb, len - NS_SMBUFSIZE);
                ATM_SKB(skb)->vcc = vcc;
-               do_gettimeofday(&skb->stamp);
+               __net_timestamp(skb);
                vcc->push(vcc, skb);
                atomic_inc(&vcc->stats->rx);
             }
 
-            push_rxbufs(card, BUF_SM, (u32) sb, (u32) virt_to_bus(sb->data),
-                        0, 0);
+            push_rxbufs(card, sb);
 
          }
          
@@ -2430,6 +2438,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
                   card->hbpool.count++;
                }
             }
+            NS_SKB_CB(hb)->buf_type = BUF_NONE;
          }
          else
          if (--card->hbpool.count < card->hbnr.min)
@@ -2437,6 +2446,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
             struct sk_buff *new_hb;
             if ((new_hb = dev_alloc_skb(NS_HBUFSIZE)) != NULL)
             {
+               NS_SKB_CB(new_hb)->buf_type = BUF_NONE;
                skb_queue_tail(&card->hbpool.queue, new_hb);
                card->hbpool.count++;
             }
@@ -2444,6 +2454,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
             {
                if ((new_hb = dev_alloc_skb(NS_HBUFSIZE)) != NULL)
                {
+                  NS_SKB_CB(new_hb)->buf_type = BUF_NONE;
                   skb_queue_tail(&card->hbpool.queue, new_hb);
                   card->hbpool.count++;
                }
@@ -2473,8 +2484,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
             remaining = len - iov->iov_len;
             iov++;
             /* Free the small buffer */
-            push_rxbufs(card, BUF_SM, (u32) sb, (u32) virt_to_bus(sb->data),
-                        0, 0);
+            push_rxbufs(card, sb);
 
             /* Copy all large buffers to the huge buffer and free them */
             for (j = 1; j < NS_SKB(iovb)->iovcnt; j++)
@@ -2485,8 +2495,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
                skb_put(hb, tocopy);
                iov++;
                remaining -= tocopy;
-               push_rxbufs(card, BUF_LG, (u32) lb,
-                           (u32) virt_to_bus(lb->data), 0, 0);
+               push_rxbufs(card, lb);
             }
 #ifdef EXTRA_DEBUG
             if (remaining != 0 || hb->len != len)
@@ -2496,7 +2505,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
 #ifdef NS_USE_DESTRUCTORS
             hb->destructor = ns_hb_destructor;
 #endif /* NS_USE_DESTRUCTORS */
-            do_gettimeofday(&hb->stamp);
+            __net_timestamp(hb);
             vcc->push(vcc, hb);
             atomic_inc(&vcc->stats->rx);
          }
@@ -2527,9 +2536,10 @@ static void ns_sb_destructor(struct sk_buff *sb)
       sb = __dev_alloc_skb(NS_SMSKBSIZE, GFP_KERNEL);
       if (sb == NULL)
          break;
+      NS_SKB_CB(sb)->buf_type = BUF_SM;
       skb_queue_tail(&card->sbpool.queue, sb);
       skb_reserve(sb, NS_AAL0_HEADER);
-      push_rxbufs(card, BUF_SM, (u32) sb, (u32) virt_to_bus(sb->data), 0, 0);
+      push_rxbufs(card, sb);
    } while (card->sbfqc < card->sbnr.min);
 }
 
@@ -2550,9 +2560,10 @@ static void ns_lb_destructor(struct sk_buff *lb)
       lb = __dev_alloc_skb(NS_LGSKBSIZE, GFP_KERNEL);
       if (lb == NULL)
          break;
+      NS_SKB_CB(lb)->buf_type = BUF_LG;
       skb_queue_tail(&card->lbpool.queue, lb);
       skb_reserve(lb, NS_SMBUFSIZE);
-      push_rxbufs(card, BUF_LG, (u32) lb, (u32) virt_to_bus(lb->data), 0, 0);
+      push_rxbufs(card, lb);
    } while (card->lbfqc < card->lbnr.min);
 }
 
@@ -2569,6 +2580,7 @@ static void ns_hb_destructor(struct sk_buff *hb)
       hb = __dev_alloc_skb(NS_HBUFSIZE, GFP_KERNEL);
       if (hb == NULL)
          break;
+      NS_SKB_CB(hb)->buf_type = BUF_NONE;
       skb_queue_tail(&card->hbpool.queue, hb);
       card->hbpool.count++;
    }
@@ -2577,45 +2589,25 @@ static void ns_hb_destructor(struct sk_buff *hb)
 #endif /* NS_USE_DESTRUCTORS */
 
 
-
 static void recycle_rx_buf(ns_dev *card, struct sk_buff *skb)
 {
-   if (skb->list == &card->sbpool.queue)
-      push_rxbufs(card, BUF_SM, (u32) skb, (u32) virt_to_bus(skb->data), 0, 0);
-   else if (skb->list == &card->lbpool.queue)
-      push_rxbufs(card, BUF_LG, (u32) skb, (u32) virt_to_bus(skb->data), 0, 0);
-   else
-   {
-      printk("nicstar%d: What kind of rx buffer is this?\n", card->index);
-      dev_kfree_skb_any(skb);
-   }
-}
+        struct ns_skb_cb *cb = NS_SKB_CB(skb);
 
+        if (unlikely(cb->buf_type == BUF_NONE)) {
+                printk("nicstar%d: What kind of rx buffer is this?\n", card->index);
+                dev_kfree_skb_any(skb);
+        } else
+                push_rxbufs(card, skb);
+}
 
 
 static void recycle_iovec_rx_bufs(ns_dev *card, struct iovec *iov, int count)
 {
-   struct sk_buff *skb;
-
-   for (; count > 0; count--)
-   {
-      skb = (struct sk_buff *) (iov++)->iov_base;
-      if (skb->list == &card->sbpool.queue)
-         push_rxbufs(card, BUF_SM, (u32) skb, (u32) virt_to_bus(skb->data),
-                     0, 0);
-      else if (skb->list == &card->lbpool.queue)
-         push_rxbufs(card, BUF_LG, (u32) skb, (u32) virt_to_bus(skb->data),
-                     0, 0);
-      else
-      {
-         printk("nicstar%d: What kind of rx buffer is this?\n", card->index);
-         dev_kfree_skb_any(skb);
-      }
-   }
+        while (count-- > 0)
+                recycle_rx_buf(card, (struct sk_buff *) (iov++)->iov_base);
 }
 
 
-
 static void recycle_iov_buf(ns_dev *card, struct sk_buff *iovb)
 {
    if (card->iovpool.count < card->iovnr.max)
@@ -2631,7 +2623,7 @@ static void recycle_iov_buf(ns_dev *card, struct sk_buff *iovb)
 
 static void dequeue_sm_buf(ns_dev *card, struct sk_buff *sb)
 {
-   skb_unlink(sb);
+   skb_unlink(sb, &card->sbpool.queue);
 #ifdef NS_USE_DESTRUCTORS
    if (card->sbfqc < card->sbnr.min)
 #else
@@ -2640,10 +2632,10 @@ static void dequeue_sm_buf(ns_dev *card, struct sk_buff *sb)
       struct sk_buff *new_sb;
       if ((new_sb = dev_alloc_skb(NS_SMSKBSIZE)) != NULL)
       {
+         NS_SKB_CB(new_sb)->buf_type = BUF_SM;
          skb_queue_tail(&card->sbpool.queue, new_sb);
          skb_reserve(new_sb, NS_AAL0_HEADER);
-         push_rxbufs(card, BUF_SM, (u32) new_sb,
-                     (u32) virt_to_bus(new_sb->data), 0, 0);
+         push_rxbufs(card, new_sb);
       }
    }
    if (card->sbfqc < card->sbnr.init)
@@ -2652,10 +2644,10 @@ static void dequeue_sm_buf(ns_dev *card, struct sk_buff *sb)
       struct sk_buff *new_sb;
       if ((new_sb = dev_alloc_skb(NS_SMSKBSIZE)) != NULL)
       {
+         NS_SKB_CB(new_sb)->buf_type = BUF_SM;
          skb_queue_tail(&card->sbpool.queue, new_sb);
          skb_reserve(new_sb, NS_AAL0_HEADER);
-         push_rxbufs(card, BUF_SM, (u32) new_sb,
-                     (u32) virt_to_bus(new_sb->data), 0, 0);
+         push_rxbufs(card, new_sb);
       }
    }
 }
@@ -2664,7 +2656,7 @@ static void dequeue_sm_buf(ns_dev *card, struct sk_buff *sb)
 
 static void dequeue_lg_buf(ns_dev *card, struct sk_buff *lb)
 {
-   skb_unlink(lb);
+   skb_unlink(lb, &card->lbpool.queue);
 #ifdef NS_USE_DESTRUCTORS
    if (card->lbfqc < card->lbnr.min)
 #else
@@ -2673,10 +2665,10 @@ static void dequeue_lg_buf(ns_dev *card, struct sk_buff *lb)
       struct sk_buff *new_lb;
       if ((new_lb = dev_alloc_skb(NS_LGSKBSIZE)) != NULL)
       {
+         NS_SKB_CB(new_lb)->buf_type = BUF_LG;
          skb_queue_tail(&card->lbpool.queue, new_lb);
          skb_reserve(new_lb, NS_SMBUFSIZE);
-         push_rxbufs(card, BUF_LG, (u32) new_lb,
-                     (u32) virt_to_bus(new_lb->data), 0, 0);
+         push_rxbufs(card, new_lb);
       }
    }
    if (card->lbfqc < card->lbnr.init)
@@ -2685,10 +2677,10 @@ static void dequeue_lg_buf(ns_dev *card, struct sk_buff *lb)
       struct sk_buff *new_lb;
       if ((new_lb = dev_alloc_skb(NS_LGSKBSIZE)) != NULL)
       {
+         NS_SKB_CB(new_lb)->buf_type = BUF_LG;
          skb_queue_tail(&card->lbpool.queue, new_lb);
          skb_reserve(new_lb, NS_SMBUFSIZE);
-         push_rxbufs(card, BUF_LG, (u32) new_lb,
-                     (u32) virt_to_bus(new_lb->data), 0, 0);
+         push_rxbufs(card, new_lb);
       }
    }
 }
@@ -2880,9 +2872,10 @@ static int ns_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
                   sb = __dev_alloc_skb(NS_SMSKBSIZE, GFP_KERNEL);
                   if (sb == NULL)
                      return -ENOMEM;
+                  NS_SKB_CB(sb)->buf_type = BUF_SM;
                   skb_queue_tail(&card->sbpool.queue, sb);
                   skb_reserve(sb, NS_AAL0_HEADER);
-                  push_rxbufs(card, BUF_SM, (u32) sb, (u32) virt_to_bus(sb->data), 0, 0);
+                  push_rxbufs(card, sb);
                }
                break;
 
@@ -2894,9 +2887,10 @@ static int ns_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
                   lb = __dev_alloc_skb(NS_LGSKBSIZE, GFP_KERNEL);
                   if (lb == NULL)
                      return -ENOMEM;
+                  NS_SKB_CB(lb)->buf_type = BUF_LG;
                   skb_queue_tail(&card->lbpool.queue, lb);
                   skb_reserve(lb, NS_SMBUFSIZE);
-                  push_rxbufs(card, BUF_LG, (u32) lb, (u32) virt_to_bus(lb->data), 0, 0);
+                  push_rxbufs(card, lb);
                }
                break;
 
@@ -2923,6 +2917,7 @@ static int ns_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
                   hb = __dev_alloc_skb(NS_HBUFSIZE, GFP_KERNEL);
                   if (hb == NULL)
                      return -ENOMEM;
+                  NS_SKB_CB(hb)->buf_type = BUF_NONE;
                   ns_grab_int_lock(card, flags);
                   skb_queue_tail(&card->hbpool.queue, hb);
                   card->hbpool.count++;
@@ -2953,6 +2948,7 @@ static int ns_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
                   iovb = alloc_skb(NS_IOVBUFSIZE, GFP_KERNEL);
                   if (iovb == NULL)
                      return -ENOMEM;
+                  NS_SKB_CB(iovb)->buf_type = BUF_NONE;
                   ns_grab_int_lock(card, flags);
                   skb_queue_tail(&card->iovpool.queue, iovb);
                   card->iovpool.count++;
@@ -2979,17 +2975,12 @@ static int ns_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
 }
 
 
-
 static void which_list(ns_dev *card, struct sk_buff *skb)
 {
-   printk("It's a %s buffer.\n", skb->list == &card->sbpool.queue ?
-          "small" : skb->list == &card->lbpool.queue ? "large" :
-          skb->list == &card->hbpool.queue ? "huge" :
-          skb->list == &card->iovpool.queue ? "iovec" : "unknown");
+        printk("skb buf_type: 0x%08x\n", NS_SKB_CB(skb)->buf_type);
 }
 
 
-
 static void ns_poll(unsigned long arg)
 {
    int i;
diff --git a/drivers/atm/nicstar.h b/drivers/atm/nicstar.h
index ea83c46c8ba5..5997bcb45b59 100644
--- a/drivers/atm/nicstar.h
+++ b/drivers/atm/nicstar.h
@@ -103,8 +103,14 @@
 
 #define NS_IOREMAP_SIZE 4096
 
-#define BUF_SM 0x00000000       /* These two are used for push_rxbufs() */
-#define BUF_LG 0x00000001       /* CMD, Write_FreeBufQ, LBUF bit */
+/*
+ * BUF_XX distinguish the Rx buffers depending on their (small/large) size.
+ * BUG_SM and BUG_LG are both used by the driver and the device.
+ * BUF_NONE is only used by the driver.
+ */
+#define BUF_SM          0x00000000      /* These two are used for push_rxbufs() */
+#define BUF_LG          0x00000001      /* CMD, Write_FreeBufQ, LBUF bit */
+#define BUF_NONE        0xffffffff      /* Software only: */
 
 #define NS_HBUFSIZE 65568       /* Size of max. AAL5 PDU */
 #define NS_MAX_IOVECS (2 + (65568 - NS_SMBUFSIZE) / \
@@ -684,6 +690,12 @@ enum ns_regs
 /* Device driver structures ***************************************************/
 
 
+struct ns_skb_cb {
+        u32 buf_type;                   /* BUF_SM/BUF_LG/BUF_NONE */
+};
+
+#define NS_SKB_CB(skb)  ((struct ns_skb_cb *)((skb)->cb))
+
 typedef struct tsq_info
 {
    void *org;
diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
index a2b236a966e0..c4b75ecf9460 100644
--- a/drivers/atm/zatm.c
+++ b/drivers/atm/zatm.c
@@ -400,7 +400,7 @@ unsigned long *x;
 EVENT("error code 0x%x/0x%x\n",(here[3] & uPD98401_AAL5_ES) >>
   uPD98401_AAL5_ES_SHIFT,error);
                 skb = ((struct rx_buffer_head *) bus_to_virt(here[2]))->skb;
-                do_gettimeofday(&skb->stamp);
+                __net_timestamp(skb);
 #if 0
 printk("[-3..0] 0x%08lx 0x%08lx 0x%08lx 0x%08lx\n",((unsigned *) skb->data)[-3],
   ((unsigned *) skb->data)[-2],((unsigned *) skb->data)[-1],
@@ -417,10 +417,12 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
                 chan = (here[3] & uPD98401_AAL5_CHAN) >>
                     uPD98401_AAL5_CHAN_SHIFT;
                 if (chan < zatm_dev->chans && zatm_dev->rx_map[chan]) {
+                        int pos = ZATM_VCC(vcc)->pool;
+
                         vcc = zatm_dev->rx_map[chan];
-                        if (skb == zatm_dev->last_free[ZATM_VCC(vcc)->pool])
-                                zatm_dev->last_free[ZATM_VCC(vcc)->pool] = NULL;
-                        skb_unlink(skb);
+                        if (skb == zatm_dev->last_free[pos])
+                                zatm_dev->last_free[pos] = NULL;
+                        skb_unlink(skb, zatm_dev->pool + pos);
                 }
                 else {
                         printk(KERN_ERR DEV_LABEL "(itf %d): RX indication "
diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index 96fe2f956754..ab53832d57e5 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -180,7 +180,9 @@ static ssize_t driver_bind(struct device_driver *drv,
                 up(&dev->sem);
                 put_device(dev);
         }
-        return err;
+        if (err)
+                return err;
+        return count;
 }
 static DRIVER_ATTR(bind, S_IWUSR, NULL, driver_bind);
 
diff --git a/drivers/base/class.c b/drivers/base/class.c
index 479c12570881..0154a1623b21 100644
--- a/drivers/base/class.c
+++ b/drivers/base/class.c
@@ -299,6 +299,11 @@ static void class_dev_release(struct kobject * kobj)
 
         pr_debug("device class '%s': release.\n", cd->class_id);
 
+        if (cd->devt_attr) {
+                kfree(cd->devt_attr);
+                cd->devt_attr = NULL;
+        }
+
         if (cls->release)
                 cls->release(cd);
         else {
@@ -591,11 +596,8 @@ void class_device_del(struct class_device *class_dev)
 
         if (class_dev->dev)
                 sysfs_remove_link(&class_dev->kobj, "device");
-        if (class_dev->devt_attr) {
+        if (class_dev->devt_attr)
                 class_device_remove_file(class_dev, class_dev->devt_attr);
-                kfree(class_dev->devt_attr);
-                class_dev->devt_attr = NULL;
-        }
         class_device_remove_attrs(class_dev);
 
         kobject_hotplug(&class_dev->kobj, KOBJ_REMOVE);
diff --git a/drivers/block/aoe/aoenet.c b/drivers/block/aoe/aoenet.c
index 9e6f51c528b0..4be976940f69 100644
--- a/drivers/block/aoe/aoenet.c
+++ b/drivers/block/aoe/aoenet.c
@@ -120,7 +120,7 @@ aoenet_xmit(struct sk_buff *sl)
  * (1) len doesn't include the header by default.  I want this. 
  */
 static int
-aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt)
+aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt, struct net_device *orig_dev)
 {
         struct aoe_hdr *h;
         u32 n;
diff --git a/drivers/block/cfq-iosched.c b/drivers/block/cfq-iosched.c
index 2435a7c99b2b..cd056e7e64ec 100644
--- a/drivers/block/cfq-iosched.c
+++ b/drivers/block/cfq-iosched.c
@@ -47,7 +47,7 @@ static int cfq_slice_idle = HZ / 100;
 /*
  * disable queueing at the driver/hardware level
  */
-static int cfq_max_depth = 1;
+static int cfq_max_depth = 2;
 
 /*
  * for the hash of cfqq inside the cfqd
@@ -385,9 +385,15 @@ cfq_choose_req(struct cfq_data *cfqd, struct cfq_rq *crq1, struct cfq_rq *crq2)
                 return crq2;
         if (crq2 == NULL)
                 return crq1;
-        if (cfq_crq_requeued(crq1))
+
+        if (cfq_crq_requeued(crq1) && !cfq_crq_requeued(crq2))
                 return crq1;
-        if (cfq_crq_requeued(crq2))
+        else if (cfq_crq_requeued(crq2) && !cfq_crq_requeued(crq1))
+                return crq2;
+
+        if (cfq_crq_is_sync(crq1) && !cfq_crq_is_sync(crq2))
+                return crq1;
+        else if (cfq_crq_is_sync(crq2) && !cfq_crq_is_sync(crq1))
                 return crq2;
 
         s1 = crq1->request->sector;
@@ -1769,18 +1775,23 @@ static void
 cfq_crq_enqueued(struct cfq_data *cfqd, struct cfq_queue *cfqq,
                  struct cfq_rq *crq)
 {
-        const int sync = cfq_crq_is_sync(crq);
+        struct cfq_io_context *cic;
 
         cfqq->next_crq = cfq_choose_req(cfqd, cfqq->next_crq, crq);
 
-        if (sync) {
-                struct cfq_io_context *cic = crq->io_context;
+        /*
+         * we never wait for an async request and we don't allow preemption
+         * of an async request. so just return early
+         */
+        if (!cfq_crq_is_sync(crq))
+                return;
 
-                cfq_update_io_thinktime(cfqd, cic);
-                cfq_update_idle_window(cfqd, cfqq, cic);
+        cic = crq->io_context;
 
-                cic->last_queue = jiffies;
-        }
+        cfq_update_io_thinktime(cfqd, cic);
+        cfq_update_idle_window(cfqd, cfqq, cic);
+
+        cic->last_queue = jiffies;
 
         if (cfqq == cfqd->active_queue) {
                 /*
diff --git a/drivers/block/ll_rw_blk.c b/drivers/block/ll_rw_blk.c
index 692a5fced76e..3c818544475e 100644
--- a/drivers/block/ll_rw_blk.c
+++ b/drivers/block/ll_rw_blk.c
@@ -719,7 +719,7 @@ struct request *blk_queue_find_tag(request_queue_t *q, int tag)
 {
         struct blk_queue_tag *bqt = q->queue_tags;
 
-        if (unlikely(bqt == NULL || tag >= bqt->max_depth))
+        if (unlikely(bqt == NULL || tag >= bqt->real_max_depth))
                 return NULL;
 
         return bqt->tag_index[tag];
@@ -798,6 +798,7 @@ init_tag_map(request_queue_t *q, struct blk_queue_tag *tags, int depth)
 
         memset(tag_index, 0, depth * sizeof(struct request *));
         memset(tag_map, 0, nr_ulongs * sizeof(unsigned long));
+        tags->real_max_depth = depth;
         tags->max_depth = depth;
         tags->tag_index = tag_index;
         tags->tag_map = tag_map;
@@ -872,11 +873,22 @@ int blk_queue_resize_tags(request_queue_t *q, int new_depth)
                 return -ENXIO;
 
         /*
+         * if we already have large enough real_max_depth.  just
+         * adjust max_depth.  *NOTE* as requests with tag value
+         * between new_depth and real_max_depth can be in-flight, tag
+         * map can not be shrunk blindly here.
+         */
+        if (new_depth <= bqt->real_max_depth) {
+                bqt->max_depth = new_depth;
+                return 0;
+        }
+
+        /*
          * save the old state info, so we can copy it back
          */
         tag_index = bqt->tag_index;
         tag_map = bqt->tag_map;
-        max_depth = bqt->max_depth;
+        max_depth = bqt->real_max_depth;
 
         if (init_tag_map(q, bqt, new_depth))
                 return -ENOMEM;
@@ -913,7 +925,7 @@ void blk_queue_end_tag(request_queue_t *q, struct request *rq)
 
         BUG_ON(tag == -1);
 
-        if (unlikely(tag >= bqt->max_depth))
+        if (unlikely(tag >= bqt->real_max_depth))
                 /*
                  * This can happen after tag depth has been reduced.
                  * FIXME: how about a warning or info message here?
diff --git a/drivers/block/viodasd.c b/drivers/block/viodasd.c
index 46e56a25d2c8..e46ecd23b3ac 100644
--- a/drivers/block/viodasd.c
+++ b/drivers/block/viodasd.c
@@ -776,7 +776,7 @@ static int viodasd_remove(struct vio_dev *vdev)
  */
 static struct vio_device_id viodasd_device_table[] __devinitdata = {
         { "viodasd", "" },
-        { 0, }
+        { "", "" }
 };
 
 MODULE_DEVICE_TABLE(vio, viodasd_device_table);
diff --git a/drivers/bluetooth/bfusb.c b/drivers/bluetooth/bfusb.c
index c42d7e6ac1c5..1e9db0156ea7 100644
--- a/drivers/bluetooth/bfusb.c
+++ b/drivers/bluetooth/bfusb.c
@@ -158,7 +158,7 @@ static int bfusb_send_bulk(struct bfusb *bfusb, struct sk_buff *skb)
         if (err) {
                 BT_ERR("%s bulk tx submit failed urb %p err %d", 
                                         bfusb->hdev->name, urb, err);
-                skb_unlink(skb);
+                skb_unlink(skb, &bfusb->pending_q);
                 usb_free_urb(urb);
         } else
                 atomic_inc(&bfusb->pending_tx);
@@ -212,7 +212,7 @@ static void bfusb_tx_complete(struct urb *urb, struct pt_regs *regs)
 
         read_lock(&bfusb->lock);
 
-        skb_unlink(skb);
+        skb_unlink(skb, &bfusb->pending_q);
         skb_queue_tail(&bfusb->completed_q, skb);
 
         bfusb_tx_wakeup(bfusb);
@@ -253,7 +253,7 @@ static int bfusb_rx_submit(struct bfusb *bfusb, struct urb *urb)
         if (err) {
                 BT_ERR("%s bulk rx submit failed urb %p err %d",
                                         bfusb->hdev->name, urb, err);
-                skb_unlink(skb);
+                skb_unlink(skb, &bfusb->pending_q);
                 kfree_skb(skb);
                 usb_free_urb(urb);
         }
@@ -330,7 +330,7 @@ static inline int bfusb_recv_block(struct bfusb *bfusb, int hdr, unsigned char *
                 }
 
                 skb->dev = (void *) bfusb->hdev;
-                skb->pkt_type = pkt_type;
+                bt_cb(skb)->pkt_type = pkt_type;
 
                 bfusb->reassembly = skb;
         } else {
@@ -398,7 +398,7 @@ static void bfusb_rx_complete(struct urb *urb, struct pt_regs *regs)
                 buf   += len;
         }
 
-        skb_unlink(skb);
+        skb_unlink(skb, &bfusb->pending_q);
         kfree_skb(skb);
 
         bfusb_rx_submit(bfusb, urb);
@@ -485,7 +485,7 @@ static int bfusb_send_frame(struct sk_buff *skb)
         unsigned char buf[3];
         int sent = 0, size, count;
 
-        BT_DBG("hdev %p skb %p type %d len %d", hdev, skb, skb->pkt_type, skb->len);
+        BT_DBG("hdev %p skb %p type %d len %d", hdev, skb, bt_cb(skb)->pkt_type, skb->len);
 
         if (!hdev) {
                 BT_ERR("Frame for unknown HCI device (hdev=NULL)");
@@ -497,7 +497,7 @@ static int bfusb_send_frame(struct sk_buff *skb)
 
         bfusb = (struct bfusb *) hdev->driver_data;
 
-        switch (skb->pkt_type) {
+        switch (bt_cb(skb)->pkt_type) {
         case HCI_COMMAND_PKT:
                 hdev->stat.cmd_tx++;
                 break;
@@ -510,7 +510,7 @@ static int bfusb_send_frame(struct sk_buff *skb)
         };
 
         /* Prepend skb with frame type */
-        memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
+        memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
 
         count = skb->len;
 
diff --git a/drivers/bluetooth/bluecard_cs.c b/drivers/bluetooth/bluecard_cs.c
index bd2ec7e284cc..26fe9c0e1d20 100644
--- a/drivers/bluetooth/bluecard_cs.c
+++ b/drivers/bluetooth/bluecard_cs.c
@@ -270,7 +270,7 @@ static void bluecard_write_wakeup(bluecard_info_t *info)
                 if (!(skb = skb_dequeue(&(info->txq))))
                         break;
 
-                if (skb->pkt_type & 0x80) {
+                if (bt_cb(skb)->pkt_type & 0x80) {
                         /* Disable RTS */
                         info->ctrl_reg |= REG_CONTROL_RTS;
                         outb(info->ctrl_reg, iobase + REG_CONTROL);
@@ -288,13 +288,13 @@ static void bluecard_write_wakeup(bluecard_info_t *info)
                 /* Mark the buffer as dirty */
                 clear_bit(ready_bit, &(info->tx_state));
 
-                if (skb->pkt_type & 0x80) {
+                if (bt_cb(skb)->pkt_type & 0x80) {
                         DECLARE_WAIT_QUEUE_HEAD(wq);
                         DEFINE_WAIT(wait);
 
                         unsigned char baud_reg;
 
-                        switch (skb->pkt_type) {
+                        switch (bt_cb(skb)->pkt_type) {
                         case PKT_BAUD_RATE_460800:
                                 baud_reg = REG_CONTROL_BAUD_RATE_460800;
                                 break;
@@ -410,9 +410,9 @@ static void bluecard_receive(bluecard_info_t *info, unsigned int offset)
                 if (info->rx_state == RECV_WAIT_PACKET_TYPE) {
 
                         info->rx_skb->dev = (void *) info->hdev;
-                        info->rx_skb->pkt_type = buf[i];
+                        bt_cb(info->rx_skb)->pkt_type = buf[i];
 
-                        switch (info->rx_skb->pkt_type) {
+                        switch (bt_cb(info->rx_skb)->pkt_type) {
 
                         case 0x00:
                                 /* init packet */
@@ -444,7 +444,7 @@ static void bluecard_receive(bluecard_info_t *info, unsigned int offset)
 
                         default:
                                 /* unknown packet */
-                                BT_ERR("Unknown HCI packet with type 0x%02x received", info->rx_skb->pkt_type);
+                                BT_ERR("Unknown HCI packet with type 0x%02x received", bt_cb(info->rx_skb)->pkt_type);
                                 info->hdev->stat.err_rx++;
 
                                 kfree_skb(info->rx_skb);
@@ -586,21 +586,21 @@ static int bluecard_hci_set_baud_rate(struct hci_dev *hdev, int baud)
         switch (baud) {
         case 460800:
                 cmd[4] = 0x00;
-                skb->pkt_type = PKT_BAUD_RATE_460800;
+                bt_cb(skb)->pkt_type = PKT_BAUD_RATE_460800;
                 break;
         case 230400:
                 cmd[4] = 0x01;
-                skb->pkt_type = PKT_BAUD_RATE_230400;
+                bt_cb(skb)->pkt_type = PKT_BAUD_RATE_230400;
                 break;
         case 115200:
                 cmd[4] = 0x02;
-                skb->pkt_type = PKT_BAUD_RATE_115200;
+                bt_cb(skb)->pkt_type = PKT_BAUD_RATE_115200;
                 break;
         case 57600:
                 /* Fall through... */
         default:
                 cmd[4] = 0x03;
-                skb->pkt_type = PKT_BAUD_RATE_57600;
+                bt_cb(skb)->pkt_type = PKT_BAUD_RATE_57600;
                 break;
         }
 
@@ -680,7 +680,7 @@ static int bluecard_hci_send_frame(struct sk_buff *skb)
 
         info = (bluecard_info_t *)(hdev->driver_data);
 
-        switch (skb->pkt_type) {
+        switch (bt_cb(skb)->pkt_type) {
         case HCI_COMMAND_PKT:
                 hdev->stat.cmd_tx++;
                 break;
@@ -693,7 +693,7 @@ static int bluecard_hci_send_frame(struct sk_buff *skb)
         };
 
         /* Prepend skb with frame type */
-        memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
+        memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
         skb_queue_tail(&(info->txq), skb);
 
         bluecard_write_wakeup(info);
diff --git a/drivers/bluetooth/bpa10x.c b/drivers/bluetooth/bpa10x.c
index 2771c861f185..a1bf8f066c88 100644
--- a/drivers/bluetooth/bpa10x.c
+++ b/drivers/bluetooth/bpa10x.c
@@ -105,7 +105,7 @@ static void bpa10x_recv_bulk(struct bpa10x_data *data, unsigned char *buf, int c
                         if (skb) {
                                 memcpy(skb_put(skb, len), buf, len);
                                 skb->dev = (void *) data->hdev;
-                                skb->pkt_type = HCI_ACLDATA_PKT;
+                                bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
                                 hci_recv_frame(skb);
                         }
                         break;
@@ -117,7 +117,7 @@ static void bpa10x_recv_bulk(struct bpa10x_data *data, unsigned char *buf, int c
                         if (skb) {
                                 memcpy(skb_put(skb, len), buf, len);
                                 skb->dev = (void *) data->hdev;
-                                skb->pkt_type = HCI_SCODATA_PKT;
+                                bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
                                 hci_recv_frame(skb);
                         }
                         break;
@@ -129,7 +129,7 @@ static void bpa10x_recv_bulk(struct bpa10x_data *data, unsigned char *buf, int c
                         if (skb) {
                                 memcpy(skb_put(skb, len), buf, len);
                                 skb->dev = (void *) data->hdev;
-                                skb->pkt_type = HCI_VENDOR_PKT;
+                                bt_cb(skb)->pkt_type = HCI_VENDOR_PKT;
                                 hci_recv_frame(skb);
                         }
                         break;
@@ -190,7 +190,7 @@ static int bpa10x_recv_event(struct bpa10x_data *data, unsigned char *buf, int s
                 }
 
                 skb->dev = (void *) data->hdev;
-                skb->pkt_type = pkt_type;
+                bt_cb(skb)->pkt_type = pkt_type;
 
                 memcpy(skb_put(skb, size), buf, size);
 
@@ -307,7 +307,8 @@ unlock:
         read_unlock(&data->lock);
 }
 
-static inline struct urb *bpa10x_alloc_urb(struct usb_device *udev, unsigned int pipe, size_t size, int flags, void *data)
+static inline struct urb *bpa10x_alloc_urb(struct usb_device *udev, unsigned int pipe,
+                                        size_t size, unsigned int __nocast flags, void *data)
 {
         struct urb *urb;
         struct usb_ctrlrequest *cr;
@@ -367,11 +368,8 @@ static inline void bpa10x_free_urb(struct urb *urb)
         if (!urb)
                 return;
 
-        if (urb->setup_packet)
-                kfree(urb->setup_packet);
-
-        if (urb->transfer_buffer)
-                kfree(urb->transfer_buffer);
+        kfree(urb->setup_packet);
+        kfree(urb->transfer_buffer);
 
         usb_free_urb(urb);
 }
@@ -490,7 +488,7 @@ static int bpa10x_send_frame(struct sk_buff *skb)
         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
         struct bpa10x_data *data;
 
-        BT_DBG("hdev %p skb %p type %d len %d", hdev, skb, skb->pkt_type, skb->len);
+        BT_DBG("hdev %p skb %p type %d len %d", hdev, skb, bt_cb(skb)->pkt_type, skb->len);
 
         if (!hdev) {
                 BT_ERR("Frame for unknown HCI device");
@@ -503,9 +501,9 @@ static int bpa10x_send_frame(struct sk_buff *skb)
         data = hdev->driver_data;
 
         /* Prepend skb with frame type */
-        memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
+        memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
 
-        switch (skb->pkt_type) {
+        switch (bt_cb(skb)->pkt_type) {
         case HCI_COMMAND_PKT:
                 hdev->stat.cmd_tx++;
                 skb_queue_tail(&data->cmd_queue, skb);
diff --git a/drivers/bluetooth/bt3c_cs.c b/drivers/bluetooth/bt3c_cs.c
index adf1750ea58d..2e0338d80f32 100644
--- a/drivers/bluetooth/bt3c_cs.c
+++ b/drivers/bluetooth/bt3c_cs.c
@@ -259,11 +259,11 @@ static void bt3c_receive(bt3c_info_t *info)
                 if (info->rx_state == RECV_WAIT_PACKET_TYPE) {
 
                         info->rx_skb->dev = (void *) info->hdev;
-                        info->rx_skb->pkt_type = inb(iobase + DATA_L);
+                        bt_cb(info->rx_skb)->pkt_type = inb(iobase + DATA_L);
                         inb(iobase + DATA_H);
-                        //printk("bt3c: PACKET_TYPE=%02x\n", info->rx_skb->pkt_type);
+                        //printk("bt3c: PACKET_TYPE=%02x\n", bt_cb(info->rx_skb)->pkt_type);
 
-                        switch (info->rx_skb->pkt_type) {
+                        switch (bt_cb(info->rx_skb)->pkt_type) {
 
                         case HCI_EVENT_PKT:
                                 info->rx_state = RECV_WAIT_EVENT_HEADER;
@@ -282,7 +282,7 @@ static void bt3c_receive(bt3c_info_t *info)
 
                         default:
                                 /* Unknown packet */
-                                BT_ERR("Unknown HCI packet with type 0x%02x received", info->rx_skb->pkt_type);
+                                BT_ERR("Unknown HCI packet with type 0x%02x received", bt_cb(info->rx_skb)->pkt_type);
                                 info->hdev->stat.err_rx++;
                                 clear_bit(HCI_RUNNING, &(info->hdev->flags));
 
@@ -439,7 +439,7 @@ static int bt3c_hci_send_frame(struct sk_buff *skb)
 
         info = (bt3c_info_t *) (hdev->driver_data);
 
-        switch (skb->pkt_type) {
+        switch (bt_cb(skb)->pkt_type) {
         case HCI_COMMAND_PKT:
                 hdev->stat.cmd_tx++;
                 break;
@@ -452,7 +452,7 @@ static int bt3c_hci_send_frame(struct sk_buff *skb)
         };
 
         /* Prepend skb with frame type */
-        memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
+        memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
         skb_queue_tail(&(info->txq), skb);
 
         spin_lock_irqsave(&(info->lock), flags);
diff --git a/drivers/bluetooth/btuart_cs.c b/drivers/bluetooth/btuart_cs.c
index e4c59fdc0e12..89486ea7a021 100644
--- a/drivers/bluetooth/btuart_cs.c
+++ b/drivers/bluetooth/btuart_cs.c
@@ -211,9 +211,9 @@ static void btuart_receive(btuart_info_t *info)
                 if (info->rx_state == RECV_WAIT_PACKET_TYPE) {
 
                         info->rx_skb->dev = (void *) info->hdev;
-                        info->rx_skb->pkt_type = inb(iobase + UART_RX);
+                        bt_cb(info->rx_skb)->pkt_type = inb(iobase + UART_RX);
 
-                        switch (info->rx_skb->pkt_type) {
+                        switch (bt_cb(info->rx_skb)->pkt_type) {
 
                         case HCI_EVENT_PKT:
                                 info->rx_state = RECV_WAIT_EVENT_HEADER;
@@ -232,7 +232,7 @@ static void btuart_receive(btuart_info_t *info)
 
                         default:
                                 /* Unknown packet */
-                                BT_ERR("Unknown HCI packet with type 0x%02x received", info->rx_skb->pkt_type);
+                                BT_ERR("Unknown HCI packet with type 0x%02x received", bt_cb(info->rx_skb)->pkt_type);
                                 info->hdev->stat.err_rx++;
                                 clear_bit(HCI_RUNNING, &(info->hdev->flags));
 
@@ -447,7 +447,7 @@ static int btuart_hci_send_frame(struct sk_buff *skb)
 
         info = (btuart_info_t *)(hdev->driver_data);
 
-        switch (skb->pkt_type) {
+        switch (bt_cb(skb)->pkt_type) {
         case HCI_COMMAND_PKT:
                 hdev->stat.cmd_tx++;
                 break;
@@ -460,7 +460,7 @@ static int btuart_hci_send_frame(struct sk_buff *skb)
         };
 
         /* Prepend skb with frame type */
-        memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
+        memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
         skb_queue_tail(&(info->txq), skb);
 
         btuart_write_wakeup(info);
diff --git a/drivers/bluetooth/dtl1_cs.c b/drivers/bluetooth/dtl1_cs.c
index e39868c3da48..84c1f8839422 100644
--- a/drivers/bluetooth/dtl1_cs.c
+++ b/drivers/bluetooth/dtl1_cs.c
@@ -251,7 +251,7 @@ static void dtl1_receive(dtl1_info_t *info)
                                 info->rx_count = nsh->len + (nsh->len & 0x0001);
                                 break;
                         case RECV_WAIT_DATA:
-                                info->rx_skb->pkt_type = nsh->type;
+                                bt_cb(info->rx_skb)->pkt_type = nsh->type;
 
                                 /* remove PAD byte if it exists */
                                 if (nsh->len & 0x0001) {
@@ -262,7 +262,7 @@ static void dtl1_receive(dtl1_info_t *info)
                                 /* remove NSH */
                                 skb_pull(info->rx_skb, NSHL);
 
-                                switch (info->rx_skb->pkt_type) {
+                                switch (bt_cb(info->rx_skb)->pkt_type) {
                                 case 0x80:
                                         /* control data for the Nokia Card */
                                         dtl1_control(info, info->rx_skb);
@@ -272,12 +272,12 @@ static void dtl1_receive(dtl1_info_t *info)
                                 case 0x84:
                                         /* send frame to the HCI layer */
                                         info->rx_skb->dev = (void *) info->hdev;
-                                        info->rx_skb->pkt_type &= 0x0f;
+                                        bt_cb(info->rx_skb)->pkt_type &= 0x0f;
                                         hci_recv_frame(info->rx_skb);
                                         break;
                                 default:
                                         /* unknown packet */
-                                        BT_ERR("Unknown HCI packet with type 0x%02x received", info->rx_skb->pkt_type);
+                                        BT_ERR("Unknown HCI packet with type 0x%02x received", bt_cb(info->rx_skb)->pkt_type);
                                         kfree_skb(info->rx_skb);
                                         break;
                                 }
@@ -410,7 +410,7 @@ static int dtl1_hci_send_frame(struct sk_buff *skb)
 
         info = (dtl1_info_t *)(hdev->driver_data);
 
-        switch (skb->pkt_type) {
+        switch (bt_cb(skb)->pkt_type) {
         case HCI_COMMAND_PKT:
                 hdev->stat.cmd_tx++;
                 nsh.type = 0x81;
diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
index c0ed213fc857..0ee324e1265d 100644
--- a/drivers/bluetooth/hci_bcsp.c
+++ b/drivers/bluetooth/hci_bcsp.c
@@ -58,8 +58,6 @@
 #ifndef CONFIG_BT_HCIUART_DEBUG
 #undef  BT_DBG
 #define BT_DBG( A... )
-#undef  BT_DMP
-#define BT_DMP( A... )
 #endif
 
 static int hciextn = 1;
@@ -151,7 +149,7 @@ static int bcsp_enqueue(struct hci_uart *hu, struct sk_buff *skb)
                 return 0;
         }
 
-        switch (skb->pkt_type) {
+        switch (bt_cb(skb)->pkt_type) {
         case HCI_ACLDATA_PKT:
         case HCI_COMMAND_PKT:
                 skb_queue_tail(&bcsp->rel, skb);
@@ -229,7 +227,7 @@ static struct sk_buff *bcsp_prepare_pkt(struct bcsp_struct *bcsp, u8 *data,
         if (!nskb)
                 return NULL;
 
-        nskb->pkt_type = pkt_type;
+        bt_cb(nskb)->pkt_type = pkt_type;
 
         bcsp_slip_msgdelim(nskb);
 
@@ -288,7 +286,7 @@ static struct sk_buff *bcsp_dequeue(struct hci_uart *hu)
            since they have priority */
 
         if ((skb = skb_dequeue(&bcsp->unrel)) != NULL) {
-                struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, skb->pkt_type);
+                struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, bt_cb(skb)->pkt_type);
                 if (nskb) {
                         kfree_skb(skb);
                         return nskb;
@@ -305,7 +303,7 @@ static struct sk_buff *bcsp_dequeue(struct hci_uart *hu)
         spin_lock_irqsave(&bcsp->unack.lock, flags);
 
         if (bcsp->unack.qlen < BCSP_TXWINSIZE && (skb = skb_dequeue(&bcsp->rel)) != NULL) {
-                struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, skb->pkt_type);
+                struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, bt_cb(skb)->pkt_type);
                 if (nskb) {
                         __skb_queue_tail(&bcsp->unack, skb);
                         mod_timer(&bcsp->tbcsp, jiffies + HZ / 4);
@@ -403,7 +401,7 @@ static void bcsp_handle_le_pkt(struct hci_uart *hu)
                 if (!nskb)
                         return;
                 memcpy(skb_put(nskb, 4), conf_rsp_pkt, 4);
-                nskb->pkt_type = BCSP_LE_PKT;
+                bt_cb(nskb)->pkt_type = BCSP_LE_PKT;
 
                 skb_queue_head(&bcsp->unrel, nskb);
                 hci_uart_tx_wakeup(hu);
@@ -485,14 +483,14 @@ static inline void bcsp_complete_rx_pkt(struct hci_uart *hu)
         bcsp_pkt_cull(bcsp);
         if ((bcsp->rx_skb->data[1] & 0x0f) == 6 &&
                         bcsp->rx_skb->data[0] & 0x80) {
-                bcsp->rx_skb->pkt_type = HCI_ACLDATA_PKT;
+                bt_cb(bcsp->rx_skb)->pkt_type = HCI_ACLDATA_PKT;
                 pass_up = 1;
         } else if ((bcsp->rx_skb->data[1] & 0x0f) == 5 &&
                         bcsp->rx_skb->data[0] & 0x80) {
-                bcsp->rx_skb->pkt_type = HCI_EVENT_PKT;
+                bt_cb(bcsp->rx_skb)->pkt_type = HCI_EVENT_PKT;
                 pass_up = 1;
         } else if ((bcsp->rx_skb->data[1] & 0x0f) == 7) {
-                bcsp->rx_skb->pkt_type = HCI_SCODATA_PKT;
+                bt_cb(bcsp->rx_skb)->pkt_type = HCI_SCODATA_PKT;
                 pass_up = 1;
         } else if ((bcsp->rx_skb->data[1] & 0x0f) == 1 &&
                         !(bcsp->rx_skb->data[0] & 0x80)) {
@@ -514,7 +512,7 @@ static inline void bcsp_complete_rx_pkt(struct hci_uart *hu)
                                 hdr.evt = 0xff;
                                 hdr.plen = bcsp->rx_skb->len;
                                 memcpy(skb_push(bcsp->rx_skb, HCI_EVENT_HDR_SIZE), &hdr, HCI_EVENT_HDR_SIZE);
-                                bcsp->rx_skb->pkt_type = HCI_EVENT_PKT;
+                                bt_cb(bcsp->rx_skb)->pkt_type = HCI_EVENT_PKT;
 
                                 hci_recv_frame(bcsp->rx_skb);
                         } else {
diff --git a/drivers/bluetooth/hci_h4.c b/drivers/bluetooth/hci_h4.c
index ade94a57bb11..cf8a22d58d96 100644
--- a/drivers/bluetooth/hci_h4.c
+++ b/drivers/bluetooth/hci_h4.c
@@ -57,8 +57,6 @@
 #ifndef CONFIG_BT_HCIUART_DEBUG
 #undef  BT_DBG
 #define BT_DBG( A... )
-#undef  BT_DMP
-#define BT_DMP( A... )
 #endif
 
 /* Initialize protocol */
@@ -114,7 +112,7 @@ static int h4_enqueue(struct hci_uart *hu, struct sk_buff *skb)
         BT_DBG("hu %p skb %p", hu, skb);
 
         /* Prepend skb with frame type */
-        memcpy(skb_push(skb, 1), &skb->pkt_type, 1);
+        memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
         skb_queue_tail(&h4->txq, skb);
         return 0;
 }
@@ -125,7 +123,6 @@ static inline int h4_check_data_len(struct h4_struct *h4, int len)
 
         BT_DBG("len %d room %d", len, room);
         if (!len) {
-                BT_DMP(h4->rx_skb->data, h4->rx_skb->len);
                 hci_recv_frame(h4->rx_skb);
         } else if (len > room) {
                 BT_ERR("Data length is too large");
@@ -169,8 +166,6 @@ static int h4_recv(struct hci_uart *hu, void *data, int count)
                         case H4_W4_DATA:
                                 BT_DBG("Complete data");
 
-                                BT_DMP(h4->rx_skb->data, h4->rx_skb->len);
-
                                 hci_recv_frame(h4->rx_skb);
 
                                 h4->rx_state = H4_W4_PACKET_TYPE;
@@ -244,7 +239,7 @@ static int h4_recv(struct hci_uart *hu, void *data, int count)
                         return 0;
                 }
                 h4->rx_skb->dev = (void *) hu->hdev;
-                h4->rx_skb->pkt_type = type;
+                bt_cb(h4->rx_skb)->pkt_type = type;
         }
         return count;
 }
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index f766bc22c6bb..aed80cc22890 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -57,8 +57,6 @@
 #ifndef CONFIG_BT_HCIUART_DEBUG
 #undef  BT_DBG
 #define BT_DBG( A... )
-#undef  BT_DMP
-#define BT_DMP( A... )
 #endif
 
 static int reset = 0;
@@ -155,7 +153,7 @@ restart:
                         break;
                 }
         
-                hci_uart_tx_complete(hu, skb->pkt_type);
+                hci_uart_tx_complete(hu, bt_cb(skb)->pkt_type);
                 kfree_skb(skb);
         } 
         
@@ -231,7 +229,7 @@ static int hci_uart_send_frame(struct sk_buff *skb)
         hu = (struct hci_uart *) hdev->driver_data;
         tty = hu->tty;
 
-        BT_DBG("%s: type %d len %d", hdev->name, skb->pkt_type, skb->len);
+        BT_DBG("%s: type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
 
         hu->proto->enqueue(hu, skb);
 
diff --git a/drivers/bluetooth/hci_usb.c b/drivers/bluetooth/hci_usb.c
index b120ecf7b8c9..67d96b5cbb96 100644
--- a/drivers/bluetooth/hci_usb.c
+++ b/drivers/bluetooth/hci_usb.c
@@ -57,8 +57,6 @@
 #ifndef CONFIG_BT_HCIUSB_DEBUG
 #undef  BT_DBG
 #define BT_DBG(D...)
-#undef  BT_DMP
-#define BT_DMP(D...)
 #endif
 
 #ifndef CONFIG_BT_HCIUSB_ZERO_PACKET
@@ -110,6 +108,9 @@ static struct usb_device_id blacklist_ids[] = {
         /* Microsoft Wireless Transceiver for Bluetooth 2.0 */
         { USB_DEVICE(0x045e, 0x009c), .driver_info = HCI_RESET },
 
+        /* Kensington Bluetooth USB adapter */
+        { USB_DEVICE(0x047d, 0x105d), .driver_info = HCI_RESET },
+
         /* ISSC Bluetooth Adapter v3.1 */
         { USB_DEVICE(0x1131, 0x1001), .driver_info = HCI_RESET },
 
@@ -126,7 +127,7 @@ static struct usb_device_id blacklist_ids[] = {
         { }     /* Terminating entry */
 };
 
-static struct _urb *_urb_alloc(int isoc, int gfp)
+static struct _urb *_urb_alloc(int isoc, unsigned int __nocast gfp)
 {
         struct _urb *_urb = kmalloc(sizeof(struct _urb) +
                                 sizeof(struct usb_iso_packet_descriptor) * isoc, gfp);
@@ -387,10 +388,8 @@ static void hci_usb_unlink_urbs(struct hci_usb *husb)
                         urb = &_urb->urb;
                         BT_DBG("%s freeing _urb %p type %d urb %p",
                                         husb->hdev->name, _urb, _urb->type, urb);
-                        if (urb->setup_packet)
-                                kfree(urb->setup_packet);
-                        if (urb->transfer_buffer)
-                                kfree(urb->transfer_buffer);
+                        kfree(urb->setup_packet);
+                        kfree(urb->transfer_buffer);
                         _urb_free(_urb);
                 }
 
@@ -444,7 +443,7 @@ static int __tx_submit(struct hci_usb *husb, struct _urb *_urb)
 
 static inline int hci_usb_send_ctrl(struct hci_usb *husb, struct sk_buff *skb)
 {
-        struct _urb *_urb = __get_completed(husb, skb->pkt_type);
+        struct _urb *_urb = __get_completed(husb, bt_cb(skb)->pkt_type);
         struct usb_ctrlrequest *dr;
         struct urb *urb;
 
@@ -452,7 +451,7 @@ static inline int hci_usb_send_ctrl(struct hci_usb *husb, struct sk_buff *skb)
                 _urb = _urb_alloc(0, GFP_ATOMIC);
                 if (!_urb)
                         return -ENOMEM;
-                _urb->type = skb->pkt_type;
+                _urb->type = bt_cb(skb)->pkt_type;
 
                 dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
                 if (!dr) {
@@ -480,7 +479,7 @@ static inline int hci_usb_send_ctrl(struct hci_usb *husb, struct sk_buff *skb)
 
 static inline int hci_usb_send_bulk(struct hci_usb *husb, struct sk_buff *skb)
 {
-        struct _urb *_urb = __get_completed(husb, skb->pkt_type);
+        struct _urb *_urb = __get_completed(husb, bt_cb(skb)->pkt_type);
         struct urb *urb;
         int pipe;
 
@@ -488,7 +487,7 @@ static inline int hci_usb_send_bulk(struct hci_usb *husb, struct sk_buff *skb)
                 _urb = _urb_alloc(0, GFP_ATOMIC);
                 if (!_urb)
                         return -ENOMEM;
-                _urb->type = skb->pkt_type;
+                _urb->type = bt_cb(skb)->pkt_type;
         }
 
         urb  = &_urb->urb;
@@ -506,14 +505,14 @@ static inline int hci_usb_send_bulk(struct hci_usb *husb, struct sk_buff *skb)
 #ifdef CONFIG_BT_HCIUSB_SCO
 static inline int hci_usb_send_isoc(struct hci_usb *husb, struct sk_buff *skb)
 {
-        struct _urb *_urb = __get_completed(husb, skb->pkt_type);
+        struct _urb *_urb = __get_completed(husb, bt_cb(skb)->pkt_type);
         struct urb *urb;
 
         if (!_urb) {
                 _urb = _urb_alloc(HCI_MAX_ISOC_FRAMES, GFP_ATOMIC);
                 if (!_urb)
                         return -ENOMEM;
-                _urb->type = skb->pkt_type;
+                _urb->type = bt_cb(skb)->pkt_type;
         }
 
         BT_DBG("%s skb %p len %d", husb->hdev->name, skb, skb->len);
@@ -602,11 +601,11 @@ static int hci_usb_send_frame(struct sk_buff *skb)
         if (!test_bit(HCI_RUNNING, &hdev->flags))
                 return -EBUSY;
 
-        BT_DBG("%s type %d len %d", hdev->name, skb->pkt_type, skb->len);
+        BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
 
         husb = (struct hci_usb *) hdev->driver_data;
 
-        switch (skb->pkt_type) {
+        switch (bt_cb(skb)->pkt_type) {
         case HCI_COMMAND_PKT:
                 hdev->stat.cmd_tx++;
                 break;
@@ -628,7 +627,7 @@ static int hci_usb_send_frame(struct sk_buff *skb)
 
         read_lock(&husb->completion_lock);
 
-        skb_queue_tail(__transmit_q(husb, skb->pkt_type), skb);
+        skb_queue_tail(__transmit_q(husb, bt_cb(skb)->pkt_type), skb);
         hci_usb_tx_wakeup(husb);
 
         read_unlock(&husb->completion_lock);
@@ -683,7 +682,7 @@ static inline int __recv_frame(struct hci_usb *husb, int type, void *data, int c
                                 return -ENOMEM;
                         }
                         skb->dev = (void *) husb->hdev;
-                        skb->pkt_type = type;
+                        bt_cb(skb)->pkt_type = type;
         
                         __reassembly(husb, type) = skb;
 
@@ -703,6 +702,7 @@ static inline int __recv_frame(struct hci_usb *husb, int type, void *data, int c
                 if (!scb->expect) {
                         /* Complete frame */
                         __reassembly(husb, type) = NULL;
+                        bt_cb(skb)->pkt_type = type;
                         hci_recv_frame(skb);
                 }
 
diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index f9b956fb2b8b..52cbd45c308f 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -1,229 +1,220 @@
-/* 
-   BlueZ - Bluetooth protocol stack for Linux
-   Copyright (C) 2000-2001 Qualcomm Incorporated
-
-   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
-
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License version 2 as
-   published by the Free Software Foundation;
-
-   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
-   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
-   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
-   SOFTWARE IS DISCLAIMED.
-*/
-
 /*
- * Bluetooth HCI virtual device driver.
  *
- * $Id: hci_vhci.c,v 1.3 2002/04/17 17:37:20 maxk Exp $ 
+ *  Bluetooth virtual HCI driver
+ *
+ *  Copyright (C) 2000-2001 Qualcomm Incorporated
+ *  Copyright (C) 2002-2003 Maxim Krasnyansky <maxk@qualcomm.com>
+ *  Copyright (C) 2004-2005 Marcel Holtmann <marcel@holtmann.org>
+ *
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
  */
-#define VERSION "1.1"
 
 #include <linux/config.h>
 #include <linux/module.h>
 
-#include <linux/errno.h>
 #include <linux/kernel.h>
-#include <linux/major.h>
-#include <linux/sched.h>
+#include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/sched.h>
 #include <linux/poll.h>
-#include <linux/fcntl.h>
-#include <linux/init.h>
-#include <linux/random.h>
 
 #include <linux/skbuff.h>
 #include <linux/miscdevice.h>
 
-#include <asm/system.h>
-#include <asm/uaccess.h>
-
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
-#include "hci_vhci.h"
 
-/* HCI device part */
+#ifndef CONFIG_BT_HCIVHCI_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
+#define VERSION "1.2"
+
+static int minor = MISC_DYNAMIC_MINOR;
+
+struct vhci_data {
+        struct hci_dev *hdev;
+
+        unsigned long flags;
+
+        wait_queue_head_t read_wait;
+        struct sk_buff_head readq;
+
+        struct fasync_struct *fasync;
+};
 
-static int hci_vhci_open(struct hci_dev *hdev)
+#define VHCI_FASYNC     0x0010
+
+static struct miscdevice vhci_miscdev;
+
+static int vhci_open_dev(struct hci_dev *hdev)
 {
         set_bit(HCI_RUNNING, &hdev->flags);
-        return 0;
-}
 
-static int hci_vhci_flush(struct hci_dev *hdev)
-{
-        struct hci_vhci_struct *hci_vhci = (struct hci_vhci_struct *) hdev->driver_data;
-        skb_queue_purge(&hci_vhci->readq);
         return 0;
 }
 
-static int hci_vhci_close(struct hci_dev *hdev)
+static int vhci_close_dev(struct hci_dev *hdev)
 {
+        struct vhci_data *vhci = hdev->driver_data;
+
         if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
                 return 0;
 
-        hci_vhci_flush(hdev);
+        skb_queue_purge(&vhci->readq);
+
         return 0;
 }
 
-static void hci_vhci_destruct(struct hci_dev *hdev)
+static int vhci_flush(struct hci_dev *hdev)
 {
-        struct hci_vhci_struct *vhci;
+        struct vhci_data *vhci = hdev->driver_data;
 
-        if (!hdev) return;
+        skb_queue_purge(&vhci->readq);
 
-        vhci = (struct hci_vhci_struct *) hdev->driver_data;
-        kfree(vhci);
+        return 0;
 }
 
-static int hci_vhci_send_frame(struct sk_buff *skb)
+static int vhci_send_frame(struct sk_buff *skb)
 {
         struct hci_dev* hdev = (struct hci_dev *) skb->dev;
-        struct hci_vhci_struct *hci_vhci;
+        struct vhci_data *vhci;
 
         if (!hdev) {
-                BT_ERR("Frame for uknown device (hdev=NULL)");
+                BT_ERR("Frame for unknown HCI device (hdev=NULL)");
                 return -ENODEV;
         }
 
         if (!test_bit(HCI_RUNNING, &hdev->flags))
                 return -EBUSY;
 
-        hci_vhci = (struct hci_vhci_struct *) hdev->driver_data;
+        vhci = hdev->driver_data;
+
+        memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
+        skb_queue_tail(&vhci->readq, skb);
 
-        memcpy(skb_push(skb, 1), &skb->pkt_type, 1);
-        skb_queue_tail(&hci_vhci->readq, skb);
+        if (vhci->flags & VHCI_FASYNC)
+                kill_fasync(&vhci->fasync, SIGIO, POLL_IN);
 
-        if (hci_vhci->flags & VHCI_FASYNC)
-                kill_fasync(&hci_vhci->fasync, SIGIO, POLL_IN);
-        wake_up_interruptible(&hci_vhci->read_wait);
+        wake_up_interruptible(&vhci->read_wait);
 
         return 0;
 }
 
-/* Character device part */
-
-/* Poll */
-static unsigned int hci_vhci_chr_poll(struct file *file, poll_table * wait)
-{  
-        struct hci_vhci_struct *hci_vhci = (struct hci_vhci_struct *) file->private_data;
-
-        poll_wait(file, &hci_vhci->read_wait, wait);
- 
-        if (!skb_queue_empty(&hci_vhci->readq))
-                return POLLIN | POLLRDNORM;
-
-        return POLLOUT | POLLWRNORM;
+static void vhci_destruct(struct hci_dev *hdev)
+{
+        kfree(hdev->driver_data);
 }
 
-/* Get packet from user space buffer(already verified) */
-static inline ssize_t hci_vhci_get_user(struct hci_vhci_struct *hci_vhci, const char __user *buf, size_t count)
+static inline ssize_t vhci_get_user(struct vhci_data *vhci,
+                                        const char __user *buf, size_t count)
 {
         struct sk_buff *skb;
 
         if (count > HCI_MAX_FRAME_SIZE)
                 return -EINVAL;
 
-        if (!(skb = bt_skb_alloc(count, GFP_KERNEL)))
+        skb = bt_skb_alloc(count, GFP_KERNEL);
+        if (!skb)
                 return -ENOMEM;
-        
+
         if (copy_from_user(skb_put(skb, count), buf, count)) {
                 kfree_skb(skb);
                 return -EFAULT;
         }
 
-        skb->dev = (void *) hci_vhci->hdev;
-        skb->pkt_type = *((__u8 *) skb->data);
+        skb->dev = (void *) vhci->hdev;
+        bt_cb(skb)->pkt_type = *((__u8 *) skb->data);
         skb_pull(skb, 1);
 
         hci_recv_frame(skb);
 
         return count;
-} 
-
-/* Write */
-static ssize_t hci_vhci_chr_write(struct file * file, const char __user * buf, 
-                             size_t count, loff_t *pos)
-{
-        struct hci_vhci_struct *hci_vhci = (struct hci_vhci_struct *) file->private_data;
-
-        if (!access_ok(VERIFY_READ, buf, count))
-                return -EFAULT;
-
-        return hci_vhci_get_user(hci_vhci, buf, count);
 }
 
-/* Put packet to user space buffer(already verified) */
-static inline ssize_t hci_vhci_put_user(struct hci_vhci_struct *hci_vhci,
-                                       struct sk_buff *skb, char __user *buf,
-                                       int count)
+static inline ssize_t vhci_put_user(struct vhci_data *vhci,
+                        struct sk_buff *skb, char __user *buf, int count)
 {
-        int len = count, total = 0;
         char __user *ptr = buf;
+        int len, total = 0;
+
+        len = min_t(unsigned int, skb->len, count);
 
-        len = min_t(unsigned int, skb->len, len);
         if (copy_to_user(ptr, skb->data, len))
                 return -EFAULT;
+
         total += len;
 
-        hci_vhci->hdev->stat.byte_tx += len;
-        switch (skb->pkt_type) {
-                case HCI_COMMAND_PKT:
-                        hci_vhci->hdev->stat.cmd_tx++;
-                        break;
+        vhci->hdev->stat.byte_tx += len;
 
-                case HCI_ACLDATA_PKT:
-                        hci_vhci->hdev->stat.acl_tx++;
-                        break;
+        switch (bt_cb(skb)->pkt_type) {
+        case HCI_COMMAND_PKT:
+                vhci->hdev->stat.cmd_tx++;
+                break;
+
+        case HCI_ACLDATA_PKT:
+                vhci->hdev->stat.acl_tx++;
+                break;
 
-                case HCI_SCODATA_PKT:
-                        hci_vhci->hdev->stat.cmd_tx++;
-                        break;
+        case HCI_SCODATA_PKT:
+                vhci->hdev->stat.cmd_tx++;
+                break;
         };
 
         return total;
 }
 
-/* Read */
-static ssize_t hci_vhci_chr_read(struct file * file, char __user * buf, size_t count, loff_t *pos)
+static loff_t vhci_llseek(struct file * file, loff_t offset, int origin)
+{
+        return -ESPIPE;
+}
+
+static ssize_t vhci_read(struct file * file, char __user * buf, size_t count, loff_t *pos)
 {
-        struct hci_vhci_struct *hci_vhci = (struct hci_vhci_struct *) file->private_data;
         DECLARE_WAITQUEUE(wait, current);
+        struct vhci_data *vhci = file->private_data;
         struct sk_buff *skb;
         ssize_t ret = 0;
 
-        add_wait_queue(&hci_vhci->read_wait, &wait);
+        add_wait_queue(&vhci->read_wait, &wait);
         while (count) {
                 set_current_state(TASK_INTERRUPTIBLE);
 
-                /* Read frames from device queue */
-                if (!(skb = skb_dequeue(&hci_vhci->readq))) {
+                skb = skb_dequeue(&vhci->readq);
+                if (!skb) {
                         if (file->f_flags & O_NONBLOCK) {
                                 ret = -EAGAIN;
                                 break;
                         }
+
                         if (signal_pending(current)) {
                                 ret = -ERESTARTSYS;
                                 break;
                         }
 
-                        /* Nothing to read, let's sleep */
                         schedule();
                         continue;
                 }
 
                 if (access_ok(VERIFY_WRITE, buf, count))
-                        ret = hci_vhci_put_user(hci_vhci, skb, buf, count);
+                        ret = vhci_put_user(vhci, skb, buf, count);
                 else
                         ret = -EFAULT;
 
@@ -231,84 +222,90 @@ static ssize_t hci_vhci_chr_read(struct file * file, char __user * buf, size_t c
                 break;
         }
         set_current_state(TASK_RUNNING);
-        remove_wait_queue(&hci_vhci->read_wait, &wait);
+        remove_wait_queue(&vhci->read_wait, &wait);
 
         return ret;
 }
 
-static loff_t hci_vhci_chr_lseek(struct file * file, loff_t offset, int origin)
+static ssize_t vhci_write(struct file *file,
+                        const char __user *buf, size_t count, loff_t *pos)
 {
-        return -ESPIPE;
-}
+        struct vhci_data *vhci = file->private_data;
 
-static int hci_vhci_chr_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
-{
-        return -EINVAL;
+        if (!access_ok(VERIFY_READ, buf, count))
+                return -EFAULT;
+
+        return vhci_get_user(vhci, buf, count);
 }
 
-static int hci_vhci_chr_fasync(int fd, struct file *file, int on)
+static unsigned int vhci_poll(struct file *file, poll_table *wait)
 {
-        struct hci_vhci_struct *hci_vhci = (struct hci_vhci_struct *) file->private_data;
-        int ret;
+        struct vhci_data *vhci = file->private_data;
 
-        if ((ret = fasync_helper(fd, file, on, &hci_vhci->fasync)) < 0)
-                return ret; 
- 
-        if (on)
-                hci_vhci->flags |= VHCI_FASYNC;
-        else 
-                hci_vhci->flags &= ~VHCI_FASYNC;
+        poll_wait(file, &vhci->read_wait, wait);
 
-        return 0;
+        if (!skb_queue_empty(&vhci->readq))
+                return POLLIN | POLLRDNORM;
+
+        return POLLOUT | POLLWRNORM;
 }
 
-static int hci_vhci_chr_open(struct inode *inode, struct file * file)
+static int vhci_ioctl(struct inode *inode, struct file *file,
+                                        unsigned int cmd, unsigned long arg)
 {
-        struct hci_vhci_struct *hci_vhci = NULL; 
+        return -EINVAL;
+}
+
+static int vhci_open(struct inode *inode, struct file *file)
+{
+        struct vhci_data *vhci;
         struct hci_dev *hdev;
 
-        if (!(hci_vhci = kmalloc(sizeof(struct hci_vhci_struct), GFP_KERNEL)))
+        vhci = kmalloc(sizeof(struct vhci_data), GFP_KERNEL);
+        if (!vhci)
                 return -ENOMEM;
 
-        memset(hci_vhci, 0, sizeof(struct hci_vhci_struct));
+        memset(vhci, 0, sizeof(struct vhci_data));
 
-        skb_queue_head_init(&hci_vhci->readq);
-        init_waitqueue_head(&hci_vhci->read_wait);
+        skb_queue_head_init(&vhci->readq);
+        init_waitqueue_head(&vhci->read_wait);
 
-        /* Initialize and register HCI device */
         hdev = hci_alloc_dev();
         if (!hdev) {
-                kfree(hci_vhci);
+                kfree(vhci);
                 return -ENOMEM;
         }
 
-        hci_vhci->hdev = hdev;
+        vhci->hdev = hdev;
 
         hdev->type = HCI_VHCI;
-        hdev->driver_data = hci_vhci;
+        hdev->driver_data = vhci;
+        SET_HCIDEV_DEV(hdev, vhci_miscdev.dev);
 
-        hdev->open  = hci_vhci_open;
-        hdev->close = hci_vhci_close;
-        hdev->flush = hci_vhci_flush;
-        hdev->send  = hci_vhci_send_frame;
-        hdev->destruct = hci_vhci_destruct;
+        hdev->open     = vhci_open_dev;
+        hdev->close    = vhci_close_dev;
+        hdev->flush    = vhci_flush;
+        hdev->send     = vhci_send_frame;
+        hdev->destruct = vhci_destruct;
 
         hdev->owner = THIS_MODULE;
-        
+
         if (hci_register_dev(hdev) < 0) {
-                kfree(hci_vhci);
+                BT_ERR("Can't register HCI device");
+                kfree(vhci);
                 hci_free_dev(hdev);
                 return -EBUSY;
         }
 
-        file->private_data = hci_vhci;
-        return nonseekable_open(inode, file);   
+        file->private_data = vhci;
+
+        return nonseekable_open(inode, file);
 }
 
-static int hci_vhci_chr_close(struct inode *inode, struct file *file)
+static int vhci_release(struct inode *inode, struct file *file)
 {
-        struct hci_vhci_struct *hci_vhci = (struct hci_vhci_struct *) file->private_data;
-        struct hci_dev *hdev = hci_vhci->hdev;
+        struct vhci_data *vhci = file->private_data;
+        struct hci_dev *hdev = vhci->hdev;
 
         if (hci_unregister_dev(hdev) < 0) {
                 BT_ERR("Can't unregister HCI device %s", hdev->name);
@@ -317,48 +314,71 @@ static int hci_vhci_chr_close(struct inode *inode, struct file *file)
         hci_free_dev(hdev);
 
         file->private_data = NULL;
+
         return 0;
 }
 
-static struct file_operations hci_vhci_fops = {
-        .owner  = THIS_MODULE,  
-        .llseek = hci_vhci_chr_lseek,
-        .read   = hci_vhci_chr_read,
-        .write  = hci_vhci_chr_write,
-        .poll   = hci_vhci_chr_poll,
-        .ioctl  = hci_vhci_chr_ioctl,
-        .open   = hci_vhci_chr_open,
-        .release        = hci_vhci_chr_close,
-        .fasync = hci_vhci_chr_fasync           
+static int vhci_fasync(int fd, struct file *file, int on)
+{
+        struct vhci_data *vhci = file->private_data;
+        int err;
+
+        err = fasync_helper(fd, file, on, &vhci->fasync);
+        if (err < 0)
+                return err;
+
+        if (on)
+                vhci->flags |= VHCI_FASYNC;
+        else
+                vhci->flags &= ~VHCI_FASYNC;
+
+        return 0;
+}
+
+static struct file_operations vhci_fops = {
+        .owner          = THIS_MODULE,
+        .llseek         = vhci_llseek,
+        .read           = vhci_read,
+        .write          = vhci_write,
+        .poll           = vhci_poll,
+        .ioctl          = vhci_ioctl,
+        .open           = vhci_open,
+        .release        = vhci_release,
+        .fasync         = vhci_fasync,
 };
 
-static struct miscdevice hci_vhci_miscdev=
-{
-        VHCI_MINOR,
-        "hci_vhci",
-        &hci_vhci_fops
+static struct miscdevice vhci_miscdev= {
+        .name           = "vhci",
+        .fops           = &vhci_fops,
 };
 
-static int __init hci_vhci_init(void)
+static int __init vhci_init(void)
 {
-        BT_INFO("VHCI driver ver %s", VERSION);
+        BT_INFO("Virtual HCI driver ver %s", VERSION);
 
-        if (misc_register(&hci_vhci_miscdev)) {
-                BT_ERR("Can't register misc device %d\n", VHCI_MINOR);
+        vhci_miscdev.minor = minor;
+
+        if (misc_register(&vhci_miscdev) < 0) {
+                BT_ERR("Can't register misc device with minor %d", minor);
                 return -EIO;
         }
 
         return 0;
 }
 
-static void hci_vhci_cleanup(void)
+static void __exit vhci_exit(void)
 {
-        misc_deregister(&hci_vhci_miscdev);
+        if (misc_deregister(&vhci_miscdev) < 0)
+                BT_ERR("Can't unregister misc device with minor %d", minor);
 }
 
-module_init(hci_vhci_init);
-module_exit(hci_vhci_cleanup);
+module_init(vhci_init);
+module_exit(vhci_exit);
+
+module_param(minor, int, 0444);
+MODULE_PARM_DESC(minor, "Miscellaneous minor device number");
 
-MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>");
-MODULE_DESCRIPTION("Bluetooth VHCI driver ver " VERSION);
-MODULE_LICENSE("GPL"); 
+MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
+MODULE_DESCRIPTION("Bluetooth virtual HCI driver ver " VERSION);
+MODULE_VERSION(VERSION);
+MODULE_LICENSE("GPL");
diff --git a/drivers/bluetooth/hci_vhci.h b/drivers/bluetooth/hci_vhci.h
deleted file mode 100644
index 53b11f9ef76d..000000000000
--- a/drivers/bluetooth/hci_vhci.h
+++ /dev/null
@@ -1,50 +0,0 @@
-/* 
-   BlueZ - Bluetooth protocol stack for Linux
-   Copyright (C) 2000-2001 Qualcomm Incorporated
-
-   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
-
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License version 2 as
-   published by the Free Software Foundation;
-
-   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
-   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
-   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
-   SOFTWARE IS DISCLAIMED.
-*/
-
-/*
- * $Id: hci_vhci.h,v 1.1.1.1 2002/03/08 21:03:15 maxk Exp $
- */
-
-#ifndef __HCI_VHCI_H
-#define __HCI_VHCI_H
-
-#ifdef __KERNEL__
-
-struct hci_vhci_struct {
-        struct hci_dev       *hdev;
-        __u32                flags;
-        wait_queue_head_t    read_wait;
-        struct sk_buff_head  readq;
-        struct fasync_struct *fasync;
-};
-
-/* VHCI device flags */
-#define VHCI_FASYNC             0x0010
-
-#endif /* __KERNEL__ */
-
-#define VHCI_DEV        "/dev/vhci"
-#define VHCI_MINOR      250
-
-#endif /* __HCI_VHCI_H */
diff --git a/drivers/cdrom/viocd.c b/drivers/cdrom/viocd.c
index 38dd9ffbe8bc..0829db58462f 100644
--- a/drivers/cdrom/viocd.c
+++ b/drivers/cdrom/viocd.c
@@ -734,7 +734,7 @@ static int viocd_remove(struct vio_dev *vdev)
  */
 static struct vio_device_id viocd_device_table[] __devinitdata = {
         { "viocd", "" },
-        { 0, }
+        { "", "" }
 };
 
 MODULE_DEVICE_TABLE(vio, viocd_device_table);
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 4f27e5519296..7333b41d4224 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -80,7 +80,7 @@ config SERIAL_NONSTANDARD
 
 config COMPUTONE
         tristate "Computone IntelliPort Plus serial support"
-        depends on SERIAL_NONSTANDARD && BROKEN_ON_SMP
+        depends on SERIAL_NONSTANDARD && BROKEN_ON_SMP && (BROKEN || !SPARC32)
         ---help---
           This driver supports the entire family of Intelliport II/Plus
           controllers with the exception of the MicroChannel controllers and
@@ -138,7 +138,7 @@ config CYZ_INTR
 
 config DIGIEPCA
         tristate "Digiboard Intelligent Async Support"
-        depends on SERIAL_NONSTANDARD && BROKEN_ON_SMP
+        depends on SERIAL_NONSTANDARD && BROKEN_ON_SMP && (!64BIT || BROKEN)
         ---help---
           This is a driver for Digi International's Xx, Xeve, and Xem series
           of cards which provide multiple serial ports. You would need
@@ -208,7 +208,7 @@ config SYNCLINK
 
 config SYNCLINKMP
         tristate "SyncLink Multiport support"
-        depends on SERIAL_NONSTANDARD
+        depends on SERIAL_NONSTANDARD && (BROKEN || !SPARC32)
         help
           Enable support for the SyncLink Multiport (2 or 4 ports)
           serial adapter, running asynchronous and HDLC communications up
@@ -735,7 +735,7 @@ config SGI_IP27_RTC
 
 config GEN_RTC
         tristate "Generic /dev/rtc emulation"
-        depends on RTC!=y && !IA64 && !ARM && !PPC64
+        depends on RTC!=y && !IA64 && !ARM && !PPC64 && !M32R && !SPARC32
         ---help---
           If you say Y here and create a character special file /dev/rtc with
           major number 10 and minor number 135 using mknod ("man mknod"), you
diff --git a/drivers/char/drm/Kconfig b/drivers/char/drm/Kconfig
index 123417e43040..56ace9d5e2ae 100644
--- a/drivers/char/drm/Kconfig
+++ b/drivers/char/drm/Kconfig
@@ -23,13 +23,6 @@ config DRM_TDFX
           Choose this option if you have a 3dfx Banshee or Voodoo3 (or later),
           graphics card.  If M is selected, the module will be called tdfx.
 
-config DRM_GAMMA
-        tristate "3dlabs GMX 2000"
-        depends on DRM && BROKEN
-        help
-          This is the old gamma driver, please tell me if it might actually
-          work.
-
 config DRM_R128
         tristate "ATI Rage 128"
         depends on DRM && PCI
@@ -82,7 +75,7 @@ endchoice
 
 config DRM_MGA
         tristate "Matrox g200/g400"
-        depends on DRM && AGP
+        depends on DRM
         help
           Choose this option if you have a Matrox G200, G400 or G450 graphics
           card.  If M is selected, the module will be called mga.  AGP
@@ -103,3 +96,10 @@ config DRM_VIA
           Choose this option if you have a Via unichrome or compatible video
           chipset. If M is selected the module will be called via.
 
+config DRM_SAVAGE
+        tristate "Savage video cards"
+        depends on DRM
+        help
+          Choose this option if you have a Savage3D/4/SuperSavage/Pro/Twister
+          chipset. If M is selected the module will be called savage.
+
diff --git a/drivers/char/drm/Makefile b/drivers/char/drm/Makefile
index ddd941045b1f..e41060c76226 100644
--- a/drivers/char/drm/Makefile
+++ b/drivers/char/drm/Makefile
@@ -8,16 +8,16 @@ drm-objs    :=	drm_auth.o drm_bufs.o drm_context.o drm_dma.o drm_drawable.o \
                 drm_agpsupport.o drm_scatter.o ati_pcigart.o drm_pci.o \
                 drm_sysfs.o
 
-gamma-objs  := gamma_drv.o gamma_dma.o
 tdfx-objs   := tdfx_drv.o
 r128-objs   := r128_drv.o r128_cce.o r128_state.o r128_irq.o
 mga-objs    := mga_drv.o mga_dma.o mga_state.o mga_warp.o mga_irq.o
 i810-objs   := i810_drv.o i810_dma.o
 i830-objs   := i830_drv.o i830_dma.o i830_irq.o
 i915-objs   := i915_drv.o i915_dma.o i915_irq.o i915_mem.o
-radeon-objs := radeon_drv.o radeon_cp.o radeon_state.o radeon_mem.o radeon_irq.o
+radeon-objs := radeon_drv.o radeon_cp.o radeon_state.o radeon_mem.o radeon_irq.o r300_cmdbuf.o
 ffb-objs    := ffb_drv.o ffb_context.o
 sis-objs    := sis_drv.o sis_ds.o sis_mm.o
+savage-objs := savage_drv.o savage_bci.o savage_state.o
 via-objs    := via_irq.o via_drv.o via_ds.o via_map.o via_mm.o via_dma.o via_verifier.o via_video.o
 
 ifeq ($(CONFIG_COMPAT),y)
@@ -29,7 +29,6 @@ i915-objs   += i915_ioc32.o
 endif
 
 obj-$(CONFIG_DRM)       += drm.o
-obj-$(CONFIG_DRM_GAMMA) += gamma.o
 obj-$(CONFIG_DRM_TDFX)  += tdfx.o
 obj-$(CONFIG_DRM_R128)  += r128.o
 obj-$(CONFIG_DRM_RADEON)+= radeon.o
@@ -39,5 +38,7 @@ obj-$(CONFIG_DRM_I830)	+= i830.o
 obj-$(CONFIG_DRM_I915)  += i915.o
 obj-$(CONFIG_DRM_FFB)   += ffb.o
 obj-$(CONFIG_DRM_SIS)   += sis.o
+obj-$(CONFIG_DRM_SAVAGE)+= savage.o
 obj-$(CONFIG_DRM_VIA)   +=via.o
 
+
diff --git a/drivers/char/drm/drm.h b/drivers/char/drm/drm.h
index e8371dd87fbc..fc6598a81acd 100644
--- a/drivers/char/drm/drm.h
+++ b/drivers/char/drm/drm.h
@@ -98,7 +98,7 @@
 #define _DRM_LOCKING_CONTEXT(lock) ((lock) & ~(_DRM_LOCK_HELD|_DRM_LOCK_CONT))
 
 
-typedef unsigned long drm_handle_t;
+typedef unsigned int  drm_handle_t;
 typedef unsigned int  drm_context_t;
 typedef unsigned int  drm_drawable_t;
 typedef unsigned int  drm_magic_t;
@@ -209,7 +209,8 @@ typedef enum drm_map_type {
         _DRM_REGISTERS      = 1,  /**< no caching, no core dump */
         _DRM_SHM            = 2,  /**< shared, cached */
         _DRM_AGP            = 3,  /**< AGP/GART */
-        _DRM_SCATTER_GATHER = 4   /**< Scatter/gather memory for PCI DMA */
+        _DRM_SCATTER_GATHER = 4,  /**< Scatter/gather memory for PCI DMA */
+        _DRM_CONSISTENT     = 5,  /**< Consistent memory for PCI DMA */
 } drm_map_type_t;
 
 
@@ -368,7 +369,8 @@ typedef struct drm_buf_desc {
         enum {
                 _DRM_PAGE_ALIGN = 0x01, /**< Align on page boundaries for DMA */
                 _DRM_AGP_BUFFER = 0x02, /**< Buffer is in AGP space */
-                _DRM_SG_BUFFER  = 0x04  /**< Scatter/gather memory buffer */
+                _DRM_SG_BUFFER  = 0x04, /**< Scatter/gather memory buffer */
+                _DRM_FB_BUFFER  = 0x08  /**< Buffer is in frame buffer */
         }             flags;
         unsigned long agp_start; /**< 
                                   * Start address of where the AGP buffers are
diff --git a/drivers/char/drm/drmP.h b/drivers/char/drm/drmP.h
index 5df09cc8c6db..6f98701dfe15 100644
--- a/drivers/char/drm/drmP.h
+++ b/drivers/char/drm/drmP.h
@@ -53,7 +53,6 @@
 #include <linux/init.h>
 #include <linux/file.h>
 #include <linux/pci.h>
-#include <linux/version.h>
 #include <linux/jiffies.h>
 #include <linux/smp_lock.h>     /* For (un)lock_kernel */
 #include <linux/mm.h>
@@ -96,6 +95,7 @@
 #define DRIVER_IRQ_SHARED  0x80
 #define DRIVER_IRQ_VBL     0x100
 #define DRIVER_DMA_QUEUE   0x200
+#define DRIVER_FB_DMA      0x400
 
 /***********************************************************************/
 /** \name Begin the DRM... */
@@ -160,36 +160,7 @@
 #define pte_unmap(pte)
 #endif
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,4,19)
-static inline struct page * vmalloc_to_page(void * vmalloc_addr)
-{
-        unsigned long addr = (unsigned long) vmalloc_addr;
-        struct page *page = NULL;
-        pgd_t *pgd = pgd_offset_k(addr);
-        pmd_t *pmd;
-        pte_t *ptep, pte;
-  
-        if (!pgd_none(*pgd)) {
-                pmd = pmd_offset(pgd, addr);
-                if (!pmd_none(*pmd)) {
-                        preempt_disable();
-                        ptep = pte_offset_map(pmd, addr);
-                        pte = *ptep;
-                        if (pte_present(pte))
-                                page = pte_page(pte);
-                        pte_unmap(ptep);
-                        preempt_enable();
-                }
-        }
-        return page;
-}
-#endif
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
-#define DRM_RPR_ARG(vma)
-#else
 #define DRM_RPR_ARG(vma) vma,
-#endif
 
 #define VM_OFFSET(vma) ((vma)->vm_pgoff << PAGE_SHIFT)
 
@@ -474,7 +445,8 @@ typedef struct drm_device_dma {
         unsigned long     byte_count;
         enum {
                 _DRM_DMA_USE_AGP = 0x01,
-                _DRM_DMA_USE_SG  = 0x02
+                _DRM_DMA_USE_SG  = 0x02,
+                _DRM_DMA_USE_FB  = 0x04
         } flags;
 
 } drm_device_dma_t;
@@ -525,12 +497,19 @@ typedef struct drm_sigdata {
         drm_hw_lock_t *lock;
 } drm_sigdata_t;
 
+typedef struct drm_dma_handle {
+        dma_addr_t busaddr;
+        void *vaddr;
+        size_t size;
+} drm_dma_handle_t;
+
 /**
  * Mappings list
  */
 typedef struct drm_map_list {
         struct list_head        head;   /**< list head */
         drm_map_t               *map;   /**< mapping */
+        unsigned int user_token;
 } drm_map_list_t;
 
 typedef drm_map_t drm_local_map_t;
@@ -578,7 +557,22 @@ struct drm_driver {
         int (*kernel_context_switch)(struct drm_device *dev, int old, int new);
         void (*kernel_context_switch_unlock)(struct drm_device *dev, drm_lock_t *lock);
         int (*vblank_wait)(struct drm_device *dev, unsigned int *sequence);
+        
+        /**
+         * Called by \c drm_device_is_agp.  Typically used to determine if a
+         * card is really attached to AGP or not.
+         *
+         * \param dev  DRM device handle
+         *
+         * \returns
+         * One of three values is returned depending on whether or not the
+         * card is absolutely \b not AGP (return of 0), absolutely \b is AGP
+         * (return of 1), or may or may not be AGP (return of 2).
+         */
+        int (*device_is_agp) (struct drm_device * dev);
+
         /* these have to be filled in */
+  
         int (*postinit)(struct drm_device *, unsigned long flags);
         irqreturn_t (*irq_handler)( DRM_IRQ_ARGS );
         void (*irq_preinstall)(struct drm_device *dev);
@@ -722,12 +716,8 @@ typedef struct drm_device {
         int               pci_slot;     /**< PCI slot number */
         int               pci_func;     /**< PCI function number */
 #ifdef __alpha__
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,4,3)
-        struct pci_controler *hose;
-#else
         struct pci_controller *hose;
 #endif
-#endif
         drm_sg_mem_t      *sg;  /**< Scatter gather memory */
         unsigned long     *ctx_bitmap;  /**< context bitmap */
         void              *dev_private; /**< device private data */
@@ -736,6 +726,7 @@ typedef struct drm_device {
 
         struct            drm_driver *driver;
         drm_local_map_t   *agp_buffer_map;
+        unsigned int agp_buffer_token;
         drm_head_t primary;             /**< primary screen head */
 } drm_device_t;
 
@@ -806,7 +797,7 @@ extern void	     *drm_ioremap_nocache(unsigned long offset, unsigned long size,
                                            drm_device_t *dev);
 extern void          drm_ioremapfree(void *pt, unsigned long size, drm_device_t *dev);
 
-extern DRM_AGP_MEM   *drm_alloc_agp(struct agp_bridge_data *bridge, int pages, u32 type);
+extern DRM_AGP_MEM   *drm_alloc_agp(drm_device_t *dev, int pages, u32 type);
 extern int           drm_free_agp(DRM_AGP_MEM *handle, int pages);
 extern int           drm_bind_agp(DRM_AGP_MEM *handle, unsigned int start);
 extern int           drm_unbind_agp(DRM_AGP_MEM *handle);
@@ -881,11 +872,19 @@ extern int	     drm_lock_free(drm_device_t *dev,
                                     unsigned int context);
 
                                 /* Buffer management support (drm_bufs.h) */
+extern int drm_addbufs_agp(drm_device_t *dev, drm_buf_desc_t *request);
+extern int drm_addbufs_pci(drm_device_t *dev, drm_buf_desc_t *request);
+extern int drm_addmap(drm_device_t *dev, unsigned int offset,
+                      unsigned int size, drm_map_type_t type,
+                      drm_map_flags_t flags, drm_local_map_t **map_ptr);
+extern int drm_addmap_ioctl(struct inode *inode, struct file *filp,
+                            unsigned int cmd, unsigned long arg);
+extern int drm_rmmap(drm_device_t *dev, drm_local_map_t *map);
+extern int drm_rmmap_locked(drm_device_t *dev, drm_local_map_t *map);
+extern int drm_rmmap_ioctl(struct inode *inode, struct file *filp,
+                           unsigned int cmd, unsigned long arg);
+
 extern int           drm_order( unsigned long size );
-extern int           drm_addmap( struct inode *inode, struct file *filp,
-                                  unsigned int cmd, unsigned long arg );
-extern int           drm_rmmap( struct inode *inode, struct file *filp,
-                                 unsigned int cmd, unsigned long arg );
 extern int           drm_addbufs( struct inode *inode, struct file *filp,
                                    unsigned int cmd, unsigned long arg );
 extern int           drm_infobufs( struct inode *inode, struct file *filp,
@@ -896,6 +895,10 @@ extern int	     drm_freebufs( struct inode *inode, struct file *filp,
                                     unsigned int cmd, unsigned long arg );
 extern int           drm_mapbufs( struct inode *inode, struct file *filp,
                                    unsigned int cmd, unsigned long arg );
+extern unsigned long drm_get_resource_start(drm_device_t *dev,
+                                            unsigned int resource);
+extern unsigned long drm_get_resource_len(drm_device_t *dev,
+                                          unsigned int resource);
 
                                 /* DMA support (drm_dma.h) */
 extern int           drm_dma_setup(drm_device_t *dev);
@@ -919,15 +922,18 @@ extern void          drm_vbl_send_signals( drm_device_t *dev );
 
                                 /* AGP/GART support (drm_agpsupport.h) */
 extern drm_agp_head_t *drm_agp_init(drm_device_t *dev);
-extern int            drm_agp_acquire(struct inode *inode, struct file *filp,
-                                       unsigned int cmd, unsigned long arg);
-extern void           drm_agp_do_release(drm_device_t *dev);
-extern int            drm_agp_release(struct inode *inode, struct file *filp,
-                                       unsigned int cmd, unsigned long arg);
-extern int            drm_agp_enable(struct inode *inode, struct file *filp,
-                                      unsigned int cmd, unsigned long arg);
-extern int            drm_agp_info(struct inode *inode, struct file *filp,
-                                    unsigned int cmd, unsigned long arg);
+extern int drm_agp_acquire(drm_device_t * dev);
+extern int drm_agp_acquire_ioctl(struct inode *inode, struct file *filp,
+                           unsigned int cmd, unsigned long arg);
+extern int drm_agp_release(drm_device_t *dev);
+extern int drm_agp_release_ioctl(struct inode *inode, struct file *filp,
+                           unsigned int cmd, unsigned long arg);
+extern int drm_agp_enable(drm_device_t *dev, drm_agp_mode_t mode);
+extern int drm_agp_enable_ioctl(struct inode *inode, struct file *filp,
+                          unsigned int cmd, unsigned long arg);
+extern int drm_agp_info(drm_device_t * dev, drm_agp_info_t *info);
+extern int drm_agp_info_ioctl(struct inode *inode, struct file *filp,
+                        unsigned int cmd, unsigned long arg);
 extern int            drm_agp_alloc(struct inode *inode, struct file *filp,
                                      unsigned int cmd, unsigned long arg);
 extern int            drm_agp_free(struct inode *inode, struct file *filp,
@@ -976,12 +982,10 @@ extern int            drm_ati_pcigart_cleanup(drm_device_t *dev,
                                                unsigned long addr,
                                                dma_addr_t bus_addr);
 
-extern void *drm_pci_alloc(drm_device_t * dev, size_t size,
-                           size_t align, dma_addr_t maxaddr,
-                           dma_addr_t * busaddr);
-
-extern void drm_pci_free(drm_device_t * dev, size_t size,
-                         void *vaddr, dma_addr_t busaddr);
+extern drm_dma_handle_t *drm_pci_alloc(drm_device_t *dev, size_t size,
+                                       size_t align, dma_addr_t maxaddr);
+extern void __drm_pci_free(drm_device_t *dev, drm_dma_handle_t *dmah);
+extern void drm_pci_free(drm_device_t *dev, drm_dma_handle_t *dmah);
 
                                /* sysfs support (drm_sysfs.c) */
 struct drm_sysfs_class;
@@ -1012,17 +1016,26 @@ static __inline__ void drm_core_ioremapfree(struct drm_map *map, struct drm_devi
                 drm_ioremapfree( map->handle, map->size, dev );
 }
 
-static __inline__ struct drm_map *drm_core_findmap(struct drm_device *dev, unsigned long offset)
+static __inline__ struct drm_map *drm_core_findmap(struct drm_device *dev, unsigned int token)
 {
-        struct list_head *_list;
-        list_for_each( _list, &dev->maplist->head ) {
-                drm_map_list_t *_entry = list_entry( _list, drm_map_list_t, head );
-                if ( _entry->map &&
-                     _entry->map->offset == offset ) {
+        drm_map_list_t *_entry;
+        list_for_each_entry(_entry, &dev->maplist->head, head)
+                if (_entry->user_token == token)
                         return _entry->map;
+        return NULL;
+}
+
+static __inline__ int drm_device_is_agp(drm_device_t *dev)
+{
+        if ( dev->driver->device_is_agp != NULL ) {
+                int err = (*dev->driver->device_is_agp)( dev );
+        
+                if (err != 2) {
+                        return err;
                 }
         }
-        return NULL;
+
+        return pci_find_capability(dev->pdev, PCI_CAP_ID_AGP);
 }
 
 static __inline__ void drm_core_dropmap(struct drm_map *map)
diff --git a/drivers/char/drm/drm_agpsupport.c b/drivers/char/drm/drm_agpsupport.c
index 8d94c0b5fa44..8c215adcb4b2 100644
--- a/drivers/char/drm/drm_agpsupport.c
+++ b/drivers/char/drm/drm_agpsupport.c
@@ -37,7 +37,7 @@
 #if __OS_HAS_AGP
 
 /**
- * AGP information ioctl.
+ * Get AGP information.
  *
  * \param inode device inode.
  * \param filp file pointer.
@@ -48,51 +48,56 @@
  * Verifies the AGP device has been initialized and acquired and fills in the
  * drm_agp_info structure with the information in drm_agp_head::agp_info.
  */
-int drm_agp_info(struct inode *inode, struct file *filp,
-                  unsigned int cmd, unsigned long arg)
+int drm_agp_info(drm_device_t *dev, drm_agp_info_t *info)
 {
-        drm_file_t       *priv   = filp->private_data;
-        drm_device_t     *dev    = priv->head->dev;
         DRM_AGP_KERN     *kern;
-        drm_agp_info_t   info;
 
         if (!dev->agp || !dev->agp->acquired)
                 return -EINVAL;
 
         kern                   = &dev->agp->agp_info;
-        info.agp_version_major = kern->version.major;
-        info.agp_version_minor = kern->version.minor;
-        info.mode              = kern->mode;
-        info.aperture_base     = kern->aper_base;
-        info.aperture_size     = kern->aper_size * 1024 * 1024;
-        info.memory_allowed    = kern->max_memory << PAGE_SHIFT;
-        info.memory_used       = kern->current_memory << PAGE_SHIFT;
-        info.id_vendor         = kern->device->vendor;
-        info.id_device         = kern->device->device;
-
-        if (copy_to_user((drm_agp_info_t __user *)arg, &info, sizeof(info)))
+        info->agp_version_major = kern->version.major;
+        info->agp_version_minor = kern->version.minor;
+        info->mode              = kern->mode;
+        info->aperture_base     = kern->aper_base;
+        info->aperture_size     = kern->aper_size * 1024 * 1024;
+        info->memory_allowed    = kern->max_memory << PAGE_SHIFT;
+        info->memory_used       = kern->current_memory << PAGE_SHIFT;
+        info->id_vendor         = kern->device->vendor;
+        info->id_device         = kern->device->device;
+
+        return 0;
+}
+EXPORT_SYMBOL(drm_agp_info);
+
+int drm_agp_info_ioctl(struct inode *inode, struct file *filp,
+                 unsigned int cmd, unsigned long arg)
+{
+        drm_file_t *priv = filp->private_data;
+        drm_device_t *dev = priv->head->dev;
+        drm_agp_info_t info;
+        int err;
+
+        err = drm_agp_info(dev, &info);
+        if (err)
+                return err;
+        
+        if (copy_to_user((drm_agp_info_t __user *) arg, &info, sizeof(info)))
                 return -EFAULT;
         return 0;
 }
 
 /**
- * Acquire the AGP device (ioctl).
+ * Acquire the AGP device.
  *
- * \param inode device inode.
- * \param filp file pointer.
- * \param cmd command.
- * \param arg user argument.
+ * \param dev DRM device that is to acquire AGP
  * \return zero on success or a negative number on failure. 
  *
  * Verifies the AGP device hasn't been acquired before and calls
- * agp_acquire().
+ * \c agp_backend_acquire.
  */
-int drm_agp_acquire(struct inode *inode, struct file *filp,
-                     unsigned int cmd, unsigned long arg)
+int drm_agp_acquire(drm_device_t *dev)
 {
-        drm_file_t       *priv   = filp->private_data;
-        drm_device_t     *dev    = priv->head->dev;
-
         if (!dev->agp)
                 return -ENODEV;
         if (dev->agp->acquired)
@@ -102,9 +107,10 @@ int drm_agp_acquire(struct inode *inode, struct file *filp,
         dev->agp->acquired = 1;
         return 0;
 }
+EXPORT_SYMBOL(drm_agp_acquire);
 
 /**
- * Release the AGP device (ioctl).
+ * Acquire the AGP device (ioctl).
  *
  * \param inode device inode.
  * \param filp file pointer.
@@ -112,63 +118,80 @@ int drm_agp_acquire(struct inode *inode, struct file *filp,
  * \param arg user argument.
  * \return zero on success or a negative number on failure.
  *
- * Verifies the AGP device has been acquired and calls agp_backend_release().
+ * Verifies the AGP device hasn't been acquired before and calls
+ * \c agp_backend_acquire.
  */
-int drm_agp_release(struct inode *inode, struct file *filp,
-                     unsigned int cmd, unsigned long arg)
+int drm_agp_acquire_ioctl(struct inode *inode, struct file *filp,
+                          unsigned int cmd, unsigned long arg)
 {
-        drm_file_t       *priv   = filp->private_data;
-        drm_device_t     *dev    = priv->head->dev;
+        drm_file_t *priv = filp->private_data;
+        
+        return drm_agp_acquire( (drm_device_t *) priv->head->dev );
+}
 
+/**
+ * Release the AGP device.
+ *
+ * \param dev DRM device that is to release AGP
+ * \return zero on success or a negative number on failure.
+ *
+ * Verifies the AGP device has been acquired and calls \c agp_backend_release.
+ */
+int drm_agp_release(drm_device_t *dev)
+{
         if (!dev->agp || !dev->agp->acquired)
                 return -EINVAL;
         agp_backend_release(dev->agp->bridge);
         dev->agp->acquired = 0;
         return 0;
-
 }
+EXPORT_SYMBOL(drm_agp_release);
 
-/**
- * Release the AGP device.
- *
- * Calls agp_backend_release().
- */
-void drm_agp_do_release(drm_device_t *dev)
+int drm_agp_release_ioctl(struct inode *inode, struct file *filp,
+                          unsigned int cmd, unsigned long arg)
 {
-  agp_backend_release(dev->agp->bridge);
+        drm_file_t *priv = filp->private_data;
+        drm_device_t *dev = priv->head->dev;
+        
+        return drm_agp_release(dev);
 }
 
 /**
  * Enable the AGP bus.
  * 
- * \param inode device inode.
- * \param filp file pointer.
- * \param cmd command.
- * \param arg pointer to a drm_agp_mode structure.
+ * \param dev DRM device that has previously acquired AGP.
+ * \param mode Requested AGP mode.
  * \return zero on success or a negative number on failure.
  *
  * Verifies the AGP device has been acquired but not enabled, and calls
- * agp_enable().
+ * \c agp_enable.
  */
-int drm_agp_enable(struct inode *inode, struct file *filp,
-                    unsigned int cmd, unsigned long arg)
+int drm_agp_enable(drm_device_t *dev, drm_agp_mode_t mode)
 {
-        drm_file_t       *priv   = filp->private_data;
-        drm_device_t     *dev    = priv->head->dev;
-        drm_agp_mode_t   mode;
-
         if (!dev->agp || !dev->agp->acquired)
                 return -EINVAL;
 
-        if (copy_from_user(&mode, (drm_agp_mode_t __user *)arg, sizeof(mode)))
-                return -EFAULT;
-
         dev->agp->mode    = mode.mode;
         agp_enable(dev->agp->bridge, mode.mode);
         dev->agp->base    = dev->agp->agp_info.aper_base;
         dev->agp->enabled = 1;
         return 0;
 }
+EXPORT_SYMBOL(drm_agp_enable);
+
+int drm_agp_enable_ioctl(struct inode *inode, struct file *filp,
+                   unsigned int cmd, unsigned long arg)
+{
+        drm_file_t *priv = filp->private_data;
+        drm_device_t *dev = priv->head->dev;
+        drm_agp_mode_t mode;
+
+
+        if (copy_from_user(&mode, (drm_agp_mode_t __user *) arg, sizeof(mode)))
+                return -EFAULT;
+
+        return drm_agp_enable(dev, mode);
+}
 
 /**
  * Allocate AGP memory.
@@ -206,7 +229,7 @@ int drm_agp_alloc(struct inode *inode, struct file *filp,
         pages = (request.size + PAGE_SIZE - 1) / PAGE_SIZE;
         type = (u32) request.type;
 
-        if (!(memory = drm_alloc_agp(dev->agp->bridge, pages, type))) {
+        if (!(memory = drm_alloc_agp(dev, pages, type))) {
                 drm_free(entry, sizeof(*entry), DRM_MEM_AGPLISTS);
                 return -ENOMEM;
         }
@@ -403,13 +426,8 @@ drm_agp_head_t *drm_agp_init(drm_device_t *dev)
                 return NULL;
         }
         head->memory = NULL;
-#if LINUX_VERSION_CODE <= 0x020408
-        head->cant_use_aperture = 0;
-        head->page_mask = ~(0xfff);
-#else
         head->cant_use_aperture = head->agp_info.cant_use_aperture;
         head->page_mask = head->agp_info.page_mask;
-#endif
 
         return head;
 }
@@ -436,6 +454,7 @@ int drm_agp_bind_memory(DRM_AGP_MEM *handle, off_t start)
                 return -EINVAL;
         return agp_bind_memory(handle, start);
 }
+EXPORT_SYMBOL(drm_agp_bind_memory);
 
 /** Calls agp_unbind_memory() */
 int drm_agp_unbind_memory(DRM_AGP_MEM *handle)
diff --git a/drivers/char/drm/drm_bufs.c b/drivers/char/drm/drm_bufs.c
index 4c6191d231b8..e0743ebbe4bd 100644
--- a/drivers/char/drm/drm_bufs.c
+++ b/drivers/char/drm/drm_bufs.c
@@ -36,37 +36,69 @@
 #include <linux/vmalloc.h>
 #include "drmP.h"
 
-/**
- * Compute size order.  Returns the exponent of the smaller power of two which
- * is greater or equal to given number.
- * 
- * \param size size.
- * \return order.
- *
- * \todo Can be made faster.
- */
-int drm_order( unsigned long size )
+unsigned long drm_get_resource_start(drm_device_t *dev, unsigned int resource)
 {
-        int order;
-        unsigned long tmp;
+        return pci_resource_start(dev->pdev, resource);
+}
+EXPORT_SYMBOL(drm_get_resource_start);
 
-        for (order = 0, tmp = size >> 1; tmp; tmp >>= 1, order++)
-                ;
+unsigned long drm_get_resource_len(drm_device_t *dev, unsigned int resource)
+{
+        return pci_resource_len(dev->pdev, resource);
+}
+EXPORT_SYMBOL(drm_get_resource_len);
 
-        if (size & (size - 1))
-                ++order;
+static drm_local_map_t *drm_find_matching_map(drm_device_t *dev,
+                                              drm_local_map_t *map)
+{
+        struct list_head *list;
 
-        return order;
+        list_for_each(list, &dev->maplist->head) {
+                drm_map_list_t *entry = list_entry(list, drm_map_list_t, head);
+                if (entry->map && map->type == entry->map->type &&
+                    entry->map->offset == map->offset) {
+                        return entry->map;
+                }
+        }
+
+        return NULL;
 }
-EXPORT_SYMBOL(drm_order);
 
-#ifdef CONFIG_COMPAT
 /*
- * Used to allocate 32-bit handles for _DRM_SHM regions
- * The 0x10000000 value is chosen to be out of the way of
- * FB/register and GART physical addresses.
+ * Used to allocate 32-bit handles for mappings.
  */
-static unsigned int map32_handle = 0x10000000;
+#define START_RANGE 0x10000000
+#define END_RANGE 0x40000000
+
+#ifdef _LP64
+static __inline__ unsigned int HandleID(unsigned long lhandle, drm_device_t *dev) 
+{
+        static unsigned int map32_handle = START_RANGE;
+        unsigned int hash;
+
+        if (lhandle & 0xffffffff00000000) {
+                hash = map32_handle;
+                map32_handle += PAGE_SIZE;
+                if (map32_handle > END_RANGE)
+                        map32_handle = START_RANGE;
+        } else 
+                hash = lhandle;
+
+        while (1) {
+                drm_map_list_t *_entry;
+                list_for_each_entry(_entry, &dev->maplist->head,head) {
+                        if (_entry->user_token == hash)
+                                break;
+                }
+                if (&_entry->head == &dev->maplist->head)
+                        return hash;
+
+                hash += PAGE_SIZE;
+                map32_handle += PAGE_SIZE;
+        }
+}
+#else
+# define HandleID(x,dev) (unsigned int)(x)
 #endif
 
 /**
@@ -82,25 +114,23 @@ static unsigned int map32_handle = 0x10000000;
  * type.  Adds the map to the map list drm_device::maplist. Adds MTRR's where
  * applicable and if supported by the kernel.
  */
-int drm_addmap( struct inode *inode, struct file *filp,
-                 unsigned int cmd, unsigned long arg )
+int drm_addmap(drm_device_t * dev, unsigned int offset,
+               unsigned int size, drm_map_type_t type,
+               drm_map_flags_t flags, drm_local_map_t ** map_ptr)
 {
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->head->dev;
         drm_map_t *map;
-        drm_map_t __user *argp = (void __user *)arg;
         drm_map_list_t *list;
-
-        if ( !(filp->f_mode & 3) ) return -EACCES; /* Require read/write */
+        drm_dma_handle_t *dmah;
+        drm_local_map_t *found_map;
 
         map = drm_alloc( sizeof(*map), DRM_MEM_MAPS );
         if ( !map )
                 return -ENOMEM;
 
-        if ( copy_from_user( map, argp, sizeof(*map) ) ) {
-                drm_free( map, sizeof(*map), DRM_MEM_MAPS );
-                return -EFAULT;
-        }
+        map->offset = offset;
+        map->size = size;
+        map->flags = flags;
+        map->type = type;
 
         /* Only allow shared memory to be removable since we only keep enough
          * book keeping information about shared memory to allow for removal
@@ -122,7 +152,7 @@ int drm_addmap( struct inode *inode, struct file *filp,
         switch ( map->type ) {
         case _DRM_REGISTERS:
         case _DRM_FRAME_BUFFER:
-#if !defined(__sparc__) && !defined(__alpha__) && !defined(__ia64__)
+#if !defined(__sparc__) && !defined(__alpha__) && !defined(__ia64__) && !defined(__powerpc64__) && !defined(__x86_64__)
                 if ( map->offset + map->size < map->offset ||
                      map->offset < virt_to_phys(high_memory) ) {
                         drm_free( map, sizeof(*map), DRM_MEM_MAPS );
@@ -132,6 +162,24 @@ int drm_addmap( struct inode *inode, struct file *filp,
 #ifdef __alpha__
                 map->offset += dev->hose->mem_space->start;
 #endif
+                /* Some drivers preinitialize some maps, without the X Server
+                 * needing to be aware of it.  Therefore, we just return success
+                 * when the server tries to create a duplicate map.
+                 */
+                found_map = drm_find_matching_map(dev, map);
+                if (found_map != NULL) {
+                        if (found_map->size != map->size) {
+                                DRM_DEBUG("Matching maps of type %d with "
+                                   "mismatched sizes, (%ld vs %ld)\n",
+                                    map->type, map->size, found_map->size);
+                                found_map->size = map->size;
+                        }
+
+                        drm_free(map, sizeof(*map), DRM_MEM_MAPS);
+                        *map_ptr = found_map;
+                        return 0;
+                }
+
                 if (drm_core_has_MTRR(dev)) {
                         if ( map->type == _DRM_FRAME_BUFFER ||
                              (map->flags & _DRM_WRITE_COMBINING) ) {
@@ -178,9 +226,22 @@ int drm_addmap( struct inode *inode, struct file *filp,
                         drm_free(map, sizeof(*map), DRM_MEM_MAPS);
                         return -EINVAL;
                 }
-                map->offset += dev->sg->handle;
+                map->offset += (unsigned long)dev->sg->virtual;
+                break;
+        case _DRM_CONSISTENT: 
+                /* dma_addr_t is 64bit on i386 with CONFIG_HIGHMEM64G,
+                 * As we're limiting the address to 2^32-1 (or less),
+                 * casting it down to 32 bits is no problem, but we
+                 * need to point to a 64bit variable first. */
+                dmah = drm_pci_alloc(dev, map->size, map->size, 0xffffffffUL);
+                if (!dmah) {
+                        drm_free(map, sizeof(*map), DRM_MEM_MAPS);
+                        return -ENOMEM;
+                }
+                map->handle = dmah->vaddr;
+                map->offset = (unsigned long)dmah->busaddr;
+                kfree(dmah);
                 break;
-
         default:
                 drm_free( map, sizeof(*map), DRM_MEM_MAPS );
                 return -EINVAL;
@@ -196,17 +257,56 @@ int drm_addmap( struct inode *inode, struct file *filp,
 
         down(&dev->struct_sem);
         list_add(&list->head, &dev->maplist->head);
-#ifdef CONFIG_COMPAT
-        /* Assign a 32-bit handle for _DRM_SHM mappings */
+        /* Assign a 32-bit handle */
         /* We do it here so that dev->struct_sem protects the increment */
-        if (map->type == _DRM_SHM)
-                map->offset = map32_handle += PAGE_SIZE;
-#endif
+        list->user_token = HandleID(map->type==_DRM_SHM
+                                    ? (unsigned long)map->handle
+                                    : map->offset, dev);
         up(&dev->struct_sem);
 
-        if ( copy_to_user( argp, map, sizeof(*map) ) )
+        *map_ptr = map;
+        return 0;
+}
+EXPORT_SYMBOL(drm_addmap);
+
+int drm_addmap_ioctl(struct inode *inode, struct file *filp,
+                     unsigned int cmd, unsigned long arg)
+{
+        drm_file_t *priv = filp->private_data;
+        drm_device_t *dev = priv->head->dev;
+        drm_map_t map;
+        drm_map_t *map_ptr;
+        drm_map_t __user *argp = (void __user *)arg;
+        int err;
+        unsigned long handle = 0;
+
+        if (!(filp->f_mode & 3))
+                return -EACCES; /* Require read/write */
+
+        if (copy_from_user(& map, argp, sizeof(map))) {
+                return -EFAULT;
+        }
+
+        err = drm_addmap(dev, map.offset, map.size, map.type, map.flags,
+                         &map_ptr);
+
+        if (err) {
+                return err;
+        }
+
+        {
+                drm_map_list_t *_entry;
+                list_for_each_entry(_entry, &dev->maplist->head, head) {
+                        if (_entry->map == map_ptr)
+                                handle = _entry->user_token;
+                }
+                if (!handle)
+                        return -EFAULT;
+        }
+
+        if (copy_to_user(argp, map_ptr, sizeof(*map_ptr)))
                 return -EFAULT;
-        if (copy_to_user(&argp->handle, &map->offset, sizeof(map->offset)))
+        if (put_user(handle, &argp->handle))
                 return -EFAULT;
         return 0;
 }
@@ -226,81 +326,138 @@ int drm_addmap( struct inode *inode, struct file *filp,
  * its being used, and free any associate resource (such as MTRR's) if it's not
  * being on use.
  *
- * \sa addmap().
+ * \sa drm_addmap
  */
-int drm_rmmap(struct inode *inode, struct file *filp,
-               unsigned int cmd, unsigned long arg)
+int drm_rmmap_locked(drm_device_t *dev, drm_local_map_t *map)
 {
-        drm_file_t      *priv   = filp->private_data;
-        drm_device_t    *dev    = priv->head->dev;
         struct list_head *list;
         drm_map_list_t *r_list = NULL;
-        drm_vma_entry_t *pt, *prev;
-        drm_map_t *map;
+        drm_dma_handle_t dmah;
+
+        /* Find the list entry for the map and remove it */
+        list_for_each(list, &dev->maplist->head) {
+                r_list = list_entry(list, drm_map_list_t, head);
+
+                if (r_list->map == map) {
+                        list_del(list);
+                        drm_free(list, sizeof(*list), DRM_MEM_MAPS);
+                        break;
+                }
+        }
+
+        /* List has wrapped around to the head pointer, or it's empty and we
+         * didn't find anything.
+         */
+        if (list == (&dev->maplist->head)) {
+                return -EINVAL;
+        }
+
+        switch (map->type) {
+        case _DRM_REGISTERS:
+                drm_ioremapfree(map->handle, map->size, dev);
+                /* FALLTHROUGH */
+        case _DRM_FRAME_BUFFER:
+                if (drm_core_has_MTRR(dev) && map->mtrr >= 0) {
+                        int retcode;
+                        retcode = mtrr_del(map->mtrr, map->offset,
+                                           map->size);
+                        DRM_DEBUG ("mtrr_del=%d\n", retcode);
+                }
+                break;
+        case _DRM_SHM:
+                vfree(map->handle);
+                break;
+        case _DRM_AGP:
+        case _DRM_SCATTER_GATHER:
+                break;
+        case _DRM_CONSISTENT:
+                dmah.vaddr = map->handle;
+                dmah.busaddr = map->offset;
+                dmah.size = map->size;
+                __drm_pci_free(dev, &dmah);
+                break;
+        }
+        drm_free(map, sizeof(*map), DRM_MEM_MAPS);
+
+        return 0;
+}
+EXPORT_SYMBOL(drm_rmmap_locked);
+
+int drm_rmmap(drm_device_t *dev, drm_local_map_t *map)
+{
+        int ret;
+
+        down(&dev->struct_sem);
+        ret = drm_rmmap_locked(dev, map);
+        up(&dev->struct_sem);
+
+        return ret;
+}
+EXPORT_SYMBOL(drm_rmmap);
+
+/* The rmmap ioctl appears to be unnecessary.  All mappings are torn down on
+ * the last close of the device, and this is necessary for cleanup when things
+ * exit uncleanly.  Therefore, having userland manually remove mappings seems
+ * like a pointless exercise since they're going away anyway.
+ *
+ * One use case might be after addmap is allowed for normal users for SHM and
+ * gets used by drivers that the server doesn't need to care about.  This seems
+ * unlikely.
+ */
+int drm_rmmap_ioctl(struct inode *inode, struct file *filp,
+                    unsigned int cmd, unsigned long arg)
+{
+        drm_file_t *priv = filp->private_data;
+        drm_device_t *dev = priv->head->dev;
         drm_map_t request;
-        int found_maps = 0;
+        drm_local_map_t *map = NULL;
+        struct list_head *list;
+        int ret;
 
-        if (copy_from_user(&request, (drm_map_t __user *)arg,
-                           sizeof(request))) {
+        if (copy_from_user(&request, (drm_map_t __user *)arg, sizeof(request))) {
                 return -EFAULT;
         }
 
         down(&dev->struct_sem);
-        list = &dev->maplist->head;
         list_for_each(list, &dev->maplist->head) {
-                r_list = list_entry(list, drm_map_list_t, head);
+                drm_map_list_t *r_list = list_entry(list, drm_map_list_t, head);
 
-                if(r_list->map &&
-                   r_list->map->offset == (unsigned long) request.handle &&
-                   r_list->map->flags & _DRM_REMOVABLE) break;
+                if (r_list->map &&
+                    r_list->user_token == (unsigned long) request.handle &&
+                    r_list->map->flags & _DRM_REMOVABLE) {
+                        map = r_list->map;
+                        break;
+                }
         }
 
         /* List has wrapped around to the head pointer, or its empty we didn't
          * find anything.
          */
-        if(list == (&dev->maplist->head)) {
+        if (list == (&dev->maplist->head)) {
                 up(&dev->struct_sem);
                 return -EINVAL;
         }
-        map = r_list->map;
-        list_del(list);
-        drm_free(list, sizeof(*list), DRM_MEM_MAPS);
 
-        for (pt = dev->vmalist, prev = NULL; pt; prev = pt, pt = pt->next) {
-                if (pt->vma->vm_private_data == map) found_maps++;
-        }
+        if (!map)
+                return -EINVAL;
 
-        if(!found_maps) {
-                switch (map->type) {
-                case _DRM_REGISTERS:
-                case _DRM_FRAME_BUFFER:
-                  if (drm_core_has_MTRR(dev)) {
-                                if (map->mtrr >= 0) {
-                                        int retcode;
-                                        retcode = mtrr_del(map->mtrr,
-                                                           map->offset,
-                                                           map->size);
-                                        DRM_DEBUG("mtrr_del = %d\n", retcode);
-                                }
-                        }
-                        drm_ioremapfree(map->handle, map->size, dev);
-                        break;
-                case _DRM_SHM:
-                        vfree(map->handle);
-                        break;
-                case _DRM_AGP:
-                case _DRM_SCATTER_GATHER:
-                        break;
-                }
-                drm_free(map, sizeof(*map), DRM_MEM_MAPS);
+        /* Register and framebuffer maps are permanent */
+        if ((map->type == _DRM_REGISTERS) || (map->type == _DRM_FRAME_BUFFER)) {
+                up(&dev->struct_sem);
+                return 0;
         }
+
+        ret = drm_rmmap_locked(dev, map);
+
         up(&dev->struct_sem);
-        return 0;
+
+        return ret;
 }
 
 /**
  * Cleanup after an error on one of the addbufs() functions.
  *
+ * \param dev DRM device.
  * \param entry buffer entry where the error occurred.
  *
  * Frees any pages and buffers associated with the given entry.
@@ -344,25 +501,19 @@ static void drm_cleanup_buf_error(drm_device_t *dev, drm_buf_entry_t *entry)
 
 #if __OS_HAS_AGP
 /**
- * Add AGP buffers for DMA transfers (ioctl).
+ * Add AGP buffers for DMA transfers.
  *
- * \param inode device inode.
- * \param filp file pointer.
- * \param cmd command.
- * \param arg pointer to a drm_buf_desc_t request.
+ * \param dev drm_device_t to which the buffers are to be added.
+ * \param request pointer to a drm_buf_desc_t describing the request.
  * \return zero on success or a negative number on failure.
  * 
  * After some sanity checks creates a drm_buf structure for each buffer and
  * reallocates the buffer list of the same size order to accommodate the new
  * buffers.
  */
-static int drm_addbufs_agp( struct inode *inode, struct file *filp,
-                            unsigned int cmd, unsigned long arg )
+int drm_addbufs_agp(drm_device_t *dev, drm_buf_desc_t *request)
 {
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->head->dev;
         drm_device_dma_t *dma = dev->dma;
-        drm_buf_desc_t request;
         drm_buf_entry_t *entry;
         drm_buf_t *buf;
         unsigned long offset;
@@ -376,25 +527,20 @@ static int drm_addbufs_agp( struct inode *inode, struct file *filp,
         int byte_count;
         int i;
         drm_buf_t **temp_buflist;
-        drm_buf_desc_t __user *argp = (void __user *)arg;
 
         if ( !dma ) return -EINVAL;
 
-        if ( copy_from_user( &request, argp,
-                             sizeof(request) ) )
-                return -EFAULT;
-
-        count = request.count;
-        order = drm_order( request.size );
+        count = request->count;
+        order = drm_order(request->size);
         size = 1 << order;
 
-        alignment  = (request.flags & _DRM_PAGE_ALIGN)
+        alignment  = (request->flags & _DRM_PAGE_ALIGN)
                 ? PAGE_ALIGN(size) : size;
         page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
         total = PAGE_SIZE << page_order;
 
         byte_count = 0;
-        agp_offset = dev->agp->base + request.agp_start;
+        agp_offset = dev->agp->base + request->agp_start;
 
         DRM_DEBUG( "count:      %d\n",  count );
         DRM_DEBUG( "order:      %d\n",  order );
@@ -508,26 +654,20 @@ static int drm_addbufs_agp( struct inode *inode, struct file *filp,
 
         up( &dev->struct_sem );
 
-        request.count = entry->buf_count;
-        request.size = size;
-
-        if ( copy_to_user( argp, &request, sizeof(request) ) )
-                return -EFAULT;
+        request->count = entry->buf_count;
+        request->size = size;
 
         dma->flags = _DRM_DMA_USE_AGP;
 
         atomic_dec( &dev->buf_alloc );
         return 0;
 }
+EXPORT_SYMBOL(drm_addbufs_agp);
 #endif /* __OS_HAS_AGP */
 
-static int drm_addbufs_pci( struct inode *inode, struct file *filp,
-                            unsigned int cmd, unsigned long arg )
+int drm_addbufs_pci(drm_device_t *dev, drm_buf_desc_t *request)
 {
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->head->dev;
         drm_device_dma_t *dma = dev->dma;
-        drm_buf_desc_t request;
         int count;
         int order;
         int size;
@@ -543,26 +683,22 @@ static int drm_addbufs_pci( struct inode *inode, struct file *filp,
         int page_count;
         unsigned long *temp_pagelist;
         drm_buf_t **temp_buflist;
-        drm_buf_desc_t __user *argp = (void __user *)arg;
 
         if (!drm_core_check_feature(dev, DRIVER_PCI_DMA)) return -EINVAL;
         if ( !dma ) return -EINVAL;
 
-        if ( copy_from_user( &request, argp, sizeof(request) ) )
-                return -EFAULT;
-
-        count = request.count;
-        order = drm_order( request.size );
+        count = request->count;
+        order = drm_order(request->size);
         size = 1 << order;
 
         DRM_DEBUG( "count=%d, size=%d (%d), order=%d, queue_count=%d\n",
-                   request.count, request.size, size,
+                   request->count, request->size, size,
                    order, dev->queue_count );
 
         if ( order < DRM_MIN_ORDER || order > DRM_MAX_ORDER ) return -EINVAL;
         if ( dev->queue_count ) return -EBUSY; /* Not while in use */
 
-        alignment = (request.flags & _DRM_PAGE_ALIGN)
+        alignment = (request->flags & _DRM_PAGE_ALIGN)
                 ? PAGE_ALIGN(size) : size;
         page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
         total = PAGE_SIZE << page_order;
@@ -740,25 +876,18 @@ static int drm_addbufs_pci( struct inode *inode, struct file *filp,
 
         up( &dev->struct_sem );
 
-        request.count = entry->buf_count;
-        request.size = size;
-
-        if ( copy_to_user( argp, &request, sizeof(request) ) )
-                return -EFAULT;
+        request->count = entry->buf_count;
+        request->size = size;
 
         atomic_dec( &dev->buf_alloc );
         return 0;
 
 }
+EXPORT_SYMBOL(drm_addbufs_pci);
 
-static int drm_addbufs_sg( struct inode *inode, struct file *filp,
-                           unsigned int cmd, unsigned long arg )
+static int drm_addbufs_sg(drm_device_t *dev, drm_buf_desc_t *request)
 {
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->head->dev;
         drm_device_dma_t *dma = dev->dma;
-        drm_buf_desc_t __user *argp = (void __user *)arg;
-        drm_buf_desc_t request;
         drm_buf_entry_t *entry;
         drm_buf_t *buf;
         unsigned long offset;
@@ -777,20 +906,17 @@ static int drm_addbufs_sg( struct inode *inode, struct file *filp,
         
         if ( !dma ) return -EINVAL;
 
-        if ( copy_from_user( &request, argp, sizeof(request) ) )
-                return -EFAULT;
-
-        count = request.count;
-        order = drm_order( request.size );
+        count = request->count;
+        order = drm_order(request->size);
         size = 1 << order;
 
-        alignment  = (request.flags & _DRM_PAGE_ALIGN)
+        alignment  = (request->flags & _DRM_PAGE_ALIGN)
                         ? PAGE_ALIGN(size) : size;
         page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
         total = PAGE_SIZE << page_order;
 
         byte_count = 0;
-        agp_offset = request.agp_start;
+        agp_offset = request->agp_start;
 
         DRM_DEBUG( "count:      %d\n",  count );
         DRM_DEBUG( "order:      %d\n",  order );
@@ -848,7 +974,8 @@ static int drm_addbufs_sg( struct inode *inode, struct file *filp,
 
                 buf->offset  = (dma->byte_count + offset);
                 buf->bus_address = agp_offset + offset;
-                buf->address = (void *)(agp_offset + offset + dev->sg->handle);
+                buf->address = (void *)(agp_offset + offset 
+                                        + (unsigned long)dev->sg->virtual);
                 buf->next    = NULL;
                 buf->waiting = 0;
                 buf->pending = 0;
@@ -905,11 +1032,8 @@ static int drm_addbufs_sg( struct inode *inode, struct file *filp,
 
         up( &dev->struct_sem );
 
-        request.count = entry->buf_count;
-        request.size = size;
-
-        if ( copy_to_user( argp, &request, sizeof(request) ) )
-                return -EFAULT;
+        request->count = entry->buf_count;
+        request->size = size;
 
         dma->flags = _DRM_DMA_USE_SG;
 
@@ -917,6 +1041,161 @@ static int drm_addbufs_sg( struct inode *inode, struct file *filp,
         return 0;
 }
 
+int drm_addbufs_fb(drm_device_t *dev, drm_buf_desc_t *request)
+{
+        drm_device_dma_t *dma = dev->dma;
+        drm_buf_entry_t *entry;
+        drm_buf_t *buf;
+        unsigned long offset;
+        unsigned long agp_offset;
+        int count;
+        int order;
+        int size;
+        int alignment;
+        int page_order;
+        int total;
+        int byte_count;
+        int i;
+        drm_buf_t **temp_buflist;
+
+        if (!drm_core_check_feature(dev, DRIVER_FB_DMA))
+                return -EINVAL;
+    
+        if (!dma)
+                return -EINVAL;
+
+        count = request->count;
+        order = drm_order(request->size);
+        size = 1 << order;
+
+        alignment = (request->flags & _DRM_PAGE_ALIGN)
+            ? PAGE_ALIGN(size) : size;
+        page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
+        total = PAGE_SIZE << page_order;
+
+        byte_count = 0;
+        agp_offset = request->agp_start;
+
+        DRM_DEBUG("count:      %d\n", count);
+        DRM_DEBUG("order:      %d\n", order);
+        DRM_DEBUG("size:       %d\n", size);
+        DRM_DEBUG("agp_offset: %lu\n", agp_offset);
+        DRM_DEBUG("alignment:  %d\n", alignment);
+        DRM_DEBUG("page_order: %d\n", page_order);
+        DRM_DEBUG("total:      %d\n", total);
+
+        if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER)
+                return -EINVAL;
+        if (dev->queue_count)
+                return -EBUSY;  /* Not while in use */
+
+        spin_lock(&dev->count_lock);
+        if (dev->buf_use) {
+                spin_unlock(&dev->count_lock);
+                return -EBUSY;
+        }
+        atomic_inc(&dev->buf_alloc);
+        spin_unlock(&dev->count_lock);
+
+        down(&dev->struct_sem);
+        entry = &dma->bufs[order];
+        if (entry->buf_count) {
+                up(&dev->struct_sem);
+                atomic_dec(&dev->buf_alloc);
+                return -ENOMEM; /* May only call once for each order */
+        }
+
+        if (count < 0 || count > 4096) {
+                up(&dev->struct_sem);
+                atomic_dec(&dev->buf_alloc);
+                return -EINVAL;
+        }
+
+        entry->buflist = drm_alloc(count * sizeof(*entry->buflist),
+                                   DRM_MEM_BUFS);
+        if (!entry->buflist) {
+                up(&dev->struct_sem);
+                atomic_dec(&dev->buf_alloc);
+                return -ENOMEM;
+        }
+        memset(entry->buflist, 0, count * sizeof(*entry->buflist));
+
+        entry->buf_size = size;
+        entry->page_order = page_order;
+
+        offset = 0;
+
+        while (entry->buf_count < count) {
+                buf = &entry->buflist[entry->buf_count];
+                buf->idx = dma->buf_count + entry->buf_count;
+                buf->total = alignment;
+                buf->order = order;
+                buf->used = 0;
+
+                buf->offset = (dma->byte_count + offset);
+                buf->bus_address = agp_offset + offset;
+                buf->address = (void *)(agp_offset + offset);
+                buf->next = NULL;
+                buf->waiting = 0;
+                buf->pending = 0;
+                init_waitqueue_head(&buf->dma_wait);
+                buf->filp = NULL;
+
+                buf->dev_priv_size = dev->driver->dev_priv_size;
+                buf->dev_private = drm_alloc(buf->dev_priv_size, DRM_MEM_BUFS);
+                if (!buf->dev_private) {
+                        /* Set count correctly so we free the proper amount. */
+                        entry->buf_count = count;
+                        drm_cleanup_buf_error(dev, entry);
+                        up(&dev->struct_sem);
+                        atomic_dec(&dev->buf_alloc);
+                        return -ENOMEM;
+                }
+                memset(buf->dev_private, 0, buf->dev_priv_size);
+
+                DRM_DEBUG("buffer %d @ %p\n", entry->buf_count, buf->address);
+
+                offset += alignment;
+                entry->buf_count++;
+                byte_count += PAGE_SIZE << page_order;
+        }
+
+        DRM_DEBUG("byte_count: %d\n", byte_count);
+
+        temp_buflist = drm_realloc(dma->buflist,
+                                   dma->buf_count * sizeof(*dma->buflist),
+                                   (dma->buf_count + entry->buf_count)
+                                   * sizeof(*dma->buflist), DRM_MEM_BUFS);
+        if (!temp_buflist) {
+                /* Free the entry because it isn't valid */
+                drm_cleanup_buf_error(dev, entry);
+                up(&dev->struct_sem);
+                atomic_dec(&dev->buf_alloc);
+                return -ENOMEM;
+        }
+        dma->buflist = temp_buflist;
+
+        for (i = 0; i < entry->buf_count; i++) {
+                dma->buflist[i + dma->buf_count] = &entry->buflist[i];
+        }
+
+        dma->buf_count += entry->buf_count;
+        dma->byte_count += byte_count;
+
+        DRM_DEBUG("dma->buf_count : %d\n", dma->buf_count);
+        DRM_DEBUG("entry->buf_count : %d\n", entry->buf_count);
+
+        up(&dev->struct_sem);
+
+        request->count = entry->buf_count;
+        request->size = size;
+
+        dma->flags = _DRM_DMA_USE_FB;
+
+        atomic_dec(&dev->buf_alloc);
+        return 0;
+}
+
 /**
  * Add buffers for DMA transfers (ioctl).
  *
@@ -937,6 +1216,7 @@ int drm_addbufs( struct inode *inode, struct file *filp,
         drm_buf_desc_t request;
         drm_file_t *priv = filp->private_data;
         drm_device_t *dev = priv->head->dev;
+        int ret;
         
         if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
                 return -EINVAL;
@@ -947,13 +1227,23 @@ int drm_addbufs( struct inode *inode, struct file *filp,
 
 #if __OS_HAS_AGP
         if ( request.flags & _DRM_AGP_BUFFER )
-                return drm_addbufs_agp( inode, filp, cmd, arg );
+                ret=drm_addbufs_agp(dev, &request);
         else
 #endif
         if ( request.flags & _DRM_SG_BUFFER )
-                return drm_addbufs_sg( inode, filp, cmd, arg );
+                ret=drm_addbufs_sg(dev, &request);
+        else if ( request.flags & _DRM_FB_BUFFER)
+                ret=drm_addbufs_fb(dev, &request);
         else
-                return drm_addbufs_pci( inode, filp, cmd, arg );
+                ret=drm_addbufs_pci(dev, &request);
+
+        if (ret==0) {
+                if (copy_to_user((void __user *)arg, &request,
+                                 sizeof(request))) {
+                        ret = -EFAULT;
+                }
+        }
+        return ret;
 }
 
 
@@ -1196,43 +1486,31 @@ int drm_mapbufs( struct inode *inode, struct file *filp,
                 return -EFAULT;
 
         if ( request.count >= dma->buf_count ) {
-                if ((drm_core_has_AGP(dev) && (dma->flags & _DRM_DMA_USE_AGP)) ||
-                    (drm_core_check_feature(dev, DRIVER_SG) && (dma->flags & _DRM_DMA_USE_SG)) ) {
+                if ((drm_core_has_AGP(dev) && (dma->flags & _DRM_DMA_USE_AGP))
+                    || (drm_core_check_feature(dev, DRIVER_SG) 
+                        && (dma->flags & _DRM_DMA_USE_SG))
+                    || (drm_core_check_feature(dev, DRIVER_FB_DMA)
+                        && (dma->flags & _DRM_DMA_USE_FB))) {
                         drm_map_t *map = dev->agp_buffer_map;
+                        unsigned long token = dev->agp_buffer_token;
 
                         if ( !map ) {
                                 retcode = -EINVAL;
                                 goto done;
                         }
 
-#if LINUX_VERSION_CODE <= 0x020402
-                        down( &current->mm->mmap_sem );
-#else
                         down_write( &current->mm->mmap_sem );
-#endif
                         virtual = do_mmap( filp, 0, map->size,
                                            PROT_READ | PROT_WRITE,
                                            MAP_SHARED,
-                                           (unsigned long)map->offset );
-#if LINUX_VERSION_CODE <= 0x020402
-                        up( &current->mm->mmap_sem );
-#else
+                                           token );
                         up_write( &current->mm->mmap_sem );
-#endif
                 } else {
-#if LINUX_VERSION_CODE <= 0x020402
-                        down( &current->mm->mmap_sem );
-#else
                         down_write( &current->mm->mmap_sem );
-#endif
                         virtual = do_mmap( filp, 0, dma->byte_count,
                                            PROT_READ | PROT_WRITE,
                                            MAP_SHARED, 0 );
-#if LINUX_VERSION_CODE <= 0x020402
-                        up( &current->mm->mmap_sem );
-#else
                         up_write( &current->mm->mmap_sem );
-#endif
                 }
                 if ( virtual > -1024UL ) {
                         /* Real error */
@@ -1279,3 +1557,26 @@ int drm_mapbufs( struct inode *inode, struct file *filp,
         return retcode;
 }
 
+/**
+ * Compute size order.  Returns the exponent of the smaller power of two which
+ * is greater or equal to given number.
+ * 
+ * \param size size.
+ * \return order.
+ *
+ * \todo Can be made faster.
+ */
+int drm_order( unsigned long size )
+{
+        int order;
+        unsigned long tmp;
+
+        for (order = 0, tmp = size >> 1; tmp; tmp >>= 1, order++)
+                ;
+
+        if (size & (size - 1))
+                ++order;
+
+        return order;
+}
+EXPORT_SYMBOL(drm_order);
diff --git a/drivers/char/drm/drm_context.c b/drivers/char/drm/drm_context.c
index a7cfabd1ca2e..f515567e5b6f 100644
--- a/drivers/char/drm/drm_context.c
+++ b/drivers/char/drm/drm_context.c
@@ -212,6 +212,7 @@ int drm_getsareactx(struct inode *inode, struct file *filp,
         drm_ctx_priv_map_t __user *argp = (void __user *)arg;
         drm_ctx_priv_map_t request;
         drm_map_t *map;
+        drm_map_list_t *_entry;
 
         if (copy_from_user(&request, argp, sizeof(request)))
                 return -EFAULT;
@@ -225,7 +226,17 @@ int drm_getsareactx(struct inode *inode, struct file *filp,
         map = dev->context_sareas[request.ctx_id];
         up(&dev->struct_sem);
 
-        request.handle = (void *) map->offset;
+        request.handle = 0;
+        list_for_each_entry(_entry, &dev->maplist->head,head) {
+                if (_entry->map == map) {
+                        request.handle = (void *)(unsigned long)_entry->user_token;
+                        break;
+                }
+        }
+        if (request.handle == 0)
+                return -EINVAL;
+
+
         if (copy_to_user(argp, &request, sizeof(request)))
                 return -EFAULT;
         return 0;
@@ -262,7 +273,7 @@ int drm_setsareactx(struct inode *inode, struct file *filp,
         list_for_each(list, &dev->maplist->head) {
                 r_list = list_entry(list, drm_map_list_t, head);
                 if (r_list->map
-                    && r_list->map->offset == (unsigned long) request.handle)
+                    && r_list->user_token == (unsigned long) request.handle)
                         goto found;
         }
 bad:
@@ -369,7 +380,7 @@ int drm_resctx( struct inode *inode, struct file *filp,
                 for ( i = 0 ; i < DRM_RESERVED_CONTEXTS ; i++ ) {
                         ctx.handle = i;
                         if ( copy_to_user( &res.contexts[i],
-                                           &i, sizeof(i) ) )
+                                           &ctx, sizeof(ctx) ) )
                                 return -EFAULT;
                 }
         }
diff --git a/drivers/char/drm/drm_drv.c b/drivers/char/drm/drm_drv.c
index 3333c250c4d9..6ba48f346fcf 100644
--- a/drivers/char/drm/drm_drv.c
+++ b/drivers/char/drm/drm_drv.c
@@ -70,8 +70,8 @@ static drm_ioctl_desc_t		  drm_ioctls[] = {
         [DRM_IOCTL_NR(DRM_IOCTL_UNBLOCK)]       = { drm_noop,        1, 1 },
         [DRM_IOCTL_NR(DRM_IOCTL_AUTH_MAGIC)]    = { drm_authmagic,   1, 1 },
 
-        [DRM_IOCTL_NR(DRM_IOCTL_ADD_MAP)]       = { drm_addmap,      1, 1 },
-        [DRM_IOCTL_NR(DRM_IOCTL_RM_MAP)]        = { drm_rmmap,       1, 0 },
+        [DRM_IOCTL_NR(DRM_IOCTL_ADD_MAP)]       = { drm_addmap_ioctl,1, 1 },
+        [DRM_IOCTL_NR(DRM_IOCTL_RM_MAP)]        = { drm_rmmap_ioctl, 1, 0 },
 
         [DRM_IOCTL_NR(DRM_IOCTL_SET_SAREA_CTX)] = { drm_setsareactx, 1, 1 },
         [DRM_IOCTL_NR(DRM_IOCTL_GET_SAREA_CTX)] = { drm_getsareactx, 1, 0 },
@@ -102,10 +102,10 @@ static drm_ioctl_desc_t		  drm_ioctls[] = {
         [DRM_IOCTL_NR(DRM_IOCTL_CONTROL)]       = { drm_control,     1, 1 },
 
 #if __OS_HAS_AGP
-        [DRM_IOCTL_NR(DRM_IOCTL_AGP_ACQUIRE)]   = { drm_agp_acquire, 1, 1 },
-        [DRM_IOCTL_NR(DRM_IOCTL_AGP_RELEASE)]   = { drm_agp_release, 1, 1 },
-        [DRM_IOCTL_NR(DRM_IOCTL_AGP_ENABLE)]    = { drm_agp_enable,  1, 1 },
-        [DRM_IOCTL_NR(DRM_IOCTL_AGP_INFO)]      = { drm_agp_info,    1, 0 },
+        [DRM_IOCTL_NR(DRM_IOCTL_AGP_ACQUIRE)]   = { drm_agp_acquire_ioctl, 1, 1 },
+        [DRM_IOCTL_NR(DRM_IOCTL_AGP_RELEASE)]   = { drm_agp_release_ioctl, 1, 1 },
+        [DRM_IOCTL_NR(DRM_IOCTL_AGP_ENABLE)]    = { drm_agp_enable_ioctl, 1, 1 },
+        [DRM_IOCTL_NR(DRM_IOCTL_AGP_INFO)]      = { drm_agp_info_ioctl, 1, 0 },
         [DRM_IOCTL_NR(DRM_IOCTL_AGP_ALLOC)]     = { drm_agp_alloc,   1, 1 },
         [DRM_IOCTL_NR(DRM_IOCTL_AGP_FREE)]      = { drm_agp_free,    1, 1 },
         [DRM_IOCTL_NR(DRM_IOCTL_AGP_BIND)]      = { drm_agp_bind,    1, 1 },
@@ -127,14 +127,12 @@ static drm_ioctl_desc_t		  drm_ioctls[] = {
  *
  * Frees every resource in \p dev.
  *
- * \sa drm_device and setup().
+ * \sa drm_device
  */
 int drm_takedown( drm_device_t *dev )
 {
         drm_magic_entry_t *pt, *next;
-        drm_map_t *map;
         drm_map_list_t *r_list;
-        struct list_head *list, *list_next;
         drm_vma_entry_t *vma, *vma_next;
         int i;
 
@@ -142,6 +140,7 @@ int drm_takedown( drm_device_t *dev )
 
         if (dev->driver->pretakedown)
           dev->driver->pretakedown(dev);
+        DRM_DEBUG("driver pretakedown completed\n");
 
         if (dev->unique) {
                 drm_free(dev->unique, strlen(dev->unique) + 1, DRM_MEM_DRIVER);
@@ -178,11 +177,16 @@ int drm_takedown( drm_device_t *dev )
                 }
                 dev->agp->memory = NULL;
 
-                if ( dev->agp->acquired ) drm_agp_do_release(dev);
+                if (dev->agp->acquired)
+                  drm_agp_release(dev);
 
                 dev->agp->acquired = 0;
                 dev->agp->enabled  = 0;
         }
+        if (drm_core_check_feature(dev, DRIVER_SG) && dev->sg) {
+                drm_sg_cleanup(dev->sg);
+                dev->sg = NULL;
+        }
 
                                 /* Clear vma list (only built for debugging) */
         if ( dev->vmalist ) {
@@ -194,48 +198,11 @@ int drm_takedown( drm_device_t *dev )
         }
 
         if( dev->maplist ) {
-                list_for_each_safe( list, list_next, &dev->maplist->head ) {
-                        r_list = (drm_map_list_t *)list;
-
-                        if ( ( map = r_list->map ) ) {
-                                switch ( map->type ) {
-                                case _DRM_REGISTERS:
-                                case _DRM_FRAME_BUFFER:
-                                        if (drm_core_has_MTRR(dev)) {
-                                                if ( map->mtrr >= 0 ) {
-                                                        int retcode;
-                                                        retcode = mtrr_del( map->mtrr,
-                                                                            map->offset,
-                                                                            map->size );
-                                                        DRM_DEBUG( "mtrr_del=%d\n", retcode );
-                                                }
-                                        }
-                                        drm_ioremapfree( map->handle, map->size, dev );
-                                        break;
-                                case _DRM_SHM:
-                                        vfree(map->handle);
-                                        break;
-
-                                case _DRM_AGP:
-                                        /* Do nothing here, because this is all
-                                         * handled in the AGP/GART driver.
-                                         */
-                                        break;
-                                case _DRM_SCATTER_GATHER:
-                                        /* Handle it */
-                                        if (drm_core_check_feature(dev, DRIVER_SG) && dev->sg) {
-                                                drm_sg_cleanup(dev->sg);
-                                                dev->sg = NULL;
-                                        }
-                                        break;
-                                }
-                                drm_free(map, sizeof(*map), DRM_MEM_MAPS);
-                        }
-                        list_del( list );
-                        drm_free(r_list, sizeof(*r_list), DRM_MEM_MAPS);
-                }
-                drm_free(dev->maplist, sizeof(*dev->maplist), DRM_MEM_MAPS);
-                dev->maplist = NULL;
+                while (!list_empty(&dev->maplist->head)) {
+                        struct list_head *list = dev->maplist->head.next;
+                        r_list = list_entry(list, drm_map_list_t, head);
+                        drm_rmmap_locked(dev, r_list->map);
+                }
         }
 
         if (drm_core_check_feature(dev, DRIVER_DMA_QUEUE) && dev->queuelist ) {
@@ -264,6 +231,7 @@ int drm_takedown( drm_device_t *dev )
         }
         up( &dev->struct_sem );
 
+        DRM_DEBUG("takedown completed\n");
         return 0;
 }
 
@@ -312,7 +280,7 @@ EXPORT_SYMBOL(drm_init);
  *
  * Cleans up all DRM device, calling takedown().
  * 
- * \sa drm_init().
+ * \sa drm_init
  */
 static void drm_cleanup( drm_device_t *dev )
 {
@@ -325,6 +293,11 @@ static void drm_cleanup( drm_device_t *dev )
 
         drm_takedown( dev );    
 
+        if (dev->maplist) {
+                drm_free(dev->maplist, sizeof(*dev->maplist), DRM_MEM_MAPS);
+                dev->maplist = NULL;
+        }
+
         drm_ctxbitmap_cleanup( dev );
         
         if (drm_core_has_MTRR(dev) && drm_core_has_AGP(dev) &&
diff --git a/drivers/char/drm/drm_fops.c b/drivers/char/drm/drm_fops.c
index 10e64fde8d78..a1f4e9cd64ed 100644
--- a/drivers/char/drm/drm_fops.c
+++ b/drivers/char/drm/drm_fops.c
@@ -71,12 +71,6 @@ static int drm_setup( drm_device_t *dev )
                 dev->magiclist[i].tail = NULL;
         }
 
-        dev->maplist = drm_alloc(sizeof(*dev->maplist),
-                                  DRM_MEM_MAPS);
-        if(dev->maplist == NULL) return -ENOMEM;
-        memset(dev->maplist, 0, sizeof(*dev->maplist));
-        INIT_LIST_HEAD(&dev->maplist->head);
-
         dev->ctxlist = drm_alloc(sizeof(*dev->ctxlist),
                                   DRM_MEM_CTXLIST);
         if(dev->ctxlist == NULL) return -ENOMEM;
diff --git a/drivers/char/drm/drm_ioctl.c b/drivers/char/drm/drm_ioctl.c
index 39afda0ccabe..d2ed3ba5aca9 100644
--- a/drivers/char/drm/drm_ioctl.c
+++ b/drivers/char/drm/drm_ioctl.c
@@ -208,7 +208,7 @@ int drm_getmap( struct inode *inode, struct file *filp,
         map.size   = r_list->map->size;
         map.type   = r_list->map->type;
         map.flags  = r_list->map->flags;
-        map.handle = r_list->map->handle;
+        map.handle = (void *)(unsigned long) r_list->user_token;
         map.mtrr   = r_list->map->mtrr;
         up(&dev->struct_sem);
 
diff --git a/drivers/char/drm/drm_memory.c b/drivers/char/drm/drm_memory.c
index ace3d42f4407..ff483fb418aa 100644
--- a/drivers/char/drm/drm_memory.c
+++ b/drivers/char/drm/drm_memory.c
@@ -142,27 +142,31 @@ void drm_free_pages(unsigned long address, int order, int area)
 
 #if __OS_HAS_AGP
 /** Wrapper around agp_allocate_memory() */
-DRM_AGP_MEM *drm_alloc_agp(struct agp_bridge_data *bridge, int pages, u32 type)
+DRM_AGP_MEM *drm_alloc_agp(drm_device_t *dev, int pages, u32 type)
 {
-        return drm_agp_allocate_memory(bridge, pages, type);
+        return drm_agp_allocate_memory(dev->agp->bridge, pages, type);
 }
+EXPORT_SYMBOL(drm_alloc_agp);
 
 /** Wrapper around agp_free_memory() */
 int drm_free_agp(DRM_AGP_MEM *handle, int pages)
 {
         return drm_agp_free_memory(handle) ? 0 : -EINVAL;
 }
+EXPORT_SYMBOL(drm_free_agp);
 
 /** Wrapper around agp_bind_memory() */
 int drm_bind_agp(DRM_AGP_MEM *handle, unsigned int start)
 {
         return drm_agp_bind_memory(handle, start);
 }
+EXPORT_SYMBOL(drm_bind_agp);
 
 /** Wrapper around agp_unbind_memory() */
 int drm_unbind_agp(DRM_AGP_MEM *handle)
 {
         return drm_agp_unbind_memory(handle);
 }
+EXPORT_SYMBOL(drm_unbind_agp);
 #endif /* agp */
 #endif /* debug_memory */
diff --git a/drivers/char/drm/drm_pci.c b/drivers/char/drm/drm_pci.c
index 192e8762571c..09ed712c1a7f 100644
--- a/drivers/char/drm/drm_pci.c
+++ b/drivers/char/drm/drm_pci.c
@@ -46,11 +46,11 @@
 /**
  * \brief Allocate a PCI consistent memory block, for DMA.
  */
-void *drm_pci_alloc(drm_device_t * dev, size_t size, size_t align,
-                    dma_addr_t maxaddr, dma_addr_t * busaddr)
+drm_dma_handle_t *drm_pci_alloc(drm_device_t * dev, size_t size, size_t align,
+                                dma_addr_t maxaddr)
 {
-        void *address;
-#if DRM_DEBUG_MEMORY
+        drm_dma_handle_t *dmah;
+#ifdef DRM_DEBUG_MEMORY
         int area = DRM_MEM_DMA;
 
         spin_lock(&drm_mem_lock);
@@ -74,13 +74,19 @@ void *drm_pci_alloc(drm_device_t * dev, size_t size, size_t align,
                 return NULL;
         }
 
-        address = pci_alloc_consistent(dev->pdev, size, busaddr);
+        dmah = kmalloc(sizeof(drm_dma_handle_t), GFP_KERNEL);
+        if (!dmah)
+                return NULL;
+        
+        dmah->size = size;
+        dmah->vaddr = pci_alloc_consistent(dev->pdev, size, &dmah->busaddr);
 
-#if DRM_DEBUG_MEMORY
-        if (address == NULL) {
+#ifdef DRM_DEBUG_MEMORY
+        if (dmah->vaddr == NULL) {
                 spin_lock(&drm_mem_lock);
                 ++drm_mem_stats[area].fail_count;
                 spin_unlock(&drm_mem_lock);
+                kfree(dmah);
                 return NULL;
         }
 
@@ -90,37 +96,42 @@ void *drm_pci_alloc(drm_device_t * dev, size_t size, size_t align,
         drm_ram_used += size;
         spin_unlock(&drm_mem_lock);
 #else
-        if (address == NULL)
+        if (dmah->vaddr == NULL) {
+                kfree(dmah);
                 return NULL;
+        }
 #endif
 
-        memset(address, 0, size);
+        memset(dmah->vaddr, 0, size);
 
-        return address;
+        return dmah;
 }
 EXPORT_SYMBOL(drm_pci_alloc);
 
 /**
- * \brief Free a PCI consistent memory block.
+ * \brief Free a PCI consistent memory block with freeing its descriptor.
+ *
+ * This function is for internal use in the Linux-specific DRM core code.
  */
 void
-drm_pci_free(drm_device_t * dev, size_t size, void *vaddr, dma_addr_t busaddr)
+__drm_pci_free(drm_device_t * dev, drm_dma_handle_t *dmah)
 {
-#if DRM_DEBUG_MEMORY
+#ifdef DRM_DEBUG_MEMORY
         int area = DRM_MEM_DMA;
         int alloc_count;
         int free_count;
 #endif
 
-        if (!vaddr) {
-#if DRM_DEBUG_MEMORY
+        if (!dmah->vaddr) {
+#ifdef DRM_DEBUG_MEMORY
                 DRM_MEM_ERROR(area, "Attempt to free address 0\n");
 #endif
         } else {
-                pci_free_consistent(dev->pdev, size, vaddr, busaddr);
+                pci_free_consistent(dev->pdev, dmah->size, dmah->vaddr,
+                                    dmah->busaddr);
         }
 
-#if DRM_DEBUG_MEMORY
+#ifdef DRM_DEBUG_MEMORY
         spin_lock(&drm_mem_lock);
         free_count = ++drm_mem_stats[area].free_count;
         alloc_count = drm_mem_stats[area].succeed_count;
@@ -135,6 +146,16 @@ drm_pci_free(drm_device_t * dev, size_t size, void *vaddr, dma_addr_t busaddr)
 #endif
 
 }
+
+/**
+ * \brief Free a PCI consistent memory block
+ */
+void
+drm_pci_free(drm_device_t *dev, drm_dma_handle_t *dmah)
+{
+        __drm_pci_free(dev, dmah);
+        kfree(dmah);
+}
 EXPORT_SYMBOL(drm_pci_free);
 
 /*@}*/
diff --git a/drivers/char/drm/drm_pciids.h b/drivers/char/drm/drm_pciids.h
index 70ca4fa55c9d..58b1747cd440 100644
--- a/drivers/char/drm/drm_pciids.h
+++ b/drivers/char/drm/drm_pciids.h
@@ -25,6 +25,8 @@
         {0x1002, 0x4965, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250}, \
         {0x1002, 0x4966, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250}, \
         {0x1002, 0x4967, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250}, \
+        {0x1002, 0x4A49, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420}, \
+        {0x1002, 0x4A4B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420}, \
         {0x1002, 0x4C57, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV200|CHIP_IS_MOBILITY}, \
         {0x1002, 0x4C58, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV200|CHIP_IS_MOBILITY}, \
         {0x1002, 0x4C59, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV100|CHIP_IS_MOBILITY}, \
@@ -33,7 +35,17 @@
         {0x1002, 0x4C65, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250|CHIP_IS_MOBILITY}, \
         {0x1002, 0x4C66, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250|CHIP_IS_MOBILITY}, \
         {0x1002, 0x4C67, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250|CHIP_IS_MOBILITY}, \
+        {0x1002, 0x4E44, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
+        {0x1002, 0x4E45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
+        {0x1002, 0x4E46, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
+        {0x1002, 0x4E47, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
+        {0x1002, 0x4E48, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R350}, \
+        {0x1002, 0x4E49, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R350}, \
+        {0x1002, 0x4E4A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
+        {0x1002, 0x4E4B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R350}, \
         {0x1002, 0x4E50, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350|CHIP_IS_MOBILITY}, \
+        {0x1002, 0x4E51, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350|CHIP_IS_MOBILITY}, \
+        {0x1002, 0x4E54, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350|CHIP_IS_MOBILITY}, \
         {0x1002, 0x5144, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R100|CHIP_SINGLE_CRTC}, \
         {0x1002, 0x5145, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R100|CHIP_SINGLE_CRTC}, \
         {0x1002, 0x5146, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R100|CHIP_SINGLE_CRTC}, \
@@ -56,6 +68,7 @@
         {0x1002, 0x516A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
         {0x1002, 0x516B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
         {0x1002, 0x516C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
+        {0x1002, 0x5460, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
         {0x1002, 0x5834, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|CHIP_IS_IGP}, \
         {0x1002, 0x5835, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|CHIP_IS_IGP|CHIP_IS_MOBILITY}, \
         {0x1002, 0x5836, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|CHIP_IS_IGP}, \
@@ -116,9 +129,10 @@
         {0, 0, 0}
 
 #define mga_PCI_IDS \
-        {0x102b, 0x0521, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x102b, 0x0525, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x102b, 0x2527, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+        {0x102b, 0x0520, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
+        {0x102b, 0x0521, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
+        {0x102b, 0x0525, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G400}, \
+        {0x102b, 0x2527, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G550}, \
         {0, 0, 0}
 
 #define mach64_PCI_IDS \
@@ -162,9 +176,10 @@
 
 #define viadrv_PCI_IDS \
         {0x1106, 0x3022, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+        {0x1106, 0x3118, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
         {0x1106, 0x3122, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
         {0x1106, 0x7205, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x1106, 0x7204, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+        {0x1106, 0x3108, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
         {0, 0, 0}
 
 #define i810_PCI_IDS \
@@ -181,33 +196,30 @@
         {0x8086, 0x2572, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
         {0, 0, 0}
 
-#define gamma_PCI_IDS \
-        {0x3d3d, 0x0008, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0, 0, 0}
-
 #define savage_PCI_IDS \
-        {0x5333, 0x8a22, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8a23, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8c10, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8c11, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8c12, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8c13, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8c20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8c21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8c22, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8c24, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8c26, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8c2a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8c2b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8c2c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8c2d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8c2e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8c2f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8a25, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8a26, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8d01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8d02, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x5333, 0x8d04, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+        {0x5333, 0x8a20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE3D}, \
+        {0x5333, 0x8a21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE3D}, \
+        {0x5333, 0x8a22, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE4}, \
+        {0x5333, 0x8a23, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE4}, \
+        {0x5333, 0x8c10, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE_MX}, \
+        {0x5333, 0x8c11, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE_MX}, \
+        {0x5333, 0x8c12, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE_MX}, \
+        {0x5333, 0x8c13, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE_MX}, \
+        {0x5333, 0x8c22, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SUPERSAVAGE}, \
+        {0x5333, 0x8c24, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SUPERSAVAGE}, \
+        {0x5333, 0x8c26, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SUPERSAVAGE}, \
+        {0x5333, 0x8c2a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SUPERSAVAGE}, \
+        {0x5333, 0x8c2b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SUPERSAVAGE}, \
+        {0x5333, 0x8c2c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SUPERSAVAGE}, \
+        {0x5333, 0x8c2d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SUPERSAVAGE}, \
+        {0x5333, 0x8c2e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SUPERSAVAGE}, \
+        {0x5333, 0x8c2f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SUPERSAVAGE}, \
+        {0x5333, 0x8a25, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGE}, \
+        {0x5333, 0x8a26, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGE}, \
+        {0x5333, 0x8d01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_TWISTER}, \
+        {0x5333, 0x8d02, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_TWISTER}, \
+        {0x5333, 0x8d03, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
+        {0x5333, 0x8d04, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
         {0, 0, 0}
 
 #define ffb_PCI_IDS \
@@ -223,10 +235,3 @@
         {0x8086, 0x2772, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
         {0, 0, 0}
 
-#define viadrv_PCI_IDS \
-        {0x1106, 0x3022, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x1106, 0x3122, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x1106, 0x7205, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x1106, 0x7204, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0, 0, 0}
-
diff --git a/drivers/char/drm/drm_proc.c b/drivers/char/drm/drm_proc.c
index 4774087d2e9e..32d2bb99462c 100644
--- a/drivers/char/drm/drm_proc.c
+++ b/drivers/char/drm/drm_proc.c
@@ -210,8 +210,8 @@ static int drm__vm_info(char *buf, char **start, off_t offset, int request,
 
                                 /* Hardcoded from _DRM_FRAME_BUFFER,
                                    _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
-                                   _DRM_SCATTER_GATHER. */
-        const char   *types[] = { "FB", "REG", "SHM", "AGP", "SG" };
+                                   _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
+        const char   *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
         const char   *type;
         int          i;
 
@@ -229,16 +229,19 @@ static int drm__vm_info(char *buf, char **start, off_t offset, int request,
         if (dev->maplist != NULL) list_for_each(list, &dev->maplist->head) {
                 r_list = list_entry(list, drm_map_list_t, head);
                 map = r_list->map;
-                if(!map) continue;
-                if (map->type < 0 || map->type > 4) type = "??";
-                else                                type = types[map->type];
-                DRM_PROC_PRINT("%4d 0x%08lx 0x%08lx %4.4s  0x%02x 0x%08lx ",
+                if(!map)
+                        continue;
+                if (map->type < 0 || map->type > 5)
+                        type = "??";
+                else    
+                        type = types[map->type];
+                DRM_PROC_PRINT("%4d 0x%08lx 0x%08lx %4.4s  0x%02x 0x%08x ",
                                i,
                                map->offset,
                                map->size,
                                type,
                                map->flags,
-                               (unsigned long)map->handle);
+                               r_list->user_token);
                 if (map->mtrr < 0) {
                         DRM_PROC_PRINT("none\n");
                 } else {
diff --git a/drivers/char/drm/drm_scatter.c b/drivers/char/drm/drm_scatter.c
index 54fddb6ea2d1..ed267d49bc6a 100644
--- a/drivers/char/drm/drm_scatter.c
+++ b/drivers/char/drm/drm_scatter.c
@@ -61,6 +61,12 @@ void drm_sg_cleanup( drm_sg_mem_t *entry )
                    DRM_MEM_SGLISTS );
 }
 
+#ifdef _LP64
+# define ScatterHandle(x) (unsigned int)((x >> 32) + (x & ((1L << 32) - 1)))
+#else
+# define ScatterHandle(x) (unsigned int)(x)
+#endif
+
 int drm_sg_alloc( struct inode *inode, struct file *filp,
                    unsigned int cmd, unsigned long arg )
 {
@@ -133,12 +139,13 @@ int drm_sg_alloc( struct inode *inode, struct file *filp,
          */
         memset( entry->virtual, 0, pages << PAGE_SHIFT );
 
-        entry->handle = (unsigned long)entry->virtual;
+        entry->handle = ScatterHandle((unsigned long)entry->virtual);
 
         DRM_DEBUG( "sg alloc handle  = %08lx\n", entry->handle );
         DRM_DEBUG( "sg alloc virtual = %p\n", entry->virtual );
 
-        for ( i = entry->handle, j = 0 ; j < pages ; i += PAGE_SIZE, j++ ) {
+        for (i = (unsigned long)entry->virtual, j = 0; j < pages; 
+                i += PAGE_SIZE, j++) {
                 entry->pagelist[j] = vmalloc_to_page((void *)i);
                 if (!entry->pagelist[j])
                         goto failed;
diff --git a/drivers/char/drm/drm_stub.c b/drivers/char/drm/drm_stub.c
index 48829a1a086a..95a976c96eb8 100644
--- a/drivers/char/drm/drm_stub.c
+++ b/drivers/char/drm/drm_stub.c
@@ -75,6 +75,11 @@ static int drm_fill_in_dev(drm_device_t *dev, struct pci_dev *pdev, const struct
         dev->pci_func = PCI_FUNC(pdev->devfn);
         dev->irq = pdev->irq;
 
+        dev->maplist = drm_calloc(1, sizeof(*dev->maplist), DRM_MEM_MAPS);
+        if (dev->maplist == NULL)
+                return -ENOMEM;
+        INIT_LIST_HEAD(&dev->maplist->head);
+
         /* the DRM has 6 basic counters */
         dev->counters = 6;
         dev->types[0]  = _DRM_STAT_LOCK;
@@ -91,7 +96,8 @@ static int drm_fill_in_dev(drm_device_t *dev, struct pci_dev *pdev, const struct
                         goto error_out_unreg;
 
         if (drm_core_has_AGP(dev)) {
-                dev->agp = drm_agp_init(dev);
+                if (drm_device_is_agp(dev))
+                        dev->agp = drm_agp_init(dev);
                 if (drm_core_check_feature(dev, DRIVER_REQUIRE_AGP) && (dev->agp == NULL)) {
                         DRM_ERROR( "Cannot initialize the agpgart module.\n" );
                         retcode = -EINVAL;
diff --git a/drivers/char/drm/drm_vm.c b/drivers/char/drm/drm_vm.c
index 621220f3f372..ced4215e2275 100644
--- a/drivers/char/drm/drm_vm.c
+++ b/drivers/char/drm/drm_vm.c
@@ -73,12 +73,13 @@ static __inline__ struct page *drm_do_vm_nopage(struct vm_area_struct *vma,
                 r_list = list_entry(list, drm_map_list_t, head);
                 map = r_list->map;
                 if (!map) continue;
-                if (map->offset == VM_OFFSET(vma)) break;
+                if (r_list->user_token == VM_OFFSET(vma))
+                        break;
         }
 
         if (map && map->type == _DRM_AGP) {
                 unsigned long offset = address - vma->vm_start;
-                unsigned long baddr = VM_OFFSET(vma) + offset;
+                unsigned long baddr = map->offset + offset;
                 struct drm_agp_mem *agpmem;
                 struct page *page;
 
@@ -210,6 +211,8 @@ static void drm_vm_shm_close(struct vm_area_struct *vma)
                 }
 
                 if(!found_maps) {
+                        drm_dma_handle_t dmah;
+
                         switch (map->type) {
                         case _DRM_REGISTERS:
                         case _DRM_FRAME_BUFFER:
@@ -228,6 +231,12 @@ static void drm_vm_shm_close(struct vm_area_struct *vma)
                         case _DRM_AGP:
                         case _DRM_SCATTER_GATHER:
                                 break;
+                        case _DRM_CONSISTENT:
+                                dmah.vaddr = map->handle;
+                                dmah.busaddr = map->offset;
+                                dmah.size = map->size;
+                                __drm_pci_free(dev, &dmah);
+                                break;
                         }
                         drm_free(map, sizeof(*map), DRM_MEM_MAPS);
                 }
@@ -296,7 +305,7 @@ static __inline__ struct page *drm_do_vm_sg_nopage(struct vm_area_struct *vma,
 
 
         offset = address - vma->vm_start;
-        map_offset = map->offset - dev->sg->handle;
+        map_offset = map->offset - (unsigned long)dev->sg->virtual;
         page_offset = (offset >> PAGE_SHIFT) + (map_offset >> PAGE_SHIFT);
         page = entry->pagelist[page_offset];
         get_page(page);
@@ -305,8 +314,6 @@ static __inline__ struct page *drm_do_vm_sg_nopage(struct vm_area_struct *vma,
 }
 
 
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,0)
-
 static struct page *drm_vm_nopage(struct vm_area_struct *vma,
                                    unsigned long address,
                                    int *type) {
@@ -335,35 +342,6 @@ static struct page *drm_vm_sg_nopage(struct vm_area_struct *vma,
         return drm_do_vm_sg_nopage(vma, address);
 }
 
-#else   /* LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,0) */
-
-static struct page *drm_vm_nopage(struct vm_area_struct *vma,
-                                   unsigned long address,
-                                   int unused) {
-        return drm_do_vm_nopage(vma, address);
-}
-
-static struct page *drm_vm_shm_nopage(struct vm_area_struct *vma,
-                                       unsigned long address,
-                                       int unused) {
-        return drm_do_vm_shm_nopage(vma, address);
-}
-
-static struct page *drm_vm_dma_nopage(struct vm_area_struct *vma,
-                                       unsigned long address,
-                                       int unused) {
-        return drm_do_vm_dma_nopage(vma, address);
-}
-
-static struct page *drm_vm_sg_nopage(struct vm_area_struct *vma,
-                                      unsigned long address,
-                                      int unused) {
-        return drm_do_vm_sg_nopage(vma, address);
-}
-
-#endif
-
-
 /** AGP virtual memory operations */
 static struct vm_operations_struct   drm_vm_ops = {
         .nopage = drm_vm_nopage,
@@ -487,11 +465,7 @@ static int drm_mmap_dma(struct file *filp, struct vm_area_struct *vma)
 
         vma->vm_ops   = &drm_vm_dma_ops;
 
-#if LINUX_VERSION_CODE <= 0x02040e /* KERNEL_VERSION(2,4,14) */
-        vma->vm_flags |= VM_LOCKED | VM_SHM; /* Don't swap */
-#else
         vma->vm_flags |= VM_RESERVED; /* Don't swap */
-#endif
 
         vma->vm_file  =  filp;  /* Needed for drm_vm_open() */
         drm_vm_open(vma);
@@ -560,13 +534,12 @@ int drm_mmap(struct file *filp, struct vm_area_struct *vma)
                                    for performance, even if the list was a
                                    bit longer. */
         list_for_each(list, &dev->maplist->head) {
-                unsigned long off;
 
                 r_list = list_entry(list, drm_map_list_t, head);
                 map = r_list->map;
                 if (!map) continue;
-                off = dev->driver->get_map_ofs(map);
-                if (off == VM_OFFSET(vma)) break;
+                if (r_list->user_token == VM_OFFSET(vma))
+                        break;
         }
 
         if (!map || ((map->flags&_DRM_RESTRICTED) && !capable(CAP_SYS_ADMIN)))
@@ -605,17 +578,17 @@ int drm_mmap(struct file *filp, struct vm_area_struct *vma)
                 /* fall through to _DRM_FRAME_BUFFER... */        
         case _DRM_FRAME_BUFFER:
         case _DRM_REGISTERS:
-                if (VM_OFFSET(vma) >= __pa(high_memory)) {
 #if defined(__i386__) || defined(__x86_64__)
-                        if (boot_cpu_data.x86 > 3 && map->type != _DRM_AGP) {
-                                pgprot_val(vma->vm_page_prot) |= _PAGE_PCD;
-                                pgprot_val(vma->vm_page_prot) &= ~_PAGE_PWT;
-                        }
+                if (boot_cpu_data.x86 > 3 && map->type != _DRM_AGP) {
+                        pgprot_val(vma->vm_page_prot) |= _PAGE_PCD;
+                        pgprot_val(vma->vm_page_prot) &= ~_PAGE_PWT;
+                }
 #elif defined(__powerpc__)
-                        pgprot_val(vma->vm_page_prot) |= _PAGE_NO_CACHE | _PAGE_GUARDED;
+                pgprot_val(vma->vm_page_prot) |= _PAGE_NO_CACHE;
+                if (map->type == _DRM_REGISTERS)
+                        pgprot_val(vma->vm_page_prot) |= _PAGE_GUARDED;
 #endif
-                        vma->vm_flags |= VM_IO; /* not in core dump */
-                }
+                vma->vm_flags |= VM_IO; /* not in core dump */
 #if defined(__ia64__)
                 if (efi_range_is_wc(vma->vm_start, vma->vm_end -
                                     vma->vm_start))
@@ -628,12 +601,12 @@ int drm_mmap(struct file *filp, struct vm_area_struct *vma)
                 offset = dev->driver->get_reg_ofs(dev);
 #ifdef __sparc__
                 if (io_remap_pfn_range(DRM_RPR_ARG(vma) vma->vm_start,
-                                        (VM_OFFSET(vma) + offset) >> PAGE_SHIFT,
+                                        (map->offset + offset) >> PAGE_SHIFT,
                                         vma->vm_end - vma->vm_start,
                                         vma->vm_page_prot))
 #else
                 if (io_remap_pfn_range(vma, vma->vm_start,
-                                     (VM_OFFSET(vma) + offset) >> PAGE_SHIFT,
+                                     (map->offset + offset) >> PAGE_SHIFT,
                                      vma->vm_end - vma->vm_start,
                                      vma->vm_page_prot))
 #endif
@@ -641,37 +614,28 @@ int drm_mmap(struct file *filp, struct vm_area_struct *vma)
                 DRM_DEBUG("   Type = %d; start = 0x%lx, end = 0x%lx,"
                           " offset = 0x%lx\n",
                           map->type,
-                          vma->vm_start, vma->vm_end, VM_OFFSET(vma) + offset);
+                          vma->vm_start, vma->vm_end, map->offset + offset);
                 vma->vm_ops = &drm_vm_ops;
                 break;
         case _DRM_SHM:
+        case _DRM_CONSISTENT:
+                /* Consistent memory is really like shared memory. It's only
+                 * allocate in a different way */
                 vma->vm_ops = &drm_vm_shm_ops;
                 vma->vm_private_data = (void *)map;
                                 /* Don't let this area swap.  Change when
                                    DRM_KERNEL advisory is supported. */
-#if LINUX_VERSION_CODE <= 0x02040e /* KERNEL_VERSION(2,4,14) */
-                vma->vm_flags |= VM_LOCKED;
-#else
                 vma->vm_flags |= VM_RESERVED;
-#endif
                 break;
         case _DRM_SCATTER_GATHER:
                 vma->vm_ops = &drm_vm_sg_ops;
                 vma->vm_private_data = (void *)map;
-#if LINUX_VERSION_CODE <= 0x02040e /* KERNEL_VERSION(2,4,14) */
-                vma->vm_flags |= VM_LOCKED;
-#else
                 vma->vm_flags |= VM_RESERVED;
-#endif
                 break;
         default:
                 return -EINVAL; /* This should never happen. */
         }
-#if LINUX_VERSION_CODE <= 0x02040e /* KERNEL_VERSION(2,4,14) */
-        vma->vm_flags |= VM_LOCKED | VM_SHM; /* Don't swap */
-#else
         vma->vm_flags |= VM_RESERVED; /* Don't swap */
-#endif
 
         vma->vm_file  =  filp;  /* Needed for drm_vm_open() */
         drm_vm_open(vma);
diff --git a/drivers/char/drm/ffb_drv.c b/drivers/char/drm/ffb_drv.c
index ec614fff8f04..1bd0d55ee0f0 100644
--- a/drivers/char/drm/ffb_drv.c
+++ b/drivers/char/drm/ffb_drv.c
@@ -152,14 +152,11 @@ static drm_map_t *ffb_find_map(struct file *filp, unsigned long off)
                 return NULL;
 
         list_for_each(list, &dev->maplist->head) {
-                unsigned long uoff;
-
                 r_list = (drm_map_list_t *)list;
                 map = r_list->map;
                 if (!map)
                         continue;
-                uoff = (map->offset & 0xffffffff);
-                if (uoff == off)
+                if (r_list->user_token == off)
                         return map;
         }
 
diff --git a/drivers/char/drm/gamma_context.h b/drivers/char/drm/gamma_context.h
deleted file mode 100644
index d11b507f87ee..000000000000
--- a/drivers/char/drm/gamma_context.h
+++ /dev/null
@@ -1,492 +0,0 @@
-/* drm_context.h -- IOCTLs for generic contexts -*- linux-c -*-
- * Created: Fri Nov 24 18:31:37 2000 by gareth@valinux.com
- *
- * Copyright 1999, 2000 Precision Insight, Inc., Cedar Park, Texas.
- * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
- * All Rights Reserved.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sublicense,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice (including the next
- * paragraph) shall be included in all copies or substantial portions of the
- * Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
- * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
- * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
- * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- *
- * Authors:
- *    Rickard E. (Rik) Faith <faith@valinux.com>
- *    Gareth Hughes <gareth@valinux.com>
- * ChangeLog:
- *  2001-11-16  Torsten Duwe <duwe@caldera.de>
- *              added context constructor/destructor hooks,
- *              needed by SiS driver's memory management.
- */
-
-/* ================================================================
- * Old-style context support -- only used by gamma.  
- */
-
-
-/* The drm_read and drm_write_string code (especially that which manages
-   the circular buffer), is based on Alessandro Rubini's LINUX DEVICE
-   DRIVERS (Cambridge: O'Reilly, 1998), pages 111-113. */
-
-ssize_t gamma_fops_read(struct file *filp, char __user *buf, size_t count, loff_t *off)
-{
-        drm_file_t    *priv   = filp->private_data;
-        drm_device_t  *dev    = priv->dev;
-        int           left;
-        int           avail;
-        int           send;
-        int           cur;
-
-        DRM_DEBUG("%p, %p\n", dev->buf_rp, dev->buf_wp);
-
-        while (dev->buf_rp == dev->buf_wp) {
-                DRM_DEBUG("  sleeping\n");
-                if (filp->f_flags & O_NONBLOCK) {
-                        return -EAGAIN;
-                }
-                interruptible_sleep_on(&dev->buf_readers);
-                if (signal_pending(current)) {
-                        DRM_DEBUG("  interrupted\n");
-                        return -ERESTARTSYS;
-                }
-                DRM_DEBUG("  awake\n");
-        }
-
-        left  = (dev->buf_rp + DRM_BSZ - dev->buf_wp) % DRM_BSZ;
-        avail = DRM_BSZ - left;
-        send  = DRM_MIN(avail, count);
-
-        while (send) {
-                if (dev->buf_wp > dev->buf_rp) {
-                        cur = DRM_MIN(send, dev->buf_wp - dev->buf_rp);
-                } else {
-                        cur = DRM_MIN(send, dev->buf_end - dev->buf_rp);
-                }
-                if (copy_to_user(buf, dev->buf_rp, cur))
-                        return -EFAULT;
-                dev->buf_rp += cur;
-                if (dev->buf_rp == dev->buf_end) dev->buf_rp = dev->buf;
-                send -= cur;
-        }
-
-        wake_up_interruptible(&dev->buf_writers);
-        return DRM_MIN(avail, count);
-}
-
-
-/* In an incredibly convoluted setup, the kernel module actually calls
- * back into the X server to perform context switches on behalf of the
- * 3d clients.
- */
-int DRM(write_string)(drm_device_t *dev, const char *s)
-{
-        int left   = (dev->buf_rp + DRM_BSZ - dev->buf_wp) % DRM_BSZ;
-        int send   = strlen(s);
-        int count;
-
-        DRM_DEBUG("%d left, %d to send (%p, %p)\n",
-                  left, send, dev->buf_rp, dev->buf_wp);
-
-        if (left == 1 || dev->buf_wp != dev->buf_rp) {
-                DRM_ERROR("Buffer not empty (%d left, wp = %p, rp = %p)\n",
-                          left,
-                          dev->buf_wp,
-                          dev->buf_rp);
-        }
-
-        while (send) {
-                if (dev->buf_wp >= dev->buf_rp) {
-                        count = DRM_MIN(send, dev->buf_end - dev->buf_wp);
-                        if (count == left) --count; /* Leave a hole */
-                } else {
-                        count = DRM_MIN(send, dev->buf_rp - dev->buf_wp - 1);
-                }
-                strncpy(dev->buf_wp, s, count);
-                dev->buf_wp += count;
-                if (dev->buf_wp == dev->buf_end) dev->buf_wp = dev->buf;
-                send -= count;
-        }
-
-        if (dev->buf_async) kill_fasync(&dev->buf_async, SIGIO, POLL_IN);
-
-        DRM_DEBUG("waking\n");
-        wake_up_interruptible(&dev->buf_readers);
-        return 0;
-}
-
-unsigned int gamma_fops_poll(struct file *filp, struct poll_table_struct *wait)
-{
-        drm_file_t   *priv = filp->private_data;
-        drm_device_t *dev  = priv->dev;
-
-        poll_wait(filp, &dev->buf_readers, wait);
-        if (dev->buf_wp != dev->buf_rp) return POLLIN | POLLRDNORM;
-        return 0;
-}
-
-int DRM(context_switch)(drm_device_t *dev, int old, int new)
-{
-        char        buf[64];
-        drm_queue_t *q;
-
-        if (test_and_set_bit(0, &dev->context_flag)) {
-                DRM_ERROR("Reentering -- FIXME\n");
-                return -EBUSY;
-        }
-
-        DRM_DEBUG("Context switch from %d to %d\n", old, new);
-
-        if (new >= dev->queue_count) {
-                clear_bit(0, &dev->context_flag);
-                return -EINVAL;
-        }
-
-        if (new == dev->last_context) {
-                clear_bit(0, &dev->context_flag);
-                return 0;
-        }
-
-        q = dev->queuelist[new];
-        atomic_inc(&q->use_count);
-        if (atomic_read(&q->use_count) == 1) {
-                atomic_dec(&q->use_count);
-                clear_bit(0, &dev->context_flag);
-                return -EINVAL;
-        }
-
-        /* This causes the X server to wake up & do a bunch of hardware
-         * interaction to actually effect the context switch.
-         */
-        sprintf(buf, "C %d %d\n", old, new);
-        DRM(write_string)(dev, buf);
-
-        atomic_dec(&q->use_count);
-
-        return 0;
-}
-
-int DRM(context_switch_complete)(drm_device_t *dev, int new)
-{
-        drm_device_dma_t *dma = dev->dma;
-
-        dev->last_context = new;  /* PRE/POST: This is the _only_ writer. */
-        dev->last_switch  = jiffies;
-
-        if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
-                DRM_ERROR("Lock isn't held after context switch\n");
-        }
-
-        if (!dma || !(dma->next_buffer && dma->next_buffer->while_locked)) {
-                if (DRM(lock_free)(dev, &dev->lock.hw_lock->lock,
-                                  DRM_KERNEL_CONTEXT)) {
-                        DRM_ERROR("Cannot free lock\n");
-                }
-        }
-
-        clear_bit(0, &dev->context_flag);
-        wake_up_interruptible(&dev->context_wait);
-
-        return 0;
-}
-
-static int DRM(init_queue)(drm_device_t *dev, drm_queue_t *q, drm_ctx_t *ctx)
-{
-        DRM_DEBUG("\n");
-
-        if (atomic_read(&q->use_count) != 1
-            || atomic_read(&q->finalization)
-            || atomic_read(&q->block_count)) {
-                DRM_ERROR("New queue is already in use: u%d f%d b%d\n",
-                          atomic_read(&q->use_count),
-                          atomic_read(&q->finalization),
-                          atomic_read(&q->block_count));
-        }
-
-        atomic_set(&q->finalization,  0);
-        atomic_set(&q->block_count,   0);
-        atomic_set(&q->block_read,    0);
-        atomic_set(&q->block_write,   0);
-        atomic_set(&q->total_queued,  0);
-        atomic_set(&q->total_flushed, 0);
-        atomic_set(&q->total_locks,   0);
-
-        init_waitqueue_head(&q->write_queue);
-        init_waitqueue_head(&q->read_queue);
-        init_waitqueue_head(&q->flush_queue);
-
-        q->flags = ctx->flags;
-
-        DRM(waitlist_create)(&q->waitlist, dev->dma->buf_count);
-
-        return 0;
-}
-
-
-/* drm_alloc_queue:
-PRE: 1) dev->queuelist[0..dev->queue_count] is allocated and will not
-        disappear (so all deallocation must be done after IOCTLs are off)
-     2) dev->queue_count < dev->queue_slots
-     3) dev->queuelist[i].use_count == 0 and
-        dev->queuelist[i].finalization == 0 if i not in use
-POST: 1) dev->queuelist[i].use_count == 1
-      2) dev->queue_count < dev->queue_slots */
-
-static int DRM(alloc_queue)(drm_device_t *dev)
-{
-        int         i;
-        drm_queue_t *queue;
-        int         oldslots;
-        int         newslots;
-                                /* Check for a free queue */
-        for (i = 0; i < dev->queue_count; i++) {
-                atomic_inc(&dev->queuelist[i]->use_count);
-                if (atomic_read(&dev->queuelist[i]->use_count) == 1
-                    && !atomic_read(&dev->queuelist[i]->finalization)) {
-                        DRM_DEBUG("%d (free)\n", i);
-                        return i;
-                }
-                atomic_dec(&dev->queuelist[i]->use_count);
-        }
-                                /* Allocate a new queue */
-        down(&dev->struct_sem);
-
-        queue = DRM(alloc)(sizeof(*queue), DRM_MEM_QUEUES);
-        memset(queue, 0, sizeof(*queue));
-        atomic_set(&queue->use_count, 1);
-
-        ++dev->queue_count;
-        if (dev->queue_count >= dev->queue_slots) {
-                oldslots = dev->queue_slots * sizeof(*dev->queuelist);
-                if (!dev->queue_slots) dev->queue_slots = 1;
-                dev->queue_slots *= 2;
-                newslots = dev->queue_slots * sizeof(*dev->queuelist);
-
-                dev->queuelist = DRM(realloc)(dev->queuelist,
-                                              oldslots,
-                                              newslots,
-                                              DRM_MEM_QUEUES);
-                if (!dev->queuelist) {
-                        up(&dev->struct_sem);
-                        DRM_DEBUG("out of memory\n");
-                        return -ENOMEM;
-                }
-        }
-        dev->queuelist[dev->queue_count-1] = queue;
-
-        up(&dev->struct_sem);
-        DRM_DEBUG("%d (new)\n", dev->queue_count - 1);
-        return dev->queue_count - 1;
-}
-
-int DRM(resctx)(struct inode *inode, struct file *filp,
-                unsigned int cmd, unsigned long arg)
-{
-        drm_ctx_res_t __user *argp = (void __user *)arg;
-        drm_ctx_res_t   res;
-        drm_ctx_t       ctx;
-        int             i;
-
-        DRM_DEBUG("%d\n", DRM_RESERVED_CONTEXTS);
-        if (copy_from_user(&res, argp, sizeof(res)))
-                return -EFAULT;
-        if (res.count >= DRM_RESERVED_CONTEXTS) {
-                memset(&ctx, 0, sizeof(ctx));
-                for (i = 0; i < DRM_RESERVED_CONTEXTS; i++) {
-                        ctx.handle = i;
-                        if (copy_to_user(&res.contexts[i],
-                                         &i,
-                                         sizeof(i)))
-                                return -EFAULT;
-                }
-        }
-        res.count = DRM_RESERVED_CONTEXTS;
-        if (copy_to_user(argp, &res, sizeof(res)))
-                return -EFAULT;
-        return 0;
-}
-
-int DRM(addctx)(struct inode *inode, struct file *filp,
-                unsigned int cmd, unsigned long arg)
-{
-        drm_file_t      *priv   = filp->private_data;
-        drm_device_t    *dev    = priv->dev;
-        drm_ctx_t       ctx;
-        drm_ctx_t       __user *argp = (void __user *)arg;
-
-        if (copy_from_user(&ctx, argp, sizeof(ctx)))
-                return -EFAULT;
-        if ((ctx.handle = DRM(alloc_queue)(dev)) == DRM_KERNEL_CONTEXT) {
-                                /* Init kernel's context and get a new one. */
-                DRM(init_queue)(dev, dev->queuelist[ctx.handle], &ctx);
-                ctx.handle = DRM(alloc_queue)(dev);
-        }
-        DRM(init_queue)(dev, dev->queuelist[ctx.handle], &ctx);
-        DRM_DEBUG("%d\n", ctx.handle);
-        if (copy_to_user(argp, &ctx, sizeof(ctx)))
-                return -EFAULT;
-        return 0;
-}
-
-int DRM(modctx)(struct inode *inode, struct file *filp,
-                unsigned int cmd, unsigned long arg)
-{
-        drm_file_t      *priv   = filp->private_data;
-        drm_device_t    *dev    = priv->dev;
-        drm_ctx_t       ctx;
-        drm_queue_t     *q;
-
-        if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
-                return -EFAULT;
-
-        DRM_DEBUG("%d\n", ctx.handle);
-
-        if (ctx.handle < 0 || ctx.handle >= dev->queue_count) return -EINVAL;
-        q = dev->queuelist[ctx.handle];
-
-        atomic_inc(&q->use_count);
-        if (atomic_read(&q->use_count) == 1) {
-                                /* No longer in use */
-                atomic_dec(&q->use_count);
-                return -EINVAL;
-        }
-
-        if (DRM_BUFCOUNT(&q->waitlist)) {
-                atomic_dec(&q->use_count);
-                return -EBUSY;
-        }
-
-        q->flags = ctx.flags;
-
-        atomic_dec(&q->use_count);
-        return 0;
-}
-
-int DRM(getctx)(struct inode *inode, struct file *filp,
-                unsigned int cmd, unsigned long arg)
-{
-        drm_file_t      *priv   = filp->private_data;
-        drm_device_t    *dev    = priv->dev;
-        drm_ctx_t       __user *argp = (void __user *)arg;
-        drm_ctx_t       ctx;
-        drm_queue_t     *q;
-
-        if (copy_from_user(&ctx, argp, sizeof(ctx)))
-                return -EFAULT;
-
-        DRM_DEBUG("%d\n", ctx.handle);
-
-        if (ctx.handle >= dev->queue_count) return -EINVAL;
-        q = dev->queuelist[ctx.handle];
-
-        atomic_inc(&q->use_count);
-        if (atomic_read(&q->use_count) == 1) {
-                                /* No longer in use */
-                atomic_dec(&q->use_count);
-                return -EINVAL;
-        }
-
-        ctx.flags = q->flags;
-        atomic_dec(&q->use_count);
-
-        if (copy_to_user(argp, &ctx, sizeof(ctx)))
-                return -EFAULT;
-
-        return 0;
-}
-
-int DRM(switchctx)(struct inode *inode, struct file *filp,
-                   unsigned int cmd, unsigned long arg)
-{
-        drm_file_t      *priv   = filp->private_data;
-        drm_device_t    *dev    = priv->dev;
-        drm_ctx_t       ctx;
-
-        if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
-                return -EFAULT;
-        DRM_DEBUG("%d\n", ctx.handle);
-        return DRM(context_switch)(dev, dev->last_context, ctx.handle);
-}
-
-int DRM(newctx)(struct inode *inode, struct file *filp,
-                unsigned int cmd, unsigned long arg)
-{
-        drm_file_t      *priv   = filp->private_data;
-        drm_device_t    *dev    = priv->dev;
-        drm_ctx_t       ctx;
-
-        if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
-                return -EFAULT;
-        DRM_DEBUG("%d\n", ctx.handle);
-        DRM(context_switch_complete)(dev, ctx.handle);
-
-        return 0;
-}
-
-int DRM(rmctx)(struct inode *inode, struct file *filp,
-               unsigned int cmd, unsigned long arg)
-{
-        drm_file_t      *priv   = filp->private_data;
-        drm_device_t    *dev    = priv->dev;
-        drm_ctx_t       ctx;
-        drm_queue_t     *q;
-        drm_buf_t       *buf;
-
-        if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
-                return -EFAULT;
-        DRM_DEBUG("%d\n", ctx.handle);
-
-        if (ctx.handle >= dev->queue_count) return -EINVAL;
-        q = dev->queuelist[ctx.handle];
-
-        atomic_inc(&q->use_count);
-        if (atomic_read(&q->use_count) == 1) {
-                                /* No longer in use */
-                atomic_dec(&q->use_count);
-                return -EINVAL;
-        }
-
-        atomic_inc(&q->finalization); /* Mark queue in finalization state */
-        atomic_sub(2, &q->use_count); /* Mark queue as unused (pending
-                                         finalization) */
-
-        while (test_and_set_bit(0, &dev->interrupt_flag)) {
-                schedule();
-                if (signal_pending(current)) {
-                        clear_bit(0, &dev->interrupt_flag);
-                        return -EINTR;
-                }
-        }
-                                /* Remove queued buffers */
-        while ((buf = DRM(waitlist_get)(&q->waitlist))) {
-                DRM(free_buffer)(dev, buf);
-        }
-        clear_bit(0, &dev->interrupt_flag);
-
-                                /* Wakeup blocked processes */
-        wake_up_interruptible(&q->read_queue);
-        wake_up_interruptible(&q->write_queue);
-        wake_up_interruptible(&q->flush_queue);
-
-                                /* Finalization over.  Queue is made
-                                   available when both use_count and
-                                   finalization become 0, which won't
-                                   happen until all the waiting processes
-                                   stop waiting. */
-        atomic_dec(&q->finalization);
-        return 0;
-}
-
diff --git a/drivers/char/drm/gamma_dma.c b/drivers/char/drm/gamma_dma.c
deleted file mode 100644
index e486fb8d31e9..000000000000
--- a/drivers/char/drm/gamma_dma.c
+++ /dev/null
@@ -1,946 +0,0 @@
-/* gamma_dma.c -- DMA support for GMX 2000 -*- linux-c -*-
- * Created: Fri Mar 19 14:30:16 1999 by faith@precisioninsight.com
- *
- * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
- * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
- * All Rights Reserved.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sublicense,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice (including the next
- * paragraph) shall be included in all copies or substantial portions of the
- * Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
- * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
- * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
- * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
- * DEALINGS IN THE SOFTWARE.
- *
- * Authors:
- *    Rickard E. (Rik) Faith <faith@valinux.com>
- *
- */
-
-#include "gamma.h"
-#include "drmP.h"
-#include "drm.h"
-#include "gamma_drm.h"
-#include "gamma_drv.h"
-
-#include <linux/interrupt.h>    /* For task queue support */
-#include <linux/delay.h>
-
-static inline void gamma_dma_dispatch(drm_device_t *dev, unsigned long address,
-                                      unsigned long length)
-{
-        drm_gamma_private_t *dev_priv =
-                                (drm_gamma_private_t *)dev->dev_private;
-        mb();
-        while ( GAMMA_READ(GAMMA_INFIFOSPACE) < 2)
-                cpu_relax();
-
-        GAMMA_WRITE(GAMMA_DMAADDRESS, address);
-
-        while (GAMMA_READ(GAMMA_GCOMMANDSTATUS) != 4)
-                cpu_relax();
-
-        GAMMA_WRITE(GAMMA_DMACOUNT, length / 4);
-}
-
-void gamma_dma_quiescent_single(drm_device_t *dev)
-{
-        drm_gamma_private_t *dev_priv =
-                                (drm_gamma_private_t *)dev->dev_private;
-        while (GAMMA_READ(GAMMA_DMACOUNT))
-                cpu_relax();
-
-        while (GAMMA_READ(GAMMA_INFIFOSPACE) < 2)
-                cpu_relax();
-
-        GAMMA_WRITE(GAMMA_FILTERMODE, 1 << 10);
-        GAMMA_WRITE(GAMMA_SYNC, 0);
-
-        do {
-                while (!GAMMA_READ(GAMMA_OUTFIFOWORDS))
-                        cpu_relax();
-        } while (GAMMA_READ(GAMMA_OUTPUTFIFO) != GAMMA_SYNC_TAG);
-}
-
-void gamma_dma_quiescent_dual(drm_device_t *dev)
-{
-        drm_gamma_private_t *dev_priv =
-                                (drm_gamma_private_t *)dev->dev_private;
-        while (GAMMA_READ(GAMMA_DMACOUNT))
-                cpu_relax();
-
-        while (GAMMA_READ(GAMMA_INFIFOSPACE) < 3)
-                cpu_relax();
-
-        GAMMA_WRITE(GAMMA_BROADCASTMASK, 3);
-        GAMMA_WRITE(GAMMA_FILTERMODE, 1 << 10);
-        GAMMA_WRITE(GAMMA_SYNC, 0);
-
-        /* Read from first MX */
-        do {
-                while (!GAMMA_READ(GAMMA_OUTFIFOWORDS))
-                        cpu_relax();
-        } while (GAMMA_READ(GAMMA_OUTPUTFIFO) != GAMMA_SYNC_TAG);
-
-        /* Read from second MX */
-        do {
-                while (!GAMMA_READ(GAMMA_OUTFIFOWORDS + 0x10000))
-                        cpu_relax();
-        } while (GAMMA_READ(GAMMA_OUTPUTFIFO + 0x10000) != GAMMA_SYNC_TAG);
-}
-
-void gamma_dma_ready(drm_device_t *dev)
-{
-        drm_gamma_private_t *dev_priv =
-                                (drm_gamma_private_t *)dev->dev_private;
-        while (GAMMA_READ(GAMMA_DMACOUNT))
-                cpu_relax();
-}
-
-static inline int gamma_dma_is_ready(drm_device_t *dev)
-{
-        drm_gamma_private_t *dev_priv =
-                                (drm_gamma_private_t *)dev->dev_private;
-        return (!GAMMA_READ(GAMMA_DMACOUNT));
-}
-
-irqreturn_t gamma_driver_irq_handler( DRM_IRQ_ARGS )
-{
-        drm_device_t     *dev = (drm_device_t *)arg;
-        drm_device_dma_t *dma = dev->dma;
-        drm_gamma_private_t *dev_priv =
-                                (drm_gamma_private_t *)dev->dev_private;
-
-        /* FIXME: should check whether we're actually interested in the interrupt? */
-        atomic_inc(&dev->counts[6]); /* _DRM_STAT_IRQ */
-
-        while (GAMMA_READ(GAMMA_INFIFOSPACE) < 3)
-                cpu_relax();
-
-        GAMMA_WRITE(GAMMA_GDELAYTIMER, 0xc350/2); /* 0x05S */
-        GAMMA_WRITE(GAMMA_GCOMMANDINTFLAGS, 8);
-        GAMMA_WRITE(GAMMA_GINTFLAGS, 0x2001);
-        if (gamma_dma_is_ready(dev)) {
-                                /* Free previous buffer */
-                if (test_and_set_bit(0, &dev->dma_flag))
-                        return IRQ_HANDLED;
-                if (dma->this_buffer) {
-                        gamma_free_buffer(dev, dma->this_buffer);
-                        dma->this_buffer = NULL;
-                }
-                clear_bit(0, &dev->dma_flag);
-
-                /* Dispatch new buffer */
-                schedule_work(&dev->work);
-        }
-        return IRQ_HANDLED;
-}
-
-/* Only called by gamma_dma_schedule. */
-static int gamma_do_dma(drm_device_t *dev, int locked)
-{
-        unsigned long    address;
-        unsigned long    length;
-        drm_buf_t        *buf;
-        int              retcode = 0;
-        drm_device_dma_t *dma = dev->dma;
-
-        if (test_and_set_bit(0, &dev->dma_flag)) return -EBUSY;
-
-
-        if (!dma->next_buffer) {
-                DRM_ERROR("No next_buffer\n");
-                clear_bit(0, &dev->dma_flag);
-                return -EINVAL;
-        }
-
-        buf     = dma->next_buffer;
-        /* WE NOW ARE ON LOGICAL PAGES!! - using page table setup in dma_init */
-        /* So we pass the buffer index value into the physical page offset */
-        address = buf->idx << 12;
-        length  = buf->used;
-
-        DRM_DEBUG("context %d, buffer %d (%ld bytes)\n",
-                  buf->context, buf->idx, length);
-
-        if (buf->list == DRM_LIST_RECLAIM) {
-                gamma_clear_next_buffer(dev);
-                gamma_free_buffer(dev, buf);
-                clear_bit(0, &dev->dma_flag);
-                return -EINVAL;
-        }
-
-        if (!length) {
-                DRM_ERROR("0 length buffer\n");
-                gamma_clear_next_buffer(dev);
-                gamma_free_buffer(dev, buf);
-                clear_bit(0, &dev->dma_flag);
-                return 0;
-        }
-
-        if (!gamma_dma_is_ready(dev)) {
-                clear_bit(0, &dev->dma_flag);
-                return -EBUSY;
-        }
-
-        if (buf->while_locked) {
-                if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
-                        DRM_ERROR("Dispatching buffer %d from pid %d"
-                                  " \"while locked\", but no lock held\n",
-                                  buf->idx, current->pid);
-                }
-        } else {
-                if (!locked && !gamma_lock_take(&dev->lock.hw_lock->lock,
-                                              DRM_KERNEL_CONTEXT)) {
-                        clear_bit(0, &dev->dma_flag);
-                        return -EBUSY;
-                }
-        }
-
-        if (dev->last_context != buf->context
-            && !(dev->queuelist[buf->context]->flags
-                 & _DRM_CONTEXT_PRESERVED)) {
-                                /* PRE: dev->last_context != buf->context */
-                if (DRM(context_switch)(dev, dev->last_context,
-                                        buf->context)) {
-                        DRM(clear_next_buffer)(dev);
-                        DRM(free_buffer)(dev, buf);
-                }
-                retcode = -EBUSY;
-                goto cleanup;
-
-                                /* POST: we will wait for the context
-                                   switch and will dispatch on a later call
-                                   when dev->last_context == buf->context.
-                                   NOTE WE HOLD THE LOCK THROUGHOUT THIS
-                                   TIME! */
-        }
-
-        gamma_clear_next_buffer(dev);
-        buf->pending     = 1;
-        buf->waiting     = 0;
-        buf->list        = DRM_LIST_PEND;
-
-        /* WE NOW ARE ON LOGICAL PAGES!!! - overriding address */
-        address = buf->idx << 12;
-
-        gamma_dma_dispatch(dev, address, length);
-        gamma_free_buffer(dev, dma->this_buffer);
-        dma->this_buffer = buf;
-
-        atomic_inc(&dev->counts[7]); /* _DRM_STAT_DMA */
-        atomic_add(length, &dev->counts[8]); /* _DRM_STAT_PRIMARY */
-
-        if (!buf->while_locked && !dev->context_flag && !locked) {
-                if (gamma_lock_free(dev, &dev->lock.hw_lock->lock,
-                                  DRM_KERNEL_CONTEXT)) {
-                        DRM_ERROR("\n");
-                }
-        }
-cleanup:
-
-        clear_bit(0, &dev->dma_flag);
-
-
-        return retcode;
-}
-
-static void gamma_dma_timer_bh(unsigned long dev)
-{
-        gamma_dma_schedule((drm_device_t *)dev, 0);
-}
-
-void gamma_irq_immediate_bh(void *dev)
-{
-        gamma_dma_schedule(dev, 0);
-}
-
-int gamma_dma_schedule(drm_device_t *dev, int locked)
-{
-        int              next;
-        drm_queue_t      *q;
-        drm_buf_t        *buf;
-        int              retcode   = 0;
-        int              processed = 0;
-        int              missed;
-        int              expire    = 20;
-        drm_device_dma_t *dma      = dev->dma;
-
-        if (test_and_set_bit(0, &dev->interrupt_flag)) {
-                                /* Not reentrant */
-                atomic_inc(&dev->counts[10]); /* _DRM_STAT_MISSED */
-                return -EBUSY;
-        }
-        missed = atomic_read(&dev->counts[10]);
-
-
-again:
-        if (dev->context_flag) {
-                clear_bit(0, &dev->interrupt_flag);
-                return -EBUSY;
-        }
-        if (dma->next_buffer) {
-                                /* Unsent buffer that was previously
-                                   selected, but that couldn't be sent
-                                   because the lock could not be obtained
-                                   or the DMA engine wasn't ready.  Try
-                                   again. */
-                if (!(retcode = gamma_do_dma(dev, locked))) ++processed;
-        } else {
-                do {
-                        next = gamma_select_queue(dev, gamma_dma_timer_bh);
-                        if (next >= 0) {
-                                q   = dev->queuelist[next];
-                                buf = gamma_waitlist_get(&q->waitlist);
-                                dma->next_buffer = buf;
-                                dma->next_queue  = q;
-                                if (buf && buf->list == DRM_LIST_RECLAIM) {
-                                        gamma_clear_next_buffer(dev);
-                                        gamma_free_buffer(dev, buf);
-                                }
-                        }
-                } while (next >= 0 && !dma->next_buffer);
-                if (dma->next_buffer) {
-                        if (!(retcode = gamma_do_dma(dev, locked))) {
-                                ++processed;
-                        }
-                }
-        }
-
-        if (--expire) {
-                if (missed != atomic_read(&dev->counts[10])) {
-                        if (gamma_dma_is_ready(dev)) goto again;
-                }
-                if (processed && gamma_dma_is_ready(dev)) {
-                        processed = 0;
-                        goto again;
-                }
-        }
-
-        clear_bit(0, &dev->interrupt_flag);
-
-        return retcode;
-}
-
-static int gamma_dma_priority(struct file *filp, 
-                              drm_device_t *dev, drm_dma_t *d)
-{
-        unsigned long     address;
-        unsigned long     length;
-        int               must_free = 0;
-        int               retcode   = 0;
-        int               i;
-        int               idx;
-        drm_buf_t         *buf;
-        drm_buf_t         *last_buf = NULL;
-        drm_device_dma_t  *dma      = dev->dma;
-        int               *send_indices = NULL;
-        int               *send_sizes = NULL;
-
-        DECLARE_WAITQUEUE(entry, current);
-
-                                /* Turn off interrupt handling */
-        while (test_and_set_bit(0, &dev->interrupt_flag)) {
-                schedule();
-                if (signal_pending(current)) return -EINTR;
-        }
-        if (!(d->flags & _DRM_DMA_WHILE_LOCKED)) {
-                while (!gamma_lock_take(&dev->lock.hw_lock->lock,
-                                      DRM_KERNEL_CONTEXT)) {
-                        schedule();
-                        if (signal_pending(current)) {
-                                clear_bit(0, &dev->interrupt_flag);
-                                return -EINTR;
-                        }
-                }
-                ++must_free;
-        }
-
-        send_indices = DRM(alloc)(d->send_count * sizeof(*send_indices),
-                                  DRM_MEM_DRIVER);
-        if (send_indices == NULL)
-                return -ENOMEM;
-        if (copy_from_user(send_indices, d->send_indices, 
-                           d->send_count * sizeof(*send_indices))) {
-                retcode = -EFAULT;
-                goto cleanup;
-        }
-        
-        send_sizes = DRM(alloc)(d->send_count * sizeof(*send_sizes),
-                                DRM_MEM_DRIVER);
-        if (send_sizes == NULL)
-                return -ENOMEM;
-        if (copy_from_user(send_sizes, d->send_sizes, 
-                           d->send_count * sizeof(*send_sizes))) {
-                retcode = -EFAULT;
-                goto cleanup;
-        }
-
-        for (i = 0; i < d->send_count; i++) {
-                idx = send_indices[i];
-                if (idx < 0 || idx >= dma->buf_count) {
-                        DRM_ERROR("Index %d (of %d max)\n",
-                                  send_indices[i], dma->buf_count - 1);
-                        continue;
-                }
-                buf = dma->buflist[ idx ];
-                if (buf->filp != filp) {
-                        DRM_ERROR("Process %d using buffer not owned\n",
-                                  current->pid);
-                        retcode = -EINVAL;
-                        goto cleanup;
-                }
-                if (buf->list != DRM_LIST_NONE) {
-                        DRM_ERROR("Process %d using buffer on list %d\n",
-                                  current->pid, buf->list);
-                        retcode = -EINVAL;
-                        goto cleanup;
-                }
-                                /* This isn't a race condition on
-                                   buf->list, since our concern is the
-                                   buffer reclaim during the time the
-                                   process closes the /dev/drm? handle, so
-                                   it can't also be doing DMA. */
-                buf->list         = DRM_LIST_PRIO;
-                buf->used         = send_sizes[i];
-                buf->context      = d->context;
-                buf->while_locked = d->flags & _DRM_DMA_WHILE_LOCKED;
-                address           = (unsigned long)buf->address;
-                length            = buf->used;
-                if (!length) {
-                        DRM_ERROR("0 length buffer\n");
-                }
-                if (buf->pending) {
-                        DRM_ERROR("Sending pending buffer:"
-                                  " buffer %d, offset %d\n",
-                                  send_indices[i], i);
-                        retcode = -EINVAL;
-                        goto cleanup;
-                }
-                if (buf->waiting) {
-                        DRM_ERROR("Sending waiting buffer:"
-                                  " buffer %d, offset %d\n",
-                                  send_indices[i], i);
-                        retcode = -EINVAL;
-                        goto cleanup;
-                }
-                buf->pending = 1;
-
-                if (dev->last_context != buf->context
-                    && !(dev->queuelist[buf->context]->flags
-                         & _DRM_CONTEXT_PRESERVED)) {
-                        add_wait_queue(&dev->context_wait, &entry);
-                        current->state = TASK_INTERRUPTIBLE;
-                                /* PRE: dev->last_context != buf->context */
-                        DRM(context_switch)(dev, dev->last_context,
-                                            buf->context);
-                                /* POST: we will wait for the context
-                                   switch and will dispatch on a later call
-                                   when dev->last_context == buf->context.
-                                   NOTE WE HOLD THE LOCK THROUGHOUT THIS
-                                   TIME! */
-                        schedule();
-                        current->state = TASK_RUNNING;
-                        remove_wait_queue(&dev->context_wait, &entry);
-                        if (signal_pending(current)) {
-                                retcode = -EINTR;
-                                goto cleanup;
-                        }
-                        if (dev->last_context != buf->context) {
-                                DRM_ERROR("Context mismatch: %d %d\n",
-                                          dev->last_context,
-                                          buf->context);
-                        }
-                }
-
-                gamma_dma_dispatch(dev, address, length);
-                atomic_inc(&dev->counts[9]); /* _DRM_STAT_SPECIAL */
-                atomic_add(length, &dev->counts[8]); /* _DRM_STAT_PRIMARY */
-
-                if (last_buf) {
-                        gamma_free_buffer(dev, last_buf);
-                }
-                last_buf = buf;
-        }
-
-
-cleanup:
-        if (last_buf) {
-                gamma_dma_ready(dev);
-                gamma_free_buffer(dev, last_buf);
-        }
-        if (send_indices)
-                DRM(free)(send_indices, d->send_count * sizeof(*send_indices), 
-                          DRM_MEM_DRIVER);
-        if (send_sizes)
-                DRM(free)(send_sizes, d->send_count * sizeof(*send_sizes), 
-                          DRM_MEM_DRIVER);
-
-        if (must_free && !dev->context_flag) {
-                if (gamma_lock_free(dev, &dev->lock.hw_lock->lock,
-                                  DRM_KERNEL_CONTEXT)) {
-                        DRM_ERROR("\n");
-                }
-        }
-        clear_bit(0, &dev->interrupt_flag);
-        return retcode;
-}
-
-static int gamma_dma_send_buffers(struct file *filp,
-                                  drm_device_t *dev, drm_dma_t *d)
-{
-        DECLARE_WAITQUEUE(entry, current);
-        drm_buf_t         *last_buf = NULL;
-        int               retcode   = 0;
-        drm_device_dma_t  *dma      = dev->dma;
-        int               send_index;
-
-        if (get_user(send_index, &d->send_indices[d->send_count-1]))
-                return -EFAULT;
-
-        if (d->flags & _DRM_DMA_BLOCK) {
-                last_buf = dma->buflist[send_index];
-                add_wait_queue(&last_buf->dma_wait, &entry);
-        }
-
-        if ((retcode = gamma_dma_enqueue(filp, d))) {
-                if (d->flags & _DRM_DMA_BLOCK)
-                        remove_wait_queue(&last_buf->dma_wait, &entry);
-                return retcode;
-        }
-
-        gamma_dma_schedule(dev, 0);
-
-        if (d->flags & _DRM_DMA_BLOCK) {
-                DRM_DEBUG("%d waiting\n", current->pid);
-                for (;;) {
-                        current->state = TASK_INTERRUPTIBLE;
-                        if (!last_buf->waiting && !last_buf->pending)
-                                break; /* finished */
-                        schedule();
-                        if (signal_pending(current)) {
-                                retcode = -EINTR; /* Can't restart */
-                                break;
-                        }
-                }
-                current->state = TASK_RUNNING;
-                DRM_DEBUG("%d running\n", current->pid);
-                remove_wait_queue(&last_buf->dma_wait, &entry);
-                if (!retcode
-                    || (last_buf->list==DRM_LIST_PEND && !last_buf->pending)) {
-                        if (!waitqueue_active(&last_buf->dma_wait)) {
-                                gamma_free_buffer(dev, last_buf);
-                        }
-                }
-                if (retcode) {
-                        DRM_ERROR("ctx%d w%d p%d c%ld i%d l%d pid:%d\n",
-                                  d->context,
-                                  last_buf->waiting,
-                                  last_buf->pending,
-                                  (long)DRM_WAITCOUNT(dev, d->context),
-                                  last_buf->idx,
-                                  last_buf->list,
-                                  current->pid);
-                }
-        }
-        return retcode;
-}
-
-int gamma_dma(struct inode *inode, struct file *filp, unsigned int cmd,
-              unsigned long arg)
-{
-        drm_file_t        *priv     = filp->private_data;
-        drm_device_t      *dev      = priv->dev;
-        drm_device_dma_t  *dma      = dev->dma;
-        int               retcode   = 0;
-        drm_dma_t         __user *argp = (void __user *)arg;
-        drm_dma_t         d;
-
-        if (copy_from_user(&d, argp, sizeof(d)))
-                return -EFAULT;
-
-        if (d.send_count < 0 || d.send_count > dma->buf_count) {
-                DRM_ERROR("Process %d trying to send %d buffers (of %d max)\n",
-                          current->pid, d.send_count, dma->buf_count);
-                return -EINVAL;
-        }
-
-        if (d.request_count < 0 || d.request_count > dma->buf_count) {
-                DRM_ERROR("Process %d trying to get %d buffers (of %d max)\n",
-                          current->pid, d.request_count, dma->buf_count);
-                return -EINVAL;
-        }
-
-        if (d.send_count) {
-                if (d.flags & _DRM_DMA_PRIORITY)
-                        retcode = gamma_dma_priority(filp, dev, &d);
-                else
-                        retcode = gamma_dma_send_buffers(filp, dev, &d);
-        }
-
-        d.granted_count = 0;
-
-        if (!retcode && d.request_count) {
-                retcode = gamma_dma_get_buffers(filp, &d);
-        }
-
-        DRM_DEBUG("%d returning, granted = %d\n",
-                  current->pid, d.granted_count);
-        if (copy_to_user(argp, &d, sizeof(d)))
-                return -EFAULT;
-
-        return retcode;
-}
-
-/* =============================================================
- * DMA initialization, cleanup
- */
-
-static int gamma_do_init_dma( drm_device_t *dev, drm_gamma_init_t *init )
-{
-        drm_gamma_private_t *dev_priv;
-        drm_device_dma_t    *dma = dev->dma;
-        drm_buf_t           *buf;
-        int i;
-        struct list_head    *list;
-        unsigned long       *pgt;
-
-        DRM_DEBUG( "%s\n", __FUNCTION__ );
-
-        dev_priv = DRM(alloc)( sizeof(drm_gamma_private_t),
-                                                        DRM_MEM_DRIVER );
-        if ( !dev_priv )
-                return -ENOMEM;
-
-        dev->dev_private = (void *)dev_priv;
-
-        memset( dev_priv, 0, sizeof(drm_gamma_private_t) );
-
-        dev_priv->num_rast = init->num_rast;
-
-        list_for_each(list, &dev->maplist->head) {
-                drm_map_list_t *r_list = list_entry(list, drm_map_list_t, head);
-                if( r_list->map &&
-                    r_list->map->type == _DRM_SHM &&
-                    r_list->map->flags & _DRM_CONTAINS_LOCK ) {
-                        dev_priv->sarea = r_list->map;
-                        break;
-                }
-        }
-        
-        dev_priv->mmio0 = drm_core_findmap(dev, init->mmio0);
-        dev_priv->mmio1 = drm_core_findmap(dev, init->mmio1);
-        dev_priv->mmio2 = drm_core_findmap(dev, init->mmio2);
-        dev_priv->mmio3 = drm_core_findmap(dev, init->mmio3);
-        
-        dev_priv->sarea_priv = (drm_gamma_sarea_t *)
-                ((u8 *)dev_priv->sarea->handle +
-                 init->sarea_priv_offset);
-
-        if (init->pcimode) {
-                buf = dma->buflist[GLINT_DRI_BUF_COUNT];
-                pgt = buf->address;
-
-                for (i = 0; i < GLINT_DRI_BUF_COUNT; i++) {
-                        buf = dma->buflist[i];
-                        *pgt = virt_to_phys((void*)buf->address) | 0x07;
-                        pgt++;
-                }
-
-                buf = dma->buflist[GLINT_DRI_BUF_COUNT];
-        } else {
-                dev->agp_buffer_map = drm_core_findmap(dev, init->buffers_offset);
-                drm_core_ioremap( dev->agp_buffer_map, dev);
-
-                buf = dma->buflist[GLINT_DRI_BUF_COUNT];
-                pgt = buf->address;
-
-                for (i = 0; i < GLINT_DRI_BUF_COUNT; i++) {
-                        buf = dma->buflist[i];
-                        *pgt = (unsigned long)buf->address + 0x07;
-                        pgt++;
-                }
-
-                buf = dma->buflist[GLINT_DRI_BUF_COUNT];
-
-                while (GAMMA_READ(GAMMA_INFIFOSPACE) < 1);
-                GAMMA_WRITE( GAMMA_GDMACONTROL, 0xe);
-        }
-        while (GAMMA_READ(GAMMA_INFIFOSPACE) < 2);
-        GAMMA_WRITE( GAMMA_PAGETABLEADDR, virt_to_phys((void*)buf->address) );
-        GAMMA_WRITE( GAMMA_PAGETABLELENGTH, 2 );
-
-        return 0;
-}
-
-int gamma_do_cleanup_dma( drm_device_t *dev )
-{
-        DRM_DEBUG( "%s\n", __FUNCTION__ );
-
-        /* Make sure interrupts are disabled here because the uninstall ioctl
-         * may not have been called from userspace and after dev_private
-         * is freed, it's too late.
-         */
-        if (drm_core_check_feature(dev, DRIVER_HAVE_IRQ))
-                if ( dev->irq_enabled ) 
-                        DRM(irq_uninstall)(dev);
-
-        if ( dev->dev_private ) {
-
-                if ( dev->agp_buffer_map != NULL )
-                        drm_core_ioremapfree( dev->agp_buffer_map, dev );
-
-                DRM(free)( dev->dev_private, sizeof(drm_gamma_private_t),
-                           DRM_MEM_DRIVER );
-                dev->dev_private = NULL;
-        }
-
-        return 0;
-}
-
-int gamma_dma_init( struct inode *inode, struct file *filp,
-                  unsigned int cmd, unsigned long arg )
-{
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->dev;
-        drm_gamma_init_t init;
-
-        LOCK_TEST_WITH_RETURN( dev, filp );
-
-        if ( copy_from_user( &init, (drm_gamma_init_t __user *)arg, sizeof(init) ) )
-                return -EFAULT;
-
-        switch ( init.func ) {
-        case GAMMA_INIT_DMA:
-                return gamma_do_init_dma( dev, &init );
-        case GAMMA_CLEANUP_DMA:
-                return gamma_do_cleanup_dma( dev );
-        }
-
-        return -EINVAL;
-}
-
-static int gamma_do_copy_dma( drm_device_t *dev, drm_gamma_copy_t *copy )
-{
-        drm_device_dma_t    *dma = dev->dma;
-        unsigned int        *screenbuf;
-
-        DRM_DEBUG( "%s\n", __FUNCTION__ );
-
-        /* We've DRM_RESTRICTED this DMA buffer */
-
-        screenbuf = dma->buflist[ GLINT_DRI_BUF_COUNT + 1 ]->address;
-
-#if 0
-        *buffer++ = 0x180;      /* Tag (FilterMode) */
-        *buffer++ = 0x200;      /* Allow FBColor through */
-        *buffer++ = 0x53B;      /* Tag */
-        *buffer++ = copy->Pitch;
-        *buffer++ = 0x53A;      /* Tag */
-        *buffer++ = copy->SrcAddress;
-        *buffer++ = 0x539;      /* Tag */
-        *buffer++ = copy->WidthHeight; /* Initiates transfer */
-        *buffer++ = 0x53C;      /* Tag - DMAOutputAddress */
-        *buffer++ = virt_to_phys((void*)screenbuf);
-        *buffer++ = 0x53D;      /* Tag - DMAOutputCount */
-        *buffer++ = copy->Count; /* Reads HostOutFifo BLOCKS until ..*/
-
-        /* Data now sitting in dma->buflist[ GLINT_DRI_BUF_COUNT + 1 ] */
-        /* Now put it back to the screen */
-
-        *buffer++ = 0x180;      /* Tag (FilterMode) */
-        *buffer++ = 0x400;      /* Allow Sync through */
-        *buffer++ = 0x538;      /* Tag - DMARectangleReadTarget */
-        *buffer++ = 0x155;      /* FBSourceData | count */
-        *buffer++ = 0x537;      /* Tag */
-        *buffer++ = copy->Pitch;
-        *buffer++ = 0x536;      /* Tag */
-        *buffer++ = copy->DstAddress;
-        *buffer++ = 0x535;      /* Tag */
-        *buffer++ = copy->WidthHeight; /* Initiates transfer */
-        *buffer++ = 0x530;      /* Tag - DMAAddr */
-        *buffer++ = virt_to_phys((void*)screenbuf);
-        *buffer++ = 0x531;
-        *buffer++ = copy->Count; /* initiates DMA transfer of color data */
-#endif
-
-        /* need to dispatch it now */
-
-        return 0;
-}
-
-int gamma_dma_copy( struct inode *inode, struct file *filp,
-                  unsigned int cmd, unsigned long arg )
-{
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->dev;
-        drm_gamma_copy_t copy;
-
-        if ( copy_from_user( &copy, (drm_gamma_copy_t __user *)arg, sizeof(copy) ) )
-                return -EFAULT;
-
-        return gamma_do_copy_dma( dev, &copy );
-}
-
-/* =============================================================
- * Per Context SAREA Support
- */
-
-int gamma_getsareactx(struct inode *inode, struct file *filp,
-                     unsigned int cmd, unsigned long arg)
-{
-        drm_file_t      *priv   = filp->private_data;
-        drm_device_t    *dev    = priv->dev;
-        drm_ctx_priv_map_t __user *argp = (void __user *)arg;
-        drm_ctx_priv_map_t request;
-        drm_map_t *map;
-
-        if (copy_from_user(&request, argp, sizeof(request)))
-                return -EFAULT;
-
-        down(&dev->struct_sem);
-        if ((int)request.ctx_id >= dev->max_context) {
-                up(&dev->struct_sem);
-                return -EINVAL;
-        }
-
-        map = dev->context_sareas[request.ctx_id];
-        up(&dev->struct_sem);
-
-        request.handle = map->handle;
-        if (copy_to_user(argp, &request, sizeof(request)))
-                return -EFAULT;
-        return 0;
-}
-
-int gamma_setsareactx(struct inode *inode, struct file *filp,
-                     unsigned int cmd, unsigned long arg)
-{
-        drm_file_t      *priv   = filp->private_data;
-        drm_device_t    *dev    = priv->dev;
-        drm_ctx_priv_map_t request;
-        drm_map_t *map = NULL;
-        drm_map_list_t *r_list;
-        struct list_head *list;
-
-        if (copy_from_user(&request,
-                           (drm_ctx_priv_map_t __user *)arg,
-                           sizeof(request)))
-                return -EFAULT;
-
-        down(&dev->struct_sem);
-        r_list = NULL;
-        list_for_each(list, &dev->maplist->head) {
-                r_list = list_entry(list, drm_map_list_t, head);
-                if(r_list->map &&
-                   r_list->map->handle == request.handle) break;
-        }
-        if (list == &(dev->maplist->head)) {
-                up(&dev->struct_sem);
-                return -EINVAL;
-        }
-        map = r_list->map;
-        up(&dev->struct_sem);
-
-        if (!map) return -EINVAL;
-
-        down(&dev->struct_sem);
-        if ((int)request.ctx_id >= dev->max_context) {
-                up(&dev->struct_sem);
-                return -EINVAL;
-        }
-        dev->context_sareas[request.ctx_id] = map;
-        up(&dev->struct_sem);
-        return 0;
-}
-
-void gamma_driver_irq_preinstall( drm_device_t *dev ) {
-        drm_gamma_private_t *dev_priv =
-                                (drm_gamma_private_t *)dev->dev_private;
-
-        while(GAMMA_READ(GAMMA_INFIFOSPACE) < 2)
-                cpu_relax();
-
-        GAMMA_WRITE( GAMMA_GCOMMANDMODE,        0x00000004 );
-        GAMMA_WRITE( GAMMA_GDMACONTROL,         0x00000000 );
-}
-
-void gamma_driver_irq_postinstall( drm_device_t *dev ) {
-        drm_gamma_private_t *dev_priv =
-                                (drm_gamma_private_t *)dev->dev_private;
-
-        while(GAMMA_READ(GAMMA_INFIFOSPACE) < 3)
-                cpu_relax();
-
-        GAMMA_WRITE( GAMMA_GINTENABLE,          0x00002001 );
-        GAMMA_WRITE( GAMMA_COMMANDINTENABLE,    0x00000008 );
-        GAMMA_WRITE( GAMMA_GDELAYTIMER,         0x00039090 );
-}
-
-void gamma_driver_irq_uninstall( drm_device_t *dev ) {
-        drm_gamma_private_t *dev_priv =
-                                (drm_gamma_private_t *)dev->dev_private;
-        if (!dev_priv)
-                return;
-
-        while(GAMMA_READ(GAMMA_INFIFOSPACE) < 3)
-                cpu_relax();
-
-        GAMMA_WRITE( GAMMA_GDELAYTIMER,         0x00000000 );
-        GAMMA_WRITE( GAMMA_COMMANDINTENABLE,    0x00000000 );
-        GAMMA_WRITE( GAMMA_GINTENABLE,          0x00000000 );
-}
-
-extern drm_ioctl_desc_t DRM(ioctls)[];
-
-static int gamma_driver_preinit(drm_device_t *dev)
-{
-        /* reset the finish ioctl */
-        DRM(ioctls)[DRM_IOCTL_NR(DRM_IOCTL_FINISH)].func = DRM(finish);
-        return 0;
-}
-
-static void gamma_driver_pretakedown(drm_device_t *dev)
-{
-        gamma_do_cleanup_dma(dev);
-}
-
-static void gamma_driver_dma_ready(drm_device_t *dev)
-{
-        gamma_dma_ready(dev);
-}
-
-static int gamma_driver_dma_quiescent(drm_device_t *dev)
-{
-        drm_gamma_private_t *dev_priv = (
-                drm_gamma_private_t *)dev->dev_private;
-        if (dev_priv->num_rast == 2)
-                gamma_dma_quiescent_dual(dev);
-        else gamma_dma_quiescent_single(dev);
-        return 0;
-}
-
-void gamma_driver_register_fns(drm_device_t *dev)
-{
-        dev->driver_features = DRIVER_USE_AGP | DRIVER_USE_MTRR | DRIVER_PCI_DMA | DRIVER_HAVE_DMA | DRIVER_HAVE_IRQ;
-        DRM(fops).read = gamma_fops_read;
-        DRM(fops).poll = gamma_fops_poll;
-        dev->driver.preinit = gamma_driver_preinit;
-        dev->driver.pretakedown = gamma_driver_pretakedown;
-        dev->driver.dma_ready = gamma_driver_dma_ready;
-        dev->driver.dma_quiescent = gamma_driver_dma_quiescent;
-        dev->driver.dma_flush_block_and_flush = gamma_flush_block_and_flush;
-        dev->driver.dma_flush_unblock = gamma_flush_unblock;
-}
diff --git a/drivers/char/drm/gamma_drm.h b/drivers/char/drm/gamma_drm.h
deleted file mode 100644
index 20819ded0e15..000000000000
--- a/drivers/char/drm/gamma_drm.h
+++ /dev/null
@@ -1,90 +0,0 @@
-#ifndef _GAMMA_DRM_H_
-#define _GAMMA_DRM_H_
-
-typedef struct _drm_gamma_tex_region {
-        unsigned char next, prev; /* indices to form a circular LRU  */
-        unsigned char in_use;   /* owned by a client, or free? */
-        int age;                /* tracked by clients to update local LRU's */
-} drm_gamma_tex_region_t;
-
-typedef struct {
-        unsigned int    GDeltaMode;
-        unsigned int    GDepthMode;
-        unsigned int    GGeometryMode;
-        unsigned int    GTransformMode;
-} drm_gamma_context_regs_t;
-
-typedef struct _drm_gamma_sarea {
-        drm_gamma_context_regs_t context_state;
-
-        unsigned int dirty;
-
-
-        /* Maintain an LRU of contiguous regions of texture space.  If
-         * you think you own a region of texture memory, and it has an
-         * age different to the one you set, then you are mistaken and
-         * it has been stolen by another client.  If global texAge
-         * hasn't changed, there is no need to walk the list.
-         *
-         * These regions can be used as a proxy for the fine-grained
-         * texture information of other clients - by maintaining them
-         * in the same lru which is used to age their own textures,
-         * clients have an approximate lru for the whole of global
-         * texture space, and can make informed decisions as to which
-         * areas to kick out.  There is no need to choose whether to
-         * kick out your own texture or someone else's - simply eject
-         * them all in LRU order.  
-         */
-   
-#define GAMMA_NR_TEX_REGIONS 64
-        drm_gamma_tex_region_t texList[GAMMA_NR_TEX_REGIONS+1]; 
-                                /* Last elt is sentinal */
-        int texAge;             /* last time texture was uploaded */
-        int last_enqueue;       /* last time a buffer was enqueued */
-        int last_dispatch;      /* age of the most recently dispatched buffer */
-        int last_quiescent;     /*  */
-        int ctxOwner;           /* last context to upload state */
-
-        int vertex_prim;
-} drm_gamma_sarea_t;
-
-/* WARNING: If you change any of these defines, make sure to change the
- * defines in the Xserver file (xf86drmGamma.h)
- */
-
-/* Gamma specific ioctls
- * The device specific ioctl range is 0x40 to 0x79.
- */
-#define DRM_IOCTL_GAMMA_INIT            DRM_IOW( 0x40, drm_gamma_init_t)
-#define DRM_IOCTL_GAMMA_COPY            DRM_IOW( 0x41, drm_gamma_copy_t)
-
-typedef struct drm_gamma_copy {
-        unsigned int    DMAOutputAddress;
-        unsigned int    DMAOutputCount;
-        unsigned int    DMAReadGLINTSource;
-        unsigned int    DMARectangleWriteAddress;
-        unsigned int    DMARectangleWriteLinePitch;
-        unsigned int    DMARectangleWrite;
-        unsigned int    DMARectangleReadAddress;
-        unsigned int    DMARectangleReadLinePitch;
-        unsigned int    DMARectangleRead;
-        unsigned int    DMARectangleReadTarget;
-} drm_gamma_copy_t;
-
-typedef struct drm_gamma_init {
-        enum {
-                GAMMA_INIT_DMA    = 0x01,
-                GAMMA_CLEANUP_DMA = 0x02
-        } func;
-
-        int sarea_priv_offset;
-        int pcimode;
-        unsigned int mmio0;
-        unsigned int mmio1;
-        unsigned int mmio2;
-        unsigned int mmio3;
-        unsigned int buffers_offset;
-        int num_rast;
-} drm_gamma_init_t;
-
-#endif /* _GAMMA_DRM_H_ */
diff --git a/drivers/char/drm/gamma_drv.c b/drivers/char/drm/gamma_drv.c
deleted file mode 100644
index e7e64b62792a..000000000000
--- a/drivers/char/drm/gamma_drv.c
+++ /dev/null
@@ -1,59 +0,0 @@
-/* gamma.c -- 3dlabs GMX 2000 driver -*- linux-c -*-
- * Created: Mon Jan  4 08:58:31 1999 by faith@precisioninsight.com
- *
- * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
- * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
- * All Rights Reserved.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sublicense,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice (including the next
- * paragraph) shall be included in all copies or substantial portions of the
- * Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
- * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
- * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
- * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
- * DEALINGS IN THE SOFTWARE.
- *
- * Authors:
- *    Rickard E. (Rik) Faith <faith@valinux.com>
- *    Gareth Hughes <gareth@valinux.com>
- */
-
-#include <linux/config.h>
-#include "gamma.h"
-#include "drmP.h"
-#include "drm.h"
-#include "gamma_drm.h"
-#include "gamma_drv.h"
-
-#include "drm_auth.h"
-#include "drm_agpsupport.h"
-#include "drm_bufs.h"
-#include "gamma_context.h"      /* NOTE! */
-#include "drm_dma.h"
-#include "gamma_old_dma.h"      /* NOTE */
-#include "drm_drawable.h"
-#include "drm_drv.h"
-
-#include "drm_fops.h"
-#include "drm_init.h"
-#include "drm_ioctl.h"
-#include "drm_irq.h"
-#include "gamma_lists.h"        /* NOTE */
-#include "drm_lock.h"
-#include "gamma_lock.h"         /* NOTE */
-#include "drm_memory.h"
-#include "drm_proc.h"
-#include "drm_vm.h"
-#include "drm_stub.h"
-#include "drm_scatter.h"
diff --git a/drivers/char/drm/gamma_drv.h b/drivers/char/drm/gamma_drv.h
deleted file mode 100644
index 146fcc6253cd..000000000000
--- a/drivers/char/drm/gamma_drv.h
+++ /dev/null
@@ -1,147 +0,0 @@
-/* gamma_drv.h -- Private header for 3dlabs GMX 2000 driver -*- linux-c -*-
- * Created: Mon Jan  4 10:05:05 1999 by faith@precisioninsight.com
- *
- * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
- * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
- * All rights reserved.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sublicense,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice (including the next
- * paragraph) shall be included in all copies or substantial portions of the
- * Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
- * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
- * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
- * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
- * DEALINGS IN THE SOFTWARE.
- *
- * Authors:
- *    Rickard E. (Rik) Faith <faith@valinux.com>
- *
- */
-
-#ifndef _GAMMA_DRV_H_
-#define _GAMMA_DRV_H_
-
-typedef struct drm_gamma_private {
-        drm_gamma_sarea_t *sarea_priv;
-        drm_map_t *sarea;
-        drm_map_t *mmio0;
-        drm_map_t *mmio1;
-        drm_map_t *mmio2;
-        drm_map_t *mmio3;
-        int num_rast;
-} drm_gamma_private_t;
-
-                                /* gamma_dma.c */
-extern int gamma_dma_init( struct inode *inode, struct file *filp,
-                         unsigned int cmd, unsigned long arg );
-extern int gamma_dma_copy( struct inode *inode, struct file *filp,
-                         unsigned int cmd, unsigned long arg );
-
-extern int gamma_do_cleanup_dma( drm_device_t *dev );
-extern void gamma_dma_ready(drm_device_t *dev);
-extern void gamma_dma_quiescent_single(drm_device_t *dev);
-extern void gamma_dma_quiescent_dual(drm_device_t *dev);
-
-                                /* gamma_dma.c */
-extern int  gamma_dma_schedule(drm_device_t *dev, int locked);
-extern int  gamma_dma(struct inode *inode, struct file *filp,
-                      unsigned int cmd, unsigned long arg);
-extern int  gamma_find_devices(void);
-extern int  gamma_found(void);
-
-/* Gamma-specific code pulled from drm_fops.h:
- */
-extern int           DRM(finish)(struct inode *inode, struct file *filp,
-                                 unsigned int cmd, unsigned long arg);
-extern int           DRM(flush_unblock)(drm_device_t *dev, int context,
-                                        drm_lock_flags_t flags);
-extern int           DRM(flush_block_and_flush)(drm_device_t *dev, int context,
-                                                drm_lock_flags_t flags);
-
-/* Gamma-specific code pulled from drm_dma.h:
- */
-extern void          DRM(clear_next_buffer)(drm_device_t *dev);
-extern int           DRM(select_queue)(drm_device_t *dev,
-                                       void (*wrapper)(unsigned long));
-extern int           DRM(dma_enqueue)(struct file *filp, drm_dma_t *dma);
-extern int           DRM(dma_get_buffers)(struct file *filp, drm_dma_t *dma);
-
-
-/* Gamma-specific code pulled from drm_lists.h (now renamed gamma_lists.h):
- */
-extern int           DRM(waitlist_create)(drm_waitlist_t *bl, int count);
-extern int           DRM(waitlist_destroy)(drm_waitlist_t *bl);
-extern int           DRM(waitlist_put)(drm_waitlist_t *bl, drm_buf_t *buf);
-extern drm_buf_t     *DRM(waitlist_get)(drm_waitlist_t *bl);
-extern int           DRM(freelist_create)(drm_freelist_t *bl, int count);
-extern int           DRM(freelist_destroy)(drm_freelist_t *bl);
-extern int           DRM(freelist_put)(drm_device_t *dev, drm_freelist_t *bl,
-                                       drm_buf_t *buf);
-extern drm_buf_t     *DRM(freelist_get)(drm_freelist_t *bl, int block);
-
-/* externs for gamma changes to the ops */
-extern struct file_operations DRM(fops);
-extern unsigned int gamma_fops_poll(struct file *filp, struct poll_table_struct *wait);
-extern ssize_t gamma_fops_read(struct file *filp, char __user *buf, size_t count, loff_t *off);
-
-
-#define GLINT_DRI_BUF_COUNT 256
-
-#define GAMMA_OFF(reg)                                             \
-        ((reg < 0x1000)                                            \
-         ? reg                                                     \
-         : ((reg < 0x10000)                                        \
-            ? (reg - 0x1000)                                       \
-            : ((reg < 0x11000)                                     \
-               ? (reg - 0x10000)                                   \
-               : (reg - 0x11000))))
-
-#define GAMMA_BASE(reg)  ((unsigned long)                                    \
-                          ((reg < 0x1000)    ? dev_priv->mmio0->handle :     \
-                           ((reg < 0x10000)  ? dev_priv->mmio1->handle :     \
-                            ((reg < 0x11000) ? dev_priv->mmio2->handle :     \
-                                               dev_priv->mmio3->handle))))
-#define GAMMA_ADDR(reg)  (GAMMA_BASE(reg) + GAMMA_OFF(reg))
-#define GAMMA_DEREF(reg) *(__volatile__ int *)GAMMA_ADDR(reg)
-#define GAMMA_READ(reg)  GAMMA_DEREF(reg)
-#define GAMMA_WRITE(reg,val) do { GAMMA_DEREF(reg) = val; } while (0)
-
-#define GAMMA_BROADCASTMASK    0x9378
-#define GAMMA_COMMANDINTENABLE 0x0c48
-#define GAMMA_DMAADDRESS       0x0028
-#define GAMMA_DMACOUNT         0x0030
-#define GAMMA_FILTERMODE       0x8c00
-#define GAMMA_GCOMMANDINTFLAGS 0x0c50
-#define GAMMA_GCOMMANDMODE     0x0c40
-#define         GAMMA_QUEUED_DMA_MODE           1<<1
-#define GAMMA_GCOMMANDSTATUS   0x0c60
-#define GAMMA_GDELAYTIMER      0x0c38
-#define GAMMA_GDMACONTROL      0x0060
-#define         GAMMA_USE_AGP                   1<<1
-#define GAMMA_GINTENABLE       0x0808
-#define GAMMA_GINTFLAGS        0x0810
-#define GAMMA_INFIFOSPACE      0x0018
-#define GAMMA_OUTFIFOWORDS     0x0020
-#define GAMMA_OUTPUTFIFO       0x2000
-#define GAMMA_SYNC             0x8c40
-#define GAMMA_SYNC_TAG         0x0188
-#define GAMMA_PAGETABLEADDR    0x0C00
-#define GAMMA_PAGETABLELENGTH  0x0C08
-
-#define GAMMA_PASSTHROUGH       0x1FE
-#define GAMMA_DMAADDRTAG        0x530
-#define GAMMA_DMACOUNTTAG       0x531
-#define GAMMA_COMMANDINTTAG     0x532
-
-#endif
diff --git a/drivers/char/drm/gamma_lists.h b/drivers/char/drm/gamma_lists.h
deleted file mode 100644
index 2d93f412b96b..000000000000
--- a/drivers/char/drm/gamma_lists.h
+++ /dev/null
@@ -1,215 +0,0 @@
-/* drm_lists.h -- Buffer list handling routines -*- linux-c -*-
- * Created: Mon Apr 19 20:54:22 1999 by faith@valinux.com
- *
- * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
- * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
- * All Rights Reserved.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sublicense,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice (including the next
- * paragraph) shall be included in all copies or substantial portions of the
- * Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
- * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
- * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
- * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- *
- * Authors:
- *    Rickard E. (Rik) Faith <faith@valinux.com>
- *    Gareth Hughes <gareth@valinux.com>
- */
-
-#include "drmP.h"
-
-
-int DRM(waitlist_create)(drm_waitlist_t *bl, int count)
-{
-        if (bl->count) return -EINVAL;
-
-        bl->bufs       = DRM(alloc)((bl->count + 2) * sizeof(*bl->bufs),
-                                    DRM_MEM_BUFLISTS);
-
-        if(!bl->bufs) return -ENOMEM;
-        memset(bl->bufs, 0, sizeof(*bl->bufs));
-        bl->count      = count;
-        bl->rp         = bl->bufs;
-        bl->wp         = bl->bufs;
-        bl->end        = &bl->bufs[bl->count+1];
-        spin_lock_init(&bl->write_lock);
-        spin_lock_init(&bl->read_lock);
-        return 0;
-}
-
-int DRM(waitlist_destroy)(drm_waitlist_t *bl)
-{
-        if (bl->rp != bl->wp) return -EINVAL;
-        if (bl->bufs) DRM(free)(bl->bufs,
-                                (bl->count + 2) * sizeof(*bl->bufs),
-                                DRM_MEM_BUFLISTS);
-        bl->count = 0;
-        bl->bufs  = NULL;
-        bl->rp    = NULL;
-        bl->wp    = NULL;
-        bl->end   = NULL;
-        return 0;
-}
-
-int DRM(waitlist_put)(drm_waitlist_t *bl, drm_buf_t *buf)
-{
-        int           left;
-        unsigned long flags;
-
-        left = DRM_LEFTCOUNT(bl);
-        if (!left) {
-                DRM_ERROR("Overflow while adding buffer %d from filp %p\n",
-                          buf->idx, buf->filp);
-                return -EINVAL;
-        }
-        buf->list        = DRM_LIST_WAIT;
-
-        spin_lock_irqsave(&bl->write_lock, flags);
-        *bl->wp = buf;
-        if (++bl->wp >= bl->end) bl->wp = bl->bufs;
-        spin_unlock_irqrestore(&bl->write_lock, flags);
-
-        return 0;
-}
-
-drm_buf_t *DRM(waitlist_get)(drm_waitlist_t *bl)
-{
-        drm_buf_t     *buf;
-        unsigned long flags;
-
-        spin_lock_irqsave(&bl->read_lock, flags);
-        buf = *bl->rp;
-        if (bl->rp == bl->wp) {
-                spin_unlock_irqrestore(&bl->read_lock, flags);
-                return NULL;
-        }
-        if (++bl->rp >= bl->end) bl->rp = bl->bufs;
-        spin_unlock_irqrestore(&bl->read_lock, flags);
-
-        return buf;
-}
-
-int DRM(freelist_create)(drm_freelist_t *bl, int count)
-{
-        atomic_set(&bl->count, 0);
-        bl->next      = NULL;
-        init_waitqueue_head(&bl->waiting);
-        bl->low_mark  = 0;
-        bl->high_mark = 0;
-        atomic_set(&bl->wfh,   0);
-        spin_lock_init(&bl->lock);
-        ++bl->initialized;
-        return 0;
-}
-
-int DRM(freelist_destroy)(drm_freelist_t *bl)
-{
-        atomic_set(&bl->count, 0);
-        bl->next = NULL;
-        return 0;
-}
-
-int DRM(freelist_put)(drm_device_t *dev, drm_freelist_t *bl, drm_buf_t *buf)
-{
-        drm_device_dma_t *dma  = dev->dma;
-
-        if (!dma) {
-                DRM_ERROR("No DMA support\n");
-                return 1;
-        }
-
-        if (buf->waiting || buf->pending || buf->list == DRM_LIST_FREE) {
-                DRM_ERROR("Freed buffer %d: w%d, p%d, l%d\n",
-                          buf->idx, buf->waiting, buf->pending, buf->list);
-        }
-        if (!bl) return 1;
-        buf->list       = DRM_LIST_FREE;
-
-        spin_lock(&bl->lock);
-        buf->next       = bl->next;
-        bl->next        = buf;
-        spin_unlock(&bl->lock);
-
-        atomic_inc(&bl->count);
-        if (atomic_read(&bl->count) > dma->buf_count) {
-                DRM_ERROR("%d of %d buffers free after addition of %d\n",
-                          atomic_read(&bl->count), dma->buf_count, buf->idx);
-                return 1;
-        }
-                                /* Check for high water mark */
-        if (atomic_read(&bl->wfh) && atomic_read(&bl->count)>=bl->high_mark) {
-                atomic_set(&bl->wfh, 0);
-                wake_up_interruptible(&bl->waiting);
-        }
-        return 0;
-}
-
-static drm_buf_t *DRM(freelist_try)(drm_freelist_t *bl)
-{
-        drm_buf_t         *buf;
-
-        if (!bl) return NULL;
-
-                                /* Get buffer */
-        spin_lock(&bl->lock);
-        if (!bl->next) {
-                spin_unlock(&bl->lock);
-                return NULL;
-        }
-        buf       = bl->next;
-        bl->next  = bl->next->next;
-        spin_unlock(&bl->lock);
-
-        atomic_dec(&bl->count);
-        buf->next = NULL;
-        buf->list = DRM_LIST_NONE;
-        if (buf->waiting || buf->pending) {
-                DRM_ERROR("Free buffer %d: w%d, p%d, l%d\n",
-                          buf->idx, buf->waiting, buf->pending, buf->list);
-        }
-
-        return buf;
-}
-
-drm_buf_t *DRM(freelist_get)(drm_freelist_t *bl, int block)
-{
-        drm_buf_t         *buf  = NULL;
-        DECLARE_WAITQUEUE(entry, current);
-
-        if (!bl || !bl->initialized) return NULL;
-
-                                /* Check for low water mark */
-        if (atomic_read(&bl->count) <= bl->low_mark) /* Became low */
-                atomic_set(&bl->wfh, 1);
-        if (atomic_read(&bl->wfh)) {
-                if (block) {
-                        add_wait_queue(&bl->waiting, &entry);
-                        for (;;) {
-                                current->state = TASK_INTERRUPTIBLE;
-                                if (!atomic_read(&bl->wfh)
-                                    && (buf = DRM(freelist_try)(bl))) break;
-                                schedule();
-                                if (signal_pending(current)) break;
-                        }
-                        current->state = TASK_RUNNING;
-                        remove_wait_queue(&bl->waiting, &entry);
-                }
-                return buf;
-        }
-
-        return DRM(freelist_try)(bl);
-}
-
diff --git a/drivers/char/drm/gamma_lock.h b/drivers/char/drm/gamma_lock.h
deleted file mode 100644
index ddec67e4ed16..000000000000
--- a/drivers/char/drm/gamma_lock.h
+++ /dev/null
@@ -1,140 +0,0 @@
-/* lock.c -- IOCTLs for locking -*- linux-c -*-
- * Created: Tue Feb  2 08:37:54 1999 by faith@valinux.com
- *
- * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
- * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
- * All Rights Reserved.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sublicense,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice (including the next
- * paragraph) shall be included in all copies or substantial portions of the
- * Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
- * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
- * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
- * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- *
- * Authors:
- *    Rickard E. (Rik) Faith <faith@valinux.com>
- *    Gareth Hughes <gareth@valinux.com>
- */
-
-
-/* Gamma-specific code extracted from drm_lock.h:
- */
-static int DRM(flush_queue)(drm_device_t *dev, int context)
-{
-        DECLARE_WAITQUEUE(entry, current);
-        int               ret   = 0;
-        drm_queue_t       *q    = dev->queuelist[context];
-
-        DRM_DEBUG("\n");
-
-        atomic_inc(&q->use_count);
-        if (atomic_read(&q->use_count) > 1) {
-                atomic_inc(&q->block_write);
-                add_wait_queue(&q->flush_queue, &entry);
-                atomic_inc(&q->block_count);
-                for (;;) {
-                        current->state = TASK_INTERRUPTIBLE;
-                        if (!DRM_BUFCOUNT(&q->waitlist)) break;
-                        schedule();
-                        if (signal_pending(current)) {
-                                ret = -EINTR; /* Can't restart */
-                                break;
-                        }
-                }
-                atomic_dec(&q->block_count);
-                current->state = TASK_RUNNING;
-                remove_wait_queue(&q->flush_queue, &entry);
-        }
-        atomic_dec(&q->use_count);
-
-                                /* NOTE: block_write is still incremented!
-                                   Use drm_flush_unlock_queue to decrement. */
-        return ret;
-}
-
-static int DRM(flush_unblock_queue)(drm_device_t *dev, int context)
-{
-        drm_queue_t       *q    = dev->queuelist[context];
-
-        DRM_DEBUG("\n");
-
-        atomic_inc(&q->use_count);
-        if (atomic_read(&q->use_count) > 1) {
-                if (atomic_read(&q->block_write)) {
-                        atomic_dec(&q->block_write);
-                        wake_up_interruptible(&q->write_queue);
-                }
-        }
-        atomic_dec(&q->use_count);
-        return 0;
-}
-
-int DRM(flush_block_and_flush)(drm_device_t *dev, int context,
-                               drm_lock_flags_t flags)
-{
-        int ret = 0;
-        int i;
-
-        DRM_DEBUG("\n");
-
-        if (flags & _DRM_LOCK_FLUSH) {
-                ret = DRM(flush_queue)(dev, DRM_KERNEL_CONTEXT);
-                if (!ret) ret = DRM(flush_queue)(dev, context);
-        }
-        if (flags & _DRM_LOCK_FLUSH_ALL) {
-                for (i = 0; !ret && i < dev->queue_count; i++) {
-                        ret = DRM(flush_queue)(dev, i);
-                }
-        }
-        return ret;
-}
-
-int DRM(flush_unblock)(drm_device_t *dev, int context, drm_lock_flags_t flags)
-{
-        int ret = 0;
-        int i;
-
-        DRM_DEBUG("\n");
-
-        if (flags & _DRM_LOCK_FLUSH) {
-                ret = DRM(flush_unblock_queue)(dev, DRM_KERNEL_CONTEXT);
-                if (!ret) ret = DRM(flush_unblock_queue)(dev, context);
-        }
-        if (flags & _DRM_LOCK_FLUSH_ALL) {
-                for (i = 0; !ret && i < dev->queue_count; i++) {
-                        ret = DRM(flush_unblock_queue)(dev, i);
-                }
-        }
-
-        return ret;
-}
-
-int DRM(finish)(struct inode *inode, struct file *filp, unsigned int cmd,
-                unsigned long arg)
-{
-        drm_file_t        *priv   = filp->private_data;
-        drm_device_t      *dev    = priv->dev;
-        int               ret     = 0;
-        drm_lock_t        lock;
-
-        DRM_DEBUG("\n");
-
-        if (copy_from_user(&lock, (drm_lock_t __user *)arg, sizeof(lock)))
-                return -EFAULT;
-        ret = DRM(flush_block_and_flush)(dev, lock.context, lock.flags);
-        DRM(flush_unblock)(dev, lock.context, lock.flags);
-        return ret;
-}
diff --git a/drivers/char/drm/gamma_old_dma.h b/drivers/char/drm/gamma_old_dma.h
deleted file mode 100644
index abdd454aab9f..000000000000
--- a/drivers/char/drm/gamma_old_dma.h
+++ /dev/null
@@ -1,313 +0,0 @@
-/* drm_dma.c -- DMA IOCTL and function support -*- linux-c -*-
- * Created: Fri Mar 19 14:30:16 1999 by faith@valinux.com
- *
- * Copyright 1999, 2000 Precision Insight, Inc., Cedar Park, Texas.
- * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
- * All Rights Reserved.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sublicense,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice (including the next
- * paragraph) shall be included in all copies or substantial portions of the
- * Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
- * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
- * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
- * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- *
- * Authors:
- *    Rickard E. (Rik) Faith <faith@valinux.com>
- *    Gareth Hughes <gareth@valinux.com>
- */
-
-
-/* Gamma-specific code pulled from drm_dma.h:
- */
-
-void DRM(clear_next_buffer)(drm_device_t *dev)
-{
-        drm_device_dma_t *dma = dev->dma;
-
-        dma->next_buffer = NULL;
-        if (dma->next_queue && !DRM_BUFCOUNT(&dma->next_queue->waitlist)) {
-                wake_up_interruptible(&dma->next_queue->flush_queue);
-        }
-        dma->next_queue  = NULL;
-}
-
-int DRM(select_queue)(drm_device_t *dev, void (*wrapper)(unsigned long))
-{
-        int        i;
-        int        candidate = -1;
-        int        j         = jiffies;
-
-        if (!dev) {
-                DRM_ERROR("No device\n");
-                return -1;
-        }
-        if (!dev->queuelist || !dev->queuelist[DRM_KERNEL_CONTEXT]) {
-                                /* This only happens between the time the
-                                   interrupt is initialized and the time
-                                   the queues are initialized. */
-                return -1;
-        }
-
-                                /* Doing "while locked" DMA? */
-        if (DRM_WAITCOUNT(dev, DRM_KERNEL_CONTEXT)) {
-                return DRM_KERNEL_CONTEXT;
-        }
-
-                                /* If there are buffers on the last_context
-                                   queue, and we have not been executing
-                                   this context very long, continue to
-                                   execute this context. */
-        if (dev->last_switch <= j
-            && dev->last_switch + DRM_TIME_SLICE > j
-            && DRM_WAITCOUNT(dev, dev->last_context)) {
-                return dev->last_context;
-        }
-
-                                /* Otherwise, find a candidate */
-        for (i = dev->last_checked + 1; i < dev->queue_count; i++) {
-                if (DRM_WAITCOUNT(dev, i)) {
-                        candidate = dev->last_checked = i;
-                        break;
-                }
-        }
-
-        if (candidate < 0) {
-                for (i = 0; i < dev->queue_count; i++) {
-                        if (DRM_WAITCOUNT(dev, i)) {
-                                candidate = dev->last_checked = i;
-                                break;
-                        }
-                }
-        }
-
-        if (wrapper
-            && candidate >= 0
-            && candidate != dev->last_context
-            && dev->last_switch <= j
-            && dev->last_switch + DRM_TIME_SLICE > j) {
-                if (dev->timer.expires != dev->last_switch + DRM_TIME_SLICE) {
-                        del_timer(&dev->timer);
-                        dev->timer.function = wrapper;
-                        dev->timer.data     = (unsigned long)dev;
-                        dev->timer.expires  = dev->last_switch+DRM_TIME_SLICE;
-                        add_timer(&dev->timer);
-                }
-                return -1;
-        }
-
-        return candidate;
-}
-
-
-int DRM(dma_enqueue)(struct file *filp, drm_dma_t *d)
-{
-        drm_file_t    *priv   = filp->private_data;
-        drm_device_t  *dev    = priv->dev;
-        int               i;
-        drm_queue_t       *q;
-        drm_buf_t         *buf;
-        int               idx;
-        int               while_locked = 0;
-        drm_device_dma_t  *dma = dev->dma;
-        int               *ind;
-        int               err;
-        DECLARE_WAITQUEUE(entry, current);
-
-        DRM_DEBUG("%d\n", d->send_count);
-
-        if (d->flags & _DRM_DMA_WHILE_LOCKED) {
-                int context = dev->lock.hw_lock->lock;
-
-                if (!_DRM_LOCK_IS_HELD(context)) {
-                        DRM_ERROR("No lock held during \"while locked\""
-                                  " request\n");
-                        return -EINVAL;
-                }
-                if (d->context != _DRM_LOCKING_CONTEXT(context)
-                    && _DRM_LOCKING_CONTEXT(context) != DRM_KERNEL_CONTEXT) {
-                        DRM_ERROR("Lock held by %d while %d makes"
-                                  " \"while locked\" request\n",
-                                  _DRM_LOCKING_CONTEXT(context),
-                                  d->context);
-                        return -EINVAL;
-                }
-                q = dev->queuelist[DRM_KERNEL_CONTEXT];
-                while_locked = 1;
-        } else {
-                q = dev->queuelist[d->context];
-        }
-
-
-        atomic_inc(&q->use_count);
-        if (atomic_read(&q->block_write)) {
-                add_wait_queue(&q->write_queue, &entry);
-                atomic_inc(&q->block_count);
-                for (;;) {
-                        current->state = TASK_INTERRUPTIBLE;
-                        if (!atomic_read(&q->block_write)) break;
-                        schedule();
-                        if (signal_pending(current)) {
-                                atomic_dec(&q->use_count);
-                                remove_wait_queue(&q->write_queue, &entry);
-                                return -EINTR;
-                        }
-                }
-                atomic_dec(&q->block_count);
-                current->state = TASK_RUNNING;
-                remove_wait_queue(&q->write_queue, &entry);
-        }
-
-        ind = DRM(alloc)(d->send_count * sizeof(int), DRM_MEM_DRIVER);
-        if (!ind)
-                return -ENOMEM;
-
-        if (copy_from_user(ind, d->send_indices, d->send_count * sizeof(int))) {
-                err = -EFAULT;
-                goto out;
-        }
-
-        err = -EINVAL;
-        for (i = 0; i < d->send_count; i++) {
-                idx = ind[i];
-                if (idx < 0 || idx >= dma->buf_count) {
-                        DRM_ERROR("Index %d (of %d max)\n",
-                                  ind[i], dma->buf_count - 1);
-                        goto out;
-                }
-                buf = dma->buflist[ idx ];
-                if (buf->filp != filp) {
-                        DRM_ERROR("Process %d using buffer not owned\n",
-                                  current->pid);
-                        goto out;
-                }
-                if (buf->list != DRM_LIST_NONE) {
-                        DRM_ERROR("Process %d using buffer %d on list %d\n",
-                                  current->pid, buf->idx, buf->list);
-                        goto out;
-                }
-                buf->used         = ind[i];
-                buf->while_locked = while_locked;
-                buf->context      = d->context;
-                if (!buf->used) {
-                        DRM_ERROR("Queueing 0 length buffer\n");
-                }
-                if (buf->pending) {
-                        DRM_ERROR("Queueing pending buffer:"
-                                  " buffer %d, offset %d\n",
-                                  ind[i], i);
-                        goto out;
-                }
-                if (buf->waiting) {
-                        DRM_ERROR("Queueing waiting buffer:"
-                                  " buffer %d, offset %d\n",
-                                  ind[i], i);
-                        goto out;
-                }
-                buf->waiting = 1;
-                if (atomic_read(&q->use_count) == 1
-                    || atomic_read(&q->finalization)) {
-                        DRM(free_buffer)(dev, buf);
-                } else {
-                        DRM(waitlist_put)(&q->waitlist, buf);
-                        atomic_inc(&q->total_queued);
-                }
-        }
-        atomic_dec(&q->use_count);
-
-        return 0;
-
-out:
-        DRM(free)(ind, d->send_count * sizeof(int), DRM_MEM_DRIVER);
-        atomic_dec(&q->use_count);
-        return err;
-}
-
-static int DRM(dma_get_buffers_of_order)(struct file *filp, drm_dma_t *d,
-                                         int order)
-{
-        drm_file_t    *priv   = filp->private_data;
-        drm_device_t  *dev    = priv->dev;
-        int               i;
-        drm_buf_t         *buf;
-        drm_device_dma_t  *dma = dev->dma;
-
-        for (i = d->granted_count; i < d->request_count; i++) {
-                buf = DRM(freelist_get)(&dma->bufs[order].freelist,
-                                        d->flags & _DRM_DMA_WAIT);
-                if (!buf) break;
-                if (buf->pending || buf->waiting) {
-                        DRM_ERROR("Free buffer %d in use: filp %p (w%d, p%d)\n",
-                                  buf->idx,
-                                  buf->filp,
-                                  buf->waiting,
-                                  buf->pending);
-                }
-                buf->filp     = filp;
-                if (copy_to_user(&d->request_indices[i],
-                                 &buf->idx,
-                                 sizeof(buf->idx)))
-                        return -EFAULT;
-
-                if (copy_to_user(&d->request_sizes[i],
-                                 &buf->total,
-                                 sizeof(buf->total)))
-                        return -EFAULT;
-
-                ++d->granted_count;
-        }
-        return 0;
-}
-
-
-int DRM(dma_get_buffers)(struct file *filp, drm_dma_t *dma)
-{
-        int               order;
-        int               retcode = 0;
-        int               tmp_order;
-
-        order = DRM(order)(dma->request_size);
-
-        dma->granted_count = 0;
-        retcode            = DRM(dma_get_buffers_of_order)(filp, dma, order);
-
-        if (dma->granted_count < dma->request_count
-            && (dma->flags & _DRM_DMA_SMALLER_OK)) {
-                for (tmp_order = order - 1;
-                     !retcode
-                             && dma->granted_count < dma->request_count
-                             && tmp_order >= DRM_MIN_ORDER;
-                     --tmp_order) {
-
-                        retcode = DRM(dma_get_buffers_of_order)(filp, dma,
-                                                                tmp_order);
-                }
-        }
-
-        if (dma->granted_count < dma->request_count
-            && (dma->flags & _DRM_DMA_LARGER_OK)) {
-                for (tmp_order = order + 1;
-                     !retcode
-                             && dma->granted_count < dma->request_count
-                             && tmp_order <= DRM_MAX_ORDER;
-                     ++tmp_order) {
-
-                        retcode = DRM(dma_get_buffers_of_order)(filp, dma,
-                                                                tmp_order);
-                }
-        }
-        return 0;
-}
-
diff --git a/drivers/char/drm/i810_dma.c b/drivers/char/drm/i810_dma.c
index 18e0b7622893..2f1659b96fd1 100644
--- a/drivers/char/drm/i810_dma.c
+++ b/drivers/char/drm/i810_dma.c
@@ -45,11 +45,6 @@
 #define I810_BUF_UNMAPPED 0
 #define I810_BUF_MAPPED   1
 
-#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,4,2)
-#define down_write down
-#define up_write up
-#endif
-
 static drm_buf_t *i810_freelist_get(drm_device_t *dev)
 {
         drm_device_dma_t *dma = dev->dma;
@@ -351,6 +346,7 @@ static int i810_dma_initialize(drm_device_t *dev,
                 DRM_ERROR("can not find mmio map!\n");
                 return -EINVAL;
         }
+        dev->agp_buffer_token = init->buffers_offset;
         dev->agp_buffer_map = drm_core_findmap(dev, init->buffers_offset);
         if (!dev->agp_buffer_map) {
                 dev->dev_private = (void *)dev_priv;
@@ -1383,3 +1379,19 @@ drm_ioctl_desc_t i810_ioctls[] = {
 };
 
 int i810_max_ioctl = DRM_ARRAY_SIZE(i810_ioctls);
+
+/**
+ * Determine if the device really is AGP or not.
+ *
+ * All Intel graphics chipsets are treated as AGP, even if they are really
+ * PCI-e.
+ *
+ * \param dev   The device to be tested.
+ *
+ * \returns
+ * A value of 1 is always retured to indictate every i810 is AGP.
+ */
+int i810_driver_device_is_agp(drm_device_t * dev)
+{
+        return 1;
+}
diff --git a/drivers/char/drm/i810_drv.c b/drivers/char/drm/i810_drv.c
index ff51b3259af9..00609329d578 100644
--- a/drivers/char/drm/i810_drv.c
+++ b/drivers/char/drm/i810_drv.c
@@ -84,6 +84,7 @@ static struct drm_driver driver = {
         .dev_priv_size = sizeof(drm_i810_buf_priv_t),
         .pretakedown = i810_driver_pretakedown,
         .prerelease = i810_driver_prerelease,
+        .device_is_agp = i810_driver_device_is_agp,
         .release = i810_driver_release,
         .dma_quiescent = i810_driver_dma_quiescent,
         .reclaim_buffers = i810_reclaim_buffers,
diff --git a/drivers/char/drm/i810_drv.h b/drivers/char/drm/i810_drv.h
index 1b40538d1725..62ee4f58c59a 100644
--- a/drivers/char/drm/i810_drv.h
+++ b/drivers/char/drm/i810_drv.h
@@ -120,6 +120,7 @@ extern int i810_driver_dma_quiescent(drm_device_t *dev);
 extern void i810_driver_release(drm_device_t *dev, struct file *filp);
 extern void i810_driver_pretakedown(drm_device_t *dev);
 extern void i810_driver_prerelease(drm_device_t *dev, DRMFILE filp);
+extern int i810_driver_device_is_agp(drm_device_t * dev);
 
 #define I810_BASE(reg)          ((unsigned long) \
                                 dev_priv->mmio_map->handle)
diff --git a/drivers/char/drm/i830_dma.c b/drivers/char/drm/i830_dma.c
index dc7733035864..6f89d5796ef3 100644
--- a/drivers/char/drm/i830_dma.c
+++ b/drivers/char/drm/i830_dma.c
@@ -47,11 +47,6 @@
 #define I830_BUF_UNMAPPED 0
 #define I830_BUF_MAPPED   1
 
-#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,4,2)
-#define down_write down
-#define up_write up
-#endif
-
 static drm_buf_t *i830_freelist_get(drm_device_t *dev)
 {
         drm_device_dma_t *dma = dev->dma;
@@ -358,6 +353,7 @@ static int i830_dma_initialize(drm_device_t *dev,
                 DRM_ERROR("can not find mmio map!\n");
                 return -EINVAL;
         }
+        dev->agp_buffer_token = init->buffers_offset;
         dev->agp_buffer_map = drm_core_findmap(dev, init->buffers_offset);
         if(!dev->agp_buffer_map) {
                 dev->dev_private = (void *)dev_priv;
@@ -1586,3 +1582,19 @@ drm_ioctl_desc_t i830_ioctls[] = {
 };
 
 int i830_max_ioctl = DRM_ARRAY_SIZE(i830_ioctls);
+
+/**
+ * Determine if the device really is AGP or not.
+ *
+ * All Intel graphics chipsets are treated as AGP, even if they are really
+ * PCI-e.
+ *
+ * \param dev   The device to be tested.
+ *
+ * \returns
+ * A value of 1 is always retured to indictate every i8xx is AGP.
+ */
+int i830_driver_device_is_agp(drm_device_t * dev)
+{
+        return 1;
+}
diff --git a/drivers/char/drm/i830_drv.c b/drivers/char/drm/i830_drv.c
index bc36be76b8b2..0da9cd19919e 100644
--- a/drivers/char/drm/i830_drv.c
+++ b/drivers/char/drm/i830_drv.c
@@ -88,6 +88,7 @@ static struct drm_driver driver = {
         .dev_priv_size = sizeof(drm_i830_buf_priv_t),
         .pretakedown = i830_driver_pretakedown,
         .prerelease = i830_driver_prerelease,
+        .device_is_agp = i830_driver_device_is_agp,
         .release = i830_driver_release,
         .dma_quiescent = i830_driver_dma_quiescent,
         .reclaim_buffers = i830_reclaim_buffers,
diff --git a/drivers/char/drm/i830_drv.h b/drivers/char/drm/i830_drv.h
index df7746131dea..63f96a8b6a4a 100644
--- a/drivers/char/drm/i830_drv.h
+++ b/drivers/char/drm/i830_drv.h
@@ -137,6 +137,7 @@ extern void i830_driver_pretakedown(drm_device_t *dev);
 extern void i830_driver_release(drm_device_t *dev, struct file *filp);
 extern int i830_driver_dma_quiescent(drm_device_t *dev);
 extern void i830_driver_prerelease(drm_device_t *dev, DRMFILE filp);
+extern int i830_driver_device_is_agp(drm_device_t * dev);
 
 #define I830_BASE(reg)          ((unsigned long) \
                                 dev_priv->mmio_map->handle)
diff --git a/drivers/char/drm/i915_dma.c b/drivers/char/drm/i915_dma.c
index acf9e52a9507..34f552f90c4a 100644
--- a/drivers/char/drm/i915_dma.c
+++ b/drivers/char/drm/i915_dma.c
@@ -95,9 +95,8 @@ static int i915_dma_cleanup(drm_device_t * dev)
                         drm_core_ioremapfree( &dev_priv->ring.map, dev);
                 }
 
-                if (dev_priv->hw_status_page) {
-                        drm_pci_free(dev, PAGE_SIZE, dev_priv->hw_status_page,
-                                     dev_priv->dma_status_page);
+                if (dev_priv->status_page_dmah) {
+                        drm_pci_free(dev, dev_priv->status_page_dmah);
                         /* Need to rewrite hardware status page */
                         I915_WRITE(0x02080, 0x1ffff000);
                 }
@@ -174,16 +173,18 @@ static int i915_initialize(drm_device_t * dev,
         dev_priv->allow_batchbuffer = 1;
 
         /* Program Hardware Status Page */
-        dev_priv->hw_status_page = drm_pci_alloc(dev, PAGE_SIZE, PAGE_SIZE,
-                                                 0xffffffff, 
-                                                 &dev_priv->dma_status_page);
+        dev_priv->status_page_dmah = drm_pci_alloc(dev, PAGE_SIZE, PAGE_SIZE,
+                                                   0xffffffff);
 
-        if (!dev_priv->hw_status_page) {
+        if (!dev_priv->status_page_dmah) {
                 dev->dev_private = (void *)dev_priv;
                 i915_dma_cleanup(dev);
                 DRM_ERROR("Can not allocate hardware status page\n");
                 return DRM_ERR(ENOMEM);
         }
+        dev_priv->hw_status_page = dev_priv->status_page_dmah->vaddr;
+        dev_priv->dma_status_page = dev_priv->status_page_dmah->busaddr;
+
         memset(dev_priv->hw_status_page, 0, PAGE_SIZE);
         DRM_DEBUG("hw status page @ %p\n", dev_priv->hw_status_page);
 
@@ -731,3 +732,19 @@ drm_ioctl_desc_t i915_ioctls[] = {
 };
 
 int i915_max_ioctl = DRM_ARRAY_SIZE(i915_ioctls);
+
+/**
+ * Determine if the device really is AGP or not.
+ *
+ * All Intel graphics chipsets are treated as AGP, even if they are really
+ * PCI-e.
+ *
+ * \param dev   The device to be tested.
+ *
+ * \returns
+ * A value of 1 is always retured to indictate every i9x5 is AGP.
+ */
+int i915_driver_device_is_agp(drm_device_t * dev)
+{
+        return 1;
+}
diff --git a/drivers/char/drm/i915_drv.c b/drivers/char/drm/i915_drv.c
index 1f59d3fc79bc..106b9ec02213 100644
--- a/drivers/char/drm/i915_drv.c
+++ b/drivers/char/drm/i915_drv.c
@@ -79,6 +79,7 @@ static struct drm_driver driver = {
                                 DRIVER_HAVE_IRQ | DRIVER_IRQ_SHARED,
         .pretakedown = i915_driver_pretakedown,
         .prerelease = i915_driver_prerelease,
+        .device_is_agp = i915_driver_device_is_agp,
         .irq_preinstall = i915_driver_irq_preinstall,
         .irq_postinstall = i915_driver_irq_postinstall,
         .irq_uninstall = i915_driver_irq_uninstall,
diff --git a/drivers/char/drm/i915_drv.h b/drivers/char/drm/i915_drv.h
index 9c37d2367dd5..70ed4e68eac8 100644
--- a/drivers/char/drm/i915_drv.h
+++ b/drivers/char/drm/i915_drv.h
@@ -79,9 +79,10 @@ typedef struct drm_i915_private {
         drm_i915_sarea_t *sarea_priv;
         drm_i915_ring_buffer_t ring;
 
+        drm_dma_handle_t *status_page_dmah;
         void *hw_status_page;
-        unsigned long counter;
         dma_addr_t dma_status_page;
+        unsigned long counter;
 
         int back_offset;
         int front_offset;
@@ -102,6 +103,7 @@ typedef struct drm_i915_private {
 extern void i915_kernel_lost_context(drm_device_t * dev);
 extern void i915_driver_pretakedown(drm_device_t *dev);
 extern void i915_driver_prerelease(drm_device_t *dev, DRMFILE filp);
+extern int i915_driver_device_is_agp(drm_device_t *dev);
 
 /* i915_irq.c */
 extern int i915_irq_emit(DRM_IOCTL_ARGS);
diff --git a/drivers/char/drm/mga_dma.c b/drivers/char/drm/mga_dma.c
index 832eaf8a5068..567b425b784f 100644
--- a/drivers/char/drm/mga_dma.c
+++ b/drivers/char/drm/mga_dma.c
@@ -23,18 +23,21 @@
  * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  * DEALINGS IN THE SOFTWARE.
- *
- * Authors:
- *    Rickard E. (Rik) Faith <faith@valinux.com>
- *    Jeff Hartmann <jhartmann@valinux.com>
- *    Keith Whitwell <keith@tungstengraphics.com>
- *
- * Rewritten by:
- *    Gareth Hughes <gareth@valinux.com>
+ */
+
+/**
+ * \file mga_dma.c
+ * DMA support for MGA G200 / G400.
+ * 
+ * \author Rickard E. (Rik) Faith <faith@valinux.com>
+ * \author Jeff Hartmann <jhartmann@valinux.com>
+ * \author Keith Whitwell <keith@tungstengraphics.com>
+ * \author Gareth Hughes <gareth@valinux.com>
  */
 
 #include "drmP.h"
 #include "drm.h"
+#include "drm_sarea.h"
 #include "mga_drm.h"
 #include "mga_drv.h"
 
@@ -148,7 +151,7 @@ void mga_do_dma_flush( drm_mga_private_t *dev_priv )
         DRM_DEBUG( "  space = 0x%06x\n", primary->space );
 
         mga_flush_write_combine();
-        MGA_WRITE( MGA_PRIMEND, tail | MGA_PAGPXFER );
+        MGA_WRITE(MGA_PRIMEND, tail | dev_priv->dma_access);
 
         DRM_DEBUG( "done.\n" );
 }
@@ -190,7 +193,7 @@ void mga_do_dma_wrap_start( drm_mga_private_t *dev_priv )
         DRM_DEBUG( "  space = 0x%06x\n", primary->space );
 
         mga_flush_write_combine();
-        MGA_WRITE( MGA_PRIMEND, tail | MGA_PAGPXFER );
+        MGA_WRITE(MGA_PRIMEND, tail | dev_priv->dma_access);
 
         set_bit( 0, &primary->wrapped );
         DRM_DEBUG( "done.\n" );
@@ -396,23 +399,383 @@ int mga_freelist_put( drm_device_t *dev, drm_buf_t *buf )
  * DMA initialization, cleanup
  */
 
+
+int mga_driver_preinit(drm_device_t *dev, unsigned long flags)
+{
+        drm_mga_private_t * dev_priv;
+
+        dev_priv = drm_alloc(sizeof(drm_mga_private_t), DRM_MEM_DRIVER);
+        if (!dev_priv)
+                return DRM_ERR(ENOMEM);
+
+        dev->dev_private = (void *)dev_priv;
+        memset(dev_priv, 0, sizeof(drm_mga_private_t));
+
+        dev_priv->usec_timeout = MGA_DEFAULT_USEC_TIMEOUT;
+        dev_priv->chipset = flags;
+
+        return 0;
+}
+
+/**
+ * Bootstrap the driver for AGP DMA.
+ * 
+ * \todo
+ * Investigate whether there is any benifit to storing the WARP microcode in
+ * AGP memory.  If not, the microcode may as well always be put in PCI
+ * memory.
+ *
+ * \todo
+ * This routine needs to set dma_bs->agp_mode to the mode actually configured
+ * in the hardware.  Looking just at the Linux AGP driver code, I don't see
+ * an easy way to determine this.
+ *
+ * \sa mga_do_dma_bootstrap, mga_do_pci_dma_bootstrap
+ */
+static int mga_do_agp_dma_bootstrap(drm_device_t * dev,
+                                    drm_mga_dma_bootstrap_t * dma_bs)
+{
+        drm_mga_private_t * const dev_priv = (drm_mga_private_t *) dev->dev_private;
+        const unsigned int warp_size = mga_warp_microcode_size(dev_priv);
+        int err;
+        unsigned  offset;
+        const unsigned secondary_size = dma_bs->secondary_bin_count
+                * dma_bs->secondary_bin_size;
+        const unsigned agp_size = (dma_bs->agp_size << 20);
+        drm_buf_desc_t req;
+        drm_agp_mode_t mode;
+        drm_agp_info_t info;
+
+        
+        /* Acquire AGP. */
+        err = drm_agp_acquire(dev);
+        if (err) {
+                DRM_ERROR("Unable to acquire AGP\n");
+                return err;
+        }
+
+        err = drm_agp_info(dev, &info);
+        if (err) {
+                DRM_ERROR("Unable to get AGP info\n");
+                return err;
+        }
+
+        mode.mode = (info.mode & ~0x07) | dma_bs->agp_mode;
+        err = drm_agp_enable(dev, mode);
+        if (err) {
+                DRM_ERROR("Unable to enable AGP (mode = 0x%lx)\n", mode.mode);
+                return err;
+        }
+
+
+        /* In addition to the usual AGP mode configuration, the G200 AGP cards
+         * need to have the AGP mode "manually" set.
+         */
+
+        if (dev_priv->chipset == MGA_CARD_TYPE_G200) {
+                if (mode.mode & 0x02) {
+                        MGA_WRITE(MGA_AGP_PLL, MGA_AGP2XPLL_ENABLE);
+                }
+                else {
+                        MGA_WRITE(MGA_AGP_PLL, MGA_AGP2XPLL_DISABLE);
+                }
+        }
+
+
+        /* Allocate and bind AGP memory. */
+        dev_priv->agp_pages = agp_size / PAGE_SIZE;
+        dev_priv->agp_mem = drm_alloc_agp( dev, dev_priv->agp_pages, 0 );
+        if (dev_priv->agp_mem == NULL) {
+                dev_priv->agp_pages = 0;
+                DRM_ERROR("Unable to allocate %uMB AGP memory\n",
+                          dma_bs->agp_size);
+                return DRM_ERR(ENOMEM);
+        }
+                
+        err = drm_bind_agp( dev_priv->agp_mem, 0 );
+        if (err) {
+                DRM_ERROR("Unable to bind AGP memory\n");
+                return err;
+        }
+
+        offset = 0;
+        err = drm_addmap( dev, offset, warp_size,
+                          _DRM_AGP, _DRM_READ_ONLY, & dev_priv->warp );
+        if (err) {
+                DRM_ERROR("Unable to map WARP microcode\n");
+                return err;
+        }
+
+        offset += warp_size;
+        err = drm_addmap( dev, offset, dma_bs->primary_size,
+                          _DRM_AGP, _DRM_READ_ONLY, & dev_priv->primary );
+        if (err) {
+                DRM_ERROR("Unable to map primary DMA region\n");
+                return err;
+        }
+
+        offset += dma_bs->primary_size;
+        err = drm_addmap( dev, offset, secondary_size,
+                          _DRM_AGP, 0, & dev->agp_buffer_map );
+        if (err) {
+                DRM_ERROR("Unable to map secondary DMA region\n");
+                return err;
+        }
+
+        (void) memset( &req, 0, sizeof(req) );
+        req.count = dma_bs->secondary_bin_count;
+        req.size = dma_bs->secondary_bin_size;
+        req.flags = _DRM_AGP_BUFFER;
+        req.agp_start = offset;
+
+        err = drm_addbufs_agp( dev, & req );
+        if (err) {
+                DRM_ERROR("Unable to add secondary DMA buffers\n");
+                return err;
+        }
+
+        offset += secondary_size;
+        err = drm_addmap( dev, offset, agp_size - offset,
+                          _DRM_AGP, 0, & dev_priv->agp_textures );
+        if (err) {
+                DRM_ERROR("Unable to map AGP texture region\n");
+                return err;
+        }
+
+        drm_core_ioremap(dev_priv->warp, dev);
+        drm_core_ioremap(dev_priv->primary, dev);
+        drm_core_ioremap(dev->agp_buffer_map, dev);
+
+        if (!dev_priv->warp->handle ||
+            !dev_priv->primary->handle || !dev->agp_buffer_map->handle) {
+                DRM_ERROR("failed to ioremap agp regions! (%p, %p, %p)\n",
+                          dev_priv->warp->handle, dev_priv->primary->handle,
+                          dev->agp_buffer_map->handle);
+                return DRM_ERR(ENOMEM);
+        }
+
+        dev_priv->dma_access = MGA_PAGPXFER;
+        dev_priv->wagp_enable = MGA_WAGP_ENABLE;
+
+        DRM_INFO("Initialized card for AGP DMA.\n");
+        return 0;
+}
+
+/**
+ * Bootstrap the driver for PCI DMA.
+ * 
+ * \todo
+ * The algorithm for decreasing the size of the primary DMA buffer could be
+ * better.  The size should be rounded up to the nearest page size, then
+ * decrease the request size by a single page each pass through the loop.
+ *
+ * \todo
+ * Determine whether the maximum address passed to drm_pci_alloc is correct.
+ * The same goes for drm_addbufs_pci.
+ * 
+ * \sa mga_do_dma_bootstrap, mga_do_agp_dma_bootstrap
+ */
+static int mga_do_pci_dma_bootstrap(drm_device_t * dev,
+                                    drm_mga_dma_bootstrap_t * dma_bs)
+{
+        drm_mga_private_t * const dev_priv = (drm_mga_private_t *) dev->dev_private;
+        const unsigned int warp_size = mga_warp_microcode_size(dev_priv);
+        unsigned int primary_size;
+        unsigned int bin_count;
+        int err;
+        drm_buf_desc_t req;
+
+        
+        if (dev->dma == NULL) {
+                DRM_ERROR("dev->dma is NULL\n");
+                return DRM_ERR(EFAULT);
+        }
+
+        /* The proper alignment is 0x100 for this mapping */
+        err = drm_addmap(dev, 0, warp_size, _DRM_CONSISTENT,
+                         _DRM_READ_ONLY, &dev_priv->warp);
+        if (err != 0) {
+                DRM_ERROR("Unable to create mapping for WARP microcode\n");
+                return err;
+        }
+
+        /* Other than the bottom two bits being used to encode other
+         * information, there don't appear to be any restrictions on the
+         * alignment of the primary or secondary DMA buffers.
+         */
+
+        for ( primary_size = dma_bs->primary_size
+              ; primary_size != 0
+              ; primary_size >>= 1 ) {
+                /* The proper alignment for this mapping is 0x04 */
+                err = drm_addmap(dev, 0, primary_size, _DRM_CONSISTENT,
+                                 _DRM_READ_ONLY, &dev_priv->primary);
+                if (!err)
+                        break;
+        }
+
+        if (err != 0) {
+                DRM_ERROR("Unable to allocate primary DMA region\n");
+                return DRM_ERR(ENOMEM);
+        }
+
+        if (dev_priv->primary->size != dma_bs->primary_size) {
+                DRM_INFO("Primary DMA buffer size reduced from %u to %u.\n",
+                         dma_bs->primary_size, 
+                         (unsigned) dev_priv->primary->size);
+                dma_bs->primary_size = dev_priv->primary->size;
+        }
+
+        for ( bin_count = dma_bs->secondary_bin_count
+              ; bin_count > 0 
+              ; bin_count-- ) {
+                (void) memset( &req, 0, sizeof(req) );
+                req.count = bin_count;
+                req.size = dma_bs->secondary_bin_size;
+
+                err = drm_addbufs_pci( dev, & req );
+                if (!err) {
+                        break;
+                }
+        }
+        
+        if (bin_count == 0) {
+                DRM_ERROR("Unable to add secondary DMA buffers\n");
+                return err;
+        }
+
+        if (bin_count != dma_bs->secondary_bin_count) {
+                DRM_INFO("Secondary PCI DMA buffer bin count reduced from %u "
+                         "to %u.\n", dma_bs->secondary_bin_count, bin_count);
+
+                dma_bs->secondary_bin_count = bin_count;
+        }
+
+        dev_priv->dma_access = 0;
+        dev_priv->wagp_enable = 0;
+
+        dma_bs->agp_mode = 0;
+
+        DRM_INFO("Initialized card for PCI DMA.\n");
+        return 0;
+}
+
+
+static int mga_do_dma_bootstrap(drm_device_t * dev,
+                                drm_mga_dma_bootstrap_t * dma_bs)
+{
+        const int is_agp = (dma_bs->agp_mode != 0) && drm_device_is_agp(dev);
+        int err;
+        drm_mga_private_t * const dev_priv =
+                (drm_mga_private_t *) dev->dev_private;
+
+
+        dev_priv->used_new_dma_init = 1;
+
+        /* The first steps are the same for both PCI and AGP based DMA.  Map
+         * the cards MMIO registers and map a status page.
+         */
+        err = drm_addmap( dev, dev_priv->mmio_base, dev_priv->mmio_size,
+                          _DRM_REGISTERS, _DRM_READ_ONLY, & dev_priv->mmio );
+        if (err) {
+                DRM_ERROR("Unable to map MMIO region\n");
+                return err;
+        }
+
+
+        err = drm_addmap( dev, 0, SAREA_MAX, _DRM_SHM,
+                          _DRM_READ_ONLY | _DRM_LOCKED | _DRM_KERNEL,
+                          & dev_priv->status );
+        if (err) {
+                DRM_ERROR("Unable to map status region\n");
+                return err;
+        }
+
+
+        /* The DMA initialization procedure is slightly different for PCI and
+         * AGP cards.  AGP cards just allocate a large block of AGP memory and
+         * carve off portions of it for internal uses.  The remaining memory
+         * is returned to user-mode to be used for AGP textures.
+         */
+
+        if (is_agp) {
+                err = mga_do_agp_dma_bootstrap(dev, dma_bs);
+        }
+        
+        /* If we attempted to initialize the card for AGP DMA but failed,
+         * clean-up any mess that may have been created.
+         */
+
+        if (err) {
+                mga_do_cleanup_dma(dev);
+        }
+
+
+        /* Not only do we want to try and initialized PCI cards for PCI DMA,
+         * but we also try to initialized AGP cards that could not be
+         * initialized for AGP DMA.  This covers the case where we have an AGP
+         * card in a system with an unsupported AGP chipset.  In that case the
+         * card will be detected as AGP, but we won't be able to allocate any
+         * AGP memory, etc.
+         */
+
+        if (!is_agp || err) {
+                err = mga_do_pci_dma_bootstrap(dev, dma_bs);
+        }
+
+
+        return err;
+}
+
+int mga_dma_bootstrap(DRM_IOCTL_ARGS)
+{
+        DRM_DEVICE;
+        drm_mga_dma_bootstrap_t bootstrap;
+        int err;
+
+
+        DRM_COPY_FROM_USER_IOCTL(bootstrap,
+                                 (drm_mga_dma_bootstrap_t __user *) data,
+                                 sizeof(bootstrap));
+
+        err = mga_do_dma_bootstrap(dev, & bootstrap);
+        if (! err) {
+                static const int modes[] = { 0, 1, 2, 2, 4, 4, 4, 4 };
+                const drm_mga_private_t * const dev_priv = 
+                        (drm_mga_private_t *) dev->dev_private;
+
+                if (dev_priv->agp_textures != NULL) {
+                        bootstrap.texture_handle = dev_priv->agp_textures->offset;
+                        bootstrap.texture_size = dev_priv->agp_textures->size;
+                }
+                else {
+                        bootstrap.texture_handle = 0;
+                        bootstrap.texture_size = 0;
+                }
+
+                bootstrap.agp_mode = modes[ bootstrap.agp_mode & 0x07 ];
+                if (DRM_COPY_TO_USER( (void __user *) data, & bootstrap,
+                                     sizeof(bootstrap))) {
+                        err = DRM_ERR(EFAULT);
+                }
+        }
+        else {
+                mga_do_cleanup_dma(dev);
+        }
+
+        return err;
+}
+
 static int mga_do_init_dma( drm_device_t *dev, drm_mga_init_t *init )
 {
         drm_mga_private_t *dev_priv;
         int ret;
         DRM_DEBUG( "\n" );
 
-        dev_priv = drm_alloc( sizeof(drm_mga_private_t), DRM_MEM_DRIVER );
-        if ( !dev_priv )
-                return DRM_ERR(ENOMEM);
-
-        memset( dev_priv, 0, sizeof(drm_mga_private_t) );
 
-        dev_priv->chipset = init->chipset;
+        dev_priv = dev->dev_private;
 
-        dev_priv->usec_timeout = MGA_DEFAULT_USEC_TIMEOUT;
-
-        if ( init->sgram ) {
+        if (init->sgram) {
                 dev_priv->clear_cmd = MGA_DWGCTL_CLEAR | MGA_ATYPE_BLK;
         } else {
                 dev_priv->clear_cmd = MGA_DWGCTL_CLEAR | MGA_ATYPE_RSTR;
@@ -436,88 +799,66 @@ static int mga_do_init_dma( drm_device_t *dev, drm_mga_init_t *init )
 
         DRM_GETSAREA();
 
-        if(!dev_priv->sarea) {
-                DRM_ERROR( "failed to find sarea!\n" );
-                /* Assign dev_private so we can do cleanup. */
-                dev->dev_private = (void *)dev_priv;
-                mga_do_cleanup_dma( dev );
+        if (!dev_priv->sarea) {
+                DRM_ERROR("failed to find sarea!\n");
                 return DRM_ERR(EINVAL);
         }
 
-        dev_priv->mmio = drm_core_findmap(dev, init->mmio_offset);
-        if(!dev_priv->mmio) {
-                DRM_ERROR( "failed to find mmio region!\n" );
-                /* Assign dev_private so we can do cleanup. */
-                dev->dev_private = (void *)dev_priv;
-                mga_do_cleanup_dma( dev );
-                return DRM_ERR(EINVAL);
-        }
-        dev_priv->status = drm_core_findmap(dev, init->status_offset);
-        if(!dev_priv->status) {
-                DRM_ERROR( "failed to find status page!\n" );
-                /* Assign dev_private so we can do cleanup. */
-                dev->dev_private = (void *)dev_priv;
-                mga_do_cleanup_dma( dev );
-                return DRM_ERR(EINVAL);
-        }
-        dev_priv->warp = drm_core_findmap(dev, init->warp_offset);
-        if(!dev_priv->warp) {
-                DRM_ERROR( "failed to find warp microcode region!\n" );
-                /* Assign dev_private so we can do cleanup. */
-                dev->dev_private = (void *)dev_priv;
-                mga_do_cleanup_dma( dev );
-                return DRM_ERR(EINVAL);
-        }
-        dev_priv->primary = drm_core_findmap(dev, init->primary_offset);
-        if(!dev_priv->primary) {
-                DRM_ERROR( "failed to find primary dma region!\n" );
-                /* Assign dev_private so we can do cleanup. */
-                dev->dev_private = (void *)dev_priv;
-                mga_do_cleanup_dma( dev );
-                return DRM_ERR(EINVAL);
-        }
-        dev->agp_buffer_map = drm_core_findmap(dev, init->buffers_offset);
-        if(!dev->agp_buffer_map) {
-                DRM_ERROR( "failed to find dma buffer region!\n" );
-                /* Assign dev_private so we can do cleanup. */
-                dev->dev_private = (void *)dev_priv;
-                mga_do_cleanup_dma( dev );
-                return DRM_ERR(EINVAL);
+        if (! dev_priv->used_new_dma_init) {
+                dev_priv->status = drm_core_findmap(dev, init->status_offset);
+                if (!dev_priv->status) {
+                        DRM_ERROR("failed to find status page!\n");
+                        return DRM_ERR(EINVAL);
+                }
+                dev_priv->mmio = drm_core_findmap(dev, init->mmio_offset);
+                if (!dev_priv->mmio) {
+                        DRM_ERROR("failed to find mmio region!\n");
+                        return DRM_ERR(EINVAL);
+                }
+                dev_priv->warp = drm_core_findmap(dev, init->warp_offset);
+                if (!dev_priv->warp) {
+                        DRM_ERROR("failed to find warp microcode region!\n");
+                        return DRM_ERR(EINVAL);
+                }
+                dev_priv->primary = drm_core_findmap(dev, init->primary_offset);
+                if (!dev_priv->primary) {
+                        DRM_ERROR("failed to find primary dma region!\n");
+                        return DRM_ERR(EINVAL);
+                }
+                dev->agp_buffer_token = init->buffers_offset;
+                dev->agp_buffer_map = drm_core_findmap(dev, init->buffers_offset);
+                if (!dev->agp_buffer_map) {
+                        DRM_ERROR("failed to find dma buffer region!\n");
+                        return DRM_ERR(EINVAL);
+                }
+
+                drm_core_ioremap(dev_priv->warp, dev);
+                drm_core_ioremap(dev_priv->primary, dev);
+                drm_core_ioremap(dev->agp_buffer_map, dev);
         }
 
         dev_priv->sarea_priv =
                 (drm_mga_sarea_t *)((u8 *)dev_priv->sarea->handle +
                                     init->sarea_priv_offset);
 
-        drm_core_ioremap( dev_priv->warp, dev );
-        drm_core_ioremap( dev_priv->primary, dev );
-        drm_core_ioremap( dev->agp_buffer_map, dev );
-
-        if(!dev_priv->warp->handle ||
-           !dev_priv->primary->handle ||
-           !dev->agp_buffer_map->handle ) {
-                DRM_ERROR( "failed to ioremap agp regions!\n" );
-                /* Assign dev_private so we can do cleanup. */
-                dev->dev_private = (void *)dev_priv;
-                mga_do_cleanup_dma( dev );
+        if (!dev_priv->warp->handle ||
+            !dev_priv->primary->handle ||
+            ((dev_priv->dma_access != 0) &&
+             ((dev->agp_buffer_map == NULL) ||
+              (dev->agp_buffer_map->handle == NULL)))) {
+                DRM_ERROR("failed to ioremap agp regions!\n");
                 return DRM_ERR(ENOMEM);
         }
 
-        ret = mga_warp_install_microcode( dev_priv );
-        if ( ret < 0 ) {
-                DRM_ERROR( "failed to install WARP ucode!\n" );
-                /* Assign dev_private so we can do cleanup. */
-                dev->dev_private = (void *)dev_priv;
-                mga_do_cleanup_dma( dev );
+        ret = mga_warp_install_microcode(dev_priv);
+        if (ret < 0) {
+                DRM_ERROR("failed to install WARP ucode!\n");
                 return ret;
         }
 
-        ret = mga_warp_init( dev_priv );
-        if ( ret < 0 ) {
-                DRM_ERROR( "failed to init WARP engine!\n" );
-                /* Assign dev_private so we can do cleanup. */
-                dev->dev_private = (void *)dev_priv;
-                mga_do_cleanup_dma( dev );
+        ret = mga_warp_init(dev_priv);
+        if (ret < 0) {
+                DRM_ERROR("failed to init WARP engine!\n");
                 return ret;
         }
 
@@ -557,22 +898,18 @@ static int mga_do_init_dma( drm_device_t *dev, drm_mga_init_t *init )
         dev_priv->sarea_priv->last_frame.head = 0;
         dev_priv->sarea_priv->last_frame.wrap = 0;
 
-        if ( mga_freelist_init( dev, dev_priv ) < 0 ) {
-                DRM_ERROR( "could not initialize freelist\n" );
-                /* Assign dev_private so we can do cleanup. */
-                dev->dev_private = (void *)dev_priv;
-                mga_do_cleanup_dma( dev );
+        if (mga_freelist_init(dev, dev_priv) < 0) {
+                DRM_ERROR("could not initialize freelist\n");
                 return DRM_ERR(ENOMEM);
         }
 
-        /* Make dev_private visable to others. */
-        dev->dev_private = (void *)dev_priv;
         return 0;
 }
 
 static int mga_do_cleanup_dma( drm_device_t *dev )
 {
-        DRM_DEBUG( "\n" );
+        int err = 0;
+        DRM_DEBUG("\n");
 
         /* Make sure interrupts are disabled here because the uninstall ioctl
          * may not have been called from userspace and after dev_private
@@ -583,20 +920,49 @@ static int mga_do_cleanup_dma( drm_device_t *dev )
         if ( dev->dev_private ) {
                 drm_mga_private_t *dev_priv = dev->dev_private;
 
-                if ( dev_priv->warp != NULL )
-                        drm_core_ioremapfree( dev_priv->warp, dev );
-                if ( dev_priv->primary != NULL )
-                        drm_core_ioremapfree( dev_priv->primary, dev );
-                if ( dev->agp_buffer_map != NULL )
-                        drm_core_ioremapfree( dev->agp_buffer_map, dev );
+                if ((dev_priv->warp != NULL) 
+                    && (dev_priv->mmio->type != _DRM_CONSISTENT))
+                        drm_core_ioremapfree(dev_priv->warp, dev);
+
+                if ((dev_priv->primary != NULL) 
+                    && (dev_priv->primary->type != _DRM_CONSISTENT))
+                        drm_core_ioremapfree(dev_priv->primary, dev);
 
-                if ( dev_priv->head != NULL ) {
-                        mga_freelist_cleanup( dev );
+                if (dev->agp_buffer_map != NULL)
+                        drm_core_ioremapfree(dev->agp_buffer_map, dev);
+
+                if (dev_priv->used_new_dma_init) {
+                        if (dev_priv->agp_mem != NULL) {
+                                dev_priv->agp_textures = NULL;
+                                drm_unbind_agp(dev_priv->agp_mem);
+
+                                drm_free_agp(dev_priv->agp_mem, dev_priv->agp_pages);
+                                dev_priv->agp_pages = 0;
+                                dev_priv->agp_mem = NULL;
+                        }
+
+                        if ((dev->agp != NULL) && dev->agp->acquired) {
+                                err = drm_agp_release(dev);
+                        }
+
+                        dev_priv->used_new_dma_init = 0;
                 }
 
-                drm_free( dev->dev_private, sizeof(drm_mga_private_t),
-                           DRM_MEM_DRIVER );
-                dev->dev_private = NULL;
+                dev_priv->warp = NULL;
+                dev_priv->primary = NULL;
+                dev_priv->mmio = NULL;
+                dev_priv->status = NULL;
+                dev_priv->sarea = NULL;
+                dev_priv->sarea_priv = NULL;
+                dev->agp_buffer_map = NULL;
+
+                memset(&dev_priv->prim, 0, sizeof(dev_priv->prim));
+                dev_priv->warp_pipe = 0;
+                memset(dev_priv->warp_pipe_phys, 0, sizeof(dev_priv->warp_pipe_phys));
+
+                if (dev_priv->head != NULL) {
+                        mga_freelist_cleanup(dev);
+                }
         }
 
         return 0;
@@ -606,14 +972,20 @@ int mga_dma_init( DRM_IOCTL_ARGS )
 {
         DRM_DEVICE;
         drm_mga_init_t init;
+        int err;
 
         LOCK_TEST_WITH_RETURN( dev, filp );
 
-        DRM_COPY_FROM_USER_IOCTL( init, (drm_mga_init_t __user *)data, sizeof(init) );
+        DRM_COPY_FROM_USER_IOCTL(init, (drm_mga_init_t __user *) data,
+                                 sizeof(init));
 
         switch ( init.func ) {
         case MGA_INIT_DMA:
-                return mga_do_init_dma( dev, &init );
+                err = mga_do_init_dma(dev, &init);
+                if (err) {
+                        (void) mga_do_cleanup_dma(dev);
+                }
+                return err;
         case MGA_CLEANUP_DMA:
                 return mga_do_cleanup_dma( dev );
         }
@@ -742,7 +1114,21 @@ int mga_dma_buffers( DRM_IOCTL_ARGS )
         return ret;
 }
 
-void mga_driver_pretakedown(drm_device_t *dev)
+/**
+ * Called just before the module is unloaded.
+ */
+int mga_driver_postcleanup(drm_device_t * dev)
+{
+        drm_free(dev->dev_private, sizeof(drm_mga_private_t), DRM_MEM_DRIVER);
+        dev->dev_private = NULL;
+
+        return 0;
+}
+
+/**
+ * Called when the last opener of the device is closed.
+ */
+void mga_driver_pretakedown(drm_device_t * dev)
 {
         mga_do_cleanup_dma( dev );
 }
diff --git a/drivers/char/drm/mga_drm.h b/drivers/char/drm/mga_drm.h
index 521d4451d012..d20aab3bd57b 100644
--- a/drivers/char/drm/mga_drm.h
+++ b/drivers/char/drm/mga_drm.h
@@ -73,7 +73,8 @@
 
 #define MGA_CARD_TYPE_G200      1
 #define MGA_CARD_TYPE_G400      2
-
+#define MGA_CARD_TYPE_G450      3       /* not currently used */
+#define MGA_CARD_TYPE_G550      4
 
 #define MGA_FRONT               0x1
 #define MGA_BACK                0x2
@@ -225,10 +226,6 @@ typedef struct _drm_mga_sarea {
 } drm_mga_sarea_t;
 
 
-/* WARNING: If you change any of these defines, make sure to change the
- * defines in the Xserver file (xf86drmMga.h)
- */
-
 /* MGA specific ioctls
  * The device specific ioctl range is 0x40 to 0x79.
  */
@@ -243,6 +240,14 @@ typedef struct _drm_mga_sarea {
 #define DRM_MGA_BLIT     0x08
 #define DRM_MGA_GETPARAM 0x09
 
+/* 3.2:
+ * ioctls for operating on fences.
+ */
+#define DRM_MGA_SET_FENCE      0x0a
+#define DRM_MGA_WAIT_FENCE     0x0b
+#define DRM_MGA_DMA_BOOTSTRAP  0x0c
+
+
 #define DRM_IOCTL_MGA_INIT     DRM_IOW( DRM_COMMAND_BASE + DRM_MGA_INIT, drm_mga_init_t)
 #define DRM_IOCTL_MGA_FLUSH    DRM_IOW( DRM_COMMAND_BASE + DRM_MGA_FLUSH, drm_lock_t)
 #define DRM_IOCTL_MGA_RESET    DRM_IO(  DRM_COMMAND_BASE + DRM_MGA_RESET)
@@ -253,6 +258,9 @@ typedef struct _drm_mga_sarea {
 #define DRM_IOCTL_MGA_ILOAD    DRM_IOW( DRM_COMMAND_BASE + DRM_MGA_ILOAD, drm_mga_iload_t)
 #define DRM_IOCTL_MGA_BLIT     DRM_IOW( DRM_COMMAND_BASE + DRM_MGA_BLIT, drm_mga_blit_t)
 #define DRM_IOCTL_MGA_GETPARAM DRM_IOWR(DRM_COMMAND_BASE + DRM_MGA_GETPARAM, drm_mga_getparam_t)
+#define DRM_IOCTL_MGA_SET_FENCE     DRM_IOW( DRM_COMMAND_BASE + DRM_MGA_SET_FENCE, uint32_t)
+#define DRM_IOCTL_MGA_WAIT_FENCE    DRM_IOWR(DRM_COMMAND_BASE + DRM_MGA_WAIT_FENCE, uint32_t)
+#define DRM_IOCTL_MGA_DMA_BOOTSTRAP DRM_IOWR(DRM_COMMAND_BASE + DRM_MGA_DMA_BOOTSTRAP, drm_mga_dma_bootstrap_t)
 
 typedef struct _drm_mga_warp_index {
         int installed;
@@ -291,12 +299,72 @@ typedef struct drm_mga_init {
         unsigned long buffers_offset;
 } drm_mga_init_t;
 
-typedef struct drm_mga_fullscreen {
-        enum {
-                MGA_INIT_FULLSCREEN    = 0x01,
-                MGA_CLEANUP_FULLSCREEN = 0x02
-        } func;
-} drm_mga_fullscreen_t;
+typedef struct drm_mga_dma_bootstrap {
+        /**
+         * \name AGP texture region
+         * 
+         * On return from the DRM_MGA_DMA_BOOTSTRAP ioctl, these fields will
+         * be filled in with the actual AGP texture settings.
+         * 
+         * \warning
+         * If these fields are non-zero, but dma_mga_dma_bootstrap::agp_mode
+         * is zero, it means that PCI memory (most likely through the use of
+         * an IOMMU) is being used for "AGP" textures.
+         */
+        /*@{*/
+        unsigned long texture_handle; /**< Handle used to map AGP textures. */
+        uint32_t     texture_size;    /**< Size of the AGP texture region. */
+        /*@}*/
+
+
+        /**
+         * Requested size of the primary DMA region.
+         * 
+         * On return from the DRM_MGA_DMA_BOOTSTRAP ioctl, this field will be
+         * filled in with the actual AGP mode.  If AGP was not available
+         */
+        uint32_t primary_size;
+
+
+        /**
+         * Requested number of secondary DMA buffers.
+         * 
+         * On return from the DRM_MGA_DMA_BOOTSTRAP ioctl, this field will be
+         * filled in with the actual number of secondary DMA buffers
+         * allocated.  Particularly when PCI DMA is used, this may be
+         * (subtantially) less than the number requested.
+         */
+        uint32_t secondary_bin_count;
+        
+        
+        /**
+         * Requested size of each secondary DMA buffer.
+         * 
+         * While the kernel \b is free to reduce
+         * dma_mga_dma_bootstrap::secondary_bin_count, it is \b not allowed
+         * to reduce dma_mga_dma_bootstrap::secondary_bin_size.
+         */
+        uint32_t secondary_bin_size;
+
+
+        /**
+         * Bit-wise mask of AGPSTAT2_* values.  Currently only \c AGPSTAT2_1X,
+         * \c AGPSTAT2_2X, and \c AGPSTAT2_4X are supported.  If this value is
+         * zero, it means that PCI DMA should be used, even if AGP is
+         * possible.
+         * 
+         * On return from the DRM_MGA_DMA_BOOTSTRAP ioctl, this field will be
+         * filled in with the actual AGP mode.  If AGP was not available
+         * (i.e., PCI DMA was used), this value will be zero.
+         */
+        uint32_t agp_mode;
+
+
+        /**
+         * Desired AGP GART size, measured in megabytes.
+         */
+        uint8_t agp_size;
+} drm_mga_dma_bootstrap_t;
 
 typedef struct drm_mga_clear {
         unsigned int flags;
@@ -341,6 +409,14 @@ typedef struct _drm_mga_blit {
  */
 #define MGA_PARAM_IRQ_NR            1
 
+/* 3.2: Query the actual card type.  The DDX only distinguishes between
+ * G200 chips and non-G200 chips, which it calls G400.  It turns out that
+ * there are some very sublte differences between the G4x0 chips and the G550
+ * chips.  Using this parameter query, a client-side driver can detect the
+ * difference between a G4x0 and a G550.
+ */
+#define MGA_PARAM_CARD_TYPE         2
+
 typedef struct drm_mga_getparam {
         int param;
         void __user *value;
diff --git a/drivers/char/drm/mga_drv.c b/drivers/char/drm/mga_drv.c
index 844cca9cb29d..daabbba3b297 100644
--- a/drivers/char/drm/mga_drv.c
+++ b/drivers/char/drm/mga_drv.c
@@ -38,8 +38,15 @@
   
 #include "drm_pciids.h"
 
+static int mga_driver_device_is_agp(drm_device_t * dev);
 static int postinit( struct drm_device *dev, unsigned long flags )
 {
+        drm_mga_private_t * const dev_priv =
+                (drm_mga_private_t *) dev->dev_private;
+
+        dev_priv->mmio_base = pci_resource_start(dev->pdev, 1);
+        dev_priv->mmio_size = pci_resource_len(dev->pdev, 1);
+
         dev->counters += 3;
         dev->types[6] = _DRM_STAT_IRQ;
         dev->types[7] = _DRM_STAT_PRIMARY;
@@ -79,8 +86,11 @@ extern int mga_max_ioctl;
 
 static struct drm_driver driver = {
         .driver_features = DRIVER_USE_AGP | DRIVER_REQUIRE_AGP | DRIVER_USE_MTRR | DRIVER_HAVE_DMA | DRIVER_HAVE_IRQ | DRIVER_IRQ_SHARED | DRIVER_IRQ_VBL,
+        .preinit = mga_driver_preinit,
+        .postcleanup = mga_driver_postcleanup,
         .pretakedown = mga_driver_pretakedown,
         .dma_quiescent = mga_driver_dma_quiescent,
+        .device_is_agp = mga_driver_device_is_agp,
         .vblank_wait = mga_driver_vblank_wait,
         .irq_preinstall = mga_driver_irq_preinstall,
         .irq_postinstall = mga_driver_irq_postinstall,
@@ -128,3 +138,38 @@ module_exit(mga_exit);
 MODULE_AUTHOR( DRIVER_AUTHOR );
 MODULE_DESCRIPTION( DRIVER_DESC );
 MODULE_LICENSE("GPL and additional rights");
+
+/**
+ * Determine if the device really is AGP or not.
+ *
+ * In addition to the usual tests performed by \c drm_device_is_agp, this
+ * function detects PCI G450 cards that appear to the system exactly like
+ * AGP G450 cards.
+ *
+ * \param dev   The device to be tested.
+ *
+ * \returns
+ * If the device is a PCI G450, zero is returned.  Otherwise 2 is returned.
+ */
+int mga_driver_device_is_agp(drm_device_t * dev)
+{
+        const struct pci_dev * const pdev = dev->pdev;
+
+
+        /* There are PCI versions of the G450.  These cards have the
+         * same PCI ID as the AGP G450, but have an additional PCI-to-PCI
+         * bridge chip.  We detect these cards, which are not currently
+         * supported by this driver, by looking at the device ID of the
+         * bus the "card" is on.  If vendor is 0x3388 (Hint Corp) and the
+         * device is 0x0021 (HB6 Universal PCI-PCI bridge), we reject the
+         * device.
+         */
+        
+        if ( (pdev->device == 0x0525)
+             && (pdev->bus->self->vendor == 0x3388)
+             && (pdev->bus->self->device == 0x0021) ) {
+                return 0;
+        }
+
+        return 2;
+}
diff --git a/drivers/char/drm/mga_drv.h b/drivers/char/drm/mga_drv.h
index 9412e2816eb7..b22fdbd4f830 100644
--- a/drivers/char/drm/mga_drv.h
+++ b/drivers/char/drm/mga_drv.h
@@ -38,10 +38,10 @@
 
 #define DRIVER_NAME             "mga"
 #define DRIVER_DESC             "Matrox G200/G400"
-#define DRIVER_DATE             "20021029"
+#define DRIVER_DATE             "20050607"
 
 #define DRIVER_MAJOR            3
-#define DRIVER_MINOR            1
+#define DRIVER_MINOR            2
 #define DRIVER_PATCHLEVEL       0
 
 typedef struct drm_mga_primary_buffer {
@@ -87,9 +87,43 @@ typedef struct drm_mga_private {
         int chipset;
         int usec_timeout;
 
+        /**
+         * If set, the new DMA initialization sequence was used.  This is
+         * primarilly used to select how the driver should uninitialized its
+         * internal DMA structures.
+         */
+        int used_new_dma_init;
+
+        /**
+         * If AGP memory is used for DMA buffers, this will be the value
+         * \c MGA_PAGPXFER.  Otherwise, it will be zero (for a PCI transfer).
+         */
+        u32 dma_access;
+
+        /**
+         * If AGP memory is used for DMA buffers, this will be the value
+         * \c MGA_WAGP_ENABLE.  Otherwise, it will be zero (for a PCI
+         * transfer).
+         */
+        u32 wagp_enable;
+
+        /**
+         * \name MMIO region parameters.
+         * 
+         * \sa drm_mga_private_t::mmio
+         */
+        /*@{*/
+        u32 mmio_base;             /**< Bus address of base of MMIO. */
+        u32 mmio_size;             /**< Size of the MMIO region. */
+        /*@}*/
+
         u32 clear_cmd;
         u32 maccess;
 
+        wait_queue_head_t fence_queue;
+        atomic_t last_fence_retired;
+        u32 next_fence_to_post;
+
         unsigned int fb_cpp;
         unsigned int front_offset;
         unsigned int front_pitch;
@@ -108,35 +142,43 @@ typedef struct drm_mga_private {
         drm_local_map_t *status;
         drm_local_map_t *warp;
         drm_local_map_t *primary;
-        drm_local_map_t *buffers;
         drm_local_map_t *agp_textures;
+        
+        DRM_AGP_MEM *agp_mem;
+        unsigned int agp_pages;
 } drm_mga_private_t;
 
                                 /* mga_dma.c */
-extern int mga_dma_init( DRM_IOCTL_ARGS );
-extern int mga_dma_flush( DRM_IOCTL_ARGS );
-extern int mga_dma_reset( DRM_IOCTL_ARGS );
-extern int mga_dma_buffers( DRM_IOCTL_ARGS );
-extern void mga_driver_pretakedown(drm_device_t *dev);
-extern int mga_driver_dma_quiescent(drm_device_t *dev);
-
-extern int mga_do_wait_for_idle( drm_mga_private_t *dev_priv );
-
-extern void mga_do_dma_flush( drm_mga_private_t *dev_priv );
-extern void mga_do_dma_wrap_start( drm_mga_private_t *dev_priv );
-extern void mga_do_dma_wrap_end( drm_mga_private_t *dev_priv );
+extern int mga_driver_preinit(drm_device_t * dev, unsigned long flags);
+extern int mga_dma_bootstrap(DRM_IOCTL_ARGS);
+extern int mga_dma_init(DRM_IOCTL_ARGS);
+extern int mga_dma_flush(DRM_IOCTL_ARGS);
+extern int mga_dma_reset(DRM_IOCTL_ARGS);
+extern int mga_dma_buffers(DRM_IOCTL_ARGS);
+extern int mga_driver_postcleanup(drm_device_t * dev);
+extern void mga_driver_pretakedown(drm_device_t * dev);
+extern int mga_driver_dma_quiescent(drm_device_t * dev);
+
+extern int mga_do_wait_for_idle(drm_mga_private_t * dev_priv);
+
+extern void mga_do_dma_flush(drm_mga_private_t * dev_priv);
+extern void mga_do_dma_wrap_start(drm_mga_private_t * dev_priv);
+extern void mga_do_dma_wrap_end(drm_mga_private_t * dev_priv);
 
 extern int mga_freelist_put( drm_device_t *dev, drm_buf_t *buf );
 
                                 /* mga_warp.c */
-extern int mga_warp_install_microcode( drm_mga_private_t *dev_priv );
-extern int mga_warp_init( drm_mga_private_t *dev_priv );
-
-extern int mga_driver_vblank_wait(drm_device_t *dev, unsigned int *sequence);
-extern irqreturn_t mga_driver_irq_handler( DRM_IRQ_ARGS );
-extern void mga_driver_irq_preinstall( drm_device_t *dev );
-extern void mga_driver_irq_postinstall( drm_device_t *dev );
-extern void mga_driver_irq_uninstall( drm_device_t *dev );
+extern unsigned int mga_warp_microcode_size(const drm_mga_private_t * dev_priv);
+extern int mga_warp_install_microcode(drm_mga_private_t * dev_priv);
+extern int mga_warp_init(drm_mga_private_t * dev_priv);
+
+                                /* mga_irq.c */
+extern int mga_driver_fence_wait(drm_device_t * dev, unsigned int *sequence);
+extern int mga_driver_vblank_wait(drm_device_t * dev, unsigned int *sequence);
+extern irqreturn_t mga_driver_irq_handler(DRM_IRQ_ARGS);
+extern void mga_driver_irq_preinstall(drm_device_t * dev);
+extern void mga_driver_irq_postinstall(drm_device_t * dev);
+extern void mga_driver_irq_uninstall(drm_device_t * dev);
 extern long mga_compat_ioctl(struct file *filp, unsigned int cmd,
                              unsigned long arg);
 
@@ -527,6 +569,12 @@ do {									\
  */
 #define MGA_EXEC                        0x0100
 
+/* AGP PLL encoding (for G200 only).
+ */
+#define MGA_AGP_PLL                     0x1e4c
+#       define MGA_AGP2XPLL_DISABLE             (0 << 0)
+#       define MGA_AGP2XPLL_ENABLE              (1 << 0)
+
 /* Warp registers
  */
 #define MGA_WR0                         0x2d00
diff --git a/drivers/char/drm/mga_ioc32.c b/drivers/char/drm/mga_ioc32.c
index bc745cfa2095..77d738e75a4d 100644
--- a/drivers/char/drm/mga_ioc32.c
+++ b/drivers/char/drm/mga_ioc32.c
@@ -129,9 +129,76 @@ static int compat_mga_getparam(struct file *file, unsigned int cmd,
                          DRM_IOCTL_MGA_GETPARAM, (unsigned long)getparam);
 }
 
+typedef struct drm_mga_drm_bootstrap32 {
+        u32 texture_handle;
+        u32 texture_size;
+        u32 primary_size;
+        u32 secondary_bin_count;
+        u32 secondary_bin_size;
+        u32 agp_mode;
+        u8 agp_size;
+} drm_mga_dma_bootstrap32_t;
+
+static int compat_mga_dma_bootstrap(struct file *file, unsigned int cmd,
+                                    unsigned long arg)
+{
+        drm_mga_dma_bootstrap32_t dma_bootstrap32;
+        drm_mga_dma_bootstrap_t __user *dma_bootstrap;
+        int err;
+
+        if (copy_from_user(&dma_bootstrap32, (void __user *)arg,
+                           sizeof(dma_bootstrap32)))
+                return -EFAULT;
+
+        dma_bootstrap = compat_alloc_user_space(sizeof(*dma_bootstrap));
+        if (!access_ok(VERIFY_WRITE, dma_bootstrap, sizeof(*dma_bootstrap))
+            || __put_user(dma_bootstrap32.texture_handle,
+                          &dma_bootstrap->texture_handle)
+            || __put_user(dma_bootstrap32.texture_size,
+                          &dma_bootstrap->texture_size)
+            || __put_user(dma_bootstrap32.primary_size,
+                          &dma_bootstrap->primary_size)
+            || __put_user(dma_bootstrap32.secondary_bin_count,
+                          &dma_bootstrap->secondary_bin_count)
+            || __put_user(dma_bootstrap32.secondary_bin_size,
+                          &dma_bootstrap->secondary_bin_size)
+            || __put_user(dma_bootstrap32.agp_mode, &dma_bootstrap->agp_mode)
+            || __put_user(dma_bootstrap32.agp_size, &dma_bootstrap->agp_size))
+                return -EFAULT;
+
+        err = drm_ioctl(file->f_dentry->d_inode, file,
+                        DRM_IOCTL_MGA_DMA_BOOTSTRAP,
+                        (unsigned long)dma_bootstrap);
+        if (err)
+                return err;
+
+        if (__get_user(dma_bootstrap32.texture_handle,
+                       &dma_bootstrap->texture_handle)
+            || __get_user(dma_bootstrap32.texture_size,
+                          &dma_bootstrap->texture_size)
+            || __get_user(dma_bootstrap32.primary_size,
+                          &dma_bootstrap->primary_size)
+            || __get_user(dma_bootstrap32.secondary_bin_count,
+                          &dma_bootstrap->secondary_bin_count)
+            || __get_user(dma_bootstrap32.secondary_bin_size,
+                          &dma_bootstrap->secondary_bin_size)
+            || __get_user(dma_bootstrap32.agp_mode,
+                          &dma_bootstrap->agp_mode)
+            || __get_user(dma_bootstrap32.agp_size,
+                          &dma_bootstrap->agp_size))
+                return -EFAULT;
+
+        if (copy_to_user((void __user *)arg, &dma_bootstrap32,
+                         sizeof(dma_bootstrap32)))
+                return -EFAULT;
+
+        return 0;
+}
+
 drm_ioctl_compat_t *mga_compat_ioctls[] = {
         [DRM_MGA_INIT] = compat_mga_init,
         [DRM_MGA_GETPARAM] = compat_mga_getparam,
+        [DRM_MGA_DMA_BOOTSTRAP] = compat_mga_dma_bootstrap,
 };
 
 /**
diff --git a/drivers/char/drm/mga_irq.c b/drivers/char/drm/mga_irq.c
index bc0b6b5d43a6..52eaa4e788f9 100644
--- a/drivers/char/drm/mga_irq.c
+++ b/drivers/char/drm/mga_irq.c
@@ -41,15 +41,40 @@ irqreturn_t mga_driver_irq_handler( DRM_IRQ_ARGS )
         drm_mga_private_t *dev_priv = 
            (drm_mga_private_t *)dev->dev_private;
         int status;
+        int handled = 0;
+
+        status = MGA_READ(MGA_STATUS);
 
-        status = MGA_READ( MGA_STATUS );
-        
         /* VBLANK interrupt */
         if ( status & MGA_VLINEPEN ) {
                 MGA_WRITE( MGA_ICLEAR, MGA_VLINEICLR );
                 atomic_inc(&dev->vbl_received);
                 DRM_WAKEUP(&dev->vbl_queue);
-                drm_vbl_send_signals( dev );
+                drm_vbl_send_signals(dev);
+                handled = 1;
+        }
+
+        /* SOFTRAP interrupt */
+        if (status & MGA_SOFTRAPEN) {
+                const u32 prim_start = MGA_READ(MGA_PRIMADDRESS);
+                const u32 prim_end   = MGA_READ(MGA_PRIMEND);
+
+
+                MGA_WRITE(MGA_ICLEAR, MGA_SOFTRAPICLR);
+
+                /* In addition to clearing the interrupt-pending bit, we
+                 * have to write to MGA_PRIMEND to re-start the DMA operation.
+                 */
+                if ( (prim_start & ~0x03) != (prim_end & ~0x03) ) {
+                        MGA_WRITE(MGA_PRIMEND, prim_end);
+                }
+
+                atomic_inc(&dev_priv->last_fence_retired);
+                DRM_WAKEUP(&dev_priv->fence_queue);
+                handled = 1;
+        }
+
+        if ( handled ) {
                 return IRQ_HANDLED;
         }
         return IRQ_NONE;
@@ -73,9 +98,28 @@ int mga_driver_vblank_wait(drm_device_t *dev, unsigned int *sequence)
         return ret;
 }
 
-void mga_driver_irq_preinstall( drm_device_t *dev ) {
-        drm_mga_private_t *dev_priv = 
-           (drm_mga_private_t *)dev->dev_private;
+int mga_driver_fence_wait(drm_device_t * dev, unsigned int *sequence)
+{
+        drm_mga_private_t *dev_priv = (drm_mga_private_t *) dev->dev_private;
+        unsigned int cur_fence;
+        int ret = 0;
+
+        /* Assume that the user has missed the current sequence number
+         * by about a day rather than she wants to wait for years
+         * using fences.
+         */
+        DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
+                    (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
+                      - *sequence) <= (1 << 23)));
+
+        *sequence = cur_fence;
+
+        return ret;
+}
+
+void mga_driver_irq_preinstall(drm_device_t * dev)
+{
+        drm_mga_private_t *dev_priv = (drm_mga_private_t *) dev->dev_private;
 
         /* Disable *all* interrupts */
         MGA_WRITE( MGA_IEN, 0 );
@@ -83,12 +127,14 @@ void mga_driver_irq_preinstall( drm_device_t *dev ) {
         MGA_WRITE( MGA_ICLEAR, ~0 );
 }
 
-void mga_driver_irq_postinstall( drm_device_t *dev ) {
-        drm_mga_private_t *dev_priv = 
-           (drm_mga_private_t *)dev->dev_private;
+void mga_driver_irq_postinstall(drm_device_t * dev)
+{
+        drm_mga_private_t *dev_priv = (drm_mga_private_t *) dev->dev_private;
+
+        DRM_INIT_WAITQUEUE( &dev_priv->fence_queue );
 
-        /* Turn on VBL interrupt */
-        MGA_WRITE( MGA_IEN, MGA_VLINEIEN );
+        /* Turn on vertical blank interrupt and soft trap interrupt. */
+        MGA_WRITE(MGA_IEN, MGA_VLINEIEN | MGA_SOFTRAPEN);
 }
 
 void mga_driver_irq_uninstall( drm_device_t *dev ) {
@@ -98,5 +144,7 @@ void mga_driver_irq_uninstall( drm_device_t *dev ) {
                 return;
 
         /* Disable *all* interrupts */
-        MGA_WRITE( MGA_IEN, 0 );
+        MGA_WRITE(MGA_IEN, 0);
+        
+        dev->irq_enabled = 0;
 }
diff --git a/drivers/char/drm/mga_state.c b/drivers/char/drm/mga_state.c
index 3c7a8f5ba501..05bbb4719376 100644
--- a/drivers/char/drm/mga_state.c
+++ b/drivers/char/drm/mga_state.c
@@ -53,16 +53,16 @@ static void mga_emit_clip_rect( drm_mga_private_t *dev_priv,
 
         /* Force reset of DWGCTL on G400 (eliminates clip disable bit).
          */
-        if ( dev_priv->chipset == MGA_CARD_TYPE_G400 ) {
-                DMA_BLOCK( MGA_DWGCTL,          ctx->dwgctl,
-                           MGA_LEN + MGA_EXEC,  0x80000000,
-                           MGA_DWGCTL,          ctx->dwgctl,
-                           MGA_LEN + MGA_EXEC,  0x80000000 );
+        if (dev_priv->chipset == MGA_CARD_TYPE_G400) {
+                DMA_BLOCK(MGA_DWGCTL, ctx->dwgctl,
+                          MGA_LEN + MGA_EXEC, 0x80000000,
+                          MGA_DWGCTL, ctx->dwgctl,
+                          MGA_LEN + MGA_EXEC, 0x80000000);
         }
-        DMA_BLOCK( MGA_DMAPAD,  0x00000000,
-                   MGA_CXBNDRY, (box->x2 << 16) | box->x1,
-                   MGA_YTOP,    box->y1 * pitch,
-                   MGA_YBOT,    box->y2 * pitch );
+        DMA_BLOCK(MGA_DMAPAD, 0x00000000,
+                  MGA_CXBNDRY, ((box->x2 - 1) << 16) | box->x1,
+                  MGA_YTOP, box->y1 * pitch,
+                  MGA_YBOT, (box->y2 - 1) * pitch);
 
         ADVANCE_DMA();
 }
@@ -260,12 +260,11 @@ static __inline__ void mga_g200_emit_pipe( drm_mga_private_t *dev_priv )
 
         /* Padding required to to hardware bug.
          */
-        DMA_BLOCK( MGA_DMAPAD,  0xffffffff,
-                   MGA_DMAPAD,  0xffffffff,
-                   MGA_DMAPAD,  0xffffffff,
-                   MGA_WIADDR,  (dev_priv->warp_pipe_phys[pipe] |
-                                 MGA_WMODE_START |
-                                 MGA_WAGP_ENABLE) );
+        DMA_BLOCK(MGA_DMAPAD, 0xffffffff,
+                  MGA_DMAPAD, 0xffffffff,
+                  MGA_DMAPAD, 0xffffffff,
+                  MGA_WIADDR, (dev_priv->warp_pipe_phys[pipe] |
+                               MGA_WMODE_START | dev_priv->wagp_enable));
 
         ADVANCE_DMA();
 }
@@ -342,12 +341,11 @@ static __inline__ void mga_g400_emit_pipe( drm_mga_private_t *dev_priv )
                    MGA_WR60,    MGA_G400_WR_MAGIC );    /* tex1 height       */
 
         /* Padding required to to hardware bug */
-        DMA_BLOCK( MGA_DMAPAD,  0xffffffff,
-                   MGA_DMAPAD,  0xffffffff,
-                   MGA_DMAPAD,  0xffffffff,
-                   MGA_WIADDR2, (dev_priv->warp_pipe_phys[pipe] |
-                                 MGA_WMODE_START |
-                                 MGA_WAGP_ENABLE) );
+        DMA_BLOCK(MGA_DMAPAD, 0xffffffff,
+                  MGA_DMAPAD, 0xffffffff,
+                  MGA_DMAPAD, 0xffffffff,
+                  MGA_WIADDR2, (dev_priv->warp_pipe_phys[pipe] |
+                                MGA_WMODE_START | dev_priv->wagp_enable));
 
         ADVANCE_DMA();
 }
@@ -459,9 +457,9 @@ static int mga_verify_state( drm_mga_private_t *dev_priv )
         if ( dirty & MGA_UPLOAD_TEX0 )
                 ret |= mga_verify_tex( dev_priv, 0 );
 
-        if ( dev_priv->chipset == MGA_CARD_TYPE_G400 ) {
-                if ( dirty & MGA_UPLOAD_TEX1 )
-                        ret |= mga_verify_tex( dev_priv, 1 );
+        if (dev_priv->chipset >= MGA_CARD_TYPE_G400) {
+                if (dirty & MGA_UPLOAD_TEX1)
+                        ret |= mga_verify_tex(dev_priv, 1);
 
                 if ( dirty & MGA_UPLOAD_PIPE )
                         ret |= ( sarea_priv->warp_pipe > MGA_MAX_G400_PIPES );
@@ -686,12 +684,12 @@ static void mga_dma_dispatch_vertex( drm_device_t *dev, drm_buf_t *buf )
 
                         BEGIN_DMA( 1 );
 
-                        DMA_BLOCK( MGA_DMAPAD,          0x00000000,
-                                   MGA_DMAPAD,          0x00000000,
-                                   MGA_SECADDRESS,      (address |
-                                                         MGA_DMA_VERTEX),
-                                   MGA_SECEND,          ((address + length) |
-                                                         MGA_PAGPXFER) );
+                        DMA_BLOCK(MGA_DMAPAD, 0x00000000,
+                                  MGA_DMAPAD, 0x00000000,
+                                  MGA_SECADDRESS, (address |
+                                                   MGA_DMA_VERTEX),
+                                  MGA_SECEND, ((address + length) |
+                                               dev_priv->dma_access));
 
                         ADVANCE_DMA();
                 } while ( ++i < sarea_priv->nbox );
@@ -733,11 +731,11 @@ static void mga_dma_dispatch_indices( drm_device_t *dev, drm_buf_t *buf,
 
                         BEGIN_DMA( 1 );
 
-                        DMA_BLOCK( MGA_DMAPAD,          0x00000000,
-                                   MGA_DMAPAD,          0x00000000,
-                                   MGA_SETUPADDRESS,    address + start,
-                                   MGA_SETUPEND,        ((address + end) |
-                                                         MGA_PAGPXFER) );
+                        DMA_BLOCK(MGA_DMAPAD, 0x00000000,
+                                  MGA_DMAPAD, 0x00000000,
+                                  MGA_SETUPADDRESS, address + start,
+                                  MGA_SETUPEND, ((address + end) |
+                                                 dev_priv->dma_access));
 
                         ADVANCE_DMA();
                 } while ( ++i < sarea_priv->nbox );
@@ -764,7 +762,7 @@ static void mga_dma_dispatch_iload( drm_device_t *dev, drm_buf_t *buf,
         drm_mga_private_t *dev_priv = dev->dev_private;
         drm_mga_buf_priv_t *buf_priv = buf->dev_private;
         drm_mga_context_regs_t *ctx = &dev_priv->sarea_priv->context_state;
-        u32 srcorg = buf->bus_address | MGA_SRCACC_AGP | MGA_SRCMAP_SYSMEM;
+        u32 srcorg = buf->bus_address | dev_priv->dma_access | MGA_SRCMAP_SYSMEM;
         u32 y2;
         DMA_LOCALS;
         DRM_DEBUG( "buf=%d used=%d\n", buf->idx, buf->used );
@@ -1095,6 +1093,9 @@ static int mga_getparam( DRM_IOCTL_ARGS )
         case MGA_PARAM_IRQ_NR:
                 value = dev->irq;
                 break;
+        case MGA_PARAM_CARD_TYPE:
+                value = dev_priv->chipset;
+                break;
         default:
                 return DRM_ERR(EINVAL);
         }
@@ -1107,17 +1108,82 @@ static int mga_getparam( DRM_IOCTL_ARGS )
         return 0;
 }
 
+static int mga_set_fence(DRM_IOCTL_ARGS)
+{
+        DRM_DEVICE;
+        drm_mga_private_t *dev_priv = dev->dev_private;
+        u32 temp;
+        DMA_LOCALS;
+
+        if (!dev_priv) {
+                DRM_ERROR("%s called with no initialization\n", __FUNCTION__);
+                return DRM_ERR(EINVAL);
+        }
+
+        DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
+
+        /* I would normal do this assignment in the declaration of temp,
+         * but dev_priv may be NULL.
+         */
+
+        temp = dev_priv->next_fence_to_post;
+        dev_priv->next_fence_to_post++;
+
+        BEGIN_DMA(1);
+        DMA_BLOCK(MGA_DMAPAD, 0x00000000,
+                  MGA_DMAPAD, 0x00000000,
+                  MGA_DMAPAD, 0x00000000,
+                  MGA_SOFTRAP, 0x00000000);
+        ADVANCE_DMA();
+
+        if (DRM_COPY_TO_USER( (u32 __user *) data, & temp, sizeof(u32))) {
+                DRM_ERROR("copy_to_user\n");
+                return DRM_ERR(EFAULT);
+        }
+
+        return 0;
+}
+
+static int mga_wait_fence(DRM_IOCTL_ARGS)
+{
+        DRM_DEVICE;
+        drm_mga_private_t *dev_priv = dev->dev_private;
+        u32 fence;
+
+        if (!dev_priv) {
+                DRM_ERROR("%s called with no initialization\n", __FUNCTION__);
+                return DRM_ERR(EINVAL);
+        }
+
+        DRM_COPY_FROM_USER_IOCTL(fence, (u32 __user *) data, sizeof(u32));
+
+        DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
+
+        mga_driver_fence_wait(dev, & fence);
+
+        if (DRM_COPY_TO_USER( (u32 __user *) data, & fence, sizeof(u32))) {
+                DRM_ERROR("copy_to_user\n");
+                return DRM_ERR(EFAULT);
+        }
+
+        return 0;
+}
+
 drm_ioctl_desc_t mga_ioctls[] = {
-        [DRM_IOCTL_NR(DRM_MGA_INIT)]    = { mga_dma_init,    1, 1 },
-        [DRM_IOCTL_NR(DRM_MGA_FLUSH)]   = { mga_dma_flush,   1, 0 },
-        [DRM_IOCTL_NR(DRM_MGA_RESET)]   = { mga_dma_reset,   1, 0 },
-        [DRM_IOCTL_NR(DRM_MGA_SWAP)]    = { mga_dma_swap,    1, 0 },
-        [DRM_IOCTL_NR(DRM_MGA_CLEAR)]   = { mga_dma_clear,   1, 0 },
-        [DRM_IOCTL_NR(DRM_MGA_VERTEX)]  = { mga_dma_vertex,  1, 0 },
-        [DRM_IOCTL_NR(DRM_MGA_INDICES)] = { mga_dma_indices, 1, 0 },
-        [DRM_IOCTL_NR(DRM_MGA_ILOAD)]   = { mga_dma_iload,   1, 0 },
-        [DRM_IOCTL_NR(DRM_MGA_BLIT)]    = { mga_dma_blit,    1, 0 },
-        [DRM_IOCTL_NR(DRM_MGA_GETPARAM)]= { mga_getparam,    1, 0 },
+        [DRM_IOCTL_NR(DRM_MGA_INIT)] = {mga_dma_init, 1, 1},
+        [DRM_IOCTL_NR(DRM_MGA_FLUSH)] = {mga_dma_flush, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_RESET)] = {mga_dma_reset, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_SWAP)] = {mga_dma_swap, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_CLEAR)] = {mga_dma_clear, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_VERTEX)] = {mga_dma_vertex, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_INDICES)] = {mga_dma_indices, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_ILOAD)] = {mga_dma_iload, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_BLIT)] = {mga_dma_blit, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_GETPARAM)] = {mga_getparam, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_SET_FENCE)] = {mga_set_fence, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_WAIT_FENCE)] = {mga_wait_fence, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_DMA_BOOTSTRAP)] = {mga_dma_bootstrap, 1, 1},
+
 };
 
 int mga_max_ioctl = DRM_ARRAY_SIZE(mga_ioctls);
diff --git a/drivers/char/drm/mga_warp.c b/drivers/char/drm/mga_warp.c
index 0a3a0cc700dc..55ccc8a0ac29 100644
--- a/drivers/char/drm/mga_warp.c
+++ b/drivers/char/drm/mga_warp.c
@@ -48,65 +48,52 @@ do {									\
         vcbase += WARP_UCODE_SIZE( which );                             \
 } while (0)
 
-
-static unsigned int mga_warp_g400_microcode_size( drm_mga_private_t *dev_priv )
-{
-        unsigned int size;
-
-        size = ( WARP_UCODE_SIZE( warp_g400_tgz ) +
-                 WARP_UCODE_SIZE( warp_g400_tgza ) +
-                 WARP_UCODE_SIZE( warp_g400_tgzaf ) +
-                 WARP_UCODE_SIZE( warp_g400_tgzf ) +
-                 WARP_UCODE_SIZE( warp_g400_tgzs ) +
-                 WARP_UCODE_SIZE( warp_g400_tgzsa ) +
-                 WARP_UCODE_SIZE( warp_g400_tgzsaf ) +
-                 WARP_UCODE_SIZE( warp_g400_tgzsf ) +
-                 WARP_UCODE_SIZE( warp_g400_t2gz ) +
-                 WARP_UCODE_SIZE( warp_g400_t2gza ) +
-                 WARP_UCODE_SIZE( warp_g400_t2gzaf ) +
-                 WARP_UCODE_SIZE( warp_g400_t2gzf ) +
-                 WARP_UCODE_SIZE( warp_g400_t2gzs ) +
-                 WARP_UCODE_SIZE( warp_g400_t2gzsa ) +
-                 WARP_UCODE_SIZE( warp_g400_t2gzsaf ) +
-                 WARP_UCODE_SIZE( warp_g400_t2gzsf ) );
-
-        size = PAGE_ALIGN( size );
-
-        DRM_DEBUG( "G400 ucode size = %d bytes\n", size );
-        return size;
-}
-
-static unsigned int mga_warp_g200_microcode_size( drm_mga_private_t *dev_priv )
+static const unsigned int mga_warp_g400_microcode_size =
+               (WARP_UCODE_SIZE(warp_g400_tgz) +
+                WARP_UCODE_SIZE(warp_g400_tgza) +
+                WARP_UCODE_SIZE(warp_g400_tgzaf) +
+                WARP_UCODE_SIZE(warp_g400_tgzf) +
+                WARP_UCODE_SIZE(warp_g400_tgzs) +
+                WARP_UCODE_SIZE(warp_g400_tgzsa) +
+                WARP_UCODE_SIZE(warp_g400_tgzsaf) +
+                WARP_UCODE_SIZE(warp_g400_tgzsf) +
+                WARP_UCODE_SIZE(warp_g400_t2gz) +
+                WARP_UCODE_SIZE(warp_g400_t2gza) +
+                WARP_UCODE_SIZE(warp_g400_t2gzaf) +
+                WARP_UCODE_SIZE(warp_g400_t2gzf) +
+                WARP_UCODE_SIZE(warp_g400_t2gzs) +
+                WARP_UCODE_SIZE(warp_g400_t2gzsa) +
+                WARP_UCODE_SIZE(warp_g400_t2gzsaf) +
+                WARP_UCODE_SIZE(warp_g400_t2gzsf));
+
+static const unsigned int mga_warp_g200_microcode_size =
+               (WARP_UCODE_SIZE(warp_g200_tgz) +
+                WARP_UCODE_SIZE(warp_g200_tgza) +
+                WARP_UCODE_SIZE(warp_g200_tgzaf) +
+                WARP_UCODE_SIZE(warp_g200_tgzf) +
+                WARP_UCODE_SIZE(warp_g200_tgzs) +
+                WARP_UCODE_SIZE(warp_g200_tgzsa) +
+                WARP_UCODE_SIZE(warp_g200_tgzsaf) +
+                WARP_UCODE_SIZE(warp_g200_tgzsf));
+
+
+unsigned int mga_warp_microcode_size(const drm_mga_private_t * dev_priv)
 {
-        unsigned int size;
-
-        size = ( WARP_UCODE_SIZE( warp_g200_tgz ) +
-                 WARP_UCODE_SIZE( warp_g200_tgza ) +
-                 WARP_UCODE_SIZE( warp_g200_tgzaf ) +
-                 WARP_UCODE_SIZE( warp_g200_tgzf ) +
-                 WARP_UCODE_SIZE( warp_g200_tgzs ) +
-                 WARP_UCODE_SIZE( warp_g200_tgzsa ) +
-                 WARP_UCODE_SIZE( warp_g200_tgzsaf ) +
-                 WARP_UCODE_SIZE( warp_g200_tgzsf ) );
-
-        size = PAGE_ALIGN( size );
-
-        DRM_DEBUG( "G200 ucode size = %d bytes\n", size );
-        return size;
+        switch (dev_priv->chipset) {
+        case MGA_CARD_TYPE_G400:
+        case MGA_CARD_TYPE_G550:
+                return PAGE_ALIGN(mga_warp_g400_microcode_size);
+        case MGA_CARD_TYPE_G200:
+                return PAGE_ALIGN(mga_warp_g200_microcode_size);
+        default:
+                return 0;
+        }
 }
 
 static int mga_warp_install_g400_microcode( drm_mga_private_t *dev_priv )
 {
         unsigned char *vcbase = dev_priv->warp->handle;
         unsigned long pcbase = dev_priv->warp->offset;
-        unsigned int size;
-
-        size = mga_warp_g400_microcode_size( dev_priv );
-        if ( size > dev_priv->warp->size ) {
-                DRM_ERROR( "microcode too large! (%u > %lu)\n",
-                           size, dev_priv->warp->size );
-                return DRM_ERR(ENOMEM);
-        }
 
         memset( dev_priv->warp_pipe_phys, 0,
                 sizeof(dev_priv->warp_pipe_phys) );
@@ -136,35 +123,36 @@ static int mga_warp_install_g200_microcode( drm_mga_private_t *dev_priv )
 {
         unsigned char *vcbase = dev_priv->warp->handle;
         unsigned long pcbase = dev_priv->warp->offset;
-        unsigned int size;
-
-        size = mga_warp_g200_microcode_size( dev_priv );
-        if ( size > dev_priv->warp->size ) {
-                DRM_ERROR( "microcode too large! (%u > %lu)\n",
-                           size, dev_priv->warp->size );
-                return DRM_ERR(ENOMEM);
-        }
 
-        memset( dev_priv->warp_pipe_phys, 0,
-                sizeof(dev_priv->warp_pipe_phys) );
+        memset(dev_priv->warp_pipe_phys, 0, sizeof(dev_priv->warp_pipe_phys));
 
-        WARP_UCODE_INSTALL( warp_g200_tgz,      MGA_WARP_TGZ );
-        WARP_UCODE_INSTALL( warp_g200_tgzf,     MGA_WARP_TGZF );
-        WARP_UCODE_INSTALL( warp_g200_tgza,     MGA_WARP_TGZA );
-        WARP_UCODE_INSTALL( warp_g200_tgzaf,    MGA_WARP_TGZAF );
-        WARP_UCODE_INSTALL( warp_g200_tgzs,     MGA_WARP_TGZS );
-        WARP_UCODE_INSTALL( warp_g200_tgzsf,    MGA_WARP_TGZSF );
-        WARP_UCODE_INSTALL( warp_g200_tgzsa,    MGA_WARP_TGZSA );
-        WARP_UCODE_INSTALL( warp_g200_tgzsaf,   MGA_WARP_TGZSAF );
+        WARP_UCODE_INSTALL(warp_g200_tgz, MGA_WARP_TGZ);
+        WARP_UCODE_INSTALL(warp_g200_tgzf, MGA_WARP_TGZF);
+        WARP_UCODE_INSTALL(warp_g200_tgza, MGA_WARP_TGZA);
+        WARP_UCODE_INSTALL(warp_g200_tgzaf, MGA_WARP_TGZAF);
+        WARP_UCODE_INSTALL(warp_g200_tgzs, MGA_WARP_TGZS);
+        WARP_UCODE_INSTALL(warp_g200_tgzsf, MGA_WARP_TGZSF);
+        WARP_UCODE_INSTALL(warp_g200_tgzsa, MGA_WARP_TGZSA);
+        WARP_UCODE_INSTALL(warp_g200_tgzsaf, MGA_WARP_TGZSAF);
 
         return 0;
 }
 
 int mga_warp_install_microcode( drm_mga_private_t *dev_priv )
 {
-        switch ( dev_priv->chipset ) {
+        const unsigned int size = mga_warp_microcode_size(dev_priv);
+
+        DRM_DEBUG("MGA ucode size = %d bytes\n", size);
+        if (size > dev_priv->warp->size) {
+                DRM_ERROR("microcode too large! (%u > %lu)\n",
+                          size, dev_priv->warp->size);
+                return DRM_ERR(ENOMEM);
+        }
+
+        switch (dev_priv->chipset) {
         case MGA_CARD_TYPE_G400:
-                return mga_warp_install_g400_microcode( dev_priv );
+        case MGA_CARD_TYPE_G550:
+                return mga_warp_install_g400_microcode(dev_priv);
         case MGA_CARD_TYPE_G200:
                 return mga_warp_install_g200_microcode( dev_priv );
         default:
@@ -182,10 +170,11 @@ int mga_warp_init( drm_mga_private_t *dev_priv )
          */
         switch ( dev_priv->chipset ) {
         case MGA_CARD_TYPE_G400:
-                MGA_WRITE( MGA_WIADDR2, MGA_WMODE_SUSPEND );
-                MGA_WRITE( MGA_WGETMSB, 0x00000E00 );
-                MGA_WRITE( MGA_WVRTXSZ, 0x00001807 );
-                MGA_WRITE( MGA_WACCEPTSEQ, 0x18000000 );
+        case MGA_CARD_TYPE_G550:
+                MGA_WRITE(MGA_WIADDR2, MGA_WMODE_SUSPEND);
+                MGA_WRITE(MGA_WGETMSB, 0x00000E00);
+                MGA_WRITE(MGA_WVRTXSZ, 0x00001807);
+                MGA_WRITE(MGA_WACCEPTSEQ, 0x18000000);
                 break;
         case MGA_CARD_TYPE_G200:
                 MGA_WRITE( MGA_WIADDR, MGA_WMODE_SUSPEND );
diff --git a/drivers/char/drm/r128_cce.c b/drivers/char/drm/r128_cce.c
index 08ed8d01d9d9..895152206b31 100644
--- a/drivers/char/drm/r128_cce.c
+++ b/drivers/char/drm/r128_cce.c
@@ -326,7 +326,8 @@ static void r128_cce_init_ring_buffer( drm_device_t *dev,
                 ring_start = dev_priv->cce_ring->offset - dev->agp->base;
         else
 #endif
-                ring_start = dev_priv->cce_ring->offset - dev->sg->handle;
+                ring_start = dev_priv->cce_ring->offset - 
+                                (unsigned long)dev->sg->virtual;
 
         R128_WRITE( R128_PM4_BUFFER_OFFSET, ring_start | R128_AGP_OFFSET );
 
@@ -487,6 +488,7 @@ static int r128_do_init_cce( drm_device_t *dev, drm_r128_init_t *init )
                 r128_do_cleanup_cce( dev );
                 return DRM_ERR(EINVAL);
         }
+        dev->agp_buffer_token = init->buffers_offset;
         dev->agp_buffer_map = drm_core_findmap(dev, init->buffers_offset);
         if(!dev->agp_buffer_map) {
                 DRM_ERROR("could not find dma buffer region!\n");
@@ -537,7 +539,7 @@ static int r128_do_init_cce( drm_device_t *dev, drm_r128_init_t *init )
                 dev_priv->cce_buffers_offset = dev->agp->base;
         else
 #endif
-                dev_priv->cce_buffers_offset = dev->sg->handle;
+                dev_priv->cce_buffers_offset = (unsigned long)dev->sg->virtual;
 
         dev_priv->ring.start = (u32 *)dev_priv->cce_ring->handle;
         dev_priv->ring.end = ((u32 *)dev_priv->cce_ring->handle
diff --git a/drivers/char/drm/r128_drm.h b/drivers/char/drm/r128_drm.h
index 0cba17d1e0ff..b616cd3ed2cd 100644
--- a/drivers/char/drm/r128_drm.h
+++ b/drivers/char/drm/r128_drm.h
@@ -215,7 +215,7 @@ typedef struct drm_r128_sarea {
 #define DRM_IOCTL_R128_INDIRECT   DRM_IOWR(DRM_COMMAND_BASE + DRM_R128_INDIRECT, drm_r128_indirect_t)
 #define DRM_IOCTL_R128_FULLSCREEN DRM_IOW( DRM_COMMAND_BASE + DRM_R128_FULLSCREEN, drm_r128_fullscreen_t)
 #define DRM_IOCTL_R128_CLEAR2     DRM_IOW( DRM_COMMAND_BASE + DRM_R128_CLEAR2, drm_r128_clear2_t)
-#define DRM_IOCTL_R128_GETPARAM   DRM_IOW( DRM_COMMAND_BASE + DRM_R128_GETPARAM, drm_r128_getparam_t)
+#define DRM_IOCTL_R128_GETPARAM   DRM_IOWR( DRM_COMMAND_BASE + DRM_R128_GETPARAM, drm_r128_getparam_t)
 #define DRM_IOCTL_R128_FLIP       DRM_IO(  DRM_COMMAND_BASE + DRM_R128_FLIP)
 
 typedef struct drm_r128_init {
diff --git a/drivers/char/drm/r300_cmdbuf.c b/drivers/char/drm/r300_cmdbuf.c
new file mode 100644
index 000000000000..623f1f460cb5
--- /dev/null
+++ b/drivers/char/drm/r300_cmdbuf.c
@@ -0,0 +1,801 @@
+/* r300_cmdbuf.c -- Command buffer emission for R300 -*- linux-c -*-
+ *
+ * Copyright (C) The Weather Channel, Inc.  2002.
+ * Copyright (C) 2004 Nicolai Haehnle.
+ * All Rights Reserved.
+ *
+ * The Weather Channel (TM) funded Tungsten Graphics to develop the
+ * initial release of the Radeon 8500 driver under the XFree86 license.
+ * This notice must be preserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * Authors:
+ *    Nicolai Haehnle <prefect_@gmx.net>
+ */
+
+#include "drmP.h"
+#include "drm.h"
+#include "radeon_drm.h"
+#include "radeon_drv.h"
+#include "r300_reg.h"
+
+
+#define R300_SIMULTANEOUS_CLIPRECTS             4
+
+/* Values for R300_RE_CLIPRECT_CNTL depending on the number of cliprects
+ */
+static const int r300_cliprect_cntl[4] = {
+        0xAAAA,
+        0xEEEE,
+        0xFEFE,
+        0xFFFE
+};
+
+
+/**
+ * Emit up to R300_SIMULTANEOUS_CLIPRECTS cliprects from the given command
+ * buffer, starting with index n.
+ */
+static int r300_emit_cliprects(drm_radeon_private_t* dev_priv,
+                               drm_radeon_cmd_buffer_t* cmdbuf,
+                               int n)
+{
+        drm_clip_rect_t box;
+        int nr;
+        int i;
+        RING_LOCALS;
+
+        nr = cmdbuf->nbox - n;
+        if (nr > R300_SIMULTANEOUS_CLIPRECTS)
+                nr = R300_SIMULTANEOUS_CLIPRECTS;
+
+        DRM_DEBUG("%i cliprects\n", nr);
+
+        if (nr) {
+                BEGIN_RING(6 + nr*2);
+                OUT_RING( CP_PACKET0( R300_RE_CLIPRECT_TL_0, nr*2 - 1 ) );
+
+                for(i = 0; i < nr; ++i) {
+                        if (DRM_COPY_FROM_USER_UNCHECKED(&box, &cmdbuf->boxes[n+i], sizeof(box))) {
+                                DRM_ERROR("copy cliprect faulted\n");
+                                return DRM_ERR(EFAULT);
+                        }
+
+                        box.x1 = (box.x1 + R300_CLIPRECT_OFFSET) & R300_CLIPRECT_MASK;
+                        box.y1 = (box.y1 + R300_CLIPRECT_OFFSET) & R300_CLIPRECT_MASK;
+                        box.x2 = (box.x2 + R300_CLIPRECT_OFFSET) & R300_CLIPRECT_MASK;
+                        box.y2 = (box.y2 + R300_CLIPRECT_OFFSET) & R300_CLIPRECT_MASK;
+
+                        OUT_RING((box.x1 << R300_CLIPRECT_X_SHIFT) |
+                                        (box.y1 << R300_CLIPRECT_Y_SHIFT));
+                        OUT_RING((box.x2 << R300_CLIPRECT_X_SHIFT) |
+                                        (box.y2 << R300_CLIPRECT_Y_SHIFT));
+                }
+
+                OUT_RING_REG( R300_RE_CLIPRECT_CNTL, r300_cliprect_cntl[nr-1] );
+
+                /* TODO/SECURITY: Force scissors to a safe value, otherwise the
+                * client might be able to trample over memory.
+                * The impact should be very limited, but I'd rather be safe than
+                * sorry.
+                */
+                OUT_RING( CP_PACKET0( R300_RE_SCISSORS_TL, 1 ) );
+                OUT_RING( 0 );
+                OUT_RING( R300_SCISSORS_X_MASK | R300_SCISSORS_Y_MASK );
+                ADVANCE_RING();
+                } else {
+                /* Why we allow zero cliprect rendering:
+                 * There are some commands in a command buffer that must be submitted
+                 * even when there are no cliprects, e.g. DMA buffer discard
+                 * or state setting (though state setting could be avoided by
+                 * simulating a loss of context).
+                 *
+                 * Now since the cmdbuf interface is so chaotic right now (and is
+                 * bound to remain that way for a bit until things settle down),
+                 * it is basically impossible to filter out the commands that are
+                 * necessary and those that aren't.
+                 *
+                 * So I choose the safe way and don't do any filtering at all;
+                 * instead, I simply set up the engine so that all rendering
+                 * can't produce any fragments.
+                 */
+                BEGIN_RING(2);
+                OUT_RING_REG( R300_RE_CLIPRECT_CNTL, 0 );
+                ADVANCE_RING();
+                }
+
+        return 0;
+}
+
+u8  r300_reg_flags[0x10000>>2];
+
+
+void r300_init_reg_flags(void)
+{
+        int i;
+        memset(r300_reg_flags, 0, 0x10000>>2);
+        #define ADD_RANGE_MARK(reg, count,mark) \
+                for(i=((reg)>>2);i<((reg)>>2)+(count);i++)\
+                        r300_reg_flags[i]|=(mark);
+        
+        #define MARK_SAFE               1
+        #define MARK_CHECK_OFFSET       2
+        
+        #define ADD_RANGE(reg, count)   ADD_RANGE_MARK(reg, count, MARK_SAFE)
+
+        /* these match cmducs() command in r300_driver/r300/r300_cmdbuf.c */
+        ADD_RANGE(R300_SE_VPORT_XSCALE, 6);
+        ADD_RANGE(0x2080, 1);
+        ADD_RANGE(R300_SE_VTE_CNTL, 2);
+        ADD_RANGE(0x2134, 2);
+        ADD_RANGE(0x2140, 1);
+        ADD_RANGE(R300_VAP_INPUT_CNTL_0, 2);
+        ADD_RANGE(0x21DC, 1);
+        ADD_RANGE(0x221C, 1);
+        ADD_RANGE(0x2220, 4);
+        ADD_RANGE(0x2288, 1);
+        ADD_RANGE(R300_VAP_OUTPUT_VTX_FMT_0, 2);
+        ADD_RANGE(R300_VAP_PVS_CNTL_1, 3);
+        ADD_RANGE(R300_GB_ENABLE, 1);
+        ADD_RANGE(R300_GB_MSPOS0, 5);
+        ADD_RANGE(R300_TX_ENABLE, 1);
+        ADD_RANGE(0x4200, 4);
+        ADD_RANGE(0x4214, 1);
+        ADD_RANGE(R300_RE_POINTSIZE, 1);
+        ADD_RANGE(0x4230, 3);
+        ADD_RANGE(R300_RE_LINE_CNT, 1);
+        ADD_RANGE(0x4238, 1);
+        ADD_RANGE(0x4260, 3);
+        ADD_RANGE(0x4274, 4);
+        ADD_RANGE(0x4288, 5);
+        ADD_RANGE(0x42A0, 1);
+        ADD_RANGE(R300_RE_ZBIAS_T_FACTOR, 4);
+        ADD_RANGE(0x42B4, 1);
+        ADD_RANGE(R300_RE_CULL_CNTL, 1);
+        ADD_RANGE(0x42C0, 2);
+        ADD_RANGE(R300_RS_CNTL_0, 2);
+        ADD_RANGE(R300_RS_INTERP_0, 8);
+        ADD_RANGE(R300_RS_ROUTE_0, 8);
+        ADD_RANGE(0x43A4, 2);
+        ADD_RANGE(0x43E8, 1);
+        ADD_RANGE(R300_PFS_CNTL_0, 3);
+        ADD_RANGE(R300_PFS_NODE_0, 4);
+        ADD_RANGE(R300_PFS_TEXI_0, 64);
+        ADD_RANGE(0x46A4, 5);
+        ADD_RANGE(R300_PFS_INSTR0_0, 64);
+        ADD_RANGE(R300_PFS_INSTR1_0, 64);
+        ADD_RANGE(R300_PFS_INSTR2_0, 64);
+        ADD_RANGE(R300_PFS_INSTR3_0, 64);
+        ADD_RANGE(0x4BC0, 1);
+        ADD_RANGE(0x4BC8, 3);
+        ADD_RANGE(R300_PP_ALPHA_TEST, 2);
+        ADD_RANGE(0x4BD8, 1);
+        ADD_RANGE(R300_PFS_PARAM_0_X, 64);
+        ADD_RANGE(0x4E00, 1);
+        ADD_RANGE(R300_RB3D_CBLEND, 2);
+        ADD_RANGE(R300_RB3D_COLORMASK, 1);
+        ADD_RANGE(0x4E10, 3);
+        ADD_RANGE_MARK(R300_RB3D_COLOROFFSET0, 1, MARK_CHECK_OFFSET); /* check offset */
+        ADD_RANGE(R300_RB3D_COLORPITCH0, 1);
+        ADD_RANGE(0x4E50, 9);
+        ADD_RANGE(0x4E88, 1);
+        ADD_RANGE(0x4EA0, 2);
+        ADD_RANGE(R300_RB3D_ZSTENCIL_CNTL_0, 3);
+        ADD_RANGE(0x4F10, 4);
+        ADD_RANGE_MARK(R300_RB3D_DEPTHOFFSET, 1, MARK_CHECK_OFFSET); /* check offset */
+        ADD_RANGE(R300_RB3D_DEPTHPITCH, 1); 
+        ADD_RANGE(0x4F28, 1);
+        ADD_RANGE(0x4F30, 2);
+        ADD_RANGE(0x4F44, 1);
+        ADD_RANGE(0x4F54, 1);
+
+        ADD_RANGE(R300_TX_FILTER_0, 16);
+        ADD_RANGE(R300_TX_UNK1_0, 16);
+        ADD_RANGE(R300_TX_SIZE_0, 16);
+        ADD_RANGE(R300_TX_FORMAT_0, 16);
+                /* Texture offset is dangerous and needs more checking */
+        ADD_RANGE_MARK(R300_TX_OFFSET_0, 16, MARK_CHECK_OFFSET);
+        ADD_RANGE(R300_TX_UNK4_0, 16);
+        ADD_RANGE(R300_TX_BORDER_COLOR_0, 16);
+
+        /* Sporadic registers used as primitives are emitted */
+        ADD_RANGE(0x4f18, 1);
+        ADD_RANGE(R300_RB3D_DSTCACHE_CTLSTAT, 1);
+        ADD_RANGE(R300_VAP_INPUT_ROUTE_0_0, 8);
+        ADD_RANGE(R300_VAP_INPUT_ROUTE_1_0, 8);
+
+}
+
+static __inline__ int r300_check_range(unsigned  reg, int count)
+{
+        int i;
+        if(reg & ~0xffff)return -1;
+        for(i=(reg>>2);i<(reg>>2)+count;i++)
+                if(r300_reg_flags[i]!=MARK_SAFE)return 1;
+        return 0;
+}
+
+  /* we expect offsets passed to the framebuffer to be either within video memory or
+      within AGP space */
+static __inline__ int r300_check_offset(drm_radeon_private_t* dev_priv, u32 offset)
+{
+        /* we realy want to check against end of video aperture
+                but this value is not being kept. 
+                This code is correct for now (does the same thing as the
+                code that sets MC_FB_LOCATION) in radeon_cp.c */
+        if((offset>=dev_priv->fb_location) && 
+                (offset<dev_priv->gart_vm_start))return 0;
+        if((offset>=dev_priv->gart_vm_start) &&
+                 (offset<dev_priv->gart_vm_start+dev_priv->gart_size))return 0;
+        return 1;
+}
+
+static __inline__ int r300_emit_carefully_checked_packet0(drm_radeon_private_t* dev_priv,
+                                                drm_radeon_cmd_buffer_t* cmdbuf,
+                                                drm_r300_cmd_header_t header)
+{
+        int reg;
+        int sz;
+        int i;
+        int values[64];
+        RING_LOCALS;
+
+        sz = header.packet0.count;
+        reg = (header.packet0.reghi << 8) | header.packet0.reglo;
+        
+        if((sz>64)||(sz<0)){
+                DRM_ERROR("Cannot emit more than 64 values at a time (reg=%04x sz=%d)\n", reg, sz);
+                return DRM_ERR(EINVAL);
+                }
+        for(i=0;i<sz;i++){
+                values[i]=((int __user*)cmdbuf->buf)[i];
+                switch(r300_reg_flags[(reg>>2)+i]){
+                case MARK_SAFE:
+                        break;
+                case MARK_CHECK_OFFSET:
+                        if(r300_check_offset(dev_priv, (u32)values[i])){
+                                DRM_ERROR("Offset failed range check (reg=%04x sz=%d)\n", reg, sz);
+                                return DRM_ERR(EINVAL);
+                                }
+                        break;
+                default:
+                        DRM_ERROR("Register %04x failed check as flag=%02x\n", reg+i*4, r300_reg_flags[(reg>>2)+i]);
+                        return DRM_ERR(EINVAL);
+                        }
+                }
+                
+        BEGIN_RING(1+sz);
+        OUT_RING( CP_PACKET0( reg, sz-1 ) );
+        OUT_RING_TABLE( values, sz );
+        ADVANCE_RING();
+
+        cmdbuf->buf += sz*4;
+        cmdbuf->bufsz -= sz*4;
+
+        return 0;
+}
+
+/**
+ * Emits a packet0 setting arbitrary registers.
+ * Called by r300_do_cp_cmdbuf.
+ *
+ * Note that checks are performed on contents and addresses of the registers
+ */
+static __inline__ int r300_emit_packet0(drm_radeon_private_t* dev_priv,
+                                                drm_radeon_cmd_buffer_t* cmdbuf,
+                                                drm_r300_cmd_header_t header)
+{
+        int reg;
+        int sz;
+        RING_LOCALS;
+
+        sz = header.packet0.count;
+        reg = (header.packet0.reghi << 8) | header.packet0.reglo;
+
+        if (!sz)
+                return 0;
+
+        if (sz*4 > cmdbuf->bufsz)
+                return DRM_ERR(EINVAL);
+                
+        if (reg+sz*4 >= 0x10000){
+                DRM_ERROR("No such registers in hardware reg=%04x sz=%d\n", reg, sz);
+                return DRM_ERR(EINVAL);
+                }
+
+        if(r300_check_range(reg, sz)){
+                /* go and check everything */
+                return r300_emit_carefully_checked_packet0(dev_priv, cmdbuf, header);
+                }
+        /* the rest of the data is safe to emit, whatever the values the user passed */
+
+        BEGIN_RING(1+sz);
+        OUT_RING( CP_PACKET0( reg, sz-1 ) );
+        OUT_RING_TABLE( (int __user*)cmdbuf->buf, sz );
+        ADVANCE_RING();
+
+        cmdbuf->buf += sz*4;
+        cmdbuf->bufsz -= sz*4;
+
+        return 0;
+}
+
+
+/**
+ * Uploads user-supplied vertex program instructions or parameters onto
+ * the graphics card.
+ * Called by r300_do_cp_cmdbuf.
+ */
+static __inline__ int r300_emit_vpu(drm_radeon_private_t* dev_priv,
+                                    drm_radeon_cmd_buffer_t* cmdbuf,
+                                    drm_r300_cmd_header_t header)
+{
+        int sz;
+        int addr;
+        RING_LOCALS;
+
+        sz = header.vpu.count;
+        addr = (header.vpu.adrhi << 8) | header.vpu.adrlo;
+
+        if (!sz)
+                return 0;
+        if (sz*16 > cmdbuf->bufsz)
+                return DRM_ERR(EINVAL);
+
+        BEGIN_RING(5+sz*4);
+        /* Wait for VAP to come to senses.. */
+        /* there is no need to emit it multiple times, (only once before VAP is programmed,
+           but this optimization is for later */
+        OUT_RING_REG( R300_VAP_PVS_WAITIDLE, 0 );
+        OUT_RING_REG( R300_VAP_PVS_UPLOAD_ADDRESS, addr );
+        OUT_RING( CP_PACKET0_TABLE( R300_VAP_PVS_UPLOAD_DATA, sz*4 - 1 ) );
+        OUT_RING_TABLE( (int __user*)cmdbuf->buf, sz*4 );
+
+        ADVANCE_RING();
+
+        cmdbuf->buf += sz*16;
+        cmdbuf->bufsz -= sz*16;
+
+        return 0;
+}
+
+
+/**
+ * Emit a clear packet from userspace.
+ * Called by r300_emit_packet3.
+ */
+static __inline__ int r300_emit_clear(drm_radeon_private_t* dev_priv,
+                                      drm_radeon_cmd_buffer_t* cmdbuf)
+{
+        RING_LOCALS;
+
+        if (8*4 > cmdbuf->bufsz)
+                return DRM_ERR(EINVAL);
+
+        BEGIN_RING(10);
+        OUT_RING( CP_PACKET3( R200_3D_DRAW_IMMD_2, 8 ) );
+        OUT_RING( R300_PRIM_TYPE_POINT|R300_PRIM_WALK_RING|
+                  (1<<R300_PRIM_NUM_VERTICES_SHIFT) );
+        OUT_RING_TABLE( (int __user*)cmdbuf->buf, 8 );
+        ADVANCE_RING();
+
+        cmdbuf->buf += 8*4;
+        cmdbuf->bufsz -= 8*4;
+
+        return 0;
+}
+
+static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t* dev_priv,
+                                      drm_radeon_cmd_buffer_t* cmdbuf,
+                                      u32 header)
+{
+        int count, i,k;
+        #define MAX_ARRAY_PACKET  64
+        u32 payload[MAX_ARRAY_PACKET];
+        u32 narrays;
+        RING_LOCALS;
+
+        count=(header>>16) & 0x3fff;
+        
+        if((count+1)>MAX_ARRAY_PACKET){
+                DRM_ERROR("Too large payload in 3D_LOAD_VBPNTR (count=%d)\n", count);
+                return DRM_ERR(EINVAL);
+                }
+        memset(payload, 0, MAX_ARRAY_PACKET*4);
+        memcpy(payload, cmdbuf->buf+4, (count+1)*4);    
+        
+        /* carefully check packet contents */
+        
+        narrays=payload[0];
+        k=0;
+        i=1;
+        while((k<narrays) && (i<(count+1))){
+                i++; /* skip attribute field */
+                if(r300_check_offset(dev_priv, payload[i])){
+                        DRM_ERROR("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n", k, i);
+                        return DRM_ERR(EINVAL);
+                        }
+                k++;
+                i++;
+                if(k==narrays)break;
+                /* have one more to process, they come in pairs */
+                if(r300_check_offset(dev_priv, payload[i])){
+                        DRM_ERROR("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n", k, i);
+                        return DRM_ERR(EINVAL);
+                        }
+                k++;
+                i++;                    
+                }
+        /* do the counts match what we expect ? */
+        if((k!=narrays) || (i!=(count+1))){
+                DRM_ERROR("Malformed 3D_LOAD_VBPNTR packet (k=%d i=%d narrays=%d count+1=%d).\n", k, i, narrays, count+1);
+                return DRM_ERR(EINVAL);
+                }
+
+        /* all clear, output packet */
+
+        BEGIN_RING(count+2);
+        OUT_RING(header);
+        OUT_RING_TABLE(payload, count+1);
+        ADVANCE_RING();
+
+        cmdbuf->buf += (count+2)*4;
+        cmdbuf->bufsz -= (count+2)*4;
+
+        return 0;
+}
+
+static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t* dev_priv,
+                                      drm_radeon_cmd_buffer_t* cmdbuf)
+{
+        u32 header;
+        int count;
+        RING_LOCALS;
+
+        if (4 > cmdbuf->bufsz)
+                return DRM_ERR(EINVAL);
+
+        /* Fixme !! This simply emits a packet without much checking.
+           We need to be smarter. */
+
+        /* obtain first word - actual packet3 header */
+        header = *(u32 __user*)cmdbuf->buf;
+
+        /* Is it packet 3 ? */
+        if( (header>>30)!=0x3 ) {
+                DRM_ERROR("Not a packet3 header (0x%08x)\n", header);
+                return DRM_ERR(EINVAL);
+                }
+
+        count=(header>>16) & 0x3fff;
+
+        /* Check again now that we know how much data to expect */
+        if ((count+2)*4 > cmdbuf->bufsz){
+                DRM_ERROR("Expected packet3 of length %d but have only %d bytes left\n",
+                        (count+2)*4, cmdbuf->bufsz);
+                return DRM_ERR(EINVAL);
+                }
+
+        /* Is it a packet type we know about ? */
+        switch(header & 0xff00){
+        case RADEON_3D_LOAD_VBPNTR: /* load vertex array pointers */
+                return r300_emit_3d_load_vbpntr(dev_priv, cmdbuf, header);
+
+        case RADEON_CP_3D_DRAW_IMMD_2: /* triggers drawing using in-packet vertex data */
+        case RADEON_CP_3D_DRAW_VBUF_2: /* triggers drawing of vertex buffers setup elsewhere */
+        case RADEON_CP_3D_DRAW_INDX_2: /* triggers drawing using indices to vertex buffer */
+        case RADEON_CP_INDX_BUFFER: /* DRAW_INDX_2 without INDX_BUFFER seems to lock up the gpu */
+        case RADEON_WAIT_FOR_IDLE:
+        case RADEON_CP_NOP:
+                /* these packets are safe */
+                break;
+        default:
+                DRM_ERROR("Unknown packet3 header (0x%08x)\n", header);
+                return DRM_ERR(EINVAL);
+                }
+
+
+        BEGIN_RING(count+2);
+        OUT_RING(header);
+        OUT_RING_TABLE( (int __user*)(cmdbuf->buf+4), count+1);
+        ADVANCE_RING();
+
+        cmdbuf->buf += (count+2)*4;
+        cmdbuf->bufsz -= (count+2)*4;
+
+        return 0;
+}
+
+
+/**
+ * Emit a rendering packet3 from userspace.
+ * Called by r300_do_cp_cmdbuf.
+ */
+static __inline__ int r300_emit_packet3(drm_radeon_private_t* dev_priv,
+                                        drm_radeon_cmd_buffer_t* cmdbuf,
+                                        drm_r300_cmd_header_t header)
+{
+        int n;
+        int ret;
+        char __user* orig_buf = cmdbuf->buf;
+        int orig_bufsz = cmdbuf->bufsz;
+
+        /* This is a do-while-loop so that we run the interior at least once,
+         * even if cmdbuf->nbox is 0. Compare r300_emit_cliprects for rationale.
+         */
+        n = 0;
+        do {
+                if (cmdbuf->nbox > R300_SIMULTANEOUS_CLIPRECTS) {
+                        ret = r300_emit_cliprects(dev_priv, cmdbuf, n);
+                        if (ret)
+                                return ret;
+
+                        cmdbuf->buf = orig_buf;
+                        cmdbuf->bufsz = orig_bufsz;
+                        }
+
+                switch(header.packet3.packet) {
+                case R300_CMD_PACKET3_CLEAR:
+                        DRM_DEBUG("R300_CMD_PACKET3_CLEAR\n");
+                        ret = r300_emit_clear(dev_priv, cmdbuf);
+                        if (ret) {
+                                DRM_ERROR("r300_emit_clear failed\n");
+                                return ret;
+                                }
+                        break;
+
+                case R300_CMD_PACKET3_RAW:
+                        DRM_DEBUG("R300_CMD_PACKET3_RAW\n");
+                        ret = r300_emit_raw_packet3(dev_priv, cmdbuf);
+                        if (ret) {
+                                DRM_ERROR("r300_emit_raw_packet3 failed\n");
+                                return ret;
+                                }
+                        break;
+
+                default:
+                        DRM_ERROR("bad packet3 type %i at %p\n",
+                                header.packet3.packet,
+                                cmdbuf->buf - sizeof(header));
+                        return DRM_ERR(EINVAL);
+                        }
+
+                n += R300_SIMULTANEOUS_CLIPRECTS;
+        } while(n < cmdbuf->nbox);
+
+        return 0;
+}
+
+/* Some of the R300 chips seem to be extremely touchy about the two registers
+ * that are configured in r300_pacify.
+ * Among the worst offenders seems to be the R300 ND (0x4E44): When userspace
+ * sends a command buffer that contains only state setting commands and a
+ * vertex program/parameter upload sequence, this will eventually lead to a
+ * lockup, unless the sequence is bracketed by calls to r300_pacify.
+ * So we should take great care to *always* call r300_pacify before
+ * *anything* 3D related, and again afterwards. This is what the
+ * call bracket in r300_do_cp_cmdbuf is for.
+ */
+
+/**
+ * Emit the sequence to pacify R300.
+ */
+static __inline__ void r300_pacify(drm_radeon_private_t* dev_priv)
+{
+        RING_LOCALS;
+
+        BEGIN_RING(6);
+        OUT_RING( CP_PACKET0( R300_RB3D_DSTCACHE_CTLSTAT, 0 ) );
+        OUT_RING( 0xa );
+        OUT_RING( CP_PACKET0( 0x4f18, 0 ) );
+        OUT_RING( 0x3 );
+        OUT_RING( CP_PACKET3( RADEON_CP_NOP, 0 ) );
+        OUT_RING( 0x0 );
+        ADVANCE_RING();
+}
+
+
+/**
+ * Called by r300_do_cp_cmdbuf to update the internal buffer age and state.
+ * The actual age emit is done by r300_do_cp_cmdbuf, which is why you must
+ * be careful about how this function is called.
+ */
+static void r300_discard_buffer(drm_device_t * dev, drm_buf_t * buf)
+{
+        drm_radeon_private_t *dev_priv = dev->dev_private;
+        drm_radeon_buf_priv_t *buf_priv = buf->dev_private;
+
+        buf_priv->age = ++dev_priv->sarea_priv->last_dispatch;
+        buf->pending = 1;
+        buf->used = 0;
+}
+
+
+/**
+ * Parses and validates a user-supplied command buffer and emits appropriate
+ * commands on the DMA ring buffer.
+ * Called by the ioctl handler function radeon_cp_cmdbuf.
+ */
+int r300_do_cp_cmdbuf(drm_device_t* dev,
+                          DRMFILE filp,
+                      drm_file_t* filp_priv,
+                      drm_radeon_cmd_buffer_t* cmdbuf)
+{
+        drm_radeon_private_t *dev_priv = dev->dev_private;
+        drm_device_dma_t *dma = dev->dma;
+        drm_buf_t *buf = NULL;
+        int emit_dispatch_age = 0;
+        int ret = 0;
+
+        DRM_DEBUG("\n");
+
+        /* See the comment above r300_emit_begin3d for why this call must be here,
+         * and what the cleanup gotos are for. */
+        r300_pacify(dev_priv);
+
+        if (cmdbuf->nbox <= R300_SIMULTANEOUS_CLIPRECTS) {
+                ret = r300_emit_cliprects(dev_priv, cmdbuf, 0);
+                if (ret)
+                        goto cleanup;
+                }
+
+        while(cmdbuf->bufsz >= sizeof(drm_r300_cmd_header_t)) {
+                int idx;
+                drm_r300_cmd_header_t header;
+
+                header.u = *(unsigned int *)cmdbuf->buf;
+
+                cmdbuf->buf += sizeof(header);
+                cmdbuf->bufsz -= sizeof(header);
+
+                switch(header.header.cmd_type) {
+                case R300_CMD_PACKET0: 
+                        DRM_DEBUG("R300_CMD_PACKET0\n");
+                        ret = r300_emit_packet0(dev_priv, cmdbuf, header);
+                        if (ret) {
+                                DRM_ERROR("r300_emit_packet0 failed\n");
+                                goto cleanup;
+                                }
+                        break;
+
+                case R300_CMD_VPU:
+                        DRM_DEBUG("R300_CMD_VPU\n");
+                        ret = r300_emit_vpu(dev_priv, cmdbuf, header);
+                        if (ret) {
+                                DRM_ERROR("r300_emit_vpu failed\n");
+                                goto cleanup;
+                                }
+                        break;
+
+                case R300_CMD_PACKET3:
+                        DRM_DEBUG("R300_CMD_PACKET3\n");
+                        ret = r300_emit_packet3(dev_priv, cmdbuf, header);
+                        if (ret) {
+                                DRM_ERROR("r300_emit_packet3 failed\n");
+                                goto cleanup;
+                                }
+                        break;
+
+                case R300_CMD_END3D:
+                        DRM_DEBUG("R300_CMD_END3D\n");
+                        /* TODO: 
+                                Ideally userspace driver should not need to issue this call, 
+                                i.e. the drm driver should issue it automatically and prevent
+                                lockups.
+                                
+                                In practice, we do not understand why this call is needed and what
+                                it does (except for some vague guesses that it has to do with cache
+                                coherence) and so the user space driver does it. 
+                                
+                                Once we are sure which uses prevent lockups the code could be moved
+                                into the kernel and the userspace driver will not
+                                need to use this command.
+
+                                Note that issuing this command does not hurt anything
+                                except, possibly, performance */
+                        r300_pacify(dev_priv);
+                        break;
+
+                case R300_CMD_CP_DELAY:
+                        /* simple enough, we can do it here */
+                        DRM_DEBUG("R300_CMD_CP_DELAY\n");
+                        {
+                                int i;
+                                RING_LOCALS;
+
+                                BEGIN_RING(header.delay.count);
+                                for(i=0;i<header.delay.count;i++)
+                                        OUT_RING(RADEON_CP_PACKET2);
+                                ADVANCE_RING();
+                        }
+                        break;
+
+                case R300_CMD_DMA_DISCARD:
+                        DRM_DEBUG("RADEON_CMD_DMA_DISCARD\n");
+                        idx = header.dma.buf_idx;
+                        if (idx < 0 || idx >= dma->buf_count) {
+                                DRM_ERROR("buffer index %d (of %d max)\n",
+                                        idx, dma->buf_count - 1);
+                                ret = DRM_ERR(EINVAL);
+                                goto cleanup;
+                                }
+
+                        buf = dma->buflist[idx];
+                        if (buf->filp != filp || buf->pending) {
+                                DRM_ERROR("bad buffer %p %p %d\n",
+                                buf->filp, filp, buf->pending);
+                                ret = DRM_ERR(EINVAL);
+                                goto cleanup;
+                                }
+
+                        emit_dispatch_age = 1;
+                        r300_discard_buffer(dev, buf);
+                        break;
+
+                case R300_CMD_WAIT:
+                        /* simple enough, we can do it here */
+                        DRM_DEBUG("R300_CMD_WAIT\n");
+                        if(header.wait.flags==0)break; /* nothing to do */
+
+                        {
+                                RING_LOCALS;
+
+                                BEGIN_RING(2);
+                                OUT_RING( CP_PACKET0( RADEON_WAIT_UNTIL, 0 ) );
+                                OUT_RING( (header.wait.flags & 0xf)<<14 );
+                                ADVANCE_RING();
+                        }
+                        break;
+
+                default:
+                        DRM_ERROR("bad cmd_type %i at %p\n",
+                                  header.header.cmd_type,
+                                  cmdbuf->buf - sizeof(header));
+                        ret = DRM_ERR(EINVAL);
+                        goto cleanup;
+                        }
+        }
+
+        DRM_DEBUG("END\n");
+
+cleanup:
+        r300_pacify(dev_priv);
+
+        /* We emit the vertex buffer age here, outside the pacifier "brackets"
+         * for two reasons:
+         *  (1) This may coalesce multiple age emissions into a single one and
+         *  (2) more importantly, some chips lock up hard when scratch registers
+         *      are written inside the pacifier bracket.
+         */
+        if (emit_dispatch_age) {
+                RING_LOCALS;
+
+                /* Emit the vertex buffer age */
+                BEGIN_RING(2);
+                RADEON_DISPATCH_AGE(dev_priv->sarea_priv->last_dispatch);
+                ADVANCE_RING();
+                }
+
+        COMMIT_RING();
+
+        return ret;
+}
+
diff --git a/drivers/char/drm/r300_reg.h b/drivers/char/drm/r300_reg.h
new file mode 100644
index 000000000000..c3e7ca3dbe3d
--- /dev/null
+++ b/drivers/char/drm/r300_reg.h
@@ -0,0 +1,1412 @@
+/**************************************************************************
+
+Copyright (C) 2004-2005 Nicolai Haehnle et al.
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of this software and associated documentation files (the "Software"),
+to deal in the Software without restriction, including without limitation
+on the rights to use, copy, modify, merge, publish, distribute, sub
+license, and/or sell copies of the Software, and to permit persons to whom
+the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice (including the next
+paragraph) shall be included in all copies or substantial portions of the
+Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+THE AUTHOR(S) AND/OR THEIR SUPPLIERS BE LIABLE FOR ANY CLAIM,
+DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+**************************************************************************/
+
+#ifndef _R300_REG_H
+#define _R300_REG_H
+
+#define R300_MC_INIT_MISC_LAT_TIMER     0x180
+#       define R300_MC_MISC__MC_CPR_INIT_LAT_SHIFT      0
+#       define R300_MC_MISC__MC_VF_INIT_LAT_SHIFT       4
+#       define R300_MC_MISC__MC_DISP0R_INIT_LAT_SHIFT   8
+#       define R300_MC_MISC__MC_DISP1R_INIT_LAT_SHIFT   12
+#       define R300_MC_MISC__MC_FIXED_INIT_LAT_SHIFT    16
+#       define R300_MC_MISC__MC_E2R_INIT_LAT_SHIFT      20
+#       define R300_MC_MISC__MC_SAME_PAGE_PRIO_SHIFT    24
+#       define R300_MC_MISC__MC_GLOBW_INIT_LAT_SHIFT    28
+
+
+#define R300_MC_INIT_GFX_LAT_TIMER      0x154
+#       define R300_MC_MISC__MC_G3D0R_INIT_LAT_SHIFT    0
+#       define R300_MC_MISC__MC_G3D1R_INIT_LAT_SHIFT    4
+#       define R300_MC_MISC__MC_G3D2R_INIT_LAT_SHIFT    8
+#       define R300_MC_MISC__MC_G3D3R_INIT_LAT_SHIFT    12
+#       define R300_MC_MISC__MC_TX0R_INIT_LAT_SHIFT     16
+#       define R300_MC_MISC__MC_TX1R_INIT_LAT_SHIFT     20
+#       define R300_MC_MISC__MC_GLOBR_INIT_LAT_SHIFT    24
+#       define R300_MC_MISC__MC_GLOBW_FULL_LAT_SHIFT    28
+
+/*
+This file contains registers and constants for the R300. They have been
+found mostly by examining command buffers captured using glxtest, as well
+as by extrapolating some known registers and constants from the R200.
+
+I am fairly certain that they are correct unless stated otherwise in comments.
+*/
+
+#define R300_SE_VPORT_XSCALE                0x1D98
+#define R300_SE_VPORT_XOFFSET               0x1D9C
+#define R300_SE_VPORT_YSCALE                0x1DA0
+#define R300_SE_VPORT_YOFFSET               0x1DA4
+#define R300_SE_VPORT_ZSCALE                0x1DA8
+#define R300_SE_VPORT_ZOFFSET               0x1DAC
+
+
+/* This register is written directly and also starts data section in many 3d CP_PACKET3's */
+#define R300_VAP_VF_CNTL        0x2084
+
+#       define  R300_VAP_VF_CNTL__PRIM_TYPE__SHIFT                       0
+#       define  R300_VAP_VF_CNTL__PRIM_NONE                              (0<<0)
+#       define  R300_VAP_VF_CNTL__PRIM_POINTS                            (1<<0)
+#       define  R300_VAP_VF_CNTL__PRIM_LINES                             (2<<0)
+#       define  R300_VAP_VF_CNTL__PRIM_LINE_STRIP                        (3<<0)
+#       define  R300_VAP_VF_CNTL__PRIM_TRIANGLES                         (4<<0)
+#       define  R300_VAP_VF_CNTL__PRIM_TRIANGLE_FAN                      (5<<0)
+#       define  R300_VAP_VF_CNTL__PRIM_TRIANGLE_STRIP                    (6<<0)
+#       define  R300_VAP_VF_CNTL__PRIM_LINE_LOOP                         (12<<0)
+#       define  R300_VAP_VF_CNTL__PRIM_QUADS                             (13<<0)
+#       define  R300_VAP_VF_CNTL__PRIM_QUAD_STRIP                        (14<<0)
+#       define  R300_VAP_VF_CNTL__PRIM_POLYGON                           (15<<0)
+
+#       define  R300_VAP_VF_CNTL__PRIM_WALK__SHIFT                       4
+        /* State based - direct writes to registers trigger vertex generation */
+#       define  R300_VAP_VF_CNTL__PRIM_WALK_STATE_BASED                      (0<<4)
+#       define  R300_VAP_VF_CNTL__PRIM_WALK_INDICES                          (1<<4)
+#       define  R300_VAP_VF_CNTL__PRIM_WALK_VERTEX_LIST                      (2<<4)
+#       define  R300_VAP_VF_CNTL__PRIM_WALK_VERTEX_EMBEDDED                  (3<<4)
+
+                /* I don't think I saw these three used.. */
+#       define  R300_VAP_VF_CNTL__COLOR_ORDER__SHIFT                     6
+#       define  R300_VAP_VF_CNTL__TCL_OUTPUT_CTL_ENA__SHIFT              9
+#       define  R300_VAP_VF_CNTL__PROG_STREAM_ENA__SHIFT                 10
+
+                /* index size - when not set the indices are assumed to be 16 bit */
+#       define  R300_VAP_VF_CNTL__INDEX_SIZE_32bit                      (1<<11)
+                /* number of vertices */
+#       define  R300_VAP_VF_CNTL__NUM_VERTICES__SHIFT                    16
+
+/* BEGIN: Wild guesses */
+#define R300_VAP_OUTPUT_VTX_FMT_0           0x2090
+#       define R300_VAP_OUTPUT_VTX_FMT_0__POS_PRESENT     (1<<0)
+#       define R300_VAP_OUTPUT_VTX_FMT_0__COLOR_PRESENT   (1<<1)
+#       define R300_VAP_OUTPUT_VTX_FMT_0__COLOR_1_PRESENT (1<<2) /* GUESS */
+#       define R300_VAP_OUTPUT_VTX_FMT_0__COLOR_2_PRESENT (1<<3) /* GUESS */
+#       define R300_VAP_OUTPUT_VTX_FMT_0__COLOR_3_PRESENT (1<<4) /* GUESS */
+#       define R300_VAP_OUTPUT_VTX_FMT_0__PT_SIZE_PRESENT (1<<16) /* GUESS */
+
+#define R300_VAP_OUTPUT_VTX_FMT_1           0x2094
+#       define R300_VAP_OUTPUT_VTX_FMT_1__TEX_0_COMP_CNT_SHIFT 0
+#       define R300_VAP_OUTPUT_VTX_FMT_1__TEX_1_COMP_CNT_SHIFT 3
+#       define R300_VAP_OUTPUT_VTX_FMT_1__TEX_2_COMP_CNT_SHIFT 6
+#       define R300_VAP_OUTPUT_VTX_FMT_1__TEX_3_COMP_CNT_SHIFT 9
+#       define R300_VAP_OUTPUT_VTX_FMT_1__TEX_4_COMP_CNT_SHIFT 12
+#       define R300_VAP_OUTPUT_VTX_FMT_1__TEX_5_COMP_CNT_SHIFT 15
+#       define R300_VAP_OUTPUT_VTX_FMT_1__TEX_6_COMP_CNT_SHIFT 18
+#       define R300_VAP_OUTPUT_VTX_FMT_1__TEX_7_COMP_CNT_SHIFT 21
+/* END */
+
+#define R300_SE_VTE_CNTL                  0x20b0
+#       define     R300_VPORT_X_SCALE_ENA                0x00000001
+#       define     R300_VPORT_X_OFFSET_ENA               0x00000002
+#       define     R300_VPORT_Y_SCALE_ENA                0x00000004
+#       define     R300_VPORT_Y_OFFSET_ENA               0x00000008
+#       define     R300_VPORT_Z_SCALE_ENA                0x00000010
+#       define     R300_VPORT_Z_OFFSET_ENA               0x00000020
+#       define     R300_VTX_XY_FMT                       0x00000100
+#       define     R300_VTX_Z_FMT                        0x00000200
+#       define     R300_VTX_W0_FMT                       0x00000400
+#       define     R300_VTX_W0_NORMALIZE                 0x00000800
+#       define     R300_VTX_ST_DENORMALIZED              0x00001000
+
+/* BEGIN: Vertex data assembly - lots of uncertainties */
+/* gap */
+/* Where do we get our vertex data?
+//
+// Vertex data either comes either from immediate mode registers or from
+// vertex arrays.
+// There appears to be no mixed mode (though we can force the pitch of
+// vertex arrays to 0, effectively reusing the same element over and over
+// again).
+//
+// Immediate mode is controlled by the INPUT_CNTL registers. I am not sure
+// if these registers influence vertex array processing.
+//
+// Vertex arrays are controlled via the 3D_LOAD_VBPNTR packet3.
+//
+// In both cases, vertex attributes are then passed through INPUT_ROUTE.
+
+// Beginning with INPUT_ROUTE_0_0 is a list of WORDs that route vertex data
+// into the vertex processor's input registers.
+// The first word routes the first input, the second word the second, etc.
+// The corresponding input is routed into the register with the given index.
+// The list is ended by a word with INPUT_ROUTE_END set.
+//
+// Always set COMPONENTS_4 in immediate mode. */
+
+#define R300_VAP_INPUT_ROUTE_0_0            0x2150
+#       define R300_INPUT_ROUTE_COMPONENTS_1     (0 << 0)
+#       define R300_INPUT_ROUTE_COMPONENTS_2     (1 << 0)
+#       define R300_INPUT_ROUTE_COMPONENTS_3     (2 << 0)
+#       define R300_INPUT_ROUTE_COMPONENTS_4     (3 << 0)
+#       define R300_INPUT_ROUTE_COMPONENTS_RGBA  (4 << 0) /* GUESS */
+#       define R300_VAP_INPUT_ROUTE_IDX_SHIFT    8
+#       define R300_VAP_INPUT_ROUTE_IDX_MASK     (31 << 8) /* GUESS */
+#       define R300_VAP_INPUT_ROUTE_END          (1 << 13)
+#       define R300_INPUT_ROUTE_IMMEDIATE_MODE   (0 << 14) /* GUESS */
+#       define R300_INPUT_ROUTE_FLOAT            (1 << 14) /* GUESS */
+#       define R300_INPUT_ROUTE_UNSIGNED_BYTE    (2 << 14) /* GUESS */
+#       define R300_INPUT_ROUTE_FLOAT_COLOR      (3 << 14) /* GUESS */
+#define R300_VAP_INPUT_ROUTE_0_1            0x2154
+#define R300_VAP_INPUT_ROUTE_0_2            0x2158
+#define R300_VAP_INPUT_ROUTE_0_3            0x215C
+#define R300_VAP_INPUT_ROUTE_0_4            0x2160
+#define R300_VAP_INPUT_ROUTE_0_5            0x2164
+#define R300_VAP_INPUT_ROUTE_0_6            0x2168
+#define R300_VAP_INPUT_ROUTE_0_7            0x216C
+
+/* gap */
+/* Notes:
+//  - always set up to produce at least two attributes:
+//    if vertex program uses only position, fglrx will set normal, too
+//  - INPUT_CNTL_0_COLOR and INPUT_CNTL_COLOR bits are always equal */
+#define R300_VAP_INPUT_CNTL_0               0x2180
+#       define R300_INPUT_CNTL_0_COLOR           0x00000001
+#define R300_VAP_INPUT_CNTL_1               0x2184
+#       define R300_INPUT_CNTL_POS               0x00000001
+#       define R300_INPUT_CNTL_NORMAL            0x00000002
+#       define R300_INPUT_CNTL_COLOR             0x00000004
+#       define R300_INPUT_CNTL_TC0               0x00000400
+#       define R300_INPUT_CNTL_TC1               0x00000800
+#       define R300_INPUT_CNTL_TC2               0x00001000 /* GUESS */
+#       define R300_INPUT_CNTL_TC3               0x00002000 /* GUESS */
+#       define R300_INPUT_CNTL_TC4               0x00004000 /* GUESS */
+#       define R300_INPUT_CNTL_TC5               0x00008000 /* GUESS */
+#       define R300_INPUT_CNTL_TC6               0x00010000 /* GUESS */
+#       define R300_INPUT_CNTL_TC7               0x00020000 /* GUESS */
+
+/* gap */
+/* Words parallel to INPUT_ROUTE_0; All words that are active in INPUT_ROUTE_0
+// are set to a swizzling bit pattern, other words are 0.
+//
+// In immediate mode, the pattern is always set to xyzw. In vertex array
+// mode, the swizzling pattern is e.g. used to set zw components in texture
+// coordinates with only tweo components. */
+#define R300_VAP_INPUT_ROUTE_1_0            0x21E0
+#       define R300_INPUT_ROUTE_SELECT_X    0
+#       define R300_INPUT_ROUTE_SELECT_Y    1
+#       define R300_INPUT_ROUTE_SELECT_Z    2
+#       define R300_INPUT_ROUTE_SELECT_W    3
+#       define R300_INPUT_ROUTE_SELECT_ZERO 4
+#       define R300_INPUT_ROUTE_SELECT_ONE  5
+#       define R300_INPUT_ROUTE_SELECT_MASK 7
+#       define R300_INPUT_ROUTE_X_SHIFT          0
+#       define R300_INPUT_ROUTE_Y_SHIFT          3
+#       define R300_INPUT_ROUTE_Z_SHIFT          6
+#       define R300_INPUT_ROUTE_W_SHIFT          9
+#       define R300_INPUT_ROUTE_ENABLE           (15 << 12)
+#define R300_VAP_INPUT_ROUTE_1_1            0x21E4
+#define R300_VAP_INPUT_ROUTE_1_2            0x21E8
+#define R300_VAP_INPUT_ROUTE_1_3            0x21EC
+#define R300_VAP_INPUT_ROUTE_1_4            0x21F0
+#define R300_VAP_INPUT_ROUTE_1_5            0x21F4
+#define R300_VAP_INPUT_ROUTE_1_6            0x21F8
+#define R300_VAP_INPUT_ROUTE_1_7            0x21FC
+
+/* END */
+
+/* gap */
+/* BEGIN: Upload vertex program and data
+// The programmable vertex shader unit has a memory bank of unknown size
+// that can be written to in 16 byte units by writing the address into
+// UPLOAD_ADDRESS, followed by data in UPLOAD_DATA (multiples of 4 DWORDs).
+//
+// Pointers into the memory bank are always in multiples of 16 bytes.
+//
+// The memory bank is divided into areas with fixed meaning.
+//
+// Starting at address UPLOAD_PROGRAM: Vertex program instructions.
+// Native limits reported by drivers from ATI suggest size 256 (i.e. 4KB),
+// whereas the difference between known addresses suggests size 512.
+//
+// Starting at address UPLOAD_PARAMETERS: Vertex program parameters.
+// Native reported limits and the VPI layout suggest size 256, whereas
+// difference between known addresses suggests size 512.
+//
+// At address UPLOAD_POINTSIZE is a vector (0, 0, ps, 0), where ps is the
+// floating point pointsize. The exact purpose of this state is uncertain,
+// as there is also the R300_RE_POINTSIZE register.
+//
+// Multiple vertex programs and parameter sets can be loaded at once,
+// which could explain the size discrepancy. */
+#define R300_VAP_PVS_UPLOAD_ADDRESS         0x2200
+#       define R300_PVS_UPLOAD_PROGRAM           0x00000000
+#       define R300_PVS_UPLOAD_PARAMETERS        0x00000200
+#       define R300_PVS_UPLOAD_POINTSIZE         0x00000406
+/* gap */
+#define R300_VAP_PVS_UPLOAD_DATA            0x2208
+/* END */
+
+/* gap */
+/* I do not know the purpose of this register. However, I do know that
+// it is set to 221C_CLEAR for clear operations and to 221C_NORMAL
+// for normal rendering. */
+#define R300_VAP_UNKNOWN_221C               0x221C
+#       define R300_221C_NORMAL                  0x00000000
+#       define R300_221C_CLEAR                   0x0001C000
+
+/* gap */
+/* Sometimes, END_OF_PKT and 0x2284=0 are the only commands sent between
+// rendering commands and overwriting vertex program parameters.
+// Therefore, I suspect writing zero to 0x2284 synchronizes the engine and
+// avoids bugs caused by still running shaders reading bad data from memory. */
+#define R300_VAP_PVS_WAITIDLE               0x2284 /* GUESS */
+
+/* Absolutely no clue what this register is about. */
+#define R300_VAP_UNKNOWN_2288               0x2288
+#       define R300_2288_R300                    0x00750000 /* -- nh */
+#       define R300_2288_RV350                   0x0000FFFF /* -- Vladimir */
+
+/* gap */
+/* Addresses are relative to the vertex program instruction area of the
+// memory bank. PROGRAM_END points to the last instruction of the active
+// program
+//
+// The meaning of the two UNKNOWN fields is obviously not known. However,
+// experiments so far have shown that both *must* point to an instruction
+// inside the vertex program, otherwise the GPU locks up.
+// fglrx usually sets CNTL_3_UNKNOWN to the end of the program and
+// CNTL_1_UNKNOWN points to instruction where last write to position takes place. 
+// Most likely this is used to ignore rest of the program in cases where group of verts arent visible.
+// For some reason this "section" is sometimes accepted other instruction that have
+// no relationship with position calculations. 
+*/
+#define R300_VAP_PVS_CNTL_1                 0x22D0
+#       define R300_PVS_CNTL_1_PROGRAM_START_SHIFT   0
+#       define R300_PVS_CNTL_1_POS_END_SHIFT         10
+#       define R300_PVS_CNTL_1_PROGRAM_END_SHIFT     20
+/* Addresses are relative the the vertex program parameters area. */
+#define R300_VAP_PVS_CNTL_2                 0x22D4
+#       define R300_PVS_CNTL_2_PARAM_OFFSET_SHIFT 0
+#       define R300_PVS_CNTL_2_PARAM_COUNT_SHIFT  16
+#define R300_VAP_PVS_CNTL_3                0x22D8
+#       define R300_PVS_CNTL_3_PROGRAM_UNKNOWN_SHIFT 10
+#       define R300_PVS_CNTL_3_PROGRAM_UNKNOWN2_SHIFT 0
+
+/* The entire range from 0x2300 to 0x2AC inclusive seems to be used for
+// immediate vertices */
+#define R300_VAP_VTX_COLOR_R                0x2464
+#define R300_VAP_VTX_COLOR_G                0x2468
+#define R300_VAP_VTX_COLOR_B                0x246C
+#define R300_VAP_VTX_POS_0_X_1              0x2490 /* used for glVertex2*() */
+#define R300_VAP_VTX_POS_0_Y_1              0x2494
+#define R300_VAP_VTX_COLOR_PKD              0x249C /* RGBA */
+#define R300_VAP_VTX_POS_0_X_2              0x24A0 /* used for glVertex3*() */
+#define R300_VAP_VTX_POS_0_Y_2              0x24A4
+#define R300_VAP_VTX_POS_0_Z_2              0x24A8
+#define R300_VAP_VTX_END_OF_PKT             0x24AC /* write 0 to indicate end of packet? */
+
+/* gap */
+
+/* These are values from r300_reg/r300_reg.h - they are known to be correct
+   and are here so we can use one register file instead of several
+   - Vladimir */
+#define R300_GB_VAP_RASTER_VTX_FMT_0    0x4000
+#       define R300_GB_VAP_RASTER_VTX_FMT_0__POS_PRESENT        (1<<0)
+#       define R300_GB_VAP_RASTER_VTX_FMT_0__COLOR_0_PRESENT    (1<<1)
+#       define R300_GB_VAP_RASTER_VTX_FMT_0__COLOR_1_PRESENT    (1<<2)
+#       define R300_GB_VAP_RASTER_VTX_FMT_0__COLOR_2_PRESENT    (1<<3)
+#       define R300_GB_VAP_RASTER_VTX_FMT_0__COLOR_3_PRESENT    (1<<4)
+#       define R300_GB_VAP_RASTER_VTX_FMT_0__COLOR_SPACE        (0xf<<5)
+#       define R300_GB_VAP_RASTER_VTX_FMT_0__PT_SIZE_PRESENT    (0x1<<16)
+
+#define R300_GB_VAP_RASTER_VTX_FMT_1    0x4004
+        /* each of the following is 3 bits wide, specifies number
+           of components */
+#       define R300_GB_VAP_RASTER_VTX_FMT_1__TEX_0_COMP_CNT_SHIFT       0
+#       define R300_GB_VAP_RASTER_VTX_FMT_1__TEX_1_COMP_CNT_SHIFT       3
+#       define R300_GB_VAP_RASTER_VTX_FMT_1__TEX_2_COMP_CNT_SHIFT       6
+#       define R300_GB_VAP_RASTER_VTX_FMT_1__TEX_3_COMP_CNT_SHIFT       9
+#       define R300_GB_VAP_RASTER_VTX_FMT_1__TEX_4_COMP_CNT_SHIFT       12
+#       define R300_GB_VAP_RASTER_VTX_FMT_1__TEX_5_COMP_CNT_SHIFT       15
+#       define R300_GB_VAP_RASTER_VTX_FMT_1__TEX_6_COMP_CNT_SHIFT       18
+#       define R300_GB_VAP_RASTER_VTX_FMT_1__TEX_7_COMP_CNT_SHIFT       21
+
+/* UNK30 seems to enables point to quad transformation on textures
+   (or something closely related to that).
+   This bit is rather fatal at the time being due to lackings at pixel shader side */
+#define R300_GB_ENABLE  0x4008
+#       define R300_GB_POINT_STUFF_ENABLE       (1<<0)
+#       define R300_GB_LINE_STUFF_ENABLE        (1<<1)
+#       define R300_GB_TRIANGLE_STUFF_ENABLE    (1<<2)
+#       define R300_GB_STENCIL_AUTO_ENABLE      (1<<4)
+#       define R300_GB_UNK30                    (1<<30)
+        /* each of the following is 2 bits wide */
+#define R300_GB_TEX_REPLICATE   0
+#define R300_GB_TEX_ST          1
+#define R300_GB_TEX_STR         2
+#       define R300_GB_TEX0_SOURCE_SHIFT        16
+#       define R300_GB_TEX1_SOURCE_SHIFT        18
+#       define R300_GB_TEX2_SOURCE_SHIFT        20
+#       define R300_GB_TEX3_SOURCE_SHIFT        22
+#       define R300_GB_TEX4_SOURCE_SHIFT        24
+#       define R300_GB_TEX5_SOURCE_SHIFT        26
+#       define R300_GB_TEX6_SOURCE_SHIFT        28
+#       define R300_GB_TEX7_SOURCE_SHIFT        30
+
+/* MSPOS - positions for multisample antialiasing (?) */
+#define R300_GB_MSPOS0  0x4010
+        /* shifts - each of the fields is 4 bits */
+#       define R300_GB_MSPOS0__MS_X0_SHIFT      0
+#       define R300_GB_MSPOS0__MS_Y0_SHIFT      4
+#       define R300_GB_MSPOS0__MS_X1_SHIFT      8
+#       define R300_GB_MSPOS0__MS_Y1_SHIFT      12
+#       define R300_GB_MSPOS0__MS_X2_SHIFT      16
+#       define R300_GB_MSPOS0__MS_Y2_SHIFT      20
+#       define R300_GB_MSPOS0__MSBD0_Y          24
+#       define R300_GB_MSPOS0__MSBD0_X          28
+
+#define R300_GB_MSPOS1  0x4014
+#       define R300_GB_MSPOS1__MS_X3_SHIFT      0
+#       define R300_GB_MSPOS1__MS_Y3_SHIFT      4
+#       define R300_GB_MSPOS1__MS_X4_SHIFT      8
+#       define R300_GB_MSPOS1__MS_Y4_SHIFT      12
+#       define R300_GB_MSPOS1__MS_X5_SHIFT      16
+#       define R300_GB_MSPOS1__MS_Y5_SHIFT      20
+#       define R300_GB_MSPOS1__MSBD1            24
+
+
+#define R300_GB_TILE_CONFIG     0x4018
+#       define R300_GB_TILE_ENABLE      (1<<0)
+#       define R300_GB_TILE_PIPE_COUNT_RV300    0
+#       define R300_GB_TILE_PIPE_COUNT_R300     (3<<1)
+#       define R300_GB_TILE_PIPE_COUNT_R420     (7<<1)
+#       define R300_GB_TILE_SIZE_8              0
+#       define R300_GB_TILE_SIZE_16             (1<<4)
+#       define R300_GB_TILE_SIZE_32             (2<<4)
+#       define R300_GB_SUPER_SIZE_1             (0<<6)
+#       define R300_GB_SUPER_SIZE_2             (1<<6)
+#       define R300_GB_SUPER_SIZE_4             (2<<6)
+#       define R300_GB_SUPER_SIZE_8             (3<<6)
+#       define R300_GB_SUPER_SIZE_16            (4<<6)
+#       define R300_GB_SUPER_SIZE_32            (5<<6)
+#       define R300_GB_SUPER_SIZE_64            (6<<6)
+#       define R300_GB_SUPER_SIZE_128           (7<<6)
+#       define R300_GB_SUPER_X_SHIFT            9       /* 3 bits wide */
+#       define R300_GB_SUPER_Y_SHIFT            12      /* 3 bits wide */
+#       define R300_GB_SUPER_TILE_A             0
+#       define R300_GB_SUPER_TILE_B             (1<<15)
+#       define R300_GB_SUBPIXEL_1_12            0
+#       define R300_GB_SUBPIXEL_1_16            (1<<16)
+
+#define R300_GB_FIFO_SIZE       0x4024
+        /* each of the following is 2 bits wide */
+#define R300_GB_FIFO_SIZE_32    0
+#define R300_GB_FIFO_SIZE_64    1
+#define R300_GB_FIFO_SIZE_128   2
+#define R300_GB_FIFO_SIZE_256   3
+#       define R300_SC_IFIFO_SIZE_SHIFT 0
+#       define R300_SC_TZFIFO_SIZE_SHIFT        2
+#       define R300_SC_BFIFO_SIZE_SHIFT 4
+
+#       define R300_US_OFIFO_SIZE_SHIFT 12
+#       define R300_US_WFIFO_SIZE_SHIFT 14
+        /* the following use the same constants as above, but meaning is
+           is times 2 (i.e. instead of 32 words it means 64 */
+#       define R300_RS_TFIFO_SIZE_SHIFT 6
+#       define R300_RS_CFIFO_SIZE_SHIFT 8
+#       define R300_US_RAM_SIZE_SHIFT           10
+        /* watermarks, 3 bits wide */
+#       define R300_RS_HIGHWATER_COL_SHIFT      16
+#       define R300_RS_HIGHWATER_TEX_SHIFT      19
+#       define R300_OFIFO_HIGHWATER_SHIFT       22      /* two bits only */
+#       define R300_CUBE_FIFO_HIGHWATER_COL_SHIFT       24
+
+#define R300_GB_SELECT  0x401C
+#       define R300_GB_FOG_SELECT_C0A           0
+#       define R300_GB_FOG_SELECT_C1A           1
+#       define R300_GB_FOG_SELECT_C2A           2
+#       define R300_GB_FOG_SELECT_C3A           3
+#       define R300_GB_FOG_SELECT_1_1_W 4
+#       define R300_GB_FOG_SELECT_Z             5
+#       define R300_GB_DEPTH_SELECT_Z           0
+#       define R300_GB_DEPTH_SELECT_1_1_W       (1<<3)
+#       define R300_GB_W_SELECT_1_W             0
+#       define R300_GB_W_SELECT_1               (1<<4)
+
+#define R300_GB_AA_CONFIG               0x4020
+#       define R300_AA_ENABLE                   0x01
+#       define R300_AA_SUBSAMPLES_2             0
+#       define R300_AA_SUBSAMPLES_3             (1<<1)
+#       define R300_AA_SUBSAMPLES_4             (2<<1)
+#       define R300_AA_SUBSAMPLES_6             (3<<1)
+
+/* END */
+
+/* gap */
+/* The upper enable bits are guessed, based on fglrx reported limits. */
+#define R300_TX_ENABLE                      0x4104
+#       define R300_TX_ENABLE_0                  (1 << 0)
+#       define R300_TX_ENABLE_1                  (1 << 1)
+#       define R300_TX_ENABLE_2                  (1 << 2)
+#       define R300_TX_ENABLE_3                  (1 << 3)
+#       define R300_TX_ENABLE_4                  (1 << 4)
+#       define R300_TX_ENABLE_5                  (1 << 5)
+#       define R300_TX_ENABLE_6                  (1 << 6)
+#       define R300_TX_ENABLE_7                  (1 << 7)
+#       define R300_TX_ENABLE_8                  (1 << 8)
+#       define R300_TX_ENABLE_9                  (1 << 9)
+#       define R300_TX_ENABLE_10                 (1 << 10)
+#       define R300_TX_ENABLE_11                 (1 << 11)
+#       define R300_TX_ENABLE_12                 (1 << 12)
+#       define R300_TX_ENABLE_13                 (1 << 13)
+#       define R300_TX_ENABLE_14                 (1 << 14)
+#       define R300_TX_ENABLE_15                 (1 << 15)
+
+/* The pointsize is given in multiples of 6. The pointsize can be
+// enormous: Clear() renders a single point that fills the entire
+// framebuffer. */
+#define R300_RE_POINTSIZE                   0x421C
+#       define R300_POINTSIZE_Y_SHIFT            0
+#       define R300_POINTSIZE_Y_MASK             (0xFFFF << 0) /* GUESS */
+#       define R300_POINTSIZE_X_SHIFT            16
+#       define R300_POINTSIZE_X_MASK             (0xFFFF << 16) /* GUESS */
+#       define R300_POINTSIZE_MAX             (R300_POINTSIZE_Y_MASK / 6)
+
+/* The line width is given in multiples of 6.
+   In default mode lines are classified as vertical lines.
+   HO: horizontal
+   VE: vertical or horizontal
+   HO & VE: no classification
+*/
+#define R300_RE_LINE_CNT                      0x4234
+#       define R300_LINESIZE_SHIFT            0
+#       define R300_LINESIZE_MASK             (0xFFFF << 0) /* GUESS */
+#       define R300_LINESIZE_MAX             (R300_LINESIZE_MASK / 6)
+#       define R300_LINE_CNT_HO               (1 << 16)
+#       define R300_LINE_CNT_VE               (1 << 17)
+
+/* Some sort of scale or clamp value for texcoordless textures. */
+#define R300_RE_UNK4238                       0x4238
+
+#define R300_RE_SHADE_MODEL                   0x4278
+#       define R300_RE_SHADE_MODEL_SMOOTH     0x3aaaa
+#       define R300_RE_SHADE_MODEL_FLAT       0x39595
+
+/* Dangerous */
+#define R300_RE_POLYGON_MODE                  0x4288
+#       define R300_PM_ENABLED                (1 << 0)
+#       define R300_PM_FRONT_POINT            (0 << 0)
+#       define R300_PM_BACK_POINT             (0 << 0)
+#       define R300_PM_FRONT_LINE             (1 << 4)
+#       define R300_PM_FRONT_FILL             (1 << 5)
+#       define R300_PM_BACK_LINE              (1 << 7)
+#       define R300_PM_BACK_FILL              (1 << 8)
+
+/* Not sure why there are duplicate of factor and constant values. 
+   My best guess so far is that there are seperate zbiases for test and write. 
+   Ordering might be wrong.
+   Some of the tests indicate that fgl has a fallback implementation of zbias
+   via pixel shaders. */
+#define R300_RE_ZBIAS_T_FACTOR                0x42A4
+#define R300_RE_ZBIAS_T_CONSTANT              0x42A8
+#define R300_RE_ZBIAS_W_FACTOR                0x42AC
+#define R300_RE_ZBIAS_W_CONSTANT              0x42B0
+
+/* This register needs to be set to (1<<1) for RV350 to correctly
+   perform depth test (see --vb-triangles in r300_demo)
+   Don't know about other chips. - Vladimir
+   This is set to 3 when GL_POLYGON_OFFSET_FILL is on.
+   My guess is that there are two bits for each zbias primitive (FILL, LINE, POINT).
+   One to enable depth test and one for depth write.
+   Yet this doesnt explain why depth writes work ...
+    */
+#define R300_RE_OCCLUSION_CNTL              0x42B4
+#       define R300_OCCLUSION_ON                (1<<1)
+
+#define R300_RE_CULL_CNTL                   0x42B8
+#       define R300_CULL_FRONT                   (1 << 0)
+#       define R300_CULL_BACK                    (1 << 1)
+#       define R300_FRONT_FACE_CCW               (0 << 2)
+#       define R300_FRONT_FACE_CW                (1 << 2)
+
+
+/* BEGIN: Rasterization / Interpolators - many guesses
+// 0_UNKNOWN_18 has always been set except for clear operations.
+// TC_CNT is the number of incoming texture coordinate sets (i.e. it depends
+// on the vertex program, *not* the fragment program) */
+#define R300_RS_CNTL_0                      0x4300
+#       define R300_RS_CNTL_TC_CNT_SHIFT         2
+#       define R300_RS_CNTL_TC_CNT_MASK          (7 << 2)
+#               define R300_RS_CNTL_CI_CNT_SHIFT         7 /* number of color interpolators used */
+#       define R300_RS_CNTL_0_UNKNOWN_18         (1 << 18)
+/* Guess: RS_CNTL_1 holds the index of the highest used RS_ROUTE_n register. */
+#define R300_RS_CNTL_1                      0x4304
+
+/* gap */
+/* Only used for texture coordinates.
+// Use the source field to route texture coordinate input from the vertex program
+// to the desired interpolator. Note that the source field is relative to the
+// outputs the vertex program *actually* writes. If a vertex program only writes
+// texcoord[1], this will be source index 0.
+// Set INTERP_USED on all interpolators that produce data used by the
+// fragment program. INTERP_USED looks like a swizzling mask, but
+// I haven't seen it used that way.
+//
+// Note: The _UNKNOWN constants are always set in their respective register.
+// I don't know if this is necessary. */
+#define R300_RS_INTERP_0                    0x4310
+#define R300_RS_INTERP_1                    0x4314
+#       define R300_RS_INTERP_1_UNKNOWN          0x40
+#define R300_RS_INTERP_2                    0x4318
+#       define R300_RS_INTERP_2_UNKNOWN          0x80
+#define R300_RS_INTERP_3                    0x431C
+#       define R300_RS_INTERP_3_UNKNOWN          0xC0
+#define R300_RS_INTERP_4                    0x4320
+#define R300_RS_INTERP_5                    0x4324
+#define R300_RS_INTERP_6                    0x4328
+#define R300_RS_INTERP_7                    0x432C
+#       define R300_RS_INTERP_SRC_SHIFT          2
+#       define R300_RS_INTERP_SRC_MASK           (7 << 2)
+#       define R300_RS_INTERP_USED               0x00D10000
+
+/* These DWORDs control how vertex data is routed into fragment program
+// registers, after interpolators. */
+#define R300_RS_ROUTE_0                     0x4330
+#define R300_RS_ROUTE_1                     0x4334
+#define R300_RS_ROUTE_2                     0x4338
+#define R300_RS_ROUTE_3                     0x433C /* GUESS */
+#define R300_RS_ROUTE_4                     0x4340 /* GUESS */
+#define R300_RS_ROUTE_5                     0x4344 /* GUESS */
+#define R300_RS_ROUTE_6                     0x4348 /* GUESS */
+#define R300_RS_ROUTE_7                     0x434C /* GUESS */
+#       define R300_RS_ROUTE_SOURCE_INTERP_0     0
+#       define R300_RS_ROUTE_SOURCE_INTERP_1     1
+#       define R300_RS_ROUTE_SOURCE_INTERP_2     2
+#       define R300_RS_ROUTE_SOURCE_INTERP_3     3
+#       define R300_RS_ROUTE_SOURCE_INTERP_4     4
+#       define R300_RS_ROUTE_SOURCE_INTERP_5     5 /* GUESS */
+#       define R300_RS_ROUTE_SOURCE_INTERP_6     6 /* GUESS */
+#       define R300_RS_ROUTE_SOURCE_INTERP_7     7 /* GUESS */
+#       define R300_RS_ROUTE_ENABLE              (1 << 3) /* GUESS */
+#       define R300_RS_ROUTE_DEST_SHIFT          6
+#       define R300_RS_ROUTE_DEST_MASK           (31 << 6) /* GUESS */
+
+/* Special handling for color: When the fragment program uses color,
+// the ROUTE_0_COLOR bit is set and ROUTE_0_COLOR_DEST contains the
+// color register index. */
+#       define R300_RS_ROUTE_0_COLOR             (1 << 14)
+#       define R300_RS_ROUTE_0_COLOR_DEST_SHIFT  17
+#       define R300_RS_ROUTE_0_COLOR_DEST_MASK   (31 << 17) /* GUESS */
+/* As above, but for secondary color */
+#               define R300_RS_ROUTE_1_COLOR1            (1 << 14)
+#               define R300_RS_ROUTE_1_COLOR1_DEST_SHIFT 17
+#               define R300_RS_ROUTE_1_COLOR1_DEST_MASK  (31 << 17)
+#               define R300_RS_ROUTE_1_UNKNOWN11         (1 << 11)
+/* END */
+
+/* BEGIN: Scissors and cliprects
+// There are four clipping rectangles. Their corner coordinates are inclusive.
+// Every pixel is assigned a number from 0 and 15 by setting bits 0-3 depending
+// on whether the pixel is inside cliprects 0-3, respectively. For example,
+// if a pixel is inside cliprects 0 and 1, but outside 2 and 3, it is assigned
+// the number 3 (binary 0011).
+// Iff the bit corresponding to the pixel's number in RE_CLIPRECT_CNTL is set,
+// the pixel is rasterized.
+//
+// In addition to this, there is a scissors rectangle. Only pixels inside the
+// scissors rectangle are drawn. (coordinates are inclusive)
+//
+// For some reason, the top-left corner of the framebuffer is at (1440, 1440)
+// for the purpose of clipping and scissors. */
+#define R300_RE_CLIPRECT_TL_0               0x43B0
+#define R300_RE_CLIPRECT_BR_0               0x43B4
+#define R300_RE_CLIPRECT_TL_1               0x43B8
+#define R300_RE_CLIPRECT_BR_1               0x43BC
+#define R300_RE_CLIPRECT_TL_2               0x43C0
+#define R300_RE_CLIPRECT_BR_2               0x43C4
+#define R300_RE_CLIPRECT_TL_3               0x43C8
+#define R300_RE_CLIPRECT_BR_3               0x43CC
+#       define R300_CLIPRECT_OFFSET              1440
+#       define R300_CLIPRECT_MASK                0x1FFF
+#       define R300_CLIPRECT_X_SHIFT             0
+#       define R300_CLIPRECT_X_MASK              (0x1FFF << 0)
+#       define R300_CLIPRECT_Y_SHIFT             13
+#       define R300_CLIPRECT_Y_MASK              (0x1FFF << 13)
+#define R300_RE_CLIPRECT_CNTL               0x43D0
+#       define R300_CLIP_OUT                     (1 << 0)
+#       define R300_CLIP_0                       (1 << 1)
+#       define R300_CLIP_1                       (1 << 2)
+#       define R300_CLIP_10                      (1 << 3)
+#       define R300_CLIP_2                       (1 << 4)
+#       define R300_CLIP_20                      (1 << 5)
+#       define R300_CLIP_21                      (1 << 6)
+#       define R300_CLIP_210                     (1 << 7)
+#       define R300_CLIP_3                       (1 << 8)
+#       define R300_CLIP_30                      (1 << 9)
+#       define R300_CLIP_31                      (1 << 10)
+#       define R300_CLIP_310                     (1 << 11)
+#       define R300_CLIP_32                      (1 << 12)
+#       define R300_CLIP_320                     (1 << 13)
+#       define R300_CLIP_321                     (1 << 14)
+#       define R300_CLIP_3210                    (1 << 15)
+
+/* gap */
+#define R300_RE_SCISSORS_TL                 0x43E0
+#define R300_RE_SCISSORS_BR                 0x43E4
+#       define R300_SCISSORS_OFFSET              1440
+#       define R300_SCISSORS_X_SHIFT             0
+#       define R300_SCISSORS_X_MASK              (0x1FFF << 0)
+#       define R300_SCISSORS_Y_SHIFT             13
+#       define R300_SCISSORS_Y_MASK              (0x1FFF << 13)
+/* END */
+
+/* BEGIN: Texture specification
+// The texture specification dwords are grouped by meaning and not by texture unit.
+// This means that e.g. the offset for texture image unit N is found in register
+// TX_OFFSET_0 + (4*N) */
+#define R300_TX_FILTER_0                    0x4400
+#       define R300_TX_REPEAT                    0
+#       define R300_TX_MIRRORED                  1
+#       define R300_TX_CLAMP                     4
+#       define R300_TX_CLAMP_TO_EDGE             2
+#       define R300_TX_CLAMP_TO_BORDER           6
+#       define R300_TX_WRAP_S_SHIFT              0
+#       define R300_TX_WRAP_S_MASK               (7 << 0)
+#       define R300_TX_WRAP_T_SHIFT              3
+#       define R300_TX_WRAP_T_MASK               (7 << 3)
+#       define R300_TX_WRAP_Q_SHIFT              6
+#       define R300_TX_WRAP_Q_MASK               (7 << 6)
+#       define R300_TX_MAG_FILTER_NEAREST        (1 << 9)
+#       define R300_TX_MAG_FILTER_LINEAR         (2 << 9)
+#       define R300_TX_MAG_FILTER_MASK           (3 << 9)
+#       define R300_TX_MIN_FILTER_NEAREST        (1 << 11)
+#       define R300_TX_MIN_FILTER_LINEAR         (2 << 11)
+#       define R300_TX_MIN_FILTER_NEAREST_MIP_NEAREST       (5  <<  11)
+#       define R300_TX_MIN_FILTER_NEAREST_MIP_LINEAR        (9  <<  11)
+#       define R300_TX_MIN_FILTER_LINEAR_MIP_NEAREST        (6  <<  11)
+#       define R300_TX_MIN_FILTER_LINEAR_MIP_LINEAR         (10 <<  11)
+
+/* NOTE: NEAREST doesnt seem to exist.
+   Im not seting MAG_FILTER_MASK and (3 << 11) on for all
+   anisotropy modes because that would void selected mag filter */
+#       define R300_TX_MIN_FILTER_ANISO_NEAREST             ((0 << 13) /*|R300_TX_MAG_FILTER_MASK|(3<<11)*/)
+#       define R300_TX_MIN_FILTER_ANISO_LINEAR              ((0 << 13) /*|R300_TX_MAG_FILTER_MASK|(3<<11)*/)
+#       define R300_TX_MIN_FILTER_ANISO_NEAREST_MIP_NEAREST ((1 << 13) /*|R300_TX_MAG_FILTER_MASK|(3<<11)*/)
+#       define R300_TX_MIN_FILTER_ANISO_NEAREST_MIP_LINEAR  ((2 << 13) /*|R300_TX_MAG_FILTER_MASK|(3<<11)*/)
+#       define R300_TX_MIN_FILTER_MASK           ( (15 << 11) | (3 << 13) )
+#       define R300_TX_MAX_ANISO_1_TO_1  (0 << 21)
+#       define R300_TX_MAX_ANISO_2_TO_1  (2 << 21)
+#       define R300_TX_MAX_ANISO_4_TO_1  (4 << 21)
+#       define R300_TX_MAX_ANISO_8_TO_1  (6 << 21)
+#       define R300_TX_MAX_ANISO_16_TO_1 (8 << 21)
+#       define R300_TX_MAX_ANISO_MASK    (14 << 21)
+
+#define R300_TX_UNK1_0                      0x4440
+#       define R300_LOD_BIAS_MASK           0x1fff
+
+#define R300_TX_SIZE_0                      0x4480
+#       define R300_TX_WIDTHMASK_SHIFT           0
+#       define R300_TX_WIDTHMASK_MASK            (2047 << 0)
+#       define R300_TX_HEIGHTMASK_SHIFT          11
+#       define R300_TX_HEIGHTMASK_MASK           (2047 << 11)
+#       define R300_TX_UNK23                     (1 << 23)
+#       define R300_TX_SIZE_SHIFT                26 /* largest of width, height */
+#       define R300_TX_SIZE_MASK                 (15 << 26)
+#define R300_TX_FORMAT_0                    0x44C0
+        /* The interpretation of the format word by Wladimir van der Laan */
+        /* The X, Y, Z and W refer to the layout of the components.
+           They are given meanings as R, G, B and Alpha by the swizzle
+           specification */
+#       define R300_TX_FORMAT_X8                    0x0
+#       define R300_TX_FORMAT_X16                   0x1
+#       define R300_TX_FORMAT_Y4X4                  0x2
+#       define R300_TX_FORMAT_Y8X8                  0x3
+#       define R300_TX_FORMAT_Y16X16                0x4
+#       define R300_TX_FORMAT_Z3Y3X2                0x5
+#       define R300_TX_FORMAT_Z5Y6X5                0x6
+#       define R300_TX_FORMAT_Z6Y5X5                0x7
+#       define R300_TX_FORMAT_Z11Y11X10             0x8
+#       define R300_TX_FORMAT_Z10Y11X11             0x9
+#       define R300_TX_FORMAT_W4Z4Y4X4              0xA
+#       define R300_TX_FORMAT_W1Z5Y5X5              0xB
+#       define R300_TX_FORMAT_W8Z8Y8X8              0xC
+#       define R300_TX_FORMAT_W2Z10Y10X10           0xD
+#       define R300_TX_FORMAT_W16Z16Y16X16          0xE
+#       define R300_TX_FORMAT_DXT1                  0xF
+#       define R300_TX_FORMAT_DXT3                  0x10
+#       define R300_TX_FORMAT_DXT5                  0x11
+#       define R300_TX_FORMAT_D3DMFT_CxV8U8         0x12     /* no swizzle */
+#       define R300_TX_FORMAT_A8R8G8B8              0x13     /* no swizzle */
+#       define R300_TX_FORMAT_B8G8_B8G8             0x14     /* no swizzle */
+#       define R300_TX_FORMAT_G8R8_G8B8             0x15     /* no swizzle */
+                                                  /* 0x16 - some 16 bit green format.. ?? */
+#       define R300_TX_FORMAT_UNK25                (1 << 25) /* no swizzle */
+
+        /* gap */
+        /* Floating point formats */
+        /* Note - hardware supports both 16 and 32 bit floating point */
+#       define R300_TX_FORMAT_FL_I16                0x18
+#       define R300_TX_FORMAT_FL_I16A16             0x19
+#       define R300_TX_FORMAT_FL_R16G16B16A16       0x1A
+#       define R300_TX_FORMAT_FL_I32                0x1B
+#       define R300_TX_FORMAT_FL_I32A32             0x1C
+#       define R300_TX_FORMAT_FL_R32G32B32A32       0x1D
+        /* alpha modes, convenience mostly */
+        /* if you have alpha, pick constant appropriate to the
+           number of channels (1 for I8, 2 for I8A8, 4 for R8G8B8A8, etc */
+#       define R300_TX_FORMAT_ALPHA_1CH             0x000
+#       define R300_TX_FORMAT_ALPHA_2CH             0x200
+#       define R300_TX_FORMAT_ALPHA_4CH             0x600
+#       define R300_TX_FORMAT_ALPHA_NONE            0xA00
+        /* Swizzling */
+        /* constants */
+#       define R300_TX_FORMAT_X         0
+#       define R300_TX_FORMAT_Y         1
+#       define R300_TX_FORMAT_Z         2
+#       define R300_TX_FORMAT_W         3
+#       define R300_TX_FORMAT_ZERO      4
+#       define R300_TX_FORMAT_ONE       5
+#       define R300_TX_FORMAT_CUT_Z     6               /* 2.0*Z, everything above 1.0 is set to 0.0 */
+#       define R300_TX_FORMAT_CUT_W     7               /* 2.0*W, everything above 1.0 is set to 0.0 */
+
+#       define R300_TX_FORMAT_B_SHIFT   18
+#       define R300_TX_FORMAT_G_SHIFT   15
+#       define R300_TX_FORMAT_R_SHIFT   12
+#       define R300_TX_FORMAT_A_SHIFT   9
+        /* Convenience macro to take care of layout and swizzling */
+#       define R300_EASY_TX_FORMAT(B, G, R, A, FMT)     (\
+          ((R300_TX_FORMAT_##B)<<R300_TX_FORMAT_B_SHIFT) \
+        | ((R300_TX_FORMAT_##G)<<R300_TX_FORMAT_G_SHIFT) \
+        | ((R300_TX_FORMAT_##R)<<R300_TX_FORMAT_R_SHIFT) \
+        | ((R300_TX_FORMAT_##A)<<R300_TX_FORMAT_A_SHIFT) \
+        | (R300_TX_FORMAT_##FMT) \
+          )
+        /* These can be ORed with result of R300_EASY_TX_FORMAT() */
+        /* We don't really know what they do. Take values from a constant color ? */
+#       define R300_TX_FORMAT_CONST_X           (1<<5)
+#       define R300_TX_FORMAT_CONST_Y           (2<<5)
+#       define R300_TX_FORMAT_CONST_Z           (4<<5)
+#       define R300_TX_FORMAT_CONST_W           (8<<5)
+
+#       define R300_TX_FORMAT_YUV_MODE          0x00800000
+
+#define R300_TX_OFFSET_0                    0x4540
+/* BEGIN: Guess from R200 */
+#       define R300_TXO_ENDIAN_NO_SWAP           (0 << 0)
+#       define R300_TXO_ENDIAN_BYTE_SWAP         (1 << 0)
+#       define R300_TXO_ENDIAN_WORD_SWAP         (2 << 0)
+#       define R300_TXO_ENDIAN_HALFDW_SWAP       (3 << 0)
+#       define R300_TXO_OFFSET_MASK              0xffffffe0
+#       define R300_TXO_OFFSET_SHIFT             5
+/* END */
+#define R300_TX_UNK4_0                      0x4580
+#define R300_TX_BORDER_COLOR_0              0x45C0 //ff00ff00 == { 0, 1.0, 0, 1.0 }
+
+/* END */
+
+/* BEGIN: Fragment program instruction set
+// Fragment programs are written directly into register space.
+// There are separate instruction streams for texture instructions and ALU
+// instructions.
+// In order to synchronize these streams, the program is divided into up
+// to 4 nodes. Each node begins with a number of TEX operations, followed
+// by a number of ALU operations.
+// The first node can have zero TEX ops, all subsequent nodes must have at least
+// one TEX ops.
+// All nodes must have at least one ALU op.
+//
+// The index of the last node is stored in PFS_CNTL_0: A value of 0 means
+// 1 node, a value of 3 means 4 nodes.
+// The total amount of instructions is defined in PFS_CNTL_2. The offsets are
+// offsets into the respective instruction streams, while *_END points to the
+// last instruction relative to this offset. */
+#define R300_PFS_CNTL_0                     0x4600
+#       define R300_PFS_CNTL_LAST_NODES_SHIFT    0
+#       define R300_PFS_CNTL_LAST_NODES_MASK     (3 << 0)
+#       define R300_PFS_CNTL_FIRST_NODE_HAS_TEX  (1 << 3)
+#define R300_PFS_CNTL_1                     0x4604
+/* There is an unshifted value here which has so far always been equal to the
+// index of the highest used temporary register. */
+#define R300_PFS_CNTL_2                     0x4608
+#       define R300_PFS_CNTL_ALU_OFFSET_SHIFT    0
+#       define R300_PFS_CNTL_ALU_OFFSET_MASK     (63 << 0)
+#       define R300_PFS_CNTL_ALU_END_SHIFT       6
+#       define R300_PFS_CNTL_ALU_END_MASK        (63 << 0)
+#       define R300_PFS_CNTL_TEX_OFFSET_SHIFT    12
+#       define R300_PFS_CNTL_TEX_OFFSET_MASK     (31 << 12) /* GUESS */
+#       define R300_PFS_CNTL_TEX_END_SHIFT       18
+#       define R300_PFS_CNTL_TEX_END_MASK        (31 << 18) /* GUESS */
+
+/* gap */
+/* Nodes are stored backwards. The last active node is always stored in
+// PFS_NODE_3.
+// Example: In a 2-node program, NODE_0 and NODE_1 are set to 0. The
+// first node is stored in NODE_2, the second node is stored in NODE_3.
+//
+// Offsets are relative to the master offset from PFS_CNTL_2.
+// LAST_NODE is set for the last node, and only for the last node. */
+#define R300_PFS_NODE_0                     0x4610
+#define R300_PFS_NODE_1                     0x4614
+#define R300_PFS_NODE_2                     0x4618
+#define R300_PFS_NODE_3                     0x461C
+#       define R300_PFS_NODE_ALU_OFFSET_SHIFT    0
+#       define R300_PFS_NODE_ALU_OFFSET_MASK     (63 << 0)
+#       define R300_PFS_NODE_ALU_END_SHIFT       6
+#       define R300_PFS_NODE_ALU_END_MASK        (63 << 6)
+#       define R300_PFS_NODE_TEX_OFFSET_SHIFT    12
+#       define R300_PFS_NODE_TEX_OFFSET_MASK     (31 << 12)
+#       define R300_PFS_NODE_TEX_END_SHIFT       17
+#       define R300_PFS_NODE_TEX_END_MASK        (31 << 17)
+#       define R300_PFS_NODE_LAST_NODE           (1 << 22)
+
+/* TEX
+// As far as I can tell, texture instructions cannot write into output
+// registers directly. A subsequent ALU instruction is always necessary,
+// even if it's just MAD o0, r0, 1, 0 */
+#define R300_PFS_TEXI_0                     0x4620
+#       define R300_FPITX_SRC_SHIFT              0
+#       define R300_FPITX_SRC_MASK               (31 << 0)
+#       define R300_FPITX_SRC_CONST              (1 << 5) /* GUESS */
+#       define R300_FPITX_DST_SHIFT              6
+#       define R300_FPITX_DST_MASK               (31 << 6)
+#       define R300_FPITX_IMAGE_SHIFT            11
+#       define R300_FPITX_IMAGE_MASK             (15 << 11) /* GUESS based on layout and native limits */
+/* Unsure if these are opcodes, or some kind of bitfield, but this is how
+ * they were set when I checked
+ */
+#               define R300_FPITX_OPCODE_SHIFT                  15
+#                       define R300_FPITX_OP_TEX                        1
+#                       define R300_FPITX_OP_TXP                        3
+#                       define R300_FPITX_OP_TXB                        4
+
+/* ALU
+// The ALU instructions register blocks are enumerated according to the order
+// in which fglrx. I assume there is space for 64 instructions, since
+// each block has space for a maximum of 64 DWORDs, and this matches reported
+// native limits.
+//
+// The basic functional block seems to be one MAD for each color and alpha,
+// and an adder that adds all components after the MUL.
+//  - ADD, MUL, MAD etc.: use MAD with appropriate neutral operands
+//  - DP4: Use OUTC_DP4, OUTA_DP4
+//  - DP3: Use OUTC_DP3, OUTA_DP4, appropriate alpha operands
+//  - DPH: Use OUTC_DP4, OUTA_DP4, appropriate alpha operands
+//  - CMP: If ARG2 < 0, return ARG1, else return ARG0
+//  - FLR: use FRC+MAD
+//  - XPD: use MAD+MAD
+//  - SGE, SLT: use MAD+CMP
+//  - RSQ: use ABS modifier for argument
+//  - Use OUTC_REPL_ALPHA to write results of an alpha-only operation (e.g. RCP)
+//    into color register
+//  - apparently, there's no quick DST operation
+//  - fglrx set FPI2_UNKNOWN_31 on a "MAD fragment.color, tmp0, tmp1, tmp2"
+//  - fglrx set FPI2_UNKNOWN_31 on a "MAX r2, r1, c0"
+//  - fglrx once set FPI0_UNKNOWN_31 on a "FRC r1, r1"
+//
+// Operand selection
+// First stage selects three sources from the available registers and
+// constant parameters. This is defined in INSTR1 (color) and INSTR3 (alpha).
+// fglrx sorts the three source fields: Registers before constants,
+// lower indices before higher indices; I do not know whether this is necessary.
+// fglrx fills unused sources with "read constant 0"
+// According to specs, you cannot select more than two different constants.
+//
+// Second stage selects the operands from the sources. This is defined in
+// INSTR0 (color) and INSTR2 (alpha). You can also select the special constants
+// zero and one.
+// Swizzling and negation happens in this stage, as well.
+//
+// Important: Color and alpha seem to be mostly separate, i.e. their sources
+// selection appears to be fully independent (the register storage is probably
+// physically split into a color and an alpha section).
+// However (because of the apparent physical split), there is some interaction
+// WRT swizzling. If, for example, you want to load an R component into an
+// Alpha operand, this R component is taken from a *color* source, not from
+// an alpha source. The corresponding register doesn't even have to appear in
+// the alpha sources list. (I hope this alll makes sense to you)
+//
+// Destination selection
+// The destination register index is in FPI1 (color) and FPI3 (alpha) together
+// with enable bits.
+// There are separate enable bits for writing into temporary registers
+// (DSTC_REG_* /DSTA_REG) and and program output registers (DSTC_OUTPUT_* /DSTA_OUTPUT).
+// You can write to both at once, or not write at all (the same index
+// must be used for both).
+//
+// Note: There is a special form for LRP
+//  - Argument order is the same as in ARB_fragment_program.
+//  - Operation is MAD
+//  - ARG1 is set to ARGC_SRC1C_LRP/ARGC_SRC1A_LRP
+//  - Set FPI0/FPI2_SPECIAL_LRP
+// Arbitrary LRP (including support for swizzling) requires vanilla MAD+MAD */
+#define R300_PFS_INSTR1_0                   0x46C0
+#       define R300_FPI1_SRC0C_SHIFT             0
+#       define R300_FPI1_SRC0C_MASK              (31 << 0)
+#       define R300_FPI1_SRC0C_CONST             (1 << 5)
+#       define R300_FPI1_SRC1C_SHIFT             6
+#       define R300_FPI1_SRC1C_MASK              (31 << 6)
+#       define R300_FPI1_SRC1C_CONST             (1 << 11)
+#       define R300_FPI1_SRC2C_SHIFT             12
+#       define R300_FPI1_SRC2C_MASK              (31 << 12)
+#       define R300_FPI1_SRC2C_CONST             (1 << 17)
+#       define R300_FPI1_DSTC_SHIFT              18
+#       define R300_FPI1_DSTC_MASK               (31 << 18)
+#       define R300_FPI1_DSTC_REG_X              (1 << 23)
+#       define R300_FPI1_DSTC_REG_Y              (1 << 24)
+#       define R300_FPI1_DSTC_REG_Z              (1 << 25)
+#       define R300_FPI1_DSTC_OUTPUT_X           (1 << 26)
+#       define R300_FPI1_DSTC_OUTPUT_Y           (1 << 27)
+#       define R300_FPI1_DSTC_OUTPUT_Z           (1 << 28)
+
+#define R300_PFS_INSTR3_0                   0x47C0
+#       define R300_FPI3_SRC0A_SHIFT             0
+#       define R300_FPI3_SRC0A_MASK              (31 << 0)
+#       define R300_FPI3_SRC0A_CONST             (1 << 5)
+#       define R300_FPI3_SRC1A_SHIFT             6
+#       define R300_FPI3_SRC1A_MASK              (31 << 6)
+#       define R300_FPI3_SRC1A_CONST             (1 << 11)
+#       define R300_FPI3_SRC2A_SHIFT             12
+#       define R300_FPI3_SRC2A_MASK              (31 << 12)
+#       define R300_FPI3_SRC2A_CONST             (1 << 17)
+#       define R300_FPI3_DSTA_SHIFT              18
+#       define R300_FPI3_DSTA_MASK               (31 << 18)
+#       define R300_FPI3_DSTA_REG                (1 << 23)
+#       define R300_FPI3_DSTA_OUTPUT             (1 << 24)
+
+#define R300_PFS_INSTR0_0                   0x48C0
+#       define R300_FPI0_ARGC_SRC0C_XYZ          0
+#       define R300_FPI0_ARGC_SRC0C_XXX          1
+#       define R300_FPI0_ARGC_SRC0C_YYY          2
+#       define R300_FPI0_ARGC_SRC0C_ZZZ          3
+#       define R300_FPI0_ARGC_SRC1C_XYZ          4
+#       define R300_FPI0_ARGC_SRC1C_XXX          5
+#       define R300_FPI0_ARGC_SRC1C_YYY          6
+#       define R300_FPI0_ARGC_SRC1C_ZZZ          7
+#       define R300_FPI0_ARGC_SRC2C_XYZ          8
+#       define R300_FPI0_ARGC_SRC2C_XXX          9
+#       define R300_FPI0_ARGC_SRC2C_YYY          10
+#       define R300_FPI0_ARGC_SRC2C_ZZZ          11
+#       define R300_FPI0_ARGC_SRC0A              12
+#       define R300_FPI0_ARGC_SRC1A              13
+#       define R300_FPI0_ARGC_SRC2A              14
+#       define R300_FPI0_ARGC_SRC1C_LRP          15
+#       define R300_FPI0_ARGC_ZERO               20
+#       define R300_FPI0_ARGC_ONE                21
+#       define R300_FPI0_ARGC_HALF               22 /* GUESS */
+#       define R300_FPI0_ARGC_SRC0C_YZX          23
+#       define R300_FPI0_ARGC_SRC1C_YZX          24
+#       define R300_FPI0_ARGC_SRC2C_YZX          25
+#       define R300_FPI0_ARGC_SRC0C_ZXY          26
+#       define R300_FPI0_ARGC_SRC1C_ZXY          27
+#       define R300_FPI0_ARGC_SRC2C_ZXY          28
+#       define R300_FPI0_ARGC_SRC0CA_WZY         29
+#       define R300_FPI0_ARGC_SRC1CA_WZY         30
+#       define R300_FPI0_ARGC_SRC2CA_WZY         31
+
+#       define R300_FPI0_ARG0C_SHIFT             0
+#       define R300_FPI0_ARG0C_MASK              (31 << 0)
+#       define R300_FPI0_ARG0C_NEG               (1 << 5)
+#       define R300_FPI0_ARG0C_ABS               (1 << 6)
+#       define R300_FPI0_ARG1C_SHIFT             7
+#       define R300_FPI0_ARG1C_MASK              (31 << 7)
+#       define R300_FPI0_ARG1C_NEG               (1 << 12)
+#       define R300_FPI0_ARG1C_ABS               (1 << 13)
+#       define R300_FPI0_ARG2C_SHIFT             14
+#       define R300_FPI0_ARG2C_MASK              (31 << 14)
+#       define R300_FPI0_ARG2C_NEG               (1 << 19)
+#       define R300_FPI0_ARG2C_ABS               (1 << 20)
+#       define R300_FPI0_SPECIAL_LRP             (1 << 21)
+#       define R300_FPI0_OUTC_MAD                (0 << 23)
+#       define R300_FPI0_OUTC_DP3                (1 << 23)
+#       define R300_FPI0_OUTC_DP4                (2 << 23)
+#       define R300_FPI0_OUTC_MIN                (4 << 23)
+#       define R300_FPI0_OUTC_MAX                (5 << 23)
+#       define R300_FPI0_OUTC_CMP                (8 << 23)
+#       define R300_FPI0_OUTC_FRC                (9 << 23)
+#       define R300_FPI0_OUTC_REPL_ALPHA         (10 << 23)
+#       define R300_FPI0_OUTC_SAT                (1 << 30)
+#       define R300_FPI0_UNKNOWN_31              (1 << 31)
+
+#define R300_PFS_INSTR2_0                   0x49C0
+#       define R300_FPI2_ARGA_SRC0C_X            0
+#       define R300_FPI2_ARGA_SRC0C_Y            1
+#       define R300_FPI2_ARGA_SRC0C_Z            2
+#       define R300_FPI2_ARGA_SRC1C_X            3
+#       define R300_FPI2_ARGA_SRC1C_Y            4
+#       define R300_FPI2_ARGA_SRC1C_Z            5
+#       define R300_FPI2_ARGA_SRC2C_X            6
+#       define R300_FPI2_ARGA_SRC2C_Y            7
+#       define R300_FPI2_ARGA_SRC2C_Z            8
+#       define R300_FPI2_ARGA_SRC0A              9
+#       define R300_FPI2_ARGA_SRC1A              10
+#       define R300_FPI2_ARGA_SRC2A              11
+#       define R300_FPI2_ARGA_SRC1A_LRP          15
+#       define R300_FPI2_ARGA_ZERO               16
+#       define R300_FPI2_ARGA_ONE                17
+#       define R300_FPI2_ARGA_HALF               18 /* GUESS */
+
+#       define R300_FPI2_ARG0A_SHIFT             0
+#       define R300_FPI2_ARG0A_MASK              (31 << 0)
+#       define R300_FPI2_ARG0A_NEG               (1 << 5)
+#               define R300_FPI2_ARG0A_ABS                               (1 << 6) /* GUESS */
+#       define R300_FPI2_ARG1A_SHIFT             7
+#       define R300_FPI2_ARG1A_MASK              (31 << 7)
+#       define R300_FPI2_ARG1A_NEG               (1 << 12)
+#               define R300_FPI2_ARG1A_ABS                               (1 << 13) /* GUESS */
+#       define R300_FPI2_ARG2A_SHIFT             14
+#       define R300_FPI2_ARG2A_MASK              (31 << 14)
+#       define R300_FPI2_ARG2A_NEG               (1 << 19)
+#               define R300_FPI2_ARG2A_ABS                               (1 << 20) /* GUESS */
+#       define R300_FPI2_SPECIAL_LRP             (1 << 21)
+#       define R300_FPI2_OUTA_MAD                (0 << 23)
+#       define R300_FPI2_OUTA_DP4                (1 << 23)
+#       define R300_FPI2_OUTA_MIN                (2 << 23)
+#       define R300_FPI2_OUTA_MAX                (3 << 23)
+#       define R300_FPI2_OUTA_CMP                (6 << 23)
+#       define R300_FPI2_OUTA_FRC                (7 << 23)
+#       define R300_FPI2_OUTA_EX2                (8 << 23)
+#       define R300_FPI2_OUTA_LG2                (9 << 23)
+#       define R300_FPI2_OUTA_RCP                (10 << 23)
+#       define R300_FPI2_OUTA_RSQ                (11 << 23)
+#       define R300_FPI2_OUTA_SAT                (1 << 30)
+#       define R300_FPI2_UNKNOWN_31              (1 << 31)
+/* END */
+
+/* gap */
+#define R300_PP_ALPHA_TEST                  0x4BD4
+#       define R300_REF_ALPHA_MASK               0x000000ff
+#       define R300_ALPHA_TEST_FAIL              (0 << 8)
+#       define R300_ALPHA_TEST_LESS              (1 << 8)
+#       define R300_ALPHA_TEST_LEQUAL            (3 << 8)
+#       define R300_ALPHA_TEST_EQUAL             (2 << 8)
+#       define R300_ALPHA_TEST_GEQUAL            (6 << 8)
+#       define R300_ALPHA_TEST_GREATER           (4 << 8)
+#       define R300_ALPHA_TEST_NEQUAL            (5 << 8)
+#       define R300_ALPHA_TEST_PASS              (7 << 8)
+#       define R300_ALPHA_TEST_OP_MASK           (7 << 8)
+#       define R300_ALPHA_TEST_ENABLE            (1 << 11)
+
+/* gap */
+/* Fragment program parameters in 7.16 floating point */
+#define R300_PFS_PARAM_0_X                  0x4C00
+#define R300_PFS_PARAM_0_Y                  0x4C04
+#define R300_PFS_PARAM_0_Z                  0x4C08
+#define R300_PFS_PARAM_0_W                  0x4C0C
+/* GUESS: PARAM_31 is last, based on native limits reported by fglrx */
+#define R300_PFS_PARAM_31_X                 0x4DF0
+#define R300_PFS_PARAM_31_Y                 0x4DF4
+#define R300_PFS_PARAM_31_Z                 0x4DF8
+#define R300_PFS_PARAM_31_W                 0x4DFC
+
+/* Notes:
+// - AFAIK fglrx always sets BLEND_UNKNOWN when blending is used in the application
+// - AFAIK fglrx always sets BLEND_NO_SEPARATE when CBLEND and ABLEND are set to the same
+//   function (both registers are always set up completely in any case)
+// - Most blend flags are simply copied from R200 and not tested yet */
+#define R300_RB3D_CBLEND                    0x4E04
+#define R300_RB3D_ABLEND                    0x4E08
+ /* the following only appear in CBLEND */
+#       define R300_BLEND_ENABLE                     (1 << 0)
+#       define R300_BLEND_UNKNOWN                    (3 << 1)
+#       define R300_BLEND_NO_SEPARATE                (1 << 3)
+ /* the following are shared between CBLEND and ABLEND */
+#       define R300_FCN_MASK                         (3  << 12)
+#       define R300_COMB_FCN_ADD_CLAMP               (0  << 12)
+#       define R300_COMB_FCN_ADD_NOCLAMP             (1  << 12)
+#       define R300_COMB_FCN_SUB_CLAMP               (2  << 12)
+#       define R300_COMB_FCN_SUB_NOCLAMP             (3  << 12)
+#       define R300_SRC_BLEND_GL_ZERO                (32 << 16)
+#       define R300_SRC_BLEND_GL_ONE                 (33 << 16)
+#       define R300_SRC_BLEND_GL_SRC_COLOR           (34 << 16)
+#       define R300_SRC_BLEND_GL_ONE_MINUS_SRC_COLOR (35 << 16)
+#       define R300_SRC_BLEND_GL_DST_COLOR           (36 << 16)
+#       define R300_SRC_BLEND_GL_ONE_MINUS_DST_COLOR (37 << 16)
+#       define R300_SRC_BLEND_GL_SRC_ALPHA           (38 << 16)
+#       define R300_SRC_BLEND_GL_ONE_MINUS_SRC_ALPHA (39 << 16)
+#       define R300_SRC_BLEND_GL_DST_ALPHA           (40 << 16)
+#       define R300_SRC_BLEND_GL_ONE_MINUS_DST_ALPHA (41 << 16)
+#       define R300_SRC_BLEND_GL_SRC_ALPHA_SATURATE  (42 << 16)
+#       define R300_SRC_BLEND_MASK                   (63 << 16)
+#       define R300_DST_BLEND_GL_ZERO                (32 << 24)
+#       define R300_DST_BLEND_GL_ONE                 (33 << 24)
+#       define R300_DST_BLEND_GL_SRC_COLOR           (34 << 24)
+#       define R300_DST_BLEND_GL_ONE_MINUS_SRC_COLOR (35 << 24)
+#       define R300_DST_BLEND_GL_DST_COLOR           (36 << 24)
+#       define R300_DST_BLEND_GL_ONE_MINUS_DST_COLOR (37 << 24)
+#       define R300_DST_BLEND_GL_SRC_ALPHA           (38 << 24)
+#       define R300_DST_BLEND_GL_ONE_MINUS_SRC_ALPHA (39 << 24)
+#       define R300_DST_BLEND_GL_DST_ALPHA           (40 << 24)
+#       define R300_DST_BLEND_GL_ONE_MINUS_DST_ALPHA (41 << 24)
+#       define R300_DST_BLEND_MASK                   (63 << 24)
+#define R300_RB3D_COLORMASK                 0x4E0C
+#       define R300_COLORMASK0_B                 (1<<0)
+#       define R300_COLORMASK0_G                 (1<<1)
+#       define R300_COLORMASK0_R                 (1<<2)
+#       define R300_COLORMASK0_A                 (1<<3)
+
+/* gap */
+#define R300_RB3D_COLOROFFSET0              0x4E28
+#       define R300_COLOROFFSET_MASK             0xFFFFFFF0 /* GUESS */
+#define R300_RB3D_COLOROFFSET1              0x4E2C /* GUESS */
+#define R300_RB3D_COLOROFFSET2              0x4E30 /* GUESS */
+#define R300_RB3D_COLOROFFSET3              0x4E34 /* GUESS */
+/* gap */
+/* Bit 16: Larger tiles
+// Bit 17: 4x2 tiles
+// Bit 18: Extremely weird tile like, but some pixels duplicated? */
+#define R300_RB3D_COLORPITCH0               0x4E38
+#       define R300_COLORPITCH_MASK              0x00001FF8 /* GUESS */
+#       define R300_COLOR_TILE_ENABLE            (1 << 16) /* GUESS */
+#       define R300_COLOR_MICROTILE_ENABLE       (1 << 17) /* GUESS */
+#       define R300_COLOR_ENDIAN_NO_SWAP         (0 << 18) /* GUESS */
+#       define R300_COLOR_ENDIAN_WORD_SWAP       (1 << 18) /* GUESS */
+#       define R300_COLOR_ENDIAN_DWORD_SWAP      (2 << 18) /* GUESS */
+#       define R300_COLOR_FORMAT_RGB565          (2 << 22)
+#       define R300_COLOR_FORMAT_ARGB8888        (3 << 22)
+#define R300_RB3D_COLORPITCH1               0x4E3C /* GUESS */
+#define R300_RB3D_COLORPITCH2               0x4E40 /* GUESS */
+#define R300_RB3D_COLORPITCH3               0x4E44 /* GUESS */
+
+/* gap */
+/* Guess by Vladimir.
+// Set to 0A before 3D operations, set to 02 afterwards. */
+#define R300_RB3D_DSTCACHE_CTLSTAT          0x4E4C
+#       define R300_RB3D_DSTCACHE_02             0x00000002
+#       define R300_RB3D_DSTCACHE_0A             0x0000000A
+
+/* gap */
+/* There seems to be no "write only" setting, so use Z-test = ALWAYS for this. */
+/* Bit (1<<8) is the "test" bit. so plain write is 6  - vd */
+#define R300_RB3D_ZSTENCIL_CNTL_0                   0x4F00
+#       define R300_RB3D_Z_DISABLED_1            0x00000010 /* GUESS */
+#       define R300_RB3D_Z_DISABLED_2            0x00000014 /* GUESS */
+#       define R300_RB3D_Z_TEST                  0x00000012
+#       define R300_RB3D_Z_TEST_AND_WRITE        0x00000016
+#       define R300_RB3D_Z_WRITE_ONLY            0x00000006
+
+#       define R300_RB3D_Z_TEST                  0x00000012
+#       define R300_RB3D_Z_TEST_AND_WRITE        0x00000016
+#       define R300_RB3D_Z_WRITE_ONLY            0x00000006
+#       define R300_RB3D_STENCIL_ENABLE          0x00000001
+
+#define R300_RB3D_ZSTENCIL_CNTL_1                   0x4F04
+                /* functions */
+#       define R300_ZS_NEVER                    0
+#       define R300_ZS_LESS                     1
+#       define R300_ZS_LEQUAL                   2
+#       define R300_ZS_EQUAL                    3
+#       define R300_ZS_GEQUAL                   4
+#       define R300_ZS_GREATER                  5
+#       define R300_ZS_NOTEQUAL                 6
+#       define R300_ZS_ALWAYS                   7
+#       define R300_ZS_MASK                     7
+                /* operations */
+#       define R300_ZS_KEEP                     0
+#       define R300_ZS_ZERO                     1
+#       define R300_ZS_REPLACE                  2
+#       define R300_ZS_INCR                     3
+#       define R300_ZS_DECR                     4
+#       define R300_ZS_INVERT                   5
+#       define R300_ZS_INCR_WRAP                6
+#       define R300_ZS_DECR_WRAP                7
+
+       /* front and back refer to operations done for front
+          and back faces, i.e. separate stencil function support */
+#       define R300_RB3D_ZS1_DEPTH_FUNC_SHIFT           0
+#       define R300_RB3D_ZS1_FRONT_FUNC_SHIFT           3
+#       define R300_RB3D_ZS1_FRONT_FAIL_OP_SHIFT        6
+#       define R300_RB3D_ZS1_FRONT_ZPASS_OP_SHIFT       9
+#       define R300_RB3D_ZS1_FRONT_ZFAIL_OP_SHIFT      12
+#       define R300_RB3D_ZS1_BACK_FUNC_SHIFT           15
+#       define R300_RB3D_ZS1_BACK_FAIL_OP_SHIFT        18
+#       define R300_RB3D_ZS1_BACK_ZPASS_OP_SHIFT       21
+#       define R300_RB3D_ZS1_BACK_ZFAIL_OP_SHIFT       24
+
+
+
+#define R300_RB3D_ZSTENCIL_CNTL_2                   0x4F08
+#       define R300_RB3D_ZS2_STENCIL_REF_SHIFT          0
+#       define R300_RB3D_ZS2_STENCIL_MASK               0xFF
+#       define R300_RB3D_ZS2_STENCIL_MASK_SHIFT         8
+#       define R300_RB3D_ZS2_STENCIL_WRITE_MASK_SHIFT   16
+
+/* gap */
+
+#define R300_RB3D_ZSTENCIL_FORMAT                   0x4F10
+#       define R300_DEPTH_FORMAT_16BIT_INT_Z     (0 << 0)
+#       define R300_DEPTH_FORMAT_24BIT_INT_Z     (2 << 0)
+
+/* gap */
+#define R300_RB3D_DEPTHOFFSET               0x4F20
+#define R300_RB3D_DEPTHPITCH                0x4F24
+#       define R300_DEPTHPITCH_MASK              0x00001FF8 /* GUESS */
+#       define R300_DEPTH_TILE_ENABLE            (1 << 16) /* GUESS */
+#       define R300_DEPTH_MICROTILE_ENABLE       (1 << 17) /* GUESS */
+#       define R300_DEPTH_ENDIAN_NO_SWAP         (0 << 18) /* GUESS */
+#       define R300_DEPTH_ENDIAN_WORD_SWAP       (1 << 18) /* GUESS */
+#       define R300_DEPTH_ENDIAN_DWORD_SWAP      (2 << 18) /* GUESS */
+
+/* BEGIN: Vertex program instruction set
+// Every instruction is four dwords long:
+//  DWORD 0: output and opcode
+//  DWORD 1: first argument
+//  DWORD 2: second argument
+//  DWORD 3: third argument
+//
+// Notes:
+//  - ABS r, a is implemented as MAX r, a, -a
+//  - MOV is implemented as ADD to zero
+//  - XPD is implemented as MUL + MAD
+//  - FLR is implemented as FRC + ADD
+//  - apparently, fglrx tries to schedule instructions so that there is at least
+//    one instruction between the write to a temporary and the first read
+//    from said temporary; however, violations of this scheduling are allowed
+//  - register indices seem to be unrelated with OpenGL aliasing to conventional state
+//  - only one attribute and one parameter can be loaded at a time; however, the
+//    same attribute/parameter can be used for more than one argument
+//  - the second software argument for POW is the third hardware argument (no idea why)
+//  - MAD with only temporaries as input seems to use VPI_OUT_SELECT_MAD_2
+//
+// There is some magic surrounding LIT:
+//  The single argument is replicated across all three inputs, but swizzled:
+//   First argument: xyzy
+//   Second argument: xyzx
+//   Third argument: xyzw
+//  Whenever the result is used later in the fragment program, fglrx forces x and w
+//  to be 1.0 in the input selection; I don't know whether this is strictly necessary */
+#define R300_VPI_OUT_OP_DOT                     (1 << 0)
+#define R300_VPI_OUT_OP_MUL                     (2 << 0)
+#define R300_VPI_OUT_OP_ADD                     (3 << 0)
+#define R300_VPI_OUT_OP_MAD                     (4 << 0)
+#define R300_VPI_OUT_OP_DST                     (5 << 0)
+#define R300_VPI_OUT_OP_FRC                     (6 << 0)
+#define R300_VPI_OUT_OP_MAX                     (7 << 0)
+#define R300_VPI_OUT_OP_MIN                     (8 << 0)
+#define R300_VPI_OUT_OP_SGE                     (9 << 0)
+#define R300_VPI_OUT_OP_SLT                     (10 << 0)
+#define R300_VPI_OUT_OP_UNK12                   (12 << 0) /* Used in GL_POINT_DISTANCE_ATTENUATION_ARB, vector(scalar, vector) */
+#define R300_VPI_OUT_OP_EXP                     (65 << 0)
+#define R300_VPI_OUT_OP_LOG                     (66 << 0)
+#define R300_VPI_OUT_OP_UNK67                   (67 << 0) /* Used in fog computations, scalar(scalar) */
+#define R300_VPI_OUT_OP_LIT                     (68 << 0)
+#define R300_VPI_OUT_OP_POW                     (69 << 0)
+#define R300_VPI_OUT_OP_RCP                     (70 << 0)
+#define R300_VPI_OUT_OP_RSQ                     (72 << 0)
+#define R300_VPI_OUT_OP_UNK73                   (73 << 0) /* Used in GL_POINT_DISTANCE_ATTENUATION_ARB, scalar(scalar) */
+#define R300_VPI_OUT_OP_EX2                     (75 << 0)
+#define R300_VPI_OUT_OP_LG2                     (76 << 0)
+#define R300_VPI_OUT_OP_MAD_2                   (128 << 0)
+#define R300_VPI_OUT_OP_UNK129                  (129 << 0) /* all temps, vector(scalar, vector, vector) */
+
+#define R300_VPI_OUT_REG_CLASS_TEMPORARY        (0 << 8)
+#define R300_VPI_OUT_REG_CLASS_RESULT           (2 << 8)
+#define R300_VPI_OUT_REG_CLASS_MASK             (31 << 8)
+
+#define R300_VPI_OUT_REG_INDEX_SHIFT            13
+#define R300_VPI_OUT_REG_INDEX_MASK             (31 << 13) /* GUESS based on fglrx native limits */
+
+#define R300_VPI_OUT_WRITE_X                    (1 << 20)
+#define R300_VPI_OUT_WRITE_Y                    (1 << 21)
+#define R300_VPI_OUT_WRITE_Z                    (1 << 22)
+#define R300_VPI_OUT_WRITE_W                    (1 << 23)
+
+#define R300_VPI_IN_REG_CLASS_TEMPORARY         (0 << 0)
+#define R300_VPI_IN_REG_CLASS_ATTRIBUTE         (1 << 0)
+#define R300_VPI_IN_REG_CLASS_PARAMETER         (2 << 0)
+#define R300_VPI_IN_REG_CLASS_NONE              (9 << 0)
+#define R300_VPI_IN_REG_CLASS_MASK              (31 << 0) /* GUESS */
+
+#define R300_VPI_IN_REG_INDEX_SHIFT             5
+#define R300_VPI_IN_REG_INDEX_MASK              (255 << 5) /* GUESS based on fglrx native limits */
+
+/* The R300 can select components from the input register arbitrarily.
+// Use the following constants, shifted by the component shift you
+// want to select */
+#define R300_VPI_IN_SELECT_X    0
+#define R300_VPI_IN_SELECT_Y    1
+#define R300_VPI_IN_SELECT_Z    2
+#define R300_VPI_IN_SELECT_W    3
+#define R300_VPI_IN_SELECT_ZERO 4
+#define R300_VPI_IN_SELECT_ONE  5
+#define R300_VPI_IN_SELECT_MASK 7
+
+#define R300_VPI_IN_X_SHIFT                     13
+#define R300_VPI_IN_Y_SHIFT                     16
+#define R300_VPI_IN_Z_SHIFT                     19
+#define R300_VPI_IN_W_SHIFT                     22
+
+#define R300_VPI_IN_NEG_X                       (1 << 25)
+#define R300_VPI_IN_NEG_Y                       (1 << 26)
+#define R300_VPI_IN_NEG_Z                       (1 << 27)
+#define R300_VPI_IN_NEG_W                       (1 << 28)
+/* END */
+
+//BEGIN: Packet 3 commands
+
+// A primitive emission dword.
+#define R300_PRIM_TYPE_NONE                     (0 << 0)
+#define R300_PRIM_TYPE_POINT                    (1 << 0)
+#define R300_PRIM_TYPE_LINE                     (2 << 0)
+#define R300_PRIM_TYPE_LINE_STRIP               (3 << 0)
+#define R300_PRIM_TYPE_TRI_LIST                 (4 << 0)
+#define R300_PRIM_TYPE_TRI_FAN                  (5 << 0)
+#define R300_PRIM_TYPE_TRI_STRIP                (6 << 0)
+#define R300_PRIM_TYPE_TRI_TYPE2                (7 << 0)
+#define R300_PRIM_TYPE_RECT_LIST                (8 << 0)
+#define R300_PRIM_TYPE_3VRT_POINT_LIST          (9 << 0)
+#define R300_PRIM_TYPE_3VRT_LINE_LIST           (10 << 0)
+#define R300_PRIM_TYPE_POINT_SPRITES            (11 << 0) // GUESS (based on r200)
+#define R300_PRIM_TYPE_LINE_LOOP                (12 << 0)
+#define R300_PRIM_TYPE_QUADS                    (13 << 0)
+#define R300_PRIM_TYPE_QUAD_STRIP               (14 << 0)
+#define R300_PRIM_TYPE_POLYGON                  (15 << 0)
+#define R300_PRIM_TYPE_MASK                     0xF
+#define R300_PRIM_WALK_IND                      (1 << 4)
+#define R300_PRIM_WALK_LIST                     (2 << 4)
+#define R300_PRIM_WALK_RING                     (3 << 4)
+#define R300_PRIM_WALK_MASK                     (3 << 4)
+#define R300_PRIM_COLOR_ORDER_BGRA              (0 << 6) // GUESS (based on r200)
+#define R300_PRIM_COLOR_ORDER_RGBA              (1 << 6) // GUESS
+#define R300_PRIM_NUM_VERTICES_SHIFT            16
+
+// Draw a primitive from vertex data in arrays loaded via 3D_LOAD_VBPNTR.
+// Two parameter dwords:
+// 0. The first parameter appears to be always 0
+// 1. The second parameter is a standard primitive emission dword.
+#define R300_PACKET3_3D_DRAW_VBUF           0x00002800
+
+// Specify the full set of vertex arrays as (address, stride).
+// The first parameter is the number of vertex arrays specified.
+// The rest of the command is a variable length list of blocks, where
+// each block is three dwords long and specifies two arrays.
+// The first dword of a block is split into two words, the lower significant
+// word refers to the first array, the more significant word to the second
+// array in the block.
+// The low byte of each word contains the size of an array entry in dwords,
+// the high byte contains the stride of the array.
+// The second dword of a block contains the pointer to the first array,
+// the third dword of a block contains the pointer to the second array.
+// Note that if the total number of arrays is odd, the third dword of
+// the last block is omitted.
+#define R300_PACKET3_3D_LOAD_VBPNTR         0x00002F00
+
+#define R300_PACKET3_INDX_BUFFER            0x00003300
+#    define R300_EB_UNK1_SHIFT                      24
+#    define R300_EB_UNK1                    (0x80<<24)
+#    define R300_EB_UNK2                        0x0810
+#define R300_PACKET3_3D_DRAW_INDX_2         0x00003600
+
+//END
+
+#endif /* _R300_REG_H */
diff --git a/drivers/char/drm/radeon_cp.c b/drivers/char/drm/radeon_cp.c
index 20bcf872b348..6d9080a3ca7e 100644
--- a/drivers/char/drm/radeon_cp.c
+++ b/drivers/char/drm/radeon_cp.c
@@ -32,6 +32,7 @@
 #include "drm.h"
 #include "radeon_drm.h"
 #include "radeon_drv.h"
+#include "r300_reg.h"
 
 #define RADEON_FIFO_DEBUG       0
 
@@ -1151,6 +1152,8 @@ static void radeon_cp_init_ring_buffer( drm_device_t *dev,
 
 #if __OS_HAS_AGP
         if ( !dev_priv->is_pci ) {
+                /* set RADEON_AGP_BASE here instead of relying on X from user space */
+                RADEON_WRITE(RADEON_AGP_BASE, (unsigned int)dev->agp->base);
                 RADEON_WRITE( RADEON_CP_RB_RPTR_ADDR,
                               dev_priv->ring_rptr->offset
                               - dev->agp->base
@@ -1407,6 +1410,7 @@ static int radeon_do_init_cp( drm_device_t *dev, drm_radeon_init_t *init )
                 radeon_do_cleanup_cp(dev);
                 return DRM_ERR(EINVAL);
         }
+        dev->agp_buffer_token = init->buffers_offset;
         dev->agp_buffer_map = drm_core_findmap(dev, init->buffers_offset);
         if(!dev->agp_buffer_map) {
                 DRM_ERROR("could not find dma buffer region!\n");
@@ -1625,6 +1629,9 @@ int radeon_cp_init( DRM_IOCTL_ARGS )
 
         DRM_COPY_FROM_USER_IOCTL( init, (drm_radeon_init_t __user *)data, sizeof(init) );
 
+        if(init.func == RADEON_INIT_R300_CP)
+                r300_init_reg_flags();
+
         switch ( init.func ) {
         case RADEON_INIT_CP:
         case RADEON_INIT_R200_CP:
@@ -2039,15 +2046,43 @@ int radeon_driver_preinit(struct drm_device *dev, unsigned long flags)
         case CHIP_RV200:
         case CHIP_R200:
         case CHIP_R300:
+        case CHIP_R420:
                 dev_priv->flags |= CHIP_HAS_HIERZ;
                 break;
         default:
         /* all other chips have no hierarchical z buffer */
                 break;
         }
+
+        if (drm_device_is_agp(dev))
+                dev_priv->flags |= CHIP_IS_AGP;
+        
+        DRM_DEBUG("%s card detected\n",
+                  ((dev_priv->flags & CHIP_IS_AGP) ? "AGP" : "PCI"));
         return ret;
 }
 
+int radeon_presetup(struct drm_device *dev)
+{
+        int ret;
+        drm_local_map_t *map;
+        drm_radeon_private_t *dev_priv = dev->dev_private;
+
+        ret = drm_addmap(dev, drm_get_resource_start(dev, 2),
+                         drm_get_resource_len(dev, 2), _DRM_REGISTERS,
+                         _DRM_READ_ONLY, &dev_priv->mmio);
+        if (ret != 0)
+                return ret;
+
+        ret = drm_addmap(dev, drm_get_resource_start(dev, 0),
+                         drm_get_resource_len(dev, 0), _DRM_FRAME_BUFFER,
+                         _DRM_WRITE_COMBINING, &map);
+        if (ret != 0)
+                return ret;
+
+        return 0;
+}
+
 int radeon_driver_postcleanup(struct drm_device *dev)
 {
         drm_radeon_private_t *dev_priv = dev->dev_private;
diff --git a/drivers/char/drm/radeon_drm.h b/drivers/char/drm/radeon_drm.h
index c1e62d047989..3792798270a4 100644
--- a/drivers/char/drm/radeon_drm.h
+++ b/drivers/char/drm/radeon_drm.h
@@ -195,6 +195,52 @@ typedef union {
 #define RADEON_WAIT_2D  0x1
 #define RADEON_WAIT_3D  0x2
 
+/* Allowed parameters for R300_CMD_PACKET3
+ */
+#define R300_CMD_PACKET3_CLEAR          0
+#define R300_CMD_PACKET3_RAW            1
+
+/* Commands understood by cmd_buffer ioctl for R300.
+ * The interface has not been stabilized, so some of these may be removed
+ * and eventually reordered before stabilization.
+ */
+#define R300_CMD_PACKET0                1 
+#define R300_CMD_VPU                    2 /* emit vertex program upload */
+#define R300_CMD_PACKET3                3 /* emit a packet3 */
+#define R300_CMD_END3D                  4 /* emit sequence ending 3d rendering */
+#define R300_CMD_CP_DELAY               5
+#define R300_CMD_DMA_DISCARD            6
+#define R300_CMD_WAIT                   7
+#       define R300_WAIT_2D             0x1
+#       define R300_WAIT_3D             0x2
+#       define R300_WAIT_2D_CLEAN       0x3
+#       define R300_WAIT_3D_CLEAN       0x4
+
+typedef union {
+        unsigned int u;
+        struct {
+                unsigned char cmd_type, pad0, pad1, pad2;
+        } header;
+        struct {
+                unsigned char cmd_type, count, reglo, reghi;
+        } packet0;
+        struct {
+                unsigned char cmd_type, count, adrlo, adrhi;
+        } vpu;
+        struct {
+                unsigned char cmd_type, packet, pad0, pad1;
+        } packet3;
+        struct {
+                unsigned char cmd_type, packet;
+                unsigned short count; /* amount of packet2 to emit */
+        } delay;
+        struct {
+                unsigned char cmd_type, buf_idx, pad0, pad1;
+        } dma;
+        struct {
+                unsigned char cmd_type, flags, pad0, pad1;      
+        } wait;
+} drm_r300_cmd_header_t;
 
 #define RADEON_FRONT                    0x1
 #define RADEON_BACK                     0x2
diff --git a/drivers/char/drm/radeon_drv.c b/drivers/char/drm/radeon_drv.c
index 18e4e5b0952f..e0682f64b400 100644
--- a/drivers/char/drm/radeon_drv.c
+++ b/drivers/char/drm/radeon_drv.c
@@ -76,6 +76,7 @@ static struct drm_driver driver = {
         .driver_features = DRIVER_USE_AGP | DRIVER_USE_MTRR | DRIVER_PCI_DMA | DRIVER_SG | DRIVER_HAVE_IRQ | DRIVER_HAVE_DMA | DRIVER_IRQ_SHARED | DRIVER_IRQ_VBL,
         .dev_priv_size = sizeof(drm_radeon_buf_priv_t),
         .preinit = radeon_driver_preinit,
+        .presetup = radeon_presetup,
         .postcleanup = radeon_driver_postcleanup,
         .prerelease = radeon_driver_prerelease,
         .pretakedown = radeon_driver_pretakedown,
diff --git a/drivers/char/drm/radeon_drv.h b/drivers/char/drm/radeon_drv.h
index 771aa80a5e8c..f12a963ede18 100644
--- a/drivers/char/drm/radeon_drv.h
+++ b/drivers/char/drm/radeon_drv.h
@@ -82,9 +82,10 @@
  *     - Add support for r100 cube maps
  * 1.16- Add R200_EMIT_PP_TRI_PERF_CNTL packet to support brilinear
  *       texture filtering on r200
+ * 1.17- Add initial support for R300 (3D).
  */
 #define DRIVER_MAJOR            1
-#define DRIVER_MINOR            16
+#define DRIVER_MINOR            17
 #define DRIVER_PATCHLEVEL       0
 
 #define GET_RING_HEAD(dev_priv)         DRM_READ32(  (dev_priv)->ring_rptr, 0 )
@@ -106,7 +107,9 @@ enum radeon_family {
         CHIP_RV280,
         CHIP_R300,
         CHIP_RS300,
+        CHIP_R350,
         CHIP_RV350,
+        CHIP_R420,
         CHIP_LAST,
 };
 
@@ -290,6 +293,7 @@ extern int radeon_wait_ring( drm_radeon_private_t *dev_priv, int n );
 extern int radeon_do_cp_idle( drm_radeon_private_t *dev_priv );
 
 extern int radeon_driver_preinit(struct drm_device *dev, unsigned long flags);
+extern int radeon_presetup(struct drm_device *dev);
 extern int radeon_driver_postcleanup(struct drm_device *dev);
 
 extern int radeon_mem_alloc( DRM_IOCTL_ARGS );
@@ -320,6 +324,14 @@ extern int radeon_postcleanup( struct drm_device *dev );
 extern long radeon_compat_ioctl(struct file *filp, unsigned int cmd,
                                 unsigned long arg);
 
+
+/* r300_cmdbuf.c */
+extern void r300_init_reg_flags(void);
+
+extern int r300_do_cp_cmdbuf(drm_device_t* dev, DRMFILE filp,
+                             drm_file_t* filp_priv,
+                             drm_radeon_cmd_buffer_t* cmdbuf);
+
 /* Flags for stats.boxes
  */
 #define RADEON_BOX_DMA_IDLE      0x1
@@ -357,6 +369,11 @@ extern long radeon_compat_ioctl(struct file *filp, unsigned int cmd,
 #define RADEON_CRTC2_OFFSET             0x0324
 #define RADEON_CRTC2_OFFSET_CNTL        0x0328
 
+#define RADEON_MPP_TB_CONFIG            0x01c0
+#define RADEON_MEM_CNTL                 0x0140
+#define RADEON_MEM_SDRAM_MODE_REG       0x0158
+#define RADEON_AGP_BASE                 0x0170
+
 #define RADEON_RB3D_COLOROFFSET         0x1c40
 #define RADEON_RB3D_COLORPITCH          0x1c48
 
@@ -651,16 +668,27 @@ extern long radeon_compat_ioctl(struct file *filp, unsigned int cmd,
 #define RADEON_CP_PACKET1               0x40000000
 #define RADEON_CP_PACKET2               0x80000000
 #define RADEON_CP_PACKET3               0xC0000000
+#       define RADEON_CP_NOP                    0x00001000
+#       define RADEON_CP_NEXT_CHAR              0x00001900
+#       define RADEON_CP_PLY_NEXTSCAN           0x00001D00
+#       define RADEON_CP_SET_SCISSORS           0x00001E00
+             /* GEN_INDX_PRIM is unsupported starting with R300 */
 #       define RADEON_3D_RNDR_GEN_INDX_PRIM     0x00002300
 #       define RADEON_WAIT_FOR_IDLE             0x00002600
 #       define RADEON_3D_DRAW_VBUF              0x00002800
 #       define RADEON_3D_DRAW_IMMD              0x00002900
 #       define RADEON_3D_DRAW_INDX              0x00002A00
+#       define RADEON_CP_LOAD_PALETTE           0x00002C00
 #       define RADEON_3D_LOAD_VBPNTR            0x00002F00
 #       define RADEON_MPEG_IDCT_MACROBLOCK      0x00003000
 #       define RADEON_MPEG_IDCT_MACROBLOCK_REV  0x00003100
 #       define RADEON_3D_CLEAR_ZMASK            0x00003200
+#       define RADEON_CP_INDX_BUFFER            0x00003300
+#       define RADEON_CP_3D_DRAW_VBUF_2         0x00003400
+#       define RADEON_CP_3D_DRAW_IMMD_2         0x00003500
+#       define RADEON_CP_3D_DRAW_INDX_2         0x00003600
 #       define RADEON_3D_CLEAR_HIZ              0x00003700
+#       define RADEON_CP_3D_CLEAR_CMASK         0x00003802
 #       define RADEON_CNTL_HOSTDATA_BLT         0x00009400
 #       define RADEON_CNTL_PAINT_MULTI          0x00009A00
 #       define RADEON_CNTL_BITBLT_MULTI         0x00009B00
diff --git a/drivers/char/drm/radeon_state.c b/drivers/char/drm/radeon_state.c
index 1f79e249146c..64a3e3a406ef 100644
--- a/drivers/char/drm/radeon_state.c
+++ b/drivers/char/drm/radeon_state.c
@@ -1493,7 +1493,7 @@ static void radeon_cp_dispatch_indices( drm_device_t *dev,
 
 }
 
-#define RADEON_MAX_TEXTURE_SIZE (RADEON_BUFFER_SIZE - 8 * sizeof(u32))
+#define RADEON_MAX_TEXTURE_SIZE RADEON_BUFFER_SIZE
 
 static int radeon_cp_dispatch_texture( DRMFILE filp,
                                        drm_device_t *dev,
@@ -1506,10 +1506,11 @@ static int radeon_cp_dispatch_texture( DRMFILE filp,
         u32 format;
         u32 *buffer;
         const u8 __user *data;
-        int size, dwords, tex_width, blit_width;
+        int size, dwords, tex_width, blit_width, spitch;
         u32 height;
         int i;
         u32 texpitch, microtile;
+        u32 offset;
         RING_LOCALS;
 
         DRM_GET_PRIV_WITH_RETURN( filp_priv, filp );
@@ -1530,17 +1531,6 @@ static int radeon_cp_dispatch_texture( DRMFILE filp,
         RADEON_WAIT_UNTIL_IDLE();
         ADVANCE_RING();
 
-#ifdef __BIG_ENDIAN
-        /* The Mesa texture functions provide the data in little endian as the
-         * chip wants it, but we need to compensate for the fact that the CP
-         * ring gets byte-swapped
-         */
-        BEGIN_RING( 2 );
-        OUT_RING_REG( RADEON_RBBM_GUICNTL, RADEON_HOST_DATA_SWAP_32BIT );
-        ADVANCE_RING();
-#endif
-
-
         /* The compiler won't optimize away a division by a variable,
          * even if the only legal values are powers of two.  Thus, we'll
          * use a shift instead.
@@ -1572,6 +1562,10 @@ static int radeon_cp_dispatch_texture( DRMFILE filp,
                 DRM_ERROR( "invalid texture format %d\n", tex->format );
                 return DRM_ERR(EINVAL);
         }
+        spitch = blit_width >> 6;
+        if (spitch == 0 && image->height > 1)
+                return DRM_ERR(EINVAL);
+
         texpitch = tex->pitch;
         if ((texpitch << 22) & RADEON_DST_TILE_MICRO) {
                 microtile = 1;
@@ -1624,25 +1618,6 @@ static int radeon_cp_dispatch_texture( DRMFILE filp,
                  */
                 buffer = (u32*)((char*)dev->agp_buffer_map->handle + buf->offset);
                 dwords = size / 4;
-                buffer[0] = CP_PACKET3( RADEON_CNTL_HOSTDATA_BLT, dwords + 6 );
-                buffer[1] = (RADEON_GMC_DST_PITCH_OFFSET_CNTL |
-                             RADEON_GMC_BRUSH_NONE |
-                             (format << 8) |
-                             RADEON_GMC_SRC_DATATYPE_COLOR |
-                             RADEON_ROP3_S |
-                             RADEON_DP_SRC_SOURCE_HOST_DATA |
-                             RADEON_GMC_CLR_CMP_CNTL_DIS |
-                             RADEON_GMC_WR_MSK_DIS);
-                
-                buffer[2] = (texpitch << 22) | (tex->offset >> 10);
-                buffer[3] = 0xffffffff;
-                buffer[4] = 0xffffffff;
-                buffer[5] = (image->y << 16) | image->x;
-                buffer[6] = (height << 16) | image->width;
-                buffer[7] = dwords;
-                buffer += 8;
-
-                
 
                 if (microtile) {
                         /* texture micro tiling in use, minimum texture width is thus 16 bytes.
@@ -1750,9 +1725,28 @@ static int radeon_cp_dispatch_texture( DRMFILE filp,
                 }
 
                 buf->filp = filp;
-                buf->used = (dwords + 8) * sizeof(u32);
-                radeon_cp_dispatch_indirect( dev, buf, 0, buf->used );
-                radeon_cp_discard_buffer( dev, buf );
+                buf->used = size;
+                offset = dev_priv->gart_buffers_offset + buf->offset;
+                BEGIN_RING(9);
+                OUT_RING(CP_PACKET3(RADEON_CNTL_BITBLT_MULTI, 5));
+                OUT_RING(RADEON_GMC_SRC_PITCH_OFFSET_CNTL |
+                         RADEON_GMC_DST_PITCH_OFFSET_CNTL |
+                         RADEON_GMC_BRUSH_NONE |
+                         (format << 8) |
+                         RADEON_GMC_SRC_DATATYPE_COLOR |
+                         RADEON_ROP3_S |
+                         RADEON_DP_SRC_SOURCE_MEMORY |
+                         RADEON_GMC_CLR_CMP_CNTL_DIS |
+                         RADEON_GMC_WR_MSK_DIS );
+                OUT_RING((spitch << 22) | (offset >> 10));
+                OUT_RING((texpitch << 22) | (tex->offset >> 10));
+                OUT_RING(0);
+                OUT_RING((image->x << 16) | image->y);
+                OUT_RING((image->width << 16) | height);
+                RADEON_WAIT_UNTIL_2D_IDLE();
+                ADVANCE_RING();
+
+                radeon_cp_discard_buffer(dev, buf);
 
                 /* Update the input parameters for next time */
                 image->y += height;
@@ -2797,6 +2791,17 @@ static int radeon_cp_cmdbuf( DRM_IOCTL_ARGS )
 
         orig_nbox = cmdbuf.nbox;
 
+        if(dev_priv->microcode_version == UCODE_R300) {
+                int temp;
+                temp=r300_do_cp_cmdbuf(dev, filp, filp_priv, &cmdbuf);
+        
+                if (orig_bufsz != 0)
+                        drm_free(kbuf, orig_bufsz, DRM_MEM_DRIVER);
+        
+                return temp;
+        }
+
+        /* microcode_version != r300 */
         while ( cmdbuf.bufsz >= sizeof(header) ) {
 
                 header.i = *(int *)cmdbuf.buf;
diff --git a/drivers/char/drm/savage_bci.c b/drivers/char/drm/savage_bci.c
new file mode 100644
index 000000000000..2fd40bac7c97
--- /dev/null
+++ b/drivers/char/drm/savage_bci.c
@@ -0,0 +1,1096 @@
+/* savage_bci.c -- BCI support for Savage
+ *
+ * Copyright 2004  Felix Kuehling
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sub license,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NON-INFRINGEMENT. IN NO EVENT SHALL FELIX KUEHLING BE LIABLE FOR
+ * ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
+ * CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+#include "drmP.h"
+#include "savage_drm.h"
+#include "savage_drv.h"
+
+/* Need a long timeout for shadow status updates can take a while
+ * and so can waiting for events when the queue is full. */
+#define SAVAGE_DEFAULT_USEC_TIMEOUT     1000000 /* 1s */
+#define SAVAGE_EVENT_USEC_TIMEOUT       5000000 /* 5s */
+#define SAVAGE_FREELIST_DEBUG           0
+
+static int
+savage_bci_wait_fifo_shadow(drm_savage_private_t *dev_priv, unsigned int n)
+{
+        uint32_t mask = dev_priv->status_used_mask;
+        uint32_t threshold = dev_priv->bci_threshold_hi;
+        uint32_t status;
+        int i;
+
+#if SAVAGE_BCI_DEBUG
+        if (n > dev_priv->cob_size + SAVAGE_BCI_FIFO_SIZE - threshold)
+                DRM_ERROR("Trying to emit %d words "
+                          "(more than guaranteed space in COB)\n", n);
+#endif
+
+        for (i = 0; i < SAVAGE_DEFAULT_USEC_TIMEOUT; i++) {
+                DRM_MEMORYBARRIER();
+                status = dev_priv->status_ptr[0];
+                if ((status & mask) < threshold)
+                        return 0;
+                DRM_UDELAY(1);
+        }
+
+#if SAVAGE_BCI_DEBUG
+        DRM_ERROR("failed!\n");
+        DRM_INFO("   status=0x%08x, threshold=0x%08x\n", status, threshold);
+#endif
+        return DRM_ERR(EBUSY);
+}
+
+static int
+savage_bci_wait_fifo_s3d(drm_savage_private_t *dev_priv, unsigned int n)
+{
+        uint32_t maxUsed = dev_priv->cob_size + SAVAGE_BCI_FIFO_SIZE - n;
+        uint32_t status;
+        int i;
+
+        for (i = 0; i < SAVAGE_DEFAULT_USEC_TIMEOUT; i++) {
+                status = SAVAGE_READ(SAVAGE_STATUS_WORD0);
+                if ((status & SAVAGE_FIFO_USED_MASK_S3D) <= maxUsed)
+                        return 0;
+                DRM_UDELAY(1);
+        }
+
+#if SAVAGE_BCI_DEBUG
+        DRM_ERROR("failed!\n");
+        DRM_INFO("   status=0x%08x\n", status);
+#endif
+        return DRM_ERR(EBUSY);
+}
+
+static int
+savage_bci_wait_fifo_s4(drm_savage_private_t *dev_priv, unsigned int n)
+{
+        uint32_t maxUsed = dev_priv->cob_size + SAVAGE_BCI_FIFO_SIZE - n;
+        uint32_t status;
+        int i;
+
+        for (i = 0; i < SAVAGE_DEFAULT_USEC_TIMEOUT; i++) {
+                status = SAVAGE_READ(SAVAGE_ALT_STATUS_WORD0);
+                if ((status & SAVAGE_FIFO_USED_MASK_S4) <= maxUsed)
+                        return 0;
+                DRM_UDELAY(1);
+        }
+
+#if SAVAGE_BCI_DEBUG
+        DRM_ERROR("failed!\n");
+        DRM_INFO("   status=0x%08x\n", status);
+#endif
+        return DRM_ERR(EBUSY);
+}
+
+/*
+ * Waiting for events.
+ *
+ * The BIOSresets the event tag to 0 on mode changes. Therefore we
+ * never emit 0 to the event tag. If we find a 0 event tag we know the
+ * BIOS stomped on it and return success assuming that the BIOS waited
+ * for engine idle.
+ *
+ * Note: if the Xserver uses the event tag it has to follow the same
+ * rule. Otherwise there may be glitches every 2^16 events.
+ */
+static int
+savage_bci_wait_event_shadow(drm_savage_private_t *dev_priv, uint16_t e)
+{
+        uint32_t status;
+        int i;
+
+        for (i = 0; i < SAVAGE_EVENT_USEC_TIMEOUT; i++) {
+                DRM_MEMORYBARRIER();
+                status = dev_priv->status_ptr[1];
+                if ((((status & 0xffff) - e) & 0xffff) <= 0x7fff ||
+                    (status & 0xffff) == 0)
+                        return 0;
+                DRM_UDELAY(1);
+        }
+
+#if SAVAGE_BCI_DEBUG
+        DRM_ERROR("failed!\n");
+        DRM_INFO("   status=0x%08x, e=0x%04x\n", status, e);
+#endif
+
+        return DRM_ERR(EBUSY);
+}
+
+static int
+savage_bci_wait_event_reg(drm_savage_private_t *dev_priv, uint16_t e)
+{
+        uint32_t status;
+        int i;
+
+        for (i = 0; i < SAVAGE_EVENT_USEC_TIMEOUT; i++) {
+                status = SAVAGE_READ(SAVAGE_STATUS_WORD1);
+                if ((((status & 0xffff) - e) & 0xffff) <= 0x7fff ||
+                    (status & 0xffff) == 0)
+                        return 0;
+                DRM_UDELAY(1);
+        }
+
+#if SAVAGE_BCI_DEBUG
+        DRM_ERROR("failed!\n");
+        DRM_INFO("   status=0x%08x, e=0x%04x\n", status, e);
+#endif
+
+        return DRM_ERR(EBUSY);
+}
+
+uint16_t savage_bci_emit_event(drm_savage_private_t *dev_priv,
+                               unsigned int flags)
+{
+        uint16_t count;
+        BCI_LOCALS;
+
+        if (dev_priv->status_ptr) {
+                /* coordinate with Xserver */
+                count = dev_priv->status_ptr[1023];
+                if (count < dev_priv->event_counter)
+                        dev_priv->event_wrap++;
+        } else {
+                count = dev_priv->event_counter;
+        }
+        count = (count + 1) & 0xffff;
+        if (count == 0) {
+                count++; /* See the comment above savage_wait_event_*. */
+                dev_priv->event_wrap++;
+        }
+        dev_priv->event_counter = count;
+        if (dev_priv->status_ptr)
+                dev_priv->status_ptr[1023] = (uint32_t)count;
+
+        if ((flags & (SAVAGE_WAIT_2D | SAVAGE_WAIT_3D))) {
+                unsigned int wait_cmd = BCI_CMD_WAIT;
+                if ((flags & SAVAGE_WAIT_2D))
+                        wait_cmd |= BCI_CMD_WAIT_2D;
+                if ((flags & SAVAGE_WAIT_3D))
+                        wait_cmd |= BCI_CMD_WAIT_3D;
+                BEGIN_BCI(2);
+                BCI_WRITE(wait_cmd);
+        } else {
+                BEGIN_BCI(1);
+        }
+        BCI_WRITE(BCI_CMD_UPDATE_EVENT_TAG | (uint32_t)count);
+
+        return count;
+}
+
+/*
+ * Freelist management
+ */
+static int savage_freelist_init(drm_device_t *dev)
+{
+        drm_savage_private_t *dev_priv = dev->dev_private;
+        drm_device_dma_t *dma = dev->dma;
+        drm_buf_t *buf;
+        drm_savage_buf_priv_t *entry;
+        int i;
+        DRM_DEBUG("count=%d\n", dma->buf_count);
+
+        dev_priv->head.next = &dev_priv->tail;
+        dev_priv->head.prev = NULL;
+        dev_priv->head.buf = NULL;
+
+        dev_priv->tail.next = NULL;
+        dev_priv->tail.prev = &dev_priv->head;
+        dev_priv->tail.buf = NULL;
+
+        for (i = 0; i < dma->buf_count; i++) {
+                buf = dma->buflist[i];
+                entry = buf->dev_private;
+
+                SET_AGE(&entry->age, 0, 0);
+                entry->buf = buf;
+
+                entry->next = dev_priv->head.next;
+                entry->prev = &dev_priv->head;
+                dev_priv->head.next->prev = entry;
+                dev_priv->head.next = entry;
+        }
+
+        return 0;
+}
+
+static drm_buf_t *savage_freelist_get(drm_device_t *dev)
+{
+        drm_savage_private_t *dev_priv = dev->dev_private;
+        drm_savage_buf_priv_t *tail = dev_priv->tail.prev;
+        uint16_t event;
+        unsigned int wrap;
+        DRM_DEBUG("\n");
+
+        UPDATE_EVENT_COUNTER();
+        if (dev_priv->status_ptr)
+                event = dev_priv->status_ptr[1] & 0xffff;
+        else
+                event = SAVAGE_READ(SAVAGE_STATUS_WORD1) & 0xffff;
+        wrap = dev_priv->event_wrap;
+        if (event > dev_priv->event_counter)
+                wrap--; /* hardware hasn't passed the last wrap yet */
+
+        DRM_DEBUG("   tail=0x%04x %d\n", tail->age.event, tail->age.wrap);
+        DRM_DEBUG("   head=0x%04x %d\n", event, wrap);
+
+        if (tail->buf && (TEST_AGE(&tail->age, event, wrap) || event == 0)) {
+                drm_savage_buf_priv_t *next = tail->next;
+                drm_savage_buf_priv_t *prev = tail->prev;
+                prev->next = next;
+                next->prev = prev;
+                tail->next = tail->prev = NULL;
+                return tail->buf;
+        }
+
+        DRM_DEBUG("returning NULL, tail->buf=%p!\n", tail->buf);
+        return NULL;
+}
+
+void savage_freelist_put(drm_device_t *dev, drm_buf_t *buf)
+{
+        drm_savage_private_t *dev_priv = dev->dev_private;
+        drm_savage_buf_priv_t *entry = buf->dev_private, *prev, *next;
+
+        DRM_DEBUG("age=0x%04x wrap=%d\n", entry->age.event, entry->age.wrap);
+
+        if (entry->next != NULL || entry->prev != NULL) {
+                DRM_ERROR("entry already on freelist.\n");
+                return;
+        }
+
+        prev = &dev_priv->head;
+        next = prev->next;
+        prev->next = entry;
+        next->prev = entry;
+        entry->prev = prev;
+        entry->next = next;
+}
+
+/*
+ * Command DMA
+ */
+static int savage_dma_init(drm_savage_private_t *dev_priv)
+{
+        unsigned int i;
+
+        dev_priv->nr_dma_pages = dev_priv->cmd_dma->size /
+                (SAVAGE_DMA_PAGE_SIZE*4);
+        dev_priv->dma_pages = drm_alloc(sizeof(drm_savage_dma_page_t) *
+                                        dev_priv->nr_dma_pages,
+                                        DRM_MEM_DRIVER);
+        if (dev_priv->dma_pages == NULL)
+                return DRM_ERR(ENOMEM);
+
+        for (i = 0; i < dev_priv->nr_dma_pages; ++i) {
+                SET_AGE(&dev_priv->dma_pages[i].age, 0, 0);
+                dev_priv->dma_pages[i].used = 0;
+                dev_priv->dma_pages[i].flushed = 0;
+        }
+        SET_AGE(&dev_priv->last_dma_age, 0, 0);
+
+        dev_priv->first_dma_page = 0;
+        dev_priv->current_dma_page = 0;
+
+        return 0;
+}
+
+void savage_dma_reset(drm_savage_private_t *dev_priv)
+{
+        uint16_t event;
+        unsigned int wrap, i;
+        event = savage_bci_emit_event(dev_priv, 0);
+        wrap = dev_priv->event_wrap;
+        for (i = 0; i < dev_priv->nr_dma_pages; ++i) {
+                SET_AGE(&dev_priv->dma_pages[i].age, event, wrap);
+                dev_priv->dma_pages[i].used = 0;
+                dev_priv->dma_pages[i].flushed = 0;
+        }
+        SET_AGE(&dev_priv->last_dma_age, event, wrap);
+        dev_priv->first_dma_page = dev_priv->current_dma_page = 0;
+}
+
+void savage_dma_wait(drm_savage_private_t *dev_priv, unsigned int page)
+{
+        uint16_t event;
+        unsigned int wrap;
+
+        /* Faked DMA buffer pages don't age. */
+        if (dev_priv->cmd_dma == &dev_priv->fake_dma)
+                return;
+
+        UPDATE_EVENT_COUNTER();
+        if (dev_priv->status_ptr)
+                event = dev_priv->status_ptr[1] & 0xffff;
+        else
+                event = SAVAGE_READ(SAVAGE_STATUS_WORD1) & 0xffff;
+        wrap = dev_priv->event_wrap;
+        if (event > dev_priv->event_counter)
+                wrap--; /* hardware hasn't passed the last wrap yet */
+
+        if (dev_priv->dma_pages[page].age.wrap > wrap ||
+            (dev_priv->dma_pages[page].age.wrap == wrap &&
+             dev_priv->dma_pages[page].age.event > event)) {
+                if (dev_priv->wait_evnt(dev_priv,
+                                        dev_priv->dma_pages[page].age.event)
+                    < 0)
+                        DRM_ERROR("wait_evnt failed!\n");
+        }
+}
+
+uint32_t *savage_dma_alloc(drm_savage_private_t *dev_priv, unsigned int n)
+{
+        unsigned int cur = dev_priv->current_dma_page;
+        unsigned int rest = SAVAGE_DMA_PAGE_SIZE -
+                dev_priv->dma_pages[cur].used;
+        unsigned int nr_pages = (n - rest + SAVAGE_DMA_PAGE_SIZE-1) /
+                SAVAGE_DMA_PAGE_SIZE;
+        uint32_t *dma_ptr;
+        unsigned int i;
+
+        DRM_DEBUG("cur=%u, cur->used=%u, n=%u, rest=%u, nr_pages=%u\n",
+                  cur, dev_priv->dma_pages[cur].used, n, rest, nr_pages);
+
+        if (cur + nr_pages < dev_priv->nr_dma_pages) {
+                dma_ptr = (uint32_t *)dev_priv->cmd_dma->handle +
+                        cur*SAVAGE_DMA_PAGE_SIZE +
+                        dev_priv->dma_pages[cur].used;
+                if (n < rest)
+                        rest = n;
+                dev_priv->dma_pages[cur].used += rest;
+                n -= rest;
+                cur++;
+        } else {
+                dev_priv->dma_flush(dev_priv);
+                nr_pages = (n + SAVAGE_DMA_PAGE_SIZE-1) / SAVAGE_DMA_PAGE_SIZE;
+                for (i = cur; i < dev_priv->nr_dma_pages; ++i) {
+                        dev_priv->dma_pages[i].age = dev_priv->last_dma_age;
+                        dev_priv->dma_pages[i].used = 0;
+                        dev_priv->dma_pages[i].flushed = 0;
+                }
+                dma_ptr = (uint32_t *)dev_priv->cmd_dma->handle;
+                dev_priv->first_dma_page = cur = 0;
+        }
+        for (i = cur; nr_pages > 0; ++i, --nr_pages) {
+#if SAVAGE_DMA_DEBUG
+                if (dev_priv->dma_pages[i].used) {
+                        DRM_ERROR("unflushed page %u: used=%u\n",
+                                  i, dev_priv->dma_pages[i].used);
+                }
+#endif
+                if (n > SAVAGE_DMA_PAGE_SIZE)
+                        dev_priv->dma_pages[i].used = SAVAGE_DMA_PAGE_SIZE;
+                else
+                        dev_priv->dma_pages[i].used = n;
+                n -= SAVAGE_DMA_PAGE_SIZE;
+        }
+        dev_priv->current_dma_page = --i;
+
+        DRM_DEBUG("cur=%u, cur->used=%u, n=%u\n",
+                  i, dev_priv->dma_pages[i].used, n);
+
+        savage_dma_wait(dev_priv, dev_priv->current_dma_page);
+
+        return dma_ptr;
+}
+
+static void savage_dma_flush(drm_savage_private_t *dev_priv)
+{
+        unsigned int first = dev_priv->first_dma_page;
+        unsigned int cur = dev_priv->current_dma_page;
+        uint16_t event;
+        unsigned int wrap, pad, align, len, i;
+        unsigned long phys_addr;
+        BCI_LOCALS;
+
+        if (first == cur &&
+            dev_priv->dma_pages[cur].used == dev_priv->dma_pages[cur].flushed)
+                return;
+
+        /* pad length to multiples of 2 entries
+         * align start of next DMA block to multiles of 8 entries */
+        pad = -dev_priv->dma_pages[cur].used & 1;
+        align = -(dev_priv->dma_pages[cur].used + pad) & 7;
+
+        DRM_DEBUG("first=%u, cur=%u, first->flushed=%u, cur->used=%u, "
+                  "pad=%u, align=%u\n",
+                  first, cur, dev_priv->dma_pages[first].flushed,
+                  dev_priv->dma_pages[cur].used, pad, align);
+
+        /* pad with noops */
+        if (pad) {
+                uint32_t *dma_ptr = (uint32_t *)dev_priv->cmd_dma->handle +
+                        cur * SAVAGE_DMA_PAGE_SIZE +
+                        dev_priv->dma_pages[cur].used;
+                dev_priv->dma_pages[cur].used += pad;
+                while(pad != 0) {
+                        *dma_ptr++ = BCI_CMD_WAIT;
+                        pad--;
+                }
+        }
+
+        DRM_MEMORYBARRIER();
+
+        /* do flush ... */
+        phys_addr = dev_priv->cmd_dma->offset +
+                (first * SAVAGE_DMA_PAGE_SIZE +
+                 dev_priv->dma_pages[first].flushed) * 4;
+        len = (cur - first) * SAVAGE_DMA_PAGE_SIZE +
+                dev_priv->dma_pages[cur].used -
+                dev_priv->dma_pages[first].flushed;
+
+        DRM_DEBUG("phys_addr=%lx, len=%u\n",
+                  phys_addr | dev_priv->dma_type, len);
+
+        BEGIN_BCI(3);
+        BCI_SET_REGISTERS(SAVAGE_DMABUFADDR, 1);
+        BCI_WRITE(phys_addr | dev_priv->dma_type);
+        BCI_DMA(len);
+
+        /* fix alignment of the start of the next block */
+        dev_priv->dma_pages[cur].used += align;
+
+        /* age DMA pages */
+        event = savage_bci_emit_event(dev_priv, 0);
+        wrap = dev_priv->event_wrap;
+        for (i = first; i < cur; ++i) {
+                SET_AGE(&dev_priv->dma_pages[i].age, event, wrap);
+                dev_priv->dma_pages[i].used = 0;
+                dev_priv->dma_pages[i].flushed = 0;
+        }
+        /* age the current page only when it's full */
+        if (dev_priv->dma_pages[cur].used == SAVAGE_DMA_PAGE_SIZE) {
+                SET_AGE(&dev_priv->dma_pages[cur].age, event, wrap);
+                dev_priv->dma_pages[cur].used = 0;
+                dev_priv->dma_pages[cur].flushed = 0;
+                /* advance to next page */
+                cur++;
+                if (cur == dev_priv->nr_dma_pages)
+                        cur = 0;
+                dev_priv->first_dma_page = dev_priv->current_dma_page = cur;
+        } else {
+                dev_priv->first_dma_page = cur;
+                dev_priv->dma_pages[cur].flushed = dev_priv->dma_pages[i].used;
+        }
+        SET_AGE(&dev_priv->last_dma_age, event, wrap);
+
+        DRM_DEBUG("first=cur=%u, cur->used=%u, cur->flushed=%u\n", cur,
+                  dev_priv->dma_pages[cur].used,
+                  dev_priv->dma_pages[cur].flushed);
+}
+
+static void savage_fake_dma_flush(drm_savage_private_t *dev_priv)
+{
+        unsigned int i, j;
+        BCI_LOCALS;
+
+        if (dev_priv->first_dma_page == dev_priv->current_dma_page &&
+            dev_priv->dma_pages[dev_priv->current_dma_page].used == 0)
+                return;
+
+        DRM_DEBUG("first=%u, cur=%u, cur->used=%u\n",
+                  dev_priv->first_dma_page, dev_priv->current_dma_page,
+                  dev_priv->dma_pages[dev_priv->current_dma_page].used);
+
+        for (i = dev_priv->first_dma_page;
+             i <= dev_priv->current_dma_page && dev_priv->dma_pages[i].used;
+             ++i) {
+                uint32_t *dma_ptr = (uint32_t *)dev_priv->cmd_dma->handle +
+                        i * SAVAGE_DMA_PAGE_SIZE;
+#if SAVAGE_DMA_DEBUG
+                /* Sanity check: all pages except the last one must be full. */
+                if (i < dev_priv->current_dma_page &&
+                    dev_priv->dma_pages[i].used != SAVAGE_DMA_PAGE_SIZE) {
+                        DRM_ERROR("partial DMA page %u: used=%u",
+                                  i, dev_priv->dma_pages[i].used);
+                }
+#endif
+                BEGIN_BCI(dev_priv->dma_pages[i].used);
+                for (j = 0; j < dev_priv->dma_pages[i].used; ++j) {
+                        BCI_WRITE(dma_ptr[j]);
+                }
+                dev_priv->dma_pages[i].used = 0;
+        }
+
+        /* reset to first page */
+        dev_priv->first_dma_page = dev_priv->current_dma_page = 0;
+}
+
+/*
+ * Initalize mappings. On Savage4 and SavageIX the alignment
+ * and size of the aperture is not suitable for automatic MTRR setup
+ * in drm_addmap. Therefore we do it manually before the maps are
+ * initialized. We also need to take care of deleting the MTRRs in
+ * postcleanup.
+ */
+int savage_preinit(drm_device_t *dev, unsigned long chipset)
+{
+        drm_savage_private_t *dev_priv;
+        unsigned long mmio_base, fb_base, fb_size, aperture_base;
+        /* fb_rsrc and aper_rsrc aren't really used currently, but still exist
+         * in case we decide we need information on the BAR for BSD in the
+         * future.
+         */
+        unsigned int fb_rsrc, aper_rsrc;
+        int ret = 0;
+
+        dev_priv = drm_alloc(sizeof(drm_savage_private_t), DRM_MEM_DRIVER);
+        if (dev_priv == NULL)
+                return DRM_ERR(ENOMEM);
+
+        memset(dev_priv, 0, sizeof(drm_savage_private_t));
+        dev->dev_private = (void *)dev_priv;
+        dev_priv->chipset = (enum savage_family)chipset;
+
+        dev_priv->mtrr[0].handle = -1;
+        dev_priv->mtrr[1].handle = -1;
+        dev_priv->mtrr[2].handle = -1;
+        if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
+                fb_rsrc = 0;
+                fb_base = drm_get_resource_start(dev, 0);
+                fb_size = SAVAGE_FB_SIZE_S3;
+                mmio_base = fb_base + SAVAGE_FB_SIZE_S3;
+                aper_rsrc = 0;
+                aperture_base = fb_base + SAVAGE_APERTURE_OFFSET;
+                /* this should always be true */
+                if (drm_get_resource_len(dev, 0) == 0x08000000) {
+                        /* Don't make MMIO write-cobining! We need 3
+                         * MTRRs. */
+                        dev_priv->mtrr[0].base = fb_base;
+                        dev_priv->mtrr[0].size = 0x01000000;
+                        dev_priv->mtrr[0].handle = mtrr_add(
+                                dev_priv->mtrr[0].base, dev_priv->mtrr[0].size,
+                                MTRR_TYPE_WRCOMB, 1);
+                        dev_priv->mtrr[1].base = fb_base+0x02000000;
+                        dev_priv->mtrr[1].size = 0x02000000;
+                        dev_priv->mtrr[1].handle = mtrr_add(
+                                dev_priv->mtrr[1].base, dev_priv->mtrr[1].size,
+                                MTRR_TYPE_WRCOMB, 1);
+                        dev_priv->mtrr[2].base = fb_base+0x04000000;
+                        dev_priv->mtrr[2].size = 0x04000000;
+                        dev_priv->mtrr[2].handle = mtrr_add(
+                                dev_priv->mtrr[2].base, dev_priv->mtrr[2].size,
+                                MTRR_TYPE_WRCOMB, 1);
+                } else {
+                        DRM_ERROR("strange pci_resource_len %08lx\n",
+                                  drm_get_resource_len(dev, 0));
+                }
+        } else if (chipset != S3_SUPERSAVAGE && chipset != S3_SAVAGE2000) {
+                mmio_base = drm_get_resource_start(dev, 0);
+                fb_rsrc = 1;
+                fb_base = drm_get_resource_start(dev, 1);
+                fb_size = SAVAGE_FB_SIZE_S4;
+                aper_rsrc = 1;
+                aperture_base = fb_base + SAVAGE_APERTURE_OFFSET;
+                /* this should always be true */
+                if (drm_get_resource_len(dev, 1) == 0x08000000) {
+                        /* Can use one MTRR to cover both fb and
+                         * aperture. */
+                        dev_priv->mtrr[0].base = fb_base;
+                        dev_priv->mtrr[0].size = 0x08000000;
+                        dev_priv->mtrr[0].handle = mtrr_add(
+                                dev_priv->mtrr[0].base, dev_priv->mtrr[0].size,
+                                MTRR_TYPE_WRCOMB, 1);
+                } else {
+                        DRM_ERROR("strange pci_resource_len %08lx\n",
+                                  drm_get_resource_len(dev, 1));
+                }
+        } else {
+                mmio_base = drm_get_resource_start(dev, 0);
+                fb_rsrc = 1;
+                fb_base = drm_get_resource_start(dev, 1);
+                fb_size = drm_get_resource_len(dev, 1);
+                aper_rsrc = 2;
+                aperture_base = drm_get_resource_start(dev, 2);
+                /* Automatic MTRR setup will do the right thing. */
+        }
+
+        ret = drm_addmap(dev, mmio_base, SAVAGE_MMIO_SIZE, _DRM_REGISTERS,
+                         _DRM_READ_ONLY, &dev_priv->mmio);
+        if (ret)
+                return ret;
+
+        ret = drm_addmap(dev, fb_base, fb_size, _DRM_FRAME_BUFFER,
+                         _DRM_WRITE_COMBINING, &dev_priv->fb);
+        if (ret)
+                return ret;
+
+        ret = drm_addmap(dev, aperture_base, SAVAGE_APERTURE_SIZE,
+                         _DRM_FRAME_BUFFER, _DRM_WRITE_COMBINING,
+                         &dev_priv->aperture);
+        if (ret)
+                return ret;
+
+        return ret;
+}
+
+/*
+ * Delete MTRRs and free device-private data.
+ */
+int savage_postcleanup(drm_device_t *dev)
+{
+        drm_savage_private_t *dev_priv = dev->dev_private;
+        int i;
+
+        for (i = 0; i < 3; ++i)
+                if (dev_priv->mtrr[i].handle >= 0)
+                        mtrr_del(dev_priv->mtrr[i].handle,
+                                 dev_priv->mtrr[i].base,
+                                 dev_priv->mtrr[i].size);
+
+        drm_free(dev_priv, sizeof(drm_savage_private_t), DRM_MEM_DRIVER);
+
+        return 0;
+}
+
+static int savage_do_init_bci(drm_device_t *dev, drm_savage_init_t *init)
+{
+        drm_savage_private_t *dev_priv = dev->dev_private;
+
+        if (init->fb_bpp != 16 && init->fb_bpp != 32) {
+                DRM_ERROR("invalid frame buffer bpp %d!\n", init->fb_bpp);
+                return DRM_ERR(EINVAL);
+        }
+        if (init->depth_bpp != 16 && init->depth_bpp != 32) {
+                DRM_ERROR("invalid depth buffer bpp %d!\n", init->fb_bpp);
+                return DRM_ERR(EINVAL);
+        }
+        if (init->dma_type != SAVAGE_DMA_AGP &&
+            init->dma_type != SAVAGE_DMA_PCI) {
+                DRM_ERROR("invalid dma memory type %d!\n", init->dma_type);
+                return DRM_ERR(EINVAL);
+        }
+
+        dev_priv->cob_size = init->cob_size;
+        dev_priv->bci_threshold_lo = init->bci_threshold_lo;
+        dev_priv->bci_threshold_hi = init->bci_threshold_hi;
+        dev_priv->dma_type = init->dma_type;
+
+        dev_priv->fb_bpp = init->fb_bpp;
+        dev_priv->front_offset = init->front_offset;
+        dev_priv->front_pitch = init->front_pitch;
+        dev_priv->back_offset = init->back_offset;
+        dev_priv->back_pitch = init->back_pitch;
+        dev_priv->depth_bpp = init->depth_bpp;
+        dev_priv->depth_offset = init->depth_offset;
+        dev_priv->depth_pitch = init->depth_pitch;
+
+        dev_priv->texture_offset = init->texture_offset;
+        dev_priv->texture_size = init->texture_size;
+
+        DRM_GETSAREA();
+        if (!dev_priv->sarea) {
+                DRM_ERROR("could not find sarea!\n");
+                savage_do_cleanup_bci(dev);
+                return DRM_ERR(EINVAL);
+        }
+        if (init->status_offset != 0) {
+                dev_priv->status = drm_core_findmap(dev, init->status_offset);
+                if (!dev_priv->status) {
+                        DRM_ERROR("could not find shadow status region!\n");
+                        savage_do_cleanup_bci(dev);
+                        return DRM_ERR(EINVAL);
+                }
+        } else {
+                dev_priv->status = NULL;
+        }
+        if (dev_priv->dma_type == SAVAGE_DMA_AGP && init->buffers_offset) {
+                dev->agp_buffer_map = drm_core_findmap(dev,
+                                                       init->buffers_offset);
+                if (!dev->agp_buffer_map) {
+                        DRM_ERROR("could not find DMA buffer region!\n");
+                        savage_do_cleanup_bci(dev);
+                        return DRM_ERR(EINVAL);
+                }
+                drm_core_ioremap(dev->agp_buffer_map, dev);
+                if (!dev->agp_buffer_map) {
+                        DRM_ERROR("failed to ioremap DMA buffer region!\n");
+                        savage_do_cleanup_bci(dev);
+                        return DRM_ERR(ENOMEM);
+                }
+        }
+        if (init->agp_textures_offset) {
+                dev_priv->agp_textures =
+                        drm_core_findmap(dev, init->agp_textures_offset);
+                if (!dev_priv->agp_textures) {
+                        DRM_ERROR("could not find agp texture region!\n");
+                        savage_do_cleanup_bci(dev);
+                        return DRM_ERR(EINVAL);
+                }
+        } else {
+                dev_priv->agp_textures = NULL;
+        }
+
+        if (init->cmd_dma_offset) {
+                if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
+                        DRM_ERROR("command DMA not supported on "
+                                  "Savage3D/MX/IX.\n");
+                        savage_do_cleanup_bci(dev);
+                        return DRM_ERR(EINVAL);
+                }
+                if (dev->dma && dev->dma->buflist) {
+                        DRM_ERROR("command and vertex DMA not supported "
+                                  "at the same time.\n");
+                        savage_do_cleanup_bci(dev);
+                        return DRM_ERR(EINVAL);
+                }
+                dev_priv->cmd_dma = drm_core_findmap(dev, init->cmd_dma_offset);
+                if (!dev_priv->cmd_dma) {
+                        DRM_ERROR("could not find command DMA region!\n");
+                        savage_do_cleanup_bci(dev);
+                        return DRM_ERR(EINVAL);
+                }
+                if (dev_priv->dma_type == SAVAGE_DMA_AGP) {
+                        if (dev_priv->cmd_dma->type != _DRM_AGP) {
+                                DRM_ERROR("AGP command DMA region is not a "
+                                          "_DRM_AGP map!\n");
+                                savage_do_cleanup_bci(dev);
+                                return DRM_ERR(EINVAL);
+                        }
+                        drm_core_ioremap(dev_priv->cmd_dma, dev);
+                        if (!dev_priv->cmd_dma->handle) {
+                                DRM_ERROR("failed to ioremap command "
+                                          "DMA region!\n");
+                                savage_do_cleanup_bci(dev);
+                                return DRM_ERR(ENOMEM);
+                        }
+                } else if (dev_priv->cmd_dma->type != _DRM_CONSISTENT) {
+                        DRM_ERROR("PCI command DMA region is not a "
+                                  "_DRM_CONSISTENT map!\n");
+                        savage_do_cleanup_bci(dev);
+                        return DRM_ERR(EINVAL);
+                }
+        } else {
+                dev_priv->cmd_dma = NULL;
+        }
+
+        dev_priv->dma_flush = savage_dma_flush;
+        if (!dev_priv->cmd_dma) {
+                DRM_DEBUG("falling back to faked command DMA.\n");
+                dev_priv->fake_dma.offset = 0;
+                dev_priv->fake_dma.size = SAVAGE_FAKE_DMA_SIZE;
+                dev_priv->fake_dma.type = _DRM_SHM;
+                dev_priv->fake_dma.handle = drm_alloc(SAVAGE_FAKE_DMA_SIZE,
+                                                      DRM_MEM_DRIVER);
+                if (!dev_priv->fake_dma.handle) {
+                        DRM_ERROR("could not allocate faked DMA buffer!\n");
+                        savage_do_cleanup_bci(dev);
+                        return DRM_ERR(ENOMEM);
+                }
+                dev_priv->cmd_dma = &dev_priv->fake_dma;
+                dev_priv->dma_flush = savage_fake_dma_flush;
+        }
+
+        dev_priv->sarea_priv =
+                (drm_savage_sarea_t *)((uint8_t *)dev_priv->sarea->handle +
+                                       init->sarea_priv_offset);
+
+        /* setup bitmap descriptors */
+        {
+                unsigned int color_tile_format;
+                unsigned int depth_tile_format;
+                unsigned int front_stride, back_stride, depth_stride;
+                if (dev_priv->chipset <= S3_SAVAGE4) {
+                        color_tile_format = dev_priv->fb_bpp == 16 ?
+                                SAVAGE_BD_TILE_16BPP : SAVAGE_BD_TILE_32BPP;
+                        depth_tile_format = dev_priv->depth_bpp == 16 ?
+                                SAVAGE_BD_TILE_16BPP : SAVAGE_BD_TILE_32BPP;
+                } else {
+                        color_tile_format = SAVAGE_BD_TILE_DEST;
+                        depth_tile_format = SAVAGE_BD_TILE_DEST;
+                }
+                front_stride = dev_priv->front_pitch / (dev_priv->fb_bpp/8);
+                back_stride  = dev_priv-> back_pitch / (dev_priv->fb_bpp/8);
+                depth_stride = dev_priv->depth_pitch / (dev_priv->depth_bpp/8);
+
+                dev_priv->front_bd = front_stride | SAVAGE_BD_BW_DISABLE |
+                        (dev_priv->fb_bpp << SAVAGE_BD_BPP_SHIFT) |
+                        (color_tile_format << SAVAGE_BD_TILE_SHIFT);
+
+                dev_priv-> back_bd =  back_stride | SAVAGE_BD_BW_DISABLE |
+                        (dev_priv->fb_bpp << SAVAGE_BD_BPP_SHIFT) |
+                        (color_tile_format << SAVAGE_BD_TILE_SHIFT);
+
+                dev_priv->depth_bd = depth_stride | SAVAGE_BD_BW_DISABLE |
+                        (dev_priv->depth_bpp << SAVAGE_BD_BPP_SHIFT) |
+                        (depth_tile_format << SAVAGE_BD_TILE_SHIFT);
+        }
+
+        /* setup status and bci ptr */
+        dev_priv->event_counter = 0;
+        dev_priv->event_wrap = 0;
+        dev_priv->bci_ptr = (volatile uint32_t *)
+            ((uint8_t *)dev_priv->mmio->handle + SAVAGE_BCI_OFFSET);
+        if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
+                dev_priv->status_used_mask = SAVAGE_FIFO_USED_MASK_S3D;
+        } else {
+                dev_priv->status_used_mask = SAVAGE_FIFO_USED_MASK_S4;
+        }
+        if (dev_priv->status != NULL) {
+                dev_priv->status_ptr =
+                        (volatile uint32_t *)dev_priv->status->handle;
+                dev_priv->wait_fifo = savage_bci_wait_fifo_shadow;
+                dev_priv->wait_evnt = savage_bci_wait_event_shadow;
+                dev_priv->status_ptr[1023] = dev_priv->event_counter;
+        } else {
+                dev_priv->status_ptr = NULL;
+                if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
+                        dev_priv->wait_fifo = savage_bci_wait_fifo_s3d;
+                } else {
+                        dev_priv->wait_fifo = savage_bci_wait_fifo_s4;
+                }
+                dev_priv->wait_evnt = savage_bci_wait_event_reg;
+        }
+
+        /* cliprect functions */
+        if (S3_SAVAGE3D_SERIES(dev_priv->chipset))
+                dev_priv->emit_clip_rect = savage_emit_clip_rect_s3d;
+        else
+                dev_priv->emit_clip_rect = savage_emit_clip_rect_s4;
+
+        if (savage_freelist_init(dev) < 0) {
+                DRM_ERROR("could not initialize freelist\n");
+                savage_do_cleanup_bci(dev);
+                return DRM_ERR(ENOMEM);
+        }
+
+        if (savage_dma_init(dev_priv) <  0) {
+                DRM_ERROR("could not initialize command DMA\n");
+                savage_do_cleanup_bci(dev);
+                return DRM_ERR(ENOMEM);
+        }
+
+        return 0;
+}
+
+int savage_do_cleanup_bci(drm_device_t *dev)
+{
+        drm_savage_private_t *dev_priv = dev->dev_private;
+
+        if (dev_priv->cmd_dma == &dev_priv->fake_dma) {
+                if (dev_priv->fake_dma.handle)
+                        drm_free(dev_priv->fake_dma.handle,
+                                 SAVAGE_FAKE_DMA_SIZE, DRM_MEM_DRIVER);
+        } else if (dev_priv->cmd_dma && dev_priv->cmd_dma->handle &&
+                   dev_priv->cmd_dma->type == _DRM_AGP &&
+                   dev_priv->dma_type == SAVAGE_DMA_AGP)
+                drm_core_ioremapfree(dev_priv->cmd_dma, dev);
+
+        if (dev_priv->dma_type == SAVAGE_DMA_AGP &&
+            dev->agp_buffer_map && dev->agp_buffer_map->handle) {
+                drm_core_ioremapfree(dev->agp_buffer_map, dev);
+                /* make sure the next instance (which may be running
+                 * in PCI mode) doesn't try to use an old
+                 * agp_buffer_map. */
+                dev->agp_buffer_map = NULL;
+        }
+
+        if (dev_priv->dma_pages)
+                drm_free(dev_priv->dma_pages,
+                         sizeof(drm_savage_dma_page_t)*dev_priv->nr_dma_pages,
+                         DRM_MEM_DRIVER);
+
+        return 0;
+}
+
+static int savage_bci_init(DRM_IOCTL_ARGS)
+{
+        DRM_DEVICE;
+        drm_savage_init_t init;
+
+        LOCK_TEST_WITH_RETURN(dev, filp);
+
+        DRM_COPY_FROM_USER_IOCTL(init, (drm_savage_init_t __user *)data,
+                                 sizeof(init));
+
+        switch (init.func) {
+        case SAVAGE_INIT_BCI:
+                return savage_do_init_bci(dev, &init);
+        case SAVAGE_CLEANUP_BCI:
+                return savage_do_cleanup_bci(dev);
+        }
+
+        return DRM_ERR(EINVAL);
+}
+
+static int savage_bci_event_emit(DRM_IOCTL_ARGS)
+{
+        DRM_DEVICE;
+        drm_savage_private_t *dev_priv = dev->dev_private;
+        drm_savage_event_emit_t event;
+
+        DRM_DEBUG("\n");
+
+        LOCK_TEST_WITH_RETURN(dev, filp);
+
+        DRM_COPY_FROM_USER_IOCTL(event, (drm_savage_event_emit_t __user *)data,
+                                 sizeof(event));
+
+        event.count = savage_bci_emit_event(dev_priv, event.flags);
+        event.count |= dev_priv->event_wrap << 16;
+        DRM_COPY_TO_USER_IOCTL(&((drm_savage_event_emit_t __user *)data)->count,
+                               event.count, sizeof(event.count));
+        return 0;
+}
+
+static int savage_bci_event_wait(DRM_IOCTL_ARGS)
+{
+        DRM_DEVICE;
+        drm_savage_private_t *dev_priv = dev->dev_private;
+        drm_savage_event_wait_t event;
+        unsigned int event_e, hw_e;
+        unsigned int event_w, hw_w;
+
+        DRM_DEBUG("\n");
+
+        DRM_COPY_FROM_USER_IOCTL(event, (drm_savage_event_wait_t __user *)data,
+                                 sizeof(event));
+
+        UPDATE_EVENT_COUNTER();
+        if (dev_priv->status_ptr)
+                hw_e = dev_priv->status_ptr[1] & 0xffff;
+        else
+                hw_e = SAVAGE_READ(SAVAGE_STATUS_WORD1) & 0xffff;
+        hw_w = dev_priv->event_wrap;
+        if (hw_e > dev_priv->event_counter)
+                hw_w--; /* hardware hasn't passed the last wrap yet */
+
+        event_e = event.count & 0xffff;
+        event_w = event.count >> 16;
+
+        /* Don't need to wait if
+         * - event counter wrapped since the event was emitted or
+         * - the hardware has advanced up to or over the event to wait for.
+         */
+        if (event_w < hw_w || (event_w == hw_w && event_e <= hw_e) )
+                return 0;
+        else
+                return dev_priv->wait_evnt(dev_priv, event_e);
+}
+
+/*
+ * DMA buffer management
+ */
+
+static int savage_bci_get_buffers(DRMFILE filp, drm_device_t *dev, drm_dma_t *d)
+{
+        drm_buf_t *buf;
+        int i;
+
+        for (i = d->granted_count; i < d->request_count; i++) {
+                buf = savage_freelist_get(dev);
+                if (!buf)
+                        return DRM_ERR(EAGAIN);
+
+                buf->filp = filp;
+
+                if (DRM_COPY_TO_USER(&d->request_indices[i],
+                                     &buf->idx, sizeof(buf->idx)))
+                        return DRM_ERR(EFAULT);
+                if (DRM_COPY_TO_USER(&d->request_sizes[i],
+                                     &buf->total, sizeof(buf->total)))
+                        return DRM_ERR(EFAULT);
+
+                d->granted_count++;
+        }
+        return 0;
+}
+
+int savage_bci_buffers(DRM_IOCTL_ARGS)
+{
+        DRM_DEVICE;
+        drm_device_dma_t *dma = dev->dma;
+        drm_dma_t d;
+        int ret = 0;
+
+        LOCK_TEST_WITH_RETURN(dev, filp);
+
+        DRM_COPY_FROM_USER_IOCTL(d, (drm_dma_t __user *)data, sizeof(d));
+
+        /* Please don't send us buffers.
+         */
+        if (d.send_count != 0) {
+                DRM_ERROR("Process %d trying to send %d buffers via drmDMA\n",
+                          DRM_CURRENTPID, d.send_count);
+                return DRM_ERR(EINVAL);
+        }
+
+        /* We'll send you buffers.
+         */
+        if (d.request_count < 0 || d.request_count > dma->buf_count) {
+                DRM_ERROR("Process %d trying to get %d buffers (of %d max)\n",
+                          DRM_CURRENTPID, d.request_count, dma->buf_count);
+                return DRM_ERR(EINVAL);
+        }
+
+        d.granted_count = 0;
+
+        if (d.request_count) {
+                ret = savage_bci_get_buffers(filp, dev, &d);
+        }
+
+        DRM_COPY_TO_USER_IOCTL((drm_dma_t __user *)data, d, sizeof(d));
+
+        return ret;
+}
+
+void savage_reclaim_buffers(drm_device_t *dev, DRMFILE filp) {
+        drm_device_dma_t *dma = dev->dma;
+        drm_savage_private_t *dev_priv = dev->dev_private;
+        int i;
+
+        if (!dma)
+                return;
+        if (!dev_priv)
+                return;
+        if (!dma->buflist)
+                return;
+
+        /*i830_flush_queue(dev);*/
+
+        for (i = 0; i < dma->buf_count; i++) {
+                drm_buf_t *buf = dma->buflist[i];
+                drm_savage_buf_priv_t *buf_priv = buf->dev_private;
+
+                if (buf->filp == filp && buf_priv &&
+                    buf_priv->next == NULL && buf_priv->prev == NULL) {
+                        uint16_t event;
+                        DRM_DEBUG("reclaimed from client\n");
+                        event = savage_bci_emit_event(dev_priv, SAVAGE_WAIT_3D);
+                        SET_AGE(&buf_priv->age, event, dev_priv->event_wrap);
+                        savage_freelist_put(dev, buf);
+                }
+        }
+
+        drm_core_reclaim_buffers(dev, filp);
+}
+
+
+drm_ioctl_desc_t savage_ioctls[] = {
+        [DRM_IOCTL_NR(DRM_SAVAGE_BCI_INIT)] = {savage_bci_init, 1, 1},
+        [DRM_IOCTL_NR(DRM_SAVAGE_BCI_CMDBUF)] = {savage_bci_cmdbuf, 1, 0},
+        [DRM_IOCTL_NR(DRM_SAVAGE_BCI_EVENT_EMIT)] = {savage_bci_event_emit, 1, 0},
+        [DRM_IOCTL_NR(DRM_SAVAGE_BCI_EVENT_WAIT)] = {savage_bci_event_wait, 1, 0},
+};
+
+int savage_max_ioctl = DRM_ARRAY_SIZE(savage_ioctls);
diff --git a/drivers/char/drm/savage_drm.h b/drivers/char/drm/savage_drm.h
new file mode 100644
index 000000000000..6526c9aa7589
--- /dev/null
+++ b/drivers/char/drm/savage_drm.h
@@ -0,0 +1,209 @@
+/* savage_drm.h -- Public header for the savage driver
+ *
+ * Copyright 2004  Felix Kuehling
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sub license,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NON-INFRINGEMENT. IN NO EVENT SHALL FELIX KUEHLING BE LIABLE FOR
+ * ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
+ * CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef __SAVAGE_DRM_H__
+#define __SAVAGE_DRM_H__
+
+#ifndef __SAVAGE_SAREA_DEFINES__
+#define __SAVAGE_SAREA_DEFINES__
+
+/* 2 heaps (1 for card, 1 for agp), each divided into upto 128
+ * regions, subject to a minimum region size of (1<<16) == 64k.
+ *
+ * Clients may subdivide regions internally, but when sharing between
+ * clients, the region size is the minimum granularity.
+ */
+
+#define SAVAGE_CARD_HEAP                0
+#define SAVAGE_AGP_HEAP                 1
+#define SAVAGE_NR_TEX_HEAPS             2
+#define SAVAGE_NR_TEX_REGIONS           16
+#define SAVAGE_LOG_MIN_TEX_REGION_SIZE  16
+
+#endif /* __SAVAGE_SAREA_DEFINES__ */
+
+typedef struct _drm_savage_sarea {
+        /* LRU lists for texture memory in agp space and on the card.
+         */
+        drm_tex_region_t texList[SAVAGE_NR_TEX_HEAPS][SAVAGE_NR_TEX_REGIONS+1];
+        unsigned int texAge[SAVAGE_NR_TEX_HEAPS];
+
+        /* Mechanism to validate card state.
+         */
+        int ctxOwner;
+} drm_savage_sarea_t, *drm_savage_sarea_ptr;
+
+/* Savage-specific ioctls
+ */
+#define DRM_SAVAGE_BCI_INIT             0x00
+#define DRM_SAVAGE_BCI_CMDBUF           0x01
+#define DRM_SAVAGE_BCI_EVENT_EMIT       0x02
+#define DRM_SAVAGE_BCI_EVENT_WAIT       0x03
+
+#define DRM_IOCTL_SAVAGE_INIT           DRM_IOW( DRM_COMMAND_BASE + DRM_SAVAGE_BCI_INIT, drm_savage_init_t)
+#define DRM_IOCTL_SAVAGE_CMDBUF         DRM_IOW( DRM_COMMAND_BASE + DRM_SAVAGE_BCI_CMDBUF, drm_savage_cmdbuf_t)
+#define DRM_IOCTL_SAVAGE_EVENT_EMIT     DRM_IOWR(DRM_COMMAND_BASE + DRM_SAVAGE_BCI_EVENT_EMIT, drm_savage_event_emit_t)
+#define DRM_IOCTL_SAVAGE_EVENT_WAIT     DRM_IOW( DRM_COMMAND_BASE + DRM_SAVAGE_BCI_EVENT_WAIT, drm_savage_event_wait_t)
+
+#define SAVAGE_DMA_PCI  1
+#define SAVAGE_DMA_AGP  3
+typedef struct drm_savage_init {
+        enum {
+                SAVAGE_INIT_BCI = 1,
+                SAVAGE_CLEANUP_BCI = 2
+        } func;
+        unsigned int sarea_priv_offset;
+
+        /* some parameters */
+        unsigned int cob_size;
+        unsigned int bci_threshold_lo, bci_threshold_hi;
+        unsigned int dma_type;
+
+        /* frame buffer layout */
+        unsigned int fb_bpp;
+        unsigned int front_offset, front_pitch;
+        unsigned int back_offset, back_pitch;
+        unsigned int depth_bpp;
+        unsigned int depth_offset, depth_pitch;
+
+        /* local textures */
+        unsigned int texture_offset;
+        unsigned int texture_size;
+
+        /* physical locations of non-permanent maps */
+        unsigned long status_offset;
+        unsigned long buffers_offset;
+        unsigned long agp_textures_offset;
+        unsigned long cmd_dma_offset;
+} drm_savage_init_t;
+
+typedef union drm_savage_cmd_header drm_savage_cmd_header_t;
+typedef struct drm_savage_cmdbuf {
+                                /* command buffer in client's address space */
+        drm_savage_cmd_header_t __user *cmd_addr;
+        unsigned int size;      /* size of the command buffer in 64bit units */
+
+        unsigned int dma_idx;   /* DMA buffer index to use */
+        int discard;            /* discard DMA buffer when done */
+                                /* vertex buffer in client's address space */
+        unsigned int __user *vb_addr;
+        unsigned int vb_size;   /* size of client vertex buffer in bytes */
+        unsigned int vb_stride; /* stride of vertices in 32bit words */
+                                /* boxes in client's address space */
+        drm_clip_rect_t __user *box_addr;
+        unsigned int nbox;      /* number of clipping boxes */
+} drm_savage_cmdbuf_t;
+
+#define SAVAGE_WAIT_2D  0x1 /* wait for 2D idle before updating event tag */
+#define SAVAGE_WAIT_3D  0x2 /* wait for 3D idle before updating event tag */
+#define SAVAGE_WAIT_IRQ 0x4 /* emit or wait for IRQ, not implemented yet */
+typedef struct drm_savage_event {
+        unsigned int count;
+        unsigned int flags;
+} drm_savage_event_emit_t, drm_savage_event_wait_t;
+
+/* Commands for the cmdbuf ioctl
+ */
+#define SAVAGE_CMD_STATE        0  /* a range of state registers */
+#define SAVAGE_CMD_DMA_PRIM     1  /* vertices from DMA buffer */
+#define SAVAGE_CMD_VB_PRIM      2  /* vertices from client vertex buffer */
+#define SAVAGE_CMD_DMA_IDX      3  /* indexed vertices from DMA buffer */
+#define SAVAGE_CMD_VB_IDX       4  /* indexed vertices client vertex buffer */
+#define SAVAGE_CMD_CLEAR        5  /* clear buffers */
+#define SAVAGE_CMD_SWAP         6  /* swap buffers */
+
+/* Primitive types
+*/
+#define SAVAGE_PRIM_TRILIST     0  /* triangle list */
+#define SAVAGE_PRIM_TRISTRIP    1  /* triangle strip */
+#define SAVAGE_PRIM_TRIFAN      2  /* triangle fan */
+#define SAVAGE_PRIM_TRILIST_201 3  /* reorder verts for correct flat
+                                    * shading on s3d */
+
+/* Skip flags (vertex format)
+ */
+#define SAVAGE_SKIP_Z           0x01
+#define SAVAGE_SKIP_W           0x02
+#define SAVAGE_SKIP_C0          0x04
+#define SAVAGE_SKIP_C1          0x08
+#define SAVAGE_SKIP_S0          0x10
+#define SAVAGE_SKIP_T0          0x20
+#define SAVAGE_SKIP_ST0         0x30
+#define SAVAGE_SKIP_S1          0x40
+#define SAVAGE_SKIP_T1          0x80
+#define SAVAGE_SKIP_ST1         0xc0
+#define SAVAGE_SKIP_ALL_S3D     0x3f
+#define SAVAGE_SKIP_ALL_S4      0xff
+
+/* Buffer names for clear command
+ */
+#define SAVAGE_FRONT            0x1
+#define SAVAGE_BACK             0x2
+#define SAVAGE_DEPTH            0x4
+
+/* 64-bit command header
+ */
+union drm_savage_cmd_header {
+        struct {
+                unsigned char cmd;      /* command */
+                unsigned char pad0;
+                unsigned short pad1;
+                unsigned short pad2;
+                unsigned short pad3;
+        } cmd; /* generic */
+        struct {
+                unsigned char cmd;
+                unsigned char global;   /* need idle engine? */
+                unsigned short count;   /* number of consecutive registers */
+                unsigned short start;   /* first register */
+                unsigned short pad3;
+        } state; /* SAVAGE_CMD_STATE */
+        struct {
+                unsigned char cmd;
+                unsigned char prim;     /* primitive type */
+                unsigned short skip;    /* vertex format (skip flags) */
+                unsigned short count;   /* number of vertices */
+                unsigned short start;   /* first vertex in DMA/vertex buffer */
+        } prim; /* SAVAGE_CMD_DMA_PRIM, SAVAGE_CMD_VB_PRIM */
+        struct {
+                unsigned char cmd;
+                unsigned char prim;
+                unsigned short skip;
+                unsigned short count;   /* number of indices that follow */
+                unsigned short pad3;
+        } idx; /* SAVAGE_CMD_DMA_IDX, SAVAGE_CMD_VB_IDX */
+        struct {
+                unsigned char cmd;
+                unsigned char pad0;
+                unsigned short pad1;
+                unsigned int flags;
+        } clear0; /* SAVAGE_CMD_CLEAR */
+        struct {
+                unsigned int mask;
+                unsigned int value;
+        } clear1; /* SAVAGE_CMD_CLEAR data */
+};
+
+#endif
diff --git a/drivers/char/drm/savage_drv.c b/drivers/char/drm/savage_drv.c
new file mode 100644
index 000000000000..ac8d270427ca
--- /dev/null
+++ b/drivers/char/drm/savage_drv.c
@@ -0,0 +1,112 @@
+/* savage_drv.c -- Savage driver for Linux
+ *
+ * Copyright 2004  Felix Kuehling
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sub license,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NON-INFRINGEMENT. IN NO EVENT SHALL FELIX KUEHLING BE LIABLE FOR
+ * ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
+ * CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <linux/config.h>
+#include "drmP.h"
+#include "savage_drm.h"
+#include "savage_drv.h"
+
+#include "drm_pciids.h"
+
+static int postinit( struct drm_device *dev, unsigned long flags )
+{
+        DRM_INFO( "Initialized %s %d.%d.%d %s on minor %d: %s\n",
+                DRIVER_NAME,
+                DRIVER_MAJOR,
+                DRIVER_MINOR,
+                DRIVER_PATCHLEVEL,
+                DRIVER_DATE,
+                dev->primary.minor,
+                pci_pretty_name(dev->pdev)
+                );
+        return 0;
+}
+
+static int version( drm_version_t *version )
+{
+        int len;
+
+        version->version_major = DRIVER_MAJOR;
+        version->version_minor = DRIVER_MINOR;
+        version->version_patchlevel = DRIVER_PATCHLEVEL;
+        DRM_COPY( version->name, DRIVER_NAME );
+        DRM_COPY( version->date, DRIVER_DATE );
+        DRM_COPY( version->desc, DRIVER_DESC );
+        return 0;
+}
+
+static struct pci_device_id pciidlist[] = {
+        savage_PCI_IDS
+};
+
+extern drm_ioctl_desc_t savage_ioctls[];
+extern int savage_max_ioctl;
+
+static struct drm_driver driver = {
+        .driver_features =
+            DRIVER_USE_AGP | DRIVER_USE_MTRR |
+            DRIVER_HAVE_DMA | DRIVER_PCI_DMA,
+        .dev_priv_size = sizeof(drm_savage_buf_priv_t),
+        .preinit = savage_preinit,
+        .postinit = postinit,
+        .postcleanup = savage_postcleanup,
+        .reclaim_buffers = savage_reclaim_buffers,
+        .get_map_ofs = drm_core_get_map_ofs,
+        .get_reg_ofs = drm_core_get_reg_ofs,
+        .version = version,
+        .ioctls = savage_ioctls,
+        .dma_ioctl = savage_bci_buffers,
+        .fops = {
+                .owner   = THIS_MODULE,
+                .open    = drm_open,
+                .release = drm_release,
+                .ioctl   = drm_ioctl,
+                .mmap    = drm_mmap,
+                .poll = drm_poll,
+                .fasync  = drm_fasync,
+        },
+        .pci_driver = {
+                .name          = DRIVER_NAME,
+                .id_table      = pciidlist,
+        }
+};
+
+static int __init savage_init(void)
+{
+        driver.num_ioctls = savage_max_ioctl;
+        return drm_init(&driver);
+}
+
+static void __exit savage_exit(void)
+{
+        drm_exit(&driver);
+}
+
+module_init(savage_init);
+module_exit(savage_exit);
+
+MODULE_AUTHOR( DRIVER_AUTHOR );
+MODULE_DESCRIPTION( DRIVER_DESC );
+MODULE_LICENSE("GPL and additional rights");
diff --git a/drivers/char/drm/savage_drv.h b/drivers/char/drm/savage_drv.h
new file mode 100644
index 000000000000..a45434944658
--- /dev/null
+++ b/drivers/char/drm/savage_drv.h
@@ -0,0 +1,579 @@
+/* savage_drv.h -- Private header for the savage driver
+ *
+ * Copyright 2004  Felix Kuehling
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sub license,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NON-INFRINGEMENT. IN NO EVENT SHALL FELIX KUEHLING BE LIABLE FOR
+ * ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
+ * CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef __SAVAGE_DRV_H__
+#define __SAVAGE_DRV_H__
+
+#define DRIVER_AUTHOR   "Felix Kuehling"
+
+#define DRIVER_NAME     "savage"
+#define DRIVER_DESC     "Savage3D/MX/IX, Savage4, SuperSavage, Twister, ProSavage[DDR]"
+#define DRIVER_DATE     "20050313"
+
+#define DRIVER_MAJOR            2
+#define DRIVER_MINOR            4
+#define DRIVER_PATCHLEVEL       1
+/* Interface history:
+ *
+ * 1.x   The DRM driver from the VIA/S3 code drop, basically a dummy
+ * 2.0   The first real DRM
+ * 2.1   Scissors registers managed by the DRM, 3D operations clipped by
+ *       cliprects of the cmdbuf ioctl
+ * 2.2   Implemented SAVAGE_CMD_DMA_IDX and SAVAGE_CMD_VB_IDX
+ * 2.3   Event counters used by BCI_EVENT_EMIT/WAIT ioctls are now 32 bits
+ *       wide and thus very long lived (unlikely to ever wrap). The size
+ *       in the struct was 32 bits before, but only 16 bits were used
+ * 2.4   Implemented command DMA. Now drm_savage_init_t.cmd_dma_offset is
+ *       actually used
+ */
+
+typedef struct drm_savage_age {
+        uint16_t event;
+        unsigned int wrap;
+} drm_savage_age_t;
+
+typedef struct drm_savage_buf_priv {
+        struct drm_savage_buf_priv *next;
+        struct drm_savage_buf_priv *prev;
+        drm_savage_age_t age;
+        drm_buf_t *buf;
+} drm_savage_buf_priv_t;
+
+typedef struct drm_savage_dma_page {
+        drm_savage_age_t age;
+        unsigned int used, flushed;
+} drm_savage_dma_page_t;
+#define SAVAGE_DMA_PAGE_SIZE 1024 /* in dwords */
+/* Fake DMA buffer size in bytes. 4 pages. Allows a maximum command
+ * size of 16kbytes or 4k entries. Minimum requirement would be
+ * 10kbytes for 255 40-byte vertices in one drawing command. */
+#define SAVAGE_FAKE_DMA_SIZE (SAVAGE_DMA_PAGE_SIZE*4*4)
+
+/* interesting bits of hardware state that are saved in dev_priv */
+typedef union {
+        struct drm_savage_common_state {
+                uint32_t vbaddr;
+        } common;
+        struct {
+                unsigned char pad[sizeof(struct drm_savage_common_state)];
+                uint32_t texctrl, texaddr;
+                uint32_t scstart, new_scstart;
+                uint32_t scend, new_scend;
+        } s3d;
+        struct {
+                unsigned char pad[sizeof(struct drm_savage_common_state)];
+                uint32_t texdescr, texaddr0, texaddr1;
+                uint32_t drawctrl0, new_drawctrl0;
+                uint32_t drawctrl1, new_drawctrl1;
+        } s4;
+} drm_savage_state_t;
+
+/* these chip tags should match the ones in the 2D driver in savage_regs.h. */
+enum savage_family {
+        S3_UNKNOWN = 0,
+        S3_SAVAGE3D,
+        S3_SAVAGE_MX,
+        S3_SAVAGE4,
+        S3_PROSAVAGE,
+        S3_TWISTER,
+        S3_PROSAVAGEDDR,
+        S3_SUPERSAVAGE,
+        S3_SAVAGE2000,
+        S3_LAST
+};
+
+#define S3_SAVAGE3D_SERIES(chip)  ((chip>=S3_SAVAGE3D) && (chip<=S3_SAVAGE_MX))
+
+#define S3_SAVAGE4_SERIES(chip)  ((chip==S3_SAVAGE4)            \
+                                  || (chip==S3_PROSAVAGE)       \
+                                  || (chip==S3_TWISTER)         \
+                                  || (chip==S3_PROSAVAGEDDR))
+
+#define S3_SAVAGE_MOBILE_SERIES(chip)   ((chip==S3_SAVAGE_MX) || (chip==S3_SUPERSAVAGE))
+
+#define S3_SAVAGE_SERIES(chip)    ((chip>=S3_SAVAGE3D) && (chip<=S3_SAVAGE2000))
+
+#define S3_MOBILE_TWISTER_SERIES(chip)   ((chip==S3_TWISTER)    \
+                                          ||(chip==S3_PROSAVAGEDDR))
+
+/* flags */
+#define SAVAGE_IS_AGP 1
+
+typedef struct drm_savage_private {
+        drm_savage_sarea_t *sarea_priv;
+
+        drm_savage_buf_priv_t head, tail;
+
+        /* who am I? */
+        enum savage_family chipset;
+
+        unsigned int cob_size;
+        unsigned int bci_threshold_lo, bci_threshold_hi;
+        unsigned int dma_type;
+
+        /* frame buffer layout */
+        unsigned int fb_bpp;
+        unsigned int front_offset, front_pitch;
+        unsigned int back_offset, back_pitch;
+        unsigned int depth_bpp;
+        unsigned int depth_offset, depth_pitch;
+
+        /* bitmap descriptors for swap and clear */
+        unsigned int front_bd, back_bd, depth_bd;
+
+        /* local textures */
+        unsigned int texture_offset;
+        unsigned int texture_size;
+
+        /* memory regions in physical memory */
+        drm_local_map_t *sarea;
+        drm_local_map_t *mmio;
+        drm_local_map_t *fb;
+        drm_local_map_t *aperture;
+        drm_local_map_t *status;
+        drm_local_map_t *agp_textures;
+        drm_local_map_t *cmd_dma;
+        drm_local_map_t fake_dma;
+
+        struct {
+                int handle;
+                unsigned long base, size;
+        } mtrr[3];
+
+        /* BCI and status-related stuff */
+        volatile uint32_t *status_ptr, *bci_ptr;
+        uint32_t status_used_mask;
+        uint16_t event_counter;
+        unsigned int event_wrap;
+
+        /* Savage4 command DMA */
+        drm_savage_dma_page_t *dma_pages;
+        unsigned int nr_dma_pages, first_dma_page, current_dma_page;
+        drm_savage_age_t last_dma_age;
+
+        /* saved hw state for global/local check on S3D */
+        uint32_t hw_draw_ctrl, hw_zbuf_ctrl;
+        /* and for scissors (global, so don't emit if not changed) */
+        uint32_t hw_scissors_start, hw_scissors_end;
+
+        drm_savage_state_t state;
+
+        /* after emitting a wait cmd Savage3D needs 63 nops before next DMA */
+        unsigned int waiting;
+
+        /* config/hardware-dependent function pointers */
+        int (*wait_fifo)(struct drm_savage_private *dev_priv, unsigned int n);
+        int (*wait_evnt)(struct drm_savage_private *dev_priv, uint16_t e);
+        /* Err, there is a macro wait_event in include/linux/wait.h.
+         * Avoid unwanted macro expansion. */
+        void (*emit_clip_rect)(struct drm_savage_private *dev_priv,
+                               drm_clip_rect_t *pbox);
+        void (*dma_flush)(struct drm_savage_private *dev_priv);
+} drm_savage_private_t;
+
+/* ioctls */
+extern int savage_bci_cmdbuf(DRM_IOCTL_ARGS);
+extern int savage_bci_buffers(DRM_IOCTL_ARGS);
+
+/* BCI functions */
+extern uint16_t savage_bci_emit_event(drm_savage_private_t *dev_priv,
+                                      unsigned int flags);
+extern void savage_freelist_put(drm_device_t *dev, drm_buf_t *buf);
+extern void savage_dma_reset(drm_savage_private_t *dev_priv);
+extern void savage_dma_wait(drm_savage_private_t *dev_priv, unsigned int page);
+extern uint32_t *savage_dma_alloc(drm_savage_private_t *dev_priv,
+                                  unsigned int n);
+extern int savage_preinit(drm_device_t *dev, unsigned long chipset);
+extern int savage_postcleanup(drm_device_t *dev);
+extern int savage_do_cleanup_bci(drm_device_t *dev);
+extern void savage_reclaim_buffers(drm_device_t *dev, DRMFILE filp);
+
+/* state functions */
+extern void savage_emit_clip_rect_s3d(drm_savage_private_t *dev_priv,
+                                      drm_clip_rect_t *pbox);
+extern void savage_emit_clip_rect_s4(drm_savage_private_t *dev_priv,
+                                     drm_clip_rect_t *pbox);
+
+#define SAVAGE_FB_SIZE_S3       0x01000000      /*  16MB */
+#define SAVAGE_FB_SIZE_S4       0x02000000      /*  32MB */
+#define SAVAGE_MMIO_SIZE        0x00080000      /* 512kB */
+#define SAVAGE_APERTURE_OFFSET  0x02000000      /*  32MB */
+#define SAVAGE_APERTURE_SIZE    0x05000000      /* 5 tiled surfaces, 16MB each */
+
+#define SAVAGE_BCI_OFFSET       0x00010000      /* offset of the BCI region
+                                                 * inside the MMIO region */
+#define SAVAGE_BCI_FIFO_SIZE    32              /* number of entries in on-chip
+                                                 * BCI FIFO */
+
+/*
+ * MMIO registers
+ */
+#define SAVAGE_STATUS_WORD0             0x48C00
+#define SAVAGE_STATUS_WORD1             0x48C04
+#define SAVAGE_ALT_STATUS_WORD0         0x48C60
+
+#define SAVAGE_FIFO_USED_MASK_S3D       0x0001ffff
+#define SAVAGE_FIFO_USED_MASK_S4        0x001fffff
+
+/* Copied from savage_bci.h in the 2D driver with some renaming. */
+
+/* Bitmap descriptors */
+#define SAVAGE_BD_STRIDE_SHIFT 0
+#define SAVAGE_BD_BPP_SHIFT   16
+#define SAVAGE_BD_TILE_SHIFT  24
+#define SAVAGE_BD_BW_DISABLE  (1<<28)
+/* common: */
+#define SAVAGE_BD_TILE_LINEAR           0
+/* savage4, MX, IX, 3D */
+#define SAVAGE_BD_TILE_16BPP            2
+#define SAVAGE_BD_TILE_32BPP            3
+/* twister, prosavage, DDR, supersavage, 2000 */
+#define SAVAGE_BD_TILE_DEST             1
+#define SAVAGE_BD_TILE_TEXTURE          2
+/* GBD - BCI enable */
+/* savage4, MX, IX, 3D */
+#define SAVAGE_GBD_BCI_ENABLE                    8
+/* twister, prosavage, DDR, supersavage, 2000 */
+#define SAVAGE_GBD_BCI_ENABLE_TWISTER            0
+
+#define SAVAGE_GBD_BIG_ENDIAN                    4
+#define SAVAGE_GBD_LITTLE_ENDIAN                 0
+#define SAVAGE_GBD_64                            1
+
+/*  Global Bitmap Descriptor */
+#define SAVAGE_BCI_GLB_BD_LOW             0x8168
+#define SAVAGE_BCI_GLB_BD_HIGH            0x816C
+
+/*
+ * BCI registers
+ */
+/* Savage4/Twister/ProSavage 3D registers */
+#define SAVAGE_DRAWLOCALCTRL_S4         0x1e
+#define SAVAGE_TEXPALADDR_S4            0x1f
+#define SAVAGE_TEXCTRL0_S4              0x20
+#define SAVAGE_TEXCTRL1_S4              0x21
+#define SAVAGE_TEXADDR0_S4              0x22
+#define SAVAGE_TEXADDR1_S4              0x23
+#define SAVAGE_TEXBLEND0_S4             0x24
+#define SAVAGE_TEXBLEND1_S4             0x25
+#define SAVAGE_TEXXPRCLR_S4             0x26 /* never used */
+#define SAVAGE_TEXDESCR_S4              0x27
+#define SAVAGE_FOGTABLE_S4              0x28
+#define SAVAGE_FOGCTRL_S4               0x30
+#define SAVAGE_STENCILCTRL_S4           0x31
+#define SAVAGE_ZBUFCTRL_S4              0x32
+#define SAVAGE_ZBUFOFF_S4               0x33
+#define SAVAGE_DESTCTRL_S4              0x34
+#define SAVAGE_DRAWCTRL0_S4             0x35
+#define SAVAGE_DRAWCTRL1_S4             0x36
+#define SAVAGE_ZWATERMARK_S4            0x37
+#define SAVAGE_DESTTEXRWWATERMARK_S4    0x38
+#define SAVAGE_TEXBLENDCOLOR_S4         0x39
+/* Savage3D/MX/IX 3D registers */
+#define SAVAGE_TEXPALADDR_S3D           0x18
+#define SAVAGE_TEXXPRCLR_S3D            0x19 /* never used */
+#define SAVAGE_TEXADDR_S3D              0x1A
+#define SAVAGE_TEXDESCR_S3D             0x1B
+#define SAVAGE_TEXCTRL_S3D              0x1C
+#define SAVAGE_FOGTABLE_S3D             0x20
+#define SAVAGE_FOGCTRL_S3D              0x30
+#define SAVAGE_DRAWCTRL_S3D             0x31
+#define SAVAGE_ZBUFCTRL_S3D             0x32
+#define SAVAGE_ZBUFOFF_S3D              0x33
+#define SAVAGE_DESTCTRL_S3D             0x34
+#define SAVAGE_SCSTART_S3D              0x35
+#define SAVAGE_SCEND_S3D                0x36
+#define SAVAGE_ZWATERMARK_S3D           0x37 
+#define SAVAGE_DESTTEXRWWATERMARK_S3D   0x38
+/* common stuff */
+#define SAVAGE_VERTBUFADDR              0x3e
+#define SAVAGE_BITPLANEWTMASK           0xd7
+#define SAVAGE_DMABUFADDR               0x51
+
+/* texture enable bits (needed for tex addr checking) */
+#define SAVAGE_TEXCTRL_TEXEN_MASK       0x00010000 /* S3D */
+#define SAVAGE_TEXDESCR_TEX0EN_MASK     0x02000000 /* S4 */
+#define SAVAGE_TEXDESCR_TEX1EN_MASK     0x04000000 /* S4 */
+
+/* Global fields in Savage4/Twister/ProSavage 3D registers:
+ *
+ * All texture registers and DrawLocalCtrl are local. All other
+ * registers are global. */
+
+/* Global fields in Savage3D/MX/IX 3D registers:
+ *
+ * All texture registers are local. DrawCtrl and ZBufCtrl are
+ * partially local. All other registers are global.
+ *
+ * DrawCtrl global fields: cullMode, alphaTestCmpFunc, alphaTestEn, alphaRefVal
+ * ZBufCtrl global fields: zCmpFunc, zBufEn
+ */
+#define SAVAGE_DRAWCTRL_S3D_GLOBAL      0x03f3c00c
+#define SAVAGE_ZBUFCTRL_S3D_GLOBAL      0x00000027
+
+/* Masks for scissor bits (drawCtrl[01] on s4, scissorStart/End on s3d)
+ */
+#define SAVAGE_SCISSOR_MASK_S4          0x00fff7ff
+#define SAVAGE_SCISSOR_MASK_S3D         0x07ff07ff
+
+/*
+ * BCI commands
+ */
+#define BCI_CMD_NOP                  0x40000000
+#define BCI_CMD_RECT                 0x48000000
+#define BCI_CMD_RECT_XP              0x01000000
+#define BCI_CMD_RECT_YP              0x02000000
+#define BCI_CMD_SCANLINE             0x50000000
+#define BCI_CMD_LINE                 0x5C000000
+#define BCI_CMD_LINE_LAST_PIXEL      0x58000000
+#define BCI_CMD_BYTE_TEXT            0x63000000
+#define BCI_CMD_NT_BYTE_TEXT         0x67000000
+#define BCI_CMD_BIT_TEXT             0x6C000000
+#define BCI_CMD_GET_ROP(cmd)         (((cmd) >> 16) & 0xFF)
+#define BCI_CMD_SET_ROP(cmd, rop)    ((cmd) |= ((rop & 0xFF) << 16))
+#define BCI_CMD_SEND_COLOR           0x00008000
+
+#define BCI_CMD_CLIP_NONE            0x00000000
+#define BCI_CMD_CLIP_CURRENT         0x00002000
+#define BCI_CMD_CLIP_LR              0x00004000
+#define BCI_CMD_CLIP_NEW             0x00006000
+
+#define BCI_CMD_DEST_GBD             0x00000000
+#define BCI_CMD_DEST_PBD             0x00000800
+#define BCI_CMD_DEST_PBD_NEW         0x00000C00
+#define BCI_CMD_DEST_SBD             0x00001000
+#define BCI_CMD_DEST_SBD_NEW         0x00001400
+
+#define BCI_CMD_SRC_TRANSPARENT      0x00000200
+#define BCI_CMD_SRC_SOLID            0x00000000
+#define BCI_CMD_SRC_GBD              0x00000020
+#define BCI_CMD_SRC_COLOR            0x00000040
+#define BCI_CMD_SRC_MONO             0x00000060
+#define BCI_CMD_SRC_PBD_COLOR        0x00000080
+#define BCI_CMD_SRC_PBD_MONO         0x000000A0
+#define BCI_CMD_SRC_PBD_COLOR_NEW    0x000000C0
+#define BCI_CMD_SRC_PBD_MONO_NEW     0x000000E0
+#define BCI_CMD_SRC_SBD_COLOR        0x00000100
+#define BCI_CMD_SRC_SBD_MONO         0x00000120
+#define BCI_CMD_SRC_SBD_COLOR_NEW    0x00000140
+#define BCI_CMD_SRC_SBD_MONO_NEW     0x00000160
+
+#define BCI_CMD_PAT_TRANSPARENT      0x00000010
+#define BCI_CMD_PAT_NONE             0x00000000
+#define BCI_CMD_PAT_COLOR            0x00000002
+#define BCI_CMD_PAT_MONO             0x00000003
+#define BCI_CMD_PAT_PBD_COLOR        0x00000004
+#define BCI_CMD_PAT_PBD_MONO         0x00000005
+#define BCI_CMD_PAT_PBD_COLOR_NEW    0x00000006
+#define BCI_CMD_PAT_PBD_MONO_NEW     0x00000007
+#define BCI_CMD_PAT_SBD_COLOR        0x00000008
+#define BCI_CMD_PAT_SBD_MONO         0x00000009
+#define BCI_CMD_PAT_SBD_COLOR_NEW    0x0000000A
+#define BCI_CMD_PAT_SBD_MONO_NEW     0x0000000B
+
+#define BCI_BD_BW_DISABLE            0x10000000
+#define BCI_BD_TILE_MASK             0x03000000
+#define BCI_BD_TILE_NONE             0x00000000
+#define BCI_BD_TILE_16               0x02000000
+#define BCI_BD_TILE_32               0x03000000
+#define BCI_BD_GET_BPP(bd)           (((bd) >> 16) & 0xFF)
+#define BCI_BD_SET_BPP(bd, bpp)      ((bd) |= (((bpp) & 0xFF) << 16))
+#define BCI_BD_GET_STRIDE(bd)        ((bd) & 0xFFFF)
+#define BCI_BD_SET_STRIDE(bd, st)    ((bd) |= ((st) & 0xFFFF))
+
+#define BCI_CMD_SET_REGISTER            0x96000000
+
+#define BCI_CMD_WAIT                    0xC0000000
+#define BCI_CMD_WAIT_3D                 0x00010000
+#define BCI_CMD_WAIT_2D                 0x00020000
+
+#define BCI_CMD_UPDATE_EVENT_TAG        0x98000000
+
+#define BCI_CMD_DRAW_PRIM               0x80000000
+#define BCI_CMD_DRAW_INDEXED_PRIM       0x88000000
+#define BCI_CMD_DRAW_CONT               0x01000000
+#define BCI_CMD_DRAW_TRILIST            0x00000000
+#define BCI_CMD_DRAW_TRISTRIP           0x02000000
+#define BCI_CMD_DRAW_TRIFAN             0x04000000
+#define BCI_CMD_DRAW_SKIPFLAGS          0x000000ff
+#define BCI_CMD_DRAW_NO_Z               0x00000001
+#define BCI_CMD_DRAW_NO_W               0x00000002
+#define BCI_CMD_DRAW_NO_CD              0x00000004
+#define BCI_CMD_DRAW_NO_CS              0x00000008
+#define BCI_CMD_DRAW_NO_U0              0x00000010
+#define BCI_CMD_DRAW_NO_V0              0x00000020
+#define BCI_CMD_DRAW_NO_UV0             0x00000030
+#define BCI_CMD_DRAW_NO_U1              0x00000040
+#define BCI_CMD_DRAW_NO_V1              0x00000080
+#define BCI_CMD_DRAW_NO_UV1             0x000000c0
+
+#define BCI_CMD_DMA                     0xa8000000
+
+#define BCI_W_H(w, h)                ((((h) << 16) | (w)) & 0x0FFF0FFF)
+#define BCI_X_Y(x, y)                ((((y) << 16) | (x)) & 0x0FFF0FFF)
+#define BCI_X_W(x, y)                ((((w) << 16) | (x)) & 0x0FFF0FFF)
+#define BCI_CLIP_LR(l, r)            ((((r) << 16) | (l)) & 0x0FFF0FFF)
+#define BCI_CLIP_TL(t, l)            ((((t) << 16) | (l)) & 0x0FFF0FFF)
+#define BCI_CLIP_BR(b, r)            ((((b) << 16) | (r)) & 0x0FFF0FFF)
+
+#define BCI_LINE_X_Y(x, y)           (((y) << 16) | ((x) & 0xFFFF))
+#define BCI_LINE_STEPS(diag, axi)    (((axi) << 16) | ((diag) & 0xFFFF))
+#define BCI_LINE_MISC(maj, ym, xp, yp, err) \
+        (((maj) & 0x1FFF) | \
+        ((ym) ? 1<<13 : 0) | \
+        ((xp) ? 1<<14 : 0) | \
+        ((yp) ? 1<<15 : 0) | \
+        ((err) << 16))
+
+/*
+ * common commands
+ */
+#define BCI_SET_REGISTERS( first, n )                   \
+        BCI_WRITE(BCI_CMD_SET_REGISTER |                \
+                  ((uint32_t)(n) & 0xff) << 16 |        \
+                  ((uint32_t)(first) & 0xffff))
+#define DMA_SET_REGISTERS( first, n )                   \
+        DMA_WRITE(BCI_CMD_SET_REGISTER |                \
+                  ((uint32_t)(n) & 0xff) << 16 |        \
+                  ((uint32_t)(first) & 0xffff))
+
+#define BCI_DRAW_PRIMITIVE(n, type, skip)         \
+        BCI_WRITE(BCI_CMD_DRAW_PRIM | (type) | (skip) | \
+                  ((n) << 16))
+#define DMA_DRAW_PRIMITIVE(n, type, skip)         \
+        DMA_WRITE(BCI_CMD_DRAW_PRIM | (type) | (skip) | \
+                  ((n) << 16))
+
+#define BCI_DRAW_INDICES_S3D(n, type, i0)         \
+        BCI_WRITE(BCI_CMD_DRAW_INDEXED_PRIM | (type) |  \
+                  ((n) << 16) | (i0))
+
+#define BCI_DRAW_INDICES_S4(n, type, skip)        \
+        BCI_WRITE(BCI_CMD_DRAW_INDEXED_PRIM | (type) |  \
+                  (skip) | ((n) << 16))
+
+#define BCI_DMA(n)      \
+        BCI_WRITE(BCI_CMD_DMA | (((n) >> 1) - 1))
+
+/*
+ * access to MMIO
+ */
+#define SAVAGE_READ(reg)        DRM_READ32(  dev_priv->mmio, (reg) )
+#define SAVAGE_WRITE(reg)       DRM_WRITE32( dev_priv->mmio, (reg) )
+
+/*
+ * access to the burst command interface (BCI)
+ */
+#define SAVAGE_BCI_DEBUG 1
+
+#define BCI_LOCALS    volatile uint32_t *bci_ptr;
+
+#define BEGIN_BCI( n ) do {                     \
+        dev_priv->wait_fifo(dev_priv, (n));     \
+        bci_ptr = dev_priv->bci_ptr;            \
+} while(0)
+
+#define BCI_WRITE( val ) *bci_ptr++ = (uint32_t)(val)
+
+#define BCI_COPY_FROM_USER(src,n) do {                          \
+    unsigned int i;                                             \
+    for (i = 0; i < n; ++i) {                                   \
+        uint32_t val;                                           \
+        DRM_GET_USER_UNCHECKED(val, &((uint32_t*)(src))[i]);    \
+        BCI_WRITE(val);                                         \
+    }                                                           \
+} while(0)
+
+/*
+ * command DMA support
+ */
+#define SAVAGE_DMA_DEBUG 1
+
+#define DMA_LOCALS   uint32_t *dma_ptr;
+
+#define BEGIN_DMA( n ) do {                                             \
+        unsigned int cur = dev_priv->current_dma_page;                  \
+        unsigned int rest = SAVAGE_DMA_PAGE_SIZE -                      \
+                dev_priv->dma_pages[cur].used;                          \
+        if ((n) > rest) {                                               \
+                dma_ptr = savage_dma_alloc(dev_priv, (n));              \
+        } else { /* fast path for small allocations */                  \
+                dma_ptr = (uint32_t *)dev_priv->cmd_dma->handle +       \
+                        cur * SAVAGE_DMA_PAGE_SIZE +                    \
+                        dev_priv->dma_pages[cur].used;                  \
+                if (dev_priv->dma_pages[cur].used == 0)                 \
+                        savage_dma_wait(dev_priv, cur);                 \
+                dev_priv->dma_pages[cur].used += (n);                   \
+        }                                                               \
+} while(0)
+
+#define DMA_WRITE( val ) *dma_ptr++ = (uint32_t)(val)
+
+#define DMA_COPY_FROM_USER(src,n) do {                          \
+        DRM_COPY_FROM_USER_UNCHECKED(dma_ptr, (src), (n)*4);    \
+        dma_ptr += n;                                           \
+} while(0)
+
+#if SAVAGE_DMA_DEBUG
+#define DMA_COMMIT() do {                                               \
+        unsigned int cur = dev_priv->current_dma_page;                  \
+        uint32_t *expected = (uint32_t *)dev_priv->cmd_dma->handle +    \
+                        cur * SAVAGE_DMA_PAGE_SIZE +                    \
+                        dev_priv->dma_pages[cur].used;                  \
+        if (dma_ptr != expected) {                                      \
+                DRM_ERROR("DMA allocation and use don't match: "        \
+                          "%p != %p\n", expected, dma_ptr);             \
+                savage_dma_reset(dev_priv);                             \
+        }                                                               \
+} while(0)
+#else
+#define DMA_COMMIT() do {/* nothing */} while(0)
+#endif
+
+#define DMA_FLUSH() dev_priv->dma_flush(dev_priv)
+
+/* Buffer aging via event tag
+ */
+
+#define UPDATE_EVENT_COUNTER( ) do {                    \
+        if (dev_priv->status_ptr) {                     \
+                uint16_t count;                         \
+                /* coordinate with Xserver */           \
+                count = dev_priv->status_ptr[1023];     \
+                if (count < dev_priv->event_counter)    \
+                        dev_priv->event_wrap++;         \
+                dev_priv->event_counter = count;        \
+        }                                               \
+} while(0)
+
+#define SET_AGE( age, e, w ) do {       \
+        (age)->event = e;               \
+        (age)->wrap = w;                \
+} while(0)
+
+#define TEST_AGE( age, e, w )                           \
+        ( (age)->wrap < (w) || ( (age)->wrap == (w) && (age)->event <= (e) ) )
+
+#endif /* __SAVAGE_DRV_H__ */
diff --git a/drivers/char/drm/savage_state.c b/drivers/char/drm/savage_state.c
new file mode 100644
index 000000000000..475695a00083
--- /dev/null
+++ b/drivers/char/drm/savage_state.c
@@ -0,0 +1,1146 @@
+/* savage_state.c -- State and drawing support for Savage
+ *
+ * Copyright 2004  Felix Kuehling
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sub license,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NON-INFRINGEMENT. IN NO EVENT SHALL FELIX KUEHLING BE LIABLE FOR
+ * ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
+ * CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+#include "drmP.h"
+#include "savage_drm.h"
+#include "savage_drv.h"
+
+void savage_emit_clip_rect_s3d(drm_savage_private_t *dev_priv,
+                               drm_clip_rect_t *pbox)
+{
+        uint32_t scstart = dev_priv->state.s3d.new_scstart;
+        uint32_t scend   = dev_priv->state.s3d.new_scend;
+        scstart = (scstart & ~SAVAGE_SCISSOR_MASK_S3D) |
+                ((uint32_t)pbox->x1 & 0x000007ff) | 
+                (((uint32_t)pbox->y1 << 16) & 0x07ff0000);
+        scend   = (scend   & ~SAVAGE_SCISSOR_MASK_S3D) |
+                (((uint32_t)pbox->x2-1) & 0x000007ff) |
+                ((((uint32_t)pbox->y2-1) << 16) & 0x07ff0000);
+        if (scstart != dev_priv->state.s3d.scstart ||
+            scend   != dev_priv->state.s3d.scend) {
+                DMA_LOCALS;
+                BEGIN_DMA(4);
+                DMA_WRITE(BCI_CMD_WAIT|BCI_CMD_WAIT_3D);
+                DMA_SET_REGISTERS(SAVAGE_SCSTART_S3D, 2);
+                DMA_WRITE(scstart);
+                DMA_WRITE(scend);
+                dev_priv->state.s3d.scstart = scstart;
+                dev_priv->state.s3d.scend   = scend;
+                dev_priv->waiting = 1;
+                DMA_COMMIT();
+        }
+}
+
+void savage_emit_clip_rect_s4(drm_savage_private_t *dev_priv,
+                              drm_clip_rect_t *pbox)
+{
+        uint32_t drawctrl0 = dev_priv->state.s4.new_drawctrl0;
+        uint32_t drawctrl1 = dev_priv->state.s4.new_drawctrl1;
+        drawctrl0 = (drawctrl0 & ~SAVAGE_SCISSOR_MASK_S4) |
+                ((uint32_t)pbox->x1 & 0x000007ff) |
+                (((uint32_t)pbox->y1 << 12) & 0x00fff000);
+        drawctrl1 = (drawctrl1 & ~SAVAGE_SCISSOR_MASK_S4) |
+                (((uint32_t)pbox->x2-1) & 0x000007ff) |
+                ((((uint32_t)pbox->y2-1) << 12) & 0x00fff000);
+        if (drawctrl0 != dev_priv->state.s4.drawctrl0 ||
+            drawctrl1 != dev_priv->state.s4.drawctrl1) {
+                DMA_LOCALS;
+                BEGIN_DMA(4);
+                DMA_WRITE(BCI_CMD_WAIT|BCI_CMD_WAIT_3D);
+                DMA_SET_REGISTERS(SAVAGE_DRAWCTRL0_S4, 2);
+                DMA_WRITE(drawctrl0);
+                DMA_WRITE(drawctrl1);
+                dev_priv->state.s4.drawctrl0 = drawctrl0;
+                dev_priv->state.s4.drawctrl1 = drawctrl1;
+                dev_priv->waiting = 1;
+                DMA_COMMIT();
+        }
+}
+
+static int savage_verify_texaddr(drm_savage_private_t *dev_priv, int unit,
+                                 uint32_t addr)
+{
+        if ((addr & 6) != 2) { /* reserved bits */
+                DRM_ERROR("bad texAddr%d %08x (reserved bits)\n", unit, addr);
+                return DRM_ERR(EINVAL);
+        }
+        if (!(addr & 1)) { /* local */
+                addr &= ~7;
+                if (addr <  dev_priv->texture_offset ||
+                    addr >= dev_priv->texture_offset+dev_priv->texture_size) {
+                        DRM_ERROR("bad texAddr%d %08x (local addr out of range)\n",
+                                  unit, addr);
+                        return DRM_ERR(EINVAL);
+                }
+        } else { /* AGP */
+                if (!dev_priv->agp_textures) {
+                        DRM_ERROR("bad texAddr%d %08x (AGP not available)\n",
+                                  unit, addr);
+                        return DRM_ERR(EINVAL);
+                }
+                addr &= ~7;
+                if (addr < dev_priv->agp_textures->offset ||
+                    addr >= (dev_priv->agp_textures->offset +
+                             dev_priv->agp_textures->size)) {
+                        DRM_ERROR("bad texAddr%d %08x (AGP addr out of range)\n",
+                                  unit, addr);
+                        return DRM_ERR(EINVAL);
+                }
+        }
+        return 0;
+}
+
+#define SAVE_STATE(reg,where)                   \
+        if(start <= reg && start+count > reg)   \
+                DRM_GET_USER_UNCHECKED(dev_priv->state.where, &regs[reg-start])
+#define SAVE_STATE_MASK(reg,where,mask) do {                    \
+        if(start <= reg && start+count > reg) {                 \
+                uint32_t tmp;                                   \
+                DRM_GET_USER_UNCHECKED(tmp, &regs[reg-start]);  \
+                dev_priv->state.where = (tmp & (mask)) |        \
+                        (dev_priv->state.where & ~(mask));      \
+        }                                                       \
+} while (0)
+static int savage_verify_state_s3d(drm_savage_private_t *dev_priv,
+                                   unsigned int start, unsigned int count,
+                                   const uint32_t __user *regs)
+{
+        if (start < SAVAGE_TEXPALADDR_S3D ||
+            start+count-1 > SAVAGE_DESTTEXRWWATERMARK_S3D) {
+                DRM_ERROR("invalid register range (0x%04x-0x%04x)\n",
+                          start, start+count-1);
+                return DRM_ERR(EINVAL);
+        }
+
+        SAVE_STATE_MASK(SAVAGE_SCSTART_S3D, s3d.new_scstart,
+                        ~SAVAGE_SCISSOR_MASK_S3D);
+        SAVE_STATE_MASK(SAVAGE_SCEND_S3D, s3d.new_scend,
+                        ~SAVAGE_SCISSOR_MASK_S3D);
+
+        /* if any texture regs were changed ... */
+        if (start <= SAVAGE_TEXCTRL_S3D &&
+            start+count > SAVAGE_TEXPALADDR_S3D) {
+                /* ... check texture state */
+                SAVE_STATE(SAVAGE_TEXCTRL_S3D, s3d.texctrl);
+                SAVE_STATE(SAVAGE_TEXADDR_S3D, s3d.texaddr);
+                if (dev_priv->state.s3d.texctrl & SAVAGE_TEXCTRL_TEXEN_MASK)
+                        return savage_verify_texaddr(
+                                dev_priv, 0, dev_priv->state.s3d.texaddr);
+        }
+
+        return 0;
+}
+
+static int savage_verify_state_s4(drm_savage_private_t *dev_priv,
+                                  unsigned int start, unsigned int count,
+                                  const uint32_t __user *regs)
+{
+        int ret = 0;
+
+        if (start < SAVAGE_DRAWLOCALCTRL_S4 ||
+            start+count-1 > SAVAGE_TEXBLENDCOLOR_S4) {
+                DRM_ERROR("invalid register range (0x%04x-0x%04x)\n",
+                          start, start+count-1);
+                return DRM_ERR(EINVAL);
+        }
+
+        SAVE_STATE_MASK(SAVAGE_DRAWCTRL0_S4, s4.new_drawctrl0,
+                        ~SAVAGE_SCISSOR_MASK_S4);
+        SAVE_STATE_MASK(SAVAGE_DRAWCTRL1_S4, s4.new_drawctrl1,
+                        ~SAVAGE_SCISSOR_MASK_S4);
+
+        /* if any texture regs were changed ... */
+        if (start <= SAVAGE_TEXDESCR_S4 &&
+            start+count > SAVAGE_TEXPALADDR_S4) {
+                /* ... check texture state */
+                SAVE_STATE(SAVAGE_TEXDESCR_S4, s4.texdescr);
+                SAVE_STATE(SAVAGE_TEXADDR0_S4, s4.texaddr0);
+                SAVE_STATE(SAVAGE_TEXADDR1_S4, s4.texaddr1);
+                if (dev_priv->state.s4.texdescr & SAVAGE_TEXDESCR_TEX0EN_MASK)
+                        ret |= savage_verify_texaddr(
+                                dev_priv, 0, dev_priv->state.s4.texaddr0);
+                if (dev_priv->state.s4.texdescr & SAVAGE_TEXDESCR_TEX1EN_MASK)
+                        ret |= savage_verify_texaddr(
+                                dev_priv, 1, dev_priv->state.s4.texaddr1);
+        }
+
+        return ret;
+}
+#undef SAVE_STATE
+#undef SAVE_STATE_MASK
+
+static int savage_dispatch_state(drm_savage_private_t *dev_priv,
+                                 const drm_savage_cmd_header_t *cmd_header,
+                                 const uint32_t __user *regs)
+{
+        unsigned int count = cmd_header->state.count;
+        unsigned int start = cmd_header->state.start;
+        unsigned int count2 = 0;
+        unsigned int bci_size;
+        int ret;
+        DMA_LOCALS;
+
+        if (!count)
+                return 0;
+
+        if (DRM_VERIFYAREA_READ(regs, count*4))
+                return DRM_ERR(EFAULT);
+
+        if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
+                ret = savage_verify_state_s3d(dev_priv, start, count, regs);
+                if (ret != 0)
+                        return ret;
+                /* scissor regs are emitted in savage_dispatch_draw */
+                if (start < SAVAGE_SCSTART_S3D) {
+                        if (start+count > SAVAGE_SCEND_S3D+1)
+                                count2 = count - (SAVAGE_SCEND_S3D+1 - start);
+                        if (start+count > SAVAGE_SCSTART_S3D)
+                                count = SAVAGE_SCSTART_S3D - start;
+                } else if (start <= SAVAGE_SCEND_S3D) {
+                        if (start+count > SAVAGE_SCEND_S3D+1) {
+                                count -= SAVAGE_SCEND_S3D+1 - start;
+                                start = SAVAGE_SCEND_S3D+1;
+                        } else
+                                return 0;
+                }
+        } else {
+                ret = savage_verify_state_s4(dev_priv, start, count, regs);
+                if (ret != 0)
+                        return ret;
+                /* scissor regs are emitted in savage_dispatch_draw */
+                if (start < SAVAGE_DRAWCTRL0_S4) {
+                        if (start+count > SAVAGE_DRAWCTRL1_S4+1)
+                                count2 = count - (SAVAGE_DRAWCTRL1_S4+1 - start);
+                        if (start+count > SAVAGE_DRAWCTRL0_S4)
+                                count = SAVAGE_DRAWCTRL0_S4 - start;
+                } else if (start <= SAVAGE_DRAWCTRL1_S4) {
+                        if (start+count > SAVAGE_DRAWCTRL1_S4+1) {
+                                count -= SAVAGE_DRAWCTRL1_S4+1 - start;
+                                start = SAVAGE_DRAWCTRL1_S4+1;
+                        } else
+                                return 0;
+                }
+        }
+
+        bci_size = count + (count+254)/255 + count2 + (count2+254)/255;
+
+        if (cmd_header->state.global) {
+                BEGIN_DMA(bci_size+1);
+                DMA_WRITE(BCI_CMD_WAIT | BCI_CMD_WAIT_3D);
+                dev_priv->waiting = 1;
+        } else {
+                BEGIN_DMA(bci_size);
+        }
+
+        do {
+                while (count > 0) {
+                        unsigned int n = count < 255 ? count : 255;
+                        DMA_SET_REGISTERS(start, n);
+                        DMA_COPY_FROM_USER(regs, n);
+                        count -= n;
+                        start += n;
+                        regs += n;
+                }
+                start += 2;
+                regs += 2;
+                count = count2;
+                count2 = 0;
+        } while (count);
+
+        DMA_COMMIT();
+
+        return 0;
+}
+
+static int savage_dispatch_dma_prim(drm_savage_private_t *dev_priv,
+                                    const drm_savage_cmd_header_t *cmd_header,
+                                    const drm_buf_t *dmabuf)
+{
+        unsigned char reorder = 0;
+        unsigned int prim = cmd_header->prim.prim;
+        unsigned int skip = cmd_header->prim.skip;
+        unsigned int n = cmd_header->prim.count;
+        unsigned int start = cmd_header->prim.start;
+        unsigned int i;
+        BCI_LOCALS;
+
+        if (!dmabuf) {
+            DRM_ERROR("called without dma buffers!\n");
+            return DRM_ERR(EINVAL);
+        }
+
+        if (!n)
+                return 0;
+
+        switch (prim) {
+        case SAVAGE_PRIM_TRILIST_201:
+                reorder = 1;
+                prim = SAVAGE_PRIM_TRILIST;
+        case SAVAGE_PRIM_TRILIST:
+                if (n % 3 != 0) {
+                        DRM_ERROR("wrong number of vertices %u in TRILIST\n",
+                                  n);
+                        return DRM_ERR(EINVAL);
+                }
+                break;
+        case SAVAGE_PRIM_TRISTRIP:
+        case SAVAGE_PRIM_TRIFAN:
+                if (n < 3) {
+                        DRM_ERROR("wrong number of vertices %u in TRIFAN/STRIP\n",
+                                  n);
+                        return DRM_ERR(EINVAL);
+                }
+                break;
+        default:
+                DRM_ERROR("invalid primitive type %u\n", prim);
+                return DRM_ERR(EINVAL);
+        }
+
+        if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
+                if (skip != 0) {
+                        DRM_ERROR("invalid skip flags 0x%04x for DMA\n",
+                                  skip);
+                        return DRM_ERR(EINVAL);
+                }
+        } else {
+                unsigned int size = 10 - (skip & 1) - (skip >> 1 & 1) -
+                        (skip >> 2 & 1) - (skip >> 3 & 1) - (skip >> 4 & 1) -
+                        (skip >> 5 & 1) - (skip >> 6 & 1) - (skip >> 7 & 1);
+                if (skip > SAVAGE_SKIP_ALL_S4 || size != 8) {
+                        DRM_ERROR("invalid skip flags 0x%04x for DMA\n",
+                                  skip);
+                        return DRM_ERR(EINVAL);
+                }
+                if (reorder) {
+                        DRM_ERROR("TRILIST_201 used on Savage4 hardware\n");
+                        return DRM_ERR(EINVAL);
+                }
+        }
+
+        if (start + n > dmabuf->total/32) {
+                DRM_ERROR("vertex indices (%u-%u) out of range (0-%u)\n",
+                          start, start + n - 1, dmabuf->total/32);
+                return DRM_ERR(EINVAL);
+        }
+
+        /* Vertex DMA doesn't work with command DMA at the same time,
+         * so we use BCI_... to submit commands here. Flush buffered
+         * faked DMA first. */
+        DMA_FLUSH();
+
+        if (dmabuf->bus_address != dev_priv->state.common.vbaddr) {
+                BEGIN_BCI(2);
+                BCI_SET_REGISTERS(SAVAGE_VERTBUFADDR, 1);
+                BCI_WRITE(dmabuf->bus_address | dev_priv->dma_type);
+                dev_priv->state.common.vbaddr = dmabuf->bus_address;
+        }
+        if (S3_SAVAGE3D_SERIES(dev_priv->chipset) && dev_priv->waiting) {
+                /* Workaround for what looks like a hardware bug. If a
+                 * WAIT_3D_IDLE was emitted some time before the
+                 * indexed drawing command then the engine will lock
+                 * up. There are two known workarounds:
+                 * WAIT_IDLE_EMPTY or emit at least 63 NOPs. */
+                BEGIN_BCI(63);
+                for (i = 0; i < 63; ++i)
+                        BCI_WRITE(BCI_CMD_WAIT);
+                dev_priv->waiting = 0;
+        }
+
+        prim <<= 25;
+        while (n != 0) {
+                /* Can emit up to 255 indices (85 triangles) at once. */
+                unsigned int count = n > 255 ? 255 : n;
+                if (reorder) {
+                        /* Need to reorder indices for correct flat
+                         * shading while preserving the clock sense
+                         * for correct culling. Only on Savage3D. */
+                        int reorder[3] = {-1, -1, -1};
+                        reorder[start%3] = 2;
+
+                        BEGIN_BCI((count+1+1)/2);
+                        BCI_DRAW_INDICES_S3D(count, prim, start+2);
+
+                        for (i = start+1; i+1 < start+count; i += 2)
+                                BCI_WRITE((i + reorder[i % 3]) |
+                                          ((i+1 + reorder[(i+1) % 3]) << 16));
+                        if (i < start+count)
+                                BCI_WRITE(i + reorder[i%3]);
+                } else if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
+                        BEGIN_BCI((count+1+1)/2);
+                        BCI_DRAW_INDICES_S3D(count, prim, start);
+
+                        for (i = start+1; i+1 < start+count; i += 2)
+                                BCI_WRITE(i | ((i+1) << 16));
+                        if (i < start+count)
+                                BCI_WRITE(i);
+                } else {
+                        BEGIN_BCI((count+2+1)/2);
+                        BCI_DRAW_INDICES_S4(count, prim, skip);
+
+                        for (i = start; i+1 < start+count; i += 2)
+                                BCI_WRITE(i | ((i+1) << 16));
+                        if (i < start+count)
+                                BCI_WRITE(i);
+                }
+
+                start += count;
+                n -= count;
+
+                prim |= BCI_CMD_DRAW_CONT;
+        }
+
+        return 0;
+}
+
+static int savage_dispatch_vb_prim(drm_savage_private_t *dev_priv,
+                                   const drm_savage_cmd_header_t *cmd_header,
+                                   const uint32_t __user *vtxbuf,
+                                   unsigned int vb_size,
+                                   unsigned int vb_stride)
+{
+        unsigned char reorder = 0;
+        unsigned int prim = cmd_header->prim.prim;
+        unsigned int skip = cmd_header->prim.skip;
+        unsigned int n = cmd_header->prim.count;
+        unsigned int start = cmd_header->prim.start;
+        unsigned int vtx_size;
+        unsigned int i;
+        DMA_LOCALS;
+
+        if (!n)
+                return 0;
+
+        switch (prim) {
+        case SAVAGE_PRIM_TRILIST_201:
+                reorder = 1;
+                prim = SAVAGE_PRIM_TRILIST;
+        case SAVAGE_PRIM_TRILIST:
+                if (n % 3 != 0) {
+                        DRM_ERROR("wrong number of vertices %u in TRILIST\n",
+                                  n);
+                        return DRM_ERR(EINVAL);
+                }
+                break;
+        case SAVAGE_PRIM_TRISTRIP:
+        case SAVAGE_PRIM_TRIFAN:
+                if (n < 3) {
+                        DRM_ERROR("wrong number of vertices %u in TRIFAN/STRIP\n",
+                                  n);
+                        return DRM_ERR(EINVAL);
+                }
+                break;
+        default:
+                DRM_ERROR("invalid primitive type %u\n", prim);
+                return DRM_ERR(EINVAL);
+        }
+
+        if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
+                if (skip > SAVAGE_SKIP_ALL_S3D) {
+                        DRM_ERROR("invalid skip flags 0x%04x\n", skip);
+                        return DRM_ERR(EINVAL);
+                }
+                vtx_size = 8; /* full vertex */
+        } else {
+                if (skip > SAVAGE_SKIP_ALL_S4) {
+                        DRM_ERROR("invalid skip flags 0x%04x\n", skip);
+                        return DRM_ERR(EINVAL);
+                }
+                vtx_size = 10; /* full vertex */
+        }
+
+        vtx_size -= (skip & 1) + (skip >> 1 & 1) +
+                (skip >> 2 & 1) + (skip >> 3 & 1) + (skip >> 4 & 1) +
+                (skip >> 5 & 1) + (skip >> 6 & 1) + (skip >> 7 & 1);
+
+        if (vtx_size > vb_stride) {
+                DRM_ERROR("vertex size greater than vb stride (%u > %u)\n",
+                          vtx_size, vb_stride);
+                return DRM_ERR(EINVAL);
+        }
+
+        if (start + n > vb_size / (vb_stride*4)) {
+                DRM_ERROR("vertex indices (%u-%u) out of range (0-%u)\n",
+                          start, start + n - 1, vb_size / (vb_stride*4));
+                return DRM_ERR(EINVAL);
+        }
+
+        prim <<= 25;
+        while (n != 0) {
+                /* Can emit up to 255 vertices (85 triangles) at once. */
+                unsigned int count = n > 255 ? 255 : n;
+                if (reorder) {
+                        /* Need to reorder vertices for correct flat
+                         * shading while preserving the clock sense
+                         * for correct culling. Only on Savage3D. */
+                        int reorder[3] = {-1, -1, -1};
+                        reorder[start%3] = 2;
+
+                        BEGIN_DMA(count*vtx_size+1);
+                        DMA_DRAW_PRIMITIVE(count, prim, skip);
+
+                        for (i = start; i < start+count; ++i) {
+                                unsigned int j = i + reorder[i % 3];
+                                DMA_COPY_FROM_USER(&vtxbuf[vb_stride*j],
+                                                   vtx_size);
+                        }
+
+                        DMA_COMMIT();
+                } else {
+                        BEGIN_DMA(count*vtx_size+1);
+                        DMA_DRAW_PRIMITIVE(count, prim, skip);
+
+                        if (vb_stride == vtx_size) {
+                                DMA_COPY_FROM_USER(&vtxbuf[vb_stride*start],
+                                                   vtx_size*count);
+                        } else {
+                                for (i = start; i < start+count; ++i) {
+                                        DMA_COPY_FROM_USER(
+                                                &vtxbuf[vb_stride*i],
+                                                vtx_size);
+                                }
+                        }
+
+                        DMA_COMMIT();
+                }
+
+                start += count;
+                n -= count;
+
+                prim |= BCI_CMD_DRAW_CONT;
+        }
+
+        return 0;
+}
+
+static int savage_dispatch_dma_idx(drm_savage_private_t *dev_priv,
+                                   const drm_savage_cmd_header_t *cmd_header,
+                                   const uint16_t __user *usr_idx,
+                                   const drm_buf_t *dmabuf)
+{
+        unsigned char reorder = 0;
+        unsigned int prim = cmd_header->idx.prim;
+        unsigned int skip = cmd_header->idx.skip;
+        unsigned int n = cmd_header->idx.count;
+        unsigned int i;
+        BCI_LOCALS;
+
+        if (!dmabuf) {
+            DRM_ERROR("called without dma buffers!\n");
+            return DRM_ERR(EINVAL);
+        }
+
+        if (!n)
+                return 0;
+
+        switch (prim) {
+        case SAVAGE_PRIM_TRILIST_201:
+                reorder = 1;
+                prim = SAVAGE_PRIM_TRILIST;
+        case SAVAGE_PRIM_TRILIST:
+                if (n % 3 != 0) {
+                        DRM_ERROR("wrong number of indices %u in TRILIST\n",
+                                  n);
+                        return DRM_ERR(EINVAL);
+                }
+                break;
+        case SAVAGE_PRIM_TRISTRIP:
+        case SAVAGE_PRIM_TRIFAN:
+                if (n < 3) {
+                        DRM_ERROR("wrong number of indices %u in TRIFAN/STRIP\n",
+                                  n);
+                        return DRM_ERR(EINVAL);
+                }
+                break;
+        default:
+                DRM_ERROR("invalid primitive type %u\n", prim);
+                return DRM_ERR(EINVAL);
+        }
+
+        if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
+                if (skip != 0) {
+                        DRM_ERROR("invalid skip flags 0x%04x for DMA\n",
+                                  skip);
+                        return DRM_ERR(EINVAL);
+                }
+        } else {
+                unsigned int size = 10 - (skip & 1) - (skip >> 1 & 1) -
+                        (skip >> 2 & 1) - (skip >> 3 & 1) - (skip >> 4 & 1) -
+                        (skip >> 5 & 1) - (skip >> 6 & 1) - (skip >> 7 & 1);
+                if (skip > SAVAGE_SKIP_ALL_S4 || size != 8) {
+                        DRM_ERROR("invalid skip flags 0x%04x for DMA\n",
+                                  skip);
+                        return DRM_ERR(EINVAL);
+                }
+                if (reorder) {
+                        DRM_ERROR("TRILIST_201 used on Savage4 hardware\n");
+                        return DRM_ERR(EINVAL);
+                }
+        }
+
+        /* Vertex DMA doesn't work with command DMA at the same time,
+         * so we use BCI_... to submit commands here. Flush buffered
+         * faked DMA first. */
+        DMA_FLUSH();
+
+        if (dmabuf->bus_address != dev_priv->state.common.vbaddr) {
+                BEGIN_BCI(2);
+                BCI_SET_REGISTERS(SAVAGE_VERTBUFADDR, 1);
+                BCI_WRITE(dmabuf->bus_address | dev_priv->dma_type);
+                dev_priv->state.common.vbaddr = dmabuf->bus_address;
+        }
+        if (S3_SAVAGE3D_SERIES(dev_priv->chipset) && dev_priv->waiting) {
+                /* Workaround for what looks like a hardware bug. If a
+                 * WAIT_3D_IDLE was emitted some time before the
+                 * indexed drawing command then the engine will lock
+                 * up. There are two known workarounds:
+                 * WAIT_IDLE_EMPTY or emit at least 63 NOPs. */
+                BEGIN_BCI(63);
+                for (i = 0; i < 63; ++i)
+                        BCI_WRITE(BCI_CMD_WAIT);
+                dev_priv->waiting = 0;
+        }
+
+        prim <<= 25;
+        while (n != 0) {
+                /* Can emit up to 255 indices (85 triangles) at once. */
+                unsigned int count = n > 255 ? 255 : n;
+                /* Is it ok to allocate 510 bytes on the stack in an ioctl? */
+                uint16_t idx[255];
+
+                /* Copy and check indices */
+                DRM_COPY_FROM_USER_UNCHECKED(idx, usr_idx, count*2);
+                for (i = 0; i < count; ++i) {
+                        if (idx[i] > dmabuf->total/32) {
+                                DRM_ERROR("idx[%u]=%u out of range (0-%u)\n",
+                                          i, idx[i], dmabuf->total/32);
+                                return DRM_ERR(EINVAL);
+                        }
+                }
+
+                if (reorder) {
+                        /* Need to reorder indices for correct flat
+                         * shading while preserving the clock sense
+                         * for correct culling. Only on Savage3D. */
+                        int reorder[3] = {2, -1, -1};
+
+                        BEGIN_BCI((count+1+1)/2);
+                        BCI_DRAW_INDICES_S3D(count, prim, idx[2]);
+
+                        for (i = 1; i+1 < count; i += 2)
+                                BCI_WRITE(idx[i + reorder[i % 3]] |
+                                          (idx[i+1 + reorder[(i+1) % 3]] << 16));
+                        if (i < count)
+                                BCI_WRITE(idx[i + reorder[i%3]]);
+                } else if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
+                        BEGIN_BCI((count+1+1)/2);
+                        BCI_DRAW_INDICES_S3D(count, prim, idx[0]);
+
+                        for (i = 1; i+1 < count; i += 2)
+                                BCI_WRITE(idx[i] | (idx[i+1] << 16));
+                        if (i < count)
+                                BCI_WRITE(idx[i]);
+                } else {
+                        BEGIN_BCI((count+2+1)/2);
+                        BCI_DRAW_INDICES_S4(count, prim, skip);
+
+                        for (i = 0; i+1 < count; i += 2)
+                                BCI_WRITE(idx[i] | (idx[i+1] << 16));
+                        if (i < count)
+                                BCI_WRITE(idx[i]);
+                }
+
+                usr_idx += count;
+                n -= count;
+
+                prim |= BCI_CMD_DRAW_CONT;
+        }
+
+        return 0;
+}
+
+static int savage_dispatch_vb_idx(drm_savage_private_t *dev_priv,
+                                  const drm_savage_cmd_header_t *cmd_header,
+                                  const uint16_t __user *usr_idx,
+                                  const uint32_t __user *vtxbuf,
+                                  unsigned int vb_size,
+                                  unsigned int vb_stride)
+{
+        unsigned char reorder = 0;
+        unsigned int prim = cmd_header->idx.prim;
+        unsigned int skip = cmd_header->idx.skip;
+        unsigned int n = cmd_header->idx.count;
+        unsigned int vtx_size;
+        unsigned int i;
+        DMA_LOCALS;
+
+        if (!n)
+                return 0;
+
+        switch (prim) {
+        case SAVAGE_PRIM_TRILIST_201:
+                reorder = 1;
+                prim = SAVAGE_PRIM_TRILIST;
+        case SAVAGE_PRIM_TRILIST:
+                if (n % 3 != 0) {
+                        DRM_ERROR("wrong number of indices %u in TRILIST\n",
+                                  n);
+                        return DRM_ERR(EINVAL);
+                }
+                break;
+        case SAVAGE_PRIM_TRISTRIP:
+        case SAVAGE_PRIM_TRIFAN:
+                if (n < 3) {
+                        DRM_ERROR("wrong number of indices %u in TRIFAN/STRIP\n",
+                                  n);
+                        return DRM_ERR(EINVAL);
+                }
+                break;
+        default:
+                DRM_ERROR("invalid primitive type %u\n", prim);
+                return DRM_ERR(EINVAL);
+        }
+
+        if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
+                if (skip > SAVAGE_SKIP_ALL_S3D) {
+                        DRM_ERROR("invalid skip flags 0x%04x\n", skip);
+                        return DRM_ERR(EINVAL);
+                }
+                vtx_size = 8; /* full vertex */
+        } else {
+                if (skip > SAVAGE_SKIP_ALL_S4) {
+                        DRM_ERROR("invalid skip flags 0x%04x\n", skip);
+                        return DRM_ERR(EINVAL);
+                }
+                vtx_size = 10; /* full vertex */
+        }
+
+        vtx_size -= (skip & 1) + (skip >> 1 & 1) +
+                (skip >> 2 & 1) + (skip >> 3 & 1) + (skip >> 4 & 1) +
+                (skip >> 5 & 1) + (skip >> 6 & 1) + (skip >> 7 & 1);
+
+        if (vtx_size > vb_stride) {
+                DRM_ERROR("vertex size greater than vb stride (%u > %u)\n",
+                          vtx_size, vb_stride);
+                return DRM_ERR(EINVAL);
+        }
+
+        prim <<= 25;
+        while (n != 0) {
+                /* Can emit up to 255 vertices (85 triangles) at once. */
+                unsigned int count = n > 255 ? 255 : n;
+                /* Is it ok to allocate 510 bytes on the stack in an ioctl? */
+                uint16_t idx[255];
+
+                /* Copy and check indices */
+                DRM_COPY_FROM_USER_UNCHECKED(idx, usr_idx, count*2);
+                for (i = 0; i < count; ++i) {
+                        if (idx[i] > vb_size / (vb_stride*4)) {
+                                DRM_ERROR("idx[%u]=%u out of range (0-%u)\n",
+                                          i, idx[i],  vb_size / (vb_stride*4));
+                                return DRM_ERR(EINVAL);
+                        }
+                }
+
+                if (reorder) {
+                        /* Need to reorder vertices for correct flat
+                         * shading while preserving the clock sense
+                         * for correct culling. Only on Savage3D. */
+                        int reorder[3] = {2, -1, -1};
+
+                        BEGIN_DMA(count*vtx_size+1);
+                        DMA_DRAW_PRIMITIVE(count, prim, skip);
+
+                        for (i = 0; i < count; ++i) {
+                                unsigned int j = idx[i + reorder[i % 3]];
+                                DMA_COPY_FROM_USER(&vtxbuf[vb_stride*j],
+                                                   vtx_size);
+                        }
+
+                        DMA_COMMIT();
+                } else {
+                        BEGIN_DMA(count*vtx_size+1);
+                        DMA_DRAW_PRIMITIVE(count, prim, skip);
+
+                        for (i = 0; i < count; ++i) {
+                                unsigned int j = idx[i];
+                                DMA_COPY_FROM_USER(&vtxbuf[vb_stride*j],
+                                                   vtx_size);
+                        }
+
+                        DMA_COMMIT();
+                }
+
+                usr_idx += count;
+                n -= count;
+
+                prim |= BCI_CMD_DRAW_CONT;
+        }
+
+        return 0;
+}
+
+static int savage_dispatch_clear(drm_savage_private_t *dev_priv,
+                                 const drm_savage_cmd_header_t *cmd_header,
+                                 const drm_savage_cmd_header_t __user *data,
+                                 unsigned int nbox,
+                                 const drm_clip_rect_t __user *usr_boxes)
+{
+        unsigned int flags = cmd_header->clear0.flags, mask, value;
+        unsigned int clear_cmd;
+        unsigned int i, nbufs;
+        DMA_LOCALS;
+
+        if (nbox == 0)
+                return 0;
+
+        DRM_GET_USER_UNCHECKED(mask, &((const drm_savage_cmd_header_t*)data)
+                               ->clear1.mask);
+        DRM_GET_USER_UNCHECKED(value, &((const drm_savage_cmd_header_t*)data)
+                               ->clear1.value);
+
+        clear_cmd = BCI_CMD_RECT | BCI_CMD_RECT_XP | BCI_CMD_RECT_YP |
+                BCI_CMD_SEND_COLOR | BCI_CMD_DEST_PBD_NEW;
+        BCI_CMD_SET_ROP(clear_cmd,0xCC);
+
+        nbufs = ((flags & SAVAGE_FRONT) ? 1 : 0) +
+                ((flags & SAVAGE_BACK) ? 1 : 0) +
+                ((flags & SAVAGE_DEPTH) ? 1 : 0);
+        if (nbufs == 0)
+                return 0;
+
+        if (mask != 0xffffffff) {
+                /* set mask */
+                BEGIN_DMA(2);
+                DMA_SET_REGISTERS(SAVAGE_BITPLANEWTMASK, 1);
+                DMA_WRITE(mask);
+                DMA_COMMIT();
+        }
+        for (i = 0; i < nbox; ++i) {
+                drm_clip_rect_t box;
+                unsigned int x, y, w, h;
+                unsigned int buf;
+                DRM_COPY_FROM_USER_UNCHECKED(&box, &usr_boxes[i], sizeof(box));
+                x = box.x1, y = box.y1;
+                w = box.x2 - box.x1;
+                h = box.y2 - box.y1;
+                BEGIN_DMA(nbufs*6);
+                for (buf = SAVAGE_FRONT; buf <= SAVAGE_DEPTH; buf <<= 1) {
+                        if (!(flags & buf))
+                                continue;
+                        DMA_WRITE(clear_cmd);
+                        switch(buf) {
+                        case SAVAGE_FRONT:
+                                DMA_WRITE(dev_priv->front_offset);
+                                DMA_WRITE(dev_priv->front_bd);
+                                break;
+                        case SAVAGE_BACK:
+                                DMA_WRITE(dev_priv->back_offset);
+                                DMA_WRITE(dev_priv->back_bd);
+                                break;
+                        case SAVAGE_DEPTH:
+                                DMA_WRITE(dev_priv->depth_offset);
+                                DMA_WRITE(dev_priv->depth_bd);
+                                break;
+                        }
+                        DMA_WRITE(value);
+                        DMA_WRITE(BCI_X_Y(x, y));
+                        DMA_WRITE(BCI_W_H(w, h));
+                }
+                DMA_COMMIT();
+        }
+        if (mask != 0xffffffff) {
+                /* reset mask */
+                BEGIN_DMA(2);
+                DMA_SET_REGISTERS(SAVAGE_BITPLANEWTMASK, 1);
+                DMA_WRITE(0xffffffff);
+                DMA_COMMIT();
+        }
+
+        return 0;
+}
+
+static int savage_dispatch_swap(drm_savage_private_t *dev_priv,
+                                unsigned int nbox,
+                                const drm_clip_rect_t __user *usr_boxes)
+{
+        unsigned int swap_cmd;
+        unsigned int i;
+        DMA_LOCALS;
+
+        if (nbox == 0)
+                return 0;
+
+        swap_cmd = BCI_CMD_RECT | BCI_CMD_RECT_XP | BCI_CMD_RECT_YP |
+                BCI_CMD_SRC_PBD_COLOR_NEW | BCI_CMD_DEST_GBD;
+        BCI_CMD_SET_ROP(swap_cmd,0xCC);
+
+        for (i = 0; i < nbox; ++i) {
+                drm_clip_rect_t box;
+                DRM_COPY_FROM_USER_UNCHECKED(&box, &usr_boxes[i], sizeof(box));
+
+                BEGIN_DMA(6);
+                DMA_WRITE(swap_cmd);
+                DMA_WRITE(dev_priv->back_offset);
+                DMA_WRITE(dev_priv->back_bd);
+                DMA_WRITE(BCI_X_Y(box.x1, box.y1));
+                DMA_WRITE(BCI_X_Y(box.x1, box.y1));
+                DMA_WRITE(BCI_W_H(box.x2-box.x1, box.y2-box.y1));
+                DMA_COMMIT();
+        }
+
+        return 0;
+}
+
+static int savage_dispatch_draw(drm_savage_private_t *dev_priv,
+                                const drm_savage_cmd_header_t __user *start,
+                                const drm_savage_cmd_header_t __user *end,
+                                const drm_buf_t *dmabuf,
+                                const unsigned int __user *usr_vtxbuf,
+                                unsigned int vb_size, unsigned int vb_stride,
+                                unsigned int nbox,
+                                const drm_clip_rect_t __user *usr_boxes)
+{
+        unsigned int i, j;
+        int ret;
+
+        for (i = 0; i < nbox; ++i) {
+                drm_clip_rect_t box;
+                const drm_savage_cmd_header_t __user *usr_cmdbuf;
+                DRM_COPY_FROM_USER_UNCHECKED(&box, &usr_boxes[i], sizeof(box));
+                dev_priv->emit_clip_rect(dev_priv, &box);
+
+                usr_cmdbuf = start;
+                while (usr_cmdbuf < end) {
+                        drm_savage_cmd_header_t cmd_header;
+                        DRM_COPY_FROM_USER_UNCHECKED(&cmd_header, usr_cmdbuf,
+                                                     sizeof(cmd_header));
+                        usr_cmdbuf++;
+                        switch (cmd_header.cmd.cmd) {
+                        case SAVAGE_CMD_DMA_PRIM:
+                                ret = savage_dispatch_dma_prim(
+                                        dev_priv, &cmd_header, dmabuf);
+                                break;
+                        case SAVAGE_CMD_VB_PRIM:
+                                ret = savage_dispatch_vb_prim(
+                                        dev_priv, &cmd_header,
+                                        (const uint32_t __user *)usr_vtxbuf,
+                                        vb_size, vb_stride);
+                                break;
+                        case SAVAGE_CMD_DMA_IDX:
+                                j = (cmd_header.idx.count + 3) / 4;
+                                /* j was check in savage_bci_cmdbuf */
+                                ret = savage_dispatch_dma_idx(
+                                        dev_priv, &cmd_header,
+                                        (const uint16_t __user *)usr_cmdbuf,
+                                        dmabuf);
+                                usr_cmdbuf += j;
+                                break;
+                        case SAVAGE_CMD_VB_IDX:
+                                j = (cmd_header.idx.count + 3) / 4;
+                                /* j was check in savage_bci_cmdbuf */
+                                ret = savage_dispatch_vb_idx(
+                                        dev_priv, &cmd_header,
+                                        (const uint16_t __user *)usr_cmdbuf,
+                                        (const uint32_t __user *)usr_vtxbuf,
+                                        vb_size, vb_stride);
+                                usr_cmdbuf += j;
+                                break;
+                        default:
+                                /* What's the best return code? EFAULT? */
+                                DRM_ERROR("IMPLEMENTATION ERROR: "
+                                          "non-drawing-command %d\n",
+                                          cmd_header.cmd.cmd);
+                                return DRM_ERR(EINVAL);
+                        }
+
+                        if (ret != 0)
+                                return ret;
+                }
+        }
+
+        return 0;
+}
+
+int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
+{
+        DRM_DEVICE;
+        drm_savage_private_t *dev_priv = dev->dev_private;
+        drm_device_dma_t *dma = dev->dma;
+        drm_buf_t *dmabuf;
+        drm_savage_cmdbuf_t cmdbuf;
+        drm_savage_cmd_header_t __user *usr_cmdbuf;
+        drm_savage_cmd_header_t __user *first_draw_cmd;
+        unsigned int __user *usr_vtxbuf;
+        drm_clip_rect_t __user *usr_boxes;
+        unsigned int i, j;
+        int ret = 0;
+
+        DRM_DEBUG("\n");
+        
+        LOCK_TEST_WITH_RETURN(dev, filp);
+
+        DRM_COPY_FROM_USER_IOCTL(cmdbuf, (drm_savage_cmdbuf_t __user *)data,
+                                 sizeof(cmdbuf));
+
+        if (dma && dma->buflist) {
+                if (cmdbuf.dma_idx > dma->buf_count) {
+                        DRM_ERROR("vertex buffer index %u out of range (0-%u)\n",
+                                  cmdbuf.dma_idx, dma->buf_count-1);
+                        return DRM_ERR(EINVAL);
+                }
+                dmabuf = dma->buflist[cmdbuf.dma_idx];
+        } else {
+                dmabuf = NULL;
+        }
+
+        usr_cmdbuf = (drm_savage_cmd_header_t __user *)cmdbuf.cmd_addr;
+        usr_vtxbuf = (unsigned int __user *)cmdbuf.vb_addr;
+        usr_boxes = (drm_clip_rect_t __user *)cmdbuf.box_addr;
+        if ((cmdbuf.size && DRM_VERIFYAREA_READ(usr_cmdbuf, cmdbuf.size*8)) ||
+            (cmdbuf.vb_size && DRM_VERIFYAREA_READ(
+                    usr_vtxbuf, cmdbuf.vb_size)) ||
+            (cmdbuf.nbox && DRM_VERIFYAREA_READ(
+                    usr_boxes, cmdbuf.nbox*sizeof(drm_clip_rect_t))))
+                return DRM_ERR(EFAULT);
+
+        /* Make sure writes to DMA buffers are finished before sending
+         * DMA commands to the graphics hardware. */
+        DRM_MEMORYBARRIER();
+
+        /* Coming from user space. Don't know if the Xserver has
+         * emitted wait commands. Assuming the worst. */
+        dev_priv->waiting = 1;
+
+        i = 0;
+        first_draw_cmd = NULL;
+        while (i < cmdbuf.size) {
+                drm_savage_cmd_header_t cmd_header;
+                DRM_COPY_FROM_USER_UNCHECKED(&cmd_header, usr_cmdbuf,
+                                             sizeof(cmd_header));
+                usr_cmdbuf++;
+                i++;
+
+                /* Group drawing commands with same state to minimize
+                 * iterations over clip rects. */
+                j = 0;
+                switch (cmd_header.cmd.cmd) {
+                case SAVAGE_CMD_DMA_IDX:
+                case SAVAGE_CMD_VB_IDX:
+                        j = (cmd_header.idx.count + 3) / 4;
+                        if (i + j > cmdbuf.size) {
+                                DRM_ERROR("indexed drawing command extends "
+                                          "beyond end of command buffer\n");
+                                DMA_FLUSH();
+                                return DRM_ERR(EINVAL);
+                        }
+                        /* fall through */
+                case SAVAGE_CMD_DMA_PRIM:
+                case SAVAGE_CMD_VB_PRIM:
+                        if (!first_draw_cmd)
+                                first_draw_cmd = usr_cmdbuf-1;
+                        usr_cmdbuf += j;
+                        i += j;
+                        break;
+                default:
+                        if (first_draw_cmd) {
+                                ret = savage_dispatch_draw (
+                                        dev_priv, first_draw_cmd, usr_cmdbuf-1,
+                                        dmabuf, usr_vtxbuf, cmdbuf.vb_size,
+                                        cmdbuf.vb_stride,
+                                        cmdbuf.nbox, usr_boxes);
+                                if (ret != 0)
+                                        return ret;
+                                first_draw_cmd = NULL;
+                        }
+                }
+                if (first_draw_cmd)
+                        continue;
+
+                switch (cmd_header.cmd.cmd) {
+                case SAVAGE_CMD_STATE:
+                        j = (cmd_header.state.count + 1) / 2;
+                        if (i + j > cmdbuf.size) {
+                                DRM_ERROR("command SAVAGE_CMD_STATE extends "
+                                          "beyond end of command buffer\n");
+                                DMA_FLUSH();
+                                return DRM_ERR(EINVAL);
+                        }
+                        ret = savage_dispatch_state(
+                                dev_priv, &cmd_header,
+                                (uint32_t __user *)usr_cmdbuf);
+                        usr_cmdbuf += j;
+                        i += j;
+                        break;
+                case SAVAGE_CMD_CLEAR:
+                        if (i + 1 > cmdbuf.size) {
+                                DRM_ERROR("command SAVAGE_CMD_CLEAR extends "
+                                          "beyond end of command buffer\n");
+                                DMA_FLUSH();
+                                return DRM_ERR(EINVAL);
+                        }
+                        ret = savage_dispatch_clear(dev_priv, &cmd_header,
+                                                    usr_cmdbuf,
+                                                    cmdbuf.nbox, usr_boxes);
+                        usr_cmdbuf++;
+                        i++;
+                        break;
+                case SAVAGE_CMD_SWAP:
+                        ret = savage_dispatch_swap(dev_priv,
+                                                   cmdbuf.nbox, usr_boxes);
+                        break;
+                default:
+                        DRM_ERROR("invalid command 0x%x\n", cmd_header.cmd.cmd);
+                        DMA_FLUSH();
+                        return DRM_ERR(EINVAL);
+                }
+
+                if (ret != 0) {
+                        DMA_FLUSH();
+                        return ret;
+                }
+        }
+
+        if (first_draw_cmd) {
+                ret = savage_dispatch_draw (
+                        dev_priv, first_draw_cmd, usr_cmdbuf, dmabuf,
+                        usr_vtxbuf, cmdbuf.vb_size, cmdbuf.vb_stride,
+                        cmdbuf.nbox, usr_boxes);
+                if (ret != 0) {
+                        DMA_FLUSH();
+                        return ret;
+                }
+        }
+
+        DMA_FLUSH();
+
+        if (dmabuf && cmdbuf.discard) {
+                drm_savage_buf_priv_t *buf_priv = dmabuf->dev_private;
+                uint16_t event;
+                event = savage_bci_emit_event(dev_priv, SAVAGE_WAIT_3D);
+                SET_AGE(&buf_priv->age, event, dev_priv->event_wrap);
+                savage_freelist_put(dev, dmabuf);
+        }
+
+        return 0;
+}
diff --git a/drivers/char/hvc_vio.c b/drivers/char/hvc_vio.c
index 60bb9152b832..78d681dc35a8 100644
--- a/drivers/char/hvc_vio.c
+++ b/drivers/char/hvc_vio.c
@@ -39,7 +39,7 @@ char hvc_driver_name[] = "hvc_console";
 
 static struct vio_device_id hvc_driver_table[] __devinitdata = {
         {"serial", "hvterm1"},
-        { NULL, }
+        { "", "" }
 };
 MODULE_DEVICE_TABLE(vio, hvc_driver_table);
 
diff --git a/drivers/char/hvcs.c b/drivers/char/hvcs.c
index 3236d2404905..f47f009f9259 100644
--- a/drivers/char/hvcs.c
+++ b/drivers/char/hvcs.c
@@ -527,7 +527,7 @@ static int khvcsd(void *unused)
 
 static struct vio_device_id hvcs_driver_table[] __devinitdata= {
         {"serial-server", "hvterm2"},
-        { NULL, }
+        { "", "" }
 };
 MODULE_DEVICE_TABLE(vio, hvcs_driver_table);
 
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 42187381506b..850a78c9c4bc 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -261,7 +261,11 @@ static int mmap_mem(struct file * file, struct vm_area_struct * vma)
 
 static int mmap_kmem(struct file * file, struct vm_area_struct * vma)
 {
-        unsigned long long val;
+        unsigned long pfn;
+
+        /* Turn a kernel-virtual address into a physical page frame */
+        pfn = __pa((u64)vma->vm_pgoff << PAGE_SHIFT) >> PAGE_SHIFT;
+
         /*
          * RED-PEN: on some architectures there is more mapped memory
          * than available in mem_map which pfn_valid checks
@@ -269,10 +273,10 @@ static int mmap_kmem(struct file * file, struct vm_area_struct * vma)
          *
          * RED-PEN: vmalloc is not supported right now.
          */
-        if (!pfn_valid(vma->vm_pgoff))
+        if (!pfn_valid(pfn))
                 return -EIO;
-        val = (u64)vma->vm_pgoff << PAGE_SHIFT;
-        vma->vm_pgoff = __pa(val) >> PAGE_SHIFT;
+
+        vma->vm_pgoff = pfn;
         return mmap_mem(file, vma);
 }
 
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 6b11d6b2129f..7999da25fe40 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1589,6 +1589,40 @@ u32 secure_tcpv6_port_ephemeral(const __u32 *saddr, const __u32 *daddr, __u16 dp
 EXPORT_SYMBOL(secure_tcpv6_port_ephemeral);
 #endif
 
+#if defined(CONFIG_IP_DCCP) || defined(CONFIG_IP_DCCP_MODULE)
+/* Similar to secure_tcp_sequence_number but generate a 48 bit value
+ * bit's 32-47 increase every key exchange
+ *       0-31  hash(source, dest)
+ */
+u64 secure_dccp_sequence_number(__u32 saddr, __u32 daddr,
+                                __u16 sport, __u16 dport)
+{
+        struct timeval tv;
+        u64 seq;
+        __u32 hash[4];
+        struct keydata *keyptr = get_keyptr();
+
+        hash[0] = saddr;
+        hash[1] = daddr;
+        hash[2] = (sport << 16) + dport;
+        hash[3] = keyptr->secret[11];
+
+        seq = half_md4_transform(hash, keyptr->secret);
+        seq |= ((u64)keyptr->count) << (32 - HASH_BITS);
+
+        do_gettimeofday(&tv);
+        seq += tv.tv_usec + tv.tv_sec * 1000000;
+        seq &= (1ull << 48) - 1;
+#if 0
+        printk("dccp init_seq(%lx, %lx, %d, %d) = %d\n",
+               saddr, daddr, sport, dport, seq);
+#endif
+        return seq;
+}
+
+EXPORT_SYMBOL(secure_dccp_sequence_number);
+#endif
+
 #endif /* CONFIG_INET */
 
 
diff --git a/drivers/char/rtc.c b/drivers/char/rtc.c
index d8f9e94ae475..cd4fe8b1709f 100644
--- a/drivers/char/rtc.c
+++ b/drivers/char/rtc.c
@@ -1209,6 +1209,7 @@ static int rtc_proc_open(struct inode *inode, struct file *file)
 
 void rtc_get_rtc_time(struct rtc_time *rtc_tm)
 {
+        unsigned long uip_watchdog = jiffies;
         unsigned char ctrl;
 #ifdef CONFIG_MACH_DECSTATION
         unsigned int real_year;
@@ -1224,8 +1225,10 @@ void rtc_get_rtc_time(struct rtc_time *rtc_tm)
          * Once the read clears, read the RTC time (again via ioctl). Easy.
          */
 
-        if (rtc_is_updating() != 0)
-                msleep(20);
+        while (rtc_is_updating() != 0 && jiffies - uip_watchdog < 2*HZ/100) {
+                barrier();
+                cpu_relax();
+        }
 
         /*
          * Only the values that we read from the RTC are set. We leave
diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index 94a3b3e20bf9..79e9832ef1f3 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -17,6 +17,8 @@ config TCG_TPM
           obtained at: <http://sourceforge.net/projects/trousers>.  To 
           compile this driver as a module, choose M here; the module 
           will be called tpm. If unsure, say N.
+          Note: For more TPM drivers enable CONFIG_PNP, CONFIG_ACPI_BUS
+          and CONFIG_PNPACPI.
 
 config TCG_NSC
         tristate "National Semiconductor TPM Interface"
@@ -36,12 +38,13 @@ config TCG_ATMEL
           as a module, choose M here; the module will be called tpm_atmel.
 
 config TCG_INFINEON
-        tristate "Infineon Technologies SLD 9630 TPM Interface"
-        depends on TCG_TPM
+        tristate "Infineon Technologies TPM Interface"
+        depends on TCG_TPM && PNPACPI
         ---help---
           If you have a TPM security chip from Infineon Technologies
-          say Yes and it will be accessible from within Linux.  To
-          compile this driver as a module, choose M here; the module
+          (either SLD 9630 TT 1.1 or SLB 9635 TT 1.2) say Yes and it
+          will be accessible from within Linux.
+          To compile this driver as a module, choose M here; the module
           will be called tpm_infineon.
           Further information on this driver and the supported hardware
           can be found at http://www.prosec.rub.de/tpm
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index 0e3241645c19..dc8c540391fd 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -1,7 +1,7 @@
 /*
  * Description:
  * Device Driver for the Infineon Technologies
- * SLD 9630 TT Trusted Platform Module
+ * SLD 9630 TT 1.1 and SLB 9635 TT 1.2 Trusted Platform Module
  * Specifications at www.trustedcomputinggroup.org
  *
  * Copyright (C) 2005, Marcel Selhorst <selhorst@crypto.rub.de>
@@ -12,9 +12,10 @@
  * modify it under the terms of the GNU General Public License as
  * published by the Free Software Foundation, version 2 of the
  * License.
- *
  */
 
+#include <acpi/acpi_bus.h>
+#include <linux/pnp.h>
 #include "tpm.h"
 
 /* Infineon specific definitions */
@@ -26,8 +27,11 @@
 #define TPM_MSLEEP_TIME         3
 /* gives number of max. msleep()-calls before throwing timeout */
 #define TPM_MAX_TRIES           5000
-#define TCPA_INFINEON_DEV_VEN_VALUE     0x15D1
-#define TPM_DATA                        (TPM_ADDR + 1) & 0xff
+#define TPM_INFINEON_DEV_VEN_VALUE      0x15D1
+
+/* These values will be filled after ACPI-call */
+static int TPM_INF_DATA = 0;
+static int TPM_INF_ADDR = 0;
 
 /* TPM header definitions */
 enum infineon_tpm_header {
@@ -305,9 +309,10 @@ static int tpm_inf_send(struct tpm_chip *chip, u8 * buf, size_t count)
 
 static void tpm_inf_cancel(struct tpm_chip *chip)
 {
-        /* Nothing yet!
-           This has something to do with the internal functions
-           of the TPM. Abort isn't really necessary...
+        /*
+           Since we are using the legacy mode to communicate
+           with the TPM, we have no cancel functions, but have
+           a workaround for interrupting the TPM through WTX.
          */
 }
 
@@ -345,6 +350,32 @@ static struct tpm_vendor_specific tpm_inf = {
         .miscdev = {.fops = &inf_ops,},
 };
 
+static const struct pnp_device_id tpm_pnp_tbl[] = {
+        /* Infineon TPMs */
+        {"IFX0101", 0},
+        {"IFX0102", 0},
+        {"", 0}
+};
+
+static int __devinit tpm_inf_acpi_probe(struct pnp_dev *dev,
+                                        const struct pnp_device_id *dev_id)
+{
+        TPM_INF_ADDR = (pnp_port_start(dev, 0) & 0xff);
+        TPM_INF_DATA = ((TPM_INF_ADDR + 1) & 0xff);
+        tpm_inf.base = pnp_port_start(dev, 1);
+        dev_info(&dev->dev, "Found %s with ID %s\n",
+                 dev->name, dev_id->id);
+        if (!((tpm_inf.base >> 8) & 0xff))
+                tpm_inf.base = 0;
+        return 0;
+}
+
+static struct pnp_driver tpm_inf_pnp = {
+        .name = "tpm_inf_pnp",
+        .id_table = tpm_pnp_tbl,
+        .probe = tpm_inf_acpi_probe,
+};
+
 static int __devinit tpm_inf_probe(struct pci_dev *pci_dev,
                                    const struct pci_device_id *pci_id)
 {
@@ -353,64 +384,99 @@ static int __devinit tpm_inf_probe(struct pci_dev *pci_dev,
         int vendorid[2];
         int version[2];
         int productid[2];
+        char chipname[20];
 
         if (pci_enable_device(pci_dev))
                 return -EIO;
 
         dev_info(&pci_dev->dev, "LPC-bus found at 0x%x\n", pci_id->device);
 
+        /* read IO-ports from ACPI */
+        pnp_register_driver(&tpm_inf_pnp);
+        pnp_unregister_driver(&tpm_inf_pnp);
+
+        /* Make sure, we have received valid config ports */
+        if (!TPM_INF_ADDR) {
+                pci_disable_device(pci_dev);
+                return -EIO;
+        }
+
         /* query chip for its vendor, its version number a.s.o. */
-        outb(ENABLE_REGISTER_PAIR, TPM_ADDR);
-        outb(IDVENL, TPM_ADDR);
-        vendorid[1] = inb(TPM_DATA);
-        outb(IDVENH, TPM_ADDR);
-        vendorid[0] = inb(TPM_DATA);
-        outb(IDPDL, TPM_ADDR);
-        productid[1] = inb(TPM_DATA);
-        outb(IDPDH, TPM_ADDR);
-        productid[0] = inb(TPM_DATA);
-        outb(CHIP_ID1, TPM_ADDR);
-        version[1] = inb(TPM_DATA);
-        outb(CHIP_ID2, TPM_ADDR);
-        version[0] = inb(TPM_DATA);
-
-        if ((vendorid[0] << 8 | vendorid[1]) == (TCPA_INFINEON_DEV_VEN_VALUE)) {
-
-                /* read IO-ports from TPM */
-                outb(IOLIMH, TPM_ADDR);
-                ioh = inb(TPM_DATA);
-                outb(IOLIML, TPM_ADDR);
-                iol = inb(TPM_DATA);
-                tpm_inf.base = (ioh << 8) | iol;
+        outb(ENABLE_REGISTER_PAIR, TPM_INF_ADDR);
+        outb(IDVENL, TPM_INF_ADDR);
+        vendorid[1] = inb(TPM_INF_DATA);
+        outb(IDVENH, TPM_INF_ADDR);
+        vendorid[0] = inb(TPM_INF_DATA);
+        outb(IDPDL, TPM_INF_ADDR);
+        productid[1] = inb(TPM_INF_DATA);
+        outb(IDPDH, TPM_INF_ADDR);
+        productid[0] = inb(TPM_INF_DATA);
+        outb(CHIP_ID1, TPM_INF_ADDR);
+        version[1] = inb(TPM_INF_DATA);
+        outb(CHIP_ID2, TPM_INF_ADDR);
+        version[0] = inb(TPM_INF_DATA);
+
+        switch ((productid[0] << 8) | productid[1]) {
+        case 6:
+                sprintf(chipname, " (SLD 9630 TT 1.1)");
+                break;
+        case 11:
+                sprintf(chipname, " (SLB 9635 TT 1.2)");
+                break;
+        default:
+                sprintf(chipname, " (unknown chip)");
+                break;
+        }
+        chipname[19] = 0;
+
+        if ((vendorid[0] << 8 | vendorid[1]) == (TPM_INFINEON_DEV_VEN_VALUE)) {
 
                 if (tpm_inf.base == 0) {
-                        dev_err(&pci_dev->dev, "No IO-ports set!\n");
+                        dev_err(&pci_dev->dev, "No IO-ports found!\n");
                         pci_disable_device(pci_dev);
-                        return -ENODEV;
+                        return -EIO;
+                }
+                /* configure TPM with IO-ports */
+                outb(IOLIMH, TPM_INF_ADDR);
+                outb(((tpm_inf.base >> 8) & 0xff), TPM_INF_DATA);
+                outb(IOLIML, TPM_INF_ADDR);
+                outb((tpm_inf.base & 0xff), TPM_INF_DATA);
+
+                /* control if IO-ports are set correctly */
+                outb(IOLIMH, TPM_INF_ADDR);
+                ioh = inb(TPM_INF_DATA);
+                outb(IOLIML, TPM_INF_ADDR);
+                iol = inb(TPM_INF_DATA);
+
+                if ((ioh << 8 | iol) != tpm_inf.base) {
+                        dev_err(&pci_dev->dev,
+                                "Could not set IO-ports to %04x\n",
+                                tpm_inf.base);
+                        pci_disable_device(pci_dev);
+                        return -EIO;
                 }
 
                 /* activate register */
-                outb(TPM_DAR, TPM_ADDR);
-                outb(0x01, TPM_DATA);
-                outb(DISABLE_REGISTER_PAIR, TPM_ADDR);
+                outb(TPM_DAR, TPM_INF_ADDR);
+                outb(0x01, TPM_INF_DATA);
+                outb(DISABLE_REGISTER_PAIR, TPM_INF_ADDR);
 
                 /* disable RESET, LP and IRQC */
                 outb(RESET_LP_IRQC_DISABLE, tpm_inf.base + CMD);
 
                 /* Finally, we're done, print some infos */
                 dev_info(&pci_dev->dev, "TPM found: "
+                         "config base 0x%x, "
                          "io base 0x%x, "
                          "chip version %02x%02x, "
                          "vendor id %x%x (Infineon), "
                          "product id %02x%02x"
                          "%s\n",
+                         TPM_INF_ADDR,
                          tpm_inf.base,
                          version[0], version[1],
                          vendorid[0], vendorid[1],
-                         productid[0], productid[1], ((productid[0] == 0)
-                                                      && (productid[1] ==
-                                                          6)) ?
-                         " (SLD 9630 TT 1.1)" : "");
+                         productid[0], productid[1], chipname);
 
                 rc = tpm_register_hardware(pci_dev, &tpm_inf);
                 if (rc < 0) {
@@ -462,6 +528,6 @@ module_init(init_inf);
 module_exit(cleanup_inf);
 
 MODULE_AUTHOR("Marcel Selhorst <selhorst@crypto.rub.de>");
-MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT");
-MODULE_VERSION("1.4");
+MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT 1.1 / SLB 9635 TT 1.2");
+MODULE_VERSION("1.5");
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/viotape.c b/drivers/char/viotape.c
index 4764b4f9555d..0aff45fac2e6 100644
--- a/drivers/char/viotape.c
+++ b/drivers/char/viotape.c
@@ -991,7 +991,7 @@ static int viotape_remove(struct vio_dev *vdev)
  */
 static struct vio_device_id viotape_device_table[] __devinitdata = {
         { "viotape", "" },
-        { 0, }
+        { "", "" }
 };
 
 MODULE_DEVICE_TABLE(vio, viotape_device_table);
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 30d96739fb23..665103ccaee8 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -2433,7 +2433,7 @@ static int con_open(struct tty_struct *tty, struct file *filp)
         int ret = 0;
 
         acquire_console_sem();
-        if (tty->count == 1) {
+        if (tty->driver_data == NULL) {
                 ret = vc_allocate(currcons);
                 if (ret == 0) {
                         struct vc_data *vc = vc_cons[currcons].d;
diff --git a/drivers/char/watchdog/i8xx_tco.c b/drivers/char/watchdog/i8xx_tco.c
index f975dab1ddf9..a13395e2c372 100644
--- a/drivers/char/watchdog/i8xx_tco.c
+++ b/drivers/char/watchdog/i8xx_tco.c
@@ -1,5 +1,5 @@
 /*
- *      i8xx_tco 0.07:  TCO timer driver for i8xx chipsets
+ *      i8xx_tco:       TCO timer driver for i8xx chipsets
  *
  *      (c) Copyright 2000 kernel concepts <nils@kernelconcepts.de>, All Rights Reserved.
  *                              http://www.kernelconcepts.de
@@ -63,6 +63,9 @@
  *  20050128 Wim Van Sebroeck <wim@iguana.be>
  *      0.07 Added support for the ICH4-M, ICH6, ICH6R, ICH6-M, ICH6W and ICH6RW
  *           chipsets. Also added support for the "undocumented" ICH7 chipset.
+ *  20050807 Wim Van Sebroeck <wim@iguana.be>
+ *      0.08 Make sure that the watchdog is only "armed" when started.
+ *           (Kernel Bug 4251)
  */
 
 /*
@@ -87,7 +90,7 @@
 #include "i8xx_tco.h"
 
 /* Module and version information */
-#define TCO_VERSION "0.07"
+#define TCO_VERSION "0.08"
 #define TCO_MODULE_NAME "i8xx TCO timer"
 #define TCO_DRIVER_NAME   TCO_MODULE_NAME ", v" TCO_VERSION
 #define PFX TCO_MODULE_NAME ": "
@@ -125,10 +128,18 @@ static int tco_timer_start (void)
         unsigned char val;
 
         spin_lock(&tco_lock);
+
+        /* disable chipset's NO_REBOOT bit */
+        pci_read_config_byte (i8xx_tco_pci, 0xd4, &val);
+        val &= 0xfd;
+        pci_write_config_byte (i8xx_tco_pci, 0xd4, val);
+
+        /* Bit 11: TCO Timer Halt -> 0 = The TCO timer is enabled to count */
         val = inb (TCO1_CNT + 1);
         val &= 0xf7;
         outb (val, TCO1_CNT + 1);
         val = inb (TCO1_CNT + 1);
+
         spin_unlock(&tco_lock);
 
         if (val & 0x08)
@@ -138,13 +149,20 @@ static int tco_timer_start (void)
 
 static int tco_timer_stop (void)
 {
-        unsigned char val;
+        unsigned char val, val1;
 
         spin_lock(&tco_lock);
+        /* Bit 11: TCO Timer Halt -> 1 = The TCO timer is disabled */
         val = inb (TCO1_CNT + 1);
         val |= 0x08;
         outb (val, TCO1_CNT + 1);
         val = inb (TCO1_CNT + 1);
+
+        /* Set the NO_REBOOT bit to prevent later reboots, just for sure */
+        pci_read_config_byte (i8xx_tco_pci, 0xd4, &val1);
+        val1 |= 0x02;
+        pci_write_config_byte (i8xx_tco_pci, 0xd4, val1);
+
         spin_unlock(&tco_lock);
 
         if ((val & 0x08) == 0)
@@ -155,6 +173,7 @@ static int tco_timer_stop (void)
 static int tco_timer_keepalive (void)
 {
         spin_lock(&tco_lock);
+        /* Reload the timer by writing to the TCO Timer Reload register */
         outb (0x01, TCO1_RLD);
         spin_unlock(&tco_lock);
         return 0;
@@ -417,9 +436,8 @@ static unsigned char __init i8xx_tco_getdevice (void)
                         printk (KERN_ERR PFX "failed to get TCOBASE address\n");
                         return 0;
                 }
-                /*
-                 * Check chipset's NO_REBOOT bit
-                 */
+
+                /* Check chipset's NO_REBOOT bit */
                 pci_read_config_byte (i8xx_tco_pci, 0xd4, &val1);
                 if (val1 & 0x02) {
                         val1 &= 0xfd;
@@ -430,6 +448,10 @@ static unsigned char __init i8xx_tco_getdevice (void)
                                 return 0;       /* Cannot reset NO_REBOOT bit */
                         }
                 }
+                /* Disable reboots untill the watchdog starts */
+                val1 |= 0x02;
+                pci_write_config_byte (i8xx_tco_pci, 0xd4, val1);
+
                 /* Set the TCO_EN bit in SMI_EN register */
                 if (!request_region (SMI_EN + 1, 1, "i8xx TCO")) {
                         printk (KERN_ERR PFX "I/O address 0x%04x already in use\n",
@@ -505,17 +527,10 @@ out:
 
 static void __exit watchdog_cleanup (void)
 {
-        u8 val;
-
         /* Stop the timer before we leave */
         if (!nowayout)
                 tco_timer_stop ();
 
-        /* Set the NO_REBOOT bit to prevent later reboots, just for sure */
-        pci_read_config_byte (i8xx_tco_pci, 0xd4, &val);
-        val |= 0x02;
-        pci_write_config_byte (i8xx_tco_pci, 0xd4, val);
-
         /* Deregister */
         misc_deregister (&i8xx_tco_miscdev);
         unregister_reboot_notifier(&i8xx_tco_notifier);
diff --git a/drivers/fc4/fc.c b/drivers/fc4/fc.c
index 5d961f5e0ca0..e4710d1d1f9d 100644
--- a/drivers/fc4/fc.c
+++ b/drivers/fc4/fc.c
@@ -1004,8 +1004,8 @@ int fcp_scsi_dev_reset(Scsi_Cmnd *SCpnt)
                 return FAILED;
         }
         fc->rst_pkt->eh_state = SCSI_STATE_UNUSED;
-        return SUCCESS;
 #endif
+        return SUCCESS;
 }
 
 static int __fcp_scsi_host_reset(Scsi_Cmnd *SCpnt)
diff --git a/drivers/hwmon/adm1026.c b/drivers/hwmon/adm1026.c
index 4fa17c76eea2..c8a7f47911f9 100644
--- a/drivers/hwmon/adm1026.c
+++ b/drivers/hwmon/adm1026.c
@@ -325,7 +325,7 @@ int adm1026_attach_adapter(struct i2c_adapter *adapter)
 int adm1026_detach_client(struct i2c_client *client)
 {
         i2c_detach_client(client);
-        kfree(client);
+        kfree(i2c_get_clientdata(client));
         return 0;
 }
 
@@ -1691,7 +1691,7 @@ int adm1026_detect(struct i2c_adapter *adapter, int address,
 
         /* Error out and cleanup code */
 exitfree:
-        kfree(new_client);
+        kfree(data);
 exit:
         return err;
 }
diff --git a/drivers/hwmon/adm1031.c b/drivers/hwmon/adm1031.c
index 9168e983ca1d..936250957270 100644
--- a/drivers/hwmon/adm1031.c
+++ b/drivers/hwmon/adm1031.c
@@ -834,7 +834,7 @@ static int adm1031_detect(struct i2c_adapter *adapter, int address, int kind)
         return 0;
 
 exit_free:
-        kfree(new_client);
+        kfree(data);
 exit:
         return err;
 }
@@ -845,7 +845,7 @@ static int adm1031_detach_client(struct i2c_client *client)
         if ((ret = i2c_detach_client(client)) != 0) {
                 return ret;
         }
-        kfree(client);
+        kfree(i2c_get_clientdata(client));
         return 0;
 }
 
diff --git a/drivers/hwmon/adm9240.c b/drivers/hwmon/adm9240.c
index 5c68e9c311aa..ce2a6eb93f6e 100644
--- a/drivers/hwmon/adm9240.c
+++ b/drivers/hwmon/adm9240.c
@@ -616,7 +616,7 @@ static int adm9240_detect(struct i2c_adapter *adapter, int address, int kind)
 
         return 0;
 exit_free:
-        kfree(new_client);
+        kfree(data);
 exit:
         return err;
 }
diff --git a/drivers/hwmon/fscpos.c b/drivers/hwmon/fscpos.c
index 270015b626ad..301ae98bd0ad 100644
--- a/drivers/hwmon/fscpos.c
+++ b/drivers/hwmon/fscpos.c
@@ -167,7 +167,7 @@ static ssize_t set_temp_reset(struct i2c_client *client, struct fscpos_data
                                 "experience to the module author.\n");
 
         /* Supported value: 2 (clears the status) */
-        fscpos_write_value(client, FSCPOS_REG_TEMP_STATE[nr], 2);
+        fscpos_write_value(client, FSCPOS_REG_TEMP_STATE[nr - 1], 2);
         return count;
 }
 
diff --git a/drivers/hwmon/smsc47b397.c b/drivers/hwmon/smsc47b397.c
index 251ac2659554..fdeeb3ab6f2f 100644
--- a/drivers/hwmon/smsc47b397.c
+++ b/drivers/hwmon/smsc47b397.c
@@ -298,7 +298,7 @@ static int smsc47b397_detect(struct i2c_adapter *adapter, int addr, int kind)
         return 0;
 
 error_free:
-        kfree(new_client);
+        kfree(data);
 error_release:
         release_region(addr, SMSC_EXTENT);
         return err;
diff --git a/drivers/hwmon/smsc47m1.c b/drivers/hwmon/smsc47m1.c
index 897117a7213f..7166ad0b2fda 100644
--- a/drivers/hwmon/smsc47m1.c
+++ b/drivers/hwmon/smsc47m1.c
@@ -495,7 +495,7 @@ static int smsc47m1_detect(struct i2c_adapter *adapter, int address, int kind)
         return 0;
 
 error_free:
-        kfree(new_client);
+        kfree(data);
 error_release:
         release_region(address, SMSC_EXTENT);
         return err;
diff --git a/drivers/i2c/busses/i2c-sibyte.c b/drivers/i2c/busses/i2c-sibyte.c
index 1c99536b673b..fa503ed9f86d 100644
--- a/drivers/i2c/busses/i2c-sibyte.c
+++ b/drivers/i2c/busses/i2c-sibyte.c
@@ -23,8 +23,8 @@
 #include <asm/sibyte/sb1250_smbus.h>
 
 static struct i2c_algo_sibyte_data sibyte_board_data[2] = {
-        { NULL, 0, (void *) (KSEG1+A_SMB_BASE(0)) },
-        { NULL, 1, (void *) (KSEG1+A_SMB_BASE(1)) }
+        { NULL, 0, (void *) (CKSEG1+A_SMB_BASE(0)) },
+        { NULL, 1, (void *) (CKSEG1+A_SMB_BASE(1)) }
 };
 
 static struct i2c_adapter sibyte_board_adapter[2] = {
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index 5f33df47aa74..1cadd2c3cadd 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -764,6 +764,7 @@ config BLK_DEV_IDE_PMAC_ATA100FIRST
 config BLK_DEV_IDEDMA_PMAC
         bool "PowerMac IDE DMA support"
         depends on BLK_DEV_IDE_PMAC
+        select BLK_DEV_IDEDMA_PCI
         help
           This option allows the driver for the built-in IDE controller on
           Power Macintoshes and PowerBooks to use DMA (direct memory access)
diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c
index f9c1acb4ed6a..c9d3a00a3c0c 100644
--- a/drivers/ide/ide-disk.c
+++ b/drivers/ide/ide-disk.c
@@ -1220,7 +1220,7 @@ static int ide_disk_probe(struct device *dev)
                 goto failed;
 
         g = alloc_disk_node(1 << PARTN_BITS,
-                        pcibus_to_node(drive->hwif->pci_dev->bus));
+                        hwif_to_node(drive->hwif));
         if (!g)
                 goto out_free_idkp;
 
diff --git a/drivers/ide/ide-floppy.c b/drivers/ide/ide-floppy.c
index 9eab6426148e..29c22fc278c6 100644
--- a/drivers/ide/ide-floppy.c
+++ b/drivers/ide/ide-floppy.c
@@ -317,7 +317,7 @@ typedef struct ide_floppy_obj {
         unsigned long flags;
 } idefloppy_floppy_t;
 
-#define IDEFLOPPY_TICKS_DELAY   3       /* default delay for ZIP 100 */
+#define IDEFLOPPY_TICKS_DELAY   HZ/20   /* default delay for ZIP 100 (50ms) */
 
 /*
  *      Floppy flag bits values.
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 7df85af75371..c1128ae5cd2f 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -978,8 +978,7 @@ static int ide_init_queue(ide_drive_t *drive)
          *      do not.
          */
 
-        q = blk_init_queue_node(do_ide_request, &ide_lock,
-                                pcibus_to_node(drive->hwif->pci_dev->bus));
+        q = blk_init_queue_node(do_ide_request, &ide_lock, hwif_to_node(hwif));
         if (!q)
                 return 1;
 
@@ -1048,6 +1047,8 @@ static int init_irq (ide_hwif_t *hwif)
 
         BUG_ON(in_interrupt());
         BUG_ON(irqs_disabled());        
+        BUG_ON(hwif == NULL);
+
         down(&ide_cfg_sem);
         hwif->hwgroup = NULL;
 #if MAX_HWIFS > 1
@@ -1097,7 +1098,7 @@ static int init_irq (ide_hwif_t *hwif)
                 spin_unlock_irq(&ide_lock);
         } else {
                 hwgroup = kmalloc_node(sizeof(ide_hwgroup_t), GFP_KERNEL,
-                        pcibus_to_node(hwif->drives[0].hwif->pci_dev->bus));
+                                        hwif_to_node(hwif->drives[0].hwif));
                 if (!hwgroup)
                         goto out_up;
 
diff --git a/drivers/ide/pci/generic.c b/drivers/ide/pci/generic.c
index da46577380f3..6e3ab0c38c4d 100644
--- a/drivers/ide/pci/generic.c
+++ b/drivers/ide/pci/generic.c
@@ -173,6 +173,12 @@ static ide_pci_device_t generic_chipsets[] __devinitdata = {
                 .channels       = 2,
                 .autodma        = NOAUTODMA,
                 .bootable       = ON_BOARD,
+        },{     /* 14 */
+                .name           = "Revolution",
+                .init_hwif      = init_hwif_generic,
+                .channels       = 2,
+                .autodma        = AUTODMA,
+                .bootable       = OFF_BOARD,
         }
 };
 
@@ -231,6 +237,7 @@ static struct pci_device_id generic_pci_tbl[] = {
         { PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO,     PCI_ANY_ID, PCI_ANY_ID, 0, 0, 11},
         { PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_1,   PCI_ANY_ID, PCI_ANY_ID, 0, 0, 12},
         { PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_2,   PCI_ANY_ID, PCI_ANY_ID, 0, 0, 13},
+        { PCI_VENDOR_ID_NETCELL,PCI_DEVICE_ID_REVOLUTION,          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 14},
         /* Must come last. If you add entries adjust this table appropriately and the init_one code */
         { PCI_ANY_ID,           PCI_ANY_ID,                        PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_STORAGE_IDE << 8, 0xFFFFFF00UL, 0},
         { 0, },
diff --git a/drivers/ide/pci/serverworks.c b/drivers/ide/pci/serverworks.c
index c6f5fa4b4ca6..ff2e217a8c84 100644
--- a/drivers/ide/pci/serverworks.c
+++ b/drivers/ide/pci/serverworks.c
@@ -21,6 +21,9 @@
  *
  *   CSB6: `Champion South Bridge' IDE Interface (optional: third channel)
  *
+ *   HT1000: AKA BCM5785 - Hypertransport Southbridge for Opteron systems. IDE
+ *   controller same as the CSB6. Single channel ATA100 only.
+ *
  * Documentation:
  *      Available under NDA only. Errata info very hard to get.
  *
@@ -71,6 +74,8 @@ static u8 svwks_ratemask (ide_drive_t *drive)
         if (!svwks_revision)
                 pci_read_config_byte(dev, PCI_REVISION_ID, &svwks_revision);
 
+        if (dev->device == PCI_DEVICE_ID_SERVERWORKS_HT1000IDE)
+                return 2;
         if (dev->device == PCI_DEVICE_ID_SERVERWORKS_OSB4IDE) {
                 u32 reg = 0;
                 if (isa_dev)
@@ -109,6 +114,7 @@ static u8 svwks_csb_check (struct pci_dev *dev)
                 case PCI_DEVICE_ID_SERVERWORKS_CSB5IDE:
                 case PCI_DEVICE_ID_SERVERWORKS_CSB6IDE:
                 case PCI_DEVICE_ID_SERVERWORKS_CSB6IDE2:
+                case PCI_DEVICE_ID_SERVERWORKS_HT1000IDE:
                         return 1;
                 default:
                         break;
@@ -438,6 +444,13 @@ static unsigned int __devinit init_chipset_svwks (struct pci_dev *dev, const cha
                         btr |= (svwks_revision >= SVWKS_CSB5_REVISION_NEW) ? 0x3 : 0x2;
                 pci_write_config_byte(dev, 0x5A, btr);
         }
+        /* Setup HT1000 SouthBridge Controller - Single Channel Only */
+        else if (dev->device == PCI_DEVICE_ID_SERVERWORKS_HT1000IDE) {
+                pci_read_config_byte(dev, 0x5A, &btr);
+                btr &= ~0x40;
+                btr |= 0x3;
+                pci_write_config_byte(dev, 0x5A, btr);
+        }
 
         return (dev->irq) ? dev->irq : 0;
 }
@@ -629,6 +642,15 @@ static ide_pci_device_t serverworks_chipsets[] __devinitdata = {
                 .channels       = 1,    /* 2 */
                 .autodma        = AUTODMA,
                 .bootable       = ON_BOARD,
+        },{     /* 4 */
+                .name           = "SvrWks HT1000",
+                .init_setup     = init_setup_svwks,
+                .init_chipset   = init_chipset_svwks,
+                .init_hwif      = init_hwif_svwks,
+                .init_dma       = init_dma_svwks,
+                .channels       = 1,    /* 2 */
+                .autodma        = AUTODMA,
+                .bootable       = ON_BOARD,
         }
 };
 
@@ -653,6 +675,7 @@ static struct pci_device_id svwks_pci_tbl[] = {
         { PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_CSB5IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 1},
         { PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_CSB6IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 2},
         { PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_CSB6IDE2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 3},
+        { PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_HT1000IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4},
         { 0, },
 };
 MODULE_DEVICE_TABLE(pci, svwks_pci_tbl);
diff --git a/drivers/ide/ppc/pmac.c b/drivers/ide/ppc/pmac.c
index be0fcc8f4b15..ea65b070a367 100644
--- a/drivers/ide/ppc/pmac.c
+++ b/drivers/ide/ppc/pmac.c
@@ -1664,7 +1664,7 @@ static struct macio_driver pmac_ide_macio_driver =
 };
 
 static struct pci_device_id pmac_ide_pci_match[] = {
-        { PCI_VENDOR_ID_APPLE, PCI_DEVIEC_ID_APPLE_UNI_N_ATA, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { PCI_VENDOR_ID_APPLE, PCI_DEVICE_ID_APPLE_UNI_N_ATA, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         { PCI_VENDOR_ID_APPLE, PCI_DEVICE_ID_APPLE_IPID_ATA100, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         { PCI_VENDOR_ID_APPLE, PCI_DEVICE_ID_APPLE_K2_ATA100, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         { PCI_VENDOR_ID_APPLE, PCI_DEVICE_ID_APPLE_SH_ATA,
diff --git a/drivers/ide/setup-pci.c b/drivers/ide/setup-pci.c
index 77da827b2898..18ed7765417c 100644
--- a/drivers/ide/setup-pci.c
+++ b/drivers/ide/setup-pci.c
@@ -229,6 +229,7 @@ second_chance_to_dma:
                         case PCI_DEVICE_ID_AMD_VIPER_7409:
                         case PCI_DEVICE_ID_CMD_643:
                         case PCI_DEVICE_ID_SERVERWORKS_CSB5IDE:
+                        case PCI_DEVICE_ID_REVOLUTION:
                                 simplex_stat = hwif->INB(dma_base + 2);
                                 hwif->OUTB((simplex_stat&0x60),(dma_base + 2));
                                 simplex_stat = hwif->INB(dma_base + 2);
diff --git a/drivers/ieee1394/ieee1394_core.c b/drivers/ieee1394/ieee1394_core.c
index b248d89de8b4..d633770fac8e 100644
--- a/drivers/ieee1394/ieee1394_core.c
+++ b/drivers/ieee1394/ieee1394_core.c
@@ -681,7 +681,7 @@ static void handle_packet_response(struct hpsb_host *host, int tcode,
                 return;
         }
 
-        __skb_unlink(skb, skb->list);
+        __skb_unlink(skb, &host->pending_packet_queue);
 
         if (packet->state == hpsb_queued) {
                 packet->sendtime = jiffies;
@@ -989,7 +989,7 @@ void abort_timedouts(unsigned long __opaque)
                 packet = (struct hpsb_packet *)skb->data;
 
                 if (time_before(packet->sendtime + expire, jiffies)) {
-                        __skb_unlink(skb, skb->list);
+                        __skb_unlink(skb, &host->pending_packet_queue);
                         packet->state = hpsb_complete;
                         packet->ack_code = ACKX_TIMEOUT;
                         queue_packet_complete(packet);
diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c
index b12a970cc9a3..27018c8efc24 100644
--- a/drivers/ieee1394/ohci1394.c
+++ b/drivers/ieee1394/ohci1394.c
@@ -478,7 +478,6 @@ static void ohci_initialize(struct ti_ohci *ohci)
         int num_ports, i;
 
         spin_lock_init(&ohci->phy_reg_lock);
-        spin_lock_init(&ohci->event_lock);
 
         /* Put some defaults to these undefined bus options */
         buf = reg_read(ohci, OHCI1394_BusOptions);
@@ -3402,7 +3401,14 @@ static int __devinit ohci1394_pci_probe(struct pci_dev *dev,
         /* We hopefully don't have to pre-allocate IT DMA like we did
          * for IR DMA above. Allocate it on-demand and mark inactive. */
         ohci->it_legacy_context.ohci = NULL;
+        spin_lock_init(&ohci->event_lock);
 
+        /*
+         * interrupts are disabled, all right, but... due to SA_SHIRQ we
+         * might get called anyway.  We'll see no event, of course, but
+         * we need to get to that "no event", so enough should be initialized
+         * by that point.
+         */
         if (request_irq(dev->irq, ohci_irq_handler, SA_SHIRQ,
                          OHCI1394_DRIVER_NAME, ohci))
                 FAIL(-ENOMEM, "Failed to allocate shared interrupt %d", dev->irq);
diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig
index 79c8e2dd9c33..32cdfb30e9b4 100644
--- a/drivers/infiniband/Kconfig
+++ b/drivers/infiniband/Kconfig
@@ -1,6 +1,7 @@
 menu "InfiniBand support"
 
 config INFINIBAND
+        depends on PCI || BROKEN
         tristate "InfiniBand support"
         ---help---
           Core support for InfiniBand (IB).  Make sure to also select
diff --git a/drivers/infiniband/core/Makefile b/drivers/infiniband/core/Makefile
index 10be36731ed7..678a7e097f32 100644
--- a/drivers/infiniband/core/Makefile
+++ b/drivers/infiniband/core/Makefile
@@ -1,5 +1,3 @@
-EXTRA_CFLAGS += -Idrivers/infiniband/include
-
 obj-$(CONFIG_INFINIBAND) +=             ib_core.o ib_mad.o ib_sa.o \
                                         ib_cm.o ib_umad.o ib_ucm.o
 obj-$(CONFIG_INFINIBAND_USER_VERBS) +=  ib_uverbs.o
diff --git a/drivers/infiniband/core/agent.c b/drivers/infiniband/core/agent.c
index 729f0b0d983a..5ac86f566dc0 100644
--- a/drivers/infiniband/core/agent.c
+++ b/drivers/infiniband/core/agent.c
@@ -1,9 +1,10 @@
 /*
- * Copyright (c) 2004 Mellanox Technologies Ltd.  All rights reserved.
- * Copyright (c) 2004 Infinicon Corporation.  All rights reserved.
- * Copyright (c) 2004 Intel Corporation.  All rights reserved.
- * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
- * Copyright (c) 2004 Voltaire Corporation.  All rights reserved.
+ * Copyright (c) 2004, 2005 Mellanox Technologies Ltd.  All rights reserved.
+ * Copyright (c) 2004, 2005 Infinicon Corporation.  All rights reserved.
+ * Copyright (c) 2004, 2005 Intel Corporation.  All rights reserved.
+ * Copyright (c) 2004, 2005 Topspin Corporation.  All rights reserved.
+ * Copyright (c) 2004, 2005 Voltaire Corporation.  All rights reserved.
+ * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -40,7 +41,7 @@
 
 #include <asm/bug.h>
 
-#include <ib_smi.h>
+#include <rdma/ib_smi.h>
 
 #include "smi.h"
 #include "agent_priv.h"
diff --git a/drivers/infiniband/core/agent_priv.h b/drivers/infiniband/core/agent_priv.h
index 17435af1e914..2ec6d7f1b7d0 100644
--- a/drivers/infiniband/core/agent_priv.h
+++ b/drivers/infiniband/core/agent_priv.h
@@ -1,9 +1,9 @@
 /*
- * Copyright (c) 2004 Mellanox Technologies Ltd.  All rights reserved.
- * Copyright (c) 2004 Infinicon Corporation.  All rights reserved.
- * Copyright (c) 2004 Intel Corporation.  All rights reserved.
- * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
- * Copyright (c) 2004 Voltaire Corporation.  All rights reserved.
+ * Copyright (c) 2004, 2005 Mellanox Technologies Ltd.  All rights reserved.
+ * Copyright (c) 2004, 2005 Infinicon Corporation.  All rights reserved.
+ * Copyright (c) 2004, 2005 Intel Corporation.  All rights reserved.
+ * Copyright (c) 2004, 2005 Topspin Corporation.  All rights reserved.
+ * Copyright (c) 2004, 2005 Voltaire Corporation.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index 3042360c97e1..f014e639088c 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -1,5 +1,8 @@
 /*
  * Copyright (c) 2004 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Intel Corporation. All rights reserved.
+ * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
+ * Copyright (c) 2005 Voltaire, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -32,12 +35,11 @@
  * $Id: cache.c 1349 2004-12-16 21:09:43Z roland $
  */
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
 
-#include <ib_cache.h>
+#include <rdma/ib_cache.h>
 
 #include "core_priv.h"
 
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index 403ed125d8f4..4de93ba274a6 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -43,8 +43,8 @@
 #include <linux/spinlock.h>
 #include <linux/workqueue.h>
 
-#include <ib_cache.h>
-#include <ib_cm.h>
+#include <rdma/ib_cache.h>
+#include <rdma/ib_cm.h>
 #include "cm_msgs.h"
 
 MODULE_AUTHOR("Sean Hefty");
@@ -83,7 +83,7 @@ struct cm_port {
 struct cm_device {
         struct list_head list;
         struct ib_device *device;
-        u64 ca_guid;
+        __be64 ca_guid;
         struct cm_port port[0];
 };
 
@@ -100,8 +100,8 @@ struct cm_work {
         struct list_head list;
         struct cm_port *port;
         struct ib_mad_recv_wc *mad_recv_wc;     /* Received MADs */
-        u32 local_id;                           /* Established / timewait */
-        u32 remote_id;
+        __be32 local_id;                        /* Established / timewait */
+        __be32 remote_id;
         struct ib_cm_event cm_event;
         struct ib_sa_path_rec path[0];
 };
@@ -110,8 +110,8 @@ struct cm_timewait_info {
         struct cm_work work;                    /* Must be first. */
         struct rb_node remote_qp_node;
         struct rb_node remote_id_node;
-        u64 remote_ca_guid;
-        u32 remote_qpn;
+        __be64 remote_ca_guid;
+        __be32 remote_qpn;
         u8 inserted_remote_qp;
         u8 inserted_remote_id;
 };
@@ -132,11 +132,11 @@ struct cm_id_private {
         struct cm_av alt_av;
 
         void *private_data;
-        u64 tid;
-        u32 local_qpn;
-        u32 remote_qpn;
-        u32 sq_psn;
-        u32 rq_psn;
+        __be64 tid;
+        __be32 local_qpn;
+        __be32 remote_qpn;
+        __be32 sq_psn;
+        __be32 rq_psn;
         int timeout_ms;
         enum ib_mtu path_mtu;
         u8 private_data_len;
@@ -253,7 +253,7 @@ static void cm_set_ah_attr(struct ib_ah_attr *ah_attr, u8 port_num,
                            u16 dlid, u8 sl, u16 src_path_bits)
 {
         memset(ah_attr, 0, sizeof ah_attr);
-        ah_attr->dlid = be16_to_cpu(dlid);
+        ah_attr->dlid = dlid;
         ah_attr->sl = sl;
         ah_attr->src_path_bits = src_path_bits;
         ah_attr->port_num = port_num;
@@ -264,7 +264,7 @@ static void cm_init_av_for_response(struct cm_port *port,
 {
         av->port = port;
         av->pkey_index = wc->pkey_index;
-        cm_set_ah_attr(&av->ah_attr, port->port_num, cpu_to_be16(wc->slid),
+        cm_set_ah_attr(&av->ah_attr, port->port_num, wc->slid,
                        wc->sl, wc->dlid_path_bits);
 }
 
@@ -295,8 +295,9 @@ static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av)
                 return ret;
 
         av->port = port;
-        cm_set_ah_attr(&av->ah_attr, av->port->port_num, path->dlid,
-                       path->sl, path->slid & 0x7F);
+        cm_set_ah_attr(&av->ah_attr, av->port->port_num,
+                       be16_to_cpu(path->dlid), path->sl,
+                       be16_to_cpu(path->slid) & 0x7F);
         av->packet_life_time = path->packet_life_time;
         return 0;
 }
@@ -309,26 +310,26 @@ static int cm_alloc_id(struct cm_id_private *cm_id_priv)
         do {
                 spin_lock_irqsave(&cm.lock, flags);
                 ret = idr_get_new_above(&cm.local_id_table, cm_id_priv, 1,
-                                        (int *) &cm_id_priv->id.local_id);
+                                        (__force int *) &cm_id_priv->id.local_id);
                 spin_unlock_irqrestore(&cm.lock, flags);
         } while( (ret == -EAGAIN) && idr_pre_get(&cm.local_id_table, GFP_KERNEL) );
         return ret;
 }
 
-static void cm_free_id(u32 local_id)
+static void cm_free_id(__be32 local_id)
 {
         unsigned long flags;
 
         spin_lock_irqsave(&cm.lock, flags);
-        idr_remove(&cm.local_id_table, (int) local_id);
+        idr_remove(&cm.local_id_table, (__force int) local_id);
         spin_unlock_irqrestore(&cm.lock, flags);
 }
 
-static struct cm_id_private * cm_get_id(u32 local_id, u32 remote_id)
+static struct cm_id_private * cm_get_id(__be32 local_id, __be32 remote_id)
 {
         struct cm_id_private *cm_id_priv;
 
-        cm_id_priv = idr_find(&cm.local_id_table, (int) local_id);
+        cm_id_priv = idr_find(&cm.local_id_table, (__force int) local_id);
         if (cm_id_priv) {
                 if (cm_id_priv->id.remote_id == remote_id)
                         atomic_inc(&cm_id_priv->refcount);
@@ -339,7 +340,7 @@ static struct cm_id_private * cm_get_id(u32 local_id, u32 remote_id)
         return cm_id_priv;
 }
 
-static struct cm_id_private * cm_acquire_id(u32 local_id, u32 remote_id)
+static struct cm_id_private * cm_acquire_id(__be32 local_id, __be32 remote_id)
 {
         struct cm_id_private *cm_id_priv;
         unsigned long flags;
@@ -356,8 +357,8 @@ static struct cm_id_private * cm_insert_listen(struct cm_id_private *cm_id_priv)
         struct rb_node **link = &cm.listen_service_table.rb_node;
         struct rb_node *parent = NULL;
         struct cm_id_private *cur_cm_id_priv;
-        u64 service_id = cm_id_priv->id.service_id;
-        u64 service_mask = cm_id_priv->id.service_mask;
+        __be64 service_id = cm_id_priv->id.service_id;
+        __be64 service_mask = cm_id_priv->id.service_mask;
 
         while (*link) {
                 parent = *link;
@@ -376,7 +377,7 @@ static struct cm_id_private * cm_insert_listen(struct cm_id_private *cm_id_priv)
         return NULL;
 }
 
-static struct cm_id_private * cm_find_listen(u64 service_id)
+static struct cm_id_private * cm_find_listen(__be64 service_id)
 {
         struct rb_node *node = cm.listen_service_table.rb_node;
         struct cm_id_private *cm_id_priv;
@@ -400,8 +401,8 @@ static struct cm_timewait_info * cm_insert_remote_id(struct cm_timewait_info
         struct rb_node **link = &cm.remote_id_table.rb_node;
         struct rb_node *parent = NULL;
         struct cm_timewait_info *cur_timewait_info;
-        u64 remote_ca_guid = timewait_info->remote_ca_guid;
-        u32 remote_id = timewait_info->work.remote_id;
+        __be64 remote_ca_guid = timewait_info->remote_ca_guid;
+        __be32 remote_id = timewait_info->work.remote_id;
 
         while (*link) {
                 parent = *link;
@@ -424,8 +425,8 @@ static struct cm_timewait_info * cm_insert_remote_id(struct cm_timewait_info
         return NULL;
 }
 
-static struct cm_timewait_info * cm_find_remote_id(u64 remote_ca_guid,
-                                                   u32 remote_id)
+static struct cm_timewait_info * cm_find_remote_id(__be64 remote_ca_guid,
+                                                   __be32 remote_id)
 {
         struct rb_node *node = cm.remote_id_table.rb_node;
         struct cm_timewait_info *timewait_info;
@@ -453,8 +454,8 @@ static struct cm_timewait_info * cm_insert_remote_qpn(struct cm_timewait_info
         struct rb_node **link = &cm.remote_qp_table.rb_node;
         struct rb_node *parent = NULL;
         struct cm_timewait_info *cur_timewait_info;
-        u64 remote_ca_guid = timewait_info->remote_ca_guid;
-        u32 remote_qpn = timewait_info->remote_qpn;
+        __be64 remote_ca_guid = timewait_info->remote_ca_guid;
+        __be32 remote_qpn = timewait_info->remote_qpn;
 
         while (*link) {
                 parent = *link;
@@ -484,7 +485,7 @@ static struct cm_id_private * cm_insert_remote_sidr(struct cm_id_private
         struct rb_node *parent = NULL;
         struct cm_id_private *cur_cm_id_priv;
         union ib_gid *port_gid = &cm_id_priv->av.dgid;
-        u32 remote_id = cm_id_priv->id.remote_id;
+        __be32 remote_id = cm_id_priv->id.remote_id;
 
         while (*link) {
                 parent = *link;
@@ -598,7 +599,7 @@ static void cm_cleanup_timewait(struct cm_timewait_info *timewait_info)
         spin_unlock_irqrestore(&cm.lock, flags);
 }
 
-static struct cm_timewait_info * cm_create_timewait_info(u32 local_id)
+static struct cm_timewait_info * cm_create_timewait_info(__be32 local_id)
 {
         struct cm_timewait_info *timewait_info;
 
@@ -715,14 +716,15 @@ retest:
 EXPORT_SYMBOL(ib_destroy_cm_id);
 
 int ib_cm_listen(struct ib_cm_id *cm_id,
-                 u64 service_id,
-                 u64 service_mask)
+                 __be64 service_id,
+                 __be64 service_mask)
 {
         struct cm_id_private *cm_id_priv, *cur_cm_id_priv;
         unsigned long flags;
         int ret = 0;
 
-        service_mask = service_mask ? service_mask : ~0ULL;
+        service_mask = service_mask ? service_mask :
+                       __constant_cpu_to_be64(~0ULL);
         service_id &= service_mask;
         if ((service_id & IB_SERVICE_ID_AGN_MASK) == IB_CM_ASSIGN_SERVICE_ID &&
             (service_id != IB_CM_ASSIGN_SERVICE_ID))
@@ -735,8 +737,8 @@ int ib_cm_listen(struct ib_cm_id *cm_id,
 
         spin_lock_irqsave(&cm.lock, flags);
         if (service_id == IB_CM_ASSIGN_SERVICE_ID) {
-                cm_id->service_id = __cpu_to_be64(cm.listen_service_id++);
-                cm_id->service_mask = ~0ULL;
+                cm_id->service_id = cpu_to_be64(cm.listen_service_id++);
+                cm_id->service_mask = __constant_cpu_to_be64(~0ULL);
         } else {
                 cm_id->service_id = service_id;
                 cm_id->service_mask = service_mask;
@@ -752,18 +754,19 @@ int ib_cm_listen(struct ib_cm_id *cm_id,
 }
 EXPORT_SYMBOL(ib_cm_listen);
 
-static u64 cm_form_tid(struct cm_id_private *cm_id_priv,
-                       enum cm_msg_sequence msg_seq)
+static __be64 cm_form_tid(struct cm_id_private *cm_id_priv,
+                          enum cm_msg_sequence msg_seq)
 {
         u64 hi_tid, low_tid;
 
         hi_tid   = ((u64) cm_id_priv->av.port->mad_agent->hi_tid) << 32;
-        low_tid  = (u64) (cm_id_priv->id.local_id | (msg_seq << 30));
+        low_tid  = (u64) ((__force u32)cm_id_priv->id.local_id |
+                          (msg_seq << 30));
         return cpu_to_be64(hi_tid | low_tid);
 }
 
 static void cm_format_mad_hdr(struct ib_mad_hdr *hdr,
-                              enum cm_msg_attr_id attr_id, u64 tid)
+                              __be16 attr_id, __be64 tid)
 {
         hdr->base_version  = IB_MGMT_BASE_VERSION;
         hdr->mgmt_class    = IB_MGMT_CLASS_CM;
@@ -896,7 +899,7 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
                         goto error1;
         }
         cm_id->service_id = param->service_id;
-        cm_id->service_mask = ~0ULL;
+        cm_id->service_mask = __constant_cpu_to_be64(~0ULL);
         cm_id_priv->timeout_ms = cm_convert_to_ms(
                                     param->primary_path->packet_life_time) * 2 +
                                  cm_convert_to_ms(
@@ -963,7 +966,7 @@ static int cm_issue_rej(struct cm_port *port,
         rej_msg->remote_comm_id = rcv_msg->local_comm_id;
         rej_msg->local_comm_id = rcv_msg->remote_comm_id;
         cm_rej_set_msg_rejected(rej_msg, msg_rejected);
-        rej_msg->reason = reason;
+        rej_msg->reason = cpu_to_be16(reason);
 
         if (ari && ari_length) {
                 cm_rej_set_reject_info_len(rej_msg, ari_length);
@@ -977,8 +980,8 @@ static int cm_issue_rej(struct cm_port *port,
         return ret;
 }
 
-static inline int cm_is_active_peer(u64 local_ca_guid, u64 remote_ca_guid,
-                                    u32 local_qpn, u32 remote_qpn)
+static inline int cm_is_active_peer(__be64 local_ca_guid, __be64 remote_ca_guid,
+                                    __be32 local_qpn, __be32 remote_qpn)
 {
         return (be64_to_cpu(local_ca_guid) > be64_to_cpu(remote_ca_guid) ||
                 ((local_ca_guid == remote_ca_guid) &&
@@ -1137,7 +1140,7 @@ static void cm_format_rej(struct cm_rej_msg *rej_msg,
                 break;
         }
 
-        rej_msg->reason = reason;
+        rej_msg->reason = cpu_to_be16(reason);
         if (ari && ari_length) {
                 cm_rej_set_reject_info_len(rej_msg, ari_length);
                 memcpy(rej_msg->ari, ari, ari_length);
@@ -1276,7 +1279,7 @@ static int cm_req_handler(struct cm_work *work)
         cm_id_priv->id.cm_handler = listen_cm_id_priv->id.cm_handler;
         cm_id_priv->id.context = listen_cm_id_priv->id.context;
         cm_id_priv->id.service_id = req_msg->service_id;
-        cm_id_priv->id.service_mask = ~0ULL;
+        cm_id_priv->id.service_mask = __constant_cpu_to_be64(~0ULL);
 
         cm_format_paths_from_req(req_msg, &work->path[0], &work->path[1]);
         ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av);
@@ -1969,7 +1972,7 @@ static void cm_format_rej_event(struct cm_work *work)
         param = &work->cm_event.param.rej_rcvd;
         param->ari = rej_msg->ari;
         param->ari_length = cm_rej_get_reject_info_len(rej_msg);
-        param->reason = rej_msg->reason;
+        param->reason = __be16_to_cpu(rej_msg->reason);
         work->cm_event.private_data = &rej_msg->private_data;
 }
 
@@ -1978,20 +1981,20 @@ static struct cm_id_private * cm_acquire_rejected_id(struct cm_rej_msg *rej_msg)
         struct cm_timewait_info *timewait_info;
         struct cm_id_private *cm_id_priv;
         unsigned long flags;
-        u32 remote_id;
+        __be32 remote_id;
 
         remote_id = rej_msg->local_comm_id;
 
-        if (rej_msg->reason == IB_CM_REJ_TIMEOUT) {
+        if (__be16_to_cpu(rej_msg->reason) == IB_CM_REJ_TIMEOUT) {
                 spin_lock_irqsave(&cm.lock, flags);
-                timewait_info = cm_find_remote_id( *((u64 *) rej_msg->ari),
+                timewait_info = cm_find_remote_id( *((__be64 *) rej_msg->ari),
                                                   remote_id);
                 if (!timewait_info) {
                         spin_unlock_irqrestore(&cm.lock, flags);
                         return NULL;
                 }
                 cm_id_priv = idr_find(&cm.local_id_table,
-                                      (int) timewait_info->work.local_id);
+                                      (__force int) timewait_info->work.local_id);
                 if (cm_id_priv) {
                         if (cm_id_priv->id.remote_id == remote_id)
                                 atomic_inc(&cm_id_priv->refcount);
@@ -2032,7 +2035,7 @@ static int cm_rej_handler(struct cm_work *work)
                 /* fall through */
         case IB_CM_REQ_RCVD:
         case IB_CM_MRA_REQ_SENT:
-                if (rej_msg->reason == IB_CM_REJ_STALE_CONN)
+                if (__be16_to_cpu(rej_msg->reason) == IB_CM_REJ_STALE_CONN)
                         cm_enter_timewait(cm_id_priv);
                 else
                         cm_reset_to_idle(cm_id_priv);
@@ -2553,7 +2556,7 @@ static void cm_format_sidr_req(struct cm_sidr_req_msg *sidr_req_msg,
         cm_format_mad_hdr(&sidr_req_msg->hdr, CM_SIDR_REQ_ATTR_ID,
                           cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_SIDR));
         sidr_req_msg->request_id = cm_id_priv->id.local_id;
-        sidr_req_msg->pkey = param->pkey;
+        sidr_req_msg->pkey = cpu_to_be16(param->pkey);
         sidr_req_msg->service_id = param->service_id;
 
         if (param->private_data && param->private_data_len)
@@ -2580,7 +2583,7 @@ int ib_send_cm_sidr_req(struct ib_cm_id *cm_id,
                 goto out;
 
         cm_id->service_id = param->service_id;
-        cm_id->service_mask = ~0ULL;
+        cm_id->service_mask = __constant_cpu_to_be64(~0ULL);
         cm_id_priv->timeout_ms = param->timeout_ms;
         cm_id_priv->max_cm_retries = param->max_cm_retries;
         ret = cm_alloc_msg(cm_id_priv, &msg);
@@ -2621,7 +2624,7 @@ static void cm_format_sidr_req_event(struct cm_work *work,
         sidr_req_msg = (struct cm_sidr_req_msg *)
                                 work->mad_recv_wc->recv_buf.mad;
         param = &work->cm_event.param.sidr_req_rcvd;
-        param->pkey = sidr_req_msg->pkey;
+        param->pkey = __be16_to_cpu(sidr_req_msg->pkey);
         param->listen_id = listen_id;
         param->device = work->port->mad_agent->device;
         param->port = work->port->port_num;
@@ -2645,7 +2648,7 @@ static int cm_sidr_req_handler(struct cm_work *work)
         sidr_req_msg = (struct cm_sidr_req_msg *)
                                 work->mad_recv_wc->recv_buf.mad;
         wc = work->mad_recv_wc->wc;
-        cm_id_priv->av.dgid.global.subnet_prefix = wc->slid;
+        cm_id_priv->av.dgid.global.subnet_prefix = cpu_to_be64(wc->slid);
         cm_id_priv->av.dgid.global.interface_id = 0;
         cm_init_av_for_response(work->port, work->mad_recv_wc->wc,
                                 &cm_id_priv->av);
@@ -2673,7 +2676,7 @@ static int cm_sidr_req_handler(struct cm_work *work)
         cm_id_priv->id.cm_handler = cur_cm_id_priv->id.cm_handler;
         cm_id_priv->id.context = cur_cm_id_priv->id.context;
         cm_id_priv->id.service_id = sidr_req_msg->service_id;
-        cm_id_priv->id.service_mask = ~0ULL;
+        cm_id_priv->id.service_mask = __constant_cpu_to_be64(~0ULL);
 
         cm_format_sidr_req_event(work, &cur_cm_id_priv->id);
         cm_process_work(cm_id_priv, work);
@@ -3175,10 +3178,10 @@ int ib_cm_init_qp_attr(struct ib_cm_id *cm_id,
 }
 EXPORT_SYMBOL(ib_cm_init_qp_attr);
 
-static u64 cm_get_ca_guid(struct ib_device *device)
+static __be64 cm_get_ca_guid(struct ib_device *device)
 {
         struct ib_device_attr *device_attr;
-        u64 guid;
+        __be64 guid;
         int ret;
 
         device_attr = kmalloc(sizeof *device_attr, GFP_KERNEL);
diff --git a/drivers/infiniband/core/cm_msgs.h b/drivers/infiniband/core/cm_msgs.h
index 15a309a77b2b..813ab70bf6d5 100644
--- a/drivers/infiniband/core/cm_msgs.h
+++ b/drivers/infiniband/core/cm_msgs.h
@@ -34,7 +34,7 @@
 #if !defined(CM_MSGS_H)
 #define CM_MSGS_H
 
-#include <ib_mad.h>
+#include <rdma/ib_mad.h>
 
 /*
  * Parameters to routines below should be in network-byte order, and values
@@ -43,19 +43,17 @@
 
 #define IB_CM_CLASS_VERSION     2 /* IB specification 1.2 */
 
-enum cm_msg_attr_id {
-        CM_REQ_ATTR_ID      = __constant_htons(0x0010),
-        CM_MRA_ATTR_ID      = __constant_htons(0x0011),
-        CM_REJ_ATTR_ID      = __constant_htons(0x0012),
-        CM_REP_ATTR_ID      = __constant_htons(0x0013),
-        CM_RTU_ATTR_ID      = __constant_htons(0x0014),
-        CM_DREQ_ATTR_ID     = __constant_htons(0x0015),
-        CM_DREP_ATTR_ID     = __constant_htons(0x0016),
-        CM_SIDR_REQ_ATTR_ID = __constant_htons(0x0017),
-        CM_SIDR_REP_ATTR_ID = __constant_htons(0x0018),
-        CM_LAP_ATTR_ID      = __constant_htons(0x0019),
-        CM_APR_ATTR_ID      = __constant_htons(0x001A)
-};
+#define CM_REQ_ATTR_ID      __constant_htons(0x0010)
+#define CM_MRA_ATTR_ID      __constant_htons(0x0011)
+#define CM_REJ_ATTR_ID      __constant_htons(0x0012)
+#define CM_REP_ATTR_ID      __constant_htons(0x0013)
+#define CM_RTU_ATTR_ID      __constant_htons(0x0014)
+#define CM_DREQ_ATTR_ID     __constant_htons(0x0015)
+#define CM_DREP_ATTR_ID     __constant_htons(0x0016)
+#define CM_SIDR_REQ_ATTR_ID __constant_htons(0x0017)
+#define CM_SIDR_REP_ATTR_ID __constant_htons(0x0018)
+#define CM_LAP_ATTR_ID      __constant_htons(0x0019)
+#define CM_APR_ATTR_ID      __constant_htons(0x001A)
 
 enum cm_msg_sequence {
         CM_MSG_SEQUENCE_REQ,
@@ -67,35 +65,35 @@ enum cm_msg_sequence {
 struct cm_req_msg {
         struct ib_mad_hdr hdr;
 
-        u32 local_comm_id;
-        u32 rsvd4;
-        u64 service_id;
-        u64 local_ca_guid;
-        u32 rsvd24;
-        u32 local_qkey;
+        __be32 local_comm_id;
+        __be32 rsvd4;
+        __be64 service_id;
+        __be64 local_ca_guid;
+        __be32 rsvd24;
+        __be32 local_qkey;
         /* local QPN:24, responder resources:8 */
-        u32 offset32;
+        __be32 offset32;
         /* local EECN:24, initiator depth:8 */
-        u32 offset36;
+        __be32 offset36;
         /*
          * remote EECN:24, remote CM response timeout:5,
          * transport service type:2, end-to-end flow control:1
          */
-        u32 offset40;
+        __be32 offset40;
         /* starting PSN:24, local CM response timeout:5, retry count:3 */
-        u32 offset44;
-        u16 pkey;
+        __be32 offset44;
+        __be16 pkey;
         /* path MTU:4, RDC exists:1, RNR retry count:3. */
         u8 offset50;
         /* max CM Retries:4, SRQ:1, rsvd:3 */
         u8 offset51;
 
-        u16 primary_local_lid;
-        u16 primary_remote_lid;
+        __be16 primary_local_lid;
+        __be16 primary_remote_lid;
         union ib_gid primary_local_gid;
         union ib_gid primary_remote_gid;
         /* flow label:20, rsvd:6, packet rate:6 */
-        u32 primary_offset88;
+        __be32 primary_offset88;
         u8 primary_traffic_class;
         u8 primary_hop_limit;
         /* SL:4, subnet local:1, rsvd:3 */
@@ -103,12 +101,12 @@ struct cm_req_msg {
         /* local ACK timeout:5, rsvd:3 */
         u8 primary_offset95;
 
-        u16 alt_local_lid;
-        u16 alt_remote_lid;
+        __be16 alt_local_lid;
+        __be16 alt_remote_lid;
         union ib_gid alt_local_gid;
         union ib_gid alt_remote_gid;
         /* flow label:20, rsvd:6, packet rate:6 */
-        u32 alt_offset132;
+        __be32 alt_offset132;
         u8 alt_traffic_class;
         u8 alt_hop_limit;
         /* SL:4, subnet local:1, rsvd:3 */
@@ -120,12 +118,12 @@ struct cm_req_msg {
 
 } __attribute__ ((packed));
 
-static inline u32 cm_req_get_local_qpn(struct cm_req_msg *req_msg)
+static inline __be32 cm_req_get_local_qpn(struct cm_req_msg *req_msg)
 {
         return cpu_to_be32(be32_to_cpu(req_msg->offset32) >> 8);
 }
 
-static inline void cm_req_set_local_qpn(struct cm_req_msg *req_msg, u32 qpn)
+static inline void cm_req_set_local_qpn(struct cm_req_msg *req_msg, __be32 qpn)
 {
         req_msg->offset32 = cpu_to_be32((be32_to_cpu(qpn) << 8) |
                                          (be32_to_cpu(req_msg->offset32) &
@@ -208,13 +206,13 @@ static inline void cm_req_set_flow_ctrl(struct cm_req_msg *req_msg,
                                           0xFFFFFFFE));
 }
 
-static inline u32 cm_req_get_starting_psn(struct cm_req_msg *req_msg)
+static inline __be32 cm_req_get_starting_psn(struct cm_req_msg *req_msg)
 {
         return cpu_to_be32(be32_to_cpu(req_msg->offset44) >> 8);
 }
 
 static inline void cm_req_set_starting_psn(struct cm_req_msg *req_msg,
-                                           u32 starting_psn)
+                                           __be32 starting_psn)
 {
         req_msg->offset44 = cpu_to_be32((be32_to_cpu(starting_psn) << 8) |
                             (be32_to_cpu(req_msg->offset44) & 0x000000FF));
@@ -288,13 +286,13 @@ static inline void cm_req_set_srq(struct cm_req_msg *req_msg, u8 srq)
                                   ((srq & 0x1) << 3));
 }
 
-static inline u32 cm_req_get_primary_flow_label(struct cm_req_msg *req_msg)
+static inline __be32 cm_req_get_primary_flow_label(struct cm_req_msg *req_msg)
 {
-        return cpu_to_be32((be32_to_cpu(req_msg->primary_offset88) >> 12));
+        return cpu_to_be32(be32_to_cpu(req_msg->primary_offset88) >> 12);
 }
 
 static inline void cm_req_set_primary_flow_label(struct cm_req_msg *req_msg,
-                                                 u32 flow_label)
+                                                 __be32 flow_label)
 {
         req_msg->primary_offset88 = cpu_to_be32(
                                     (be32_to_cpu(req_msg->primary_offset88) &
@@ -350,13 +348,13 @@ static inline void cm_req_set_primary_local_ack_timeout(struct cm_req_msg *req_m
                                           (local_ack_timeout << 3));
 }
 
-static inline u32 cm_req_get_alt_flow_label(struct cm_req_msg *req_msg)
+static inline __be32 cm_req_get_alt_flow_label(struct cm_req_msg *req_msg)
 {
-        return cpu_to_be32((be32_to_cpu(req_msg->alt_offset132) >> 12));
+        return cpu_to_be32(be32_to_cpu(req_msg->alt_offset132) >> 12);
 }
 
 static inline void cm_req_set_alt_flow_label(struct cm_req_msg *req_msg,
-                                             u32 flow_label)
+                                             __be32 flow_label)
 {
         req_msg->alt_offset132 = cpu_to_be32(
                                  (be32_to_cpu(req_msg->alt_offset132) &
@@ -422,8 +420,8 @@ enum cm_msg_response {
  struct cm_mra_msg {
         struct ib_mad_hdr hdr;
 
-        u32 local_comm_id;
-        u32 remote_comm_id;
+        __be32 local_comm_id;
+        __be32 remote_comm_id;
         /* message MRAed:2, rsvd:6 */
         u8 offset8;
         /* service timeout:5, rsvd:3 */
@@ -458,13 +456,13 @@ static inline void cm_mra_set_service_timeout(struct cm_mra_msg *mra_msg,
 struct cm_rej_msg {
         struct ib_mad_hdr hdr;
 
-        u32 local_comm_id;
-        u32 remote_comm_id;
+        __be32 local_comm_id;
+        __be32 remote_comm_id;
         /* message REJected:2, rsvd:6 */
         u8 offset8;
         /* reject info length:7, rsvd:1. */
         u8 offset9;
-        u16 reason;
+        __be16 reason;
         u8 ari[IB_CM_REJ_ARI_LENGTH];
 
         u8 private_data[IB_CM_REJ_PRIVATE_DATA_SIZE];
@@ -495,45 +493,45 @@ static inline void cm_rej_set_reject_info_len(struct cm_rej_msg *rej_msg,
 struct cm_rep_msg {
         struct ib_mad_hdr hdr;
 
-        u32 local_comm_id;
-        u32 remote_comm_id;
-        u32 local_qkey;
+        __be32 local_comm_id;
+        __be32 remote_comm_id;
+        __be32 local_qkey;
         /* local QPN:24, rsvd:8 */
-        u32 offset12;
+        __be32 offset12;
         /* local EECN:24, rsvd:8 */
-        u32 offset16;
+        __be32 offset16;
         /* starting PSN:24 rsvd:8 */
-        u32 offset20;
+        __be32 offset20;
         u8 resp_resources;
         u8 initiator_depth;
         /* target ACK delay:5, failover accepted:2, end-to-end flow control:1 */
         u8 offset26;
         /* RNR retry count:3, SRQ:1, rsvd:5 */
         u8 offset27;
-        u64 local_ca_guid;
+        __be64 local_ca_guid;
 
         u8 private_data[IB_CM_REP_PRIVATE_DATA_SIZE];
 
 } __attribute__ ((packed));
 
-static inline u32 cm_rep_get_local_qpn(struct cm_rep_msg *rep_msg)
+static inline __be32 cm_rep_get_local_qpn(struct cm_rep_msg *rep_msg)
 {
         return cpu_to_be32(be32_to_cpu(rep_msg->offset12) >> 8);
 }
 
-static inline void cm_rep_set_local_qpn(struct cm_rep_msg *rep_msg, u32 qpn)
+static inline void cm_rep_set_local_qpn(struct cm_rep_msg *rep_msg, __be32 qpn)
 {
         rep_msg->offset12 = cpu_to_be32((be32_to_cpu(qpn) << 8) |
                             (be32_to_cpu(rep_msg->offset12) & 0x000000FF));
 }
 
-static inline u32 cm_rep_get_starting_psn(struct cm_rep_msg *rep_msg)
+static inline __be32 cm_rep_get_starting_psn(struct cm_rep_msg *rep_msg)
 {
         return cpu_to_be32(be32_to_cpu(rep_msg->offset20) >> 8);
 }
 
 static inline void cm_rep_set_starting_psn(struct cm_rep_msg *rep_msg,
-                                           u32 starting_psn)
+                                           __be32 starting_psn)
 {
         rep_msg->offset20 = cpu_to_be32((be32_to_cpu(starting_psn) << 8) |
                             (be32_to_cpu(rep_msg->offset20) & 0x000000FF));
@@ -600,8 +598,8 @@ static inline void cm_rep_set_srq(struct cm_rep_msg *rep_msg, u8 srq)
 struct cm_rtu_msg {
         struct ib_mad_hdr hdr;
 
-        u32 local_comm_id;
-        u32 remote_comm_id;
+        __be32 local_comm_id;
+        __be32 remote_comm_id;
 
         u8 private_data[IB_CM_RTU_PRIVATE_DATA_SIZE];
 
@@ -610,21 +608,21 @@ struct cm_rtu_msg {
 struct cm_dreq_msg {
         struct ib_mad_hdr hdr;
 
-        u32 local_comm_id;
-        u32 remote_comm_id;
+        __be32 local_comm_id;
+        __be32 remote_comm_id;
         /* remote QPN/EECN:24, rsvd:8 */
-        u32 offset8;
+        __be32 offset8;
 
         u8 private_data[IB_CM_DREQ_PRIVATE_DATA_SIZE];
 
 } __attribute__ ((packed));
 
-static inline u32 cm_dreq_get_remote_qpn(struct cm_dreq_msg *dreq_msg)
+static inline __be32 cm_dreq_get_remote_qpn(struct cm_dreq_msg *dreq_msg)
 {
         return cpu_to_be32(be32_to_cpu(dreq_msg->offset8) >> 8);
 }
 
-static inline void cm_dreq_set_remote_qpn(struct cm_dreq_msg *dreq_msg, u32 qpn)
+static inline void cm_dreq_set_remote_qpn(struct cm_dreq_msg *dreq_msg, __be32 qpn)
 {
         dreq_msg->offset8 = cpu_to_be32((be32_to_cpu(qpn) << 8) |
                             (be32_to_cpu(dreq_msg->offset8) & 0x000000FF));
@@ -633,8 +631,8 @@ static inline void cm_dreq_set_remote_qpn(struct cm_dreq_msg *dreq_msg, u32 qpn)
 struct cm_drep_msg {
         struct ib_mad_hdr hdr;
 
-        u32 local_comm_id;
-        u32 remote_comm_id;
+        __be32 local_comm_id;
+        __be32 remote_comm_id;
 
         u8 private_data[IB_CM_DREP_PRIVATE_DATA_SIZE];
 
@@ -643,37 +641,37 @@ struct cm_drep_msg {
 struct cm_lap_msg {
         struct ib_mad_hdr hdr;
 
-        u32 local_comm_id;
-        u32 remote_comm_id;
+        __be32 local_comm_id;
+        __be32 remote_comm_id;
 
-        u32 rsvd8;
+        __be32 rsvd8;
         /* remote QPN/EECN:24, remote CM response timeout:5, rsvd:3 */
-        u32 offset12;
-        u32 rsvd16;
+        __be32 offset12;
+        __be32 rsvd16;
 
-        u16 alt_local_lid;
-        u16 alt_remote_lid;
+        __be16 alt_local_lid;
+        __be16 alt_remote_lid;
         union ib_gid alt_local_gid;
         union ib_gid alt_remote_gid;
         /* flow label:20, rsvd:4, traffic class:8 */
-        u32 offset56;
+        __be32 offset56;
         u8 alt_hop_limit;
         /* rsvd:2, packet rate:6 */
-        uint8_t offset61;
+        u8 offset61;
         /* SL:4, subnet local:1, rsvd:3 */
-        uint8_t offset62;
+        u8 offset62;
         /* local ACK timeout:5, rsvd:3 */
-        uint8_t offset63;
+        u8 offset63;
 
         u8 private_data[IB_CM_LAP_PRIVATE_DATA_SIZE];
 } __attribute__  ((packed));
 
-static inline u32 cm_lap_get_remote_qpn(struct cm_lap_msg *lap_msg)
+static inline __be32 cm_lap_get_remote_qpn(struct cm_lap_msg *lap_msg)
 {
         return cpu_to_be32(be32_to_cpu(lap_msg->offset12) >> 8);
 }
 
-static inline void cm_lap_set_remote_qpn(struct cm_lap_msg *lap_msg, u32 qpn)
+static inline void cm_lap_set_remote_qpn(struct cm_lap_msg *lap_msg, __be32 qpn)
 {
         lap_msg->offset12 = cpu_to_be32((be32_to_cpu(qpn) << 8) |
                                          (be32_to_cpu(lap_msg->offset12) &
@@ -693,17 +691,17 @@ static inline void cm_lap_set_remote_resp_timeout(struct cm_lap_msg *lap_msg,
                                           0xFFFFFF07));
 }
 
-static inline u32 cm_lap_get_flow_label(struct cm_lap_msg *lap_msg)
+static inline __be32 cm_lap_get_flow_label(struct cm_lap_msg *lap_msg)
 {
-        return be32_to_cpu(lap_msg->offset56) >> 12;
+        return cpu_to_be32(be32_to_cpu(lap_msg->offset56) >> 12);
 }
 
 static inline void cm_lap_set_flow_label(struct cm_lap_msg *lap_msg,
-                                         u32 flow_label)
+                                         __be32 flow_label)
 {
-        lap_msg->offset56 = cpu_to_be32((flow_label << 12) |
-                                         (be32_to_cpu(lap_msg->offset56) &
-                                          0x00000FFF));
+        lap_msg->offset56 = cpu_to_be32(
+                                 (be32_to_cpu(lap_msg->offset56) & 0x00000FFF) |
+                                 (be32_to_cpu(flow_label) << 12));
 }
 
 static inline u8 cm_lap_get_traffic_class(struct cm_lap_msg *lap_msg)
@@ -766,8 +764,8 @@ static inline void cm_lap_set_local_ack_timeout(struct cm_lap_msg *lap_msg,
 struct cm_apr_msg {
         struct ib_mad_hdr hdr;
 
-        u32 local_comm_id;
-        u32 remote_comm_id;
+        __be32 local_comm_id;
+        __be32 remote_comm_id;
 
         u8 info_length;
         u8 ap_status;
@@ -779,10 +777,10 @@ struct cm_apr_msg {
 struct cm_sidr_req_msg {
         struct ib_mad_hdr hdr;
 
-        u32 request_id;
-        u16 pkey;
-        u16 rsvd;
-        u64 service_id;
+        __be32 request_id;
+        __be16 pkey;
+        __be16 rsvd;
+        __be64 service_id;
 
         u8 private_data[IB_CM_SIDR_REQ_PRIVATE_DATA_SIZE];
 } __attribute__ ((packed));
@@ -790,26 +788,26 @@ struct cm_sidr_req_msg {
 struct cm_sidr_rep_msg {
         struct ib_mad_hdr hdr;
 
-        u32 request_id;
+        __be32 request_id;
         u8 status;
         u8 info_length;
-        u16 rsvd;
+        __be16 rsvd;
         /* QPN:24, rsvd:8 */
-        u32 offset8;
-        u64 service_id;
-        u32 qkey;
+        __be32 offset8;
+        __be64 service_id;
+        __be32 qkey;
         u8 info[IB_CM_SIDR_REP_INFO_LENGTH];
 
         u8 private_data[IB_CM_SIDR_REP_PRIVATE_DATA_SIZE];
 } __attribute__ ((packed));
 
-static inline u32 cm_sidr_rep_get_qpn(struct cm_sidr_rep_msg *sidr_rep_msg)
+static inline __be32 cm_sidr_rep_get_qpn(struct cm_sidr_rep_msg *sidr_rep_msg)
 {
         return cpu_to_be32(be32_to_cpu(sidr_rep_msg->offset8) >> 8);
 }
 
 static inline void cm_sidr_rep_set_qpn(struct cm_sidr_rep_msg *sidr_rep_msg,
-                                       u32 qpn)
+                                       __be32 qpn)
 {
         sidr_rep_msg->offset8 = cpu_to_be32((be32_to_cpu(qpn) << 8) |
                                         (be32_to_cpu(sidr_rep_msg->offset8) &
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index 797049626ff6..7ad47a4b166b 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -38,7 +38,7 @@
 #include <linux/list.h>
 #include <linux/spinlock.h>
 
-#include <ib_verbs.h>
+#include <rdma/ib_verbs.h>
 
 int  ib_device_register_sysfs(struct ib_device *device);
 void ib_device_unregister_sysfs(struct ib_device *device);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 9197e92d708a..d3cf84e01587 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2004 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
index 7763b31abba7..d34a6f1c4f4c 100644
--- a/drivers/infiniband/core/fmr_pool.c
+++ b/drivers/infiniband/core/fmr_pool.c
@@ -39,7 +39,7 @@
 #include <linux/jhash.h>
 #include <linux/kthread.h>
 
-#include <ib_fmr_pool.h>
+#include <rdma/ib_fmr_pool.h>
 
 #include "core_priv.h"
 
@@ -334,6 +334,7 @@ void ib_destroy_fmr_pool(struct ib_fmr_pool *pool)
 {
         struct ib_pool_fmr *fmr;
         struct ib_pool_fmr *tmp;
+        LIST_HEAD(fmr_list);
         int                 i;
 
         kthread_stop(pool->thread);
@@ -341,6 +342,11 @@ void ib_destroy_fmr_pool(struct ib_fmr_pool *pool)
 
         i = 0;
         list_for_each_entry_safe(fmr, tmp, &pool->free_list, list) {
+                if (fmr->remap_count) {
+                        INIT_LIST_HEAD(&fmr_list);
+                        list_add_tail(&fmr->fmr->list, &fmr_list);
+                        ib_unmap_fmr(&fmr_list);
+                }
                 ib_dealloc_fmr(fmr->fmr);
                 list_del(&fmr->list);
                 kfree(fmr);
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index b97e210ce9c8..a4a4d9c1eef3 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -693,7 +693,8 @@ static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
                 goto out;
         }
 
-        build_smp_wc(send_wr->wr_id, smp->dr_slid, send_wr->wr.ud.pkey_index,
+        build_smp_wc(send_wr->wr_id, be16_to_cpu(smp->dr_slid),
+                     send_wr->wr.ud.pkey_index,
                      send_wr->wr.ud.port_num, &mad_wc);
 
         /* No GRH for DR SMP */
@@ -1554,7 +1555,7 @@ static int is_data_mad(struct ib_mad_agent_private *mad_agent_priv,
 }
 
 struct ib_mad_send_wr_private*
-ib_find_send_mad(struct ib_mad_agent_private *mad_agent_priv, u64 tid)
+ib_find_send_mad(struct ib_mad_agent_private *mad_agent_priv, __be64 tid)
 {
         struct ib_mad_send_wr_private *mad_send_wr;
 
@@ -1597,7 +1598,7 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
         struct ib_mad_send_wr_private *mad_send_wr;
         struct ib_mad_send_wc mad_send_wc;
         unsigned long flags;
-        u64 tid;
+        __be64 tid;
 
         INIT_LIST_HEAD(&mad_recv_wc->rmpp_list);
         list_add(&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list);
@@ -2165,7 +2166,8 @@ static void local_completions(void *data)
                          * Defined behavior is to complete response
                          * before request
                          */
-                        build_smp_wc(local->wr_id, IB_LID_PERMISSIVE,
+                        build_smp_wc(local->wr_id,
+                                     be16_to_cpu(IB_LID_PERMISSIVE),
                                      0 /* pkey index */,
                                      recv_mad_agent->agent.port_num, &wc);
 
@@ -2294,7 +2296,7 @@ static void timeout_sends(void *data)
         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
 }
 
-static void ib_mad_thread_completion_handler(struct ib_cq *cq)
+static void ib_mad_thread_completion_handler(struct ib_cq *cq, void *arg)
 {
         struct ib_mad_port_private *port_priv = cq->cq_context;
 
@@ -2574,8 +2576,7 @@ static int ib_mad_port_open(struct ib_device *device,
 
         cq_size = (IB_MAD_QP_SEND_SIZE + IB_MAD_QP_RECV_SIZE) * 2;
         port_priv->cq = ib_create_cq(port_priv->device,
-                                     (ib_comp_handler)
-                                        ib_mad_thread_completion_handler,
+                                     ib_mad_thread_completion_handler,
                                      NULL, port_priv, cq_size);
         if (IS_ERR(port_priv->cq)) {
                 printk(KERN_ERR PFX "Couldn't create ib_mad CQ\n");
diff --git a/drivers/infiniband/core/mad_priv.h b/drivers/infiniband/core/mad_priv.h
index 568da10b05ab..f1ba794e0daa 100644
--- a/drivers/infiniband/core/mad_priv.h
+++ b/drivers/infiniband/core/mad_priv.h
@@ -40,8 +40,8 @@
 #include <linux/pci.h>
 #include <linux/kthread.h>
 #include <linux/workqueue.h>
-#include <ib_mad.h>
-#include <ib_smi.h>
+#include <rdma/ib_mad.h>
+#include <rdma/ib_smi.h>
 
 
 #define PFX "ib_mad: "
@@ -121,7 +121,7 @@ struct ib_mad_send_wr_private {
         struct ib_send_wr send_wr;
         struct ib_sge sg_list[IB_MAD_SEND_REQ_MAX_SG];
         u64 wr_id;                      /* client WR ID */
-        u64 tid;
+        __be64 tid;
         unsigned long timeout;
         int retries;
         int retry;
@@ -144,7 +144,7 @@ struct ib_mad_local_private {
         struct ib_send_wr send_wr;
         struct ib_sge sg_list[IB_MAD_SEND_REQ_MAX_SG];
         u64 wr_id;                      /* client WR ID */
-        u64 tid;
+        __be64 tid;
 };
 
 struct ib_mad_mgmt_method_table {
@@ -210,7 +210,7 @@ extern kmem_cache_t *ib_mad_cache;
 int ib_send_mad(struct ib_mad_send_wr_private *mad_send_wr);
 
 struct ib_mad_send_wr_private *
-ib_find_send_mad(struct ib_mad_agent_private *mad_agent_priv, u64 tid);
+ib_find_send_mad(struct ib_mad_agent_private *mad_agent_priv, __be64 tid);
 
 void ib_mad_complete_send_wr(struct ib_mad_send_wr_private *mad_send_wr,
                              struct ib_mad_send_wc *mad_send_wc);
diff --git a/drivers/infiniband/core/mad_rmpp.c b/drivers/infiniband/core/mad_rmpp.c
index 8f1eb80e421f..43fd805e0265 100644
--- a/drivers/infiniband/core/mad_rmpp.c
+++ b/drivers/infiniband/core/mad_rmpp.c
@@ -61,7 +61,7 @@ struct mad_rmpp_recv {
         int seg_num;
         int newwin;
 
-        u64 tid;
+        __be64 tid;
         u32 src_qp;
         u16 slid;
         u8 mgmt_class;
@@ -100,6 +100,121 @@ void ib_cancel_rmpp_recvs(struct ib_mad_agent_private *agent)
         }
 }
 
+static int data_offset(u8 mgmt_class)
+{
+        if (mgmt_class == IB_MGMT_CLASS_SUBN_ADM)
+                return offsetof(struct ib_sa_mad, data);
+        else if ((mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
+                 (mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END))
+                return offsetof(struct ib_vendor_mad, data);
+        else
+                return offsetof(struct ib_rmpp_mad, data);
+}
+
+static void format_ack(struct ib_rmpp_mad *ack,
+                       struct ib_rmpp_mad *data,
+                       struct mad_rmpp_recv *rmpp_recv)
+{
+        unsigned long flags;
+
+        memcpy(&ack->mad_hdr, &data->mad_hdr,
+               data_offset(data->mad_hdr.mgmt_class));
+
+        ack->mad_hdr.method ^= IB_MGMT_METHOD_RESP;
+        ack->rmpp_hdr.rmpp_type = IB_MGMT_RMPP_TYPE_ACK;
+        ib_set_rmpp_flags(&ack->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
+
+        spin_lock_irqsave(&rmpp_recv->lock, flags);
+        rmpp_recv->last_ack = rmpp_recv->seg_num;
+        ack->rmpp_hdr.seg_num = cpu_to_be32(rmpp_recv->seg_num);
+        ack->rmpp_hdr.paylen_newwin = cpu_to_be32(rmpp_recv->newwin);
+        spin_unlock_irqrestore(&rmpp_recv->lock, flags);
+}
+
+static void ack_recv(struct mad_rmpp_recv *rmpp_recv,
+                     struct ib_mad_recv_wc *recv_wc)
+{
+        struct ib_mad_send_buf *msg;
+        struct ib_send_wr *bad_send_wr;
+        int hdr_len, ret;
+
+        hdr_len = sizeof(struct ib_mad_hdr) + sizeof(struct ib_rmpp_hdr);
+        msg = ib_create_send_mad(&rmpp_recv->agent->agent, recv_wc->wc->src_qp,
+                                 recv_wc->wc->pkey_index, rmpp_recv->ah, 1,
+                                 hdr_len, sizeof(struct ib_rmpp_mad) - hdr_len,
+                                 GFP_KERNEL);
+        if (!msg)
+                return;
+
+        format_ack((struct ib_rmpp_mad *) msg->mad,
+                   (struct ib_rmpp_mad *) recv_wc->recv_buf.mad, rmpp_recv);
+        ret = ib_post_send_mad(&rmpp_recv->agent->agent, &msg->send_wr,
+                               &bad_send_wr);
+        if (ret)
+                ib_free_send_mad(msg);
+}
+
+static int alloc_response_msg(struct ib_mad_agent *agent,
+                              struct ib_mad_recv_wc *recv_wc,
+                              struct ib_mad_send_buf **msg)
+{
+        struct ib_mad_send_buf *m;
+        struct ib_ah *ah;
+        int hdr_len;
+
+        ah = ib_create_ah_from_wc(agent->qp->pd, recv_wc->wc,
+                                  recv_wc->recv_buf.grh, agent->port_num);
+        if (IS_ERR(ah))
+                return PTR_ERR(ah);
+
+        hdr_len = sizeof(struct ib_mad_hdr) + sizeof(struct ib_rmpp_hdr);
+        m = ib_create_send_mad(agent, recv_wc->wc->src_qp,
+                               recv_wc->wc->pkey_index, ah, 1, hdr_len,
+                               sizeof(struct ib_rmpp_mad) - hdr_len,
+                               GFP_KERNEL);
+        if (IS_ERR(m)) {
+                ib_destroy_ah(ah);
+                return PTR_ERR(m);
+        }
+        *msg = m;
+        return 0;
+}
+
+static void free_msg(struct ib_mad_send_buf *msg)
+{
+        ib_destroy_ah(msg->send_wr.wr.ud.ah);
+        ib_free_send_mad(msg);
+}
+
+static void nack_recv(struct ib_mad_agent_private *agent,
+                      struct ib_mad_recv_wc *recv_wc, u8 rmpp_status)
+{
+        struct ib_mad_send_buf *msg;
+        struct ib_rmpp_mad *rmpp_mad;
+        struct ib_send_wr *bad_send_wr;
+        int ret;
+
+        ret = alloc_response_msg(&agent->agent, recv_wc, &msg);
+        if (ret)
+                return;
+
+        rmpp_mad = (struct ib_rmpp_mad *) msg->mad;
+        memcpy(rmpp_mad, recv_wc->recv_buf.mad,
+               data_offset(recv_wc->recv_buf.mad->mad_hdr.mgmt_class));
+
+        rmpp_mad->mad_hdr.method ^= IB_MGMT_METHOD_RESP;
+        rmpp_mad->rmpp_hdr.rmpp_version = IB_MGMT_RMPP_VERSION;
+        rmpp_mad->rmpp_hdr.rmpp_type = IB_MGMT_RMPP_TYPE_ABORT;
+        ib_set_rmpp_flags(&rmpp_mad->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
+        rmpp_mad->rmpp_hdr.rmpp_status = rmpp_status;
+        rmpp_mad->rmpp_hdr.seg_num = 0;
+        rmpp_mad->rmpp_hdr.paylen_newwin = 0;
+
+        ret = ib_post_send_mad(&agent->agent, &msg->send_wr, &bad_send_wr);
+        if (ret)
+                free_msg(msg);
+}
+
 static void recv_timeout_handler(void *data)
 {
         struct mad_rmpp_recv *rmpp_recv = data;
@@ -115,8 +230,8 @@ static void recv_timeout_handler(void *data)
         list_del(&rmpp_recv->list);
         spin_unlock_irqrestore(&rmpp_recv->agent->lock, flags);
 
-        /* TODO: send abort. */
         rmpp_wc = rmpp_recv->rmpp_wc;
+        nack_recv(rmpp_recv->agent, rmpp_wc, IB_MGMT_RMPP_STATUS_T2L);
         destroy_rmpp_recv(rmpp_recv);
         ib_free_recv_mad(rmpp_wc);
 }
@@ -230,60 +345,6 @@ insert_rmpp_recv(struct ib_mad_agent_private *agent,
         return cur_rmpp_recv;
 }
 
-static int data_offset(u8 mgmt_class)
-{
-        if (mgmt_class == IB_MGMT_CLASS_SUBN_ADM)
-                return offsetof(struct ib_sa_mad, data);
-        else if ((mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
-                 (mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END))
-                return offsetof(struct ib_vendor_mad, data);
-        else
-                return offsetof(struct ib_rmpp_mad, data);
-}
-
-static void format_ack(struct ib_rmpp_mad *ack,
-                       struct ib_rmpp_mad *data,
-                       struct mad_rmpp_recv *rmpp_recv)
-{
-        unsigned long flags;
-
-        memcpy(&ack->mad_hdr, &data->mad_hdr,
-               data_offset(data->mad_hdr.mgmt_class));
-
-        ack->mad_hdr.method ^= IB_MGMT_METHOD_RESP;
-        ack->rmpp_hdr.rmpp_type = IB_MGMT_RMPP_TYPE_ACK;
-        ib_set_rmpp_flags(&ack->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
-
-        spin_lock_irqsave(&rmpp_recv->lock, flags);
-        rmpp_recv->last_ack = rmpp_recv->seg_num;
-        ack->rmpp_hdr.seg_num = cpu_to_be32(rmpp_recv->seg_num);
-        ack->rmpp_hdr.paylen_newwin = cpu_to_be32(rmpp_recv->newwin);
-        spin_unlock_irqrestore(&rmpp_recv->lock, flags);
-}
-
-static void ack_recv(struct mad_rmpp_recv *rmpp_recv,
-                     struct ib_mad_recv_wc *recv_wc)
-{
-        struct ib_mad_send_buf *msg;
-        struct ib_send_wr *bad_send_wr;
-        int hdr_len, ret;
-
-        hdr_len = sizeof(struct ib_mad_hdr) + sizeof(struct ib_rmpp_hdr);
-        msg = ib_create_send_mad(&rmpp_recv->agent->agent, recv_wc->wc->src_qp,
-                                 recv_wc->wc->pkey_index, rmpp_recv->ah, 1,
-                                 hdr_len, sizeof(struct ib_rmpp_mad) - hdr_len,
-                                 GFP_KERNEL);
-        if (!msg)
-                return;
-
-        format_ack((struct ib_rmpp_mad *) msg->mad,
-                   (struct ib_rmpp_mad *) recv_wc->recv_buf.mad, rmpp_recv);
-        ret = ib_post_send_mad(&rmpp_recv->agent->agent, &msg->send_wr,
-                               &bad_send_wr);
-        if (ret)
-                ib_free_send_mad(msg);
-}
-
 static inline int get_last_flag(struct ib_mad_recv_buf *seg)
 {
         struct ib_rmpp_mad *rmpp_mad;
@@ -559,6 +620,34 @@ static int send_next_seg(struct ib_mad_send_wr_private *mad_send_wr)
         return ib_send_mad(mad_send_wr);
 }
 
+static void abort_send(struct ib_mad_agent_private *agent, __be64 tid,
+                       u8 rmpp_status)
+{
+        struct ib_mad_send_wr_private *mad_send_wr;
+        struct ib_mad_send_wc wc;
+        unsigned long flags;
+
+        spin_lock_irqsave(&agent->lock, flags);
+        mad_send_wr = ib_find_send_mad(agent, tid);
+        if (!mad_send_wr)
+                goto out;       /* Unmatched send */
+
+        if ((mad_send_wr->last_ack == mad_send_wr->total_seg) ||
+            (!mad_send_wr->timeout) || (mad_send_wr->status != IB_WC_SUCCESS))
+                goto out;       /* Send is already done */
+
+        ib_mark_mad_done(mad_send_wr);
+        spin_unlock_irqrestore(&agent->lock, flags);
+
+        wc.status = IB_WC_REM_ABORT_ERR;
+        wc.vendor_err = rmpp_status;
+        wc.wr_id = mad_send_wr->wr_id;
+        ib_mad_complete_send_wr(mad_send_wr, &wc);
+        return;
+out:
+        spin_unlock_irqrestore(&agent->lock, flags);
+}
+
 static void process_rmpp_ack(struct ib_mad_agent_private *agent,
                              struct ib_mad_recv_wc *mad_recv_wc)
 {
@@ -568,11 +657,21 @@ static void process_rmpp_ack(struct ib_mad_agent_private *agent,
         int seg_num, newwin, ret;
 
         rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad;
-        if (rmpp_mad->rmpp_hdr.rmpp_status)
+        if (rmpp_mad->rmpp_hdr.rmpp_status) {
+                abort_send(agent, rmpp_mad->mad_hdr.tid,
+                           IB_MGMT_RMPP_STATUS_BAD_STATUS);
+                nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
                 return;
+        }
 
         seg_num = be32_to_cpu(rmpp_mad->rmpp_hdr.seg_num);
         newwin = be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
+        if (newwin < seg_num) {
+                abort_send(agent, rmpp_mad->mad_hdr.tid,
+                           IB_MGMT_RMPP_STATUS_W2S);
+                nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_W2S);
+                return;
+        }
 
         spin_lock_irqsave(&agent->lock, flags);
         mad_send_wr = ib_find_send_mad(agent, rmpp_mad->mad_hdr.tid);
@@ -583,8 +682,13 @@ static void process_rmpp_ack(struct ib_mad_agent_private *agent,
             (!mad_send_wr->timeout) || (mad_send_wr->status != IB_WC_SUCCESS))
                 goto out;       /* Send is already done */
 
-        if (seg_num > mad_send_wr->total_seg)
-                goto out;       /* Bad ACK */
+        if (seg_num > mad_send_wr->total_seg || seg_num > mad_send_wr->newwin) {
+                spin_unlock_irqrestore(&agent->lock, flags);
+                abort_send(agent, rmpp_mad->mad_hdr.tid,
+                           IB_MGMT_RMPP_STATUS_S2B);
+                nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_S2B);
+                return;
+        }
 
         if (newwin < mad_send_wr->newwin || seg_num < mad_send_wr->last_ack)
                 goto out;       /* Old ACK */
@@ -628,6 +732,72 @@ out:
         spin_unlock_irqrestore(&agent->lock, flags);
 }
 
+static struct ib_mad_recv_wc *
+process_rmpp_data(struct ib_mad_agent_private *agent,
+                  struct ib_mad_recv_wc *mad_recv_wc)
+{
+        struct ib_rmpp_hdr *rmpp_hdr;
+        u8 rmpp_status;
+
+        rmpp_hdr = &((struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad)->rmpp_hdr;
+
+        if (rmpp_hdr->rmpp_status) {
+                rmpp_status = IB_MGMT_RMPP_STATUS_BAD_STATUS;
+                goto bad;
+        }
+
+        if (rmpp_hdr->seg_num == __constant_htonl(1)) {
+                if (!(ib_get_rmpp_flags(rmpp_hdr) & IB_MGMT_RMPP_FLAG_FIRST)) {
+                        rmpp_status = IB_MGMT_RMPP_STATUS_BAD_SEG;
+                        goto bad;
+                }
+                return start_rmpp(agent, mad_recv_wc);
+        } else {
+                if (ib_get_rmpp_flags(rmpp_hdr) & IB_MGMT_RMPP_FLAG_FIRST) {
+                        rmpp_status = IB_MGMT_RMPP_STATUS_BAD_SEG;
+                        goto bad;
+                }
+                return continue_rmpp(agent, mad_recv_wc);
+        }
+bad:
+        nack_recv(agent, mad_recv_wc, rmpp_status);
+        ib_free_recv_mad(mad_recv_wc);
+        return NULL;
+}
+
+static void process_rmpp_stop(struct ib_mad_agent_private *agent,
+                              struct ib_mad_recv_wc *mad_recv_wc)
+{
+        struct ib_rmpp_mad *rmpp_mad;
+
+        rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad;
+
+        if (rmpp_mad->rmpp_hdr.rmpp_status != IB_MGMT_RMPP_STATUS_RESX) {
+                abort_send(agent, rmpp_mad->mad_hdr.tid,
+                           IB_MGMT_RMPP_STATUS_BAD_STATUS);
+                nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
+        } else
+                abort_send(agent, rmpp_mad->mad_hdr.tid,
+                           rmpp_mad->rmpp_hdr.rmpp_status);
+}
+
+static void process_rmpp_abort(struct ib_mad_agent_private *agent,
+                               struct ib_mad_recv_wc *mad_recv_wc)
+{
+        struct ib_rmpp_mad *rmpp_mad;
+
+        rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad;
+
+        if (rmpp_mad->rmpp_hdr.rmpp_status < IB_MGMT_RMPP_STATUS_ABORT_MIN ||
+            rmpp_mad->rmpp_hdr.rmpp_status > IB_MGMT_RMPP_STATUS_ABORT_MAX) {
+                abort_send(agent, rmpp_mad->mad_hdr.tid,
+                           IB_MGMT_RMPP_STATUS_BAD_STATUS);
+                nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
+        } else
+                abort_send(agent, rmpp_mad->mad_hdr.tid,
+                           rmpp_mad->rmpp_hdr.rmpp_status);
+}
+
 struct ib_mad_recv_wc *
 ib_process_rmpp_recv_wc(struct ib_mad_agent_private *agent,
                         struct ib_mad_recv_wc *mad_recv_wc)
@@ -638,23 +808,29 @@ ib_process_rmpp_recv_wc(struct ib_mad_agent_private *agent,
         if (!(rmpp_mad->rmpp_hdr.rmpp_rtime_flags & IB_MGMT_RMPP_FLAG_ACTIVE))
                 return mad_recv_wc;
 
-        if (rmpp_mad->rmpp_hdr.rmpp_version != IB_MGMT_RMPP_VERSION)
+        if (rmpp_mad->rmpp_hdr.rmpp_version != IB_MGMT_RMPP_VERSION) {
+                abort_send(agent, rmpp_mad->mad_hdr.tid,
+                           IB_MGMT_RMPP_STATUS_UNV);
+                nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_UNV);
                 goto out;
+        }
 
         switch (rmpp_mad->rmpp_hdr.rmpp_type) {
         case IB_MGMT_RMPP_TYPE_DATA:
-                if (rmpp_mad->rmpp_hdr.seg_num == __constant_htonl(1))
-                        return start_rmpp(agent, mad_recv_wc);
-                else
-                        return continue_rmpp(agent, mad_recv_wc);
+                return process_rmpp_data(agent, mad_recv_wc);
         case IB_MGMT_RMPP_TYPE_ACK:
                 process_rmpp_ack(agent, mad_recv_wc);
                 break;
         case IB_MGMT_RMPP_TYPE_STOP:
+                process_rmpp_stop(agent, mad_recv_wc);
+                break;
         case IB_MGMT_RMPP_TYPE_ABORT:
-                /* TODO: process_rmpp_nack(agent, mad_recv_wc); */
+                process_rmpp_abort(agent, mad_recv_wc);
                 break;
         default:
+                abort_send(agent, rmpp_mad->mad_hdr.tid,
+                           IB_MGMT_RMPP_STATUS_BADT);
+                nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BADT);
                 break;
         }
 out:
@@ -714,7 +890,10 @@ int ib_process_rmpp_send_wc(struct ib_mad_send_wr_private *mad_send_wr,
         if (rmpp_mad->rmpp_hdr.rmpp_type != IB_MGMT_RMPP_TYPE_DATA) {
                 msg = (struct ib_mad_send_buf *) (unsigned long)
                       mad_send_wc->wr_id;
-                ib_free_send_mad(msg);
+                if (rmpp_mad->rmpp_hdr.rmpp_type == IB_MGMT_RMPP_TYPE_ACK)
+                        ib_free_send_mad(msg);
+                else
+                        free_msg(msg);
                 return IB_RMPP_RESULT_INTERNAL;  /* ACK, STOP, or ABORT */
         }
 
diff --git a/drivers/infiniband/core/packer.c b/drivers/infiniband/core/packer.c
index eb5ff54c10d7..35df5010e723 100644
--- a/drivers/infiniband/core/packer.c
+++ b/drivers/infiniband/core/packer.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
+ * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -32,7 +33,7 @@
  * $Id: packer.c 1349 2004-12-16 21:09:43Z roland $
  */
 
-#include <ib_pack.h>
+#include <rdma/ib_pack.h>
 
 static u64 value_read(int offset, int size, void *structure)
 {
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 795184931c83..126ac80db7b8 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2004 Topspin Communications.  All rights reserved.
- * Copyright (c) 2005 Voltaire, Inc.  All rights reserved.
+ * Copyright (c) 2005 Voltaire, Inc.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -44,8 +44,8 @@
 #include <linux/kref.h>
 #include <linux/idr.h>
 
-#include <ib_pack.h>
-#include <ib_sa.h>
+#include <rdma/ib_pack.h>
+#include <rdma/ib_sa.h>
 
 MODULE_AUTHOR("Roland Dreier");
 MODULE_DESCRIPTION("InfiniBand subnet administration query support");
diff --git a/drivers/infiniband/core/smi.c b/drivers/infiniband/core/smi.c
index b4b284324a33..35852e794e26 100644
--- a/drivers/infiniband/core/smi.c
+++ b/drivers/infiniband/core/smi.c
@@ -1,9 +1,10 @@
 /*
- * Copyright (c) 2004 Mellanox Technologies Ltd.  All rights reserved.
- * Copyright (c) 2004 Infinicon Corporation.  All rights reserved.
- * Copyright (c) 2004 Intel Corporation.  All rights reserved.
- * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
- * Copyright (c) 2004 Voltaire Corporation.  All rights reserved.
+ * Copyright (c) 2004, 2005 Mellanox Technologies Ltd.  All rights reserved.
+ * Copyright (c) 2004, 2005 Infinicon Corporation.  All rights reserved.
+ * Copyright (c) 2004, 2005 Intel Corporation.  All rights reserved.
+ * Copyright (c) 2004, 2005 Topspin Corporation.  All rights reserved.
+ * Copyright (c) 2004, 2005 Voltaire Corporation.  All rights reserved.
+ * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -36,7 +37,7 @@
  * $Id: smi.c 1389 2004-12-27 22:56:47Z roland $
  */
 
-#include <ib_smi.h>
+#include <rdma/ib_smi.h>
 #include "smi.h"
 
 /*
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 90d51b179abe..fae1c2dcee51 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -1,5 +1,7 @@
 /*
  * Copyright (c) 2004, 2005 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies Ltd.  All rights reserved.
+ * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -34,7 +36,7 @@
 
 #include "core_priv.h"
 
-#include <ib_mad.h>
+#include <rdma/ib_mad.h>
 
 struct ib_port {
         struct kobject         kobj;
@@ -253,14 +255,14 @@ static ssize_t show_port_gid(struct ib_port *p, struct port_attribute *attr,
                 return ret;
 
         return sprintf(buf, "%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x\n",
-                       be16_to_cpu(((u16 *) gid.raw)[0]),
-                       be16_to_cpu(((u16 *) gid.raw)[1]),
-                       be16_to_cpu(((u16 *) gid.raw)[2]),
-                       be16_to_cpu(((u16 *) gid.raw)[3]),
-                       be16_to_cpu(((u16 *) gid.raw)[4]),
-                       be16_to_cpu(((u16 *) gid.raw)[5]),
-                       be16_to_cpu(((u16 *) gid.raw)[6]),
-                       be16_to_cpu(((u16 *) gid.raw)[7]));
+                       be16_to_cpu(((__be16 *) gid.raw)[0]),
+                       be16_to_cpu(((__be16 *) gid.raw)[1]),
+                       be16_to_cpu(((__be16 *) gid.raw)[2]),
+                       be16_to_cpu(((__be16 *) gid.raw)[3]),
+                       be16_to_cpu(((__be16 *) gid.raw)[4]),
+                       be16_to_cpu(((__be16 *) gid.raw)[5]),
+                       be16_to_cpu(((__be16 *) gid.raw)[6]),
+                       be16_to_cpu(((__be16 *) gid.raw)[7]));
 }
 
 static ssize_t show_port_pkey(struct ib_port *p, struct port_attribute *attr,
@@ -332,11 +334,11 @@ static ssize_t show_pma_counter(struct ib_port *p, struct port_attribute *attr,
                 break;
         case 16:
                 ret = sprintf(buf, "%u\n",
-                              be16_to_cpup((u16 *)(out_mad->data + 40 + offset / 8)));
+                              be16_to_cpup((__be16 *)(out_mad->data + 40 + offset / 8)));
                 break;
         case 32:
                 ret = sprintf(buf, "%u\n",
-                              be32_to_cpup((u32 *)(out_mad->data + 40 + offset / 8)));
+                              be32_to_cpup((__be32 *)(out_mad->data + 40 + offset / 8)));
                 break;
         default:
                 ret = 0;
@@ -598,10 +600,10 @@ static ssize_t show_sys_image_guid(struct class_device *cdev, char *buf)
                 return ret;
 
         return sprintf(buf, "%04x:%04x:%04x:%04x\n",
-                       be16_to_cpu(((u16 *) &attr.sys_image_guid)[0]),
-                       be16_to_cpu(((u16 *) &attr.sys_image_guid)[1]),
-                       be16_to_cpu(((u16 *) &attr.sys_image_guid)[2]),
-                       be16_to_cpu(((u16 *) &attr.sys_image_guid)[3]));
+                       be16_to_cpu(((__be16 *) &attr.sys_image_guid)[0]),
+                       be16_to_cpu(((__be16 *) &attr.sys_image_guid)[1]),
+                       be16_to_cpu(((__be16 *) &attr.sys_image_guid)[2]),
+                       be16_to_cpu(((__be16 *) &attr.sys_image_guid)[3]));
 }
 
 static ssize_t show_node_guid(struct class_device *cdev, char *buf)
@@ -615,10 +617,10 @@ static ssize_t show_node_guid(struct class_device *cdev, char *buf)
                 return ret;
 
         return sprintf(buf, "%04x:%04x:%04x:%04x\n",
-                       be16_to_cpu(((u16 *) &attr.node_guid)[0]),
-                       be16_to_cpu(((u16 *) &attr.node_guid)[1]),
-                       be16_to_cpu(((u16 *) &attr.node_guid)[2]),
-                       be16_to_cpu(((u16 *) &attr.node_guid)[3]));
+                       be16_to_cpu(((__be16 *) &attr.node_guid)[0]),
+                       be16_to_cpu(((__be16 *) &attr.node_guid)[1]),
+                       be16_to_cpu(((__be16 *) &attr.node_guid)[2]),
+                       be16_to_cpu(((__be16 *) &attr.node_guid)[3]));
 }
 
 static CLASS_DEVICE_ATTR(node_type, S_IRUGO, show_node_type, NULL);
diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
index 61d07c732f49..79595826ccc7 100644
--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2005 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Intel Corporation.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -73,14 +74,18 @@ static struct semaphore ctx_id_mutex;
 static struct idr       ctx_id_table;
 static int              ctx_id_rover = 0;
 
-static struct ib_ucm_context *ib_ucm_ctx_get(int id)
+static struct ib_ucm_context *ib_ucm_ctx_get(struct ib_ucm_file *file, int id)
 {
         struct ib_ucm_context *ctx;
 
         down(&ctx_id_mutex);
         ctx = idr_find(&ctx_id_table, id);
-        if (ctx)
-                ctx->ref++;
+        if (!ctx)
+                ctx = ERR_PTR(-ENOENT);
+        else if (ctx->file != file)
+                ctx = ERR_PTR(-EINVAL);
+        else
+                atomic_inc(&ctx->ref);
         up(&ctx_id_mutex);
 
         return ctx;
@@ -88,21 +93,37 @@ static struct ib_ucm_context *ib_ucm_ctx_get(int id)
 
 static void ib_ucm_ctx_put(struct ib_ucm_context *ctx)
 {
+        if (atomic_dec_and_test(&ctx->ref))
+                wake_up(&ctx->wait);
+}
+
+static ssize_t ib_ucm_destroy_ctx(struct ib_ucm_file *file, int id)
+{
+        struct ib_ucm_context *ctx;
         struct ib_ucm_event *uevent;
 
         down(&ctx_id_mutex);
-
-        ctx->ref--;
-        if (!ctx->ref)
+        ctx = idr_find(&ctx_id_table, id);
+        if (!ctx)
+                ctx = ERR_PTR(-ENOENT);
+        else if (ctx->file != file)
+                ctx = ERR_PTR(-EINVAL);
+        else
                 idr_remove(&ctx_id_table, ctx->id);
-
         up(&ctx_id_mutex);
 
-        if (ctx->ref)
-                return;
+        if (IS_ERR(ctx))
+                return PTR_ERR(ctx);
 
-        down(&ctx->file->mutex);
+        atomic_dec(&ctx->ref);
+        wait_event(ctx->wait, !atomic_read(&ctx->ref));
+
+        /* No new events will be generated after destroying the cm_id. */
+        if (!IS_ERR(ctx->cm_id))
+                ib_destroy_cm_id(ctx->cm_id);
 
+        /* Cleanup events not yet reported to the user. */
+        down(&file->mutex);
         list_del(&ctx->file_list);
         while (!list_empty(&ctx->events)) {
 
@@ -117,13 +138,10 @@ static void ib_ucm_ctx_put(struct ib_ucm_context *ctx)
 
                 kfree(uevent);
         }
+        up(&file->mutex);
 
-        up(&ctx->file->mutex);
-
-        ucm_dbg("Destroyed CM ID <%d>\n", ctx->id);
-
-        ib_destroy_cm_id(ctx->cm_id);
         kfree(ctx);
+        return 0;
 }
 
 static struct ib_ucm_context *ib_ucm_ctx_alloc(struct ib_ucm_file *file)
@@ -135,11 +153,11 @@ static struct ib_ucm_context *ib_ucm_ctx_alloc(struct ib_ucm_file *file)
         if (!ctx)
                 return NULL;
 
-        ctx->ref  = 1; /* user reference */
+        atomic_set(&ctx->ref, 1);
+        init_waitqueue_head(&ctx->wait);
         ctx->file = file;
 
         INIT_LIST_HEAD(&ctx->events);
-        init_MUTEX(&ctx->mutex);
 
         list_add_tail(&ctx->file_list, &file->ctxs);
 
@@ -177,8 +195,8 @@ static void ib_ucm_event_path_get(struct ib_ucm_path_rec *upath,
         if (!kpath || !upath)
                 return;
 
-        memcpy(upath->dgid, kpath->dgid.raw, sizeof(union ib_gid));
-        memcpy(upath->sgid, kpath->sgid.raw, sizeof(union ib_gid));
+        memcpy(upath->dgid, kpath->dgid.raw, sizeof *upath->dgid);
+        memcpy(upath->sgid, kpath->sgid.raw, sizeof *upath->sgid);
 
         upath->dlid             = kpath->dlid;
         upath->slid             = kpath->slid;
@@ -201,10 +219,11 @@ static void ib_ucm_event_path_get(struct ib_ucm_path_rec *upath,
                 kpath->packet_life_time_selector;
 }
 
-static void ib_ucm_event_req_get(struct ib_ucm_req_event_resp *ureq,
+static void ib_ucm_event_req_get(struct ib_ucm_context *ctx,
+                                 struct ib_ucm_req_event_resp *ureq,
                                  struct ib_cm_req_event_param *kreq)
 {
-        ureq->listen_id = (long)kreq->listen_id->context;
+        ureq->listen_id = ctx->id;
 
         ureq->remote_ca_guid             = kreq->remote_ca_guid;
         ureq->remote_qkey                = kreq->remote_qkey;
@@ -240,34 +259,11 @@ static void ib_ucm_event_rep_get(struct ib_ucm_rep_event_resp *urep,
         urep->srq                 = krep->srq;
 }
 
-static void ib_ucm_event_rej_get(struct ib_ucm_rej_event_resp *urej,
-                                 struct ib_cm_rej_event_param *krej)
-{
-        urej->reason = krej->reason;
-}
-
-static void ib_ucm_event_mra_get(struct ib_ucm_mra_event_resp *umra,
-                                 struct ib_cm_mra_event_param *kmra)
-{
-        umra->timeout = kmra->service_timeout;
-}
-
-static void ib_ucm_event_lap_get(struct ib_ucm_lap_event_resp *ulap,
-                                 struct ib_cm_lap_event_param *klap)
-{
-        ib_ucm_event_path_get(&ulap->path, klap->alternate_path);
-}
-
-static void ib_ucm_event_apr_get(struct ib_ucm_apr_event_resp *uapr,
-                                 struct ib_cm_apr_event_param *kapr)
-{
-        uapr->status = kapr->ap_status;
-}
-
-static void ib_ucm_event_sidr_req_get(struct ib_ucm_sidr_req_event_resp *ureq,
+static void ib_ucm_event_sidr_req_get(struct ib_ucm_context *ctx,
+                                      struct ib_ucm_sidr_req_event_resp *ureq,
                                       struct ib_cm_sidr_req_event_param *kreq)
 {
-        ureq->listen_id = (long)kreq->listen_id->context;
+        ureq->listen_id = ctx->id;
         ureq->pkey      = kreq->pkey;
 }
 
@@ -279,19 +275,18 @@ static void ib_ucm_event_sidr_rep_get(struct ib_ucm_sidr_rep_event_resp *urep,
         urep->qpn    = krep->qpn;
 };
 
-static int ib_ucm_event_process(struct ib_cm_event *evt,
+static int ib_ucm_event_process(struct ib_ucm_context *ctx,
+                                struct ib_cm_event *evt,
                                 struct ib_ucm_event *uvt)
 {
         void *info = NULL;
-        int result;
 
         switch (evt->event) {
         case IB_CM_REQ_RECEIVED:
-                ib_ucm_event_req_get(&uvt->resp.u.req_resp,
+                ib_ucm_event_req_get(ctx, &uvt->resp.u.req_resp,
                                      &evt->param.req_rcvd);
                 uvt->data_len      = IB_CM_REQ_PRIVATE_DATA_SIZE;
-                uvt->resp.present |= (evt->param.req_rcvd.primary_path ?
-                                      IB_UCM_PRES_PRIMARY : 0);
+                uvt->resp.present  = IB_UCM_PRES_PRIMARY;
                 uvt->resp.present |= (evt->param.req_rcvd.alternate_path ?
                                       IB_UCM_PRES_ALTERNATE : 0);
                 break;
@@ -299,57 +294,46 @@ static int ib_ucm_event_process(struct ib_cm_event *evt,
                 ib_ucm_event_rep_get(&uvt->resp.u.rep_resp,
                                      &evt->param.rep_rcvd);
                 uvt->data_len = IB_CM_REP_PRIVATE_DATA_SIZE;
-
                 break;
         case IB_CM_RTU_RECEIVED:
                 uvt->data_len = IB_CM_RTU_PRIVATE_DATA_SIZE;
                 uvt->resp.u.send_status = evt->param.send_status;
-
                 break;
         case IB_CM_DREQ_RECEIVED:
                 uvt->data_len = IB_CM_DREQ_PRIVATE_DATA_SIZE;
                 uvt->resp.u.send_status = evt->param.send_status;
-
                 break;
         case IB_CM_DREP_RECEIVED:
                 uvt->data_len = IB_CM_DREP_PRIVATE_DATA_SIZE;
                 uvt->resp.u.send_status = evt->param.send_status;
-
                 break;
         case IB_CM_MRA_RECEIVED:
-                ib_ucm_event_mra_get(&uvt->resp.u.mra_resp,
-                                     &evt->param.mra_rcvd);
+                uvt->resp.u.mra_resp.timeout =
+                                        evt->param.mra_rcvd.service_timeout;
                 uvt->data_len = IB_CM_MRA_PRIVATE_DATA_SIZE;
-
                 break;
         case IB_CM_REJ_RECEIVED:
-                ib_ucm_event_rej_get(&uvt->resp.u.rej_resp,
-                                     &evt->param.rej_rcvd);
+                uvt->resp.u.rej_resp.reason = evt->param.rej_rcvd.reason;
                 uvt->data_len = IB_CM_REJ_PRIVATE_DATA_SIZE;
                 uvt->info_len = evt->param.rej_rcvd.ari_length;
                 info          = evt->param.rej_rcvd.ari;
-
                 break;
         case IB_CM_LAP_RECEIVED:
-                ib_ucm_event_lap_get(&uvt->resp.u.lap_resp,
-                                     &evt->param.lap_rcvd);
+                ib_ucm_event_path_get(&uvt->resp.u.lap_resp.path,
+                                      evt->param.lap_rcvd.alternate_path);
                 uvt->data_len = IB_CM_LAP_PRIVATE_DATA_SIZE;
-                uvt->resp.present |= (evt->param.lap_rcvd.alternate_path ?
-                                      IB_UCM_PRES_ALTERNATE : 0);
+                uvt->resp.present = IB_UCM_PRES_ALTERNATE;
                 break;
         case IB_CM_APR_RECEIVED:
-                ib_ucm_event_apr_get(&uvt->resp.u.apr_resp,
-                                     &evt->param.apr_rcvd);
+                uvt->resp.u.apr_resp.status = evt->param.apr_rcvd.ap_status;
                 uvt->data_len = IB_CM_APR_PRIVATE_DATA_SIZE;
                 uvt->info_len = evt->param.apr_rcvd.info_len;
                 info          = evt->param.apr_rcvd.apr_info;
-
                 break;
         case IB_CM_SIDR_REQ_RECEIVED:
-                ib_ucm_event_sidr_req_get(&uvt->resp.u.sidr_req_resp,
+                ib_ucm_event_sidr_req_get(ctx, &uvt->resp.u.sidr_req_resp,
                                           &evt->param.sidr_req_rcvd);
                 uvt->data_len = IB_CM_SIDR_REQ_PRIVATE_DATA_SIZE;
-
                 break;
         case IB_CM_SIDR_REP_RECEIVED:
                 ib_ucm_event_sidr_rep_get(&uvt->resp.u.sidr_rep_resp,
@@ -357,43 +341,35 @@ static int ib_ucm_event_process(struct ib_cm_event *evt,
                 uvt->data_len = IB_CM_SIDR_REP_PRIVATE_DATA_SIZE;
                 uvt->info_len = evt->param.sidr_rep_rcvd.info_len;
                 info          = evt->param.sidr_rep_rcvd.info;
-
                 break;
         default:
                 uvt->resp.u.send_status = evt->param.send_status;
-
                 break;
         }
 
-        if (uvt->data_len && evt->private_data) {
-
+        if (uvt->data_len) {
                 uvt->data = kmalloc(uvt->data_len, GFP_KERNEL);
-                if (!uvt->data) {
-                        result = -ENOMEM;
-                        goto error;
-                }
+                if (!uvt->data)
+                        goto err1;
 
                 memcpy(uvt->data, evt->private_data, uvt->data_len);
                 uvt->resp.present |= IB_UCM_PRES_DATA;
         }
 
-        if (uvt->info_len && info) {
-
+        if (uvt->info_len) {
                 uvt->info = kmalloc(uvt->info_len, GFP_KERNEL);
-                if (!uvt->info) {
-                        result = -ENOMEM;
-                        goto error;
-                }
+                if (!uvt->info)
+                        goto err2;
 
                 memcpy(uvt->info, info, uvt->info_len);
                 uvt->resp.present |= IB_UCM_PRES_INFO;
         }
-
         return 0;
-error:
-        kfree(uvt->info);
+
+err2:
         kfree(uvt->data);
-        return result;
+err1:
+        return -ENOMEM;
 }
 
 static int ib_ucm_event_handler(struct ib_cm_id *cm_id,
@@ -403,63 +379,42 @@ static int ib_ucm_event_handler(struct ib_cm_id *cm_id,
         struct ib_ucm_context *ctx;
         int result = 0;
         int id;
-        /*
-         * lookup correct context based on event type.
-         */
-        switch (event->event) {
-        case IB_CM_REQ_RECEIVED:
-                id = (long)event->param.req_rcvd.listen_id->context;
-                break;
-        case IB_CM_SIDR_REQ_RECEIVED:
-                id = (long)event->param.sidr_req_rcvd.listen_id->context;
-                break;
-        default:
-                id = (long)cm_id->context;
-                break;
-        }
 
-        ucm_dbg("Event. CM ID <%d> event <%d>\n", id, event->event);
-
-        ctx = ib_ucm_ctx_get(id);
-        if (!ctx)
-                return -ENOENT;
+        ctx = cm_id->context;
 
         if (event->event == IB_CM_REQ_RECEIVED ||
             event->event == IB_CM_SIDR_REQ_RECEIVED)
                 id = IB_UCM_CM_ID_INVALID;
+        else
+                id = ctx->id;
 
         uevent = kmalloc(sizeof(*uevent), GFP_KERNEL);
-        if (!uevent) {
-                result = -ENOMEM;
-                goto done;
-        }
+        if (!uevent)
+                goto err1;
 
         memset(uevent, 0, sizeof(*uevent));
-
         uevent->resp.id    = id;
         uevent->resp.event = event->event;
 
-        result = ib_ucm_event_process(event, uevent);
+        result = ib_ucm_event_process(ctx, event, uevent);
         if (result)
-                goto done;
+                goto err2;
 
         uevent->ctx   = ctx;
-        uevent->cm_id = ((event->event == IB_CM_REQ_RECEIVED ||
-                          event->event == IB_CM_SIDR_REQ_RECEIVED ) ?
-                         cm_id : NULL);
+        uevent->cm_id = (id == IB_UCM_CM_ID_INVALID) ? cm_id : NULL;
 
         down(&ctx->file->mutex);
-
         list_add_tail(&uevent->file_list, &ctx->file->events);
         list_add_tail(&uevent->ctx_list, &ctx->events);
-
         wake_up_interruptible(&ctx->file->poll_wait);
-
         up(&ctx->file->mutex);
-done:
-        ctx->error = result;
-        ib_ucm_ctx_put(ctx); /* func reference */
-        return result;
+        return 0;
+
+err2:
+        kfree(uevent);
+err1:
+        /* Destroy new cm_id's */
+        return (id == IB_UCM_CM_ID_INVALID);
 }
 
 static ssize_t ib_ucm_event(struct ib_ucm_file *file,
@@ -517,9 +472,8 @@ static ssize_t ib_ucm_event(struct ib_ucm_file *file,
                 goto done;
         }
 
-        ctx->cm_id             = uevent->cm_id;
-        ctx->cm_id->cm_handler = ib_ucm_event_handler;
-        ctx->cm_id->context    = (void *)(unsigned long)ctx->id;
+        ctx->cm_id          = uevent->cm_id;
+        ctx->cm_id->context = ctx;
 
         uevent->resp.id = ctx->id;
 
@@ -585,30 +539,29 @@ static ssize_t ib_ucm_create_id(struct ib_ucm_file *file,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
+        down(&file->mutex);
         ctx = ib_ucm_ctx_alloc(file);
+        up(&file->mutex);
         if (!ctx)
                 return -ENOMEM;
 
-        ctx->cm_id = ib_create_cm_id(ib_ucm_event_handler,
-                                     (void *)(unsigned long)ctx->id);
-        if (!ctx->cm_id) {
-                result = -ENOMEM;
-                goto err_cm;
+        ctx->cm_id = ib_create_cm_id(ib_ucm_event_handler, ctx);
+        if (IS_ERR(ctx->cm_id)) {
+                result = PTR_ERR(ctx->cm_id);
+                goto err;
         }
 
         resp.id = ctx->id;
         if (copy_to_user((void __user *)(unsigned long)cmd.response,
                          &resp, sizeof(resp))) {
                 result = -EFAULT;
-                goto err_ret;
+                goto err;
         }
 
         return 0;
-err_ret:
-        ib_destroy_cm_id(ctx->cm_id);
-err_cm:
-        ib_ucm_ctx_put(ctx); /* user reference */
 
+err:
+        ib_ucm_destroy_ctx(file, ctx->id);
         return result;
 }
 
@@ -617,19 +570,11 @@ static ssize_t ib_ucm_destroy_id(struct ib_ucm_file *file,
                                  int in_len, int out_len)
 {
         struct ib_ucm_destroy_id cmd;
-        struct ib_ucm_context *ctx;
 
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        ctx = ib_ucm_ctx_get(cmd.id);
-        if (!ctx)
-                return -ENOENT;
-
-        ib_ucm_ctx_put(ctx); /* user reference */
-        ib_ucm_ctx_put(ctx); /* func reference */
-
-        return 0;
+        return ib_ucm_destroy_ctx(file, cmd.id);
 }
 
 static ssize_t ib_ucm_attr_id(struct ib_ucm_file *file,
@@ -647,15 +592,9 @@ static ssize_t ib_ucm_attr_id(struct ib_ucm_file *file,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        ctx = ib_ucm_ctx_get(cmd.id);
-        if (!ctx)
-                return -ENOENT;
-
-        down(&ctx->file->mutex);
-        if (ctx->file != file) {
-                result = -EINVAL;
-                goto done;
-        }
+        ctx = ib_ucm_ctx_get(file, cmd.id);
+        if (IS_ERR(ctx))
+                return PTR_ERR(ctx);
 
         resp.service_id   = ctx->cm_id->service_id;
         resp.service_mask = ctx->cm_id->service_mask;
@@ -666,9 +605,7 @@ static ssize_t ib_ucm_attr_id(struct ib_ucm_file *file,
                          &resp, sizeof(resp)))
                 result = -EFAULT;
 
-done:
-        up(&ctx->file->mutex);
-        ib_ucm_ctx_put(ctx); /* func reference */
+        ib_ucm_ctx_put(ctx);
         return result;
 }
 
@@ -683,19 +620,12 @@ static ssize_t ib_ucm_listen(struct ib_ucm_file *file,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        ctx = ib_ucm_ctx_get(cmd.id);
-        if (!ctx)
-                return -ENOENT;
+        ctx = ib_ucm_ctx_get(file, cmd.id);
+        if (IS_ERR(ctx))
+                return PTR_ERR(ctx);
 
-        down(&ctx->file->mutex);
-        if (ctx->file != file)
-                result = -EINVAL;
-        else
-                result = ib_cm_listen(ctx->cm_id, cmd.service_id,
-                                      cmd.service_mask);
-
-        up(&ctx->file->mutex);
-        ib_ucm_ctx_put(ctx); /* func reference */
+        result = ib_cm_listen(ctx->cm_id, cmd.service_id, cmd.service_mask);
+        ib_ucm_ctx_put(ctx);
         return result;
 }
 
@@ -710,18 +640,12 @@ static ssize_t ib_ucm_establish(struct ib_ucm_file *file,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        ctx = ib_ucm_ctx_get(cmd.id);
-        if (!ctx)
-                return -ENOENT;
-
-        down(&ctx->file->mutex);
-        if (ctx->file != file)
-                result = -EINVAL;
-        else
-                result = ib_cm_establish(ctx->cm_id);
+        ctx = ib_ucm_ctx_get(file, cmd.id);
+        if (IS_ERR(ctx))
+                return PTR_ERR(ctx);
 
-        up(&ctx->file->mutex);
-        ib_ucm_ctx_put(ctx); /* func reference */
+        result = ib_cm_establish(ctx->cm_id);
+        ib_ucm_ctx_put(ctx);
         return result;
 }
 
@@ -768,8 +692,8 @@ static int ib_ucm_path_get(struct ib_sa_path_rec **path, u64 src)
                 return -EFAULT;
         }
 
-        memcpy(sa_path->dgid.raw, ucm_path.dgid, sizeof(union ib_gid));
-        memcpy(sa_path->sgid.raw, ucm_path.sgid, sizeof(union ib_gid));
+        memcpy(sa_path->dgid.raw, ucm_path.dgid, sizeof sa_path->dgid);
+        memcpy(sa_path->sgid.raw, ucm_path.sgid, sizeof sa_path->sgid);
 
         sa_path->dlid             = ucm_path.dlid;
         sa_path->slid             = ucm_path.slid;
@@ -839,25 +763,17 @@ static ssize_t ib_ucm_send_req(struct ib_ucm_file *file,
         param.max_cm_retries             = cmd.max_cm_retries;
         param.srq                        = cmd.srq;
 
-        ctx = ib_ucm_ctx_get(cmd.id);
-        if (!ctx) {
-                result = -ENOENT;
-                goto done;
-        }
-
-        down(&ctx->file->mutex);
-        if (ctx->file != file)
-                result = -EINVAL;
-        else
+        ctx = ib_ucm_ctx_get(file, cmd.id);
+        if (!IS_ERR(ctx)) {
                 result = ib_send_cm_req(ctx->cm_id, &param);
+                ib_ucm_ctx_put(ctx);
+        } else
+                result = PTR_ERR(ctx);
 
-        up(&ctx->file->mutex);
-        ib_ucm_ctx_put(ctx); /* func reference */
 done:
         kfree(param.private_data);
         kfree(param.primary_path);
         kfree(param.alternate_path);
-
         return result;
 }
 
@@ -890,23 +806,14 @@ static ssize_t ib_ucm_send_rep(struct ib_ucm_file *file,
         param.rnr_retry_count     = cmd.rnr_retry_count;
         param.srq                 = cmd.srq;
 
-        ctx = ib_ucm_ctx_get(cmd.id);
-        if (!ctx) {
-                result = -ENOENT;
-                goto done;
-        }
-
-        down(&ctx->file->mutex);
-        if (ctx->file != file)
-                result = -EINVAL;
-        else
+        ctx = ib_ucm_ctx_get(file, cmd.id);
+        if (!IS_ERR(ctx)) {
                 result = ib_send_cm_rep(ctx->cm_id, &param);
+                ib_ucm_ctx_put(ctx);
+        } else
+                result = PTR_ERR(ctx);
 
-        up(&ctx->file->mutex);
-        ib_ucm_ctx_put(ctx); /* func reference */
-done:
         kfree(param.private_data);
-
         return result;
 }
 
@@ -928,23 +835,14 @@ static ssize_t ib_ucm_send_private_data(struct ib_ucm_file *file,
         if (result)
                 return result;
 
-        ctx = ib_ucm_ctx_get(cmd.id);
-        if (!ctx) {
-                result = -ENOENT;
-                goto done;
-        }
-
-        down(&ctx->file->mutex);
-        if (ctx->file != file)
-                result = -EINVAL;
-        else
+        ctx = ib_ucm_ctx_get(file, cmd.id);
+        if (!IS_ERR(ctx)) {
                 result = func(ctx->cm_id, private_data, cmd.len);
+                ib_ucm_ctx_put(ctx);
+        } else
+                result = PTR_ERR(ctx);
 
-        up(&ctx->file->mutex);
-        ib_ucm_ctx_put(ctx); /* func reference */
-done:
         kfree(private_data);
-
         return result;
 }
 
@@ -995,26 +893,17 @@ static ssize_t ib_ucm_send_info(struct ib_ucm_file *file,
         if (result)
                 goto done;
 
-        ctx = ib_ucm_ctx_get(cmd.id);
-        if (!ctx) {
-                result = -ENOENT;
-                goto done;
-        }
-
-        down(&ctx->file->mutex);
-        if (ctx->file != file)
-                result = -EINVAL;
-        else
-                result = func(ctx->cm_id, cmd.status,
-                              info, cmd.info_len,
+        ctx = ib_ucm_ctx_get(file, cmd.id);
+        if (!IS_ERR(ctx)) {
+                result = func(ctx->cm_id, cmd.status, info, cmd.info_len,
                               data, cmd.data_len);
+                ib_ucm_ctx_put(ctx);
+        } else
+                result = PTR_ERR(ctx);
 
-        up(&ctx->file->mutex);
-        ib_ucm_ctx_put(ctx); /* func reference */
 done:
         kfree(data);
         kfree(info);
-
         return result;
 }
 
@@ -1048,24 +937,14 @@ static ssize_t ib_ucm_send_mra(struct ib_ucm_file *file,
         if (result)
                 return result;
 
-        ctx = ib_ucm_ctx_get(cmd.id);
-        if (!ctx) {
-                result = -ENOENT;
-                goto done;
-        }
+        ctx = ib_ucm_ctx_get(file, cmd.id);
+        if (!IS_ERR(ctx)) {
+                result = ib_send_cm_mra(ctx->cm_id, cmd.timeout, data, cmd.len);
+                ib_ucm_ctx_put(ctx);
+        } else
+                result = PTR_ERR(ctx);
 
-        down(&ctx->file->mutex);
-        if (ctx->file != file)
-                result = -EINVAL;
-        else
-                result = ib_send_cm_mra(ctx->cm_id, cmd.timeout,
-                                        data, cmd.len);
-
-        up(&ctx->file->mutex);
-        ib_ucm_ctx_put(ctx); /* func reference */
-done:
         kfree(data);
-
         return result;
 }
 
@@ -1090,24 +969,16 @@ static ssize_t ib_ucm_send_lap(struct ib_ucm_file *file,
         if (result)
                 goto done;
 
-        ctx = ib_ucm_ctx_get(cmd.id);
-        if (!ctx) {
-                result = -ENOENT;
-                goto done;
-        }
-
-        down(&ctx->file->mutex);
-        if (ctx->file != file)
-                result = -EINVAL;
-        else
+        ctx = ib_ucm_ctx_get(file, cmd.id);
+        if (!IS_ERR(ctx)) {
                 result = ib_send_cm_lap(ctx->cm_id, path, data, cmd.len);
+                ib_ucm_ctx_put(ctx);
+        } else
+                result = PTR_ERR(ctx);
 
-        up(&ctx->file->mutex);
-        ib_ucm_ctx_put(ctx); /* func reference */
 done:
         kfree(data);
         kfree(path);
-
         return result;
 }
 
@@ -1140,24 +1011,16 @@ static ssize_t ib_ucm_send_sidr_req(struct ib_ucm_file *file,
         param.max_cm_retries   = cmd.max_cm_retries;
         param.pkey             = cmd.pkey;
 
-        ctx = ib_ucm_ctx_get(cmd.id);
-        if (!ctx) {
-                result = -ENOENT;
-                goto done;
-        }
-
-        down(&ctx->file->mutex);
-        if (ctx->file != file)
-                result = -EINVAL;
-        else
+        ctx = ib_ucm_ctx_get(file, cmd.id);
+        if (!IS_ERR(ctx)) {
                 result = ib_send_cm_sidr_req(ctx->cm_id, &param);
+                ib_ucm_ctx_put(ctx);
+        } else
+                result = PTR_ERR(ctx);
 
-        up(&ctx->file->mutex);
-        ib_ucm_ctx_put(ctx); /* func reference */
 done:
         kfree(param.private_data);
         kfree(param.path);
-
         return result;
 }
 
@@ -1184,30 +1047,22 @@ static ssize_t ib_ucm_send_sidr_rep(struct ib_ucm_file *file,
         if (result)
                 goto done;
 
-        param.qp_num       = cmd.qpn;
-        param.qkey           = cmd.qkey;
-        param.status       = cmd.status;
-        param.info_length      = cmd.info_len;
-        param.private_data_len = cmd.data_len;
-
-        ctx = ib_ucm_ctx_get(cmd.id);
-        if (!ctx) {
-                result = -ENOENT;
-                goto done;
-        }
+        param.qp_num            = cmd.qpn;
+        param.qkey              = cmd.qkey;
+        param.status            = cmd.status;
+        param.info_length       = cmd.info_len;
+        param.private_data_len  = cmd.data_len;
 
-        down(&ctx->file->mutex);
-        if (ctx->file != file)
-                result = -EINVAL;
-        else
+        ctx = ib_ucm_ctx_get(file, cmd.id);
+        if (!IS_ERR(ctx)) {
                 result = ib_send_cm_sidr_rep(ctx->cm_id, &param);
+                ib_ucm_ctx_put(ctx);
+        } else
+                result = PTR_ERR(ctx);
 
-        up(&ctx->file->mutex);
-        ib_ucm_ctx_put(ctx); /* func reference */
 done:
         kfree(param.private_data);
         kfree(param.info);
-
         return result;
 }
 
@@ -1305,22 +1160,17 @@ static int ib_ucm_close(struct inode *inode, struct file *filp)
         struct ib_ucm_context *ctx;
 
         down(&file->mutex);
-
         while (!list_empty(&file->ctxs)) {
 
                 ctx = list_entry(file->ctxs.next,
                                  struct ib_ucm_context, file_list);
 
-                up(&ctx->file->mutex);
-                ib_ucm_ctx_put(ctx); /* user reference */
+                up(&file->mutex);
+                ib_ucm_destroy_ctx(file, ctx->id);
                 down(&file->mutex);
         }
-
         up(&file->mutex);
-
         kfree(file);
-
-        ucm_dbg("Deleted struct\n");
         return 0;
 }
 
diff --git a/drivers/infiniband/core/ucm.h b/drivers/infiniband/core/ucm.h
index 6d36606151b2..c8819b928a1b 100644
--- a/drivers/infiniband/core/ucm.h
+++ b/drivers/infiniband/core/ucm.h
@@ -40,17 +40,15 @@
 #include <linux/cdev.h>
 #include <linux/idr.h>
 
-#include <ib_cm.h>
-#include <ib_user_cm.h>
+#include <rdma/ib_cm.h>
+#include <rdma/ib_user_cm.h>
 
 #define IB_UCM_CM_ID_INVALID 0xffffffff
 
 struct ib_ucm_file {
         struct semaphore mutex;
         struct file *filp;
-        /*
-         * list of pending events
-         */
+
         struct list_head  ctxs;   /* list of active connections */
         struct list_head  events; /* list of pending events */
         wait_queue_head_t poll_wait;
@@ -58,12 +56,11 @@ struct ib_ucm_file {
 
 struct ib_ucm_context {
         int                 id;
-        int                 ref;
-        int                 error;
+        wait_queue_head_t   wait;
+        atomic_t            ref;
 
         struct ib_ucm_file *file;
         struct ib_cm_id    *cm_id;
-        struct semaphore    mutex;
 
         struct list_head    events;    /* list of pending events. */
         struct list_head    file_list; /* member in file ctx list */
diff --git a/drivers/infiniband/core/ud_header.c b/drivers/infiniband/core/ud_header.c
index dc4eb1db5e96..527b23450ab3 100644
--- a/drivers/infiniband/core/ud_header.c
+++ b/drivers/infiniband/core/ud_header.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
+ * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -34,7 +35,7 @@
 
 #include <linux/errno.h>
 
-#include <ib_pack.h>
+#include <rdma/ib_pack.h>
 
 #define STRUCT_FIELD(header, field) \
         .struct_offset_bytes = offsetof(struct ib_unpacked_ ## header, field),      \
@@ -194,6 +195,7 @@ void ib_ud_header_init(int     		    payload_bytes,
                        struct ib_ud_header *header)
 {
         int header_len;
+        u16 packet_length;
 
         memset(header, 0, sizeof *header);
 
@@ -208,7 +210,7 @@ void ib_ud_header_init(int     		    payload_bytes,
         header->lrh.link_version     = 0;
         header->lrh.link_next_header =
                 grh_present ? IB_LNH_IBA_GLOBAL : IB_LNH_IBA_LOCAL;
-        header->lrh.packet_length    = (IB_LRH_BYTES     +
+        packet_length                = (IB_LRH_BYTES     +
                                         IB_BTH_BYTES     +
                                         IB_DETH_BYTES    +
                                         payload_bytes    +
@@ -217,8 +219,7 @@ void ib_ud_header_init(int     		    payload_bytes,
 
         header->grh_present          = grh_present;
         if (grh_present) {
-                header->lrh.packet_length  += IB_GRH_BYTES / 4;
-
+                packet_length              += IB_GRH_BYTES / 4;
                 header->grh.ip_version      = 6;
                 header->grh.payload_length  =
                         cpu_to_be16((IB_BTH_BYTES     +
@@ -229,7 +230,7 @@ void ib_ud_header_init(int     		    payload_bytes,
                 header->grh.next_header     = 0x1b;
         }
 
-        cpu_to_be16s(&header->lrh.packet_length);
+        header->lrh.packet_length = cpu_to_be16(packet_length);
 
         if (header->immediate_present)
                 header->bth.opcode           = IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE;
diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index 2e38792df533..7c2f03057ddb 100644
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2004 Topspin Communications.  All rights reserved.
- * Copyright (c) 2005 Voltaire, Inc. All rights reserved.
+ * Copyright (c) 2005 Voltaire, Inc. All rights reserved. 
  * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -49,8 +49,8 @@
 #include <asm/uaccess.h>
 #include <asm/semaphore.h>
 
-#include <ib_mad.h>
-#include <ib_user_mad.h>
+#include <rdma/ib_mad.h>
+#include <rdma/ib_user_mad.h>
 
 MODULE_AUTHOR("Roland Dreier");
 MODULE_DESCRIPTION("InfiniBand userspace MAD packet access");
@@ -271,7 +271,7 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
         struct ib_send_wr *bad_wr;
         struct ib_rmpp_mad *rmpp_mad;
         u8 method;
-        u64 *tid;
+        __be64 *tid;
         int ret, length, hdr_len, data_len, rmpp_hdr_size;
         int rmpp_active = 0;
 
@@ -316,7 +316,7 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
         if (packet->mad.hdr.grh_present) {
                 ah_attr.ah_flags = IB_AH_GRH;
                 memcpy(ah_attr.grh.dgid.raw, packet->mad.hdr.gid, 16);
-                ah_attr.grh.flow_label     = packet->mad.hdr.flow_label;
+                ah_attr.grh.flow_label     = be32_to_cpu(packet->mad.hdr.flow_label);
                 ah_attr.grh.hop_limit      = packet->mad.hdr.hop_limit;
                 ah_attr.grh.traffic_class  = packet->mad.hdr.traffic_class;
         }
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index 7696022f9a4e..180b3d4765e4 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (c) 2005 Topspin Communications.  All rights reserved.
  * Copyright (c) 2005 Cisco Systems.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
+ * Copyright (c) 2005 Voltaire, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -43,8 +45,8 @@
 #include <linux/kref.h>
 #include <linux/idr.h>
 
-#include <ib_verbs.h>
-#include <ib_user_verbs.h>
+#include <rdma/ib_verbs.h>
+#include <rdma/ib_user_verbs.h>
 
 struct ib_uverbs_device {
         int                                     devnum;
@@ -97,10 +99,12 @@ extern struct idr ib_uverbs_mw_idr;
 extern struct idr ib_uverbs_ah_idr;
 extern struct idr ib_uverbs_cq_idr;
 extern struct idr ib_uverbs_qp_idr;
+extern struct idr ib_uverbs_srq_idr;
 
 void ib_uverbs_comp_handler(struct ib_cq *cq, void *cq_context);
 void ib_uverbs_cq_event_handler(struct ib_event *event, void *context_ptr);
 void ib_uverbs_qp_event_handler(struct ib_event *event, void *context_ptr);
+void ib_uverbs_srq_event_handler(struct ib_event *event, void *context_ptr);
 
 int ib_umem_get(struct ib_device *dev, struct ib_umem *mem,
                 void *addr, size_t size, int write);
@@ -129,5 +133,8 @@ IB_UVERBS_DECLARE_CMD(modify_qp);
 IB_UVERBS_DECLARE_CMD(destroy_qp);
 IB_UVERBS_DECLARE_CMD(attach_mcast);
 IB_UVERBS_DECLARE_CMD(detach_mcast);
+IB_UVERBS_DECLARE_CMD(create_srq);
+IB_UVERBS_DECLARE_CMD(modify_srq);
+IB_UVERBS_DECLARE_CMD(destroy_srq);
 
 #endif /* UVERBS_H */
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 5f2bbcda4c73..ebccf9f38af9 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -724,6 +724,7 @@ ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
         struct ib_uobject              *uobj;
         struct ib_pd                   *pd;
         struct ib_cq                   *scq, *rcq;
+        struct ib_srq                  *srq;
         struct ib_qp                   *qp;
         struct ib_qp_init_attr          attr;
         int ret;
@@ -747,10 +748,12 @@ ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
         pd  = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
         scq = idr_find(&ib_uverbs_cq_idr, cmd.send_cq_handle);
         rcq = idr_find(&ib_uverbs_cq_idr, cmd.recv_cq_handle);
+        srq = cmd.is_srq ? idr_find(&ib_uverbs_srq_idr, cmd.srq_handle) : NULL;
 
         if (!pd  || pd->uobject->context  != file->ucontext ||
             !scq || scq->uobject->context != file->ucontext ||
-            !rcq || rcq->uobject->context != file->ucontext) {
+            !rcq || rcq->uobject->context != file->ucontext ||
+            (cmd.is_srq && (!srq || srq->uobject->context != file->ucontext))) {
                 ret = -EINVAL;
                 goto err_up;
         }
@@ -759,7 +762,7 @@ ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
         attr.qp_context    = file;
         attr.send_cq       = scq;
         attr.recv_cq       = rcq;
-        attr.srq           = NULL;
+        attr.srq           = srq;
         attr.sq_sig_type   = cmd.sq_sig_all ? IB_SIGNAL_ALL_WR : IB_SIGNAL_REQ_WR;
         attr.qp_type       = cmd.qp_type;
 
@@ -1004,3 +1007,178 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
 
         return ret ? ret : in_len;
 }
+
+ssize_t ib_uverbs_create_srq(struct ib_uverbs_file *file,
+                             const char __user *buf, int in_len,
+                             int out_len)
+{
+        struct ib_uverbs_create_srq      cmd;
+        struct ib_uverbs_create_srq_resp resp;
+        struct ib_udata                  udata;
+        struct ib_uobject               *uobj;
+        struct ib_pd                    *pd;
+        struct ib_srq                   *srq;
+        struct ib_srq_init_attr          attr;
+        int ret;
+
+        if (out_len < sizeof resp)
+                return -ENOSPC;
+
+        if (copy_from_user(&cmd, buf, sizeof cmd))
+                return -EFAULT;
+
+        INIT_UDATA(&udata, buf + sizeof cmd,
+                   (unsigned long) cmd.response + sizeof resp,
+                   in_len - sizeof cmd, out_len - sizeof resp);
+
+        uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
+        if (!uobj)
+                return -ENOMEM;
+
+        down(&ib_uverbs_idr_mutex);
+
+        pd  = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
+
+        if (!pd || pd->uobject->context != file->ucontext) {
+                ret = -EINVAL;
+                goto err_up;
+        }
+
+        attr.event_handler  = ib_uverbs_srq_event_handler;
+        attr.srq_context    = file;
+        attr.attr.max_wr    = cmd.max_wr;
+        attr.attr.max_sge   = cmd.max_sge;
+        attr.attr.srq_limit = cmd.srq_limit;
+
+        uobj->user_handle = cmd.user_handle;
+        uobj->context     = file->ucontext;
+
+        srq = pd->device->create_srq(pd, &attr, &udata);
+        if (IS_ERR(srq)) {
+                ret = PTR_ERR(srq);
+                goto err_up;
+        }
+
+        srq->device        = pd->device;
+        srq->pd            = pd;
+        srq->uobject       = uobj;
+        srq->event_handler = attr.event_handler;
+        srq->srq_context   = attr.srq_context;
+        atomic_inc(&pd->usecnt);
+        atomic_set(&srq->usecnt, 0);
+
+        memset(&resp, 0, sizeof resp);
+
+retry:
+        if (!idr_pre_get(&ib_uverbs_srq_idr, GFP_KERNEL)) {
+                ret = -ENOMEM;
+                goto err_destroy;
+        }
+
+        ret = idr_get_new(&ib_uverbs_srq_idr, srq, &uobj->id);
+
+        if (ret == -EAGAIN)
+                goto retry;
+        if (ret)
+                goto err_destroy;
+
+        resp.srq_handle = uobj->id;
+
+        spin_lock_irq(&file->ucontext->lock);
+        list_add_tail(&uobj->list, &file->ucontext->srq_list);
+        spin_unlock_irq(&file->ucontext->lock);
+
+        if (copy_to_user((void __user *) (unsigned long) cmd.response,
+                         &resp, sizeof resp)) {
+                ret = -EFAULT;
+                goto err_list;
+        }
+
+        up(&ib_uverbs_idr_mutex);
+
+        return in_len;
+
+err_list:
+        spin_lock_irq(&file->ucontext->lock);
+        list_del(&uobj->list);
+        spin_unlock_irq(&file->ucontext->lock);
+
+err_destroy:
+        ib_destroy_srq(srq);
+
+err_up:
+        up(&ib_uverbs_idr_mutex);
+
+        kfree(uobj);
+        return ret;
+}
+
+ssize_t ib_uverbs_modify_srq(struct ib_uverbs_file *file,
+                             const char __user *buf, int in_len,
+                             int out_len)
+{
+        struct ib_uverbs_modify_srq cmd;
+        struct ib_srq              *srq;
+        struct ib_srq_attr          attr;
+        int                         ret;
+
+        if (copy_from_user(&cmd, buf, sizeof cmd))
+                return -EFAULT;
+
+        down(&ib_uverbs_idr_mutex);
+
+        srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);
+        if (!srq || srq->uobject->context != file->ucontext) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        attr.max_wr    = cmd.max_wr;
+        attr.max_sge   = cmd.max_sge;
+        attr.srq_limit = cmd.srq_limit;
+
+        ret = ib_modify_srq(srq, &attr, cmd.attr_mask);
+
+out:
+        up(&ib_uverbs_idr_mutex);
+
+        return ret ? ret : in_len;
+}
+
+ssize_t ib_uverbs_destroy_srq(struct ib_uverbs_file *file,
+                              const char __user *buf, int in_len,
+                              int out_len)
+{
+        struct ib_uverbs_destroy_srq cmd;
+        struct ib_srq               *srq;
+        struct ib_uobject           *uobj;
+        int                          ret = -EINVAL;
+
+        if (copy_from_user(&cmd, buf, sizeof cmd))
+                return -EFAULT;
+
+        down(&ib_uverbs_idr_mutex);
+
+        srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);
+        if (!srq || srq->uobject->context != file->ucontext)
+                goto out;
+
+        uobj = srq->uobject;
+
+        ret = ib_destroy_srq(srq);
+        if (ret)
+                goto out;
+
+        idr_remove(&ib_uverbs_srq_idr, cmd.srq_handle);
+
+        spin_lock_irq(&file->ucontext->lock);
+        list_del(&uobj->list);
+        spin_unlock_irq(&file->ucontext->lock);
+
+        kfree(uobj);
+
+out:
+        up(&ib_uverbs_idr_mutex);
+
+        return ret ? ret : in_len;
+}
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index eb99e693dec2..09caf5b1ef36 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (c) 2005 Topspin Communications.  All rights reserved.
  * Copyright (c) 2005 Cisco Systems.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
+ * Copyright (c) 2005 Voltaire, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -67,6 +69,7 @@ DEFINE_IDR(ib_uverbs_mw_idr);
 DEFINE_IDR(ib_uverbs_ah_idr);
 DEFINE_IDR(ib_uverbs_cq_idr);
 DEFINE_IDR(ib_uverbs_qp_idr);
+DEFINE_IDR(ib_uverbs_srq_idr);
 
 static spinlock_t map_lock;
 static DECLARE_BITMAP(dev_map, IB_UVERBS_MAX_DEVICES);
@@ -91,6 +94,9 @@ static ssize_t (*uverbs_cmd_table[])(struct ib_uverbs_file *file,
         [IB_USER_VERBS_CMD_DESTROY_QP]    = ib_uverbs_destroy_qp,
         [IB_USER_VERBS_CMD_ATTACH_MCAST]  = ib_uverbs_attach_mcast,
         [IB_USER_VERBS_CMD_DETACH_MCAST]  = ib_uverbs_detach_mcast,
+        [IB_USER_VERBS_CMD_CREATE_SRQ]    = ib_uverbs_create_srq,
+        [IB_USER_VERBS_CMD_MODIFY_SRQ]    = ib_uverbs_modify_srq,
+        [IB_USER_VERBS_CMD_DESTROY_SRQ]   = ib_uverbs_destroy_srq,
 };
 
 static struct vfsmount *uverbs_event_mnt;
@@ -125,18 +131,26 @@ static int ib_dealloc_ucontext(struct ib_ucontext *context)
                 kfree(uobj);
         }
 
-        /* XXX Free SRQs */
+        list_for_each_entry_safe(uobj, tmp, &context->srq_list, list) {
+                struct ib_srq *srq = idr_find(&ib_uverbs_srq_idr, uobj->id);
+                idr_remove(&ib_uverbs_srq_idr, uobj->id);
+                ib_destroy_srq(srq);
+                list_del(&uobj->list);
+                kfree(uobj);
+        }
+
         /* XXX Free MWs */
 
         list_for_each_entry_safe(uobj, tmp, &context->mr_list, list) {
                 struct ib_mr *mr = idr_find(&ib_uverbs_mr_idr, uobj->id);
+                struct ib_device *mrdev = mr->device;
                 struct ib_umem_object *memobj;
 
                 idr_remove(&ib_uverbs_mr_idr, uobj->id);
                 ib_dereg_mr(mr);
 
                 memobj = container_of(uobj, struct ib_umem_object, uobject);
-                ib_umem_release_on_close(mr->device, &memobj->umem);
+                ib_umem_release_on_close(mrdev, &memobj->umem);
 
                 list_del(&uobj->list);
                 kfree(memobj);
@@ -343,6 +357,13 @@ void ib_uverbs_qp_event_handler(struct ib_event *event, void *context_ptr)
                                 event->event);
 }
 
+void ib_uverbs_srq_event_handler(struct ib_event *event, void *context_ptr)
+{
+        ib_uverbs_async_handler(context_ptr,
+                                event->element.srq->uobject->user_handle,
+                                event->event);
+}
+
 static void ib_uverbs_event_handler(struct ib_event_handler *handler,
                                     struct ib_event *event)
 {
diff --git a/drivers/infiniband/core/uverbs_mem.c b/drivers/infiniband/core/uverbs_mem.c
index ed550f6595bd..36a32c315668 100644
--- a/drivers/infiniband/core/uverbs_mem.c
+++ b/drivers/infiniband/core/uverbs_mem.c
@@ -1,6 +1,7 @@
 /*
  * Copyright (c) 2005 Topspin Communications.  All rights reserved.
  * Copyright (c) 2005 Cisco Systems.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 506fdf1f2a26..5081d903e561 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -4,6 +4,7 @@
  * Copyright (c) 2004 Intel Corporation.  All rights reserved.
  * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
  * Copyright (c) 2004 Voltaire Corporation.  All rights reserved.
+ * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
  * Copyright (c) 2005 Cisco Systems.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -40,8 +41,8 @@
 #include <linux/errno.h>
 #include <linux/err.h>
 
-#include <ib_verbs.h>
-#include <ib_cache.h>
+#include <rdma/ib_verbs.h>
+#include <rdma/ib_cache.h>
 
 /* Protection domains */
 
@@ -153,6 +154,66 @@ int ib_destroy_ah(struct ib_ah *ah)
 }
 EXPORT_SYMBOL(ib_destroy_ah);
 
+/* Shared receive queues */
+
+struct ib_srq *ib_create_srq(struct ib_pd *pd,
+                             struct ib_srq_init_attr *srq_init_attr)
+{
+        struct ib_srq *srq;
+
+        if (!pd->device->create_srq)
+                return ERR_PTR(-ENOSYS);
+
+        srq = pd->device->create_srq(pd, srq_init_attr, NULL);
+
+        if (!IS_ERR(srq)) {
+                srq->device        = pd->device;
+                srq->pd            = pd;
+                srq->uobject       = NULL;
+                srq->event_handler = srq_init_attr->event_handler;
+                srq->srq_context   = srq_init_attr->srq_context;
+                atomic_inc(&pd->usecnt);
+                atomic_set(&srq->usecnt, 0);
+        }
+
+        return srq;
+}
+EXPORT_SYMBOL(ib_create_srq);
+
+int ib_modify_srq(struct ib_srq *srq,
+                  struct ib_srq_attr *srq_attr,
+                  enum ib_srq_attr_mask srq_attr_mask)
+{
+        return srq->device->modify_srq(srq, srq_attr, srq_attr_mask);
+}
+EXPORT_SYMBOL(ib_modify_srq);
+
+int ib_query_srq(struct ib_srq *srq,
+                 struct ib_srq_attr *srq_attr)
+{
+        return srq->device->query_srq ?
+                srq->device->query_srq(srq, srq_attr) : -ENOSYS;
+}
+EXPORT_SYMBOL(ib_query_srq);
+
+int ib_destroy_srq(struct ib_srq *srq)
+{
+        struct ib_pd *pd;
+        int ret;
+
+        if (atomic_read(&srq->usecnt))
+                return -EBUSY;
+
+        pd = srq->pd;
+
+        ret = srq->device->destroy_srq(srq);
+        if (!ret)
+                atomic_dec(&pd->usecnt);
+
+        return ret;
+}
+EXPORT_SYMBOL(ib_destroy_srq);
+
 /* Queue pairs */
 
 struct ib_qp *ib_create_qp(struct ib_pd *pd,
diff --git a/drivers/infiniband/hw/mthca/Makefile b/drivers/infiniband/hw/mthca/Makefile
index 5dcbd43073e2..c44f7bae5424 100644
--- a/drivers/infiniband/hw/mthca/Makefile
+++ b/drivers/infiniband/hw/mthca/Makefile
@@ -1,5 +1,3 @@
-EXTRA_CFLAGS += -Idrivers/infiniband/include
-
 ifdef CONFIG_INFINIBAND_MTHCA_DEBUG
 EXTRA_CFLAGS += -DDEBUG
 endif
@@ -9,4 +7,4 @@ obj-$(CONFIG_INFINIBAND_MTHCA) += ib_mthca.o
 ib_mthca-y :=   mthca_main.o mthca_cmd.o mthca_profile.o mthca_reset.o \
                 mthca_allocator.o mthca_eq.o mthca_pd.o mthca_cq.o \
                 mthca_mr.o mthca_qp.o mthca_av.o mthca_mcg.o mthca_mad.o \
-                mthca_provider.o mthca_memfree.o mthca_uar.o
+                mthca_provider.o mthca_memfree.o mthca_uar.o mthca_srq.o
diff --git a/drivers/infiniband/hw/mthca/mthca_allocator.c b/drivers/infiniband/hw/mthca/mthca_allocator.c
index b1db48dd91d6..9ba3211cef7c 100644
--- a/drivers/infiniband/hw/mthca/mthca_allocator.c
+++ b/drivers/infiniband/hw/mthca/mthca_allocator.c
@@ -177,3 +177,119 @@ void mthca_array_cleanup(struct mthca_array *array, int nent)
 
         kfree(array->page_list);
 }
+
+/*
+ * Handling for queue buffers -- we allocate a bunch of memory and
+ * register it in a memory region at HCA virtual address 0.  If the
+ * requested size is > max_direct, we split the allocation into
+ * multiple pages, so we don't require too much contiguous memory.
+ */
+
+int mthca_buf_alloc(struct mthca_dev *dev, int size, int max_direct,
+                    union mthca_buf *buf, int *is_direct, struct mthca_pd *pd,
+                    int hca_write, struct mthca_mr *mr)
+{
+        int err = -ENOMEM;
+        int npages, shift;
+        u64 *dma_list = NULL;
+        dma_addr_t t;
+        int i;
+
+        if (size <= max_direct) {
+                *is_direct = 1;
+                npages     = 1;
+                shift      = get_order(size) + PAGE_SHIFT;
+
+                buf->direct.buf = dma_alloc_coherent(&dev->pdev->dev,
+                                                     size, &t, GFP_KERNEL);
+                if (!buf->direct.buf)
+                        return -ENOMEM;
+
+                pci_unmap_addr_set(&buf->direct, mapping, t);
+
+                memset(buf->direct.buf, 0, size);
+
+                while (t & ((1 << shift) - 1)) {
+                        --shift;
+                        npages *= 2;
+                }
+
+                dma_list = kmalloc(npages * sizeof *dma_list, GFP_KERNEL);
+                if (!dma_list)
+                        goto err_free;
+
+                for (i = 0; i < npages; ++i)
+                        dma_list[i] = t + i * (1 << shift);
+        } else {
+                *is_direct = 0;
+                npages     = (size + PAGE_SIZE - 1) / PAGE_SIZE;
+                shift      = PAGE_SHIFT;
+
+                dma_list = kmalloc(npages * sizeof *dma_list, GFP_KERNEL);
+                if (!dma_list)
+                        return -ENOMEM;
+
+                buf->page_list = kmalloc(npages * sizeof *buf->page_list,
+                                         GFP_KERNEL);
+                if (!buf->page_list)
+                        goto err_out;
+
+                for (i = 0; i < npages; ++i)
+                        buf->page_list[i].buf = NULL;
+
+                for (i = 0; i < npages; ++i) {
+                        buf->page_list[i].buf =
+                                dma_alloc_coherent(&dev->pdev->dev, PAGE_SIZE,
+                                                   &t, GFP_KERNEL);
+                        if (!buf->page_list[i].buf)
+                                goto err_free;
+
+                        dma_list[i] = t;
+                        pci_unmap_addr_set(&buf->page_list[i], mapping, t);
+
+                        memset(buf->page_list[i].buf, 0, PAGE_SIZE);
+                }
+        }
+
+        err = mthca_mr_alloc_phys(dev, pd->pd_num,
+                                  dma_list, shift, npages,
+                                  0, size,
+                                  MTHCA_MPT_FLAG_LOCAL_READ |
+                                  (hca_write ? MTHCA_MPT_FLAG_LOCAL_WRITE : 0),
+                                  mr);
+        if (err)
+                goto err_free;
+
+        kfree(dma_list);
+
+        return 0;
+
+err_free:
+        mthca_buf_free(dev, size, buf, *is_direct, NULL);
+
+err_out:
+        kfree(dma_list);
+
+        return err;
+}
+
+void mthca_buf_free(struct mthca_dev *dev, int size, union mthca_buf *buf,
+                    int is_direct, struct mthca_mr *mr)
+{
+        int i;
+
+        if (mr)
+                mthca_free_mr(dev, mr);
+
+        if (is_direct)
+                dma_free_coherent(&dev->pdev->dev, size, buf->direct.buf,
+                                  pci_unmap_addr(&buf->direct, mapping));
+        else {
+                for (i = 0; i < (size + PAGE_SIZE - 1) / PAGE_SIZE; ++i)
+                        dma_free_coherent(&dev->pdev->dev, PAGE_SIZE,
+                                          buf->page_list[i].buf,
+                                          pci_unmap_addr(&buf->page_list[i],
+                                                         mapping));
+                kfree(buf->page_list);
+        }
+}
diff --git a/drivers/infiniband/hw/mthca/mthca_av.c b/drivers/infiniband/hw/mthca/mthca_av.c
index d58dcbe66488..889e85096736 100644
--- a/drivers/infiniband/hw/mthca/mthca_av.c
+++ b/drivers/infiniband/hw/mthca/mthca_av.c
@@ -35,22 +35,22 @@
 
 #include <linux/init.h>
 
-#include <ib_verbs.h>
-#include <ib_cache.h>
+#include <rdma/ib_verbs.h>
+#include <rdma/ib_cache.h>
 
 #include "mthca_dev.h"
 
 struct mthca_av {
-        u32 port_pd;
-        u8  reserved1;
-        u8  g_slid;
-        u16 dlid;
-        u8  reserved2;
-        u8  gid_index;
-        u8  msg_sr;
-        u8  hop_limit;
-        u32 sl_tclass_flowlabel;
-        u32 dgid[4];
+        __be32 port_pd;
+        u8     reserved1;
+        u8     g_slid;
+        __be16 dlid;
+        u8     reserved2;
+        u8     gid_index;
+        u8     msg_sr;
+        u8     hop_limit;
+        __be32 sl_tclass_flowlabel;
+        __be32 dgid[4];
 };
 
 int mthca_create_ah(struct mthca_dev *dev,
@@ -128,7 +128,7 @@ on_hca_fail:
                           av, (unsigned long) ah->avdma);
                 for (j = 0; j < 8; ++j)
                         printk(KERN_DEBUG "  [%2x] %08x\n",
-                               j * 4, be32_to_cpu(((u32 *) av)[j]));
+                               j * 4, be32_to_cpu(((__be32 *) av)[j]));
         }
 
         if (ah->type == MTHCA_AH_ON_HCA) {
@@ -169,7 +169,7 @@ int mthca_read_ah(struct mthca_dev *dev, struct mthca_ah *ah,
 
         header->lrh.service_level   = be32_to_cpu(ah->av->sl_tclass_flowlabel) >> 28;
         header->lrh.destination_lid = ah->av->dlid;
-        header->lrh.source_lid      = ah->av->g_slid & 0x7f;
+        header->lrh.source_lid      = cpu_to_be16(ah->av->g_slid & 0x7f);
         if (ah->av->g_slid & 0x80) {
                 header->grh_present = 1;
                 header->grh.traffic_class =
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index 1557a522d831..cc758a2d2bc6 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2004, 2005 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -36,7 +37,7 @@
 #include <linux/pci.h>
 #include <linux/errno.h>
 #include <asm/io.h>
-#include <ib_mad.h>
+#include <rdma/ib_mad.h>
 
 #include "mthca_dev.h"
 #include "mthca_config_reg.h"
@@ -108,6 +109,7 @@ enum {
         CMD_SW2HW_SRQ       = 0x35,
         CMD_HW2SW_SRQ       = 0x36,
         CMD_QUERY_SRQ       = 0x37,
+        CMD_ARM_SRQ         = 0x40,
 
         /* QP/EE commands */
         CMD_RST2INIT_QPEE   = 0x19,
@@ -219,20 +221,20 @@ static int mthca_cmd_post(struct mthca_dev *dev,
          * (and some architectures such as ia64 implement memcpy_toio
          * in terms of writeb).
          */
-        __raw_writel(cpu_to_be32(in_param >> 32),           dev->hcr + 0 * 4);
-        __raw_writel(cpu_to_be32(in_param & 0xfffffffful),  dev->hcr + 1 * 4);
-        __raw_writel(cpu_to_be32(in_modifier),              dev->hcr + 2 * 4);
-        __raw_writel(cpu_to_be32(out_param >> 32),          dev->hcr + 3 * 4);
-        __raw_writel(cpu_to_be32(out_param & 0xfffffffful), dev->hcr + 4 * 4);
-        __raw_writel(cpu_to_be32(token << 16),              dev->hcr + 5 * 4);
+        __raw_writel((__force u32) cpu_to_be32(in_param >> 32),           dev->hcr + 0 * 4);
+        __raw_writel((__force u32) cpu_to_be32(in_param & 0xfffffffful),  dev->hcr + 1 * 4);
+        __raw_writel((__force u32) cpu_to_be32(in_modifier),              dev->hcr + 2 * 4);
+        __raw_writel((__force u32) cpu_to_be32(out_param >> 32),          dev->hcr + 3 * 4);
+        __raw_writel((__force u32) cpu_to_be32(out_param & 0xfffffffful), dev->hcr + 4 * 4);
+        __raw_writel((__force u32) cpu_to_be32(token << 16),              dev->hcr + 5 * 4);
 
         /* __raw_writel may not order writes. */
         wmb();
 
-        __raw_writel(cpu_to_be32((1 << HCR_GO_BIT)                |
-                                 (event ? (1 << HCA_E_BIT) : 0)   |
-                                 (op_modifier << HCR_OPMOD_SHIFT) |
-                                 op),                       dev->hcr + 6 * 4);
+        __raw_writel((__force u32) cpu_to_be32((1 << HCR_GO_BIT)                |
+                                               (event ? (1 << HCA_E_BIT) : 0)   |
+                                               (op_modifier << HCR_OPMOD_SHIFT) |
+                                               op),                       dev->hcr + 6 * 4);
 
 out:
         up(&dev->cmd.hcr_sem);
@@ -273,12 +275,14 @@ static int mthca_cmd_poll(struct mthca_dev *dev,
                 goto out;
         }
 
-        if (out_is_imm) {
-                memcpy_fromio(out_param, dev->hcr + HCR_OUT_PARAM_OFFSET, sizeof (u64));
-                be64_to_cpus(out_param);
-        }
+        if (out_is_imm)
+                *out_param = 
+                        (u64) be32_to_cpu((__force __be32)
+                                          __raw_readl(dev->hcr + HCR_OUT_PARAM_OFFSET)) << 32 |
+                        (u64) be32_to_cpu((__force __be32)
+                                          __raw_readl(dev->hcr + HCR_OUT_PARAM_OFFSET + 4));
 
-        *status = be32_to_cpu(__raw_readl(dev->hcr + HCR_STATUS_OFFSET)) >> 24;
+        *status = be32_to_cpu((__force __be32) __raw_readl(dev->hcr + HCR_STATUS_OFFSET)) >> 24;
 
 out:
         up(&dev->cmd.poll_sem);
@@ -1029,6 +1033,8 @@ int mthca_QUERY_DEV_LIM(struct mthca_dev *dev,
 
         mthca_dbg(dev, "Max QPs: %d, reserved QPs: %d, entry size: %d\n",
                   dev_lim->max_qps, dev_lim->reserved_qps, dev_lim->qpc_entry_sz);
+        mthca_dbg(dev, "Max SRQs: %d, reserved SRQs: %d, entry size: %d\n",
+                  dev_lim->max_srqs, dev_lim->reserved_srqs, dev_lim->srq_entry_sz);
         mthca_dbg(dev, "Max CQs: %d, reserved CQs: %d, entry size: %d\n",
                   dev_lim->max_cqs, dev_lim->reserved_cqs, dev_lim->cqc_entry_sz);
         mthca_dbg(dev, "Max EQs: %d, reserved EQs: %d, entry size: %d\n",
@@ -1082,6 +1088,34 @@ out:
         return err;
 }
 
+static void get_board_id(void *vsd, char *board_id)
+{
+        int i;
+
+#define VSD_OFFSET_SIG1         0x00
+#define VSD_OFFSET_SIG2         0xde
+#define VSD_OFFSET_MLX_BOARD_ID 0xd0
+#define VSD_OFFSET_TS_BOARD_ID  0x20
+
+#define VSD_SIGNATURE_TOPSPIN   0x5ad
+
+        memset(board_id, 0, MTHCA_BOARD_ID_LEN);
+
+        if (be16_to_cpup(vsd + VSD_OFFSET_SIG1) == VSD_SIGNATURE_TOPSPIN &&
+            be16_to_cpup(vsd + VSD_OFFSET_SIG2) == VSD_SIGNATURE_TOPSPIN) {
+                strlcpy(board_id, vsd + VSD_OFFSET_TS_BOARD_ID, MTHCA_BOARD_ID_LEN);
+        } else {
+                /*
+                 * The board ID is a string but the firmware byte
+                 * swaps each 4-byte word before passing it back to
+                 * us.  Therefore we need to swab it before printing.
+                 */
+                for (i = 0; i < 4; ++i)
+                        ((u32 *) board_id)[i] =
+                                swab32(*(u32 *) (vsd + VSD_OFFSET_MLX_BOARD_ID + i * 4));
+        }
+}
+
 int mthca_QUERY_ADAPTER(struct mthca_dev *dev,
                         struct mthca_adapter *adapter, u8 *status)
 {
@@ -1094,6 +1128,7 @@ int mthca_QUERY_ADAPTER(struct mthca_dev *dev,
 #define QUERY_ADAPTER_DEVICE_ID_OFFSET     0x04
 #define QUERY_ADAPTER_REVISION_ID_OFFSET   0x08
 #define QUERY_ADAPTER_INTA_PIN_OFFSET      0x10
+#define QUERY_ADAPTER_VSD_OFFSET           0x20
 
         mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL);
         if (IS_ERR(mailbox))
@@ -1111,6 +1146,9 @@ int mthca_QUERY_ADAPTER(struct mthca_dev *dev,
         MTHCA_GET(adapter->revision_id, outbox, QUERY_ADAPTER_REVISION_ID_OFFSET);
         MTHCA_GET(adapter->inta_pin, outbox,    QUERY_ADAPTER_INTA_PIN_OFFSET);
 
+        get_board_id(outbox + QUERY_ADAPTER_VSD_OFFSET / 4,
+                     adapter->board_id);
+
 out:
         mthca_free_mailbox(dev, mailbox);
         return err;
@@ -1121,7 +1159,7 @@ int mthca_INIT_HCA(struct mthca_dev *dev,
                    u8 *status)
 {
         struct mthca_mailbox *mailbox;
-        u32 *inbox;
+        __be32 *inbox;
         int err;
 
 #define INIT_HCA_IN_SIZE                 0x200
@@ -1247,10 +1285,8 @@ int mthca_INIT_IB(struct mthca_dev *dev,
 #define INIT_IB_FLAG_SIG         (1 << 18)
 #define INIT_IB_FLAG_NG          (1 << 17)
 #define INIT_IB_FLAG_G0          (1 << 16)
-#define INIT_IB_FLAG_1X          (1 << 8)
-#define INIT_IB_FLAG_4X          (1 << 9)
-#define INIT_IB_FLAG_12X         (1 << 11)
 #define INIT_IB_VL_SHIFT         4
+#define INIT_IB_PORT_WIDTH_SHIFT 8
 #define INIT_IB_MTU_SHIFT        12
 #define INIT_IB_MAX_GID_OFFSET   0x06
 #define INIT_IB_MAX_PKEY_OFFSET  0x0a
@@ -1266,12 +1302,11 @@ int mthca_INIT_IB(struct mthca_dev *dev,
         memset(inbox, 0, INIT_IB_IN_SIZE);
 
         flags = 0;
-        flags |= param->enable_1x     ? INIT_IB_FLAG_1X  : 0;
-        flags |= param->enable_4x     ? INIT_IB_FLAG_4X  : 0;
         flags |= param->set_guid0     ? INIT_IB_FLAG_G0  : 0;
         flags |= param->set_node_guid ? INIT_IB_FLAG_NG  : 0;
         flags |= param->set_si_guid   ? INIT_IB_FLAG_SIG : 0;
         flags |= param->vl_cap << INIT_IB_VL_SHIFT;
+        flags |= param->port_width << INIT_IB_PORT_WIDTH_SHIFT;
         flags |= param->mtu_cap << INIT_IB_MTU_SHIFT;
         MTHCA_PUT(inbox, flags, INIT_IB_FLAGS_OFFSET);
 
@@ -1342,7 +1377,7 @@ int mthca_MAP_ICM(struct mthca_dev *dev, struct mthca_icm *icm, u64 virt, u8 *st
 int mthca_MAP_ICM_page(struct mthca_dev *dev, u64 dma_addr, u64 virt, u8 *status)
 {
         struct mthca_mailbox *mailbox;
-        u64 *inbox;
+        __be64 *inbox;
         int err;
 
         mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL);
@@ -1468,6 +1503,27 @@ int mthca_HW2SW_CQ(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
                              CMD_TIME_CLASS_A, status);
 }
 
+int mthca_SW2HW_SRQ(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
+                    int srq_num, u8 *status)
+{
+        return mthca_cmd(dev, mailbox->dma, srq_num, 0, CMD_SW2HW_SRQ,
+                        CMD_TIME_CLASS_A, status);
+}
+
+int mthca_HW2SW_SRQ(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
+                    int srq_num, u8 *status)
+{
+        return mthca_cmd_box(dev, 0, mailbox->dma, srq_num, 0,
+                             CMD_HW2SW_SRQ,
+                             CMD_TIME_CLASS_A, status);
+}
+
+int mthca_ARM_SRQ(struct mthca_dev *dev, int srq_num, int limit, u8 *status)
+{
+        return mthca_cmd(dev, limit, srq_num, 0, CMD_ARM_SRQ,
+                         CMD_TIME_CLASS_B, status);
+}
+
 int mthca_MODIFY_QP(struct mthca_dev *dev, int trans, u32 num,
                     int is_ee, struct mthca_mailbox *mailbox, u32 optmask,
                     u8 *status)
@@ -1513,7 +1569,7 @@ int mthca_MODIFY_QP(struct mthca_dev *dev, int trans, u32 num,
                                 if (i % 8 == 0)
                                         printk("  [%02x] ", i * 4);
                                 printk(" %08x",
-                                       be32_to_cpu(((u32 *) mailbox->buf)[i + 2]));
+                                       be32_to_cpu(((__be32 *) mailbox->buf)[i + 2]));
                                 if ((i + 1) % 8 == 0)
                                         printk("\n");
                         }
@@ -1533,7 +1589,7 @@ int mthca_MODIFY_QP(struct mthca_dev *dev, int trans, u32 num,
                                 if (i % 8 == 0)
                                         printk("[%02x] ", i * 4);
                                 printk(" %08x",
-                                       be32_to_cpu(((u32 *) mailbox->buf)[i + 2]));
+                                       be32_to_cpu(((__be32 *) mailbox->buf)[i + 2]));
                                 if ((i + 1) % 8 == 0)
                                         printk("\n");
                         }
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.h b/drivers/infiniband/hw/mthca/mthca_cmd.h
index ed517f175dd6..65f976a13e02 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.h
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2004, 2005 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -35,7 +36,7 @@
 #ifndef MTHCA_CMD_H
 #define MTHCA_CMD_H
 
-#include <ib_verbs.h>
+#include <rdma/ib_verbs.h>
 
 #define MTHCA_MAILBOX_SIZE 4096
 
@@ -183,10 +184,11 @@ struct mthca_dev_lim {
 };
 
 struct mthca_adapter {
-        u32 vendor_id;
-        u32 device_id;
-        u32 revision_id;
-        u8  inta_pin;
+        u32  vendor_id;
+        u32  device_id;
+        u32  revision_id;
+        char board_id[MTHCA_BOARD_ID_LEN];
+        u8   inta_pin;
 };
 
 struct mthca_init_hca_param {
@@ -218,8 +220,7 @@ struct mthca_init_hca_param {
 };
 
 struct mthca_init_ib_param {
-        int enable_1x;
-        int enable_4x;
+        int port_width;
         int vl_cap;
         int mtu_cap;
         u16 gid_cap;
@@ -297,6 +298,11 @@ int mthca_SW2HW_CQ(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
                    int cq_num, u8 *status);
 int mthca_HW2SW_CQ(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
                    int cq_num, u8 *status);
+int mthca_SW2HW_SRQ(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
+                    int srq_num, u8 *status);
+int mthca_HW2SW_SRQ(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
+                    int srq_num, u8 *status);
+int mthca_ARM_SRQ(struct mthca_dev *dev, int srq_num, int limit, u8 *status);
 int mthca_MODIFY_QP(struct mthca_dev *dev, int trans, u32 num,
                     int is_ee, struct mthca_mailbox *mailbox, u32 optmask,
                     u8 *status);
diff --git a/drivers/infiniband/hw/mthca/mthca_config_reg.h b/drivers/infiniband/hw/mthca/mthca_config_reg.h
index b4bfbbfe2c3d..afa56bfaab2e 100644
--- a/drivers/infiniband/hw/mthca/mthca_config_reg.h
+++ b/drivers/infiniband/hw/mthca/mthca_config_reg.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2004 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
index 5687c3014522..8600b6c3e0c2 100644
--- a/drivers/infiniband/hw/mthca/mthca_cq.c
+++ b/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -2,6 +2,8 @@
  * Copyright (c) 2004, 2005 Topspin Communications.  All rights reserved.
  * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
  * Copyright (c) 2005 Cisco Systems, Inc. All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
+ * Copyright (c) 2004 Voltaire, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -37,7 +39,7 @@
 #include <linux/init.h>
 #include <linux/hardirq.h>
 
-#include <ib_pack.h>
+#include <rdma/ib_pack.h>
 
 #include "mthca_dev.h"
 #include "mthca_cmd.h"
@@ -55,21 +57,21 @@ enum {
  * Must be packed because start is 64 bits but only aligned to 32 bits.
  */
 struct mthca_cq_context {
-        u32 flags;
-        u64 start;
-        u32 logsize_usrpage;
-        u32 error_eqn;          /* Tavor only */
-        u32 comp_eqn;
-        u32 pd;
-        u32 lkey;
-        u32 last_notified_index;
-        u32 solicit_producer_index;
-        u32 consumer_index;
-        u32 producer_index;
-        u32 cqn;
-        u32 ci_db;              /* Arbel only */
-        u32 state_db;           /* Arbel only */
-        u32 reserved;
+        __be32 flags;
+        __be64 start;
+        __be32 logsize_usrpage;
+        __be32 error_eqn;       /* Tavor only */
+        __be32 comp_eqn;
+        __be32 pd;
+        __be32 lkey;
+        __be32 last_notified_index;
+        __be32 solicit_producer_index;
+        __be32 consumer_index;
+        __be32 producer_index;
+        __be32 cqn;
+        __be32 ci_db;           /* Arbel only */
+        __be32 state_db;        /* Arbel only */
+        u32    reserved;
 } __attribute__((packed));
 
 #define MTHCA_CQ_STATUS_OK          ( 0 << 28)
@@ -108,31 +110,31 @@ enum {
 };
 
 struct mthca_cqe {
-        u32 my_qpn;
-        u32 my_ee;
-        u32 rqpn;
-        u16 sl_g_mlpath;
-        u16 rlid;
-        u32 imm_etype_pkey_eec;
-        u32 byte_cnt;
-        u32 wqe;
-        u8  opcode;
-        u8  is_send;
-        u8  reserved;
-        u8  owner;
+        __be32 my_qpn;
+        __be32 my_ee;
+        __be32 rqpn;
+        __be16 sl_g_mlpath;
+        __be16 rlid;
+        __be32 imm_etype_pkey_eec;
+        __be32 byte_cnt;
+        __be32 wqe;
+        u8     opcode;
+        u8     is_send;
+        u8     reserved;
+        u8     owner;
 };
 
 struct mthca_err_cqe {
-        u32 my_qpn;
-        u32 reserved1[3];
-        u8  syndrome;
-        u8  reserved2;
-        u16 db_cnt;
-        u32 reserved3;
-        u32 wqe;
-        u8  opcode;
-        u8  reserved4[2];
-        u8  owner;
+        __be32 my_qpn;
+        u32    reserved1[3];
+        u8     syndrome;
+        u8     reserved2;
+        __be16 db_cnt;
+        u32    reserved3;
+        __be32 wqe;
+        u8     opcode;
+        u8     reserved4[2];
+        u8     owner;
 };
 
 #define MTHCA_CQ_ENTRY_OWNER_SW      (0 << 7)
@@ -191,7 +193,7 @@ static void dump_cqe(struct mthca_dev *dev, void *cqe_ptr)
 static inline void update_cons_index(struct mthca_dev *dev, struct mthca_cq *cq,
                                      int incr)
 {
-        u32 doorbell[2];
+        __be32 doorbell[2];
 
         if (mthca_is_memfree(dev)) {
                 *cq->set_ci_db = cpu_to_be32(cq->cons_index);
@@ -222,7 +224,8 @@ void mthca_cq_event(struct mthca_dev *dev, u32 cqn)
         cq->ibcq.comp_handler(&cq->ibcq, cq->ibcq.cq_context);
 }
 
-void mthca_cq_clean(struct mthca_dev *dev, u32 cqn, u32 qpn)
+void mthca_cq_clean(struct mthca_dev *dev, u32 cqn, u32 qpn,
+                    struct mthca_srq *srq)
 {
         struct mthca_cq *cq;
         struct mthca_cqe *cqe;
@@ -263,8 +266,11 @@ void mthca_cq_clean(struct mthca_dev *dev, u32 cqn, u32 qpn)
          */
         while (prod_index > cq->cons_index) {
                 cqe = get_cqe(cq, (prod_index - 1) & cq->ibcq.cqe);
-                if (cqe->my_qpn == cpu_to_be32(qpn))
+                if (cqe->my_qpn == cpu_to_be32(qpn)) {
+                        if (srq)
+                                mthca_free_srq_wqe(srq, be32_to_cpu(cqe->wqe));
                         ++nfreed;
+                }
                 else if (nfreed)
                         memcpy(get_cqe(cq, (prod_index - 1 + nfreed) &
                                        cq->ibcq.cqe),
@@ -291,7 +297,7 @@ static int handle_error_cqe(struct mthca_dev *dev, struct mthca_cq *cq,
 {
         int err;
         int dbd;
-        u32 new_wqe;
+        __be32 new_wqe;
 
         if (cqe->syndrome == SYNDROME_LOCAL_QP_OP_ERR) {
                 mthca_dbg(dev, "local QP operation err "
@@ -365,6 +371,13 @@ static int handle_error_cqe(struct mthca_dev *dev, struct mthca_cq *cq,
                 break;
         }
 
+        /*
+         * Mem-free HCAs always generate one CQE per WQE, even in the
+         * error case, so we don't have to check the doorbell count, etc.
+         */
+        if (mthca_is_memfree(dev))
+                return 0;
+
         err = mthca_free_err_wqe(dev, qp, is_send, wqe_index, &dbd, &new_wqe);
         if (err)
                 return err;
@@ -373,12 +386,8 @@ static int handle_error_cqe(struct mthca_dev *dev, struct mthca_cq *cq,
          * If we're at the end of the WQE chain, or we've used up our
          * doorbell count, free the CQE.  Otherwise just update it for
          * the next poll operation.
-         *
-         * This does not apply to mem-free HCAs: they don't use the
-         * doorbell count field, and so we should always free the CQE.
          */
-        if (mthca_is_memfree(dev) ||
-            !(new_wqe & cpu_to_be32(0x3f)) || (!cqe->db_cnt && dbd))
+        if (!(new_wqe & cpu_to_be32(0x3f)) || (!cqe->db_cnt && dbd))
                 return 0;
 
         cqe->db_cnt   = cpu_to_be16(be16_to_cpu(cqe->db_cnt) - dbd);
@@ -450,23 +459,27 @@ static inline int mthca_poll_one(struct mthca_dev *dev,
                              >> wq->wqe_shift);
                 entry->wr_id = (*cur_qp)->wrid[wqe_index +
                                                (*cur_qp)->rq.max];
+        } else if ((*cur_qp)->ibqp.srq) {
+                struct mthca_srq *srq = to_msrq((*cur_qp)->ibqp.srq);
+                u32 wqe = be32_to_cpu(cqe->wqe);
+                wq = NULL;
+                wqe_index = wqe >> srq->wqe_shift;
+                entry->wr_id = srq->wrid[wqe_index];
+                mthca_free_srq_wqe(srq, wqe);
         } else {
                 wq = &(*cur_qp)->rq;
                 wqe_index = be32_to_cpu(cqe->wqe) >> wq->wqe_shift;
                 entry->wr_id = (*cur_qp)->wrid[wqe_index];
         }
 
-        if (wq->last_comp < wqe_index)
-                wq->tail += wqe_index - wq->last_comp;
-        else
-                wq->tail += wqe_index + wq->max - wq->last_comp;
-
-        wq->last_comp = wqe_index;
+        if (wq) {
+                if (wq->last_comp < wqe_index)
+                        wq->tail += wqe_index - wq->last_comp;
+                else
+                        wq->tail += wqe_index + wq->max - wq->last_comp;
 
-        if (0)
-                mthca_dbg(dev, "%s completion for QP %06x, index %d (nr %d)\n",
-                          is_send ? "Send" : "Receive",
-                          (*cur_qp)->qpn, wqe_index, wq->max);
+                wq->last_comp = wqe_index;
+        }
 
         if (is_error) {
                 err = handle_error_cqe(dev, cq, *cur_qp, wqe_index, is_send,
@@ -584,13 +597,13 @@ int mthca_poll_cq(struct ib_cq *ibcq, int num_entries,
 
 int mthca_tavor_arm_cq(struct ib_cq *cq, enum ib_cq_notify notify)
 {
-        u32 doorbell[2];
+        __be32 doorbell[2];
 
         doorbell[0] = cpu_to_be32((notify == IB_CQ_SOLICITED ?
                                    MTHCA_TAVOR_CQ_DB_REQ_NOT_SOL :
                                    MTHCA_TAVOR_CQ_DB_REQ_NOT)      |
                                   to_mcq(cq)->cqn);
-        doorbell[1] = 0xffffffff;
+        doorbell[1] = (__force __be32) 0xffffffff;
 
         mthca_write64(doorbell,
                       to_mdev(cq->device)->kar + MTHCA_CQ_DOORBELL,
@@ -602,9 +615,9 @@ int mthca_tavor_arm_cq(struct ib_cq *cq, enum ib_cq_notify notify)
 int mthca_arbel_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify notify)
 {
         struct mthca_cq *cq = to_mcq(ibcq);
-        u32 doorbell[2];
+        __be32 doorbell[2];
         u32 sn;
-        u32 ci;
+        __be32 ci;
 
         sn = cq->arm_sn & 3;
         ci = cpu_to_be32(cq->cons_index);
@@ -637,113 +650,8 @@ int mthca_arbel_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify notify)
 
 static void mthca_free_cq_buf(struct mthca_dev *dev, struct mthca_cq *cq)
 {
-        int i;
-        int size;
-
-        if (cq->is_direct)
-                dma_free_coherent(&dev->pdev->dev,
-                                  (cq->ibcq.cqe + 1) * MTHCA_CQ_ENTRY_SIZE,
-                                  cq->queue.direct.buf,
-                                  pci_unmap_addr(&cq->queue.direct,
-                                                 mapping));
-        else {
-                size = (cq->ibcq.cqe + 1) * MTHCA_CQ_ENTRY_SIZE;
-                for (i = 0; i < (size + PAGE_SIZE - 1) / PAGE_SIZE; ++i)
-                        if (cq->queue.page_list[i].buf)
-                                dma_free_coherent(&dev->pdev->dev, PAGE_SIZE,
-                                                  cq->queue.page_list[i].buf,
-                                                  pci_unmap_addr(&cq->queue.page_list[i],
-                                                                 mapping));
-
-                kfree(cq->queue.page_list);
-        }
-}
-
-static int mthca_alloc_cq_buf(struct mthca_dev *dev, int size,
-                              struct mthca_cq *cq)
-{
-        int err = -ENOMEM;
-        int npages, shift;
-        u64 *dma_list = NULL;
-        dma_addr_t t;
-        int i;
-
-        if (size <= MTHCA_MAX_DIRECT_CQ_SIZE) {
-                cq->is_direct = 1;
-                npages        = 1;
-                shift         = get_order(size) + PAGE_SHIFT;
-
-                cq->queue.direct.buf = dma_alloc_coherent(&dev->pdev->dev,
-                                                          size, &t, GFP_KERNEL);
-                if (!cq->queue.direct.buf)
-                        return -ENOMEM;
-
-                pci_unmap_addr_set(&cq->queue.direct, mapping, t);
-
-                memset(cq->queue.direct.buf, 0, size);
-
-                while (t & ((1 << shift) - 1)) {
-                        --shift;
-                        npages *= 2;
-                }
-
-                dma_list = kmalloc(npages * sizeof *dma_list, GFP_KERNEL);
-                if (!dma_list)
-                        goto err_free;
-
-                for (i = 0; i < npages; ++i)
-                        dma_list[i] = t + i * (1 << shift);
-        } else {
-                cq->is_direct = 0;
-                npages        = (size + PAGE_SIZE - 1) / PAGE_SIZE;
-                shift         = PAGE_SHIFT;
-
-                dma_list = kmalloc(npages * sizeof *dma_list, GFP_KERNEL);
-                if (!dma_list)
-                        return -ENOMEM;
-
-                cq->queue.page_list = kmalloc(npages * sizeof *cq->queue.page_list,
-                                              GFP_KERNEL);
-                if (!cq->queue.page_list)
-                        goto err_out;
-
-                for (i = 0; i < npages; ++i)
-                        cq->queue.page_list[i].buf = NULL;
-
-                for (i = 0; i < npages; ++i) {
-                        cq->queue.page_list[i].buf =
-                                dma_alloc_coherent(&dev->pdev->dev, PAGE_SIZE,
-                                                   &t, GFP_KERNEL);
-                        if (!cq->queue.page_list[i].buf)
-                                goto err_free;
-
-                        dma_list[i] = t;
-                        pci_unmap_addr_set(&cq->queue.page_list[i], mapping, t);
-
-                        memset(cq->queue.page_list[i].buf, 0, PAGE_SIZE);
-                }
-        }
-
-        err = mthca_mr_alloc_phys(dev, dev->driver_pd.pd_num,
-                                  dma_list, shift, npages,
-                                  0, size,
-                                  MTHCA_MPT_FLAG_LOCAL_WRITE |
-                                  MTHCA_MPT_FLAG_LOCAL_READ,
-                                  &cq->mr);
-        if (err)
-                goto err_free;
-
-        kfree(dma_list);
-
-        return 0;
-
-err_free:
-        mthca_free_cq_buf(dev, cq);
-
-err_out:
-        kfree(dma_list);
-
-        return err;
+        mthca_buf_free(dev, (cq->ibcq.cqe + 1) * MTHCA_CQ_ENTRY_SIZE,
+                       &cq->queue, cq->is_direct, &cq->mr);
 }
 
 int mthca_init_cq(struct mthca_dev *dev, int nent,
@@ -795,7 +703,9 @@ int mthca_init_cq(struct mthca_dev *dev, int nent,
         cq_context = mailbox->buf;
 
         if (cq->is_kernel) {
-                err = mthca_alloc_cq_buf(dev, size, cq);
+                err = mthca_buf_alloc(dev, size, MTHCA_MAX_DIRECT_CQ_SIZE,
+                                      &cq->queue, &cq->is_direct,
+                                      &dev->driver_pd, 1, &cq->mr);
                 if (err)
                         goto err_out_mailbox;
 
@@ -811,7 +721,6 @@ int mthca_init_cq(struct mthca_dev *dev, int nent,
         cq_context->flags           = cpu_to_be32(MTHCA_CQ_STATUS_OK      |
                                                   MTHCA_CQ_STATE_DISARMED |
                                                   MTHCA_CQ_FLAG_TR);
-        cq_context->start           = cpu_to_be64(0);
         cq_context->logsize_usrpage = cpu_to_be32((ffs(nent) - 1) << 24);
         if (ctx)
                 cq_context->logsize_usrpage |= cpu_to_be32(ctx->uar.index);
@@ -857,10 +766,8 @@ int mthca_init_cq(struct mthca_dev *dev, int nent,
         return 0;
 
 err_out_free_mr:
-        if (cq->is_kernel) {
-                mthca_free_mr(dev, &cq->mr);
+        if (cq->is_kernel)
                 mthca_free_cq_buf(dev, cq);
-        }
 
 err_out_mailbox:
         mthca_free_mailbox(dev, mailbox);
@@ -904,7 +811,7 @@ void mthca_free_cq(struct mthca_dev *dev,
                 mthca_warn(dev, "HW2SW_CQ returned status 0x%02x\n", status);
 
         if (0) {
-                u32 *ctx = mailbox->buf;
+                __be32 *ctx = mailbox->buf;
                 int j;
 
                 printk(KERN_ERR "context for CQN %x (cons index %x, next sw %d)\n",
@@ -928,7 +835,6 @@ void mthca_free_cq(struct mthca_dev *dev,
         wait_event(cq->wait, !atomic_read(&cq->refcount));
 
         if (cq->is_kernel) {
-                mthca_free_mr(dev, &cq->mr);
                 mthca_free_cq_buf(dev, cq);
                 if (mthca_is_memfree(dev)) {
                         mthca_free_db(dev, MTHCA_DB_TYPE_CQ_ARM,    cq->arm_db_index);
diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h b/drivers/infiniband/hw/mthca/mthca_dev.h
index 5ecdd2eeeb0f..7bff5a8425f4 100644
--- a/drivers/infiniband/hw/mthca/mthca_dev.h
+++ b/drivers/infiniband/hw/mthca/mthca_dev.h
@@ -2,6 +2,8 @@
  * Copyright (c) 2004, 2005 Topspin Communications.  All rights reserved.
  * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
  * Copyright (c) 2005 Cisco Systems.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
+ * Copyright (c) 2004 Voltaire, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -67,6 +69,10 @@ enum {
 };
 
 enum {
+        MTHCA_BOARD_ID_LEN = 64
+};
+
+enum {
         MTHCA_EQ_CONTEXT_SIZE =  0x40,
         MTHCA_CQ_CONTEXT_SIZE =  0x40,
         MTHCA_QP_CONTEXT_SIZE = 0x200,
@@ -142,6 +148,7 @@ struct mthca_limits {
         int      reserved_mcgs;
         int      num_pds;
         int      reserved_pds;
+        u8       port_width_cap;
 };
 
 struct mthca_alloc {
@@ -211,6 +218,13 @@ struct mthca_cq_table {
         struct mthca_icm_table *table;
 };
 
+struct mthca_srq_table {
+        struct mthca_alloc      alloc;
+        spinlock_t              lock;
+        struct mthca_array      srq;
+        struct mthca_icm_table *table;
+};
+
 struct mthca_qp_table {
         struct mthca_alloc      alloc;
         u32                     rdb_base;
@@ -246,6 +260,7 @@ struct mthca_dev {
         unsigned long    device_cap_flags;
 
         u32              rev_id;
+        char             board_id[MTHCA_BOARD_ID_LEN];
 
         /* firmware info */
         u64              fw_ver;
@@ -291,6 +306,7 @@ struct mthca_dev {
         struct mthca_mr_table  mr_table;
         struct mthca_eq_table  eq_table;
         struct mthca_cq_table  cq_table;
+        struct mthca_srq_table srq_table;
         struct mthca_qp_table  qp_table;
         struct mthca_av_table  av_table;
         struct mthca_mcg_table mcg_table;
@@ -331,14 +347,13 @@ extern void __buggy_use_of_MTHCA_PUT(void);
 
 #define MTHCA_PUT(dest, source, offset)                               \
         do {                                                          \
-                __typeof__(source) *__p =                             \
-                        (__typeof__(source) *) ((char *) (dest) + (offset)); \
+                void *__d = ((char *) (dest) + (offset));             \
                 switch (sizeof(source)) {                             \
-                        case 1: *__p = (source);            break;    \
-                        case 2: *__p = cpu_to_be16(source); break;    \
-                        case 4: *__p = cpu_to_be32(source); break;    \
-                        case 8: *__p = cpu_to_be64(source); break;    \
-                        default: __buggy_use_of_MTHCA_PUT();          \
+                case 1: *(u8 *) __d = (source);                break; \
+                case 2: *(__be16 *) __d = cpu_to_be16(source); break; \
+                case 4: *(__be32 *) __d = cpu_to_be32(source); break; \
+                case 8: *(__be64 *) __d = cpu_to_be64(source); break; \
+                default: __buggy_use_of_MTHCA_PUT();                  \
                 }                                                     \
         } while (0)
 
@@ -354,12 +369,18 @@ int mthca_array_set(struct mthca_array *array, int index, void *value);
 void mthca_array_clear(struct mthca_array *array, int index);
 int mthca_array_init(struct mthca_array *array, int nent);
 void mthca_array_cleanup(struct mthca_array *array, int nent);
+int mthca_buf_alloc(struct mthca_dev *dev, int size, int max_direct,
+                    union mthca_buf *buf, int *is_direct, struct mthca_pd *pd,
+                    int hca_write, struct mthca_mr *mr);
+void mthca_buf_free(struct mthca_dev *dev, int size, union mthca_buf *buf,
+                    int is_direct, struct mthca_mr *mr);
 
 int mthca_init_uar_table(struct mthca_dev *dev);
 int mthca_init_pd_table(struct mthca_dev *dev);
 int mthca_init_mr_table(struct mthca_dev *dev);
 int mthca_init_eq_table(struct mthca_dev *dev);
 int mthca_init_cq_table(struct mthca_dev *dev);
+int mthca_init_srq_table(struct mthca_dev *dev);
 int mthca_init_qp_table(struct mthca_dev *dev);
 int mthca_init_av_table(struct mthca_dev *dev);
 int mthca_init_mcg_table(struct mthca_dev *dev);
@@ -369,6 +390,7 @@ void mthca_cleanup_pd_table(struct mthca_dev *dev);
 void mthca_cleanup_mr_table(struct mthca_dev *dev);
 void mthca_cleanup_eq_table(struct mthca_dev *dev);
 void mthca_cleanup_cq_table(struct mthca_dev *dev);
+void mthca_cleanup_srq_table(struct mthca_dev *dev);
 void mthca_cleanup_qp_table(struct mthca_dev *dev);
 void mthca_cleanup_av_table(struct mthca_dev *dev);
 void mthca_cleanup_mcg_table(struct mthca_dev *dev);
@@ -419,7 +441,19 @@ int mthca_init_cq(struct mthca_dev *dev, int nent,
 void mthca_free_cq(struct mthca_dev *dev,
                    struct mthca_cq *cq);
 void mthca_cq_event(struct mthca_dev *dev, u32 cqn);
-void mthca_cq_clean(struct mthca_dev *dev, u32 cqn, u32 qpn);
+void mthca_cq_clean(struct mthca_dev *dev, u32 cqn, u32 qpn,
+                    struct mthca_srq *srq);
+
+int mthca_alloc_srq(struct mthca_dev *dev, struct mthca_pd *pd,
+                    struct ib_srq_attr *attr, struct mthca_srq *srq);
+void mthca_free_srq(struct mthca_dev *dev, struct mthca_srq *srq);
+void mthca_srq_event(struct mthca_dev *dev, u32 srqn,
+                     enum ib_event_type event_type);
+void mthca_free_srq_wqe(struct mthca_srq *srq, u32 wqe_addr);
+int mthca_tavor_post_srq_recv(struct ib_srq *srq, struct ib_recv_wr *wr,
+                              struct ib_recv_wr **bad_wr);
+int mthca_arbel_post_srq_recv(struct ib_srq *srq, struct ib_recv_wr *wr,
+                              struct ib_recv_wr **bad_wr);
 
 void mthca_qp_event(struct mthca_dev *dev, u32 qpn,
                     enum ib_event_type event_type);
@@ -433,7 +467,7 @@ int mthca_arbel_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 int mthca_arbel_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
                              struct ib_recv_wr **bad_wr);
 int mthca_free_err_wqe(struct mthca_dev *dev, struct mthca_qp *qp, int is_send,
-                       int index, int *dbd, u32 *new_wqe);
+                       int index, int *dbd, __be32 *new_wqe);
 int mthca_alloc_qp(struct mthca_dev *dev,
                    struct mthca_pd *pd,
                    struct mthca_cq *send_cq,
diff --git a/drivers/infiniband/hw/mthca/mthca_doorbell.h b/drivers/infiniband/hw/mthca/mthca_doorbell.h
index 535fad7710fb..dd9a44d170c9 100644
--- a/drivers/infiniband/hw/mthca/mthca_doorbell.h
+++ b/drivers/infiniband/hw/mthca/mthca_doorbell.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (c) 2004 Topspin Communications.  All rights reserved.
  * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -57,13 +58,13 @@ static inline void mthca_write64_raw(__be64 val, void __iomem *dest)
         __raw_writeq((__force u64) val, dest);
 }
 
-static inline void mthca_write64(u32 val[2], void __iomem *dest,
+static inline void mthca_write64(__be32 val[2], void __iomem *dest,
                                  spinlock_t *doorbell_lock)
 {
         __raw_writeq(*(u64 *) val, dest);
 }
 
-static inline void mthca_write_db_rec(u32 val[2], u32 *db)
+static inline void mthca_write_db_rec(__be32 val[2], __be32 *db)
 {
         *(u64 *) db = *(u64 *) val;
 }
@@ -86,18 +87,18 @@ static inline void mthca_write64_raw(__be64 val, void __iomem *dest)
         __raw_writel(((__force u32 *) &val)[1], dest + 4);
 }
 
-static inline void mthca_write64(u32 val[2], void __iomem *dest,
+static inline void mthca_write64(__be32 val[2], void __iomem *dest,
                                  spinlock_t *doorbell_lock)
 {
         unsigned long flags;
 
         spin_lock_irqsave(doorbell_lock, flags);
-        __raw_writel(val[0], dest);
-        __raw_writel(val[1], dest + 4);
+        __raw_writel((__force u32) val[0], dest);
+        __raw_writel((__force u32) val[1], dest + 4);
         spin_unlock_irqrestore(doorbell_lock, flags);
 }
 
-static inline void mthca_write_db_rec(u32 val[2], u32 *db)
+static inline void mthca_write_db_rec(__be32 val[2], __be32 *db)
 {
         db[0] = val[0];
         wmb();
diff --git a/drivers/infiniband/hw/mthca/mthca_eq.c b/drivers/infiniband/hw/mthca/mthca_eq.c
index cbcf2b4722e4..18f0981eb0c1 100644
--- a/drivers/infiniband/hw/mthca/mthca_eq.c
+++ b/drivers/infiniband/hw/mthca/mthca_eq.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2004, 2005 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -51,18 +52,18 @@ enum {
  * Must be packed because start is 64 bits but only aligned to 32 bits.
  */
 struct mthca_eq_context {
-        u32 flags;
-        u64 start;
-        u32 logsize_usrpage;
-        u32 tavor_pd;           /* reserved for Arbel */
-        u8  reserved1[3];
-        u8  intr;
-        u32 arbel_pd;           /* lost_count for Tavor */
-        u32 lkey;
-        u32 reserved2[2];
-        u32 consumer_index;
-        u32 producer_index;
-        u32 reserved3[4];
+        __be32 flags;
+        __be64 start;
+        __be32 logsize_usrpage;
+        __be32 tavor_pd;        /* reserved for Arbel */
+        u8     reserved1[3];
+        u8     intr;
+        __be32 arbel_pd;        /* lost_count for Tavor */
+        __be32 lkey;
+        u32    reserved2[2];
+        __be32 consumer_index;
+        __be32 producer_index;
+        u32    reserved3[4];
 } __attribute__((packed));
 
 #define MTHCA_EQ_STATUS_OK          ( 0 << 28)
@@ -127,28 +128,28 @@ struct mthca_eqe {
         union {
                 u32 raw[6];
                 struct {
-                        u32 cqn;
+                        __be32 cqn;
                 } __attribute__((packed)) comp;
                 struct {
-                        u16 reserved1;
-                        u16 token;
-                        u32 reserved2;
-                        u8  reserved3[3];
-                        u8  status;
-                        u64 out_param;
+                        u16    reserved1;
+                        __be16 token;
+                        u32    reserved2;
+                        u8     reserved3[3];
+                        u8     status;
+                        __be64 out_param;
                 } __attribute__((packed)) cmd;
                 struct {
-                        u32 qpn;
+                        __be32 qpn;
                 } __attribute__((packed)) qp;
                 struct {
-                        u32 cqn;
-                        u32 reserved1;
-                        u8  reserved2[3];
-                        u8  syndrome;
+                        __be32 cqn;
+                        u32    reserved1;
+                        u8     reserved2[3];
+                        u8     syndrome;
                 } __attribute__((packed)) cq_err;
                 struct {
-                        u32 reserved1[2];
-                        u32 port;
+                        u32    reserved1[2];
+                        __be32 port;
                 } __attribute__((packed)) port_change;
         } event;
         u8 reserved3[3];
@@ -167,7 +168,7 @@ static inline u64 async_mask(struct mthca_dev *dev)
 
 static inline void tavor_set_eq_ci(struct mthca_dev *dev, struct mthca_eq *eq, u32 ci)
 {
-        u32 doorbell[2];
+        __be32 doorbell[2];
 
         doorbell[0] = cpu_to_be32(MTHCA_EQ_DB_SET_CI | eq->eqn);
         doorbell[1] = cpu_to_be32(ci & (eq->nent - 1));
@@ -190,8 +191,8 @@ static inline void arbel_set_eq_ci(struct mthca_dev *dev, struct mthca_eq *eq, u
 {
         /* See comment in tavor_set_eq_ci() above. */
         wmb();
-        __raw_writel(cpu_to_be32(ci), dev->eq_regs.arbel.eq_set_ci_base +
-                     eq->eqn * 8);
+        __raw_writel((__force u32) cpu_to_be32(ci),
+                     dev->eq_regs.arbel.eq_set_ci_base + eq->eqn * 8);
         /* We still want ordering, just not swabbing, so add a barrier */
         mb();
 }
@@ -206,7 +207,7 @@ static inline void set_eq_ci(struct mthca_dev *dev, struct mthca_eq *eq, u32 ci)
 
 static inline void tavor_eq_req_not(struct mthca_dev *dev, int eqn)
 {
-        u32 doorbell[2];
+        __be32 doorbell[2];
 
         doorbell[0] = cpu_to_be32(MTHCA_EQ_DB_REQ_NOT | eqn);
         doorbell[1] = 0;
@@ -224,7 +225,7 @@ static inline void arbel_eq_req_not(struct mthca_dev *dev, u32 eqn_mask)
 static inline void disarm_cq(struct mthca_dev *dev, int eqn, int cqn)
 {
         if (!mthca_is_memfree(dev)) {
-                u32 doorbell[2];
+                __be32 doorbell[2];
 
                 doorbell[0] = cpu_to_be32(MTHCA_EQ_DB_DISARM_CQ | eqn);
                 doorbell[1] = cpu_to_be32(cqn);
diff --git a/drivers/infiniband/hw/mthca/mthca_mad.c b/drivers/infiniband/hw/mthca/mthca_mad.c
index 7df223642015..9804174f7f3c 100644
--- a/drivers/infiniband/hw/mthca/mthca_mad.c
+++ b/drivers/infiniband/hw/mthca/mthca_mad.c
@@ -1,5 +1,7 @@
 /*
  * Copyright (c) 2004 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
+ * Copyright (c) 2004 Voltaire, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -32,9 +34,9 @@
  * $Id: mthca_mad.c 1349 2004-12-16 21:09:43Z roland $
  */
 
-#include <ib_verbs.h>
-#include <ib_mad.h>
-#include <ib_smi.h>
+#include <rdma/ib_verbs.h>
+#include <rdma/ib_mad.h>
+#include <rdma/ib_smi.h>
 
 #include "mthca_dev.h"
 #include "mthca_cmd.h"
@@ -192,7 +194,7 @@ int mthca_process_mad(struct ib_device *ibdev,
 {
         int err;
         u8 status;
-        u16 slid = in_wc ? in_wc->slid : IB_LID_PERMISSIVE;
+        u16 slid = in_wc ? in_wc->slid : be16_to_cpu(IB_LID_PERMISSIVE);
 
         /* Forward locally generated traps to the SM */
         if (in_mad->mad_hdr.method == IB_MGMT_METHOD_TRAP &&
diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
index 2ef916859e17..3241d6c9dc11 100644
--- a/drivers/infiniband/hw/mthca/mthca_main.c
+++ b/drivers/infiniband/hw/mthca/mthca_main.c
@@ -1,6 +1,7 @@
 /*
  * Copyright (c) 2004, 2005 Topspin Communications.  All rights reserved.
  * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -34,7 +35,6 @@
  */
 
 #include <linux/config.h>
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/errno.h>
@@ -171,6 +171,7 @@ static int __devinit mthca_dev_lim(struct mthca_dev *mdev, struct mthca_dev_lim
         mdev->limits.reserved_mrws      = dev_lim->reserved_mrws;
         mdev->limits.reserved_uars      = dev_lim->reserved_uars;
         mdev->limits.reserved_pds       = dev_lim->reserved_pds;
+        mdev->limits.port_width_cap     = dev_lim->max_port_width;
 
         /* IB_DEVICE_RESIZE_MAX_WR not supported by driver.
            May be doable since hardware supports it for SRQ.
@@ -212,7 +213,6 @@ static int __devinit mthca_init_tavor(struct mthca_dev *mdev)
         struct mthca_dev_lim        dev_lim;
         struct mthca_profile        profile;
         struct mthca_init_hca_param init_hca;
-        struct mthca_adapter        adapter;
 
         err = mthca_SYS_EN(mdev, &status);
         if (err) {
@@ -253,6 +253,8 @@ static int __devinit mthca_init_tavor(struct mthca_dev *mdev)
         profile = default_profile;
         profile.num_uar   = dev_lim.uar_size / PAGE_SIZE;
         profile.uarc_size = 0;
+        if (mdev->mthca_flags & MTHCA_FLAG_SRQ)
+                profile.num_srq = dev_lim.max_srqs;
 
         err = mthca_make_profile(mdev, &profile, &dev_lim, &init_hca);
         if (err < 0)
@@ -270,26 +272,8 @@ static int __devinit mthca_init_tavor(struct mthca_dev *mdev)
                 goto err_disable;
         }
 
-        err = mthca_QUERY_ADAPTER(mdev, &adapter, &status);
-        if (err) {
-                mthca_err(mdev, "QUERY_ADAPTER command failed, aborting.\n");
-                goto err_close;
-        }
-        if (status) {
-                mthca_err(mdev, "QUERY_ADAPTER returned status 0x%02x, "
-                          "aborting.\n", status);
-                err = -EINVAL;
-                goto err_close;
-        }
-
-        mdev->eq_table.inta_pin = adapter.inta_pin;
-        mdev->rev_id            = adapter.revision_id;
-
         return 0;
 
-err_close:
-        mthca_CLOSE_HCA(mdev, 0, &status);
-
 err_disable:
         mthca_SYS_DIS(mdev, &status);
 
@@ -442,15 +426,29 @@ static int __devinit mthca_init_icm(struct mthca_dev *mdev,
         }
 
        mdev->cq_table.table = mthca_alloc_icm_table(mdev, init_hca->cqc_base,
-                                                     dev_lim->cqc_entry_sz,
-                                                     mdev->limits.num_cqs,
-                                                     mdev->limits.reserved_cqs, 0);
+                                                    dev_lim->cqc_entry_sz,
+                                                    mdev->limits.num_cqs,
+                                                    mdev->limits.reserved_cqs, 0);
         if (!mdev->cq_table.table) {
                 mthca_err(mdev, "Failed to map CQ context memory, aborting.\n");
                 err = -ENOMEM;
                 goto err_unmap_rdb;
         }
 
+        if (mdev->mthca_flags & MTHCA_FLAG_SRQ) {
+                mdev->srq_table.table =
+                        mthca_alloc_icm_table(mdev, init_hca->srqc_base,
+                                              dev_lim->srq_entry_sz,
+                                              mdev->limits.num_srqs,
+                                              mdev->limits.reserved_srqs, 0);
+                if (!mdev->srq_table.table) {
+                        mthca_err(mdev, "Failed to map SRQ context memory, "
+                                  "aborting.\n");
+                        err = -ENOMEM;
+                        goto err_unmap_cq;
+                }
+        }
+
         /*
          * It's not strictly required, but for simplicity just map the
          * whole multicast group table now.  The table isn't very big
@@ -466,11 +464,15 @@ static int __devinit mthca_init_icm(struct mthca_dev *mdev,
         if (!mdev->mcg_table.table) {
                 mthca_err(mdev, "Failed to map MCG context memory, aborting.\n");
                 err = -ENOMEM;
-                goto err_unmap_cq;
+                goto err_unmap_srq;
         }
 
         return 0;
 
+err_unmap_srq:
+        if (mdev->mthca_flags & MTHCA_FLAG_SRQ)
+                mthca_free_icm_table(mdev, mdev->srq_table.table);
+
 err_unmap_cq:
         mthca_free_icm_table(mdev, mdev->cq_table.table);
 
@@ -506,7 +508,6 @@ static int __devinit mthca_init_arbel(struct mthca_dev *mdev)
         struct mthca_dev_lim        dev_lim;
         struct mthca_profile        profile;
         struct mthca_init_hca_param init_hca;
-        struct mthca_adapter        adapter;
         u64 icm_size;
         u8 status;
         int err;
@@ -551,6 +552,8 @@ static int __devinit mthca_init_arbel(struct mthca_dev *mdev)
         profile = default_profile;
         profile.num_uar  = dev_lim.uar_size / PAGE_SIZE;
         profile.num_udav = 0;
+        if (mdev->mthca_flags & MTHCA_FLAG_SRQ)
+                profile.num_srq = dev_lim.max_srqs;
 
         icm_size = mthca_make_profile(mdev, &profile, &dev_lim, &init_hca);
         if ((int) icm_size < 0) {
@@ -574,24 +577,11 @@ static int __devinit mthca_init_arbel(struct mthca_dev *mdev)
                 goto err_free_icm;
         }
 
-        err = mthca_QUERY_ADAPTER(mdev, &adapter, &status);
-        if (err) {
-                mthca_err(mdev, "QUERY_ADAPTER command failed, aborting.\n");
-                goto err_free_icm;
-        }
-        if (status) {
-                mthca_err(mdev, "QUERY_ADAPTER returned status 0x%02x, "
-                          "aborting.\n", status);
-                err = -EINVAL;
-                goto err_free_icm;
-        }
-
-        mdev->eq_table.inta_pin = adapter.inta_pin;
-        mdev->rev_id            = adapter.revision_id;
-
         return 0;
 
 err_free_icm:
+        if (mdev->mthca_flags & MTHCA_FLAG_SRQ)
+                mthca_free_icm_table(mdev, mdev->srq_table.table);
         mthca_free_icm_table(mdev, mdev->cq_table.table);
         mthca_free_icm_table(mdev, mdev->qp_table.rdb_table);
         mthca_free_icm_table(mdev, mdev->qp_table.eqp_table);
@@ -614,12 +604,70 @@ err_disable:
         return err;
 }
 
+static void mthca_close_hca(struct mthca_dev *mdev)
+{
+        u8 status;
+
+        mthca_CLOSE_HCA(mdev, 0, &status);
+
+        if (mthca_is_memfree(mdev)) {
+                if (mdev->mthca_flags & MTHCA_FLAG_SRQ)
+                        mthca_free_icm_table(mdev, mdev->srq_table.table);
+                mthca_free_icm_table(mdev, mdev->cq_table.table);
+                mthca_free_icm_table(mdev, mdev->qp_table.rdb_table);
+                mthca_free_icm_table(mdev, mdev->qp_table.eqp_table);
+                mthca_free_icm_table(mdev, mdev->qp_table.qp_table);
+                mthca_free_icm_table(mdev, mdev->mr_table.mpt_table);
+                mthca_free_icm_table(mdev, mdev->mr_table.mtt_table);
+                mthca_unmap_eq_icm(mdev);
+
+                mthca_UNMAP_ICM_AUX(mdev, &status);
+                mthca_free_icm(mdev, mdev->fw.arbel.aux_icm);
+
+                mthca_UNMAP_FA(mdev, &status);
+                mthca_free_icm(mdev, mdev->fw.arbel.fw_icm);
+
+                if (!(mdev->mthca_flags & MTHCA_FLAG_NO_LAM))
+                        mthca_DISABLE_LAM(mdev, &status);
+        } else
+                mthca_SYS_DIS(mdev, &status);
+}
+
 static int __devinit mthca_init_hca(struct mthca_dev *mdev)
 {
+        u8 status;
+        int err;
+        struct mthca_adapter adapter;
+
         if (mthca_is_memfree(mdev))
-                return mthca_init_arbel(mdev);
+                err = mthca_init_arbel(mdev);
         else
-                return mthca_init_tavor(mdev);
+                err = mthca_init_tavor(mdev);
+
+        if (err)
+                return err;
+
+        err = mthca_QUERY_ADAPTER(mdev, &adapter, &status);
+        if (err) {
+                mthca_err(mdev, "QUERY_ADAPTER command failed, aborting.\n");
+                goto err_close;
+        }
+        if (status) {
+                mthca_err(mdev, "QUERY_ADAPTER returned status 0x%02x, "
+                          "aborting.\n", status);
+                err = -EINVAL;
+                goto err_close;
+        }
+
+        mdev->eq_table.inta_pin = adapter.inta_pin;
+        mdev->rev_id            = adapter.revision_id;
+        memcpy(mdev->board_id, adapter.board_id, sizeof mdev->board_id);
+
+        return 0;
+
+err_close:
+        mthca_close_hca(mdev);
+        return err;
 }
 
 static int __devinit mthca_setup_hca(struct mthca_dev *dev)
@@ -709,11 +757,18 @@ static int __devinit mthca_setup_hca(struct mthca_dev *dev)
                 goto err_cmd_poll;
         }
 
+        err = mthca_init_srq_table(dev);
+        if (err) {
+                mthca_err(dev, "Failed to initialize "
+                          "shared receive queue table, aborting.\n");
+                goto err_cq_table_free;
+        }
+
         err = mthca_init_qp_table(dev);
         if (err) {
                 mthca_err(dev, "Failed to initialize "
                           "queue pair table, aborting.\n");
-                goto err_cq_table_free;
+                goto err_srq_table_free;
         }
 
         err = mthca_init_av_table(dev);
@@ -738,6 +793,9 @@ err_av_table_free:
 err_qp_table_free:
         mthca_cleanup_qp_table(dev);
 
+err_srq_table_free:
+        mthca_cleanup_srq_table(dev);
+
 err_cq_table_free:
         mthca_cleanup_cq_table(dev);
 
@@ -844,33 +902,6 @@ static int __devinit mthca_enable_msi_x(struct mthca_dev *mdev)
         return 0;
 }
 
-static void mthca_close_hca(struct mthca_dev *mdev)
-{
-        u8 status;
-
-        mthca_CLOSE_HCA(mdev, 0, &status);
-
-        if (mthca_is_memfree(mdev)) {
-                mthca_free_icm_table(mdev, mdev->cq_table.table);
-                mthca_free_icm_table(mdev, mdev->qp_table.rdb_table);
-                mthca_free_icm_table(mdev, mdev->qp_table.eqp_table);
-                mthca_free_icm_table(mdev, mdev->qp_table.qp_table);
-                mthca_free_icm_table(mdev, mdev->mr_table.mpt_table);
-                mthca_free_icm_table(mdev, mdev->mr_table.mtt_table);
-                mthca_unmap_eq_icm(mdev);
-
-                mthca_UNMAP_ICM_AUX(mdev, &status);
-                mthca_free_icm(mdev, mdev->fw.arbel.aux_icm);
-
-                mthca_UNMAP_FA(mdev, &status);
-                mthca_free_icm(mdev, mdev->fw.arbel.fw_icm);
-
-                if (!(mdev->mthca_flags & MTHCA_FLAG_NO_LAM))
-                        mthca_DISABLE_LAM(mdev, &status);
-        } else
-                mthca_SYS_DIS(mdev, &status);
-}
-
 /* Types of supported HCA */
 enum {
         TAVOR,                  /* MT23108                        */
@@ -887,9 +918,9 @@ static struct {
         int is_memfree;
         int is_pcie;
 } mthca_hca_table[] = {
-        [TAVOR]        = { .latest_fw = MTHCA_FW_VER(3, 3, 2), .is_memfree = 0, .is_pcie = 0 },
-        [ARBEL_COMPAT] = { .latest_fw = MTHCA_FW_VER(4, 6, 2), .is_memfree = 0, .is_pcie = 1 },
-        [ARBEL_NATIVE] = { .latest_fw = MTHCA_FW_VER(5, 0, 1), .is_memfree = 1, .is_pcie = 1 },
+        [TAVOR]        = { .latest_fw = MTHCA_FW_VER(3, 3, 3), .is_memfree = 0, .is_pcie = 0 },
+        [ARBEL_COMPAT] = { .latest_fw = MTHCA_FW_VER(4, 7, 0), .is_memfree = 0, .is_pcie = 1 },
+        [ARBEL_NATIVE] = { .latest_fw = MTHCA_FW_VER(5, 1, 0), .is_memfree = 1, .is_pcie = 1 },
         [SINAI]        = { .latest_fw = MTHCA_FW_VER(1, 0, 1), .is_memfree = 1, .is_pcie = 1 }
 };
 
@@ -1051,6 +1082,7 @@ err_cleanup:
         mthca_cleanup_mcg_table(mdev);
         mthca_cleanup_av_table(mdev);
         mthca_cleanup_qp_table(mdev);
+        mthca_cleanup_srq_table(mdev);
         mthca_cleanup_cq_table(mdev);
         mthca_cmd_use_polling(mdev);
         mthca_cleanup_eq_table(mdev);
@@ -1100,6 +1132,7 @@ static void __devexit mthca_remove_one(struct pci_dev *pdev)
                 mthca_cleanup_mcg_table(mdev);
                 mthca_cleanup_av_table(mdev);
                 mthca_cleanup_qp_table(mdev);
+                mthca_cleanup_srq_table(mdev);
                 mthca_cleanup_cq_table(mdev);
                 mthca_cmd_use_polling(mdev);
                 mthca_cleanup_eq_table(mdev);
diff --git a/drivers/infiniband/hw/mthca/mthca_mcg.c b/drivers/infiniband/hw/mthca/mthca_mcg.c
index 5be7d949dbf6..a2707605f4c8 100644
--- a/drivers/infiniband/hw/mthca/mthca_mcg.c
+++ b/drivers/infiniband/hw/mthca/mthca_mcg.c
@@ -42,10 +42,10 @@ enum {
 };
 
 struct mthca_mgm {
-        u32 next_gid_index;
-        u32 reserved[3];
-        u8  gid[16];
-        u32 qp[MTHCA_QP_PER_MGM];
+        __be32 next_gid_index;
+        u32    reserved[3];
+        u8     gid[16];
+        __be32 qp[MTHCA_QP_PER_MGM];
 };
 
 static const u8 zero_gid[16];   /* automatically initialized to 0 */
@@ -94,10 +94,14 @@ static int find_mgm(struct mthca_dev *dev,
         if (0)
                 mthca_dbg(dev, "Hash for %04x:%04x:%04x:%04x:"
                           "%04x:%04x:%04x:%04x is %04x\n",
-                          be16_to_cpu(((u16 *) gid)[0]), be16_to_cpu(((u16 *) gid)[1]),
-                          be16_to_cpu(((u16 *) gid)[2]), be16_to_cpu(((u16 *) gid)[3]),
-                          be16_to_cpu(((u16 *) gid)[4]), be16_to_cpu(((u16 *) gid)[5]),
-                          be16_to_cpu(((u16 *) gid)[6]), be16_to_cpu(((u16 *) gid)[7]),
+                          be16_to_cpu(((__be16 *) gid)[0]),
+                          be16_to_cpu(((__be16 *) gid)[1]),
+                          be16_to_cpu(((__be16 *) gid)[2]),
+                          be16_to_cpu(((__be16 *) gid)[3]),
+                          be16_to_cpu(((__be16 *) gid)[4]),
+                          be16_to_cpu(((__be16 *) gid)[5]),
+                          be16_to_cpu(((__be16 *) gid)[6]),
+                          be16_to_cpu(((__be16 *) gid)[7]),
                           *hash);
 
         *index = *hash;
@@ -258,14 +262,14 @@ int mthca_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
         if (index == -1) {
                 mthca_err(dev, "MGID %04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x "
                           "not found\n",
-                          be16_to_cpu(((u16 *) gid->raw)[0]),
-                          be16_to_cpu(((u16 *) gid->raw)[1]),
-                          be16_to_cpu(((u16 *) gid->raw)[2]),
-                          be16_to_cpu(((u16 *) gid->raw)[3]),
-                          be16_to_cpu(((u16 *) gid->raw)[4]),
-                          be16_to_cpu(((u16 *) gid->raw)[5]),
-                          be16_to_cpu(((u16 *) gid->raw)[6]),
-                          be16_to_cpu(((u16 *) gid->raw)[7]));
+                          be16_to_cpu(((__be16 *) gid->raw)[0]),
+                          be16_to_cpu(((__be16 *) gid->raw)[1]),
+                          be16_to_cpu(((__be16 *) gid->raw)[2]),
+                          be16_to_cpu(((__be16 *) gid->raw)[3]),
+                          be16_to_cpu(((__be16 *) gid->raw)[4]),
+                          be16_to_cpu(((__be16 *) gid->raw)[5]),
+                          be16_to_cpu(((__be16 *) gid->raw)[6]),
+                          be16_to_cpu(((__be16 *) gid->raw)[7]));
                 err = -EINVAL;
                 goto out;
         }
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index 2a8646150355..1827400f189b 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -1,6 +1,7 @@
 /*
  * Copyright (c) 2004, 2005 Topspin Communications.  All rights reserved.
  * Copyright (c) 2005 Cisco Systems.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -285,6 +286,7 @@ struct mthca_icm_table *mthca_alloc_icm_table(struct mthca_dev *dev,
 {
         struct mthca_icm_table *table;
         int num_icm;
+        unsigned chunk_size;
         int i;
         u8 status;
 
@@ -305,7 +307,11 @@ struct mthca_icm_table *mthca_alloc_icm_table(struct mthca_dev *dev,
                 table->icm[i] = NULL;
 
         for (i = 0; i * MTHCA_TABLE_CHUNK_SIZE < reserved * obj_size; ++i) {
-                table->icm[i] = mthca_alloc_icm(dev, MTHCA_TABLE_CHUNK_SIZE >> PAGE_SHIFT,
+                chunk_size = MTHCA_TABLE_CHUNK_SIZE;
+                if ((i + 1) * MTHCA_TABLE_CHUNK_SIZE > nobj * obj_size)
+                        chunk_size = nobj * obj_size - i * MTHCA_TABLE_CHUNK_SIZE;
+
+                table->icm[i] = mthca_alloc_icm(dev, chunk_size >> PAGE_SHIFT,
                                                 (use_lowmem ? GFP_KERNEL : GFP_HIGHUSER) |
                                                 __GFP_NOWARN);
                 if (!table->icm[i])
@@ -481,7 +487,7 @@ void mthca_cleanup_user_db_tab(struct mthca_dev *dev, struct mthca_uar *uar,
         }
 }
 
-int mthca_alloc_db(struct mthca_dev *dev, int type, u32 qn, u32 **db)
+int mthca_alloc_db(struct mthca_dev *dev, int type, u32 qn, __be32 **db)
 {
         int group;
         int start, end, dir;
@@ -564,7 +570,7 @@ found:
 
         page->db_rec[j] = cpu_to_be64((qn << 8) | (type << 5));
 
-        *db = (u32 *) &page->db_rec[j];
+        *db = (__be32 *) &page->db_rec[j];
 
 out:
         up(&dev->db_tab->mutex);
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.h b/drivers/infiniband/hw/mthca/mthca_memfree.h
index 4761d844cb5f..bafa51544aa3 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.h
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (c) 2004, 2005 Topspin Communications.  All rights reserved.
  * Copyright (c) 2005 Cisco Systems.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -137,7 +138,7 @@ enum {
 
 struct mthca_db_page {
         DECLARE_BITMAP(used, MTHCA_DB_REC_PER_PAGE);
-        u64       *db_rec;
+        __be64    *db_rec;
         dma_addr_t mapping;
 };
 
@@ -172,7 +173,7 @@ void mthca_cleanup_user_db_tab(struct mthca_dev *dev, struct mthca_uar *uar,
 
 int mthca_init_db_tab(struct mthca_dev *dev);
 void mthca_cleanup_db_tab(struct mthca_dev *dev);
-int mthca_alloc_db(struct mthca_dev *dev, int type, u32 qn, u32 **db);
+int mthca_alloc_db(struct mthca_dev *dev, int type, u32 qn, __be32 **db);
 void mthca_free_db(struct mthca_dev *dev, int type, int db_index);
 
 #endif /* MTHCA_MEMFREE_H */
diff --git a/drivers/infiniband/hw/mthca/mthca_mr.c b/drivers/infiniband/hw/mthca/mthca_mr.c
index cbe50feaf680..1f97a44477f5 100644
--- a/drivers/infiniband/hw/mthca/mthca_mr.c
+++ b/drivers/infiniband/hw/mthca/mthca_mr.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2004 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -50,18 +51,18 @@ struct mthca_mtt {
  * Must be packed because mtt_seg is 64 bits but only aligned to 32 bits.
  */
 struct mthca_mpt_entry {
-        u32 flags;
-        u32 page_size;
-        u32 key;
-        u32 pd;
-        u64 start;
-        u64 length;
-        u32 lkey;
-        u32 window_count;
-        u32 window_count_limit;
-        u64 mtt_seg;
-        u32 mtt_sz;             /* Arbel only */
-        u32 reserved[2];
+        __be32 flags;
+        __be32 page_size;
+        __be32 key;
+        __be32 pd;
+        __be64 start;
+        __be64 length;
+        __be32 lkey;
+        __be32 window_count;
+        __be32 window_count_limit;
+        __be64 mtt_seg;
+        __be32 mtt_sz;          /* Arbel only */
+        u32    reserved[2];
 } __attribute__((packed));
 
 #define MTHCA_MPT_FLAG_SW_OWNS       (0xfUL << 28)
@@ -247,7 +248,7 @@ int mthca_write_mtt(struct mthca_dev *dev, struct mthca_mtt *mtt,
                     int start_index, u64 *buffer_list, int list_len)
 {
         struct mthca_mailbox *mailbox;
-        u64 *mtt_entry;
+        __be64 *mtt_entry;
         int err = 0;
         u8 status;
         int i;
@@ -389,7 +390,7 @@ int mthca_mr_alloc(struct mthca_dev *dev, u32 pd, int buffer_size_shift,
                 for (i = 0; i < sizeof (struct mthca_mpt_entry) / 4; ++i) {
                         if (i % 4 == 0)
                                 printk("[%02x] ", i * 4);
-                        printk(" %08x", be32_to_cpu(((u32 *) mpt_entry)[i]));
+                        printk(" %08x", be32_to_cpu(((__be32 *) mpt_entry)[i]));
                         if ((i + 1) % 4 == 0)
                                 printk("\n");
                 }
@@ -458,7 +459,7 @@ int mthca_mr_alloc_phys(struct mthca_dev *dev, u32 pd,
 static void mthca_free_region(struct mthca_dev *dev, u32 lkey)
 {
         mthca_table_put(dev, dev->mr_table.mpt_table,
-                        arbel_key_to_hw_index(lkey));
+                        key_to_hw_index(dev, lkey));
 
         mthca_free(&dev->mr_table.mpt_alloc, key_to_hw_index(dev, lkey));
 }
@@ -562,7 +563,7 @@ int mthca_fmr_alloc(struct mthca_dev *dev, u32 pd,
                 for (i = 0; i < sizeof (struct mthca_mpt_entry) / 4; ++i) {
                         if (i % 4 == 0)
                                 printk("[%02x] ", i * 4);
-                        printk(" %08x", be32_to_cpu(((u32 *) mpt_entry)[i]));
+                        printk(" %08x", be32_to_cpu(((__be32 *) mpt_entry)[i]));
                         if ((i + 1) % 4 == 0)
                                 printk("\n");
                 }
@@ -669,7 +670,7 @@ int mthca_tavor_map_phys_fmr(struct ib_fmr *ibfmr, u64 *page_list,
         mpt_entry.length = cpu_to_be64(list_len * (1ull << fmr->attr.page_size));
         mpt_entry.start  = cpu_to_be64(iova);
 
-        writel(mpt_entry.lkey, &fmr->mem.tavor.mpt->key);
+        __raw_writel((__force u32) mpt_entry.lkey, &fmr->mem.tavor.mpt->key);
         memcpy_toio(&fmr->mem.tavor.mpt->start, &mpt_entry.start,
                     offsetof(struct mthca_mpt_entry, window_count) -
                     offsetof(struct mthca_mpt_entry, start));
diff --git a/drivers/infiniband/hw/mthca/mthca_pd.c b/drivers/infiniband/hw/mthca/mthca_pd.c
index c2c899844e98..3dbf06a6e6f4 100644
--- a/drivers/infiniband/hw/mthca/mthca_pd.c
+++ b/drivers/infiniband/hw/mthca/mthca_pd.c
@@ -1,6 +1,7 @@
 /*
  * Copyright (c) 2004 Topspin Communications.  All rights reserved.
  * Copyright (c) 2005 Cisco Systems.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
diff --git a/drivers/infiniband/hw/mthca/mthca_profile.c b/drivers/infiniband/hw/mthca/mthca_profile.c
index 4fedc32d5871..0576056b34f4 100644
--- a/drivers/infiniband/hw/mthca/mthca_profile.c
+++ b/drivers/infiniband/hw/mthca/mthca_profile.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2004, 2005 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -101,6 +102,7 @@ u64 mthca_make_profile(struct mthca_dev *dev,
         profile[MTHCA_RES_UARC].size = request->uarc_size;
 
         profile[MTHCA_RES_QP].num    = request->num_qp;
+        profile[MTHCA_RES_SRQ].num   = request->num_srq;
         profile[MTHCA_RES_EQP].num   = request->num_qp;
         profile[MTHCA_RES_RDB].num   = request->num_qp * request->rdb_per_qp;
         profile[MTHCA_RES_CQ].num    = request->num_cq;
diff --git a/drivers/infiniband/hw/mthca/mthca_profile.h b/drivers/infiniband/hw/mthca/mthca_profile.h
index 17aef3357661..94641808f97f 100644
--- a/drivers/infiniband/hw/mthca/mthca_profile.h
+++ b/drivers/infiniband/hw/mthca/mthca_profile.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2004, 2005 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -41,6 +42,7 @@
 struct mthca_profile {
         int num_qp;
         int rdb_per_qp;
+        int num_srq;
         int num_cq;
         int num_mcg;
         int num_mpt;
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index 81919a7b4935..1c1c2e230871 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -2,6 +2,8 @@
  * Copyright (c) 2004, 2005 Topspin Communications.  All rights reserved.
  * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
  * Copyright (c) 2005 Cisco Systems. All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
+ * Copyright (c) 2004 Voltaire, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -34,7 +36,7 @@
  * $Id: mthca_provider.c 1397 2004-12-28 05:09:00Z roland $
  */
 
-#include <ib_smi.h>
+#include <rdma/ib_smi.h>
 #include <linux/mm.h>
 
 #include "mthca_dev.h"
@@ -79,10 +81,10 @@ static int mthca_query_device(struct ib_device *ibdev,
         }
 
         props->device_cap_flags    = mdev->device_cap_flags;
-        props->vendor_id           = be32_to_cpup((u32 *) (out_mad->data + 36)) &
+        props->vendor_id           = be32_to_cpup((__be32 *) (out_mad->data + 36)) &
                 0xffffff;
-        props->vendor_part_id      = be16_to_cpup((u16 *) (out_mad->data + 30));
-        props->hw_ver              = be16_to_cpup((u16 *) (out_mad->data + 32));
+        props->vendor_part_id      = be16_to_cpup((__be16 *) (out_mad->data + 30));
+        props->hw_ver              = be16_to_cpup((__be16 *) (out_mad->data + 32));
         memcpy(&props->sys_image_guid, out_mad->data +  4, 8);
         memcpy(&props->node_guid,      out_mad->data + 12, 8);
 
@@ -118,6 +120,8 @@ static int mthca_query_port(struct ib_device *ibdev,
         if (!in_mad || !out_mad)
                 goto out;
 
+        memset(props, 0, sizeof *props);
+
         memset(in_mad, 0, sizeof *in_mad);
         in_mad->base_version       = 1;
         in_mad->mgmt_class         = IB_MGMT_CLASS_SUBN_LID_ROUTED;
@@ -136,16 +140,17 @@ static int mthca_query_port(struct ib_device *ibdev,
                 goto out;
         }
 
-        props->lid               = be16_to_cpup((u16 *) (out_mad->data + 16));
+        props->lid               = be16_to_cpup((__be16 *) (out_mad->data + 16));
         props->lmc               = out_mad->data[34] & 0x7;
-        props->sm_lid            = be16_to_cpup((u16 *) (out_mad->data + 18));
+        props->sm_lid            = be16_to_cpup((__be16 *) (out_mad->data + 18));
         props->sm_sl             = out_mad->data[36] & 0xf;
         props->state             = out_mad->data[32] & 0xf;
         props->phys_state        = out_mad->data[33] >> 4;
-        props->port_cap_flags    = be32_to_cpup((u32 *) (out_mad->data + 20));
+        props->port_cap_flags    = be32_to_cpup((__be32 *) (out_mad->data + 20));
         props->gid_tbl_len       = to_mdev(ibdev)->limits.gid_table_len;
+        props->max_msg_sz        = 0x80000000;
         props->pkey_tbl_len      = to_mdev(ibdev)->limits.pkey_table_len;
-        props->qkey_viol_cntr    = be16_to_cpup((u16 *) (out_mad->data + 48));
+        props->qkey_viol_cntr    = be16_to_cpup((__be16 *) (out_mad->data + 48));
         props->active_width      = out_mad->data[31] & 0xf;
         props->active_speed      = out_mad->data[35] >> 4;
 
@@ -221,7 +226,7 @@ static int mthca_query_pkey(struct ib_device *ibdev,
                 goto out;
         }
 
-        *pkey = be16_to_cpu(((u16 *) out_mad->data)[index % 32]);
+        *pkey = be16_to_cpu(((__be16 *) out_mad->data)[index % 32]);
 
  out:
         kfree(in_mad);
@@ -420,6 +425,77 @@ static int mthca_ah_destroy(struct ib_ah *ah)
         return 0;
 }
 
+static struct ib_srq *mthca_create_srq(struct ib_pd *pd,
+                                       struct ib_srq_init_attr *init_attr,
+                                       struct ib_udata *udata)
+{
+        struct mthca_create_srq ucmd;
+        struct mthca_ucontext *context = NULL;
+        struct mthca_srq *srq;
+        int err;
+
+        srq = kmalloc(sizeof *srq, GFP_KERNEL);
+        if (!srq)
+                return ERR_PTR(-ENOMEM);
+
+        if (pd->uobject) {
+                context = to_mucontext(pd->uobject->context);
+
+                if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd))
+                        return ERR_PTR(-EFAULT);
+
+                err = mthca_map_user_db(to_mdev(pd->device), &context->uar,
+                                        context->db_tab, ucmd.db_index,
+                                        ucmd.db_page);
+
+                if (err)
+                        goto err_free;
+
+                srq->mr.ibmr.lkey = ucmd.lkey;
+                srq->db_index     = ucmd.db_index;
+        }
+
+        err = mthca_alloc_srq(to_mdev(pd->device), to_mpd(pd),
+                              &init_attr->attr, srq);
+
+        if (err && pd->uobject)
+                mthca_unmap_user_db(to_mdev(pd->device), &context->uar,
+                                    context->db_tab, ucmd.db_index);
+
+        if (err)
+                goto err_free;
+
+        if (context && ib_copy_to_udata(udata, &srq->srqn, sizeof (__u32))) {
+                mthca_free_srq(to_mdev(pd->device), srq);
+                err = -EFAULT;
+                goto err_free;
+        }
+
+        return &srq->ibsrq;
+
+err_free:
+        kfree(srq);
+
+        return ERR_PTR(err);
+}
+
+static int mthca_destroy_srq(struct ib_srq *srq)
+{
+        struct mthca_ucontext *context;
+
+        if (srq->uobject) {
+                context = to_mucontext(srq->uobject->context);
+
+                mthca_unmap_user_db(to_mdev(srq->device), &context->uar,
+                                    context->db_tab, to_msrq(srq)->db_index);
+        }
+
+        mthca_free_srq(to_mdev(srq->device), to_msrq(srq));
+        kfree(srq);
+
+        return 0;
+}
+
 static struct ib_qp *mthca_create_qp(struct ib_pd *pd,
                                      struct ib_qp_init_attr *init_attr,
                                      struct ib_udata *udata)
@@ -956,14 +1032,22 @@ static ssize_t show_hca(struct class_device *cdev, char *buf)
         }
 }
 
+static ssize_t show_board(struct class_device *cdev, char *buf)
+{
+        struct mthca_dev *dev = container_of(cdev, struct mthca_dev, ib_dev.class_dev);
+        return sprintf(buf, "%.*s\n", MTHCA_BOARD_ID_LEN, dev->board_id);
+}
+
 static CLASS_DEVICE_ATTR(hw_rev,   S_IRUGO, show_rev,    NULL);
 static CLASS_DEVICE_ATTR(fw_ver,   S_IRUGO, show_fw_ver, NULL);
 static CLASS_DEVICE_ATTR(hca_type, S_IRUGO, show_hca,    NULL);
+static CLASS_DEVICE_ATTR(board_id, S_IRUGO, show_board,  NULL);
 
 static struct class_device_attribute *mthca_class_attributes[] = {
         &class_device_attr_hw_rev,
         &class_device_attr_fw_ver,
-        &class_device_attr_hca_type
+        &class_device_attr_hca_type,
+        &class_device_attr_board_id
 };
 
 int mthca_register_device(struct mthca_dev *dev)
@@ -990,6 +1074,17 @@ int mthca_register_device(struct mthca_dev *dev)
         dev->ib_dev.dealloc_pd           = mthca_dealloc_pd;
         dev->ib_dev.create_ah            = mthca_ah_create;
         dev->ib_dev.destroy_ah           = mthca_ah_destroy;
+
+        if (dev->mthca_flags & MTHCA_FLAG_SRQ) {
+                dev->ib_dev.create_srq           = mthca_create_srq;
+                dev->ib_dev.destroy_srq          = mthca_destroy_srq;
+
+                if (mthca_is_memfree(dev))
+                        dev->ib_dev.post_srq_recv = mthca_arbel_post_srq_recv;
+                else
+                        dev->ib_dev.post_srq_recv = mthca_tavor_post_srq_recv;
+        }
+
         dev->ib_dev.create_qp            = mthca_create_qp;
         dev->ib_dev.modify_qp            = mthca_modify_qp;
         dev->ib_dev.destroy_qp           = mthca_destroy_qp;
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.h b/drivers/infiniband/hw/mthca/mthca_provider.h
index 1d032791cc8b..bcd4b01a339c 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.h
+++ b/drivers/infiniband/hw/mthca/mthca_provider.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (c) 2004 Topspin Communications.  All rights reserved.
  * Copyright (c) 2005 Cisco Systems.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -36,8 +37,8 @@
 #ifndef MTHCA_PROVIDER_H
 #define MTHCA_PROVIDER_H
 
-#include <ib_verbs.h>
-#include <ib_pack.h>
+#include <rdma/ib_verbs.h>
+#include <rdma/ib_pack.h>
 
 #define MTHCA_MPT_FLAG_ATOMIC        (1 << 14)
 #define MTHCA_MPT_FLAG_REMOTE_WRITE  (1 << 13)
@@ -50,6 +51,11 @@ struct mthca_buf_list {
         DECLARE_PCI_UNMAP_ADDR(mapping)
 };
 
+union mthca_buf {
+        struct mthca_buf_list direct;
+        struct mthca_buf_list *page_list;
+};
+
 struct mthca_uar {
         unsigned long pfn;
         int           index;
@@ -181,19 +187,39 @@ struct mthca_cq {
 
         /* Next fields are Arbel only */
         int                    set_ci_db_index;
-        u32                   *set_ci_db;
+        __be32                *set_ci_db;
         int                    arm_db_index;
-        u32                   *arm_db;
+        __be32                *arm_db;
         int                    arm_sn;
 
-        union {
-                struct mthca_buf_list direct;
-                struct mthca_buf_list *page_list;
-        }                      queue;
+        union mthca_buf        queue;
         struct mthca_mr        mr;
         wait_queue_head_t      wait;
 };
 
+struct mthca_srq {
+        struct ib_srq           ibsrq;
+        spinlock_t              lock;
+        atomic_t                refcount;
+        int                     srqn;
+        int                     max;
+        int                     max_gs;
+        int                     wqe_shift;
+        int                     first_free;
+        int                     last_free;
+        u16                     counter;  /* Arbel only */
+        int                     db_index; /* Arbel only */
+        __be32                 *db;       /* Arbel only */
+        void                   *last;
+
+        int                     is_direct;
+        u64                    *wrid;
+        union mthca_buf         queue;
+        struct mthca_mr         mr;
+
+        wait_queue_head_t       wait;
+};
+
 struct mthca_wq {
         spinlock_t lock;
         int        max;
@@ -206,7 +232,7 @@ struct mthca_wq {
         int        wqe_shift;
 
         int        db_index;    /* Arbel only */
-        u32       *db;
+        __be32    *db;
 };
 
 struct mthca_qp {
@@ -227,10 +253,7 @@ struct mthca_qp {
         int                    send_wqe_offset;
 
         u64                   *wrid;
-        union {
-                struct mthca_buf_list direct;
-                struct mthca_buf_list *page_list;
-        }                      queue;
+        union mthca_buf        queue;
 
         wait_queue_head_t      wait;
 };
@@ -277,6 +300,11 @@ static inline struct mthca_cq *to_mcq(struct ib_cq *ibcq)
         return container_of(ibcq, struct mthca_cq, ibcq);
 }
 
+static inline struct mthca_srq *to_msrq(struct ib_srq *ibsrq)
+{
+        return container_of(ibsrq, struct mthca_srq, ibsrq);
+}
+
 static inline struct mthca_qp *to_mqp(struct ib_qp *ibqp)
 {
         return container_of(ibqp, struct mthca_qp, ibqp);
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index f7126b14d5ae..0164b84d4ec6 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (c) 2004 Topspin Communications.  All rights reserved.
  * Copyright (c) 2005 Cisco Systems. All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
+ * Copyright (c) 2004 Voltaire, Inc. All rights reserved. 
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -35,13 +37,14 @@
 
 #include <linux/init.h>
 
-#include <ib_verbs.h>
-#include <ib_cache.h>
-#include <ib_pack.h>
+#include <rdma/ib_verbs.h>
+#include <rdma/ib_cache.h>
+#include <rdma/ib_pack.h>
 
 #include "mthca_dev.h"
 #include "mthca_cmd.h"
 #include "mthca_memfree.h"
+#include "mthca_wqe.h"
 
 enum {
         MTHCA_MAX_DIRECT_QP_SIZE = 4 * PAGE_SIZE,
@@ -95,62 +98,62 @@ enum {
 };
 
 struct mthca_qp_path {
-        u32 port_pkey;
-        u8  rnr_retry;
-        u8  g_mylmc;
-        u16 rlid;
-        u8  ackto;
-        u8  mgid_index;
-        u8  static_rate;
-        u8  hop_limit;
-        u32 sl_tclass_flowlabel;
-        u8  rgid[16];
+        __be32 port_pkey;
+        u8     rnr_retry;
+        u8     g_mylmc;
+        __be16 rlid;
+        u8     ackto;
+        u8     mgid_index;
+        u8     static_rate;
+        u8     hop_limit;
+        __be32 sl_tclass_flowlabel;
+        u8     rgid[16];
 } __attribute__((packed));
 
 struct mthca_qp_context {
-        u32 flags;
-        u32 tavor_sched_queue;  /* Reserved on Arbel */
-        u8  mtu_msgmax;
-        u8  rq_size_stride;     /* Reserved on Tavor */
-        u8  sq_size_stride;     /* Reserved on Tavor */
-        u8  rlkey_arbel_sched_queue;    /* Reserved on Tavor */
-        u32 usr_page;
-        u32 local_qpn;
-        u32 remote_qpn;
-        u32 reserved1[2];
+        __be32 flags;
+        __be32 tavor_sched_queue; /* Reserved on Arbel */
+        u8     mtu_msgmax;
+        u8     rq_size_stride;  /* Reserved on Tavor */
+        u8     sq_size_stride;  /* Reserved on Tavor */
+        u8     rlkey_arbel_sched_queue; /* Reserved on Tavor */
+        __be32 usr_page;
+        __be32 local_qpn;
+        __be32 remote_qpn;
+        u32    reserved1[2];
         struct mthca_qp_path pri_path;
         struct mthca_qp_path alt_path;
-        u32 rdd;
-        u32 pd;
-        u32 wqe_base;
-        u32 wqe_lkey;
-        u32 params1;
-        u32 reserved2;
-        u32 next_send_psn;
-        u32 cqn_snd;
-        u32 snd_wqe_base_l;     /* Next send WQE on Tavor */
-        u32 snd_db_index;       /* (debugging only entries) */
-        u32 last_acked_psn;
-        u32 ssn;
-        u32 params2;
-        u32 rnr_nextrecvpsn;
-        u32 ra_buff_indx;
-        u32 cqn_rcv;
-        u32 rcv_wqe_base_l;     /* Next recv WQE on Tavor */
-        u32 rcv_db_index;       /* (debugging only entries) */
-        u32 qkey;
-        u32 srqn;
-        u32 rmsn;
-        u16 rq_wqe_counter;     /* reserved on Tavor */
-        u16 sq_wqe_counter;     /* reserved on Tavor */
-        u32 reserved3[18];
+        __be32 rdd;
+        __be32 pd;
+        __be32 wqe_base;
+        __be32 wqe_lkey;
+        __be32 params1;
+        __be32 reserved2;
+        __be32 next_send_psn;
+        __be32 cqn_snd;
+        __be32 snd_wqe_base_l;  /* Next send WQE on Tavor */
+        __be32 snd_db_index;    /* (debugging only entries) */
+        __be32 last_acked_psn;
+        __be32 ssn;
+        __be32 params2;
+        __be32 rnr_nextrecvpsn;
+        __be32 ra_buff_indx;
+        __be32 cqn_rcv;
+        __be32 rcv_wqe_base_l;  /* Next recv WQE on Tavor */
+        __be32 rcv_db_index;    /* (debugging only entries) */
+        __be32 qkey;
+        __be32 srqn;
+        __be32 rmsn;
+        __be16 rq_wqe_counter;  /* reserved on Tavor */
+        __be16 sq_wqe_counter;  /* reserved on Tavor */
+        u32    reserved3[18];
 } __attribute__((packed));
 
 struct mthca_qp_param {
-        u32 opt_param_mask;
-        u32 reserved1;
+        __be32 opt_param_mask;
+        u32    reserved1;
         struct mthca_qp_context context;
-        u32 reserved2[62];
+        u32    reserved2[62];
 } __attribute__((packed));
 
 enum {
@@ -173,80 +176,6 @@ enum {
         MTHCA_QP_OPTPAR_SCHED_QUEUE       = 1 << 16
 };
 
-enum {
-        MTHCA_NEXT_DBD       = 1 << 7,
-        MTHCA_NEXT_FENCE     = 1 << 6,
-        MTHCA_NEXT_CQ_UPDATE = 1 << 3,
-        MTHCA_NEXT_EVENT_GEN = 1 << 2,
-        MTHCA_NEXT_SOLICIT   = 1 << 1,
-
-        MTHCA_MLX_VL15       = 1 << 17,
-        MTHCA_MLX_SLR        = 1 << 16
-};
-
-enum {
-        MTHCA_INVAL_LKEY = 0x100
-};
-
-struct mthca_next_seg {
-        u32 nda_op;             /* [31:6] next WQE [4:0] next opcode */
-        u32 ee_nds;             /* [31:8] next EE  [7] DBD [6] F [5:0] next WQE size */
-        u32 flags;              /* [3] CQ [2] Event [1] Solicit */
-        u32 imm;                /* immediate data */
-};
-
-struct mthca_tavor_ud_seg {
-        u32 reserved1;
-        u32 lkey;
-        u64 av_addr;
-        u32 reserved2[4];
-        u32 dqpn;
-        u32 qkey;
-        u32 reserved3[2];
-};
-
-struct mthca_arbel_ud_seg {
-        u32 av[8];
-        u32 dqpn;
-        u32 qkey;
-        u32 reserved[2];
-};
-
-struct mthca_bind_seg {
-        u32 flags;              /* [31] Atomic [30] rem write [29] rem read */
-        u32 reserved;
-        u32 new_rkey;
-        u32 lkey;
-        u64 addr;
-        u64 length;
-};
-
-struct mthca_raddr_seg {
-        u64 raddr;
-        u32 rkey;
-        u32 reserved;
-};
-
-struct mthca_atomic_seg {
-        u64 swap_add;
-        u64 compare;
-};
-
-struct mthca_data_seg {
-        u32 byte_count;
-        u32 lkey;
-        u64 addr;
-};
-
-struct mthca_mlx_seg {
-        u32 nda_op;
-        u32 nds;
-        u32 flags;              /* [17] VL15 [16] SLR [14:12] static rate
-                                   [11:8] SL [3] C [2] E */
-        u16 rlid;
-        u16 vcrc;
-};
-
 static const u8 mthca_opcode[] = {
         [IB_WR_SEND]                 = MTHCA_OPCODE_SEND,
         [IB_WR_SEND_WITH_IMM]        = MTHCA_OPCODE_SEND_IMM,
@@ -573,12 +502,11 @@ static void init_port(struct mthca_dev *dev, int port)
 
         memset(&param, 0, sizeof param);
 
-        param.enable_1x = 1;
-        param.enable_4x = 1;
-        param.vl_cap    = dev->limits.vl_cap;
-        param.mtu_cap   = dev->limits.mtu_cap;
-        param.gid_cap   = dev->limits.gid_table_len;
-        param.pkey_cap  = dev->limits.pkey_table_len;
+        param.port_width = dev->limits.port_width_cap;
+        param.vl_cap     = dev->limits.vl_cap;
+        param.mtu_cap    = dev->limits.mtu_cap;
+        param.gid_cap    = dev->limits.gid_table_len;
+        param.pkey_cap   = dev->limits.pkey_table_len;
 
         err = mthca_INIT_IB(dev, &param, port, &status);
         if (err)
@@ -684,10 +612,13 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask)
                 qp_context->mtu_msgmax = (attr->path_mtu << 5) | 31;
 
         if (mthca_is_memfree(dev)) {
-                qp_context->rq_size_stride =
-                        ((ffs(qp->rq.max) - 1) << 3) | (qp->rq.wqe_shift - 4);
-                qp_context->sq_size_stride =
-                        ((ffs(qp->sq.max) - 1) << 3) | (qp->sq.wqe_shift - 4);
+                if (qp->rq.max)
+                        qp_context->rq_size_stride = long_log2(qp->rq.max) << 3;
+                qp_context->rq_size_stride |= qp->rq.wqe_shift - 4;
+
+                if (qp->sq.max)
+                        qp_context->sq_size_stride = long_log2(qp->sq.max) << 3;
+                qp_context->sq_size_stride |= qp->sq.wqe_shift - 4;
         }
 
         /* leave arbel_sched_queue as 0 */
@@ -856,6 +787,9 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask)
 
         qp_context->params2 |= cpu_to_be32(MTHCA_QP_BIT_RSC);
 
+        if (ibqp->srq)
+                qp_context->params2 |= cpu_to_be32(MTHCA_QP_BIT_RIC);
+
         if (attr_mask & IB_QP_MIN_RNR_TIMER) {
                 qp_context->rnr_nextrecvpsn |= cpu_to_be32(attr->min_rnr_timer << 24);
                 qp_param->opt_param_mask |= cpu_to_be32(MTHCA_QP_OPTPAR_RNR_TIMEOUT);
@@ -878,6 +812,10 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask)
                 qp_param->opt_param_mask |= cpu_to_be32(MTHCA_QP_OPTPAR_Q_KEY);
         }
 
+        if (ibqp->srq)
+                qp_context->srqn = cpu_to_be32(1 << 24 |
+                                               to_msrq(ibqp->srq)->srqn);
+
         err = mthca_MODIFY_QP(dev, state_table[cur_state][new_state].trans,
                               qp->qpn, 0, mailbox, 0, &status);
         if (status) {
@@ -925,10 +863,6 @@ static int mthca_alloc_wqe_buf(struct mthca_dev *dev,
                                struct mthca_qp *qp)
 {
         int size;
-        int i;
-        int npages, shift;
-        dma_addr_t t;
-        u64 *dma_list = NULL;
         int err = -ENOMEM;
 
         size = sizeof (struct mthca_next_seg) +
@@ -978,116 +912,24 @@ static int mthca_alloc_wqe_buf(struct mthca_dev *dev,
         if (!qp->wrid)
                 goto err_out;
 
-        if (size <= MTHCA_MAX_DIRECT_QP_SIZE) {
-                qp->is_direct = 1;
-                npages = 1;
-                shift = get_order(size) + PAGE_SHIFT;
-
-                if (0)
-                        mthca_dbg(dev, "Creating direct QP of size %d (shift %d)\n",
-                                  size, shift);
-
-                qp->queue.direct.buf = dma_alloc_coherent(&dev->pdev->dev, size,
-                                                          &t, GFP_KERNEL);
-                if (!qp->queue.direct.buf)
-                        goto err_out;
-
-                pci_unmap_addr_set(&qp->queue.direct, mapping, t);
-
-                memset(qp->queue.direct.buf, 0, size);
-
-                while (t & ((1 << shift) - 1)) {
-                        --shift;
-                        npages *= 2;
-                }
-
-                dma_list = kmalloc(npages * sizeof *dma_list, GFP_KERNEL);
-                if (!dma_list)
-                        goto err_out_free;
-
-                for (i = 0; i < npages; ++i)
-                        dma_list[i] = t + i * (1 << shift);
-        } else {
-                qp->is_direct = 0;
-                npages = size / PAGE_SIZE;
-                shift = PAGE_SHIFT;
-
-                if (0)
-                        mthca_dbg(dev, "Creating indirect QP with %d pages\n", npages);
-
-                dma_list = kmalloc(npages * sizeof *dma_list, GFP_KERNEL);
-                if (!dma_list)
-                        goto err_out;
-
-                qp->queue.page_list = kmalloc(npages *
-                                              sizeof *qp->queue.page_list,
-                                              GFP_KERNEL);
-                if (!qp->queue.page_list)
-                        goto err_out;
-
-                for (i = 0; i < npages; ++i) {
-                        qp->queue.page_list[i].buf =
-                                dma_alloc_coherent(&dev->pdev->dev, PAGE_SIZE,
-                                                   &t, GFP_KERNEL);
-                        if (!qp->queue.page_list[i].buf)
-                                goto err_out_free;
-
-                        memset(qp->queue.page_list[i].buf, 0, PAGE_SIZE);
-
-                        pci_unmap_addr_set(&qp->queue.page_list[i], mapping, t);
-                        dma_list[i] = t;
-                }
-        }
-
-        err = mthca_mr_alloc_phys(dev, pd->pd_num, dma_list, shift,
-                                  npages, 0, size,
-                                  MTHCA_MPT_FLAG_LOCAL_READ,
-                                  &qp->mr);
+        err = mthca_buf_alloc(dev, size, MTHCA_MAX_DIRECT_QP_SIZE,
+                              &qp->queue, &qp->is_direct, pd, 0, &qp->mr);
         if (err)
-                goto err_out_free;
+                goto err_out;
 
-        kfree(dma_list);
         return 0;
 
- err_out_free:
-        if (qp->is_direct) {
-                dma_free_coherent(&dev->pdev->dev, size, qp->queue.direct.buf,
-                                  pci_unmap_addr(&qp->queue.direct, mapping));
-        } else
-                for (i = 0; i < npages; ++i) {
-                        if (qp->queue.page_list[i].buf)
-                                dma_free_coherent(&dev->pdev->dev, PAGE_SIZE,
-                                                  qp->queue.page_list[i].buf,
-                                                  pci_unmap_addr(&qp->queue.page_list[i],
-                                                                 mapping));
-
-                }
-
- err_out:
+err_out:
         kfree(qp->wrid);
-        kfree(dma_list);
         return err;
 }
 
 static void mthca_free_wqe_buf(struct mthca_dev *dev,
                                struct mthca_qp *qp)
 {
-        int i;
-        int size = PAGE_ALIGN(qp->send_wqe_offset +
-                              (qp->sq.max << qp->sq.wqe_shift));
-
-        if (qp->is_direct) {
-                dma_free_coherent(&dev->pdev->dev, size, qp->queue.direct.buf,
-                                  pci_unmap_addr(&qp->queue.direct, mapping));
-        } else {
-                for (i = 0; i < size / PAGE_SIZE; ++i) {
-                        dma_free_coherent(&dev->pdev->dev, PAGE_SIZE,
-                                          qp->queue.page_list[i].buf,
-                                          pci_unmap_addr(&qp->queue.page_list[i],
-                                                         mapping));
-                }
-        }
-
+        mthca_buf_free(dev, PAGE_ALIGN(qp->send_wqe_offset +
+                                       (qp->sq.max << qp->sq.wqe_shift)),
+                       &qp->queue, qp->is_direct, &qp->mr);
         kfree(qp->wrid);
 }
 
@@ -1428,11 +1270,12 @@ void mthca_free_qp(struct mthca_dev *dev,
          * unref the mem-free tables and free the QPN in our table.
          */
         if (!qp->ibqp.uobject) {
-                mthca_cq_clean(dev, to_mcq(qp->ibqp.send_cq)->cqn, qp->qpn);
+                mthca_cq_clean(dev, to_mcq(qp->ibqp.send_cq)->cqn, qp->qpn,
+                               qp->ibqp.srq ? to_msrq(qp->ibqp.srq) : NULL);
                 if (qp->ibqp.send_cq != qp->ibqp.recv_cq)
-                        mthca_cq_clean(dev, to_mcq(qp->ibqp.recv_cq)->cqn, qp->qpn);
+                        mthca_cq_clean(dev, to_mcq(qp->ibqp.recv_cq)->cqn, qp->qpn,
+                                       qp->ibqp.srq ? to_msrq(qp->ibqp.srq) : NULL);
 
-                mthca_free_mr(dev, &qp->mr);
                 mthca_free_memfree(dev, qp);
                 mthca_free_wqe_buf(dev, qp);
         }
@@ -1457,6 +1300,7 @@ static int build_mlx_header(struct mthca_dev *dev, struct mthca_sqp *sqp,
 {
         int header_size;
         int err;
+        u16 pkey;
 
         ib_ud_header_init(256, /* assume a MAD */
                           sqp->ud_header.grh_present,
@@ -1467,8 +1311,8 @@ static int build_mlx_header(struct mthca_dev *dev, struct mthca_sqp *sqp,
                 return err;
         mlx->flags &= ~cpu_to_be32(MTHCA_NEXT_SOLICIT | 1);
         mlx->flags |= cpu_to_be32((!sqp->qp.ibqp.qp_num ? MTHCA_MLX_VL15 : 0) |
-                                  (sqp->ud_header.lrh.destination_lid == 0xffff ?
-                                   MTHCA_MLX_SLR : 0) |
+                                  (sqp->ud_header.lrh.destination_lid ==
+                                   IB_LID_PERMISSIVE ? MTHCA_MLX_SLR : 0) |
                                   (sqp->ud_header.lrh.service_level << 8));
         mlx->rlid = sqp->ud_header.lrh.destination_lid;
         mlx->vcrc = 0;
@@ -1488,18 +1332,16 @@ static int build_mlx_header(struct mthca_dev *dev, struct mthca_sqp *sqp,
         }
 
         sqp->ud_header.lrh.virtual_lane    = !sqp->qp.ibqp.qp_num ? 15 : 0;
-        if (sqp->ud_header.lrh.destination_lid == 0xffff)
-                sqp->ud_header.lrh.source_lid = 0xffff;
+        if (sqp->ud_header.lrh.destination_lid == IB_LID_PERMISSIVE)
+                sqp->ud_header.lrh.source_lid = IB_LID_PERMISSIVE;
         sqp->ud_header.bth.solicited_event = !!(wr->send_flags & IB_SEND_SOLICITED);
         if (!sqp->qp.ibqp.qp_num)
                 ib_get_cached_pkey(&dev->ib_dev, sqp->port,
-                                   sqp->pkey_index,
-                                   &sqp->ud_header.bth.pkey);
+                                   sqp->pkey_index, &pkey);
         else
                 ib_get_cached_pkey(&dev->ib_dev, sqp->port,
-                                   wr->wr.ud.pkey_index,
-                                   &sqp->ud_header.bth.pkey);
-        cpu_to_be16s(&sqp->ud_header.bth.pkey);
+                                   wr->wr.ud.pkey_index, &pkey);
+        sqp->ud_header.bth.pkey = cpu_to_be16(pkey);
         sqp->ud_header.bth.destination_qpn = cpu_to_be32(wr->wr.ud.remote_qpn);
         sqp->ud_header.bth.psn = cpu_to_be32((sqp->send_psn++) & ((1 << 24) - 1));
         sqp->ud_header.deth.qkey = cpu_to_be32(wr->wr.ud.remote_qkey & 0x80000000 ?
@@ -1742,7 +1584,7 @@ int mthca_tavor_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 
 out:
         if (likely(nreq)) {
-                u32 doorbell[2];
+                __be32 doorbell[2];
 
                 doorbell[0] = cpu_to_be32(((qp->sq.next_ind << qp->sq.wqe_shift) +
                                            qp->send_wqe_offset) | f0 | op0);
@@ -1843,7 +1685,7 @@ int mthca_tavor_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
 
 out:
         if (likely(nreq)) {
-                u32 doorbell[2];
+                __be32 doorbell[2];
 
                 doorbell[0] = cpu_to_be32((qp->rq.next_ind << qp->rq.wqe_shift) | size0);
                 doorbell[1] = cpu_to_be32((qp->qpn << 8) | nreq);
@@ -2064,7 +1906,7 @@ int mthca_arbel_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 
 out:
         if (likely(nreq)) {
-                u32 doorbell[2];
+                __be32 doorbell[2];
 
                 doorbell[0] = cpu_to_be32((nreq << 24)                  |
                                           ((qp->sq.head & 0xffff) << 8) |
@@ -2174,19 +2016,25 @@ out:
 }
 
 int mthca_free_err_wqe(struct mthca_dev *dev, struct mthca_qp *qp, int is_send,
-                       int index, int *dbd, u32 *new_wqe)
+                       int index, int *dbd, __be32 *new_wqe)
 {
         struct mthca_next_seg *next;
 
+        /*
+         * For SRQs, all WQEs generate a CQE, so we're always at the
+         * end of the doorbell chain.
+         */
+        if (qp->ibqp.srq) {
+                *new_wqe = 0;
+                return 0;
+        }
+
         if (is_send)
                 next = get_send_wqe(qp, index);
         else
                 next = get_recv_wqe(qp, index);
 
-        if (mthca_is_memfree(dev))
-                *dbd = 1;
-        else
-                *dbd = !!(next->ee_nds & cpu_to_be32(MTHCA_NEXT_DBD));
+        *dbd = !!(next->ee_nds & cpu_to_be32(MTHCA_NEXT_DBD));
         if (next->ee_nds & cpu_to_be32(0x3f))
                 *new_wqe = (next->nda_op & cpu_to_be32(~0x3f)) |
                         (next->ee_nds & cpu_to_be32(0x3f));
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c
new file mode 100644
index 000000000000..75cd2d84ef12
--- /dev/null
+++ b/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -0,0 +1,591 @@
+/*
+ * Copyright (c) 2005 Cisco Systems. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ * $Id: mthca_srq.c 3047 2005-08-10 03:59:35Z roland $
+ */
+
+#include "mthca_dev.h"
+#include "mthca_cmd.h"
+#include "mthca_memfree.h"
+#include "mthca_wqe.h"
+
+enum {
+        MTHCA_MAX_DIRECT_SRQ_SIZE = 4 * PAGE_SIZE
+};
+
+struct mthca_tavor_srq_context {
+        __be64 wqe_base_ds;     /* low 6 bits is descriptor size */
+        __be32 state_pd;
+        __be32 lkey;
+        __be32 uar;
+        __be32 wqe_cnt;
+        u32    reserved[2];
+};
+
+struct mthca_arbel_srq_context {
+        __be32 state_logsize_srqn;
+        __be32 lkey;
+        __be32 db_index;
+        __be32 logstride_usrpage;
+        __be64 wqe_base;
+        __be32 eq_pd;
+        __be16 limit_watermark;
+        __be16 wqe_cnt;
+        u16    reserved1;
+        __be16 wqe_counter;
+        u32    reserved2[3];
+};
+
+static void *get_wqe(struct mthca_srq *srq, int n)
+{
+        if (srq->is_direct)
+                return srq->queue.direct.buf + (n << srq->wqe_shift);
+        else
+                return srq->queue.page_list[(n << srq->wqe_shift) >> PAGE_SHIFT].buf +
+                        ((n << srq->wqe_shift) & (PAGE_SIZE - 1));
+}
+
+/*
+ * Return a pointer to the location within a WQE that we're using as a
+ * link when the WQE is in the free list.  We use an offset of 4
+ * because in the Tavor case, posting a WQE may overwrite the first
+ * four bytes of the previous WQE.  The offset avoids corrupting our
+ * free list if the WQE has already completed and been put on the free
+ * list when we post the next WQE.
+ */
+static inline int *wqe_to_link(void *wqe)
+{
+        return (int *) (wqe + 4);
+}
+
+static void mthca_tavor_init_srq_context(struct mthca_dev *dev,
+                                         struct mthca_pd *pd,
+                                         struct mthca_srq *srq,
+                                         struct mthca_tavor_srq_context *context)
+{
+        memset(context, 0, sizeof *context);
+
+        context->wqe_base_ds = cpu_to_be64(1 << (srq->wqe_shift - 4));
+        context->state_pd    = cpu_to_be32(pd->pd_num);
+        context->lkey        = cpu_to_be32(srq->mr.ibmr.lkey);
+
+        if (pd->ibpd.uobject)
+                context->uar =
+                        cpu_to_be32(to_mucontext(pd->ibpd.uobject->context)->uar.index);
+        else
+                context->uar = cpu_to_be32(dev->driver_uar.index);
+}
+
+static void mthca_arbel_init_srq_context(struct mthca_dev *dev,
+                                         struct mthca_pd *pd,
+                                         struct mthca_srq *srq,
+                                         struct mthca_arbel_srq_context *context)
+{
+        int logsize;
+
+        memset(context, 0, sizeof *context);
+
+        logsize = long_log2(srq->max) + srq->wqe_shift;
+        context->state_logsize_srqn = cpu_to_be32(logsize << 24 | srq->srqn);
+        context->lkey = cpu_to_be32(srq->mr.ibmr.lkey);
+        context->db_index = cpu_to_be32(srq->db_index);
+        context->logstride_usrpage = cpu_to_be32((srq->wqe_shift - 4) << 29);
+        if (pd->ibpd.uobject)
+                context->logstride_usrpage |=
+                        cpu_to_be32(to_mucontext(pd->ibpd.uobject->context)->uar.index);
+        else
+                context->logstride_usrpage |= cpu_to_be32(dev->driver_uar.index);
+        context->eq_pd = cpu_to_be32(MTHCA_EQ_ASYNC << 24 | pd->pd_num);
+}
+
+static void mthca_free_srq_buf(struct mthca_dev *dev, struct mthca_srq *srq)
+{
+        mthca_buf_free(dev, srq->max << srq->wqe_shift, &srq->queue,
+                       srq->is_direct, &srq->mr);
+        kfree(srq->wrid);
+}
+
+static int mthca_alloc_srq_buf(struct mthca_dev *dev, struct mthca_pd *pd,
+                               struct mthca_srq *srq)
+{
+        struct mthca_data_seg *scatter;
+        void *wqe;
+        int err;
+        int i;
+
+        if (pd->ibpd.uobject)
+                return 0;
+
+        srq->wrid = kmalloc(srq->max * sizeof (u64), GFP_KERNEL);
+        if (!srq->wrid)
+                return -ENOMEM;
+
+        err = mthca_buf_alloc(dev, srq->max << srq->wqe_shift,
+                              MTHCA_MAX_DIRECT_SRQ_SIZE,
+                              &srq->queue, &srq->is_direct, pd, 1, &srq->mr);
+        if (err) {
+                kfree(srq->wrid);
+                return err;
+        }
+
+        /*
+         * Now initialize the SRQ buffer so that all of the WQEs are
+         * linked into the list of free WQEs.  In addition, set the
+         * scatter list L_Keys to the sentry value of 0x100.
+         */
+        for (i = 0; i < srq->max; ++i) {
+                wqe = get_wqe(srq, i);
+
+                *wqe_to_link(wqe) = i < srq->max - 1 ? i + 1 : -1;
+
+                for (scatter = wqe + sizeof (struct mthca_next_seg);
+                     (void *) scatter < wqe + (1 << srq->wqe_shift);
+                     ++scatter)
+                        scatter->lkey = cpu_to_be32(MTHCA_INVAL_LKEY);
+        }
+
+        return 0;
+}
+
+int mthca_alloc_srq(struct mthca_dev *dev, struct mthca_pd *pd,
+                    struct ib_srq_attr *attr, struct mthca_srq *srq)
+{
+        struct mthca_mailbox *mailbox;
+        u8 status;
+        int ds;
+        int err;
+
+        /* Sanity check SRQ size before proceeding */
+        if (attr->max_wr > 16 << 20 || attr->max_sge > 64)
+                return -EINVAL;
+
+        srq->max      = attr->max_wr;
+        srq->max_gs   = attr->max_sge;
+        srq->last     = NULL;
+        srq->counter  = 0;
+
+        if (mthca_is_memfree(dev))
+                srq->max = roundup_pow_of_two(srq->max + 1);
+
+        ds = min(64UL,
+                 roundup_pow_of_two(sizeof (struct mthca_next_seg) +
+                                    srq->max_gs * sizeof (struct mthca_data_seg)));
+        srq->wqe_shift = long_log2(ds);
+
+        srq->srqn = mthca_alloc(&dev->srq_table.alloc);
+        if (srq->srqn == -1)
+                return -ENOMEM;
+
+        if (mthca_is_memfree(dev)) {
+                err = mthca_table_get(dev, dev->srq_table.table, srq->srqn);
+                if (err)
+                        goto err_out;
+
+                if (!pd->ibpd.uobject) {
+                        srq->db_index = mthca_alloc_db(dev, MTHCA_DB_TYPE_SRQ,
+                                                       srq->srqn, &srq->db);
+                        if (srq->db_index < 0) {
+                                err = -ENOMEM;
+                                goto err_out_icm;
+                        }
+                }
+        }
+
+        mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL);
+        if (IS_ERR(mailbox)) {
+                err = PTR_ERR(mailbox);
+                goto err_out_db;
+        }
+
+        err = mthca_alloc_srq_buf(dev, pd, srq);
+        if (err)
+                goto err_out_mailbox;
+
+        spin_lock_init(&srq->lock);
+        atomic_set(&srq->refcount, 1);
+        init_waitqueue_head(&srq->wait);
+
+        if (mthca_is_memfree(dev))
+                mthca_arbel_init_srq_context(dev, pd, srq, mailbox->buf);
+        else
+                mthca_tavor_init_srq_context(dev, pd, srq, mailbox->buf);
+
+        err = mthca_SW2HW_SRQ(dev, mailbox, srq->srqn, &status);
+
+        if (err) {
+                mthca_warn(dev, "SW2HW_SRQ failed (%d)\n", err);
+                goto err_out_free_buf;
+        }
+        if (status) {
+                mthca_warn(dev, "SW2HW_SRQ returned status 0x%02x\n",
+                           status);
+                err = -EINVAL;
+                goto err_out_free_buf;
+        }
+
+        spin_lock_irq(&dev->srq_table.lock);
+        if (mthca_array_set(&dev->srq_table.srq,
+                            srq->srqn & (dev->limits.num_srqs - 1),
+                            srq)) {
+                spin_unlock_irq(&dev->srq_table.lock);
+                goto err_out_free_srq;
+        }
+        spin_unlock_irq(&dev->srq_table.lock);
+
+        mthca_free_mailbox(dev, mailbox);
+
+        srq->first_free = 0;
+        srq->last_free  = srq->max - 1;
+
+        return 0;
+
+err_out_free_srq:
+        err = mthca_HW2SW_SRQ(dev, mailbox, srq->srqn, &status);
+        if (err)
+                mthca_warn(dev, "HW2SW_SRQ failed (%d)\n", err);
+        else if (status)
+                mthca_warn(dev, "HW2SW_SRQ returned status 0x%02x\n", status);
+
+err_out_free_buf:
+        if (!pd->ibpd.uobject)
+                mthca_free_srq_buf(dev, srq);
+
+err_out_mailbox:
+        mthca_free_mailbox(dev, mailbox);
+
+err_out_db:
+        if (!pd->ibpd.uobject && mthca_is_memfree(dev))
+                mthca_free_db(dev, MTHCA_DB_TYPE_SRQ, srq->db_index);
+
+err_out_icm:
+        mthca_table_put(dev, dev->srq_table.table, srq->srqn);
+
+err_out:
+        mthca_free(&dev->srq_table.alloc, srq->srqn);
+
+        return err;
+}
+
+void mthca_free_srq(struct mthca_dev *dev, struct mthca_srq *srq)
+{
+        struct mthca_mailbox *mailbox;
+        int err;
+        u8 status;
+
+        mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL);
+        if (IS_ERR(mailbox)) {
+                mthca_warn(dev, "No memory for mailbox to free SRQ.\n");
+                return;
+        }
+
+        err = mthca_HW2SW_SRQ(dev, mailbox, srq->srqn, &status);
+        if (err)
+                mthca_warn(dev, "HW2SW_SRQ failed (%d)\n", err);
+        else if (status)
+                mthca_warn(dev, "HW2SW_SRQ returned status 0x%02x\n", status);
+
+        spin_lock_irq(&dev->srq_table.lock);
+        mthca_array_clear(&dev->srq_table.srq,
+                          srq->srqn & (dev->limits.num_srqs - 1));
+        spin_unlock_irq(&dev->srq_table.lock);
+
+        atomic_dec(&srq->refcount);
+        wait_event(srq->wait, !atomic_read(&srq->refcount));
+
+        if (!srq->ibsrq.uobject) {
+                mthca_free_srq_buf(dev, srq);
+                if (mthca_is_memfree(dev))
+                        mthca_free_db(dev, MTHCA_DB_TYPE_SRQ, srq->db_index);
+        }
+
+        mthca_table_put(dev, dev->srq_table.table, srq->srqn);
+        mthca_free(&dev->srq_table.alloc, srq->srqn);
+        mthca_free_mailbox(dev, mailbox);
+}
+
+void mthca_srq_event(struct mthca_dev *dev, u32 srqn,
+                     enum ib_event_type event_type)
+{
+        struct mthca_srq *srq;
+        struct ib_event event;
+
+        spin_lock(&dev->srq_table.lock);
+        srq = mthca_array_get(&dev->srq_table.srq, srqn & (dev->limits.num_srqs - 1));
+        if (srq)
+                atomic_inc(&srq->refcount);
+        spin_unlock(&dev->srq_table.lock);
+
+        if (!srq) {
+                mthca_warn(dev, "Async event for bogus SRQ %08x\n", srqn);
+                return;
+        }
+
+        if (!srq->ibsrq.event_handler)
+                goto out;
+
+        event.device      = &dev->ib_dev;
+        event.event       = event_type;
+        event.element.srq  = &srq->ibsrq;
+        srq->ibsrq.event_handler(&event, srq->ibsrq.srq_context);
+
+out:
+        if (atomic_dec_and_test(&srq->refcount))
+                wake_up(&srq->wait);
+}
+
+/*
+ * This function must be called with IRQs disabled.
+ */
+void mthca_free_srq_wqe(struct mthca_srq *srq, u32 wqe_addr)
+{
+        int ind;
+
+        ind = wqe_addr >> srq->wqe_shift;
+
+        spin_lock(&srq->lock);
+
+        if (likely(srq->first_free >= 0))
+                *wqe_to_link(get_wqe(srq, srq->last_free)) = ind;
+        else
+                srq->first_free = ind;
+
+        *wqe_to_link(get_wqe(srq, ind)) = -1;
+        srq->last_free = ind;
+
+        spin_unlock(&srq->lock);
+}
+
+int mthca_tavor_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
+                              struct ib_recv_wr **bad_wr)
+{
+        struct mthca_dev *dev = to_mdev(ibsrq->device);
+        struct mthca_srq *srq = to_msrq(ibsrq);
+        unsigned long flags;
+        int err = 0;
+        int first_ind;
+        int ind;
+        int next_ind;
+        int nreq;
+        int i;
+        void *wqe;
+        void *prev_wqe;
+
+        spin_lock_irqsave(&srq->lock, flags);
+
+        first_ind = srq->first_free;
+
+        for (nreq = 0; wr; ++nreq, wr = wr->next) {
+                ind = srq->first_free;
+
+                if (ind < 0) {
+                        mthca_err(dev, "SRQ %06x full\n", srq->srqn);
+                        err = -ENOMEM;
+                        *bad_wr = wr;
+                        return nreq;
+                }
+
+                wqe       = get_wqe(srq, ind);
+                next_ind  = *wqe_to_link(wqe);
+                prev_wqe  = srq->last;
+                srq->last = wqe;
+
+                ((struct mthca_next_seg *) wqe)->nda_op = 0;
+                ((struct mthca_next_seg *) wqe)->ee_nds = 0;
+                /* flags field will always remain 0 */
+
+                wqe += sizeof (struct mthca_next_seg);
+
+                if (unlikely(wr->num_sge > srq->max_gs)) {
+                        err = -EINVAL;
+                        *bad_wr = wr;
+                        srq->last = prev_wqe;
+                        return nreq;
+                }
+
+                for (i = 0; i < wr->num_sge; ++i) {
+                        ((struct mthca_data_seg *) wqe)->byte_count =
+                                cpu_to_be32(wr->sg_list[i].length);
+                        ((struct mthca_data_seg *) wqe)->lkey =
+                                cpu_to_be32(wr->sg_list[i].lkey);
+                        ((struct mthca_data_seg *) wqe)->addr =
+                                cpu_to_be64(wr->sg_list[i].addr);
+                        wqe += sizeof (struct mthca_data_seg);
+                }
+
+                if (i < srq->max_gs) {
+                        ((struct mthca_data_seg *) wqe)->byte_count = 0;
+                        ((struct mthca_data_seg *) wqe)->lkey = cpu_to_be32(MTHCA_INVAL_LKEY);
+                        ((struct mthca_data_seg *) wqe)->addr = 0;
+                }
+
+                if (likely(prev_wqe)) {
+                        ((struct mthca_next_seg *) prev_wqe)->nda_op =
+                                cpu_to_be32((ind << srq->wqe_shift) | 1);
+                        wmb();
+                        ((struct mthca_next_seg *) prev_wqe)->ee_nds =
+                                cpu_to_be32(MTHCA_NEXT_DBD);
+                }
+
+                srq->wrid[ind]  = wr->wr_id;
+                srq->first_free = next_ind;
+        }
+
+        return nreq;
+
+        if (likely(nreq)) {
+                __be32 doorbell[2];
+
+                doorbell[0] = cpu_to_be32(first_ind << srq->wqe_shift);
+                doorbell[1] = cpu_to_be32((srq->srqn << 8) | nreq);
+
+                /*
+                 * Make sure that descriptors are written before
+                 * doorbell is rung.
+                 */
+                wmb();
+
+                mthca_write64(doorbell,
+                              dev->kar + MTHCA_RECEIVE_DOORBELL,
+                              MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
+        }
+
+        spin_unlock_irqrestore(&srq->lock, flags);
+        return err;
+}
+
+int mthca_arbel_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
+                              struct ib_recv_wr **bad_wr)
+{
+        struct mthca_dev *dev = to_mdev(ibsrq->device);
+        struct mthca_srq *srq = to_msrq(ibsrq);
+        unsigned long flags;
+        int err = 0;
+        int ind;
+        int next_ind;
+        int nreq;
+        int i;
+        void *wqe;
+
+        spin_lock_irqsave(&srq->lock, flags);
+
+        for (nreq = 0; wr; ++nreq, wr = wr->next) {
+                ind = srq->first_free;
+
+                if (ind < 0) {
+                        mthca_err(dev, "SRQ %06x full\n", srq->srqn);
+                        err = -ENOMEM;
+                        *bad_wr = wr;
+                        return nreq;
+                }
+
+                wqe       = get_wqe(srq, ind);
+                next_ind  = *wqe_to_link(wqe);
+
+                ((struct mthca_next_seg *) wqe)->nda_op =
+                        cpu_to_be32((next_ind << srq->wqe_shift) | 1);
+                ((struct mthca_next_seg *) wqe)->ee_nds = 0;
+                /* flags field will always remain 0 */
+
+                wqe += sizeof (struct mthca_next_seg);
+
+                if (unlikely(wr->num_sge > srq->max_gs)) {
+                        err = -EINVAL;
+                        *bad_wr = wr;
+                        return nreq;
+                }
+
+                for (i = 0; i < wr->num_sge; ++i) {
+                        ((struct mthca_data_seg *) wqe)->byte_count =
+                                cpu_to_be32(wr->sg_list[i].length);
+                        ((struct mthca_data_seg *) wqe)->lkey =
+                                cpu_to_be32(wr->sg_list[i].lkey);
+                        ((struct mthca_data_seg *) wqe)->addr =
+                                cpu_to_be64(wr->sg_list[i].addr);
+                        wqe += sizeof (struct mthca_data_seg);
+                }
+
+                if (i < srq->max_gs) {
+                        ((struct mthca_data_seg *) wqe)->byte_count = 0;
+                        ((struct mthca_data_seg *) wqe)->lkey = cpu_to_be32(MTHCA_INVAL_LKEY);
+                        ((struct mthca_data_seg *) wqe)->addr = 0;
+                }
+
+                srq->wrid[ind]  = wr->wr_id;
+                srq->first_free = next_ind;
+        }
+
+        if (likely(nreq)) {
+                srq->counter += nreq;
+
+                /*
+                 * Make sure that descriptors are written before
+                 * we write doorbell record.
+                 */
+                wmb();
+                *srq->db = cpu_to_be32(srq->counter);
+        }
+
+        spin_unlock_irqrestore(&srq->lock, flags);
+        return err;
+}
+
+int __devinit mthca_init_srq_table(struct mthca_dev *dev)
+{
+        int err;
+
+        if (!(dev->mthca_flags & MTHCA_FLAG_SRQ))
+                return 0;
+
+        spin_lock_init(&dev->srq_table.lock);
+
+        err = mthca_alloc_init(&dev->srq_table.alloc,
+                               dev->limits.num_srqs,
+                               dev->limits.num_srqs - 1,
+                               dev->limits.reserved_srqs);
+        if (err)
+                return err;
+
+        err = mthca_array_init(&dev->srq_table.srq,
+                               dev->limits.num_srqs);
+        if (err)
+                mthca_alloc_cleanup(&dev->srq_table.alloc);
+
+        return err;
+}
+
+void __devexit mthca_cleanup_srq_table(struct mthca_dev *dev)
+{
+        if (!(dev->mthca_flags & MTHCA_FLAG_SRQ))
+                return;
+
+        mthca_array_cleanup(&dev->srq_table.srq, dev->limits.num_srqs);
+        mthca_alloc_cleanup(&dev->srq_table.alloc);
+}
diff --git a/drivers/infiniband/hw/mthca/mthca_user.h b/drivers/infiniband/hw/mthca/mthca_user.h
index 3024c1b4547d..41613ec8a04e 100644
--- a/drivers/infiniband/hw/mthca/mthca_user.h
+++ b/drivers/infiniband/hw/mthca/mthca_user.h
@@ -69,6 +69,17 @@ struct mthca_create_cq_resp {
         __u32 reserved;
 };
 
+struct mthca_create_srq {
+        __u32 lkey;
+        __u32 db_index;
+        __u64 db_page;
+};
+
+struct mthca_create_srq_resp {
+        __u32 srqn;
+        __u32 reserved;
+};
+
 struct mthca_create_qp {
         __u32 lkey;
         __u32 reserved;
diff --git a/drivers/infiniband/hw/mthca/mthca_wqe.h b/drivers/infiniband/hw/mthca/mthca_wqe.h
new file mode 100644
index 000000000000..1f4c0ff28f79
--- /dev/null
+++ b/drivers/infiniband/hw/mthca/mthca_wqe.h
@@ -0,0 +1,114 @@
+/*
+ * Copyright (c) 2005 Cisco Systems. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ * $Id: mthca_wqe.h 3047 2005-08-10 03:59:35Z roland $
+ */
+
+#ifndef MTHCA_WQE_H
+#define MTHCA_WQE_H
+
+#include <linux/types.h>
+
+enum {
+        MTHCA_NEXT_DBD       = 1 << 7,
+        MTHCA_NEXT_FENCE     = 1 << 6,
+        MTHCA_NEXT_CQ_UPDATE = 1 << 3,
+        MTHCA_NEXT_EVENT_GEN = 1 << 2,
+        MTHCA_NEXT_SOLICIT   = 1 << 1,
+
+        MTHCA_MLX_VL15       = 1 << 17,
+        MTHCA_MLX_SLR        = 1 << 16
+};
+
+enum {
+        MTHCA_INVAL_LKEY = 0x100
+};
+
+struct mthca_next_seg {
+        __be32 nda_op;          /* [31:6] next WQE [4:0] next opcode */
+        __be32 ee_nds;          /* [31:8] next EE  [7] DBD [6] F [5:0] next WQE size */
+        __be32 flags;           /* [3] CQ [2] Event [1] Solicit */
+        __be32 imm;             /* immediate data */
+};
+
+struct mthca_tavor_ud_seg {
+        u32    reserved1;
+        __be32 lkey;
+        __be64 av_addr;
+        u32    reserved2[4];
+        __be32 dqpn;
+        __be32 qkey;
+        u32    reserved3[2];
+};
+
+struct mthca_arbel_ud_seg {
+        __be32 av[8];
+        __be32 dqpn;
+        __be32 qkey;
+        u32    reserved[2];
+};
+
+struct mthca_bind_seg {
+        __be32 flags;           /* [31] Atomic [30] rem write [29] rem read */
+        u32    reserved;
+        __be32 new_rkey;
+        __be32 lkey;
+        __be64 addr;
+        __be64 length;
+};
+
+struct mthca_raddr_seg {
+        __be64 raddr;
+        __be32 rkey;
+        u32    reserved;
+};
+
+struct mthca_atomic_seg {
+        __be64 swap_add;
+        __be64 compare;
+};
+
+struct mthca_data_seg {
+        __be32 byte_count;
+        __be32 lkey;
+        __be64 addr;
+};
+
+struct mthca_mlx_seg {
+        __be32 nda_op;
+        __be32 nds;
+        __be32 flags;           /* [17] VL15 [16] SLR [14:12] static rate
+                                   [11:8] SL [3] C [2] E */
+        __be16 rlid;
+        __be16 vcrc;
+};
+
+#endif /* MTHCA_WQE_H */
diff --git a/drivers/infiniband/include/ib_cache.h b/drivers/infiniband/include/ib_cache.h
deleted file mode 100644
index 44ef6bb9b9df..000000000000
--- a/drivers/infiniband/include/ib_cache.h
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Copyright (c) 2004 Topspin Communications.  All rights reserved.
- *
- * This software is available to you under a choice of one of two
- * licenses.  You may choose to be licensed under the terms of the GNU
- * General Public License (GPL) Version 2, available from the file
- * COPYING in the main directory of this source tree, or the
- * OpenIB.org BSD license below:
- *
- *     Redistribution and use in source and binary forms, with or
- *     without modification, are permitted provided that the following
- *     conditions are met:
- *
- *      - Redistributions of source code must retain the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer.
- *
- *      - Redistributions in binary form must reproduce the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer in the documentation and/or other materials
- *        provided with the distribution.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- *
- * $Id: ib_cache.h 1349 2004-12-16 21:09:43Z roland $
- */
-
-#ifndef _IB_CACHE_H
-#define _IB_CACHE_H
-
-#include <ib_verbs.h>
-
-/**
- * ib_get_cached_gid - Returns a cached GID table entry
- * @device: The device to query.
- * @port_num: The port number of the device to query.
- * @index: The index into the cached GID table to query.
- * @gid: The GID value found at the specified index.
- *
- * ib_get_cached_gid() fetches the specified GID table entry stored in
- * the local software cache.
- */
-int ib_get_cached_gid(struct ib_device    *device,
-                      u8                   port_num,
-                      int                  index,
-                      union ib_gid        *gid);
-
-/**
- * ib_find_cached_gid - Returns the port number and GID table index where
- *   a specified GID value occurs.
- * @device: The device to query.
- * @gid: The GID value to search for.
- * @port_num: The port number of the device where the GID value was found.
- * @index: The index into the cached GID table where the GID was found.  This
- *   parameter may be NULL.
- *
- * ib_find_cached_gid() searches for the specified GID value in
- * the local software cache.
- */
-int ib_find_cached_gid(struct ib_device *device,
-                       union ib_gid     *gid,
-                       u8               *port_num,
-                       u16              *index);
-
-/**
- * ib_get_cached_pkey - Returns a cached PKey table entry
- * @device: The device to query.
- * @port_num: The port number of the device to query.
- * @index: The index into the cached PKey table to query.
- * @pkey: The PKey value found at the specified index.
- *
- * ib_get_cached_pkey() fetches the specified PKey table entry stored in
- * the local software cache.
- */
-int ib_get_cached_pkey(struct ib_device    *device_handle,
-                       u8                   port_num,
-                       int                  index,
-                       u16                 *pkey);
-
-/**
- * ib_find_cached_pkey - Returns the PKey table index where a specified
- *   PKey value occurs.
- * @device: The device to query.
- * @port_num: The port number of the device to search for the PKey.
- * @pkey: The PKey value to search for.
- * @index: The index into the cached PKey table where the PKey was found.
- *
- * ib_find_cached_pkey() searches the specified PKey table in
- * the local software cache.
- */
-int ib_find_cached_pkey(struct ib_device    *device,
-                        u8                   port_num,
-                        u16                  pkey,
-                        u16                 *index);
-
-#endif /* _IB_CACHE_H */
diff --git a/drivers/infiniband/include/ib_cm.h b/drivers/infiniband/include/ib_cm.h
deleted file mode 100644
index e5d74a730a70..000000000000
--- a/drivers/infiniband/include/ib_cm.h
+++ /dev/null
@@ -1,568 +0,0 @@
-/*
- * Copyright (c) 2004 Intel Corporation.  All rights reserved.
- * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
- * Copyright (c) 2004 Voltaire Corporation.  All rights reserved.
- * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
- *
- * This software is available to you under a choice of one of two
- * licenses.  You may choose to be licensed under the terms of the GNU
- * General Public License (GPL) Version 2, available from the file
- * COPYING in the main directory of this source tree, or the
- * OpenIB.org BSD license below:
- *
- *     Redistribution and use in source and binary forms, with or
- *     without modification, are permitted provided that the following
- *     conditions are met:
- *
- *      - Redistributions of source code must retain the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer.
- *
- *      - Redistributions in binary form must reproduce the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer in the documentation and/or other materials
- *        provided with the distribution.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- *
- * $Id: ib_cm.h 2730 2005-06-28 16:43:03Z sean.hefty $
- */
-#if !defined(IB_CM_H)
-#define IB_CM_H
-
-#include <ib_mad.h>
-#include <ib_sa.h>
-
-enum ib_cm_state {
-        IB_CM_IDLE,
-        IB_CM_LISTEN,
-        IB_CM_REQ_SENT,
-        IB_CM_REQ_RCVD,
-        IB_CM_MRA_REQ_SENT,
-        IB_CM_MRA_REQ_RCVD,
-        IB_CM_REP_SENT,
-        IB_CM_REP_RCVD,
-        IB_CM_MRA_REP_SENT,
-        IB_CM_MRA_REP_RCVD,
-        IB_CM_ESTABLISHED,
-        IB_CM_DREQ_SENT,
-        IB_CM_DREQ_RCVD,
-        IB_CM_TIMEWAIT,
-        IB_CM_SIDR_REQ_SENT,
-        IB_CM_SIDR_REQ_RCVD
-};
-
-enum ib_cm_lap_state {
-        IB_CM_LAP_IDLE,
-        IB_CM_LAP_SENT,
-        IB_CM_LAP_RCVD,
-        IB_CM_MRA_LAP_SENT,
-        IB_CM_MRA_LAP_RCVD,
-};
-
-enum ib_cm_event_type {
-        IB_CM_REQ_ERROR,
-        IB_CM_REQ_RECEIVED,
-        IB_CM_REP_ERROR,
-        IB_CM_REP_RECEIVED,
-        IB_CM_RTU_RECEIVED,
-        IB_CM_USER_ESTABLISHED,
-        IB_CM_DREQ_ERROR,
-        IB_CM_DREQ_RECEIVED,
-        IB_CM_DREP_RECEIVED,
-        IB_CM_TIMEWAIT_EXIT,
-        IB_CM_MRA_RECEIVED,
-        IB_CM_REJ_RECEIVED,
-        IB_CM_LAP_ERROR,
-        IB_CM_LAP_RECEIVED,
-        IB_CM_APR_RECEIVED,
-        IB_CM_SIDR_REQ_ERROR,
-        IB_CM_SIDR_REQ_RECEIVED,
-        IB_CM_SIDR_REP_RECEIVED
-};
-
-enum ib_cm_data_size {
-        IB_CM_REQ_PRIVATE_DATA_SIZE      = 92,
-        IB_CM_MRA_PRIVATE_DATA_SIZE      = 222,
-        IB_CM_REJ_PRIVATE_DATA_SIZE      = 148,
-        IB_CM_REP_PRIVATE_DATA_SIZE      = 196,
-        IB_CM_RTU_PRIVATE_DATA_SIZE      = 224,
-        IB_CM_DREQ_PRIVATE_DATA_SIZE     = 220,
-        IB_CM_DREP_PRIVATE_DATA_SIZE     = 224,
-        IB_CM_REJ_ARI_LENGTH             = 72,
-        IB_CM_LAP_PRIVATE_DATA_SIZE      = 168,
-        IB_CM_APR_PRIVATE_DATA_SIZE      = 148,
-        IB_CM_APR_INFO_LENGTH            = 72,
-        IB_CM_SIDR_REQ_PRIVATE_DATA_SIZE = 216,
-        IB_CM_SIDR_REP_PRIVATE_DATA_SIZE = 136,
-        IB_CM_SIDR_REP_INFO_LENGTH       = 72
-};
-
-struct ib_cm_id;
-
-struct ib_cm_req_event_param {
-        struct ib_cm_id         *listen_id;
-        struct ib_device        *device;
-        u8                      port;
-
-        struct ib_sa_path_rec   *primary_path;
-        struct ib_sa_path_rec   *alternate_path;
-
-        u64                     remote_ca_guid;
-        u32                     remote_qkey;
-        u32                     remote_qpn;
-        enum ib_qp_type         qp_type;
-
-        u32                     starting_psn;
-        u8                      responder_resources;
-        u8                      initiator_depth;
-        unsigned int            local_cm_response_timeout:5;
-        unsigned int            flow_control:1;
-        unsigned int            remote_cm_response_timeout:5;
-        unsigned int            retry_count:3;
-        unsigned int            rnr_retry_count:3;
-        unsigned int            srq:1;
-};
-
-struct ib_cm_rep_event_param {
-        u64                     remote_ca_guid;
-        u32                     remote_qkey;
-        u32                     remote_qpn;
-        u32                     starting_psn;
-        u8                      responder_resources;
-        u8                      initiator_depth;
-        unsigned int            target_ack_delay:5;
-        unsigned int            failover_accepted:2;
-        unsigned int            flow_control:1;
-        unsigned int            rnr_retry_count:3;
-        unsigned int            srq:1;
-};
-
-enum ib_cm_rej_reason {
-        IB_CM_REJ_NO_QP                         = __constant_htons(1),
-        IB_CM_REJ_NO_EEC                        = __constant_htons(2),
-        IB_CM_REJ_NO_RESOURCES                  = __constant_htons(3),
-        IB_CM_REJ_TIMEOUT                       = __constant_htons(4),
-        IB_CM_REJ_UNSUPPORTED                   = __constant_htons(5),
-        IB_CM_REJ_INVALID_COMM_ID               = __constant_htons(6),
-        IB_CM_REJ_INVALID_COMM_INSTANCE         = __constant_htons(7),
-        IB_CM_REJ_INVALID_SERVICE_ID            = __constant_htons(8),
-        IB_CM_REJ_INVALID_TRANSPORT_TYPE        = __constant_htons(9),
-        IB_CM_REJ_STALE_CONN                    = __constant_htons(10),
-        IB_CM_REJ_RDC_NOT_EXIST                 = __constant_htons(11),
-        IB_CM_REJ_INVALID_GID                   = __constant_htons(12),
-        IB_CM_REJ_INVALID_LID                   = __constant_htons(13),
-        IB_CM_REJ_INVALID_SL                    = __constant_htons(14),
-        IB_CM_REJ_INVALID_TRAFFIC_CLASS         = __constant_htons(15),
-        IB_CM_REJ_INVALID_HOP_LIMIT             = __constant_htons(16),
-        IB_CM_REJ_INVALID_PACKET_RATE           = __constant_htons(17),
-        IB_CM_REJ_INVALID_ALT_GID               = __constant_htons(18),
-        IB_CM_REJ_INVALID_ALT_LID               = __constant_htons(19),
-        IB_CM_REJ_INVALID_ALT_SL                = __constant_htons(20),
-        IB_CM_REJ_INVALID_ALT_TRAFFIC_CLASS     = __constant_htons(21),
-        IB_CM_REJ_INVALID_ALT_HOP_LIMIT         = __constant_htons(22),
-        IB_CM_REJ_INVALID_ALT_PACKET_RATE       = __constant_htons(23),
-        IB_CM_REJ_PORT_REDIRECT                 = __constant_htons(24),
-        IB_CM_REJ_INVALID_MTU                   = __constant_htons(26),
-        IB_CM_REJ_INSUFFICIENT_RESP_RESOURCES   = __constant_htons(27),
-        IB_CM_REJ_CONSUMER_DEFINED              = __constant_htons(28),
-        IB_CM_REJ_INVALID_RNR_RETRY             = __constant_htons(29),
-        IB_CM_REJ_DUPLICATE_LOCAL_COMM_ID       = __constant_htons(30),
-        IB_CM_REJ_INVALID_CLASS_VERSION         = __constant_htons(31),
-        IB_CM_REJ_INVALID_FLOW_LABEL            = __constant_htons(32),
-        IB_CM_REJ_INVALID_ALT_FLOW_LABEL        = __constant_htons(33)
-};
-
-struct ib_cm_rej_event_param {
-        enum ib_cm_rej_reason   reason;
-        void                    *ari;
-        u8                      ari_length;
-};
-
-struct ib_cm_mra_event_param {
-        u8      service_timeout;
-};
-
-struct ib_cm_lap_event_param {
-        struct ib_sa_path_rec   *alternate_path;
-};
-
-enum ib_cm_apr_status {
-        IB_CM_APR_SUCCESS,
-        IB_CM_APR_INVALID_COMM_ID,
-        IB_CM_APR_UNSUPPORTED,
-        IB_CM_APR_REJECT,
-        IB_CM_APR_REDIRECT,
-        IB_CM_APR_IS_CURRENT,
-        IB_CM_APR_INVALID_QPN_EECN,
-        IB_CM_APR_INVALID_LID,
-        IB_CM_APR_INVALID_GID,
-        IB_CM_APR_INVALID_FLOW_LABEL,
-        IB_CM_APR_INVALID_TCLASS,
-        IB_CM_APR_INVALID_HOP_LIMIT,
-        IB_CM_APR_INVALID_PACKET_RATE,
-        IB_CM_APR_INVALID_SL
-};
-
-struct ib_cm_apr_event_param {
-        enum ib_cm_apr_status   ap_status;
-        void                    *apr_info;
-        u8                      info_len;
-};
-
-struct ib_cm_sidr_req_event_param {
-        struct ib_cm_id         *listen_id;
-        struct ib_device        *device;
-        u8                      port;
-
-        u16     pkey;
-};
-
-enum ib_cm_sidr_status {
-        IB_SIDR_SUCCESS,
-        IB_SIDR_UNSUPPORTED,
-        IB_SIDR_REJECT,
-        IB_SIDR_NO_QP,
-        IB_SIDR_REDIRECT,
-        IB_SIDR_UNSUPPORTED_VERSION
-};
-
-struct ib_cm_sidr_rep_event_param {
-        enum ib_cm_sidr_status  status;
-        u32                     qkey;
-        u32                     qpn;
-        void                    *info;
-        u8                      info_len;
-
-};
-
-struct ib_cm_event {
-        enum ib_cm_event_type   event;
-        union {
-                struct ib_cm_req_event_param    req_rcvd;
-                struct ib_cm_rep_event_param    rep_rcvd;
-                /* No data for RTU received events. */
-                struct ib_cm_rej_event_param    rej_rcvd;
-                struct ib_cm_mra_event_param    mra_rcvd;
-                struct ib_cm_lap_event_param    lap_rcvd;
-                struct ib_cm_apr_event_param    apr_rcvd;
-                /* No data for DREQ/DREP received events. */
-                struct ib_cm_sidr_req_event_param sidr_req_rcvd;
-                struct ib_cm_sidr_rep_event_param sidr_rep_rcvd;
-                enum ib_wc_status               send_status;
-        } param;
-
-        void                    *private_data;
-};
-
-/**
- * ib_cm_handler - User-defined callback to process communication events.
- * @cm_id: Communication identifier associated with the reported event.
- * @event: Information about the communication event.
- *
- * IB_CM_REQ_RECEIVED and IB_CM_SIDR_REQ_RECEIVED communication events
- * generated as a result of listen requests result in the allocation of a
- * new @cm_id.  The new @cm_id is returned to the user through this callback.
- * Clients are responsible for destroying the new @cm_id.  For peer-to-peer
- * IB_CM_REQ_RECEIVED and all other events, the returned @cm_id corresponds
- * to a user's existing communication identifier.
- *
- * Users may not call ib_destroy_cm_id while in the context of this callback;
- * however, returning a non-zero value instructs the communication manager to
- * destroy the @cm_id after the callback completes.
- */
-typedef int (*ib_cm_handler)(struct ib_cm_id *cm_id,
-                             struct ib_cm_event *event);
-
-struct ib_cm_id {
-        ib_cm_handler           cm_handler;
-        void                    *context;
-        u64                     service_id;
-        u64                     service_mask;
-        enum ib_cm_state        state;          /* internal CM/debug use */
-        enum ib_cm_lap_state    lap_state;      /* internal CM/debug use */
-        u32                     local_id;
-        u32                     remote_id;
-};
-
-/**
- * ib_create_cm_id - Allocate a communication identifier.
- * @cm_handler: Callback invoked to notify the user of CM events.
- * @context: User specified context associated with the communication
- *   identifier.
- *
- * Communication identifiers are used to track connection states, service
- * ID resolution requests, and listen requests.
- */
-struct ib_cm_id *ib_create_cm_id(ib_cm_handler cm_handler,
-                                 void *context);
-
-/**
- * ib_destroy_cm_id - Destroy a connection identifier.
- * @cm_id: Connection identifier to destroy.
- *
- * This call blocks until the connection identifier is destroyed.
- */
-void ib_destroy_cm_id(struct ib_cm_id *cm_id);
-
-#define IB_SERVICE_ID_AGN_MASK  __constant_cpu_to_be64(0xFF00000000000000ULL)
-#define IB_CM_ASSIGN_SERVICE_ID __constant_cpu_to_be64(0x0200000000000000ULL)
-
-/**
- * ib_cm_listen - Initiates listening on the specified service ID for
- *   connection and service ID resolution requests.
- * @cm_id: Connection identifier associated with the listen request.
- * @service_id: Service identifier matched against incoming connection
- *   and service ID resolution requests.  The service ID should be specified
- *   network-byte order.  If set to IB_CM_ASSIGN_SERVICE_ID, the CM will
- *   assign a service ID to the caller.
- * @service_mask: Mask applied to service ID used to listen across a
- *   range of service IDs.  If set to 0, the service ID is matched
- *   exactly.  This parameter is ignored if %service_id is set to
- *   IB_CM_ASSIGN_SERVICE_ID.
- */
-int ib_cm_listen(struct ib_cm_id *cm_id,
-                 u64 service_id,
-                 u64 service_mask);
-
-struct ib_cm_req_param {
-        struct ib_sa_path_rec   *primary_path;
-        struct ib_sa_path_rec   *alternate_path;
-        u64                     service_id;
-        u32                     qp_num;
-        enum ib_qp_type         qp_type;
-        u32                     starting_psn;
-        const void              *private_data;
-        u8                      private_data_len;
-        u8                      peer_to_peer;
-        u8                      responder_resources;
-        u8                      initiator_depth;
-        u8                      remote_cm_response_timeout;
-        u8                      flow_control;
-        u8                      local_cm_response_timeout;
-        u8                      retry_count;
-        u8                      rnr_retry_count;
-        u8                      max_cm_retries;
-        u8                      srq;
-};
-
-/**
- * ib_send_cm_req - Sends a connection request to the remote node.
- * @cm_id: Connection identifier that will be associated with the
- *   connection request.
- * @param: Connection request information needed to establish the
- *   connection.
- */
-int ib_send_cm_req(struct ib_cm_id *cm_id,
-                   struct ib_cm_req_param *param);
-
-struct ib_cm_rep_param {
-        u32             qp_num;
-        u32             starting_psn;
-        const void      *private_data;
-        u8              private_data_len;
-        u8              responder_resources;
-        u8              initiator_depth;
-        u8              target_ack_delay;
-        u8              failover_accepted;
-        u8              flow_control;
-        u8              rnr_retry_count;
-        u8              srq;
-};
-
-/**
- * ib_send_cm_rep - Sends a connection reply in response to a connection
- *   request.
- * @cm_id: Connection identifier that will be associated with the
- *   connection request.
- * @param: Connection reply information needed to establish the
- *   connection.
- */
-int ib_send_cm_rep(struct ib_cm_id *cm_id,
-                   struct ib_cm_rep_param *param);
-
-/**
- * ib_send_cm_rtu - Sends a connection ready to use message in response
- *   to a connection reply message.
- * @cm_id: Connection identifier associated with the connection request.
- * @private_data: Optional user-defined private data sent with the
- *   ready to use message.
- * @private_data_len: Size of the private data buffer, in bytes.
- */
-int ib_send_cm_rtu(struct ib_cm_id *cm_id,
-                   const void *private_data,
-                   u8 private_data_len);
-
-/**
- * ib_send_cm_dreq - Sends a disconnection request for an existing
- *   connection.
- * @cm_id: Connection identifier associated with the connection being
- *   released.
- * @private_data: Optional user-defined private data sent with the
- *   disconnection request message.
- * @private_data_len: Size of the private data buffer, in bytes.
- */
-int ib_send_cm_dreq(struct ib_cm_id *cm_id,
-                    const void *private_data,
-                    u8 private_data_len);
-
-/**
- * ib_send_cm_drep - Sends a disconnection reply to a disconnection request.
- * @cm_id: Connection identifier associated with the connection being
- *   released.
- * @private_data: Optional user-defined private data sent with the
- *   disconnection reply message.
- * @private_data_len: Size of the private data buffer, in bytes.
- *
- * If the cm_id is in the correct state, the CM will transition the connection
- * to the timewait state, even if an error occurs sending the DREP message.
- */
-int ib_send_cm_drep(struct ib_cm_id *cm_id,
-                    const void *private_data,
-                    u8 private_data_len);
-
-/**
- * ib_cm_establish - Forces a connection state to established.
- * @cm_id: Connection identifier to transition to established.
- *
- * This routine should be invoked by users who receive messages on a
- * connected QP before an RTU has been received.
- */
-int ib_cm_establish(struct ib_cm_id *cm_id);
-
-/**
- * ib_send_cm_rej - Sends a connection rejection message to the
- *   remote node.
- * @cm_id: Connection identifier associated with the connection being
- *   rejected.
- * @reason: Reason for the connection request rejection.
- * @ari: Optional additional rejection information.
- * @ari_length: Size of the additional rejection information, in bytes.
- * @private_data: Optional user-defined private data sent with the
- *   rejection message.
- * @private_data_len: Size of the private data buffer, in bytes.
- */
-int ib_send_cm_rej(struct ib_cm_id *cm_id,
-                   enum ib_cm_rej_reason reason,
-                   void *ari,
-                   u8 ari_length,
-                   const void *private_data,
-                   u8 private_data_len);
-
-/**
- * ib_send_cm_mra - Sends a message receipt acknowledgement to a connection
- *   message.
- * @cm_id: Connection identifier associated with the connection message.
- * @service_timeout: The maximum time required for the sender to reply to
- *   to the connection message.
- * @private_data: Optional user-defined private data sent with the
- *   message receipt acknowledgement.
- * @private_data_len: Size of the private data buffer, in bytes.
- */
-int ib_send_cm_mra(struct ib_cm_id *cm_id,
-                   u8 service_timeout,
-                   const void *private_data,
-                   u8 private_data_len);
-
-/**
- * ib_send_cm_lap - Sends a load alternate path request.
- * @cm_id: Connection identifier associated with the load alternate path
- *   message.
- * @alternate_path: A path record that identifies the alternate path to
- *   load.
- * @private_data: Optional user-defined private data sent with the
- *   load alternate path message.
- * @private_data_len: Size of the private data buffer, in bytes.
- */
-int ib_send_cm_lap(struct ib_cm_id *cm_id,
-                   struct ib_sa_path_rec *alternate_path,
-                   const void *private_data,
-                   u8 private_data_len);
-
-/**
- * ib_cm_init_qp_attr - Initializes the QP attributes for use in transitioning
- *   to a specified QP state.
- * @cm_id: Communication identifier associated with the QP attributes to
- *   initialize.
- * @qp_attr: On input, specifies the desired QP state.  On output, the
- *   mandatory and desired optional attributes will be set in order to
- *   modify the QP to the specified state.
- * @qp_attr_mask: The QP attribute mask that may be used to transition the
- *   QP to the specified state.
- *
- * Users must set the @qp_attr->qp_state to the desired QP state.  This call
- * will set all required attributes for the given transition, along with
- * known optional attributes.  Users may override the attributes returned from
- * this call before calling ib_modify_qp.
- */
-int ib_cm_init_qp_attr(struct ib_cm_id *cm_id,
-                       struct ib_qp_attr *qp_attr,
-                       int *qp_attr_mask);
-
-/**
- * ib_send_cm_apr - Sends an alternate path response message in response to
- *   a load alternate path request.
- * @cm_id: Connection identifier associated with the alternate path response.
- * @status: Reply status sent with the alternate path response.
- * @info: Optional additional information sent with the alternate path
- *   response.
- * @info_length: Size of the additional information, in bytes.
- * @private_data: Optional user-defined private data sent with the
- *   alternate path response message.
- * @private_data_len: Size of the private data buffer, in bytes.
- */
-int ib_send_cm_apr(struct ib_cm_id *cm_id,
-                   enum ib_cm_apr_status status,
-                   void *info,
-                   u8 info_length,
-                   const void *private_data,
-                   u8 private_data_len);
-
-struct ib_cm_sidr_req_param {
-        struct ib_sa_path_rec   *path;
-        u64                     service_id;
-        int                     timeout_ms;
-        const void              *private_data;
-        u8                      private_data_len;
-        u8                      max_cm_retries;
-        u16                     pkey;
-};
-
-/**
- * ib_send_cm_sidr_req - Sends a service ID resolution request to the
- *   remote node.
- * @cm_id: Communication identifier that will be associated with the
- *   service ID resolution request.
- * @param: Service ID resolution request information.
- */
-int ib_send_cm_sidr_req(struct ib_cm_id *cm_id,
-                        struct ib_cm_sidr_req_param *param);
-
-struct ib_cm_sidr_rep_param {
-        u32                     qp_num;
-        u32                     qkey;
-        enum ib_cm_sidr_status  status;
-        const void              *info;
-        u8                      info_length;
-        const void              *private_data;
-        u8                      private_data_len;
-};
-
-/**
- * ib_send_cm_sidr_rep - Sends a service ID resolution request to the
- *   remote node.
- * @cm_id: Communication identifier associated with the received service ID
- *   resolution request.
- * @param: Service ID resolution reply information.
- */
-int ib_send_cm_sidr_rep(struct ib_cm_id *cm_id,
-                        struct ib_cm_sidr_rep_param *param);
-
-#endif /* IB_CM_H */
diff --git a/drivers/infiniband/include/ib_fmr_pool.h b/drivers/infiniband/include/ib_fmr_pool.h
deleted file mode 100644
index 6c9e24d6e144..000000000000
--- a/drivers/infiniband/include/ib_fmr_pool.h
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
- * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
- *
- * This software is available to you under a choice of one of two
- * licenses.  You may choose to be licensed under the terms of the GNU
- * General Public License (GPL) Version 2, available from the file
- * COPYING in the main directory of this source tree, or the
- * OpenIB.org BSD license below:
- *
- *     Redistribution and use in source and binary forms, with or
- *     without modification, are permitted provided that the following
- *     conditions are met:
- *
- *      - Redistributions of source code must retain the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer.
- *
- *      - Redistributions in binary form must reproduce the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer in the documentation and/or other materials
- *        provided with the distribution.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- *
- * $Id: ib_fmr_pool.h 2730 2005-06-28 16:43:03Z sean.hefty $
- */
-
-#if !defined(IB_FMR_POOL_H)
-#define IB_FMR_POOL_H
-
-#include <ib_verbs.h>
-
-struct ib_fmr_pool;
-
-/**
- * struct ib_fmr_pool_param - Parameters for creating FMR pool
- * @max_pages_per_fmr:Maximum number of pages per map request.
- * @access:Access flags for FMRs in pool.
- * @pool_size:Number of FMRs to allocate for pool.
- * @dirty_watermark:Flush is triggered when @dirty_watermark dirty
- *     FMRs are present.
- * @flush_function:Callback called when unmapped FMRs are flushed and
- *     more FMRs are possibly available for mapping
- * @flush_arg:Context passed to user's flush function.
- * @cache:If set, FMRs may be reused after unmapping for identical map
- *     requests.
- */
-struct ib_fmr_pool_param {
-        int                     max_pages_per_fmr;
-        enum ib_access_flags    access;
-        int                     pool_size;
-        int                     dirty_watermark;
-        void                  (*flush_function)(struct ib_fmr_pool *pool,
-                                                void *              arg);
-        void                   *flush_arg;
-        unsigned                cache:1;
-};
-
-struct ib_pool_fmr {
-        struct ib_fmr      *fmr;
-        struct ib_fmr_pool *pool;
-        struct list_head    list;
-        struct hlist_node   cache_node;
-        int                 ref_count;
-        int                 remap_count;
-        u64                 io_virtual_address;
-        int                 page_list_len;
-        u64                 page_list[0];
-};
-
-struct ib_fmr_pool *ib_create_fmr_pool(struct ib_pd             *pd,
-                                       struct ib_fmr_pool_param *params);
-
-void ib_destroy_fmr_pool(struct ib_fmr_pool *pool);
-
-int ib_flush_fmr_pool(struct ib_fmr_pool *pool);
-
-struct ib_pool_fmr *ib_fmr_pool_map_phys(struct ib_fmr_pool *pool_handle,
-                                         u64                *page_list,
-                                         int                 list_len,
-                                         u64                *io_virtual_address);
-
-int ib_fmr_pool_unmap(struct ib_pool_fmr *fmr);
-
-#endif /* IB_FMR_POOL_H */
diff --git a/drivers/infiniband/include/ib_mad.h b/drivers/infiniband/include/ib_mad.h
deleted file mode 100644
index 491b6f25b3b8..000000000000
--- a/drivers/infiniband/include/ib_mad.h
+++ /dev/null
@@ -1,577 +0,0 @@
-/*
- * Copyright (c) 2004 Mellanox Technologies Ltd.  All rights reserved.
- * Copyright (c) 2004 Infinicon Corporation.  All rights reserved.
- * Copyright (c) 2004 Intel Corporation.  All rights reserved.
- * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
- * Copyright (c) 2004 Voltaire Corporation.  All rights reserved.
- *
- * This software is available to you under a choice of one of two
- * licenses.  You may choose to be licensed under the terms of the GNU
- * General Public License (GPL) Version 2, available from the file
- * COPYING in the main directory of this source tree, or the
- * OpenIB.org BSD license below:
- *
- *     Redistribution and use in source and binary forms, with or
- *     without modification, are permitted provided that the following
- *     conditions are met:
- *
- *      - Redistributions of source code must retain the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer.
- *
- *      - Redistributions in binary form must reproduce the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer in the documentation and/or other materials
- *        provided with the distribution.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- *
- * $Id: ib_mad.h 2775 2005-07-02 13:42:12Z halr $
- */
-
-#if !defined( IB_MAD_H )
-#define IB_MAD_H
-
-#include <linux/pci.h>
-
-#include <ib_verbs.h>
-
-/* Management base version */
-#define IB_MGMT_BASE_VERSION                    1
-
-/* Management classes */
-#define IB_MGMT_CLASS_SUBN_LID_ROUTED           0x01
-#define IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE       0x81
-#define IB_MGMT_CLASS_SUBN_ADM                  0x03
-#define IB_MGMT_CLASS_PERF_MGMT                 0x04
-#define IB_MGMT_CLASS_BM                        0x05
-#define IB_MGMT_CLASS_DEVICE_MGMT               0x06
-#define IB_MGMT_CLASS_CM                        0x07
-#define IB_MGMT_CLASS_SNMP                      0x08
-#define IB_MGMT_CLASS_VENDOR_RANGE2_START       0x30
-#define IB_MGMT_CLASS_VENDOR_RANGE2_END         0x4F
-
-#define IB_OPENIB_OUI                           (0x001405)
-
-/* Management methods */
-#define IB_MGMT_METHOD_GET                      0x01
-#define IB_MGMT_METHOD_SET                      0x02
-#define IB_MGMT_METHOD_GET_RESP                 0x81
-#define IB_MGMT_METHOD_SEND                     0x03
-#define IB_MGMT_METHOD_TRAP                     0x05
-#define IB_MGMT_METHOD_REPORT                   0x06
-#define IB_MGMT_METHOD_REPORT_RESP              0x86
-#define IB_MGMT_METHOD_TRAP_REPRESS             0x07
-
-#define IB_MGMT_METHOD_RESP                     0x80
-
-#define IB_MGMT_MAX_METHODS                     128
-
-/* RMPP information */
-#define IB_MGMT_RMPP_VERSION                    1
-
-#define IB_MGMT_RMPP_TYPE_DATA                  1
-#define IB_MGMT_RMPP_TYPE_ACK                   2
-#define IB_MGMT_RMPP_TYPE_STOP                  3
-#define IB_MGMT_RMPP_TYPE_ABORT                 4
-
-#define IB_MGMT_RMPP_FLAG_ACTIVE                1
-#define IB_MGMT_RMPP_FLAG_FIRST                 (1<<1)
-#define IB_MGMT_RMPP_FLAG_LAST                  (1<<2)
-
-#define IB_MGMT_RMPP_NO_RESPTIME                0x1F
-
-#define IB_MGMT_RMPP_STATUS_SUCCESS             0
-#define IB_MGMT_RMPP_STATUS_RESX                1
-#define IB_MGMT_RMPP_STATUS_T2L                 118
-#define IB_MGMT_RMPP_STATUS_BAD_LEN             119
-#define IB_MGMT_RMPP_STATUS_BAD_SEG             120
-#define IB_MGMT_RMPP_STATUS_BADT                121
-#define IB_MGMT_RMPP_STATUS_W2S                 122
-#define IB_MGMT_RMPP_STATUS_S2B                 123
-#define IB_MGMT_RMPP_STATUS_BAD_STATUS          124
-#define IB_MGMT_RMPP_STATUS_UNV                 125
-#define IB_MGMT_RMPP_STATUS_TMR                 126
-#define IB_MGMT_RMPP_STATUS_UNSPEC              127
-
-#define IB_QP0          0
-#define IB_QP1          __constant_htonl(1)
-#define IB_QP1_QKEY     0x80010000
-#define IB_QP_SET_QKEY  0x80000000
-
-struct ib_mad_hdr {
-        u8      base_version;
-        u8      mgmt_class;
-        u8      class_version;
-        u8      method;
-        u16     status;
-        u16     class_specific;
-        u64     tid;
-        u16     attr_id;
-        u16     resv;
-        u32     attr_mod;
-};
-
-struct ib_rmpp_hdr {
-        u8      rmpp_version;
-        u8      rmpp_type;
-        u8      rmpp_rtime_flags;
-        u8      rmpp_status;
-        u32     seg_num;
-        u32     paylen_newwin;
-};
-
-typedef u64 __bitwise ib_sa_comp_mask;
-
-#define IB_SA_COMP_MASK(n) ((__force ib_sa_comp_mask) cpu_to_be64(1ull << n))
-
-/*
- * ib_sa_hdr and ib_sa_mad structures must be packed because they have
- * 64-bit fields that are only 32-bit aligned. 64-bit architectures will
- * lay them out wrong otherwise.  (And unfortunately they are sent on
- * the wire so we can't change the layout)
- */
-struct ib_sa_hdr {
-        u64                     sm_key;
-        u16                     attr_offset;
-        u16                     reserved;
-        ib_sa_comp_mask         comp_mask;
-} __attribute__ ((packed));
-
-struct ib_mad {
-        struct ib_mad_hdr       mad_hdr;
-        u8                      data[232];
-};
-
-struct ib_rmpp_mad {
-        struct ib_mad_hdr       mad_hdr;
-        struct ib_rmpp_hdr      rmpp_hdr;
-        u8                      data[220];
-};
-
-struct ib_sa_mad {
-        struct ib_mad_hdr       mad_hdr;
-        struct ib_rmpp_hdr      rmpp_hdr;
-        struct ib_sa_hdr        sa_hdr;
-        u8                      data[200];
-} __attribute__ ((packed));
-
-struct ib_vendor_mad {
-        struct ib_mad_hdr       mad_hdr;
-        struct ib_rmpp_hdr      rmpp_hdr;
-        u8                      reserved;
-        u8                      oui[3];
-        u8                      data[216];
-};
-
-/**
- * ib_mad_send_buf - MAD data buffer and work request for sends.
- * @mad: References an allocated MAD data buffer.  The size of the data
- *   buffer is specified in the @send_wr.length field.
- * @mapping: DMA mapping information.
- * @mad_agent: MAD agent that allocated the buffer.
- * @context: User-controlled context fields.
- * @send_wr: An initialized work request structure used when sending the MAD.
- *   The wr_id field of the work request is initialized to reference this
- *   data structure.
- * @sge: A scatter-gather list referenced by the work request.
- *
- * Users are responsible for initializing the MAD buffer itself, with the
- * exception of specifying the payload length field in any RMPP MAD.
- */
-struct ib_mad_send_buf {
-        struct ib_mad           *mad;
-        DECLARE_PCI_UNMAP_ADDR(mapping)
-        struct ib_mad_agent     *mad_agent;
-        void                    *context[2];
-        struct ib_send_wr       send_wr;
-        struct ib_sge           sge;
-};
-
-/**
- * ib_get_rmpp_resptime - Returns the RMPP response time.
- * @rmpp_hdr: An RMPP header.
- */
-static inline u8 ib_get_rmpp_resptime(struct ib_rmpp_hdr *rmpp_hdr)
-{
-        return rmpp_hdr->rmpp_rtime_flags >> 3;
-}
-
-/**
- * ib_get_rmpp_flags - Returns the RMPP flags.
- * @rmpp_hdr: An RMPP header.
- */
-static inline u8 ib_get_rmpp_flags(struct ib_rmpp_hdr *rmpp_hdr)
-{
-        return rmpp_hdr->rmpp_rtime_flags & 0x7;
-}
-
-/**
- * ib_set_rmpp_resptime - Sets the response time in an RMPP header.
- * @rmpp_hdr: An RMPP header.
- * @rtime: The response time to set.
- */
-static inline void ib_set_rmpp_resptime(struct ib_rmpp_hdr *rmpp_hdr, u8 rtime)
-{
-        rmpp_hdr->rmpp_rtime_flags = ib_get_rmpp_flags(rmpp_hdr) | (rtime << 3);
-}
-
-/**
- * ib_set_rmpp_flags - Sets the flags in an RMPP header.
- * @rmpp_hdr: An RMPP header.
- * @flags: The flags to set.
- */
-static inline void ib_set_rmpp_flags(struct ib_rmpp_hdr *rmpp_hdr, u8 flags)
-{
-        rmpp_hdr->rmpp_rtime_flags = (rmpp_hdr->rmpp_rtime_flags & 0xF1) |
-                                     (flags & 0x7);
-}
-
-struct ib_mad_agent;
-struct ib_mad_send_wc;
-struct ib_mad_recv_wc;
-
-/**
- * ib_mad_send_handler - callback handler for a sent MAD.
- * @mad_agent: MAD agent that sent the MAD.
- * @mad_send_wc: Send work completion information on the sent MAD.
- */
-typedef void (*ib_mad_send_handler)(struct ib_mad_agent *mad_agent,
-                                    struct ib_mad_send_wc *mad_send_wc);
-
-/**
- * ib_mad_snoop_handler - Callback handler for snooping sent MADs.
- * @mad_agent: MAD agent that snooped the MAD.
- * @send_wr: Work request information on the sent MAD.
- * @mad_send_wc: Work completion information on the sent MAD.  Valid
- *   only for snooping that occurs on a send completion.
- *
- * Clients snooping MADs should not modify data referenced by the @send_wr
- * or @mad_send_wc.
- */
-typedef void (*ib_mad_snoop_handler)(struct ib_mad_agent *mad_agent,
-                                     struct ib_send_wr *send_wr,
-                                     struct ib_mad_send_wc *mad_send_wc);
-
-/**
- * ib_mad_recv_handler - callback handler for a received MAD.
- * @mad_agent: MAD agent requesting the received MAD.
- * @mad_recv_wc: Received work completion information on the received MAD.
- *
- * MADs received in response to a send request operation will be handed to
- * the user after the send operation completes.  All data buffers given
- * to registered agents through this routine are owned by the receiving
- * client, except for snooping agents.  Clients snooping MADs should not
- * modify the data referenced by @mad_recv_wc.
- */
-typedef void (*ib_mad_recv_handler)(struct ib_mad_agent *mad_agent,
-                                    struct ib_mad_recv_wc *mad_recv_wc);
-
-/**
- * ib_mad_agent - Used to track MAD registration with the access layer.
- * @device: Reference to device registration is on.
- * @qp: Reference to QP used for sending and receiving MADs.
- * @mr: Memory region for system memory usable for DMA.
- * @recv_handler: Callback handler for a received MAD.
- * @send_handler: Callback handler for a sent MAD.
- * @snoop_handler: Callback handler for snooped sent MADs.
- * @context: User-specified context associated with this registration.
- * @hi_tid: Access layer assigned transaction ID for this client.
- *   Unsolicited MADs sent by this client will have the upper 32-bits
- *   of their TID set to this value.
- * @port_num: Port number on which QP is registered
- * @rmpp_version: If set, indicates the RMPP version used by this agent.
- */
-struct ib_mad_agent {
-        struct ib_device        *device;
-        struct ib_qp            *qp;
-        struct ib_mr            *mr;
-        ib_mad_recv_handler     recv_handler;
-        ib_mad_send_handler     send_handler;
-        ib_mad_snoop_handler    snoop_handler;
-        void                    *context;
-        u32                     hi_tid;
-        u8                      port_num;
-        u8                      rmpp_version;
-};
-
-/**
- * ib_mad_send_wc - MAD send completion information.
- * @wr_id: Work request identifier associated with the send MAD request.
- * @status: Completion status.
- * @vendor_err: Optional vendor error information returned with a failed
- *   request.
- */
-struct ib_mad_send_wc {
-        u64                     wr_id;
-        enum ib_wc_status       status;
-        u32                     vendor_err;
-};
-
-/**
- * ib_mad_recv_buf - received MAD buffer information.
- * @list: Reference to next data buffer for a received RMPP MAD.
- * @grh: References a data buffer containing the global route header.
- *   The data refereced by this buffer is only valid if the GRH is
- *   valid.
- * @mad: References the start of the received MAD.
- */
-struct ib_mad_recv_buf {
-        struct list_head        list;
-        struct ib_grh           *grh;
-        struct ib_mad           *mad;
-};
-
-/**
- * ib_mad_recv_wc - received MAD information.
- * @wc: Completion information for the received data.
- * @recv_buf: Specifies the location of the received data buffer(s).
- * @rmpp_list: Specifies a list of RMPP reassembled received MAD buffers.
- * @mad_len: The length of the received MAD, without duplicated headers.
- *
- * For received response, the wr_id field of the wc is set to the wr_id
- *   for the corresponding send request.
- */
-struct ib_mad_recv_wc {
-        struct ib_wc            *wc;
-        struct ib_mad_recv_buf  recv_buf;
-        struct list_head        rmpp_list;
-        int                     mad_len;
-};
-
-/**
- * ib_mad_reg_req - MAD registration request
- * @mgmt_class: Indicates which management class of MADs should be receive
- *   by the caller.  This field is only required if the user wishes to
- *   receive unsolicited MADs, otherwise it should be 0.
- * @mgmt_class_version: Indicates which version of MADs for the given
- *   management class to receive.
- * @oui: Indicates IEEE OUI when mgmt_class is a vendor class
- *   in the range from 0x30 to 0x4f. Otherwise not used.
- * @method_mask: The caller will receive unsolicited MADs for any method
- *   where @method_mask = 1.
- */
-struct ib_mad_reg_req {
-        u8      mgmt_class;
-        u8      mgmt_class_version;
-        u8      oui[3];
-        DECLARE_BITMAP(method_mask, IB_MGMT_MAX_METHODS);
-};
-
-/**
- * ib_register_mad_agent - Register to send/receive MADs.
- * @device: The device to register with.
- * @port_num: The port on the specified device to use.
- * @qp_type: Specifies which QP to access.  Must be either
- *   IB_QPT_SMI or IB_QPT_GSI.
- * @mad_reg_req: Specifies which unsolicited MADs should be received
- *   by the caller.  This parameter may be NULL if the caller only
- *   wishes to receive solicited responses.
- * @rmpp_version: If set, indicates that the client will send
- *   and receive MADs that contain the RMPP header for the given version.
- *   If set to 0, indicates that RMPP is not used by this client.
- * @send_handler: The completion callback routine invoked after a send
- *   request has completed.
- * @recv_handler: The completion callback routine invoked for a received
- *   MAD.
- * @context: User specified context associated with the registration.
- */
-struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
-                                           u8 port_num,
-                                           enum ib_qp_type qp_type,
-                                           struct ib_mad_reg_req *mad_reg_req,
-                                           u8 rmpp_version,
-                                           ib_mad_send_handler send_handler,
-                                           ib_mad_recv_handler recv_handler,
-                                           void *context);
-
-enum ib_mad_snoop_flags {
-        /*IB_MAD_SNOOP_POSTED_SENDS        = 1,*/
-        /*IB_MAD_SNOOP_RMPP_SENDS          = (1<<1),*/
-        IB_MAD_SNOOP_SEND_COMPLETIONS      = (1<<2),
-        /*IB_MAD_SNOOP_RMPP_SEND_COMPLETIONS = (1<<3),*/
-        IB_MAD_SNOOP_RECVS                 = (1<<4)
-        /*IB_MAD_SNOOP_RMPP_RECVS          = (1<<5),*/
-        /*IB_MAD_SNOOP_REDIRECTED_QPS      = (1<<6)*/
-};
-
-/**
- * ib_register_mad_snoop - Register to snoop sent and received MADs.
- * @device: The device to register with.
- * @port_num: The port on the specified device to use.
- * @qp_type: Specifies which QP traffic to snoop.  Must be either
- *   IB_QPT_SMI or IB_QPT_GSI.
- * @mad_snoop_flags: Specifies information where snooping occurs.
- * @send_handler: The callback routine invoked for a snooped send.
- * @recv_handler: The callback routine invoked for a snooped receive.
- * @context: User specified context associated with the registration.
- */
-struct ib_mad_agent *ib_register_mad_snoop(struct ib_device *device,
-                                           u8 port_num,
-                                           enum ib_qp_type qp_type,
-                                           int mad_snoop_flags,
-                                           ib_mad_snoop_handler snoop_handler,
-                                           ib_mad_recv_handler recv_handler,
-                                           void *context);
-
-/**
- * ib_unregister_mad_agent - Unregisters a client from using MAD services.
- * @mad_agent: Corresponding MAD registration request to deregister.
- *
- * After invoking this routine, MAD services are no longer usable by the
- * client on the associated QP.
- */
-int ib_unregister_mad_agent(struct ib_mad_agent *mad_agent);
-
-/**
- * ib_post_send_mad - Posts MAD(s) to the send queue of the QP associated
- *   with the registered client.
- * @mad_agent: Specifies the associated registration to post the send to.
- * @send_wr: Specifies the information needed to send the MAD(s).
- * @bad_send_wr: Specifies the MAD on which an error was encountered.
- *
- * Sent MADs are not guaranteed to complete in the order that they were posted.
- *
- * If the MAD requires RMPP, the data buffer should contain a single copy
- * of the common MAD, RMPP, and class specific headers, followed by the class
- * defined data.  If the class defined data would not divide evenly into
- * RMPP segments, then space must be allocated at the end of the referenced
- * buffer for any required padding.  To indicate the amount of class defined
- * data being transferred, the paylen_newwin field in the RMPP header should
- * be set to the size of the class specific header plus the amount of class
- * defined data being transferred.  The paylen_newwin field should be
- * specified in network-byte order.
- */
-int ib_post_send_mad(struct ib_mad_agent *mad_agent,
-                     struct ib_send_wr *send_wr,
-                     struct ib_send_wr **bad_send_wr);
-
-/**
- * ib_coalesce_recv_mad - Coalesces received MAD data into a single buffer.
- * @mad_recv_wc: Work completion information for a received MAD.
- * @buf: User-provided data buffer to receive the coalesced buffers.  The
- *   referenced buffer should be at least the size of the mad_len specified
- *   by @mad_recv_wc.
- *
- * This call copies a chain of received MAD segments into a single data buffer,
- * removing duplicated headers.
- */
-void ib_coalesce_recv_mad(struct ib_mad_recv_wc *mad_recv_wc, void *buf);
-
-/**
- * ib_free_recv_mad - Returns data buffers used to receive a MAD.
- * @mad_recv_wc: Work completion information for a received MAD.
- *
- * Clients receiving MADs through their ib_mad_recv_handler must call this
- * routine to return the work completion buffers to the access layer.
- */
-void ib_free_recv_mad(struct ib_mad_recv_wc *mad_recv_wc);
-
-/**
- * ib_cancel_mad - Cancels an outstanding send MAD operation.
- * @mad_agent: Specifies the registration associated with sent MAD.
- * @wr_id: Indicates the work request identifier of the MAD to cancel.
- *
- * MADs will be returned to the user through the corresponding
- * ib_mad_send_handler.
- */
-void ib_cancel_mad(struct ib_mad_agent *mad_agent, u64 wr_id);
-
-/**
- * ib_modify_mad - Modifies an outstanding send MAD operation.
- * @mad_agent: Specifies the registration associated with sent MAD.
- * @wr_id: Indicates the work request identifier of the MAD to modify.
- * @timeout_ms: New timeout value for sent MAD.
- *
- * This call will reset the timeout value for a sent MAD to the specified
- * value.
- */
-int ib_modify_mad(struct ib_mad_agent *mad_agent, u64 wr_id, u32 timeout_ms);
-
-/**
- * ib_redirect_mad_qp - Registers a QP for MAD services.
- * @qp: Reference to a QP that requires MAD services.
- * @rmpp_version: If set, indicates that the client will send
- *   and receive MADs that contain the RMPP header for the given version.
- *   If set to 0, indicates that RMPP is not used by this client.
- * @send_handler: The completion callback routine invoked after a send
- *   request has completed.
- * @recv_handler: The completion callback routine invoked for a received
- *   MAD.
- * @context: User specified context associated with the registration.
- *
- * Use of this call allows clients to use MAD services, such as RMPP,
- * on user-owned QPs.  After calling this routine, users may send
- * MADs on the specified QP by calling ib_mad_post_send.
- */
-struct ib_mad_agent *ib_redirect_mad_qp(struct ib_qp *qp,
-                                        u8 rmpp_version,
-                                        ib_mad_send_handler send_handler,
-                                        ib_mad_recv_handler recv_handler,
-                                        void *context);
-
-/**
- * ib_process_mad_wc - Processes a work completion associated with a
- *   MAD sent or received on a redirected QP.
- * @mad_agent: Specifies the registered MAD service using the redirected QP.
- * @wc: References a work completion associated with a sent or received
- *   MAD segment.
- *
- * This routine is used to complete or continue processing on a MAD request.
- * If the work completion is associated with a send operation, calling
- * this routine is required to continue an RMPP transfer or to wait for a
- * corresponding response, if it is a request.  If the work completion is
- * associated with a receive operation, calling this routine is required to
- * process an inbound or outbound RMPP transfer, or to match a response MAD
- * with its corresponding request.
- */
-int ib_process_mad_wc(struct ib_mad_agent *mad_agent,
-                      struct ib_wc *wc);
-
-/**
- * ib_create_send_mad - Allocate and initialize a data buffer and work request
- *   for sending a MAD.
- * @mad_agent: Specifies the registered MAD service to associate with the MAD.
- * @remote_qpn: Specifies the QPN of the receiving node.
- * @pkey_index: Specifies which PKey the MAD will be sent using.  This field
- *   is valid only if the remote_qpn is QP 1.
- * @ah: References the address handle used to transfer to the remote node.
- * @rmpp_active: Indicates if the send will enable RMPP.
- * @hdr_len: Indicates the size of the data header of the MAD.  This length
- *   should include the common MAD header, RMPP header, plus any class
- *   specific header.
- * @data_len: Indicates the size of any user-transferred data.  The call will
- *   automatically adjust the allocated buffer size to account for any
- *   additional padding that may be necessary.
- * @gfp_mask: GFP mask used for the memory allocation.
- *
- * This is a helper routine that may be used to allocate a MAD.  Users are
- * not required to allocate outbound MADs using this call.  The returned
- * MAD send buffer will reference a data buffer usable for sending a MAD, along
- * with an initialized work request structure.  Users may modify the returned
- * MAD data buffer or work request before posting the send.
- *
- * The returned data buffer will be cleared.  Users are responsible for
- * initializing the common MAD and any class specific headers.  If @rmpp_active
- * is set, the RMPP header will be initialized for sending.
- */
-struct ib_mad_send_buf * ib_create_send_mad(struct ib_mad_agent *mad_agent,
-                                            u32 remote_qpn, u16 pkey_index,
-                                            struct ib_ah *ah, int rmpp_active,
-                                            int hdr_len, int data_len,
-                                            unsigned int __nocast gfp_mask);
-
-/**
- * ib_free_send_mad - Returns data buffers used to send a MAD.
- * @send_buf: Previously allocated send data buffer.
- */
-void ib_free_send_mad(struct ib_mad_send_buf *send_buf);
-
-#endif /* IB_MAD_H */
diff --git a/drivers/infiniband/include/ib_pack.h b/drivers/infiniband/include/ib_pack.h
deleted file mode 100644
index fe480f3e8654..000000000000
--- a/drivers/infiniband/include/ib_pack.h
+++ /dev/null
@@ -1,245 +0,0 @@
-/*
- * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
- *
- * This software is available to you under a choice of one of two
- * licenses.  You may choose to be licensed under the terms of the GNU
- * General Public License (GPL) Version 2, available from the file
- * COPYING in the main directory of this source tree, or the
- * OpenIB.org BSD license below:
- *
- *     Redistribution and use in source and binary forms, with or
- *     without modification, are permitted provided that the following
- *     conditions are met:
- *
- *      - Redistributions of source code must retain the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer.
- *
- *      - Redistributions in binary form must reproduce the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer in the documentation and/or other materials
- *        provided with the distribution.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- *
- * $Id: ib_pack.h 1349 2004-12-16 21:09:43Z roland $
- */
-
-#ifndef IB_PACK_H
-#define IB_PACK_H
-
-#include <ib_verbs.h>
-
-enum {
-        IB_LRH_BYTES  = 8,
-        IB_GRH_BYTES  = 40,
-        IB_BTH_BYTES  = 12,
-        IB_DETH_BYTES = 8
-};
-
-struct ib_field {
-        size_t struct_offset_bytes;
-        size_t struct_size_bytes;
-        int    offset_words;
-        int    offset_bits;
-        int    size_bits;
-        char  *field_name;
-};
-
-#define RESERVED \
-        .field_name          = "reserved"
-
-/*
- * This macro cleans up the definitions of constants for BTH opcodes.
- * It is used to define constants such as IB_OPCODE_UD_SEND_ONLY,
- * which becomes IB_OPCODE_UD + IB_OPCODE_SEND_ONLY, and this gives
- * the correct value.
- *
- * In short, user code should use the constants defined using the
- * macro rather than worrying about adding together other constants.
-*/
-#define IB_OPCODE(transport, op) \
-        IB_OPCODE_ ## transport ## _ ## op = \
-                IB_OPCODE_ ## transport + IB_OPCODE_ ## op
-
-enum {
-        /* transport types -- just used to define real constants */
-        IB_OPCODE_RC                                = 0x00,
-        IB_OPCODE_UC                                = 0x20,
-        IB_OPCODE_RD                                = 0x40,
-        IB_OPCODE_UD                                = 0x60,
-
-        /* operations -- just used to define real constants */
-        IB_OPCODE_SEND_FIRST                        = 0x00,
-        IB_OPCODE_SEND_MIDDLE                       = 0x01,
-        IB_OPCODE_SEND_LAST                         = 0x02,
-        IB_OPCODE_SEND_LAST_WITH_IMMEDIATE          = 0x03,
-        IB_OPCODE_SEND_ONLY                         = 0x04,
-        IB_OPCODE_SEND_ONLY_WITH_IMMEDIATE          = 0x05,
-        IB_OPCODE_RDMA_WRITE_FIRST                  = 0x06,
-        IB_OPCODE_RDMA_WRITE_MIDDLE                 = 0x07,
-        IB_OPCODE_RDMA_WRITE_LAST                   = 0x08,
-        IB_OPCODE_RDMA_WRITE_LAST_WITH_IMMEDIATE    = 0x09,
-        IB_OPCODE_RDMA_WRITE_ONLY                   = 0x0a,
-        IB_OPCODE_RDMA_WRITE_ONLY_WITH_IMMEDIATE    = 0x0b,
-        IB_OPCODE_RDMA_READ_REQUEST                 = 0x0c,
-        IB_OPCODE_RDMA_READ_RESPONSE_FIRST          = 0x0d,
-        IB_OPCODE_RDMA_READ_RESPONSE_MIDDLE         = 0x0e,
-        IB_OPCODE_RDMA_READ_RESPONSE_LAST           = 0x0f,
-        IB_OPCODE_RDMA_READ_RESPONSE_ONLY           = 0x10,
-        IB_OPCODE_ACKNOWLEDGE                       = 0x11,
-        IB_OPCODE_ATOMIC_ACKNOWLEDGE                = 0x12,
-        IB_OPCODE_COMPARE_SWAP                      = 0x13,
-        IB_OPCODE_FETCH_ADD                         = 0x14,
-
-        /* real constants follow -- see comment about above IB_OPCODE()
-           macro for more details */
-
-        /* RC */
-        IB_OPCODE(RC, SEND_FIRST),
-        IB_OPCODE(RC, SEND_MIDDLE),
-        IB_OPCODE(RC, SEND_LAST),
-        IB_OPCODE(RC, SEND_LAST_WITH_IMMEDIATE),
-        IB_OPCODE(RC, SEND_ONLY),
-        IB_OPCODE(RC, SEND_ONLY_WITH_IMMEDIATE),
-        IB_OPCODE(RC, RDMA_WRITE_FIRST),
-        IB_OPCODE(RC, RDMA_WRITE_MIDDLE),
-        IB_OPCODE(RC, RDMA_WRITE_LAST),
-        IB_OPCODE(RC, RDMA_WRITE_LAST_WITH_IMMEDIATE),
-        IB_OPCODE(RC, RDMA_WRITE_ONLY),
-        IB_OPCODE(RC, RDMA_WRITE_ONLY_WITH_IMMEDIATE),
-        IB_OPCODE(RC, RDMA_READ_REQUEST),
-        IB_OPCODE(RC, RDMA_READ_RESPONSE_FIRST),
-        IB_OPCODE(RC, RDMA_READ_RESPONSE_MIDDLE),
-        IB_OPCODE(RC, RDMA_READ_RESPONSE_LAST),
-        IB_OPCODE(RC, RDMA_READ_RESPONSE_ONLY),
-        IB_OPCODE(RC, ACKNOWLEDGE),
-        IB_OPCODE(RC, ATOMIC_ACKNOWLEDGE),
-        IB_OPCODE(RC, COMPARE_SWAP),
-        IB_OPCODE(RC, FETCH_ADD),
-
-        /* UC */
-        IB_OPCODE(UC, SEND_FIRST),
-        IB_OPCODE(UC, SEND_MIDDLE),
-        IB_OPCODE(UC, SEND_LAST),
-        IB_OPCODE(UC, SEND_LAST_WITH_IMMEDIATE),
-        IB_OPCODE(UC, SEND_ONLY),
-        IB_OPCODE(UC, SEND_ONLY_WITH_IMMEDIATE),
-        IB_OPCODE(UC, RDMA_WRITE_FIRST),
-        IB_OPCODE(UC, RDMA_WRITE_MIDDLE),
-        IB_OPCODE(UC, RDMA_WRITE_LAST),
-        IB_OPCODE(UC, RDMA_WRITE_LAST_WITH_IMMEDIATE),
-        IB_OPCODE(UC, RDMA_WRITE_ONLY),
-        IB_OPCODE(UC, RDMA_WRITE_ONLY_WITH_IMMEDIATE),
-
-        /* RD */
-        IB_OPCODE(RD, SEND_FIRST),
-        IB_OPCODE(RD, SEND_MIDDLE),
-        IB_OPCODE(RD, SEND_LAST),
-        IB_OPCODE(RD, SEND_LAST_WITH_IMMEDIATE),
-        IB_OPCODE(RD, SEND_ONLY),
-        IB_OPCODE(RD, SEND_ONLY_WITH_IMMEDIATE),
-        IB_OPCODE(RD, RDMA_WRITE_FIRST),
-        IB_OPCODE(RD, RDMA_WRITE_MIDDLE),
-        IB_OPCODE(RD, RDMA_WRITE_LAST),
-        IB_OPCODE(RD, RDMA_WRITE_LAST_WITH_IMMEDIATE),
-        IB_OPCODE(RD, RDMA_WRITE_ONLY),
-        IB_OPCODE(RD, RDMA_WRITE_ONLY_WITH_IMMEDIATE),
-        IB_OPCODE(RD, RDMA_READ_REQUEST),
-        IB_OPCODE(RD, RDMA_READ_RESPONSE_FIRST),
-        IB_OPCODE(RD, RDMA_READ_RESPONSE_MIDDLE),
-        IB_OPCODE(RD, RDMA_READ_RESPONSE_LAST),
-        IB_OPCODE(RD, RDMA_READ_RESPONSE_ONLY),
-        IB_OPCODE(RD, ACKNOWLEDGE),
-        IB_OPCODE(RD, ATOMIC_ACKNOWLEDGE),
-        IB_OPCODE(RD, COMPARE_SWAP),
-        IB_OPCODE(RD, FETCH_ADD),
-
-        /* UD */
-        IB_OPCODE(UD, SEND_ONLY),
-        IB_OPCODE(UD, SEND_ONLY_WITH_IMMEDIATE)
-};
-
-enum {
-        IB_LNH_RAW        = 0,
-        IB_LNH_IP         = 1,
-        IB_LNH_IBA_LOCAL  = 2,
-        IB_LNH_IBA_GLOBAL = 3
-};
-
-struct ib_unpacked_lrh {
-        u8        virtual_lane;
-        u8        link_version;
-        u8        service_level;
-        u8        link_next_header;
-        __be16    destination_lid;
-        __be16    packet_length;
-        __be16    source_lid;
-};
-
-struct ib_unpacked_grh {
-        u8           ip_version;
-        u8           traffic_class;
-        __be32       flow_label;
-        __be16       payload_length;
-        u8           next_header;
-        u8           hop_limit;
-        union ib_gid source_gid;
-        union ib_gid destination_gid;
-};
-
-struct ib_unpacked_bth {
-        u8           opcode;
-        u8           solicited_event;
-        u8           mig_req;
-        u8           pad_count;
-        u8           transport_header_version;
-        __be16       pkey;
-        __be32       destination_qpn;
-        u8           ack_req;
-        __be32       psn;
-};
-
-struct ib_unpacked_deth {
-        __be32       qkey;
-        __be32       source_qpn;
-};
-
-struct ib_ud_header {
-        struct ib_unpacked_lrh  lrh;
-        int                     grh_present;
-        struct ib_unpacked_grh  grh;
-        struct ib_unpacked_bth  bth;
-        struct ib_unpacked_deth deth;
-        int                     immediate_present;
-        __be32                  immediate_data;
-};
-
-void ib_pack(const struct ib_field        *desc,
-             int                           desc_len,
-             void                         *structure,
-             void                         *buf);
-
-void ib_unpack(const struct ib_field        *desc,
-               int                           desc_len,
-               void                         *buf,
-               void                         *structure);
-
-void ib_ud_header_init(int                 payload_bytes,
-                       int                 grh_present,
-                       struct ib_ud_header *header);
-
-int ib_ud_header_pack(struct ib_ud_header *header,
-                      void                *buf);
-
-int ib_ud_header_unpack(void                *buf,
-                        struct ib_ud_header *header);
-
-#endif /* IB_PACK_H */
diff --git a/drivers/infiniband/include/ib_sa.h b/drivers/infiniband/include/ib_sa.h
deleted file mode 100644
index 6d999f7b5d93..000000000000
--- a/drivers/infiniband/include/ib_sa.h
+++ /dev/null
@@ -1,373 +0,0 @@
-/*
- * Copyright (c) 2004 Topspin Communications.  All rights reserved.
- * Copyright (c) 2005 Voltaire, Inc.  All rights reserved.
- *
- * This software is available to you under a choice of one of two
- * licenses.  You may choose to be licensed under the terms of the GNU
- * General Public License (GPL) Version 2, available from the file
- * COPYING in the main directory of this source tree, or the
- * OpenIB.org BSD license below:
- *
- *     Redistribution and use in source and binary forms, with or
- *     without modification, are permitted provided that the following
- *     conditions are met:
- *
- *      - Redistributions of source code must retain the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer.
- *
- *      - Redistributions in binary form must reproduce the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer in the documentation and/or other materials
- *        provided with the distribution.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- *
- * $Id: ib_sa.h 2811 2005-07-06 18:11:43Z halr $
- */
-
-#ifndef IB_SA_H
-#define IB_SA_H
-
-#include <linux/compiler.h>
-
-#include <ib_verbs.h>
-#include <ib_mad.h>
-
-enum {
-        IB_SA_CLASS_VERSION             = 2,    /* IB spec version 1.1/1.2 */
-
-        IB_SA_METHOD_GET_TABLE          = 0x12,
-        IB_SA_METHOD_GET_TABLE_RESP     = 0x92,
-        IB_SA_METHOD_DELETE             = 0x15
-};
-
-enum ib_sa_selector {
-        IB_SA_GTE  = 0,
-        IB_SA_LTE  = 1,
-        IB_SA_EQ   = 2,
-        /*
-         * The meaning of "best" depends on the attribute: for
-         * example, for MTU best will return the largest available
-         * MTU, while for packet life time, best will return the
-         * smallest available life time.
-         */
-        IB_SA_BEST = 3
-};
-
-enum ib_sa_rate {
-        IB_SA_RATE_2_5_GBPS = 2,
-        IB_SA_RATE_5_GBPS   = 5,
-        IB_SA_RATE_10_GBPS  = 3,
-        IB_SA_RATE_20_GBPS  = 6,
-        IB_SA_RATE_30_GBPS  = 4,
-        IB_SA_RATE_40_GBPS  = 7,
-        IB_SA_RATE_60_GBPS  = 8,
-        IB_SA_RATE_80_GBPS  = 9,
-        IB_SA_RATE_120_GBPS = 10
-};
-
-static inline int ib_sa_rate_enum_to_int(enum ib_sa_rate rate)
-{
-        switch (rate) {
-        case IB_SA_RATE_2_5_GBPS: return  1;
-        case IB_SA_RATE_5_GBPS:   return  2;
-        case IB_SA_RATE_10_GBPS:  return  4;
-        case IB_SA_RATE_20_GBPS:  return  8;
-        case IB_SA_RATE_30_GBPS:  return 12;
-        case IB_SA_RATE_40_GBPS:  return 16;
-        case IB_SA_RATE_60_GBPS:  return 24;
-        case IB_SA_RATE_80_GBPS:  return 32;
-        case IB_SA_RATE_120_GBPS: return 48;
-        default:                  return -1;
-        }
-}
-
-/*
- * Structures for SA records are named "struct ib_sa_xxx_rec."  No
- * attempt is made to pack structures to match the physical layout of
- * SA records in SA MADs; all packing and unpacking is handled by the
- * SA query code.
- *
- * For a record with structure ib_sa_xxx_rec, the naming convention
- * for the component mask value for field yyy is IB_SA_XXX_REC_YYY (we
- * never use different abbreviations or otherwise change the spelling
- * of xxx/yyy between ib_sa_xxx_rec.yyy and IB_SA_XXX_REC_YYY).
- *
- * Reserved rows are indicated with comments to help maintainability.
- */
-
-/* reserved:                                                             0 */
-/* reserved:                                                             1 */
-#define IB_SA_PATH_REC_DGID                             IB_SA_COMP_MASK( 2)
-#define IB_SA_PATH_REC_SGID                             IB_SA_COMP_MASK( 3)
-#define IB_SA_PATH_REC_DLID                             IB_SA_COMP_MASK( 4)
-#define IB_SA_PATH_REC_SLID                             IB_SA_COMP_MASK( 5)
-#define IB_SA_PATH_REC_RAW_TRAFFIC                      IB_SA_COMP_MASK( 6)
-/* reserved:                                                             7 */
-#define IB_SA_PATH_REC_FLOW_LABEL                       IB_SA_COMP_MASK( 8)
-#define IB_SA_PATH_REC_HOP_LIMIT                        IB_SA_COMP_MASK( 9)
-#define IB_SA_PATH_REC_TRAFFIC_CLASS                    IB_SA_COMP_MASK(10)
-#define IB_SA_PATH_REC_REVERSIBLE                       IB_SA_COMP_MASK(11)
-#define IB_SA_PATH_REC_NUMB_PATH                        IB_SA_COMP_MASK(12)
-#define IB_SA_PATH_REC_PKEY                             IB_SA_COMP_MASK(13)
-/* reserved:                                                            14 */
-#define IB_SA_PATH_REC_SL                               IB_SA_COMP_MASK(15)
-#define IB_SA_PATH_REC_MTU_SELECTOR                     IB_SA_COMP_MASK(16)
-#define IB_SA_PATH_REC_MTU                              IB_SA_COMP_MASK(17)
-#define IB_SA_PATH_REC_RATE_SELECTOR                    IB_SA_COMP_MASK(18)
-#define IB_SA_PATH_REC_RATE                             IB_SA_COMP_MASK(19)
-#define IB_SA_PATH_REC_PACKET_LIFE_TIME_SELECTOR        IB_SA_COMP_MASK(20)
-#define IB_SA_PATH_REC_PACKET_LIFE_TIME                 IB_SA_COMP_MASK(21)
-#define IB_SA_PATH_REC_PREFERENCE                       IB_SA_COMP_MASK(22)
-
-struct ib_sa_path_rec {
-        /* reserved */
-        /* reserved */
-        union ib_gid dgid;
-        union ib_gid sgid;
-        u16          dlid;
-        u16          slid;
-        int          raw_traffic;
-        /* reserved */
-        u32          flow_label;
-        u8           hop_limit;
-        u8           traffic_class;
-        int          reversible;
-        u8           numb_path;
-        u16          pkey;
-        /* reserved */
-        u8           sl;
-        u8           mtu_selector;
-        u8           mtu;
-        u8           rate_selector;
-        u8           rate;
-        u8           packet_life_time_selector;
-        u8           packet_life_time;
-        u8           preference;
-};
-
-#define IB_SA_MCMEMBER_REC_MGID                         IB_SA_COMP_MASK( 0)
-#define IB_SA_MCMEMBER_REC_PORT_GID                     IB_SA_COMP_MASK( 1)
-#define IB_SA_MCMEMBER_REC_QKEY                         IB_SA_COMP_MASK( 2)
-#define IB_SA_MCMEMBER_REC_MLID                         IB_SA_COMP_MASK( 3)
-#define IB_SA_MCMEMBER_REC_MTU_SELECTOR                 IB_SA_COMP_MASK( 4)
-#define IB_SA_MCMEMBER_REC_MTU                          IB_SA_COMP_MASK( 5)
-#define IB_SA_MCMEMBER_REC_TRAFFIC_CLASS                IB_SA_COMP_MASK( 6)
-#define IB_SA_MCMEMBER_REC_PKEY                         IB_SA_COMP_MASK( 7)
-#define IB_SA_MCMEMBER_REC_RATE_SELECTOR                IB_SA_COMP_MASK( 8)
-#define IB_SA_MCMEMBER_REC_RATE                         IB_SA_COMP_MASK( 9)
-#define IB_SA_MCMEMBER_REC_PACKET_LIFE_TIME_SELECTOR    IB_SA_COMP_MASK(10)
-#define IB_SA_MCMEMBER_REC_PACKET_LIFE_TIME             IB_SA_COMP_MASK(11)
-#define IB_SA_MCMEMBER_REC_SL                           IB_SA_COMP_MASK(12)
-#define IB_SA_MCMEMBER_REC_FLOW_LABEL                   IB_SA_COMP_MASK(13)
-#define IB_SA_MCMEMBER_REC_HOP_LIMIT                    IB_SA_COMP_MASK(14)
-#define IB_SA_MCMEMBER_REC_SCOPE                        IB_SA_COMP_MASK(15)
-#define IB_SA_MCMEMBER_REC_JOIN_STATE                   IB_SA_COMP_MASK(16)
-#define IB_SA_MCMEMBER_REC_PROXY_JOIN                   IB_SA_COMP_MASK(17)
-
-struct ib_sa_mcmember_rec {
-        union ib_gid mgid;
-        union ib_gid port_gid;
-        u32          qkey;
-        u16          mlid;
-        u8           mtu_selector;
-        u8           mtu;
-        u8           traffic_class;
-        u16          pkey;
-        u8           rate_selector;
-        u8           rate;
-        u8           packet_life_time_selector;
-        u8           packet_life_time;
-        u8           sl;
-        u32          flow_label;
-        u8           hop_limit;
-        u8           scope;
-        u8           join_state;
-        int          proxy_join;
-};
-
-/* Service Record Component Mask Sec 15.2.5.14 Ver 1.1  */
-#define IB_SA_SERVICE_REC_SERVICE_ID                    IB_SA_COMP_MASK( 0)
-#define IB_SA_SERVICE_REC_SERVICE_GID                   IB_SA_COMP_MASK( 1)
-#define IB_SA_SERVICE_REC_SERVICE_PKEY                  IB_SA_COMP_MASK( 2)
-/* reserved:                                                             3 */
-#define IB_SA_SERVICE_REC_SERVICE_LEASE                 IB_SA_COMP_MASK( 4)
-#define IB_SA_SERVICE_REC_SERVICE_KEY                   IB_SA_COMP_MASK( 5)
-#define IB_SA_SERVICE_REC_SERVICE_NAME                  IB_SA_COMP_MASK( 6)
-#define IB_SA_SERVICE_REC_SERVICE_DATA8_0               IB_SA_COMP_MASK( 7)
-#define IB_SA_SERVICE_REC_SERVICE_DATA8_1               IB_SA_COMP_MASK( 8)
-#define IB_SA_SERVICE_REC_SERVICE_DATA8_2               IB_SA_COMP_MASK( 9)
-#define IB_SA_SERVICE_REC_SERVICE_DATA8_3               IB_SA_COMP_MASK(10)
-#define IB_SA_SERVICE_REC_SERVICE_DATA8_4               IB_SA_COMP_MASK(11)
-#define IB_SA_SERVICE_REC_SERVICE_DATA8_5               IB_SA_COMP_MASK(12)
-#define IB_SA_SERVICE_REC_SERVICE_DATA8_6               IB_SA_COMP_MASK(13)
-#define IB_SA_SERVICE_REC_SERVICE_DATA8_7               IB_SA_COMP_MASK(14)
-#define IB_SA_SERVICE_REC_SERVICE_DATA8_8               IB_SA_COMP_MASK(15)
-#define IB_SA_SERVICE_REC_SERVICE_DATA8_9               IB_SA_COMP_MASK(16)
-#define IB_SA_SERVICE_REC_SERVICE_DATA8_10              IB_SA_COMP_MASK(17)
-#define IB_SA_SERVICE_REC_SERVICE_DATA8_11              IB_SA_COMP_MASK(18)
-#define IB_SA_SERVICE_REC_SERVICE_DATA8_12              IB_SA_COMP_MASK(19)
-#define IB_SA_SERVICE_REC_SERVICE_DATA8_13              IB_SA_COMP_MASK(20)
-#define IB_SA_SERVICE_REC_SERVICE_DATA8_14              IB_SA_COMP_MASK(21)
-#define IB_SA_SERVICE_REC_SERVICE_DATA8_15              IB_SA_COMP_MASK(22)
-#define IB_SA_SERVICE_REC_SERVICE_DATA16_0              IB_SA_COMP_MASK(23)
-#define IB_SA_SERVICE_REC_SERVICE_DATA16_1              IB_SA_COMP_MASK(24)
-#define IB_SA_SERVICE_REC_SERVICE_DATA16_2              IB_SA_COMP_MASK(25)
-#define IB_SA_SERVICE_REC_SERVICE_DATA16_3              IB_SA_COMP_MASK(26)
-#define IB_SA_SERVICE_REC_SERVICE_DATA16_4              IB_SA_COMP_MASK(27)
-#define IB_SA_SERVICE_REC_SERVICE_DATA16_5              IB_SA_COMP_MASK(28)
-#define IB_SA_SERVICE_REC_SERVICE_DATA16_6              IB_SA_COMP_MASK(29)
-#define IB_SA_SERVICE_REC_SERVICE_DATA16_7              IB_SA_COMP_MASK(30)
-#define IB_SA_SERVICE_REC_SERVICE_DATA32_0              IB_SA_COMP_MASK(31)
-#define IB_SA_SERVICE_REC_SERVICE_DATA32_1              IB_SA_COMP_MASK(32)
-#define IB_SA_SERVICE_REC_SERVICE_DATA32_2              IB_SA_COMP_MASK(33)
-#define IB_SA_SERVICE_REC_SERVICE_DATA32_3              IB_SA_COMP_MASK(34)
-#define IB_SA_SERVICE_REC_SERVICE_DATA64_0              IB_SA_COMP_MASK(35)
-#define IB_SA_SERVICE_REC_SERVICE_DATA64_1              IB_SA_COMP_MASK(36)
-
-#define IB_DEFAULT_SERVICE_LEASE        0xFFFFFFFF
-
-struct ib_sa_service_rec {
-        u64             id;
-        union ib_gid    gid;
-        u16             pkey;
-        /* reserved */
-        u32             lease;
-        u8              key[16];
-        u8              name[64];
-        u8              data8[16];
-        u16             data16[8];
-        u32             data32[4];
-        u64             data64[2];
-};
-
-struct ib_sa_query;
-
-void ib_sa_cancel_query(int id, struct ib_sa_query *query);
-
-int ib_sa_path_rec_get(struct ib_device *device, u8 port_num,
-                       struct ib_sa_path_rec *rec,
-                       ib_sa_comp_mask comp_mask,
-                       int timeout_ms, unsigned int __nocast gfp_mask,
-                       void (*callback)(int status,
-                                        struct ib_sa_path_rec *resp,
-                                        void *context),
-                       void *context,
-                       struct ib_sa_query **query);
-
-int ib_sa_mcmember_rec_query(struct ib_device *device, u8 port_num,
-                             u8 method,
-                             struct ib_sa_mcmember_rec *rec,
-                             ib_sa_comp_mask comp_mask,
-                             int timeout_ms, unsigned int __nocast gfp_mask,
-                             void (*callback)(int status,
-                                              struct ib_sa_mcmember_rec *resp,
-                                              void *context),
-                             void *context,
-                             struct ib_sa_query **query);
-
-int ib_sa_service_rec_query(struct ib_device *device, u8 port_num,
-                         u8 method,
-                         struct ib_sa_service_rec *rec,
-                         ib_sa_comp_mask comp_mask,
-                         int timeout_ms, unsigned int __nocast gfp_mask,
-                         void (*callback)(int status,
-                                          struct ib_sa_service_rec *resp,
-                                          void *context),
-                         void *context,
-                         struct ib_sa_query **sa_query);
-
-/**
- * ib_sa_mcmember_rec_set - Start an MCMember set query
- * @device:device to send query on
- * @port_num: port number to send query on
- * @rec:MCMember Record to send in query
- * @comp_mask:component mask to send in query
- * @timeout_ms:time to wait for response
- * @gfp_mask:GFP mask to use for internal allocations
- * @callback:function called when query completes, times out or is
- * canceled
- * @context:opaque user context passed to callback
- * @sa_query:query context, used to cancel query
- *
- * Send an MCMember Set query to the SA (eg to join a multicast
- * group).  The callback function will be called when the query
- * completes (or fails); status is 0 for a successful response, -EINTR
- * if the query is canceled, -ETIMEDOUT is the query timed out, or
- * -EIO if an error occurred sending the query.  The resp parameter of
- * the callback is only valid if status is 0.
- *
- * If the return value of ib_sa_mcmember_rec_set() is negative, it is
- * an error code.  Otherwise it is a query ID that can be used to
- * cancel the query.
- */
-static inline int
-ib_sa_mcmember_rec_set(struct ib_device *device, u8 port_num,
-                       struct ib_sa_mcmember_rec *rec,
-                       ib_sa_comp_mask comp_mask,
-                       int timeout_ms, unsigned int __nocast gfp_mask,
-                       void (*callback)(int status,
-                                        struct ib_sa_mcmember_rec *resp,
-                                        void *context),
-                       void *context,
-                       struct ib_sa_query **query)
-{
-        return ib_sa_mcmember_rec_query(device, port_num,
-                                        IB_MGMT_METHOD_SET,
-                                        rec, comp_mask,
-                                        timeout_ms, gfp_mask, callback,
-                                        context, query);
-}
-
-/**
- * ib_sa_mcmember_rec_delete - Start an MCMember delete query
- * @device:device to send query on
- * @port_num: port number to send query on
- * @rec:MCMember Record to send in query
- * @comp_mask:component mask to send in query
- * @timeout_ms:time to wait for response
- * @gfp_mask:GFP mask to use for internal allocations
- * @callback:function called when query completes, times out or is
- * canceled
- * @context:opaque user context passed to callback
- * @sa_query:query context, used to cancel query
- *
- * Send an MCMember Delete query to the SA (eg to leave a multicast
- * group).  The callback function will be called when the query
- * completes (or fails); status is 0 for a successful response, -EINTR
- * if the query is canceled, -ETIMEDOUT is the query timed out, or
- * -EIO if an error occurred sending the query.  The resp parameter of
- * the callback is only valid if status is 0.
- *
- * If the return value of ib_sa_mcmember_rec_delete() is negative, it
- * is an error code.  Otherwise it is a query ID that can be used to
- * cancel the query.
- */
-static inline int
-ib_sa_mcmember_rec_delete(struct ib_device *device, u8 port_num,
-                          struct ib_sa_mcmember_rec *rec,
-                          ib_sa_comp_mask comp_mask,
-                          int timeout_ms, unsigned int __nocast gfp_mask,
-                          void (*callback)(int status,
-                                           struct ib_sa_mcmember_rec *resp,
-                                           void *context),
-                          void *context,
-                          struct ib_sa_query **query)
-{
-        return ib_sa_mcmember_rec_query(device, port_num,
-                                        IB_SA_METHOD_DELETE,
-                                        rec, comp_mask,
-                                        timeout_ms, gfp_mask, callback,
-                                        context, query);
-}
-
-
-#endif /* IB_SA_H */
diff --git a/drivers/infiniband/include/ib_smi.h b/drivers/infiniband/include/ib_smi.h
deleted file mode 100644
index ca8216514963..000000000000
--- a/drivers/infiniband/include/ib_smi.h
+++ /dev/null
@@ -1,96 +0,0 @@
-/*
- * Copyright (c) 2004 Mellanox Technologies Ltd.  All rights reserved.
- * Copyright (c) 2004 Infinicon Corporation.  All rights reserved.
- * Copyright (c) 2004 Intel Corporation.  All rights reserved.
- * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
- * Copyright (c) 2004 Voltaire Corporation.  All rights reserved.
- *
- * This software is available to you under a choice of one of two
- * licenses.  You may choose to be licensed under the terms of the GNU
- * General Public License (GPL) Version 2, available from the file
- * COPYING in the main directory of this source tree, or the
- * OpenIB.org BSD license below:
- *
- *     Redistribution and use in source and binary forms, with or
- *     without modification, are permitted provided that the following
- *     conditions are met:
- *
- *      - Redistributions of source code must retain the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer.
- *
- *      - Redistributions in binary form must reproduce the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer in the documentation and/or other materials
- *        provided with the distribution.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- *
- * $Id: ib_smi.h 1389 2004-12-27 22:56:47Z roland $
- */
-
-#if !defined( IB_SMI_H )
-#define IB_SMI_H
-
-#include <ib_mad.h>
-
-#define IB_LID_PERMISSIVE                       0xFFFF
-
-#define IB_SMP_DATA_SIZE                        64
-#define IB_SMP_MAX_PATH_HOPS                    64
-
-struct ib_smp {
-        u8      base_version;
-        u8      mgmt_class;
-        u8      class_version;
-        u8      method;
-        u16     status;
-        u8      hop_ptr;
-        u8      hop_cnt;
-        u64     tid;
-        u16     attr_id;
-        u16     resv;
-        u32     attr_mod;
-        u64     mkey;
-        u16     dr_slid;
-        u16     dr_dlid;
-        u8      reserved[28];
-        u8      data[IB_SMP_DATA_SIZE];
-        u8      initial_path[IB_SMP_MAX_PATH_HOPS];
-        u8      return_path[IB_SMP_MAX_PATH_HOPS];
-} __attribute__ ((packed));
-
-#define IB_SMP_DIRECTION                        __constant_htons(0x8000)
-
-/* Subnet management attributes */
-#define IB_SMP_ATTR_NOTICE                      __constant_htons(0x0002)
-#define IB_SMP_ATTR_NODE_DESC                   __constant_htons(0x0010)
-#define IB_SMP_ATTR_NODE_INFO                   __constant_htons(0x0011)
-#define IB_SMP_ATTR_SWITCH_INFO                 __constant_htons(0x0012)
-#define IB_SMP_ATTR_GUID_INFO                   __constant_htons(0x0014)
-#define IB_SMP_ATTR_PORT_INFO                   __constant_htons(0x0015)
-#define IB_SMP_ATTR_PKEY_TABLE                  __constant_htons(0x0016)
-#define IB_SMP_ATTR_SL_TO_VL_TABLE              __constant_htons(0x0017)
-#define IB_SMP_ATTR_VL_ARB_TABLE                __constant_htons(0x0018)
-#define IB_SMP_ATTR_LINEAR_FORWARD_TABLE        __constant_htons(0x0019)
-#define IB_SMP_ATTR_RANDOM_FORWARD_TABLE        __constant_htons(0x001A)
-#define IB_SMP_ATTR_MCAST_FORWARD_TABLE         __constant_htons(0x001B)
-#define IB_SMP_ATTR_SM_INFO                     __constant_htons(0x0020)
-#define IB_SMP_ATTR_VENDOR_DIAG                 __constant_htons(0x0030)
-#define IB_SMP_ATTR_LED_INFO                    __constant_htons(0x0031)
-#define IB_SMP_ATTR_VENDOR_MASK                 __constant_htons(0xFF00)
-
-static inline u8
-ib_get_smp_direction(struct ib_smp *smp)
-{
-        return ((smp->status & IB_SMP_DIRECTION) == IB_SMP_DIRECTION);
-}
-
-#endif /* IB_SMI_H */
diff --git a/drivers/infiniband/include/ib_user_cm.h b/drivers/infiniband/include/ib_user_cm.h
deleted file mode 100644
index 500b1af6ff77..000000000000
--- a/drivers/infiniband/include/ib_user_cm.h
+++ /dev/null
@@ -1,328 +0,0 @@
-/*
- * Copyright (c) 2005 Topspin Communications.  All rights reserved.
- *
- * This software is available to you under a choice of one of two
- * licenses.  You may choose to be licensed under the terms of the GNU
- * General Public License (GPL) Version 2, available from the file
- * COPYING in the main directory of this source tree, or the
- * OpenIB.org BSD license below:
- *
- *     Redistribution and use in source and binary forms, with or
- *     without modification, are permitted provided that the following
- *     conditions are met:
- *
- *      - Redistributions of source code must retain the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer.
- *
- *      - Redistributions in binary form must reproduce the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer in the documentation and/or other materials
- *        provided with the distribution.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- *
- * $Id: ib_user_cm.h 2576 2005-06-09 17:00:30Z libor $
- */
-
-#ifndef IB_USER_CM_H
-#define IB_USER_CM_H
-
-#include <linux/types.h>
-
-#define IB_USER_CM_ABI_VERSION 1
-
-enum {
-        IB_USER_CM_CMD_CREATE_ID,
-        IB_USER_CM_CMD_DESTROY_ID,
-        IB_USER_CM_CMD_ATTR_ID,
-
-        IB_USER_CM_CMD_LISTEN,
-        IB_USER_CM_CMD_ESTABLISH,
-
-        IB_USER_CM_CMD_SEND_REQ,
-        IB_USER_CM_CMD_SEND_REP,
-        IB_USER_CM_CMD_SEND_RTU,
-        IB_USER_CM_CMD_SEND_DREQ,
-        IB_USER_CM_CMD_SEND_DREP,
-        IB_USER_CM_CMD_SEND_REJ,
-        IB_USER_CM_CMD_SEND_MRA,
-        IB_USER_CM_CMD_SEND_LAP,
-        IB_USER_CM_CMD_SEND_APR,
-        IB_USER_CM_CMD_SEND_SIDR_REQ,
-        IB_USER_CM_CMD_SEND_SIDR_REP,
-
-        IB_USER_CM_CMD_EVENT,
-};
-/*
- * command ABI structures.
- */
-struct ib_ucm_cmd_hdr {
-        __u32 cmd;
-        __u16 in;
-        __u16 out;
-};
-
-struct ib_ucm_create_id {
-        __u64 response;
-};
-
-struct ib_ucm_create_id_resp {
-        __u32 id;
-};
-
-struct ib_ucm_destroy_id {
-        __u32 id;
-};
-
-struct ib_ucm_attr_id {
-        __u64 response;
-        __u32 id;
-};
-
-struct ib_ucm_attr_id_resp {
-        __u64 service_id;
-        __u64 service_mask;
-        __u32 local_id;
-        __u32 remote_id;
-};
-
-struct ib_ucm_listen {
-        __u64 service_id;
-        __u64 service_mask;
-        __u32 id;
-};
-
-struct ib_ucm_establish {
-        __u32 id;
-};
-
-struct ib_ucm_private_data {
-        __u64 data;
-        __u32 id;
-        __u8  len;
-        __u8  reserved[3];
-};
-
-struct ib_ucm_path_rec {
-        __u8  dgid[16];
-        __u8  sgid[16];
-        __u16 dlid;
-        __u16 slid;
-        __u32 raw_traffic;
-        __u32 flow_label;
-        __u32 reversible;
-        __u32 mtu;
-        __u16 pkey;
-        __u8  hop_limit;
-        __u8  traffic_class;
-        __u8  numb_path;
-        __u8  sl;
-        __u8  mtu_selector;
-        __u8  rate_selector;
-        __u8  rate;
-        __u8  packet_life_time_selector;
-        __u8  packet_life_time;
-        __u8  preference;
-};
-
-struct ib_ucm_req {
-        __u32 id;
-        __u32 qpn;
-        __u32 qp_type;
-        __u32 psn;
-        __u64 sid;
-        __u64 data;
-        __u64 primary_path;
-        __u64 alternate_path;
-        __u8  len;
-        __u8  peer_to_peer;
-        __u8  responder_resources;
-        __u8  initiator_depth;
-        __u8  remote_cm_response_timeout;
-        __u8  flow_control;
-        __u8  local_cm_response_timeout;
-        __u8  retry_count;
-        __u8  rnr_retry_count;
-        __u8  max_cm_retries;
-        __u8  srq;
-        __u8  reserved[1];
-};
-
-struct ib_ucm_rep {
-        __u64 data;
-        __u32 id;
-        __u32 qpn;
-        __u32 psn;
-        __u8  len;
-        __u8  responder_resources;
-        __u8  initiator_depth;
-        __u8  target_ack_delay;
-        __u8  failover_accepted;
-        __u8  flow_control;
-        __u8  rnr_retry_count;
-        __u8  srq;
-};
-
-struct ib_ucm_info {
-        __u32 id;
-        __u32 status;
-        __u64 info;
-        __u64 data;
-        __u8  info_len;
-        __u8  data_len;
-        __u8  reserved[2];
-};
-
-struct ib_ucm_mra {
-        __u64 data;
-        __u32 id;
-        __u8  len;
-        __u8  timeout;
-        __u8  reserved[2];
-};
-
-struct ib_ucm_lap {
-        __u64 path;
-        __u64 data;
-        __u32 id;
-        __u8  len;
-        __u8  reserved[3];
-};
-
-struct ib_ucm_sidr_req {
-        __u32 id;
-        __u32 timeout;
-        __u64 sid;
-        __u64 data;
-        __u64 path;
-        __u16 pkey;
-        __u8  len;
-        __u8  max_cm_retries;
-};
-
-struct ib_ucm_sidr_rep {
-        __u32 id;
-        __u32 qpn;
-        __u32 qkey;
-        __u32 status;
-        __u64 info;
-        __u64 data;
-        __u8  info_len;
-        __u8  data_len;
-        __u8  reserved[2];
-};
-/*
- * event notification ABI structures.
- */
-struct ib_ucm_event_get {
-        __u64 response;
-        __u64 data;
-        __u64 info;
-        __u8  data_len;
-        __u8  info_len;
-        __u8  reserved[2];
-};
-
-struct ib_ucm_req_event_resp {
-        __u32                  listen_id;
-        /* device */
-        /* port */
-        struct ib_ucm_path_rec primary_path;
-        struct ib_ucm_path_rec alternate_path;
-        __u64                  remote_ca_guid;
-        __u32                  remote_qkey;
-        __u32                  remote_qpn;
-        __u32                  qp_type;
-        __u32                  starting_psn;
-        __u8  responder_resources;
-        __u8  initiator_depth;
-        __u8  local_cm_response_timeout;
-        __u8  flow_control;
-        __u8  remote_cm_response_timeout;
-        __u8  retry_count;
-        __u8  rnr_retry_count;
-        __u8  srq;
-};
-
-struct ib_ucm_rep_event_resp {
-        __u64 remote_ca_guid;
-        __u32 remote_qkey;
-        __u32 remote_qpn;
-        __u32 starting_psn;
-        __u8  responder_resources;
-        __u8  initiator_depth;
-        __u8  target_ack_delay;
-        __u8  failover_accepted;
-        __u8  flow_control;
-        __u8  rnr_retry_count;
-        __u8  srq;
-        __u8  reserved[1];
-};
-
-struct ib_ucm_rej_event_resp {
-        __u32 reason;
-        /* ari in ib_ucm_event_get info field. */
-};
-
-struct ib_ucm_mra_event_resp {
-        __u8  timeout;
-        __u8  reserved[3];
-};
-
-struct ib_ucm_lap_event_resp {
-        struct ib_ucm_path_rec path;
-};
-
-struct ib_ucm_apr_event_resp {
-        __u32 status;
-        /* apr info in ib_ucm_event_get info field. */
-};
-
-struct ib_ucm_sidr_req_event_resp {
-        __u32 listen_id;
-        /* device */
-        /* port */
-        __u16 pkey;
-        __u8  reserved[2];
-};
-
-struct ib_ucm_sidr_rep_event_resp {
-        __u32 status;
-        __u32 qkey;
-        __u32 qpn;
-        /* info in ib_ucm_event_get info field. */
-};
-
-#define IB_UCM_PRES_DATA      0x01
-#define IB_UCM_PRES_INFO      0x02
-#define IB_UCM_PRES_PRIMARY   0x04
-#define IB_UCM_PRES_ALTERNATE 0x08
-
-struct ib_ucm_event_resp {
-        __u32 id;
-        __u32 event;
-        __u32 present;
-        union {
-                struct ib_ucm_req_event_resp req_resp;
-                struct ib_ucm_rep_event_resp rep_resp;
-                struct ib_ucm_rej_event_resp rej_resp;
-                struct ib_ucm_mra_event_resp mra_resp;
-                struct ib_ucm_lap_event_resp lap_resp;
-                struct ib_ucm_apr_event_resp apr_resp;
-
-                struct ib_ucm_sidr_req_event_resp sidr_req_resp;
-                struct ib_ucm_sidr_rep_event_resp sidr_rep_resp;
-
-                __u32                             send_status;
-        } u;
-};
-
-#endif /* IB_USER_CM_H */
diff --git a/drivers/infiniband/include/ib_user_mad.h b/drivers/infiniband/include/ib_user_mad.h
deleted file mode 100644
index a9a56b50aacc..000000000000
--- a/drivers/infiniband/include/ib_user_mad.h
+++ /dev/null
@@ -1,139 +0,0 @@
-/*
- * Copyright (c) 2004 Topspin Communications.  All rights reserved.
- * Copyright (c) 2005 Voltaire, Inc. All rights reserved.
- *
- * This software is available to you under a choice of one of two
- * licenses.  You may choose to be licensed under the terms of the GNU
- * General Public License (GPL) Version 2, available from the file
- * COPYING in the main directory of this source tree, or the
- * OpenIB.org BSD license below:
- *
- *     Redistribution and use in source and binary forms, with or
- *     without modification, are permitted provided that the following
- *     conditions are met:
- *
- *      - Redistributions of source code must retain the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer.
- *
- *      - Redistributions in binary form must reproduce the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer in the documentation and/or other materials
- *        provided with the distribution.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- *
- * $Id: ib_user_mad.h 2814 2005-07-06 19:14:09Z halr $
- */
-
-#ifndef IB_USER_MAD_H
-#define IB_USER_MAD_H
-
-#include <linux/types.h>
-#include <linux/ioctl.h>
-
-/*
- * Increment this value if any changes that break userspace ABI
- * compatibility are made.
- */
-#define IB_USER_MAD_ABI_VERSION 5
-
-/*
- * Make sure that all structs defined in this file remain laid out so
- * that they pack the same way on 32-bit and 64-bit architectures (to
- * avoid incompatibility between 32-bit userspace and 64-bit kernels).
- */
-
-/**
- * ib_user_mad_hdr - MAD packet header
- * @id - ID of agent MAD received with/to be sent with
- * @status - 0 on successful receive, ETIMEDOUT if no response
- *   received (transaction ID in data[] will be set to TID of original
- *   request) (ignored on send)
- * @timeout_ms - Milliseconds to wait for response (unset on receive)
- * @retries - Number of automatic retries to attempt
- * @qpn - Remote QP number received from/to be sent to
- * @qkey - Remote Q_Key to be sent with (unset on receive)
- * @lid - Remote lid received from/to be sent to
- * @sl - Service level received with/to be sent with
- * @path_bits - Local path bits received with/to be sent with
- * @grh_present - If set, GRH was received/should be sent
- * @gid_index - Local GID index to send with (unset on receive)
- * @hop_limit - Hop limit in GRH
- * @traffic_class - Traffic class in GRH
- * @gid - Remote GID in GRH
- * @flow_label - Flow label in GRH
- *
- * All multi-byte quantities are stored in network (big endian) byte order.
- */
-struct ib_user_mad_hdr {
-        __u32   id;
-        __u32   status;
-        __u32   timeout_ms;
-        __u32   retries;
-        __u32   length;
-        __u32   qpn;
-        __u32   qkey;
-        __u16   lid;
-        __u8    sl;
-        __u8    path_bits;
-        __u8    grh_present;
-        __u8    gid_index;
-        __u8    hop_limit;
-        __u8    traffic_class;
-        __u8    gid[16];
-        __u32   flow_label;
-};
-
-/**
- * ib_user_mad - MAD packet
- * @hdr - MAD packet header
- * @data - Contents of MAD
- *
- */
-struct ib_user_mad {
-        struct ib_user_mad_hdr hdr;
-        __u8    data[0];
-};
-
-/**
- * ib_user_mad_reg_req - MAD registration request
- * @id - Set by the kernel; used to identify agent in future requests.
- * @qpn - Queue pair number; must be 0 or 1.
- * @method_mask - The caller will receive unsolicited MADs for any method
- *   where @method_mask = 1.
- * @mgmt_class - Indicates which management class of MADs should be receive
- *   by the caller.  This field is only required if the user wishes to
- *   receive unsolicited MADs, otherwise it should be 0.
- * @mgmt_class_version - Indicates which version of MADs for the given
- *   management class to receive.
- * @oui: Indicates IEEE OUI when mgmt_class is a vendor class
- *   in the range from 0x30 to 0x4f. Otherwise not used.
- * @rmpp_version: If set, indicates the RMPP version used.
- *
- */
-struct ib_user_mad_reg_req {
-        __u32   id;
-        __u32   method_mask[4];
-        __u8    qpn;
-        __u8    mgmt_class;
-        __u8    mgmt_class_version;
-        __u8    oui[3];
-        __u8    rmpp_version;
-};
-
-#define IB_IOCTL_MAGIC          0x1b
-
-#define IB_USER_MAD_REGISTER_AGENT      _IOWR(IB_IOCTL_MAGIC, 1, \
-                                              struct ib_user_mad_reg_req)
-
-#define IB_USER_MAD_UNREGISTER_AGENT    _IOW(IB_IOCTL_MAGIC, 2, __u32)
-
-#endif /* IB_USER_MAD_H */
diff --git a/drivers/infiniband/include/ib_user_verbs.h b/drivers/infiniband/include/ib_user_verbs.h
deleted file mode 100644
index 7c613706af72..000000000000
--- a/drivers/infiniband/include/ib_user_verbs.h
+++ /dev/null
@@ -1,389 +0,0 @@
-/*
- * Copyright (c) 2005 Topspin Communications.  All rights reserved.
- * Copyright (c) 2005 Cisco Systems.  All rights reserved.
- *
- * This software is available to you under a choice of one of two
- * licenses.  You may choose to be licensed under the terms of the GNU
- * General Public License (GPL) Version 2, available from the file
- * COPYING in the main directory of this source tree, or the
- * OpenIB.org BSD license below:
- *
- *     Redistribution and use in source and binary forms, with or
- *     without modification, are permitted provided that the following
- *     conditions are met:
- *
- *      - Redistributions of source code must retain the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer.
- *
- *      - Redistributions in binary form must reproduce the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer in the documentation and/or other materials
- *        provided with the distribution.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- *
- * $Id: ib_user_verbs.h 2708 2005-06-24 17:27:21Z roland $
- */
-
-#ifndef IB_USER_VERBS_H
-#define IB_USER_VERBS_H
-
-#include <linux/types.h>
-
-/*
- * Increment this value if any changes that break userspace ABI
- * compatibility are made.
- */
-#define IB_USER_VERBS_ABI_VERSION       1
-
-enum {
-        IB_USER_VERBS_CMD_QUERY_PARAMS,
-        IB_USER_VERBS_CMD_GET_CONTEXT,
-        IB_USER_VERBS_CMD_QUERY_DEVICE,
-        IB_USER_VERBS_CMD_QUERY_PORT,
-        IB_USER_VERBS_CMD_QUERY_GID,
-        IB_USER_VERBS_CMD_QUERY_PKEY,
-        IB_USER_VERBS_CMD_ALLOC_PD,
-        IB_USER_VERBS_CMD_DEALLOC_PD,
-        IB_USER_VERBS_CMD_CREATE_AH,
-        IB_USER_VERBS_CMD_MODIFY_AH,
-        IB_USER_VERBS_CMD_QUERY_AH,
-        IB_USER_VERBS_CMD_DESTROY_AH,
-        IB_USER_VERBS_CMD_REG_MR,
-        IB_USER_VERBS_CMD_REG_SMR,
-        IB_USER_VERBS_CMD_REREG_MR,
-        IB_USER_VERBS_CMD_QUERY_MR,
-        IB_USER_VERBS_CMD_DEREG_MR,
-        IB_USER_VERBS_CMD_ALLOC_MW,
-        IB_USER_VERBS_CMD_BIND_MW,
-        IB_USER_VERBS_CMD_DEALLOC_MW,
-        IB_USER_VERBS_CMD_CREATE_CQ,
-        IB_USER_VERBS_CMD_RESIZE_CQ,
-        IB_USER_VERBS_CMD_DESTROY_CQ,
-        IB_USER_VERBS_CMD_POLL_CQ,
-        IB_USER_VERBS_CMD_PEEK_CQ,
-        IB_USER_VERBS_CMD_REQ_NOTIFY_CQ,
-        IB_USER_VERBS_CMD_CREATE_QP,
-        IB_USER_VERBS_CMD_QUERY_QP,
-        IB_USER_VERBS_CMD_MODIFY_QP,
-        IB_USER_VERBS_CMD_DESTROY_QP,
-        IB_USER_VERBS_CMD_POST_SEND,
-        IB_USER_VERBS_CMD_POST_RECV,
-        IB_USER_VERBS_CMD_ATTACH_MCAST,
-        IB_USER_VERBS_CMD_DETACH_MCAST
-};
-
-/*
- * Make sure that all structs defined in this file remain laid out so
- * that they pack the same way on 32-bit and 64-bit architectures (to
- * avoid incompatibility between 32-bit userspace and 64-bit kernels).
- * In particular do not use pointer types -- pass pointers in __u64
- * instead.
- */
-
-struct ib_uverbs_async_event_desc {
-        __u64 element;
-        __u32 event_type;       /* enum ib_event_type */
-        __u32 reserved;
-};
-
-struct ib_uverbs_comp_event_desc {
-        __u64 cq_handle;
-};
-
-/*
- * All commands from userspace should start with a __u32 command field
- * followed by __u16 in_words and out_words fields (which give the
- * length of the command block and response buffer if any in 32-bit
- * words).  The kernel driver will read these fields first and read
- * the rest of the command struct based on these value.
- */
-
-struct ib_uverbs_cmd_hdr {
-        __u32 command;
-        __u16 in_words;
-        __u16 out_words;
-};
-
-/*
- * No driver_data for "query params" command, since this is intended
- * to be a core function with no possible device dependence.
- */
-struct ib_uverbs_query_params {
-        __u64 response;
-};
-
-struct ib_uverbs_query_params_resp {
-        __u32 num_cq_events;
-};
-
-struct ib_uverbs_get_context {
-        __u64 response;
-        __u64 cq_fd_tab;
-        __u64 driver_data[0];
-};
-
-struct ib_uverbs_get_context_resp {
-        __u32 async_fd;
-        __u32 reserved;
-};
-
-struct ib_uverbs_query_device {
-        __u64 response;
-        __u64 driver_data[0];
-};
-
-struct ib_uverbs_query_device_resp {
-        __u64 fw_ver;
-        __u64 node_guid;
-        __u64 sys_image_guid;
-        __u64 max_mr_size;
-        __u64 page_size_cap;
-        __u32 vendor_id;
-        __u32 vendor_part_id;
-        __u32 hw_ver;
-        __u32 max_qp;
-        __u32 max_qp_wr;
-        __u32 device_cap_flags;
-        __u32 max_sge;
-        __u32 max_sge_rd;
-        __u32 max_cq;
-        __u32 max_cqe;
-        __u32 max_mr;
-        __u32 max_pd;
-        __u32 max_qp_rd_atom;
-        __u32 max_ee_rd_atom;
-        __u32 max_res_rd_atom;
-        __u32 max_qp_init_rd_atom;
-        __u32 max_ee_init_rd_atom;
-        __u32 atomic_cap;
-        __u32 max_ee;
-        __u32 max_rdd;
-        __u32 max_mw;
-        __u32 max_raw_ipv6_qp;
-        __u32 max_raw_ethy_qp;
-        __u32 max_mcast_grp;
-        __u32 max_mcast_qp_attach;
-        __u32 max_total_mcast_qp_attach;
-        __u32 max_ah;
-        __u32 max_fmr;
-        __u32 max_map_per_fmr;
-        __u32 max_srq;
-        __u32 max_srq_wr;
-        __u32 max_srq_sge;
-        __u16 max_pkeys;
-        __u8  local_ca_ack_delay;
-        __u8  phys_port_cnt;
-        __u8  reserved[4];
-};
-
-struct ib_uverbs_query_port {
-        __u64 response;
-        __u8  port_num;
-        __u8  reserved[7];
-        __u64 driver_data[0];
-};
-
-struct ib_uverbs_query_port_resp {
-        __u32 port_cap_flags;
-        __u32 max_msg_sz;
-        __u32 bad_pkey_cntr;
-        __u32 qkey_viol_cntr;
-        __u32 gid_tbl_len;
-        __u16 pkey_tbl_len;
-        __u16 lid;
-        __u16 sm_lid;
-        __u8  state;
-        __u8  max_mtu;
-        __u8  active_mtu;
-        __u8  lmc;
-        __u8  max_vl_num;
-        __u8  sm_sl;
-        __u8  subnet_timeout;
-        __u8  init_type_reply;
-        __u8  active_width;
-        __u8  active_speed;
-        __u8  phys_state;
-        __u8  reserved[3];
-};
-
-struct ib_uverbs_query_gid {
-        __u64 response;
-        __u8  port_num;
-        __u8  index;
-        __u8  reserved[6];
-        __u64 driver_data[0];
-};
-
-struct ib_uverbs_query_gid_resp {
-        __u8  gid[16];
-};
-
-struct ib_uverbs_query_pkey {
-        __u64 response;
-        __u8  port_num;
-        __u8  index;
-        __u8  reserved[6];
-        __u64 driver_data[0];
-};
-
-struct ib_uverbs_query_pkey_resp {
-        __u16 pkey;
-        __u16 reserved;
-};
-
-struct ib_uverbs_alloc_pd {
-        __u64 response;
-        __u64 driver_data[0];
-};
-
-struct ib_uverbs_alloc_pd_resp {
-        __u32 pd_handle;
-};
-
-struct ib_uverbs_dealloc_pd {
-        __u32 pd_handle;
-};
-
-struct ib_uverbs_reg_mr {
-        __u64 response;
-        __u64 start;
-        __u64 length;
-        __u64 hca_va;
-        __u32 pd_handle;
-        __u32 access_flags;
-        __u64 driver_data[0];
-};
-
-struct ib_uverbs_reg_mr_resp {
-        __u32 mr_handle;
-        __u32 lkey;
-        __u32 rkey;
-};
-
-struct ib_uverbs_dereg_mr {
-        __u32 mr_handle;
-};
-
-struct ib_uverbs_create_cq {
-        __u64 response;
-        __u64 user_handle;
-        __u32 cqe;
-        __u32 event_handler;
-        __u64 driver_data[0];
-};
-
-struct ib_uverbs_create_cq_resp {
-        __u32 cq_handle;
-        __u32 cqe;
-};
-
-struct ib_uverbs_destroy_cq {
-        __u32 cq_handle;
-};
-
-struct ib_uverbs_create_qp {
-        __u64 response;
-        __u64 user_handle;
-        __u32 pd_handle;
-        __u32 send_cq_handle;
-        __u32 recv_cq_handle;
-        __u32 srq_handle;
-        __u32 max_send_wr;
-        __u32 max_recv_wr;
-        __u32 max_send_sge;
-        __u32 max_recv_sge;
-        __u32 max_inline_data;
-        __u8  sq_sig_all;
-        __u8  qp_type;
-        __u8  is_srq;
-        __u8  reserved;
-        __u64 driver_data[0];
-};
-
-struct ib_uverbs_create_qp_resp {
-        __u32 qp_handle;
-        __u32 qpn;
-};
-
-/*
- * This struct needs to remain a multiple of 8 bytes to keep the
- * alignment of the modify QP parameters.
- */
-struct ib_uverbs_qp_dest {
-        __u8  dgid[16];
-        __u32 flow_label;
-        __u16 dlid;
-        __u16 reserved;
-        __u8  sgid_index;
-        __u8  hop_limit;
-        __u8  traffic_class;
-        __u8  sl;
-        __u8  src_path_bits;
-        __u8  static_rate;
-        __u8  is_global;
-        __u8  port_num;
-};
-
-struct ib_uverbs_modify_qp {
-        struct ib_uverbs_qp_dest dest;
-        struct ib_uverbs_qp_dest alt_dest;
-        __u32 qp_handle;
-        __u32 attr_mask;
-        __u32 qkey;
-        __u32 rq_psn;
-        __u32 sq_psn;
-        __u32 dest_qp_num;
-        __u32 qp_access_flags;
-        __u16 pkey_index;
-        __u16 alt_pkey_index;
-        __u8  qp_state;
-        __u8  cur_qp_state;
-        __u8  path_mtu;
-        __u8  path_mig_state;
-        __u8  en_sqd_async_notify;
-        __u8  max_rd_atomic;
-        __u8  max_dest_rd_atomic;
-        __u8  min_rnr_timer;
-        __u8  port_num;
-        __u8  timeout;
-        __u8  retry_cnt;
-        __u8  rnr_retry;
-        __u8  alt_port_num;
-        __u8  alt_timeout;
-        __u8  reserved[2];
-        __u64 driver_data[0];
-};
-
-struct ib_uverbs_modify_qp_resp {
-};
-
-struct ib_uverbs_destroy_qp {
-        __u32 qp_handle;
-};
-
-struct ib_uverbs_attach_mcast {
-        __u8  gid[16];
-        __u32 qp_handle;
-        __u16 mlid;
-        __u16 reserved;
-        __u64 driver_data[0];
-};
-
-struct ib_uverbs_detach_mcast {
-        __u8  gid[16];
-        __u32 qp_handle;
-        __u16 mlid;
-        __u16 reserved;
-        __u64 driver_data[0];
-};
-
-#endif /* IB_USER_VERBS_H */
diff --git a/drivers/infiniband/include/ib_verbs.h b/drivers/infiniband/include/ib_verbs.h
deleted file mode 100644
index 5d24edaa66e6..000000000000
--- a/drivers/infiniband/include/ib_verbs.h
+++ /dev/null
@@ -1,1365 +0,0 @@
-/*
- * Copyright (c) 2004 Mellanox Technologies Ltd.  All rights reserved.
- * Copyright (c) 2004 Infinicon Corporation.  All rights reserved.
- * Copyright (c) 2004 Intel Corporation.  All rights reserved.
- * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
- * Copyright (c) 2004 Voltaire Corporation.  All rights reserved.
- * Copyright (c) 2005 Cisco Systems.  All rights reserved.
- *
- * This software is available to you under a choice of one of two
- * licenses.  You may choose to be licensed under the terms of the GNU
- * General Public License (GPL) Version 2, available from the file
- * COPYING in the main directory of this source tree, or the
- * OpenIB.org BSD license below:
- *
- *     Redistribution and use in source and binary forms, with or
- *     without modification, are permitted provided that the following
- *     conditions are met:
- *
- *      - Redistributions of source code must retain the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer.
- *
- *      - Redistributions in binary form must reproduce the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer in the documentation and/or other materials
- *        provided with the distribution.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- *
- * $Id: ib_verbs.h 1349 2004-12-16 21:09:43Z roland $
- */
-
-#if !defined(IB_VERBS_H)
-#define IB_VERBS_H
-
-#include <linux/types.h>
-#include <linux/device.h>
-
-#include <asm/atomic.h>
-#include <asm/scatterlist.h>
-#include <asm/uaccess.h>
-
-union ib_gid {
-        u8      raw[16];
-        struct {
-                u64     subnet_prefix;
-                u64     interface_id;
-        } global;
-};
-
-enum ib_node_type {
-        IB_NODE_CA      = 1,
-        IB_NODE_SWITCH,
-        IB_NODE_ROUTER
-};
-
-enum ib_device_cap_flags {
-        IB_DEVICE_RESIZE_MAX_WR         = 1,
-        IB_DEVICE_BAD_PKEY_CNTR         = (1<<1),
-        IB_DEVICE_BAD_QKEY_CNTR         = (1<<2),
-        IB_DEVICE_RAW_MULTI             = (1<<3),
-        IB_DEVICE_AUTO_PATH_MIG         = (1<<4),
-        IB_DEVICE_CHANGE_PHY_PORT       = (1<<5),
-        IB_DEVICE_UD_AV_PORT_ENFORCE    = (1<<6),
-        IB_DEVICE_CURR_QP_STATE_MOD     = (1<<7),
-        IB_DEVICE_SHUTDOWN_PORT         = (1<<8),
-        IB_DEVICE_INIT_TYPE             = (1<<9),
-        IB_DEVICE_PORT_ACTIVE_EVENT     = (1<<10),
-        IB_DEVICE_SYS_IMAGE_GUID        = (1<<11),
-        IB_DEVICE_RC_RNR_NAK_GEN        = (1<<12),
-        IB_DEVICE_SRQ_RESIZE            = (1<<13),
-        IB_DEVICE_N_NOTIFY_CQ           = (1<<14),
-};
-
-enum ib_atomic_cap {
-        IB_ATOMIC_NONE,
-        IB_ATOMIC_HCA,
-        IB_ATOMIC_GLOB
-};
-
-struct ib_device_attr {
-        u64                     fw_ver;
-        u64                     node_guid;
-        u64                     sys_image_guid;
-        u64                     max_mr_size;
-        u64                     page_size_cap;
-        u32                     vendor_id;
-        u32                     vendor_part_id;
-        u32                     hw_ver;
-        int                     max_qp;
-        int                     max_qp_wr;
-        int                     device_cap_flags;
-        int                     max_sge;
-        int                     max_sge_rd;
-        int                     max_cq;
-        int                     max_cqe;
-        int                     max_mr;
-        int                     max_pd;
-        int                     max_qp_rd_atom;
-        int                     max_ee_rd_atom;
-        int                     max_res_rd_atom;
-        int                     max_qp_init_rd_atom;
-        int                     max_ee_init_rd_atom;
-        enum ib_atomic_cap      atomic_cap;
-        int                     max_ee;
-        int                     max_rdd;
-        int                     max_mw;
-        int                     max_raw_ipv6_qp;
-        int                     max_raw_ethy_qp;
-        int                     max_mcast_grp;
-        int                     max_mcast_qp_attach;
-        int                     max_total_mcast_qp_attach;
-        int                     max_ah;
-        int                     max_fmr;
-        int                     max_map_per_fmr;
-        int                     max_srq;
-        int                     max_srq_wr;
-        int                     max_srq_sge;
-        u16                     max_pkeys;
-        u8                      local_ca_ack_delay;
-};
-
-enum ib_mtu {
-        IB_MTU_256  = 1,
-        IB_MTU_512  = 2,
-        IB_MTU_1024 = 3,
-        IB_MTU_2048 = 4,
-        IB_MTU_4096 = 5
-};
-
-static inline int ib_mtu_enum_to_int(enum ib_mtu mtu)
-{
-        switch (mtu) {
-        case IB_MTU_256:  return  256;
-        case IB_MTU_512:  return  512;
-        case IB_MTU_1024: return 1024;
-        case IB_MTU_2048: return 2048;
-        case IB_MTU_4096: return 4096;
-        default:          return -1;
-        }
-}
-
-enum ib_port_state {
-        IB_PORT_NOP             = 0,
-        IB_PORT_DOWN            = 1,
-        IB_PORT_INIT            = 2,
-        IB_PORT_ARMED           = 3,
-        IB_PORT_ACTIVE          = 4,
-        IB_PORT_ACTIVE_DEFER    = 5
-};
-
-enum ib_port_cap_flags {
-        IB_PORT_SM                              = 1 <<  1,
-        IB_PORT_NOTICE_SUP                      = 1 <<  2,
-        IB_PORT_TRAP_SUP                        = 1 <<  3,
-        IB_PORT_OPT_IPD_SUP                     = 1 <<  4,
-        IB_PORT_AUTO_MIGR_SUP                   = 1 <<  5,
-        IB_PORT_SL_MAP_SUP                      = 1 <<  6,
-        IB_PORT_MKEY_NVRAM                      = 1 <<  7,
-        IB_PORT_PKEY_NVRAM                      = 1 <<  8,
-        IB_PORT_LED_INFO_SUP                    = 1 <<  9,
-        IB_PORT_SM_DISABLED                     = 1 << 10,
-        IB_PORT_SYS_IMAGE_GUID_SUP              = 1 << 11,
-        IB_PORT_PKEY_SW_EXT_PORT_TRAP_SUP       = 1 << 12,
-        IB_PORT_CM_SUP                          = 1 << 16,
-        IB_PORT_SNMP_TUNNEL_SUP                 = 1 << 17,
-        IB_PORT_REINIT_SUP                      = 1 << 18,
-        IB_PORT_DEVICE_MGMT_SUP                 = 1 << 19,
-        IB_PORT_VENDOR_CLASS_SUP                = 1 << 20,
-        IB_PORT_DR_NOTICE_SUP                   = 1 << 21,
-        IB_PORT_CAP_MASK_NOTICE_SUP             = 1 << 22,
-        IB_PORT_BOOT_MGMT_SUP                   = 1 << 23,
-        IB_PORT_LINK_LATENCY_SUP                = 1 << 24,
-        IB_PORT_CLIENT_REG_SUP                  = 1 << 25
-};
-
-enum ib_port_width {
-        IB_WIDTH_1X     = 1,
-        IB_WIDTH_4X     = 2,
-        IB_WIDTH_8X     = 4,
-        IB_WIDTH_12X    = 8
-};
-
-static inline int ib_width_enum_to_int(enum ib_port_width width)
-{
-        switch (width) {
-        case IB_WIDTH_1X:  return  1;
-        case IB_WIDTH_4X:  return  4;
-        case IB_WIDTH_8X:  return  8;
-        case IB_WIDTH_12X: return 12;
-        default:          return -1;
-        }
-}
-
-struct ib_port_attr {
-        enum ib_port_state      state;
-        enum ib_mtu             max_mtu;
-        enum ib_mtu             active_mtu;
-        int                     gid_tbl_len;
-        u32                     port_cap_flags;
-        u32                     max_msg_sz;
-        u32                     bad_pkey_cntr;
-        u32                     qkey_viol_cntr;
-        u16                     pkey_tbl_len;
-        u16                     lid;
-        u16                     sm_lid;
-        u8                      lmc;
-        u8                      max_vl_num;
-        u8                      sm_sl;
-        u8                      subnet_timeout;
-        u8                      init_type_reply;
-        u8                      active_width;
-        u8                      active_speed;
-        u8                      phys_state;
-};
-
-enum ib_device_modify_flags {
-        IB_DEVICE_MODIFY_SYS_IMAGE_GUID = 1
-};
-
-struct ib_device_modify {
-        u64     sys_image_guid;
-};
-
-enum ib_port_modify_flags {
-        IB_PORT_SHUTDOWN                = 1,
-        IB_PORT_INIT_TYPE               = (1<<2),
-        IB_PORT_RESET_QKEY_CNTR         = (1<<3)
-};
-
-struct ib_port_modify {
-        u32     set_port_cap_mask;
-        u32     clr_port_cap_mask;
-        u8      init_type;
-};
-
-enum ib_event_type {
-        IB_EVENT_CQ_ERR,
-        IB_EVENT_QP_FATAL,
-        IB_EVENT_QP_REQ_ERR,
-        IB_EVENT_QP_ACCESS_ERR,
-        IB_EVENT_COMM_EST,
-        IB_EVENT_SQ_DRAINED,
-        IB_EVENT_PATH_MIG,
-        IB_EVENT_PATH_MIG_ERR,
-        IB_EVENT_DEVICE_FATAL,
-        IB_EVENT_PORT_ACTIVE,
-        IB_EVENT_PORT_ERR,
-        IB_EVENT_LID_CHANGE,
-        IB_EVENT_PKEY_CHANGE,
-        IB_EVENT_SM_CHANGE
-};
-
-struct ib_event {
-        struct ib_device        *device;
-        union {
-                struct ib_cq    *cq;
-                struct ib_qp    *qp;
-                u8              port_num;
-        } element;
-        enum ib_event_type      event;
-};
-
-struct ib_event_handler {
-        struct ib_device *device;
-        void            (*handler)(struct ib_event_handler *, struct ib_event *);
-        struct list_head  list;
-};
-
-#define INIT_IB_EVENT_HANDLER(_ptr, _device, _handler)          \
-        do {                                                    \
-                (_ptr)->device  = _device;                      \
-                (_ptr)->handler = _handler;                     \
-                INIT_LIST_HEAD(&(_ptr)->list);                  \
-        } while (0)
-
-struct ib_global_route {
-        union ib_gid    dgid;
-        u32             flow_label;
-        u8              sgid_index;
-        u8              hop_limit;
-        u8              traffic_class;
-};
-
-struct ib_grh {
-        u32             version_tclass_flow;
-        u16             paylen;
-        u8              next_hdr;
-        u8              hop_limit;
-        union ib_gid    sgid;
-        union ib_gid    dgid;
-};
-
-enum {
-        IB_MULTICAST_QPN = 0xffffff
-};
-
-enum ib_ah_flags {
-        IB_AH_GRH       = 1
-};
-
-struct ib_ah_attr {
-        struct ib_global_route  grh;
-        u16                     dlid;
-        u8                      sl;
-        u8                      src_path_bits;
-        u8                      static_rate;
-        u8                      ah_flags;
-        u8                      port_num;
-};
-
-enum ib_wc_status {
-        IB_WC_SUCCESS,
-        IB_WC_LOC_LEN_ERR,
-        IB_WC_LOC_QP_OP_ERR,
-        IB_WC_LOC_EEC_OP_ERR,
-        IB_WC_LOC_PROT_ERR,
-        IB_WC_WR_FLUSH_ERR,
-        IB_WC_MW_BIND_ERR,
-        IB_WC_BAD_RESP_ERR,
-        IB_WC_LOC_ACCESS_ERR,
-        IB_WC_REM_INV_REQ_ERR,
-        IB_WC_REM_ACCESS_ERR,
-        IB_WC_REM_OP_ERR,
-        IB_WC_RETRY_EXC_ERR,
-        IB_WC_RNR_RETRY_EXC_ERR,
-        IB_WC_LOC_RDD_VIOL_ERR,
-        IB_WC_REM_INV_RD_REQ_ERR,
-        IB_WC_REM_ABORT_ERR,
-        IB_WC_INV_EECN_ERR,
-        IB_WC_INV_EEC_STATE_ERR,
-        IB_WC_FATAL_ERR,
-        IB_WC_RESP_TIMEOUT_ERR,
-        IB_WC_GENERAL_ERR
-};
-
-enum ib_wc_opcode {
-        IB_WC_SEND,
-        IB_WC_RDMA_WRITE,
-        IB_WC_RDMA_READ,
-        IB_WC_COMP_SWAP,
-        IB_WC_FETCH_ADD,
-        IB_WC_BIND_MW,
-/*
- * Set value of IB_WC_RECV so consumers can test if a completion is a
- * receive by testing (opcode & IB_WC_RECV).
- */
-        IB_WC_RECV                      = 1 << 7,
-        IB_WC_RECV_RDMA_WITH_IMM
-};
-
-enum ib_wc_flags {
-        IB_WC_GRH               = 1,
-        IB_WC_WITH_IMM          = (1<<1)
-};
-
-struct ib_wc {
-        u64                     wr_id;
-        enum ib_wc_status       status;
-        enum ib_wc_opcode       opcode;
-        u32                     vendor_err;
-        u32                     byte_len;
-        __be32                  imm_data;
-        u32                     qp_num;
-        u32                     src_qp;
-        int                     wc_flags;
-        u16                     pkey_index;
-        u16                     slid;
-        u8                      sl;
-        u8                      dlid_path_bits;
-        u8                      port_num;       /* valid only for DR SMPs on switches */
-};
-
-enum ib_cq_notify {
-        IB_CQ_SOLICITED,
-        IB_CQ_NEXT_COMP
-};
-
-struct ib_qp_cap {
-        u32     max_send_wr;
-        u32     max_recv_wr;
-        u32     max_send_sge;
-        u32     max_recv_sge;
-        u32     max_inline_data;
-};
-
-enum ib_sig_type {
-        IB_SIGNAL_ALL_WR,
-        IB_SIGNAL_REQ_WR
-};
-
-enum ib_qp_type {
-        /*
-         * IB_QPT_SMI and IB_QPT_GSI have to be the first two entries
-         * here (and in that order) since the MAD layer uses them as
-         * indices into a 2-entry table.
-         */
-        IB_QPT_SMI,
-        IB_QPT_GSI,
-
-        IB_QPT_RC,
-        IB_QPT_UC,
-        IB_QPT_UD,
-        IB_QPT_RAW_IPV6,
-        IB_QPT_RAW_ETY
-};
-
-struct ib_qp_init_attr {
-        void                  (*event_handler)(struct ib_event *, void *);
-        void                   *qp_context;
-        struct ib_cq           *send_cq;
-        struct ib_cq           *recv_cq;
-        struct ib_srq          *srq;
-        struct ib_qp_cap        cap;
-        enum ib_sig_type        sq_sig_type;
-        enum ib_qp_type         qp_type;
-        u8                      port_num; /* special QP types only */
-};
-
-enum ib_rnr_timeout {
-        IB_RNR_TIMER_655_36 =  0,
-        IB_RNR_TIMER_000_01 =  1,
-        IB_RNR_TIMER_000_02 =  2,
-        IB_RNR_TIMER_000_03 =  3,
-        IB_RNR_TIMER_000_04 =  4,
-        IB_RNR_TIMER_000_06 =  5,
-        IB_RNR_TIMER_000_08 =  6,
-        IB_RNR_TIMER_000_12 =  7,
-        IB_RNR_TIMER_000_16 =  8,
-        IB_RNR_TIMER_000_24 =  9,
-        IB_RNR_TIMER_000_32 = 10,
-        IB_RNR_TIMER_000_48 = 11,
-        IB_RNR_TIMER_000_64 = 12,
-        IB_RNR_TIMER_000_96 = 13,
-        IB_RNR_TIMER_001_28 = 14,
-        IB_RNR_TIMER_001_92 = 15,
-        IB_RNR_TIMER_002_56 = 16,
-        IB_RNR_TIMER_003_84 = 17,
-        IB_RNR_TIMER_005_12 = 18,
-        IB_RNR_TIMER_007_68 = 19,
-        IB_RNR_TIMER_010_24 = 20,
-        IB_RNR_TIMER_015_36 = 21,
-        IB_RNR_TIMER_020_48 = 22,
-        IB_RNR_TIMER_030_72 = 23,
-        IB_RNR_TIMER_040_96 = 24,
-        IB_RNR_TIMER_061_44 = 25,
-        IB_RNR_TIMER_081_92 = 26,
-        IB_RNR_TIMER_122_88 = 27,
-        IB_RNR_TIMER_163_84 = 28,
-        IB_RNR_TIMER_245_76 = 29,
-        IB_RNR_TIMER_327_68 = 30,
-        IB_RNR_TIMER_491_52 = 31
-};
-
-enum ib_qp_attr_mask {
-        IB_QP_STATE                     = 1,
-        IB_QP_CUR_STATE                 = (1<<1),
-        IB_QP_EN_SQD_ASYNC_NOTIFY       = (1<<2),
-        IB_QP_ACCESS_FLAGS              = (1<<3),
-        IB_QP_PKEY_INDEX                = (1<<4),
-        IB_QP_PORT                      = (1<<5),
-        IB_QP_QKEY                      = (1<<6),
-        IB_QP_AV                        = (1<<7),
-        IB_QP_PATH_MTU                  = (1<<8),
-        IB_QP_TIMEOUT                   = (1<<9),
-        IB_QP_RETRY_CNT                 = (1<<10),
-        IB_QP_RNR_RETRY                 = (1<<11),
-        IB_QP_RQ_PSN                    = (1<<12),
-        IB_QP_MAX_QP_RD_ATOMIC          = (1<<13),
-        IB_QP_ALT_PATH                  = (1<<14),
-        IB_QP_MIN_RNR_TIMER             = (1<<15),
-        IB_QP_SQ_PSN                    = (1<<16),
-        IB_QP_MAX_DEST_RD_ATOMIC        = (1<<17),
-        IB_QP_PATH_MIG_STATE            = (1<<18),
-        IB_QP_CAP                       = (1<<19),
-        IB_QP_DEST_QPN                  = (1<<20)
-};
-
-enum ib_qp_state {
-        IB_QPS_RESET,
-        IB_QPS_INIT,
-        IB_QPS_RTR,
-        IB_QPS_RTS,
-        IB_QPS_SQD,
-        IB_QPS_SQE,
-        IB_QPS_ERR
-};
-
-enum ib_mig_state {
-        IB_MIG_MIGRATED,
-        IB_MIG_REARM,
-        IB_MIG_ARMED
-};
-
-struct ib_qp_attr {
-        enum ib_qp_state        qp_state;
-        enum ib_qp_state        cur_qp_state;
-        enum ib_mtu             path_mtu;
-        enum ib_mig_state       path_mig_state;
-        u32                     qkey;
-        u32                     rq_psn;
-        u32                     sq_psn;
-        u32                     dest_qp_num;
-        int                     qp_access_flags;
-        struct ib_qp_cap        cap;
-        struct ib_ah_attr       ah_attr;
-        struct ib_ah_attr       alt_ah_attr;
-        u16                     pkey_index;
-        u16                     alt_pkey_index;
-        u8                      en_sqd_async_notify;
-        u8                      sq_draining;
-        u8                      max_rd_atomic;
-        u8                      max_dest_rd_atomic;
-        u8                      min_rnr_timer;
-        u8                      port_num;
-        u8                      timeout;
-        u8                      retry_cnt;
-        u8                      rnr_retry;
-        u8                      alt_port_num;
-        u8                      alt_timeout;
-};
-
-enum ib_wr_opcode {
-        IB_WR_RDMA_WRITE,
-        IB_WR_RDMA_WRITE_WITH_IMM,
-        IB_WR_SEND,
-        IB_WR_SEND_WITH_IMM,
-        IB_WR_RDMA_READ,
-        IB_WR_ATOMIC_CMP_AND_SWP,
-        IB_WR_ATOMIC_FETCH_AND_ADD
-};
-
-enum ib_send_flags {
-        IB_SEND_FENCE           = 1,
-        IB_SEND_SIGNALED        = (1<<1),
-        IB_SEND_SOLICITED       = (1<<2),
-        IB_SEND_INLINE          = (1<<3)
-};
-
-struct ib_sge {
-        u64     addr;
-        u32     length;
-        u32     lkey;
-};
-
-struct ib_send_wr {
-        struct ib_send_wr      *next;
-        u64                     wr_id;
-        struct ib_sge          *sg_list;
-        int                     num_sge;
-        enum ib_wr_opcode       opcode;
-        int                     send_flags;
-        __be32                  imm_data;
-        union {
-                struct {
-                        u64     remote_addr;
-                        u32     rkey;
-                } rdma;
-                struct {
-                        u64     remote_addr;
-                        u64     compare_add;
-                        u64     swap;
-                        u32     rkey;
-                } atomic;
-                struct {
-                        struct ib_ah *ah;
-                        struct ib_mad_hdr *mad_hdr;
-                        u32     remote_qpn;
-                        u32     remote_qkey;
-                        int     timeout_ms; /* valid for MADs only */
-                        int     retries;    /* valid for MADs only */
-                        u16     pkey_index; /* valid for GSI only */
-                        u8      port_num;   /* valid for DR SMPs on switch only */
-                } ud;
-        } wr;
-};
-
-struct ib_recv_wr {
-        struct ib_recv_wr      *next;
-        u64                     wr_id;
-        struct ib_sge          *sg_list;
-        int                     num_sge;
-};
-
-enum ib_access_flags {
-        IB_ACCESS_LOCAL_WRITE   = 1,
-        IB_ACCESS_REMOTE_WRITE  = (1<<1),
-        IB_ACCESS_REMOTE_READ   = (1<<2),
-        IB_ACCESS_REMOTE_ATOMIC = (1<<3),
-        IB_ACCESS_MW_BIND       = (1<<4)
-};
-
-struct ib_phys_buf {
-        u64      addr;
-        u64      size;
-};
-
-struct ib_mr_attr {
-        struct ib_pd    *pd;
-        u64             device_virt_addr;
-        u64             size;
-        int             mr_access_flags;
-        u32             lkey;
-        u32             rkey;
-};
-
-enum ib_mr_rereg_flags {
-        IB_MR_REREG_TRANS       = 1,
-        IB_MR_REREG_PD          = (1<<1),
-        IB_MR_REREG_ACCESS      = (1<<2)
-};
-
-struct ib_mw_bind {
-        struct ib_mr   *mr;
-        u64             wr_id;
-        u64             addr;
-        u32             length;
-        int             send_flags;
-        int             mw_access_flags;
-};
-
-struct ib_fmr_attr {
-        int     max_pages;
-        int     max_maps;
-        u8      page_size;
-};
-
-struct ib_ucontext {
-        struct ib_device       *device;
-        struct list_head        pd_list;
-        struct list_head        mr_list;
-        struct list_head        mw_list;
-        struct list_head        cq_list;
-        struct list_head        qp_list;
-        struct list_head        srq_list;
-        struct list_head        ah_list;
-        spinlock_t              lock;
-};
-
-struct ib_uobject {
-        u64                     user_handle;    /* handle given to us by userspace */
-        struct ib_ucontext     *context;        /* associated user context */
-        struct list_head        list;           /* link to context's list */
-        u32                     id;             /* index into kernel idr */
-};
-
-struct ib_umem {
-        unsigned long           user_base;
-        unsigned long           virt_base;
-        size_t                  length;
-        int                     offset;
-        int                     page_size;
-        int                     writable;
-        struct list_head        chunk_list;
-};
-
-struct ib_umem_chunk {
-        struct list_head        list;
-        int                     nents;
-        int                     nmap;
-        struct scatterlist      page_list[0];
-};
-
-struct ib_udata {
-        void __user *inbuf;
-        void __user *outbuf;
-        size_t       inlen;
-        size_t       outlen;
-};
-
-#define IB_UMEM_MAX_PAGE_CHUNK                                          \
-        ((PAGE_SIZE - offsetof(struct ib_umem_chunk, page_list)) /      \
-         ((void *) &((struct ib_umem_chunk *) 0)->page_list[1] -        \
-          (void *) &((struct ib_umem_chunk *) 0)->page_list[0]))
-
-struct ib_umem_object {
-        struct ib_uobject       uobject;
-        struct ib_umem          umem;
-};
-
-struct ib_pd {
-        struct ib_device       *device;
-        struct ib_uobject      *uobject;
-        atomic_t                usecnt; /* count all resources */
-};
-
-struct ib_ah {
-        struct ib_device        *device;
-        struct ib_pd            *pd;
-        struct ib_uobject       *uobject;
-};
-
-typedef void (*ib_comp_handler)(struct ib_cq *cq, void *cq_context);
-
-struct ib_cq {
-        struct ib_device       *device;
-        struct ib_uobject      *uobject;
-        ib_comp_handler         comp_handler;
-        void                  (*event_handler)(struct ib_event *, void *);
-        void *                  cq_context;
-        int                     cqe;
-        atomic_t                usecnt; /* count number of work queues */
-};
-
-struct ib_srq {
-        struct ib_device        *device;
-        struct ib_uobject       *uobject;
-        struct ib_pd            *pd;
-        void                    *srq_context;
-        atomic_t                usecnt;
-};
-
-struct ib_qp {
-        struct ib_device       *device;
-        struct ib_pd           *pd;
-        struct ib_cq           *send_cq;
-        struct ib_cq           *recv_cq;
-        struct ib_srq          *srq;
-        struct ib_uobject      *uobject;
-        void                  (*event_handler)(struct ib_event *, void *);
-        void                   *qp_context;
-        u32                     qp_num;
-        enum ib_qp_type         qp_type;
-};
-
-struct ib_mr {
-        struct ib_device  *device;
-        struct ib_pd      *pd;
-        struct ib_uobject *uobject;
-        u32                lkey;
-        u32                rkey;
-        atomic_t           usecnt; /* count number of MWs */
-};
-
-struct ib_mw {
-        struct ib_device        *device;
-        struct ib_pd            *pd;
-        struct ib_uobject       *uobject;
-        u32                     rkey;
-};
-
-struct ib_fmr {
-        struct ib_device        *device;
-        struct ib_pd            *pd;
-        struct list_head        list;
-        u32                     lkey;
-        u32                     rkey;
-};
-
-struct ib_mad;
-struct ib_grh;
-
-enum ib_process_mad_flags {
-        IB_MAD_IGNORE_MKEY      = 1,
-        IB_MAD_IGNORE_BKEY      = 2,
-        IB_MAD_IGNORE_ALL       = IB_MAD_IGNORE_MKEY | IB_MAD_IGNORE_BKEY
-};
-
-enum ib_mad_result {
-        IB_MAD_RESULT_FAILURE  = 0,      /* (!SUCCESS is the important flag) */
-        IB_MAD_RESULT_SUCCESS  = 1 << 0, /* MAD was successfully processed   */
-        IB_MAD_RESULT_REPLY    = 1 << 1, /* Reply packet needs to be sent    */
-        IB_MAD_RESULT_CONSUMED = 1 << 2  /* Packet consumed: stop processing */
-};
-
-#define IB_DEVICE_NAME_MAX 64
-
-struct ib_cache {
-        rwlock_t                lock;
-        struct ib_event_handler event_handler;
-        struct ib_pkey_cache  **pkey_cache;
-        struct ib_gid_cache   **gid_cache;
-};
-
-struct ib_device {
-        struct device                *dma_device;
-
-        char                          name[IB_DEVICE_NAME_MAX];
-
-        struct list_head              event_handler_list;
-        spinlock_t                    event_handler_lock;
-
-        struct list_head              core_list;
-        struct list_head              client_data_list;
-        spinlock_t                    client_data_lock;
-
-        struct ib_cache               cache;
-
-        u32                           flags;
-
-        int                        (*query_device)(struct ib_device *device,
-                                                   struct ib_device_attr *device_attr);
-        int                        (*query_port)(struct ib_device *device,
-                                                 u8 port_num,
-                                                 struct ib_port_attr *port_attr);
-        int                        (*query_gid)(struct ib_device *device,
-                                                u8 port_num, int index,
-                                                union ib_gid *gid);
-        int                        (*query_pkey)(struct ib_device *device,
-                                                 u8 port_num, u16 index, u16 *pkey);
-        int                        (*modify_device)(struct ib_device *device,
-                                                    int device_modify_mask,
-                                                    struct ib_device_modify *device_modify);
-        int                        (*modify_port)(struct ib_device *device,
-                                                  u8 port_num, int port_modify_mask,
-                                                  struct ib_port_modify *port_modify);
-        struct ib_ucontext *       (*alloc_ucontext)(struct ib_device *device,
-                                                     struct ib_udata *udata);
-        int                        (*dealloc_ucontext)(struct ib_ucontext *context);
-        int                        (*mmap)(struct ib_ucontext *context,
-                                           struct vm_area_struct *vma);
-        struct ib_pd *             (*alloc_pd)(struct ib_device *device,
-                                               struct ib_ucontext *context,
-                                               struct ib_udata *udata);
-        int                        (*dealloc_pd)(struct ib_pd *pd);
-        struct ib_ah *             (*create_ah)(struct ib_pd *pd,
-                                                struct ib_ah_attr *ah_attr);
-        int                        (*modify_ah)(struct ib_ah *ah,
-                                                struct ib_ah_attr *ah_attr);
-        int                        (*query_ah)(struct ib_ah *ah,
-                                               struct ib_ah_attr *ah_attr);
-        int                        (*destroy_ah)(struct ib_ah *ah);
-        struct ib_qp *             (*create_qp)(struct ib_pd *pd,
-                                                struct ib_qp_init_attr *qp_init_attr,
-                                                struct ib_udata *udata);
-        int                        (*modify_qp)(struct ib_qp *qp,
-                                                struct ib_qp_attr *qp_attr,
-                                                int qp_attr_mask);
-        int                        (*query_qp)(struct ib_qp *qp,
-                                               struct ib_qp_attr *qp_attr,
-                                               int qp_attr_mask,
-                                               struct ib_qp_init_attr *qp_init_attr);
-        int                        (*destroy_qp)(struct ib_qp *qp);
-        int                        (*post_send)(struct ib_qp *qp,
-                                                struct ib_send_wr *send_wr,
-                                                struct ib_send_wr **bad_send_wr);
-        int                        (*post_recv)(struct ib_qp *qp,
-                                                struct ib_recv_wr *recv_wr,
-                                                struct ib_recv_wr **bad_recv_wr);
-        struct ib_cq *             (*create_cq)(struct ib_device *device, int cqe,
-                                                struct ib_ucontext *context,
-                                                struct ib_udata *udata);
-        int                        (*destroy_cq)(struct ib_cq *cq);
-        int                        (*resize_cq)(struct ib_cq *cq, int *cqe);
-        int                        (*poll_cq)(struct ib_cq *cq, int num_entries,
-                                              struct ib_wc *wc);
-        int                        (*peek_cq)(struct ib_cq *cq, int wc_cnt);
-        int                        (*req_notify_cq)(struct ib_cq *cq,
-                                                    enum ib_cq_notify cq_notify);
-        int                        (*req_ncomp_notif)(struct ib_cq *cq,
-                                                      int wc_cnt);
-        struct ib_mr *             (*get_dma_mr)(struct ib_pd *pd,
-                                                 int mr_access_flags);
-        struct ib_mr *             (*reg_phys_mr)(struct ib_pd *pd,
-                                                  struct ib_phys_buf *phys_buf_array,
-                                                  int num_phys_buf,
-                                                  int mr_access_flags,
-                                                  u64 *iova_start);
-        struct ib_mr *             (*reg_user_mr)(struct ib_pd *pd,
-                                                  struct ib_umem *region,
-                                                  int mr_access_flags,
-                                                  struct ib_udata *udata);
-        int                        (*query_mr)(struct ib_mr *mr,
-                                               struct ib_mr_attr *mr_attr);
-        int                        (*dereg_mr)(struct ib_mr *mr);
-        int                        (*rereg_phys_mr)(struct ib_mr *mr,
-                                                    int mr_rereg_mask,
-                                                    struct ib_pd *pd,
-                                                    struct ib_phys_buf *phys_buf_array,
-                                                    int num_phys_buf,
-                                                    int mr_access_flags,
-                                                    u64 *iova_start);
-        struct ib_mw *             (*alloc_mw)(struct ib_pd *pd);
-        int                        (*bind_mw)(struct ib_qp *qp,
-                                              struct ib_mw *mw,
-                                              struct ib_mw_bind *mw_bind);
-        int                        (*dealloc_mw)(struct ib_mw *mw);
-        struct ib_fmr *            (*alloc_fmr)(struct ib_pd *pd,
-                                                int mr_access_flags,
-                                                struct ib_fmr_attr *fmr_attr);
-        int                        (*map_phys_fmr)(struct ib_fmr *fmr,
-                                                   u64 *page_list, int list_len,
-                                                   u64 iova);
-        int                        (*unmap_fmr)(struct list_head *fmr_list);
-        int                        (*dealloc_fmr)(struct ib_fmr *fmr);
-        int                        (*attach_mcast)(struct ib_qp *qp,
-                                                   union ib_gid *gid,
-                                                   u16 lid);
-        int                        (*detach_mcast)(struct ib_qp *qp,
-                                                   union ib_gid *gid,
-                                                   u16 lid);
-        int                        (*process_mad)(struct ib_device *device,
-                                                  int process_mad_flags,
-                                                  u8 port_num,
-                                                  struct ib_wc *in_wc,
-                                                  struct ib_grh *in_grh,
-                                                  struct ib_mad *in_mad,
-                                                  struct ib_mad *out_mad);
-
-        struct module               *owner;
-        struct class_device          class_dev;
-        struct kobject               ports_parent;
-        struct list_head             port_list;
-
-        enum {
-                IB_DEV_UNINITIALIZED,
-                IB_DEV_REGISTERED,
-                IB_DEV_UNREGISTERED
-        }                            reg_state;
-
-        u8                           node_type;
-        u8                           phys_port_cnt;
-};
-
-struct ib_client {
-        char  *name;
-        void (*add)   (struct ib_device *);
-        void (*remove)(struct ib_device *);
-
-        struct list_head list;
-};
-
-struct ib_device *ib_alloc_device(size_t size);
-void ib_dealloc_device(struct ib_device *device);
-
-int ib_register_device   (struct ib_device *device);
-void ib_unregister_device(struct ib_device *device);
-
-int ib_register_client   (struct ib_client *client);
-void ib_unregister_client(struct ib_client *client);
-
-void *ib_get_client_data(struct ib_device *device, struct ib_client *client);
-void  ib_set_client_data(struct ib_device *device, struct ib_client *client,
-                         void *data);
-
-static inline int ib_copy_from_udata(void *dest, struct ib_udata *udata, size_t len)
-{
-        return copy_from_user(dest, udata->inbuf, len) ? -EFAULT : 0;
-}
-
-static inline int ib_copy_to_udata(struct ib_udata *udata, void *src, size_t len)
-{
-        return copy_to_user(udata->outbuf, src, len) ? -EFAULT : 0;
-}
-
-int ib_register_event_handler  (struct ib_event_handler *event_handler);
-int ib_unregister_event_handler(struct ib_event_handler *event_handler);
-void ib_dispatch_event(struct ib_event *event);
-
-int ib_query_device(struct ib_device *device,
-                    struct ib_device_attr *device_attr);
-
-int ib_query_port(struct ib_device *device,
-                  u8 port_num, struct ib_port_attr *port_attr);
-
-int ib_query_gid(struct ib_device *device,
-                 u8 port_num, int index, union ib_gid *gid);
-
-int ib_query_pkey(struct ib_device *device,
-                  u8 port_num, u16 index, u16 *pkey);
-
-int ib_modify_device(struct ib_device *device,
-                     int device_modify_mask,
-                     struct ib_device_modify *device_modify);
-
-int ib_modify_port(struct ib_device *device,
-                   u8 port_num, int port_modify_mask,
-                   struct ib_port_modify *port_modify);
-
-/**
- * ib_alloc_pd - Allocates an unused protection domain.
- * @device: The device on which to allocate the protection domain.
- *
- * A protection domain object provides an association between QPs, shared
- * receive queues, address handles, memory regions, and memory windows.
- */
-struct ib_pd *ib_alloc_pd(struct ib_device *device);
-
-/**
- * ib_dealloc_pd - Deallocates a protection domain.
- * @pd: The protection domain to deallocate.
- */
-int ib_dealloc_pd(struct ib_pd *pd);
-
-/**
- * ib_create_ah - Creates an address handle for the given address vector.
- * @pd: The protection domain associated with the address handle.
- * @ah_attr: The attributes of the address vector.
- *
- * The address handle is used to reference a local or global destination
- * in all UD QP post sends.
- */
-struct ib_ah *ib_create_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr);
-
-/**
- * ib_create_ah_from_wc - Creates an address handle associated with the
- *   sender of the specified work completion.
- * @pd: The protection domain associated with the address handle.
- * @wc: Work completion information associated with a received message.
- * @grh: References the received global route header.  This parameter is
- *   ignored unless the work completion indicates that the GRH is valid.
- * @port_num: The outbound port number to associate with the address.
- *
- * The address handle is used to reference a local or global destination
- * in all UD QP post sends.
- */
-struct ib_ah *ib_create_ah_from_wc(struct ib_pd *pd, struct ib_wc *wc,
-                                   struct ib_grh *grh, u8 port_num);
-
-/**
- * ib_modify_ah - Modifies the address vector associated with an address
- *   handle.
- * @ah: The address handle to modify.
- * @ah_attr: The new address vector attributes to associate with the
- *   address handle.
- */
-int ib_modify_ah(struct ib_ah *ah, struct ib_ah_attr *ah_attr);
-
-/**
- * ib_query_ah - Queries the address vector associated with an address
- *   handle.
- * @ah: The address handle to query.
- * @ah_attr: The address vector attributes associated with the address
- *   handle.
- */
-int ib_query_ah(struct ib_ah *ah, struct ib_ah_attr *ah_attr);
-
-/**
- * ib_destroy_ah - Destroys an address handle.
- * @ah: The address handle to destroy.
- */
-int ib_destroy_ah(struct ib_ah *ah);
-
-/**
- * ib_create_qp - Creates a QP associated with the specified protection
- *   domain.
- * @pd: The protection domain associated with the QP.
- * @qp_init_attr: A list of initial attributes required to create the QP.
- */
-struct ib_qp *ib_create_qp(struct ib_pd *pd,
-                           struct ib_qp_init_attr *qp_init_attr);
-
-/**
- * ib_modify_qp - Modifies the attributes for the specified QP and then
- *   transitions the QP to the given state.
- * @qp: The QP to modify.
- * @qp_attr: On input, specifies the QP attributes to modify.  On output,
- *   the current values of selected QP attributes are returned.
- * @qp_attr_mask: A bit-mask used to specify which attributes of the QP
- *   are being modified.
- */
-int ib_modify_qp(struct ib_qp *qp,
-                 struct ib_qp_attr *qp_attr,
-                 int qp_attr_mask);
-
-/**
- * ib_query_qp - Returns the attribute list and current values for the
- *   specified QP.
- * @qp: The QP to query.
- * @qp_attr: The attributes of the specified QP.
- * @qp_attr_mask: A bit-mask used to select specific attributes to query.
- * @qp_init_attr: Additional attributes of the selected QP.
- *
- * The qp_attr_mask may be used to limit the query to gathering only the
- * selected attributes.
- */
-int ib_query_qp(struct ib_qp *qp,
-                struct ib_qp_attr *qp_attr,
-                int qp_attr_mask,
-                struct ib_qp_init_attr *qp_init_attr);
-
-/**
- * ib_destroy_qp - Destroys the specified QP.
- * @qp: The QP to destroy.
- */
-int ib_destroy_qp(struct ib_qp *qp);
-
-/**
- * ib_post_send - Posts a list of work requests to the send queue of
- *   the specified QP.
- * @qp: The QP to post the work request on.
- * @send_wr: A list of work requests to post on the send queue.
- * @bad_send_wr: On an immediate failure, this parameter will reference
- *   the work request that failed to be posted on the QP.
- */
-static inline int ib_post_send(struct ib_qp *qp,
-                               struct ib_send_wr *send_wr,
-                               struct ib_send_wr **bad_send_wr)
-{
-        return qp->device->post_send(qp, send_wr, bad_send_wr);
-}
-
-/**
- * ib_post_recv - Posts a list of work requests to the receive queue of
- *   the specified QP.
- * @qp: The QP to post the work request on.
- * @recv_wr: A list of work requests to post on the receive queue.
- * @bad_recv_wr: On an immediate failure, this parameter will reference
- *   the work request that failed to be posted on the QP.
- */
-static inline int ib_post_recv(struct ib_qp *qp,
-                               struct ib_recv_wr *recv_wr,
-                               struct ib_recv_wr **bad_recv_wr)
-{
-        return qp->device->post_recv(qp, recv_wr, bad_recv_wr);
-}
-
-/**
- * ib_create_cq - Creates a CQ on the specified device.
- * @device: The device on which to create the CQ.
- * @comp_handler: A user-specified callback that is invoked when a
- *   completion event occurs on the CQ.
- * @event_handler: A user-specified callback that is invoked when an
- *   asynchronous event not associated with a completion occurs on the CQ.
- * @cq_context: Context associated with the CQ returned to the user via
- *   the associated completion and event handlers.
- * @cqe: The minimum size of the CQ.
- *
- * Users can examine the cq structure to determine the actual CQ size.
- */
-struct ib_cq *ib_create_cq(struct ib_device *device,
-                           ib_comp_handler comp_handler,
-                           void (*event_handler)(struct ib_event *, void *),
-                           void *cq_context, int cqe);
-
-/**
- * ib_resize_cq - Modifies the capacity of the CQ.
- * @cq: The CQ to resize.
- * @cqe: The minimum size of the CQ.
- *
- * Users can examine the cq structure to determine the actual CQ size.
- */
-int ib_resize_cq(struct ib_cq *cq, int cqe);
-
-/**
- * ib_destroy_cq - Destroys the specified CQ.
- * @cq: The CQ to destroy.
- */
-int ib_destroy_cq(struct ib_cq *cq);
-
-/**
- * ib_poll_cq - poll a CQ for completion(s)
- * @cq:the CQ being polled
- * @num_entries:maximum number of completions to return
- * @wc:array of at least @num_entries &struct ib_wc where completions
- *   will be returned
- *
- * Poll a CQ for (possibly multiple) completions.  If the return value
- * is < 0, an error occurred.  If the return value is >= 0, it is the
- * number of completions returned.  If the return value is
- * non-negative and < num_entries, then the CQ was emptied.
- */
-static inline int ib_poll_cq(struct ib_cq *cq, int num_entries,
-                             struct ib_wc *wc)
-{
-        return cq->device->poll_cq(cq, num_entries, wc);
-}
-
-/**
- * ib_peek_cq - Returns the number of unreaped completions currently
- *   on the specified CQ.
- * @cq: The CQ to peek.
- * @wc_cnt: A minimum number of unreaped completions to check for.
- *
- * If the number of unreaped completions is greater than or equal to wc_cnt,
- * this function returns wc_cnt, otherwise, it returns the actual number of
- * unreaped completions.
- */
-int ib_peek_cq(struct ib_cq *cq, int wc_cnt);
-
-/**
- * ib_req_notify_cq - Request completion notification on a CQ.
- * @cq: The CQ to generate an event for.
- * @cq_notify: If set to %IB_CQ_SOLICITED, completion notification will
- *   occur on the next solicited event. If set to %IB_CQ_NEXT_COMP,
- *   notification will occur on the next completion.
- */
-static inline int ib_req_notify_cq(struct ib_cq *cq,
-                                   enum ib_cq_notify cq_notify)
-{
-        return cq->device->req_notify_cq(cq, cq_notify);
-}
-
-/**
- * ib_req_ncomp_notif - Request completion notification when there are
- *   at least the specified number of unreaped completions on the CQ.
- * @cq: The CQ to generate an event for.
- * @wc_cnt: The number of unreaped completions that should be on the
- *   CQ before an event is generated.
- */
-static inline int ib_req_ncomp_notif(struct ib_cq *cq, int wc_cnt)
-{
-        return cq->device->req_ncomp_notif ?
-                cq->device->req_ncomp_notif(cq, wc_cnt) :
-                -ENOSYS;
-}
-
-/**
- * ib_get_dma_mr - Returns a memory region for system memory that is
- *   usable for DMA.
- * @pd: The protection domain associated with the memory region.
- * @mr_access_flags: Specifies the memory access rights.
- */
-struct ib_mr *ib_get_dma_mr(struct ib_pd *pd, int mr_access_flags);
-
-/**
- * ib_reg_phys_mr - Prepares a virtually addressed memory region for use
- *   by an HCA.
- * @pd: The protection domain associated assigned to the registered region.
- * @phys_buf_array: Specifies a list of physical buffers to use in the
- *   memory region.
- * @num_phys_buf: Specifies the size of the phys_buf_array.
- * @mr_access_flags: Specifies the memory access rights.
- * @iova_start: The offset of the region's starting I/O virtual address.
- */
-struct ib_mr *ib_reg_phys_mr(struct ib_pd *pd,
-                             struct ib_phys_buf *phys_buf_array,
-                             int num_phys_buf,
-                             int mr_access_flags,
-                             u64 *iova_start);
-
-/**
- * ib_rereg_phys_mr - Modifies the attributes of an existing memory region.
- *   Conceptually, this call performs the functions deregister memory region
- *   followed by register physical memory region.  Where possible,
- *   resources are reused instead of deallocated and reallocated.
- * @mr: The memory region to modify.
- * @mr_rereg_mask: A bit-mask used to indicate which of the following
- *   properties of the memory region are being modified.
- * @pd: If %IB_MR_REREG_PD is set in mr_rereg_mask, this field specifies
- *   the new protection domain to associated with the memory region,
- *   otherwise, this parameter is ignored.
- * @phys_buf_array: If %IB_MR_REREG_TRANS is set in mr_rereg_mask, this
- *   field specifies a list of physical buffers to use in the new
- *   translation, otherwise, this parameter is ignored.
- * @num_phys_buf: If %IB_MR_REREG_TRANS is set in mr_rereg_mask, this
- *   field specifies the size of the phys_buf_array, otherwise, this
- *   parameter is ignored.
- * @mr_access_flags: If %IB_MR_REREG_ACCESS is set in mr_rereg_mask, this
- *   field specifies the new memory access rights, otherwise, this
- *   parameter is ignored.
- * @iova_start: The offset of the region's starting I/O virtual address.
- */
-int ib_rereg_phys_mr(struct ib_mr *mr,
-                     int mr_rereg_mask,
-                     struct ib_pd *pd,
-                     struct ib_phys_buf *phys_buf_array,
-                     int num_phys_buf,
-                     int mr_access_flags,
-                     u64 *iova_start);
-
-/**
- * ib_query_mr - Retrieves information about a specific memory region.
- * @mr: The memory region to retrieve information about.
- * @mr_attr: The attributes of the specified memory region.
- */
-int ib_query_mr(struct ib_mr *mr, struct ib_mr_attr *mr_attr);
-
-/**
- * ib_dereg_mr - Deregisters a memory region and removes it from the
- *   HCA translation table.
- * @mr: The memory region to deregister.
- */
-int ib_dereg_mr(struct ib_mr *mr);
-
-/**
- * ib_alloc_mw - Allocates a memory window.
- * @pd: The protection domain associated with the memory window.
- */
-struct ib_mw *ib_alloc_mw(struct ib_pd *pd);
-
-/**
- * ib_bind_mw - Posts a work request to the send queue of the specified
- *   QP, which binds the memory window to the given address range and
- *   remote access attributes.
- * @qp: QP to post the bind work request on.
- * @mw: The memory window to bind.
- * @mw_bind: Specifies information about the memory window, including
- *   its address range, remote access rights, and associated memory region.
- */
-static inline int ib_bind_mw(struct ib_qp *qp,
-                             struct ib_mw *mw,
-                             struct ib_mw_bind *mw_bind)
-{
-        /* XXX reference counting in corresponding MR? */
-        return mw->device->bind_mw ?
-                mw->device->bind_mw(qp, mw, mw_bind) :
-                -ENOSYS;
-}
-
-/**
- * ib_dealloc_mw - Deallocates a memory window.
- * @mw: The memory window to deallocate.
- */
-int ib_dealloc_mw(struct ib_mw *mw);
-
-/**
- * ib_alloc_fmr - Allocates a unmapped fast memory region.
- * @pd: The protection domain associated with the unmapped region.
- * @mr_access_flags: Specifies the memory access rights.
- * @fmr_attr: Attributes of the unmapped region.
- *
- * A fast memory region must be mapped before it can be used as part of
- * a work request.
- */
-struct ib_fmr *ib_alloc_fmr(struct ib_pd *pd,
-                            int mr_access_flags,
-                            struct ib_fmr_attr *fmr_attr);
-
-/**
- * ib_map_phys_fmr - Maps a list of physical pages to a fast memory region.
- * @fmr: The fast memory region to associate with the pages.
- * @page_list: An array of physical pages to map to the fast memory region.
- * @list_len: The number of pages in page_list.
- * @iova: The I/O virtual address to use with the mapped region.
- */
-static inline int ib_map_phys_fmr(struct ib_fmr *fmr,
-                                  u64 *page_list, int list_len,
-                                  u64 iova)
-{
-        return fmr->device->map_phys_fmr(fmr, page_list, list_len, iova);
-}
-
-/**
- * ib_unmap_fmr - Removes the mapping from a list of fast memory regions.
- * @fmr_list: A linked list of fast memory regions to unmap.
- */
-int ib_unmap_fmr(struct list_head *fmr_list);
-
-/**
- * ib_dealloc_fmr - Deallocates a fast memory region.
- * @fmr: The fast memory region to deallocate.
- */
-int ib_dealloc_fmr(struct ib_fmr *fmr);
-
-/**
- * ib_attach_mcast - Attaches the specified QP to a multicast group.
- * @qp: QP to attach to the multicast group.  The QP must be type
- *   IB_QPT_UD.
- * @gid: Multicast group GID.
- * @lid: Multicast group LID in host byte order.
- *
- * In order to send and receive multicast packets, subnet
- * administration must have created the multicast group and configured
- * the fabric appropriately.  The port associated with the specified
- * QP must also be a member of the multicast group.
- */
-int ib_attach_mcast(struct ib_qp *qp, union ib_gid *gid, u16 lid);
-
-/**
- * ib_detach_mcast - Detaches the specified QP from a multicast group.
- * @qp: QP to detach from the multicast group.
- * @gid: Multicast group GID.
- * @lid: Multicast group LID in host byte order.
- */
-int ib_detach_mcast(struct ib_qp *qp, union ib_gid *gid, u16 lid);
-
-#endif /* IB_VERBS_H */
diff --git a/drivers/infiniband/ulp/ipoib/Makefile b/drivers/infiniband/ulp/ipoib/Makefile
index 394bc08abc6f..8935e74ae3f8 100644
--- a/drivers/infiniband/ulp/ipoib/Makefile
+++ b/drivers/infiniband/ulp/ipoib/Makefile
@@ -1,5 +1,3 @@
-EXTRA_CFLAGS += -Idrivers/infiniband/include
-
 obj-$(CONFIG_INFINIBAND_IPOIB)                  += ib_ipoib.o
 
 ib_ipoib-y                                      := ipoib_main.o \
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 04c98f54e9c4..bea960b8191f 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -1,5 +1,7 @@
 /*
  * Copyright (c) 2004, 2005 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
+ * Copyright (c) 2004 Voltaire, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -49,9 +51,9 @@
 #include <asm/atomic.h>
 #include <asm/semaphore.h>
 
-#include <ib_verbs.h>
-#include <ib_pack.h>
-#include <ib_sa.h>
+#include <rdma/ib_verbs.h>
+#include <rdma/ib_pack.h>
+#include <rdma/ib_sa.h>
 
 /* constants */
 
@@ -88,8 +90,8 @@ enum {
 /* structs */
 
 struct ipoib_header {
-        u16 proto;
-        u16 reserved;
+        __be16  proto;
+        u16     reserved;
 };
 
 struct ipoib_pseudoheader {
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_fs.c b/drivers/infiniband/ulp/ipoib/ipoib_fs.c
index a84e5fe0f193..38b150f775e7 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_fs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_fs.c
@@ -97,7 +97,7 @@ static int ipoib_mcg_seq_show(struct seq_file *file, void *iter_ptr)
 
                 for (n = 0, i = 0; i < sizeof mgid / 2; ++i) {
                         n += sprintf(gid_buf + n, "%x",
-                                     be16_to_cpu(((u16 *)mgid.raw)[i]));
+                                     be16_to_cpu(((__be16 *) mgid.raw)[i]));
                         if (i < sizeof mgid / 2 - 1)
                                 gid_buf[n++] = ':';
                 }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index eee82363167d..ef0e3894863c 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -1,5 +1,8 @@
 /*
  * Copyright (c) 2004, 2005 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
+ * Copyright (c) 2004, 2005 Voltaire, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -35,7 +38,7 @@
 #include <linux/delay.h>
 #include <linux/dma-mapping.h>
 
-#include <ib_cache.h>
+#include <rdma/ib_cache.h>
 
 #include "ipoib.h"
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 6f60abbaebd5..0e8ac138e355 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1,5 +1,7 @@
 /*
  * Copyright (c) 2004 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
+ * Copyright (c) 2004 Voltaire, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -34,7 +36,6 @@
 
 #include "ipoib.h"
 
-#include <linux/version.h>
 #include <linux/module.h>
 
 #include <linux/init.h>
@@ -600,14 +601,15 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
                         ipoib_mcast_send(dev, (union ib_gid *) (phdr->hwaddr + 4), skb);
                 } else {
-                        /* unicast GID -- should be ARP reply */
+                        /* unicast GID -- should be ARP or RARP reply */
 
-                        if (be16_to_cpup((u16 *) skb->data) != ETH_P_ARP) {
+                        if ((be16_to_cpup((__be16 *) skb->data) != ETH_P_ARP) &&
+                            (be16_to_cpup((__be16 *) skb->data) != ETH_P_RARP)) {
                                 ipoib_warn(priv, "Unicast, no %s: type %04x, QPN %06x "
                                            IPOIB_GID_FMT "\n",
                                            skb->dst ? "neigh" : "dst",
-                                           be16_to_cpup((u16 *) skb->data),
-                                           be32_to_cpup((u32 *) phdr->hwaddr),
+                                           be16_to_cpup((__be16 *) skb->data),
+                                           be32_to_cpup((__be32 *) phdr->hwaddr),
                                            IPOIB_GID_ARG(*(union ib_gid *) (phdr->hwaddr + 4)));
                                 dev_kfree_skb_any(skb);
                                 ++priv->stats.tx_dropped;
@@ -670,7 +672,7 @@ static void ipoib_set_mcast_list(struct net_device *dev)
 {
         struct ipoib_dev_priv *priv = netdev_priv(dev);
 
-        schedule_work(&priv->restart_task);
+        queue_work(ipoib_workqueue, &priv->restart_task);
 }
 
 static void ipoib_neigh_destructor(struct neighbour *n)
@@ -779,15 +781,11 @@ void ipoib_dev_cleanup(struct net_device *dev)
 
         ipoib_ib_dev_cleanup(dev);
 
-        if (priv->rx_ring) {
-                kfree(priv->rx_ring);
-                priv->rx_ring = NULL;
-        }
+        kfree(priv->rx_ring);
+        kfree(priv->tx_ring);
 
-        if (priv->tx_ring) {
-                kfree(priv->tx_ring);
-                priv->tx_ring = NULL;
-        }
+        priv->rx_ring = NULL;
+        priv->tx_ring = NULL;
 }
 
 static void ipoib_setup(struct net_device *dev)
@@ -885,6 +883,12 @@ static ssize_t create_child(struct class_device *cdev,
         if (pkey < 0 || pkey > 0xffff)
                 return -EINVAL;
 
+        /*
+         * Set the full membership bit, so that we join the right
+         * broadcast group, etc.
+         */
+        pkey |= 0x8000;
+
         ret = ipoib_vlan_add(container_of(cdev, struct net_device, class_dev),
                              pkey);
 
@@ -937,6 +941,12 @@ static struct net_device *ipoib_add_port(const char *format,
                 goto alloc_mem_failed;
         }
 
+        /*
+         * Set the full membership bit, so that we join the right
+         * broadcast group, etc.
+         */
+        priv->pkey |= 0x8000;
+
         priv->dev->broadcast[8] = priv->pkey >> 8;
         priv->dev->broadcast[9] = priv->pkey & 0xff;
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 70208c3d21e2..aca7aea18a69 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -1,5 +1,7 @@
 /*
  * Copyright (c) 2004, 2005 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
+ * Copyright (c) 2004 Voltaire, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -357,7 +359,7 @@ static int ipoib_mcast_sendonly_join(struct ipoib_mcast *mcast)
 
         rec.mgid     = mcast->mcmember.mgid;
         rec.port_gid = priv->local_gid;
-        rec.pkey     = be16_to_cpu(priv->pkey);
+        rec.pkey     = cpu_to_be16(priv->pkey);
 
         ret = ib_sa_mcmember_rec_set(priv->ca, priv->port, &rec,
                                      IB_SA_MCMEMBER_REC_MGID            |
@@ -457,7 +459,7 @@ static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast,
 
         rec.mgid     = mcast->mcmember.mgid;
         rec.port_gid = priv->local_gid;
-        rec.pkey     = be16_to_cpu(priv->pkey);
+        rec.pkey     = cpu_to_be16(priv->pkey);
 
         comp_mask =
                 IB_SA_MCMEMBER_REC_MGID         |
@@ -646,7 +648,7 @@ static int ipoib_mcast_leave(struct net_device *dev, struct ipoib_mcast *mcast)
 
         rec.mgid     = mcast->mcmember.mgid;
         rec.port_gid = priv->local_gid;
-        rec.pkey     = be16_to_cpu(priv->pkey);
+        rec.pkey     = cpu_to_be16(priv->pkey);
 
         /* Remove ourselves from the multicast group */
         ret = ipoib_mcast_detach(dev, be16_to_cpu(mcast->mcmember.mlid),
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
index 4933edf062c2..79f59d0563ed 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2004, 2005 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -32,7 +33,7 @@
  * $Id: ipoib_verbs.c 1349 2004-12-16 21:09:43Z roland $
  */
 
-#include <ib_cache.h>
+#include <rdma/ib_cache.h>
 
 #include "ipoib.h"
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index 94b8ea812fef..332d730e60c2 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -32,7 +32,6 @@
  * $Id: ipoib_vlan.c 1349 2004-12-16 21:09:43Z roland $
  */
 
-#include <linux/version.h>
 #include <linux/module.h>
 
 #include <linux/init.h>
diff --git a/drivers/input/gameport/ns558.c b/drivers/input/gameport/ns558.c
index 1ab5f2dc8a2a..70f051894a3c 100644
--- a/drivers/input/gameport/ns558.c
+++ b/drivers/input/gameport/ns558.c
@@ -275,9 +275,9 @@ static int __init ns558_init(void)
 
 static void __exit ns558_exit(void)
 {
-        struct ns558 *ns558;
+        struct ns558 *ns558, *safe;
 
-        list_for_each_entry(ns558, &ns558_list, node) {
+        list_for_each_entry_safe(ns558, safe, &ns558_list, node) {
                 gameport_unregister_port(ns558->gameport);
                 release_region(ns558->io & ~(ns558->size - 1), ns558->size);
                 kfree(ns558);
diff --git a/drivers/isdn/act2000/capi.c b/drivers/isdn/act2000/capi.c
index afa46681f983..6ae6eb322111 100644
--- a/drivers/isdn/act2000/capi.c
+++ b/drivers/isdn/act2000/capi.c
@@ -606,7 +606,7 @@ handle_ack(act2000_card *card, act2000_chan *chan, __u8 blocknr) {
                 if ((((m->msg.data_b3_req.fakencci >> 8) & 0xff) == chan->ncci) &&
                     (m->msg.data_b3_req.blocknr == blocknr)) {
                         /* found corresponding DATA_B3_REQ */
-                        skb_unlink(tmp);
+                        skb_unlink(tmp, &card->ackq);
                         chan->queued -= m->msg.data_b3_req.datalen;
                         if (m->msg.data_b3_req.flags)
                                 ret = m->msg.data_b3_req.datalen;
diff --git a/drivers/isdn/capi/capifs.c b/drivers/isdn/capi/capifs.c
index f8570fd9d2ab..3abd7fc6e5ef 100644
--- a/drivers/isdn/capi/capifs.c
+++ b/drivers/isdn/capi/capifs.c
@@ -191,8 +191,10 @@ static int __init capifs_init(void)
         err = register_filesystem(&capifs_fs_type);
         if (!err) {
                 capifs_mnt = kern_mount(&capifs_fs_type);
-                if (IS_ERR(capifs_mnt))
+                if (IS_ERR(capifs_mnt)) {
                         err = PTR_ERR(capifs_mnt);
+                        unregister_filesystem(&capifs_fs_type);
+                }
         }
         if (!err)
                 printk(KERN_NOTICE "capifs: Rev %s\n", rev);
diff --git a/drivers/isdn/hisax/Kconfig b/drivers/isdn/hisax/Kconfig
index 6c7b8bffc6fd..801c98f30e5c 100644
--- a/drivers/isdn/hisax/Kconfig
+++ b/drivers/isdn/hisax/Kconfig
@@ -134,6 +134,7 @@ config HISAX_AVM_A1
 
 config HISAX_FRITZPCI
         bool "AVM PnP/PCI (Fritz!PnP/PCI)"
+        depends on BROKEN || !PPC64
         help
           This enables HiSax support for the AVM "Fritz!PnP" and "Fritz!PCI".
           See <file:Documentation/isdn/README.HiSax> on how to configure it.
diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
index f30e8e63ae0d..96c115e13389 100644
--- a/drivers/isdn/i4l/isdn_net.c
+++ b/drivers/isdn/i4l/isdn_net.c
@@ -1786,7 +1786,6 @@ isdn_net_receive(struct net_device *ndev, struct sk_buff *skb)
                 lp->stats.rx_bytes += skb->len;
         }
         skb->dev = ndev;
-        skb->input_dev = ndev;
         skb->pkt_type = PACKET_HOST;
         skb->mac.raw = skb->data;
 #ifdef ISDN_DEBUG_NET_DUMP
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index 260a323a96d3..d97a9be5469c 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -1177,7 +1177,6 @@ isdn_ppp_push_higher(isdn_net_dev * net_dev, isdn_net_local * lp, struct sk_buff
                 mlp->huptimer = 0;
 #endif /* CONFIG_IPPP_FILTER */
         skb->dev = dev;
-        skb->input_dev = dev;
         skb->mac.raw = skb->data;
         netif_rx(skb);
         /* net_dev->local->stats.rx_packets++; done in isdn_net.c */
diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
index e0d1b01cc74c..386df71eee74 100644
--- a/drivers/isdn/icn/icn.c
+++ b/drivers/isdn/icn/icn.c
@@ -1650,7 +1650,7 @@ static void __exit icn_exit(void)
 {
         isdn_ctrl cmd;
         icn_card *card = cards;
-        icn_card *last;
+        icn_card *last, *tmpcard;
         int i;
         unsigned long flags;
 
@@ -1670,8 +1670,9 @@ static void __exit icn_exit(void)
                         for (i = 0; i < ICN_BCH; i++)
                                 icn_free_queue(card, i);
                 }
-                card = card->next;
+                tmpcard = card->next;
                 spin_unlock_irqrestore(&card->lock, flags);
+                card = tmpcard;
         }
         card = cards;
         cards = NULL;
diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig
index 65ab64c43b3e..bc3e096d84f7 100644
--- a/drivers/macintosh/Kconfig
+++ b/drivers/macintosh/Kconfig
@@ -103,7 +103,7 @@ config PMAC_MEDIABAY
 # on non-powerbook machines (but only on PMU based ones AFAIK)
 config PMAC_BACKLIGHT
         bool "Backlight control for LCD screens"
-        depends on ADB_PMU
+        depends on ADB_PMU && (BROKEN || !PPC64)
         help
           Say Y here to build in code to manage the LCD backlight on a
           Macintosh PowerBook.  With this code, the backlight will be turned
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 70bca955e0de..41df4cda66e2 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -818,8 +818,7 @@ int bitmap_unplug(struct bitmap *bitmap)
         return 0;
 }
 
-static void bitmap_set_memory_bits(struct bitmap *bitmap, sector_t offset,
-        unsigned long sectors, int in_sync);
+static void bitmap_set_memory_bits(struct bitmap *bitmap, sector_t offset);
 /* * bitmap_init_from_disk -- called at bitmap_create time to initialize
  * the in-memory bitmap from the on-disk bitmap -- also, sets up the
  * memory mapping of the bitmap file
@@ -828,7 +827,7 @@ static void bitmap_set_memory_bits(struct bitmap *bitmap, sector_t offset,
  *   previously kicked from the array, we mark all the bits as
  *   1's in order to cause a full resync.
  */
-static int bitmap_init_from_disk(struct bitmap *bitmap, int in_sync)
+static int bitmap_init_from_disk(struct bitmap *bitmap)
 {
         unsigned long i, chunks, index, oldindex, bit;
         struct page *page = NULL, *oldpage = NULL;
@@ -929,8 +928,7 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, int in_sync)
                 }
                 if (test_bit(bit, page_address(page))) {
                         /* if the disk bit is set, set the memory bit */
-                        bitmap_set_memory_bits(bitmap,
-                                        i << CHUNK_BLOCK_SHIFT(bitmap), 1, in_sync);
+                        bitmap_set_memory_bits(bitmap, i << CHUNK_BLOCK_SHIFT(bitmap));
                         bit_cnt++;
                 }
         }
@@ -1426,35 +1424,53 @@ void bitmap_close_sync(struct bitmap *bitmap)
         }
 }
 
-static void bitmap_set_memory_bits(struct bitmap *bitmap, sector_t offset,
-                                   unsigned long sectors, int in_sync)
+static void bitmap_set_memory_bits(struct bitmap *bitmap, sector_t offset)
 {
         /* For each chunk covered by any of these sectors, set the
-         * counter to 1 and set resync_needed unless in_sync.  They should all
+         * counter to 1 and set resync_needed.  They should all
          * be 0 at this point
          */
-        while (sectors) {
-                int secs;
-                bitmap_counter_t *bmc;
-                spin_lock_irq(&bitmap->lock);
-                bmc = bitmap_get_counter(bitmap, offset, &secs, 1);
-                if (!bmc) {
-                        spin_unlock_irq(&bitmap->lock);
-                        return;
-                }
-                if (! *bmc) {
-                        struct page *page;
-                        *bmc = 1 | (in_sync? 0 : NEEDED_MASK);
-                        bitmap_count_page(bitmap, offset, 1);
-                        page = filemap_get_page(bitmap, offset >> CHUNK_BLOCK_SHIFT(bitmap));
-                        set_page_attr(bitmap, page, BITMAP_PAGE_CLEAN);
-                }
+
+        int secs;
+        bitmap_counter_t *bmc;
+        spin_lock_irq(&bitmap->lock);
+        bmc = bitmap_get_counter(bitmap, offset, &secs, 1);
+        if (!bmc) {
                 spin_unlock_irq(&bitmap->lock);
-                if (sectors > secs)
-                        sectors -= secs;
-                else
-                        sectors = 0;
+                return;
+        }
+        if (! *bmc) {
+                struct page *page;
+                *bmc = 1 | NEEDED_MASK;
+                bitmap_count_page(bitmap, offset, 1);
+                page = filemap_get_page(bitmap, offset >> CHUNK_BLOCK_SHIFT(bitmap));
+                set_page_attr(bitmap, page, BITMAP_PAGE_CLEAN);
         }
+        spin_unlock_irq(&bitmap->lock);
+
+}
+
+/*
+ * flush out any pending updates
+ */
+void bitmap_flush(mddev_t *mddev)
+{
+        struct bitmap *bitmap = mddev->bitmap;
+        int sleep;
+
+        if (!bitmap) /* there was no bitmap */
+                return;
+
+        /* run the daemon_work three time to ensure everything is flushed
+         * that can be
+         */
+        sleep = bitmap->daemon_sleep;
+        bitmap->daemon_sleep = 0;
+        bitmap_daemon_work(bitmap);
+        bitmap_daemon_work(bitmap);
+        bitmap_daemon_work(bitmap);
+        bitmap->daemon_sleep = sleep;
+        bitmap_update_sb(bitmap);
 }
 
 /*
@@ -1565,7 +1581,8 @@ int bitmap_create(mddev_t *mddev)
 
         /* now that we have some pages available, initialize the in-memory
          * bitmap from the on-disk bitmap */
-        err = bitmap_init_from_disk(bitmap, mddev->recovery_cp == MaxSector);
+        err = bitmap_init_from_disk(bitmap);
+
         if (err)
                 return err;
 
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index 12031c9d3f1e..b08df8b9b2ca 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -1230,7 +1230,7 @@ static int __init dm_mirror_init(void)
         if (r)
                 return r;
 
-        _kmirrord_wq = create_workqueue("kmirrord");
+        _kmirrord_wq = create_singlethread_workqueue("kmirrord");
         if (!_kmirrord_wq) {
                 DMERR("couldn't start kmirrord");
                 dm_dirty_log_exit();
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 6580e0fa4a47..20ca80b7dc20 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -256,8 +256,7 @@ static inline void mddev_unlock(mddev_t * mddev)
 {
         up(&mddev->reconfig_sem);
 
-        if (mddev->thread)
-                md_wakeup_thread(mddev->thread);
+        md_wakeup_thread(mddev->thread);
 }
 
 mdk_rdev_t * find_rdev_nr(mddev_t *mddev, int nr)
@@ -623,6 +622,7 @@ static int super_90_validate(mddev_t *mddev, mdk_rdev_t *rdev)
                 mddev->raid_disks = sb->raid_disks;
                 mddev->size = sb->size;
                 mddev->events = md_event(sb);
+                mddev->bitmap_offset = 0;
 
                 if (sb->state & (1<<MD_SB_CLEAN))
                         mddev->recovery_cp = MaxSector;
@@ -938,6 +938,7 @@ static int super_1_validate(mddev_t *mddev, mdk_rdev_t *rdev)
                 mddev->raid_disks = le32_to_cpu(sb->raid_disks);
                 mddev->size = le64_to_cpu(sb->size)/2;
                 mddev->events = le64_to_cpu(sb->events);
+                mddev->bitmap_offset = 0;
                 
                 mddev->recovery_cp = le64_to_cpu(sb->resync_offset);
                 memcpy(mddev->uuid, sb->set_uuid, 16);
@@ -1688,6 +1689,7 @@ static int do_md_run(mddev_t * mddev)
         mddev->pers = pers[pnum];
         spin_unlock(&pers_lock);
 
+        mddev->recovery = 0;
         mddev->resync_max_sectors = mddev->size << 1; /* may be over-ridden by personality */
 
         /* before we start the array running, initialise the bitmap */
@@ -1712,6 +1714,7 @@ static int do_md_run(mddev_t * mddev)
         mddev->in_sync = 1;
         
         set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
+        md_wakeup_thread(mddev->thread);
         
         if (mddev->sb_dirty)
                 md_update_sb(mddev);
@@ -1798,6 +1801,8 @@ static int do_md_stop(mddev_t * mddev, int ro)
                                 goto out;
                         mddev->ro = 1;
                 } else {
+                        bitmap_flush(mddev);
+                        wait_event(mddev->sb_wait, atomic_read(&mddev->pending_writes)==0);
                         if (mddev->ro)
                                 set_disk_ro(disk, 0);
                         blk_queue_make_request(mddev->queue, md_fail_request);
@@ -1822,6 +1827,7 @@ static int do_md_stop(mddev_t * mddev, int ro)
                 fput(mddev->bitmap_file);
                 mddev->bitmap_file = NULL;
         }
+        mddev->bitmap_offset = 0;
 
         /*
          * Free resources if final stop
@@ -2231,8 +2237,7 @@ static int add_new_disk(mddev_t * mddev, mdu_disk_info_t *info)
                         export_rdev(rdev);
 
                 set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
-                if (mddev->thread)
-                        md_wakeup_thread(mddev->thread);
+                md_wakeup_thread(mddev->thread);
                 return err;
         }
 
@@ -3484,7 +3489,6 @@ static void md_do_sync(mddev_t *mddev)
                         goto skip;
                 }
                 ITERATE_MDDEV(mddev2,tmp) {
-                        printk(".");
                         if (mddev2 == mddev)
                                 continue;
                         if (mddev2->curr_resync && 
@@ -4007,3 +4011,5 @@ EXPORT_SYMBOL(md_wakeup_thread);
 EXPORT_SYMBOL(md_print_devices);
 EXPORT_SYMBOL(md_check_recovery);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("md");
+MODULE_ALIAS_BLOCKDEV_MAJOR(MD_MAJOR);
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index d3a64a04a6d8..51d9645ed09c 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -893,7 +893,6 @@ static int end_sync_read(struct bio *bio, unsigned int bytes_done, int error)
         if (!uptodate) {
                 md_error(r1_bio->mddev,
                          conf->mirrors[r1_bio->read_disk].rdev);
-                set_bit(R1BIO_Degraded, &r1_bio->state);
         } else
                 set_bit(R1BIO_Uptodate, &r1_bio->state);
         rdev_dec_pending(conf->mirrors[r1_bio->read_disk].rdev, conf->mddev);
@@ -918,10 +917,9 @@ static int end_sync_write(struct bio *bio, unsigned int bytes_done, int error)
                         mirror = i;
                         break;
                 }
-        if (!uptodate) {
+        if (!uptodate)
                 md_error(mddev, conf->mirrors[mirror].rdev);
-                set_bit(R1BIO_Degraded, &r1_bio->state);
-        }
+
         update_head_pos(mirror, r1_bio);
 
         if (atomic_dec_and_test(&r1_bio->remaining)) {
@@ -1109,6 +1107,7 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
         int i;
         int write_targets = 0;
         int sync_blocks;
+        int still_degraded = 0;
 
         if (!conf->r1buf_pool)
         {
@@ -1137,7 +1136,10 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                 return 0;
         }
 
-        if (!bitmap_start_sync(mddev->bitmap, sector_nr, &sync_blocks, mddev->degraded) &&
+        /* before building a request, check if we can skip these blocks..
+         * This call the bitmap_start_sync doesn't actually record anything
+         */
+        if (!bitmap_start_sync(mddev->bitmap, sector_nr, &sync_blocks, 1) &&
             !conf->fullsync) {
                 /* We can skip this block, and probably several more */
                 *skipped = 1;
@@ -1203,24 +1205,23 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                 if (i == disk) {
                         bio->bi_rw = READ;
                         bio->bi_end_io = end_sync_read;
-                } else if (conf->mirrors[i].rdev &&
-                           !conf->mirrors[i].rdev->faulty &&
-                           (!conf->mirrors[i].rdev->in_sync ||
-                            sector_nr + RESYNC_SECTORS > mddev->recovery_cp)) {
+                } else if (conf->mirrors[i].rdev == NULL ||
+                           conf->mirrors[i].rdev->faulty) {
+                        still_degraded = 1;
+                        continue;
+                } else if (!conf->mirrors[i].rdev->in_sync ||
+                           sector_nr + RESYNC_SECTORS > mddev->recovery_cp) {
                         bio->bi_rw = WRITE;
                         bio->bi_end_io = end_sync_write;
                         write_targets ++;
                 } else
+                        /* no need to read or write here */
                         continue;
                 bio->bi_sector = sector_nr + conf->mirrors[i].rdev->data_offset;
                 bio->bi_bdev = conf->mirrors[i].rdev->bdev;
                 bio->bi_private = r1_bio;
         }
 
-        if (write_targets + 1 < conf->raid_disks)
-                /* array degraded, can't clear bitmap */
-                set_bit(R1BIO_Degraded, &r1_bio->state);
-
         if (write_targets == 0) {
                 /* There is nowhere to write, so all non-sync
                  * drives must be failed - so we are finished
@@ -1243,7 +1244,7 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                         break;
                 if (sync_blocks == 0) {
                         if (!bitmap_start_sync(mddev->bitmap, sector_nr,
-                                        &sync_blocks, mddev->degraded) &&
+                                        &sync_blocks, still_degraded) &&
                                         !conf->fullsync)
                                 break;
                         if (sync_blocks < (PAGE_SIZE>>9))
diff --git a/drivers/media/dvb/dvb-usb/dibusb-common.c b/drivers/media/dvb/dvb-usb/dibusb-common.c
index 63b626f70c81..9b9d6f8ee74e 100644
--- a/drivers/media/dvb/dvb-usb/dibusb-common.c
+++ b/drivers/media/dvb/dvb-usb/dibusb-common.c
@@ -70,13 +70,22 @@ EXPORT_SYMBOL(dibusb_power_ctrl);
 
 int dibusb2_0_streaming_ctrl(struct dvb_usb_device *d, int onoff)
 {
-        u8 b[2];
-        b[0] = DIBUSB_REQ_SET_IOCTL;
-        b[1] = onoff ? DIBUSB_IOCTL_CMD_ENABLE_STREAM : DIBUSB_IOCTL_CMD_DISABLE_STREAM;
+        u8 b[3] = { 0 };
+        int ret;
+
+        if ((ret = dibusb_streaming_ctrl(d,onoff)) < 0)
+                return ret;
 
-        dvb_usb_generic_write(d,b,3);
+        if (onoff) {
+                b[0] = DIBUSB_REQ_SET_STREAMING_MODE;
+                b[1] = 0x00;
+                if ((ret = dvb_usb_generic_write(d,b,2)) < 0)
+                        return ret;
+        }
 
-        return dibusb_streaming_ctrl(d,onoff);
+        b[0] = DIBUSB_REQ_SET_IOCTL;
+        b[1] = onoff ? DIBUSB_IOCTL_CMD_ENABLE_STREAM : DIBUSB_IOCTL_CMD_DISABLE_STREAM;
+        return dvb_usb_generic_write(d,b,3);
 }
 EXPORT_SYMBOL(dibusb2_0_streaming_ctrl);
 
diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-dvb.c b/drivers/media/dvb/dvb-usb/dvb-usb-dvb.c
index 3491ff40885c..6fa92100248b 100644
--- a/drivers/media/dvb/dvb-usb/dvb-usb-dvb.c
+++ b/drivers/media/dvb/dvb-usb/dvb-usb-dvb.c
@@ -23,12 +23,12 @@ static int dvb_usb_ctrl_feed(struct dvb_demux_feed *dvbdmxfeed, int onoff)
          */
         if (newfeedcount == 0) {
                 deb_ts("stop feeding\n");
+                dvb_usb_urb_kill(d);
 
                 if (d->props.streaming_ctrl != NULL)
                         if ((ret = d->props.streaming_ctrl(d,0)))
                                 err("error while stopping stream.");
 
-                dvb_usb_urb_kill(d);
         }
 
         d->feedcount = newfeedcount;
@@ -44,6 +44,8 @@ static int dvb_usb_ctrl_feed(struct dvb_demux_feed *dvbdmxfeed, int onoff)
          * for reception.
          */
         if (d->feedcount == onoff && d->feedcount > 0) {
+                deb_ts("submitting all URBs\n");
+                dvb_usb_urb_submit(d);
 
                 deb_ts("controlling pid parser\n");
                 if (d->props.caps & DVB_USB_HAS_PID_FILTER &&
@@ -59,7 +61,6 @@ static int dvb_usb_ctrl_feed(struct dvb_demux_feed *dvbdmxfeed, int onoff)
                                 return -ENODEV;
                         }
 
-                dvb_usb_urb_submit(d);
         }
         return 0;
 }
diff --git a/drivers/media/dvb/frontends/Kconfig b/drivers/media/dvb/frontends/Kconfig
index e83256d0fd14..a50a41f6f79d 100644
--- a/drivers/media/dvb/frontends/Kconfig
+++ b/drivers/media/dvb/frontends/Kconfig
@@ -188,7 +188,7 @@ config DVB_BCM3510
           support this frontend.
 
 config DVB_LGDT330X
-        tristate "LGDT3302 or LGDT3303 based (DViCO FusionHDTV Gold)"
+        tristate "LG Electronics LGDT3302/LGDT3303 based"
         depends on DVB_CORE
         help
           An ATSC 8VSB and QAM64/256 tuner module. Say Y when you want
diff --git a/drivers/media/dvb/frontends/dvb-pll.c b/drivers/media/dvb/frontends/dvb-pll.c
index 5264310c070e..536c35d969b7 100644
--- a/drivers/media/dvb/frontends/dvb-pll.c
+++ b/drivers/media/dvb/frontends/dvb-pll.c
@@ -225,6 +225,22 @@ struct dvb_pll_desc dvb_pll_tua6034 = {
 };
 EXPORT_SYMBOL(dvb_pll_tua6034);
 
+/* Infineon TUA6034
+ * used in LG Innotek TDVS-H062F
+ */
+struct dvb_pll_desc dvb_pll_tdvs_tua6034 = {
+        .name  = "LG/Infineon TUA6034",
+        .min   =  54000000,
+        .max   = 863000000,
+        .count = 3,
+        .entries = {
+                {  160000000, 44000000, 62500, 0xce, 0x01 },
+                {  455000000, 44000000, 62500, 0xce, 0x02 },
+                {  999999999, 44000000, 62500, 0xce, 0x04 },
+        },
+};
+EXPORT_SYMBOL(dvb_pll_tdvs_tua6034);
+
 /* Philips FMD1216ME
  * used in Medion Hybrid PCMCIA card and USB Box
  */
diff --git a/drivers/media/dvb/frontends/dvb-pll.h b/drivers/media/dvb/frontends/dvb-pll.h
index cb794759d89e..205b2d1a8852 100644
--- a/drivers/media/dvb/frontends/dvb-pll.h
+++ b/drivers/media/dvb/frontends/dvb-pll.h
@@ -31,6 +31,7 @@ extern struct dvb_pll_desc dvb_pll_unknown_1;
 extern struct dvb_pll_desc dvb_pll_tua6010xs;
 extern struct dvb_pll_desc dvb_pll_env57h1xd5;
 extern struct dvb_pll_desc dvb_pll_tua6034;
+extern struct dvb_pll_desc dvb_pll_tdvs_tua6034;
 extern struct dvb_pll_desc dvb_pll_tda665x;
 extern struct dvb_pll_desc dvb_pll_fmd1216me;
 extern struct dvb_pll_desc dvb_pll_tded4;
diff --git a/drivers/media/dvb/frontends/lgdt330x.c b/drivers/media/dvb/frontends/lgdt330x.c
index e94dee50eecd..1f1cd7a8d500 100644
--- a/drivers/media/dvb/frontends/lgdt330x.c
+++ b/drivers/media/dvb/frontends/lgdt330x.c
@@ -1,11 +1,8 @@
 /*
- *    Support for LGDT3302 & LGDT3303 (DViCO FusionHDTV Gold) - VSB/QAM
+ *    Support for LGDT3302 and LGDT3303 - VSB/QAM
  *
  *    Copyright (C) 2005 Wilson Michaels <wilsonmichaels@earthlink.net>
  *
- *    Based on code from  Kirk Lapray <kirk_lapray@bigfoot.com>
- *                           Copyright (C) 2005
- *
  *    This program is free software; you can redistribute it and/or modify
  *    it under the terms of the GNU General Public License as published by
  *    the Free Software Foundation; either version 2 of the License, or
@@ -25,11 +22,13 @@
 /*
  *                      NOTES ABOUT THIS DRIVER
  *
- * This driver supports DViCO FusionHDTV Gold under Linux.
+ * This Linux driver supports:
+ *   DViCO FusionHDTV 3 Gold-Q
+ *   DViCO FusionHDTV 3 Gold-T
+ *   DViCO FusionHDTV 5 Gold
  *
  * TODO:
- * BER and signal strength always return 0.
- * Include support for LGDT3303
+ * signal strength always returns 0.
  *
  */
 
@@ -41,7 +40,6 @@
 #include <asm/byteorder.h>
 
 #include "dvb_frontend.h"
-#include "dvb-pll.h"
 #include "lgdt330x_priv.h"
 #include "lgdt330x.h"
 
@@ -70,55 +68,37 @@ struct lgdt330x_state
         u32 current_frequency;
 };
 
-static int i2c_writebytes (struct lgdt330x_state* state,
-                           u8 addr, /* demod_address or pll_address */
+static int i2c_write_demod_bytes (struct lgdt330x_state* state,
                            u8 *buf, /* data bytes to send */
                            int len  /* number of bytes to send */ )
 {
-        u8 tmp[] = { buf[0], buf[1] };
         struct i2c_msg msg =
-                { .addr = addr, .flags = 0, .buf = tmp,  .len = 2 };
-        int err;
+                { .addr = state->config->demod_address,
+                  .flags = 0,
+                  .buf = buf,
+                  .len = 2 };
         int i;
+        int err;
 
-        for (i=1; i<len; i++) {
-                tmp[1] = buf[i];
+        for (i=0; i<len-1; i+=2){
                 if ((err = i2c_transfer(state->i2c, &msg, 1)) != 1) {
-                        printk(KERN_WARNING "lgdt330x: %s error (addr %02x <- %02x, err == %i)\n", __FUNCTION__, addr, buf[0], err);
+                        printk(KERN_WARNING "lgdt330x: %s error (addr %02x <- %02x, err = %i)\n", __FUNCTION__, msg.buf[0], msg.buf[1], err);
                         if (err < 0)
                                 return err;
                         else
                                 return -EREMOTEIO;
                 }
-                tmp[0]++;
+                msg.buf += 2;
         }
         return 0;
 }
 
-#if 0
-static int i2c_readbytes (struct lgdt330x_state* state,
-                          u8 addr, /* demod_address or pll_address */
-                          u8 *buf, /* holds data bytes read */
-                          int len  /* number of bytes to read */ )
-{
-        struct i2c_msg msg =
-                { .addr = addr, .flags = I2C_M_RD, .buf = buf,  .len = len };
-        int err;
-
-        if ((err = i2c_transfer(state->i2c, &msg, 1)) != 1) {
-                printk(KERN_WARNING "lgdt330x: %s error (addr %02x, err == %i)\n", __FUNCTION__, addr, err);
-                return -EREMOTEIO;
-        }
-        return 0;
-}
-#endif
-
 /*
  * This routine writes the register (reg) to the demod bus
  * then reads the data returned for (len) bytes.
  */
 
-static u8 i2c_selectreadbytes (struct lgdt330x_state* state,
+static u8 i2c_read_demod_bytes (struct lgdt330x_state* state,
                                enum I2C_REG reg, u8* buf, int len)
 {
         u8 wr [] = { reg };
@@ -139,7 +119,7 @@ static u8 i2c_selectreadbytes (struct lgdt330x_state* state,
 }
 
 /* Software reset */
-int lgdt330x_SwReset(struct lgdt330x_state* state)
+static int lgdt3302_SwReset(struct lgdt330x_state* state)
 {
         u8 ret;
         u8 reset[] = {
@@ -148,23 +128,51 @@ int lgdt330x_SwReset(struct lgdt330x_state* state)
                       * bits 5-0 are 1 to mask interrupts */
         };
 
-        ret = i2c_writebytes(state,
-                             state->config->demod_address,
+        ret = i2c_write_demod_bytes(state,
+                             reset, sizeof(reset));
+        if (ret == 0) {
+
+                /* force reset high (inactive) and unmask interrupts */
+                reset[1] = 0x7f;
+                ret = i2c_write_demod_bytes(state,
+                                     reset, sizeof(reset));
+        }
+        return ret;
+}
+
+static int lgdt3303_SwReset(struct lgdt330x_state* state)
+{
+        u8 ret;
+        u8 reset[] = {
+                0x02,
+                0x00 /* bit 0 is active low software reset */
+        };
+
+        ret = i2c_write_demod_bytes(state,
                              reset, sizeof(reset));
         if (ret == 0) {
-                /* spec says reset takes 100 ns why wait */
-                /* mdelay(100);    */ /* keep low for 100mS */
-                reset[1] = 0x7f;      /* force reset high (inactive)
-                                       * and unmask interrupts */
-                ret = i2c_writebytes(state,
-                                     state->config->demod_address,
+
+                /* force reset high (inactive) */
+                reset[1] = 0x01;
+                ret = i2c_write_demod_bytes(state,
                                      reset, sizeof(reset));
         }
-        /* Spec does not indicate a need for this either */
-        /*mdelay(5); */               /* wait 5 msec before doing more */
         return ret;
 }
 
+static int lgdt330x_SwReset(struct lgdt330x_state* state)
+{
+        switch (state->config->demod_chip) {
+        case LGDT3302:
+                return lgdt3302_SwReset(state);
+        case LGDT3303:
+                return lgdt3303_SwReset(state);
+        default:
+                return -ENODEV;
+        }
+}
+
+
 static int lgdt330x_init(struct dvb_frontend* fe)
 {
         /* Hardware reset is done using gpio[0] of cx23880x chip.
@@ -173,22 +181,98 @@ static int lgdt330x_init(struct dvb_frontend* fe)
          * Maybe there needs to be a callable function in cx88-core or
          * the caller of this function needs to do it. */
 
-        dprintk("%s entered\n", __FUNCTION__);
-        return lgdt330x_SwReset((struct lgdt330x_state*) fe->demodulator_priv);
+        /*
+         * Array of byte pairs <address, value>
+         * to initialize each different chip
+         */
+        static u8 lgdt3302_init_data[] = {
+                /* Use 50MHz parameter values from spec sheet since xtal is 50 */
+                /* Change the value of NCOCTFV[25:0] of carrier
+                   recovery center frequency register */
+                VSB_CARRIER_FREQ0, 0x00,
+                VSB_CARRIER_FREQ1, 0x87,
+                VSB_CARRIER_FREQ2, 0x8e,
+                VSB_CARRIER_FREQ3, 0x01,
+                /* Change the TPCLK pin polarity
+                   data is valid on falling clock */
+                DEMUX_CONTROL, 0xfb,
+                /* Change the value of IFBW[11:0] of
+                   AGC IF/RF loop filter bandwidth register */
+                AGC_RF_BANDWIDTH0, 0x40,
+                AGC_RF_BANDWIDTH1, 0x93,
+                AGC_RF_BANDWIDTH2, 0x00,
+                /* Change the value of bit 6, 'nINAGCBY' and
+                   'NSSEL[1:0] of ACG function control register 2 */
+                AGC_FUNC_CTRL2, 0xc6,
+                /* Change the value of bit 6 'RFFIX'
+                   of AGC function control register 3 */
+                AGC_FUNC_CTRL3, 0x40,
+                /* Set the value of 'INLVTHD' register 0x2a/0x2c
+                   to 0x7fe */
+                AGC_DELAY0, 0x07,
+                AGC_DELAY2, 0xfe,
+                /* Change the value of IAGCBW[15:8]
+                   of inner AGC loop filter bandwith */
+                AGC_LOOP_BANDWIDTH0, 0x08,
+                AGC_LOOP_BANDWIDTH1, 0x9a
+        };
+
+        static u8 lgdt3303_init_data[] = {
+                0x4c, 0x14
+        };
+
+        struct lgdt330x_state* state = fe->demodulator_priv;
+        char  *chip_name;
+        int    err;
+
+        switch (state->config->demod_chip) {
+        case LGDT3302:
+                chip_name = "LGDT3302";
+                err = i2c_write_demod_bytes(state, lgdt3302_init_data,
+                                                                        sizeof(lgdt3302_init_data));
+                break;
+        case LGDT3303:
+                chip_name = "LGDT3303";
+                err = i2c_write_demod_bytes(state, lgdt3303_init_data,
+                                                                        sizeof(lgdt3303_init_data));
+                break;
+        default:
+                chip_name = "undefined";
+                printk (KERN_WARNING "Only LGDT3302 and LGDT3303 are supported chips.\n");
+                err = -ENODEV;
+        }
+        dprintk("%s entered as %s\n", __FUNCTION__, chip_name);
+        if (err < 0)
+                return err;
+        return lgdt330x_SwReset(state);
 }
 
 static int lgdt330x_read_ber(struct dvb_frontend* fe, u32* ber)
 {
-        *ber = 0; /* Dummy out for now */
+        *ber = 0; /* Not supplied by the demod chips */
         return 0;
 }
 
 static int lgdt330x_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 {
-        struct lgdt330x_state* state = (struct lgdt330x_state*) fe->demodulator_priv;
+        struct lgdt330x_state* state = fe->demodulator_priv;
+        int err;
         u8 buf[2];
 
-        i2c_selectreadbytes(state, PACKET_ERR_COUNTER1, buf, sizeof(buf));
+        switch (state->config->demod_chip) {
+        case LGDT3302:
+                err = i2c_read_demod_bytes(state, LGDT3302_PACKET_ERR_COUNTER1,
+                                                                  buf, sizeof(buf));
+                break;
+        case LGDT3303:
+                err = i2c_read_demod_bytes(state, LGDT3303_PACKET_ERR_COUNTER1,
+                                                                  buf, sizeof(buf));
+                break;
+        default:
+                printk(KERN_WARNING
+                           "Only LGDT3302 and LGDT3303 are supported chips.\n");
+                err = -ENODEV;
+        }
 
         *ucblocks = (buf[0] << 8) | buf[1];
         return 0;
@@ -197,123 +281,113 @@ static int lgdt330x_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 static int lgdt330x_set_parameters(struct dvb_frontend* fe,
                                    struct dvb_frontend_parameters *param)
 {
-        struct lgdt330x_state* state =
-                (struct lgdt330x_state*) fe->demodulator_priv;
+        /*
+         * Array of byte pairs <address, value>
+         * to initialize 8VSB for lgdt3303 chip 50 MHz IF
+         */
+        static u8 lgdt3303_8vsb_44_data[] = {
+                0x04, 0x00,
+                0x0d, 0x40,
+        0x0e, 0x87,
+        0x0f, 0x8e,
+        0x10, 0x01,
+        0x47, 0x8b };
+
+        /*
+         * Array of byte pairs <address, value>
+         * to initialize QAM for lgdt3303 chip
+         */
+        static u8 lgdt3303_qam_data[] = {
+                0x04, 0x00,
+                0x0d, 0x00,
+                0x0e, 0x00,
+                0x0f, 0x00,
+                0x10, 0x00,
+                0x51, 0x63,
+                0x47, 0x66,
+                0x48, 0x66,
+                0x4d, 0x1a,
+                0x49, 0x08,
+                0x4a, 0x9b };
+
+        struct lgdt330x_state* state = fe->demodulator_priv;
 
-        /* Use 50MHz parameter values from spec sheet since xtal is 50 */
         static u8 top_ctrl_cfg[]   = { TOP_CONTROL, 0x03 };
-        static u8 vsb_freq_cfg[]   = { VSB_CARRIER_FREQ0, 0x00, 0x87, 0x8e, 0x01 };
-        static u8 demux_ctrl_cfg[] = { DEMUX_CONTROL, 0xfb };
-        static u8 agc_rf_cfg[]     = { AGC_RF_BANDWIDTH0, 0x40, 0x93, 0x00 };
-        static u8 agc_ctrl_cfg[]   = { AGC_FUNC_CTRL2, 0xc6, 0x40 };
-        static u8 agc_delay_cfg[]  = { AGC_DELAY0, 0x07, 0x00, 0xfe };
-        static u8 agc_loop_cfg[]   = { AGC_LOOP_BANDWIDTH0, 0x08, 0x9a };
 
+        int err;
         /* Change only if we are actually changing the modulation */
         if (state->current_modulation != param->u.vsb.modulation) {
                 switch(param->u.vsb.modulation) {
                 case VSB_8:
                         dprintk("%s: VSB_8 MODE\n", __FUNCTION__);
 
-                        /* Select VSB mode and serial MPEG interface */
-                        top_ctrl_cfg[1] = 0x07;
+                        /* Select VSB mode */
+                        top_ctrl_cfg[1] = 0x03;
 
                         /* Select ANT connector if supported by card */
                         if (state->config->pll_rf_set)
                                 state->config->pll_rf_set(fe, 1);
+
+                        if (state->config->demod_chip == LGDT3303) {
+                                err = i2c_write_demod_bytes(state, lgdt3303_8vsb_44_data,
+                                                                                        sizeof(lgdt3303_8vsb_44_data));
+                        }
                         break;
 
                 case QAM_64:
                         dprintk("%s: QAM_64 MODE\n", __FUNCTION__);
 
-                        /* Select QAM_64 mode and serial MPEG interface */
-                        top_ctrl_cfg[1] = 0x04;
+                        /* Select QAM_64 mode */
+                        top_ctrl_cfg[1] = 0x00;
 
                         /* Select CABLE connector if supported by card */
                         if (state->config->pll_rf_set)
                                 state->config->pll_rf_set(fe, 0);
+
+                        if (state->config->demod_chip == LGDT3303) {
+                                err = i2c_write_demod_bytes(state, lgdt3303_qam_data,
+                                                                                        sizeof(lgdt3303_qam_data));
+                        }
                         break;
 
                 case QAM_256:
                         dprintk("%s: QAM_256 MODE\n", __FUNCTION__);
 
-                        /* Select QAM_256 mode and serial MPEG interface */
-                        top_ctrl_cfg[1] = 0x05;
+                        /* Select QAM_256 mode */
+                        top_ctrl_cfg[1] = 0x01;
 
                         /* Select CABLE connector if supported by card */
                         if (state->config->pll_rf_set)
                                 state->config->pll_rf_set(fe, 0);
+
+                        if (state->config->demod_chip == LGDT3303) {
+                                err = i2c_write_demod_bytes(state, lgdt3303_qam_data,
+                                                                                        sizeof(lgdt3303_qam_data));
+                        }
                         break;
                 default:
                         printk(KERN_WARNING "lgdt330x: %s: Modulation type(%d) UNSUPPORTED\n", __FUNCTION__, param->u.vsb.modulation);
                         return -1;
                 }
-                /* Initializations common to all modes */
+                /*
+                 * select serial or parallel MPEG harware interface
+                 * Serial:   0x04 for LGDT3302 or 0x40 for LGDT3303
+                 * Parallel: 0x00
+                 */
+                top_ctrl_cfg[1] |= state->config->serial_mpeg;
 
                 /* Select the requested mode */
-                i2c_writebytes(state, state->config->demod_address,
-                               top_ctrl_cfg, sizeof(top_ctrl_cfg));
-
-                /* Change the value of IFBW[11:0]
-                   of AGC IF/RF loop filter bandwidth register */
-                i2c_writebytes(state, state->config->demod_address,
-                               agc_rf_cfg, sizeof(agc_rf_cfg));
-
-                /* Change the value of bit 6, 'nINAGCBY' and
-                   'NSSEL[1:0] of ACG function control register 2 */
-                /* Change the value of bit 6 'RFFIX'
-                   of AGC function control register 3 */
-                i2c_writebytes(state, state->config->demod_address,
-                               agc_ctrl_cfg, sizeof(agc_ctrl_cfg));
-
-                /* Change the TPCLK pin polarity
-                   data is valid on falling clock */
-                i2c_writebytes(state, state->config->demod_address,
-                               demux_ctrl_cfg, sizeof(demux_ctrl_cfg));
-
-                /* Change the value of NCOCTFV[25:0] of carrier
-                   recovery center frequency register */
-                i2c_writebytes(state, state->config->demod_address,
-                                       vsb_freq_cfg, sizeof(vsb_freq_cfg));
-
-                /* Set the value of 'INLVTHD' register 0x2a/0x2c to 0x7fe */
-                i2c_writebytes(state, state->config->demod_address,
-                               agc_delay_cfg, sizeof(agc_delay_cfg));
-
-                /* Change the value of IAGCBW[15:8]
-                   of inner AGC loop filter bandwith */
-                i2c_writebytes(state, state->config->demod_address,
-                               agc_loop_cfg, sizeof(agc_loop_cfg));
-
+                i2c_write_demod_bytes(state, top_ctrl_cfg,
+                                                          sizeof(top_ctrl_cfg));
                 state->config->set_ts_params(fe, 0);
                 state->current_modulation = param->u.vsb.modulation;
         }
 
         /* Change only if we are actually changing the channel */
         if (state->current_frequency != param->frequency) {
-                u8 buf[5];
-                struct i2c_msg msg = { .flags = 0, .buf = &buf[1], .len = 4 };
-                int err;
-
-                state->config->pll_set(fe, param, buf);
-                msg.addr = buf[0];
-
-                dprintk("%s: tuner at 0x%02x bytes: 0x%02x 0x%02x "
-                        "0x%02x 0x%02x\n", __FUNCTION__,
-                        buf[0],buf[1],buf[2],buf[3],buf[4]);
-                if ((err = i2c_transfer(state->i2c, &msg, 1)) != 1) {
-                        printk(KERN_WARNING "lgdt330x: %s error (addr %02x <- %02x, err = %i)\n", __FUNCTION__, buf[0], buf[1], err);
-                        if (err < 0)
-                                return err;
-                        else
-                                return -EREMOTEIO;
-                }
-#if 0
-                /* Check the status of the tuner pll */
-                i2c_readbytes(state, buf[0], &buf[1], 1);
-                dprintk("%s: tuner status byte = 0x%02x\n", __FUNCTION__, buf[1]);
-#endif
-                /* Update current frequency */
+                /* Tune to the new frequency */
+                state->config->pll_set(fe, param);
+                /* Keep track of the new frequency */
                 state->current_frequency = param->frequency;
         }
         lgdt330x_SwReset(state);
@@ -328,21 +402,15 @@ static int lgdt330x_get_frontend(struct dvb_frontend* fe,
         return 0;
 }
 
-static int lgdt330x_read_status(struct dvb_frontend* fe, fe_status_t* status)
+static int lgdt3302_read_status(struct dvb_frontend* fe, fe_status_t* status)
 {
-        struct lgdt330x_state* state = (struct lgdt330x_state*) fe->demodulator_priv;
+        struct lgdt330x_state* state = fe->demodulator_priv;
         u8 buf[3];
 
         *status = 0; /* Reset status result */
 
-        /*
-         * You must set the Mask bits to 1 in the IRQ_MASK in order
-         * to see that status bit in the IRQ_STATUS register.
-         * This is done in SwReset();
-         */
-
         /* AGC status register */
-        i2c_selectreadbytes(state, AGC_STATUS, buf, 1);
+        i2c_read_demod_bytes(state, AGC_STATUS, buf, 1);
         dprintk("%s: AGC_STATUS = 0x%02x\n", __FUNCTION__, buf[0]);
         if ((buf[0] & 0x0c) == 0x8){
                 /* Test signal does not exist flag */
@@ -353,16 +421,15 @@ static int lgdt330x_read_status(struct dvb_frontend* fe, fe_status_t* status)
                 return 0;
         }
 
+        /*
+         * You must set the Mask bits to 1 in the IRQ_MASK in order
+         * to see that status bit in the IRQ_STATUS register.
+         * This is done in SwReset();
+         */
         /* signal status */
-        i2c_selectreadbytes(state, TOP_CONTROL, buf, sizeof(buf));
+        i2c_read_demod_bytes(state, TOP_CONTROL, buf, sizeof(buf));
         dprintk("%s: TOP_CONTROL = 0x%02x, IRO_MASK = 0x%02x, IRQ_STATUS = 0x%02x\n", __FUNCTION__, buf[0], buf[1], buf[2]);
 
-#if 0
-        /* Alternative method to check for a signal */
-        /* using the SNR good/bad interrupts.   */
-        if ((buf[2] & 0x30) == 0x10)
-                *status |= FE_HAS_SIGNAL;
-#endif
 
         /* sync status */
         if ((buf[2] & 0x03) == 0x01) {
@@ -376,7 +443,7 @@ static int lgdt330x_read_status(struct dvb_frontend* fe, fe_status_t* status)
         }
 
         /* Carrier Recovery Lock Status Register */
-        i2c_selectreadbytes(state, CARRIER_LOCK, buf, 1);
+        i2c_read_demod_bytes(state, CARRIER_LOCK, buf, 1);
         dprintk("%s: CARRIER_LOCK = 0x%02x\n", __FUNCTION__, buf[0]);
         switch (state->current_modulation) {
         case QAM_256:
@@ -396,13 +463,75 @@ static int lgdt330x_read_status(struct dvb_frontend* fe, fe_status_t* status)
         return 0;
 }
 
+static int lgdt3303_read_status(struct dvb_frontend* fe, fe_status_t* status)
+{
+        struct lgdt330x_state* state = fe->demodulator_priv;
+        int err;
+        u8 buf[3];
+
+        *status = 0; /* Reset status result */
+
+        /* lgdt3303 AGC status register */
+        err = i2c_read_demod_bytes(state, 0x58, buf, 1);
+        if (err < 0)
+                return err;
+
+        dprintk("%s: AGC_STATUS = 0x%02x\n", __FUNCTION__, buf[0]);
+        if ((buf[0] & 0x21) == 0x01){
+                /* Test input signal does not exist flag */
+                /* as well as the AGC lock flag.   */
+                *status |= FE_HAS_SIGNAL;
+        } else {
+                /* Without a signal all other status bits are meaningless */
+                return 0;
+        }
+
+        /* Carrier Recovery Lock Status Register */
+        i2c_read_demod_bytes(state, CARRIER_LOCK, buf, 1);
+        dprintk("%s: CARRIER_LOCK = 0x%02x\n", __FUNCTION__, buf[0]);
+        switch (state->current_modulation) {
+        case QAM_256:
+        case QAM_64:
+                /* Need to undestand why there are 3 lock levels here */
+                if ((buf[0] & 0x07) == 0x07)
+                        *status |= FE_HAS_CARRIER;
+                else
+                        break;
+                i2c_read_demod_bytes(state, 0x8a, buf, 1);
+                if ((buf[0] & 0x04) == 0x04)
+                        *status |= FE_HAS_SYNC;
+                if ((buf[0] & 0x01) == 0x01)
+                        *status |= FE_HAS_LOCK;
+                if ((buf[0] & 0x08) == 0x08)
+                        *status |= FE_HAS_VITERBI;
+                break;
+        case VSB_8:
+                if ((buf[0] & 0x80) == 0x80)
+                        *status |= FE_HAS_CARRIER;
+                else
+                        break;
+                i2c_read_demod_bytes(state, 0x38, buf, 1);
+                if ((buf[0] & 0x02) == 0x00)
+                        *status |= FE_HAS_SYNC;
+                if ((buf[0] & 0x01) == 0x01) {
+                        *status |= FE_HAS_LOCK;
+                        *status |= FE_HAS_VITERBI;
+                }
+                break;
+        default:
+                printk("KERN_WARNING lgdt330x: %s: Modulation set to unsupported value\n", __FUNCTION__);
+        }
+        return 0;
+}
+
 static int lgdt330x_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 {
         /* not directly available. */
+        *strength = 0;
         return 0;
 }
 
-static int lgdt330x_read_snr(struct dvb_frontend* fe, u16* snr)
+static int lgdt3302_read_snr(struct dvb_frontend* fe, u16* snr)
 {
 #ifdef SNR_IN_DB
         /*
@@ -451,7 +580,7 @@ static int lgdt330x_read_snr(struct dvb_frontend* fe, u16* snr)
                   91,    115,    144,    182,    229,    288, 362,   456,   574,   722,
                   909,   1144,   1440,   1813,   2282,   2873, 3617,  4553,  5732,  7216,
                   9084,  11436,  14396,  18124,  22817,  28724,  36161, 45524, 57312, 72151,
-                  90833, 114351, 143960, 181235, 228161, 0x040000
+                  90833, 114351, 143960, 181235, 228161, 0x080000
                 };
 
         static u8 buf[5];/* read data buffer */
@@ -459,8 +588,8 @@ static int lgdt330x_read_snr(struct dvb_frontend* fe, u16* snr)
         static u32 snr_db;  /* index into SNR_EQ[] */
         struct lgdt330x_state* state = (struct lgdt330x_state*) fe->demodulator_priv;
 
-        /* read both equalizer and pase tracker noise data */
-        i2c_selectreadbytes(state, EQPH_ERR0, buf, sizeof(buf));
+        /* read both equalizer and phase tracker noise data */
+        i2c_read_demod_bytes(state, EQPH_ERR0, buf, sizeof(buf));
 
         if (state->current_modulation == VSB_8) {
                 /* Equalizer Mean-Square Error Register for VSB */
@@ -496,19 +625,20 @@ static int lgdt330x_read_snr(struct dvb_frontend* fe, u16* snr)
         struct lgdt330x_state* state = (struct lgdt330x_state*) fe->demodulator_priv;
 
         /* read both equalizer and pase tracker noise data */
-        i2c_selectreadbytes(state, EQPH_ERR0, buf, sizeof(buf));
+        i2c_read_demod_bytes(state, EQPH_ERR0, buf, sizeof(buf));
 
         if (state->current_modulation == VSB_8) {
-                /* Equalizer Mean-Square Error Register for VSB */
-                noise = ((buf[0] & 7) << 16) | (buf[1] << 8) | buf[2];
-        } else {
-                /* Phase Tracker Mean-Square Error Register for QAM */
+                /* Phase Tracker Mean-Square Error Register for VSB */
                 noise = ((buf[0] & 7<<3) << 13) | (buf[3] << 8) | buf[4];
+        } else {
+
+                /* Carrier Recovery Mean-Square Error for QAM */
+                i2c_read_demod_bytes(state, 0x1a, buf, 2);
+                noise = ((buf[0] & 3) << 8) | buf[1];
         }
 
         /* Small values for noise mean signal is better so invert noise */
-        /* Noise is 19 bit value so discard 3 LSB*/
-        *snr = ~noise>>3;
+        *snr = ~noise;
 #endif
 
         dprintk("%s: noise = 0x%05x, snr = %idb\n",__FUNCTION__, noise, *snr);
@@ -516,6 +646,32 @@ static int lgdt330x_read_snr(struct dvb_frontend* fe, u16* snr)
         return 0;
 }
 
+static int lgdt3303_read_snr(struct dvb_frontend* fe, u16* snr)
+{
+        /* Return the raw noise value */
+        static u8 buf[5];/* read data buffer */
+        static u32 noise;   /* noise value */
+        struct lgdt330x_state* state = (struct lgdt330x_state*) fe->demodulator_priv;
+
+        if (state->current_modulation == VSB_8) {
+
+                /* Phase Tracker Mean-Square Error Register for VSB */
+                noise = ((buf[0] & 7) << 16) | (buf[3] << 8) | buf[4];
+        } else {
+
+                /* Carrier Recovery Mean-Square Error for QAM */
+                i2c_read_demod_bytes(state, 0x1a, buf, 2);
+                noise = (buf[0] << 8) | buf[1];
+        }
+
+        /* Small values for noise mean signal is better so invert noise */
+        *snr = ~noise;
+
+        dprintk("%s: noise = 0x%05x, snr = %idb\n",__FUNCTION__, noise, *snr);
+
+        return 0;
+}
+
 static int lgdt330x_get_tune_settings(struct dvb_frontend* fe, struct dvb_frontend_tune_settings* fe_tune_settings)
 {
         /* I have no idea about this - it may not be needed */
@@ -531,7 +687,8 @@ static void lgdt330x_release(struct dvb_frontend* fe)
         kfree(state);
 }
 
-static struct dvb_frontend_ops lgdt330x_ops;
+static struct dvb_frontend_ops lgdt3302_ops;
+static struct dvb_frontend_ops lgdt3303_ops;
 
 struct dvb_frontend* lgdt330x_attach(const struct lgdt330x_config* config,
                                      struct i2c_adapter* i2c)
@@ -548,9 +705,19 @@ struct dvb_frontend* lgdt330x_attach(const struct lgdt330x_config* config,
         /* Setup the state */
         state->config = config;
         state->i2c = i2c;
-        memcpy(&state->ops, &lgdt330x_ops, sizeof(struct dvb_frontend_ops));
+        switch (config->demod_chip) {
+        case LGDT3302:
+                memcpy(&state->ops, &lgdt3302_ops, sizeof(struct dvb_frontend_ops));
+                break;
+        case LGDT3303:
+                memcpy(&state->ops, &lgdt3303_ops, sizeof(struct dvb_frontend_ops));
+                break;
+        default:
+                goto error;
+        }
+
         /* Verify communication with demod chip */
-        if (i2c_selectreadbytes(state, 2, buf, 1))
+        if (i2c_read_demod_bytes(state, 2, buf, 1))
                 goto error;
 
         state->current_frequency = -1;
@@ -568,9 +735,33 @@ error:
         return NULL;
 }
 
-static struct dvb_frontend_ops lgdt330x_ops = {
+static struct dvb_frontend_ops lgdt3302_ops = {
+        .info = {
+                .name= "LG Electronics LGDT3302 VSB/QAM Frontend",
+                .type = FE_ATSC,
+                .frequency_min= 54000000,
+                .frequency_max= 858000000,
+                .frequency_stepsize= 62500,
+                /* Symbol rate is for all VSB modes need to check QAM */
+                .symbol_rate_min    = 10762000,
+                .symbol_rate_max    = 10762000,
+                .caps = FE_CAN_QAM_64 | FE_CAN_QAM_256 | FE_CAN_8VSB
+        },
+        .init                 = lgdt330x_init,
+        .set_frontend         = lgdt330x_set_parameters,
+        .get_frontend         = lgdt330x_get_frontend,
+        .get_tune_settings    = lgdt330x_get_tune_settings,
+        .read_status          = lgdt3302_read_status,
+        .read_ber             = lgdt330x_read_ber,
+        .read_signal_strength = lgdt330x_read_signal_strength,
+        .read_snr             = lgdt3302_read_snr,
+        .read_ucblocks        = lgdt330x_read_ucblocks,
+        .release              = lgdt330x_release,
+};
+
+static struct dvb_frontend_ops lgdt3303_ops = {
         .info = {
-                .name= "LG Electronics lgdt330x VSB/QAM Frontend",
+                .name= "LG Electronics LGDT3303 VSB/QAM Frontend",
                 .type = FE_ATSC,
                 .frequency_min= 54000000,
                 .frequency_max= 858000000,
@@ -584,15 +775,15 @@ static struct dvb_frontend_ops lgdt330x_ops = {
         .set_frontend         = lgdt330x_set_parameters,
         .get_frontend         = lgdt330x_get_frontend,
         .get_tune_settings    = lgdt330x_get_tune_settings,
-        .read_status          = lgdt330x_read_status,
+        .read_status          = lgdt3303_read_status,
         .read_ber             = lgdt330x_read_ber,
         .read_signal_strength = lgdt330x_read_signal_strength,
-        .read_snr             = lgdt330x_read_snr,
+        .read_snr             = lgdt3303_read_snr,
         .read_ucblocks        = lgdt330x_read_ucblocks,
         .release              = lgdt330x_release,
 };
 
-MODULE_DESCRIPTION("lgdt330x [DViCO FusionHDTV 3 Gold] (ATSC 8VSB & ITU-T J.83 AnnexB 64/256 QAM) Demodulator Driver");
+MODULE_DESCRIPTION("LGDT330X (ATSC 8VSB & ITU-T J.83 AnnexB 64/256 QAM) Demodulator Driver");
 MODULE_AUTHOR("Wilson Michaels");
 MODULE_LICENSE("GPL");
 
@@ -601,6 +792,5 @@ EXPORT_SYMBOL(lgdt330x_attach);
 /*
  * Local variables:
  * c-basic-offset: 8
- * compile-command: "make DVB=1"
  * End:
  */
diff --git a/drivers/media/dvb/frontends/lgdt330x.h b/drivers/media/dvb/frontends/lgdt330x.h
index 04986f8e7565..e209ba1e47c5 100644
--- a/drivers/media/dvb/frontends/lgdt330x.h
+++ b/drivers/media/dvb/frontends/lgdt330x.h
@@ -1,5 +1,5 @@
 /*
- *    Support for LGDT3302 & LGDT3303 (DViCO FustionHDTV Gold) - VSB/QAM
+ *    Support for LGDT3302 and LGDT3303 - VSB/QAM
  *
  *    Copyright (C) 2005 Wilson Michaels <wilsonmichaels@earthlink.net>
  *
@@ -24,14 +24,26 @@
 
 #include <linux/dvb/frontend.h>
 
+typedef enum lg_chip_t {
+                UNDEFINED,
+                LGDT3302,
+                LGDT3303
+}lg_chip_type;
+
 struct lgdt330x_config
 {
         /* The demodulator's i2c address */
         u8 demod_address;
 
+        /* LG demodulator chip LGDT3302 or LGDT3303 */
+        lg_chip_type demod_chip;
+
+        /* MPEG hardware interface - 0:parallel 1:serial */
+        int serial_mpeg;
+
         /* PLL interface */
         int (*pll_rf_set) (struct dvb_frontend* fe, int index);
-        int (*pll_set)(struct dvb_frontend* fe, struct dvb_frontend_parameters* params, u8* pll_address);
+        int (*pll_set)(struct dvb_frontend* fe, struct dvb_frontend_parameters* params);
 
         /* Need to set device param for start_dma */
         int (*set_ts_params)(struct dvb_frontend* fe, int is_punctured);
diff --git a/drivers/media/dvb/frontends/lgdt330x_priv.h b/drivers/media/dvb/frontends/lgdt330x_priv.h
index 4143ce8f1a95..59b7c5b9012d 100644
--- a/drivers/media/dvb/frontends/lgdt330x_priv.h
+++ b/drivers/media/dvb/frontends/lgdt330x_priv.h
@@ -1,5 +1,5 @@
 /*
- *    Support for LGDT3302 & LGDT3303 (DViCO FustionHDTV Gold) - VSB/QAM
+ *    Support for LGDT3302 and LGDT3303 - VSB/QAM
  *
  *    Copyright (C) 2005 Wilson Michaels <wilsonmichaels@earthlink.net>
  *
@@ -57,8 +57,10 @@ enum I2C_REG {
         PH_ERR1= 0x4a,
         PH_ERR2= 0x4b,
         DEMUX_CONTROL= 0x66,
-        PACKET_ERR_COUNTER1= 0x6a,
-        PACKET_ERR_COUNTER2= 0x6b,
+        LGDT3302_PACKET_ERR_COUNTER1= 0x6a,
+        LGDT3302_PACKET_ERR_COUNTER2= 0x6b,
+        LGDT3303_PACKET_ERR_COUNTER1= 0x8b,
+        LGDT3303_PACKET_ERR_COUNTER2= 0x8c,
 };
 
 #endif /* _LGDT330X_PRIV_ */
diff --git a/drivers/media/dvb/frontends/tda80xx.c b/drivers/media/dvb/frontends/tda80xx.c
index 88e125079ca1..d1cabb6a0a13 100644
--- a/drivers/media/dvb/frontends/tda80xx.c
+++ b/drivers/media/dvb/frontends/tda80xx.c
@@ -30,6 +30,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <asm/irq.h>
 #include <asm/div64.h>
 
 #include "dvb_frontend.h"
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index ac81e5e01a9a..3f5742396096 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -356,7 +356,7 @@ config VIDEO_M32R_AR
 
 config VIDEO_M32R_AR_M64278
         tristate "Use Colour AR module M64278(VGA)"
-        depends on VIDEO_M32R_AR
+        depends on VIDEO_M32R_AR && PLAT_M32700UT
         ---help---
           Say Y here to use the Renesas M64278E-800 camera module,
           which supports VGA(640x480 pixcels) size of images.
diff --git a/drivers/media/video/bttv-cards.c b/drivers/media/video/bttv-cards.c
index 6c52fd0bb7df..a97b9b958ed6 100644
--- a/drivers/media/video/bttv-cards.c
+++ b/drivers/media/video/bttv-cards.c
@@ -95,7 +95,7 @@ static int __devinit pvr_boot(struct bttv *btv);
 static unsigned int triton1=0;
 static unsigned int vsfx=0;
 static unsigned int latency = UNSET;
-static unsigned int no_overlay=-1;
+int no_overlay=-1;
 
 static unsigned int card[BTTV_MAX]   = { [ 0 ... (BTTV_MAX-1) ] = UNSET };
 static unsigned int pll[BTTV_MAX]    = { [ 0 ... (BTTV_MAX-1) ] = UNSET };
@@ -4296,9 +4296,11 @@ void __devinit bttv_check_chipset(void)
                 printk(KERN_INFO "bttv: Host bridge needs VSFX enabled.\n");
         if (pcipci_fail) {
                 printk(KERN_WARNING "bttv: BT848 and your chipset may not work together.\n");
-                if (UNSET == no_overlay) {
-                        printk(KERN_WARNING "bttv: going to disable overlay.\n");
+                if (!no_overlay) {
+                        printk(KERN_WARNING "bttv: overlay will be disabled.\n");
                         no_overlay = 1;
+                } else {
+                        printk(KERN_WARNING "bttv: overlay forced. Use this option at your own risk.\n");
                 }
         }
         if (UNSET != latency)
diff --git a/drivers/media/video/bttv-driver.c b/drivers/media/video/bttv-driver.c
index 67f331eeeb19..eee9322ce21b 100644
--- a/drivers/media/video/bttv-driver.c
+++ b/drivers/media/video/bttv-driver.c
@@ -1,5 +1,5 @@
 /*
-    $Id: bttv-driver.c,v 1.45 2005/07/20 19:43:24 mkrufky Exp $
+    $Id: bttv-driver.c,v 1.52 2005/08/04 00:55:16 mchehab Exp $
 
     bttv - Bt848 frame grabber driver
 
@@ -80,6 +80,7 @@ static unsigned int irq_iswitch = 0;
 static unsigned int uv_ratio    = 50;
 static unsigned int full_luma_range = 0;
 static unsigned int coring      = 0;
+extern int no_overlay;
 
 /* API features (turn on/off stuff for testing) */
 static unsigned int v4l2        = 1;
@@ -2151,6 +2152,10 @@ static int bttv_s_fmt(struct bttv_fh *fh, struct bttv *btv,
                 return 0;
         }
         case V4L2_BUF_TYPE_VIDEO_OVERLAY:
+                if (no_overlay > 0) {
+                        printk ("V4L2_BUF_TYPE_VIDEO_OVERLAY: no_overlay\n");
+                        return -EINVAL;
+                }
                 return setup_window(fh, btv, &f->fmt.win, 1);
         case V4L2_BUF_TYPE_VBI_CAPTURE:
                 retval = bttv_switch_type(fh,f->type);
@@ -2224,9 +2229,11 @@ static int bttv_do_ioctl(struct inode *inode, struct file *file,
                         /* others */
                         cap->type = VID_TYPE_CAPTURE|
                                 VID_TYPE_TUNER|
-                                VID_TYPE_OVERLAY|
                                 VID_TYPE_CLIPPING|
                                 VID_TYPE_SCALES;
+                        if (no_overlay <= 0)
+                                cap->type |= VID_TYPE_OVERLAY;
+
                         cap->maxwidth  = bttv_tvnorms[btv->tvnorm].swidth;
                         cap->maxheight = bttv_tvnorms[btv->tvnorm].sheight;
                         cap->minwidth  = 48;
@@ -2302,6 +2309,11 @@ static int bttv_do_ioctl(struct inode *inode, struct file *file,
                 struct video_window *win = arg;
                 struct v4l2_window w2;
 
+                if (no_overlay > 0) {
+                        printk ("VIDIOCSWIN: no_overlay\n");
+                        return -EINVAL;
+                }
+
                 w2.field = V4L2_FIELD_ANY;
                 w2.w.left    = win->x;
                 w2.w.top     = win->y;
@@ -2577,10 +2589,12 @@ static int bttv_do_ioctl(struct inode *inode, struct file *file,
                 cap->version = BTTV_VERSION_CODE;
                 cap->capabilities =
                         V4L2_CAP_VIDEO_CAPTURE |
-                        V4L2_CAP_VIDEO_OVERLAY |
                         V4L2_CAP_VBI_CAPTURE |
                         V4L2_CAP_READWRITE |
                         V4L2_CAP_STREAMING;
+                if (no_overlay <= 0)
+                        cap->capabilities |= V4L2_CAP_VIDEO_OVERLAY;
+
                 if (bttv_tvcards[btv->c.type].tuner != UNSET &&
                     bttv_tvcards[btv->c.type].tuner != TUNER_ABSENT)
                         cap->capabilities |= V4L2_CAP_TUNER;
@@ -3076,7 +3090,7 @@ static struct file_operations bttv_fops =
 static struct video_device bttv_video_template =
 {
         .name     = "UNSET",
-        .type     = VID_TYPE_CAPTURE|VID_TYPE_TUNER|VID_TYPE_OVERLAY|
+        .type     = VID_TYPE_CAPTURE|VID_TYPE_TUNER|
                     VID_TYPE_CLIPPING|VID_TYPE_SCALES,
         .hardware = VID_HARDWARE_BT848,
         .fops     = &bttv_fops,
@@ -3756,6 +3770,12 @@ static void bttv_unregister_video(struct bttv *btv)
 /* register video4linux devices */
 static int __devinit bttv_register_video(struct bttv *btv)
 {
+        if (no_overlay <= 0) {
+                bttv_video_template.type |= VID_TYPE_OVERLAY;
+        } else {
+                printk("bttv: Overlay support disabled.\n");
+        }
+
         /* video */
         btv->video_dev = vdev_init(btv, &bttv_video_template, "video");
         if (NULL == btv->video_dev)
diff --git a/drivers/media/video/cx88/cx88-dvb.c b/drivers/media/video/cx88/cx88-dvb.c
index ef0e9a85c359..78d223257a68 100644
--- a/drivers/media/video/cx88/cx88-dvb.c
+++ b/drivers/media/video/cx88/cx88-dvb.c
@@ -1,5 +1,5 @@
 /*
- * $Id: cx88-dvb.c,v 1.54 2005/07/25 05:13:50 mkrufky Exp $
+ * $Id: cx88-dvb.c,v 1.58 2005/08/07 09:24:08 mkrufky Exp $
  *
  * device driver for Conexant 2388x based TV cards
  * MPEG Transport Stream (DVB) routines
@@ -208,14 +208,26 @@ static struct or51132_config pchdtv_hd3000 = {
 
 #ifdef HAVE_LGDT330X
 static int lgdt330x_pll_set(struct dvb_frontend* fe,
-                            struct dvb_frontend_parameters* params,
-                            u8* pllbuf)
+                            struct dvb_frontend_parameters* params)
 {
         struct cx8802_dev *dev= fe->dvb->priv;
+        u8 buf[4];
+        struct i2c_msg msg =
+                { .addr = dev->core->pll_addr, .flags = 0, .buf = buf, .len = 4 };
+        int err;
 
-        pllbuf[0] = dev->core->pll_addr;
-        dvb_pll_configure(dev->core->pll_desc, &pllbuf[1],
-                          params->frequency, 0);
+        dvb_pll_configure(dev->core->pll_desc, buf, params->frequency, 0);
+        dprintk(1, "%s: tuner at 0x%02x bytes: 0x%02x 0x%02x 0x%02x 0x%02x\n",
+                        __FUNCTION__, msg.addr, buf[0],buf[1],buf[2],buf[3]);
+        if ((err = i2c_transfer(&dev->core->i2c_adap, &msg, 1)) != 1) {
+                printk(KERN_WARNING "cx88-dvb: %s error "
+                           "(addr %02x <- %02x, err = %i)\n",
+                           __FUNCTION__, buf[0], buf[1], err);
+                if (err < 0)
+                        return err;
+                else
+                        return -EREMOTEIO;
+        }
         return 0;
 }
 
@@ -244,6 +256,8 @@ static int lgdt330x_set_ts_param(struct dvb_frontend* fe, int is_punctured)
 
 static struct lgdt330x_config fusionhdtv_3_gold = {
         .demod_address    = 0x0e,
+        .demod_chip       = LGDT3302,
+        .serial_mpeg      = 0x04, /* TPSERIAL for 3302 in TOP_CONTROL */
         .pll_set          = lgdt330x_pll_set,
         .set_ts_params    = lgdt330x_set_ts_param,
 };
diff --git a/drivers/message/i2o/Kconfig b/drivers/message/i2o/Kconfig
index 06e8eb19a05c..43a942a29c2e 100644
--- a/drivers/message/i2o/Kconfig
+++ b/drivers/message/i2o/Kconfig
@@ -53,6 +53,9 @@ config I2O_CONFIG
           To compile this support as a module, choose M here: the
           module will be called i2o_config.
 
+          Note: If you want to use the new API you have to download the
+          i2o_config patch from http://i2o.shadowconnect.com/
+
 config I2O_CONFIG_OLD_IOCTL
         bool "Enable ioctls (OBSOLETE)"
         depends on I2O_CONFIG
diff --git a/drivers/message/i2o/config-osm.c b/drivers/message/i2o/config-osm.c
index fe2e7afc9eae..af32ab4e90cd 100644
--- a/drivers/message/i2o/config-osm.c
+++ b/drivers/message/i2o/config-osm.c
@@ -30,503 +30,9 @@
 
 static struct i2o_driver i2o_config_driver;
 
-/* Special file operations for sysfs */
-struct fops_attribute {
-        struct bin_attribute bin;
-        struct file_operations fops;
-};
-
-/**
- *      sysfs_read_dummy
- */
-static ssize_t sysfs_read_dummy(struct kobject *kobj, char *buf, loff_t offset,
-                                size_t count)
-{
-        return 0;
-};
-
-/**
- *      sysfs_write_dummy
- */
-static ssize_t sysfs_write_dummy(struct kobject *kobj, char *buf, loff_t offset,
-                                 size_t count)
-{
-        return 0;
-};
-
-/**
- *      sysfs_create_fops_file - Creates attribute with special file operations
- *      @kobj: kobject which should contains the attribute
- *      @attr: attributes which should be used to create file
- *
- *      First creates attribute @attr in kobject @kobj. If it is the first time
- *      this function is called, merge old fops from sysfs with new one and
- *      write it back. Afterwords the new fops will be set for the created
- *      attribute.
- *
- *      Returns 0 on success or negative error code on failure.
- */
-static int sysfs_create_fops_file(struct kobject *kobj,
-                                  struct fops_attribute *attr)
-{
-        struct file_operations tmp, *fops;
-        struct dentry *d;
-        struct qstr qstr;
-        int rc;
-
-        fops = &attr->fops;
-
-        if (fops->read)
-                attr->bin.read = sysfs_read_dummy;
-
-        if (fops->write)
-                attr->bin.write = sysfs_write_dummy;
-
-        if ((rc = sysfs_create_bin_file(kobj, &attr->bin)))
-                return rc;
-
-        qstr.name = attr->bin.attr.name;
-        qstr.len = strlen(qstr.name);
-        qstr.hash = full_name_hash(qstr.name, qstr.len);
-
-        if ((d = lookup_hash(&qstr, kobj->dentry))) {
-                if (!fops->owner) {
-                        memcpy(&tmp, d->d_inode->i_fop, sizeof(tmp));
-                        if (fops->read)
-                                tmp.read = fops->read;
-                        if (fops->write)
-                                tmp.write = fops->write;
-                        memcpy(fops, &tmp, sizeof(tmp));
-                }
-
-                d->d_inode->i_fop = fops;
-        } else
-                sysfs_remove_bin_file(kobj, &attr->bin);
-
-        return -ENOENT;
-};
-
-/**
- *      sysfs_remove_fops_file - Remove attribute with special file operations
- *      @kobj: kobject which contains the attribute
- *      @attr: attributes which are used to create file
- *
- *      Only wrapper arround sysfs_remove_bin_file()
- *
- *      Returns 0 on success or negative error code on failure.
- */
-static inline int sysfs_remove_fops_file(struct kobject *kobj,
-                                         struct fops_attribute *attr)
-{
-        return sysfs_remove_bin_file(kobj, &attr->bin);
-};
-
-/**
- *      i2o_config_read_hrt - Returns the HRT of the controller
- *      @kob: kernel object handle
- *      @buf: buffer into which the HRT should be copied
- *      @off: file offset
- *      @count: number of bytes to read
- *
- *      Put @count bytes starting at @off into @buf from the HRT of the I2O
- *      controller corresponding to @kobj.
- *
- *      Returns number of bytes copied into buffer.
- */
-static ssize_t i2o_config_read_hrt(struct kobject *kobj, char *buf,
-                                   loff_t offset, size_t count)
-{
-        struct i2o_controller *c = kobj_to_i2o_device(kobj)->iop;
-        i2o_hrt *hrt = c->hrt.virt;
-
-        u32 size = (hrt->num_entries * hrt->entry_len + 2) * 4;
-
-        if (offset > size)
-                return 0;
-
-        if (offset + count > size)
-                count = size - offset;
-
-        memcpy(buf, (u8 *) hrt + offset, count);
-
-        return count;
-};
-
-/**
- *      i2o_config_read_lct - Returns the LCT of the controller
- *      @kob: kernel object handle
- *      @buf: buffer into which the LCT should be copied
- *      @off: file offset
- *      @count: number of bytes to read
- *
- *      Put @count bytes starting at @off into @buf from the LCT of the I2O
- *      controller corresponding to @kobj.
- *
- *      Returns number of bytes copied into buffer.
- */
-static ssize_t i2o_config_read_lct(struct kobject *kobj, char *buf,
-                                   loff_t offset, size_t count)
-{
-        struct i2o_controller *c = kobj_to_i2o_device(kobj)->iop;
-        u32 size = c->lct->table_size * 4;
-
-        if (offset > size)
-                return 0;
-
-        if (offset + count > size)
-                count = size - offset;
-
-        memcpy(buf, (u8 *) c->lct + offset, count);
-
-        return count;
-};
-
-#define I2O_CONFIG_SW_ATTR(_name,_mode,_type,_swid) \
-static ssize_t i2o_config_##_name##_read(struct file *file, char __user *buf, size_t count, loff_t * offset) { \
-        return i2o_config_sw_read(file, buf, count, offset, _type, _swid); \
-};\
-\
-static ssize_t i2o_config_##_name##_write(struct file *file, const char __user *buf, size_t count, loff_t * offset) { \
-        return i2o_config_sw_write(file, buf, count, offset, _type, _swid); \
-}; \
-\
-static struct fops_attribute i2o_config_attr_##_name = { \
-        .bin = { .attr = { .name = __stringify(_name), .mode = _mode, \
-                           .owner = THIS_MODULE }, \
-                 .size = 0, }, \
-        .fops = { .write = i2o_config_##_name##_write, \
-                  .read = i2o_config_##_name##_read} \
-};
-
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-
-/**
- *      i2o_config_dpt_reagion - Converts type and id to flash region
- *      @swtype: type of software module reading
- *      @swid: id of software which should be read
- *
- *      Converts type and id from I2O spec to the matching region for DPT /
- *      Adaptec controllers.
- *
- *      Returns region which match type and id or -1 on error.
- */
-static u32 i2o_config_dpt_region(u8 swtype, u8 swid)
-{
-        switch (swtype) {
-        case I2O_SOFTWARE_MODULE_IRTOS:
-                /*
-                 * content: operation firmware
-                 * region size:
-                 *      0xbc000 for 2554, 3754, 2564, 3757
-                 *      0x170000 for 2865
-                 *      0x17c000 for 3966
-                 */
-                if (!swid)
-                        return 0;
-
-                break;
-
-        case I2O_SOFTWARE_MODULE_IOP_PRIVATE:
-                /*
-                 * content: BIOS and SMOR
-                 * BIOS size: first 0x8000 bytes
-                 * region size:
-                 *      0x40000 for 2554, 3754, 2564, 3757
-                 *      0x80000 for 2865, 3966
-                 */
-                if (!swid)
-                        return 1;
-
-                break;
-
-        case I2O_SOFTWARE_MODULE_IOP_CONFIG:
-                switch (swid) {
-                case 0:
-                        /*
-                         * content: NVRAM defaults
-                         * region size: 0x2000 bytes
-                         */
-                        return 2;
-                case 1:
-                        /*
-                         * content: serial number
-                         * region size: 0x2000 bytes
-                         */
-                        return 3;
-                }
-                break;
-        }
-
-        return -1;
-};
-
-#endif
-
-/**
- *      i2o_config_sw_read - Read a software module from controller
- *      @file: file pointer
- *      @buf: buffer into which the data should be copied
- *      @count: number of bytes to read
- *      @off: file offset
- *      @swtype: type of software module reading
- *      @swid: id of software which should be read
- *
- *      Transfers @count bytes at offset @offset from IOP into buffer using
- *      type @swtype and id @swid as described in I2O spec.
- *
- *      Returns number of bytes copied into buffer or error code on failure.
- */
-static ssize_t i2o_config_sw_read(struct file *file, char __user * buf,
-                                  size_t count, loff_t * offset, u8 swtype,
-                                  u32 swid)
-{
-        struct sysfs_dirent *sd = file->f_dentry->d_parent->d_fsdata;
-        struct kobject *kobj = sd->s_element;
-        struct i2o_controller *c = kobj_to_i2o_device(kobj)->iop;
-        u32 m, function = I2O_CMD_SW_UPLOAD;
-        struct i2o_dma buffer;
-        struct i2o_message __iomem *msg;
-        u32 __iomem *mptr;
-        int rc, status;
-
-        m = i2o_msg_get_wait(c, &msg, I2O_TIMEOUT_MESSAGE_GET);
-        if (m == I2O_QUEUE_EMPTY)
-                return -EBUSY;
-
-        mptr = &msg->body[3];
-
-        if ((rc = i2o_dma_alloc(&c->pdev->dev, &buffer, count, GFP_KERNEL))) {
-                i2o_msg_nop(c, m);
-                return rc;
-        }
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-        if (c->adaptec) {
-                mptr = &msg->body[4];
-                function = I2O_CMD_PRIVATE;
-
-                writel(TEN_WORD_MSG_SIZE | SGL_OFFSET_8, &msg->u.head[0]);
-
-                writel(I2O_VENDOR_DPT << 16 | I2O_DPT_FLASH_READ,
-                       &msg->body[0]);
-                writel(i2o_config_dpt_region(swtype, swid), &msg->body[1]);
-                writel(*offset, &msg->body[2]);
-                writel(count, &msg->body[3]);
-        } else
-#endif
-                writel(NINE_WORD_MSG_SIZE | SGL_OFFSET_7, &msg->u.head[0]);
-
-        writel(0xD0000000 | count, mptr++);
-        writel(buffer.phys, mptr);
-
-        writel(function << 24 | HOST_TID << 12 | ADAPTER_TID, &msg->u.head[1]);
-        writel(i2o_config_driver.context, &msg->u.head[2]);
-        writel(0, &msg->u.head[3]);
-
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-        if (!c->adaptec)
-#endif
-        {
-                writel((u32) swtype << 16 | (u32) 1 << 8, &msg->body[0]);
-                writel(0, &msg->body[1]);
-                writel(swid, &msg->body[2]);
-        }
-
-        status = i2o_msg_post_wait_mem(c, m, 60, &buffer);
-
-        if (status == I2O_POST_WAIT_OK) {
-                if (!(rc = copy_to_user(buf, buffer.virt, count))) {
-                        rc = count;
-                        *offset += count;
-                }
-        } else
-                rc = -EIO;
-
-        if (status != -ETIMEDOUT)
-                i2o_dma_free(&c->pdev->dev, &buffer);
-
-        return rc;
-};
-
-/**
- *      i2o_config_sw_write - Write a software module to controller
- *      @file: file pointer
- *      @buf: buffer into which the data should be copied
- *      @count: number of bytes to read
- *      @off: file offset
- *      @swtype: type of software module writing
- *      @swid: id of software which should be written
- *
- *      Transfers @count bytes at offset @offset from buffer to IOP using
- *      type @swtype and id @swid as described in I2O spec.
- *
- *      Returns number of bytes copied from buffer or error code on failure.
- */
-static ssize_t i2o_config_sw_write(struct file *file, const char __user * buf,
-                                   size_t count, loff_t * offset, u8 swtype,
-                                   u32 swid)
-{
-        struct sysfs_dirent *sd = file->f_dentry->d_parent->d_fsdata;
-        struct kobject *kobj = sd->s_element;
-        struct i2o_controller *c = kobj_to_i2o_device(kobj)->iop;
-        u32 m, function = I2O_CMD_SW_DOWNLOAD;
-        struct i2o_dma buffer;
-        struct i2o_message __iomem *msg;
-        u32 __iomem *mptr;
-        int rc, status;
-
-        m = i2o_msg_get_wait(c, &msg, I2O_TIMEOUT_MESSAGE_GET);
-        if (m == I2O_QUEUE_EMPTY)
-                return -EBUSY;
-
-        mptr = &msg->body[3];
-
-        if ((rc = i2o_dma_alloc(&c->pdev->dev, &buffer, count, GFP_KERNEL)))
-                goto nop_msg;
-
-        if ((rc = copy_from_user(buffer.virt, buf, count)))
-                goto free_buffer;
-
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-        if (c->adaptec) {
-                mptr = &msg->body[4];
-                function = I2O_CMD_PRIVATE;
-
-                writel(TEN_WORD_MSG_SIZE | SGL_OFFSET_8, &msg->u.head[0]);
-
-                writel(I2O_VENDOR_DPT << 16 | I2O_DPT_FLASH_WRITE,
-                       &msg->body[0]);
-                writel(i2o_config_dpt_region(swtype, swid), &msg->body[1]);
-                writel(*offset, &msg->body[2]);
-                writel(count, &msg->body[3]);
-        } else
-#endif
-                writel(NINE_WORD_MSG_SIZE | SGL_OFFSET_7, &msg->u.head[0]);
-
-        writel(0xD4000000 | count, mptr++);
-        writel(buffer.phys, mptr);
-
-        writel(function << 24 | HOST_TID << 12 | ADAPTER_TID, &msg->u.head[1]);
-        writel(i2o_config_driver.context, &msg->u.head[2]);
-        writel(0, &msg->u.head[3]);
-
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-        if (!c->adaptec)
-#endif
-        {
-                writel((u32) swtype << 16 | (u32) 1 << 8, &msg->body[0]);
-                writel(0, &msg->body[1]);
-                writel(swid, &msg->body[2]);
-        }
-
-        status = i2o_msg_post_wait_mem(c, m, 60, &buffer);
-
-        if (status != -ETIMEDOUT)
-                i2o_dma_free(&c->pdev->dev, &buffer);
-
-        if (status != I2O_POST_WAIT_OK)
-                return -EIO;
-
-        *offset += count;
-
-        return count;
-
-      free_buffer:
-        i2o_dma_free(&c->pdev->dev, &buffer);
-
-      nop_msg:
-        i2o_msg_nop(c, m);
-
-        return rc;
-};
-
-/* attribute for HRT in sysfs */
-static struct bin_attribute i2o_config_hrt_attr = {
-        .attr = {
-                 .name = "hrt",
-                 .mode = S_IRUGO,
-                 .owner = THIS_MODULE},
-        .size = 0,
-        .read = i2o_config_read_hrt
-};
-
-/* attribute for LCT in sysfs */
-static struct bin_attribute i2o_config_lct_attr = {
-        .attr = {
-                 .name = "lct",
-                 .mode = S_IRUGO,
-                 .owner = THIS_MODULE},
-        .size = 0,
-        .read = i2o_config_read_lct
-};
-
-/* IRTOS firmware access */
-I2O_CONFIG_SW_ATTR(irtos, S_IWRSR, I2O_SOFTWARE_MODULE_IRTOS, 0);
-
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-
-/*
- * attribute for BIOS / SMOR, nvram and serial number access on DPT / Adaptec
- * controllers
- */
-I2O_CONFIG_SW_ATTR(bios, S_IWRSR, I2O_SOFTWARE_MODULE_IOP_PRIVATE, 0);
-I2O_CONFIG_SW_ATTR(nvram, S_IWRSR, I2O_SOFTWARE_MODULE_IOP_CONFIG, 0);
-I2O_CONFIG_SW_ATTR(serial, S_IWRSR, I2O_SOFTWARE_MODULE_IOP_CONFIG, 1);
-
-#endif
-
-/**
- *      i2o_config_notify_controller_add - Notify of added controller
- *      @c: the controller which was added
- *
- *      If a I2O controller is added, we catch the notification to add sysfs
- *      entries.
- */
-static void i2o_config_notify_controller_add(struct i2o_controller *c)
-{
-        struct kobject *kobj = &c->exec->device.kobj;
-
-        sysfs_create_bin_file(kobj, &i2o_config_hrt_attr);
-        sysfs_create_bin_file(kobj, &i2o_config_lct_attr);
-
-        sysfs_create_fops_file(kobj, &i2o_config_attr_irtos);
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-        if (c->adaptec) {
-                sysfs_create_fops_file(kobj, &i2o_config_attr_bios);
-                sysfs_create_fops_file(kobj, &i2o_config_attr_nvram);
-                sysfs_create_fops_file(kobj, &i2o_config_attr_serial);
-        }
-#endif
-};
-
-/**
- *      i2o_config_notify_controller_remove - Notify of removed controller
- *      @c: the controller which was removed
- *
- *      If a I2O controller is removed, we catch the notification to remove the
- *      sysfs entries.
- */
-static void i2o_config_notify_controller_remove(struct i2o_controller *c)
-{
-        struct kobject *kobj = &c->exec->device.kobj;
-
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-        if (c->adaptec) {
-                sysfs_remove_fops_file(kobj, &i2o_config_attr_serial);
-                sysfs_remove_fops_file(kobj, &i2o_config_attr_nvram);
-                sysfs_remove_fops_file(kobj, &i2o_config_attr_bios);
-        }
-#endif
-        sysfs_remove_fops_file(kobj, &i2o_config_attr_irtos);
-
-        sysfs_remove_bin_file(kobj, &i2o_config_lct_attr);
-        sysfs_remove_bin_file(kobj, &i2o_config_hrt_attr);
-};
-
 /* Config OSM driver struct */
 static struct i2o_driver i2o_config_driver = {
         .name = OSM_NAME,
-        .notify_controller_add = i2o_config_notify_controller_add,
-        .notify_controller_remove = i2o_config_notify_controller_remove
 };
 
 #ifdef CONFIG_I2O_CONFIG_OLD_IOCTL
diff --git a/drivers/message/i2o/pci.c b/drivers/message/i2o/pci.c
index 7a60fd7be8ad..66c03e882570 100644
--- a/drivers/message/i2o/pci.c
+++ b/drivers/message/i2o/pci.c
@@ -32,6 +32,8 @@
 #include <linux/i2o.h>
 #include "core.h"
 
+#define OSM_DESCRIPTION "I2O-subsystem"
+
 /* PCI device id table for all I2O controllers */
 static struct pci_device_id __devinitdata i2o_pci_ids[] = {
         {PCI_DEVICE_CLASS(PCI_CLASS_INTELLIGENT_I2O << 8, 0xffff00)},
@@ -66,6 +68,8 @@ static void i2o_pci_free(struct i2o_controller *c)
 
         if (c->base.virt)
                 iounmap(c->base.virt);
+
+        pci_release_regions(c->pdev);
 }
 
 /**
@@ -84,6 +88,11 @@ static int __devinit i2o_pci_alloc(struct i2o_controller *c)
         struct device *dev = &pdev->dev;
         int i;
 
+        if (pci_request_regions(pdev, OSM_DESCRIPTION)) {
+                printk(KERN_ERR "%s: device already claimed\n", c->name);
+                return -ENODEV;
+        }
+
         for (i = 0; i < 6; i++) {
                 /* Skip I/O spaces */
                 if (!(pci_resource_flags(pdev, i) & IORESOURCE_IO)) {
@@ -138,6 +147,7 @@ static int __devinit i2o_pci_alloc(struct i2o_controller *c)
         c->base.virt = ioremap_nocache(c->base.phys, c->base.len);
         if (!c->base.virt) {
                 printk(KERN_ERR "%s: Unable to map controller.\n", c->name);
+                i2o_pci_free(c);
                 return -ENOMEM;
         }
 
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
new file mode 100644
index 000000000000..1588a59e3767
--- /dev/null
+++ b/drivers/mfd/Kconfig
@@ -0,0 +1,16 @@
+#
+# Multifunction miscellaneous devices
+#
+
+menu "Multimedia Capabilities Port drivers"
+
+config MCP
+        tristate
+
+# Interface drivers
+config MCP_SA11X0
+        tristate "Support SA11x0 MCP interface"
+        depends on ARCH_SA1100
+        select MCP
+
+endmenu
diff --git a/drivers/mfd/Makefile b/drivers/mfd/Makefile
new file mode 100644
index 000000000000..98bdd6a42188
--- /dev/null
+++ b/drivers/mfd/Makefile
@@ -0,0 +1,6 @@
+#
+# Makefile for multifunction miscellaneous devices
+#
+
+obj-$(CONFIG_MCP)               += mcp-core.o
+obj-$(CONFIG_MCP_SA11X0)        += mcp-sa11x0.o
diff --git a/drivers/mfd/mcp-core.c b/drivers/mfd/mcp-core.c
new file mode 100644
index 000000000000..c75d713c01e4
--- /dev/null
+++ b/drivers/mfd/mcp-core.c
@@ -0,0 +1,255 @@
+/*
+ *  linux/drivers/mfd/mcp-core.c
+ *
+ *  Copyright (C) 2001 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License.
+ *
+ *  Generic MCP (Multimedia Communications Port) layer.  All MCP locking
+ *  is solely held within this file.
+ */
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/errno.h>
+#include <linux/smp.h>
+#include <linux/device.h>
+
+#include <asm/dma.h>
+#include <asm/system.h>
+
+#include "mcp.h"
+
+#define to_mcp(d)               container_of(d, struct mcp, attached_device)
+#define to_mcp_driver(d)        container_of(d, struct mcp_driver, drv)
+
+static int mcp_bus_match(struct device *dev, struct device_driver *drv)
+{
+        return 1;
+}
+
+static int mcp_bus_probe(struct device *dev)
+{
+        struct mcp *mcp = to_mcp(dev);
+        struct mcp_driver *drv = to_mcp_driver(dev->driver);
+
+        return drv->probe(mcp);
+}
+
+static int mcp_bus_remove(struct device *dev)
+{
+        struct mcp *mcp = to_mcp(dev);
+        struct mcp_driver *drv = to_mcp_driver(dev->driver);
+
+        drv->remove(mcp);
+        return 0;
+}
+
+static int mcp_bus_suspend(struct device *dev, pm_message_t state)
+{
+        struct mcp *mcp = to_mcp(dev);
+        int ret = 0;
+
+        if (dev->driver) {
+                struct mcp_driver *drv = to_mcp_driver(dev->driver);
+
+                ret = drv->suspend(mcp, state);
+        }
+        return ret;
+}
+
+static int mcp_bus_resume(struct device *dev)
+{
+        struct mcp *mcp = to_mcp(dev);
+        int ret = 0;
+
+        if (dev->driver) {
+                struct mcp_driver *drv = to_mcp_driver(dev->driver);
+
+                ret = drv->resume(mcp);
+        }
+        return ret;
+}
+
+static struct bus_type mcp_bus_type = {
+        .name           = "mcp",
+        .match          = mcp_bus_match,
+        .suspend        = mcp_bus_suspend,
+        .resume         = mcp_bus_resume,
+};
+
+/**
+ *      mcp_set_telecom_divisor - set the telecom divisor
+ *      @mcp: MCP interface structure
+ *      @div: SIB clock divisor
+ *
+ *      Set the telecom divisor on the MCP interface.  The resulting
+ *      sample rate is SIBCLOCK/div.
+ */
+void mcp_set_telecom_divisor(struct mcp *mcp, unsigned int div)
+{
+        spin_lock_irq(&mcp->lock);
+        mcp->ops->set_telecom_divisor(mcp, div);
+        spin_unlock_irq(&mcp->lock);
+}
+EXPORT_SYMBOL(mcp_set_telecom_divisor);
+
+/**
+ *      mcp_set_audio_divisor - set the audio divisor
+ *      @mcp: MCP interface structure
+ *      @div: SIB clock divisor
+ *
+ *      Set the audio divisor on the MCP interface.
+ */
+void mcp_set_audio_divisor(struct mcp *mcp, unsigned int div)
+{
+        spin_lock_irq(&mcp->lock);
+        mcp->ops->set_audio_divisor(mcp, div);
+        spin_unlock_irq(&mcp->lock);
+}
+EXPORT_SYMBOL(mcp_set_audio_divisor);
+
+/**
+ *      mcp_reg_write - write a device register
+ *      @mcp: MCP interface structure
+ *      @reg: 4-bit register index
+ *      @val: 16-bit data value
+ *
+ *      Write a device register.  The MCP interface must be enabled
+ *      to prevent this function hanging.
+ */
+void mcp_reg_write(struct mcp *mcp, unsigned int reg, unsigned int val)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&mcp->lock, flags);
+        mcp->ops->reg_write(mcp, reg, val);
+        spin_unlock_irqrestore(&mcp->lock, flags);
+}
+EXPORT_SYMBOL(mcp_reg_write);
+
+/**
+ *      mcp_reg_read - read a device register
+ *      @mcp: MCP interface structure
+ *      @reg: 4-bit register index
+ *
+ *      Read a device register and return its value.  The MCP interface
+ *      must be enabled to prevent this function hanging.
+ */
+unsigned int mcp_reg_read(struct mcp *mcp, unsigned int reg)
+{
+        unsigned long flags;
+        unsigned int val;
+
+        spin_lock_irqsave(&mcp->lock, flags);
+        val = mcp->ops->reg_read(mcp, reg);
+        spin_unlock_irqrestore(&mcp->lock, flags);
+
+        return val;
+}
+EXPORT_SYMBOL(mcp_reg_read);
+
+/**
+ *      mcp_enable - enable the MCP interface
+ *      @mcp: MCP interface to enable
+ *
+ *      Enable the MCP interface.  Each call to mcp_enable will need
+ *      a corresponding call to mcp_disable to disable the interface.
+ */
+void mcp_enable(struct mcp *mcp)
+{
+        spin_lock_irq(&mcp->lock);
+        if (mcp->use_count++ == 0)
+                mcp->ops->enable(mcp);
+        spin_unlock_irq(&mcp->lock);
+}
+EXPORT_SYMBOL(mcp_enable);
+
+/**
+ *      mcp_disable - disable the MCP interface
+ *      @mcp: MCP interface to disable
+ *
+ *      Disable the MCP interface.  The MCP interface will only be
+ *      disabled once the number of calls to mcp_enable matches the
+ *      number of calls to mcp_disable.
+ */
+void mcp_disable(struct mcp *mcp)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&mcp->lock, flags);
+        if (--mcp->use_count == 0)
+                mcp->ops->disable(mcp);
+        spin_unlock_irqrestore(&mcp->lock, flags);
+}
+EXPORT_SYMBOL(mcp_disable);
+
+static void mcp_release(struct device *dev)
+{
+        struct mcp *mcp = container_of(dev, struct mcp, attached_device);
+
+        kfree(mcp);
+}
+
+struct mcp *mcp_host_alloc(struct device *parent, size_t size)
+{
+        struct mcp *mcp;
+
+        mcp = kmalloc(sizeof(struct mcp) + size, GFP_KERNEL);
+        if (mcp) {
+                memset(mcp, 0, sizeof(struct mcp) + size);
+                spin_lock_init(&mcp->lock);
+                mcp->attached_device.parent = parent;
+                mcp->attached_device.bus = &mcp_bus_type;
+                mcp->attached_device.dma_mask = parent->dma_mask;
+                mcp->attached_device.release = mcp_release;
+        }
+        return mcp;
+}
+EXPORT_SYMBOL(mcp_host_alloc);
+
+int mcp_host_register(struct mcp *mcp)
+{
+        strcpy(mcp->attached_device.bus_id, "mcp0");
+        return device_register(&mcp->attached_device);
+}
+EXPORT_SYMBOL(mcp_host_register);
+
+void mcp_host_unregister(struct mcp *mcp)
+{
+        device_unregister(&mcp->attached_device);
+}
+EXPORT_SYMBOL(mcp_host_unregister);
+
+int mcp_driver_register(struct mcp_driver *mcpdrv)
+{
+        mcpdrv->drv.bus = &mcp_bus_type;
+        mcpdrv->drv.probe = mcp_bus_probe;
+        mcpdrv->drv.remove = mcp_bus_remove;
+        return driver_register(&mcpdrv->drv);
+}
+EXPORT_SYMBOL(mcp_driver_register);
+
+void mcp_driver_unregister(struct mcp_driver *mcpdrv)
+{
+        driver_unregister(&mcpdrv->drv);
+}
+EXPORT_SYMBOL(mcp_driver_unregister);
+
+static int __init mcp_init(void)
+{
+        return bus_register(&mcp_bus_type);
+}
+
+static void __exit mcp_exit(void)
+{
+        bus_unregister(&mcp_bus_type);
+}
+
+module_init(mcp_init);
+module_exit(mcp_exit);
+
+MODULE_AUTHOR("Russell King <rmk@arm.linux.org.uk>");
+MODULE_DESCRIPTION("Core multimedia communications port driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/mfd/mcp-sa11x0.c b/drivers/mfd/mcp-sa11x0.c
new file mode 100644
index 000000000000..e9806fbbe696
--- /dev/null
+++ b/drivers/mfd/mcp-sa11x0.c
@@ -0,0 +1,275 @@
+/*
+ *  linux/drivers/mfd/mcp-sa11x0.c
+ *
+ *  Copyright (C) 2001-2005 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License.
+ *
+ *  SA11x0 MCP (Multimedia Communications Port) driver.
+ *
+ *  MCP read/write timeouts from Jordi Colomer, rehacked by rmk.
+ */
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/delay.h>
+#include <linux/spinlock.h>
+#include <linux/slab.h>
+#include <linux/device.h>
+
+#include <asm/dma.h>
+#include <asm/hardware.h>
+#include <asm/mach-types.h>
+#include <asm/system.h>
+#include <asm/arch/mcp.h>
+
+#include <asm/arch/assabet.h>
+
+#include "mcp.h"
+
+struct mcp_sa11x0 {
+        u32     mccr0;
+        u32     mccr1;
+};
+
+#define priv(mcp)       ((struct mcp_sa11x0 *)mcp_priv(mcp))
+
+static void
+mcp_sa11x0_set_telecom_divisor(struct mcp *mcp, unsigned int divisor)
+{
+        unsigned int mccr0;
+
+        divisor /= 32;
+
+        mccr0 = Ser4MCCR0 & ~0x00007f00;
+        mccr0 |= divisor << 8;
+        Ser4MCCR0 = mccr0;
+}
+
+static void
+mcp_sa11x0_set_audio_divisor(struct mcp *mcp, unsigned int divisor)
+{
+        unsigned int mccr0;
+
+        divisor /= 32;
+
+        mccr0 = Ser4MCCR0 & ~0x0000007f;
+        mccr0 |= divisor;
+        Ser4MCCR0 = mccr0;
+}
+
+/*
+ * Write data to the device.  The bit should be set after 3 subframe
+ * times (each frame is 64 clocks).  We wait a maximum of 6 subframes.
+ * We really should try doing something more productive while we
+ * wait.
+ */
+static void
+mcp_sa11x0_write(struct mcp *mcp, unsigned int reg, unsigned int val)
+{
+        int ret = -ETIME;
+        int i;
+
+        Ser4MCDR2 = reg << 17 | MCDR2_Wr | (val & 0xffff);
+
+        for (i = 0; i < 2; i++) {
+                udelay(mcp->rw_timeout);
+                if (Ser4MCSR & MCSR_CWC) {
+                        ret = 0;
+                        break;
+                }
+        }
+
+        if (ret < 0)
+                printk(KERN_WARNING "mcp: write timed out\n");
+}
+
+/*
+ * Read data from the device.  The bit should be set after 3 subframe
+ * times (each frame is 64 clocks).  We wait a maximum of 6 subframes.
+ * We really should try doing something more productive while we
+ * wait.
+ */
+static unsigned int
+mcp_sa11x0_read(struct mcp *mcp, unsigned int reg)
+{
+        int ret = -ETIME;
+        int i;
+
+        Ser4MCDR2 = reg << 17 | MCDR2_Rd;
+
+        for (i = 0; i < 2; i++) {
+                udelay(mcp->rw_timeout);
+                if (Ser4MCSR & MCSR_CRC) {
+                        ret = Ser4MCDR2 & 0xffff;
+                        break;
+                }
+        }
+
+        if (ret < 0)
+                printk(KERN_WARNING "mcp: read timed out\n");
+
+        return ret;
+}
+
+static void mcp_sa11x0_enable(struct mcp *mcp)
+{
+        Ser4MCSR = -1;
+        Ser4MCCR0 |= MCCR0_MCE;
+}
+
+static void mcp_sa11x0_disable(struct mcp *mcp)
+{
+        Ser4MCCR0 &= ~MCCR0_MCE;
+}
+
+/*
+ * Our methods.
+ */
+static struct mcp_ops mcp_sa11x0 = {
+        .set_telecom_divisor    = mcp_sa11x0_set_telecom_divisor,
+        .set_audio_divisor      = mcp_sa11x0_set_audio_divisor,
+        .reg_write              = mcp_sa11x0_write,
+        .reg_read               = mcp_sa11x0_read,
+        .enable                 = mcp_sa11x0_enable,
+        .disable                = mcp_sa11x0_disable,
+};
+
+static int mcp_sa11x0_probe(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct mcp_plat_data *data = pdev->dev.platform_data;
+        struct mcp *mcp;
+        int ret;
+
+        if (!data)
+                return -ENODEV;
+
+        if (!request_mem_region(0x80060000, 0x60, "sa11x0-mcp"))
+                return -EBUSY;
+
+        mcp = mcp_host_alloc(&pdev->dev, sizeof(struct mcp_sa11x0));
+        if (!mcp) {
+                ret = -ENOMEM;
+                goto release;
+        }
+
+        mcp->owner              = THIS_MODULE;
+        mcp->ops                = &mcp_sa11x0;
+        mcp->sclk_rate          = data->sclk_rate;
+        mcp->dma_audio_rd       = DMA_Ser4MCP0Rd;
+        mcp->dma_audio_wr       = DMA_Ser4MCP0Wr;
+        mcp->dma_telco_rd       = DMA_Ser4MCP1Rd;
+        mcp->dma_telco_wr       = DMA_Ser4MCP1Wr;
+
+        dev_set_drvdata(dev, mcp);
+
+        if (machine_is_assabet()) {
+                ASSABET_BCR_set(ASSABET_BCR_CODEC_RST);
+        }
+
+        /*
+         * Setup the PPC unit correctly.
+         */
+        PPDR &= ~PPC_RXD4;
+        PPDR |= PPC_TXD4 | PPC_SCLK | PPC_SFRM;
+        PSDR |= PPC_RXD4;
+        PSDR &= ~(PPC_TXD4 | PPC_SCLK | PPC_SFRM);
+        PPSR &= ~(PPC_TXD4 | PPC_SCLK | PPC_SFRM);
+
+        /*
+         * Initialise device.  Note that we initially
+         * set the sampling rate to minimum.
+         */
+        Ser4MCSR = -1;
+        Ser4MCCR1 = data->mccr1;
+        Ser4MCCR0 = data->mccr0 | 0x7f7f;
+
+        /*
+         * Calculate the read/write timeout (us) from the bit clock
+         * rate.  This is the period for 3 64-bit frames.  Always
+         * round this time up.
+         */
+        mcp->rw_timeout = (64 * 3 * 1000000 + mcp->sclk_rate - 1) /
+                          mcp->sclk_rate;
+
+        ret = mcp_host_register(mcp);
+        if (ret == 0)
+                goto out;
+
+ release:
+        release_mem_region(0x80060000, 0x60);
+        dev_set_drvdata(dev, NULL);
+
+ out:
+        return ret;
+}
+
+static int mcp_sa11x0_remove(struct device *dev)
+{
+        struct mcp *mcp = dev_get_drvdata(dev);
+
+        dev_set_drvdata(dev, NULL);
+        mcp_host_unregister(mcp);
+        release_mem_region(0x80060000, 0x60);
+
+        return 0;
+}
+
+static int mcp_sa11x0_suspend(struct device *dev, pm_message_t state, u32 level)
+{
+        struct mcp *mcp = dev_get_drvdata(dev);
+
+        if (level == SUSPEND_DISABLE) {
+                priv(mcp)->mccr0 = Ser4MCCR0;
+                priv(mcp)->mccr1 = Ser4MCCR1;
+                Ser4MCCR0 &= ~MCCR0_MCE;
+        }
+        return 0;
+}
+
+static int mcp_sa11x0_resume(struct device *dev, u32 level)
+{
+        struct mcp *mcp = dev_get_drvdata(dev);
+
+        if (level == RESUME_RESTORE_STATE) {
+                Ser4MCCR1 = priv(mcp)->mccr1;
+                Ser4MCCR0 = priv(mcp)->mccr0;
+        }
+        return 0;
+}
+
+/*
+ * The driver for the SA11x0 MCP port.
+ */
+static struct device_driver mcp_sa11x0_driver = {
+        .name           = "sa11x0-mcp",
+        .bus            = &platform_bus_type,
+        .probe          = mcp_sa11x0_probe,
+        .remove         = mcp_sa11x0_remove,
+        .suspend        = mcp_sa11x0_suspend,
+        .resume         = mcp_sa11x0_resume,
+};
+
+/*
+ * This needs re-working
+ */
+static int __init mcp_sa11x0_init(void)
+{
+        return driver_register(&mcp_sa11x0_driver);
+}
+
+static void __exit mcp_sa11x0_exit(void)
+{
+        driver_unregister(&mcp_sa11x0_driver);
+}
+
+module_init(mcp_sa11x0_init);
+module_exit(mcp_sa11x0_exit);
+
+MODULE_AUTHOR("Russell King <rmk@arm.linux.org.uk>");
+MODULE_DESCRIPTION("SA11x0 multimedia communications port driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/mfd/mcp.h b/drivers/mfd/mcp.h
new file mode 100644
index 000000000000..c093a93b8808
--- /dev/null
+++ b/drivers/mfd/mcp.h
@@ -0,0 +1,66 @@
+/*
+ *  linux/drivers/mfd/mcp.h
+ *
+ *  Copyright (C) 2001 Russell King, All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License.
+ */
+#ifndef MCP_H
+#define MCP_H
+
+struct mcp_ops;
+
+struct mcp {
+        struct module   *owner;
+        struct mcp_ops  *ops;
+        spinlock_t      lock;
+        int             use_count;
+        unsigned int    sclk_rate;
+        unsigned int    rw_timeout;
+        dma_device_t    dma_audio_rd;
+        dma_device_t    dma_audio_wr;
+        dma_device_t    dma_telco_rd;
+        dma_device_t    dma_telco_wr;
+        struct device   attached_device;
+};
+
+struct mcp_ops {
+        void            (*set_telecom_divisor)(struct mcp *, unsigned int);
+        void            (*set_audio_divisor)(struct mcp *, unsigned int);
+        void            (*reg_write)(struct mcp *, unsigned int, unsigned int);
+        unsigned int    (*reg_read)(struct mcp *, unsigned int);
+        void            (*enable)(struct mcp *);
+        void            (*disable)(struct mcp *);
+};
+
+void mcp_set_telecom_divisor(struct mcp *, unsigned int);
+void mcp_set_audio_divisor(struct mcp *, unsigned int);
+void mcp_reg_write(struct mcp *, unsigned int, unsigned int);
+unsigned int mcp_reg_read(struct mcp *, unsigned int);
+void mcp_enable(struct mcp *);
+void mcp_disable(struct mcp *);
+#define mcp_get_sclk_rate(mcp)  ((mcp)->sclk_rate)
+
+struct mcp *mcp_host_alloc(struct device *, size_t);
+int mcp_host_register(struct mcp *);
+void mcp_host_unregister(struct mcp *);
+
+struct mcp_driver {
+        struct device_driver drv;
+        int (*probe)(struct mcp *);
+        void (*remove)(struct mcp *);
+        int (*suspend)(struct mcp *, pm_message_t);
+        int (*resume)(struct mcp *);
+};
+
+int mcp_driver_register(struct mcp_driver *);
+void mcp_driver_unregister(struct mcp_driver *);
+
+#define mcp_get_drvdata(mcp)    dev_get_drvdata(&(mcp)->attached_device)
+#define mcp_set_drvdata(mcp,d)  dev_set_drvdata(&(mcp)->attached_device, d)
+
+#define mcp_priv(mcp)           ((void *)((mcp)+1))
+
+#endif
diff --git a/drivers/mmc/mmc.c b/drivers/mmc/mmc.c
index eeb9f6668e69..3c5904834fe8 100644
--- a/drivers/mmc/mmc.c
+++ b/drivers/mmc/mmc.c
@@ -361,7 +361,7 @@ static void mmc_decode_cid(struct mmc_card *card)
 
         default:
                 printk("%s: card has unknown MMCA version %d\n",
-                        card->host->host_name, card->csd.mmca_vsn);
+                        mmc_hostname(card->host), card->csd.mmca_vsn);
                 mmc_card_set_bad(card);
                 break;
         }
@@ -383,7 +383,7 @@ static void mmc_decode_csd(struct mmc_card *card)
         csd_struct = UNSTUFF_BITS(resp, 126, 2);
         if (csd_struct != 1 && csd_struct != 2) {
                 printk("%s: unrecognised CSD structure version %d\n",
-                        card->host->host_name, csd_struct);
+                        mmc_hostname(card->host), csd_struct);
                 mmc_card_set_bad(card);
                 return;
         }
@@ -551,7 +551,7 @@ static void mmc_discover_cards(struct mmc_host *host)
                 }
                 if (err != MMC_ERR_NONE) {
                         printk(KERN_ERR "%s: error requesting CID: %d\n",
-                                host->host_name, err);
+                                mmc_hostname(host), err);
                         break;
                 }
 
@@ -796,17 +796,13 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
 {
         struct mmc_host *host;
 
-        host = kmalloc(sizeof(struct mmc_host) + extra, GFP_KERNEL);
+        host = mmc_alloc_host_sysfs(extra, dev);
         if (host) {
-                memset(host, 0, sizeof(struct mmc_host) + extra);
-
                 spin_lock_init(&host->lock);
                 init_waitqueue_head(&host->wq);
                 INIT_LIST_HEAD(&host->cards);
                 INIT_WORK(&host->detect, mmc_rescan, host);
 
-                host->dev = dev;
-
                 /*
                  * By default, hosts do not support SGIO or large requests.
                  * They have to set these according to their abilities.
@@ -828,15 +824,15 @@ EXPORT_SYMBOL(mmc_alloc_host);
  */
 int mmc_add_host(struct mmc_host *host)
 {
-        static unsigned int host_num;
+        int ret;
 
-        snprintf(host->host_name, sizeof(host->host_name),
-                 "mmc%d", host_num++);
-
-        mmc_power_off(host);
-        mmc_detect_change(host);
+        ret = mmc_add_host_sysfs(host);
+        if (ret == 0) {
+                mmc_power_off(host);
+                mmc_detect_change(host);
+        }
 
-        return 0;
+        return ret;
 }
 
 EXPORT_SYMBOL(mmc_add_host);
@@ -859,6 +855,7 @@ void mmc_remove_host(struct mmc_host *host)
         }
 
         mmc_power_off(host);
+        mmc_remove_host_sysfs(host);
 }
 
 EXPORT_SYMBOL(mmc_remove_host);
@@ -872,7 +869,7 @@ EXPORT_SYMBOL(mmc_remove_host);
 void mmc_free_host(struct mmc_host *host)
 {
         flush_scheduled_work();
-        kfree(host);
+        mmc_free_host_sysfs(host);
 }
 
 EXPORT_SYMBOL(mmc_free_host);
diff --git a/drivers/mmc/mmc.h b/drivers/mmc/mmc.h
index b498dffe0b11..97bae00292fa 100644
--- a/drivers/mmc/mmc.h
+++ b/drivers/mmc/mmc.h
@@ -13,4 +13,9 @@
 void mmc_init_card(struct mmc_card *card, struct mmc_host *host);
 int mmc_register_card(struct mmc_card *card);
 void mmc_remove_card(struct mmc_card *card);
+
+struct mmc_host *mmc_alloc_host_sysfs(int extra, struct device *dev);
+int mmc_add_host_sysfs(struct mmc_host *host);
+void mmc_remove_host_sysfs(struct mmc_host *host);
+void mmc_free_host_sysfs(struct mmc_host *host);
 #endif
diff --git a/drivers/mmc/mmc_sysfs.c b/drivers/mmc/mmc_sysfs.c
index 5556cd3b5559..ad8949810fc5 100644
--- a/drivers/mmc/mmc_sysfs.c
+++ b/drivers/mmc/mmc_sysfs.c
@@ -12,6 +12,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/device.h>
+#include <linux/idr.h>
 
 #include <linux/mmc/card.h>
 #include <linux/mmc/host.h>
@@ -20,6 +21,7 @@
 
 #define dev_to_mmc_card(d)      container_of(d, struct mmc_card, dev)
 #define to_mmc_driver(d)        container_of(d, struct mmc_driver, drv)
+#define cls_dev_to_mmc_host(d)  container_of(d, struct mmc_host, class_dev)
 
 #define MMC_ATTR(name, fmt, args...)                                    \
 static ssize_t mmc_##name##_show (struct device *dev, struct device_attribute *attr, char *buf) \
@@ -206,7 +208,7 @@ void mmc_init_card(struct mmc_card *card, struct mmc_host *host)
 int mmc_register_card(struct mmc_card *card)
 {
         snprintf(card->dev.bus_id, sizeof(card->dev.bus_id),
-                 "%s:%04x", card->host->host_name, card->rca);
+                 "%s:%04x", mmc_hostname(card->host), card->rca);
 
         return device_add(&card->dev);
 }
@@ -224,13 +226,97 @@ void mmc_remove_card(struct mmc_card *card)
 }
 
 
+static void mmc_host_classdev_release(struct class_device *dev)
+{
+        struct mmc_host *host = cls_dev_to_mmc_host(dev);
+        kfree(host);
+}
+
+static struct class mmc_host_class = {
+        .name           = "mmc_host",
+        .release        = mmc_host_classdev_release,
+};
+
+static DEFINE_IDR(mmc_host_idr);
+static DEFINE_SPINLOCK(mmc_host_lock);
+
+/*
+ * Internal function. Allocate a new MMC host.
+ */
+struct mmc_host *mmc_alloc_host_sysfs(int extra, struct device *dev)
+{
+        struct mmc_host *host;
+
+        host = kmalloc(sizeof(struct mmc_host) + extra, GFP_KERNEL);
+        if (host) {
+                memset(host, 0, sizeof(struct mmc_host) + extra);
+
+                host->dev = dev;
+                host->class_dev.dev = host->dev;
+                host->class_dev.class = &mmc_host_class;
+                class_device_initialize(&host->class_dev);
+        }
+
+        return host;
+}
+
+/*
+ * Internal function. Register a new MMC host with the MMC class.
+ */
+int mmc_add_host_sysfs(struct mmc_host *host)
+{
+        int err;
+
+        if (!idr_pre_get(&mmc_host_idr, GFP_KERNEL))
+                return -ENOMEM;
+
+        spin_lock(&mmc_host_lock);
+        err = idr_get_new(&mmc_host_idr, host, &host->index);
+        spin_unlock(&mmc_host_lock);
+        if (err)
+                return err;
+
+        snprintf(host->class_dev.class_id, BUS_ID_SIZE,
+                 "mmc%d", host->index);
+
+        return class_device_add(&host->class_dev);
+}
+
+/*
+ * Internal function. Unregister a MMC host with the MMC class.
+ */
+void mmc_remove_host_sysfs(struct mmc_host *host)
+{
+        class_device_del(&host->class_dev);
+
+        spin_lock(&mmc_host_lock);
+        idr_remove(&mmc_host_idr, host->index);
+        spin_unlock(&mmc_host_lock);
+}
+
+/*
+ * Internal function. Free a MMC host.
+ */
+void mmc_free_host_sysfs(struct mmc_host *host)
+{
+        class_device_put(&host->class_dev);
+}
+
+
 static int __init mmc_init(void)
 {
-        return bus_register(&mmc_bus_type);
+        int ret = bus_register(&mmc_bus_type);
+        if (ret == 0) {
+                ret = class_register(&mmc_host_class);
+                if (ret)
+                        bus_unregister(&mmc_bus_type);
+        }
+        return ret;
 }
 
 static void __exit mmc_exit(void)
 {
+        class_unregister(&mmc_host_class);
         bus_unregister(&mmc_bus_type);
 }
 
diff --git a/drivers/mmc/mmci.c b/drivers/mmc/mmci.c
index 7a42966d755b..716c4ef4faf6 100644
--- a/drivers/mmc/mmci.c
+++ b/drivers/mmc/mmci.c
@@ -34,7 +34,7 @@
 
 #ifdef CONFIG_MMC_DEBUG
 #define DBG(host,fmt,args...)   \
-        pr_debug("%s: %s: " fmt, host->mmc->host_name, __func__ , args)
+        pr_debug("%s: %s: " fmt, mmc_hostname(host->mmc), __func__ , args)
 #else
 #define DBG(host,fmt,args...)   do { } while (0)
 #endif
@@ -541,7 +541,7 @@ static int mmci_probe(struct amba_device *dev, void *id)
         mmc_add_host(mmc);
 
         printk(KERN_INFO "%s: MMCI rev %x cfg %02x at 0x%08lx irq %d,%d\n",
-                mmc->host_name, amba_rev(dev), amba_config(dev),
+                mmc_hostname(mmc), amba_rev(dev), amba_config(dev),
                 dev->res.start, dev->irq[0], dev->irq[1]);
 
         init_timer(&host->timer);
diff --git a/drivers/mmc/wbsd.c b/drivers/mmc/wbsd.c
index 8b487ed1069c..402c2d661fb2 100644
--- a/drivers/mmc/wbsd.c
+++ b/drivers/mmc/wbsd.c
@@ -42,7 +42,7 @@
 #include "wbsd.h"
 
 #define DRIVER_NAME "wbsd"
-#define DRIVER_VERSION "1.2"
+#define DRIVER_VERSION "1.3"
 
 #ifdef CONFIG_MMC_DEBUG
 #define DBG(x...) \
@@ -1796,7 +1796,7 @@ static int __devinit wbsd_init(struct device* dev, int base, int irq, int dma,
         
         mmc_add_host(mmc);
 
-        printk(KERN_INFO "%s: W83L51xD", mmc->host_name);
+        printk(KERN_INFO "%s: W83L51xD", mmc_hostname(mmc));
         if (host->chip_id != 0)
                 printk(" id %x", (int)host->chip_id);
         printk(" at 0x%x irq %d", (int)host->base, (int)host->irq);
diff --git a/drivers/net/8139cp.c b/drivers/net/8139cp.c
index 7b293f01c9ed..34b80de34fae 100644
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -1897,6 +1897,7 @@ static int cp_resume (struct pci_dev *pdev)
 {
         struct net_device *dev;
         struct cp_private *cp;
+        unsigned long flags;
 
         dev = pci_get_drvdata (pdev);
         cp  = netdev_priv(dev);
@@ -1910,6 +1911,12 @@ static int cp_resume (struct pci_dev *pdev)
         
         cp_init_hw (cp);
         netif_start_queue (dev);
+
+        spin_lock_irqsave (&cp->lock, flags);
+
+        mii_check_media(&cp->mii_if, netif_msg_link(cp), FALSE);
+
+        spin_unlock_irqrestore (&cp->lock, flags);
         
         return 0;
 }
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 8a835eb58808..e0239a10d325 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -131,6 +131,8 @@ config NET_SB1000
 
         source "drivers/net/arcnet/Kconfig"
 
+source "drivers/net/phy/Kconfig"
+
 #
 #       Ethernet
 #
@@ -1145,7 +1147,7 @@ config IBMVETH
           be called ibmveth.
 
 config IBM_EMAC
-        tristate "IBM PPC4xx EMAC driver support"
+        bool "IBM PPC4xx EMAC driver support"
         depends on 4xx
         select CRC32
         ---help---
@@ -1154,7 +1156,7 @@ config IBM_EMAC
 
 config IBM_EMAC_ERRMSG
         bool "Verbose error messages"
-        depends on IBM_EMAC
+        depends on IBM_EMAC && BROKEN
 
 config IBM_EMAC_RXB
         int "Number of receive buffers"
@@ -1921,6 +1923,17 @@ config R8169_VLAN
           
           If in doubt, say Y.
 
+config SIS190
+        tristate "SiS190 gigabit ethernet support"
+        depends on PCI
+        select CRC32
+        select MII
+        ---help---
+          Say Y here if you have a SiS 190 PCI Gigabit Ethernet adapter.
+
+          To compile this driver as a module, choose M here: the module
+          will be called sis190.  This is recommended.
+
 config SKGE
         tristate "New SysKonnect GigaEthernet support (EXPERIMENTAL)"
         depends on PCI && EXPERIMENTAL
@@ -2091,6 +2104,25 @@ endmenu
 menu "Ethernet (10000 Mbit)"
         depends on !UML
 
+config CHELSIO_T1
+        tristate "Chelsio 10Gb Ethernet support"
+        depends on PCI
+        help
+          This driver supports Chelsio N110 and N210 models 10Gb Ethernet
+          cards. More information about adapter features and performance
+          tuning is in <file:Documentation/networking/cxgb.txt>.
+
+          For general information about Chelsio and our products, visit
+          our website at <http://www.chelsio.com>.
+
+          For customer support, please visit our customer support page at
+          <http://www.chelsio.com/support.htm>.
+
+          Please send feedback to <linux-bugs@chelsio.com>.
+
+          To compile this driver as a module, choose M here: the module
+          will be called cxgb.
+
 config IXGB
         tristate "Intel(R) PRO/10GbE support"
         depends on PCI
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 63c6d1e6d4d9..5baafcd55610 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -9,6 +9,7 @@ endif
 obj-$(CONFIG_E1000) += e1000/
 obj-$(CONFIG_IBM_EMAC) += ibm_emac/
 obj-$(CONFIG_IXGB) += ixgb/
+obj-$(CONFIG_CHELSIO_T1) += chelsio/
 obj-$(CONFIG_BONDING) += bonding/
 obj-$(CONFIG_GIANFAR) += gianfar_driver.o
 
@@ -42,6 +43,7 @@ obj-$(CONFIG_EEPRO100) += eepro100.o
 obj-$(CONFIG_E100) += e100.o
 obj-$(CONFIG_TLAN) += tlan.o
 obj-$(CONFIG_EPIC100) += epic100.o
+obj-$(CONFIG_SIS190) += sis190.o
 obj-$(CONFIG_SIS900) += sis900.o
 obj-$(CONFIG_YELLOWFIN) += yellowfin.o
 obj-$(CONFIG_ACENIC) += acenic.o
@@ -65,6 +67,7 @@ obj-$(CONFIG_ADAPTEC_STARFIRE) += starfire.o
 #
 
 obj-$(CONFIG_MII) += mii.o
+obj-$(CONFIG_PHYLIB) += phy/
 
 obj-$(CONFIG_SUNDANCE) += sundance.o
 obj-$(CONFIG_HAMACHI) += hamachi.o
diff --git a/drivers/net/Space.c b/drivers/net/Space.c
index 3707df6b0cfa..60304f7e7e5b 100644
--- a/drivers/net/Space.c
+++ b/drivers/net/Space.c
@@ -87,7 +87,6 @@ extern struct net_device *mvme147lance_probe(int unit);
 extern struct net_device *tc515_probe(int unit);
 extern struct net_device *lance_probe(int unit);
 extern struct net_device *mace_probe(int unit);
-extern struct net_device *macsonic_probe(int unit);
 extern struct net_device *mac8390_probe(int unit);
 extern struct net_device *mac89x0_probe(int unit);
 extern struct net_device *mc32_probe(int unit);
@@ -284,9 +283,6 @@ static struct devprobe2 m68k_probes[] __initdata = {
 #ifdef CONFIG_MACMACE           /* Mac 68k Quadra AV builtin Ethernet */
         {mace_probe, 0},
 #endif
-#ifdef CONFIG_MACSONIC          /* Mac SONIC-based Ethernet of all sorts */ 
-        {macsonic_probe, 0},
-#endif
 #ifdef CONFIG_MAC8390           /* NuBus NS8390-based cards */
         {mac8390_probe, 0},
 #endif
@@ -318,17 +314,9 @@ static void __init ethif_probe2(int unit)
 #ifdef CONFIG_TR
 /* Token-ring device probe */
 extern int ibmtr_probe_card(struct net_device *);
-extern struct net_device *sk_isa_probe(int unit);
-extern struct net_device *proteon_probe(int unit);
 extern struct net_device *smctr_probe(int unit);
 
 static struct devprobe2 tr_probes2[] __initdata = {
-#ifdef CONFIG_SKISA
-        {sk_isa_probe, 0},
-#endif
-#ifdef CONFIG_PROTEON
-        {proteon_probe, 0},
-#endif
 #ifdef CONFIG_SMCTR
         {smctr_probe, 0},
 #endif
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 8acc655ec1e8..7babf6af4e28 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -14,8 +14,8 @@
 
 #define DRV_MODULE_NAME         "bnx2"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "1.2.19"
-#define DRV_MODULE_RELDATE      "May 23, 2005"
+#define DRV_MODULE_VERSION      "1.2.20"
+#define DRV_MODULE_RELDATE      "August 22, 2005"
 
 #define RUN_AT(x) (jiffies + (x))
 
@@ -52,7 +52,6 @@ static struct {
         { "HP NC370i Multifunction Gigabit Server Adapter" },
         { "Broadcom NetXtreme II BCM5706 1000Base-SX" },
         { "HP NC370F Multifunction Gigabit Server Adapter" },
-        { 0 },
         };
 
 static struct pci_device_id bnx2_pci_tbl[] = {
@@ -108,6 +107,15 @@ static struct flash_spec flash_table[] =
 
 MODULE_DEVICE_TABLE(pci, bnx2_pci_tbl);
 
+static inline u32 bnx2_tx_avail(struct bnx2 *bp)
+{
+        u32 diff = TX_RING_IDX(bp->tx_prod) - TX_RING_IDX(bp->tx_cons);
+
+        if (diff > MAX_TX_DESC_CNT)
+                diff = (diff & MAX_TX_DESC_CNT) - 1;
+        return (bp->tx_ring_size - diff);
+}
+
 static u32
 bnx2_reg_rd_ind(struct bnx2 *bp, u32 offset)
 {
@@ -807,7 +815,19 @@ bnx2_setup_serdes_phy(struct bnx2 *bp)
                 bnx2_write_phy(bp, MII_ADVERTISE, new_adv);
                 bnx2_write_phy(bp, MII_BMCR, bmcr | BMCR_ANRESTART |
                         BMCR_ANENABLE);
-                bp->serdes_an_pending = SERDES_AN_TIMEOUT / bp->timer_interval;
+                if (CHIP_NUM(bp) == CHIP_NUM_5706) {
+                        /* Speed up link-up time when the link partner
+                         * does not autonegotiate which is very common
+                         * in blade servers. Some blade servers use
+                         * IPMI for kerboard input and it's important
+                         * to minimize link disruptions. Autoneg. involves
+                         * exchanging base pages plus 3 next pages and
+                         * normally completes in about 120 msec.
+                         */
+                        bp->current_interval = SERDES_AN_TIMEOUT;
+                        bp->serdes_an_pending = 1;
+                        mod_timer(&bp->timer, jiffies + bp->current_interval);
+                }
         }
 
         return 0;
@@ -1327,22 +1347,17 @@ bnx2_tx_int(struct bnx2 *bp)
                 }
         }
 
-        atomic_add(tx_free_bd, &bp->tx_avail_bd);
+        bp->tx_cons = sw_cons;
 
         if (unlikely(netif_queue_stopped(bp->dev))) {
-                unsigned long flags;
-
-                spin_lock_irqsave(&bp->tx_lock, flags);
+                spin_lock(&bp->tx_lock);
                 if ((netif_queue_stopped(bp->dev)) &&
-                        (atomic_read(&bp->tx_avail_bd) > MAX_SKB_FRAGS)) {
+                    (bnx2_tx_avail(bp) > MAX_SKB_FRAGS)) {
 
                         netif_wake_queue(bp->dev);
                 }
-                spin_unlock_irqrestore(&bp->tx_lock, flags);
+                spin_unlock(&bp->tx_lock);
         }
-
-        bp->tx_cons = sw_cons;
-
 }
 
 static inline void
@@ -1523,15 +1538,12 @@ bnx2_msi(int irq, void *dev_instance, struct pt_regs *regs)
                 BNX2_PCICFG_INT_ACK_CMD_MASK_INT);
 
         /* Return here if interrupt is disabled. */
-        if (unlikely(atomic_read(&bp->intr_sem) != 0)) {
-                return IRQ_RETVAL(1);
-        }
+        if (unlikely(atomic_read(&bp->intr_sem) != 0))
+                return IRQ_HANDLED;
 
-        if (netif_rx_schedule_prep(dev)) {
-                __netif_rx_schedule(dev);
-        }
+        netif_rx_schedule(dev);
 
-        return IRQ_RETVAL(1);
+        return IRQ_HANDLED;
 }
 
 static irqreturn_t
@@ -1549,22 +1561,19 @@ bnx2_interrupt(int irq, void *dev_instance, struct pt_regs *regs)
         if ((bp->status_blk->status_idx == bp->last_status_idx) ||
             (REG_RD(bp, BNX2_PCICFG_MISC_STATUS) &
              BNX2_PCICFG_MISC_STATUS_INTA_VALUE))
-                return IRQ_RETVAL(0);
+                return IRQ_NONE;
 
         REG_WR(bp, BNX2_PCICFG_INT_ACK_CMD,
                 BNX2_PCICFG_INT_ACK_CMD_USE_INT_HC_PARAM |
                 BNX2_PCICFG_INT_ACK_CMD_MASK_INT);
 
         /* Return here if interrupt is shared and is disabled. */
-        if (unlikely(atomic_read(&bp->intr_sem) != 0)) {
-                return IRQ_RETVAL(1);
-        }
+        if (unlikely(atomic_read(&bp->intr_sem) != 0))
+                return IRQ_HANDLED;
 
-        if (netif_rx_schedule_prep(dev)) {
-                __netif_rx_schedule(dev);
-        }
+        netif_rx_schedule(dev);
 
-        return IRQ_RETVAL(1);
+        return IRQ_HANDLED;
 }
 
 static int
@@ -1581,11 +1590,9 @@ bnx2_poll(struct net_device *dev, int *budget)
                 (bp->status_blk->status_attn_bits_ack &
                 STATUS_ATTN_BITS_LINK_STATE)) {
 
-                unsigned long flags;
-
-                spin_lock_irqsave(&bp->phy_lock, flags);
+                spin_lock(&bp->phy_lock);
                 bnx2_phy_int(bp);
-                spin_unlock_irqrestore(&bp->phy_lock, flags);
+                spin_unlock(&bp->phy_lock);
         }
 
         if (bp->status_blk->status_tx_quick_consumer_index0 != bp->tx_cons) {
@@ -1628,9 +1635,8 @@ bnx2_set_rx_mode(struct net_device *dev)
         struct bnx2 *bp = dev->priv;
         u32 rx_mode, sort_mode;
         int i;
-        unsigned long flags;
 
-        spin_lock_irqsave(&bp->phy_lock, flags);
+        spin_lock_bh(&bp->phy_lock);
 
         rx_mode = bp->rx_mode & ~(BNX2_EMAC_RX_MODE_PROMISCUOUS |
                                   BNX2_EMAC_RX_MODE_KEEP_VLAN_TAG);
@@ -1691,7 +1697,7 @@ bnx2_set_rx_mode(struct net_device *dev)
         REG_WR(bp, BNX2_RPM_SORT_USER0, sort_mode);
         REG_WR(bp, BNX2_RPM_SORT_USER0, sort_mode | BNX2_RPM_SORT_USER0_ENA);
 
-        spin_unlock_irqrestore(&bp->phy_lock, flags);
+        spin_unlock_bh(&bp->phy_lock);
 }
 
 static void
@@ -2960,7 +2966,6 @@ bnx2_init_tx_ring(struct bnx2 *bp)
         bp->tx_prod = 0;
         bp->tx_cons = 0;
         bp->tx_prod_bseq = 0;
-        atomic_set(&bp->tx_avail_bd, bp->tx_ring_size);
         
         val = BNX2_L2CTX_TYPE_TYPE_L2;
         val |= BNX2_L2CTX_TYPE_SIZE_L2;
@@ -3507,11 +3512,11 @@ bnx2_test_registers(struct bnx2 *bp)
                 rw_mask = reg_tbl[i].rw_mask;
                 ro_mask = reg_tbl[i].ro_mask;
 
-                save_val = readl((u8 *) bp->regview + offset);
+                save_val = readl(bp->regview + offset);
 
-                writel(0, (u8 *) bp->regview + offset);
+                writel(0, bp->regview + offset);
 
-                val = readl((u8 *) bp->regview + offset);
+                val = readl(bp->regview + offset);
                 if ((val & rw_mask) != 0) {
                         goto reg_test_err;
                 }
@@ -3520,9 +3525,9 @@ bnx2_test_registers(struct bnx2 *bp)
                         goto reg_test_err;
                 }
 
-                writel(0xffffffff, (u8 *) bp->regview + offset);
+                writel(0xffffffff, bp->regview + offset);
 
-                val = readl((u8 *) bp->regview + offset);
+                val = readl(bp->regview + offset);
                 if ((val & rw_mask) != rw_mask) {
                         goto reg_test_err;
                 }
@@ -3531,11 +3536,11 @@ bnx2_test_registers(struct bnx2 *bp)
                         goto reg_test_err;
                 }
 
-                writel(save_val, (u8 *) bp->regview + offset);
+                writel(save_val, bp->regview + offset);
                 continue;
 
 reg_test_err:
-                writel(save_val, (u8 *) bp->regview + offset);
+                writel(save_val, bp->regview + offset);
                 ret = -ENODEV;
                 break;
         }
@@ -3752,10 +3757,10 @@ bnx2_test_link(struct bnx2 *bp)
 {
         u32 bmsr;
 
-        spin_lock_irq(&bp->phy_lock);
+        spin_lock_bh(&bp->phy_lock);
         bnx2_read_phy(bp, MII_BMSR, &bmsr);
         bnx2_read_phy(bp, MII_BMSR, &bmsr);
-        spin_unlock_irq(&bp->phy_lock);
+        spin_unlock_bh(&bp->phy_lock);
                 
         if (bmsr & BMSR_LSTATUS) {
                 return 0;
@@ -3801,6 +3806,9 @@ bnx2_timer(unsigned long data)
         struct bnx2 *bp = (struct bnx2 *) data;
         u32 msg;
 
+        if (!netif_running(bp->dev))
+                return;
+
         if (atomic_read(&bp->intr_sem) != 0)
                 goto bnx2_restart_timer;
 
@@ -3809,15 +3817,16 @@ bnx2_timer(unsigned long data)
 
         if ((bp->phy_flags & PHY_SERDES_FLAG) &&
             (CHIP_NUM(bp) == CHIP_NUM_5706)) {
-                unsigned long flags;
 
-                spin_lock_irqsave(&bp->phy_lock, flags);
+                spin_lock(&bp->phy_lock);
                 if (bp->serdes_an_pending) {
                         bp->serdes_an_pending--;
                 }
                 else if ((bp->link_up == 0) && (bp->autoneg & AUTONEG_SPEED)) {
                         u32 bmcr;
 
+                        bp->current_interval = bp->timer_interval;
+
                         bnx2_read_phy(bp, MII_BMCR, &bmcr);
 
                         if (bmcr & BMCR_ANENABLE) {
@@ -3860,14 +3869,14 @@ bnx2_timer(unsigned long data)
 
                         }
                 }
+                else
+                        bp->current_interval = bp->timer_interval;
 
-                spin_unlock_irqrestore(&bp->phy_lock, flags);
+                spin_unlock(&bp->phy_lock);
         }
 
 bnx2_restart_timer:
-        bp->timer.expires = RUN_AT(bp->timer_interval);
-
-        add_timer(&bp->timer);
+        mod_timer(&bp->timer, jiffies + bp->current_interval);
 }
 
 /* Called with rtnl_lock */
@@ -3920,12 +3929,7 @@ bnx2_open(struct net_device *dev)
                 return rc;
         }
         
-        init_timer(&bp->timer);
-
-        bp->timer.expires = RUN_AT(bp->timer_interval);
-        bp->timer.data = (unsigned long) bp;
-        bp->timer.function = bnx2_timer;
-        add_timer(&bp->timer);
+        mod_timer(&bp->timer, jiffies + bp->current_interval);
 
         atomic_set(&bp->intr_sem, 0);
 
@@ -3976,12 +3980,17 @@ bnx2_reset_task(void *data)
 {
         struct bnx2 *bp = data;
 
+        if (!netif_running(bp->dev))
+                return;
+
+        bp->in_reset_task = 1;
         bnx2_netif_stop(bp);
 
         bnx2_init_nic(bp);
 
         atomic_set(&bp->intr_sem, 1);
         bnx2_netif_start(bp);
+        bp->in_reset_task = 0;
 }
 
 static void
@@ -4041,9 +4050,7 @@ bnx2_start_xmit(struct sk_buff *skb, struct net_device *dev)
         u16 prod, ring_prod;
         int i;
 
-        if (unlikely(atomic_read(&bp->tx_avail_bd) <
-                (skb_shinfo(skb)->nr_frags + 1))) {
-
+        if (unlikely(bnx2_tx_avail(bp) < (skb_shinfo(skb)->nr_frags + 1))) {
                 netif_stop_queue(dev);
                 printk(KERN_ERR PFX "%s: BUG! Tx ring full when queue awake!\n",
                         dev->name);
@@ -4140,8 +4147,6 @@ bnx2_start_xmit(struct sk_buff *skb, struct net_device *dev)
         prod = NEXT_TX_BD(prod);
         bp->tx_prod_bseq += skb->len;
 
-        atomic_sub(last_frag + 1, &bp->tx_avail_bd);
-
         REG_WR16(bp, MB_TX_CID_ADDR + BNX2_L2CTX_TX_HOST_BIDX, prod);
         REG_WR(bp, MB_TX_CID_ADDR + BNX2_L2CTX_TX_HOST_BSEQ, bp->tx_prod_bseq);
 
@@ -4150,17 +4155,13 @@ bnx2_start_xmit(struct sk_buff *skb, struct net_device *dev)
         bp->tx_prod = prod;
         dev->trans_start = jiffies;
 
-        if (unlikely(atomic_read(&bp->tx_avail_bd) <= MAX_SKB_FRAGS)) {
-                unsigned long flags;
-
-                spin_lock_irqsave(&bp->tx_lock, flags);
-                if (atomic_read(&bp->tx_avail_bd) <= MAX_SKB_FRAGS) {
-                        netif_stop_queue(dev);
-
-                        if (atomic_read(&bp->tx_avail_bd) > MAX_SKB_FRAGS)
-                                netif_wake_queue(dev);
-                }
-                spin_unlock_irqrestore(&bp->tx_lock, flags);
+        if (unlikely(bnx2_tx_avail(bp) <= MAX_SKB_FRAGS)) {
+                spin_lock(&bp->tx_lock);
+                netif_stop_queue(dev);
+                
+                if (bnx2_tx_avail(bp) > MAX_SKB_FRAGS)
+                        netif_wake_queue(dev);
+                spin_unlock(&bp->tx_lock);
         }
 
         return NETDEV_TX_OK;
@@ -4173,7 +4174,13 @@ bnx2_close(struct net_device *dev)
         struct bnx2 *bp = dev->priv;
         u32 reset_code;
 
-        flush_scheduled_work();
+        /* Calling flush_scheduled_work() may deadlock because
+         * linkwatch_event() may be on the workqueue and it will try to get
+         * the rtnl_lock which we are holding.
+         */
+        while (bp->in_reset_task)
+                msleep(1);
+
         bnx2_netif_stop(bp);
         del_timer_sync(&bp->timer);
         if (bp->wol)
@@ -4390,11 +4397,11 @@ bnx2_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
         bp->req_line_speed = req_line_speed;
         bp->req_duplex = req_duplex;
 
-        spin_lock_irq(&bp->phy_lock);
+        spin_lock_bh(&bp->phy_lock);
 
         bnx2_setup_phy(bp);
 
-        spin_unlock_irq(&bp->phy_lock);
+        spin_unlock_bh(&bp->phy_lock);
 
         return 0;
 }
@@ -4464,19 +4471,20 @@ bnx2_nway_reset(struct net_device *dev)
                 return -EINVAL;
         }
 
-        spin_lock_irq(&bp->phy_lock);
+        spin_lock_bh(&bp->phy_lock);
 
         /* Force a link down visible on the other side */
         if (bp->phy_flags & PHY_SERDES_FLAG) {
                 bnx2_write_phy(bp, MII_BMCR, BMCR_LOOPBACK);
-                spin_unlock_irq(&bp->phy_lock);
+                spin_unlock_bh(&bp->phy_lock);
 
                 msleep(20);
 
-                spin_lock_irq(&bp->phy_lock);
+                spin_lock_bh(&bp->phy_lock);
                 if (CHIP_NUM(bp) == CHIP_NUM_5706) {
-                        bp->serdes_an_pending = SERDES_AN_TIMEOUT /
-                                bp->timer_interval;
+                        bp->current_interval = SERDES_AN_TIMEOUT;
+                        bp->serdes_an_pending = 1;
+                        mod_timer(&bp->timer, jiffies + bp->current_interval);
                 }
         }
 
@@ -4484,7 +4492,7 @@ bnx2_nway_reset(struct net_device *dev)
         bmcr &= ~BMCR_LOOPBACK;
         bnx2_write_phy(bp, MII_BMCR, bmcr | BMCR_ANRESTART | BMCR_ANENABLE);
 
-        spin_unlock_irq(&bp->phy_lock);
+        spin_unlock_bh(&bp->phy_lock);
 
         return 0;
 }
@@ -4670,11 +4678,11 @@ bnx2_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam *epause)
                 bp->autoneg &= ~AUTONEG_FLOW_CTRL;
         }
 
-        spin_lock_irq(&bp->phy_lock);
+        spin_lock_bh(&bp->phy_lock);
 
         bnx2_setup_phy(bp);
 
-        spin_unlock_irq(&bp->phy_lock);
+        spin_unlock_bh(&bp->phy_lock);
 
         return 0;
 }
@@ -4698,7 +4706,7 @@ bnx2_set_rx_csum(struct net_device *dev, u32 data)
 
 #define BNX2_NUM_STATS 45
 
-struct {
+static struct {
         char string[ETH_GSTRING_LEN];
 } bnx2_stats_str_arr[BNX2_NUM_STATS] = {
         { "rx_bytes" },
@@ -4750,7 +4758,7 @@ struct {
 
 #define STATS_OFFSET32(offset_name) (offsetof(struct statistics_block, offset_name) / 4)
 
-unsigned long bnx2_stats_offset_arr[BNX2_NUM_STATS] = {
+static unsigned long bnx2_stats_offset_arr[BNX2_NUM_STATS] = {
     STATS_OFFSET32(stat_IfHCInOctets_hi),
     STATS_OFFSET32(stat_IfHCInBadOctets_hi),
     STATS_OFFSET32(stat_IfHCOutOctets_hi),
@@ -4801,7 +4809,7 @@ unsigned long bnx2_stats_offset_arr[BNX2_NUM_STATS] = {
 /* stat_IfHCInBadOctets and stat_Dot3StatsCarrierSenseErrors are
  * skipped because of errata.
  */               
-u8 bnx2_5706_stats_len_arr[BNX2_NUM_STATS] = {
+static u8 bnx2_5706_stats_len_arr[BNX2_NUM_STATS] = {
         8,0,8,8,8,8,8,8,8,8,
         4,0,4,4,4,4,4,4,4,4,
         4,4,4,4,4,4,4,4,4,4,
@@ -4811,7 +4819,7 @@ u8 bnx2_5706_stats_len_arr[BNX2_NUM_STATS] = {
 
 #define BNX2_NUM_TESTS 6
 
-struct {
+static struct {
         char string[ETH_GSTRING_LEN];
 } bnx2_tests_str_arr[BNX2_NUM_TESTS] = {
         { "register_test (offline)" },
@@ -4910,7 +4918,7 @@ bnx2_get_ethtool_stats(struct net_device *dev,
         struct bnx2 *bp = dev->priv;
         int i;
         u32 *hw_stats = (u32 *) bp->stats_blk;
-        u8 *stats_len_arr = 0;
+        u8 *stats_len_arr = NULL;
 
         if (hw_stats == NULL) {
                 memset(buf, 0, sizeof(u64) * BNX2_NUM_STATS);
@@ -5012,7 +5020,7 @@ static struct ethtool_ops bnx2_ethtool_ops = {
 static int
 bnx2_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
-        struct mii_ioctl_data *data = (struct mii_ioctl_data *)&ifr->ifr_data;
+        struct mii_ioctl_data *data = if_mii(ifr);
         struct bnx2 *bp = dev->priv;
         int err;
 
@@ -5024,9 +5032,9 @@ bnx2_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         case SIOCGMIIREG: {
                 u32 mii_regval;
 
-                spin_lock_irq(&bp->phy_lock);
+                spin_lock_bh(&bp->phy_lock);
                 err = bnx2_read_phy(bp, data->reg_num & 0x1f, &mii_regval);
-                spin_unlock_irq(&bp->phy_lock);
+                spin_unlock_bh(&bp->phy_lock);
 
                 data->val_out = mii_regval;
 
@@ -5037,9 +5045,9 @@ bnx2_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
 
-                spin_lock_irq(&bp->phy_lock);
+                spin_lock_bh(&bp->phy_lock);
                 err = bnx2_write_phy(bp, data->reg_num & 0x1f, data->val_in);
-                spin_unlock_irq(&bp->phy_lock);
+                spin_unlock_bh(&bp->phy_lock);
 
                 return err;
 
@@ -5057,6 +5065,9 @@ bnx2_change_mac_addr(struct net_device *dev, void *p)
         struct sockaddr *addr = p;
         struct bnx2 *bp = dev->priv;
 
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EINVAL;
+
         memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
         if (netif_running(dev))
                 bnx2_set_mac_addr(bp);
@@ -5305,6 +5316,7 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
         bp->stats_ticks = 1000000 & 0xffff00;
 
         bp->timer_interval =  HZ;
+        bp->current_interval =  HZ;
 
         /* Disable WOL support if we are running on a SERDES chip. */
         if (CHIP_BOND_ID(bp) & CHIP_BOND_ID_SERDES_BIT) {
@@ -5328,6 +5340,15 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
         bp->req_line_speed = 0;
         if (bp->phy_flags & PHY_SERDES_FLAG) {
                 bp->advertising = ETHTOOL_ALL_FIBRE_SPEED | ADVERTISED_Autoneg;
+
+                reg = REG_RD_IND(bp, HOST_VIEW_SHMEM_BASE +
+                                 BNX2_PORT_HW_CFG_CONFIG);
+                reg &= BNX2_PORT_HW_CFG_CFG_DFLT_LINK_MASK;
+                if (reg == BNX2_PORT_HW_CFG_CFG_DFLT_LINK_1G) {
+                        bp->autoneg = 0;
+                        bp->req_line_speed = bp->line_speed = SPEED_1000;
+                        bp->req_duplex = DUPLEX_FULL;
+                }
         }
         else {
                 bp->advertising = ETHTOOL_ALL_COPPER_SPEED | ADVERTISED_Autoneg;
@@ -5335,11 +5356,17 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
 
         bp->req_flow_ctrl = FLOW_CTRL_RX | FLOW_CTRL_TX;
 
+        init_timer(&bp->timer);
+        bp->timer.expires = RUN_AT(bp->timer_interval);
+        bp->timer.data = (unsigned long) bp;
+        bp->timer.function = bnx2_timer;
+
         return 0;
 
 err_out_unmap:
         if (bp->regview) {
                 iounmap(bp->regview);
+                bp->regview = NULL;
         }
 
 err_out_release:
@@ -5454,6 +5481,8 @@ bnx2_remove_one(struct pci_dev *pdev)
         struct net_device *dev = pci_get_drvdata(pdev);
         struct bnx2 *bp = dev->priv;
 
+        flush_scheduled_work();
+
         unregister_netdev(dev);
 
         if (bp->regview)
@@ -5505,12 +5534,12 @@ bnx2_resume(struct pci_dev *pdev)
 }
 
 static struct pci_driver bnx2_pci_driver = {
-        name:           DRV_MODULE_NAME,
-        id_table:       bnx2_pci_tbl,
-        probe:          bnx2_init_one,
-        remove:         __devexit_p(bnx2_remove_one),
-        suspend:        bnx2_suspend,
-        resume:         bnx2_resume,
+        .name           = DRV_MODULE_NAME,
+        .id_table       = bnx2_pci_tbl,
+        .probe          = bnx2_init_one,
+        .remove         = __devexit_p(bnx2_remove_one),
+        .suspend        = bnx2_suspend,
+        .resume         = bnx2_resume,
 };
 
 static int __init bnx2_init(void)
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index 8214a2853d0d..9ad3f5740cd8 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -3841,12 +3841,12 @@ struct bnx2 {
         struct status_block     *status_blk;
         u32                     last_status_idx;
 
-        atomic_t                tx_avail_bd;
         struct tx_bd            *tx_desc_ring;
         struct sw_bd            *tx_buf_ring;
         u32                     tx_prod_bseq;
         u16                     tx_prod;
         u16                     tx_cons;
+        int                     tx_ring_size;
 
 #ifdef BCM_VLAN 
         struct                  vlan_group *vlgrp;
@@ -3872,8 +3872,10 @@ struct bnx2 {
         char                    *name;
 
         int                     timer_interval;
+        int                     current_interval;
         struct                  timer_list timer;
         struct work_struct      reset_task;
+        int                     in_reset_task;
 
         /* Used to synchronize phy accesses. */
         spinlock_t              phy_lock;
@@ -3927,7 +3929,6 @@ struct bnx2 {
         u16                     fw_wr_seq;
         u16                     fw_drv_pulse_wr_seq;
 
-        int                     tx_ring_size;
         dma_addr_t              tx_desc_mapping;
 
 
@@ -3985,7 +3986,7 @@ struct bnx2 {
 #define PHY_LOOPBACK            2
 
         u8                      serdes_an_pending;
-#define SERDES_AN_TIMEOUT       (2 * HZ)
+#define SERDES_AN_TIMEOUT       (HZ / 3)
 
         u8                      mac_addr[8];
 
@@ -4171,6 +4172,9 @@ struct fw_info {
 
 #define BNX2_PORT_HW_CFG_MAC_LOWER              0x00000054
 #define BNX2_PORT_HW_CFG_CONFIG                 0x00000058
+#define BNX2_PORT_HW_CFG_CFG_DFLT_LINK_MASK      0x001f0000
+#define BNX2_PORT_HW_CFG_CFG_DFLT_LINK_AN        0x00000000
+#define BNX2_PORT_HW_CFG_CFG_DFLT_LINK_1G        0x00030000
 
 #define BNX2_PORT_HW_CFG_IMD_MAC_A_UPPER        0x00000068
 #define BNX2_PORT_HW_CFG_IMD_MAC_A_LOWER        0x0000006c
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index a2e8dda5afac..d2f34d5a8083 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2419,22 +2419,19 @@ out:
         return 0;
 }
 
-int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type* ptype)
+int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type* ptype, struct net_device *orig_dev)
 {
         struct bonding *bond = dev->priv;
         struct slave *slave = NULL;
         int ret = NET_RX_DROP;
 
-        if (!(dev->flags & IFF_MASTER)) {
+        if (!(dev->flags & IFF_MASTER))
                 goto out;
-        }
 
         read_lock(&bond->lock);
-        slave = bond_get_slave_by_dev((struct bonding *)dev->priv,
-                                      skb->real_dev);
-        if (slave == NULL) {
+        slave = bond_get_slave_by_dev((struct bonding *)dev->priv, orig_dev);
+        if (!slave)
                 goto out_unlock;
-        }
 
         bond_3ad_rx_indication((struct lacpdu *) skb->data, slave, skb->len);
 
diff --git a/drivers/net/bonding/bond_3ad.h b/drivers/net/bonding/bond_3ad.h
index f46823894187..673a30af5660 100644
--- a/drivers/net/bonding/bond_3ad.h
+++ b/drivers/net/bonding/bond_3ad.h
@@ -295,6 +295,6 @@ void bond_3ad_adapter_duplex_changed(struct slave *slave);
 void bond_3ad_handle_link_change(struct slave *slave, char link);
 int  bond_3ad_get_active_agg_info(struct bonding *bond, struct ad_info *ad_info);
 int bond_3ad_xmit_xor(struct sk_buff *skb, struct net_device *dev);
-int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type* ptype);
+int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type* ptype, struct net_device *orig_dev);
 #endif //__BOND_3AD_H__
 
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 5ce606d9dc03..f8fce3961197 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -354,15 +354,14 @@ static void rlb_update_entry_from_arp(struct bonding *bond, struct arp_pkt *arp)
         _unlock_rx_hashtbl(bond);
 }
 
-static int rlb_arp_recv(struct sk_buff *skb, struct net_device *bond_dev, struct packet_type *ptype)
+static int rlb_arp_recv(struct sk_buff *skb, struct net_device *bond_dev, struct packet_type *ptype, struct net_device *orig_dev)
 {
         struct bonding *bond = bond_dev->priv;
         struct arp_pkt *arp = (struct arp_pkt *)skb->data;
         int res = NET_RX_DROP;
 
-        if (!(bond_dev->flags & IFF_MASTER)) {
+        if (!(bond_dev->flags & IFF_MASTER))
                 goto out;
-        }
 
         if (!arp) {
                 dprintk("Packet has no ARP data\n");
@@ -1106,18 +1105,13 @@ static int alb_handle_addr_collision_on_attach(struct bonding *bond, struct slav
                         }
                 }
 
-                if (found) {
-                        /* a slave was found that is using the mac address
-                         * of the new slave
-                         */
-                        printk(KERN_ERR DRV_NAME
-                               ": Error: the hw address of slave %s is not "
-                               "unique - cannot enslave it!",
-                               slave->dev->name);
-                        return -EINVAL;
-                }
+                if (!found)
+                        return 0;
 
-                return 0;
+                /* Try setting slave mac to bond address and fall-through
+                   to code handling that situation below... */
+                alb_set_slave_mac_addr(slave, bond->dev->dev_addr,
+                                       bond->alb_info.rlb_enabled);
         }
 
         /* The slave's address is equal to the address of the bond.
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 2c930da90a85..94c9f68dd16b 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1604,6 +1604,44 @@ static int bond_sethwaddr(struct net_device *bond_dev, struct net_device *slave_
         return 0;
 }
 
+#define BOND_INTERSECT_FEATURES \
+        (NETIF_F_SG|NETIF_F_IP_CSUM|NETIF_F_NO_CSUM|NETIF_F_HW_CSUM)
+
+/* 
+ * Compute the features available to the bonding device by 
+ * intersection of all of the slave devices' BOND_INTERSECT_FEATURES.
+ * Call this after attaching or detaching a slave to update the 
+ * bond's features.
+ */
+static int bond_compute_features(struct bonding *bond)
+{
+        int i;
+        struct slave *slave;
+        struct net_device *bond_dev = bond->dev;
+        int features = bond->bond_features;
+
+        bond_for_each_slave(bond, slave, i) {
+                struct net_device * slave_dev = slave->dev;
+                if (i == 0) {
+                        features |= BOND_INTERSECT_FEATURES;
+                }
+                features &=
+                        ~(~slave_dev->features & BOND_INTERSECT_FEATURES);
+        }
+
+        /* turn off NETIF_F_SG if we need a csum and h/w can't do it */
+        if ((features & NETIF_F_SG) && 
+                !(features & (NETIF_F_IP_CSUM |
+                              NETIF_F_NO_CSUM |
+                              NETIF_F_HW_CSUM))) {
+                features &= ~NETIF_F_SG;
+        }
+
+        bond_dev->features = features;
+
+        return 0;
+}
+
 /* enslave device <slave> to bond device <master> */
 static int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 {
@@ -1811,6 +1849,8 @@ static int bond_enslave(struct net_device *bond_dev, struct net_device *slave_de
         new_slave->delay = 0;
         new_slave->link_failure_count = 0;
 
+        bond_compute_features(bond);
+
         if (bond->params.miimon && !bond->params.use_carrier) {
                 link_reporting = bond_check_dev_link(bond, slave_dev, 1);
 
@@ -2015,7 +2055,7 @@ err_free:
 
 err_undo_flags:
         bond_dev->features = old_features;
-
+ 
         return res;
 }
 
@@ -2100,6 +2140,8 @@ static int bond_release(struct net_device *bond_dev, struct net_device *slave_de
         /* release the slave from its bond */
         bond_detach_slave(bond, slave);
 
+        bond_compute_features(bond);
+
         if (bond->primary_slave == slave) {
                 bond->primary_slave = NULL;
         }
@@ -2243,6 +2285,8 @@ static int bond_release_all(struct net_device *bond_dev)
                         bond_alb_deinit_slave(bond, slave);
                 }
 
+                bond_compute_features(bond);
+
                 /* now that the slave is detached, unlock and perform
                  * all the undo steps that should not be called from
                  * within a lock.
@@ -3588,6 +3632,7 @@ static int bond_master_netdev_event(unsigned long event, struct net_device *bond
 static int bond_slave_netdev_event(unsigned long event, struct net_device *slave_dev)
 {
         struct net_device *bond_dev = slave_dev->master;
+        struct bonding *bond = bond_dev->priv;
 
         switch (event) {
         case NETDEV_UNREGISTER:
@@ -3626,6 +3671,9 @@ static int bond_slave_netdev_event(unsigned long event, struct net_device *slave
                  * TODO: handle changing the primary's name
                  */
                 break;
+        case NETDEV_FEAT_CHANGE:
+                bond_compute_features(bond);
+                break;
         default:
                 break;
         }
@@ -4526,6 +4574,11 @@ static inline void bond_set_mode_ops(struct bonding *bond, int mode)
         }
 }
 
+static struct ethtool_ops bond_ethtool_ops = {
+        .get_tx_csum            = ethtool_op_get_tx_csum,
+        .get_sg                 = ethtool_op_get_sg,
+};
+
 /*
  * Does not allocate but creates a /proc entry.
  * Allowed to fail.
@@ -4555,6 +4608,7 @@ static int __init bond_init(struct net_device *bond_dev, struct bond_params *par
         bond_dev->stop = bond_close;
         bond_dev->get_stats = bond_get_stats;
         bond_dev->do_ioctl = bond_do_ioctl;
+        bond_dev->ethtool_ops = &bond_ethtool_ops;
         bond_dev->set_multicast_list = bond_set_multicast_list;
         bond_dev->change_mtu = bond_change_mtu;
         bond_dev->set_mac_address = bond_set_mac_address;
@@ -4591,6 +4645,8 @@ static int __init bond_init(struct net_device *bond_dev, struct bond_params *par
                                NETIF_F_HW_VLAN_RX |
                                NETIF_F_HW_VLAN_FILTER);
 
+        bond->bond_features = bond_dev->features;
+
 #ifdef CONFIG_PROC_FS
         bond_create_proc_entry(bond);
 #endif
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index d27f377b3eeb..388196980862 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -211,6 +211,9 @@ struct bonding {
         struct   bond_params params;
         struct   list_head vlan_list;
         struct   vlan_group *vlgrp;
+        /* the features the bonding device supports, independently 
+         * of any slaves */
+        int      bond_features; 
 };
 
 /**
diff --git a/drivers/net/chelsio/Makefile b/drivers/net/chelsio/Makefile
new file mode 100644
index 000000000000..91e927827c43
--- /dev/null
+++ b/drivers/net/chelsio/Makefile
@@ -0,0 +1,11 @@
+#
+# Chelsio 10Gb NIC driver for Linux.
+#
+
+obj-$(CONFIG_CHELSIO_T1) += cxgb.o
+
+EXTRA_CFLAGS += -I$(TOPDIR)/drivers/net/chelsio $(DEBUG_FLAGS)
+
+
+cxgb-objs := cxgb2.o espi.o pm3393.o sge.o subr.o mv88x201x.o
+
diff --git a/drivers/net/chelsio/common.h b/drivers/net/chelsio/common.h
new file mode 100644
index 000000000000..f09348802b46
--- /dev/null
+++ b/drivers/net/chelsio/common.h
@@ -0,0 +1,314 @@
+/*****************************************************************************
+ *                                                                           *
+ * File: common.h                                                            *
+ * $Revision: 1.21 $                                                         *
+ * $Date: 2005/06/22 00:43:25 $                                              *
+ * Description:                                                              *
+ *  part of the Chelsio 10Gb Ethernet Driver.                                *
+ *                                                                           *
+ * This program is free software; you can redistribute it and/or modify      *
+ * it under the terms of the GNU General Public License, version 2, as       *
+ * published by the Free Software Foundation.                                *
+ *                                                                           *
+ * You should have received a copy of the GNU General Public License along   *
+ * with this program; if not, write to the Free Software Foundation, Inc.,   *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
+ *                                                                           *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
+ *                                                                           *
+ * http://www.chelsio.com                                                    *
+ *                                                                           *
+ * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
+ * All rights reserved.                                                      *
+ *                                                                           *
+ * Maintainers: maintainers@chelsio.com                                      *
+ *                                                                           *
+ * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
+ *          Tina Yang               <tainay@chelsio.com>                     *
+ *          Felix Marti             <felix@chelsio.com>                      *
+ *          Scott Bardone           <sbardone@chelsio.com>                   *
+ *          Kurt Ottaway            <kottaway@chelsio.com>                   *
+ *          Frank DiMambro          <frank@chelsio.com>                      *
+ *                                                                           *
+ * History:                                                                  *
+ *                                                                           *
+ ****************************************************************************/
+
+#ifndef _CXGB_COMMON_H_
+#define _CXGB_COMMON_H_
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/types.h>
+#include <linux/delay.h>
+#include <linux/pci.h>
+#include <linux/ethtool.h>
+#include <linux/mii.h>
+#include <linux/crc32.h>
+#include <linux/init.h>
+#include <asm/io.h>
+#include <linux/pci_ids.h>
+
+#define DRV_DESCRIPTION "Chelsio 10Gb Ethernet Driver"
+#define DRV_NAME "cxgb"
+#define DRV_VERSION "2.1.1"
+#define PFX      DRV_NAME ": "
+
+#define CH_ERR(fmt, ...)   printk(KERN_ERR PFX fmt, ## __VA_ARGS__)
+#define CH_WARN(fmt, ...)  printk(KERN_WARNING PFX fmt, ## __VA_ARGS__)
+#define CH_ALERT(fmt, ...) printk(KERN_ALERT PFX fmt, ## __VA_ARGS__)
+
+#define CH_DEVICE(devid, ssid, idx) \
+        { PCI_VENDOR_ID_CHELSIO, devid, PCI_ANY_ID, ssid, 0, 0, idx }
+
+#define SUPPORTED_PAUSE       (1 << 13)
+#define SUPPORTED_LOOPBACK    (1 << 15)
+
+#define ADVERTISED_PAUSE      (1 << 13)
+#define ADVERTISED_ASYM_PAUSE (1 << 14)
+
+typedef struct adapter adapter_t;
+
+void t1_elmer0_ext_intr(adapter_t *adapter);
+void t1_link_changed(adapter_t *adapter, int port_id, int link_status,
+                        int speed, int duplex, int fc);
+
+struct t1_rx_mode {
+        struct net_device *dev;
+        u32 idx;
+        struct dev_mc_list *list;
+};
+
+#define t1_rx_mode_promisc(rm)  (rm->dev->flags & IFF_PROMISC)
+#define t1_rx_mode_allmulti(rm) (rm->dev->flags & IFF_ALLMULTI)
+#define t1_rx_mode_mc_cnt(rm)   (rm->dev->mc_count)
+
+static inline u8 *t1_get_next_mcaddr(struct t1_rx_mode *rm)
+{
+        u8 *addr = 0;
+
+        if (rm->idx++ < rm->dev->mc_count) {
+                addr = rm->list->dmi_addr;
+                rm->list = rm->list->next;
+        }
+        return addr;
+}
+
+#define MAX_NPORTS 4
+
+#define SPEED_INVALID 0xffff
+#define DUPLEX_INVALID 0xff
+
+enum {
+        CHBT_BOARD_N110,
+        CHBT_BOARD_N210
+};
+
+enum {
+        CHBT_TERM_T1,
+        CHBT_TERM_T2
+};
+
+enum {
+        CHBT_MAC_PM3393,
+};
+
+enum {
+        CHBT_PHY_88X2010,
+};
+
+enum {
+        PAUSE_RX      = 1 << 0,
+        PAUSE_TX      = 1 << 1,
+        PAUSE_AUTONEG = 1 << 2
+};
+
+/* Revisions of T1 chip */
+enum {
+        TERM_T1A   = 0,
+        TERM_T1B   = 1,
+        TERM_T2    = 3
+};
+
+struct sge_params {
+        unsigned int cmdQ_size[2];
+        unsigned int freelQ_size[2];
+        unsigned int large_buf_capacity;
+        unsigned int rx_coalesce_usecs;
+        unsigned int last_rx_coalesce_raw;
+        unsigned int default_rx_coalesce_usecs;
+        unsigned int sample_interval_usecs;
+        unsigned int coalesce_enable;
+        unsigned int polling;
+};
+
+struct chelsio_pci_params {
+        unsigned short speed;
+        unsigned char  width;
+        unsigned char  is_pcix;
+};
+
+struct adapter_params {
+        struct sge_params sge;
+        struct chelsio_pci_params pci;
+
+        const struct board_info *brd_info;
+
+        unsigned int   nports;          /* # of ethernet ports */
+        unsigned int   stats_update_period;
+        unsigned short chip_revision;
+        unsigned char  chip_version;
+};
+
+struct link_config {
+        unsigned int   supported;        /* link capabilities */
+        unsigned int   advertising;      /* advertised capabilities */
+        unsigned short requested_speed;  /* speed user has requested */
+        unsigned short speed;            /* actual link speed */
+        unsigned char  requested_duplex; /* duplex user has requested */
+        unsigned char  duplex;           /* actual link duplex */
+        unsigned char  requested_fc;     /* flow control user has requested */
+        unsigned char  fc;               /* actual link flow control */
+        unsigned char  autoneg;          /* autonegotiating? */
+};
+
+struct cmac;
+struct cphy;
+
+struct port_info {
+        struct net_device *dev;
+        struct cmac *mac;
+        struct cphy *phy;
+        struct link_config link_config;
+        struct net_device_stats netstats;
+};
+
+struct sge;
+struct peespi;
+
+struct adapter {
+        u8 *regs;
+        struct pci_dev *pdev;
+        unsigned long registered_device_map;
+        unsigned long open_device_map;
+        unsigned long flags;
+
+        const char *name;
+        int msg_enable;
+        u32 mmio_len;
+
+        struct work_struct ext_intr_handler_task;
+        struct adapter_params params;
+
+        struct vlan_group *vlan_grp;
+
+        /* Terminator modules. */
+        struct sge    *sge;
+        struct peespi *espi;
+
+        struct port_info port[MAX_NPORTS];
+        struct work_struct stats_update_task;
+        struct timer_list stats_update_timer;
+
+        struct semaphore mib_mutex;
+        spinlock_t tpi_lock;
+        spinlock_t work_lock;
+        /* guards async operations */
+        spinlock_t async_lock ____cacheline_aligned;
+        u32 slow_intr_mask;
+};
+
+enum {                                           /* adapter flags */
+        FULL_INIT_DONE        = 1 << 0,
+        TSO_CAPABLE           = 1 << 2,
+        TCP_CSUM_CAPABLE      = 1 << 3,
+        UDP_CSUM_CAPABLE      = 1 << 4,
+        VLAN_ACCEL_CAPABLE    = 1 << 5,
+        RX_CSUM_ENABLED       = 1 << 6,
+};
+
+struct mdio_ops;
+struct gmac;
+struct gphy;
+
+struct board_info {
+        unsigned char           board;
+        unsigned char           port_number;
+        unsigned long           caps;
+        unsigned char           chip_term;
+        unsigned char           chip_mac;
+        unsigned char           chip_phy;
+        unsigned int            clock_core;
+        unsigned int            clock_mc3;
+        unsigned int            clock_mc4;
+        unsigned int            espi_nports;
+        unsigned int            clock_cspi;
+        unsigned int            clock_elmer0;
+        unsigned char           mdio_mdien;
+        unsigned char           mdio_mdiinv;
+        unsigned char           mdio_mdc;
+        unsigned char           mdio_phybaseaddr;
+        struct gmac            *gmac;
+        struct gphy            *gphy;
+        struct mdio_ops        *mdio_ops;
+        const char             *desc;
+};
+
+extern struct pci_device_id t1_pci_tbl[];
+
+static inline int adapter_matches_type(const adapter_t *adapter,
+                                       int version, int revision)
+{
+        return adapter->params.chip_version == version &&
+               adapter->params.chip_revision == revision;
+}
+
+#define t1_is_T1B(adap) adapter_matches_type(adap, CHBT_TERM_T1, TERM_T1B)
+#define is_T2(adap)     adapter_matches_type(adap, CHBT_TERM_T2, TERM_T2)
+
+/* Returns true if an adapter supports VLAN acceleration and TSO */
+static inline int vlan_tso_capable(const adapter_t *adapter)
+{
+        return !t1_is_T1B(adapter);
+}
+
+#define for_each_port(adapter, iter) \
+        for (iter = 0; iter < (adapter)->params.nports; ++iter)
+
+#define board_info(adapter) ((adapter)->params.brd_info)
+#define is_10G(adapter) (board_info(adapter)->caps & SUPPORTED_10000baseT_Full)
+
+static inline unsigned int core_ticks_per_usec(const adapter_t *adap)
+{
+        return board_info(adap)->clock_core / 1000000;
+}
+
+extern int t1_tpi_write(adapter_t *adapter, u32 addr, u32 value);
+extern int t1_tpi_read(adapter_t *adapter, u32 addr, u32 *value);
+
+extern void t1_interrupts_enable(adapter_t *adapter);
+extern void t1_interrupts_disable(adapter_t *adapter);
+extern void t1_interrupts_clear(adapter_t *adapter);
+extern int elmer0_ext_intr_handler(adapter_t *adapter);
+extern int t1_slow_intr_handler(adapter_t *adapter);
+
+extern int t1_link_start(struct cphy *phy, struct cmac *mac, struct link_config *lc);
+extern const struct board_info *t1_get_board_info(unsigned int board_id);
+extern const struct board_info *t1_get_board_info_from_ids(unsigned int devid,
+                                                    unsigned short ssid);
+extern int t1_seeprom_read(adapter_t *adapter, u32 addr, u32 *data);
+extern int t1_get_board_rev(adapter_t *adapter, const struct board_info *bi,
+                     struct adapter_params *p);
+extern int t1_init_hw_modules(adapter_t *adapter);
+extern int t1_init_sw_modules(adapter_t *adapter, const struct board_info *bi);
+extern void t1_free_sw_modules(adapter_t *adapter);
+extern void t1_fatal_err(adapter_t *adapter);
+
+extern void t1_tp_set_udp_checksum_offload(adapter_t *adapter, int enable);
+extern void t1_tp_set_tcp_checksum_offload(adapter_t *adapter, int enable);
+extern void t1_tp_set_ip_checksum_offload(adapter_t *adapter, int enable);
+
+#endif /* _CXGB_COMMON_H_ */
diff --git a/drivers/net/chelsio/cphy.h b/drivers/net/chelsio/cphy.h
new file mode 100644
index 000000000000..3412342f7345
--- /dev/null
+++ b/drivers/net/chelsio/cphy.h
@@ -0,0 +1,148 @@
+/*****************************************************************************
+ *                                                                           *
+ * File: cphy.h                                                              *
+ * $Revision: 1.7 $                                                          *
+ * $Date: 2005/06/21 18:29:47 $                                              *
+ * Description:                                                              *
+ *  part of the Chelsio 10Gb Ethernet Driver.                                *
+ *                                                                           *
+ * This program is free software; you can redistribute it and/or modify      *
+ * it under the terms of the GNU General Public License, version 2, as       *
+ * published by the Free Software Foundation.                                *
+ *                                                                           *
+ * You should have received a copy of the GNU General Public License along   *
+ * with this program; if not, write to the Free Software Foundation, Inc.,   *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
+ *                                                                           *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
+ *                                                                           *
+ * http://www.chelsio.com                                                    *
+ *                                                                           *
+ * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
+ * All rights reserved.                                                      *
+ *                                                                           *
+ * Maintainers: maintainers@chelsio.com                                      *
+ *                                                                           *
+ * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
+ *          Tina Yang               <tainay@chelsio.com>                     *
+ *          Felix Marti             <felix@chelsio.com>                      *
+ *          Scott Bardone           <sbardone@chelsio.com>                   *
+ *          Kurt Ottaway            <kottaway@chelsio.com>                   *
+ *          Frank DiMambro          <frank@chelsio.com>                      *
+ *                                                                           *
+ * History:                                                                  *
+ *                                                                           *
+ ****************************************************************************/
+
+#ifndef _CXGB_CPHY_H_
+#define _CXGB_CPHY_H_
+
+#include "common.h"
+
+struct mdio_ops {
+        void (*init)(adapter_t *adapter, const struct board_info *bi);
+        int  (*read)(adapter_t *adapter, int phy_addr, int mmd_addr,
+                     int reg_addr, unsigned int *val);
+        int  (*write)(adapter_t *adapter, int phy_addr, int mmd_addr,
+                      int reg_addr, unsigned int val);
+};
+
+/* PHY interrupt types */
+enum {
+        cphy_cause_link_change = 0x1,
+        cphy_cause_error = 0x2
+};
+
+struct cphy;
+
+/* PHY operations */
+struct cphy_ops {
+        void (*destroy)(struct cphy *);
+        int (*reset)(struct cphy *, int wait);
+
+        int (*interrupt_enable)(struct cphy *);
+        int (*interrupt_disable)(struct cphy *);
+        int (*interrupt_clear)(struct cphy *);
+        int (*interrupt_handler)(struct cphy *);
+
+        int (*autoneg_enable)(struct cphy *);
+        int (*autoneg_disable)(struct cphy *);
+        int (*autoneg_restart)(struct cphy *);
+
+        int (*advertise)(struct cphy *phy, unsigned int advertise_map);
+        int (*set_loopback)(struct cphy *, int on);
+        int (*set_speed_duplex)(struct cphy *phy, int speed, int duplex);
+        int (*get_link_status)(struct cphy *phy, int *link_ok, int *speed,
+                               int *duplex, int *fc);
+};
+
+/* A PHY instance */
+struct cphy {
+        int addr;                            /* PHY address */
+        adapter_t *adapter;                  /* associated adapter */
+        struct cphy_ops *ops;                /* PHY operations */
+        int (*mdio_read)(adapter_t *adapter, int phy_addr, int mmd_addr,
+                         int reg_addr, unsigned int *val);
+        int (*mdio_write)(adapter_t *adapter, int phy_addr, int mmd_addr,
+                          int reg_addr, unsigned int val);
+        struct cphy_instance *instance;
+};
+
+/* Convenience MDIO read/write wrappers */
+static inline int mdio_read(struct cphy *cphy, int mmd, int reg,
+                            unsigned int *valp)
+{
+        return cphy->mdio_read(cphy->adapter, cphy->addr, mmd, reg, valp);
+}
+
+static inline int mdio_write(struct cphy *cphy, int mmd, int reg,
+                             unsigned int val)
+{
+        return cphy->mdio_write(cphy->adapter, cphy->addr, mmd, reg, val);
+}
+
+static inline int simple_mdio_read(struct cphy *cphy, int reg,
+                                   unsigned int *valp)
+{
+        return mdio_read(cphy, 0, reg, valp);
+}
+
+static inline int simple_mdio_write(struct cphy *cphy, int reg,
+                                    unsigned int val)
+{
+        return mdio_write(cphy, 0, reg, val);
+}
+
+/* Convenience initializer */
+static inline void cphy_init(struct cphy *phy, adapter_t *adapter,
+                             int phy_addr, struct cphy_ops *phy_ops,
+                             struct mdio_ops *mdio_ops)
+{
+        phy->adapter = adapter;
+        phy->addr    = phy_addr;
+        phy->ops     = phy_ops;
+        if (mdio_ops) {
+                phy->mdio_read  = mdio_ops->read;
+                phy->mdio_write = mdio_ops->write;
+        }
+}
+
+/* Operations of the PHY-instance factory */
+struct gphy {
+        /* Construct a PHY instance with the given PHY address */
+        struct cphy *(*create)(adapter_t *adapter, int phy_addr,
+                               struct mdio_ops *mdio_ops);
+
+        /*
+         * Reset the PHY chip.  This resets the whole PHY chip, not individual
+         * ports.
+         */
+        int (*reset)(adapter_t *adapter);
+};
+
+extern struct gphy t1_mv88x201x_ops;
+extern struct gphy t1_dummy_phy_ops;
+
+#endif /* _CXGB_CPHY_H_ */
diff --git a/drivers/net/chelsio/cpl5_cmd.h b/drivers/net/chelsio/cpl5_cmd.h
new file mode 100644
index 000000000000..27925e487bcf
--- /dev/null
+++ b/drivers/net/chelsio/cpl5_cmd.h
@@ -0,0 +1,145 @@
+/*****************************************************************************
+ *                                                                           *
+ * File: cpl5_cmd.h                                                          *
+ * $Revision: 1.6 $                                                          *
+ * $Date: 2005/06/21 18:29:47 $                                              *
+ * Description:                                                              *
+ *  part of the Chelsio 10Gb Ethernet Driver.                                *
+ *                                                                           *
+ * This program is free software; you can redistribute it and/or modify      *
+ * it under the terms of the GNU General Public License, version 2, as       *
+ * published by the Free Software Foundation.                                *
+ *                                                                           *
+ * You should have received a copy of the GNU General Public License along   *
+ * with this program; if not, write to the Free Software Foundation, Inc.,   *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
+ *                                                                           *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
+ *                                                                           *
+ * http://www.chelsio.com                                                    *
+ *                                                                           *
+ * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
+ * All rights reserved.                                                      *
+ *                                                                           *
+ * Maintainers: maintainers@chelsio.com                                      *
+ *                                                                           *
+ * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
+ *          Tina Yang               <tainay@chelsio.com>                     *
+ *          Felix Marti             <felix@chelsio.com>                      *
+ *          Scott Bardone           <sbardone@chelsio.com>                   *
+ *          Kurt Ottaway            <kottaway@chelsio.com>                   *
+ *          Frank DiMambro          <frank@chelsio.com>                      *
+ *                                                                           *
+ * History:                                                                  *
+ *                                                                           *
+ ****************************************************************************/
+
+#ifndef _CXGB_CPL5_CMD_H_
+#define _CXGB_CPL5_CMD_H_
+
+#include <asm/byteorder.h>
+
+#if !defined(__LITTLE_ENDIAN_BITFIELD) && !defined(__BIG_ENDIAN_BITFIELD)
+#error "Adjust your <asm/byteorder.h> defines"
+#endif
+
+enum CPL_opcode {
+        CPL_RX_PKT            = 0xAD,
+        CPL_TX_PKT            = 0xB2,
+        CPL_TX_PKT_LSO        = 0xB6,
+};
+
+enum {                /* TX_PKT_LSO ethernet types */
+        CPL_ETH_II,
+        CPL_ETH_II_VLAN,
+        CPL_ETH_802_3,
+        CPL_ETH_802_3_VLAN
+};
+
+struct cpl_rx_data {
+        u32 rsvd0;
+        u32 len;
+        u32 seq;
+        u16 urg;
+        u8  rsvd1;
+        u8  status;
+};
+
+/*
+ * We want this header's alignment to be no more stringent than 2-byte aligned.
+ * All fields are u8 or u16 except for the length.  However that field is not
+ * used so we break it into 2 16-bit parts to easily meet our alignment needs.
+ */
+struct cpl_tx_pkt {
+        u8 opcode;
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+        u8 iff:4;
+        u8 ip_csum_dis:1;
+        u8 l4_csum_dis:1;
+        u8 vlan_valid:1;
+        u8 rsvd:1;
+#else
+        u8 rsvd:1;
+        u8 vlan_valid:1;
+        u8 l4_csum_dis:1;
+        u8 ip_csum_dis:1;
+        u8 iff:4;
+#endif
+        u16 vlan;
+        u16 len_hi;
+        u16 len_lo;
+};
+
+struct cpl_tx_pkt_lso {
+        u8 opcode;
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+        u8 iff:4;
+        u8 ip_csum_dis:1;
+        u8 l4_csum_dis:1;
+        u8 vlan_valid:1;
+        u8 rsvd:1;
+#else
+        u8 rsvd:1;
+        u8 vlan_valid:1;
+        u8 l4_csum_dis:1;
+        u8 ip_csum_dis:1;
+        u8 iff:4;
+#endif
+        u16 vlan;
+        u32 len;
+
+        u32 rsvd2;
+        u8 rsvd3;
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+        u8 tcp_hdr_words:4;
+        u8 ip_hdr_words:4;
+#else
+        u8 ip_hdr_words:4;
+        u8 tcp_hdr_words:4;
+#endif
+        u16 eth_type_mss;
+};
+
+struct cpl_rx_pkt {
+        u8 opcode;
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+        u8 iff:4;
+        u8 csum_valid:1;
+        u8 bad_pkt:1;
+        u8 vlan_valid:1;
+        u8 rsvd:1;
+#else
+        u8 rsvd:1;
+        u8 vlan_valid:1;
+        u8 bad_pkt:1;
+        u8 csum_valid:1;
+        u8 iff:4;
+#endif
+        u16 csum;
+        u16 vlan;
+        u16 len;
+};
+
+#endif /* _CXGB_CPL5_CMD_H_ */
diff --git a/drivers/net/chelsio/cxgb2.c b/drivers/net/chelsio/cxgb2.c
new file mode 100644
index 000000000000..28ae478b386d
--- /dev/null
+++ b/drivers/net/chelsio/cxgb2.c
@@ -0,0 +1,1256 @@
+/*****************************************************************************
+ *                                                                           *
+ * File: cxgb2.c                                                             *
+ * $Revision: 1.25 $                                                         *
+ * $Date: 2005/06/22 00:43:25 $                                              *
+ * Description:                                                              *
+ *  Chelsio 10Gb Ethernet Driver.                                            *
+ *                                                                           *
+ * This program is free software; you can redistribute it and/or modify      *
+ * it under the terms of the GNU General Public License, version 2, as       *
+ * published by the Free Software Foundation.                                *
+ *                                                                           *
+ * You should have received a copy of the GNU General Public License along   *
+ * with this program; if not, write to the Free Software Foundation, Inc.,   *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
+ *                                                                           *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
+ *                                                                           *
+ * http://www.chelsio.com                                                    *
+ *                                                                           *
+ * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
+ * All rights reserved.                                                      *
+ *                                                                           *
+ * Maintainers: maintainers@chelsio.com                                      *
+ *                                                                           *
+ * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
+ *          Tina Yang               <tainay@chelsio.com>                     *
+ *          Felix Marti             <felix@chelsio.com>                      *
+ *          Scott Bardone           <sbardone@chelsio.com>                   *
+ *          Kurt Ottaway            <kottaway@chelsio.com>                   *
+ *          Frank DiMambro          <frank@chelsio.com>                      *
+ *                                                                           *
+ * History:                                                                  *
+ *                                                                           *
+ ****************************************************************************/
+
+#include "common.h"
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/if_vlan.h>
+#include <linux/mii.h>
+#include <linux/sockios.h>
+#include <linux/proc_fs.h>
+#include <linux/dma-mapping.h>
+#include <asm/uaccess.h>
+
+#include "cpl5_cmd.h"
+#include "regs.h"
+#include "gmac.h"
+#include "cphy.h"
+#include "sge.h"
+#include "espi.h"
+
+#ifdef work_struct
+#include <linux/tqueue.h>
+#define INIT_WORK INIT_TQUEUE
+#define schedule_work schedule_task
+#define flush_scheduled_work flush_scheduled_tasks
+
+static inline void schedule_mac_stats_update(struct adapter *ap, int secs)
+{
+        mod_timer(&ap->stats_update_timer, jiffies + secs * HZ);
+}
+
+static inline void cancel_mac_stats_update(struct adapter *ap)
+{
+        del_timer_sync(&ap->stats_update_timer);
+        flush_scheduled_tasks();
+}
+
+/*
+ * Stats update timer for 2.4.  It schedules a task to do the actual update as
+ * we need to access MAC statistics in process context.
+ */
+static void mac_stats_timer(unsigned long data)
+{
+        struct adapter *ap = (struct adapter *)data;
+
+        schedule_task(&ap->stats_update_task);
+}
+#else
+#include <linux/workqueue.h>
+
+static inline void schedule_mac_stats_update(struct adapter *ap, int secs)
+{
+        schedule_delayed_work(&ap->stats_update_task, secs * HZ);
+}
+
+static inline void cancel_mac_stats_update(struct adapter *ap)
+{
+        cancel_delayed_work(&ap->stats_update_task);
+}
+#endif
+
+#define MAX_CMDQ_ENTRIES 16384
+#define MAX_CMDQ1_ENTRIES 1024
+#define MAX_RX_BUFFERS 16384
+#define MAX_RX_JUMBO_BUFFERS 16384
+#define MAX_TX_BUFFERS_HIGH     16384U
+#define MAX_TX_BUFFERS_LOW      1536U
+#define MIN_FL_ENTRIES 32
+
+#define PORT_MASK ((1 << MAX_NPORTS) - 1)
+
+#define DFLT_MSG_ENABLE (NETIF_MSG_DRV | NETIF_MSG_PROBE | NETIF_MSG_LINK | \
+                         NETIF_MSG_TIMER | NETIF_MSG_IFDOWN | NETIF_MSG_IFUP |\
+                         NETIF_MSG_RX_ERR | NETIF_MSG_TX_ERR)
+
+/*
+ * The EEPROM is actually bigger but only the first few bytes are used so we
+ * only report those.
+ */
+#define EEPROM_SIZE 32
+
+MODULE_DESCRIPTION(DRV_DESCRIPTION);
+MODULE_AUTHOR("Chelsio Communications");
+MODULE_LICENSE("GPL");
+
+static int dflt_msg_enable = DFLT_MSG_ENABLE;
+
+MODULE_PARM(dflt_msg_enable, "i");
+MODULE_PARM_DESC(dflt_msg_enable, "Chelsio T1 message enable bitmap");
+
+
+static const char pci_speed[][4] = {
+        "33", "66", "100", "133"
+};
+
+/*
+ * Setup MAC to receive the types of packets we want.
+ */
+static void t1_set_rxmode(struct net_device *dev)
+{
+        struct adapter *adapter = dev->priv;
+        struct cmac *mac = adapter->port[dev->if_port].mac;
+        struct t1_rx_mode rm;
+
+        rm.dev = dev;
+        rm.idx = 0;
+        rm.list = dev->mc_list;
+        mac->ops->set_rx_mode(mac, &rm);
+}
+
+static void link_report(struct port_info *p)
+{
+        if (!netif_carrier_ok(p->dev))
+                printk(KERN_INFO "%s: link down\n", p->dev->name);
+        else {
+                const char *s = "10Mbps";
+
+                switch (p->link_config.speed) {
+                        case SPEED_10000: s = "10Gbps"; break;
+                        case SPEED_1000:  s = "1000Mbps"; break;
+                        case SPEED_100:   s = "100Mbps"; break;
+                }
+
+        printk(KERN_INFO "%s: link up, %s, %s-duplex\n",
+                       p->dev->name, s,
+                       p->link_config.duplex == DUPLEX_FULL ? "full" : "half");
+        }
+}
+
+void t1_link_changed(struct adapter *adapter, int port_id, int link_stat,
+                        int speed, int duplex, int pause)
+{
+        struct port_info *p = &adapter->port[port_id];
+
+        if (link_stat != netif_carrier_ok(p->dev)) {
+                if (link_stat)
+                        netif_carrier_on(p->dev);
+                else
+                        netif_carrier_off(p->dev);
+                link_report(p);
+
+        }
+}
+
+static void link_start(struct port_info *p)
+{
+        struct cmac *mac = p->mac;
+
+        mac->ops->reset(mac);
+        if (mac->ops->macaddress_set)
+                mac->ops->macaddress_set(mac, p->dev->dev_addr);
+        t1_set_rxmode(p->dev);
+        t1_link_start(p->phy, mac, &p->link_config);
+        mac->ops->enable(mac, MAC_DIRECTION_RX | MAC_DIRECTION_TX);
+}
+
+static void enable_hw_csum(struct adapter *adapter)
+{
+        if (adapter->flags & TSO_CAPABLE)
+                t1_tp_set_ip_checksum_offload(adapter, 1); /* for TSO only */
+        t1_tp_set_tcp_checksum_offload(adapter, 1);
+}
+
+/*
+ * Things to do upon first use of a card.
+ * This must run with the rtnl lock held.
+ */
+static int cxgb_up(struct adapter *adapter)
+{
+        int err = 0;
+
+        if (!(adapter->flags & FULL_INIT_DONE)) {
+                err = t1_init_hw_modules(adapter);
+                if (err)
+                        goto out_err;
+
+                enable_hw_csum(adapter);
+                adapter->flags |= FULL_INIT_DONE;
+        }
+
+        t1_interrupts_clear(adapter);
+        if ((err = request_irq(adapter->pdev->irq,
+                               t1_select_intr_handler(adapter), SA_SHIRQ,
+                               adapter->name, adapter))) {
+                goto out_err;
+        }
+        t1_sge_start(adapter->sge);
+        t1_interrupts_enable(adapter);
+ out_err:
+        return err;
+}
+
+/*
+ * Release resources when all the ports have been stopped.
+ */
+static void cxgb_down(struct adapter *adapter)
+{
+        t1_sge_stop(adapter->sge);
+        t1_interrupts_disable(adapter);
+        free_irq(adapter->pdev->irq, adapter);
+}
+
+static int cxgb_open(struct net_device *dev)
+{
+        int err;
+        struct adapter *adapter = dev->priv;
+        int other_ports = adapter->open_device_map & PORT_MASK;
+
+        if (!adapter->open_device_map && (err = cxgb_up(adapter)) < 0)
+                return err;
+
+        __set_bit(dev->if_port, &adapter->open_device_map);
+        link_start(&adapter->port[dev->if_port]);
+        netif_start_queue(dev);
+        if (!other_ports && adapter->params.stats_update_period)
+                schedule_mac_stats_update(adapter,
+                                          adapter->params.stats_update_period);
+        return 0;
+}
+
+static int cxgb_close(struct net_device *dev)
+{
+        struct adapter *adapter = dev->priv;
+        struct port_info *p = &adapter->port[dev->if_port];
+        struct cmac *mac = p->mac;
+
+        netif_stop_queue(dev);
+        mac->ops->disable(mac, MAC_DIRECTION_TX | MAC_DIRECTION_RX);
+        netif_carrier_off(dev);
+
+        clear_bit(dev->if_port, &adapter->open_device_map);
+        if (adapter->params.stats_update_period &&
+            !(adapter->open_device_map & PORT_MASK)) {
+                /* Stop statistics accumulation. */
+                smp_mb__after_clear_bit();
+                spin_lock(&adapter->work_lock);   /* sync with update task */
+                spin_unlock(&adapter->work_lock);
+                cancel_mac_stats_update(adapter);
+        }
+
+        if (!adapter->open_device_map)
+                cxgb_down(adapter);
+        return 0;
+}
+
+static struct net_device_stats *t1_get_stats(struct net_device *dev)
+{
+        struct adapter *adapter = dev->priv;
+        struct port_info *p = &adapter->port[dev->if_port];
+        struct net_device_stats *ns = &p->netstats;
+        const struct cmac_statistics *pstats;
+
+        /* Do a full update of the MAC stats */
+        pstats = p->mac->ops->statistics_update(p->mac,
+                                                      MAC_STATS_UPDATE_FULL);
+
+        ns->tx_packets = pstats->TxUnicastFramesOK +
+                pstats->TxMulticastFramesOK + pstats->TxBroadcastFramesOK;
+
+        ns->rx_packets = pstats->RxUnicastFramesOK +
+                pstats->RxMulticastFramesOK + pstats->RxBroadcastFramesOK;
+
+        ns->tx_bytes = pstats->TxOctetsOK;
+        ns->rx_bytes = pstats->RxOctetsOK;
+
+        ns->tx_errors = pstats->TxLateCollisions + pstats->TxLengthErrors +
+                pstats->TxUnderrun + pstats->TxFramesAbortedDueToXSCollisions;
+        ns->rx_errors = pstats->RxDataErrors + pstats->RxJabberErrors +
+                pstats->RxFCSErrors + pstats->RxAlignErrors +
+                pstats->RxSequenceErrors + pstats->RxFrameTooLongErrors +
+                pstats->RxSymbolErrors + pstats->RxRuntErrors;
+
+        ns->multicast  = pstats->RxMulticastFramesOK;
+        ns->collisions = pstats->TxTotalCollisions;
+
+        /* detailed rx_errors */
+        ns->rx_length_errors = pstats->RxFrameTooLongErrors +
+                pstats->RxJabberErrors;
+        ns->rx_over_errors   = 0;
+        ns->rx_crc_errors    = pstats->RxFCSErrors;
+        ns->rx_frame_errors  = pstats->RxAlignErrors;
+        ns->rx_fifo_errors   = 0;
+        ns->rx_missed_errors = 0;
+
+        /* detailed tx_errors */
+        ns->tx_aborted_errors   = pstats->TxFramesAbortedDueToXSCollisions;
+        ns->tx_carrier_errors   = 0;
+        ns->tx_fifo_errors      = pstats->TxUnderrun;
+        ns->tx_heartbeat_errors = 0;
+        ns->tx_window_errors    = pstats->TxLateCollisions;
+        return ns;
+}
+
+static u32 get_msglevel(struct net_device *dev)
+{
+        struct adapter *adapter = dev->priv;
+
+        return adapter->msg_enable;
+}
+
+static void set_msglevel(struct net_device *dev, u32 val)
+{
+        struct adapter *adapter = dev->priv;
+
+        adapter->msg_enable = val;
+}
+
+static char stats_strings[][ETH_GSTRING_LEN] = {
+        "TxOctetsOK",
+        "TxOctetsBad",
+        "TxUnicastFramesOK",
+        "TxMulticastFramesOK",
+        "TxBroadcastFramesOK",
+        "TxPauseFrames",
+        "TxFramesWithDeferredXmissions",
+        "TxLateCollisions",
+        "TxTotalCollisions",
+        "TxFramesAbortedDueToXSCollisions",
+        "TxUnderrun",
+        "TxLengthErrors",
+        "TxInternalMACXmitError",
+        "TxFramesWithExcessiveDeferral",
+        "TxFCSErrors",
+
+        "RxOctetsOK",
+        "RxOctetsBad",
+        "RxUnicastFramesOK",
+        "RxMulticastFramesOK",
+        "RxBroadcastFramesOK",
+        "RxPauseFrames",
+        "RxFCSErrors",
+        "RxAlignErrors",
+        "RxSymbolErrors",
+        "RxDataErrors",
+        "RxSequenceErrors",
+        "RxRuntErrors",
+        "RxJabberErrors",
+        "RxInternalMACRcvError",
+        "RxInRangeLengthErrors",
+        "RxOutOfRangeLengthField",
+        "RxFrameTooLongErrors",
+
+        "TSO",
+        "VLANextractions",
+        "VLANinsertions",
+        "RxCsumGood",
+        "TxCsumOffload",
+        "RxDrops"
+
+        "respQ_empty",
+        "respQ_overflow",
+        "freelistQ_empty",
+        "pkt_too_big",
+        "pkt_mismatch",
+        "cmdQ_full0",
+        "cmdQ_full1",
+        "tx_ipfrags",
+        "tx_reg_pkts",
+        "tx_lso_pkts",
+        "tx_do_cksum",
+        
+        "espi_DIP2ParityErr",
+        "espi_DIP4Err",
+        "espi_RxDrops",
+        "espi_TxDrops",
+        "espi_RxOvfl",
+        "espi_ParityErr"
+};
+ 
+#define T2_REGMAP_SIZE (3 * 1024)
+
+static int get_regs_len(struct net_device *dev)
+{
+        return T2_REGMAP_SIZE;
+}
+
+static void get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
+{
+        struct adapter *adapter = dev->priv;
+
+        strcpy(info->driver, DRV_NAME);
+        strcpy(info->version, DRV_VERSION);
+        strcpy(info->fw_version, "N/A");
+        strcpy(info->bus_info, pci_name(adapter->pdev));
+}
+
+static int get_stats_count(struct net_device *dev)
+{
+        return ARRAY_SIZE(stats_strings);
+}
+
+static void get_strings(struct net_device *dev, u32 stringset, u8 *data)
+{
+        if (stringset == ETH_SS_STATS)
+                memcpy(data, stats_strings, sizeof(stats_strings));
+}
+
+static void get_stats(struct net_device *dev, struct ethtool_stats *stats,
+                      u64 *data)
+{
+        struct adapter *adapter = dev->priv;
+        struct cmac *mac = adapter->port[dev->if_port].mac;
+        const struct cmac_statistics *s;
+        const struct sge_port_stats *ss;
+        const struct sge_intr_counts *t;
+
+        s = mac->ops->statistics_update(mac, MAC_STATS_UPDATE_FULL);
+        ss = t1_sge_get_port_stats(adapter->sge, dev->if_port);
+        t = t1_sge_get_intr_counts(adapter->sge);
+
+        *data++ = s->TxOctetsOK;
+        *data++ = s->TxOctetsBad;
+        *data++ = s->TxUnicastFramesOK;
+        *data++ = s->TxMulticastFramesOK;
+        *data++ = s->TxBroadcastFramesOK;
+        *data++ = s->TxPauseFrames;
+        *data++ = s->TxFramesWithDeferredXmissions;
+        *data++ = s->TxLateCollisions;
+        *data++ = s->TxTotalCollisions;
+        *data++ = s->TxFramesAbortedDueToXSCollisions;
+        *data++ = s->TxUnderrun;
+        *data++ = s->TxLengthErrors;
+        *data++ = s->TxInternalMACXmitError;
+        *data++ = s->TxFramesWithExcessiveDeferral;
+        *data++ = s->TxFCSErrors;
+
+        *data++ = s->RxOctetsOK;
+        *data++ = s->RxOctetsBad;
+        *data++ = s->RxUnicastFramesOK;
+        *data++ = s->RxMulticastFramesOK;
+        *data++ = s->RxBroadcastFramesOK;
+        *data++ = s->RxPauseFrames;
+        *data++ = s->RxFCSErrors;
+        *data++ = s->RxAlignErrors;
+        *data++ = s->RxSymbolErrors;
+        *data++ = s->RxDataErrors;
+        *data++ = s->RxSequenceErrors;
+        *data++ = s->RxRuntErrors;
+        *data++ = s->RxJabberErrors;
+        *data++ = s->RxInternalMACRcvError;
+        *data++ = s->RxInRangeLengthErrors;
+        *data++ = s->RxOutOfRangeLengthField;
+        *data++ = s->RxFrameTooLongErrors;
+
+        *data++ = ss->tso;
+        *data++ = ss->vlan_xtract;
+        *data++ = ss->vlan_insert;
+        *data++ = ss->rx_cso_good;
+        *data++ = ss->tx_cso;
+        *data++ = ss->rx_drops;
+
+        *data++ = (u64)t->respQ_empty;
+        *data++ = (u64)t->respQ_overflow;
+        *data++ = (u64)t->freelistQ_empty;
+        *data++ = (u64)t->pkt_too_big;
+        *data++ = (u64)t->pkt_mismatch;
+        *data++ = (u64)t->cmdQ_full[0];
+        *data++ = (u64)t->cmdQ_full[1];
+        *data++ = (u64)t->tx_ipfrags;
+        *data++ = (u64)t->tx_reg_pkts;
+        *data++ = (u64)t->tx_lso_pkts;
+        *data++ = (u64)t->tx_do_cksum;
+}
+
+static inline void reg_block_dump(struct adapter *ap, void *buf,
+                                  unsigned int start, unsigned int end)
+{
+        u32 *p = buf + start;
+
+        for ( ; start <= end; start += sizeof(u32))
+                *p++ = readl(ap->regs + start);
+}
+
+static void get_regs(struct net_device *dev, struct ethtool_regs *regs,
+                     void *buf)
+{
+        struct adapter *ap = dev->priv;
+
+        /*
+         * Version scheme: bits 0..9: chip version, bits 10..15: chip revision
+         */
+        regs->version = 2;
+
+        memset(buf, 0, T2_REGMAP_SIZE);
+        reg_block_dump(ap, buf, 0, A_SG_RESPACCUTIMER);
+}
+
+static int get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct adapter *adapter = dev->priv;
+        struct port_info *p = &adapter->port[dev->if_port];
+
+        cmd->supported = p->link_config.supported;
+        cmd->advertising = p->link_config.advertising;
+
+        if (netif_carrier_ok(dev)) {
+                cmd->speed = p->link_config.speed;
+                cmd->duplex = p->link_config.duplex;
+        } else {
+                cmd->speed = -1;
+                cmd->duplex = -1;
+        }
+
+        cmd->port = (cmd->supported & SUPPORTED_TP) ? PORT_TP : PORT_FIBRE;
+        cmd->phy_address = p->phy->addr;
+        cmd->transceiver = XCVR_EXTERNAL;
+        cmd->autoneg = p->link_config.autoneg;
+        cmd->maxtxpkt = 0;
+        cmd->maxrxpkt = 0;
+        return 0;
+}
+
+static int speed_duplex_to_caps(int speed, int duplex)
+{
+        int cap = 0;
+
+        switch (speed) {
+        case SPEED_10:
+                if (duplex == DUPLEX_FULL)
+                        cap = SUPPORTED_10baseT_Full;
+                else
+                        cap = SUPPORTED_10baseT_Half;
+                break;
+        case SPEED_100:
+                if (duplex == DUPLEX_FULL)
+                        cap = SUPPORTED_100baseT_Full;
+                else
+                        cap = SUPPORTED_100baseT_Half;
+                break;
+        case SPEED_1000:
+                if (duplex == DUPLEX_FULL)
+                        cap = SUPPORTED_1000baseT_Full;
+                else
+                        cap = SUPPORTED_1000baseT_Half;
+                break;
+        case SPEED_10000:
+                if (duplex == DUPLEX_FULL)
+                        cap = SUPPORTED_10000baseT_Full;
+        }
+        return cap;
+}
+
+#define ADVERTISED_MASK (ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full | \
+                      ADVERTISED_100baseT_Half | ADVERTISED_100baseT_Full | \
+                      ADVERTISED_1000baseT_Half | ADVERTISED_1000baseT_Full | \
+                      ADVERTISED_10000baseT_Full)
+
+static int set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct adapter *adapter = dev->priv;
+        struct port_info *p = &adapter->port[dev->if_port];
+        struct link_config *lc = &p->link_config;
+
+        if (!(lc->supported & SUPPORTED_Autoneg))
+                return -EOPNOTSUPP;             /* can't change speed/duplex */
+
+        if (cmd->autoneg == AUTONEG_DISABLE) {
+                int cap = speed_duplex_to_caps(cmd->speed, cmd->duplex);
+
+                if (!(lc->supported & cap) || cmd->speed == SPEED_1000)
+                        return -EINVAL;
+                lc->requested_speed = cmd->speed;
+                lc->requested_duplex = cmd->duplex;
+                lc->advertising = 0;
+        } else {
+                cmd->advertising &= ADVERTISED_MASK;
+                if (cmd->advertising & (cmd->advertising - 1))
+                        cmd->advertising = lc->supported;
+                cmd->advertising &= lc->supported;
+                if (!cmd->advertising)
+                        return -EINVAL;
+                lc->requested_speed = SPEED_INVALID;
+                lc->requested_duplex = DUPLEX_INVALID;
+                lc->advertising = cmd->advertising | ADVERTISED_Autoneg;
+        }
+        lc->autoneg = cmd->autoneg;
+        if (netif_running(dev))
+                t1_link_start(p->phy, p->mac, lc);
+        return 0;
+}
+
+static void get_pauseparam(struct net_device *dev,
+                           struct ethtool_pauseparam *epause)
+{
+        struct adapter *adapter = dev->priv;
+        struct port_info *p = &adapter->port[dev->if_port];
+
+        epause->autoneg = (p->link_config.requested_fc & PAUSE_AUTONEG) != 0;
+        epause->rx_pause = (p->link_config.fc & PAUSE_RX) != 0;
+        epause->tx_pause = (p->link_config.fc & PAUSE_TX) != 0;
+}
+
+static int set_pauseparam(struct net_device *dev,
+                          struct ethtool_pauseparam *epause)
+{
+        struct adapter *adapter = dev->priv;
+        struct port_info *p = &adapter->port[dev->if_port];
+        struct link_config *lc = &p->link_config;
+
+        if (epause->autoneg == AUTONEG_DISABLE)
+                lc->requested_fc = 0;
+        else if (lc->supported & SUPPORTED_Autoneg)
+                lc->requested_fc = PAUSE_AUTONEG;
+        else
+                return -EINVAL;
+
+        if (epause->rx_pause)
+                lc->requested_fc |= PAUSE_RX;
+        if (epause->tx_pause)
+                lc->requested_fc |= PAUSE_TX;
+        if (lc->autoneg == AUTONEG_ENABLE) {
+                if (netif_running(dev))
+                        t1_link_start(p->phy, p->mac, lc);
+        } else {
+                lc->fc = lc->requested_fc & (PAUSE_RX | PAUSE_TX);
+                if (netif_running(dev))
+                        p->mac->ops->set_speed_duplex_fc(p->mac, -1, -1,
+                                                         lc->fc);
+        }
+        return 0;
+}
+
+static u32 get_rx_csum(struct net_device *dev)
+{
+        struct adapter *adapter = dev->priv;
+
+        return (adapter->flags & RX_CSUM_ENABLED) != 0;
+}
+
+static int set_rx_csum(struct net_device *dev, u32 data)
+{
+        struct adapter *adapter = dev->priv;
+
+        if (data)
+                adapter->flags |= RX_CSUM_ENABLED;
+        else
+                adapter->flags &= ~RX_CSUM_ENABLED;
+        return 0;
+}
+
+static int set_tso(struct net_device *dev, u32 value)
+{
+        struct adapter *adapter = dev->priv;
+
+        if (!(adapter->flags & TSO_CAPABLE))
+                return value ? -EOPNOTSUPP : 0;
+        return ethtool_op_set_tso(dev, value);
+}
+
+static void get_sge_param(struct net_device *dev, struct ethtool_ringparam *e)
+{
+        struct adapter *adapter = dev->priv;
+        int jumbo_fl = t1_is_T1B(adapter) ? 1 : 0;
+
+        e->rx_max_pending = MAX_RX_BUFFERS;
+        e->rx_mini_max_pending = 0;
+        e->rx_jumbo_max_pending = MAX_RX_JUMBO_BUFFERS;
+        e->tx_max_pending = MAX_CMDQ_ENTRIES;
+
+        e->rx_pending = adapter->params.sge.freelQ_size[!jumbo_fl];
+        e->rx_mini_pending = 0;
+        e->rx_jumbo_pending = adapter->params.sge.freelQ_size[jumbo_fl];
+        e->tx_pending = adapter->params.sge.cmdQ_size[0];
+}
+
+static int set_sge_param(struct net_device *dev, struct ethtool_ringparam *e)
+{
+        struct adapter *adapter = dev->priv;
+        int jumbo_fl = t1_is_T1B(adapter) ? 1 : 0;
+
+        if (e->rx_pending > MAX_RX_BUFFERS || e->rx_mini_pending ||
+            e->rx_jumbo_pending > MAX_RX_JUMBO_BUFFERS ||
+            e->tx_pending > MAX_CMDQ_ENTRIES ||
+            e->rx_pending < MIN_FL_ENTRIES ||
+            e->rx_jumbo_pending < MIN_FL_ENTRIES ||
+            e->tx_pending < (adapter->params.nports + 1) * (MAX_SKB_FRAGS + 1))
+                return -EINVAL;
+
+        if (adapter->flags & FULL_INIT_DONE)
+        return -EBUSY;
+
+        adapter->params.sge.freelQ_size[!jumbo_fl] = e->rx_pending;
+        adapter->params.sge.freelQ_size[jumbo_fl] = e->rx_jumbo_pending;
+        adapter->params.sge.cmdQ_size[0] = e->tx_pending;
+        adapter->params.sge.cmdQ_size[1] = e->tx_pending > MAX_CMDQ1_ENTRIES ?
+                MAX_CMDQ1_ENTRIES : e->tx_pending;
+        return 0;
+}
+
+static int set_coalesce(struct net_device *dev, struct ethtool_coalesce *c)
+{
+        struct adapter *adapter = dev->priv;
+
+        /*
+         * If RX coalescing is requested we use NAPI, otherwise interrupts.
+         * This choice can be made only when all ports and the TOE are off.
+         */
+        if (adapter->open_device_map == 0)
+                adapter->params.sge.polling = c->use_adaptive_rx_coalesce;
+
+        if (adapter->params.sge.polling) {
+                adapter->params.sge.rx_coalesce_usecs = 0;
+        } else {
+                adapter->params.sge.rx_coalesce_usecs = c->rx_coalesce_usecs;
+        }
+        adapter->params.sge.coalesce_enable = c->use_adaptive_rx_coalesce;
+        adapter->params.sge.sample_interval_usecs = c->rate_sample_interval;
+        t1_sge_set_coalesce_params(adapter->sge, &adapter->params.sge);
+        return 0;
+}
+
+static int get_coalesce(struct net_device *dev, struct ethtool_coalesce *c)
+{
+        struct adapter *adapter = dev->priv;
+
+        c->rx_coalesce_usecs = adapter->params.sge.rx_coalesce_usecs;
+        c->rate_sample_interval = adapter->params.sge.sample_interval_usecs;
+        c->use_adaptive_rx_coalesce = adapter->params.sge.coalesce_enable;
+        return 0;
+}
+
+static int get_eeprom_len(struct net_device *dev)
+{
+    return EEPROM_SIZE;
+}
+
+#define EEPROM_MAGIC(ap) \
+        (PCI_VENDOR_ID_CHELSIO | ((ap)->params.chip_version << 16))
+
+static int get_eeprom(struct net_device *dev, struct ethtool_eeprom *e,
+                      u8 *data)
+{
+        int i;
+        u8 buf[EEPROM_SIZE] __attribute__((aligned(4)));
+        struct adapter *adapter = dev->priv;
+
+        e->magic = EEPROM_MAGIC(adapter);
+        for (i = e->offset & ~3; i < e->offset + e->len; i += sizeof(u32))
+                t1_seeprom_read(adapter, i, (u32 *)&buf[i]);
+        memcpy(data, buf + e->offset, e->len);
+        return 0;
+}
+
+static struct ethtool_ops t1_ethtool_ops = {
+        .get_settings      = get_settings,
+        .set_settings      = set_settings,
+        .get_drvinfo       = get_drvinfo,
+        .get_msglevel      = get_msglevel,
+        .set_msglevel      = set_msglevel,
+        .get_ringparam     = get_sge_param,
+        .set_ringparam     = set_sge_param,
+        .get_coalesce      = get_coalesce,
+        .set_coalesce      = set_coalesce,
+        .get_eeprom_len    = get_eeprom_len,
+        .get_eeprom        = get_eeprom,
+        .get_pauseparam    = get_pauseparam,
+        .set_pauseparam    = set_pauseparam,
+        .get_rx_csum       = get_rx_csum,
+        .set_rx_csum       = set_rx_csum,
+        .get_tx_csum       = ethtool_op_get_tx_csum,
+        .set_tx_csum       = ethtool_op_set_tx_csum,
+        .get_sg            = ethtool_op_get_sg,
+        .set_sg            = ethtool_op_set_sg,
+        .get_link          = ethtool_op_get_link,
+        .get_strings       = get_strings,
+        .get_stats_count   = get_stats_count,
+        .get_ethtool_stats = get_stats,
+        .get_regs_len      = get_regs_len,
+        .get_regs          = get_regs,
+        .get_tso           = ethtool_op_get_tso,
+        .set_tso           = set_tso,
+};
+
+static void cxgb_proc_cleanup(struct adapter *adapter,
+                                        struct proc_dir_entry *dir)
+{
+        const char *name;
+        name = adapter->name;
+        remove_proc_entry(name, dir);
+}
+//#define chtoe_setup_toedev(adapter) NULL
+#define update_mtu_tab(adapter)
+#define write_smt_entry(adapter, idx)
+
+static int t1_ioctl(struct net_device *dev, struct ifreq *req, int cmd)
+{
+        struct adapter *adapter = dev->priv;
+        struct mii_ioctl_data *data = (struct mii_ioctl_data *)&req->ifr_data;
+
+        switch (cmd) {
+        case SIOCGMIIPHY:
+                data->phy_id = adapter->port[dev->if_port].phy->addr;
+                /* FALLTHRU */
+        case SIOCGMIIREG: {
+                struct cphy *phy = adapter->port[dev->if_port].phy;
+                u32 val;
+
+                if (!phy->mdio_read)
+            return -EOPNOTSUPP;
+                phy->mdio_read(adapter, data->phy_id, 0, data->reg_num & 0x1f,
+                               &val);
+                data->val_out = val;
+                break;
+        }
+        case SIOCSMIIREG: {
+                struct cphy *phy = adapter->port[dev->if_port].phy;
+
+                if (!capable(CAP_NET_ADMIN))
+                    return -EPERM;
+                if (!phy->mdio_write)
+            return -EOPNOTSUPP;
+                phy->mdio_write(adapter, data->phy_id, 0, data->reg_num & 0x1f,
+                                data->val_in);
+                break;
+        }
+
+        default:
+                return -EOPNOTSUPP;
+        }
+        return 0;
+}
+
+static int t1_change_mtu(struct net_device *dev, int new_mtu)
+{
+        int ret;
+        struct adapter *adapter = dev->priv;
+        struct cmac *mac = adapter->port[dev->if_port].mac;
+
+        if (!mac->ops->set_mtu)
+        return -EOPNOTSUPP;
+        if (new_mtu < 68)
+        return -EINVAL;
+        if ((ret = mac->ops->set_mtu(mac, new_mtu)))
+                return ret;
+        dev->mtu = new_mtu;
+        return 0;
+}
+
+static int t1_set_mac_addr(struct net_device *dev, void *p)
+{
+        struct adapter *adapter = dev->priv;
+        struct cmac *mac = adapter->port[dev->if_port].mac;
+        struct sockaddr *addr = p;
+
+        if (!mac->ops->macaddress_set)
+                return -EOPNOTSUPP;
+
+        memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
+        mac->ops->macaddress_set(mac, dev->dev_addr);
+        return 0;
+}
+
+#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
+static void vlan_rx_register(struct net_device *dev,
+                                   struct vlan_group *grp)
+{
+        struct adapter *adapter = dev->priv;
+
+        spin_lock_irq(&adapter->async_lock);
+        adapter->vlan_grp = grp;
+        t1_set_vlan_accel(adapter, grp != NULL);
+        spin_unlock_irq(&adapter->async_lock);
+}
+
+static void vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
+{
+        struct adapter *adapter = dev->priv;
+
+        spin_lock_irq(&adapter->async_lock);
+        if (adapter->vlan_grp)
+                adapter->vlan_grp->vlan_devices[vid] = NULL;
+        spin_unlock_irq(&adapter->async_lock);
+}
+#endif
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static void t1_netpoll(struct net_device *dev)
+{
+        unsigned long flags;
+        struct adapter *adapter = dev->priv;
+
+        local_irq_save(flags);
+        t1_select_intr_handler(adapter)(adapter->pdev->irq, adapter, NULL);
+        local_irq_restore(flags);
+}
+#endif
+
+/*
+ * Periodic accumulation of MAC statistics.  This is used only if the MAC
+ * does not have any other way to prevent stats counter overflow.
+ */
+static void mac_stats_task(void *data)
+{
+        int i;
+        struct adapter *adapter = data;
+
+        for_each_port(adapter, i) {
+                struct port_info *p = &adapter->port[i];
+
+                if (netif_running(p->dev))
+                        p->mac->ops->statistics_update(p->mac,
+                                                       MAC_STATS_UPDATE_FAST);
+        }
+
+        /* Schedule the next statistics update if any port is active. */
+        spin_lock(&adapter->work_lock);
+        if (adapter->open_device_map & PORT_MASK)
+                schedule_mac_stats_update(adapter,
+                                          adapter->params.stats_update_period);
+        spin_unlock(&adapter->work_lock);
+}
+
+/*
+ * Processes elmer0 external interrupts in process context.
+ */
+static void ext_intr_task(void *data)
+{
+        struct adapter *adapter = data;
+
+        elmer0_ext_intr_handler(adapter);
+
+        /* Now reenable external interrupts */
+        spin_lock_irq(&adapter->async_lock);
+        adapter->slow_intr_mask |= F_PL_INTR_EXT;
+        writel(F_PL_INTR_EXT, adapter->regs + A_PL_CAUSE);
+        writel(adapter->slow_intr_mask | F_PL_INTR_SGE_DATA,
+                   adapter->regs + A_PL_ENABLE);
+        spin_unlock_irq(&adapter->async_lock);
+}
+
+/*
+ * Interrupt-context handler for elmer0 external interrupts.
+ */
+void t1_elmer0_ext_intr(struct adapter *adapter)
+{
+        /*
+         * Schedule a task to handle external interrupts as we require
+         * a process context.  We disable EXT interrupts in the interim
+         * and let the task reenable them when it's done.
+         */
+        adapter->slow_intr_mask &= ~F_PL_INTR_EXT;
+        writel(adapter->slow_intr_mask | F_PL_INTR_SGE_DATA,
+                   adapter->regs + A_PL_ENABLE);
+        schedule_work(&adapter->ext_intr_handler_task);
+}
+
+void t1_fatal_err(struct adapter *adapter)
+{
+        if (adapter->flags & FULL_INIT_DONE) {
+                t1_sge_stop(adapter->sge);
+                t1_interrupts_disable(adapter);
+        }
+        CH_ALERT("%s: encountered fatal error, operation suspended\n",
+                 adapter->name);
+}
+
+static int __devinit init_one(struct pci_dev *pdev,
+                              const struct pci_device_id *ent)
+{
+        static int version_printed;
+
+        int i, err, pci_using_dac = 0;
+        unsigned long mmio_start, mmio_len;
+        const struct board_info *bi;
+        struct adapter *adapter = NULL;
+        struct port_info *pi;
+
+        if (!version_printed) {
+                printk(KERN_INFO "%s - version %s\n", DRV_DESCRIPTION,
+                       DRV_VERSION);
+                ++version_printed;
+        }
+
+        err = pci_enable_device(pdev);
+        if (err)
+        return err;
+
+        if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM)) {
+                CH_ERR("%s: cannot find PCI device memory base address\n",
+                       pci_name(pdev));
+                err = -ENODEV;
+                goto out_disable_pdev;
+        }
+
+        if (!pci_set_dma_mask(pdev, DMA_64BIT_MASK)) {
+                pci_using_dac = 1;
+
+                if (pci_set_consistent_dma_mask(pdev, DMA_64BIT_MASK)) {
+                        CH_ERR("%s: unable to obtain 64-bit DMA for"
+                               "consistent allocations\n", pci_name(pdev));
+                        err = -ENODEV;
+                        goto out_disable_pdev;
+                }
+
+        } else if ((err = pci_set_dma_mask(pdev, DMA_32BIT_MASK)) != 0) {
+                CH_ERR("%s: no usable DMA configuration\n", pci_name(pdev));
+                goto out_disable_pdev;
+        }
+
+        err = pci_request_regions(pdev, DRV_NAME);
+        if (err) {
+                CH_ERR("%s: cannot obtain PCI resources\n", pci_name(pdev));
+                goto out_disable_pdev;
+        }
+
+        pci_set_master(pdev);
+
+    mmio_start = pci_resource_start(pdev, 0);
+        mmio_len = pci_resource_len(pdev, 0);
+        bi = t1_get_board_info(ent->driver_data);
+
+        for (i = 0; i < bi->port_number; ++i) {
+                struct net_device *netdev;
+
+                netdev = alloc_etherdev(adapter ? 0 : sizeof(*adapter));
+                if (!netdev) {
+                        err = -ENOMEM;
+                        goto out_free_dev;
+                }
+
+                SET_MODULE_OWNER(netdev);
+                SET_NETDEV_DEV(netdev, &pdev->dev);
+
+                if (!adapter) {
+                        adapter = netdev->priv;
+                        adapter->pdev = pdev;
+                        adapter->port[0].dev = netdev;  /* so we don't leak it */
+
+                        adapter->regs = ioremap(mmio_start, mmio_len);
+                        if (!adapter->regs) {
+                                CH_ERR("%s: cannot map device registers\n",
+                                       pci_name(pdev));
+                                err = -ENOMEM;
+                                goto out_free_dev;
+                        }
+
+                        if (t1_get_board_rev(adapter, bi, &adapter->params)) {
+                                err = -ENODEV;    /* Can't handle this chip rev */
+                                goto out_free_dev;
+                        }
+
+                        adapter->name = pci_name(pdev);
+                        adapter->msg_enable = dflt_msg_enable;
+                        adapter->mmio_len = mmio_len;
+
+                        init_MUTEX(&adapter->mib_mutex);
+                        spin_lock_init(&adapter->tpi_lock);
+                        spin_lock_init(&adapter->work_lock);
+                        spin_lock_init(&adapter->async_lock);
+
+                        INIT_WORK(&adapter->ext_intr_handler_task,
+                                  ext_intr_task, adapter);
+                        INIT_WORK(&adapter->stats_update_task, mac_stats_task,
+                                  adapter);
+#ifdef work_struct
+                        init_timer(&adapter->stats_update_timer);
+                        adapter->stats_update_timer.function = mac_stats_timer;
+                        adapter->stats_update_timer.data =
+                                (unsigned long)adapter;
+#endif
+
+                        pci_set_drvdata(pdev, netdev);
+                }
+
+                pi = &adapter->port[i];
+                pi->dev = netdev;
+                netif_carrier_off(netdev);
+                netdev->irq = pdev->irq;
+                netdev->if_port = i;
+                netdev->mem_start = mmio_start;
+                netdev->mem_end = mmio_start + mmio_len - 1;
+                netdev->priv = adapter;
+                netdev->features |= NETIF_F_SG | NETIF_F_IP_CSUM;
+                netdev->features |= NETIF_F_LLTX;
+
+                adapter->flags |= RX_CSUM_ENABLED | TCP_CSUM_CAPABLE;
+                if (pci_using_dac)
+                        netdev->features |= NETIF_F_HIGHDMA;
+                if (vlan_tso_capable(adapter)) {
+#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
+                        adapter->flags |= VLAN_ACCEL_CAPABLE;
+                        netdev->features |=
+                                NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
+                        netdev->vlan_rx_register = vlan_rx_register;
+                        netdev->vlan_rx_kill_vid = vlan_rx_kill_vid;
+#endif
+                        adapter->flags |= TSO_CAPABLE;
+                        netdev->features |= NETIF_F_TSO;
+                }
+
+                netdev->open = cxgb_open;
+                netdev->stop = cxgb_close;
+                netdev->hard_start_xmit = t1_start_xmit;
+                netdev->hard_header_len += (adapter->flags & TSO_CAPABLE) ?
+                        sizeof(struct cpl_tx_pkt_lso) :
+                        sizeof(struct cpl_tx_pkt);
+                netdev->get_stats = t1_get_stats;
+                netdev->set_multicast_list = t1_set_rxmode;
+                netdev->do_ioctl = t1_ioctl;
+                netdev->change_mtu = t1_change_mtu;
+                netdev->set_mac_address = t1_set_mac_addr;
+#ifdef CONFIG_NET_POLL_CONTROLLER
+                netdev->poll_controller = t1_netpoll;
+#endif
+                netdev->weight = 64;
+
+        SET_ETHTOOL_OPS(netdev, &t1_ethtool_ops);
+        }
+
+        if (t1_init_sw_modules(adapter, bi) < 0) {
+                err = -ENODEV;
+                goto out_free_dev;
+        }
+
+        /*
+         * The card is now ready to go.  If any errors occur during device
+         * registration we do not fail the whole card but rather proceed only
+         * with the ports we manage to register successfully.  However we must
+         * register at least one net device.
+         */
+        for (i = 0; i < bi->port_number; ++i) {
+                err = register_netdev(adapter->port[i].dev);
+                if (err)
+                        CH_WARN("%s: cannot register net device %s, skipping\n",
+                                pci_name(pdev), adapter->port[i].dev->name);
+                else {
+                        /*
+                         * Change the name we use for messages to the name of
+                         * the first successfully registered interface.
+                         */
+                        if (!adapter->registered_device_map)
+                                adapter->name = adapter->port[i].dev->name;
+
+                __set_bit(i, &adapter->registered_device_map);
+                }
+        }
+        if (!adapter->registered_device_map) {
+                CH_ERR("%s: could not register any net devices\n",
+                       pci_name(pdev));
+                goto out_release_adapter_res;
+        }
+
+        printk(KERN_INFO "%s: %s (rev %d), %s %dMHz/%d-bit\n", adapter->name,
+               bi->desc, adapter->params.chip_revision,
+               adapter->params.pci.is_pcix ? "PCIX" : "PCI",
+               adapter->params.pci.speed, adapter->params.pci.width);
+        return 0;
+
+ out_release_adapter_res:
+        t1_free_sw_modules(adapter);
+ out_free_dev:
+        if (adapter) {
+                if (adapter->regs) iounmap(adapter->regs);
+                for (i = bi->port_number - 1; i >= 0; --i)
+                        if (adapter->port[i].dev) {
+                                cxgb_proc_cleanup(adapter, proc_root_driver);
+                                kfree(adapter->port[i].dev);
+                        }
+        }
+        pci_release_regions(pdev);
+ out_disable_pdev:
+        pci_disable_device(pdev);
+        pci_set_drvdata(pdev, NULL);
+        return err;
+}
+
+static inline void t1_sw_reset(struct pci_dev *pdev)
+{
+        pci_write_config_dword(pdev, A_PCICFG_PM_CSR, 3);
+        pci_write_config_dword(pdev, A_PCICFG_PM_CSR, 0);
+}
+
+static void __devexit remove_one(struct pci_dev *pdev)
+{
+        struct net_device *dev = pci_get_drvdata(pdev);
+
+        if (dev) {
+                int i;
+                struct adapter *adapter = dev->priv;
+
+                for_each_port(adapter, i)
+                        if (test_bit(i, &adapter->registered_device_map))
+                                unregister_netdev(adapter->port[i].dev);
+
+                t1_free_sw_modules(adapter);
+                iounmap(adapter->regs);
+                while (--i >= 0)
+                        if (adapter->port[i].dev) {
+                                cxgb_proc_cleanup(adapter, proc_root_driver);
+                                kfree(adapter->port[i].dev);
+                        }
+                pci_release_regions(pdev);
+                pci_disable_device(pdev);
+                pci_set_drvdata(pdev, NULL);
+                t1_sw_reset(pdev);
+        }
+}
+
+static struct pci_driver driver = {
+        .name     = DRV_NAME,
+        .id_table = t1_pci_tbl,
+        .probe    = init_one,
+        .remove   = __devexit_p(remove_one),
+};
+
+static int __init t1_init_module(void)
+{
+        return pci_module_init(&driver);
+}
+
+static void __exit t1_cleanup_module(void)
+{
+        pci_unregister_driver(&driver);
+}
+
+module_init(t1_init_module);
+module_exit(t1_cleanup_module);
diff --git a/drivers/net/chelsio/elmer0.h b/drivers/net/chelsio/elmer0.h
new file mode 100644
index 000000000000..5590cb2dac19
--- /dev/null
+++ b/drivers/net/chelsio/elmer0.h
@@ -0,0 +1,151 @@
+/*****************************************************************************
+ *                                                                           *
+ * File: elmer0.h                                                            *
+ * $Revision: 1.6 $                                                          *
+ * $Date: 2005/06/21 22:49:43 $                                              *
+ * Description:                                                              *
+ *  part of the Chelsio 10Gb Ethernet Driver.                                *
+ *                                                                           *
+ * This program is free software; you can redistribute it and/or modify      *
+ * it under the terms of the GNU General Public License, version 2, as       *
+ * published by the Free Software Foundation.                                *
+ *                                                                           *
+ * You should have received a copy of the GNU General Public License along   *
+ * with this program; if not, write to the Free Software Foundation, Inc.,   *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
+ *                                                                           *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
+ *                                                                           *
+ * http://www.chelsio.com                                                    *
+ *                                                                           *
+ * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
+ * All rights reserved.                                                      *
+ *                                                                           *
+ * Maintainers: maintainers@chelsio.com                                      *
+ *                                                                           *
+ * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
+ *          Tina Yang               <tainay@chelsio.com>                     *
+ *          Felix Marti             <felix@chelsio.com>                      *
+ *          Scott Bardone           <sbardone@chelsio.com>                   *
+ *          Kurt Ottaway            <kottaway@chelsio.com>                   *
+ *          Frank DiMambro          <frank@chelsio.com>                      *
+ *                                                                           *
+ * History:                                                                  *
+ *                                                                           *
+ ****************************************************************************/
+
+#ifndef _CXGB_ELMER0_H_
+#define _CXGB_ELMER0_H_
+
+/* ELMER0 registers */
+#define A_ELMER0_VERSION 0x100000
+#define A_ELMER0_PHY_CFG 0x100004
+#define A_ELMER0_INT_ENABLE 0x100008
+#define A_ELMER0_INT_CAUSE 0x10000c
+#define A_ELMER0_GPI_CFG 0x100010
+#define A_ELMER0_GPI_STAT 0x100014
+#define A_ELMER0_GPO 0x100018
+#define A_ELMER0_PORT0_MI1_CFG 0x400000
+
+#define S_MI1_MDI_ENABLE    0
+#define V_MI1_MDI_ENABLE(x) ((x) << S_MI1_MDI_ENABLE)
+#define F_MI1_MDI_ENABLE    V_MI1_MDI_ENABLE(1U)
+
+#define S_MI1_MDI_INVERT    1
+#define V_MI1_MDI_INVERT(x) ((x) << S_MI1_MDI_INVERT)
+#define F_MI1_MDI_INVERT    V_MI1_MDI_INVERT(1U)
+
+#define S_MI1_PREAMBLE_ENABLE    2
+#define V_MI1_PREAMBLE_ENABLE(x) ((x) << S_MI1_PREAMBLE_ENABLE)
+#define F_MI1_PREAMBLE_ENABLE    V_MI1_PREAMBLE_ENABLE(1U)
+
+#define S_MI1_SOF    3
+#define M_MI1_SOF    0x3
+#define V_MI1_SOF(x) ((x) << S_MI1_SOF)
+#define G_MI1_SOF(x) (((x) >> S_MI1_SOF) & M_MI1_SOF)
+
+#define S_MI1_CLK_DIV    5
+#define M_MI1_CLK_DIV    0xff
+#define V_MI1_CLK_DIV(x) ((x) << S_MI1_CLK_DIV)
+#define G_MI1_CLK_DIV(x) (((x) >> S_MI1_CLK_DIV) & M_MI1_CLK_DIV)
+
+#define A_ELMER0_PORT0_MI1_ADDR 0x400004
+
+#define S_MI1_REG_ADDR    0
+#define M_MI1_REG_ADDR    0x1f
+#define V_MI1_REG_ADDR(x) ((x) << S_MI1_REG_ADDR)
+#define G_MI1_REG_ADDR(x) (((x) >> S_MI1_REG_ADDR) & M_MI1_REG_ADDR)
+
+#define S_MI1_PHY_ADDR    5
+#define M_MI1_PHY_ADDR    0x1f
+#define V_MI1_PHY_ADDR(x) ((x) << S_MI1_PHY_ADDR)
+#define G_MI1_PHY_ADDR(x) (((x) >> S_MI1_PHY_ADDR) & M_MI1_PHY_ADDR)
+
+#define A_ELMER0_PORT0_MI1_DATA 0x400008
+
+#define S_MI1_DATA    0
+#define M_MI1_DATA    0xffff
+#define V_MI1_DATA(x) ((x) << S_MI1_DATA)
+#define G_MI1_DATA(x) (((x) >> S_MI1_DATA) & M_MI1_DATA)
+
+#define A_ELMER0_PORT0_MI1_OP 0x40000c
+
+#define S_MI1_OP    0
+#define M_MI1_OP    0x3
+#define V_MI1_OP(x) ((x) << S_MI1_OP)
+#define G_MI1_OP(x) (((x) >> S_MI1_OP) & M_MI1_OP)
+
+#define S_MI1_ADDR_AUTOINC    2
+#define V_MI1_ADDR_AUTOINC(x) ((x) << S_MI1_ADDR_AUTOINC)
+#define F_MI1_ADDR_AUTOINC    V_MI1_ADDR_AUTOINC(1U)
+
+#define S_MI1_OP_BUSY    31
+#define V_MI1_OP_BUSY(x) ((x) << S_MI1_OP_BUSY)
+#define F_MI1_OP_BUSY    V_MI1_OP_BUSY(1U)
+
+#define A_ELMER0_PORT1_MI1_CFG 0x500000
+#define A_ELMER0_PORT1_MI1_ADDR 0x500004
+#define A_ELMER0_PORT1_MI1_DATA 0x500008
+#define A_ELMER0_PORT1_MI1_OP 0x50000c
+#define A_ELMER0_PORT2_MI1_CFG 0x600000
+#define A_ELMER0_PORT2_MI1_ADDR 0x600004
+#define A_ELMER0_PORT2_MI1_DATA 0x600008
+#define A_ELMER0_PORT2_MI1_OP 0x60000c
+#define A_ELMER0_PORT3_MI1_CFG 0x700000
+#define A_ELMER0_PORT3_MI1_ADDR 0x700004
+#define A_ELMER0_PORT3_MI1_DATA 0x700008
+#define A_ELMER0_PORT3_MI1_OP 0x70000c
+
+/* Simple bit definition for GPI and GP0 registers. */
+#define     ELMER0_GP_BIT0              0x0001
+#define     ELMER0_GP_BIT1              0x0002
+#define     ELMER0_GP_BIT2              0x0004
+#define     ELMER0_GP_BIT3              0x0008
+#define     ELMER0_GP_BIT4              0x0010
+#define     ELMER0_GP_BIT5              0x0020
+#define     ELMER0_GP_BIT6              0x0040
+#define     ELMER0_GP_BIT7              0x0080
+#define     ELMER0_GP_BIT8              0x0100
+#define     ELMER0_GP_BIT9              0x0200
+#define     ELMER0_GP_BIT10             0x0400
+#define     ELMER0_GP_BIT11             0x0800
+#define     ELMER0_GP_BIT12             0x1000
+#define     ELMER0_GP_BIT13             0x2000
+#define     ELMER0_GP_BIT14             0x4000
+#define     ELMER0_GP_BIT15             0x8000
+#define     ELMER0_GP_BIT16             0x10000
+#define     ELMER0_GP_BIT17             0x20000
+#define     ELMER0_GP_BIT18             0x40000
+#define     ELMER0_GP_BIT19             0x80000
+
+#define MI1_OP_DIRECT_WRITE 1
+#define MI1_OP_DIRECT_READ  2
+
+#define MI1_OP_INDIRECT_ADDRESS  0
+#define MI1_OP_INDIRECT_WRITE    1
+#define MI1_OP_INDIRECT_READ_INC 2
+#define MI1_OP_INDIRECT_READ     3
+
+#endif /* _CXGB_ELMER0_H_ */
diff --git a/drivers/net/chelsio/espi.c b/drivers/net/chelsio/espi.c
new file mode 100644
index 000000000000..230642571c92
--- /dev/null
+++ b/drivers/net/chelsio/espi.c
@@ -0,0 +1,346 @@
+/*****************************************************************************
+ *                                                                           *
+ * File: espi.c                                                              *
+ * $Revision: 1.14 $                                                         *
+ * $Date: 2005/05/14 00:59:32 $                                              *
+ * Description:                                                              *
+ *  Ethernet SPI functionality.                                              *
+ *  part of the Chelsio 10Gb Ethernet Driver.                                *
+ *                                                                           *
+ * This program is free software; you can redistribute it and/or modify      *
+ * it under the terms of the GNU General Public License, version 2, as       *
+ * published by the Free Software Foundation.                                *
+ *                                                                           *
+ * You should have received a copy of the GNU General Public License along   *
+ * with this program; if not, write to the Free Software Foundation, Inc.,   *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
+ *                                                                           *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
+ *                                                                           *
+ * http://www.chelsio.com                                                    *
+ *                                                                           *
+ * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
+ * All rights reserved.                                                      *
+ *                                                                           *
+ * Maintainers: maintainers@chelsio.com                                      *
+ *                                                                           *
+ * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
+ *          Tina Yang               <tainay@chelsio.com>                     *
+ *          Felix Marti             <felix@chelsio.com>                      *
+ *          Scott Bardone           <sbardone@chelsio.com>                   *
+ *          Kurt Ottaway            <kottaway@chelsio.com>                   *
+ *          Frank DiMambro          <frank@chelsio.com>                      *
+ *                                                                           *
+ * History:                                                                  *
+ *                                                                           *
+ ****************************************************************************/
+
+#include "common.h"
+#include "regs.h"
+#include "espi.h"
+
+struct peespi {
+        adapter_t *adapter;
+        struct espi_intr_counts intr_cnt;
+        u32 misc_ctrl;
+        spinlock_t lock;
+};
+
+#define ESPI_INTR_MASK (F_DIP4ERR | F_RXDROP | F_TXDROP | F_RXOVERFLOW | \
+                        F_RAMPARITYERR | F_DIP2PARITYERR)
+#define MON_MASK  (V_MONITORED_PORT_NUM(3) | F_MONITORED_DIRECTION \
+                   | F_MONITORED_INTERFACE)
+
+#define TRICN_CNFG 14
+#define TRICN_CMD_READ  0x11
+#define TRICN_CMD_WRITE 0x21
+#define TRICN_CMD_ATTEMPTS 10
+
+static int tricn_write(adapter_t *adapter, int bundle_addr, int module_addr,
+                       int ch_addr, int reg_offset, u32 wr_data)
+{
+        int busy, attempts = TRICN_CMD_ATTEMPTS;
+
+        writel(V_WRITE_DATA(wr_data) |
+               V_REGISTER_OFFSET(reg_offset) |
+               V_CHANNEL_ADDR(ch_addr) | V_MODULE_ADDR(module_addr) |
+               V_BUNDLE_ADDR(bundle_addr) |
+               V_SPI4_COMMAND(TRICN_CMD_WRITE),
+               adapter->regs + A_ESPI_CMD_ADDR);
+        writel(0, adapter->regs + A_ESPI_GOSTAT);
+
+        do {
+                busy = readl(adapter->regs + A_ESPI_GOSTAT) & F_ESPI_CMD_BUSY;
+        } while (busy && --attempts);
+
+        if (busy)
+                CH_ERR("%s: TRICN write timed out\n", adapter->name);
+
+        return busy;
+}
+
+/* 1. Deassert rx_reset_core. */
+/* 2. Program TRICN_CNFG registers. */
+/* 3. Deassert rx_reset_link */
+static int tricn_init(adapter_t *adapter)
+{
+        int     i               = 0;
+        int     sme             = 1;
+        int     stat            = 0;
+        int     timeout         = 0;
+        int     is_ready        = 0;
+        int     dynamic_deskew  = 0;
+
+        if (dynamic_deskew)
+                sme = 0;
+
+
+        /* 1 */
+        timeout=1000;
+        do {
+                stat = readl(adapter->regs + A_ESPI_RX_RESET);
+                is_ready = (stat & 0x4);
+                timeout--;
+                udelay(5);
+        } while (!is_ready || (timeout==0));
+        writel(0x2, adapter->regs + A_ESPI_RX_RESET);
+        if (timeout==0)
+        {
+                CH_ERR("ESPI : ERROR : Timeout tricn_init() \n");
+                t1_fatal_err(adapter);
+        }
+
+        /* 2 */
+        if (sme) {
+                tricn_write(adapter, 0, 0, 0, TRICN_CNFG, 0x81);
+                tricn_write(adapter, 0, 1, 0, TRICN_CNFG, 0x81);
+                tricn_write(adapter, 0, 2, 0, TRICN_CNFG, 0x81);
+        }
+        for (i=1; i<= 8; i++) tricn_write(adapter, 0, 0, i, TRICN_CNFG, 0xf1);
+        for (i=1; i<= 2; i++) tricn_write(adapter, 0, 1, i, TRICN_CNFG, 0xf1);
+        for (i=1; i<= 3; i++) tricn_write(adapter, 0, 2, i, TRICN_CNFG, 0xe1);
+        for (i=4; i<= 4; i++) tricn_write(adapter, 0, 2, i, TRICN_CNFG, 0xf1);
+        for (i=5; i<= 5; i++) tricn_write(adapter, 0, 2, i, TRICN_CNFG, 0xe1);
+        for (i=6; i<= 6; i++) tricn_write(adapter, 0, 2, i, TRICN_CNFG, 0xf1);
+        for (i=7; i<= 7; i++) tricn_write(adapter, 0, 2, i, TRICN_CNFG, 0x80);
+        for (i=8; i<= 8; i++) tricn_write(adapter, 0, 2, i, TRICN_CNFG, 0xf1);
+
+        /* 3 */
+        writel(0x3, adapter->regs + A_ESPI_RX_RESET);
+
+        return 0;
+}
+
+void t1_espi_intr_enable(struct peespi *espi)
+{
+        u32 enable, pl_intr = readl(espi->adapter->regs + A_PL_ENABLE);
+
+        /*
+         * Cannot enable ESPI interrupts on T1B because HW asserts the
+         * interrupt incorrectly, namely the driver gets ESPI interrupts
+         * but no data is actually dropped (can verify this reading the ESPI
+         * drop registers).  Also, once the ESPI interrupt is asserted it
+         * cannot be cleared (HW bug).
+         */
+        enable = t1_is_T1B(espi->adapter) ? 0 : ESPI_INTR_MASK;
+        writel(enable, espi->adapter->regs + A_ESPI_INTR_ENABLE);
+        writel(pl_intr | F_PL_INTR_ESPI, espi->adapter->regs + A_PL_ENABLE);
+}
+
+void t1_espi_intr_clear(struct peespi *espi)
+{
+        writel(0xffffffff, espi->adapter->regs + A_ESPI_INTR_STATUS);
+        writel(F_PL_INTR_ESPI, espi->adapter->regs + A_PL_CAUSE);
+}
+
+void t1_espi_intr_disable(struct peespi *espi)
+{
+        u32 pl_intr = readl(espi->adapter->regs + A_PL_ENABLE);
+
+        writel(0, espi->adapter->regs + A_ESPI_INTR_ENABLE);
+        writel(pl_intr & ~F_PL_INTR_ESPI, espi->adapter->regs + A_PL_ENABLE);
+}
+
+int t1_espi_intr_handler(struct peespi *espi)
+{
+        u32 cnt;
+        u32 status = readl(espi->adapter->regs + A_ESPI_INTR_STATUS);
+
+        if (status & F_DIP4ERR)
+                espi->intr_cnt.DIP4_err++;
+        if (status & F_RXDROP)
+                espi->intr_cnt.rx_drops++;
+        if (status & F_TXDROP)
+                espi->intr_cnt.tx_drops++;
+        if (status & F_RXOVERFLOW)
+                espi->intr_cnt.rx_ovflw++;
+        if (status & F_RAMPARITYERR)
+                espi->intr_cnt.parity_err++;
+        if (status & F_DIP2PARITYERR) {
+                espi->intr_cnt.DIP2_parity_err++;
+
+                /*
+                 * Must read the error count to clear the interrupt
+                 * that it causes.
+                 */
+                cnt = readl(espi->adapter->regs + A_ESPI_DIP2_ERR_COUNT);
+        }
+
+        /*
+         * For T1B we need to write 1 to clear ESPI interrupts.  For T2+ we
+         * write the status as is.
+         */
+        if (status && t1_is_T1B(espi->adapter))
+                status = 1;
+        writel(status, espi->adapter->regs + A_ESPI_INTR_STATUS);
+        return 0;
+}
+
+const struct espi_intr_counts *t1_espi_get_intr_counts(struct peespi *espi)
+{
+    return &espi->intr_cnt;
+}
+
+static void espi_setup_for_pm3393(adapter_t *adapter)
+{
+        u32 wmark = t1_is_T1B(adapter) ? 0x4000 : 0x3200;
+
+        writel(0x1f4, adapter->regs + A_ESPI_SCH_TOKEN0);
+        writel(0x1f4, adapter->regs + A_ESPI_SCH_TOKEN1);
+        writel(0x1f4, adapter->regs + A_ESPI_SCH_TOKEN2);
+        writel(0x1f4, adapter->regs + A_ESPI_SCH_TOKEN3);
+        writel(0x100, adapter->regs + A_ESPI_RX_FIFO_ALMOST_EMPTY_WATERMARK);
+        writel(wmark, adapter->regs + A_ESPI_RX_FIFO_ALMOST_FULL_WATERMARK);
+        writel(3, adapter->regs + A_ESPI_CALENDAR_LENGTH);
+        writel(0x08000008, adapter->regs + A_ESPI_TRAIN);
+        writel(V_RX_NPORTS(1) | V_TX_NPORTS(1), adapter->regs + A_PORT_CONFIG);
+}
+
+/* T2 Init part --  */
+/* 1. Set T_ESPI_MISCCTRL_ADDR */
+/* 2. Init ESPI registers. */
+/* 3. Init TriCN Hard Macro */
+int t1_espi_init(struct peespi *espi, int mac_type, int nports)
+{
+        u32 cnt;
+
+        u32 status_enable_extra = 0;
+        adapter_t *adapter = espi->adapter;
+        u32 status, burstval = 0x800100;
+
+        /* Disable ESPI training.  MACs that can handle it enable it below. */
+        writel(0, adapter->regs + A_ESPI_TRAIN);
+
+        if (is_T2(adapter)) {
+                writel(V_OUT_OF_SYNC_COUNT(4) |
+                       V_DIP2_PARITY_ERR_THRES(3) |
+                       V_DIP4_THRES(1), adapter->regs + A_ESPI_MISC_CONTROL);
+                if (nports == 4) {
+                        /* T204: maxburst1 = 0x40, maxburst2 = 0x20 */
+                        burstval = 0x200040;
+                }
+        }
+        writel(burstval, adapter->regs + A_ESPI_MAXBURST1_MAXBURST2);
+
+        switch (mac_type) {
+        case CHBT_MAC_PM3393:
+                espi_setup_for_pm3393(adapter);
+                break;
+        default:
+                return -1;
+        }
+
+        /*
+         * Make sure any pending interrupts from the SPI are
+         * Cleared before enabling the interrupt.
+         */
+        writel(ESPI_INTR_MASK, espi->adapter->regs + A_ESPI_INTR_ENABLE);
+        status = readl(espi->adapter->regs + A_ESPI_INTR_STATUS);
+        if (status & F_DIP2PARITYERR) {
+                cnt = readl(espi->adapter->regs + A_ESPI_DIP2_ERR_COUNT);
+        }
+
+        /*
+         * For T1B we need to write 1 to clear ESPI interrupts.  For T2+ we
+         * write the status as is.
+         */
+        if (status && t1_is_T1B(espi->adapter))
+                status = 1;
+        writel(status, espi->adapter->regs + A_ESPI_INTR_STATUS);
+
+        writel(status_enable_extra | F_RXSTATUSENABLE,
+               adapter->regs + A_ESPI_FIFO_STATUS_ENABLE);
+
+        if (is_T2(adapter)) {
+                tricn_init(adapter);
+                /*
+                 * Always position the control at the 1st port egress IN
+                 * (sop,eop) counter to reduce PIOs for T/N210 workaround.
+                 */
+                espi->misc_ctrl = (readl(adapter->regs + A_ESPI_MISC_CONTROL)
+                                   & ~MON_MASK) | (F_MONITORED_DIRECTION
+                                   | F_MONITORED_INTERFACE);
+                writel(espi->misc_ctrl, adapter->regs + A_ESPI_MISC_CONTROL);
+                spin_lock_init(&espi->lock);
+        }
+
+        return 0;
+}
+
+void t1_espi_destroy(struct peespi *espi)
+{
+        kfree(espi);
+}
+
+struct peespi *t1_espi_create(adapter_t *adapter)
+{
+        struct peespi *espi = kmalloc(sizeof(*espi), GFP_KERNEL);
+
+        memset(espi, 0, sizeof(*espi));
+
+        if (espi)
+                espi->adapter = adapter;
+        return espi;
+}
+
+void t1_espi_set_misc_ctrl(adapter_t *adapter, u32 val)
+{
+        struct peespi *espi = adapter->espi;
+
+        if (!is_T2(adapter))
+                return;
+        spin_lock(&espi->lock);
+        espi->misc_ctrl = (val & ~MON_MASK) |
+                          (espi->misc_ctrl & MON_MASK);
+        writel(espi->misc_ctrl, adapter->regs + A_ESPI_MISC_CONTROL);
+        spin_unlock(&espi->lock);
+}
+
+u32 t1_espi_get_mon(adapter_t *adapter, u32 addr, u8 wait)
+{
+        u32 sel;
+
+        struct peespi *espi = adapter->espi;
+
+        if (!is_T2(adapter))
+                return 0;
+        sel = V_MONITORED_PORT_NUM((addr & 0x3c) >> 2);
+        if (!wait) {
+                if (!spin_trylock(&espi->lock))
+                        return 0;
+        }
+        else
+                spin_lock(&espi->lock);
+        if ((sel != (espi->misc_ctrl & MON_MASK))) {
+                writel(((espi->misc_ctrl & ~MON_MASK) | sel),
+                       adapter->regs + A_ESPI_MISC_CONTROL);
+                sel = readl(adapter->regs + A_ESPI_SCH_TOKEN3);
+                writel(espi->misc_ctrl, adapter->regs + A_ESPI_MISC_CONTROL);
+        }
+        else
+                sel = readl(adapter->regs + A_ESPI_SCH_TOKEN3);
+        spin_unlock(&espi->lock);
+        return sel;
+}
diff --git a/drivers/net/chelsio/espi.h b/drivers/net/chelsio/espi.h
new file mode 100644
index 000000000000..c90e37f8457c
--- /dev/null
+++ b/drivers/net/chelsio/espi.h
@@ -0,0 +1,68 @@
+/*****************************************************************************
+ *                                                                           *
+ * File: espi.h                                                              *
+ * $Revision: 1.7 $                                                          *
+ * $Date: 2005/06/21 18:29:47 $                                              *
+ * Description:                                                              *
+ *  part of the Chelsio 10Gb Ethernet Driver.                                *
+ *                                                                           *
+ * This program is free software; you can redistribute it and/or modify      *
+ * it under the terms of the GNU General Public License, version 2, as       *
+ * published by the Free Software Foundation.                                *
+ *                                                                           *
+ * You should have received a copy of the GNU General Public License along   *
+ * with this program; if not, write to the Free Software Foundation, Inc.,   *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
+ *                                                                           *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
+ *                                                                           *
+ * http://www.chelsio.com                                                    *
+ *                                                                           *
+ * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
+ * All rights reserved.                                                      *
+ *                                                                           *
+ * Maintainers: maintainers@chelsio.com                                      *
+ *                                                                           *
+ * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
+ *          Tina Yang               <tainay@chelsio.com>                     *
+ *          Felix Marti             <felix@chelsio.com>                      *
+ *          Scott Bardone           <sbardone@chelsio.com>                   *
+ *          Kurt Ottaway            <kottaway@chelsio.com>                   *
+ *          Frank DiMambro          <frank@chelsio.com>                      *
+ *                                                                           *
+ * History:                                                                  *
+ *                                                                           *
+ ****************************************************************************/
+
+#ifndef _CXGB_ESPI_H_
+#define _CXGB_ESPI_H_
+
+#include "common.h"
+
+struct espi_intr_counts {
+        unsigned int DIP4_err;
+        unsigned int rx_drops;
+        unsigned int tx_drops;
+        unsigned int rx_ovflw;
+        unsigned int parity_err;
+        unsigned int DIP2_parity_err;
+};
+
+struct peespi;
+
+struct peespi *t1_espi_create(adapter_t *adapter);
+void t1_espi_destroy(struct peespi *espi);
+int t1_espi_init(struct peespi *espi, int mac_type, int nports);
+
+void t1_espi_intr_enable(struct peespi *);
+void t1_espi_intr_clear(struct peespi *);
+void t1_espi_intr_disable(struct peespi *);
+int t1_espi_intr_handler(struct peespi *);
+const struct espi_intr_counts *t1_espi_get_intr_counts(struct peespi *espi);
+
+void t1_espi_set_misc_ctrl(adapter_t *adapter, u32 val);
+u32 t1_espi_get_mon(adapter_t *adapter, u32 addr, u8 wait);
+
+#endif /* _CXGB_ESPI_H_ */
diff --git a/drivers/net/chelsio/gmac.h b/drivers/net/chelsio/gmac.h
new file mode 100644
index 000000000000..746b0eeea964
--- /dev/null
+++ b/drivers/net/chelsio/gmac.h
@@ -0,0 +1,134 @@
+/*****************************************************************************
+ *                                                                           *
+ * File: gmac.h                                                              *
+ * $Revision: 1.6 $                                                          *
+ * $Date: 2005/06/21 18:29:47 $                                              *
+ * Description:                                                              *
+ *  Generic MAC functionality.                                               *
+ *  part of the Chelsio 10Gb Ethernet Driver.                                *
+ *                                                                           *
+ * This program is free software; you can redistribute it and/or modify      *
+ * it under the terms of the GNU General Public License, version 2, as       *
+ * published by the Free Software Foundation.                                *
+ *                                                                           *
+ * You should have received a copy of the GNU General Public License along   *
+ * with this program; if not, write to the Free Software Foundation, Inc.,   *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
+ *                                                                           *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
+ *                                                                           *
+ * http://www.chelsio.com                                                    *
+ *                                                                           *
+ * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
+ * All rights reserved.                                                      *
+ *                                                                           *
+ * Maintainers: maintainers@chelsio.com                                      *
+ *                                                                           *
+ * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
+ *          Tina Yang               <tainay@chelsio.com>                     *
+ *          Felix Marti             <felix@chelsio.com>                      *
+ *          Scott Bardone           <sbardone@chelsio.com>                   *
+ *          Kurt Ottaway            <kottaway@chelsio.com>                   *
+ *          Frank DiMambro          <frank@chelsio.com>                      *
+ *                                                                           *
+ * History:                                                                  *
+ *                                                                           *
+ ****************************************************************************/
+
+#ifndef _CXGB_GMAC_H_
+#define _CXGB_GMAC_H_
+
+#include "common.h"
+
+enum { MAC_STATS_UPDATE_FAST, MAC_STATS_UPDATE_FULL };
+enum { MAC_DIRECTION_RX = 1, MAC_DIRECTION_TX = 2 };
+
+struct cmac_statistics {
+        /* Transmit */
+        u64 TxOctetsOK;
+        u64 TxOctetsBad;
+        u64 TxUnicastFramesOK;
+        u64 TxMulticastFramesOK;
+        u64 TxBroadcastFramesOK;
+        u64 TxPauseFrames;
+        u64 TxFramesWithDeferredXmissions;
+        u64 TxLateCollisions;
+        u64 TxTotalCollisions;
+        u64 TxFramesAbortedDueToXSCollisions;
+        u64 TxUnderrun;
+        u64 TxLengthErrors;
+        u64 TxInternalMACXmitError;
+        u64 TxFramesWithExcessiveDeferral;
+        u64 TxFCSErrors;
+
+        /* Receive */
+        u64 RxOctetsOK;
+        u64 RxOctetsBad;
+        u64 RxUnicastFramesOK;
+        u64 RxMulticastFramesOK;
+        u64 RxBroadcastFramesOK;
+        u64 RxPauseFrames;
+        u64 RxFCSErrors;
+        u64 RxAlignErrors;
+        u64 RxSymbolErrors;
+        u64 RxDataErrors;
+        u64 RxSequenceErrors;
+        u64 RxRuntErrors;
+        u64 RxJabberErrors;
+        u64 RxInternalMACRcvError;
+        u64 RxInRangeLengthErrors;
+        u64 RxOutOfRangeLengthField;
+        u64 RxFrameTooLongErrors;
+};
+
+struct cmac_ops {
+        void (*destroy)(struct cmac *);
+        int (*reset)(struct cmac *);
+        int (*interrupt_enable)(struct cmac *);
+        int (*interrupt_disable)(struct cmac *);
+        int (*interrupt_clear)(struct cmac *);
+        int (*interrupt_handler)(struct cmac *);
+
+        int (*enable)(struct cmac *, int);
+        int (*disable)(struct cmac *, int);
+
+        int (*loopback_enable)(struct cmac *);
+        int (*loopback_disable)(struct cmac *);
+
+        int (*set_mtu)(struct cmac *, int mtu);
+        int (*set_rx_mode)(struct cmac *, struct t1_rx_mode *rm);
+
+        int (*set_speed_duplex_fc)(struct cmac *, int speed, int duplex, int fc);
+        int (*get_speed_duplex_fc)(struct cmac *, int *speed, int *duplex,
+                                   int *fc);
+
+        const struct cmac_statistics *(*statistics_update)(struct cmac *, int);
+
+        int (*macaddress_get)(struct cmac *, u8 mac_addr[6]);
+        int (*macaddress_set)(struct cmac *, u8 mac_addr[6]);
+};
+
+typedef struct _cmac_instance cmac_instance;
+
+struct cmac {
+        struct cmac_statistics stats;
+        adapter_t *adapter;
+        struct cmac_ops *ops;
+        cmac_instance *instance;
+};
+
+struct gmac {
+        unsigned int stats_update_period;
+        struct cmac *(*create)(adapter_t *adapter, int index);
+        int (*reset)(adapter_t *);
+};
+
+extern struct gmac t1_pm3393_ops;
+extern struct gmac t1_chelsio_mac_ops;
+extern struct gmac t1_vsc7321_ops;
+extern struct gmac t1_ixf1010_ops;
+extern struct gmac t1_dummy_mac_ops;
+
+#endif /* _CXGB_GMAC_H_ */
diff --git a/drivers/net/chelsio/mv88x201x.c b/drivers/net/chelsio/mv88x201x.c
new file mode 100644
index 000000000000..db5034282782
--- /dev/null
+++ b/drivers/net/chelsio/mv88x201x.c
@@ -0,0 +1,252 @@
+/*****************************************************************************
+ *                                                                           *
+ * File: mv88x201x.c                                                         *
+ * $Revision: 1.12 $                                                         *
+ * $Date: 2005/04/15 19:27:14 $                                              *
+ * Description:                                                              *
+ *  Marvell PHY (mv88x201x) functionality.                                   *
+ *  part of the Chelsio 10Gb Ethernet Driver.                                *
+ *                                                                           *
+ * This program is free software; you can redistribute it and/or modify      *
+ * it under the terms of the GNU General Public License, version 2, as       *
+ * published by the Free Software Foundation.                                *
+ *                                                                           *
+ * You should have received a copy of the GNU General Public License along   *
+ * with this program; if not, write to the Free Software Foundation, Inc.,   *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
+ *                                                                           *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
+ *                                                                           *
+ * http://www.chelsio.com                                                    *
+ *                                                                           *
+ * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
+ * All rights reserved.                                                      *
+ *                                                                           *
+ * Maintainers: maintainers@chelsio.com                                      *
+ *                                                                           *
+ * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
+ *          Tina Yang               <tainay@chelsio.com>                     *
+ *          Felix Marti             <felix@chelsio.com>                      *
+ *          Scott Bardone           <sbardone@chelsio.com>                   *
+ *          Kurt Ottaway            <kottaway@chelsio.com>                   *
+ *          Frank DiMambro          <frank@chelsio.com>                      *
+ *                                                                           *
+ * History:                                                                  *
+ *                                                                           *
+ ****************************************************************************/
+
+#include "cphy.h"
+#include "elmer0.h"
+
+/*
+ * The 88x2010 Rev C. requires some link status registers * to be read
+ * twice in order to get the right values. Future * revisions will fix
+ * this problem and then this macro * can disappear.
+ */
+#define MV88x2010_LINK_STATUS_BUGS    1
+
+static int led_init(struct cphy *cphy)
+{
+        /* Setup the LED registers so we can turn on/off.
+         * Writing these bits maps control to another
+         * register. mmd(0x1) addr(0x7)
+         */
+        mdio_write(cphy, 0x3, 0x8304, 0xdddd);
+        return 0;
+}
+
+static int led_link(struct cphy *cphy, u32 do_enable)
+{
+        u32 led = 0;
+#define LINK_ENABLE_BIT 0x1
+
+        mdio_read(cphy, 0x1, 0x7, &led);
+
+        if (do_enable & LINK_ENABLE_BIT) {
+                led |= LINK_ENABLE_BIT;
+                mdio_write(cphy, 0x1, 0x7, led);
+        } else {
+                led &= ~LINK_ENABLE_BIT;
+                mdio_write(cphy, 0x1, 0x7, led);
+        }
+        return 0;
+}
+
+/* Port Reset */
+static int mv88x201x_reset(struct cphy *cphy, int wait)
+{
+        /* This can be done through registers.  It is not required since
+         * a full chip reset is used.
+         */
+        return 0;
+}
+
+static int mv88x201x_interrupt_enable(struct cphy *cphy)
+{
+        u32 elmer;
+
+        /* Enable PHY LASI interrupts. */
+        mdio_write(cphy, 0x1, 0x9002, 0x1);
+
+        /* Enable Marvell interrupts through Elmer0. */
+        t1_tpi_read(cphy->adapter, A_ELMER0_INT_ENABLE, &elmer);
+        elmer |= ELMER0_GP_BIT6;
+        t1_tpi_write(cphy->adapter, A_ELMER0_INT_ENABLE, elmer);
+        return 0;
+}
+
+static int mv88x201x_interrupt_disable(struct cphy *cphy)
+{
+        u32 elmer;
+
+        /* Disable PHY LASI interrupts. */
+        mdio_write(cphy, 0x1, 0x9002, 0x0);
+
+        /* Disable Marvell interrupts through Elmer0. */
+        t1_tpi_read(cphy->adapter, A_ELMER0_INT_ENABLE, &elmer);
+        elmer &= ~ELMER0_GP_BIT6;
+        t1_tpi_write(cphy->adapter, A_ELMER0_INT_ENABLE, elmer);
+        return 0;
+}
+
+static int mv88x201x_interrupt_clear(struct cphy *cphy)
+{
+        u32 elmer;
+        u32 val;
+
+#ifdef MV88x2010_LINK_STATUS_BUGS
+        /* Required to read twice before clear takes affect. */
+        mdio_read(cphy, 0x1, 0x9003, &val);
+        mdio_read(cphy, 0x1, 0x9004, &val);
+        mdio_read(cphy, 0x1, 0x9005, &val);
+
+        /* Read this register after the others above it else
+         * the register doesn't clear correctly.
+         */
+        mdio_read(cphy, 0x1, 0x1, &val);
+#endif
+
+        /* Clear link status. */
+        mdio_read(cphy, 0x1, 0x1, &val);
+        /* Clear PHY LASI interrupts. */
+        mdio_read(cphy, 0x1, 0x9005, &val);
+
+#ifdef MV88x2010_LINK_STATUS_BUGS
+        /* Do it again. */
+        mdio_read(cphy, 0x1, 0x9003, &val);
+        mdio_read(cphy, 0x1, 0x9004, &val);
+#endif
+
+        /* Clear Marvell interrupts through Elmer0. */
+        t1_tpi_read(cphy->adapter, A_ELMER0_INT_CAUSE, &elmer);
+        elmer |= ELMER0_GP_BIT6;
+        t1_tpi_write(cphy->adapter, A_ELMER0_INT_CAUSE, elmer);
+        return 0;
+}
+
+static int mv88x201x_interrupt_handler(struct cphy *cphy)
+{
+        /* Clear interrupts */
+        mv88x201x_interrupt_clear(cphy);
+
+        /* We have only enabled link change interrupts and so
+         * cphy_cause must be a link change interrupt.
+         */
+        return cphy_cause_link_change;
+}
+
+static int mv88x201x_set_loopback(struct cphy *cphy, int on)
+{
+        return 0;
+}
+
+static int mv88x201x_get_link_status(struct cphy *cphy, int *link_ok,
+                                     int *speed, int *duplex, int *fc)
+{
+        u32 val = 0;
+#define LINK_STATUS_BIT 0x4
+
+        if (link_ok) {
+                /* Read link status. */
+                mdio_read(cphy, 0x1, 0x1, &val);
+                val &= LINK_STATUS_BIT;
+                *link_ok = (val == LINK_STATUS_BIT);
+                /* Turn on/off Link LED */
+                led_link(cphy, *link_ok);
+        }
+        if (speed)
+                *speed = SPEED_10000;
+        if (duplex)
+                *duplex = DUPLEX_FULL;
+        if (fc)
+                *fc = PAUSE_RX | PAUSE_TX;
+        return 0;
+}
+
+static void mv88x201x_destroy(struct cphy *cphy)
+{
+        kfree(cphy);
+}
+
+static struct cphy_ops mv88x201x_ops = {
+        .destroy           = mv88x201x_destroy,
+        .reset             = mv88x201x_reset,
+        .interrupt_enable  = mv88x201x_interrupt_enable,
+        .interrupt_disable = mv88x201x_interrupt_disable,
+        .interrupt_clear   = mv88x201x_interrupt_clear,
+        .interrupt_handler = mv88x201x_interrupt_handler,
+        .get_link_status   = mv88x201x_get_link_status,
+        .set_loopback      = mv88x201x_set_loopback,
+};
+
+static struct cphy *mv88x201x_phy_create(adapter_t *adapter, int phy_addr,
+                                         struct mdio_ops *mdio_ops)
+{
+        u32 val;
+        struct cphy *cphy = kmalloc(sizeof(*cphy), GFP_KERNEL);
+
+        if (!cphy)
+                return NULL;
+        memset(cphy, 0, sizeof(*cphy));
+        cphy_init(cphy, adapter, phy_addr, &mv88x201x_ops, mdio_ops);
+
+        /* Commands the PHY to enable XFP's clock. */
+        mdio_read(cphy, 0x3, 0x8300, &val);
+        mdio_write(cphy, 0x3, 0x8300, val | 1);
+
+        /* Clear link status. Required because of a bug in the PHY.  */
+        mdio_read(cphy, 0x1, 0x8, &val);
+        mdio_read(cphy, 0x3, 0x8, &val);
+
+        /* Allows for Link,Ack LED turn on/off */
+        led_init(cphy);
+        return cphy;
+}
+
+/* Chip Reset */
+static int mv88x201x_phy_reset(adapter_t *adapter)
+{
+        u32 val;
+
+        t1_tpi_read(adapter, A_ELMER0_GPO, &val);
+        val &= ~4;
+        t1_tpi_write(adapter, A_ELMER0_GPO, val);
+        msleep(100);
+
+        t1_tpi_write(adapter, A_ELMER0_GPO, val | 4);
+        msleep(1000);
+
+        /* Now lets enable the Laser. Delay 100us */
+        t1_tpi_read(adapter, A_ELMER0_GPO, &val);
+        val |= 0x8000;
+        t1_tpi_write(adapter, A_ELMER0_GPO, val);
+        udelay(100);
+        return 0;
+}
+
+struct gphy t1_mv88x201x_ops = {
+        mv88x201x_phy_create,
+        mv88x201x_phy_reset
+};
diff --git a/drivers/net/chelsio/pm3393.c b/drivers/net/chelsio/pm3393.c
new file mode 100644
index 000000000000..04a1404fc65e
--- /dev/null
+++ b/drivers/net/chelsio/pm3393.c
@@ -0,0 +1,826 @@
+/*****************************************************************************
+ *                                                                           *
+ * File: pm3393.c                                                            *
+ * $Revision: 1.16 $                                                         *
+ * $Date: 2005/05/14 00:59:32 $                                              *
+ * Description:                                                              *
+ *  PMC/SIERRA (pm3393) MAC-PHY functionality.                               *
+ *  part of the Chelsio 10Gb Ethernet Driver.                                *
+ *                                                                           *
+ * This program is free software; you can redistribute it and/or modify      *
+ * it under the terms of the GNU General Public License, version 2, as       *
+ * published by the Free Software Foundation.                                *
+ *                                                                           *
+ * You should have received a copy of the GNU General Public License along   *
+ * with this program; if not, write to the Free Software Foundation, Inc.,   *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
+ *                                                                           *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
+ *                                                                           *
+ * http://www.chelsio.com                                                    *
+ *                                                                           *
+ * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
+ * All rights reserved.                                                      *
+ *                                                                           *
+ * Maintainers: maintainers@chelsio.com                                      *
+ *                                                                           *
+ * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
+ *          Tina Yang               <tainay@chelsio.com>                     *
+ *          Felix Marti             <felix@chelsio.com>                      *
+ *          Scott Bardone           <sbardone@chelsio.com>                   *
+ *          Kurt Ottaway            <kottaway@chelsio.com>                   *
+ *          Frank DiMambro          <frank@chelsio.com>                      *
+ *                                                                           *
+ * History:                                                                  *
+ *                                                                           *
+ ****************************************************************************/
+
+#include "common.h"
+#include "regs.h"
+#include "gmac.h"
+#include "elmer0.h"
+#include "suni1x10gexp_regs.h"
+
+/* 802.3ae 10Gb/s MDIO Manageable Device(MMD)
+ */
+enum {
+    MMD_RESERVED,
+    MMD_PMAPMD,
+    MMD_WIS,
+    MMD_PCS,
+    MMD_PHY_XGXS,       /* XGMII Extender Sublayer */
+    MMD_DTE_XGXS,
+};
+
+enum {
+    PHY_XGXS_CTRL_1,
+    PHY_XGXS_STATUS_1
+};
+
+#define OFFSET(REG_ADDR)    (REG_ADDR << 2)
+
+/* Max frame size PM3393 can handle. Includes Ethernet header and CRC. */
+#define MAX_FRAME_SIZE  9600
+
+#define IPG 12
+#define TXXG_CONF1_VAL ((IPG << SUNI1x10GEXP_BITOFF_TXXG_IPGT) | \
+        SUNI1x10GEXP_BITMSK_TXXG_32BIT_ALIGN | SUNI1x10GEXP_BITMSK_TXXG_CRCEN | \
+        SUNI1x10GEXP_BITMSK_TXXG_PADEN)
+#define RXXG_CONF1_VAL (SUNI1x10GEXP_BITMSK_RXXG_PUREP | 0x14 | \
+        SUNI1x10GEXP_BITMSK_RXXG_FLCHK | SUNI1x10GEXP_BITMSK_RXXG_CRC_STRIP)
+
+/* Update statistics every 15 minutes */
+#define STATS_TICK_SECS (15 * 60)
+
+enum {                     /* RMON registers */
+        RxOctetsReceivedOK = SUNI1x10GEXP_REG_MSTAT_COUNTER_1_LOW,
+        RxUnicastFramesReceivedOK = SUNI1x10GEXP_REG_MSTAT_COUNTER_4_LOW,
+        RxMulticastFramesReceivedOK = SUNI1x10GEXP_REG_MSTAT_COUNTER_5_LOW,
+        RxBroadcastFramesReceivedOK = SUNI1x10GEXP_REG_MSTAT_COUNTER_6_LOW,
+        RxPAUSEMACCtrlFramesReceived = SUNI1x10GEXP_REG_MSTAT_COUNTER_8_LOW,
+        RxFrameCheckSequenceErrors = SUNI1x10GEXP_REG_MSTAT_COUNTER_10_LOW,
+        RxFramesLostDueToInternalMACErrors = SUNI1x10GEXP_REG_MSTAT_COUNTER_11_LOW,
+        RxSymbolErrors = SUNI1x10GEXP_REG_MSTAT_COUNTER_12_LOW,
+        RxInRangeLengthErrors = SUNI1x10GEXP_REG_MSTAT_COUNTER_13_LOW,
+        RxFramesTooLongErrors = SUNI1x10GEXP_REG_MSTAT_COUNTER_15_LOW,
+        RxJabbers = SUNI1x10GEXP_REG_MSTAT_COUNTER_16_LOW,
+        RxFragments = SUNI1x10GEXP_REG_MSTAT_COUNTER_17_LOW,
+        RxUndersizedFrames =  SUNI1x10GEXP_REG_MSTAT_COUNTER_18_LOW,
+
+        TxOctetsTransmittedOK = SUNI1x10GEXP_REG_MSTAT_COUNTER_33_LOW,
+        TxFramesLostDueToInternalMACTransmissionError = SUNI1x10GEXP_REG_MSTAT_COUNTER_35_LOW,
+        TxTransmitSystemError = SUNI1x10GEXP_REG_MSTAT_COUNTER_36_LOW,
+        TxUnicastFramesTransmittedOK = SUNI1x10GEXP_REG_MSTAT_COUNTER_38_LOW,
+        TxMulticastFramesTransmittedOK = SUNI1x10GEXP_REG_MSTAT_COUNTER_40_LOW,
+        TxBroadcastFramesTransmittedOK = SUNI1x10GEXP_REG_MSTAT_COUNTER_42_LOW,
+        TxPAUSEMACCtrlFramesTransmitted = SUNI1x10GEXP_REG_MSTAT_COUNTER_43_LOW
+};
+
+struct _cmac_instance {
+        u8 enabled;
+        u8 fc;
+        u8 mac_addr[6];
+};
+
+static int pmread(struct cmac *cmac, u32 reg, u32 * data32)
+{
+        t1_tpi_read(cmac->adapter, OFFSET(reg), data32);
+        return 0;
+}
+
+static int pmwrite(struct cmac *cmac, u32 reg, u32 data32)
+{
+        t1_tpi_write(cmac->adapter, OFFSET(reg), data32);
+        return 0;
+}
+
+/* Port reset. */
+static int pm3393_reset(struct cmac *cmac)
+{
+        return 0;
+}
+
+/*
+ * Enable interrupts for the PM3393
+
+        1. Enable PM3393 BLOCK interrupts.
+        2. Enable PM3393 Master Interrupt bit(INTE)
+        3. Enable ELMER's PM3393 bit.
+        4. Enable Terminator external interrupt.
+*/
+static int pm3393_interrupt_enable(struct cmac *cmac)
+{
+        u32 pl_intr;
+
+        /* PM3393 - Enabling all hardware block interrupts.
+         */
+        pmwrite(cmac, SUNI1x10GEXP_REG_SERDES_3125_INTERRUPT_ENABLE, 0xffff);
+        pmwrite(cmac, SUNI1x10GEXP_REG_XRF_INTERRUPT_ENABLE, 0xffff);
+        pmwrite(cmac, SUNI1x10GEXP_REG_XRF_DIAG_INTERRUPT_ENABLE, 0xffff);
+        pmwrite(cmac, SUNI1x10GEXP_REG_RXOAM_INTERRUPT_ENABLE, 0xffff);
+
+        /* Don't interrupt on statistics overflow, we are polling */
+        pmwrite(cmac, SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_0, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_1, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_2, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_3, 0);
+
+        pmwrite(cmac, SUNI1x10GEXP_REG_IFLX_FIFO_OVERFLOW_ENABLE, 0xffff);
+        pmwrite(cmac, SUNI1x10GEXP_REG_PL4ODP_INTERRUPT_MASK, 0xffff);
+        pmwrite(cmac, SUNI1x10GEXP_REG_XTEF_INTERRUPT_ENABLE, 0xffff);
+        pmwrite(cmac, SUNI1x10GEXP_REG_TXOAM_INTERRUPT_ENABLE, 0xffff);
+        pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_CONFIG_3, 0xffff);
+        pmwrite(cmac, SUNI1x10GEXP_REG_PL4IO_LOCK_DETECT_MASK, 0xffff);
+        pmwrite(cmac, SUNI1x10GEXP_REG_TXXG_CONFIG_3, 0xffff);
+        pmwrite(cmac, SUNI1x10GEXP_REG_PL4IDU_INTERRUPT_MASK, 0xffff);
+        pmwrite(cmac, SUNI1x10GEXP_REG_EFLX_FIFO_OVERFLOW_ERROR_ENABLE, 0xffff);
+
+        /* PM3393 - Global interrupt enable
+         */
+        /* TBD XXX Disable for now until we figure out why error interrupts keep asserting. */
+        pmwrite(cmac, SUNI1x10GEXP_REG_GLOBAL_INTERRUPT_ENABLE,
+                0 /*SUNI1x10GEXP_BITMSK_TOP_INTE */ );
+
+        /* TERMINATOR - PL_INTERUPTS_EXT */
+        pl_intr = readl(cmac->adapter->regs + A_PL_ENABLE);
+        pl_intr |= F_PL_INTR_EXT;
+        writel(pl_intr, cmac->adapter->regs + A_PL_ENABLE);
+        return 0;
+}
+
+static int pm3393_interrupt_disable(struct cmac *cmac)
+{
+        u32 elmer;
+
+        /* PM3393 - Enabling HW interrupt blocks. */
+        pmwrite(cmac, SUNI1x10GEXP_REG_SERDES_3125_INTERRUPT_ENABLE, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_XRF_INTERRUPT_ENABLE, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_XRF_DIAG_INTERRUPT_ENABLE, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_RXOAM_INTERRUPT_ENABLE, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_0, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_1, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_2, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_3, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_IFLX_FIFO_OVERFLOW_ENABLE, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_PL4ODP_INTERRUPT_MASK, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_XTEF_INTERRUPT_ENABLE, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_TXOAM_INTERRUPT_ENABLE, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_CONFIG_3, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_PL4IO_LOCK_DETECT_MASK, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_TXXG_CONFIG_3, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_PL4IDU_INTERRUPT_MASK, 0);
+        pmwrite(cmac, SUNI1x10GEXP_REG_EFLX_FIFO_OVERFLOW_ERROR_ENABLE, 0);
+
+        /* PM3393 - Global interrupt enable */
+        pmwrite(cmac, SUNI1x10GEXP_REG_GLOBAL_INTERRUPT_ENABLE, 0);
+
+        /* ELMER - External chip interrupts. */
+        t1_tpi_read(cmac->adapter, A_ELMER0_INT_ENABLE, &elmer);
+        elmer &= ~ELMER0_GP_BIT1;
+        t1_tpi_write(cmac->adapter, A_ELMER0_INT_ENABLE, elmer);
+
+        /* TERMINATOR - PL_INTERUPTS_EXT */
+        /* DO NOT DISABLE TERMINATOR's EXTERNAL INTERRUPTS. ANOTHER CHIP
+         * COULD WANT THEM ENABLED. We disable PM3393 at the ELMER level.
+         */
+
+        return 0;
+}
+
+static int pm3393_interrupt_clear(struct cmac *cmac)
+{
+        u32 elmer;
+        u32 pl_intr;
+        u32 val32;
+
+        /* PM3393 - Clearing HW interrupt blocks. Note, this assumes
+         *          bit WCIMODE=0 for a clear-on-read.
+         */
+        pmread(cmac, SUNI1x10GEXP_REG_SERDES_3125_INTERRUPT_STATUS, &val32);
+        pmread(cmac, SUNI1x10GEXP_REG_XRF_INTERRUPT_STATUS, &val32);
+        pmread(cmac, SUNI1x10GEXP_REG_XRF_DIAG_INTERRUPT_STATUS, &val32);
+        pmread(cmac, SUNI1x10GEXP_REG_RXOAM_INTERRUPT_STATUS, &val32);
+        pmread(cmac, SUNI1x10GEXP_REG_PL4ODP_INTERRUPT, &val32);
+        pmread(cmac, SUNI1x10GEXP_REG_XTEF_INTERRUPT_STATUS, &val32);
+        pmread(cmac, SUNI1x10GEXP_REG_IFLX_FIFO_OVERFLOW_INTERRUPT, &val32);
+        pmread(cmac, SUNI1x10GEXP_REG_TXOAM_INTERRUPT_STATUS, &val32);
+        pmread(cmac, SUNI1x10GEXP_REG_RXXG_INTERRUPT, &val32);
+        pmread(cmac, SUNI1x10GEXP_REG_TXXG_INTERRUPT, &val32);
+        pmread(cmac, SUNI1x10GEXP_REG_PL4IDU_INTERRUPT, &val32);
+        pmread(cmac, SUNI1x10GEXP_REG_EFLX_FIFO_OVERFLOW_ERROR_INDICATION,
+               &val32);
+        pmread(cmac, SUNI1x10GEXP_REG_PL4IO_LOCK_DETECT_STATUS, &val32);
+        pmread(cmac, SUNI1x10GEXP_REG_PL4IO_LOCK_DETECT_CHANGE, &val32);
+
+        /* PM3393 - Global interrupt status
+         */
+        pmread(cmac, SUNI1x10GEXP_REG_MASTER_INTERRUPT_STATUS, &val32);
+
+        /* ELMER - External chip interrupts.
+         */
+        t1_tpi_read(cmac->adapter, A_ELMER0_INT_CAUSE, &elmer);
+        elmer |= ELMER0_GP_BIT1;
+        t1_tpi_write(cmac->adapter, A_ELMER0_INT_CAUSE, elmer);
+
+        /* TERMINATOR - PL_INTERUPTS_EXT
+         */
+        pl_intr = readl(cmac->adapter->regs + A_PL_CAUSE);
+        pl_intr |= F_PL_INTR_EXT;
+        writel(pl_intr, cmac->adapter->regs + A_PL_CAUSE);
+
+        return 0;
+}
+
+/* Interrupt handler */
+static int pm3393_interrupt_handler(struct cmac *cmac)
+{
+        u32 master_intr_status;
+/*
+        1. Read master interrupt register.
+        2. Read BLOCK's interrupt status registers.
+        3. Handle BLOCK interrupts.
+*/
+        /* Read the master interrupt status register. */
+        pmread(cmac, SUNI1x10GEXP_REG_MASTER_INTERRUPT_STATUS,
+               &master_intr_status);
+
+        /* TBD XXX Lets just clear everything for now */
+        pm3393_interrupt_clear(cmac);
+
+        return 0;
+}
+
+static int pm3393_enable(struct cmac *cmac, int which)
+{
+        if (which & MAC_DIRECTION_RX)
+                pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_CONFIG_1,
+                        (RXXG_CONF1_VAL | SUNI1x10GEXP_BITMSK_RXXG_RXEN));
+
+        if (which & MAC_DIRECTION_TX) {
+                u32 val = TXXG_CONF1_VAL | SUNI1x10GEXP_BITMSK_TXXG_TXEN0;
+
+                if (cmac->instance->fc & PAUSE_RX)
+                        val |= SUNI1x10GEXP_BITMSK_TXXG_FCRX;
+                if (cmac->instance->fc & PAUSE_TX)
+                        val |= SUNI1x10GEXP_BITMSK_TXXG_FCTX;
+                pmwrite(cmac, SUNI1x10GEXP_REG_TXXG_CONFIG_1, val);
+        }
+
+        cmac->instance->enabled |= which;
+        return 0;
+}
+
+static int pm3393_enable_port(struct cmac *cmac, int which)
+{
+        /* Clear port statistics */
+        pmwrite(cmac, SUNI1x10GEXP_REG_MSTAT_CONTROL,
+                SUNI1x10GEXP_BITMSK_MSTAT_CLEAR);
+        udelay(2);
+        memset(&cmac->stats, 0, sizeof(struct cmac_statistics));
+
+        pm3393_enable(cmac, which);
+
+        /*
+         * XXX This should be done by the PHY and preferrably not at all.
+         * The PHY doesn't give us link status indication on its own so have
+         * the link management code query it instead.
+         */
+        {
+                extern void link_changed(adapter_t *adapter, int port_id);
+
+                link_changed(cmac->adapter, 0);
+        }
+        return 0;
+}
+
+static int pm3393_disable(struct cmac *cmac, int which)
+{
+        if (which & MAC_DIRECTION_RX)
+                pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_CONFIG_1, RXXG_CONF1_VAL);
+        if (which & MAC_DIRECTION_TX)
+                pmwrite(cmac, SUNI1x10GEXP_REG_TXXG_CONFIG_1, TXXG_CONF1_VAL);
+
+        /*
+         * The disable is graceful. Give the PM3393 time.  Can't wait very
+         * long here, we may be holding locks.
+         */
+        udelay(20);
+
+        cmac->instance->enabled &= ~which;
+        return 0;
+}
+
+static int pm3393_loopback_enable(struct cmac *cmac)
+{
+        return 0;
+}
+
+static int pm3393_loopback_disable(struct cmac *cmac)
+{
+        return 0;
+}
+
+static int pm3393_set_mtu(struct cmac *cmac, int mtu)
+{
+        int enabled = cmac->instance->enabled;
+
+        /* MAX_FRAME_SIZE includes header + FCS, mtu doesn't */
+        mtu += 14 + 4;
+        if (mtu > MAX_FRAME_SIZE)
+                return -EINVAL;
+
+        /* Disable Rx/Tx MAC before configuring it. */
+        if (enabled)
+                pm3393_disable(cmac, MAC_DIRECTION_RX | MAC_DIRECTION_TX);
+
+        pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_MAX_FRAME_LENGTH, mtu);
+        pmwrite(cmac, SUNI1x10GEXP_REG_TXXG_MAX_FRAME_SIZE, mtu);
+
+        if (enabled)
+                pm3393_enable(cmac, enabled);
+        return 0;
+}
+
+static u32 calc_crc(u8 *b, int len)
+{
+        int i;
+        u32 crc = (u32)~0;
+
+        /* calculate crc one bit at a time */
+        while (len--) {
+                crc ^= *b++;
+                for (i = 0; i < 8; i++) {
+                        if (crc & 0x1)
+                                crc = (crc >> 1) ^ 0xedb88320;
+                        else
+                                crc = (crc >> 1);
+                }
+        }
+
+        /* reverse bits */
+        crc = ((crc >> 4) & 0x0f0f0f0f) | ((crc << 4) & 0xf0f0f0f0);
+        crc = ((crc >> 2) & 0x33333333) | ((crc << 2) & 0xcccccccc);
+        crc = ((crc >> 1) & 0x55555555) | ((crc << 1) & 0xaaaaaaaa);
+        /* swap bytes */
+        crc = (crc >> 16) | (crc << 16);
+        crc = (crc >> 8 & 0x00ff00ff) | (crc << 8 & 0xff00ff00);
+
+        return crc;
+}
+
+static int pm3393_set_rx_mode(struct cmac *cmac, struct t1_rx_mode *rm)
+{
+        int enabled = cmac->instance->enabled & MAC_DIRECTION_RX;
+        u32 rx_mode;
+
+        /* Disable MAC RX before reconfiguring it */
+        if (enabled)
+                pm3393_disable(cmac, MAC_DIRECTION_RX);
+
+        pmread(cmac, SUNI1x10GEXP_REG_RXXG_ADDRESS_FILTER_CONTROL_2, &rx_mode);
+        rx_mode &= ~(SUNI1x10GEXP_BITMSK_RXXG_PMODE |
+                     SUNI1x10GEXP_BITMSK_RXXG_MHASH_EN);
+        pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_ADDRESS_FILTER_CONTROL_2,
+                (u16)rx_mode);
+
+        if (t1_rx_mode_promisc(rm)) {
+                /* Promiscuous mode. */
+                rx_mode |= SUNI1x10GEXP_BITMSK_RXXG_PMODE;
+        }
+        if (t1_rx_mode_allmulti(rm)) {
+                /* Accept all multicast. */
+                pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_LOW, 0xffff);
+                pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_MIDLOW, 0xffff);
+                pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_MIDHIGH, 0xffff);
+                pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_HIGH, 0xffff);
+                rx_mode |= SUNI1x10GEXP_BITMSK_RXXG_MHASH_EN;
+        } else if (t1_rx_mode_mc_cnt(rm)) {
+                /* Accept one or more multicast(s). */
+                u8 *addr;
+                int bit;
+                u16 mc_filter[4] = { 0, };
+
+                while ((addr = t1_get_next_mcaddr(rm))) {
+                        bit = (calc_crc(addr, ETH_ALEN) >> 23) & 0x3f;  /* bit[23:28] */
+                        mc_filter[bit >> 4] |= 1 << (bit & 0xf);
+                }
+                pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_LOW, mc_filter[0]);
+                pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_MIDLOW, mc_filter[1]);
+                pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_MIDHIGH, mc_filter[2]);
+                pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_HIGH, mc_filter[3]);
+                rx_mode |= SUNI1x10GEXP_BITMSK_RXXG_MHASH_EN;
+        }
+
+        pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_ADDRESS_FILTER_CONTROL_2, (u16)rx_mode);
+
+        if (enabled)
+                pm3393_enable(cmac, MAC_DIRECTION_RX);
+
+        return 0;
+}
+
+static int pm3393_get_speed_duplex_fc(struct cmac *cmac, int *speed,
+                                      int *duplex, int *fc)
+{
+        if (speed)
+                *speed = SPEED_10000;
+        if (duplex)
+                *duplex = DUPLEX_FULL;
+        if (fc)
+                *fc = cmac->instance->fc;
+        return 0;
+}
+
+static int pm3393_set_speed_duplex_fc(struct cmac *cmac, int speed, int duplex,
+                                      int fc)
+{
+        if (speed >= 0 && speed != SPEED_10000)
+                return -1;
+        if (duplex >= 0 && duplex != DUPLEX_FULL)
+                return -1;
+        if (fc & ~(PAUSE_TX | PAUSE_RX))
+                return -1;
+
+        if (fc != cmac->instance->fc) {
+                cmac->instance->fc = (u8) fc;
+                if (cmac->instance->enabled & MAC_DIRECTION_TX)
+                        pm3393_enable(cmac, MAC_DIRECTION_TX);
+        }
+        return 0;
+}
+
+#define RMON_UPDATE(mac, name, stat_name) \
+        { \
+                t1_tpi_read((mac)->adapter, OFFSET(name), &val0);       \
+                t1_tpi_read((mac)->adapter, OFFSET(((name)+1)), &val1); \
+                t1_tpi_read((mac)->adapter, OFFSET(((name)+2)), &val2); \
+                (mac)->stats.stat_name = ((u64)val0 & 0xffff) | \
+                                                (((u64)val1 & 0xffff) << 16) | \
+                                                (((u64)val2 & 0xff) << 32) | \
+                                                ((mac)->stats.stat_name & \
+                                                        (~(u64)0 << 40)); \
+                if (ro &        \
+                        ((name -  SUNI1x10GEXP_REG_MSTAT_COUNTER_0_LOW) >> 2)) \
+                        (mac)->stats.stat_name += ((u64)1 << 40); \
+        }
+
+static const struct cmac_statistics *pm3393_update_statistics(struct cmac *mac,
+                                                              int flag)
+{
+        u64     ro;
+        u32     val0, val1, val2, val3;
+
+        /* Snap the counters */
+        pmwrite(mac, SUNI1x10GEXP_REG_MSTAT_CONTROL,
+                SUNI1x10GEXP_BITMSK_MSTAT_SNAP);
+
+        /* Counter rollover, clear on read */
+        pmread(mac, SUNI1x10GEXP_REG_MSTAT_COUNTER_ROLLOVER_0, &val0);
+        pmread(mac, SUNI1x10GEXP_REG_MSTAT_COUNTER_ROLLOVER_1, &val1);
+        pmread(mac, SUNI1x10GEXP_REG_MSTAT_COUNTER_ROLLOVER_2, &val2);
+        pmread(mac, SUNI1x10GEXP_REG_MSTAT_COUNTER_ROLLOVER_3, &val3);
+        ro = ((u64)val0 & 0xffff) | (((u64)val1 & 0xffff) << 16) |
+                (((u64)val2 & 0xffff) << 32) | (((u64)val3 & 0xffff) << 48);
+
+        /* Rx stats */
+        RMON_UPDATE(mac, RxOctetsReceivedOK, RxOctetsOK);
+        RMON_UPDATE(mac, RxUnicastFramesReceivedOK, RxUnicastFramesOK);
+        RMON_UPDATE(mac, RxMulticastFramesReceivedOK, RxMulticastFramesOK);
+        RMON_UPDATE(mac, RxBroadcastFramesReceivedOK, RxBroadcastFramesOK);
+        RMON_UPDATE(mac, RxPAUSEMACCtrlFramesReceived, RxPauseFrames);
+        RMON_UPDATE(mac, RxFrameCheckSequenceErrors, RxFCSErrors);
+        RMON_UPDATE(mac, RxFramesLostDueToInternalMACErrors,
+                                RxInternalMACRcvError);
+        RMON_UPDATE(mac, RxSymbolErrors, RxSymbolErrors);
+        RMON_UPDATE(mac, RxInRangeLengthErrors, RxInRangeLengthErrors);
+        RMON_UPDATE(mac, RxFramesTooLongErrors , RxFrameTooLongErrors);
+        RMON_UPDATE(mac, RxJabbers, RxJabberErrors);
+        RMON_UPDATE(mac, RxFragments, RxRuntErrors);
+        RMON_UPDATE(mac, RxUndersizedFrames, RxRuntErrors);
+
+        /* Tx stats */
+        RMON_UPDATE(mac, TxOctetsTransmittedOK, TxOctetsOK);
+        RMON_UPDATE(mac, TxFramesLostDueToInternalMACTransmissionError,
+                                TxInternalMACXmitError);
+        RMON_UPDATE(mac, TxTransmitSystemError, TxFCSErrors);
+        RMON_UPDATE(mac, TxUnicastFramesTransmittedOK, TxUnicastFramesOK);
+        RMON_UPDATE(mac, TxMulticastFramesTransmittedOK, TxMulticastFramesOK);
+        RMON_UPDATE(mac, TxBroadcastFramesTransmittedOK, TxBroadcastFramesOK);
+        RMON_UPDATE(mac, TxPAUSEMACCtrlFramesTransmitted, TxPauseFrames);
+
+        return &mac->stats;
+}
+
+static int pm3393_macaddress_get(struct cmac *cmac, u8 mac_addr[6])
+{
+        memcpy(mac_addr, cmac->instance->mac_addr, 6);
+        return 0;
+}
+
+static int pm3393_macaddress_set(struct cmac *cmac, u8 ma[6])
+{
+        u32 val, lo, mid, hi, enabled = cmac->instance->enabled;
+
+        /*
+         * MAC addr: 00:07:43:00:13:09
+         *
+         * ma[5] = 0x09
+         * ma[4] = 0x13
+         * ma[3] = 0x00
+         * ma[2] = 0x43
+         * ma[1] = 0x07
+         * ma[0] = 0x00
+         *
+         * The PM3393 requires byte swapping and reverse order entry
+         * when programming MAC addresses:
+         *
+         * low_bits[15:0]    = ma[1]:ma[0]
+         * mid_bits[31:16]   = ma[3]:ma[2]
+         * high_bits[47:32]  = ma[5]:ma[4]
+         */
+
+        /* Store local copy */
+        memcpy(cmac->instance->mac_addr, ma, 6);
+
+        lo = ((u32) ma[1] << 8) | (u32) ma[0];
+        mid = ((u32) ma[3] << 8) | (u32) ma[2];
+        hi = ((u32) ma[5] << 8) | (u32) ma[4];
+
+        /* Disable Rx/Tx MAC before configuring it. */
+        if (enabled)
+                pm3393_disable(cmac, MAC_DIRECTION_RX | MAC_DIRECTION_TX);
+
+        /* Set RXXG Station Address */
+        pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_SA_15_0, lo);
+        pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_SA_31_16, mid);
+        pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_SA_47_32, hi);
+
+        /* Set TXXG Station Address */
+        pmwrite(cmac, SUNI1x10GEXP_REG_TXXG_SA_15_0, lo);
+        pmwrite(cmac, SUNI1x10GEXP_REG_TXXG_SA_31_16, mid);
+        pmwrite(cmac, SUNI1x10GEXP_REG_TXXG_SA_47_32, hi);
+
+        /* Setup Exact Match Filter 1 with our MAC address
+         *
+         * Must disable exact match filter before configuring it.
+         */
+        pmread(cmac, SUNI1x10GEXP_REG_RXXG_ADDRESS_FILTER_CONTROL_0, &val);
+        val &= 0xff0f;
+        pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_ADDRESS_FILTER_CONTROL_0, val);
+
+        pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_EXACT_MATCH_ADDR_1_LOW, lo);
+        pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_EXACT_MATCH_ADDR_1_MID, mid);
+        pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_EXACT_MATCH_ADDR_1_HIGH, hi);
+
+        val |= 0x0090;
+        pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_ADDRESS_FILTER_CONTROL_0, val);
+
+        if (enabled)
+                pm3393_enable(cmac, enabled);
+        return 0;
+}
+
+static void pm3393_destroy(struct cmac *cmac)
+{
+        kfree(cmac);
+}
+
+static struct cmac_ops pm3393_ops = {
+        .destroy                 = pm3393_destroy,
+        .reset                   = pm3393_reset,
+        .interrupt_enable        = pm3393_interrupt_enable,
+        .interrupt_disable       = pm3393_interrupt_disable,
+        .interrupt_clear         = pm3393_interrupt_clear,
+        .interrupt_handler       = pm3393_interrupt_handler,
+        .enable                  = pm3393_enable_port,
+        .disable                 = pm3393_disable,
+        .loopback_enable         = pm3393_loopback_enable,
+        .loopback_disable        = pm3393_loopback_disable,
+        .set_mtu                 = pm3393_set_mtu,
+        .set_rx_mode             = pm3393_set_rx_mode,
+        .get_speed_duplex_fc     = pm3393_get_speed_duplex_fc,
+        .set_speed_duplex_fc     = pm3393_set_speed_duplex_fc,
+        .statistics_update       = pm3393_update_statistics,
+        .macaddress_get          = pm3393_macaddress_get,
+        .macaddress_set          = pm3393_macaddress_set
+};
+
+static struct cmac *pm3393_mac_create(adapter_t *adapter, int index)
+{
+        struct cmac *cmac;
+
+        cmac = kmalloc(sizeof(*cmac) + sizeof(cmac_instance), GFP_KERNEL);
+        if (!cmac)
+                return NULL;
+        memset(cmac, 0, sizeof(*cmac));
+
+        cmac->ops = &pm3393_ops;
+        cmac->instance = (cmac_instance *) (cmac + 1);
+        cmac->adapter = adapter;
+        cmac->instance->fc = PAUSE_TX | PAUSE_RX;
+
+        t1_tpi_write(adapter, OFFSET(0x0001), 0x00008000);
+        t1_tpi_write(adapter, OFFSET(0x0001), 0x00000000);
+        t1_tpi_write(adapter, OFFSET(0x2308), 0x00009800);
+        t1_tpi_write(adapter, OFFSET(0x2305), 0x00001001);   /* PL4IO Enable */
+        t1_tpi_write(adapter, OFFSET(0x2320), 0x00008800);
+        t1_tpi_write(adapter, OFFSET(0x2321), 0x00008800);
+        t1_tpi_write(adapter, OFFSET(0x2322), 0x00008800);
+        t1_tpi_write(adapter, OFFSET(0x2323), 0x00008800);
+        t1_tpi_write(adapter, OFFSET(0x2324), 0x00008800);
+        t1_tpi_write(adapter, OFFSET(0x2325), 0x00008800);
+        t1_tpi_write(adapter, OFFSET(0x2326), 0x00008800);
+        t1_tpi_write(adapter, OFFSET(0x2327), 0x00008800);
+        t1_tpi_write(adapter, OFFSET(0x2328), 0x00008800);
+        t1_tpi_write(adapter, OFFSET(0x2329), 0x00008800);
+        t1_tpi_write(adapter, OFFSET(0x232a), 0x00008800);
+        t1_tpi_write(adapter, OFFSET(0x232b), 0x00008800);
+        t1_tpi_write(adapter, OFFSET(0x232c), 0x00008800);
+        t1_tpi_write(adapter, OFFSET(0x232d), 0x00008800);
+        t1_tpi_write(adapter, OFFSET(0x232e), 0x00008800);
+        t1_tpi_write(adapter, OFFSET(0x232f), 0x00008800);
+        t1_tpi_write(adapter, OFFSET(0x230d), 0x00009c00);
+        t1_tpi_write(adapter, OFFSET(0x2304), 0x00000202);      /* PL4IO Calendar Repetitions */
+
+        t1_tpi_write(adapter, OFFSET(0x3200), 0x00008080);      /* EFLX Enable */
+        t1_tpi_write(adapter, OFFSET(0x3210), 0x00000000);      /* EFLX Channel Deprovision */
+        t1_tpi_write(adapter, OFFSET(0x3203), 0x00000000);      /* EFLX Low Limit */
+        t1_tpi_write(adapter, OFFSET(0x3204), 0x00000040);      /* EFLX High Limit */
+        t1_tpi_write(adapter, OFFSET(0x3205), 0x000002cc);      /* EFLX Almost Full */
+        t1_tpi_write(adapter, OFFSET(0x3206), 0x00000199);      /* EFLX Almost Empty */
+        t1_tpi_write(adapter, OFFSET(0x3207), 0x00000240);      /* EFLX Cut Through Threshold */
+        t1_tpi_write(adapter, OFFSET(0x3202), 0x00000000);      /* EFLX Indirect Register Update */
+        t1_tpi_write(adapter, OFFSET(0x3210), 0x00000001);      /* EFLX Channel Provision */
+        t1_tpi_write(adapter, OFFSET(0x3208), 0x0000ffff);      /* EFLX Undocumented */
+        t1_tpi_write(adapter, OFFSET(0x320a), 0x0000ffff);      /* EFLX Undocumented */
+        t1_tpi_write(adapter, OFFSET(0x320c), 0x0000ffff);      /* EFLX enable overflow interrupt The other bit are undocumented */
+        t1_tpi_write(adapter, OFFSET(0x320e), 0x0000ffff);      /* EFLX Undocumented */
+
+        t1_tpi_write(adapter, OFFSET(0x2200), 0x0000c000);      /* IFLX Configuration - enable */
+        t1_tpi_write(adapter, OFFSET(0x2201), 0x00000000);      /* IFLX Channel Deprovision */
+        t1_tpi_write(adapter, OFFSET(0x220e), 0x00000000);      /* IFLX Low Limit */
+        t1_tpi_write(adapter, OFFSET(0x220f), 0x00000100);      /* IFLX High Limit */
+        t1_tpi_write(adapter, OFFSET(0x2210), 0x00000c00);      /* IFLX Almost Full Limit */
+        t1_tpi_write(adapter, OFFSET(0x2211), 0x00000599);      /* IFLX Almost Empty Limit */
+        t1_tpi_write(adapter, OFFSET(0x220d), 0x00000000);      /* IFLX Indirect Register Update */
+        t1_tpi_write(adapter, OFFSET(0x2201), 0x00000001);      /* IFLX Channel Provision */
+        t1_tpi_write(adapter, OFFSET(0x2203), 0x0000ffff);      /* IFLX Undocumented */
+        t1_tpi_write(adapter, OFFSET(0x2205), 0x0000ffff);      /* IFLX Undocumented */
+        t1_tpi_write(adapter, OFFSET(0x2209), 0x0000ffff);      /* IFLX Enable overflow interrupt.  The other bit are undocumented */
+
+        t1_tpi_write(adapter, OFFSET(0x2241), 0xfffffffe);      /* PL4MOS Undocumented */
+        t1_tpi_write(adapter, OFFSET(0x2242), 0x0000ffff);      /* PL4MOS Undocumented */
+        t1_tpi_write(adapter, OFFSET(0x2243), 0x00000008);      /* PL4MOS Starving Burst Size */
+        t1_tpi_write(adapter, OFFSET(0x2244), 0x00000008);      /* PL4MOS Hungry Burst Size */
+        t1_tpi_write(adapter, OFFSET(0x2245), 0x00000008);      /* PL4MOS Transfer Size */
+        t1_tpi_write(adapter, OFFSET(0x2240), 0x00000005);      /* PL4MOS Disable */
+
+        t1_tpi_write(adapter, OFFSET(0x2280), 0x00002103);      /* PL4ODP Training Repeat and SOP rule */
+        t1_tpi_write(adapter, OFFSET(0x2284), 0x00000000);      /* PL4ODP MAX_T setting */
+
+        t1_tpi_write(adapter, OFFSET(0x3280), 0x00000087);      /* PL4IDU Enable data forward, port state machine. Set ALLOW_NON_ZERO_OLB */
+        t1_tpi_write(adapter, OFFSET(0x3282), 0x0000001f);      /* PL4IDU Enable Dip4 check error interrupts */
+
+        t1_tpi_write(adapter, OFFSET(0x3040), 0x0c32);  /* # TXXG Config */
+        /* For T1 use timer based Mac flow control. */
+        t1_tpi_write(adapter, OFFSET(0x304d), 0x8000);
+        t1_tpi_write(adapter, OFFSET(0x2040), 0x059c);  /* # RXXG Config */
+        t1_tpi_write(adapter, OFFSET(0x2049), 0x0001);  /* # RXXG Cut Through */
+        t1_tpi_write(adapter, OFFSET(0x2070), 0x0000);  /* # Disable promiscuous mode */
+
+        /* Setup Exact Match Filter 0 to allow broadcast packets.
+         */
+        t1_tpi_write(adapter, OFFSET(0x206e), 0x0000);  /* # Disable Match Enable bit */
+        t1_tpi_write(adapter, OFFSET(0x204a), 0xffff);  /* # low addr */
+        t1_tpi_write(adapter, OFFSET(0x204b), 0xffff);  /* # mid addr */
+        t1_tpi_write(adapter, OFFSET(0x204c), 0xffff);  /* # high addr */
+        t1_tpi_write(adapter, OFFSET(0x206e), 0x0009);  /* # Enable Match Enable bit */
+
+        t1_tpi_write(adapter, OFFSET(0x0003), 0x0000);  /* # NO SOP/ PAD_EN setup */
+        t1_tpi_write(adapter, OFFSET(0x0100), 0x0ff0);  /* # RXEQB disabled */
+        t1_tpi_write(adapter, OFFSET(0x0101), 0x0f0f);  /* # No Preemphasis */
+
+        return cmac;
+}
+
+static int pm3393_mac_reset(adapter_t * adapter)
+{
+        u32 val;
+        u32 x;
+        u32 is_pl4_reset_finished;
+        u32 is_pl4_outof_lock;
+        u32 is_xaui_mabc_pll_locked;
+        u32 successful_reset;
+        int i;
+
+        /* The following steps are required to properly reset
+         * the PM3393. This information is provided in the
+         * PM3393 datasheet (Issue 2: November 2002)
+         * section 13.1 -- Device Reset.
+         *
+         * The PM3393 has three types of components that are
+         * individually reset:
+         *
+         * DRESETB      - Digital circuitry
+         * PL4_ARESETB  - PL4 analog circuitry
+         * XAUI_ARESETB - XAUI bus analog circuitry
+         *
+         * Steps to reset PM3393 using RSTB pin:
+         *
+         * 1. Assert RSTB pin low ( write 0 )
+         * 2. Wait at least 1ms to initiate a complete initialization of device.
+         * 3. Wait until all external clocks and REFSEL are stable.
+         * 4. Wait minimum of 1ms. (after external clocks and REFEL are stable)
+         * 5. De-assert RSTB ( write 1 )
+         * 6. Wait until internal timers to expires after ~14ms.
+         *    - Allows analog clock synthesizer(PL4CSU) to stabilize to
+         *      selected reference frequency before allowing the digital
+         *      portion of the device to operate.
+         * 7. Wait at least 200us for XAUI interface to stabilize.
+         * 8. Verify the PM3393 came out of reset successfully.
+         *    Set successful reset flag if everything worked else try again
+         *    a few more times.
+         */
+
+        successful_reset = 0;
+        for (i = 0; i < 3 && !successful_reset; i++) {
+                /* 1 */
+                t1_tpi_read(adapter, A_ELMER0_GPO, &val);
+                val &= ~1;
+                t1_tpi_write(adapter, A_ELMER0_GPO, val);
+
+                /* 2 */
+                msleep(1);
+
+                /* 3 */
+                msleep(1);
+
+                /* 4 */
+                msleep(2 /*1 extra ms for safety */ );
+
+                /* 5 */
+                val |= 1;
+                t1_tpi_write(adapter, A_ELMER0_GPO, val);
+
+                /* 6 */
+                msleep(15 /*1 extra ms for safety */ );
+
+                /* 7 */
+                msleep(1);
+
+                /* 8 */
+
+                /* Has PL4 analog block come out of reset correctly? */
+                t1_tpi_read(adapter, OFFSET(SUNI1x10GEXP_REG_DEVICE_STATUS), &val);
+                is_pl4_reset_finished = (val & SUNI1x10GEXP_BITMSK_TOP_EXPIRED);
+
+                /* TBD XXX SUNI1x10GEXP_BITMSK_TOP_PL4_IS_DOOL gets locked later in the init sequence
+                 *         figure out why? */
+
+                /* Have all PL4 block clocks locked? */
+                x = (SUNI1x10GEXP_BITMSK_TOP_PL4_ID_DOOL
+                     /*| SUNI1x10GEXP_BITMSK_TOP_PL4_IS_DOOL */  |
+                     SUNI1x10GEXP_BITMSK_TOP_PL4_ID_ROOL |
+                     SUNI1x10GEXP_BITMSK_TOP_PL4_IS_ROOL |
+                     SUNI1x10GEXP_BITMSK_TOP_PL4_OUT_ROOL);
+                is_pl4_outof_lock = (val & x);
+
+                /* ??? If this fails, might be able to software reset the XAUI part
+                 *     and try to recover... thus saving us from doing another HW reset */
+                /* Has the XAUI MABC PLL circuitry stablized? */
+                is_xaui_mabc_pll_locked =
+                    (val & SUNI1x10GEXP_BITMSK_TOP_SXRA_EXPIRED);
+
+                successful_reset = (is_pl4_reset_finished && !is_pl4_outof_lock
+                                    && is_xaui_mabc_pll_locked);
+        }
+        return successful_reset ? 0 : 1;
+}
+
+struct gmac t1_pm3393_ops = {
+        STATS_TICK_SECS,
+        pm3393_mac_create,
+        pm3393_mac_reset
+};
diff --git a/drivers/net/chelsio/regs.h b/drivers/net/chelsio/regs.h
new file mode 100644
index 000000000000..b90e11f40d1f
--- /dev/null
+++ b/drivers/net/chelsio/regs.h
@@ -0,0 +1,468 @@
+/*****************************************************************************
+ *                                                                           *
+ * File: regs.h                                                              *
+ * $Revision: 1.8 $                                                          *
+ * $Date: 2005/06/21 18:29:48 $                                              *
+ * Description:                                                              *
+ *  part of the Chelsio 10Gb Ethernet Driver.                                *
+ *                                                                           *
+ * This program is free software; you can redistribute it and/or modify      *
+ * it under the terms of the GNU General Public License, version 2, as       *
+ * published by the Free Software Foundation.                                *
+ *                                                                           *
+ * You should have received a copy of the GNU General Public License along   *
+ * with this program; if not, write to the Free Software Foundation, Inc.,   *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
+ *                                                                           *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
+ *                                                                           *
+ * http://www.chelsio.com                                                    *
+ *                                                                           *
+ * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
+ * All rights reserved.                                                      *
+ *                                                                           *
+ * Maintainers: maintainers@chelsio.com                                      *
+ *                                                                           *
+ * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
+ *          Tina Yang               <tainay@chelsio.com>                     *
+ *          Felix Marti             <felix@chelsio.com>                      *
+ *          Scott Bardone           <sbardone@chelsio.com>                   *
+ *          Kurt Ottaway            <kottaway@chelsio.com>                   *
+ *          Frank DiMambro          <frank@chelsio.com>                      *
+ *                                                                           *
+ * History:                                                                  *
+ *                                                                           *
+ ****************************************************************************/
+
+#ifndef _CXGB_REGS_H_
+#define _CXGB_REGS_H_
+
+/* SGE registers */
+#define A_SG_CONTROL 0x0
+
+#define S_CMDQ0_ENABLE    0
+#define V_CMDQ0_ENABLE(x) ((x) << S_CMDQ0_ENABLE)
+#define F_CMDQ0_ENABLE    V_CMDQ0_ENABLE(1U)
+
+#define S_CMDQ1_ENABLE    1
+#define V_CMDQ1_ENABLE(x) ((x) << S_CMDQ1_ENABLE)
+#define F_CMDQ1_ENABLE    V_CMDQ1_ENABLE(1U)
+
+#define S_FL0_ENABLE    2
+#define V_FL0_ENABLE(x) ((x) << S_FL0_ENABLE)
+#define F_FL0_ENABLE    V_FL0_ENABLE(1U)
+
+#define S_FL1_ENABLE    3
+#define V_FL1_ENABLE(x) ((x) << S_FL1_ENABLE)
+#define F_FL1_ENABLE    V_FL1_ENABLE(1U)
+
+#define S_CPL_ENABLE    4
+#define V_CPL_ENABLE(x) ((x) << S_CPL_ENABLE)
+#define F_CPL_ENABLE    V_CPL_ENABLE(1U)
+
+#define S_RESPONSE_QUEUE_ENABLE    5
+#define V_RESPONSE_QUEUE_ENABLE(x) ((x) << S_RESPONSE_QUEUE_ENABLE)
+#define F_RESPONSE_QUEUE_ENABLE    V_RESPONSE_QUEUE_ENABLE(1U)
+
+#define S_CMDQ_PRIORITY    6
+#define M_CMDQ_PRIORITY    0x3
+#define V_CMDQ_PRIORITY(x) ((x) << S_CMDQ_PRIORITY)
+#define G_CMDQ_PRIORITY(x) (((x) >> S_CMDQ_PRIORITY) & M_CMDQ_PRIORITY)
+
+#define S_DISABLE_CMDQ1_GTS    9
+#define V_DISABLE_CMDQ1_GTS(x) ((x) << S_DISABLE_CMDQ1_GTS)
+#define F_DISABLE_CMDQ1_GTS    V_DISABLE_CMDQ1_GTS(1U)
+
+#define S_DISABLE_FL0_GTS    10
+#define V_DISABLE_FL0_GTS(x) ((x) << S_DISABLE_FL0_GTS)
+#define F_DISABLE_FL0_GTS    V_DISABLE_FL0_GTS(1U)
+
+#define S_DISABLE_FL1_GTS    11
+#define V_DISABLE_FL1_GTS(x) ((x) << S_DISABLE_FL1_GTS)
+#define F_DISABLE_FL1_GTS    V_DISABLE_FL1_GTS(1U)
+
+#define S_ENABLE_BIG_ENDIAN    12
+#define V_ENABLE_BIG_ENDIAN(x) ((x) << S_ENABLE_BIG_ENDIAN)
+#define F_ENABLE_BIG_ENDIAN    V_ENABLE_BIG_ENDIAN(1U)
+
+#define S_ISCSI_COALESCE    14
+#define V_ISCSI_COALESCE(x) ((x) << S_ISCSI_COALESCE)
+#define F_ISCSI_COALESCE    V_ISCSI_COALESCE(1U)
+
+#define S_RX_PKT_OFFSET    15
+#define V_RX_PKT_OFFSET(x) ((x) << S_RX_PKT_OFFSET)
+
+#define S_VLAN_XTRACT    18
+#define V_VLAN_XTRACT(x) ((x) << S_VLAN_XTRACT)
+#define F_VLAN_XTRACT    V_VLAN_XTRACT(1U)
+
+#define A_SG_DOORBELL 0x4
+#define A_SG_CMD0BASELWR 0x8
+#define A_SG_CMD0BASEUPR 0xc
+#define A_SG_CMD1BASELWR 0x10
+#define A_SG_CMD1BASEUPR 0x14
+#define A_SG_FL0BASELWR 0x18
+#define A_SG_FL0BASEUPR 0x1c
+#define A_SG_FL1BASELWR 0x20
+#define A_SG_FL1BASEUPR 0x24
+#define A_SG_CMD0SIZE 0x28
+#define A_SG_FL0SIZE 0x2c
+#define A_SG_RSPSIZE 0x30
+#define A_SG_RSPBASELWR 0x34
+#define A_SG_RSPBASEUPR 0x38
+#define A_SG_FLTHRESHOLD 0x3c
+#define A_SG_RSPQUEUECREDIT 0x40
+#define A_SG_SLEEPING 0x48
+#define A_SG_INTRTIMER 0x4c
+#define A_SG_CMD1SIZE 0xb0
+#define A_SG_FL1SIZE 0xb4
+#define A_SG_INT_ENABLE 0xb8
+
+#define S_RESPQ_EXHAUSTED    0
+#define V_RESPQ_EXHAUSTED(x) ((x) << S_RESPQ_EXHAUSTED)
+#define F_RESPQ_EXHAUSTED    V_RESPQ_EXHAUSTED(1U)
+
+#define S_RESPQ_OVERFLOW    1
+#define V_RESPQ_OVERFLOW(x) ((x) << S_RESPQ_OVERFLOW)
+#define F_RESPQ_OVERFLOW    V_RESPQ_OVERFLOW(1U)
+
+#define S_FL_EXHAUSTED    2
+#define V_FL_EXHAUSTED(x) ((x) << S_FL_EXHAUSTED)
+#define F_FL_EXHAUSTED    V_FL_EXHAUSTED(1U)
+
+#define S_PACKET_TOO_BIG    3
+#define V_PACKET_TOO_BIG(x) ((x) << S_PACKET_TOO_BIG)
+#define F_PACKET_TOO_BIG    V_PACKET_TOO_BIG(1U)
+
+#define S_PACKET_MISMATCH    4
+#define V_PACKET_MISMATCH(x) ((x) << S_PACKET_MISMATCH)
+#define F_PACKET_MISMATCH    V_PACKET_MISMATCH(1U)
+
+#define A_SG_INT_CAUSE 0xbc
+#define A_SG_RESPACCUTIMER 0xc0
+
+/* MC3 registers */
+
+#define S_READY    1
+#define V_READY(x) ((x) << S_READY)
+#define F_READY    V_READY(1U)
+
+/* MC4 registers */
+
+#define A_MC4_CFG 0x180
+#define S_MC4_SLOW    25
+#define V_MC4_SLOW(x) ((x) << S_MC4_SLOW)
+#define F_MC4_SLOW    V_MC4_SLOW(1U)
+
+/* TPI registers */
+
+#define A_TPI_ADDR 0x280
+#define A_TPI_WR_DATA 0x284
+#define A_TPI_RD_DATA 0x288
+#define A_TPI_CSR 0x28c
+
+#define S_TPIWR    0
+#define V_TPIWR(x) ((x) << S_TPIWR)
+#define F_TPIWR    V_TPIWR(1U)
+
+#define S_TPIRDY    1
+#define V_TPIRDY(x) ((x) << S_TPIRDY)
+#define F_TPIRDY    V_TPIRDY(1U)
+
+#define A_TPI_PAR 0x29c
+
+#define S_TPIPAR    0
+#define M_TPIPAR    0x7f
+#define V_TPIPAR(x) ((x) << S_TPIPAR)
+#define G_TPIPAR(x) (((x) >> S_TPIPAR) & M_TPIPAR)
+
+/* TP registers */
+
+#define A_TP_IN_CONFIG 0x300
+
+#define S_TP_IN_CSPI_CPL    3
+#define V_TP_IN_CSPI_CPL(x) ((x) << S_TP_IN_CSPI_CPL)
+#define F_TP_IN_CSPI_CPL    V_TP_IN_CSPI_CPL(1U)
+
+#define S_TP_IN_CSPI_CHECK_IP_CSUM    5
+#define V_TP_IN_CSPI_CHECK_IP_CSUM(x) ((x) << S_TP_IN_CSPI_CHECK_IP_CSUM)
+#define F_TP_IN_CSPI_CHECK_IP_CSUM    V_TP_IN_CSPI_CHECK_IP_CSUM(1U)
+
+#define S_TP_IN_CSPI_CHECK_TCP_CSUM    6
+#define V_TP_IN_CSPI_CHECK_TCP_CSUM(x) ((x) << S_TP_IN_CSPI_CHECK_TCP_CSUM)
+#define F_TP_IN_CSPI_CHECK_TCP_CSUM    V_TP_IN_CSPI_CHECK_TCP_CSUM(1U)
+
+#define S_TP_IN_ESPI_ETHERNET    8
+#define V_TP_IN_ESPI_ETHERNET(x) ((x) << S_TP_IN_ESPI_ETHERNET)
+#define F_TP_IN_ESPI_ETHERNET    V_TP_IN_ESPI_ETHERNET(1U)
+
+#define S_TP_IN_ESPI_CHECK_IP_CSUM    12
+#define V_TP_IN_ESPI_CHECK_IP_CSUM(x) ((x) << S_TP_IN_ESPI_CHECK_IP_CSUM)
+#define F_TP_IN_ESPI_CHECK_IP_CSUM    V_TP_IN_ESPI_CHECK_IP_CSUM(1U)
+
+#define S_TP_IN_ESPI_CHECK_TCP_CSUM    13
+#define V_TP_IN_ESPI_CHECK_TCP_CSUM(x) ((x) << S_TP_IN_ESPI_CHECK_TCP_CSUM)
+#define F_TP_IN_ESPI_CHECK_TCP_CSUM    V_TP_IN_ESPI_CHECK_TCP_CSUM(1U)
+
+#define S_OFFLOAD_DISABLE    14
+#define V_OFFLOAD_DISABLE(x) ((x) << S_OFFLOAD_DISABLE)
+#define F_OFFLOAD_DISABLE    V_OFFLOAD_DISABLE(1U)
+
+#define A_TP_OUT_CONFIG 0x304
+
+#define S_TP_OUT_CSPI_CPL    2
+#define V_TP_OUT_CSPI_CPL(x) ((x) << S_TP_OUT_CSPI_CPL)
+#define F_TP_OUT_CSPI_CPL    V_TP_OUT_CSPI_CPL(1U)
+
+#define S_TP_OUT_ESPI_ETHERNET    6
+#define V_TP_OUT_ESPI_ETHERNET(x) ((x) << S_TP_OUT_ESPI_ETHERNET)
+#define F_TP_OUT_ESPI_ETHERNET    V_TP_OUT_ESPI_ETHERNET(1U)
+
+#define S_TP_OUT_ESPI_GENERATE_IP_CSUM    10
+#define V_TP_OUT_ESPI_GENERATE_IP_CSUM(x) ((x) << S_TP_OUT_ESPI_GENERATE_IP_CSUM)
+#define F_TP_OUT_ESPI_GENERATE_IP_CSUM    V_TP_OUT_ESPI_GENERATE_IP_CSUM(1U)
+
+#define S_TP_OUT_ESPI_GENERATE_TCP_CSUM    11
+#define V_TP_OUT_ESPI_GENERATE_TCP_CSUM(x) ((x) << S_TP_OUT_ESPI_GENERATE_TCP_CSUM)
+#define F_TP_OUT_ESPI_GENERATE_TCP_CSUM    V_TP_OUT_ESPI_GENERATE_TCP_CSUM(1U)
+
+#define A_TP_GLOBAL_CONFIG 0x308
+
+#define S_IP_TTL    0
+#define M_IP_TTL    0xff
+#define V_IP_TTL(x) ((x) << S_IP_TTL)
+
+#define S_TCP_CSUM    11
+#define V_TCP_CSUM(x) ((x) << S_TCP_CSUM)
+#define F_TCP_CSUM    V_TCP_CSUM(1U)
+
+#define S_UDP_CSUM    12
+#define V_UDP_CSUM(x) ((x) << S_UDP_CSUM)
+#define F_UDP_CSUM    V_UDP_CSUM(1U)
+
+#define S_IP_CSUM    13
+#define V_IP_CSUM(x) ((x) << S_IP_CSUM)
+#define F_IP_CSUM    V_IP_CSUM(1U)
+
+#define S_PATH_MTU    15
+#define V_PATH_MTU(x) ((x) << S_PATH_MTU)
+#define F_PATH_MTU    V_PATH_MTU(1U)
+
+#define S_5TUPLE_LOOKUP    17
+#define V_5TUPLE_LOOKUP(x) ((x) << S_5TUPLE_LOOKUP)
+
+#define S_SYN_COOKIE_PARAMETER    26
+#define V_SYN_COOKIE_PARAMETER(x) ((x) << S_SYN_COOKIE_PARAMETER)
+
+#define A_TP_PC_CONFIG 0x348
+#define S_DIS_TX_FILL_WIN_PUSH    12
+#define V_DIS_TX_FILL_WIN_PUSH(x) ((x) << S_DIS_TX_FILL_WIN_PUSH)
+#define F_DIS_TX_FILL_WIN_PUSH    V_DIS_TX_FILL_WIN_PUSH(1U)
+
+#define S_TP_PC_REV    30
+#define M_TP_PC_REV    0x3
+#define G_TP_PC_REV(x) (((x) >> S_TP_PC_REV) & M_TP_PC_REV)
+#define A_TP_RESET 0x44c
+#define S_TP_RESET    0
+#define V_TP_RESET(x) ((x) << S_TP_RESET)
+#define F_TP_RESET    V_TP_RESET(1U)
+
+#define A_TP_INT_ENABLE 0x470
+#define A_TP_INT_CAUSE 0x474
+#define A_TP_TX_DROP_CONFIG 0x4b8
+
+#define S_ENABLE_TX_DROP    31
+#define V_ENABLE_TX_DROP(x) ((x) << S_ENABLE_TX_DROP)
+#define F_ENABLE_TX_DROP    V_ENABLE_TX_DROP(1U)
+
+#define S_ENABLE_TX_ERROR    30
+#define V_ENABLE_TX_ERROR(x) ((x) << S_ENABLE_TX_ERROR)
+#define F_ENABLE_TX_ERROR    V_ENABLE_TX_ERROR(1U)
+
+#define S_DROP_TICKS_CNT    4
+#define V_DROP_TICKS_CNT(x) ((x) << S_DROP_TICKS_CNT)
+
+#define S_NUM_PKTS_DROPPED    0
+#define V_NUM_PKTS_DROPPED(x) ((x) << S_NUM_PKTS_DROPPED)
+
+/* CSPI registers */
+
+#define S_DIP4ERR    0
+#define V_DIP4ERR(x) ((x) << S_DIP4ERR)
+#define F_DIP4ERR    V_DIP4ERR(1U)
+
+#define S_RXDROP    1
+#define V_RXDROP(x) ((x) << S_RXDROP)
+#define F_RXDROP    V_RXDROP(1U)
+
+#define S_TXDROP    2
+#define V_TXDROP(x) ((x) << S_TXDROP)
+#define F_TXDROP    V_TXDROP(1U)
+
+#define S_RXOVERFLOW    3
+#define V_RXOVERFLOW(x) ((x) << S_RXOVERFLOW)
+#define F_RXOVERFLOW    V_RXOVERFLOW(1U)
+
+#define S_RAMPARITYERR    4
+#define V_RAMPARITYERR(x) ((x) << S_RAMPARITYERR)
+#define F_RAMPARITYERR    V_RAMPARITYERR(1U)
+
+/* ESPI registers */
+
+#define A_ESPI_SCH_TOKEN0 0x880
+#define A_ESPI_SCH_TOKEN1 0x884
+#define A_ESPI_SCH_TOKEN2 0x888
+#define A_ESPI_SCH_TOKEN3 0x88c
+#define A_ESPI_RX_FIFO_ALMOST_EMPTY_WATERMARK 0x890
+#define A_ESPI_RX_FIFO_ALMOST_FULL_WATERMARK 0x894
+#define A_ESPI_CALENDAR_LENGTH 0x898
+#define A_PORT_CONFIG 0x89c
+
+#define S_RX_NPORTS    0
+#define V_RX_NPORTS(x) ((x) << S_RX_NPORTS)
+
+#define S_TX_NPORTS    8
+#define V_TX_NPORTS(x) ((x) << S_TX_NPORTS)
+
+#define A_ESPI_FIFO_STATUS_ENABLE 0x8a0
+
+#define S_RXSTATUSENABLE    0
+#define V_RXSTATUSENABLE(x) ((x) << S_RXSTATUSENABLE)
+#define F_RXSTATUSENABLE    V_RXSTATUSENABLE(1U)
+
+#define S_INTEL1010MODE    4
+#define V_INTEL1010MODE(x) ((x) << S_INTEL1010MODE)
+#define F_INTEL1010MODE    V_INTEL1010MODE(1U)
+
+#define A_ESPI_MAXBURST1_MAXBURST2 0x8a8
+#define A_ESPI_TRAIN 0x8ac
+#define A_ESPI_INTR_STATUS 0x8c8
+
+#define S_DIP2PARITYERR    5
+#define V_DIP2PARITYERR(x) ((x) << S_DIP2PARITYERR)
+#define F_DIP2PARITYERR    V_DIP2PARITYERR(1U)
+
+#define A_ESPI_INTR_ENABLE 0x8cc
+#define A_RX_DROP_THRESHOLD 0x8d0
+#define A_ESPI_RX_RESET 0x8ec
+#define A_ESPI_MISC_CONTROL 0x8f0
+
+#define S_OUT_OF_SYNC_COUNT    0
+#define V_OUT_OF_SYNC_COUNT(x) ((x) << S_OUT_OF_SYNC_COUNT)
+
+#define S_DIP2_PARITY_ERR_THRES    5
+#define V_DIP2_PARITY_ERR_THRES(x) ((x) << S_DIP2_PARITY_ERR_THRES)
+
+#define S_DIP4_THRES    9
+#define V_DIP4_THRES(x) ((x) << S_DIP4_THRES)
+
+#define S_MONITORED_PORT_NUM    25
+#define V_MONITORED_PORT_NUM(x) ((x) << S_MONITORED_PORT_NUM)
+
+#define S_MONITORED_DIRECTION    27
+#define V_MONITORED_DIRECTION(x) ((x) << S_MONITORED_DIRECTION)
+#define F_MONITORED_DIRECTION    V_MONITORED_DIRECTION(1U)
+
+#define S_MONITORED_INTERFACE    28
+#define V_MONITORED_INTERFACE(x) ((x) << S_MONITORED_INTERFACE)
+#define F_MONITORED_INTERFACE    V_MONITORED_INTERFACE(1U)
+
+#define A_ESPI_DIP2_ERR_COUNT 0x8f4
+#define A_ESPI_CMD_ADDR 0x8f8
+
+#define S_WRITE_DATA    0
+#define V_WRITE_DATA(x) ((x) << S_WRITE_DATA)
+
+#define S_REGISTER_OFFSET    8
+#define V_REGISTER_OFFSET(x) ((x) << S_REGISTER_OFFSET)
+
+#define S_CHANNEL_ADDR    12
+#define V_CHANNEL_ADDR(x) ((x) << S_CHANNEL_ADDR)
+
+#define S_MODULE_ADDR    16
+#define V_MODULE_ADDR(x) ((x) << S_MODULE_ADDR)
+
+#define S_BUNDLE_ADDR    20
+#define V_BUNDLE_ADDR(x) ((x) << S_BUNDLE_ADDR)
+
+#define S_SPI4_COMMAND    24
+#define V_SPI4_COMMAND(x) ((x) << S_SPI4_COMMAND)
+
+#define A_ESPI_GOSTAT 0x8fc
+#define S_ESPI_CMD_BUSY    8
+#define V_ESPI_CMD_BUSY(x) ((x) << S_ESPI_CMD_BUSY)
+#define F_ESPI_CMD_BUSY    V_ESPI_CMD_BUSY(1U)
+
+/* PL registers */
+
+#define A_PL_ENABLE 0xa00
+
+#define S_PL_INTR_SGE_ERR    0
+#define V_PL_INTR_SGE_ERR(x) ((x) << S_PL_INTR_SGE_ERR)
+#define F_PL_INTR_SGE_ERR    V_PL_INTR_SGE_ERR(1U)
+
+#define S_PL_INTR_SGE_DATA    1
+#define V_PL_INTR_SGE_DATA(x) ((x) << S_PL_INTR_SGE_DATA)
+#define F_PL_INTR_SGE_DATA    V_PL_INTR_SGE_DATA(1U)
+
+#define S_PL_INTR_TP    6
+#define V_PL_INTR_TP(x) ((x) << S_PL_INTR_TP)
+#define F_PL_INTR_TP    V_PL_INTR_TP(1U)
+
+#define S_PL_INTR_ESPI    8
+#define V_PL_INTR_ESPI(x) ((x) << S_PL_INTR_ESPI)
+#define F_PL_INTR_ESPI    V_PL_INTR_ESPI(1U)
+
+#define S_PL_INTR_PCIX    10
+#define V_PL_INTR_PCIX(x) ((x) << S_PL_INTR_PCIX)
+#define F_PL_INTR_PCIX    V_PL_INTR_PCIX(1U)
+
+#define S_PL_INTR_EXT    11
+#define V_PL_INTR_EXT(x) ((x) << S_PL_INTR_EXT)
+#define F_PL_INTR_EXT    V_PL_INTR_EXT(1U)
+
+#define A_PL_CAUSE 0xa04
+
+/* MC5 registers */
+
+#define A_MC5_CONFIG 0xc04
+
+#define S_TCAM_RESET    1
+#define V_TCAM_RESET(x) ((x) << S_TCAM_RESET)
+#define F_TCAM_RESET    V_TCAM_RESET(1U)
+
+#define S_M_BUS_ENABLE    5
+#define V_M_BUS_ENABLE(x) ((x) << S_M_BUS_ENABLE)
+#define F_M_BUS_ENABLE    V_M_BUS_ENABLE(1U)
+
+/* PCICFG registers */
+
+#define A_PCICFG_PM_CSR 0x44
+#define A_PCICFG_VPD_ADDR 0x4a
+
+#define S_VPD_OP_FLAG    15
+#define V_VPD_OP_FLAG(x) ((x) << S_VPD_OP_FLAG)
+#define F_VPD_OP_FLAG    V_VPD_OP_FLAG(1U)
+
+#define A_PCICFG_VPD_DATA 0x4c
+
+#define A_PCICFG_INTR_ENABLE 0xf4
+#define A_PCICFG_INTR_CAUSE 0xf8
+
+#define A_PCICFG_MODE 0xfc
+
+#define S_PCI_MODE_64BIT    0
+#define V_PCI_MODE_64BIT(x) ((x) << S_PCI_MODE_64BIT)
+#define F_PCI_MODE_64BIT    V_PCI_MODE_64BIT(1U)
+
+#define S_PCI_MODE_PCIX    5
+#define V_PCI_MODE_PCIX(x) ((x) << S_PCI_MODE_PCIX)
+#define F_PCI_MODE_PCIX    V_PCI_MODE_PCIX(1U)
+
+#define S_PCI_MODE_CLK    6
+#define M_PCI_MODE_CLK    0x3
+#define G_PCI_MODE_CLK(x) (((x) >> S_PCI_MODE_CLK) & M_PCI_MODE_CLK)
+
+#endif /* _CXGB_REGS_H_ */
diff --git a/drivers/net/chelsio/sge.c b/drivers/net/chelsio/sge.c
new file mode 100644
index 000000000000..53b41d99b00b
--- /dev/null
+++ b/drivers/net/chelsio/sge.c
@@ -0,0 +1,1684 @@
+/*****************************************************************************
+ *                                                                           *
+ * File: sge.c                                                               *
+ * $Revision: 1.26 $                                                         *
+ * $Date: 2005/06/21 18:29:48 $                                              *
+ * Description:                                                              *
+ *  DMA engine.                                                              *
+ *  part of the Chelsio 10Gb Ethernet Driver.                                *
+ *                                                                           *
+ * This program is free software; you can redistribute it and/or modify      *
+ * it under the terms of the GNU General Public License, version 2, as       *
+ * published by the Free Software Foundation.                                *
+ *                                                                           *
+ * You should have received a copy of the GNU General Public License along   *
+ * with this program; if not, write to the Free Software Foundation, Inc.,   *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
+ *                                                                           *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
+ *                                                                           *
+ * http://www.chelsio.com                                                    *
+ *                                                                           *
+ * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
+ * All rights reserved.                                                      *
+ *                                                                           *
+ * Maintainers: maintainers@chelsio.com                                      *
+ *                                                                           *
+ * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
+ *          Tina Yang               <tainay@chelsio.com>                     *
+ *          Felix Marti             <felix@chelsio.com>                      *
+ *          Scott Bardone           <sbardone@chelsio.com>                   *
+ *          Kurt Ottaway            <kottaway@chelsio.com>                   *
+ *          Frank DiMambro          <frank@chelsio.com>                      *
+ *                                                                           *
+ * History:                                                                  *
+ *                                                                           *
+ ****************************************************************************/
+
+#include "common.h"
+
+#include <linux/config.h>
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/pci.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/if_vlan.h>
+#include <linux/skbuff.h>
+#include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/ip.h>
+#include <linux/in.h>
+#include <linux/if_arp.h>
+
+#include "cpl5_cmd.h"
+#include "sge.h"
+#include "regs.h"
+#include "espi.h"
+
+
+#ifdef NETIF_F_TSO
+#include <linux/tcp.h>
+#endif
+
+#define SGE_CMDQ_N              2
+#define SGE_FREELQ_N            2
+#define SGE_CMDQ0_E_N           1024
+#define SGE_CMDQ1_E_N           128
+#define SGE_FREEL_SIZE          4096
+#define SGE_JUMBO_FREEL_SIZE    512
+#define SGE_FREEL_REFILL_THRESH 16
+#define SGE_RESPQ_E_N           1024
+#define SGE_INTRTIMER_NRES      1000
+#define SGE_RX_COPY_THRES       256
+#define SGE_RX_SM_BUF_SIZE      1536
+
+# define SGE_RX_DROP_THRES 2
+
+#define SGE_RESPQ_REPLENISH_THRES (SGE_RESPQ_E_N / 4)
+
+/*
+ * Period of the TX buffer reclaim timer.  This timer does not need to run
+ * frequently as TX buffers are usually reclaimed by new TX packets.
+ */
+#define TX_RECLAIM_PERIOD (HZ / 4)
+
+#ifndef NET_IP_ALIGN
+# define NET_IP_ALIGN 2
+#endif
+
+#define M_CMD_LEN       0x7fffffff
+#define V_CMD_LEN(v)    (v)
+#define G_CMD_LEN(v)    ((v) & M_CMD_LEN)
+#define V_CMD_GEN1(v)   ((v) << 31)
+#define V_CMD_GEN2(v)   (v)
+#define F_CMD_DATAVALID (1 << 1)
+#define F_CMD_SOP       (1 << 2)
+#define V_CMD_EOP(v)    ((v) << 3)
+
+/*
+ * Command queue, receive buffer list, and response queue descriptors.
+ */
+#if defined(__BIG_ENDIAN_BITFIELD)
+struct cmdQ_e {
+        u32 addr_lo;
+        u32 len_gen;
+        u32 flags;
+        u32 addr_hi;
+};
+
+struct freelQ_e {
+        u32 addr_lo;
+        u32 len_gen;
+        u32 gen2;
+        u32 addr_hi;
+};
+
+struct respQ_e {
+        u32 Qsleeping           : 4;
+        u32 Cmdq1CreditReturn   : 5;
+        u32 Cmdq1DmaComplete    : 5;
+        u32 Cmdq0CreditReturn   : 5;
+        u32 Cmdq0DmaComplete    : 5;
+        u32 FreelistQid         : 2;
+        u32 CreditValid         : 1;
+        u32 DataValid           : 1;
+        u32 Offload             : 1;
+        u32 Eop                 : 1;
+        u32 Sop                 : 1;
+        u32 GenerationBit       : 1;
+        u32 BufferLength;
+};
+#elif defined(__LITTLE_ENDIAN_BITFIELD)
+struct cmdQ_e {
+        u32 len_gen;
+        u32 addr_lo;
+        u32 addr_hi;
+        u32 flags;
+};
+
+struct freelQ_e {
+        u32 len_gen;
+        u32 addr_lo;
+        u32 addr_hi;
+        u32 gen2;
+};
+
+struct respQ_e {
+        u32 BufferLength;
+        u32 GenerationBit       : 1;
+        u32 Sop                 : 1;
+        u32 Eop                 : 1;
+        u32 Offload             : 1;
+        u32 DataValid           : 1;
+        u32 CreditValid         : 1;
+        u32 FreelistQid         : 2;
+        u32 Cmdq0DmaComplete    : 5;
+        u32 Cmdq0CreditReturn   : 5;
+        u32 Cmdq1DmaComplete    : 5;
+        u32 Cmdq1CreditReturn   : 5;
+        u32 Qsleeping           : 4;
+} ;
+#endif
+
+/*
+ * SW Context Command and Freelist Queue Descriptors
+ */
+struct cmdQ_ce {
+        struct sk_buff *skb;
+        DECLARE_PCI_UNMAP_ADDR(dma_addr);
+        DECLARE_PCI_UNMAP_LEN(dma_len);
+};
+
+struct freelQ_ce {
+        struct sk_buff *skb;
+        DECLARE_PCI_UNMAP_ADDR(dma_addr);
+        DECLARE_PCI_UNMAP_LEN(dma_len);
+};
+
+/*
+ * SW command, freelist and response rings
+ */
+struct cmdQ {
+        unsigned long   status;         /* HW DMA fetch status */
+        unsigned int    in_use;         /* # of in-use command descriptors */
+        unsigned int    size;           /* # of descriptors */
+        unsigned int    processed;      /* total # of descs HW has processed */
+        unsigned int    cleaned;        /* total # of descs SW has reclaimed */
+        unsigned int    stop_thres;     /* SW TX queue suspend threshold */
+        u16             pidx;           /* producer index (SW) */
+        u16             cidx;           /* consumer index (HW) */
+        u8              genbit;         /* current generation (=valid) bit */
+        u8              sop;            /* is next entry start of packet? */
+        struct cmdQ_e  *entries;        /* HW command descriptor Q */
+        struct cmdQ_ce *centries;       /* SW command context descriptor Q */
+        spinlock_t      lock;           /* Lock to protect cmdQ enqueuing */
+        dma_addr_t      dma_addr;       /* DMA addr HW command descriptor Q */
+};
+
+struct freelQ {
+        unsigned int    credits;        /* # of available RX buffers */
+        unsigned int    size;           /* free list capacity */
+        u16             pidx;           /* producer index (SW) */
+        u16             cidx;           /* consumer index (HW) */
+        u16             rx_buffer_size; /* Buffer size on this free list */
+        u16             dma_offset;     /* DMA offset to align IP headers */
+        u16             recycleq_idx;   /* skb recycle q to use */
+        u8              genbit;         /* current generation (=valid) bit */
+        struct freelQ_e *entries;       /* HW freelist descriptor Q */
+        struct freelQ_ce *centries;     /* SW freelist context descriptor Q */
+        dma_addr_t      dma_addr;       /* DMA addr HW freelist descriptor Q */
+};
+
+struct respQ {
+        unsigned int    credits;        /* credits to be returned to SGE */
+        unsigned int    size;           /* # of response Q descriptors */
+        u16             cidx;           /* consumer index (SW) */
+        u8              genbit;         /* current generation(=valid) bit */
+        struct respQ_e *entries;        /* HW response descriptor Q */
+        dma_addr_t      dma_addr;       /* DMA addr HW response descriptor Q */
+};
+
+/* Bit flags for cmdQ.status */
+enum {
+        CMDQ_STAT_RUNNING = 1,          /* fetch engine is running */
+        CMDQ_STAT_LAST_PKT_DB = 2       /* last packet rung the doorbell */
+};
+
+/*
+ * Main SGE data structure
+ *
+ * Interrupts are handled by a single CPU and it is likely that on a MP system
+ * the application is migrated to another CPU. In that scenario, we try to
+ * seperate the RX(in irq context) and TX state in order to decrease memory
+ * contention.
+ */
+struct sge {
+        struct adapter *adapter;        /* adapter backpointer */
+        struct net_device *netdev;      /* netdevice backpointer */
+        struct freelQ   freelQ[SGE_FREELQ_N]; /* buffer free lists */
+        struct respQ    respQ;          /* response Q */
+        unsigned long   stopped_tx_queues; /* bitmap of suspended Tx queues */
+        unsigned int    rx_pkt_pad;     /* RX padding for L2 packets */
+        unsigned int    jumbo_fl;       /* jumbo freelist Q index */
+        unsigned int    intrtimer_nres; /* no-resource interrupt timer */
+        unsigned int    fixed_intrtimer;/* non-adaptive interrupt timer */
+        struct timer_list tx_reclaim_timer; /* reclaims TX buffers */
+        struct timer_list espibug_timer;
+        unsigned int    espibug_timeout;
+        struct sk_buff  *espibug_skb;
+        u32             sge_control;    /* shadow value of sge control reg */
+        struct sge_intr_counts stats;
+        struct sge_port_stats port_stats[MAX_NPORTS];
+        struct cmdQ cmdQ[SGE_CMDQ_N] ____cacheline_aligned_in_smp;
+};
+
+/*
+ * PIO to indicate that memory mapped Q contains valid descriptor(s).
+ */
+static inline void doorbell_pio(struct adapter *adapter, u32 val)
+{
+        wmb();
+        writel(val, adapter->regs + A_SG_DOORBELL);
+}
+
+/*
+ * Frees all RX buffers on the freelist Q. The caller must make sure that
+ * the SGE is turned off before calling this function.
+ */
+static void free_freelQ_buffers(struct pci_dev *pdev, struct freelQ *q)
+{
+        unsigned int cidx = q->cidx;
+
+        while (q->credits--) {
+                struct freelQ_ce *ce = &q->centries[cidx];
+
+                pci_unmap_single(pdev, pci_unmap_addr(ce, dma_addr),
+                                 pci_unmap_len(ce, dma_len),
+                                 PCI_DMA_FROMDEVICE);
+                dev_kfree_skb(ce->skb);
+                ce->skb = NULL;
+                if (++cidx == q->size)
+                        cidx = 0;
+        }
+}
+
+/*
+ * Free RX free list and response queue resources.
+ */
+static void free_rx_resources(struct sge *sge)
+{
+        struct pci_dev *pdev = sge->adapter->pdev;
+        unsigned int size, i;
+
+        if (sge->respQ.entries) {
+                size = sizeof(struct respQ_e) * sge->respQ.size;
+                pci_free_consistent(pdev, size, sge->respQ.entries,
+                                    sge->respQ.dma_addr);
+        }
+
+        for (i = 0; i < SGE_FREELQ_N; i++) {
+                struct freelQ *q = &sge->freelQ[i];
+
+                if (q->centries) {
+                        free_freelQ_buffers(pdev, q);
+                        kfree(q->centries);
+                }
+                if (q->entries) {
+                        size = sizeof(struct freelQ_e) * q->size;
+                        pci_free_consistent(pdev, size, q->entries,
+                                            q->dma_addr);
+                }
+        }
+}
+
+/*
+ * Allocates basic RX resources, consisting of memory mapped freelist Qs and a
+ * response queue.
+ */
+static int alloc_rx_resources(struct sge *sge, struct sge_params *p)
+{
+        struct pci_dev *pdev = sge->adapter->pdev;
+        unsigned int size, i;
+
+        for (i = 0; i < SGE_FREELQ_N; i++) {
+                struct freelQ *q = &sge->freelQ[i];
+
+                q->genbit = 1;
+                q->size = p->freelQ_size[i];
+                q->dma_offset = sge->rx_pkt_pad ? 0 : NET_IP_ALIGN;
+                size = sizeof(struct freelQ_e) * q->size;
+                q->entries = (struct freelQ_e *)
+                              pci_alloc_consistent(pdev, size, &q->dma_addr);
+                if (!q->entries)
+                        goto err_no_mem;
+                memset(q->entries, 0, size);
+                size = sizeof(struct freelQ_ce) * q->size;
+                q->centries = kmalloc(size, GFP_KERNEL);
+                if (!q->centries)
+                        goto err_no_mem;
+                memset(q->centries, 0, size);
+        }
+
+        /*
+         * Calculate the buffer sizes for the two free lists.  FL0 accommodates
+         * regular sized Ethernet frames, FL1 is sized not to exceed 16K,
+         * including all the sk_buff overhead.
+         *
+         * Note: For T2 FL0 and FL1 are reversed.
+         */
+        sge->freelQ[!sge->jumbo_fl].rx_buffer_size = SGE_RX_SM_BUF_SIZE +
+                sizeof(struct cpl_rx_data) +
+                sge->freelQ[!sge->jumbo_fl].dma_offset;
+        sge->freelQ[sge->jumbo_fl].rx_buffer_size = (16 * 1024) -
+                SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+
+        /*
+         * Setup which skb recycle Q should be used when recycling buffers from
+         * each free list.
+         */
+        sge->freelQ[!sge->jumbo_fl].recycleq_idx = 0;
+        sge->freelQ[sge->jumbo_fl].recycleq_idx = 1;
+
+        sge->respQ.genbit = 1;
+        sge->respQ.size = SGE_RESPQ_E_N;
+        sge->respQ.credits = 0;
+        size = sizeof(struct respQ_e) * sge->respQ.size;
+        sge->respQ.entries = (struct respQ_e *)
+                pci_alloc_consistent(pdev, size, &sge->respQ.dma_addr);
+        if (!sge->respQ.entries)
+                goto err_no_mem;
+        memset(sge->respQ.entries, 0, size);
+        return 0;
+
+err_no_mem:
+        free_rx_resources(sge);
+        return -ENOMEM;
+}
+
+/*
+ * Reclaims n TX descriptors and frees the buffers associated with them.
+ */
+static void free_cmdQ_buffers(struct sge *sge, struct cmdQ *q, unsigned int n)
+{
+        struct cmdQ_ce *ce;
+        struct pci_dev *pdev = sge->adapter->pdev;
+        unsigned int cidx = q->cidx;
+
+        q->in_use -= n;
+        ce = &q->centries[cidx];
+        while (n--) {
+                if (q->sop)
+                        pci_unmap_single(pdev, pci_unmap_addr(ce, dma_addr),
+                                         pci_unmap_len(ce, dma_len),
+                                         PCI_DMA_TODEVICE);
+                else
+                        pci_unmap_page(pdev, pci_unmap_addr(ce, dma_addr),
+                                       pci_unmap_len(ce, dma_len),
+                                       PCI_DMA_TODEVICE);
+                q->sop = 0;
+                if (ce->skb) {
+                        dev_kfree_skb(ce->skb);
+                        q->sop = 1;
+                }
+                ce++;
+                if (++cidx == q->size) {
+                        cidx = 0;
+                        ce = q->centries;
+                }
+        }
+        q->cidx = cidx;
+}
+
+/*
+ * Free TX resources.
+ *
+ * Assumes that SGE is stopped and all interrupts are disabled.
+ */
+static void free_tx_resources(struct sge *sge)
+{
+        struct pci_dev *pdev = sge->adapter->pdev;
+        unsigned int size, i;
+
+        for (i = 0; i < SGE_CMDQ_N; i++) {
+                struct cmdQ *q = &sge->cmdQ[i];
+
+                if (q->centries) {
+                        if (q->in_use)
+                                free_cmdQ_buffers(sge, q, q->in_use);
+                        kfree(q->centries);
+                }
+                if (q->entries) {
+                        size = sizeof(struct cmdQ_e) * q->size;
+                        pci_free_consistent(pdev, size, q->entries,
+                                            q->dma_addr);
+                }
+        }
+}
+
+/*
+ * Allocates basic TX resources, consisting of memory mapped command Qs.
+ */
+static int alloc_tx_resources(struct sge *sge, struct sge_params *p)
+{
+        struct pci_dev *pdev = sge->adapter->pdev;
+        unsigned int size, i;
+
+        for (i = 0; i < SGE_CMDQ_N; i++) {
+                struct cmdQ *q = &sge->cmdQ[i];
+
+                q->genbit = 1;
+                q->sop = 1;
+                q->size = p->cmdQ_size[i];
+                q->in_use = 0;
+                q->status = 0;
+                q->processed = q->cleaned = 0;
+                q->stop_thres = 0;
+                spin_lock_init(&q->lock);
+                size = sizeof(struct cmdQ_e) * q->size;
+                q->entries = (struct cmdQ_e *)
+                              pci_alloc_consistent(pdev, size, &q->dma_addr);
+                if (!q->entries)
+                        goto err_no_mem;
+                memset(q->entries, 0, size);
+                size = sizeof(struct cmdQ_ce) * q->size;
+                q->centries = kmalloc(size, GFP_KERNEL);
+                if (!q->centries)
+                        goto err_no_mem;
+                memset(q->centries, 0, size);
+        }
+
+        /*
+         * CommandQ 0 handles Ethernet and TOE packets, while queue 1 is TOE
+         * only.  For queue 0 set the stop threshold so we can handle one more
+         * packet from each port, plus reserve an additional 24 entries for
+         * Ethernet packets only.  Queue 1 never suspends nor do we reserve
+         * space for Ethernet packets.
+         */
+        sge->cmdQ[0].stop_thres = sge->adapter->params.nports *
+                (MAX_SKB_FRAGS + 1);
+        return 0;
+
+err_no_mem:
+        free_tx_resources(sge);
+        return -ENOMEM;
+}
+
+static inline void setup_ring_params(struct adapter *adapter, u64 addr,
+                                     u32 size, int base_reg_lo,
+                                     int base_reg_hi, int size_reg)
+{
+        writel((u32)addr, adapter->regs + base_reg_lo);
+        writel(addr >> 32, adapter->regs + base_reg_hi);
+        writel(size, adapter->regs + size_reg);
+}
+
+/*
+ * Enable/disable VLAN acceleration.
+ */
+void t1_set_vlan_accel(struct adapter *adapter, int on_off)
+{
+        struct sge *sge = adapter->sge;
+
+        sge->sge_control &= ~F_VLAN_XTRACT;
+        if (on_off)
+                sge->sge_control |= F_VLAN_XTRACT;
+        if (adapter->open_device_map) {
+                writel(sge->sge_control, adapter->regs + A_SG_CONTROL);
+                readl(adapter->regs + A_SG_CONTROL); /* flush */
+        }
+}
+
+/*
+ * Programs the various SGE registers. However, the engine is not yet enabled,
+ * but sge->sge_control is setup and ready to go.
+ */
+static void configure_sge(struct sge *sge, struct sge_params *p)
+{
+        struct adapter *ap = sge->adapter;
+        
+        writel(0, ap->regs + A_SG_CONTROL);
+        setup_ring_params(ap, sge->cmdQ[0].dma_addr, sge->cmdQ[0].size,
+                          A_SG_CMD0BASELWR, A_SG_CMD0BASEUPR, A_SG_CMD0SIZE);
+        setup_ring_params(ap, sge->cmdQ[1].dma_addr, sge->cmdQ[1].size,
+                          A_SG_CMD1BASELWR, A_SG_CMD1BASEUPR, A_SG_CMD1SIZE);
+        setup_ring_params(ap, sge->freelQ[0].dma_addr,
+                          sge->freelQ[0].size, A_SG_FL0BASELWR,
+                          A_SG_FL0BASEUPR, A_SG_FL0SIZE);
+        setup_ring_params(ap, sge->freelQ[1].dma_addr,
+                          sge->freelQ[1].size, A_SG_FL1BASELWR,
+                          A_SG_FL1BASEUPR, A_SG_FL1SIZE);
+
+        /* The threshold comparison uses <. */
+        writel(SGE_RX_SM_BUF_SIZE + 1, ap->regs + A_SG_FLTHRESHOLD);
+
+        setup_ring_params(ap, sge->respQ.dma_addr, sge->respQ.size,
+                          A_SG_RSPBASELWR, A_SG_RSPBASEUPR, A_SG_RSPSIZE);
+        writel((u32)sge->respQ.size - 1, ap->regs + A_SG_RSPQUEUECREDIT);
+
+        sge->sge_control = F_CMDQ0_ENABLE | F_CMDQ1_ENABLE | F_FL0_ENABLE |
+                F_FL1_ENABLE | F_CPL_ENABLE | F_RESPONSE_QUEUE_ENABLE |
+                V_CMDQ_PRIORITY(2) | F_DISABLE_CMDQ1_GTS | F_ISCSI_COALESCE |
+                F_DISABLE_FL0_GTS | F_DISABLE_FL1_GTS |
+                V_RX_PKT_OFFSET(sge->rx_pkt_pad);
+
+#if defined(__BIG_ENDIAN_BITFIELD)
+        sge->sge_control |= F_ENABLE_BIG_ENDIAN;
+#endif
+
+        /* Initialize no-resource timer */
+        sge->intrtimer_nres = SGE_INTRTIMER_NRES * core_ticks_per_usec(ap);
+
+        t1_sge_set_coalesce_params(sge, p);
+}
+
+/*
+ * Return the payload capacity of the jumbo free-list buffers.
+ */
+static inline unsigned int jumbo_payload_capacity(const struct sge *sge)
+{
+        return sge->freelQ[sge->jumbo_fl].rx_buffer_size -
+                sge->freelQ[sge->jumbo_fl].dma_offset -
+                sizeof(struct cpl_rx_data);
+}
+
+/*
+ * Frees all SGE related resources and the sge structure itself
+ */
+void t1_sge_destroy(struct sge *sge)
+{
+        if (sge->espibug_skb)
+                kfree_skb(sge->espibug_skb);
+
+        free_tx_resources(sge);
+        free_rx_resources(sge);
+        kfree(sge);
+}
+
+/*
+ * Allocates new RX buffers on the freelist Q (and tracks them on the freelist
+ * context Q) until the Q is full or alloc_skb fails.
+ *
+ * It is possible that the generation bits already match, indicating that the
+ * buffer is already valid and nothing needs to be done. This happens when we
+ * copied a received buffer into a new sk_buff during the interrupt processing.
+ *
+ * If the SGE doesn't automatically align packets properly (!sge->rx_pkt_pad),
+ * we specify a RX_OFFSET in order to make sure that the IP header is 4B
+ * aligned.
+ */
+static void refill_free_list(struct sge *sge, struct freelQ *q)
+{
+        struct pci_dev *pdev = sge->adapter->pdev;
+        struct freelQ_ce *ce = &q->centries[q->pidx];
+        struct freelQ_e *e = &q->entries[q->pidx];
+        unsigned int dma_len = q->rx_buffer_size - q->dma_offset;
+
+
+        while (q->credits < q->size) {
+                struct sk_buff *skb;
+                dma_addr_t mapping;
+
+                skb = alloc_skb(q->rx_buffer_size, GFP_ATOMIC);
+                if (!skb)
+                        break;
+
+                skb_reserve(skb, q->dma_offset);
+                mapping = pci_map_single(pdev, skb->data, dma_len,
+                                         PCI_DMA_FROMDEVICE);
+                ce->skb = skb;
+                pci_unmap_addr_set(ce, dma_addr, mapping);
+                pci_unmap_len_set(ce, dma_len, dma_len);
+                e->addr_lo = (u32)mapping;
+                e->addr_hi = (u64)mapping >> 32;
+                e->len_gen = V_CMD_LEN(dma_len) | V_CMD_GEN1(q->genbit);
+                wmb();
+                e->gen2 = V_CMD_GEN2(q->genbit);
+
+                e++;
+                ce++;
+                if (++q->pidx == q->size) {
+                        q->pidx = 0;
+                        q->genbit ^= 1;
+                        ce = q->centries;
+                        e = q->entries;
+                }
+                q->credits++;
+        }
+
+}
+
+/*
+ * Calls refill_free_list for both free lists. If we cannot fill at least 1/4
+ * of both rings, we go into 'few interrupt mode' in order to give the system
+ * time to free up resources.
+ */
+static void freelQs_empty(struct sge *sge)
+{
+        struct adapter *adapter = sge->adapter;
+        u32 irq_reg = readl(adapter->regs + A_SG_INT_ENABLE);
+        u32 irqholdoff_reg;
+
+        refill_free_list(sge, &sge->freelQ[0]);
+        refill_free_list(sge, &sge->freelQ[1]);
+
+        if (sge->freelQ[0].credits > (sge->freelQ[0].size >> 2) &&
+            sge->freelQ[1].credits > (sge->freelQ[1].size >> 2)) {
+                irq_reg |= F_FL_EXHAUSTED;
+                irqholdoff_reg = sge->fixed_intrtimer;
+        } else {
+                /* Clear the F_FL_EXHAUSTED interrupts for now */
+                irq_reg &= ~F_FL_EXHAUSTED;
+                irqholdoff_reg = sge->intrtimer_nres;
+        }
+        writel(irqholdoff_reg, adapter->regs + A_SG_INTRTIMER);
+        writel(irq_reg, adapter->regs + A_SG_INT_ENABLE);
+
+        /* We reenable the Qs to force a freelist GTS interrupt later */
+        doorbell_pio(adapter, F_FL0_ENABLE | F_FL1_ENABLE);
+}
+
+#define SGE_PL_INTR_MASK (F_PL_INTR_SGE_ERR | F_PL_INTR_SGE_DATA)
+#define SGE_INT_FATAL (F_RESPQ_OVERFLOW | F_PACKET_TOO_BIG | F_PACKET_MISMATCH)
+#define SGE_INT_ENABLE (F_RESPQ_EXHAUSTED | F_RESPQ_OVERFLOW | \
+                        F_FL_EXHAUSTED | F_PACKET_TOO_BIG | F_PACKET_MISMATCH)
+
+/*
+ * Disable SGE Interrupts
+ */
+void t1_sge_intr_disable(struct sge *sge)
+{
+        u32 val = readl(sge->adapter->regs + A_PL_ENABLE);
+
+        writel(val & ~SGE_PL_INTR_MASK, sge->adapter->regs + A_PL_ENABLE);
+        writel(0, sge->adapter->regs + A_SG_INT_ENABLE);
+}
+
+/*
+ * Enable SGE interrupts.
+ */
+void t1_sge_intr_enable(struct sge *sge)
+{
+        u32 en = SGE_INT_ENABLE;
+        u32 val = readl(sge->adapter->regs + A_PL_ENABLE);
+
+        if (sge->adapter->flags & TSO_CAPABLE)
+                en &= ~F_PACKET_TOO_BIG;
+        writel(en, sge->adapter->regs + A_SG_INT_ENABLE);
+        writel(val | SGE_PL_INTR_MASK, sge->adapter->regs + A_PL_ENABLE);
+}
+
+/*
+ * Clear SGE interrupts.
+ */
+void t1_sge_intr_clear(struct sge *sge)
+{
+        writel(SGE_PL_INTR_MASK, sge->adapter->regs + A_PL_CAUSE);
+        writel(0xffffffff, sge->adapter->regs + A_SG_INT_CAUSE);
+}
+
+/*
+ * SGE 'Error' interrupt handler
+ */
+int t1_sge_intr_error_handler(struct sge *sge)
+{
+        struct adapter *adapter = sge->adapter;
+        u32 cause = readl(adapter->regs + A_SG_INT_CAUSE);
+
+        if (adapter->flags & TSO_CAPABLE)
+                cause &= ~F_PACKET_TOO_BIG;
+        if (cause & F_RESPQ_EXHAUSTED)
+                sge->stats.respQ_empty++;
+        if (cause & F_RESPQ_OVERFLOW) {
+                sge->stats.respQ_overflow++;
+                CH_ALERT("%s: SGE response queue overflow\n",
+                         adapter->name);
+        }
+        if (cause & F_FL_EXHAUSTED) {
+                sge->stats.freelistQ_empty++;
+                freelQs_empty(sge);
+        }
+        if (cause & F_PACKET_TOO_BIG) {
+                sge->stats.pkt_too_big++;
+                CH_ALERT("%s: SGE max packet size exceeded\n",
+                         adapter->name);
+        }
+        if (cause & F_PACKET_MISMATCH) {
+                sge->stats.pkt_mismatch++;
+                CH_ALERT("%s: SGE packet mismatch\n", adapter->name);
+        }
+        if (cause & SGE_INT_FATAL)
+                t1_fatal_err(adapter);
+
+        writel(cause, adapter->regs + A_SG_INT_CAUSE);
+        return 0;
+}
+
+const struct sge_intr_counts *t1_sge_get_intr_counts(struct sge *sge)
+{
+        return &sge->stats;
+}
+
+const struct sge_port_stats *t1_sge_get_port_stats(struct sge *sge, int port)
+{
+        return &sge->port_stats[port];
+}
+
+/**
+ *      recycle_fl_buf - recycle a free list buffer
+ *      @fl: the free list
+ *      @idx: index of buffer to recycle
+ *
+ *      Recycles the specified buffer on the given free list by adding it at
+ *      the next available slot on the list.
+ */
+static void recycle_fl_buf(struct freelQ *fl, int idx)
+{
+        struct freelQ_e *from = &fl->entries[idx];
+        struct freelQ_e *to = &fl->entries[fl->pidx];
+
+        fl->centries[fl->pidx] = fl->centries[idx];
+        to->addr_lo = from->addr_lo;
+        to->addr_hi = from->addr_hi;
+        to->len_gen = G_CMD_LEN(from->len_gen) | V_CMD_GEN1(fl->genbit);
+        wmb();
+        to->gen2 = V_CMD_GEN2(fl->genbit);
+        fl->credits++;
+
+        if (++fl->pidx == fl->size) {
+                fl->pidx = 0;
+                fl->genbit ^= 1;
+        }
+}
+
+/**
+ *      get_packet - return the next ingress packet buffer
+ *      @pdev: the PCI device that received the packet
+ *      @fl: the SGE free list holding the packet
+ *      @len: the actual packet length, excluding any SGE padding
+ *      @dma_pad: padding at beginning of buffer left by SGE DMA
+ *      @skb_pad: padding to be used if the packet is copied
+ *      @copy_thres: length threshold under which a packet should be copied
+ *      @drop_thres: # of remaining buffers before we start dropping packets
+ *
+ *      Get the next packet from a free list and complete setup of the
+ *      sk_buff.  If the packet is small we make a copy and recycle the
+ *      original buffer, otherwise we use the original buffer itself.  If a
+ *      positive drop threshold is supplied packets are dropped and their
+ *      buffers recycled if (a) the number of remaining buffers is under the
+ *      threshold and the packet is too big to copy, or (b) the packet should
+ *      be copied but there is no memory for the copy.
+ */
+static inline struct sk_buff *get_packet(struct pci_dev *pdev,
+                                         struct freelQ *fl, unsigned int len,
+                                         int dma_pad, int skb_pad,
+                                         unsigned int copy_thres,
+                                         unsigned int drop_thres)
+{
+        struct sk_buff *skb;
+        struct freelQ_ce *ce = &fl->centries[fl->cidx];
+
+        if (len < copy_thres) {
+                skb = alloc_skb(len + skb_pad, GFP_ATOMIC);
+                if (likely(skb != NULL)) {
+                        skb_reserve(skb, skb_pad);
+                        skb_put(skb, len);
+                        pci_dma_sync_single_for_cpu(pdev,
+                                            pci_unmap_addr(ce, dma_addr),
+                                            pci_unmap_len(ce, dma_len),
+                                            PCI_DMA_FROMDEVICE);
+                        memcpy(skb->data, ce->skb->data + dma_pad, len);
+                        pci_dma_sync_single_for_device(pdev,
+                                            pci_unmap_addr(ce, dma_addr),
+                                            pci_unmap_len(ce, dma_len),
+                                            PCI_DMA_FROMDEVICE);
+                } else if (!drop_thres)
+                        goto use_orig_buf;
+
+                recycle_fl_buf(fl, fl->cidx);
+                return skb;
+        }
+
+        if (fl->credits < drop_thres) {
+                recycle_fl_buf(fl, fl->cidx);
+                return NULL;
+        }
+
+use_orig_buf:
+        pci_unmap_single(pdev, pci_unmap_addr(ce, dma_addr),
+                         pci_unmap_len(ce, dma_len), PCI_DMA_FROMDEVICE);
+        skb = ce->skb;
+        skb_reserve(skb, dma_pad);
+        skb_put(skb, len);
+        return skb;
+}
+
+/**
+ *      unexpected_offload - handle an unexpected offload packet
+ *      @adapter: the adapter
+ *      @fl: the free list that received the packet
+ *
+ *      Called when we receive an unexpected offload packet (e.g., the TOE
+ *      function is disabled or the card is a NIC).  Prints a message and
+ *      recycles the buffer.
+ */
+static void unexpected_offload(struct adapter *adapter, struct freelQ *fl)
+{
+        struct freelQ_ce *ce = &fl->centries[fl->cidx];
+        struct sk_buff *skb = ce->skb;
+
+        pci_dma_sync_single_for_cpu(adapter->pdev, pci_unmap_addr(ce, dma_addr),
+                            pci_unmap_len(ce, dma_len), PCI_DMA_FROMDEVICE);
+        CH_ERR("%s: unexpected offload packet, cmd %u\n",
+               adapter->name, *skb->data);
+        recycle_fl_buf(fl, fl->cidx);
+}
+
+/*
+ * Write the command descriptors to transmit the given skb starting at
+ * descriptor pidx with the given generation.
+ */
+static inline void write_tx_descs(struct adapter *adapter, struct sk_buff *skb,
+                                  unsigned int pidx, unsigned int gen,
+                                  struct cmdQ *q)
+{
+        dma_addr_t mapping;
+        struct cmdQ_e *e, *e1;
+        struct cmdQ_ce *ce;
+        unsigned int i, flags, nfrags = skb_shinfo(skb)->nr_frags;
+
+        mapping = pci_map_single(adapter->pdev, skb->data,
+                                 skb->len - skb->data_len, PCI_DMA_TODEVICE);
+        ce = &q->centries[pidx];
+        ce->skb = NULL;
+        pci_unmap_addr_set(ce, dma_addr, mapping);
+        pci_unmap_len_set(ce, dma_len, skb->len - skb->data_len);
+
+        flags = F_CMD_DATAVALID | F_CMD_SOP | V_CMD_EOP(nfrags == 0) |
+                V_CMD_GEN2(gen);
+        e = &q->entries[pidx];
+        e->addr_lo = (u32)mapping;
+        e->addr_hi = (u64)mapping >> 32;
+        e->len_gen = V_CMD_LEN(skb->len - skb->data_len) | V_CMD_GEN1(gen);
+        for (e1 = e, i = 0; nfrags--; i++) {
+                skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+
+                ce++;
+                e1++;
+                if (++pidx == q->size) {
+                        pidx = 0;
+                        gen ^= 1;
+                        ce = q->centries;
+                        e1 = q->entries;
+                }
+
+                mapping = pci_map_page(adapter->pdev, frag->page,
+                                       frag->page_offset, frag->size,
+                                       PCI_DMA_TODEVICE);
+                ce->skb = NULL;
+                pci_unmap_addr_set(ce, dma_addr, mapping);
+                pci_unmap_len_set(ce, dma_len, frag->size);
+
+                e1->addr_lo = (u32)mapping;
+                e1->addr_hi = (u64)mapping >> 32;
+                e1->len_gen = V_CMD_LEN(frag->size) | V_CMD_GEN1(gen);
+                e1->flags = F_CMD_DATAVALID | V_CMD_EOP(nfrags == 0) |
+                            V_CMD_GEN2(gen);
+        }
+
+        ce->skb = skb;
+        wmb();
+        e->flags = flags;
+}
+
+/*
+ * Clean up completed Tx buffers.
+ */
+static inline void reclaim_completed_tx(struct sge *sge, struct cmdQ *q)
+{
+        unsigned int reclaim = q->processed - q->cleaned;
+
+        if (reclaim) {
+                free_cmdQ_buffers(sge, q, reclaim);
+                q->cleaned += reclaim;
+        }
+}
+
+#ifndef SET_ETHTOOL_OPS
+# define __netif_rx_complete(dev) netif_rx_complete(dev)
+#endif
+
+/*
+ * We cannot use the standard netif_rx_schedule_prep() because we have multiple
+ * ports plus the TOE all multiplexing onto a single response queue, therefore
+ * accepting new responses cannot depend on the state of any particular port.
+ * So define our own equivalent that omits the netif_running() test.
+ */
+static inline int napi_schedule_prep(struct net_device *dev)
+{
+        return !test_and_set_bit(__LINK_STATE_RX_SCHED, &dev->state);
+}
+
+
+/**
+ *      sge_rx - process an ingress ethernet packet
+ *      @sge: the sge structure
+ *      @fl: the free list that contains the packet buffer
+ *      @len: the packet length
+ *
+ *      Process an ingress ethernet pakcet and deliver it to the stack.
+ */
+static int sge_rx(struct sge *sge, struct freelQ *fl, unsigned int len)
+{
+        struct sk_buff *skb;
+        struct cpl_rx_pkt *p;
+        struct adapter *adapter = sge->adapter;
+
+        sge->stats.ethernet_pkts++;
+        skb = get_packet(adapter->pdev, fl, len - sge->rx_pkt_pad,
+                         sge->rx_pkt_pad, 2, SGE_RX_COPY_THRES,
+                         SGE_RX_DROP_THRES);
+        if (!skb) {
+                sge->port_stats[0].rx_drops++; /* charge only port 0 for now */
+                return 0;
+        }
+
+        p = (struct cpl_rx_pkt *)skb->data;
+        skb_pull(skb, sizeof(*p));
+        skb->dev = adapter->port[p->iff].dev;
+        skb->dev->last_rx = jiffies;
+        skb->protocol = eth_type_trans(skb, skb->dev);
+        if ((adapter->flags & RX_CSUM_ENABLED) && p->csum == 0xffff &&
+            skb->protocol == htons(ETH_P_IP) &&
+            (skb->data[9] == IPPROTO_TCP || skb->data[9] == IPPROTO_UDP)) {
+                sge->port_stats[p->iff].rx_cso_good++;
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+        } else
+                skb->ip_summed = CHECKSUM_NONE;
+
+        if (unlikely(adapter->vlan_grp && p->vlan_valid)) {
+                sge->port_stats[p->iff].vlan_xtract++;
+                if (adapter->params.sge.polling)
+                        vlan_hwaccel_receive_skb(skb, adapter->vlan_grp,
+                                                 ntohs(p->vlan));
+                else
+                        vlan_hwaccel_rx(skb, adapter->vlan_grp,
+                                        ntohs(p->vlan));
+        } else if (adapter->params.sge.polling)
+                netif_receive_skb(skb);
+        else
+                netif_rx(skb);
+        return 0;
+}
+
+/*
+ * Returns true if a command queue has enough available descriptors that
+ * we can resume Tx operation after temporarily disabling its packet queue.
+ */
+static inline int enough_free_Tx_descs(const struct cmdQ *q)
+{
+        unsigned int r = q->processed - q->cleaned;
+
+        return q->in_use - r < (q->size >> 1);
+}
+
+/*
+ * Called when sufficient space has become available in the SGE command queues
+ * after the Tx packet schedulers have been suspended to restart the Tx path.
+ */
+static void restart_tx_queues(struct sge *sge)
+{
+        struct adapter *adap = sge->adapter;
+
+        if (enough_free_Tx_descs(&sge->cmdQ[0])) {
+                int i;
+
+                for_each_port(adap, i) {
+                        struct net_device *nd = adap->port[i].dev;
+
+                        if (test_and_clear_bit(nd->if_port,
+                                               &sge->stopped_tx_queues) &&
+                            netif_running(nd)) {
+                                sge->stats.cmdQ_restarted[3]++;
+                                netif_wake_queue(nd);
+                        }
+                }
+        }
+}
+
+/*
+ * update_tx_info is called from the interrupt handler/NAPI to return cmdQ0 
+ * information.
+ */
+static unsigned int update_tx_info(struct adapter *adapter, 
+                                          unsigned int flags, 
+                                          unsigned int pr0)
+{
+        struct sge *sge = adapter->sge;
+        struct cmdQ *cmdq = &sge->cmdQ[0];
+
+        cmdq->processed += pr0;
+
+        if (flags & F_CMDQ0_ENABLE) {
+                clear_bit(CMDQ_STAT_RUNNING, &cmdq->status);
+        
+                if (cmdq->cleaned + cmdq->in_use != cmdq->processed &&
+                    !test_and_set_bit(CMDQ_STAT_LAST_PKT_DB, &cmdq->status)) {
+                        set_bit(CMDQ_STAT_RUNNING, &cmdq->status);
+                        writel(F_CMDQ0_ENABLE, adapter->regs + A_SG_DOORBELL);
+                }
+                flags &= ~F_CMDQ0_ENABLE;
+        }
+        
+        if (unlikely(sge->stopped_tx_queues != 0))
+                restart_tx_queues(sge);
+
+        return flags;
+}
+
+/*
+ * Process SGE responses, up to the supplied budget.  Returns the number of
+ * responses processed.  A negative budget is effectively unlimited.
+ */
+static int process_responses(struct adapter *adapter, int budget)
+{
+        struct sge *sge = adapter->sge;
+        struct respQ *q = &sge->respQ;
+        struct respQ_e *e = &q->entries[q->cidx];
+        int budget_left = budget;
+        unsigned int flags = 0;
+        unsigned int cmdq_processed[SGE_CMDQ_N] = {0, 0};
+        
+
+        while (likely(budget_left && e->GenerationBit == q->genbit)) {
+                flags |= e->Qsleeping;
+                
+                cmdq_processed[0] += e->Cmdq0CreditReturn;
+                cmdq_processed[1] += e->Cmdq1CreditReturn;
+                
+                /* We batch updates to the TX side to avoid cacheline
+                 * ping-pong of TX state information on MP where the sender
+                 * might run on a different CPU than this function...
+                 */
+                if (unlikely(flags & F_CMDQ0_ENABLE || cmdq_processed[0] > 64)) {
+                        flags = update_tx_info(adapter, flags, cmdq_processed[0]);
+                        cmdq_processed[0] = 0;
+                }
+                if (unlikely(cmdq_processed[1] > 16)) {
+                        sge->cmdQ[1].processed += cmdq_processed[1];
+                        cmdq_processed[1] = 0;
+                }
+                if (likely(e->DataValid)) {
+                        struct freelQ *fl = &sge->freelQ[e->FreelistQid];
+
+                        if (unlikely(!e->Sop || !e->Eop))
+                                BUG();
+                        if (unlikely(e->Offload))
+                                unexpected_offload(adapter, fl);
+                        else
+                                sge_rx(sge, fl, e->BufferLength);
+
+                        /*
+                         * Note: this depends on each packet consuming a
+                         * single free-list buffer; cf. the BUG above.
+                         */
+                        if (++fl->cidx == fl->size)
+                                fl->cidx = 0;
+                        if (unlikely(--fl->credits <
+                                     fl->size - SGE_FREEL_REFILL_THRESH))
+                                refill_free_list(sge, fl);
+                } else
+                        sge->stats.pure_rsps++;
+
+                e++;
+                if (unlikely(++q->cidx == q->size)) {
+                        q->cidx = 0;
+                        q->genbit ^= 1;
+                        e = q->entries;
+                }
+                prefetch(e);
+
+                if (++q->credits > SGE_RESPQ_REPLENISH_THRES) {
+                        writel(q->credits, adapter->regs + A_SG_RSPQUEUECREDIT);
+                        q->credits = 0;
+                }
+                --budget_left;
+        }
+
+        flags = update_tx_info(adapter, flags, cmdq_processed[0]); 
+        sge->cmdQ[1].processed += cmdq_processed[1];
+
+        budget -= budget_left;
+        return budget;
+}
+
+/*
+ * A simpler version of process_responses() that handles only pure (i.e.,
+ * non data-carrying) responses.  Such respones are too light-weight to justify
+ * calling a softirq when using NAPI, so we handle them specially in hard
+ * interrupt context.  The function is called with a pointer to a response,
+ * which the caller must ensure is a valid pure response.  Returns 1 if it
+ * encounters a valid data-carrying response, 0 otherwise.
+ */
+static int process_pure_responses(struct adapter *adapter, struct respQ_e *e)
+{
+        struct sge *sge = adapter->sge;
+        struct respQ *q = &sge->respQ;
+        unsigned int flags = 0;
+        unsigned int cmdq_processed[SGE_CMDQ_N] = {0, 0};
+
+        do {
+                flags |= e->Qsleeping;
+
+                cmdq_processed[0] += e->Cmdq0CreditReturn;
+                cmdq_processed[1] += e->Cmdq1CreditReturn;
+                
+                e++;
+                if (unlikely(++q->cidx == q->size)) {
+                        q->cidx = 0;
+                        q->genbit ^= 1;
+                        e = q->entries;
+                }
+                prefetch(e);
+
+                if (++q->credits > SGE_RESPQ_REPLENISH_THRES) {
+                        writel(q->credits, adapter->regs + A_SG_RSPQUEUECREDIT);
+                        q->credits = 0;
+                }
+                sge->stats.pure_rsps++;
+        } while (e->GenerationBit == q->genbit && !e->DataValid);
+
+        flags = update_tx_info(adapter, flags, cmdq_processed[0]); 
+        sge->cmdQ[1].processed += cmdq_processed[1];
+
+        return e->GenerationBit == q->genbit;
+}
+
+/*
+ * Handler for new data events when using NAPI.  This does not need any locking
+ * or protection from interrupts as data interrupts are off at this point and
+ * other adapter interrupts do not interfere.
+ */
+static int t1_poll(struct net_device *dev, int *budget)
+{
+        struct adapter *adapter = dev->priv;
+        int effective_budget = min(*budget, dev->quota);
+
+        int work_done = process_responses(adapter, effective_budget);
+        *budget -= work_done;
+        dev->quota -= work_done;
+
+        if (work_done >= effective_budget)
+                return 1;
+
+        __netif_rx_complete(dev);
+
+        /*
+         * Because we don't atomically flush the following write it is
+         * possible that in very rare cases it can reach the device in a way
+         * that races with a new response being written plus an error interrupt
+         * causing the NAPI interrupt handler below to return unhandled status
+         * to the OS.  To protect against this would require flushing the write
+         * and doing both the write and the flush with interrupts off.  Way too
+         * expensive and unjustifiable given the rarity of the race.
+         */
+        writel(adapter->sge->respQ.cidx, adapter->regs + A_SG_SLEEPING);
+        return 0;
+}
+
+/*
+ * Returns true if the device is already scheduled for polling.
+ */
+static inline int napi_is_scheduled(struct net_device *dev)
+{
+        return test_bit(__LINK_STATE_RX_SCHED, &dev->state);
+}
+
+/*
+ * NAPI version of the main interrupt handler.
+ */
+static irqreturn_t t1_interrupt_napi(int irq, void *data, struct pt_regs *regs)
+{
+        int handled;
+        struct adapter *adapter = data;
+        struct sge *sge = adapter->sge;
+        struct respQ *q = &adapter->sge->respQ;
+
+        /*
+         * Clear the SGE_DATA interrupt first thing.  Normally the NAPI
+         * handler has control of the response queue and the interrupt handler
+         * can look at the queue reliably only once it knows NAPI is off.
+         * We can't wait that long to clear the SGE_DATA interrupt because we
+         * could race with t1_poll rearming the SGE interrupt, so we need to
+         * clear the interrupt speculatively and really early on.
+         */
+        writel(F_PL_INTR_SGE_DATA, adapter->regs + A_PL_CAUSE);
+
+        spin_lock(&adapter->async_lock);
+        if (!napi_is_scheduled(sge->netdev)) {
+                struct respQ_e *e = &q->entries[q->cidx];
+
+                if (e->GenerationBit == q->genbit) {
+                        if (e->DataValid ||
+                            process_pure_responses(adapter, e)) {
+                                if (likely(napi_schedule_prep(sge->netdev)))
+                                        __netif_rx_schedule(sge->netdev);
+                                else
+                                        printk(KERN_CRIT
+                                               "NAPI schedule failure!\n");
+                        } else
+                        writel(q->cidx, adapter->regs + A_SG_SLEEPING);
+                        handled = 1;
+                        goto unlock;
+                } else
+                writel(q->cidx, adapter->regs + A_SG_SLEEPING);
+        }  else
+        if (readl(adapter->regs + A_PL_CAUSE) & F_PL_INTR_SGE_DATA)
+                printk(KERN_ERR "data interrupt while NAPI running\n");
+        
+        handled = t1_slow_intr_handler(adapter);
+        if (!handled)
+                sge->stats.unhandled_irqs++;
+ unlock:
+        spin_unlock(&adapter->async_lock);
+        return IRQ_RETVAL(handled != 0);
+}
+
+/*
+ * Main interrupt handler, optimized assuming that we took a 'DATA'
+ * interrupt.
+ *
+ * 1. Clear the interrupt
+ * 2. Loop while we find valid descriptors and process them; accumulate
+ *      information that can be processed after the loop
+ * 3. Tell the SGE at which index we stopped processing descriptors
+ * 4. Bookkeeping; free TX buffers, ring doorbell if there are any
+ *      outstanding TX buffers waiting, replenish RX buffers, potentially
+ *      reenable upper layers if they were turned off due to lack of TX
+ *      resources which are available again.
+ * 5. If we took an interrupt, but no valid respQ descriptors was found we
+ *      let the slow_intr_handler run and do error handling.
+ */
+static irqreturn_t t1_interrupt(int irq, void *cookie, struct pt_regs *regs)
+{
+        int work_done;
+        struct respQ_e *e;
+        struct adapter *adapter = cookie;
+        struct respQ *Q = &adapter->sge->respQ;
+
+        spin_lock(&adapter->async_lock);
+        e = &Q->entries[Q->cidx];
+        prefetch(e);
+
+        writel(F_PL_INTR_SGE_DATA, adapter->regs + A_PL_CAUSE);
+
+        if (likely(e->GenerationBit == Q->genbit))
+                work_done = process_responses(adapter, -1);
+        else
+                work_done = t1_slow_intr_handler(adapter);
+
+        /*
+         * The unconditional clearing of the PL_CAUSE above may have raced
+         * with DMA completion and the corresponding generation of a response
+         * to cause us to miss the resulting data interrupt.  The next write
+         * is also unconditional to recover the missed interrupt and render
+         * this race harmless.
+         */
+        writel(Q->cidx, adapter->regs + A_SG_SLEEPING);
+
+        if (!work_done)
+                adapter->sge->stats.unhandled_irqs++;
+        spin_unlock(&adapter->async_lock);
+        return IRQ_RETVAL(work_done != 0);
+}
+
+intr_handler_t t1_select_intr_handler(adapter_t *adapter)
+{
+        return adapter->params.sge.polling ? t1_interrupt_napi : t1_interrupt;
+}
+
+/*
+ * Enqueues the sk_buff onto the cmdQ[qid] and has hardware fetch it.
+ *
+ * The code figures out how many entries the sk_buff will require in the
+ * cmdQ and updates the cmdQ data structure with the state once the enqueue
+ * has complete. Then, it doesn't access the global structure anymore, but
+ * uses the corresponding fields on the stack. In conjuction with a spinlock
+ * around that code, we can make the function reentrant without holding the
+ * lock when we actually enqueue (which might be expensive, especially on
+ * architectures with IO MMUs).
+ *
+ * This runs with softirqs disabled.
+ */
+unsigned int t1_sge_tx(struct sk_buff *skb, struct adapter *adapter,
+                       unsigned int qid, struct net_device *dev)
+{
+        struct sge *sge = adapter->sge;
+        struct cmdQ *q = &sge->cmdQ[qid];
+        unsigned int credits, pidx, genbit, count;
+
+        spin_lock(&q->lock);
+        reclaim_completed_tx(sge, q);
+
+        pidx = q->pidx;
+        credits = q->size - q->in_use;
+        count = 1 + skb_shinfo(skb)->nr_frags;
+
+        {       /* Ethernet packet */
+                if (unlikely(credits < count)) {
+                        netif_stop_queue(dev);
+                        set_bit(dev->if_port, &sge->stopped_tx_queues);
+                        sge->stats.cmdQ_full[3]++;
+                        spin_unlock(&q->lock);
+                        CH_ERR("%s: Tx ring full while queue awake!\n",
+                               adapter->name);
+                        return 1;
+                }
+                if (unlikely(credits - count < q->stop_thres)) {
+                        sge->stats.cmdQ_full[3]++;
+                        netif_stop_queue(dev);
+                        set_bit(dev->if_port, &sge->stopped_tx_queues);
+                }
+        }
+        q->in_use += count;
+        genbit = q->genbit;
+        q->pidx += count;
+        if (q->pidx >= q->size) {
+                q->pidx -= q->size;
+                q->genbit ^= 1;
+        }
+        spin_unlock(&q->lock);
+
+        write_tx_descs(adapter, skb, pidx, genbit, q);
+
+        /*
+         * We always ring the doorbell for cmdQ1.  For cmdQ0, we only ring
+         * the doorbell if the Q is asleep. There is a natural race, where
+         * the hardware is going to sleep just after we checked, however,
+         * then the interrupt handler will detect the outstanding TX packet
+         * and ring the doorbell for us.
+         */
+        if (qid)
+                doorbell_pio(adapter, F_CMDQ1_ENABLE);
+        else {
+                clear_bit(CMDQ_STAT_LAST_PKT_DB, &q->status);
+                if (test_and_set_bit(CMDQ_STAT_RUNNING, &q->status) == 0) {
+                        set_bit(CMDQ_STAT_LAST_PKT_DB, &q->status);
+                        writel(F_CMDQ0_ENABLE, adapter->regs + A_SG_DOORBELL);
+                }
+        }
+        return 0;
+}
+
+#define MK_ETH_TYPE_MSS(type, mss) (((mss) & 0x3FFF) | ((type) << 14))
+
+/*
+ *      eth_hdr_len - return the length of an Ethernet header
+ *      @data: pointer to the start of the Ethernet header
+ *
+ *      Returns the length of an Ethernet header, including optional VLAN tag.
+ */
+static inline int eth_hdr_len(const void *data)
+{
+        const struct ethhdr *e = data;
+
+        return e->h_proto == htons(ETH_P_8021Q) ? VLAN_ETH_HLEN : ETH_HLEN;
+}
+
+/*
+ * Adds the CPL header to the sk_buff and passes it to t1_sge_tx.
+ */
+int t1_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct adapter *adapter = dev->priv;
+        struct sge_port_stats *st = &adapter->sge->port_stats[dev->if_port];
+        struct sge *sge = adapter->sge;
+        struct cpl_tx_pkt *cpl;
+
+#ifdef NETIF_F_TSO
+        if (skb_shinfo(skb)->tso_size) {
+                int eth_type;
+                struct cpl_tx_pkt_lso *hdr;
+
+                st->tso++;
+
+                eth_type = skb->nh.raw - skb->data == ETH_HLEN ?
+                        CPL_ETH_II : CPL_ETH_II_VLAN;
+
+                hdr = (struct cpl_tx_pkt_lso *)skb_push(skb, sizeof(*hdr));
+                hdr->opcode = CPL_TX_PKT_LSO;
+                hdr->ip_csum_dis = hdr->l4_csum_dis = 0;
+                hdr->ip_hdr_words = skb->nh.iph->ihl;
+                hdr->tcp_hdr_words = skb->h.th->doff;
+                hdr->eth_type_mss = htons(MK_ETH_TYPE_MSS(eth_type,
+                                                skb_shinfo(skb)->tso_size));
+                hdr->len = htonl(skb->len - sizeof(*hdr));
+                cpl = (struct cpl_tx_pkt *)hdr;
+                sge->stats.tx_lso_pkts++;
+        } else
+#endif
+        {
+                /*
+                 * Packets shorter than ETH_HLEN can break the MAC, drop them
+                 * early.  Also, we may get oversized packets because some
+                 * parts of the kernel don't handle our unusual hard_header_len
+                 * right, drop those too.
+                 */
+                if (unlikely(skb->len < ETH_HLEN ||
+                             skb->len > dev->mtu + eth_hdr_len(skb->data))) {
+                        dev_kfree_skb_any(skb);
+                        return NET_XMIT_SUCCESS;
+                }
+
+                /*
+                 * We are using a non-standard hard_header_len and some kernel
+                 * components, such as pktgen, do not handle it right.
+                 * Complain when this happens but try to fix things up.
+                 */
+                if (unlikely(skb_headroom(skb) <
+                             dev->hard_header_len - ETH_HLEN)) {
+                        struct sk_buff *orig_skb = skb;
+
+                        if (net_ratelimit())
+                                printk(KERN_ERR "%s: inadequate headroom in "
+                                       "Tx packet\n", dev->name);
+                        skb = skb_realloc_headroom(skb, sizeof(*cpl));
+                        dev_kfree_skb_any(orig_skb);
+                        if (!skb)
+                                return -ENOMEM;
+                }
+
+                if (!(adapter->flags & UDP_CSUM_CAPABLE) &&
+                    skb->ip_summed == CHECKSUM_HW &&
+                    skb->nh.iph->protocol == IPPROTO_UDP)
+                        if (unlikely(skb_checksum_help(skb, 0))) {
+                                dev_kfree_skb_any(skb);
+                                return -ENOMEM;
+                        }
+
+                /* Hmmm, assuming to catch the gratious arp... and we'll use
+                 * it to flush out stuck espi packets...
+                  */
+                if (unlikely(!adapter->sge->espibug_skb)) {
+                        if (skb->protocol == htons(ETH_P_ARP) &&
+                            skb->nh.arph->ar_op == htons(ARPOP_REQUEST)) {
+                                adapter->sge->espibug_skb = skb;
+                                /* We want to re-use this skb later. We
+                                 * simply bump the reference count and it
+                                 * will not be freed...
+                                 */
+                                skb = skb_get(skb);
+                        }
+                }
+
+                cpl = (struct cpl_tx_pkt *)__skb_push(skb, sizeof(*cpl));
+                cpl->opcode = CPL_TX_PKT;
+                cpl->ip_csum_dis = 1;    /* SW calculates IP csum */
+                cpl->l4_csum_dis = skb->ip_summed == CHECKSUM_HW ? 0 : 1;
+                /* the length field isn't used so don't bother setting it */
+
+                st->tx_cso += (skb->ip_summed == CHECKSUM_HW);
+                sge->stats.tx_do_cksum += (skb->ip_summed == CHECKSUM_HW);
+                sge->stats.tx_reg_pkts++;
+        }
+        cpl->iff = dev->if_port;
+
+#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
+        if (adapter->vlan_grp && vlan_tx_tag_present(skb)) {
+                cpl->vlan_valid = 1;
+                cpl->vlan = htons(vlan_tx_tag_get(skb));
+                st->vlan_insert++;
+        } else
+#endif
+                cpl->vlan_valid = 0;
+
+        dev->trans_start = jiffies;
+        return t1_sge_tx(skb, adapter, 0, dev);
+}
+
+/*
+ * Callback for the Tx buffer reclaim timer.  Runs with softirqs disabled.
+ */
+static void sge_tx_reclaim_cb(unsigned long data)
+{
+        int i;
+        struct sge *sge = (struct sge *)data;
+
+        for (i = 0; i < SGE_CMDQ_N; ++i) {
+                struct cmdQ *q = &sge->cmdQ[i];
+
+                if (!spin_trylock(&q->lock))
+                        continue;
+
+                reclaim_completed_tx(sge, q);
+                if (i == 0 && q->in_use)   /* flush pending credits */
+                        writel(F_CMDQ0_ENABLE,
+                                sge->adapter->regs + A_SG_DOORBELL);
+
+                spin_unlock(&q->lock);
+        }
+        mod_timer(&sge->tx_reclaim_timer, jiffies + TX_RECLAIM_PERIOD);
+}
+
+/*
+ * Propagate changes of the SGE coalescing parameters to the HW.
+ */
+int t1_sge_set_coalesce_params(struct sge *sge, struct sge_params *p)
+{
+        sge->netdev->poll = t1_poll;
+        sge->fixed_intrtimer = p->rx_coalesce_usecs *
+                core_ticks_per_usec(sge->adapter);
+        writel(sge->fixed_intrtimer, sge->adapter->regs + A_SG_INTRTIMER);
+        return 0;
+}
+
+/*
+ * Allocates both RX and TX resources and configures the SGE. However,
+ * the hardware is not enabled yet.
+ */
+int t1_sge_configure(struct sge *sge, struct sge_params *p)
+{
+        if (alloc_rx_resources(sge, p))
+                return -ENOMEM;
+        if (alloc_tx_resources(sge, p)) {
+                free_rx_resources(sge);
+                return -ENOMEM;
+        }
+        configure_sge(sge, p);
+
+        /*
+         * Now that we have sized the free lists calculate the payload
+         * capacity of the large buffers.  Other parts of the driver use
+         * this to set the max offload coalescing size so that RX packets
+         * do not overflow our large buffers.
+         */
+        p->large_buf_capacity = jumbo_payload_capacity(sge);
+        return 0;
+}
+
+/*
+ * Disables the DMA engine.
+ */
+void t1_sge_stop(struct sge *sge)
+{
+        writel(0, sge->adapter->regs + A_SG_CONTROL);
+        (void) readl(sge->adapter->regs + A_SG_CONTROL); /* flush */
+        if (is_T2(sge->adapter))
+                del_timer_sync(&sge->espibug_timer);
+        del_timer_sync(&sge->tx_reclaim_timer);
+}
+
+/*
+ * Enables the DMA engine.
+ */
+void t1_sge_start(struct sge *sge)
+{
+        refill_free_list(sge, &sge->freelQ[0]);
+        refill_free_list(sge, &sge->freelQ[1]);
+
+        writel(sge->sge_control, sge->adapter->regs + A_SG_CONTROL);
+        doorbell_pio(sge->adapter, F_FL0_ENABLE | F_FL1_ENABLE);
+        (void) readl(sge->adapter->regs + A_SG_CONTROL); /* flush */
+
+        mod_timer(&sge->tx_reclaim_timer, jiffies + TX_RECLAIM_PERIOD);
+
+        if (is_T2(sge->adapter)) 
+                mod_timer(&sge->espibug_timer, jiffies + sge->espibug_timeout);
+}
+
+/*
+ * Callback for the T2 ESPI 'stuck packet feature' workaorund
+ */
+static void espibug_workaround(void *data)
+{
+        struct adapter *adapter = (struct adapter *)data;
+        struct sge *sge = adapter->sge;
+
+        if (netif_running(adapter->port[0].dev)) {
+                struct sk_buff *skb = sge->espibug_skb;
+
+                u32 seop = t1_espi_get_mon(adapter, 0x930, 0);
+
+                if ((seop & 0xfff0fff) == 0xfff && skb) {
+                        if (!skb->cb[0]) {
+                                u8 ch_mac_addr[ETH_ALEN] =
+                                    {0x0, 0x7, 0x43, 0x0, 0x0, 0x0};
+                                memcpy(skb->data + sizeof(struct cpl_tx_pkt),
+                                    ch_mac_addr, ETH_ALEN);
+                                memcpy(skb->data + skb->len - 10, ch_mac_addr,
+                                    ETH_ALEN);
+                                skb->cb[0] = 0xff;
+                        }
+
+                        /* bump the reference count to avoid freeing of the
+                         * skb once the DMA has completed.
+                         */
+                        skb = skb_get(skb);
+                        t1_sge_tx(skb, adapter, 0, adapter->port[0].dev);
+                }
+        }
+        mod_timer(&sge->espibug_timer, jiffies + sge->espibug_timeout);
+}
+
+/*
+ * Creates a t1_sge structure and returns suggested resource parameters.
+ */
+struct sge * __devinit t1_sge_create(struct adapter *adapter,
+                                     struct sge_params *p)
+{
+        struct sge *sge = kmalloc(sizeof(*sge), GFP_KERNEL);
+
+        if (!sge)
+                return NULL;
+        memset(sge, 0, sizeof(*sge));
+
+        sge->adapter = adapter;
+        sge->netdev = adapter->port[0].dev;
+        sge->rx_pkt_pad = t1_is_T1B(adapter) ? 0 : 2;
+        sge->jumbo_fl = t1_is_T1B(adapter) ? 1 : 0;
+
+        init_timer(&sge->tx_reclaim_timer);
+        sge->tx_reclaim_timer.data = (unsigned long)sge;
+        sge->tx_reclaim_timer.function = sge_tx_reclaim_cb;
+
+        if (is_T2(sge->adapter)) {
+                init_timer(&sge->espibug_timer);
+                sge->espibug_timer.function = (void *)&espibug_workaround;
+                sge->espibug_timer.data = (unsigned long)sge->adapter;
+                sge->espibug_timeout = 1;
+        }
+         
+
+        p->cmdQ_size[0] = SGE_CMDQ0_E_N;
+        p->cmdQ_size[1] = SGE_CMDQ1_E_N;
+        p->freelQ_size[!sge->jumbo_fl] = SGE_FREEL_SIZE;
+        p->freelQ_size[sge->jumbo_fl] = SGE_JUMBO_FREEL_SIZE;
+        p->rx_coalesce_usecs =  50;
+        p->coalesce_enable = 0;
+        p->sample_interval_usecs = 0;
+        p->polling = 0;
+
+        return sge;
+}
diff --git a/drivers/net/chelsio/sge.h b/drivers/net/chelsio/sge.h
new file mode 100644
index 000000000000..434b25586851
--- /dev/null
+++ b/drivers/net/chelsio/sge.h
@@ -0,0 +1,105 @@
+/*****************************************************************************
+ *                                                                           *
+ * File: sge.h                                                               *
+ * $Revision: 1.11 $                                                          *
+ * $Date: 2005/06/21 22:10:55 $                                              *
+ * Description:                                                              *
+ *  part of the Chelsio 10Gb Ethernet Driver.                                *
+ *                                                                           *
+ * This program is free software; you can redistribute it and/or modify      *
+ * it under the terms of the GNU General Public License, version 2, as       *
+ * published by the Free Software Foundation.                                *
+ *                                                                           *
+ * You should have received a copy of the GNU General Public License along   *
+ * with this program; if not, write to the Free Software Foundation, Inc.,   *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
+ *                                                                           *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
+ *                                                                           *
+ * http://www.chelsio.com                                                    *
+ *                                                                           *
+ * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
+ * All rights reserved.                                                      *
+ *                                                                           *
+ * Maintainers: maintainers@chelsio.com                                      *
+ *                                                                           *
+ * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
+ *          Tina Yang               <tainay@chelsio.com>                     *
+ *          Felix Marti             <felix@chelsio.com>                      *
+ *          Scott Bardone           <sbardone@chelsio.com>                   *
+ *          Kurt Ottaway            <kottaway@chelsio.com>                   *
+ *          Frank DiMambro          <frank@chelsio.com>                      *
+ *                                                                           *
+ * History:                                                                  *
+ *                                                                           *
+ ****************************************************************************/
+
+#ifndef _CXGB_SGE_H_
+#define _CXGB_SGE_H_
+
+#include <linux/types.h>
+#include <linux/interrupt.h>
+#include <asm/byteorder.h>
+
+#ifndef IRQ_RETVAL
+#define IRQ_RETVAL(x)
+typedef void irqreturn_t;
+#endif
+
+typedef irqreturn_t (*intr_handler_t)(int, void *, struct pt_regs *);
+
+struct sge_intr_counts {
+        unsigned int respQ_empty;      /* # times respQ empty */
+        unsigned int respQ_overflow;   /* # respQ overflow (fatal) */
+        unsigned int freelistQ_empty;  /* # times freelist empty */
+        unsigned int pkt_too_big;      /* packet too large (fatal) */
+        unsigned int pkt_mismatch;
+        unsigned int cmdQ_full[3];     /* not HW IRQ, host cmdQ[] full */
+        unsigned int cmdQ_restarted[3];/* # of times cmdQ X was restarted */
+        unsigned int ethernet_pkts;    /* # of Ethernet packets received */
+        unsigned int offload_pkts;     /* # of offload packets received */
+        unsigned int offload_bundles;  /* # of offload pkt bundles delivered */
+        unsigned int pure_rsps;        /* # of non-payload responses */
+        unsigned int unhandled_irqs;   /* # of unhandled interrupts */
+        unsigned int tx_ipfrags;
+        unsigned int tx_reg_pkts;
+        unsigned int tx_lso_pkts;
+        unsigned int tx_do_cksum;
+};
+
+struct sge_port_stats {
+        unsigned long rx_cso_good;     /* # of successful RX csum offloads */
+        unsigned long tx_cso;          /* # of TX checksum offloads */
+        unsigned long vlan_xtract;     /* # of VLAN tag extractions */
+        unsigned long vlan_insert;     /* # of VLAN tag extractions */
+        unsigned long tso;             /* # of TSO requests */
+        unsigned long rx_drops;        /* # of packets dropped due to no mem */
+};
+
+struct sk_buff;
+struct net_device;
+struct adapter;
+struct sge_params;
+struct sge;
+
+struct sge *t1_sge_create(struct adapter *, struct sge_params *);
+int t1_sge_configure(struct sge *, struct sge_params *);
+int t1_sge_set_coalesce_params(struct sge *, struct sge_params *);
+void t1_sge_destroy(struct sge *);
+intr_handler_t t1_select_intr_handler(adapter_t *adapter);
+unsigned int t1_sge_tx(struct sk_buff *skb, struct adapter *adapter,
+                       unsigned int qid, struct net_device *netdev);
+int t1_start_xmit(struct sk_buff *skb, struct net_device *dev);
+void t1_set_vlan_accel(struct adapter *adapter, int on_off);
+void t1_sge_start(struct sge *);
+void t1_sge_stop(struct sge *);
+int t1_sge_intr_error_handler(struct sge *);
+void t1_sge_intr_enable(struct sge *);
+void t1_sge_intr_disable(struct sge *);
+void t1_sge_intr_clear(struct sge *);
+const struct sge_intr_counts *t1_sge_get_intr_counts(struct sge *sge);
+const struct sge_port_stats *t1_sge_get_port_stats(struct sge *sge, int port);
+
+#endif /* _CXGB_SGE_H_ */
diff --git a/drivers/net/chelsio/subr.c b/drivers/net/chelsio/subr.c
new file mode 100644
index 000000000000..1ebb5d149aef
--- /dev/null
+++ b/drivers/net/chelsio/subr.c
@@ -0,0 +1,812 @@
+/*****************************************************************************
+ *                                                                           *
+ * File: subr.c                                                              *
+ * $Revision: 1.27 $                                                         *
+ * $Date: 2005/06/22 01:08:36 $                                              *
+ * Description:                                                              *
+ *  Various subroutines (intr,pio,etc.) used by Chelsio 10G Ethernet driver. *
+ *  part of the Chelsio 10Gb Ethernet Driver.                                *
+ *                                                                           *
+ * This program is free software; you can redistribute it and/or modify      *
+ * it under the terms of the GNU General Public License, version 2, as       *
+ * published by the Free Software Foundation.                                *
+ *                                                                           *
+ * You should have received a copy of the GNU General Public License along   *
+ * with this program; if not, write to the Free Software Foundation, Inc.,   *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
+ *                                                                           *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
+ *                                                                           *
+ * http://www.chelsio.com                                                    *
+ *                                                                           *
+ * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
+ * All rights reserved.                                                      *
+ *                                                                           *
+ * Maintainers: maintainers@chelsio.com                                      *
+ *                                                                           *
+ * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
+ *          Tina Yang               <tainay@chelsio.com>                     *
+ *          Felix Marti             <felix@chelsio.com>                      *
+ *          Scott Bardone           <sbardone@chelsio.com>                   *
+ *          Kurt Ottaway            <kottaway@chelsio.com>                   *
+ *          Frank DiMambro          <frank@chelsio.com>                      *
+ *                                                                           *
+ * History:                                                                  *
+ *                                                                           *
+ ****************************************************************************/
+
+#include "common.h"
+#include "elmer0.h"
+#include "regs.h"
+#include "gmac.h"
+#include "cphy.h"
+#include "sge.h"
+#include "espi.h"
+
+/**
+ *      t1_wait_op_done - wait until an operation is completed
+ *      @adapter: the adapter performing the operation
+ *      @reg: the register to check for completion
+ *      @mask: a single-bit field within @reg that indicates completion
+ *      @polarity: the value of the field when the operation is completed
+ *      @attempts: number of check iterations
+ *      @delay: delay in usecs between iterations
+ *
+ *      Wait until an operation is completed by checking a bit in a register
+ *      up to @attempts times.  Returns %0 if the operation completes and %1
+ *      otherwise.
+ */
+static int t1_wait_op_done(adapter_t *adapter, int reg, u32 mask, int polarity,
+                    int attempts, int delay)
+{
+        while (1) {
+                u32 val = readl(adapter->regs + reg) & mask;
+
+                if (!!val == polarity)
+                        return 0;
+                if (--attempts == 0)
+                        return 1;
+                if (delay)
+                        udelay(delay);
+        }
+}
+
+#define TPI_ATTEMPTS 50
+
+/*
+ * Write a register over the TPI interface (unlocked and locked versions).
+ */
+static int __t1_tpi_write(adapter_t *adapter, u32 addr, u32 value)
+{
+        int tpi_busy;
+
+        writel(addr, adapter->regs + A_TPI_ADDR);
+        writel(value, adapter->regs + A_TPI_WR_DATA);
+        writel(F_TPIWR, adapter->regs + A_TPI_CSR);
+
+        tpi_busy = t1_wait_op_done(adapter, A_TPI_CSR, F_TPIRDY, 1,
+                                   TPI_ATTEMPTS, 3);
+        if (tpi_busy)
+                CH_ALERT("%s: TPI write to 0x%x failed\n",
+                         adapter->name, addr);
+        return tpi_busy;
+}
+
+int t1_tpi_write(adapter_t *adapter, u32 addr, u32 value)
+{
+        int ret;
+
+        spin_lock(&(adapter)->tpi_lock);
+        ret = __t1_tpi_write(adapter, addr, value);
+        spin_unlock(&(adapter)->tpi_lock);
+        return ret;
+}
+
+/*
+ * Read a register over the TPI interface (unlocked and locked versions).
+ */
+static int __t1_tpi_read(adapter_t *adapter, u32 addr, u32 *valp)
+{
+        int tpi_busy;
+
+        writel(addr, adapter->regs + A_TPI_ADDR);
+        writel(0, adapter->regs + A_TPI_CSR);
+
+        tpi_busy = t1_wait_op_done(adapter, A_TPI_CSR, F_TPIRDY, 1,
+                                   TPI_ATTEMPTS, 3);
+        if (tpi_busy)
+                CH_ALERT("%s: TPI read from 0x%x failed\n",
+                         adapter->name, addr);
+        else
+                *valp = readl(adapter->regs + A_TPI_RD_DATA);
+        return tpi_busy;
+}
+
+int t1_tpi_read(adapter_t *adapter, u32 addr, u32 *valp)
+{
+        int ret;
+
+        spin_lock(&(adapter)->tpi_lock);
+        ret = __t1_tpi_read(adapter, addr, valp);
+        spin_unlock(&(adapter)->tpi_lock);
+        return ret;
+}
+
+/*
+ * Called when a port's link settings change to propagate the new values to the
+ * associated PHY and MAC.  After performing the common tasks it invokes an
+ * OS-specific handler.
+ */
+/* static */ void link_changed(adapter_t *adapter, int port_id)
+{
+        int link_ok, speed, duplex, fc;
+        struct cphy *phy = adapter->port[port_id].phy;
+        struct link_config *lc = &adapter->port[port_id].link_config;
+
+        phy->ops->get_link_status(phy, &link_ok, &speed, &duplex, &fc);
+
+        lc->speed = speed < 0 ? SPEED_INVALID : speed;
+        lc->duplex = duplex < 0 ? DUPLEX_INVALID : duplex;
+        if (!(lc->requested_fc & PAUSE_AUTONEG))
+                fc = lc->requested_fc & (PAUSE_RX | PAUSE_TX);
+
+        if (link_ok && speed >= 0 && lc->autoneg == AUTONEG_ENABLE) {
+                /* Set MAC speed, duplex, and flow control to match PHY. */
+                struct cmac *mac = adapter->port[port_id].mac;
+
+                mac->ops->set_speed_duplex_fc(mac, speed, duplex, fc);
+                lc->fc = (unsigned char)fc;
+        }
+        t1_link_changed(adapter, port_id, link_ok, speed, duplex, fc);
+}
+
+static int t1_pci_intr_handler(adapter_t *adapter)
+{
+        u32 pcix_cause;
+
+        pci_read_config_dword(adapter->pdev, A_PCICFG_INTR_CAUSE, &pcix_cause);
+
+        if (pcix_cause) {
+                pci_write_config_dword(adapter->pdev, A_PCICFG_INTR_CAUSE,
+                                         pcix_cause);
+                t1_fatal_err(adapter);    /* PCI errors are fatal */
+        }
+        return 0;
+}
+
+
+/*
+ * Wait until Elmer's MI1 interface is ready for new operations.
+ */
+static int mi1_wait_until_ready(adapter_t *adapter, int mi1_reg)
+{
+        int attempts = 100, busy;
+
+        do {
+                u32 val;
+
+                __t1_tpi_read(adapter, mi1_reg, &val);
+                busy = val & F_MI1_OP_BUSY;
+                if (busy)
+                        udelay(10);
+        } while (busy && --attempts);
+        if (busy)
+                CH_ALERT("%s: MDIO operation timed out\n",
+                         adapter->name);
+        return busy;
+}
+
+/*
+ * MI1 MDIO initialization.
+ */
+static void mi1_mdio_init(adapter_t *adapter, const struct board_info *bi)
+{
+        u32 clkdiv = bi->clock_elmer0 / (2 * bi->mdio_mdc) - 1;
+        u32 val = F_MI1_PREAMBLE_ENABLE | V_MI1_MDI_INVERT(bi->mdio_mdiinv) |
+                V_MI1_MDI_ENABLE(bi->mdio_mdien) | V_MI1_CLK_DIV(clkdiv);
+
+        if (!(bi->caps & SUPPORTED_10000baseT_Full))
+                val |= V_MI1_SOF(1);
+        t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_CFG, val);
+}
+
+static int mi1_mdio_ext_read(adapter_t *adapter, int phy_addr, int mmd_addr,
+                             int reg_addr, unsigned int *valp)
+{
+        u32 addr = V_MI1_REG_ADDR(mmd_addr) | V_MI1_PHY_ADDR(phy_addr);
+
+        spin_lock(&(adapter)->tpi_lock);
+
+        /* Write the address we want. */
+        __t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_ADDR, addr);
+        __t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_DATA, reg_addr);
+        __t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_OP,
+                       MI1_OP_INDIRECT_ADDRESS);
+        mi1_wait_until_ready(adapter, A_ELMER0_PORT0_MI1_OP);
+
+        /* Write the operation we want. */
+        __t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_OP, MI1_OP_INDIRECT_READ);
+        mi1_wait_until_ready(adapter, A_ELMER0_PORT0_MI1_OP);
+
+        /* Read the data. */
+        __t1_tpi_read(adapter, A_ELMER0_PORT0_MI1_DATA, valp);
+        spin_unlock(&(adapter)->tpi_lock);
+        return 0;
+}
+
+static int mi1_mdio_ext_write(adapter_t *adapter, int phy_addr, int mmd_addr,
+                              int reg_addr, unsigned int val)
+{
+        u32 addr = V_MI1_REG_ADDR(mmd_addr) | V_MI1_PHY_ADDR(phy_addr);
+
+        spin_lock(&(adapter)->tpi_lock);
+
+        /* Write the address we want. */
+        __t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_ADDR, addr);
+        __t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_DATA, reg_addr);
+        __t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_OP,
+                       MI1_OP_INDIRECT_ADDRESS);
+        mi1_wait_until_ready(adapter, A_ELMER0_PORT0_MI1_OP);
+
+        /* Write the data. */
+        __t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_DATA, val);
+        __t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_OP, MI1_OP_INDIRECT_WRITE);
+        mi1_wait_until_ready(adapter, A_ELMER0_PORT0_MI1_OP);
+        spin_unlock(&(adapter)->tpi_lock);
+        return 0;
+}
+
+static struct mdio_ops mi1_mdio_ext_ops = {
+        mi1_mdio_init,
+        mi1_mdio_ext_read,
+        mi1_mdio_ext_write
+};
+
+enum {
+        CH_BRD_N110_1F,
+        CH_BRD_N210_1F,
+};
+
+static struct board_info t1_board[] = {
+
+{ CHBT_BOARD_N110, 1/*ports#*/,
+  SUPPORTED_10000baseT_Full | SUPPORTED_FIBRE /*caps*/, CHBT_TERM_T1,
+  CHBT_MAC_PM3393, CHBT_PHY_88X2010,
+  125000000/*clk-core*/, 0/*clk-mc3*/, 0/*clk-mc4*/,
+  1/*espi-ports*/, 0/*clk-cspi*/, 44/*clk-elmer0*/, 0/*mdien*/,
+  0/*mdiinv*/, 1/*mdc*/, 0/*phybaseaddr*/, &t1_pm3393_ops,
+  &t1_mv88x201x_ops, &mi1_mdio_ext_ops,
+  "Chelsio N110 1x10GBaseX NIC" },
+
+{ CHBT_BOARD_N210, 1/*ports#*/,
+  SUPPORTED_10000baseT_Full | SUPPORTED_FIBRE /*caps*/, CHBT_TERM_T2,
+  CHBT_MAC_PM3393, CHBT_PHY_88X2010,
+  125000000/*clk-core*/, 0/*clk-mc3*/, 0/*clk-mc4*/,
+  1/*espi-ports*/, 0/*clk-cspi*/, 44/*clk-elmer0*/, 0/*mdien*/,
+  0/*mdiinv*/, 1/*mdc*/, 0/*phybaseaddr*/, &t1_pm3393_ops,
+  &t1_mv88x201x_ops, &mi1_mdio_ext_ops,
+  "Chelsio N210 1x10GBaseX NIC" },
+
+};
+
+struct pci_device_id t1_pci_tbl[] = {
+        CH_DEVICE(7, 0, CH_BRD_N110_1F),
+        CH_DEVICE(10, 1, CH_BRD_N210_1F),
+        { 0, }
+};
+
+MODULE_DEVICE_TABLE(pci, t1_pci_tbl);
+
+/*
+ * Return the board_info structure with a given index.  Out-of-range indices
+ * return NULL.
+ */
+const struct board_info *t1_get_board_info(unsigned int board_id)
+{
+        return board_id < ARRAY_SIZE(t1_board) ? &t1_board[board_id] : NULL;
+}
+
+struct chelsio_vpd_t {
+        u32 format_version;
+        u8 serial_number[16];
+        u8 mac_base_address[6];
+        u8 pad[2];           /* make multiple-of-4 size requirement explicit */
+};
+
+#define EEPROMSIZE        (8 * 1024)
+#define EEPROM_MAX_POLL   4
+
+/*
+ * Read SEEPROM. A zero is written to the flag register when the addres is
+ * written to the Control register. The hardware device will set the flag to a
+ * one when 4B have been transferred to the Data register.
+ */
+int t1_seeprom_read(adapter_t *adapter, u32 addr, u32 *data)
+{
+        int i = EEPROM_MAX_POLL;
+        u16 val;
+
+        if (addr >= EEPROMSIZE || (addr & 3))
+                return -EINVAL;
+
+        pci_write_config_word(adapter->pdev, A_PCICFG_VPD_ADDR, (u16)addr);
+        do {
+                udelay(50);
+                pci_read_config_word(adapter->pdev, A_PCICFG_VPD_ADDR, &val);
+        } while (!(val & F_VPD_OP_FLAG) && --i);
+
+        if (!(val & F_VPD_OP_FLAG)) {
+                CH_ERR("%s: reading EEPROM address 0x%x failed\n",
+                       adapter->name, addr);
+                return -EIO;
+        }
+        pci_read_config_dword(adapter->pdev, A_PCICFG_VPD_DATA, data);
+        *data = le32_to_cpu(*data);
+        return 0;
+}
+
+static int t1_eeprom_vpd_get(adapter_t *adapter, struct chelsio_vpd_t *vpd)
+{
+        int addr, ret = 0;
+
+        for (addr = 0; !ret && addr < sizeof(*vpd); addr += sizeof(u32))
+                ret = t1_seeprom_read(adapter, addr,
+                                      (u32 *)((u8 *)vpd + addr));
+
+        return ret;
+}
+
+/*
+ * Read a port's MAC address from the VPD ROM.
+ */
+static int vpd_macaddress_get(adapter_t *adapter, int index, u8 mac_addr[])
+{
+        struct chelsio_vpd_t vpd;
+
+        if (t1_eeprom_vpd_get(adapter, &vpd))
+                return 1;
+        memcpy(mac_addr, vpd.mac_base_address, 5);
+        mac_addr[5] = vpd.mac_base_address[5] + index;
+        return 0;
+}
+
+/*
+ * Set up the MAC/PHY according to the requested link settings.
+ *
+ * If the PHY can auto-negotiate first decide what to advertise, then
+ * enable/disable auto-negotiation as desired and reset.
+ *
+ * If the PHY does not auto-negotiate we just reset it.
+ *
+ * If auto-negotiation is off set the MAC to the proper speed/duplex/FC,
+ * otherwise do it later based on the outcome of auto-negotiation.
+ */
+int t1_link_start(struct cphy *phy, struct cmac *mac, struct link_config *lc)
+{
+        unsigned int fc = lc->requested_fc & (PAUSE_RX | PAUSE_TX);
+
+        if (lc->supported & SUPPORTED_Autoneg) {
+                lc->advertising &= ~(ADVERTISED_ASYM_PAUSE | ADVERTISED_PAUSE);
+                if (fc) {
+                        lc->advertising |= ADVERTISED_ASYM_PAUSE;
+                        if (fc == (PAUSE_RX | PAUSE_TX))
+                                lc->advertising |= ADVERTISED_PAUSE;
+                }
+                phy->ops->advertise(phy, lc->advertising);
+
+                if (lc->autoneg == AUTONEG_DISABLE) {
+                        lc->speed = lc->requested_speed;
+                        lc->duplex = lc->requested_duplex;
+                        lc->fc = (unsigned char)fc;
+                        mac->ops->set_speed_duplex_fc(mac, lc->speed,
+                                                      lc->duplex, fc);
+                        /* Also disables autoneg */
+                        phy->ops->set_speed_duplex(phy, lc->speed, lc->duplex);
+                        phy->ops->reset(phy, 0);
+                } else
+                        phy->ops->autoneg_enable(phy); /* also resets PHY */
+        } else {
+                mac->ops->set_speed_duplex_fc(mac, -1, -1, fc);
+                lc->fc = (unsigned char)fc;
+                phy->ops->reset(phy, 0);
+        }
+        return 0;
+}
+
+/*
+ * External interrupt handler for boards using elmer0.
+ */
+int elmer0_ext_intr_handler(adapter_t *adapter)
+{
+        struct cphy *phy;
+        int phy_cause;
+        u32 cause;
+
+        t1_tpi_read(adapter, A_ELMER0_INT_CAUSE, &cause);
+
+        switch (board_info(adapter)->board) {
+        case CHBT_BOARD_N210:
+        case CHBT_BOARD_N110:
+                if (cause & ELMER0_GP_BIT6) { /* Marvell 88x2010 interrupt */
+                        phy = adapter->port[0].phy;
+                        phy_cause = phy->ops->interrupt_handler(phy);
+                        if (phy_cause & cphy_cause_link_change)
+                                link_changed(adapter, 0);
+                }
+                break;
+        }
+        t1_tpi_write(adapter, A_ELMER0_INT_CAUSE, cause);
+        return 0;
+}
+
+/* Enables all interrupts. */
+void t1_interrupts_enable(adapter_t *adapter)
+{
+        unsigned int i;
+        u32 pl_intr;
+
+        adapter->slow_intr_mask = F_PL_INTR_SGE_ERR;
+
+        t1_sge_intr_enable(adapter->sge);
+        if (adapter->espi) {
+                adapter->slow_intr_mask |= F_PL_INTR_ESPI;
+                t1_espi_intr_enable(adapter->espi);
+        }
+
+        /* Enable MAC/PHY interrupts for each port. */
+        for_each_port(adapter, i) {
+                adapter->port[i].mac->ops->interrupt_enable(adapter->port[i].mac);
+                adapter->port[i].phy->ops->interrupt_enable(adapter->port[i].phy);
+        }
+
+        /* Enable PCIX & external chip interrupts on ASIC boards. */
+        pl_intr = readl(adapter->regs + A_PL_ENABLE);
+
+        /* PCI-X interrupts */
+        pci_write_config_dword(adapter->pdev, A_PCICFG_INTR_ENABLE,
+                               0xffffffff);
+
+        adapter->slow_intr_mask |= F_PL_INTR_EXT | F_PL_INTR_PCIX;
+        pl_intr |= F_PL_INTR_EXT | F_PL_INTR_PCIX;
+        writel(pl_intr, adapter->regs + A_PL_ENABLE);
+}
+
+/* Disables all interrupts. */
+void t1_interrupts_disable(adapter_t* adapter)
+{
+        unsigned int i;
+
+        t1_sge_intr_disable(adapter->sge);
+        if (adapter->espi)
+                t1_espi_intr_disable(adapter->espi);
+
+        /* Disable MAC/PHY interrupts for each port. */
+        for_each_port(adapter, i) {
+                adapter->port[i].mac->ops->interrupt_disable(adapter->port[i].mac);
+                adapter->port[i].phy->ops->interrupt_disable(adapter->port[i].phy);
+        }
+
+        /* Disable PCIX & external chip interrupts. */
+        writel(0, adapter->regs + A_PL_ENABLE);
+
+        /* PCI-X interrupts */
+        pci_write_config_dword(adapter->pdev, A_PCICFG_INTR_ENABLE, 0);
+
+        adapter->slow_intr_mask = 0;
+}
+
+/* Clears all interrupts */
+void t1_interrupts_clear(adapter_t* adapter)
+{
+        unsigned int i;
+        u32 pl_intr;
+
+
+        t1_sge_intr_clear(adapter->sge);
+        if (adapter->espi)
+                t1_espi_intr_clear(adapter->espi);
+
+        /* Clear MAC/PHY interrupts for each port. */
+        for_each_port(adapter, i) {
+                adapter->port[i].mac->ops->interrupt_clear(adapter->port[i].mac);
+                adapter->port[i].phy->ops->interrupt_clear(adapter->port[i].phy);
+        }
+
+        /* Enable interrupts for external devices. */
+        pl_intr = readl(adapter->regs + A_PL_CAUSE);
+
+        writel(pl_intr | F_PL_INTR_EXT | F_PL_INTR_PCIX,
+               adapter->regs + A_PL_CAUSE);
+
+        /* PCI-X interrupts */
+        pci_write_config_dword(adapter->pdev, A_PCICFG_INTR_CAUSE, 0xffffffff);
+}
+
+/*
+ * Slow path interrupt handler for ASICs.
+ */
+int t1_slow_intr_handler(adapter_t *adapter)
+{
+        u32 cause = readl(adapter->regs + A_PL_CAUSE);
+
+        cause &= adapter->slow_intr_mask;
+        if (!cause)
+                return 0;
+        if (cause & F_PL_INTR_SGE_ERR)
+                t1_sge_intr_error_handler(adapter->sge);
+        if (cause & F_PL_INTR_ESPI)
+                t1_espi_intr_handler(adapter->espi);
+        if (cause & F_PL_INTR_PCIX)
+                t1_pci_intr_handler(adapter);
+        if (cause & F_PL_INTR_EXT)
+                t1_elmer0_ext_intr(adapter);
+
+        /* Clear the interrupts just processed. */
+        writel(cause, adapter->regs + A_PL_CAUSE);
+        (void)readl(adapter->regs + A_PL_CAUSE); /* flush writes */
+        return 1;
+}
+
+/* Pause deadlock avoidance parameters */
+#define DROP_MSEC 16
+#define DROP_PKTS_CNT  1
+
+static void set_csum_offload(adapter_t *adapter, u32 csum_bit, int enable)
+{
+        u32 val = readl(adapter->regs + A_TP_GLOBAL_CONFIG);
+
+        if (enable)
+                val |= csum_bit;
+        else
+                val &= ~csum_bit;
+        writel(val, adapter->regs + A_TP_GLOBAL_CONFIG);
+}
+
+void t1_tp_set_ip_checksum_offload(adapter_t *adapter, int enable)
+{
+        set_csum_offload(adapter, F_IP_CSUM, enable);
+}
+
+void t1_tp_set_udp_checksum_offload(adapter_t *adapter, int enable)
+{
+        set_csum_offload(adapter, F_UDP_CSUM, enable);
+}
+
+void t1_tp_set_tcp_checksum_offload(adapter_t *adapter, int enable)
+{
+        set_csum_offload(adapter, F_TCP_CSUM, enable);
+}
+
+static void t1_tp_reset(adapter_t *adapter, unsigned int tp_clk)
+{
+        u32 val;
+
+        val = F_TP_IN_CSPI_CPL | F_TP_IN_CSPI_CHECK_IP_CSUM |
+              F_TP_IN_CSPI_CHECK_TCP_CSUM | F_TP_IN_ESPI_ETHERNET;
+        val |= F_TP_IN_ESPI_CHECK_IP_CSUM |
+               F_TP_IN_ESPI_CHECK_TCP_CSUM;
+        writel(val, adapter->regs + A_TP_IN_CONFIG);
+        writel(F_TP_OUT_CSPI_CPL |
+               F_TP_OUT_ESPI_ETHERNET |
+               F_TP_OUT_ESPI_GENERATE_IP_CSUM |
+               F_TP_OUT_ESPI_GENERATE_TCP_CSUM,
+               adapter->regs + A_TP_OUT_CONFIG);
+
+        val = readl(adapter->regs + A_TP_GLOBAL_CONFIG);
+        val &= ~(F_IP_CSUM | F_UDP_CSUM | F_TCP_CSUM);
+        writel(val, adapter->regs + A_TP_GLOBAL_CONFIG);
+
+        /*
+         * Enable pause frame deadlock prevention.
+         */
+        if (is_T2(adapter)) {
+                u32 drop_ticks = DROP_MSEC * (tp_clk / 1000);
+
+                writel(F_ENABLE_TX_DROP | F_ENABLE_TX_ERROR |
+                       V_DROP_TICKS_CNT(drop_ticks) |
+                       V_NUM_PKTS_DROPPED(DROP_PKTS_CNT),
+                       adapter->regs + A_TP_TX_DROP_CONFIG);
+        }
+
+        writel(F_TP_RESET, adapter->regs + A_TP_RESET);
+}
+
+int __devinit t1_get_board_rev(adapter_t *adapter, const struct board_info *bi,
+                               struct adapter_params *p)
+{
+        p->chip_version = bi->chip_term;
+        if (p->chip_version == CHBT_TERM_T1 ||
+            p->chip_version == CHBT_TERM_T2) {
+                u32 val = readl(adapter->regs + A_TP_PC_CONFIG);
+
+                val = G_TP_PC_REV(val);
+                if (val == 2)
+                        p->chip_revision = TERM_T1B;
+                else if (val == 3)
+                        p->chip_revision = TERM_T2;
+                else
+                        return -1;
+        } else
+                return -1;
+        return 0;
+}
+
+/*
+ * Enable board components other than the Chelsio chip, such as external MAC
+ * and PHY.
+ */
+static int board_init(adapter_t *adapter, const struct board_info *bi)
+{
+        switch (bi->board) {
+        case CHBT_BOARD_N110:
+        case CHBT_BOARD_N210:
+                writel(V_TPIPAR(0xf), adapter->regs + A_TPI_PAR);
+                t1_tpi_write(adapter, A_ELMER0_GPO, 0x800);
+                break;
+        }
+        return 0;
+}
+
+/*
+ * Initialize and configure the Terminator HW modules.  Note that external
+ * MAC and PHYs are initialized separately.
+ */
+int t1_init_hw_modules(adapter_t *adapter)
+{
+        int err = -EIO;
+        const struct board_info *bi = board_info(adapter);
+
+        if (!bi->clock_mc4) {
+                u32 val = readl(adapter->regs + A_MC4_CFG);
+
+                writel(val | F_READY | F_MC4_SLOW, adapter->regs + A_MC4_CFG);
+                writel(F_M_BUS_ENABLE | F_TCAM_RESET,
+                       adapter->regs + A_MC5_CONFIG);
+        }
+
+        if (adapter->espi && t1_espi_init(adapter->espi, bi->chip_mac,
+                                          bi->espi_nports))
+                goto out_err;
+
+        t1_tp_reset(adapter, bi->clock_core);
+
+        err = t1_sge_configure(adapter->sge, &adapter->params.sge);
+        if (err)
+                goto out_err;
+
+        err = 0;
+ out_err:
+        return err;
+}
+
+/*
+ * Determine a card's PCI mode.
+ */
+static void __devinit get_pci_mode(adapter_t *adapter, struct chelsio_pci_params *p)
+{
+        static unsigned short speed_map[] = { 33, 66, 100, 133 };
+        u32 pci_mode;
+
+        pci_read_config_dword(adapter->pdev, A_PCICFG_MODE, &pci_mode);
+        p->speed = speed_map[G_PCI_MODE_CLK(pci_mode)];
+        p->width = (pci_mode & F_PCI_MODE_64BIT) ? 64 : 32;
+        p->is_pcix = (pci_mode & F_PCI_MODE_PCIX) != 0;
+}
+
+/*
+ * Release the structures holding the SW per-Terminator-HW-module state.
+ */
+void t1_free_sw_modules(adapter_t *adapter)
+{
+        unsigned int i;
+
+        for_each_port(adapter, i) {
+                struct cmac *mac = adapter->port[i].mac;
+                struct cphy *phy = adapter->port[i].phy;
+
+                if (mac)
+                        mac->ops->destroy(mac);
+                if (phy)
+                        phy->ops->destroy(phy);
+        }
+
+        if (adapter->sge)
+                t1_sge_destroy(adapter->sge);
+        if (adapter->espi)
+                t1_espi_destroy(adapter->espi);
+}
+
+static void __devinit init_link_config(struct link_config *lc,
+                                       const struct board_info *bi)
+{
+        lc->supported = bi->caps;
+        lc->requested_speed = lc->speed = SPEED_INVALID;
+        lc->requested_duplex = lc->duplex = DUPLEX_INVALID;
+        lc->requested_fc = lc->fc = PAUSE_RX | PAUSE_TX;
+        if (lc->supported & SUPPORTED_Autoneg) {
+                lc->advertising = lc->supported;
+                lc->autoneg = AUTONEG_ENABLE;
+                lc->requested_fc |= PAUSE_AUTONEG;
+        } else {
+                lc->advertising = 0;
+                lc->autoneg = AUTONEG_DISABLE;
+        }
+}
+
+
+/*
+ * Allocate and initialize the data structures that hold the SW state of
+ * the Terminator HW modules.
+ */
+int __devinit t1_init_sw_modules(adapter_t *adapter,
+                                 const struct board_info *bi)
+{
+        unsigned int i;
+
+        adapter->params.brd_info = bi;
+        adapter->params.nports = bi->port_number;
+        adapter->params.stats_update_period = bi->gmac->stats_update_period;
+
+        adapter->sge = t1_sge_create(adapter, &adapter->params.sge);
+        if (!adapter->sge) {
+                CH_ERR("%s: SGE initialization failed\n",
+                       adapter->name);
+                goto error;
+        }
+
+        if (bi->espi_nports && !(adapter->espi = t1_espi_create(adapter))) {
+                CH_ERR("%s: ESPI initialization failed\n",
+                       adapter->name);
+                goto error;
+        }
+
+        board_init(adapter, bi);
+        bi->mdio_ops->init(adapter, bi);
+        if (bi->gphy->reset)
+                bi->gphy->reset(adapter);
+        if (bi->gmac->reset)
+                bi->gmac->reset(adapter);
+
+        for_each_port(adapter, i) {
+                u8 hw_addr[6];
+                struct cmac *mac;
+                int phy_addr = bi->mdio_phybaseaddr + i;
+
+                adapter->port[i].phy = bi->gphy->create(adapter, phy_addr,
+                                                        bi->mdio_ops);
+                if (!adapter->port[i].phy) {
+                        CH_ERR("%s: PHY %d initialization failed\n",
+                               adapter->name, i);
+                        goto error;
+                }
+
+                adapter->port[i].mac = mac = bi->gmac->create(adapter, i);
+                if (!mac) {
+                        CH_ERR("%s: MAC %d initialization failed\n",
+                               adapter->name, i);
+                        goto error;
+                }
+
+                /*
+                 * Get the port's MAC addresses either from the EEPROM if one
+                 * exists or the one hardcoded in the MAC.
+                 */
+                if (vpd_macaddress_get(adapter, i, hw_addr)) {
+                        CH_ERR("%s: could not read MAC address from VPD ROM\n",
+                               adapter->port[i].dev->name);
+                        goto error;
+                }
+                memcpy(adapter->port[i].dev->dev_addr, hw_addr, ETH_ALEN);
+                init_link_config(&adapter->port[i].link_config, bi);
+        }
+
+        get_pci_mode(adapter, &adapter->params.pci);
+        t1_interrupts_clear(adapter);
+        return 0;
+
+ error:
+        t1_free_sw_modules(adapter);
+        return -1;
+}
diff --git a/drivers/net/chelsio/suni1x10gexp_regs.h b/drivers/net/chelsio/suni1x10gexp_regs.h
new file mode 100644
index 000000000000..81816c2b708a
--- /dev/null
+++ b/drivers/net/chelsio/suni1x10gexp_regs.h
@@ -0,0 +1,213 @@
+/*****************************************************************************
+ *                                                                           *
+ * File: suni1x10gexp_regs.h                                                 *
+ * $Revision: 1.9 $                                                          *
+ * $Date: 2005/06/22 00:17:04 $                                              *
+ * Description:                                                              *
+ *  PMC/SIERRA (pm3393) MAC-PHY functionality.                               *
+ *  part of the Chelsio 10Gb Ethernet Driver.                                *
+ *                                                                           *
+ * This program is free software; you can redistribute it and/or modify      *
+ * it under the terms of the GNU General Public License, version 2, as       *
+ * published by the Free Software Foundation.                                *
+ *                                                                           *
+ * You should have received a copy of the GNU General Public License along   *
+ * with this program; if not, write to the Free Software Foundation, Inc.,   *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
+ *                                                                           *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
+ *                                                                           *
+ * http://www.chelsio.com                                                    *
+ *                                                                           *
+ * Maintainers: maintainers@chelsio.com                                      *
+ *                                                                           *
+ * Authors: PMC/SIERRA                                                       *
+ *                                                                           *
+ * History:                                                                  *
+ *                                                                           *
+ ****************************************************************************/
+
+#ifndef _CXGB_SUNI1x10GEXP_REGS_H_
+#define _CXGB_SUNI1x10GEXP_REGS_H_
+
+/******************************************************************************/
+/** S/UNI-1x10GE-XP REGISTER ADDRESS MAP                                     **/
+/******************************************************************************/
+/* Refer to the Register Bit Masks bellow for the naming of each register and */
+/* to the S/UNI-1x10GE-XP Data Sheet for the signification of each bit        */
+/******************************************************************************/
+
+#define SUNI1x10GEXP_REG_DEVICE_STATUS                                   0x0004
+#define SUNI1x10GEXP_REG_MASTER_INTERRUPT_STATUS                         0x000D
+#define SUNI1x10GEXP_REG_GLOBAL_INTERRUPT_ENABLE                         0x000E
+#define SUNI1x10GEXP_REG_SERDES_3125_INTERRUPT_ENABLE                    0x0102
+#define SUNI1x10GEXP_REG_SERDES_3125_INTERRUPT_STATUS                    0x0104
+#define SUNI1x10GEXP_REG_RXXG_CONFIG_1                                   0x2040
+#define SUNI1x10GEXP_REG_RXXG_CONFIG_3                                   0x2042
+#define SUNI1x10GEXP_REG_RXXG_INTERRUPT                                  0x2043
+#define SUNI1x10GEXP_REG_RXXG_MAX_FRAME_LENGTH                           0x2045
+#define SUNI1x10GEXP_REG_RXXG_SA_15_0                                    0x2046
+#define SUNI1x10GEXP_REG_RXXG_SA_31_16                                   0x2047
+#define SUNI1x10GEXP_REG_RXXG_SA_47_32                                   0x2048
+#define SUNI1x10GEXP_REG_RXXG_EXACT_MATCH_ADDR_1_LOW                     0x204D
+#define SUNI1x10GEXP_REG_RXXG_EXACT_MATCH_ADDR_1_MID                     0x204E
+#define SUNI1x10GEXP_REG_RXXG_EXACT_MATCH_ADDR_1_HIGH                    0x204F
+#define SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_LOW                         0x206A
+#define SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_MIDLOW                      0x206B
+#define SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_MIDHIGH                     0x206C
+#define SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_HIGH                        0x206D
+#define SUNI1x10GEXP_REG_RXXG_ADDRESS_FILTER_CONTROL_0                   0x206E
+#define SUNI1x10GEXP_REG_RXXG_ADDRESS_FILTER_CONTROL_2                   0x2070
+#define SUNI1x10GEXP_REG_XRF_INTERRUPT_ENABLE                            0x2088
+#define SUNI1x10GEXP_REG_XRF_INTERRUPT_STATUS                            0x2089
+#define SUNI1x10GEXP_REG_XRF_DIAG_INTERRUPT_ENABLE                       0x208B
+#define SUNI1x10GEXP_REG_XRF_DIAG_INTERRUPT_STATUS                       0x208C
+#define SUNI1x10GEXP_REG_RXOAM_INTERRUPT_ENABLE                          0x20C7
+#define SUNI1x10GEXP_REG_RXOAM_INTERRUPT_STATUS                          0x20C8
+#define SUNI1x10GEXP_REG_MSTAT_CONTROL                                   0x2100
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_ROLLOVER_0                        0x2101
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_ROLLOVER_1                        0x2102
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_ROLLOVER_2                        0x2103
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_ROLLOVER_3                        0x2104
+#define SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_0                          0x2105
+#define SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_1                          0x2106
+#define SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_2                          0x2107
+#define SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_3                          0x2108
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_0_LOW                             0x2110
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_1_LOW                             0x2114
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_4_LOW                             0x2120
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_5_LOW                             0x2124
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_6_LOW                             0x2128
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_8_LOW                             0x2130
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_10_LOW                            0x2138
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_11_LOW                            0x213C
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_12_LOW                            0x2140
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_13_LOW                            0x2144
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_15_LOW                            0x214C
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_16_LOW                            0x2150
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_17_LOW                            0x2154
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_18_LOW                            0x2158
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_33_LOW                            0x2194
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_35_LOW                            0x219C
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_36_LOW                            0x21A0
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_38_LOW                            0x21A8
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_40_LOW                            0x21B0
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_42_LOW                            0x21B8
+#define SUNI1x10GEXP_REG_MSTAT_COUNTER_43_LOW                            0x21BC
+#define SUNI1x10GEXP_REG_IFLX_FIFO_OVERFLOW_ENABLE                       0x2209
+#define SUNI1x10GEXP_REG_IFLX_FIFO_OVERFLOW_INTERRUPT                    0x220A
+#define SUNI1x10GEXP_REG_PL4ODP_INTERRUPT_MASK                           0x2282
+#define SUNI1x10GEXP_REG_PL4ODP_INTERRUPT                                0x2283
+#define SUNI1x10GEXP_REG_PL4IO_LOCK_DETECT_STATUS                        0x2300
+#define SUNI1x10GEXP_REG_PL4IO_LOCK_DETECT_CHANGE                        0x2301
+#define SUNI1x10GEXP_REG_PL4IO_LOCK_DETECT_MASK                          0x2302
+#define SUNI1x10GEXP_REG_TXXG_CONFIG_1                                   0x3040
+#define SUNI1x10GEXP_REG_TXXG_CONFIG_3                                   0x3042
+#define SUNI1x10GEXP_REG_TXXG_INTERRUPT                                  0x3043
+#define SUNI1x10GEXP_REG_TXXG_MAX_FRAME_SIZE                             0x3045
+#define SUNI1x10GEXP_REG_TXXG_SA_15_0                                    0x3047
+#define SUNI1x10GEXP_REG_TXXG_SA_31_16                                   0x3048
+#define SUNI1x10GEXP_REG_TXXG_SA_47_32                                   0x3049
+#define SUNI1x10GEXP_REG_XTEF_INTERRUPT_STATUS                           0x3084
+#define SUNI1x10GEXP_REG_XTEF_INTERRUPT_ENABLE                           0x3085
+#define SUNI1x10GEXP_REG_TXOAM_INTERRUPT_ENABLE                          0x30C6
+#define SUNI1x10GEXP_REG_TXOAM_INTERRUPT_STATUS                          0x30C7
+#define SUNI1x10GEXP_REG_EFLX_FIFO_OVERFLOW_ERROR_ENABLE                 0x320C
+#define SUNI1x10GEXP_REG_EFLX_FIFO_OVERFLOW_ERROR_INDICATION             0x320D
+#define SUNI1x10GEXP_REG_PL4IDU_INTERRUPT_MASK                           0x3282
+#define SUNI1x10GEXP_REG_PL4IDU_INTERRUPT                                0x3283
+
+/******************************************************************************/
+/*                 -- End register offset definitions --                      */
+/******************************************************************************/
+
+/******************************************************************************/
+/** SUNI-1x10GE-XP REGISTER BIT MASKS                                        **/
+/******************************************************************************/
+
+/*----------------------------------------------------------------------------
+ * Register 0x0004: S/UNI-1x10GE-XP Device Status
+ *    Bit 9 TOP_SXRA_EXPIRED
+ *    Bit 8 TOP_MDIO_BUSY
+ *    Bit 7 TOP_DTRB
+ *    Bit 6 TOP_EXPIRED
+ *    Bit 5 TOP_PAUSED
+ *    Bit 4 TOP_PL4_ID_DOOL
+ *    Bit 3 TOP_PL4_IS_DOOL
+ *    Bit 2 TOP_PL4_ID_ROOL
+ *    Bit 1 TOP_PL4_IS_ROOL
+ *    Bit 0 TOP_PL4_OUT_ROOL
+ *----------------------------------------------------------------------------*/
+#define SUNI1x10GEXP_BITMSK_TOP_SXRA_EXPIRED  0x0200
+#define SUNI1x10GEXP_BITMSK_TOP_EXPIRED       0x0040
+#define SUNI1x10GEXP_BITMSK_TOP_PL4_ID_DOOL   0x0010
+#define SUNI1x10GEXP_BITMSK_TOP_PL4_IS_DOOL   0x0008
+#define SUNI1x10GEXP_BITMSK_TOP_PL4_ID_ROOL   0x0004
+#define SUNI1x10GEXP_BITMSK_TOP_PL4_IS_ROOL   0x0002
+#define SUNI1x10GEXP_BITMSK_TOP_PL4_OUT_ROOL  0x0001
+
+/*----------------------------------------------------------------------------
+ * Register 0x000E:PM3393 Global interrupt enable
+ *    Bit 15 TOP_INTE
+ *----------------------------------------------------------------------------*/
+#define SUNI1x10GEXP_BITMSK_TOP_INTE  0x8000
+
+/*----------------------------------------------------------------------------
+ * Register 0x2040: RXXG Configuration 1
+ *    Bit 15  RXXG_RXEN
+ *    Bit 14  RXXG_ROCF
+ *    Bit 13  RXXG_PAD_STRIP
+ *    Bit 10  RXXG_PUREP
+ *    Bit 9   RXXG_LONGP
+ *    Bit 8   RXXG_PARF
+ *    Bit 7   RXXG_FLCHK
+ *    Bit 5   RXXG_PASS_CTRL
+ *    Bit 3   RXXG_CRC_STRIP
+ *    Bit 2-0 RXXG_MIFG
+ *----------------------------------------------------------------------------*/
+#define SUNI1x10GEXP_BITMSK_RXXG_RXEN       0x8000
+#define SUNI1x10GEXP_BITMSK_RXXG_PUREP      0x0400
+#define SUNI1x10GEXP_BITMSK_RXXG_FLCHK      0x0080
+#define SUNI1x10GEXP_BITMSK_RXXG_CRC_STRIP  0x0008
+
+/*----------------------------------------------------------------------------
+ * Register 0x2070: RXXG Address Filter Control 2
+ *    Bit 1 RXXG_PMODE
+ *    Bit 0 RXXG_MHASH_EN
+ *----------------------------------------------------------------------------*/
+#define SUNI1x10GEXP_BITMSK_RXXG_PMODE     0x0002
+#define SUNI1x10GEXP_BITMSK_RXXG_MHASH_EN  0x0001
+
+/*----------------------------------------------------------------------------
+ * Register 0x2100: MSTAT Control
+ *    Bit 2 MSTAT_WRITE
+ *    Bit 1 MSTAT_CLEAR
+ *    Bit 0 MSTAT_SNAP
+ *----------------------------------------------------------------------------*/
+#define SUNI1x10GEXP_BITMSK_MSTAT_CLEAR  0x0002
+#define SUNI1x10GEXP_BITMSK_MSTAT_SNAP   0x0001
+
+/*----------------------------------------------------------------------------
+ * Register 0x3040: TXXG Configuration Register 1
+ *    Bit 15   TXXG_TXEN0
+ *    Bit 13   TXXG_HOSTPAUSE
+ *    Bit 12-7 TXXG_IPGT
+ *    Bit 5    TXXG_32BIT_ALIGN
+ *    Bit 4    TXXG_CRCEN
+ *    Bit 3    TXXG_FCTX
+ *    Bit 2    TXXG_FCRX
+ *    Bit 1    TXXG_PADEN
+ *    Bit 0    TXXG_SPRE
+ *----------------------------------------------------------------------------*/
+#define SUNI1x10GEXP_BITMSK_TXXG_TXEN0        0x8000
+#define SUNI1x10GEXP_BITOFF_TXXG_IPGT         7
+#define SUNI1x10GEXP_BITMSK_TXXG_32BIT_ALIGN  0x0020
+#define SUNI1x10GEXP_BITMSK_TXXG_CRCEN        0x0010
+#define SUNI1x10GEXP_BITMSK_TXXG_FCTX         0x0008
+#define SUNI1x10GEXP_BITMSK_TXXG_FCRX         0x0004
+#define SUNI1x10GEXP_BITMSK_TXXG_PADEN        0x0002
+
+#endif /* _CXGB_SUNI1x10GEXP_REGS_H_ */
+
diff --git a/drivers/net/dm9000.c b/drivers/net/dm9000.c
index 5fddc0ff8878..6440a892bb81 100644
--- a/drivers/net/dm9000.c
+++ b/drivers/net/dm9000.c
@@ -48,6 +48,10 @@
  *                        net_device_stats
  *                      * introduced tx_timeout function
  *                      * reworked locking
+ *
+ *        01-Jul-2005   Ben Dooks <ben@simtec.co.uk>
+ *                      * fixed spinlock call without pointer
+ *                      * ensure spinlock is initialised
  */
 
 #include <linux/module.h>
@@ -148,7 +152,6 @@ static int dm9000_probe(struct device *);
 static int dm9000_open(struct net_device *);
 static int dm9000_start_xmit(struct sk_buff *, struct net_device *);
 static int dm9000_stop(struct net_device *);
-static int dm9000_do_ioctl(struct net_device *, struct ifreq *, int);
 
 
 static void dm9000_timer(unsigned long);
@@ -322,7 +325,7 @@ static void dm9000_timeout(struct net_device *dev)
 
         /* Save previous register address */
         reg_save = readb(db->io_addr);
-        spin_lock_irqsave(db->lock,flags);
+        spin_lock_irqsave(&db->lock,flags);
 
         netif_stop_queue(dev);
         dm9000_reset(db);
@@ -333,7 +336,7 @@ static void dm9000_timeout(struct net_device *dev)
 
         /* Restore previous register address */
         writeb(reg_save, db->io_addr);
-        spin_unlock_irqrestore(db->lock,flags);
+        spin_unlock_irqrestore(&db->lock,flags);
 }
 
 
@@ -387,8 +390,6 @@ dm9000_probe(struct device *dev)
         int i;
         u32 id_val;
 
-        printk(KERN_INFO "%s Ethernet Driver\n", CARDNAME);
-
         /* Init network device */
         ndev = alloc_etherdev(sizeof (struct board_info));
         if (!ndev) {
@@ -405,6 +406,8 @@ dm9000_probe(struct device *dev)
         db = (struct board_info *) ndev->priv;
         memset(db, 0, sizeof (*db));
 
+        spin_lock_init(&db->lock);
+
         if (pdev->num_resources < 2) {
                 ret = -ENODEV;
                 goto out;
@@ -541,7 +544,6 @@ dm9000_probe(struct device *dev)
         ndev->stop               = &dm9000_stop;
         ndev->get_stats          = &dm9000_get_stats;
         ndev->set_multicast_list = &dm9000_hash_table;
-        ndev->do_ioctl           = &dm9000_do_ioctl;
 
 #ifdef DM9000_PROGRAM_EEPROM
         program_eeprom(db);
@@ -612,7 +614,7 @@ dm9000_open(struct net_device *dev)
 
         /* set and active a timer process */
         init_timer(&db->timer);
-        db->timer.expires  = DM9000_TIMER_WUT * 2;
+        db->timer.expires  = DM9000_TIMER_WUT;
         db->timer.data     = (unsigned long) dev;
         db->timer.function = &dm9000_timer;
         add_timer(&db->timer);
@@ -845,15 +847,6 @@ dm9000_get_stats(struct net_device *dev)
         return &db->stats;
 }
 
-/*
- *  Process the upper socket ioctl command
- */
-static int
-dm9000_do_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
-{
-        PRINTK1("entering %s\n",__FUNCTION__);
-        return 0;
-}
 
 /*
  *  A periodic timer routine
@@ -864,21 +857,11 @@ dm9000_timer(unsigned long data)
 {
         struct net_device *dev = (struct net_device *) data;
         board_info_t *db = (board_info_t *) dev->priv;
-        u8 reg_save;
-        unsigned long flags;
 
         PRINTK3("dm9000_timer()\n");
 
-        spin_lock_irqsave(db->lock,flags);
-        /* Save previous register address */
-        reg_save = readb(db->io_addr);
-
         mii_check_media(&db->mii, netif_msg_link(db), 0);
 
-        /* Restore previous register address */
-        writeb(reg_save, db->io_addr);
-        spin_unlock_irqrestore(db->lock,flags);
-
         /* Set timer again */
         db->timer.expires = DM9000_TIMER_WUT;
         add_timer(&db->timer);
@@ -1098,9 +1081,14 @@ dm9000_phy_read(struct net_device *dev, int phy_reg_unused, int reg)
 {
         board_info_t *db = (board_info_t *) dev->priv;
         unsigned long flags;
+        unsigned int reg_save;
         int ret;
 
         spin_lock_irqsave(&db->lock,flags);
+
+        /* Save previous register address */
+        reg_save = readb(db->io_addr);
+
         /* Fill the phyxcer register into REG_0C */
         iow(db, DM9000_EPAR, DM9000_PHY | reg);
 
@@ -1111,6 +1099,9 @@ dm9000_phy_read(struct net_device *dev, int phy_reg_unused, int reg)
         /* The read data keeps on REG_0D & REG_0E */
         ret = (ior(db, DM9000_EPDRH) << 8) | ior(db, DM9000_EPDRL);
 
+        /* restore the previous address */
+        writeb(reg_save, db->io_addr);
+
         spin_unlock_irqrestore(&db->lock,flags);
 
         return ret;
@@ -1124,9 +1115,13 @@ dm9000_phy_write(struct net_device *dev, int phyaddr_unused, int reg, int value)
 {
         board_info_t *db = (board_info_t *) dev->priv;
         unsigned long flags;
+        unsigned long reg_save;
 
         spin_lock_irqsave(&db->lock,flags);
 
+        /* Save previous register address */
+        reg_save = readb(db->io_addr);
+
         /* Fill the phyxcer register into REG_0C */
         iow(db, DM9000_EPAR, DM9000_PHY | reg);
 
@@ -1138,6 +1133,9 @@ dm9000_phy_write(struct net_device *dev, int phyaddr_unused, int reg, int value)
         udelay(500);            /* Wait write complete */
         iow(db, DM9000_EPCR, 0x0);      /* Clear phyxcer write command */
 
+        /* restore the previous address */
+        writeb(reg_save, db->io_addr);
+
         spin_unlock_irqrestore(&db->lock,flags);
 }
 
@@ -1202,6 +1200,8 @@ static struct device_driver dm9000_driver = {
 static int __init
 dm9000_init(void)
 {
+        printk(KERN_INFO "%s Ethernet Driver\n", CARDNAME);
+
         return driver_register(&dm9000_driver); /* search board and register */
 }
 
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index d0fa2448761d..25cc20e415da 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   
-  Copyright(c) 1999 - 2004 Intel Corporation. All rights reserved.
+  Copyright(c) 1999 - 2005 Intel Corporation. All rights reserved.
   
   This program is free software; you can redistribute it and/or modify it 
   under the terms of the GNU General Public License as published by the Free 
@@ -156,7 +156,7 @@
 
 #define DRV_NAME                "e100"
 #define DRV_EXT         "-NAPI"
-#define DRV_VERSION             "3.4.8-k2"DRV_EXT
+#define DRV_VERSION             "3.4.14-k2"DRV_EXT
 #define DRV_DESCRIPTION         "Intel(R) PRO/100 Network Driver"
 #define DRV_COPYRIGHT           "Copyright(c) 1999-2005 Intel Corporation"
 #define PFX                     DRV_NAME ": "
@@ -785,6 +785,7 @@ static int e100_eeprom_save(struct nic *nic, u16 start, u16 count)
 }
 
 #define E100_WAIT_SCB_TIMEOUT 20000 /* we might have to wait 100ms!!! */
+#define E100_WAIT_SCB_FAST 20       /* delay like the old code */
 static inline int e100_exec_cmd(struct nic *nic, u8 cmd, dma_addr_t dma_addr)
 {
         unsigned long flags;
@@ -798,7 +799,7 @@ static inline int e100_exec_cmd(struct nic *nic, u8 cmd, dma_addr_t dma_addr)
                 if(likely(!readb(&nic->csr->scb.cmd_lo)))
                         break;
                 cpu_relax();
-                if(unlikely(i > (E100_WAIT_SCB_TIMEOUT >> 1)))
+                if(unlikely(i > E100_WAIT_SCB_FAST))
                         udelay(5);
         }
         if(unlikely(i == E100_WAIT_SCB_TIMEOUT)) {
@@ -902,8 +903,8 @@ static void mdio_write(struct net_device *netdev, int addr, int reg, int data)
 
 static void e100_get_defaults(struct nic *nic)
 {
-        struct param_range rfds = { .min = 16, .max = 256, .count = 64 };
-        struct param_range cbs  = { .min = 64, .max = 256, .count = 64 };
+        struct param_range rfds = { .min = 16, .max = 256, .count = 256 };
+        struct param_range cbs  = { .min = 64, .max = 256, .count = 128 };
 
         pci_read_config_byte(nic->pdev, PCI_REVISION_ID, &nic->rev_id);
         /* MAC type is encoded as rev ID; exception: ICH is treated as 82559 */
@@ -1006,25 +1007,213 @@ static void e100_configure(struct nic *nic, struct cb *cb, struct sk_buff *skb)
                 c[16], c[17], c[18], c[19], c[20], c[21], c[22], c[23]);
 }
 
+/********************************************************/
+/*  Micro code for 8086:1229 Rev 8                      */
+/********************************************************/
+
+/*  Parameter values for the D101M B-step  */
+#define D101M_CPUSAVER_TIMER_DWORD              78
+#define D101M_CPUSAVER_BUNDLE_DWORD             65
+#define D101M_CPUSAVER_MIN_SIZE_DWORD           126
+
+#define D101M_B_RCVBUNDLE_UCODE \
+{\
+0x00550215, 0xFFFF0437, 0xFFFFFFFF, 0x06A70789, 0xFFFFFFFF, 0x0558FFFF, \
+0x000C0001, 0x00101312, 0x000C0008, 0x00380216, \
+0x0010009C, 0x00204056, 0x002380CC, 0x00380056, \
+0x0010009C, 0x00244C0B, 0x00000800, 0x00124818, \
+0x00380438, 0x00000000, 0x00140000, 0x00380555, \
+0x00308000, 0x00100662, 0x00100561, 0x000E0408, \
+0x00134861, 0x000C0002, 0x00103093, 0x00308000, \
+0x00100624, 0x00100561, 0x000E0408, 0x00100861, \
+0x000C007E, 0x00222C21, 0x000C0002, 0x00103093, \
+0x00380C7A, 0x00080000, 0x00103090, 0x00380C7A, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x0010009C, 0x00244C2D, 0x00010004, 0x00041000, \
+0x003A0437, 0x00044010, 0x0038078A, 0x00000000, \
+0x00100099, 0x00206C7A, 0x0010009C, 0x00244C48, \
+0x00130824, 0x000C0001, 0x00101213, 0x00260C75, \
+0x00041000, 0x00010004, 0x00130826, 0x000C0006, \
+0x002206A8, 0x0013C926, 0x00101313, 0x003806A8, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00080600, 0x00101B10, 0x00050004, 0x00100826, \
+0x00101210, 0x00380C34, 0x00000000, 0x00000000, \
+0x0021155B, 0x00100099, 0x00206559, 0x0010009C, \
+0x00244559, 0x00130836, 0x000C0000, 0x00220C62, \
+0x000C0001, 0x00101B13, 0x00229C0E, 0x00210C0E, \
+0x00226C0E, 0x00216C0E, 0x0022FC0E, 0x00215C0E, \
+0x00214C0E, 0x00380555, 0x00010004, 0x00041000, \
+0x00278C67, 0x00040800, 0x00018100, 0x003A0437, \
+0x00130826, 0x000C0001, 0x00220559, 0x00101313, \
+0x00380559, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00130831, 0x0010090B, 0x00124813, \
+0x000CFF80, 0x002606AB, 0x00041000, 0x00010004, \
+0x003806A8, 0x00000000, 0x00000000, 0x00000000, \
+}
+
+/********************************************************/
+/*  Micro code for 8086:1229 Rev 9                      */
+/********************************************************/
+
+/*  Parameter values for the D101S  */
+#define D101S_CPUSAVER_TIMER_DWORD              78
+#define D101S_CPUSAVER_BUNDLE_DWORD             67
+#define D101S_CPUSAVER_MIN_SIZE_DWORD           128
+
+#define D101S_RCVBUNDLE_UCODE \
+{\
+0x00550242, 0xFFFF047E, 0xFFFFFFFF, 0x06FF0818, 0xFFFFFFFF, 0x05A6FFFF, \
+0x000C0001, 0x00101312, 0x000C0008, 0x00380243, \
+0x0010009C, 0x00204056, 0x002380D0, 0x00380056, \
+0x0010009C, 0x00244F8B, 0x00000800, 0x00124818, \
+0x0038047F, 0x00000000, 0x00140000, 0x003805A3, \
+0x00308000, 0x00100610, 0x00100561, 0x000E0408, \
+0x00134861, 0x000C0002, 0x00103093, 0x00308000, \
+0x00100624, 0x00100561, 0x000E0408, 0x00100861, \
+0x000C007E, 0x00222FA1, 0x000C0002, 0x00103093, \
+0x00380F90, 0x00080000, 0x00103090, 0x00380F90, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x0010009C, 0x00244FAD, 0x00010004, 0x00041000, \
+0x003A047E, 0x00044010, 0x00380819, 0x00000000, \
+0x00100099, 0x00206FFD, 0x0010009A, 0x0020AFFD, \
+0x0010009C, 0x00244FC8, 0x00130824, 0x000C0001, \
+0x00101213, 0x00260FF7, 0x00041000, 0x00010004, \
+0x00130826, 0x000C0006, 0x00220700, 0x0013C926, \
+0x00101313, 0x00380700, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00080600, 0x00101B10, 0x00050004, 0x00100826, \
+0x00101210, 0x00380FB6, 0x00000000, 0x00000000, \
+0x002115A9, 0x00100099, 0x002065A7, 0x0010009A, \
+0x0020A5A7, 0x0010009C, 0x002445A7, 0x00130836, \
+0x000C0000, 0x00220FE4, 0x000C0001, 0x00101B13, \
+0x00229F8E, 0x00210F8E, 0x00226F8E, 0x00216F8E, \
+0x0022FF8E, 0x00215F8E, 0x00214F8E, 0x003805A3, \
+0x00010004, 0x00041000, 0x00278FE9, 0x00040800, \
+0x00018100, 0x003A047E, 0x00130826, 0x000C0001, \
+0x002205A7, 0x00101313, 0x003805A7, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00130831, \
+0x0010090B, 0x00124813, 0x000CFF80, 0x00260703, \
+0x00041000, 0x00010004, 0x00380700  \
+}
+
+/********************************************************/
+/*  Micro code for the 8086:1229 Rev F/10               */
+/********************************************************/
+
+/*  Parameter values for the D102 E-step  */
+#define D102_E_CPUSAVER_TIMER_DWORD             42
+#define D102_E_CPUSAVER_BUNDLE_DWORD            54
+#define D102_E_CPUSAVER_MIN_SIZE_DWORD          46
+
+#define     D102_E_RCVBUNDLE_UCODE \
+{\
+0x007D028F, 0x0E4204F9, 0x14ED0C85, 0x14FA14E9, 0x0EF70E36, 0x1FFF1FFF, \
+0x00E014B9, 0x00000000, 0x00000000, 0x00000000, \
+0x00E014BD, 0x00000000, 0x00000000, 0x00000000, \
+0x00E014D5, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00E014C1, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00E014C8, 0x00000000, 0x00000000, 0x00000000, \
+0x00200600, 0x00E014EE, 0x00000000, 0x00000000, \
+0x0030FF80, 0x00940E46, 0x00038200, 0x00102000, \
+0x00E00E43, 0x00000000, 0x00000000, 0x00000000, \
+0x00300006, 0x00E014FB, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00906E41, 0x00800E3C, 0x00E00E39, 0x00000000, \
+0x00906EFD, 0x00900EFD, 0x00E00EF8, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+0x00000000, 0x00000000, 0x00000000, 0x00000000, \
+}
+
 static void e100_load_ucode(struct nic *nic, struct cb *cb, struct sk_buff *skb)
 {
-        int i;
-        static const u32 ucode[UCODE_SIZE] = {
-                /* NFS packets are misinterpreted as TCO packets and
-                 * incorrectly routed to the BMC over SMBus.  This
-                 * microcode patch checks the fragmented IP bit in the
-                 * NFS/UDP header to distinguish between NFS and TCO. */
-                0x0EF70E36, 0x1FFF1FFF, 0x1FFF1FFF, 0x1FFF1FFF, 0x1FFF1FFF,
-                0x1FFF1FFF, 0x00906E41, 0x00800E3C, 0x00E00E39, 0x00000000,
-                0x00906EFD, 0x00900EFD, 0x00E00EF8,
-        };
+/* *INDENT-OFF* */
+        static struct {
+                u32 ucode[UCODE_SIZE + 1];
+                u8 mac;
+                u8 timer_dword;
+                u8 bundle_dword;
+                u8 min_size_dword;
+        } ucode_opts[] = {
+                { D101M_B_RCVBUNDLE_UCODE,
+                  mac_82559_D101M,
+                  D101M_CPUSAVER_TIMER_DWORD,
+                  D101M_CPUSAVER_BUNDLE_DWORD,
+                  D101M_CPUSAVER_MIN_SIZE_DWORD },
+                { D101S_RCVBUNDLE_UCODE,
+                  mac_82559_D101S,
+                  D101S_CPUSAVER_TIMER_DWORD,
+                  D101S_CPUSAVER_BUNDLE_DWORD,
+                  D101S_CPUSAVER_MIN_SIZE_DWORD },
+                { D102_E_RCVBUNDLE_UCODE,
+                  mac_82551_F,
+                  D102_E_CPUSAVER_TIMER_DWORD,
+                  D102_E_CPUSAVER_BUNDLE_DWORD,
+                  D102_E_CPUSAVER_MIN_SIZE_DWORD },
+                { D102_E_RCVBUNDLE_UCODE,
+                  mac_82551_10,
+                  D102_E_CPUSAVER_TIMER_DWORD,
+                  D102_E_CPUSAVER_BUNDLE_DWORD,
+                  D102_E_CPUSAVER_MIN_SIZE_DWORD },
+                { {0}, 0, 0, 0, 0}
+        }, *opts;
+/* *INDENT-ON* */
+
+#define BUNDLESMALL 1
+#define BUNDLEMAX 50
+#define INTDELAY 15000
+
+        opts = ucode_opts;
+
+        /* do not load u-code for ICH devices */
+        if (nic->flags & ich)
+                return;
+
+        /* Search for ucode match against h/w rev_id */
+        while (opts->mac) {
+                if (nic->mac == opts->mac) {
+                        int i;
+                        u32 *ucode = opts->ucode;
+
+                        /* Insert user-tunable settings */
+                        ucode[opts->timer_dword] &= 0xFFFF0000;
+                        ucode[opts->timer_dword] |=
+                                (u16) INTDELAY;
+                        ucode[opts->bundle_dword] &= 0xFFFF0000;
+                        ucode[opts->bundle_dword] |= (u16) BUNDLEMAX;
+                        ucode[opts->min_size_dword] &= 0xFFFF0000;
+                        ucode[opts->min_size_dword] |=
+                                (BUNDLESMALL) ?  0xFFFF : 0xFF80;
+
+                        for(i = 0; i < UCODE_SIZE; i++)
+                                cb->u.ucode[i] = cpu_to_le32(ucode[i]);
+                        cb->command = cpu_to_le16(cb_ucode);
+                        return;
+                }
+                opts++;
+        }
 
-        if(nic->mac == mac_82551_F || nic->mac == mac_82551_10) {
-                for(i = 0; i < UCODE_SIZE; i++)
-                        cb->u.ucode[i] = cpu_to_le32(ucode[i]);
-                cb->command = cpu_to_le16(cb_ucode);
-        } else
-                cb->command = cpu_to_le16(cb_nop);
+        cb->command = cpu_to_le16(cb_nop);
 }
 
 static void e100_setup_iaaddr(struct nic *nic, struct cb *cb,
@@ -1307,14 +1496,15 @@ static inline void e100_xmit_prepare(struct nic *nic, struct cb *cb,
 {
         cb->command = nic->tx_command;
         /* interrupt every 16 packets regardless of delay */
-        if((nic->cbs_avail & ~15) == nic->cbs_avail) cb->command |= cb_i;
+        if((nic->cbs_avail & ~15) == nic->cbs_avail)
+                cb->command |= cpu_to_le16(cb_i);
         cb->u.tcb.tbd_array = cb->dma_addr + offsetof(struct cb, u.tcb.tbd);
         cb->u.tcb.tcb_byte_count = 0;
         cb->u.tcb.threshold = nic->tx_threshold;
         cb->u.tcb.tbd_count = 1;
         cb->u.tcb.tbd.buf_addr = cpu_to_le32(pci_map_single(nic->pdev,
                 skb->data, skb->len, PCI_DMA_TODEVICE));
-        // check for mapping failure?
+        /* check for mapping failure? */
         cb->u.tcb.tbd.size = cpu_to_le16(skb->len);
 }
 
@@ -1539,7 +1729,7 @@ static inline int e100_rx_indicate(struct nic *nic, struct rx *rx,
                 /* Don't indicate if hardware indicates errors */
                 nic->net_stats.rx_dropped++;
                 dev_kfree_skb_any(skb);
-        } else if(actual_size > nic->netdev->mtu + VLAN_ETH_HLEN) {
+        } else if(actual_size > ETH_DATA_LEN + VLAN_ETH_HLEN) {
                 /* Don't indicate oversized frames */
                 nic->rx_over_length_errors++;
                 nic->net_stats.rx_dropped++;
@@ -1706,6 +1896,7 @@ static int e100_poll(struct net_device *netdev, int *budget)
 static void e100_netpoll(struct net_device *netdev)
 {
         struct nic *nic = netdev_priv(netdev);
+
         e100_disable_irq(nic);
         e100_intr(nic->pdev->irq, netdev, NULL);
         e100_tx_clean(nic);
@@ -2108,6 +2299,8 @@ static void e100_diag_test(struct net_device *netdev,
         }
         for(i = 0; i < E100_TEST_LEN; i++)
                 test->flags |= data[i] ? ETH_TEST_FL_FAILED : 0;
+
+        msleep_interruptible(4 * 1000);
 }
 
 static int e100_phys_id(struct net_device *netdev, u32 data)
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 5e5d2c3c7ce4..9b596e0bbf95 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -2767,7 +2767,7 @@ e1000_clean_tx_irq(struct e1000_adapter *adapter)
                                         "  next_to_use          <%x>\n"
                                         "  next_to_clean        <%x>\n"
                                         "buffer_info[next_to_clean]\n"
-                                        "  dma                  <%zx>\n"
+                                        "  dma                  <%llx>\n"
                                         "  time_stamp           <%lx>\n"
                                         "  next_to_watch        <%x>\n"
                                         "  jiffies              <%lx>\n"
@@ -2776,7 +2776,7 @@ e1000_clean_tx_irq(struct e1000_adapter *adapter)
                                 E1000_READ_REG(&adapter->hw, TDT),
                                 tx_ring->next_to_use,
                                 i,
-                                tx_ring->buffer_info[i].dma,
+                                (unsigned long long)tx_ring->buffer_info[i].dma,
                                 tx_ring->buffer_info[i].time_stamp,
                                 eop,
                                 jiffies,
@@ -3789,6 +3789,7 @@ e1000_netpoll(struct net_device *netdev)
         struct e1000_adapter *adapter = netdev_priv(netdev);
         disable_irq(adapter->pdev->irq);
         e1000_intr(adapter->pdev->irq, netdev, NULL);
+        e1000_clean_tx_irq(adapter);
         enable_irq(adapter->pdev->irq);
 }
 #endif
diff --git a/drivers/net/eepro100.c b/drivers/net/eepro100.c
index 1795425f512e..8c62ced2c9b2 100644
--- a/drivers/net/eepro100.c
+++ b/drivers/net/eepro100.c
@@ -1263,8 +1263,8 @@ speedo_init_rx_ring(struct net_device *dev)
         for (i = 0; i < RX_RING_SIZE; i++) {
                 struct sk_buff *skb;
                 skb = dev_alloc_skb(PKT_BUF_SZ + sizeof(struct RxFD));
-                /* XXX: do we really want to call this before the NULL check? --hch */
-                rx_align(skb);                  /* Align IP on 16 byte boundary */
+                if (skb)
+                        rx_align(skb);        /* Align IP on 16 byte boundary */
                 sp->rx_skbuff[i] = skb;
                 if (skb == NULL)
                         break;                  /* OK.  Just initially short of Rx bufs. */
@@ -1654,8 +1654,8 @@ static inline struct RxFD *speedo_rx_alloc(struct net_device *dev, int entry)
         struct sk_buff *skb;
         /* Get a fresh skbuff to replace the consumed one. */
         skb = dev_alloc_skb(PKT_BUF_SZ + sizeof(struct RxFD));
-        /* XXX: do we really want to call this before the NULL check? --hch */
-        rx_align(skb);                          /* Align IP on 16 byte boundary */
+        if (skb)
+                rx_align(skb);          /* Align IP on 16 byte boundary */
         sp->rx_skbuff[entry] = skb;
         if (skb == NULL) {
                 sp->rx_ringp[entry] = NULL;
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 64f0f697c958..7d93948aec83 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -85,6 +85,16 @@
  *      0.33: 16 May 2005: Support for MCP51 added.
  *      0.34: 18 Jun 2005: Add DEV_NEED_LINKTIMER to all nForce nics.
  *      0.35: 26 Jun 2005: Support for MCP55 added.
+ *      0.36: 28 Jun 2005: Add jumbo frame support.
+ *      0.37: 10 Jul 2005: Additional ethtool support, cleanup of pci id list
+ *      0.38: 16 Jul 2005: tx irq rewrite: Use global flags instead of
+ *                         per-packet flags.
+ *      0.39: 18 Jul 2005: Add 64bit descriptor support.
+ *      0.40: 19 Jul 2005: Add support for mac address change.
+ *      0.41: 30 Jul 2005: Write back original MAC in nv_close instead
+ *                         of nv_remove
+ *      0.42: 06 Aug 2005: Fix lack of link speed initialization
+ *                         in the second (and later) nv_open call
  *
  * Known bugs:
  * We suspect that on some hardware no TX done interrupts are generated.
@@ -96,7 +106,7 @@
  * DEV_NEED_TIMERIRQ will not harm you on sane hardware, only generating a few
  * superfluous timer interrupts from the nic.
  */
-#define FORCEDETH_VERSION               "0.35"
+#define FORCEDETH_VERSION               "0.41"
 #define DRV_NAME                        "forcedeth"
 
 #include <linux/module.h>
@@ -131,11 +141,10 @@
  * Hardware access:
  */
 
-#define DEV_NEED_LASTPACKET1    0x0001  /* set LASTPACKET1 in tx flags */
-#define DEV_IRQMASK_1           0x0002  /* use NVREG_IRQMASK_WANTED_1 for irq mask */
-#define DEV_IRQMASK_2           0x0004  /* use NVREG_IRQMASK_WANTED_2 for irq mask */
-#define DEV_NEED_TIMERIRQ       0x0008  /* set the timer irq flag in the irq mask */
-#define DEV_NEED_LINKTIMER      0x0010  /* poll link settings. Relies on the timer irq */
+#define DEV_NEED_TIMERIRQ       0x0001  /* set the timer irq flag in the irq mask */
+#define DEV_NEED_LINKTIMER      0x0002  /* poll link settings. Relies on the timer irq */
+#define DEV_HAS_LARGEDESC       0x0004  /* device supports jumbo frames and needs packet format 2 */
+#define DEV_HAS_HIGH_DMA        0x0008  /* device supports 64bit dma */
 
 enum {
         NvRegIrqStatus = 0x000,
@@ -146,13 +155,16 @@ enum {
 #define NVREG_IRQ_RX                    0x0002
 #define NVREG_IRQ_RX_NOBUF              0x0004
 #define NVREG_IRQ_TX_ERR                0x0008
-#define NVREG_IRQ_TX2                   0x0010
+#define NVREG_IRQ_TX_OK                 0x0010
 #define NVREG_IRQ_TIMER                 0x0020
 #define NVREG_IRQ_LINK                  0x0040
+#define NVREG_IRQ_TX_ERROR              0x0080
 #define NVREG_IRQ_TX1                   0x0100
-#define NVREG_IRQMASK_WANTED_1          0x005f
-#define NVREG_IRQMASK_WANTED_2          0x0147
-#define NVREG_IRQ_UNKNOWN               (~(NVREG_IRQ_RX_ERROR|NVREG_IRQ_RX|NVREG_IRQ_RX_NOBUF|NVREG_IRQ_TX_ERR|NVREG_IRQ_TX2|NVREG_IRQ_TIMER|NVREG_IRQ_LINK|NVREG_IRQ_TX1))
+#define NVREG_IRQMASK_WANTED            0x00df
+
+#define NVREG_IRQ_UNKNOWN       (~(NVREG_IRQ_RX_ERROR|NVREG_IRQ_RX|NVREG_IRQ_RX_NOBUF|NVREG_IRQ_TX_ERR| \
+                                        NVREG_IRQ_TX_OK|NVREG_IRQ_TIMER|NVREG_IRQ_LINK|NVREG_IRQ_TX_ERROR| \
+                                        NVREG_IRQ_TX1))
 
         NvRegUnknownSetupReg6 = 0x008,
 #define NVREG_UNKSETUP6_VAL             3
@@ -286,6 +298,18 @@ struct ring_desc {
         u32 FlagLen;
 };
 
+struct ring_desc_ex {
+        u32 PacketBufferHigh;
+        u32 PacketBufferLow;
+        u32 Reserved;
+        u32 FlagLen;
+};
+
+typedef union _ring_type {
+        struct ring_desc* orig;
+        struct ring_desc_ex* ex;
+} ring_type;
+
 #define FLAG_MASK_V1 0xffff0000
 #define FLAG_MASK_V2 0xffffc000
 #define LEN_MASK_V1 (0xffffffff ^ FLAG_MASK_V1)
@@ -293,7 +317,7 @@ struct ring_desc {
 
 #define NV_TX_LASTPACKET        (1<<16)
 #define NV_TX_RETRYERROR        (1<<19)
-#define NV_TX_LASTPACKET1       (1<<24)
+#define NV_TX_FORCED_INTERRUPT  (1<<24)
 #define NV_TX_DEFERRED          (1<<26)
 #define NV_TX_CARRIERLOST       (1<<27)
 #define NV_TX_LATECOLLISION     (1<<28)
@@ -303,7 +327,7 @@ struct ring_desc {
 
 #define NV_TX2_LASTPACKET       (1<<29)
 #define NV_TX2_RETRYERROR       (1<<18)
-#define NV_TX2_LASTPACKET1      (1<<23)
+#define NV_TX2_FORCED_INTERRUPT (1<<30)
 #define NV_TX2_DEFERRED         (1<<25)
 #define NV_TX2_CARRIERLOST      (1<<26)
 #define NV_TX2_LATECOLLISION    (1<<27)
@@ -379,9 +403,13 @@ struct ring_desc {
 #define TX_LIMIT_START  62
 
 /* rx/tx mac addr + type + vlan + align + slack*/
-#define RX_NIC_BUFSIZE          (ETH_DATA_LEN + 64)
-/* even more slack */
-#define RX_ALLOC_BUFSIZE        (ETH_DATA_LEN + 128)
+#define NV_RX_HEADERS           (64)
+/* even more slack. */
+#define NV_RX_ALLOC_PAD         (64)
+
+/* maximum mtu size */
+#define NV_PKTLIMIT_1   ETH_DATA_LEN    /* hard limit not known */
+#define NV_PKTLIMIT_2   9100    /* Actual limit according to NVidia: 9202 */
 
 #define OOM_REFILL      (1+HZ/20)
 #define POLL_WAIT       (1+HZ/100)
@@ -396,6 +424,7 @@ struct ring_desc {
  */
 #define DESC_VER_1      0x0
 #define DESC_VER_2      (0x02100|NVREG_TXRXCTL_RXCHECK)
+#define DESC_VER_3      (0x02200|NVREG_TXRXCTL_RXCHECK)
 
 /* PHY defines */
 #define PHY_OUI_MARVELL 0x5043
@@ -468,11 +497,12 @@ struct fe_priv {
         /* rx specific fields.
          * Locking: Within irq hander or disable_irq+spin_lock(&np->lock);
          */
-        struct ring_desc *rx_ring;
+        ring_type rx_ring;
         unsigned int cur_rx, refill_rx;
         struct sk_buff *rx_skbuff[RX_RING];
         dma_addr_t rx_dma[RX_RING];
         unsigned int rx_buf_sz;
+        unsigned int pkt_limit;
         struct timer_list oom_kick;
         struct timer_list nic_poll;
 
@@ -484,7 +514,7 @@ struct fe_priv {
         /*
          * tx specific fields.
          */
-        struct ring_desc *tx_ring;
+        ring_type tx_ring;
         unsigned int next_tx, nic_tx;
         struct sk_buff *tx_skbuff[TX_RING];
         dma_addr_t tx_dma[TX_RING];
@@ -519,6 +549,11 @@ static inline u32 nv_descr_getlength(struct ring_desc *prd, u32 v)
                 & ((v == DESC_VER_1) ? LEN_MASK_V1 : LEN_MASK_V2);
 }
 
+static inline u32 nv_descr_getlength_ex(struct ring_desc_ex *prd, u32 v)
+{
+        return le32_to_cpu(prd->FlagLen) & LEN_MASK_V2;
+}
+
 static int reg_delay(struct net_device *dev, int offset, u32 mask, u32 target,
                                 int delay, int delaymax, const char *msg)
 {
@@ -792,7 +827,7 @@ static int nv_alloc_rx(struct net_device *dev)
                 nr = refill_rx % RX_RING;
                 if (np->rx_skbuff[nr] == NULL) {
 
-                        skb = dev_alloc_skb(RX_ALLOC_BUFSIZE);
+                        skb = dev_alloc_skb(np->rx_buf_sz + NV_RX_ALLOC_PAD);
                         if (!skb)
                                 break;
 
@@ -803,9 +838,16 @@ static int nv_alloc_rx(struct net_device *dev)
                 }
                 np->rx_dma[nr] = pci_map_single(np->pci_dev, skb->data, skb->len,
                                                 PCI_DMA_FROMDEVICE);
-                np->rx_ring[nr].PacketBuffer = cpu_to_le32(np->rx_dma[nr]);
-                wmb();
-                np->rx_ring[nr].FlagLen = cpu_to_le32(RX_NIC_BUFSIZE | NV_RX_AVAIL);
+                if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2) {
+                        np->rx_ring.orig[nr].PacketBuffer = cpu_to_le32(np->rx_dma[nr]);
+                        wmb();
+                        np->rx_ring.orig[nr].FlagLen = cpu_to_le32(np->rx_buf_sz | NV_RX_AVAIL);
+                } else {
+                        np->rx_ring.ex[nr].PacketBufferHigh = cpu_to_le64(np->rx_dma[nr]) >> 32;
+                        np->rx_ring.ex[nr].PacketBufferLow = cpu_to_le64(np->rx_dma[nr]) & 0x0FFFFFFFF;
+                        wmb();
+                        np->rx_ring.ex[nr].FlagLen = cpu_to_le32(np->rx_buf_sz | NV_RX2_AVAIL);
+                }
                 dprintk(KERN_DEBUG "%s: nv_alloc_rx: Packet %d marked as Available\n",
                                         dev->name, refill_rx);
                 refill_rx++;
@@ -831,19 +873,37 @@ static void nv_do_rx_refill(unsigned long data)
         enable_irq(dev->irq);
 }
 
-static int nv_init_ring(struct net_device *dev)
+static void nv_init_rx(struct net_device *dev) 
 {
         struct fe_priv *np = get_nvpriv(dev);
         int i;
 
-        np->next_tx = np->nic_tx = 0;
-        for (i = 0; i < TX_RING; i++)
-                np->tx_ring[i].FlagLen = 0;
-
         np->cur_rx = RX_RING;
         np->refill_rx = 0;
         for (i = 0; i < RX_RING; i++)
-                np->rx_ring[i].FlagLen = 0;
+                if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2)
+                        np->rx_ring.orig[i].FlagLen = 0;
+                else
+                        np->rx_ring.ex[i].FlagLen = 0;
+}
+
+static void nv_init_tx(struct net_device *dev)
+{
+        struct fe_priv *np = get_nvpriv(dev);
+        int i;
+
+        np->next_tx = np->nic_tx = 0;
+        for (i = 0; i < TX_RING; i++)
+                if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2)
+                        np->tx_ring.orig[i].FlagLen = 0;
+                else
+                        np->tx_ring.ex[i].FlagLen = 0;
+}
+
+static int nv_init_ring(struct net_device *dev)
+{
+        nv_init_tx(dev);
+        nv_init_rx(dev);
         return nv_alloc_rx(dev);
 }
 
@@ -852,7 +912,10 @@ static void nv_drain_tx(struct net_device *dev)
         struct fe_priv *np = get_nvpriv(dev);
         int i;
         for (i = 0; i < TX_RING; i++) {
-                np->tx_ring[i].FlagLen = 0;
+                if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2)
+                        np->tx_ring.orig[i].FlagLen = 0;
+                else
+                        np->tx_ring.ex[i].FlagLen = 0;
                 if (np->tx_skbuff[i]) {
                         pci_unmap_single(np->pci_dev, np->tx_dma[i],
                                                 np->tx_skbuff[i]->len,
@@ -869,7 +932,10 @@ static void nv_drain_rx(struct net_device *dev)
         struct fe_priv *np = get_nvpriv(dev);
         int i;
         for (i = 0; i < RX_RING; i++) {
-                np->rx_ring[i].FlagLen = 0;
+                if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2)
+                        np->rx_ring.orig[i].FlagLen = 0;
+                else
+                        np->rx_ring.ex[i].FlagLen = 0;
                 wmb();
                 if (np->rx_skbuff[i]) {
                         pci_unmap_single(np->pci_dev, np->rx_dma[i],
@@ -900,11 +966,19 @@ static int nv_start_xmit(struct sk_buff *skb, struct net_device *dev)
         np->tx_dma[nr] = pci_map_single(np->pci_dev, skb->data,skb->len,
                                         PCI_DMA_TODEVICE);
 
-        np->tx_ring[nr].PacketBuffer = cpu_to_le32(np->tx_dma[nr]);
+        if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2)
+                np->tx_ring.orig[nr].PacketBuffer = cpu_to_le32(np->tx_dma[nr]);
+        else {
+                np->tx_ring.ex[nr].PacketBufferHigh = cpu_to_le64(np->tx_dma[nr]) >> 32;
+                np->tx_ring.ex[nr].PacketBufferLow = cpu_to_le64(np->tx_dma[nr]) & 0x0FFFFFFFF;
+        }
 
         spin_lock_irq(&np->lock);
         wmb();
-        np->tx_ring[nr].FlagLen = cpu_to_le32( (skb->len-1) | np->tx_flags );
+        if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2)
+                np->tx_ring.orig[nr].FlagLen = cpu_to_le32( (skb->len-1) | np->tx_flags );
+        else
+                np->tx_ring.ex[nr].FlagLen = cpu_to_le32( (skb->len-1) | np->tx_flags );
         dprintk(KERN_DEBUG "%s: nv_start_xmit: packet packet %d queued for transmission.\n",
                                 dev->name, np->next_tx);
         {
@@ -942,7 +1016,10 @@ static void nv_tx_done(struct net_device *dev)
         while (np->nic_tx != np->next_tx) {
                 i = np->nic_tx % TX_RING;
 
-                Flags = le32_to_cpu(np->tx_ring[i].FlagLen);
+                if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2)
+                        Flags = le32_to_cpu(np->tx_ring.orig[i].FlagLen);
+                else
+                        Flags = le32_to_cpu(np->tx_ring.ex[i].FlagLen);
 
                 dprintk(KERN_DEBUG "%s: nv_tx_done: looking at packet %d, Flags 0x%x.\n",
                                         dev->name, np->nic_tx, Flags);
@@ -993,9 +1070,56 @@ static void nv_tx_timeout(struct net_device *dev)
         struct fe_priv *np = get_nvpriv(dev);
         u8 __iomem *base = get_hwbase(dev);
 
-        dprintk(KERN_DEBUG "%s: Got tx_timeout. irq: %08x\n", dev->name,
+        printk(KERN_INFO "%s: Got tx_timeout. irq: %08x\n", dev->name,
                         readl(base + NvRegIrqStatus) & NVREG_IRQSTAT_MASK);
 
+        {
+                int i;
+
+                printk(KERN_INFO "%s: Ring at %lx: next %d nic %d\n",
+                                dev->name, (unsigned long)np->ring_addr,
+                                np->next_tx, np->nic_tx);
+                printk(KERN_INFO "%s: Dumping tx registers\n", dev->name);
+                for (i=0;i<0x400;i+= 32) {
+                        printk(KERN_INFO "%3x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
+                                        i,
+                                        readl(base + i + 0), readl(base + i + 4),
+                                        readl(base + i + 8), readl(base + i + 12),
+                                        readl(base + i + 16), readl(base + i + 20),
+                                        readl(base + i + 24), readl(base + i + 28));
+                }
+                printk(KERN_INFO "%s: Dumping tx ring\n", dev->name);
+                for (i=0;i<TX_RING;i+= 4) {
+                        if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2) {
+                                printk(KERN_INFO "%03x: %08x %08x // %08x %08x // %08x %08x // %08x %08x\n",
+                                       i, 
+                                       le32_to_cpu(np->tx_ring.orig[i].PacketBuffer),
+                                       le32_to_cpu(np->tx_ring.orig[i].FlagLen),
+                                       le32_to_cpu(np->tx_ring.orig[i+1].PacketBuffer),
+                                       le32_to_cpu(np->tx_ring.orig[i+1].FlagLen),
+                                       le32_to_cpu(np->tx_ring.orig[i+2].PacketBuffer),
+                                       le32_to_cpu(np->tx_ring.orig[i+2].FlagLen),
+                                       le32_to_cpu(np->tx_ring.orig[i+3].PacketBuffer),
+                                       le32_to_cpu(np->tx_ring.orig[i+3].FlagLen));
+                        } else {
+                                printk(KERN_INFO "%03x: %08x %08x %08x // %08x %08x %08x // %08x %08x %08x // %08x %08x %08x\n",
+                                       i, 
+                                       le32_to_cpu(np->tx_ring.ex[i].PacketBufferHigh),
+                                       le32_to_cpu(np->tx_ring.ex[i].PacketBufferLow),
+                                       le32_to_cpu(np->tx_ring.ex[i].FlagLen),
+                                       le32_to_cpu(np->tx_ring.ex[i+1].PacketBufferHigh),
+                                       le32_to_cpu(np->tx_ring.ex[i+1].PacketBufferLow),
+                                       le32_to_cpu(np->tx_ring.ex[i+1].FlagLen),
+                                       le32_to_cpu(np->tx_ring.ex[i+2].PacketBufferHigh),
+                                       le32_to_cpu(np->tx_ring.ex[i+2].PacketBufferLow),
+                                       le32_to_cpu(np->tx_ring.ex[i+2].FlagLen),
+                                       le32_to_cpu(np->tx_ring.ex[i+3].PacketBufferHigh),
+                                       le32_to_cpu(np->tx_ring.ex[i+3].PacketBufferLow),
+                                       le32_to_cpu(np->tx_ring.ex[i+3].FlagLen));
+                        }
+                }
+        }
+
         spin_lock_irq(&np->lock);
 
         /* 1) stop tx engine */
@@ -1009,7 +1133,10 @@ static void nv_tx_timeout(struct net_device *dev)
                 printk(KERN_DEBUG "%s: tx_timeout: dead entries!\n", dev->name);
                 nv_drain_tx(dev);
                 np->next_tx = np->nic_tx = 0;
-                writel((u32) (np->ring_addr + RX_RING*sizeof(struct ring_desc)), base + NvRegTxRingPhysAddr);
+                if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2)
+                        writel((u32) (np->ring_addr + RX_RING*sizeof(struct ring_desc)), base + NvRegTxRingPhysAddr);
+                else
+                        writel((u32) (np->ring_addr + RX_RING*sizeof(struct ring_desc_ex)), base + NvRegTxRingPhysAddr);
                 netif_wake_queue(dev);
         }
 
@@ -1084,8 +1211,13 @@ static void nv_rx_process(struct net_device *dev)
                         break;  /* we scanned the whole ring - do not continue */
 
                 i = np->cur_rx % RX_RING;
-                Flags = le32_to_cpu(np->rx_ring[i].FlagLen);
-                len = nv_descr_getlength(&np->rx_ring[i], np->desc_ver);
+                if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2) {
+                        Flags = le32_to_cpu(np->rx_ring.orig[i].FlagLen);
+                        len = nv_descr_getlength(&np->rx_ring.orig[i], np->desc_ver);
+                } else {
+                        Flags = le32_to_cpu(np->rx_ring.ex[i].FlagLen);
+                        len = nv_descr_getlength_ex(&np->rx_ring.ex[i], np->desc_ver);
+                }
 
                 dprintk(KERN_DEBUG "%s: nv_rx_process: looking at packet %d, Flags 0x%x.\n",
                                         dev->name, np->cur_rx, Flags);
@@ -1207,15 +1339,133 @@ next_pkt:
         }
 }
 
+static void set_bufsize(struct net_device *dev)
+{
+        struct fe_priv *np = netdev_priv(dev);
+
+        if (dev->mtu <= ETH_DATA_LEN)
+                np->rx_buf_sz = ETH_DATA_LEN + NV_RX_HEADERS;
+        else
+                np->rx_buf_sz = dev->mtu + NV_RX_HEADERS;
+}
+
 /*
  * nv_change_mtu: dev->change_mtu function
  * Called with dev_base_lock held for read.
  */
 static int nv_change_mtu(struct net_device *dev, int new_mtu)
 {
-        if (new_mtu > ETH_DATA_LEN)
+        struct fe_priv *np = get_nvpriv(dev);
+        int old_mtu;
+
+        if (new_mtu < 64 || new_mtu > np->pkt_limit)
                 return -EINVAL;
+
+        old_mtu = dev->mtu;
         dev->mtu = new_mtu;
+
+        /* return early if the buffer sizes will not change */
+        if (old_mtu <= ETH_DATA_LEN && new_mtu <= ETH_DATA_LEN)
+                return 0;
+        if (old_mtu == new_mtu)
+                return 0;
+
+        /* synchronized against open : rtnl_lock() held by caller */
+        if (netif_running(dev)) {
+                u8 *base = get_hwbase(dev);
+                /*
+                 * It seems that the nic preloads valid ring entries into an
+                 * internal buffer. The procedure for flushing everything is
+                 * guessed, there is probably a simpler approach.
+                 * Changing the MTU is a rare event, it shouldn't matter.
+                 */
+                disable_irq(dev->irq);
+                spin_lock_bh(&dev->xmit_lock);
+                spin_lock(&np->lock);
+                /* stop engines */
+                nv_stop_rx(dev);
+                nv_stop_tx(dev);
+                nv_txrx_reset(dev);
+                /* drain rx queue */
+                nv_drain_rx(dev);
+                nv_drain_tx(dev);
+                /* reinit driver view of the rx queue */
+                nv_init_rx(dev);
+                nv_init_tx(dev);
+                /* alloc new rx buffers */
+                set_bufsize(dev);
+                if (nv_alloc_rx(dev)) {
+                        if (!np->in_shutdown)
+                                mod_timer(&np->oom_kick, jiffies + OOM_REFILL);
+                }
+                /* reinit nic view of the rx queue */
+                writel(np->rx_buf_sz, base + NvRegOffloadConfig);
+                writel((u32) np->ring_addr, base + NvRegRxRingPhysAddr);
+                if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2)
+                        writel((u32) (np->ring_addr + RX_RING*sizeof(struct ring_desc)), base + NvRegTxRingPhysAddr);
+                else
+                        writel((u32) (np->ring_addr + RX_RING*sizeof(struct ring_desc_ex)), base + NvRegTxRingPhysAddr);
+                writel( ((RX_RING-1) << NVREG_RINGSZ_RXSHIFT) + ((TX_RING-1) << NVREG_RINGSZ_TXSHIFT),
+                        base + NvRegRingSizes);
+                pci_push(base);
+                writel(NVREG_TXRXCTL_KICK|np->desc_ver, get_hwbase(dev) + NvRegTxRxControl);
+                pci_push(base);
+
+                /* restart rx engine */
+                nv_start_rx(dev);
+                nv_start_tx(dev);
+                spin_unlock(&np->lock);
+                spin_unlock_bh(&dev->xmit_lock);
+                enable_irq(dev->irq);
+        }
+        return 0;
+}
+
+static void nv_copy_mac_to_hw(struct net_device *dev)
+{
+        u8 *base = get_hwbase(dev);
+        u32 mac[2];
+
+        mac[0] = (dev->dev_addr[0] << 0) + (dev->dev_addr[1] << 8) +
+                        (dev->dev_addr[2] << 16) + (dev->dev_addr[3] << 24);
+        mac[1] = (dev->dev_addr[4] << 0) + (dev->dev_addr[5] << 8);
+
+        writel(mac[0], base + NvRegMacAddrA);
+        writel(mac[1], base + NvRegMacAddrB);
+}
+
+/*
+ * nv_set_mac_address: dev->set_mac_address function
+ * Called with rtnl_lock() held.
+ */
+static int nv_set_mac_address(struct net_device *dev, void *addr)
+{
+        struct fe_priv *np = get_nvpriv(dev);
+        struct sockaddr *macaddr = (struct sockaddr*)addr;
+
+        if(!is_valid_ether_addr(macaddr->sa_data))
+                return -EADDRNOTAVAIL;
+
+        /* synchronized against open : rtnl_lock() held by caller */
+        memcpy(dev->dev_addr, macaddr->sa_data, ETH_ALEN);
+
+        if (netif_running(dev)) {
+                spin_lock_bh(&dev->xmit_lock);
+                spin_lock_irq(&np->lock);
+
+                /* stop rx engine */
+                nv_stop_rx(dev);
+
+                /* set mac address */
+                nv_copy_mac_to_hw(dev);
+
+                /* restart rx engine */
+                nv_start_rx(dev);
+                spin_unlock_irq(&np->lock);
+                spin_unlock_bh(&dev->xmit_lock);
+        } else {
+                nv_copy_mac_to_hw(dev);
+        }
         return 0;
 }
 
@@ -1470,7 +1720,7 @@ static irqreturn_t nv_nic_irq(int foo, void *data, struct pt_regs *regs)
                 if (!(events & np->irqmask))
                         break;
 
-                if (events & (NVREG_IRQ_TX1|NVREG_IRQ_TX2|NVREG_IRQ_TX_ERR)) {
+                if (events & (NVREG_IRQ_TX1|NVREG_IRQ_TX_OK|NVREG_IRQ_TX_ERROR|NVREG_IRQ_TX_ERR)) {
                         spin_lock(&np->lock);
                         nv_tx_done(dev);
                         spin_unlock(&np->lock);
@@ -1761,6 +2011,50 @@ static int nv_set_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
         return 0;
 }
 
+#define FORCEDETH_REGS_VER      1
+#define FORCEDETH_REGS_SIZE     0x400 /* 256 32-bit registers */
+
+static int nv_get_regs_len(struct net_device *dev)
+{
+        return FORCEDETH_REGS_SIZE;
+}
+
+static void nv_get_regs(struct net_device *dev, struct ethtool_regs *regs, void *buf)
+{
+        struct fe_priv *np = get_nvpriv(dev);
+        u8 __iomem *base = get_hwbase(dev);
+        u32 *rbuf = buf;
+        int i;
+
+        regs->version = FORCEDETH_REGS_VER;
+        spin_lock_irq(&np->lock);
+        for (i=0;i<FORCEDETH_REGS_SIZE/sizeof(u32);i++)
+                rbuf[i] = readl(base + i*sizeof(u32));
+        spin_unlock_irq(&np->lock);
+}
+
+static int nv_nway_reset(struct net_device *dev)
+{
+        struct fe_priv *np = get_nvpriv(dev);
+        int ret;
+
+        spin_lock_irq(&np->lock);
+        if (np->autoneg) {
+                int bmcr;
+
+                bmcr = mii_rw(dev, np->phyaddr, MII_BMCR, MII_READ);
+                bmcr |= (BMCR_ANENABLE | BMCR_ANRESTART);
+                mii_rw(dev, np->phyaddr, MII_BMCR, bmcr);
+
+                ret = 0;
+        } else {
+                ret = -EINVAL;
+        }
+        spin_unlock_irq(&np->lock);
+
+        return ret;
+}
+
 static struct ethtool_ops ops = {
         .get_drvinfo = nv_get_drvinfo,
         .get_link = ethtool_op_get_link,
@@ -1768,6 +2062,9 @@ static struct ethtool_ops ops = {
         .set_wol = nv_set_wol,
         .get_settings = nv_get_settings,
         .set_settings = nv_set_settings,
+        .get_regs_len = nv_get_regs_len,
+        .get_regs = nv_get_regs,
+        .nway_reset = nv_nway_reset,
 };
 
 static int nv_open(struct net_device *dev)
@@ -1792,6 +2089,7 @@ static int nv_open(struct net_device *dev)
         writel(0, base + NvRegAdapterControl);
 
         /* 2) initialize descriptor rings */
+        set_bufsize(dev);
         oom = nv_init_ring(dev);
 
         writel(0, base + NvRegLinkSpeed);
@@ -1802,20 +2100,14 @@ static int nv_open(struct net_device *dev)
         np->in_shutdown = 0;
 
         /* 3) set mac address */
-        {
-                u32 mac[2];
-
-                mac[0] = (dev->dev_addr[0] << 0) + (dev->dev_addr[1] << 8) +
-                                (dev->dev_addr[2] << 16) + (dev->dev_addr[3] << 24);
-                mac[1] = (dev->dev_addr[4] << 0) + (dev->dev_addr[5] << 8);
-
-                writel(mac[0], base + NvRegMacAddrA);
-                writel(mac[1], base + NvRegMacAddrB);
-        }
+        nv_copy_mac_to_hw(dev);
 
         /* 4) give hw rings */
         writel((u32) np->ring_addr, base + NvRegRxRingPhysAddr);
-        writel((u32) (np->ring_addr + RX_RING*sizeof(struct ring_desc)), base + NvRegTxRingPhysAddr);
+        if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2)
+                writel((u32) (np->ring_addr + RX_RING*sizeof(struct ring_desc)), base + NvRegTxRingPhysAddr);
+        else
+                writel((u32) (np->ring_addr + RX_RING*sizeof(struct ring_desc_ex)), base + NvRegTxRingPhysAddr);
         writel( ((RX_RING-1) << NVREG_RINGSZ_RXSHIFT) + ((TX_RING-1) << NVREG_RINGSZ_TXSHIFT),
                 base + NvRegRingSizes);
 
@@ -1837,7 +2129,7 @@ static int nv_open(struct net_device *dev)
         writel(NVREG_MISC1_FORCE | NVREG_MISC1_HD, base + NvRegMisc1);
         writel(readl(base + NvRegTransmitterStatus), base + NvRegTransmitterStatus);
         writel(NVREG_PFF_ALWAYS, base + NvRegPacketFilterFlags);
-        writel(NVREG_OFFLOAD_NORMAL, base + NvRegOffloadConfig);
+        writel(np->rx_buf_sz, base + NvRegOffloadConfig);
 
         writel(readl(base + NvRegReceiverStatus), base + NvRegReceiverStatus);
         get_random_bytes(&i, sizeof(i));
@@ -1888,6 +2180,9 @@ static int nv_open(struct net_device *dev)
                 writel(NVREG_MIISTAT_MASK, base + NvRegMIIStatus);
                 dprintk(KERN_INFO "startup: got 0x%08x.\n", miistat);
         }
+        /* set linkspeed to invalid value, thus force nv_update_linkspeed
+         * to init hw */
+        np->linkspeed = 0;
         ret = nv_update_linkspeed(dev);
         nv_start_rx(dev);
         nv_start_tx(dev);
@@ -1942,6 +2237,12 @@ static int nv_close(struct net_device *dev)
         if (np->wolenabled)
                 nv_start_rx(dev);
 
+        /* special op: write back the misordered MAC address - otherwise
+         * the next nv_probe would see a wrong address.
+         */
+        writel(np->orig_mac[0], base + NvRegMacAddrA);
+        writel(np->orig_mac[1], base + NvRegMacAddrB);
+
         /* FIXME: power down nic */
 
         return 0;
@@ -2006,32 +2307,55 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         }
 
         /* handle different descriptor versions */
-        if (pci_dev->device == PCI_DEVICE_ID_NVIDIA_NVENET_1 ||
-                pci_dev->device == PCI_DEVICE_ID_NVIDIA_NVENET_2 ||
-                pci_dev->device == PCI_DEVICE_ID_NVIDIA_NVENET_3 ||    
-                pci_dev->device == PCI_DEVICE_ID_NVIDIA_NVENET_12 ||
-                pci_dev->device == PCI_DEVICE_ID_NVIDIA_NVENET_13)
-                np->desc_ver = DESC_VER_1;
-        else
+        if (id->driver_data & DEV_HAS_HIGH_DMA) {
+                /* packet format 3: supports 40-bit addressing */
+                np->desc_ver = DESC_VER_3;
+                if (pci_set_dma_mask(pci_dev, 0x0000007fffffffffULL)) {
+                        printk(KERN_INFO "forcedeth: 64-bit DMA failed, using 32-bit addressing for device %s.\n",
+                                        pci_name(pci_dev));
+                }
+        } else if (id->driver_data & DEV_HAS_LARGEDESC) {
+                /* packet format 2: supports jumbo frames */
                 np->desc_ver = DESC_VER_2;
+        } else {
+                /* original packet format */
+                np->desc_ver = DESC_VER_1;
+        }
+
+        np->pkt_limit = NV_PKTLIMIT_1;
+        if (id->driver_data & DEV_HAS_LARGEDESC)
+                np->pkt_limit = NV_PKTLIMIT_2;
 
         err = -ENOMEM;
         np->base = ioremap(addr, NV_PCI_REGSZ);
         if (!np->base)
                 goto out_relreg;
         dev->base_addr = (unsigned long)np->base;
+
         dev->irq = pci_dev->irq;
-        np->rx_ring = pci_alloc_consistent(pci_dev, sizeof(struct ring_desc) * (RX_RING + TX_RING),
-                                                &np->ring_addr);
-        if (!np->rx_ring)
-                goto out_unmap;
-        np->tx_ring = &np->rx_ring[RX_RING];
+
+        if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2) {
+                np->rx_ring.orig = pci_alloc_consistent(pci_dev,
+                                        sizeof(struct ring_desc) * (RX_RING + TX_RING),
+                                        &np->ring_addr);
+                if (!np->rx_ring.orig)
+                        goto out_unmap;
+                np->tx_ring.orig = &np->rx_ring.orig[RX_RING];
+        } else {
+                np->rx_ring.ex = pci_alloc_consistent(pci_dev,
+                                        sizeof(struct ring_desc_ex) * (RX_RING + TX_RING),
+                                        &np->ring_addr);
+                if (!np->rx_ring.ex)
+                        goto out_unmap;
+                np->tx_ring.ex = &np->rx_ring.ex[RX_RING];
+        }
 
         dev->open = nv_open;
         dev->stop = nv_close;
         dev->hard_start_xmit = nv_start_xmit;
         dev->get_stats = nv_get_stats;
         dev->change_mtu = nv_change_mtu;
+        dev->set_mac_address = nv_set_mac_address;
         dev->set_multicast_list = nv_set_multicast;
 #ifdef CONFIG_NET_POLL_CONTROLLER
         dev->poll_controller = nv_poll_controller;
@@ -2080,17 +2404,10 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
 
         if (np->desc_ver == DESC_VER_1) {
                 np->tx_flags = NV_TX_LASTPACKET|NV_TX_VALID;
-                if (id->driver_data & DEV_NEED_LASTPACKET1)
-                        np->tx_flags |= NV_TX_LASTPACKET1;
         } else {
                 np->tx_flags = NV_TX2_LASTPACKET|NV_TX2_VALID;
-                if (id->driver_data & DEV_NEED_LASTPACKET1)
-                        np->tx_flags |= NV_TX2_LASTPACKET1;
         }
-        if (id->driver_data & DEV_IRQMASK_1)
-                np->irqmask = NVREG_IRQMASK_WANTED_1;
-        if (id->driver_data & DEV_IRQMASK_2)
-                np->irqmask = NVREG_IRQMASK_WANTED_2;
+        np->irqmask = NVREG_IRQMASK_WANTED;
         if (id->driver_data & DEV_NEED_TIMERIRQ)
                 np->irqmask |= NVREG_IRQ_TIMER;
         if (id->driver_data & DEV_NEED_LINKTIMER) {
@@ -2155,8 +2472,12 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         return 0;
 
 out_freering:
-        pci_free_consistent(np->pci_dev, sizeof(struct ring_desc) * (RX_RING + TX_RING),
-                                np->rx_ring, np->ring_addr);
+        if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2)
+                pci_free_consistent(np->pci_dev, sizeof(struct ring_desc) * (RX_RING + TX_RING),
+                                    np->rx_ring.orig, np->ring_addr);
+        else
+                pci_free_consistent(np->pci_dev, sizeof(struct ring_desc_ex) * (RX_RING + TX_RING),
+                                    np->rx_ring.ex, np->ring_addr);
         pci_set_drvdata(pci_dev, NULL);
 out_unmap:
         iounmap(get_hwbase(dev));
@@ -2174,18 +2495,14 @@ static void __devexit nv_remove(struct pci_dev *pci_dev)
 {
         struct net_device *dev = pci_get_drvdata(pci_dev);
         struct fe_priv *np = get_nvpriv(dev);
-        u8 __iomem *base = get_hwbase(dev);
 
         unregister_netdev(dev);
 
-        /* special op: write back the misordered MAC address - otherwise
-         * the next nv_probe would see a wrong address.
-         */
-        writel(np->orig_mac[0], base + NvRegMacAddrA);
-        writel(np->orig_mac[1], base + NvRegMacAddrB);
-
         /* free all structures */
-        pci_free_consistent(np->pci_dev, sizeof(struct ring_desc) * (RX_RING + TX_RING), np->rx_ring, np->ring_addr);
+        if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2)
+                pci_free_consistent(np->pci_dev, sizeof(struct ring_desc) * (RX_RING + TX_RING), np->rx_ring.orig, np->ring_addr);
+        else
+                pci_free_consistent(np->pci_dev, sizeof(struct ring_desc_ex) * (RX_RING + TX_RING), np->rx_ring.ex, np->ring_addr);
         iounmap(get_hwbase(dev));
         pci_release_regions(pci_dev);
         pci_disable_device(pci_dev);
@@ -2195,109 +2512,64 @@ static void __devexit nv_remove(struct pci_dev *pci_dev)
 
 static struct pci_device_id pci_tbl[] = {
         {       /* nForce Ethernet Controller */
-                .vendor = PCI_VENDOR_ID_NVIDIA,
-                .device = PCI_DEVICE_ID_NVIDIA_NVENET_1,
-                .subvendor = PCI_ANY_ID,
-                .subdevice = PCI_ANY_ID,
-                .driver_data = DEV_IRQMASK_1|DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER,
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_1),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER,
         },
         {       /* nForce2 Ethernet Controller */
-                .vendor = PCI_VENDOR_ID_NVIDIA,
-                .device = PCI_DEVICE_ID_NVIDIA_NVENET_2,
-                .subvendor = PCI_ANY_ID,
-                .subdevice = PCI_ANY_ID,
-                .driver_data = DEV_NEED_LASTPACKET1|DEV_IRQMASK_2|DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER,
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_2),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER,
         },
         {       /* nForce3 Ethernet Controller */
-                .vendor = PCI_VENDOR_ID_NVIDIA,
-                .device = PCI_DEVICE_ID_NVIDIA_NVENET_3,
-                .subvendor = PCI_ANY_ID,
-                .subdevice = PCI_ANY_ID,
-                .driver_data = DEV_NEED_LASTPACKET1|DEV_IRQMASK_2|DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER,
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_3),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER,
         },
         {       /* nForce3 Ethernet Controller */
-                .vendor = PCI_VENDOR_ID_NVIDIA,
-                .device = PCI_DEVICE_ID_NVIDIA_NVENET_4,
-                .subvendor = PCI_ANY_ID,
-                .subdevice = PCI_ANY_ID,
-                .driver_data = DEV_NEED_LASTPACKET1|DEV_IRQMASK_2|DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER,
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_4),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC,
         },
         {       /* nForce3 Ethernet Controller */
-                .vendor = PCI_VENDOR_ID_NVIDIA,
-                .device = PCI_DEVICE_ID_NVIDIA_NVENET_5,
-                .subvendor = PCI_ANY_ID,
-                .subdevice = PCI_ANY_ID,
-                .driver_data = DEV_NEED_LASTPACKET1|DEV_IRQMASK_2|DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER,
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_5),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC,
         },
         {       /* nForce3 Ethernet Controller */
-                .vendor = PCI_VENDOR_ID_NVIDIA,
-                .device = PCI_DEVICE_ID_NVIDIA_NVENET_6,
-                .subvendor = PCI_ANY_ID,
-                .subdevice = PCI_ANY_ID,
-                .driver_data = DEV_NEED_LASTPACKET1|DEV_IRQMASK_2|DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER,
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_6),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC,
         },
         {       /* nForce3 Ethernet Controller */
-                .vendor = PCI_VENDOR_ID_NVIDIA,
-                .device = PCI_DEVICE_ID_NVIDIA_NVENET_7,
-                .subvendor = PCI_ANY_ID,
-                .subdevice = PCI_ANY_ID,
-                .driver_data = DEV_NEED_LASTPACKET1|DEV_IRQMASK_2|DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER,
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_7),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC,
         },
         {       /* CK804 Ethernet Controller */
-                .vendor = PCI_VENDOR_ID_NVIDIA,
-                .device = PCI_DEVICE_ID_NVIDIA_NVENET_8,
-                .subvendor = PCI_ANY_ID,
-                .subdevice = PCI_ANY_ID,
-                .driver_data = DEV_NEED_LASTPACKET1|DEV_IRQMASK_2|DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER,
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_8),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_HIGH_DMA,
         },
         {       /* CK804 Ethernet Controller */
-                .vendor = PCI_VENDOR_ID_NVIDIA,
-                .device = PCI_DEVICE_ID_NVIDIA_NVENET_9,
-                .subvendor = PCI_ANY_ID,
-                .subdevice = PCI_ANY_ID,
-                .driver_data = DEV_NEED_LASTPACKET1|DEV_IRQMASK_2|DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER,
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_9),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_HIGH_DMA,
         },
         {       /* MCP04 Ethernet Controller */
-                .vendor = PCI_VENDOR_ID_NVIDIA,
-                .device = PCI_DEVICE_ID_NVIDIA_NVENET_10,
-                .subvendor = PCI_ANY_ID,
-                .subdevice = PCI_ANY_ID,
-                .driver_data = DEV_NEED_LASTPACKET1|DEV_IRQMASK_2|DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER,
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_10),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_HIGH_DMA,
         },
         {       /* MCP04 Ethernet Controller */
-                .vendor = PCI_VENDOR_ID_NVIDIA,
-                .device = PCI_DEVICE_ID_NVIDIA_NVENET_11,
-                .subvendor = PCI_ANY_ID,
-                .subdevice = PCI_ANY_ID,
-                .driver_data = DEV_NEED_LASTPACKET1|DEV_IRQMASK_2|DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER,
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_11),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_HIGH_DMA,
         },
         {       /* MCP51 Ethernet Controller */
-                .vendor = PCI_VENDOR_ID_NVIDIA,
-                .device = PCI_DEVICE_ID_NVIDIA_NVENET_12,
-                .subvendor = PCI_ANY_ID,
-                .subdevice = PCI_ANY_ID,
-                .driver_data = DEV_NEED_LASTPACKET1|DEV_IRQMASK_2|DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER,
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_12),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA,
         },
         {       /* MCP51 Ethernet Controller */
-                .vendor = PCI_VENDOR_ID_NVIDIA,
-                .device = PCI_DEVICE_ID_NVIDIA_NVENET_13,
-                .subvendor = PCI_ANY_ID,
-                .subdevice = PCI_ANY_ID,
-                .driver_data = DEV_NEED_LASTPACKET1|DEV_IRQMASK_2|DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER,
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_13),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA,
         },
         {       /* MCP55 Ethernet Controller */
-                .vendor = PCI_VENDOR_ID_NVIDIA,
-                .device = PCI_DEVICE_ID_NVIDIA_NVENET_14,
-                .subvendor = PCI_ANY_ID,
-                .subdevice = PCI_ANY_ID,
-                .driver_data = DEV_NEED_LASTPACKET1|DEV_IRQMASK_2|DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER,
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_14),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_HIGH_DMA,
         },
         {       /* MCP55 Ethernet Controller */
-                .vendor = PCI_VENDOR_ID_NVIDIA,
-                .device = PCI_DEVICE_ID_NVIDIA_NVENET_15,
-                .subvendor = PCI_ANY_ID,
-                .subdevice = PCI_ANY_ID,
-                .driver_data = DEV_NEED_LASTPACKET1|DEV_IRQMASK_2|DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER,
+                PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_15),
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_HIGH_DMA,
         },
         {0,},
 };
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index e44f8e9055ef..0b230222bfea 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -130,12 +130,11 @@ struct sixpack {
 
 #define AX25_6PACK_HEADER_LEN 0
 
-static void sp_start_tx_timer(struct sixpack *);
 static void sixpack_decode(struct sixpack *, unsigned char[], int);
 static int encode_sixpack(unsigned char *, unsigned char *, int, unsigned char);
 
 /*
- * perform the persistence/slottime algorithm for CSMA access. If the
+ * Perform the persistence/slottime algorithm for CSMA access. If the
  * persistence check was successful, write the data to the serial driver.
  * Note that in case of DAMA operation, the data is not sent here.
  */
@@ -143,7 +142,7 @@ static int encode_sixpack(unsigned char *, unsigned char *, int, unsigned char);
 static void sp_xmit_on_air(unsigned long channel)
 {
         struct sixpack *sp = (struct sixpack *) channel;
-        int actual;
+        int actual, when = sp->slottime;
         static unsigned char random;
 
         random = random * 17 + 41;
@@ -159,20 +158,10 @@ static void sp_xmit_on_air(unsigned long channel)
                 sp->tty->driver->write(sp->tty, &sp->led_state, 1);
                 sp->status2 = 0;
         } else
-                sp_start_tx_timer(sp);
+                mod_timer(&sp->tx_t, jiffies + ((when + 1) * HZ) / 100);
 }
 
 /* ----> 6pack timer interrupt handler and friends. <---- */
-static void sp_start_tx_timer(struct sixpack *sp)
-{
-        int when = sp->slottime;
-
-        del_timer(&sp->tx_t);
-        sp->tx_t.data = (unsigned long) sp;
-        sp->tx_t.function = sp_xmit_on_air;
-        sp->tx_t.expires = jiffies + ((when + 1) * HZ) / 100;
-        add_timer(&sp->tx_t);
-}
 
 /* Encapsulate one AX.25 frame and stuff into a TTY queue. */
 static void sp_encaps(struct sixpack *sp, unsigned char *icp, int len)
@@ -243,8 +232,7 @@ static void sp_encaps(struct sixpack *sp, unsigned char *icp, int len)
                 sp->xleft = count;
                 sp->xhead = sp->xbuff;
                 sp->status2 = count;
-                if (sp->duplex == 0)
-                        sp_start_tx_timer(sp);
+                sp_xmit_on_air((unsigned long)sp);
         }
 
         return;
@@ -320,12 +308,6 @@ static int sp_set_mac_address(struct net_device *dev, void *addr)
 {
         struct sockaddr_ax25 *sa = addr;
 
-        if (sa->sax25_family != AF_AX25)
-                return -EINVAL;
-
-        if (!sa->sax25_ndigis)
-                return -EINVAL;
-
         spin_lock_irq(&dev->xmit_lock);
         memcpy(dev->dev_addr, &sa->sax25_call, AX25_ADDR_LEN);
         spin_unlock_irq(&dev->xmit_lock);
@@ -680,6 +662,9 @@ static int sixpack_open(struct tty_struct *tty)
         netif_start_queue(dev);
 
         init_timer(&sp->tx_t);
+        sp->tx_t.function = sp_xmit_on_air;
+        sp->tx_t.data = (unsigned long) sp;
+
         init_timer(&sp->resync_t);
 
         spin_unlock_bh(&sp->lock);
diff --git a/drivers/net/hamradio/Kconfig b/drivers/net/hamradio/Kconfig
index 0cd54306e636..de087cd609d9 100644
--- a/drivers/net/hamradio/Kconfig
+++ b/drivers/net/hamradio/Kconfig
@@ -1,6 +1,6 @@
 config MKISS
         tristate "Serial port KISS driver"
-        depends on AX25 && BROKEN_ON_SMP
+        depends on AX25
         ---help---
           KISS is a protocol used for the exchange of data between a computer
           and a Terminal Node Controller (a small embedded system commonly
diff --git a/drivers/net/hamradio/baycom_epp.c b/drivers/net/hamradio/baycom_epp.c
index a7f15d9f13e5..5298096afbdb 100644
--- a/drivers/net/hamradio/baycom_epp.c
+++ b/drivers/net/hamradio/baycom_epp.c
@@ -54,6 +54,7 @@
 #include <linux/kmod.h>
 #include <linux/hdlcdrv.h>
 #include <linux/baycom.h>
+#include <linux/jiffies.h>
 #if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
 /* prototypes for ax25_encapsulate and ax25_rebuild_header */
 #include <net/ax25.h> 
@@ -287,7 +288,7 @@ static inline void baycom_int_freq(struct baycom_state *bc)
          * measure the interrupt frequency
          */
         bc->debug_vals.cur_intcnt++;
-        if ((cur_jiffies - bc->debug_vals.last_jiffies) >= HZ) {
+        if (time_after_eq(cur_jiffies, bc->debug_vals.last_jiffies + HZ)) {
                 bc->debug_vals.last_jiffies = cur_jiffies;
                 bc->debug_vals.last_intcnt = bc->debug_vals.cur_intcnt;
                 bc->debug_vals.cur_intcnt = 0;
diff --git a/drivers/net/hamradio/baycom_par.c b/drivers/net/hamradio/baycom_par.c
index 612ad452bee0..3b1bef1ee215 100644
--- a/drivers/net/hamradio/baycom_par.c
+++ b/drivers/net/hamradio/baycom_par.c
@@ -84,6 +84,7 @@
 #include <linux/baycom.h>
 #include <linux/parport.h>
 #include <linux/bitops.h>
+#include <linux/jiffies.h>
 
 #include <asm/bug.h>
 #include <asm/system.h>
@@ -165,7 +166,7 @@ static void __inline__ baycom_int_freq(struct baycom_state *bc)
          * measure the interrupt frequency
          */
         bc->debug_vals.cur_intcnt++;
-        if ((cur_jiffies - bc->debug_vals.last_jiffies) >= HZ) {
+        if (time_after_eq(cur_jiffies, bc->debug_vals.last_jiffies + HZ)) {
                 bc->debug_vals.last_jiffies = cur_jiffies;
                 bc->debug_vals.last_intcnt = bc->debug_vals.cur_intcnt;
                 bc->debug_vals.cur_intcnt = 0;
diff --git a/drivers/net/hamradio/baycom_ser_fdx.c b/drivers/net/hamradio/baycom_ser_fdx.c
index 25f270b05378..232793d2ce6b 100644
--- a/drivers/net/hamradio/baycom_ser_fdx.c
+++ b/drivers/net/hamradio/baycom_ser_fdx.c
@@ -79,6 +79,7 @@
 #include <asm/io.h>
 #include <linux/hdlcdrv.h>
 #include <linux/baycom.h>
+#include <linux/jiffies.h>
 
 /* --------------------------------------------------------------------- */
 
@@ -159,7 +160,7 @@ static inline void baycom_int_freq(struct baycom_state *bc)
          * measure the interrupt frequency
          */
         bc->debug_vals.cur_intcnt++;
-        if ((cur_jiffies - bc->debug_vals.last_jiffies) >= HZ) {
+        if (time_after_eq(cur_jiffies, bc->debug_vals.last_jiffies + HZ)) {
                 bc->debug_vals.last_jiffies = cur_jiffies;
                 bc->debug_vals.last_intcnt = bc->debug_vals.cur_intcnt;
                 bc->debug_vals.cur_intcnt = 0;
diff --git a/drivers/net/hamradio/baycom_ser_hdx.c b/drivers/net/hamradio/baycom_ser_hdx.c
index eead85d00962..be596a3eb3fd 100644
--- a/drivers/net/hamradio/baycom_ser_hdx.c
+++ b/drivers/net/hamradio/baycom_ser_hdx.c
@@ -69,6 +69,7 @@
 #include <asm/io.h>
 #include <linux/hdlcdrv.h>
 #include <linux/baycom.h>
+#include <linux/jiffies.h>
 
 /* --------------------------------------------------------------------- */
 
@@ -150,7 +151,7 @@ static inline void baycom_int_freq(struct baycom_state *bc)
          * measure the interrupt frequency
          */
         bc->debug_vals.cur_intcnt++;
-        if ((cur_jiffies - bc->debug_vals.last_jiffies) >= HZ) {
+        if (time_after_eq(cur_jiffies, bc->debug_vals.last_jiffies + HZ)) {
                 bc->debug_vals.last_jiffies = cur_jiffies;
                 bc->debug_vals.last_intcnt = bc->debug_vals.cur_intcnt;
                 bc->debug_vals.cur_intcnt = 0;
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
index ba9f0580e1f9..2946e037a9b1 100644
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -98,7 +98,7 @@ static char bcast_addr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
 
 static char bpq_eth_addr[6];
 
-static int bpq_rcv(struct sk_buff *, struct net_device *, struct packet_type *);
+static int bpq_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *);
 static int bpq_device_event(struct notifier_block *, unsigned long, void *);
 static const char *bpq_print_ethaddr(const unsigned char *);
 
@@ -165,7 +165,7 @@ static inline int dev_is_ethdev(struct net_device *dev)
 /*
  *      Receive an AX.25 frame via an ethernet interface.
  */
-static int bpq_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *ptype)
+static int bpq_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *ptype, struct net_device *orig_dev)
 {
         int len;
         char * ptr;
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
index 3035422f5ad8..63b1a2b86acb 100644
--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -1,30 +1,19 @@
 /*
- *      MKISS Driver
+ *  This program is free software; you can distribute it and/or modify it
+ *  under the terms of the GNU General Public License (Version 2) as
+ *  published by the Free Software Foundation.
  *
- *      This module:
- *              This module is free software; you can redistribute it and/or
- *              modify it under the terms of the GNU General Public License
- *              as published by the Free Software Foundation; either version
- *              2 of the License, or (at your option) any later version.
+ *  This program is distributed in the hope it will be useful, but WITHOUT
+ *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ *  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ *  for more details.
  *
- *              This module implements the AX.25 protocol for kernel-based
- *              devices like TTYs. It interfaces between a raw TTY, and the
- *              kernel's AX.25 protocol layers, just like slip.c.
- *              AX.25 needs to be separated from slip.c while slip.c is no
- *              longer a static kernel device since it is a module.
- *              This method clears the way to implement other kiss protocols
- *              like mkiss smack g8bpq ..... so far only mkiss is implemented.
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
  *
- * Hans Alblas <hans@esrac.ele.tue.nl>
- *
- *      History
- *      Jonathan (G4KLX)        Fixed to match Linux networking changes - 2.1.15.
- *      Matthias (DG2FEF)       Added support for FlexNet CRC (on special request)
- *                              Fixed bug in ax25_close(): dev_lock_wait() was
- *                              called twice, causing a deadlock.
- *      Jeroen (PE1RXQ)         Removed old MKISS_MAGIC stuff and calls to
- *                              MOD_*_USE_COUNT
- *                              Remove cli() and fix rtnl lock usage.
+ * Copyright (C) Hans Alblas PE1AYX <hans@esrac.ele.tue.nl>
+ * Copyright (C) 2004, 05 Ralf Baechle DL5RB <ralf@linux-mips.org>
  */
 
 #include <linux/config.h>
@@ -46,177 +35,300 @@
 #include <linux/etherdevice.h>
 #include <linux/skbuff.h>
 #include <linux/if_arp.h>
+#include <linux/jiffies.h>
 
 #include <net/ax25.h>
 
-#include "mkiss.h"
-
 #ifdef CONFIG_INET
 #include <linux/ip.h>
 #include <linux/tcp.h>
 #endif
 
-static char banner[] __initdata = KERN_INFO "mkiss: AX.25 Multikiss, Hans Albas PE1AYX\n";
-
-typedef struct ax25_ctrl {
-        struct ax_disp ctrl;    /*                              */
-        struct net_device  dev; /* the device                   */
-} ax25_ctrl_t;
-
-static ax25_ctrl_t **ax25_ctrls;
-
-int ax25_maxdev = AX25_MAXDEV;          /* Can be overridden with insmod! */
-
-static struct tty_ldisc ax_ldisc;
-
-static int ax25_init(struct net_device *);
-static int kiss_esc(unsigned char *, unsigned char *, int);
-static int kiss_esc_crc(unsigned char *, unsigned char *, unsigned short, int);
-static void kiss_unesc(struct ax_disp *, unsigned char);
+#define AX_MTU          236
+
+/* SLIP/KISS protocol characters. */
+#define END             0300            /* indicates end of frame       */
+#define ESC             0333            /* indicates byte stuffing      */
+#define ESC_END         0334            /* ESC ESC_END means END 'data' */
+#define ESC_ESC         0335            /* ESC ESC_ESC means ESC 'data' */
+
+struct mkiss {
+        struct tty_struct       *tty;   /* ptr to TTY structure         */
+        struct net_device       *dev;   /* easy for intr handling       */
+
+        /* These are pointers to the malloc()ed frame buffers. */
+        spinlock_t              buflock;/* lock for rbuf and xbuf */
+        unsigned char           *rbuff; /* receiver buffer              */
+        int                     rcount; /* received chars counter       */
+        unsigned char           *xbuff; /* transmitter buffer           */
+        unsigned char           *xhead; /* pointer to next byte to XMIT */
+        int                     xleft;  /* bytes left in XMIT queue     */
+
+        struct net_device_stats stats;
+
+        /* Detailed SLIP statistics. */
+        int             mtu;            /* Our mtu (to spot changes!)   */
+        int             buffsize;       /* Max buffers sizes            */
+
+        unsigned long   flags;          /* Flag values/ mode etc        */
+                                        /* long req'd: used by set_bit --RR */
+#define AXF_INUSE       0               /* Channel in use               */
+#define AXF_ESCAPE      1               /* ESC received                 */
+#define AXF_ERROR       2               /* Parity, etc. error           */
+#define AXF_KEEPTEST    3               /* Keepalive test flag          */
+#define AXF_OUTWAIT     4               /* is outpacket was flag        */
+
+        int             mode;
+        int             crcmode;        /* MW: for FlexNet, SMACK etc.  */
+#define CRC_MODE_NONE   0
+#define CRC_MODE_FLEX   1
+#define CRC_MODE_SMACK  2
+
+        atomic_t                refcnt;
+        struct semaphore        dead_sem;
+};
 
 /*---------------------------------------------------------------------------*/
 
-static const unsigned short Crc_flex_table[] = {
-  0x0f87, 0x1e0e, 0x2c95, 0x3d1c, 0x49a3, 0x582a, 0x6ab1, 0x7b38,
-  0x83cf, 0x9246, 0xa0dd, 0xb154, 0xc5eb, 0xd462, 0xe6f9, 0xf770,
-  0x1f06, 0x0e8f, 0x3c14, 0x2d9d, 0x5922, 0x48ab, 0x7a30, 0x6bb9,
-  0x934e, 0x82c7, 0xb05c, 0xa1d5, 0xd56a, 0xc4e3, 0xf678, 0xe7f1,
-  0x2e85, 0x3f0c, 0x0d97, 0x1c1e, 0x68a1, 0x7928, 0x4bb3, 0x5a3a,
-  0xa2cd, 0xb344, 0x81df, 0x9056, 0xe4e9, 0xf560, 0xc7fb, 0xd672,
-  0x3e04, 0x2f8d, 0x1d16, 0x0c9f, 0x7820, 0x69a9, 0x5b32, 0x4abb,
-  0xb24c, 0xa3c5, 0x915e, 0x80d7, 0xf468, 0xe5e1, 0xd77a, 0xc6f3,
-  0x4d83, 0x5c0a, 0x6e91, 0x7f18, 0x0ba7, 0x1a2e, 0x28b5, 0x393c,
-  0xc1cb, 0xd042, 0xe2d9, 0xf350, 0x87ef, 0x9666, 0xa4fd, 0xb574,
-  0x5d02, 0x4c8b, 0x7e10, 0x6f99, 0x1b26, 0x0aaf, 0x3834, 0x29bd,
-  0xd14a, 0xc0c3, 0xf258, 0xe3d1, 0x976e, 0x86e7, 0xb47c, 0xa5f5,
-  0x6c81, 0x7d08, 0x4f93, 0x5e1a, 0x2aa5, 0x3b2c, 0x09b7, 0x183e,
-  0xe0c9, 0xf140, 0xc3db, 0xd252, 0xa6ed, 0xb764, 0x85ff, 0x9476,
-  0x7c00, 0x6d89, 0x5f12, 0x4e9b, 0x3a24, 0x2bad, 0x1936, 0x08bf,
-  0xf048, 0xe1c1, 0xd35a, 0xc2d3, 0xb66c, 0xa7e5, 0x957e, 0x84f7,
-  0x8b8f, 0x9a06, 0xa89d, 0xb914, 0xcdab, 0xdc22, 0xeeb9, 0xff30,
-  0x07c7, 0x164e, 0x24d5, 0x355c, 0x41e3, 0x506a, 0x62f1, 0x7378,
-  0x9b0e, 0x8a87, 0xb81c, 0xa995, 0xdd2a, 0xcca3, 0xfe38, 0xefb1,
-  0x1746, 0x06cf, 0x3454, 0x25dd, 0x5162, 0x40eb, 0x7270, 0x63f9,
-  0xaa8d, 0xbb04, 0x899f, 0x9816, 0xeca9, 0xfd20, 0xcfbb, 0xde32,
-  0x26c5, 0x374c, 0x05d7, 0x145e, 0x60e1, 0x7168, 0x43f3, 0x527a,
-  0xba0c, 0xab85, 0x991e, 0x8897, 0xfc28, 0xeda1, 0xdf3a, 0xceb3,
-  0x3644, 0x27cd, 0x1556, 0x04df, 0x7060, 0x61e9, 0x5372, 0x42fb,
-  0xc98b, 0xd802, 0xea99, 0xfb10, 0x8faf, 0x9e26, 0xacbd, 0xbd34,
-  0x45c3, 0x544a, 0x66d1, 0x7758, 0x03e7, 0x126e, 0x20f5, 0x317c,
-  0xd90a, 0xc883, 0xfa18, 0xeb91, 0x9f2e, 0x8ea7, 0xbc3c, 0xadb5,
-  0x5542, 0x44cb, 0x7650, 0x67d9, 0x1366, 0x02ef, 0x3074, 0x21fd,
-  0xe889, 0xf900, 0xcb9b, 0xda12, 0xaead, 0xbf24, 0x8dbf, 0x9c36,
-  0x64c1, 0x7548, 0x47d3, 0x565a, 0x22e5, 0x336c, 0x01f7, 0x107e,
-  0xf808, 0xe981, 0xdb1a, 0xca93, 0xbe2c, 0xafa5, 0x9d3e, 0x8cb7,
-  0x7440, 0x65c9, 0x5752, 0x46db, 0x3264, 0x23ed, 0x1176, 0x00ff
+static const unsigned short crc_flex_table[] = {
+        0x0f87, 0x1e0e, 0x2c95, 0x3d1c, 0x49a3, 0x582a, 0x6ab1, 0x7b38,
+        0x83cf, 0x9246, 0xa0dd, 0xb154, 0xc5eb, 0xd462, 0xe6f9, 0xf770,
+        0x1f06, 0x0e8f, 0x3c14, 0x2d9d, 0x5922, 0x48ab, 0x7a30, 0x6bb9,
+        0x934e, 0x82c7, 0xb05c, 0xa1d5, 0xd56a, 0xc4e3, 0xf678, 0xe7f1,
+        0x2e85, 0x3f0c, 0x0d97, 0x1c1e, 0x68a1, 0x7928, 0x4bb3, 0x5a3a,
+        0xa2cd, 0xb344, 0x81df, 0x9056, 0xe4e9, 0xf560, 0xc7fb, 0xd672,
+        0x3e04, 0x2f8d, 0x1d16, 0x0c9f, 0x7820, 0x69a9, 0x5b32, 0x4abb,
+        0xb24c, 0xa3c5, 0x915e, 0x80d7, 0xf468, 0xe5e1, 0xd77a, 0xc6f3,
+        0x4d83, 0x5c0a, 0x6e91, 0x7f18, 0x0ba7, 0x1a2e, 0x28b5, 0x393c,
+        0xc1cb, 0xd042, 0xe2d9, 0xf350, 0x87ef, 0x9666, 0xa4fd, 0xb574,
+        0x5d02, 0x4c8b, 0x7e10, 0x6f99, 0x1b26, 0x0aaf, 0x3834, 0x29bd,
+        0xd14a, 0xc0c3, 0xf258, 0xe3d1, 0x976e, 0x86e7, 0xb47c, 0xa5f5,
+        0x6c81, 0x7d08, 0x4f93, 0x5e1a, 0x2aa5, 0x3b2c, 0x09b7, 0x183e,
+        0xe0c9, 0xf140, 0xc3db, 0xd252, 0xa6ed, 0xb764, 0x85ff, 0x9476,
+        0x7c00, 0x6d89, 0x5f12, 0x4e9b, 0x3a24, 0x2bad, 0x1936, 0x08bf,
+        0xf048, 0xe1c1, 0xd35a, 0xc2d3, 0xb66c, 0xa7e5, 0x957e, 0x84f7,
+        0x8b8f, 0x9a06, 0xa89d, 0xb914, 0xcdab, 0xdc22, 0xeeb9, 0xff30,
+        0x07c7, 0x164e, 0x24d5, 0x355c, 0x41e3, 0x506a, 0x62f1, 0x7378,
+        0x9b0e, 0x8a87, 0xb81c, 0xa995, 0xdd2a, 0xcca3, 0xfe38, 0xefb1,
+        0x1746, 0x06cf, 0x3454, 0x25dd, 0x5162, 0x40eb, 0x7270, 0x63f9,
+        0xaa8d, 0xbb04, 0x899f, 0x9816, 0xeca9, 0xfd20, 0xcfbb, 0xde32,
+        0x26c5, 0x374c, 0x05d7, 0x145e, 0x60e1, 0x7168, 0x43f3, 0x527a,
+        0xba0c, 0xab85, 0x991e, 0x8897, 0xfc28, 0xeda1, 0xdf3a, 0xceb3,
+        0x3644, 0x27cd, 0x1556, 0x04df, 0x7060, 0x61e9, 0x5372, 0x42fb,
+        0xc98b, 0xd802, 0xea99, 0xfb10, 0x8faf, 0x9e26, 0xacbd, 0xbd34,
+        0x45c3, 0x544a, 0x66d1, 0x7758, 0x03e7, 0x126e, 0x20f5, 0x317c,
+        0xd90a, 0xc883, 0xfa18, 0xeb91, 0x9f2e, 0x8ea7, 0xbc3c, 0xadb5,
+        0x5542, 0x44cb, 0x7650, 0x67d9, 0x1366, 0x02ef, 0x3074, 0x21fd,
+        0xe889, 0xf900, 0xcb9b, 0xda12, 0xaead, 0xbf24, 0x8dbf, 0x9c36,
+        0x64c1, 0x7548, 0x47d3, 0x565a, 0x22e5, 0x336c, 0x01f7, 0x107e,
+        0xf808, 0xe981, 0xdb1a, 0xca93, 0xbe2c, 0xafa5, 0x9d3e, 0x8cb7,
+        0x7440, 0x65c9, 0x5752, 0x46db, 0x3264, 0x23ed, 0x1176, 0x00ff
 };
 
-/*---------------------------------------------------------------------------*/
-
 static unsigned short calc_crc_flex(unsigned char *cp, int size)
 {
-    unsigned short crc = 0xffff;
-    
-    while (size--)
-        crc = (crc << 8) ^ Crc_flex_table[((crc >> 8) ^ *cp++) & 0xff];
+        unsigned short crc = 0xffff;
 
-    return crc;
-}
+        while (size--)
+                crc = (crc << 8) ^ crc_flex_table[((crc >> 8) ^ *cp++) & 0xff];
 
-/*---------------------------------------------------------------------------*/
+        return crc;
+}
 
 static int check_crc_flex(unsigned char *cp, int size)
 {
-  unsigned short crc = 0xffff;
+        unsigned short crc = 0xffff;
 
-  if (size < 3)
-      return -1;
+        if (size < 3)
+                return -1;
 
-  while (size--)
-      crc = (crc << 8) ^ Crc_flex_table[((crc >> 8) ^ *cp++) & 0xff];
+        while (size--)
+                crc = (crc << 8) ^ crc_flex_table[((crc >> 8) ^ *cp++) & 0xff];
 
-  if ((crc & 0xffff) != 0x7070) 
-      return -1;
+        if ((crc & 0xffff) != 0x7070)
+                return -1;
 
-  return 0;
+        return 0;
 }
 
-/*---------------------------------------------------------------------------*/
+/*
+ * Standard encapsulation
+ */
 
-/* Find a free channel, and link in this `tty' line. */
-static inline struct ax_disp *ax_alloc(void)
+static int kiss_esc(unsigned char *s, unsigned char *d, int len)
 {
-        ax25_ctrl_t *axp=NULL;
-        int i;
+        unsigned char *ptr = d;
+        unsigned char c;
 
-        for (i = 0; i < ax25_maxdev; i++) {
-                axp = ax25_ctrls[i];
+        /*
+         * Send an initial END character to flush out any data that may have
+         * accumulated in the receiver due to line noise.
+         */
 
-                /* Not allocated ? */
-                if (axp == NULL)
-                        break;
+        *ptr++ = END;
 
-                /* Not in use ? */
-                if (!test_and_set_bit(AXF_INUSE, &axp->ctrl.flags))
+        while (len-- > 0) {
+                switch (c = *s++) {
+                case END:
+                        *ptr++ = ESC;
+                        *ptr++ = ESC_END;
                         break;
+                case ESC:
+                        *ptr++ = ESC;
+                        *ptr++ = ESC_ESC;
+                        break;
+                default:
+                        *ptr++ = c;
+                        break;
+                }
         }
 
-        /* Sorry, too many, all slots in use */
-        if (i >= ax25_maxdev)
-                return NULL;
+        *ptr++ = END;
+
+        return ptr - d;
+}
+
+/*
+ * MW:
+ * OK its ugly, but tell me a better solution without copying the
+ * packet to a temporary buffer :-)
+ */
+static int kiss_esc_crc(unsigned char *s, unsigned char *d, unsigned short crc,
+        int len)
+{
+        unsigned char *ptr = d;
+        unsigned char c=0;
+
+        *ptr++ = END;
+        while (len > 0) {
+                if (len > 2)
+                        c = *s++;
+                else if (len > 1)
+                        c = crc >> 8;
+                else if (len > 0)
+                        c = crc & 0xff;
+
+                len--;
 
-        /* If no channels are available, allocate one */
-        if (axp == NULL && (ax25_ctrls[i] = kmalloc(sizeof(ax25_ctrl_t), GFP_KERNEL)) != NULL) {
-                axp = ax25_ctrls[i];
+                switch (c) {
+                case END:
+                        *ptr++ = ESC;
+                        *ptr++ = ESC_END;
+                        break;
+                case ESC:
+                        *ptr++ = ESC;
+                        *ptr++ = ESC_ESC;
+                        break;
+                default:
+                        *ptr++ = c;
+                        break;
+                }
         }
-        memset(axp, 0, sizeof(ax25_ctrl_t));
-
-        /* Initialize channel control data */
-        set_bit(AXF_INUSE, &axp->ctrl.flags);
-        sprintf(axp->dev.name, "ax%d", i++);
-        axp->ctrl.tty      = NULL;
-        axp->dev.base_addr = i;
-        axp->dev.priv      = (void *)&axp->ctrl;
-        axp->dev.next      = NULL;
-        axp->dev.init      = ax25_init;
-
-        if (axp != NULL) {
-                /*
-                 * register device so that it can be ifconfig'ed
-                 * ax25_init() will be called as a side-effect
-                 * SIDE-EFFECT WARNING: ax25_init() CLEARS axp->ctrl !
-                 */
-                if (register_netdev(&axp->dev) == 0) {
-                        /* (Re-)Set the INUSE bit.   Very Important! */
-                        set_bit(AXF_INUSE, &axp->ctrl.flags);
-                        axp->ctrl.dev = &axp->dev;
-                        axp->dev.priv = (void *) &axp->ctrl;
-
-                        return &axp->ctrl;
-                } else {
-                        clear_bit(AXF_INUSE,&axp->ctrl.flags);
-                        printk(KERN_ERR "mkiss: ax_alloc() - register_netdev() failure.\n");
+        *ptr++ = END;
+
+        return ptr - d;
+}
+
+/* Send one completely decapsulated AX.25 packet to the AX.25 layer. */
+static void ax_bump(struct mkiss *ax)
+{
+        struct sk_buff *skb;
+        int count;
+
+        spin_lock_bh(&ax->buflock);
+        if (ax->rbuff[0] > 0x0f) {
+                if (ax->rbuff[0] & 0x20) {
+                        ax->crcmode = CRC_MODE_FLEX;
+                        if (check_crc_flex(ax->rbuff, ax->rcount) < 0) {
+                                ax->stats.rx_errors++;
+                                return;
+                        }
+                        ax->rcount -= 2;
+                        /* dl9sau bugfix: the trailling two bytes flexnet crc
+                         * will not be passed to the kernel. thus we have
+                         * to correct the kissparm signature, because it
+                         * indicates a crc but there's none
+                         */
+                        *ax->rbuff &= ~0x20;
                 }
+        }
+        spin_unlock_bh(&ax->buflock);
+
+        count = ax->rcount;
+
+        if ((skb = dev_alloc_skb(count)) == NULL) {
+                printk(KERN_ERR "mkiss: %s: memory squeeze, dropping packet.\n",
+                       ax->dev->name);
+                ax->stats.rx_dropped++;
+                return;
         }
 
-        return NULL;
+        spin_lock_bh(&ax->buflock);
+        memcpy(skb_put(skb,count), ax->rbuff, count);
+        spin_unlock_bh(&ax->buflock);
+        skb->protocol = ax25_type_trans(skb, ax->dev);
+        netif_rx(skb);
+        ax->dev->last_rx = jiffies;
+        ax->stats.rx_packets++;
+        ax->stats.rx_bytes += count;
 }
 
-/* Free an AX25 channel. */
-static inline void ax_free(struct ax_disp *ax)
+static void kiss_unesc(struct mkiss *ax, unsigned char s)
 {
-        /* Free all AX25 frame buffers. */
-        if (ax->rbuff)
-                kfree(ax->rbuff);
-        ax->rbuff = NULL;
-        if (ax->xbuff)
-                kfree(ax->xbuff);
-        ax->xbuff = NULL;
-        if (!test_and_clear_bit(AXF_INUSE, &ax->flags))
-                printk(KERN_ERR "mkiss: %s: ax_free for already free unit.\n", ax->dev->name);
+        switch (s) {
+        case END:
+                /* drop keeptest bit = VSV */
+                if (test_bit(AXF_KEEPTEST, &ax->flags))
+                        clear_bit(AXF_KEEPTEST, &ax->flags);
+
+                if (!test_and_clear_bit(AXF_ERROR, &ax->flags) && (ax->rcount > 2))
+                        ax_bump(ax);
+
+                clear_bit(AXF_ESCAPE, &ax->flags);
+                ax->rcount = 0;
+                return;
+
+        case ESC:
+                set_bit(AXF_ESCAPE, &ax->flags);
+                return;
+        case ESC_ESC:
+                if (test_and_clear_bit(AXF_ESCAPE, &ax->flags))
+                        s = ESC;
+                break;
+        case ESC_END:
+                if (test_and_clear_bit(AXF_ESCAPE, &ax->flags))
+                        s = END;
+                break;
+        }
+
+        spin_lock_bh(&ax->buflock);
+        if (!test_bit(AXF_ERROR, &ax->flags)) {
+                if (ax->rcount < ax->buffsize) {
+                        ax->rbuff[ax->rcount++] = s;
+                        spin_unlock_bh(&ax->buflock);
+                        return;
+                }
+
+                ax->stats.rx_over_errors++;
+                set_bit(AXF_ERROR, &ax->flags);
+        }
+        spin_unlock_bh(&ax->buflock);
+}
+
+static int ax_set_mac_address(struct net_device *dev, void *addr)
+{
+        struct sockaddr_ax25 *sa = addr;
+
+        spin_lock_irq(&dev->xmit_lock);
+        memcpy(dev->dev_addr, &sa->sax25_call, AX25_ADDR_LEN);
+        spin_unlock_irq(&dev->xmit_lock);
+
+        return 0;
 }
 
-static void ax_changedmtu(struct ax_disp *ax)
+/*---------------------------------------------------------------------------*/
+
+static void ax_changedmtu(struct mkiss *ax)
 {
         struct net_device *dev = ax->dev;
         unsigned char *xbuff, *rbuff, *oxbuff, *orbuff;
@@ -236,7 +348,8 @@ static void ax_changedmtu(struct ax_disp *ax)
         rbuff = kmalloc(len + 4, GFP_ATOMIC);
 
         if (xbuff == NULL || rbuff == NULL)  {
-                printk(KERN_ERR "mkiss: %s: unable to grow ax25 buffers, MTU change cancelled.\n",
+                printk(KERN_ERR "mkiss: %s: unable to grow ax25 buffers, "
+                       "MTU change cancelled.\n",
                        ax->dev->name);
                 dev->mtu = ax->mtu;
                 if (xbuff != NULL)
@@ -258,7 +371,7 @@ static void ax_changedmtu(struct ax_disp *ax)
                         memcpy(ax->xbuff, ax->xhead, ax->xleft);
                 } else  {
                         ax->xleft = 0;
-                        ax->tx_dropped++;
+                        ax->stats.tx_dropped++;
                 }
         }
 
@@ -269,7 +382,7 @@ static void ax_changedmtu(struct ax_disp *ax)
                         memcpy(ax->rbuff, orbuff, ax->rcount);
                 } else  {
                         ax->rcount = 0;
-                        ax->rx_over_errors++;
+                        ax->stats.rx_over_errors++;
                         set_bit(AXF_ERROR, &ax->flags);
                 }
         }
@@ -279,72 +392,14 @@ static void ax_changedmtu(struct ax_disp *ax)
 
         spin_unlock_bh(&ax->buflock);
 
-        if (oxbuff != NULL)
-                kfree(oxbuff);
-        if (orbuff != NULL)
-                kfree(orbuff);
-}
-
-
-/* Set the "sending" flag.  This must be atomic. */
-static inline void ax_lock(struct ax_disp *ax)
-{
-        netif_stop_queue(ax->dev);
-}
-
-
-/* Clear the "sending" flag.  This must be atomic. */
-static inline void ax_unlock(struct ax_disp *ax)
-{
-        netif_start_queue(ax->dev);
-}
-
-/* Send one completely decapsulated AX.25 packet to the AX.25 layer. */
-static void ax_bump(struct ax_disp *ax)
-{
-        struct sk_buff *skb;
-        int count;
-
-        spin_lock_bh(&ax->buflock);
-        if (ax->rbuff[0] > 0x0f) {
-                if (ax->rbuff[0] & 0x20) {
-                        ax->crcmode = CRC_MODE_FLEX;
-                        if (check_crc_flex(ax->rbuff, ax->rcount) < 0) {
-                                ax->rx_errors++;
-                                return;
-                        }
-                        ax->rcount -= 2;
-                        /* dl9sau bugfix: the trailling two bytes flexnet crc
-                         * will not be passed to the kernel. thus we have
-                         * to correct the kissparm signature, because it
-                         * indicates a crc but there's none
-                         */
-                        *ax->rbuff &= ~0x20;
-                }
-        }
-        spin_unlock_bh(&ax->buflock);
-
-        count = ax->rcount;
-
-        if ((skb = dev_alloc_skb(count)) == NULL) {
-                printk(KERN_ERR "mkiss: %s: memory squeeze, dropping packet.\n", ax->dev->name);
-                ax->rx_dropped++;
-                return;
-        }
-
-        spin_lock_bh(&ax->buflock);
-        memcpy(skb_put(skb,count), ax->rbuff, count);
-        spin_unlock_bh(&ax->buflock);
-        skb->protocol = ax25_type_trans(skb, ax->dev);
-        netif_rx(skb);
-        ax->dev->last_rx = jiffies;
-        ax->rx_packets++;
-        ax->rx_bytes+=count;
+        kfree(oxbuff);
+        kfree(orbuff);
 }
 
 /* Encapsulate one AX.25 packet and stuff into a TTY queue. */
-static void ax_encaps(struct ax_disp *ax, unsigned char *icp, int len)
+static void ax_encaps(struct net_device *dev, unsigned char *icp, int len)
 {
+        struct mkiss *ax = netdev_priv(dev);
         unsigned char *p;
         int actual, count;
 
@@ -354,8 +409,8 @@ static void ax_encaps(struct ax_disp *ax, unsigned char *icp, int len)
         if (len > ax->mtu) {            /* Sigh, shouldn't occur BUT ... */
                 len = ax->mtu;
                 printk(KERN_ERR "mkiss: %s: truncating oversized transmit packet!\n", ax->dev->name);
-                ax->tx_dropped++;
-                ax_unlock(ax);
+                ax->stats.tx_dropped++;
+                netif_start_queue(dev);
                 return;
         }
 
@@ -376,10 +431,11 @@ static void ax_encaps(struct ax_disp *ax, unsigned char *icp, int len)
                  break;
         }
         
-        ax->tty->flags |= (1 << TTY_DO_WRITE_WAKEUP);
+        set_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
         actual = ax->tty->driver->write(ax->tty, ax->xbuff, count);
-        ax->tx_packets++;
-        ax->tx_bytes+=actual;
+        ax->stats.tx_packets++;
+        ax->stats.tx_bytes += actual;
+
         ax->dev->trans_start = jiffies;
         ax->xleft = count - actual;
         ax->xhead = ax->xbuff + actual;
@@ -387,37 +443,10 @@ static void ax_encaps(struct ax_disp *ax, unsigned char *icp, int len)
         spin_unlock_bh(&ax->buflock);
 }
 
-/*
- * Called by the driver when there's room for more data.  If we have
- * more packets to send, we send them here.
- */
-static void ax25_write_wakeup(struct tty_struct *tty)
-{
-        int actual;
-        struct ax_disp *ax = (struct ax_disp *) tty->disc_data;
-
-        /* First make sure we're connected. */
-        if (ax == NULL || ax->magic != AX25_MAGIC || !netif_running(ax->dev))
-                return;
-        if (ax->xleft <= 0)  {
-                /* Now serial buffer is almost free & we can start
-                 * transmission of another packet
-                 */
-                tty->flags &= ~(1 << TTY_DO_WRITE_WAKEUP);
-
-                netif_wake_queue(ax->dev);
-                return;
-        }
-
-        actual = tty->driver->write(tty, ax->xhead, ax->xleft);
-        ax->xleft -= actual;
-        ax->xhead += actual;
-}
-
 /* Encapsulate an AX.25 packet and kick it into a TTY queue. */
 static int ax_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-        struct ax_disp *ax = netdev_priv(dev);
+        struct mkiss *ax = netdev_priv(dev);
 
         if (!netif_running(dev))  {
                 printk(KERN_ERR "mkiss: %s: xmit call when iface is down\n", dev->name);
@@ -429,7 +458,7 @@ static int ax_xmit(struct sk_buff *skb, struct net_device *dev)
                  * May be we must check transmitter timeout here ?
                  *      14 Oct 1994 Dmitry Gorodchanin.
                  */
-                if (jiffies - dev->trans_start  < 20 * HZ) {
+                if (time_before(jiffies, dev->trans_start + 20 * HZ)) {
                         /* 20 sec timeout not reached */
                         return 1;
                 }
@@ -439,20 +468,30 @@ static int ax_xmit(struct sk_buff *skb, struct net_device *dev)
                        "bad line quality" : "driver error");
 
                 ax->xleft = 0;
-                ax->tty->flags &= ~(1 << TTY_DO_WRITE_WAKEUP);
-                ax_unlock(ax);
+                clear_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
+                netif_start_queue(dev);
         }
 
         /* We were not busy, so we are now... :-) */
         if (skb != NULL) {
-                ax_lock(ax);
-                ax_encaps(ax, skb->data, skb->len);
+                netif_stop_queue(dev);
+                ax_encaps(dev, skb->data, skb->len);
                 kfree_skb(skb);
         }
 
         return 0;
 }
 
+static int ax_open_dev(struct net_device *dev)
+{
+        struct mkiss *ax = netdev_priv(dev);
+
+        if (ax->tty == NULL)
+                return -ENODEV;
+
+        return 0;
+}
+
 #if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
 
 /* Return the frame type ID */
@@ -481,7 +520,7 @@ static int ax_rebuild_header(struct sk_buff *skb)
 /* Open the low-level part of the AX25 channel. Easy! */
 static int ax_open(struct net_device *dev)
 {
-        struct ax_disp *ax = netdev_priv(dev);
+        struct mkiss *ax = netdev_priv(dev);
         unsigned long len;
 
         if (ax->tty == NULL)
@@ -518,7 +557,6 @@ static int ax_open(struct net_device *dev)
 
         spin_lock_init(&ax->buflock);
 
-        netif_start_queue(dev);
         return 0;
 
 noxbuff:
@@ -532,68 +570,100 @@ norbuff:
 /* Close the low-level part of the AX25 channel. Easy! */
 static int ax_close(struct net_device *dev)
 {
-        struct ax_disp *ax = netdev_priv(dev);
+        struct mkiss *ax = netdev_priv(dev);
 
-        if (ax->tty == NULL)
-                return -EBUSY;
-
-        ax->tty->flags &= ~(1 << TTY_DO_WRITE_WAKEUP);
+        if (ax->tty)
+                clear_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
 
         netif_stop_queue(dev);
 
         return 0;
 }
 
-static int ax25_receive_room(struct tty_struct *tty)
+static struct net_device_stats *ax_get_stats(struct net_device *dev)
 {
-        return 65536;  /* We can handle an infinite amount of data. :-) */
+        struct mkiss *ax = netdev_priv(dev);
+
+        return &ax->stats;
+}
+
+static void ax_setup(struct net_device *dev)
+{
+        static char ax25_bcast[AX25_ADDR_LEN] =
+                {'Q'<<1,'S'<<1,'T'<<1,' '<<1,' '<<1,' '<<1,'0'<<1};
+        static char ax25_test[AX25_ADDR_LEN] =
+                {'L'<<1,'I'<<1,'N'<<1,'U'<<1,'X'<<1,' '<<1,'1'<<1};
+
+        /* Finish setting up the DEVICE info. */
+        dev->mtu             = AX_MTU;
+        dev->hard_start_xmit = ax_xmit;
+        dev->open            = ax_open_dev;
+        dev->stop            = ax_close;
+        dev->get_stats       = ax_get_stats;
+        dev->set_mac_address = ax_set_mac_address;
+        dev->hard_header_len = 0;
+        dev->addr_len        = 0;
+        dev->type            = ARPHRD_AX25;
+        dev->tx_queue_len    = 10;
+        dev->hard_header     = ax_header;
+        dev->rebuild_header  = ax_rebuild_header;
+
+        memcpy(dev->broadcast, ax25_bcast, AX25_ADDR_LEN);
+        memcpy(dev->dev_addr,  ax25_test,  AX25_ADDR_LEN);
+
+        dev->flags      = IFF_BROADCAST | IFF_MULTICAST;
 }
 
 /*
- * Handle the 'receiver data ready' interrupt.
- * This function is called by the 'tty_io' module in the kernel when
- * a block of data has been received, which can now be decapsulated
- * and sent on to the AX.25 layer for further processing.
+ * We have a potential race on dereferencing tty->disc_data, because the tty
+ * layer provides no locking at all - thus one cpu could be running
+ * sixpack_receive_buf while another calls sixpack_close, which zeroes
+ * tty->disc_data and frees the memory that sixpack_receive_buf is using.  The
+ * best way to fix this is to use a rwlock in the tty struct, but for now we
+ * use a single global rwlock for all ttys in ppp line discipline.
  */
-static void ax25_receive_buf(struct tty_struct *tty, const unsigned char *cp, char *fp, int count)
+static rwlock_t disc_data_lock = RW_LOCK_UNLOCKED;
+
+static struct mkiss *mkiss_get(struct tty_struct *tty)
 {
-        struct ax_disp *ax = (struct ax_disp *) tty->disc_data;
+        struct mkiss *ax;
 
-        if (ax == NULL || ax->magic != AX25_MAGIC || !netif_running(ax->dev))
-                return;
+        read_lock(&disc_data_lock);
+        ax = tty->disc_data;
+        if (ax)
+                atomic_inc(&ax->refcnt);
+        read_unlock(&disc_data_lock);
 
-        /*
-         * Argh! mtu change time! - costs us the packet part received
-         * at the change
-         */
-        if (ax->mtu != ax->dev->mtu + 73)
-                ax_changedmtu(ax);
-
-        /* Read the characters out of the buffer */
-        while (count--) {
-                if (fp != NULL && *fp++) {
-                        if (!test_and_set_bit(AXF_ERROR, &ax->flags))
-                                ax->rx_errors++;
-                        cp++;
-                        continue;
-                }
+        return ax;
+}
 
-                kiss_unesc(ax, *cp++);
-        }
+static void mkiss_put(struct mkiss *ax)
+{
+        if (atomic_dec_and_test(&ax->refcnt))
+                up(&ax->dead_sem);
 }
 
-static int ax25_open(struct tty_struct *tty)
+static int mkiss_open(struct tty_struct *tty)
 {
-        struct ax_disp *ax = (struct ax_disp *) tty->disc_data;
+        struct net_device *dev;
+        struct mkiss *ax;
         int err;
 
-        /* First make sure we're not already connected. */
-        if (ax && ax->magic == AX25_MAGIC)
-                return -EEXIST;
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
 
-        /* OK.  Find a free AX25 channel to use. */
-        if ((ax = ax_alloc()) == NULL)
-                return -ENFILE;
+        dev = alloc_netdev(sizeof(struct mkiss), "ax%d", ax_setup);
+        if (!dev) {
+                err = -ENOMEM;
+                goto out;
+        }
+
+        ax = netdev_priv(dev);
+        ax->dev = dev;
+
+        spin_lock_init(&ax->buflock);
+        atomic_set(&ax->refcnt, 1);
+        init_MUTEX_LOCKED(&ax->dead_sem);
 
         ax->tty = tty;
         tty->disc_data = ax;
@@ -602,283 +672,212 @@ static int ax25_open(struct tty_struct *tty)
                 tty->driver->flush_buffer(tty);
 
         /* Restore default settings */
-        ax->dev->type = ARPHRD_AX25;
+        dev->type = ARPHRD_AX25;
 
         /* Perform the low-level AX25 initialization. */
-        if ((err = ax_open(ax->dev)))
-                return err;
+        if ((err = ax_open(ax->dev))) {
+                goto out_free_netdev;
+        }
 
-        /* Done.  We have linked the TTY line to a channel. */
-        return ax->dev->base_addr;
-}
+        if (register_netdev(dev))
+                goto out_free_buffers;
 
-static void ax25_close(struct tty_struct *tty)
-{
-        struct ax_disp *ax = (struct ax_disp *) tty->disc_data;
+        netif_start_queue(dev);
 
-        /* First make sure we're connected. */
-        if (ax == NULL || ax->magic != AX25_MAGIC)
-                return;
+        /* Done.  We have linked the TTY line to a channel. */
+        return 0;
 
-        unregister_netdev(ax->dev);
+out_free_buffers:
+        kfree(ax->rbuff);
+        kfree(ax->xbuff);
 
-        tty->disc_data = NULL;
-        ax->tty        = NULL;
+out_free_netdev:
+        free_netdev(dev);
 
-        ax_free(ax);
+out:
+        return err;
 }
 
-
-static struct net_device_stats *ax_get_stats(struct net_device *dev)
+static void mkiss_close(struct tty_struct *tty)
 {
-        static struct net_device_stats stats;
-        struct ax_disp *ax = netdev_priv(dev);
-
-        memset(&stats, 0, sizeof(struct net_device_stats));
-
-        stats.rx_packets     = ax->rx_packets;
-        stats.tx_packets     = ax->tx_packets;
-        stats.rx_bytes       = ax->rx_bytes;
-        stats.tx_bytes       = ax->tx_bytes;
-        stats.rx_dropped     = ax->rx_dropped;
-        stats.tx_dropped     = ax->tx_dropped;
-        stats.tx_errors      = ax->tx_errors;
-        stats.rx_errors      = ax->rx_errors;
-        stats.rx_over_errors = ax->rx_over_errors;
-
-        return &stats;
-}
+        struct mkiss *ax;
 
+        write_lock(&disc_data_lock);
+        ax = tty->disc_data;
+        tty->disc_data = NULL;
+        write_unlock(&disc_data_lock);
 
-/************************************************************************
- *                         STANDARD ENCAPSULATION                        *
- ************************************************************************/
-
-static int kiss_esc(unsigned char *s, unsigned char *d, int len)
-{
-        unsigned char *ptr = d;
-        unsigned char c;
+        if (ax == 0)
+                return;
 
         /*
-         * Send an initial END character to flush out any
-         * data that may have accumulated in the receiver
-         * due to line noise.
+         * We have now ensured that nobody can start using ap from now on, but
+         * we have to wait for all existing users to finish.
          */
+        if (!atomic_dec_and_test(&ax->refcnt))
+                down(&ax->dead_sem);
 
-        *ptr++ = END;
-
-        while (len-- > 0) {
-                switch (c = *s++) {
-                        case END:
-                                *ptr++ = ESC;
-                                *ptr++ = ESC_END;
-                                break;
-                        case ESC:
-                                *ptr++ = ESC;
-                                *ptr++ = ESC_ESC;
-                                break;
-                        default:
-                                *ptr++ = c;
-                                break;
-                }
-        }
+        unregister_netdev(ax->dev);
 
-        *ptr++ = END;
+        /* Free all AX25 frame buffers. */
+        kfree(ax->rbuff);
+        kfree(ax->xbuff);
 
-        return ptr - d;
+        ax->tty = NULL;
 }
 
-/*
- * MW:
- * OK its ugly, but tell me a better solution without copying the
- * packet to a temporary buffer :-)
- */
-static int kiss_esc_crc(unsigned char *s, unsigned char *d, unsigned short crc, int len)
+/* Perform I/O control on an active ax25 channel. */
+static int mkiss_ioctl(struct tty_struct *tty, struct file *file,
+        unsigned int cmd, unsigned long arg)
 {
-        unsigned char *ptr = d;
-        unsigned char c=0;
-
-        *ptr++ = END;
-        while (len > 0) {
-                if (len > 2) 
-                        c = *s++;
-                else if (len > 1)
-                        c = crc >> 8;
-                else if (len > 0)
-                        c = crc & 0xff;
+        struct mkiss *ax = mkiss_get(tty);
+        struct net_device *dev = ax->dev;
+        unsigned int tmp, err;
 
-                len--;
+        /* First make sure we're connected. */
+        if (ax == NULL)
+                return -ENXIO;
 
-                switch (c) {
-                        case END:
-                                *ptr++ = ESC;
-                                *ptr++ = ESC_END;
-                                break;
-                        case ESC:
-                                *ptr++ = ESC;
-                                *ptr++ = ESC_ESC;
-                                break;
-                        default:
-                                *ptr++ = c;
-                                break;
+        switch (cmd) {
+        case SIOCGIFNAME:
+                err = copy_to_user((void __user *) arg, ax->dev->name,
+                                   strlen(ax->dev->name) + 1) ? -EFAULT : 0;
+                break;
+
+        case SIOCGIFENCAP:
+                err = put_user(4, (int __user *) arg);
+                break;
+
+        case SIOCSIFENCAP:
+                if (get_user(tmp, (int __user *) arg)) {
+                        err = -EFAULT;
+                        break;
                 }
-        }
-        *ptr++ = END;
-        return ptr - d;         
-}
 
-static void kiss_unesc(struct ax_disp *ax, unsigned char s)
-{
-        switch (s) {
-                case END:
-                        /* drop keeptest bit = VSV */
-                        if (test_bit(AXF_KEEPTEST, &ax->flags))
-                                clear_bit(AXF_KEEPTEST, &ax->flags);
+                ax->mode = tmp;
+                dev->addr_len        = AX25_ADDR_LEN;
+                dev->hard_header_len = AX25_KISS_HEADER_LEN +
+                                       AX25_MAX_HEADER_LEN + 3;
+                dev->type            = ARPHRD_AX25;
 
-                        if (!test_and_clear_bit(AXF_ERROR, &ax->flags) && (ax->rcount > 2))
-                                ax_bump(ax);
+                err = 0;
+                break;
 
-                        clear_bit(AXF_ESCAPE, &ax->flags);
-                        ax->rcount = 0;
-                        return;
+        case SIOCSIFHWADDR: {
+                char addr[AX25_ADDR_LEN];
+printk(KERN_INFO "In SIOCSIFHWADDR");
 
-                case ESC:
-                        set_bit(AXF_ESCAPE, &ax->flags);
-                        return;
-                case ESC_ESC:
-                        if (test_and_clear_bit(AXF_ESCAPE, &ax->flags))
-                                s = ESC;
+                if (copy_from_user(&addr,
+                                   (void __user *) arg, AX25_ADDR_LEN)) {
+                        err = -EFAULT;
                         break;
-                case ESC_END:
-                        if (test_and_clear_bit(AXF_ESCAPE, &ax->flags))
-                                s = END;
-                        break;
-        }
-
-        spin_lock_bh(&ax->buflock);
-        if (!test_bit(AXF_ERROR, &ax->flags)) {
-                if (ax->rcount < ax->buffsize) {
-                        ax->rbuff[ax->rcount++] = s;
-                        spin_unlock_bh(&ax->buflock);
-                        return;
                 }
 
-                ax->rx_over_errors++;
-                set_bit(AXF_ERROR, &ax->flags);
+                spin_lock_irq(&dev->xmit_lock);
+                memcpy(dev->dev_addr, addr, AX25_ADDR_LEN);
+                spin_unlock_irq(&dev->xmit_lock);
+
+                err = 0;
+                break;
+        }
+        default:
+                err = -ENOIOCTLCMD;
         }
-        spin_unlock_bh(&ax->buflock);
-}
 
+        mkiss_put(ax);
 
-static int ax_set_mac_address(struct net_device *dev, void __user *addr)
-{
-        if (copy_from_user(dev->dev_addr, addr, AX25_ADDR_LEN))
-                return -EFAULT;
-        return 0;
+        return err;
 }
 
-static int ax_set_dev_mac_address(struct net_device *dev, void *addr)
+/*
+ * Handle the 'receiver data ready' interrupt.
+ * This function is called by the 'tty_io' module in the kernel when
+ * a block of data has been received, which can now be decapsulated
+ * and sent on to the AX.25 layer for further processing.
+ */
+static void mkiss_receive_buf(struct tty_struct *tty, const unsigned char *cp,
+        char *fp, int count)
 {
-        struct sockaddr *sa = addr;
-
-        memcpy(dev->dev_addr, sa->sa_data, AX25_ADDR_LEN);
+        struct mkiss *ax = mkiss_get(tty);
 
-        return 0;
-}
-
-
-/* Perform I/O control on an active ax25 channel. */
-static int ax25_disp_ioctl(struct tty_struct *tty, void *file, int cmd, void __user *arg)
-{
-        struct ax_disp *ax = (struct ax_disp *) tty->disc_data;
-        unsigned int tmp;
+        if (!ax)
+                return;
 
-        /* First make sure we're connected. */
-        if (ax == NULL || ax->magic != AX25_MAGIC)
-                return -EINVAL;
+        /*
+         * Argh! mtu change time! - costs us the packet part received
+         * at the change
+         */
+        if (ax->mtu != ax->dev->mtu + 73)
+                ax_changedmtu(ax);
 
-        switch (cmd) {
-                case SIOCGIFNAME:
-                        if (copy_to_user(arg, ax->dev->name, strlen(ax->dev->name) + 1))
-                                return -EFAULT;
-                        return 0;
-
-                case SIOCGIFENCAP:
-                        return put_user(4, (int __user *)arg);
-
-                case SIOCSIFENCAP:
-                        if (get_user(tmp, (int __user *)arg))
-                                return -EFAULT;
-                        ax->mode = tmp;
-                        ax->dev->addr_len        = AX25_ADDR_LEN;         /* sizeof an AX.25 addr */
-                        ax->dev->hard_header_len = AX25_KISS_HEADER_LEN + AX25_MAX_HEADER_LEN + 3;
-                        ax->dev->type            = ARPHRD_AX25;
-                        return 0;
-
-                 case SIOCSIFHWADDR:
-                        return ax_set_mac_address(ax->dev, arg);
+        /* Read the characters out of the buffer */
+        while (count--) {
+                if (fp != NULL && *fp++) {
+                        if (!test_and_set_bit(AXF_ERROR, &ax->flags))
+                                ax->stats.rx_errors++;
+                        cp++;
+                        continue;
+                }
 
-                default:
-                        return -ENOIOCTLCMD;
+                kiss_unesc(ax, *cp++);
         }
+
+        mkiss_put(ax);
+        if (test_and_clear_bit(TTY_THROTTLED, &tty->flags)
+            && tty->driver->unthrottle)
+                tty->driver->unthrottle(tty);
 }
 
-static int ax_open_dev(struct net_device *dev)
+static int mkiss_receive_room(struct tty_struct *tty)
 {
-        struct ax_disp *ax = netdev_priv(dev);
-
-        if (ax->tty == NULL)
-                return -ENODEV;
-
-        return 0;
+        return 65536;  /* We can handle an infinite amount of data. :-) */
 }
 
-
-/* Initialize the driver.  Called by network startup. */
-static int ax25_init(struct net_device *dev)
+/*
+ * Called by the driver when there's room for more data.  If we have
+ * more packets to send, we send them here.
+ */
+static void mkiss_write_wakeup(struct tty_struct *tty)
 {
-        struct ax_disp *ax = netdev_priv(dev);
-
-        static char ax25_bcast[AX25_ADDR_LEN] =
-                {'Q'<<1,'S'<<1,'T'<<1,' '<<1,' '<<1,' '<<1,'0'<<1};
-        static char ax25_test[AX25_ADDR_LEN] =
-                {'L'<<1,'I'<<1,'N'<<1,'U'<<1,'X'<<1,' '<<1,'1'<<1};
-
-        if (ax == NULL)         /* Allocation failed ?? */
-                return -ENODEV;
+        struct mkiss *ax = mkiss_get(tty);
+        int actual;
 
-        /* Set up the "AX25 Control Block". (And clear statistics) */
-        memset(ax, 0, sizeof (struct ax_disp));
-        ax->magic  = AX25_MAGIC;
-        ax->dev    = dev;
+        if (!ax)
+                return;
 
-        /* Finish setting up the DEVICE info. */
-        dev->mtu             = AX_MTU;
-        dev->hard_start_xmit = ax_xmit;
-        dev->open            = ax_open_dev;
-        dev->stop            = ax_close;
-        dev->get_stats       = ax_get_stats;
-        dev->set_mac_address = ax_set_dev_mac_address;
-        dev->hard_header_len = 0;
-        dev->addr_len        = 0;
-        dev->type            = ARPHRD_AX25;
-        dev->tx_queue_len    = 10;
-        dev->hard_header     = ax_header;
-        dev->rebuild_header  = ax_rebuild_header;
+        if (ax->xleft <= 0)  {
+                /* Now serial buffer is almost free & we can start
+                 * transmission of another packet
+                 */
+                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
 
-        memcpy(dev->broadcast, ax25_bcast, AX25_ADDR_LEN);
-        memcpy(dev->dev_addr,  ax25_test,  AX25_ADDR_LEN);
+                netif_wake_queue(ax->dev);
+                goto out;
+        }
 
-        /* New-style flags. */
-        dev->flags      = IFF_BROADCAST | IFF_MULTICAST;
+        actual = tty->driver->write(tty, ax->xhead, ax->xleft);
+        ax->xleft -= actual;
+        ax->xhead += actual;
 
-        return 0;
+out:
+        mkiss_put(ax);
 }
 
+static struct tty_ldisc ax_ldisc = {
+        .magic          = TTY_LDISC_MAGIC,
+        .name           = "mkiss",
+        .open           = mkiss_open,
+        .close          = mkiss_close,
+        .ioctl          = mkiss_ioctl,
+        .receive_buf    = mkiss_receive_buf,
+        .receive_room   = mkiss_receive_room,
+        .write_wakeup   = mkiss_write_wakeup
+};
 
-/* ******************************************************************** */
-/* *                    Init MKISS driver                             * */
-/* ******************************************************************** */
+static char banner[] __initdata = KERN_INFO \
+        "mkiss: AX.25 Multikiss, Hans Albas PE1AYX\n";
+static char msg_regfail[] __initdata = KERN_ERR \
+        "mkiss: can't register line discipline (err = %d)\n";
 
 static int __init mkiss_init_driver(void)
 {
@@ -886,64 +885,27 @@ static int __init mkiss_init_driver(void)
 
         printk(banner);
 
-        if (ax25_maxdev < 4)
-          ax25_maxdev = 4; /* Sanity */
+        if ((status = tty_register_ldisc(N_AX25, &ax_ldisc)) != 0)
+                printk(msg_regfail);
 
-        if ((ax25_ctrls = kmalloc(sizeof(void *) * ax25_maxdev, GFP_KERNEL)) == NULL) {
-                printk(KERN_ERR "mkiss: Can't allocate ax25_ctrls[] array!\n");
-                return -ENOMEM;
-        }
-
-        /* Clear the pointer array, we allocate devices when we need them */
-        memset(ax25_ctrls, 0, sizeof(void*) * ax25_maxdev); /* Pointers */
-
-        /* Fill in our line protocol discipline, and register it */
-        ax_ldisc.magic          = TTY_LDISC_MAGIC;
-        ax_ldisc.name           = "mkiss";
-        ax_ldisc.open           = ax25_open;
-        ax_ldisc.close          = ax25_close;
-        ax_ldisc.ioctl          = (int (*)(struct tty_struct *, struct file *,
-                                        unsigned int, unsigned long))ax25_disp_ioctl;
-        ax_ldisc.receive_buf    = ax25_receive_buf;
-        ax_ldisc.receive_room   = ax25_receive_room;
-        ax_ldisc.write_wakeup   = ax25_write_wakeup;
-
-        if ((status = tty_register_ldisc(N_AX25, &ax_ldisc)) != 0) {
-                printk(KERN_ERR "mkiss: can't register line discipline (err = %d)\n", status);
-                kfree(ax25_ctrls);
-        }
         return status;
 }
 
+static const char msg_unregfail[] __exitdata = KERN_ERR \
+        "mkiss: can't unregister line discipline (err = %d)\n";
+
 static void __exit mkiss_exit_driver(void)
 {
-        int i;
-
-        for (i = 0; i < ax25_maxdev; i++) {
-                if (ax25_ctrls[i]) {
-                        /*
-                        * VSV = if dev->start==0, then device
-                        * unregistered while close proc.
-                        */
-                        if (netif_running(&ax25_ctrls[i]->dev))
-                                unregister_netdev(&ax25_ctrls[i]->dev);
-                        kfree(ax25_ctrls[i]);
-                }
-        }
+        int ret;
 
-        kfree(ax25_ctrls);
-        ax25_ctrls = NULL;
-
-        if ((i = tty_unregister_ldisc(N_AX25)))
-                printk(KERN_ERR "mkiss: can't unregister line discipline (err = %d)\n", i);
+        if ((ret = tty_unregister_ldisc(N_AX25)))
+                printk(msg_unregfail, ret);
 }
 
-MODULE_AUTHOR("Hans Albas PE1AYX <hans@esrac.ele.tue.nl>");
+MODULE_AUTHOR("Ralf Baechle DL5RB <ralf@linux-mips.org>");
 MODULE_DESCRIPTION("KISS driver for AX.25 over TTYs");
-MODULE_PARM(ax25_maxdev, "i");
-MODULE_PARM_DESC(ax25_maxdev, "number of MKISS devices");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_LDISC(N_AX25);
+
 module_init(mkiss_init_driver);
 module_exit(mkiss_exit_driver);
-
diff --git a/drivers/net/ibm_emac/ibm_emac_core.c b/drivers/net/ibm_emac/ibm_emac_core.c
index 6482d994d489..0de3bb906174 100644
--- a/drivers/net/ibm_emac/ibm_emac_core.c
+++ b/drivers/net/ibm_emac/ibm_emac_core.c
@@ -1253,7 +1253,7 @@ static int emac_init_tah(struct ocp_enet_private *fep)
                  TAH_MR_CVR | TAH_MR_ST_768 | TAH_MR_TFS_10KB | TAH_MR_DTFP |
                  TAH_MR_DIG);
 
-        iounmap(&tahp);
+        iounmap(tahp);
 
         return 0;
 }
@@ -1712,11 +1712,10 @@ struct mal_commac_ops emac_commac_ops = {
 };
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
-static int emac_netpoll(struct net_device *ndev)
+static void emac_netpoll(struct net_device *ndev)
 {
         emac_rxeob_dev((void *)ndev, 0);
         emac_txeob_dev((void *)ndev, 0);
-        return 0;
 }
 #endif
 
diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
index c39b0609742a..32d5fabd4b10 100644
--- a/drivers/net/ibmveth.c
+++ b/drivers/net/ibmveth.c
@@ -1144,7 +1144,7 @@ static void ibmveth_proc_unregister_driver(void)
 
 static struct vio_device_id ibmveth_device_table[] __devinitdata= {
         { "network", "IBM,l-lan"},
-        { 0,}
+        { "", "" }
 };
 
 MODULE_DEVICE_TABLE(vio, ibmveth_device_table);
diff --git a/drivers/net/ioc3-eth.c b/drivers/net/ioc3-eth.c
index d520b5920d6c..49e5467bdd73 100644
--- a/drivers/net/ioc3-eth.c
+++ b/drivers/net/ioc3-eth.c
@@ -499,7 +499,7 @@ static int ioc3_mdio_read(struct net_device *dev, int phy, int reg)
         ioc3_w_micr((phy << MICR_PHYADDR_SHIFT) | reg | MICR_READTRIG);
         while (ioc3_r_micr() & MICR_BUSY);
 
-        return ioc3_r_micr() & MIDR_DATA_MASK;
+        return ioc3_r_midr_r() & MIDR_DATA_MASK;
 }
 
 static void ioc3_mdio_write(struct net_device *dev, int phy, int reg, int data)
@@ -1291,7 +1291,6 @@ static int ioc3_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         dev->features           = NETIF_F_IP_CSUM;
 #endif
 
-        ioc3_setup_duplex(ip);
         sw_physid1 = ioc3_mdio_read(dev, ip->mii.phy_id, MII_PHYSID1);
         sw_physid2 = ioc3_mdio_read(dev, ip->mii.phy_id, MII_PHYSID2);
 
@@ -1300,6 +1299,7 @@ static int ioc3_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto out_stop;
 
         mii_check_media(&ip->mii, 1, 1);
+        ioc3_setup_duplex(ip);
 
         vendor = (sw_physid1 << 12) | (sw_physid2 >> 4);
         model  = (sw_physid2 >> 4) & 0x3f;
@@ -1524,7 +1524,7 @@ static void ioc3_get_drvinfo (struct net_device *dev,
         struct ethtool_drvinfo *info)
 {
         struct ioc3_private *ip = netdev_priv(dev);
-                                                                                
+
         strcpy (info->driver, IOC3_NAME);
         strcpy (info->version, IOC3_VERSION);
         strcpy (info->bus_info, pci_name(ip->pdev));
@@ -1550,7 +1550,7 @@ static int ioc3_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
         spin_lock_irq(&ip->ioc3_lock);
         rc = mii_ethtool_sset(&ip->mii, cmd);
         spin_unlock_irq(&ip->ioc3_lock);
-                                                                        
+
         return rc;
 }
 
diff --git a/drivers/net/iseries_veth.c b/drivers/net/iseries_veth.c
index 55af32e9bf08..183ba97785b0 100644
--- a/drivers/net/iseries_veth.c
+++ b/drivers/net/iseries_veth.c
@@ -1370,7 +1370,7 @@ static int veth_probe(struct vio_dev *vdev, const struct vio_device_id *id)
  */
 static struct vio_device_id veth_device_table[] __devinitdata = {
         { "vlan", "" },
-        { NULL, NULL }
+        { "", "" }
 };
 MODULE_DEVICE_TABLE(vio, veth_device_table);
 
diff --git a/drivers/net/ixgb/ixgb.h b/drivers/net/ixgb/ixgb.h
index f8d3385c7842..c83271b38621 100644
--- a/drivers/net/ixgb/ixgb.h
+++ b/drivers/net/ixgb/ixgb.h
@@ -119,7 +119,7 @@ struct ixgb_adapter;
  * so a DMA handle can be stored along with the buffer */
 struct ixgb_buffer {
         struct sk_buff *skb;
-        uint64_t dma;
+        dma_addr_t dma;
         unsigned long time_stamp;
         uint16_t length;
         uint16_t next_to_watch;
diff --git a/drivers/net/ixgb/ixgb_ee.c b/drivers/net/ixgb/ixgb_ee.c
index 3aae110c5560..661a46b95a61 100644
--- a/drivers/net/ixgb/ixgb_ee.c
+++ b/drivers/net/ixgb/ixgb_ee.c
@@ -565,24 +565,6 @@ ixgb_get_ee_mac_addr(struct ixgb_hw *hw,
         }
 }
 
-/******************************************************************************
- * return the compatibility flags from EEPROM
- *
- * hw - Struct containing variables accessed by shared code
- *
- * Returns:
- *          compatibility flags if EEPROM contents are valid, 0 otherwise
- ******************************************************************************/
-uint16_t
-ixgb_get_ee_compatibility(struct ixgb_hw *hw)
-{
-        struct ixgb_ee_map_type *ee_map = (struct ixgb_ee_map_type *)hw->eeprom;
-
-        if(ixgb_check_and_get_eeprom_data(hw) == TRUE)
-                return (le16_to_cpu(ee_map->compatibility));
-
-        return(0);
-}
 
 /******************************************************************************
  * return the Printed Board Assembly number from EEPROM
@@ -602,81 +584,6 @@ ixgb_get_ee_pba_number(struct ixgb_hw *hw)
         return(0);
 }
 
-/******************************************************************************
- * return the Initialization Control Word 1 from EEPROM
- *
- * hw - Struct containing variables accessed by shared code
- *
- * Returns:
- *          Initialization Control Word 1 if EEPROM contents are valid, 0 otherwise
- ******************************************************************************/
-uint16_t
-ixgb_get_ee_init_ctrl_reg_1(struct ixgb_hw *hw)
-{
-        struct ixgb_ee_map_type *ee_map = (struct ixgb_ee_map_type *)hw->eeprom;
-
-        if(ixgb_check_and_get_eeprom_data(hw) == TRUE)
-                return (le16_to_cpu(ee_map->init_ctrl_reg_1));
-
-        return(0);
-}
-
-/******************************************************************************
- * return the Initialization Control Word 2 from EEPROM
- *
- * hw - Struct containing variables accessed by shared code
- *
- * Returns:
- *          Initialization Control Word 2 if EEPROM contents are valid, 0 otherwise
- ******************************************************************************/
-uint16_t
-ixgb_get_ee_init_ctrl_reg_2(struct ixgb_hw *hw)
-{
-        struct ixgb_ee_map_type *ee_map = (struct ixgb_ee_map_type *)hw->eeprom;
-
-        if(ixgb_check_and_get_eeprom_data(hw) == TRUE)
-                return (le16_to_cpu(ee_map->init_ctrl_reg_2));
-
-        return(0);
-}
-
-/******************************************************************************
- * return the Subsystem Id from EEPROM
- *
- * hw - Struct containing variables accessed by shared code
- *
- * Returns:
- *          Subsystem Id if EEPROM contents are valid, 0 otherwise
- ******************************************************************************/
-uint16_t
-ixgb_get_ee_subsystem_id(struct ixgb_hw *hw)
-{
-        struct ixgb_ee_map_type *ee_map = (struct ixgb_ee_map_type *)hw->eeprom;
-
-        if(ixgb_check_and_get_eeprom_data(hw) == TRUE)
-                return (le16_to_cpu(ee_map->subsystem_id));
-
-        return(0);
-}
-
-/******************************************************************************
- * return the Sub Vendor Id from EEPROM
- *
- * hw - Struct containing variables accessed by shared code
- *
- * Returns:
- *          Sub Vendor Id if EEPROM contents are valid, 0 otherwise
- ******************************************************************************/
-uint16_t
-ixgb_get_ee_subvendor_id(struct ixgb_hw *hw)
-{
-        struct ixgb_ee_map_type *ee_map = (struct ixgb_ee_map_type *)hw->eeprom;
-
-        if(ixgb_check_and_get_eeprom_data(hw) == TRUE)
-                return (le16_to_cpu(ee_map->subvendor_id));
-
-        return(0);
-}
 
 /******************************************************************************
  * return the Device Id from EEPROM
@@ -694,81 +601,6 @@ ixgb_get_ee_device_id(struct ixgb_hw *hw)
         if(ixgb_check_and_get_eeprom_data(hw) == TRUE)
                 return (le16_to_cpu(ee_map->device_id));
 
-        return(0);
-}
-
-/******************************************************************************
- * return the Vendor Id from EEPROM
- *
- * hw - Struct containing variables accessed by shared code
- *
- * Returns:
- *          Device Id if EEPROM contents are valid, 0 otherwise
- ******************************************************************************/
-uint16_t
-ixgb_get_ee_vendor_id(struct ixgb_hw *hw)
-{
-        struct ixgb_ee_map_type *ee_map = (struct ixgb_ee_map_type *)hw->eeprom;
-
-        if(ixgb_check_and_get_eeprom_data(hw) == TRUE)
-                return (le16_to_cpu(ee_map->vendor_id));
-
-        return(0);
-}
-
-/******************************************************************************
- * return the Software Defined Pins Register from EEPROM
- *
- * hw - Struct containing variables accessed by shared code
- *
- * Returns:
- *          SDP Register if EEPROM contents are valid, 0 otherwise
- ******************************************************************************/
-uint16_t
-ixgb_get_ee_swdpins_reg(struct ixgb_hw *hw)
-{
-        struct ixgb_ee_map_type *ee_map = (struct ixgb_ee_map_type *)hw->eeprom;
-
-        if(ixgb_check_and_get_eeprom_data(hw) == TRUE)
-                return (le16_to_cpu(ee_map->swdpins_reg));
-
-        return(0);
+        return (0);
 }
 
-/******************************************************************************
- * return the D3 Power Management Bits from EEPROM
- *
- * hw - Struct containing variables accessed by shared code
- *
- * Returns:
- *          D3 Power Management Bits if EEPROM contents are valid, 0 otherwise
- ******************************************************************************/
-uint8_t
-ixgb_get_ee_d3_power(struct ixgb_hw *hw)
-{
-        struct ixgb_ee_map_type *ee_map = (struct ixgb_ee_map_type *)hw->eeprom;
-
-        if(ixgb_check_and_get_eeprom_data(hw) == TRUE)
-                return (le16_to_cpu(ee_map->d3_power));
-
-        return(0);
-}
-
-/******************************************************************************
- * return the D0 Power Management Bits from EEPROM
- *
- * hw - Struct containing variables accessed by shared code
- *
- * Returns:
- *          D0 Power Management Bits if EEPROM contents are valid, 0 otherwise
- ******************************************************************************/
-uint8_t
-ixgb_get_ee_d0_power(struct ixgb_hw *hw)
-{
-        struct ixgb_ee_map_type *ee_map = (struct ixgb_ee_map_type *)hw->eeprom;
-
-        if(ixgb_check_and_get_eeprom_data(hw) == TRUE)
-                return (le16_to_cpu(ee_map->d0_power));
-
-        return(0);
-}
diff --git a/drivers/net/ixgb/ixgb_ethtool.c b/drivers/net/ixgb/ixgb_ethtool.c
index 3fa113854eeb..9d026ed77ddd 100644
--- a/drivers/net/ixgb/ixgb_ethtool.c
+++ b/drivers/net/ixgb/ixgb_ethtool.c
@@ -98,10 +98,10 @@ static struct ixgb_stats ixgb_gstrings_stats[] = {
 static int
 ixgb_get_settings(struct net_device *netdev, struct ethtool_cmd *ecmd)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
 
         ecmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_FIBRE);
-        ecmd->advertising = (SUPPORTED_10000baseT_Full | SUPPORTED_FIBRE);
+        ecmd->advertising = (ADVERTISED_10000baseT_Full | ADVERTISED_FIBRE);
         ecmd->port = PORT_FIBRE;
         ecmd->transceiver = XCVR_EXTERNAL;
 
@@ -120,7 +120,7 @@ ixgb_get_settings(struct net_device *netdev, struct ethtool_cmd *ecmd)
 static int
 ixgb_set_settings(struct net_device *netdev, struct ethtool_cmd *ecmd)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
 
         if(ecmd->autoneg == AUTONEG_ENABLE ||
            ecmd->speed + ecmd->duplex != SPEED_10000 + DUPLEX_FULL)
@@ -130,6 +130,12 @@ ixgb_set_settings(struct net_device *netdev, struct ethtool_cmd *ecmd)
                 ixgb_down(adapter, TRUE);
                 ixgb_reset(adapter);
                 ixgb_up(adapter);
+                /* be optimistic about our link, since we were up before */
+                adapter->link_speed = 10000;
+                adapter->link_duplex = FULL_DUPLEX;
+                netif_carrier_on(netdev);
+                netif_wake_queue(netdev);
+                
         } else
                 ixgb_reset(adapter);
 
@@ -140,7 +146,7 @@ static void
 ixgb_get_pauseparam(struct net_device *netdev,
                          struct ethtool_pauseparam *pause)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
         struct ixgb_hw *hw = &adapter->hw;
         
         pause->autoneg = AUTONEG_DISABLE;
@@ -159,7 +165,7 @@ static int
 ixgb_set_pauseparam(struct net_device *netdev,
                          struct ethtool_pauseparam *pause)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
         struct ixgb_hw *hw = &adapter->hw;
         
         if(pause->autoneg == AUTONEG_ENABLE)
@@ -177,6 +183,11 @@ ixgb_set_pauseparam(struct net_device *netdev,
         if(netif_running(adapter->netdev)) {
                 ixgb_down(adapter, TRUE);
                 ixgb_up(adapter);
+                /* be optimistic about our link, since we were up before */
+                adapter->link_speed = 10000;
+                adapter->link_duplex = FULL_DUPLEX;
+                netif_carrier_on(netdev);
+                netif_wake_queue(netdev);
         } else
                 ixgb_reset(adapter);
                 
@@ -186,19 +197,26 @@ ixgb_set_pauseparam(struct net_device *netdev,
 static uint32_t
 ixgb_get_rx_csum(struct net_device *netdev)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
+
         return adapter->rx_csum;
 }
 
 static int
 ixgb_set_rx_csum(struct net_device *netdev, uint32_t data)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
+
         adapter->rx_csum = data;
 
         if(netif_running(netdev)) {
                 ixgb_down(adapter,TRUE);
                 ixgb_up(adapter);
+                /* be optimistic about our link, since we were up before */
+                adapter->link_speed = 10000;
+                adapter->link_duplex = FULL_DUPLEX;
+                netif_carrier_on(netdev);
+                netif_wake_queue(netdev);
         } else
                 ixgb_reset(adapter);
         return 0;
@@ -246,14 +264,15 @@ static void
 ixgb_get_regs(struct net_device *netdev,
                    struct ethtool_regs *regs, void *p)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
         struct ixgb_hw *hw = &adapter->hw;
         uint32_t *reg = p;
         uint32_t *reg_start = reg;
         uint8_t i;
 
         /* the 1 (one) below indicates an attempt at versioning, if the
-         * interface in ethtool or the driver this 1 should be incremented */
+         * interface in ethtool or the driver changes, this 1 should be
+         * incremented */
         regs->version = (1<<24) | hw->revision_id << 16 | hw->device_id;
 
         /* General Registers */
@@ -283,7 +302,8 @@ ixgb_get_regs(struct net_device *netdev,
         *reg++ = IXGB_READ_REG(hw, RAIDC);      /*  19 */
         *reg++ = IXGB_READ_REG(hw, RXCSUM);     /*  20 */
 
-        for (i = 0; i < IXGB_RAR_ENTRIES; i++) {
+        /* there are 16 RAR entries in hardware, we only use 3 */
+        for(i = 0; i < 16; i++) {
                 *reg++ = IXGB_READ_REG_ARRAY(hw, RAL, (i << 1)); /*21,...,51 */
                 *reg++ = IXGB_READ_REG_ARRAY(hw, RAH, (i << 1)); /*22,...,52 */
         }
@@ -391,7 +411,7 @@ static int
 ixgb_get_eeprom(struct net_device *netdev,
                   struct ethtool_eeprom *eeprom, uint8_t *bytes)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
         struct ixgb_hw *hw = &adapter->hw;
         uint16_t *eeprom_buff;
         int i, max_len, first_word, last_word;
@@ -439,7 +459,7 @@ static int
 ixgb_set_eeprom(struct net_device *netdev,
                   struct ethtool_eeprom *eeprom, uint8_t *bytes)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
         struct ixgb_hw *hw = &adapter->hw;
         uint16_t *eeprom_buff;
         void *ptr;
@@ -497,7 +517,7 @@ static void
 ixgb_get_drvinfo(struct net_device *netdev,
                    struct ethtool_drvinfo *drvinfo)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
 
         strncpy(drvinfo->driver,  ixgb_driver_name, 32);
         strncpy(drvinfo->version, ixgb_driver_version, 32);
@@ -512,7 +532,7 @@ static void
 ixgb_get_ringparam(struct net_device *netdev,
                 struct ethtool_ringparam *ring)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
         struct ixgb_desc_ring *txdr = &adapter->tx_ring;
         struct ixgb_desc_ring *rxdr = &adapter->rx_ring;
 
@@ -530,7 +550,7 @@ static int
 ixgb_set_ringparam(struct net_device *netdev,
                 struct ethtool_ringparam *ring)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
         struct ixgb_desc_ring *txdr = &adapter->tx_ring;
         struct ixgb_desc_ring *rxdr = &adapter->rx_ring;
         struct ixgb_desc_ring tx_old, tx_new, rx_old, rx_new;
@@ -573,6 +593,11 @@ ixgb_set_ringparam(struct net_device *netdev,
                 adapter->tx_ring = tx_new;
                 if((err = ixgb_up(adapter)))
                         return err;
+                /* be optimistic about our link, since we were up before */
+                adapter->link_speed = 10000;
+                adapter->link_duplex = FULL_DUPLEX;
+                netif_carrier_on(netdev);
+                netif_wake_queue(netdev);
         }
 
         return 0;
@@ -607,7 +632,7 @@ ixgb_led_blink_callback(unsigned long data)
 static int
 ixgb_phys_id(struct net_device *netdev, uint32_t data)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
 
         if(!data || data > (uint32_t)(MAX_SCHEDULE_TIMEOUT / HZ))
                 data = (uint32_t)(MAX_SCHEDULE_TIMEOUT / HZ);
@@ -643,7 +668,7 @@ static void
 ixgb_get_ethtool_stats(struct net_device *netdev, 
                 struct ethtool_stats *stats, uint64_t *data)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
         int i;
 
         ixgb_update_stats(adapter);
diff --git a/drivers/net/ixgb/ixgb_hw.h b/drivers/net/ixgb/ixgb_hw.h
index 97898efe7cc8..8bcf31ed10c2 100644
--- a/drivers/net/ixgb/ixgb_hw.h
+++ b/drivers/net/ixgb/ixgb_hw.h
@@ -822,17 +822,8 @@ extern void ixgb_clear_vfta(struct ixgb_hw *hw);
 
 /* Access functions to eeprom data */
 void ixgb_get_ee_mac_addr(struct ixgb_hw *hw, uint8_t *mac_addr);
-uint16_t ixgb_get_ee_compatibility(struct ixgb_hw *hw);
 uint32_t ixgb_get_ee_pba_number(struct ixgb_hw *hw);
-uint16_t ixgb_get_ee_init_ctrl_reg_1(struct ixgb_hw *hw);
-uint16_t ixgb_get_ee_init_ctrl_reg_2(struct ixgb_hw *hw);
-uint16_t ixgb_get_ee_subsystem_id(struct ixgb_hw *hw);
-uint16_t ixgb_get_ee_subvendor_id(struct ixgb_hw *hw);
 uint16_t ixgb_get_ee_device_id(struct ixgb_hw *hw);
-uint16_t ixgb_get_ee_vendor_id(struct ixgb_hw *hw);
-uint16_t ixgb_get_ee_swdpins_reg(struct ixgb_hw *hw);
-uint8_t ixgb_get_ee_d3_power(struct ixgb_hw *hw);
-uint8_t ixgb_get_ee_d0_power(struct ixgb_hw *hw);
 boolean_t ixgb_get_eeprom_data(struct ixgb_hw *hw);
 uint16_t ixgb_get_eeprom_word(struct ixgb_hw *hw, uint16_t index);
 
diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
index 097b90ccf575..5c555373adbe 100644
--- a/drivers/net/ixgb/ixgb_main.c
+++ b/drivers/net/ixgb/ixgb_main.c
@@ -29,6 +29,11 @@
 #include "ixgb.h"
 
 /* Change Log
+ * 1.0.96 04/19/05
+ * - Make needlessly global code static -- bunk@stusta.de
+ * - ethtool cleanup -- shemminger@osdl.org
+ * - Support for MODULE_VERSION -- linville@tuxdriver.com
+ * - add skb_header_cloned check to the tso path -- herbert@apana.org.au
  * 1.0.88 01/05/05
  * - include fix to the condition that determines when to quit NAPI - Robert Olsson
  * - use netif_poll_{disable/enable} to synchronize between NAPI and i/f up/down
@@ -47,10 +52,9 @@ char ixgb_driver_string[] = "Intel(R) PRO/10GbE Network Driver";
 #else
 #define DRIVERNAPI "-NAPI"
 #endif
-
-#define DRV_VERSION "1.0.95-k2"DRIVERNAPI
+#define DRV_VERSION             "1.0.100-k2"DRIVERNAPI
 char ixgb_driver_version[] = DRV_VERSION;
-char ixgb_copyright[] = "Copyright (c) 1999-2005 Intel Corporation.";
+static char ixgb_copyright[] = "Copyright (c) 1999-2005 Intel Corporation.";
 
 /* ixgb_pci_tbl - PCI Device ID Table
  *
@@ -145,10 +149,12 @@ MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
 
 /* some defines for controlling descriptor fetches in h/w */
-#define RXDCTL_PTHRESH_DEFAULT 128      /* chip considers prefech below this */
-#define RXDCTL_HTHRESH_DEFAULT 16       /* chip will only prefetch if tail is 
-                                           pushed this many descriptors from head */
 #define RXDCTL_WTHRESH_DEFAULT 16       /* chip writes back at this many or RXT0 */
+#define RXDCTL_PTHRESH_DEFAULT 0                /* chip considers prefech below
+                                                 * this */
+#define RXDCTL_HTHRESH_DEFAULT 0                /* chip will only prefetch if tail
+                                                 * is pushed this many descriptors
+                                                 * from head */
 
 /**
  * ixgb_init_module - Driver Registration Routine
@@ -376,7 +382,7 @@ ixgb_probe(struct pci_dev *pdev,
         SET_NETDEV_DEV(netdev, &pdev->dev);
 
         pci_set_drvdata(pdev, netdev);
-        adapter = netdev->priv;
+        adapter = netdev_priv(netdev);
         adapter->netdev = netdev;
         adapter->pdev = pdev;
         adapter->hw.back = adapter;
@@ -512,7 +518,7 @@ static void __devexit
 ixgb_remove(struct pci_dev *pdev)
 {
         struct net_device *netdev = pci_get_drvdata(pdev);
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
 
         unregister_netdev(netdev);
 
@@ -583,7 +589,7 @@ ixgb_sw_init(struct ixgb_adapter *adapter)
 static int
 ixgb_open(struct net_device *netdev)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
         int err;
 
         /* allocate transmit descriptors */
@@ -626,7 +632,7 @@ err_setup_tx:
 static int
 ixgb_close(struct net_device *netdev)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
 
         ixgb_down(adapter, TRUE);
 
@@ -1017,7 +1023,7 @@ ixgb_clean_rx_ring(struct ixgb_adapter *adapter)
 static int
 ixgb_set_mac(struct net_device *netdev, void *p)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
         struct sockaddr *addr = p;
 
         if(!is_valid_ether_addr(addr->sa_data))
@@ -1043,7 +1049,7 @@ ixgb_set_mac(struct net_device *netdev, void *p)
 static void
 ixgb_set_multi(struct net_device *netdev)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
         struct ixgb_hw *hw = &adapter->hw;
         struct dev_mc_list *mc_ptr;
         uint32_t rctl;
@@ -1371,7 +1377,7 @@ ixgb_tx_queue(struct ixgb_adapter *adapter, int count, int vlan_id,int tx_flags)
 static int
 ixgb_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
         unsigned int first;
         unsigned int tx_flags = 0;
         unsigned long flags;
@@ -1425,7 +1431,7 @@ ixgb_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 static void
 ixgb_tx_timeout(struct net_device *netdev)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
 
         /* Do the reset outside of interrupt context */
         schedule_work(&adapter->tx_timeout_task);
@@ -1434,7 +1440,7 @@ ixgb_tx_timeout(struct net_device *netdev)
 static void
 ixgb_tx_timeout_task(struct net_device *netdev)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
 
         ixgb_down(adapter, TRUE);
         ixgb_up(adapter);
@@ -1451,7 +1457,7 @@ ixgb_tx_timeout_task(struct net_device *netdev)
 static struct net_device_stats *
 ixgb_get_stats(struct net_device *netdev)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
 
         return &adapter->net_stats;
 }
@@ -1467,7 +1473,7 @@ ixgb_get_stats(struct net_device *netdev)
 static int
 ixgb_change_mtu(struct net_device *netdev, int new_mtu)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
         int max_frame = new_mtu + ENET_HEADER_SIZE + ENET_FCS_LENGTH;
         int old_max_frame = netdev->mtu + ENET_HEADER_SIZE + ENET_FCS_LENGTH;
 
@@ -1522,7 +1528,8 @@ ixgb_update_stats(struct ixgb_adapter *adapter)
 
                 multi |= ((u64)IXGB_READ_REG(&adapter->hw, MPRCH) << 32);
                 /* fix up multicast stats by removing broadcasts */
-                multi -= bcast;
+                if(multi >= bcast)
+                        multi -= bcast;
                 
                 adapter->stats.mprcl += (multi & 0xFFFFFFFF);
                 adapter->stats.mprch += (multi >> 32);
@@ -1641,7 +1648,7 @@ static irqreturn_t
 ixgb_intr(int irq, void *data, struct pt_regs *regs)
 {
         struct net_device *netdev = data;
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
         struct ixgb_hw *hw = &adapter->hw;
         uint32_t icr = IXGB_READ_REG(hw, ICR);
 #ifndef CONFIG_IXGB_NAPI
@@ -1688,7 +1695,7 @@ ixgb_intr(int irq, void *data, struct pt_regs *regs)
 static int
 ixgb_clean(struct net_device *netdev, int *budget)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
         int work_to_do = min(*budget, netdev->quota);
         int tx_cleaned;
         int work_done = 0;
@@ -2017,7 +2024,7 @@ ixgb_alloc_rx_buffers(struct ixgb_adapter *adapter)
 static void
 ixgb_vlan_rx_register(struct net_device *netdev, struct vlan_group *grp)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
         uint32_t ctrl, rctl;
 
         ixgb_irq_disable(adapter);
@@ -2055,7 +2062,7 @@ ixgb_vlan_rx_register(struct net_device *netdev, struct vlan_group *grp)
 static void
 ixgb_vlan_rx_add_vid(struct net_device *netdev, uint16_t vid)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
         uint32_t vfta, index;
 
         /* add VID to filter table */
@@ -2069,7 +2076,7 @@ ixgb_vlan_rx_add_vid(struct net_device *netdev, uint16_t vid)
 static void
 ixgb_vlan_rx_kill_vid(struct net_device *netdev, uint16_t vid)
 {
-        struct ixgb_adapter *adapter = netdev->priv;
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
         uint32_t vfta, index;
 
         ixgb_irq_disable(adapter);
diff --git a/drivers/net/jazzsonic.c b/drivers/net/jazzsonic.c
index 7fec613e1675..8423cb6875f0 100644
--- a/drivers/net/jazzsonic.c
+++ b/drivers/net/jazzsonic.c
@@ -1,5 +1,10 @@
 /*
- * sonic.c
+ * jazzsonic.c
+ *
+ * (C) 2005 Finn Thain
+ *
+ * Converted to DMA API, and (from the mac68k project) introduced
+ * dhd's support for 16-bit cards.
  *
  * (C) 1996,1998 by Thomas Bogendoerfer (tsbogend@alpha.franken.de)
  * 
@@ -28,8 +33,8 @@
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/skbuff.h>
-#include <linux/bitops.h>
 #include <linux/device.h>
+#include <linux/dma-mapping.h>
 
 #include <asm/bootinfo.h>
 #include <asm/system.h>
@@ -44,22 +49,20 @@ static struct platform_device *jazz_sonic_device;
 
 #define SONIC_MEM_SIZE  0x100
 
-#define SREGS_PAD(n)    u16 n;
-
 #include "sonic.h"
 
 /*
  * Macros to access SONIC registers
  */
-#define SONIC_READ(reg) (*((volatile unsigned int *)base_addr+reg))
+#define SONIC_READ(reg) (*((volatile unsigned int *)dev->base_addr+reg))
 
 #define SONIC_WRITE(reg,val)                                            \
 do {                                                                    \
-        *((volatile unsigned int *)base_addr+(reg)) = (val);            \
+        *((volatile unsigned int *)dev->base_addr+(reg)) = (val);               \
 } while (0)
 
 
-/* use 0 for production, 1 for verification, >2 for debug */
+/* use 0 for production, 1 for verification, >1 for debug */
 #ifdef SONIC_DEBUG
 static unsigned int sonic_debug = SONIC_DEBUG;
 #else 
@@ -85,18 +88,18 @@ static unsigned short known_revisions[] =
         0xffff                  /* end of list */
 };
 
-static int __init sonic_probe1(struct net_device *dev, unsigned long base_addr,
-                               unsigned int irq)
+static int __init sonic_probe1(struct net_device *dev)
 {
         static unsigned version_printed;
         unsigned int silicon_revision;
         unsigned int val;
-        struct sonic_local *lp;
+        struct sonic_local *lp = netdev_priv(dev);
         int err = -ENODEV;
         int i;
 
-        if (!request_mem_region(base_addr, SONIC_MEM_SIZE, jazz_sonic_string))
+        if (!request_mem_region(dev->base_addr, SONIC_MEM_SIZE, jazz_sonic_string))
                 return -EBUSY;
+
         /*
          * get the Silicon Revision ID. If this is one of the known
          * one assume that we found a SONIC ethernet controller at
@@ -120,11 +123,7 @@ static int __init sonic_probe1(struct net_device *dev, unsigned long base_addr,
         if (sonic_debug  &&  version_printed++ == 0)
                 printk(version);
 
-        printk("%s: Sonic ethernet found at 0x%08lx, ", dev->name, base_addr);
-
-        /* Fill in the 'dev' fields. */
-        dev->base_addr = base_addr;
-        dev->irq = irq;
+        printk(KERN_INFO "%s: Sonic ethernet found at 0x%08lx, ", lp->device->bus_id, dev->base_addr);
 
         /*
          * Put the sonic into software reset, then
@@ -138,84 +137,44 @@ static int __init sonic_probe1(struct net_device *dev, unsigned long base_addr,
                 dev->dev_addr[i*2+1] = val >> 8;
         }
 
-        printk("HW Address ");
-        for (i = 0; i < 6; i++) {
-                printk("%2.2x", dev->dev_addr[i]);
-                if (i<5)
-                        printk(":");
-        }
-
-        printk(" IRQ %d\n", irq);
-
         err = -ENOMEM;
     
         /* Initialize the device structure. */
-        if (dev->priv == NULL) {
-                /*
-                 * the memory be located in the same 64kb segment
-                 */
-                lp = NULL;
-                i = 0;
-                do {
-                        lp = kmalloc(sizeof(*lp), GFP_KERNEL);
-                        if ((unsigned long) lp >> 16
-                            != ((unsigned long)lp + sizeof(*lp) ) >> 16) {
-                                /* FIXME, free the memory later */
-                                kfree(lp);
-                                lp = NULL;
-                        }
-                } while (lp == NULL && i++ < 20);
-
-                if (lp == NULL) {
-                        printk("%s: couldn't allocate memory for descriptors\n",
-                               dev->name);
-                        goto out;
-                }
 
-                memset(lp, 0, sizeof(struct sonic_local));
-
-                /* get the virtual dma address */
-                lp->cda_laddr = vdma_alloc(CPHYSADDR(lp),sizeof(*lp));
-                if (lp->cda_laddr == ~0UL) {
-                        printk("%s: couldn't get DMA page entry for "
-                               "descriptors\n", dev->name);
-                        goto out1;
-                }
-
-                lp->tda_laddr = lp->cda_laddr + sizeof (lp->cda);
-                lp->rra_laddr = lp->tda_laddr + sizeof (lp->tda);
-                lp->rda_laddr = lp->rra_laddr + sizeof (lp->rra);
-        
-                /* allocate receive buffer area */
-                /* FIXME, maybe we should use skbs */
-                lp->rba = kmalloc(SONIC_NUM_RRS * SONIC_RBSIZE, GFP_KERNEL);
-                if (!lp->rba) {
-                        printk("%s: couldn't allocate receive buffers\n",
-                               dev->name);
-                        goto out2;
-                }
+        lp->dma_bitmode = SONIC_BITMODE32;
 
-                /* get virtual dma address */
-                lp->rba_laddr = vdma_alloc(CPHYSADDR(lp->rba),
-                                           SONIC_NUM_RRS * SONIC_RBSIZE);
-                if (lp->rba_laddr == ~0UL) {
-                        printk("%s: couldn't get DMA page entry for receive "
-                               "buffers\n",dev->name);
-                        goto out3;
-                }
-
-                /* now convert pointer to KSEG1 pointer */
-                lp->rba = (char *)KSEG1ADDR(lp->rba);
-                flush_cache_all();
-                dev->priv = (struct sonic_local *)KSEG1ADDR(lp);
+        /* Allocate the entire chunk of memory for the descriptors.
+           Note that this cannot cross a 64K boundary. */
+        if ((lp->descriptors = dma_alloc_coherent(lp->device,
+                                SIZEOF_SONIC_DESC * SONIC_BUS_SCALE(lp->dma_bitmode),
+                                &lp->descriptors_laddr, GFP_KERNEL)) == NULL) {
+                printk(KERN_ERR "%s: couldn't alloc DMA memory for descriptors.\n", lp->device->bus_id);
+                goto out;
         }
 
-        lp = (struct sonic_local *)dev->priv;
+        /* Now set up the pointers to point to the appropriate places */
+        lp->cda = lp->descriptors;
+        lp->tda = lp->cda + (SIZEOF_SONIC_CDA
+                             * SONIC_BUS_SCALE(lp->dma_bitmode));
+        lp->rda = lp->tda + (SIZEOF_SONIC_TD * SONIC_NUM_TDS
+                             * SONIC_BUS_SCALE(lp->dma_bitmode));
+        lp->rra = lp->rda + (SIZEOF_SONIC_RD * SONIC_NUM_RDS
+                             * SONIC_BUS_SCALE(lp->dma_bitmode));
+
+        lp->cda_laddr = lp->descriptors_laddr;
+        lp->tda_laddr = lp->cda_laddr + (SIZEOF_SONIC_CDA
+                             * SONIC_BUS_SCALE(lp->dma_bitmode));
+        lp->rda_laddr = lp->tda_laddr + (SIZEOF_SONIC_TD * SONIC_NUM_TDS
+                             * SONIC_BUS_SCALE(lp->dma_bitmode));
+        lp->rra_laddr = lp->rda_laddr + (SIZEOF_SONIC_RD * SONIC_NUM_RDS
+                             * SONIC_BUS_SCALE(lp->dma_bitmode));
+
         dev->open = sonic_open;
         dev->stop = sonic_close;
         dev->hard_start_xmit = sonic_send_packet;
-        dev->get_stats  = sonic_get_stats;
+        dev->get_stats = sonic_get_stats;
         dev->set_multicast_list = &sonic_multicast_list;
+        dev->tx_timeout = sonic_tx_timeout;
         dev->watchdog_timeo = TX_TIMEOUT;
 
         /*
@@ -226,14 +185,8 @@ static int __init sonic_probe1(struct net_device *dev, unsigned long base_addr,
         SONIC_WRITE(SONIC_MPT,0xffff);
 
         return 0;
-out3:
-        kfree(lp->rba);
-out2:
-        vdma_free(lp->cda_laddr);
-out1:
-        kfree(lp);
 out:
-        release_region(base_addr, SONIC_MEM_SIZE);
+        release_region(dev->base_addr, SONIC_MEM_SIZE);
         return err;
 }
 
@@ -245,7 +198,6 @@ static int __init jazz_sonic_probe(struct device *device)
 {
         struct net_device *dev;
         struct sonic_local *lp;
-        unsigned long base_addr;
         int err = 0;
         int i;
 
@@ -255,21 +207,26 @@ static int __init jazz_sonic_probe(struct device *device)
         if (mips_machgroup != MACH_GROUP_JAZZ)
                 return -ENODEV;
 
-        dev = alloc_etherdev(0);
+        dev = alloc_etherdev(sizeof(struct sonic_local));
         if (!dev)
                 return -ENOMEM;
 
+        lp = netdev_priv(dev);
+        lp->device = device;
+        SET_NETDEV_DEV(dev, device);
+        SET_MODULE_OWNER(dev);
+
         netdev_boot_setup_check(dev);
-        base_addr = dev->base_addr;
 
-        if (base_addr >= KSEG0) { /* Check a single specified location. */
-                err = sonic_probe1(dev, base_addr, dev->irq);
-        } else if (base_addr != 0) { /* Don't probe at all. */
+        if (dev->base_addr >= KSEG0) { /* Check a single specified location. */
+                err = sonic_probe1(dev);
+        } else if (dev->base_addr != 0) { /* Don't probe at all. */
                 err = -ENXIO;
         } else {
                 for (i = 0; sonic_portlist[i].port; i++) {
-                        int io = sonic_portlist[i].port;
-                        if (sonic_probe1(dev, io, sonic_portlist[i].irq) == 0)
+                        dev->base_addr = sonic_portlist[i].port;
+                        dev->irq = sonic_portlist[i].irq;
+                        if (sonic_probe1(dev) == 0)
                                 break;
                 }
                 if (!sonic_portlist[i].port)
@@ -281,14 +238,17 @@ static int __init jazz_sonic_probe(struct device *device)
         if (err)
                 goto out1;
 
+        printk("%s: MAC ", dev->name);
+        for (i = 0; i < 6; i++) {
+                printk("%2.2x", dev->dev_addr[i]);
+                if (i < 5)
+                        printk(":");
+        }
+        printk(" IRQ %d\n", dev->irq);
+
         return 0;
 
 out1:
-        lp = dev->priv;
-        vdma_free(lp->rba_laddr);
-        kfree(lp->rba);
-        vdma_free(lp->cda_laddr);
-        kfree(lp);
         release_region(dev->base_addr, SONIC_MEM_SIZE);
 out:
         free_netdev(dev);
@@ -296,21 +256,22 @@ out:
         return err;
 }
 
-/*
- *      SONIC uses a normal IRQ
- */
-#define sonic_request_irq       request_irq
-#define sonic_free_irq          free_irq
+MODULE_DESCRIPTION("Jazz SONIC ethernet driver");
+module_param(sonic_debug, int, 0);
+MODULE_PARM_DESC(sonic_debug, "jazzsonic debug level (1-4)");
 
-#define sonic_chiptomem(x)      KSEG1ADDR(vdma_log2phys(x))
+#define SONIC_IRQ_FLAG SA_INTERRUPT
 
 #include "sonic.c"
 
 static int __devexit jazz_sonic_device_remove (struct device *device)
 {
         struct net_device *dev = device->driver_data;
+        struct sonic_local* lp = netdev_priv(dev);
 
         unregister_netdev (dev);
+        dma_free_coherent(lp->device, SIZEOF_SONIC_DESC * SONIC_BUS_SCALE(lp->dma_bitmode),
+                          lp->descriptors, lp->descriptors_laddr);
         release_region (dev->base_addr, SONIC_MEM_SIZE);
         free_netdev (dev);
 
@@ -323,7 +284,7 @@ static struct device_driver jazz_sonic_driver = {
         .probe  = jazz_sonic_probe,
         .remove = __devexit_p(jazz_sonic_device_remove),
 };
-                                                                                
+
 static void jazz_sonic_platform_release (struct device *device)
 {
         struct platform_device *pldev;
@@ -336,10 +297,11 @@ static void jazz_sonic_platform_release (struct device *device)
 static int __init jazz_sonic_init_module(void)
 {
         struct platform_device *pldev;
+        int err;
 
-        if (driver_register(&jazz_sonic_driver)) {
+        if ((err = driver_register(&jazz_sonic_driver))) {
                 printk(KERN_ERR "Driver registration failed\n");
-                return -ENOMEM;
+                return err;
         }
 
         jazz_sonic_device = NULL;
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index b33111e21313..690a1aae0b34 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -68,6 +68,7 @@ static DEFINE_PER_CPU(struct net_device_stats, loopback_stats);
  * of largesending device modulo TCP checksum, which is ignored for loopback.
  */
 
+#ifdef LOOPBACK_TSO
 static void emulate_large_send_offload(struct sk_buff *skb)
 {
         struct iphdr *iph = skb->nh.iph;
@@ -119,6 +120,7 @@ static void emulate_large_send_offload(struct sk_buff *skb)
 
         dev_kfree_skb(skb);
 }
+#endif /* LOOPBACK_TSO */
 
 /*
  * The higher levels take care of making this non-reentrant (it's
@@ -130,12 +132,13 @@ static int loopback_xmit(struct sk_buff *skb, struct net_device *dev)
 
         skb_orphan(skb);
 
-        skb->protocol=eth_type_trans(skb,dev);
-        skb->dev=dev;
+        skb->protocol = eth_type_trans(skb,dev);
+        skb->dev = dev;
 #ifndef LOOPBACK_MUST_CHECKSUM
         skb->ip_summed = CHECKSUM_UNNECESSARY;
 #endif
 
+#ifdef LOOPBACK_TSO
         if (skb_shinfo(skb)->tso_size) {
                 BUG_ON(skb->protocol != htons(ETH_P_IP));
                 BUG_ON(skb->nh.iph->protocol != IPPROTO_TCP);
@@ -143,14 +146,14 @@ static int loopback_xmit(struct sk_buff *skb, struct net_device *dev)
                 emulate_large_send_offload(skb);
                 return 0;
         }
-
+#endif
         dev->last_rx = jiffies;
 
         lb_stats = &per_cpu(loopback_stats, get_cpu());
         lb_stats->rx_bytes += skb->len;
-        lb_stats->tx_bytes += skb->len;
+        lb_stats->tx_bytes = lb_stats->rx_bytes;
         lb_stats->rx_packets++;
-        lb_stats->tx_packets++;
+        lb_stats->tx_packets = lb_stats->rx_packets;
         put_cpu();
 
         netif_rx(skb);
@@ -208,13 +211,16 @@ struct net_device loopback_dev = {
         .type                   = ARPHRD_LOOPBACK,      /* 0x0001*/
         .rebuild_header         = eth_rebuild_header,
         .flags                  = IFF_LOOPBACK,
-        .features               = NETIF_F_SG|NETIF_F_FRAGLIST
-                                  |NETIF_F_NO_CSUM|NETIF_F_HIGHDMA
-                                  |NETIF_F_LLTX,
+        .features               = NETIF_F_SG | NETIF_F_FRAGLIST
+#ifdef LOOPBACK_TSO
+                                  | NETIF_F_TSO
+#endif
+                                  | NETIF_F_NO_CSUM | NETIF_F_HIGHDMA
+                                  | NETIF_F_LLTX,
         .ethtool_ops            = &loopback_ethtool_ops,
 };
 
-/* Setup and register the of the LOOPBACK device. */
+/* Setup and register the loopback device. */
 int __init loopback_init(void)
 {
         struct net_device_stats *stats;
diff --git a/drivers/net/macsonic.c b/drivers/net/macsonic.c
index be28c65de729..405e18365ede 100644
--- a/drivers/net/macsonic.c
+++ b/drivers/net/macsonic.c
@@ -1,6 +1,12 @@
 /*
  * macsonic.c
  *
+ * (C) 2005 Finn Thain
+ *
+ * Converted to DMA API, converted to unified driver model, made it work as
+ * a module again, and from the mac68k project, introduced more 32-bit cards
+ * and dhd's support for 16-bit cards.
+ *
  * (C) 1998 Alan Cox
  *
  * Debugging Andreas Ehliar, Michael Schmitz
@@ -26,8 +32,8 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/types.h>
-#include <linux/ctype.h>
 #include <linux/fcntl.h>
 #include <linux/interrupt.h>
 #include <linux/init.h>
@@ -41,8 +47,8 @@
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/skbuff.h>
-#include <linux/module.h>
-#include <linux/bitops.h>
+#include <linux/device.h>
+#include <linux/dma-mapping.h>
 
 #include <asm/bootinfo.h>
 #include <asm/system.h>
@@ -54,25 +60,28 @@
 #include <asm/macints.h>
 #include <asm/mac_via.h>
 
-#define SREGS_PAD(n)    u16 n;
+static char mac_sonic_string[] = "macsonic";
+static struct platform_device *mac_sonic_device;
 
 #include "sonic.h"
 
-#define SONIC_READ(reg) \
-        nubus_readl(base_addr+(reg))
-#define SONIC_WRITE(reg,val) \
-        nubus_writel((val), base_addr+(reg))
-#define sonic_read(dev, reg) \
-        nubus_readl((dev)->base_addr+(reg))
-#define sonic_write(dev, reg, val) \
-        nubus_writel((val), (dev)->base_addr+(reg))
-
+/* These should basically be bus-size and endian independent (since
+   the SONIC is at least smart enough that it uses the same endianness
+   as the host, unlike certain less enlightened Macintosh NICs) */
+#define SONIC_READ(reg) (nubus_readw(dev->base_addr + (reg * 4) \
+              + lp->reg_offset))
+#define SONIC_WRITE(reg,val) (nubus_writew(val, dev->base_addr + (reg * 4) \
+              + lp->reg_offset))
+
+/* use 0 for production, 1 for verification, >1 for debug */
+#ifdef SONIC_DEBUG
+static unsigned int sonic_debug = SONIC_DEBUG;
+#else 
+static unsigned int sonic_debug = 1;
+#endif
 
-static int sonic_debug;
 static int sonic_version_printed;
 
-static int reg_offset;
-
 extern int mac_onboard_sonic_probe(struct net_device* dev);
 extern int mac_nubus_sonic_probe(struct net_device* dev);
 
@@ -108,40 +117,6 @@ enum macsonic_type {
 
 #define SONIC_READ_PROM(addr) nubus_readb(prom_addr+addr)
 
-struct net_device * __init macsonic_probe(int unit)
-{
-        struct net_device *dev = alloc_etherdev(0);
-        int err;
-
-        if (!dev)
-                return ERR_PTR(-ENOMEM);
-
-        if (unit >= 0)
-                sprintf(dev->name, "eth%d", unit);
-
-        SET_MODULE_OWNER(dev);
-
-        /* This will catch fatal stuff like -ENOMEM as well as success */
-        err = mac_onboard_sonic_probe(dev);
-        if (err == 0)
-                goto found;
-        if (err != -ENODEV)
-                goto out;
-        err = mac_nubus_sonic_probe(dev);
-        if (err)
-                goto out;
-found:
-        err = register_netdev(dev);
-        if (err)
-                goto out1;
-        return dev;
-out1:
-        kfree(dev->priv);
-out:
-        free_netdev(dev);
-        return ERR_PTR(err);
-}
-
 /*
  * For reversing the PROM address
  */
@@ -160,103 +135,55 @@ static inline void bit_reverse_addr(unsigned char addr[6])
 
 int __init macsonic_init(struct net_device* dev)
 {
-        struct sonic_local* lp = NULL;
-        int i;
+        struct sonic_local* lp = netdev_priv(dev);
 
         /* Allocate the entire chunk of memory for the descriptors.
            Note that this cannot cross a 64K boundary. */
-        for (i = 0; i < 20; i++) {
-                unsigned long desc_base, desc_top;
-                if((lp = kmalloc(sizeof(struct sonic_local), GFP_KERNEL | GFP_DMA)) == NULL) {
-                        printk(KERN_ERR "%s: couldn't allocate descriptor buffers\n", dev->name);
-                        return -ENOMEM;
-                }
-
-                desc_base = (unsigned long) lp;
-                desc_top = desc_base + sizeof(struct sonic_local);
-                if ((desc_top & 0xffff) >= (desc_base & 0xffff))
-                        break;
-                /* Hmm. try again (FIXME: does this actually work?) */
-                kfree(lp);
-                printk(KERN_DEBUG
-                       "%s: didn't get continguous chunk [%08lx - %08lx], trying again\n",
-                       dev->name, desc_base, desc_top);
-        }
-
-        if (lp == NULL) {
-                printk(KERN_ERR "%s: tried 20 times to allocate descriptor buffers, giving up.\n",
-                       dev->name);
+        if ((lp->descriptors = dma_alloc_coherent(lp->device,
+                    SIZEOF_SONIC_DESC * SONIC_BUS_SCALE(lp->dma_bitmode),
+                    &lp->descriptors_laddr, GFP_KERNEL)) == NULL) {
+                printk(KERN_ERR "%s: couldn't alloc DMA memory for descriptors.\n", lp->device->bus_id);
                 return -ENOMEM;
-        }                      
-
-        dev->priv = lp;
-
-#if 0
-        /* this code is only here as a curiousity...   mainly, where the 
-           fuck did SONIC_BUS_SCALE come from, and what was it supposed
-           to do?  the normal allocation works great for 32 bit stuffs..  */
+        }
 
         /* Now set up the pointers to point to the appropriate places */
-        lp->cda = lp->sonic_desc;
-        lp->tda = lp->cda + (SIZEOF_SONIC_CDA * SONIC_BUS_SCALE(lp->dma_bitmode));
+        lp->cda = lp->descriptors;
+        lp->tda = lp->cda + (SIZEOF_SONIC_CDA
+                             * SONIC_BUS_SCALE(lp->dma_bitmode));
         lp->rda = lp->tda + (SIZEOF_SONIC_TD * SONIC_NUM_TDS
-                             * SONIC_BUS_SCALE(lp->dma_bitmode));
+                             * SONIC_BUS_SCALE(lp->dma_bitmode));
         lp->rra = lp->rda + (SIZEOF_SONIC_RD * SONIC_NUM_RDS
-                             * SONIC_BUS_SCALE(lp->dma_bitmode));
+                             * SONIC_BUS_SCALE(lp->dma_bitmode));
 
-#endif
-        
-        memset(lp, 0, sizeof(struct sonic_local));
-
-        lp->cda_laddr = (unsigned int)&(lp->cda);
-        lp->tda_laddr = (unsigned int)lp->tda;
-        lp->rra_laddr = (unsigned int)lp->rra;
-        lp->rda_laddr = (unsigned int)lp->rda;
-
-        /* FIXME, maybe we should use skbs */
-        if ((lp->rba = (char *)
-             kmalloc(SONIC_NUM_RRS * SONIC_RBSIZE, GFP_KERNEL | GFP_DMA)) == NULL) {
-                printk(KERN_ERR "%s: couldn't allocate receive buffers\n", dev->name);
-                dev->priv = NULL;
-                kfree(lp);
-                return -ENOMEM;
-        }
-
-        lp->rba_laddr = (unsigned int)lp->rba;
-
-        {
-                int rs, ds;
-
-                /* almost always 12*4096, but let's not take chances */
-                rs = ((SONIC_NUM_RRS * SONIC_RBSIZE + 4095) / 4096) * 4096;
-                /* almost always under a page, but let's not take chances */
-                ds = ((sizeof(struct sonic_local) + 4095) / 4096) * 4096;
-                kernel_set_cachemode(lp->rba, rs, IOMAP_NOCACHE_SER);
-                kernel_set_cachemode(lp, ds, IOMAP_NOCACHE_SER);
-        }
-        
-#if 0
-        flush_cache_all();
-#endif
+        lp->cda_laddr = lp->descriptors_laddr;
+        lp->tda_laddr = lp->cda_laddr + (SIZEOF_SONIC_CDA
+                             * SONIC_BUS_SCALE(lp->dma_bitmode));
+        lp->rda_laddr = lp->tda_laddr + (SIZEOF_SONIC_TD * SONIC_NUM_TDS
+                             * SONIC_BUS_SCALE(lp->dma_bitmode));
+        lp->rra_laddr = lp->rda_laddr + (SIZEOF_SONIC_RD * SONIC_NUM_RDS
+                             * SONIC_BUS_SCALE(lp->dma_bitmode));
 
         dev->open = sonic_open;
         dev->stop = sonic_close;
         dev->hard_start_xmit = sonic_send_packet;
         dev->get_stats = sonic_get_stats;
         dev->set_multicast_list = &sonic_multicast_list;
+        dev->tx_timeout = sonic_tx_timeout;
+        dev->watchdog_timeo = TX_TIMEOUT;
 
         /*
          * clear tally counter
          */
-        sonic_write(dev, SONIC_CRCT, 0xffff);
-        sonic_write(dev, SONIC_FAET, 0xffff);
-        sonic_write(dev, SONIC_MPT, 0xffff);
+        SONIC_WRITE(SONIC_CRCT, 0xffff);
+        SONIC_WRITE(SONIC_FAET, 0xffff);
+        SONIC_WRITE(SONIC_MPT, 0xffff);
 
         return 0;
 }
 
 int __init mac_onboard_sonic_ethernet_addr(struct net_device* dev)
 {
+        struct sonic_local *lp = netdev_priv(dev);
         const int prom_addr = ONBOARD_SONIC_PROM_BASE;
         int i;
 
@@ -270,6 +197,7 @@ int __init mac_onboard_sonic_ethernet_addr(struct net_device* dev)
            why this is so. */
         if (memcmp(dev->dev_addr, "\x08\x00\x07", 3) &&
             memcmp(dev->dev_addr, "\x00\xA0\x40", 3) &&
+            memcmp(dev->dev_addr, "\x00\x80\x19", 3) &&
             memcmp(dev->dev_addr, "\x00\x05\x02", 3))
                 bit_reverse_addr(dev->dev_addr);
         else
@@ -281,22 +209,23 @@ int __init mac_onboard_sonic_ethernet_addr(struct net_device* dev)
            the card... */
         if (memcmp(dev->dev_addr, "\x08\x00\x07", 3) &&
             memcmp(dev->dev_addr, "\x00\xA0\x40", 3) &&
+            memcmp(dev->dev_addr, "\x00\x80\x19", 3) &&
             memcmp(dev->dev_addr, "\x00\x05\x02", 3))
         {
                 unsigned short val;
 
                 printk(KERN_INFO "macsonic: PROM seems to be wrong, trying CAM entry 15\n");
                 
-                sonic_write(dev, SONIC_CMD, SONIC_CR_RST);
-                sonic_write(dev, SONIC_CEP, 15);
+                SONIC_WRITE(SONIC_CMD, SONIC_CR_RST);
+                SONIC_WRITE(SONIC_CEP, 15);
 
-                val = sonic_read(dev, SONIC_CAP2);
+                val = SONIC_READ(SONIC_CAP2);
                 dev->dev_addr[5] = val >> 8;
                 dev->dev_addr[4] = val & 0xff;
-                val = sonic_read(dev, SONIC_CAP1);
+                val = SONIC_READ(SONIC_CAP1);
                 dev->dev_addr[3] = val >> 8;
                 dev->dev_addr[2] = val & 0xff;
-                val = sonic_read(dev, SONIC_CAP0);
+                val = SONIC_READ(SONIC_CAP0);
                 dev->dev_addr[1] = val >> 8;
                 dev->dev_addr[0] = val & 0xff;
                 
@@ -311,6 +240,7 @@ int __init mac_onboard_sonic_ethernet_addr(struct net_device* dev)
 
         if (memcmp(dev->dev_addr, "\x08\x00\x07", 3) &&
             memcmp(dev->dev_addr, "\x00\xA0\x40", 3) &&
+            memcmp(dev->dev_addr, "\x00\x80\x19", 3) &&
             memcmp(dev->dev_addr, "\x00\x05\x02", 3))
         {
                 /*
@@ -325,8 +255,9 @@ int __init mac_onboard_sonic_probe(struct net_device* dev)
 {
         /* Bwahahaha */
         static int once_is_more_than_enough;
-        int i;
-        int dma_bitmode;
+        struct sonic_local* lp = netdev_priv(dev);
+        int sr;
+        int commslot = 0;
         
         if (once_is_more_than_enough)
                 return -ENODEV;
@@ -335,20 +266,18 @@ int __init mac_onboard_sonic_probe(struct net_device* dev)
         if (!MACH_IS_MAC)
                 return -ENODEV;
 
-        printk(KERN_INFO "Checking for internal Macintosh ethernet (SONIC).. ");
-
         if (macintosh_config->ether_type != MAC_ETHER_SONIC)
-        {
-                printk("none.\n");
                 return -ENODEV;
-        }
-
+        
+        printk(KERN_INFO "Checking for internal Macintosh ethernet (SONIC).. ");
+        
         /* Bogus probing, on the models which may or may not have
            Ethernet (BTW, the Ethernet *is* always at the same
            address, and nothing else lives there, at least if Apple's
            documentation is to be believed) */
         if (macintosh_config->ident == MAC_MODEL_Q630 ||
             macintosh_config->ident == MAC_MODEL_P588 ||
+            macintosh_config->ident == MAC_MODEL_P575 ||
             macintosh_config->ident == MAC_MODEL_C610) {
                 unsigned long flags;
                 int card_present;
@@ -361,13 +290,13 @@ int __init mac_onboard_sonic_probe(struct net_device* dev)
                         printk("none.\n");
                         return -ENODEV;
                 }
+                commslot = 1;
         }
 
         printk("yes\n");        
 
-        /* Danger!  My arms are flailing wildly!  You *must* set this
-           before using sonic_read() */
-
+        /* Danger!  My arms are flailing wildly!  You *must* set lp->reg_offset
+         * and dev->base_addr before using SONIC_READ() or SONIC_WRITE() */
         dev->base_addr = ONBOARD_SONIC_REGISTERS;
         if (via_alt_mapping)
                 dev->irq = IRQ_AUTO_3;
@@ -379,84 +308,66 @@ int __init mac_onboard_sonic_probe(struct net_device* dev)
                 sonic_version_printed = 1;
         }
         printk(KERN_INFO "%s: onboard / comm-slot SONIC at 0x%08lx\n",
-               dev->name, dev->base_addr);
-
-        /* Now do a song and dance routine in an attempt to determine
-           the bus width */
+               lp->device->bus_id, dev->base_addr);
 
         /* The PowerBook's SONIC is 16 bit always. */
         if (macintosh_config->ident == MAC_MODEL_PB520) {
-                reg_offset = 0;
-                dma_bitmode = 0;
-        } else if (macintosh_config->ident == MAC_MODEL_C610) {
-                reg_offset = 0;
-                dma_bitmode = 1;
-        } else {
+                lp->reg_offset = 0;
+                lp->dma_bitmode = SONIC_BITMODE16;
+                sr = SONIC_READ(SONIC_SR);
+        } else if (commslot) {
                 /* Some of the comm-slot cards are 16 bit.  But some
-                   of them are not.  The 32-bit cards use offset 2 and
-                   pad with zeroes or sometimes ones (I think...)
-                   Therefore, if we try offset 0 and get a silicon
-                   revision of 0, we assume 16 bit. */
-                int sr;
-
-                /* Technically this is not necessary since we zeroed
-                   it above */
-                reg_offset = 0;
-                dma_bitmode = 0;
-                sr = sonic_read(dev, SONIC_SR);
-                if (sr == 0 || sr == 0xffff) {
-                        reg_offset = 2;
-                        /* 83932 is 0x0004, 83934 is 0x0100 or 0x0101 */
-                        sr = sonic_read(dev, SONIC_SR);
-                        dma_bitmode = 1;
-                        
+                   of them are not.  The 32-bit cards use offset 2 and
+                   have known revisions, we try reading the revision
+                   register at offset 2, if we don't get a known revision
+                   we assume 16 bit at offset 0.  */
+                lp->reg_offset = 2;
+                lp->dma_bitmode = SONIC_BITMODE16;
+
+                sr = SONIC_READ(SONIC_SR);
+                if (sr == 0x0004 || sr == 0x0006 || sr == 0x0100 || sr == 0x0101) 
+                        /* 83932 is 0x0004 or 0x0006, 83934 is 0x0100 or 0x0101 */
+                        lp->dma_bitmode = SONIC_BITMODE32;
+                else {
+                        lp->dma_bitmode = SONIC_BITMODE16;
+                        lp->reg_offset = 0;
+                        sr = SONIC_READ(SONIC_SR);
                 }
-                printk(KERN_INFO
-                       "%s: revision 0x%04x, using %d bit DMA and register offset %d\n",
-                       dev->name, sr, dma_bitmode?32:16, reg_offset);
+        } else {
+                /* All onboard cards are at offset 2 with 32 bit DMA. */
+                lp->reg_offset = 2;
+                lp->dma_bitmode = SONIC_BITMODE32;
+                sr = SONIC_READ(SONIC_SR);
         }
-        
+        printk(KERN_INFO
+               "%s: revision 0x%04x, using %d bit DMA and register offset %d\n",
+               lp->device->bus_id, sr, lp->dma_bitmode?32:16, lp->reg_offset);
 
-        /* this carries my sincere apologies -- by the time I got to updating
-           the driver, support for "reg_offsets" appeares nowhere in the sonic
-           code, going back for over a year.  Fortunately, my Mac does't seem
-           to use whatever this was.
+#if 0 /* This is sometimes useful to find out how MacOS configured the card. */
+        printk(KERN_INFO "%s: DCR: 0x%04x, DCR2: 0x%04x\n", lp->device->bus_id,
+               SONIC_READ(SONIC_DCR) & 0xffff, SONIC_READ(SONIC_DCR2) & 0xffff);
+#endif
 
-           If you know how this is supposed to be implemented, either fix it,
-           or contact me (sammy@oh.verio.com) to explain what it is. --Sam */
-           
-        if(reg_offset) {
-                printk("%s: register offset unsupported.  please fix this if you know what it is.\n", dev->name);
-                return -ENODEV;
-        }
-        
         /* Software reset, then initialize control registers. */
-        sonic_write(dev, SONIC_CMD, SONIC_CR_RST);
-        sonic_write(dev, SONIC_DCR, SONIC_DCR_BMS |
-                    SONIC_DCR_RFT1 | SONIC_DCR_TFT0 | SONIC_DCR_EXBUS |
-                    (dma_bitmode ? SONIC_DCR_DW : 0));
+        SONIC_WRITE(SONIC_CMD, SONIC_CR_RST);
+
+        SONIC_WRITE(SONIC_DCR, SONIC_DCR_EXBUS | SONIC_DCR_BMS |
+                               SONIC_DCR_RFT1  | SONIC_DCR_TFT0 |
+                               (lp->dma_bitmode ? SONIC_DCR_DW : 0));
 
         /* This *must* be written back to in order to restore the
-           extended programmable output bits */
-        sonic_write(dev, SONIC_DCR2, 0);
+         * extended programmable output bits, as it may not have been
+         * initialised since the hardware reset. */
+        SONIC_WRITE(SONIC_DCR2, 0);
 
         /* Clear *and* disable interrupts to be on the safe side */
-        sonic_write(dev, SONIC_ISR,0x7fff);
-        sonic_write(dev, SONIC_IMR,0);
+        SONIC_WRITE(SONIC_IMR, 0);
+        SONIC_WRITE(SONIC_ISR, 0x7fff);
 
         /* Now look for the MAC address. */
         if (mac_onboard_sonic_ethernet_addr(dev) != 0)
                 return -ENODEV;
 
-        printk(KERN_INFO "MAC ");
-        for (i = 0; i < 6; i++) {
-                printk("%2.2x", dev->dev_addr[i]);
-                if (i < 5)
-                        printk(":");
-        }
-
-        printk(" IRQ %d\n", dev->irq);
-
         /* Shared init code */
         return macsonic_init(dev);
 }
@@ -468,8 +379,10 @@ int __init mac_nubus_sonic_ethernet_addr(struct net_device* dev,
         int i;
         for(i = 0; i < 6; i++)
                 dev->dev_addr[i] = SONIC_READ_PROM(i);
-        /* For now we are going to assume that they're all bit-reversed */
-        bit_reverse_addr(dev->dev_addr);
+
+        /* Some of the addresses are bit-reversed */
+        if (id != MACSONIC_DAYNA)
+                bit_reverse_addr(dev->dev_addr);
 
         return 0;
 }
@@ -487,6 +400,15 @@ int __init macsonic_ident(struct nubus_dev* ndev)
                 else
                         return MACSONIC_APPLE;
         }
+        
+        if (ndev->dr_hw == NUBUS_DRHW_SMC9194 &&
+            ndev->dr_sw == NUBUS_DRSW_DAYNA)
+                return MACSONIC_DAYNA;
+        
+        if (ndev->dr_hw == NUBUS_DRHW_SONIC_LC &&
+            ndev->dr_sw == 0) { /* huh? */
+                return MACSONIC_APPLE16;
+        }
         return -1;
 }
 
@@ -494,12 +416,12 @@ int __init mac_nubus_sonic_probe(struct net_device* dev)
 {
         static int slots;
         struct nubus_dev* ndev = NULL;
+        struct sonic_local* lp = netdev_priv(dev);
         unsigned long base_addr, prom_addr;
         u16 sonic_dcr;
-        int id;
-        int i;
-        int dma_bitmode;
-
+        int id = -1;
+        int reg_offset, dma_bitmode;
+        
         /* Find the first SONIC that hasn't been initialized already */
         while ((ndev = nubus_find_type(NUBUS_CAT_NETWORK,
                                        NUBUS_TYPE_ETHERNET, ndev)) != NULL)
@@ -521,51 +443,52 @@ int __init mac_nubus_sonic_probe(struct net_device* dev)
         case MACSONIC_DUODOCK:
                 base_addr = ndev->board->slot_addr + DUODOCK_SONIC_REGISTERS;
                 prom_addr = ndev->board->slot_addr + DUODOCK_SONIC_PROM_BASE;
-                sonic_dcr = SONIC_DCR_EXBUS | SONIC_DCR_RFT0 | SONIC_DCR_RFT1
-                        | SONIC_DCR_TFT0;
+                sonic_dcr = SONIC_DCR_EXBUS | SONIC_DCR_RFT0 | SONIC_DCR_RFT1 |
+                            SONIC_DCR_TFT0;
                 reg_offset = 2;
-                dma_bitmode = 1;
+                dma_bitmode = SONIC_BITMODE32;
                 break;
         case MACSONIC_APPLE:
                 base_addr = ndev->board->slot_addr + APPLE_SONIC_REGISTERS;
                 prom_addr = ndev->board->slot_addr + APPLE_SONIC_PROM_BASE;
                 sonic_dcr = SONIC_DCR_BMS | SONIC_DCR_RFT1 | SONIC_DCR_TFT0;
                 reg_offset = 0;
-                dma_bitmode = 1;
+                dma_bitmode = SONIC_BITMODE32;
                 break;
         case MACSONIC_APPLE16:
                 base_addr = ndev->board->slot_addr + APPLE_SONIC_REGISTERS;
                 prom_addr = ndev->board->slot_addr + APPLE_SONIC_PROM_BASE;
-                sonic_dcr = SONIC_DCR_EXBUS
-                        | SONIC_DCR_RFT1 | SONIC_DCR_TFT0
-                        | SONIC_DCR_PO1 | SONIC_DCR_BMS; 
+                sonic_dcr = SONIC_DCR_EXBUS | SONIC_DCR_RFT1 | SONIC_DCR_TFT0 |
+                            SONIC_DCR_PO1 | SONIC_DCR_BMS; 
                 reg_offset = 0;
-                dma_bitmode = 0;
+                dma_bitmode = SONIC_BITMODE16;
                 break;
         case MACSONIC_DAYNALINK:
                 base_addr = ndev->board->slot_addr + APPLE_SONIC_REGISTERS;
                 prom_addr = ndev->board->slot_addr + DAYNALINK_PROM_BASE;
-                sonic_dcr = SONIC_DCR_RFT1 | SONIC_DCR_TFT0
-                        | SONIC_DCR_PO1 | SONIC_DCR_BMS; 
+                sonic_dcr = SONIC_DCR_RFT1 | SONIC_DCR_TFT0 |
+                            SONIC_DCR_PO1 | SONIC_DCR_BMS; 
                 reg_offset = 0;
-                dma_bitmode = 0;
+                dma_bitmode = SONIC_BITMODE16;
                 break;
         case MACSONIC_DAYNA:
                 base_addr = ndev->board->slot_addr + DAYNA_SONIC_REGISTERS;
                 prom_addr = ndev->board->slot_addr + DAYNA_SONIC_MAC_ADDR;
-                sonic_dcr = SONIC_DCR_BMS
-                        | SONIC_DCR_RFT1 | SONIC_DCR_TFT0 | SONIC_DCR_PO1;
+                sonic_dcr = SONIC_DCR_BMS |
+                            SONIC_DCR_RFT1 | SONIC_DCR_TFT0 | SONIC_DCR_PO1;
                 reg_offset = 0;
-                dma_bitmode = 0;
+                dma_bitmode = SONIC_BITMODE16;
                 break;
         default:
                 printk(KERN_ERR "macsonic: WTF, id is %d\n", id);
                 return -ENODEV;
         }
 
-        /* Danger!  My arms are flailing wildly!  You *must* set this
-           before using sonic_read() */
+        /* Danger!  My arms are flailing wildly!  You *must* set lp->reg_offset
+         * and dev->base_addr before using SONIC_READ() or SONIC_WRITE() */
         dev->base_addr = base_addr;
+        lp->reg_offset = reg_offset;
+        lp->dma_bitmode = dma_bitmode;
         dev->irq = SLOT2IRQ(ndev->board->slot);
 
         if (!sonic_version_printed) {
@@ -573,29 +496,66 @@ int __init mac_nubus_sonic_probe(struct net_device* dev)
                 sonic_version_printed = 1;
         }
         printk(KERN_INFO "%s: %s in slot %X\n",
-               dev->name, ndev->board->name, ndev->board->slot);
+               lp->device->bus_id, ndev->board->name, ndev->board->slot);
         printk(KERN_INFO "%s: revision 0x%04x, using %d bit DMA and register offset %d\n",
-               dev->name, sonic_read(dev, SONIC_SR), dma_bitmode?32:16, reg_offset);
+               lp->device->bus_id, SONIC_READ(SONIC_SR), dma_bitmode?32:16, reg_offset);
 
-        if(reg_offset) {
-                printk("%s: register offset unsupported.  please fix this if you know what it is.\n", dev->name);
-                return -ENODEV;
-        }
+#if 0 /* This is sometimes useful to find out how MacOS configured the card. */
+        printk(KERN_INFO "%s: DCR: 0x%04x, DCR2: 0x%04x\n", lp->device->bus_id,
+               SONIC_READ(SONIC_DCR) & 0xffff, SONIC_READ(SONIC_DCR2) & 0xffff);
+#endif
 
         /* Software reset, then initialize control registers. */
-        sonic_write(dev, SONIC_CMD, SONIC_CR_RST);
-        sonic_write(dev, SONIC_DCR, sonic_dcr
-                    | (dma_bitmode ? SONIC_DCR_DW : 0));
+        SONIC_WRITE(SONIC_CMD, SONIC_CR_RST);
+        SONIC_WRITE(SONIC_DCR, sonic_dcr | (dma_bitmode ? SONIC_DCR_DW : 0));
+        /* This *must* be written back to in order to restore the
+         * extended programmable output bits, since it may not have been
+         * initialised since the hardware reset. */
+        SONIC_WRITE(SONIC_DCR2, 0);
 
         /* Clear *and* disable interrupts to be on the safe side */
-        sonic_write(dev, SONIC_ISR,0x7fff);
-        sonic_write(dev, SONIC_IMR,0);
+        SONIC_WRITE(SONIC_IMR, 0);
+        SONIC_WRITE(SONIC_ISR, 0x7fff);
 
         /* Now look for the MAC address. */
         if (mac_nubus_sonic_ethernet_addr(dev, prom_addr, id) != 0)
                 return -ENODEV;
 
-        printk(KERN_INFO "MAC ");
+        /* Shared init code */
+        return macsonic_init(dev);
+}
+
+static int __init mac_sonic_probe(struct device *device)
+{
+        struct net_device *dev;
+        struct sonic_local *lp;
+        int err;
+        int i;
+
+        dev = alloc_etherdev(sizeof(struct sonic_local));
+        if (!dev)
+                return -ENOMEM;
+
+        lp = netdev_priv(dev);
+        lp->device = device;
+        SET_NETDEV_DEV(dev, device);
+        SET_MODULE_OWNER(dev);
+
+        /* This will catch fatal stuff like -ENOMEM as well as success */
+        err = mac_onboard_sonic_probe(dev);
+        if (err == 0)
+                goto found;
+        if (err != -ENODEV)
+                goto out;
+        err = mac_nubus_sonic_probe(dev);
+        if (err)
+                goto out;
+found:
+        err = register_netdev(dev);
+        if (err)
+                goto out;
+
+        printk("%s: MAC ", dev->name);
         for (i = 0; i < 6; i++) {
                 printk("%2.2x", dev->dev_addr[i]);
                 if (i < 5)
@@ -603,55 +563,95 @@ int __init mac_nubus_sonic_probe(struct net_device* dev)
         }
         printk(" IRQ %d\n", dev->irq);
 
-        /* Shared init code */
-        return macsonic_init(dev);
-}
+        return 0;
 
-#ifdef MODULE
-static struct net_device *dev_macsonic;
+out:
+        free_netdev(dev);
 
-MODULE_PARM(sonic_debug, "i");
+        return err;
+}
+
+MODULE_DESCRIPTION("Macintosh SONIC ethernet driver");
+module_param(sonic_debug, int, 0);
 MODULE_PARM_DESC(sonic_debug, "macsonic debug level (1-4)");
 
-int
-init_module(void)
+#define SONIC_IRQ_FLAG IRQ_FLG_FAST
+
+#include "sonic.c"
+
+static int __devexit mac_sonic_device_remove (struct device *device)
 {
-        dev_macsonic = macsonic_probe(-1);
-        if (IS_ERR(dev_macsonic)) {
-                printk(KERN_WARNING "macsonic.c: No card found\n");
-                return PTR_ERR(dev_macsonic);
-        }
+        struct net_device *dev = device->driver_data;
+        struct sonic_local* lp = netdev_priv(dev);
+
+        unregister_netdev (dev);
+        dma_free_coherent(lp->device, SIZEOF_SONIC_DESC * SONIC_BUS_SCALE(lp->dma_bitmode),
+                          lp->descriptors, lp->descriptors_laddr);
+        free_netdev (dev);
+
         return 0;
 }
 
-void
-cleanup_module(void)
+static struct device_driver mac_sonic_driver = {
+        .name   = mac_sonic_string,
+        .bus    = &platform_bus_type,
+        .probe  = mac_sonic_probe,
+        .remove = __devexit_p(mac_sonic_device_remove),
+};
+
+static void mac_sonic_platform_release(struct device *device)
 {
-        unregister_netdev(dev_macsonic);
-        kfree(dev_macsonic->priv);
-        free_netdev(dev_macsonic);
+        struct platform_device *pldev;
+
+        /* free device */
+        pldev = to_platform_device (device);
+        kfree (pldev);
 }
-#endif /* MODULE */
 
+static int __init mac_sonic_init_module(void)
+{
+        struct platform_device *pldev;
+        int err;
 
-#define vdma_alloc(foo, bar) ((u32)foo)
-#define vdma_free(baz)
-#define sonic_chiptomem(bat) (bat)
-#define PHYSADDR(quux) (quux)
-#define CPHYSADDR(quux) (quux)
+        if ((err = driver_register(&mac_sonic_driver))) {
+                printk(KERN_ERR "Driver registration failed\n");
+                return err;
+        }
 
-#define sonic_request_irq       request_irq
-#define sonic_free_irq          free_irq
+        mac_sonic_device = NULL;
 
-#include "sonic.c"
+        if (!(pldev = kmalloc (sizeof (*pldev), GFP_KERNEL))) {
+                goto out_unregister;
+        }
 
-/*
- * Local variables:
- *  compile-command: "m68k-linux-gcc -D__KERNEL__ -I../../include -Wall -Wstrict-prototypes -O2 -fomit-frame-pointer -pipe -fno-strength-reduce -ffixed-a2 -DMODULE -DMODVERSIONS -include ../../include/linux/modversions.h   -c -o macsonic.o macsonic.c"
- *  version-control: t
- *  kept-new-versions: 5
- *  c-indent-level: 8
- *  tab-width: 8
- * End:
- *
- */
+        memset(pldev, 0, sizeof (*pldev));
+        pldev->name             = mac_sonic_string;
+        pldev->id               = 0;
+        pldev->dev.release      = mac_sonic_platform_release;
+        mac_sonic_device        = pldev;
+
+        if (platform_device_register (pldev)) {
+                kfree(pldev);
+                mac_sonic_device = NULL;
+        }
+
+        return 0;
+
+out_unregister:
+        platform_device_unregister(pldev);
+
+        return -ENOMEM;
+}
+
+static void __exit mac_sonic_cleanup_module(void)
+{
+        driver_unregister(&mac_sonic_driver);
+
+        if (mac_sonic_device) {
+                platform_device_unregister(mac_sonic_device);
+                mac_sonic_device = NULL;
+        }
+}
+
+module_init(mac_sonic_init_module);
+module_exit(mac_sonic_cleanup_module);
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 0405e1f0d3df..fb6b232069d6 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -1157,16 +1157,20 @@ static int mv643xx_eth_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (!skb_shinfo(skb)->nr_frags) {
 linear:
                 if (skb->ip_summed != CHECKSUM_HW) {
+                        /* Errata BTS #50, IHL must be 5 if no HW checksum */
                         pkt_info.cmd_sts = ETH_TX_ENABLE_INTERRUPT |
-                                        ETH_TX_FIRST_DESC | ETH_TX_LAST_DESC;
+                                           ETH_TX_FIRST_DESC |
+                                           ETH_TX_LAST_DESC |
+                                           5 << ETH_TX_IHL_SHIFT;
                         pkt_info.l4i_chk = 0;
                 } else {
-                        u32 ipheader = skb->nh.iph->ihl << 11;
 
                         pkt_info.cmd_sts = ETH_TX_ENABLE_INTERRUPT |
-                                        ETH_TX_FIRST_DESC | ETH_TX_LAST_DESC |
-                                        ETH_GEN_TCP_UDP_CHECKSUM |
-                                        ETH_GEN_IP_V_4_CHECKSUM | ipheader;
+                                           ETH_TX_FIRST_DESC |
+                                           ETH_TX_LAST_DESC |
+                                           ETH_GEN_TCP_UDP_CHECKSUM |
+                                           ETH_GEN_IP_V_4_CHECKSUM |
+                                           skb->nh.iph->ihl << ETH_TX_IHL_SHIFT;
                         /* CPU already calculated pseudo header checksum. */
                         if (skb->nh.iph->protocol == IPPROTO_UDP) {
                                 pkt_info.cmd_sts |= ETH_UDP_FRAME;
@@ -1193,7 +1197,6 @@ linear:
                 stats->tx_bytes += pkt_info.byte_cnt;
         } else {
                 unsigned int frag;
-                u32 ipheader;
 
                 /* Since hardware can't handle unaligned fragments smaller
                  * than 9 bytes, if we find any, we linearize the skb
@@ -1222,12 +1225,16 @@ linear:
                                                         DMA_TO_DEVICE);
                 pkt_info.l4i_chk = 0;
                 pkt_info.return_info = 0;
-                pkt_info.cmd_sts = ETH_TX_FIRST_DESC;
 
-                if (skb->ip_summed == CHECKSUM_HW) {
-                        ipheader = skb->nh.iph->ihl << 11;
-                        pkt_info.cmd_sts |= ETH_GEN_TCP_UDP_CHECKSUM |
-                                        ETH_GEN_IP_V_4_CHECKSUM | ipheader;
+                if (skb->ip_summed != CHECKSUM_HW)
+                        /* Errata BTS #50, IHL must be 5 if no HW checksum */
+                        pkt_info.cmd_sts = ETH_TX_FIRST_DESC |
+                                           5 << ETH_TX_IHL_SHIFT;
+                else {
+                        pkt_info.cmd_sts = ETH_TX_FIRST_DESC |
+                                           ETH_GEN_TCP_UDP_CHECKSUM |
+                                           ETH_GEN_IP_V_4_CHECKSUM |
+                                           skb->nh.iph->ihl << ETH_TX_IHL_SHIFT;
                         /* CPU already calculated pseudo header checksum. */
                         if (skb->nh.iph->protocol == IPPROTO_UDP) {
                                 pkt_info.cmd_sts |= ETH_UDP_FRAME;
diff --git a/drivers/net/mv643xx_eth.h b/drivers/net/mv643xx_eth.h
index 57c4f8fbfdb6..7678b59c2952 100644
--- a/drivers/net/mv643xx_eth.h
+++ b/drivers/net/mv643xx_eth.h
@@ -49,7 +49,7 @@
 /* Checksum offload for Tx works for most packets, but
  * fails if previous packet sent did not use hw csum
  */
-#undef  MV643XX_CHECKSUM_OFFLOAD_TX
+#define MV643XX_CHECKSUM_OFFLOAD_TX
 #define MV643XX_NAPI
 #define MV643XX_TX_FAST_REFILL
 #undef  MV643XX_RX_QUEUE_FILL_ON_TASK   /* Does not work, yet */
@@ -217,6 +217,8 @@
 #define ETH_TX_ENABLE_INTERRUPT                 (BIT23)
 #define ETH_AUTO_MODE                           (BIT30)
 
+#define ETH_TX_IHL_SHIFT                        11
+
 /* typedefs */
 
 typedef enum _eth_func_ret_status {
diff --git a/drivers/net/pci-skeleton.c b/drivers/net/pci-skeleton.c
index 4a391ea0f58a..a1ac4bd1696e 100644
--- a/drivers/net/pci-skeleton.c
+++ b/drivers/net/pci-skeleton.c
@@ -486,9 +486,9 @@ struct netdrv_private {
 MODULE_AUTHOR ("Jeff Garzik <jgarzik@pobox.com>");
 MODULE_DESCRIPTION ("Skeleton for a PCI Fast Ethernet driver");
 MODULE_LICENSE("GPL");
-MODULE_PARM (multicast_filter_limit, "i");
-MODULE_PARM (max_interrupt_work, "i");
-MODULE_PARM (media, "1-" __MODULE_STRING(8) "i");
+module_param(multicast_filter_limit, int, 0);
+module_param(max_interrupt_work, int, 0);
+module_param_array(media, int, NULL, 0);
 MODULE_PARM_DESC (multicast_filter_limit, "pci-skeleton maximum number of filtered multicast addresses");
 MODULE_PARM_DESC (max_interrupt_work, "pci-skeleton maximum events handled per interrupt");
 MODULE_PARM_DESC (media, "pci-skeleton: Bits 0-3: media type, bit 17: full duplex");
diff --git a/drivers/net/pcmcia/fmvj18x_cs.c b/drivers/net/pcmcia/fmvj18x_cs.c
index 9d8197bb293a..384a736a0d2f 100644
--- a/drivers/net/pcmcia/fmvj18x_cs.c
+++ b/drivers/net/pcmcia/fmvj18x_cs.c
@@ -134,7 +134,7 @@ typedef struct local_info_t {
     u_char mc_filter[8];
 } local_info_t;
 
-#define MC_FILTERBREAK 64
+#define MC_FILTERBREAK 8
 
 /*====================================================================*/
 /* 
@@ -1012,7 +1012,7 @@ static void fjn_reset(struct net_device *dev)
         outb(BANK_1U, ioaddr + CONFIG_1);
 
     /* set the multicast table to accept none. */
-    for (i = 0; i < 6; i++) 
+    for (i = 0; i < 8; i++) 
         outb(0x00, ioaddr + MAR_ADR + i);
 
     /* Switch to bank 2 (runtime mode) */
@@ -1269,6 +1269,16 @@ static void set_rx_mode(struct net_device *dev)
     u_long flags;
     int i;
     
+    int saved_config_0 = inb(ioaddr + CONFIG_0);
+     
+    local_irq_save(flags); 
+
+    /* Disable Tx and Rx */
+    if (sram_config == 0) 
+        outb(CONFIG0_RST, ioaddr + CONFIG_0);
+    else
+        outb(CONFIG0_RST_1, ioaddr + CONFIG_0);
+
     if (dev->flags & IFF_PROMISC) {
         /* Unconditionally log net taps. */
         printk("%s: Promiscuous mode enabled.\n", dev->name);
@@ -1290,20 +1300,23 @@ static void set_rx_mode(struct net_device *dev)
         for (i = 0, mclist = dev->mc_list; mclist && i < dev->mc_count;
              i++, mclist = mclist->next) {
             unsigned int bit =
-                ether_crc_le(ETH_ALEN, mclist->dmi_addr) & 0x3f;
-            mc_filter[bit >> 3] |= (1 << bit);
+                ether_crc_le(ETH_ALEN, mclist->dmi_addr) >> 26;
+            mc_filter[bit >> 3] |= (1 << (bit & 7));
         }
+        outb(2, ioaddr + RX_MODE);      /* Use normal mode. */
     }
 
-    local_irq_save(flags); 
     if (memcmp(mc_filter, lp->mc_filter, sizeof(mc_filter))) {
         int saved_bank = inb(ioaddr + CONFIG_1);
         /* Switch to bank 1 and set the multicast table. */
         outb(0xe4, ioaddr + CONFIG_1);
         for (i = 0; i < 8; i++)
-            outb(mc_filter[i], ioaddr + 8 + i);
+            outb(mc_filter[i], ioaddr + MAR_ADR + i);
         memcpy(lp->mc_filter, mc_filter, sizeof(mc_filter));
         outb(saved_bank, ioaddr + CONFIG_1);
     }
+
+    outb(saved_config_0, ioaddr + CONFIG_0);
+
     local_irq_restore(flags);
 }
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
new file mode 100644
index 000000000000..6a2fe3583478
--- /dev/null
+++ b/drivers/net/phy/Kconfig
@@ -0,0 +1,57 @@
+#
+# PHY Layer Configuration
+#
+
+menu "PHY device support"
+
+config PHYLIB
+        tristate "PHY Device support and infrastructure"
+        depends on NET_ETHERNET
+        help
+          Ethernet controllers are usually attached to PHY
+          devices.  This option provides infrastructure for
+          managing PHY devices.
+
+config PHYCONTROL
+        bool "  Support for automatically handling PHY state changes"
+        depends on PHYLIB
+        help
+          Adds code to perform all the work for keeping PHY link
+          state (speed/duplex/etc) up-to-date.  Also handles
+          interrupts.
+
+comment "MII PHY device drivers"
+        depends on PHYLIB
+
+config MARVELL_PHY
+        tristate "Drivers for Marvell PHYs"
+        depends on PHYLIB
+        ---help---
+          Currently has a driver for the 88E1011S
+        
+config DAVICOM_PHY
+        tristate "Drivers for Davicom PHYs"
+        depends on PHYLIB
+        ---help---
+          Currently supports dm9161e and dm9131
+
+config QSEMI_PHY
+        tristate "Drivers for Quality Semiconductor PHYs"
+        depends on PHYLIB
+        ---help---
+          Currently supports the qs6612
+
+config LXT_PHY
+        tristate "Drivers for the Intel LXT PHYs"
+        depends on PHYLIB
+        ---help---
+          Currently supports the lxt970, lxt971
+
+config CICADA_PHY
+        tristate "Drivers for the Cicada PHYs"
+        depends on PHYLIB
+        ---help---
+          Currently supports the cis8204
+
+endmenu
+
diff --git a/drivers/net/phy/Makefile b/drivers/net/phy/Makefile
new file mode 100644
index 000000000000..e4116a5fbb4c
--- /dev/null
+++ b/drivers/net/phy/Makefile
@@ -0,0 +1,10 @@
+# Makefile for Linux PHY drivers
+
+libphy-objs                     := phy.o phy_device.o mdio_bus.o
+
+obj-$(CONFIG_PHYLIB)            += libphy.o
+obj-$(CONFIG_MARVELL_PHY)       += marvell.o
+obj-$(CONFIG_DAVICOM_PHY)       += davicom.o
+obj-$(CONFIG_CICADA_PHY)        += cicada.o
+obj-$(CONFIG_LXT_PHY)           += lxt.o
+obj-$(CONFIG_QSEMI_PHY)         += qsemi.o
diff --git a/drivers/net/phy/cicada.c b/drivers/net/phy/cicada.c
new file mode 100644
index 000000000000..c47fb2ecd147
--- /dev/null
+++ b/drivers/net/phy/cicada.c
@@ -0,0 +1,134 @@
+/*
+ * drivers/net/phy/cicada.c
+ *
+ * Driver for Cicada PHYs
+ *
+ * Author: Andy Fleming
+ *
+ * Copyright (c) 2004 Freescale Semiconductor, Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ */
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/unistd.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/version.h>
+#include <linux/mii.h>
+#include <linux/ethtool.h>
+#include <linux/phy.h>
+
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/uaccess.h>
+
+/* Cicada Extended Control Register 1 */
+#define MII_CIS8201_EXT_CON1           0x17
+#define MII_CIS8201_EXTCON1_INIT       0x0000
+
+/* Cicada Interrupt Mask Register */
+#define MII_CIS8201_IMASK               0x19
+#define MII_CIS8201_IMASK_IEN           0x8000
+#define MII_CIS8201_IMASK_SPEED 0x4000
+#define MII_CIS8201_IMASK_LINK          0x2000
+#define MII_CIS8201_IMASK_DUPLEX        0x1000
+#define MII_CIS8201_IMASK_MASK          0xf000
+
+/* Cicada Interrupt Status Register */
+#define MII_CIS8201_ISTAT               0x1a
+#define MII_CIS8201_ISTAT_STATUS        0x8000
+#define MII_CIS8201_ISTAT_SPEED 0x4000
+#define MII_CIS8201_ISTAT_LINK          0x2000
+#define MII_CIS8201_ISTAT_DUPLEX        0x1000
+
+/* Cicada Auxiliary Control/Status Register */
+#define MII_CIS8201_AUX_CONSTAT        0x1c
+#define MII_CIS8201_AUXCONSTAT_INIT    0x0004
+#define MII_CIS8201_AUXCONSTAT_DUPLEX  0x0020
+#define MII_CIS8201_AUXCONSTAT_SPEED   0x0018
+#define MII_CIS8201_AUXCONSTAT_GBIT    0x0010
+#define MII_CIS8201_AUXCONSTAT_100     0x0008
+
+MODULE_DESCRIPTION("Cicadia PHY driver");
+MODULE_AUTHOR("Andy Fleming");
+MODULE_LICENSE("GPL");
+
+static int cis820x_config_init(struct phy_device *phydev)
+{
+        int err;
+
+        err = phy_write(phydev, MII_CIS8201_AUX_CONSTAT,
+                        MII_CIS8201_AUXCONSTAT_INIT);
+
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, MII_CIS8201_EXT_CON1,
+                        MII_CIS8201_EXTCON1_INIT);
+
+        return err;
+}
+
+static int cis820x_ack_interrupt(struct phy_device *phydev)
+{
+        int err = phy_read(phydev, MII_CIS8201_ISTAT);
+
+        return (err < 0) ? err : 0;
+}
+
+static int cis820x_config_intr(struct phy_device *phydev)
+{
+        int err;
+
+        if(phydev->interrupts == PHY_INTERRUPT_ENABLED)
+                err = phy_write(phydev, MII_CIS8201_IMASK, 
+                                MII_CIS8201_IMASK_MASK);
+        else
+                err = phy_write(phydev, MII_CIS8201_IMASK, 0);
+
+        return err;
+}
+
+/* Cicada 820x */
+static struct phy_driver cis8204_driver = {
+        .phy_id         = 0x000fc440,
+        .name           = "Cicada Cis8204",
+        .phy_id_mask    = 0x000fffc0,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = &cis820x_config_init,
+        .config_aneg    = &genphy_config_aneg,
+        .read_status    = &genphy_read_status,
+        .ack_interrupt  = &cis820x_ack_interrupt,
+        .config_intr    = &cis820x_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+};
+
+static int __init cis8204_init(void)
+{
+        return phy_driver_register(&cis8204_driver);
+}
+
+static void __exit cis8204_exit(void)
+{
+        phy_driver_unregister(&cis8204_driver);
+}
+
+module_init(cis8204_init);
+module_exit(cis8204_exit);
diff --git a/drivers/net/phy/davicom.c b/drivers/net/phy/davicom.c
new file mode 100644
index 000000000000..6caf499fae32
--- /dev/null
+++ b/drivers/net/phy/davicom.c
@@ -0,0 +1,195 @@
+/*
+ * drivers/net/phy/davicom.c
+ *
+ * Driver for Davicom PHYs
+ *
+ * Author: Andy Fleming
+ *
+ * Copyright (c) 2004 Freescale Semiconductor, Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ */
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/unistd.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/version.h>
+#include <linux/mii.h>
+#include <linux/ethtool.h>
+#include <linux/phy.h>
+
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/uaccess.h>
+
+#define MII_DM9161_SCR          0x10
+#define MII_DM9161_SCR_INIT     0x0610
+
+/* DM9161 Interrupt Register */
+#define MII_DM9161_INTR 0x15
+#define MII_DM9161_INTR_PEND            0x8000
+#define MII_DM9161_INTR_DPLX_MASK       0x0800
+#define MII_DM9161_INTR_SPD_MASK        0x0400
+#define MII_DM9161_INTR_LINK_MASK       0x0200
+#define MII_DM9161_INTR_MASK            0x0100
+#define MII_DM9161_INTR_DPLX_CHANGE     0x0010
+#define MII_DM9161_INTR_SPD_CHANGE      0x0008
+#define MII_DM9161_INTR_LINK_CHANGE     0x0004
+#define MII_DM9161_INTR_INIT            0x0000
+#define MII_DM9161_INTR_STOP    \
+(MII_DM9161_INTR_DPLX_MASK | MII_DM9161_INTR_SPD_MASK \
+ | MII_DM9161_INTR_LINK_MASK | MII_DM9161_INTR_MASK)
+
+/* DM9161 10BT Configuration/Status */
+#define MII_DM9161_10BTCSR      0x12
+#define MII_DM9161_10BTCSR_INIT 0x7800
+
+MODULE_DESCRIPTION("Davicom PHY driver");
+MODULE_AUTHOR("Andy Fleming");
+MODULE_LICENSE("GPL");
+
+
+#define DM9161_DELAY 1
+static int dm9161_config_intr(struct phy_device *phydev)
+{
+        int temp;
+
+        temp = phy_read(phydev, MII_DM9161_INTR);
+
+        if (temp < 0)
+                return temp;
+
+        if(PHY_INTERRUPT_ENABLED == phydev->interrupts )
+                temp &= ~(MII_DM9161_INTR_STOP);
+        else
+                temp |= MII_DM9161_INTR_STOP;
+
+        temp = phy_write(phydev, MII_DM9161_INTR, temp);
+
+        return temp;
+}
+
+static int dm9161_config_aneg(struct phy_device *phydev)
+{
+        int err;
+
+        /* Isolate the PHY */
+        err = phy_write(phydev, MII_BMCR, BMCR_ISOLATE);
+
+        if (err < 0)
+                return err;
+
+        /* Configure the new settings */
+        err = genphy_config_aneg(phydev);
+
+        if (err < 0)
+                return err;
+
+        return 0;
+}
+
+static int dm9161_config_init(struct phy_device *phydev)
+{
+        int err;
+
+        /* Isolate the PHY */
+        err = phy_write(phydev, MII_BMCR, BMCR_ISOLATE);
+
+        if (err < 0)
+                return err;
+
+        /* Do not bypass the scrambler/descrambler */
+        err = phy_write(phydev, MII_DM9161_SCR, MII_DM9161_SCR_INIT);
+
+        if (err < 0)
+                return err;
+
+        /* Clear 10BTCSR to default */
+        err = phy_write(phydev, MII_DM9161_10BTCSR, MII_DM9161_10BTCSR_INIT);
+
+        if (err < 0)
+                return err;
+
+        /* Reconnect the PHY, and enable Autonegotiation */
+        err = phy_write(phydev, MII_BMCR, BMCR_ANENABLE);
+
+        if (err < 0)
+                return err;
+
+        return 0;
+}
+
+static int dm9161_ack_interrupt(struct phy_device *phydev)
+{
+        int err = phy_read(phydev, MII_DM9161_INTR);
+
+        return (err < 0) ? err : 0;
+}
+
+static struct phy_driver dm9161_driver = {
+        .phy_id         = 0x0181b880,
+        .name           = "Davicom DM9161E",
+        .phy_id_mask    = 0x0ffffff0,
+        .features       = PHY_BASIC_FEATURES,
+        .config_init    = dm9161_config_init,
+        .config_aneg    = dm9161_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE,},
+};
+
+static struct phy_driver dm9131_driver = {
+        .phy_id         = 0x00181b80,
+        .name           = "Davicom DM9131",
+        .phy_id_mask    = 0x0ffffff0,
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .ack_interrupt  = dm9161_ack_interrupt,
+        .config_intr    = dm9161_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+};
+
+static int __init davicom_init(void)
+{
+        int ret;
+
+        ret = phy_driver_register(&dm9161_driver);
+        if (ret)
+                goto err1;
+
+        ret = phy_driver_register(&dm9131_driver);
+        if (ret)
+                goto err2;
+        return 0;
+
+ err2:  
+        phy_driver_unregister(&dm9161_driver);
+ err1:
+        return ret;
+}
+
+static void __exit davicom_exit(void)
+{
+        phy_driver_unregister(&dm9161_driver);
+        phy_driver_unregister(&dm9131_driver);
+}
+
+module_init(davicom_init);
+module_exit(davicom_exit);
diff --git a/drivers/net/phy/lxt.c b/drivers/net/phy/lxt.c
new file mode 100644
index 000000000000..4c840448ec86
--- /dev/null
+++ b/drivers/net/phy/lxt.c
@@ -0,0 +1,179 @@
+/*
+ * drivers/net/phy/lxt.c
+ *
+ * Driver for Intel LXT PHYs
+ *
+ * Author: Andy Fleming
+ *
+ * Copyright (c) 2004 Freescale Semiconductor, Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ */
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/unistd.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/version.h>
+#include <linux/mii.h>
+#include <linux/ethtool.h>
+#include <linux/phy.h>
+
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/uaccess.h>
+
+/* The Level one LXT970 is used by many boards                               */
+
+#define MII_LXT970_IER       17  /* Interrupt Enable Register */
+
+#define MII_LXT970_IER_IEN      0x0002
+
+#define MII_LXT970_ISR       18  /* Interrupt Status Register */
+
+#define MII_LXT970_CONFIG    19  /* Configuration Register    */
+
+/* ------------------------------------------------------------------------- */
+/* The Level one LXT971 is used on some of my custom boards                  */
+
+/* register definitions for the 971 */
+#define MII_LXT971_IER          18  /* Interrupt Enable Register */
+#define MII_LXT971_IER_IEN      0x00f2
+
+#define MII_LXT971_ISR          19  /* Interrupt Status Register */
+
+
+MODULE_DESCRIPTION("Intel LXT PHY driver");
+MODULE_AUTHOR("Andy Fleming");
+MODULE_LICENSE("GPL");
+
+static int lxt970_ack_interrupt(struct phy_device *phydev)
+{
+        int err;
+
+        err = phy_read(phydev, MII_BMSR);
+
+        if (err < 0)
+                return err;
+
+        err = phy_read(phydev, MII_LXT970_ISR);
+
+        if (err < 0)
+                return err;
+
+        return 0;
+}
+
+static int lxt970_config_intr(struct phy_device *phydev)
+{
+        int err;
+
+        if(phydev->interrupts == PHY_INTERRUPT_ENABLED)
+                err = phy_write(phydev, MII_LXT970_IER, MII_LXT970_IER_IEN);
+        else
+                err = phy_write(phydev, MII_LXT970_IER, 0);
+
+        return err;
+}
+
+static int lxt970_config_init(struct phy_device *phydev)
+{
+        int err;
+
+        err = phy_write(phydev, MII_LXT970_CONFIG, 0);
+
+        return err;
+}
+
+
+static int lxt971_ack_interrupt(struct phy_device *phydev)
+{
+        int err = phy_read(phydev, MII_LXT971_ISR);
+
+        if (err < 0)
+                return err;
+
+        return 0;
+}
+
+static int lxt971_config_intr(struct phy_device *phydev)
+{
+        int err;
+
+        if(phydev->interrupts == PHY_INTERRUPT_ENABLED)
+                err = phy_write(phydev, MII_LXT971_IER, MII_LXT971_IER_IEN);
+        else
+                err = phy_write(phydev, MII_LXT971_IER, 0);
+
+        return err;
+}
+
+static struct phy_driver lxt970_driver = {
+        .phy_id         = 0x07810000,
+        .name           = "LXT970",
+        .phy_id_mask    = 0x0fffffff,
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = lxt970_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .ack_interrupt  = lxt970_ack_interrupt,
+        .config_intr    = lxt970_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+};
+
+static struct phy_driver lxt971_driver = {
+        .phy_id         = 0x0001378e,
+        .name           = "LXT971",
+        .phy_id_mask    = 0x0fffffff,
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .ack_interrupt  = lxt971_ack_interrupt,
+        .config_intr    = lxt971_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+};
+
+static int __init lxt_init(void)
+{
+        int ret;
+
+        ret = phy_driver_register(&lxt970_driver);
+        if (ret)
+                goto err1;
+
+        ret = phy_driver_register(&lxt971_driver);
+        if (ret)
+                goto err2;
+        return 0;
+
+ err2:  
+        phy_driver_unregister(&lxt970_driver);
+ err1:
+        return ret;
+}
+
+static void __exit lxt_exit(void)
+{
+        phy_driver_unregister(&lxt970_driver);
+        phy_driver_unregister(&lxt971_driver);
+}
+
+module_init(lxt_init);
+module_exit(lxt_exit);
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
new file mode 100644
index 000000000000..4a72b025006b
--- /dev/null
+++ b/drivers/net/phy/marvell.c
@@ -0,0 +1,140 @@
+/*
+ * drivers/net/phy/marvell.c
+ *
+ * Driver for Marvell PHYs
+ *
+ * Author: Andy Fleming
+ *
+ * Copyright (c) 2004 Freescale Semiconductor, Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ */
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/unistd.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/version.h>
+#include <linux/mii.h>
+#include <linux/ethtool.h>
+#include <linux/phy.h>
+
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/uaccess.h>
+
+#define MII_M1011_IEVENT                0x13
+#define MII_M1011_IEVENT_CLEAR          0x0000
+
+#define MII_M1011_IMASK                 0x12
+#define MII_M1011_IMASK_INIT            0x6400
+#define MII_M1011_IMASK_CLEAR           0x0000
+
+MODULE_DESCRIPTION("Marvell PHY driver");
+MODULE_AUTHOR("Andy Fleming");
+MODULE_LICENSE("GPL");
+
+static int marvell_ack_interrupt(struct phy_device *phydev)
+{
+        int err;
+
+        /* Clear the interrupts by reading the reg */
+        err = phy_read(phydev, MII_M1011_IEVENT);
+
+        if (err < 0)
+                return err;
+
+        return 0;
+}
+
+static int marvell_config_intr(struct phy_device *phydev)
+{
+        int err;
+
+        if(phydev->interrupts == PHY_INTERRUPT_ENABLED)
+                err = phy_write(phydev, MII_M1011_IMASK, MII_M1011_IMASK_INIT);
+        else
+                err = phy_write(phydev, MII_M1011_IMASK, MII_M1011_IMASK_CLEAR);
+
+        return err;
+}
+
+static int marvell_config_aneg(struct phy_device *phydev)
+{
+        int err;
+
+        /* The Marvell PHY has an errata which requires
+         * that certain registers get written in order
+         * to restart autonegotiation */
+        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
+
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1d, 0x1f);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1e, 0x200c);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1d, 0x5);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1e, 0);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1e, 0x100);
+        if (err < 0)
+                return err;
+
+
+        err = genphy_config_aneg(phydev);
+
+        return err;
+}
+
+
+static struct phy_driver m88e1101_driver = {
+        .phy_id         = 0x01410c00,
+        .phy_id_mask    = 0xffffff00,
+        .name           = "Marvell 88E1101",
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_aneg    = &marvell_config_aneg,
+        .read_status    = &genphy_read_status,
+        .ack_interrupt  = &marvell_ack_interrupt,
+        .config_intr    = &marvell_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+};
+
+static int __init marvell_init(void)
+{
+        return phy_driver_register(&m88e1101_driver);
+}
+
+static void __exit marvell_exit(void)
+{
+        phy_driver_unregister(&m88e1101_driver);
+}
+
+module_init(marvell_init);
+module_exit(marvell_exit);
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
new file mode 100644
index 000000000000..41f62c0c5fcb
--- /dev/null
+++ b/drivers/net/phy/mdio_bus.c
@@ -0,0 +1,176 @@
+/*
+ * drivers/net/phy/mdio_bus.c
+ *
+ * MDIO Bus interface
+ *
+ * Author: Andy Fleming
+ *
+ * Copyright (c) 2004 Freescale Semiconductor, Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ */
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/unistd.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/version.h>
+#include <linux/mii.h>
+#include <linux/ethtool.h>
+#include <linux/phy.h>
+
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/uaccess.h>
+
+/* mdiobus_register 
+ *
+ * description: Called by a bus driver to bring up all the PHYs
+ *   on a given bus, and attach them to the bus
+ */
+int mdiobus_register(struct mii_bus *bus)
+{
+        int i;
+        int err = 0;
+
+        spin_lock_init(&bus->mdio_lock);
+
+        if (NULL == bus || NULL == bus->name ||
+                        NULL == bus->read ||
+                        NULL == bus->write)
+                return -EINVAL;
+
+        if (bus->reset)
+                bus->reset(bus);
+
+        for (i = 0; i < PHY_MAX_ADDR; i++) {
+                struct phy_device *phydev;
+
+                phydev = get_phy_device(bus, i);
+
+                if (IS_ERR(phydev))
+                        return PTR_ERR(phydev);
+
+                /* There's a PHY at this address
+                 * We need to set:
+                 * 1) IRQ
+                 * 2) bus_id
+                 * 3) parent
+                 * 4) bus
+                 * 5) mii_bus
+                 * And, we need to register it */
+                if (phydev) {
+                        phydev->irq = bus->irq[i];
+
+                        phydev->dev.parent = bus->dev;
+                        phydev->dev.bus = &mdio_bus_type;
+                        sprintf(phydev->dev.bus_id, "phy%d:%d", bus->id, i);
+
+                        phydev->bus = bus;
+
+                        err = device_register(&phydev->dev);
+
+                        if (err)
+                                printk(KERN_ERR "phy %d failed to register\n",
+                                                i);
+                }
+
+                bus->phy_map[i] = phydev;
+        }
+
+        pr_info("%s: probed\n", bus->name);
+
+        return err;
+}
+EXPORT_SYMBOL(mdiobus_register);
+
+void mdiobus_unregister(struct mii_bus *bus)
+{
+        int i;
+
+        for (i = 0; i < PHY_MAX_ADDR; i++) {
+                if (bus->phy_map[i]) {
+                        device_unregister(&bus->phy_map[i]->dev);
+                        kfree(bus->phy_map[i]);
+                }
+        }
+}
+EXPORT_SYMBOL(mdiobus_unregister);
+
+/* mdio_bus_match
+ *
+ * description: Given a PHY device, and a PHY driver, return 1 if
+ *   the driver supports the device.  Otherwise, return 0
+ */
+static int mdio_bus_match(struct device *dev, struct device_driver *drv)
+{
+        struct phy_device *phydev = to_phy_device(dev);
+        struct phy_driver *phydrv = to_phy_driver(drv);
+
+        return (phydrv->phy_id == (phydev->phy_id & phydrv->phy_id_mask));
+}
+
+/* Suspend and resume.  Copied from platform_suspend and
+ * platform_resume
+ */
+static int mdio_bus_suspend(struct device * dev, u32 state)
+{
+        int ret = 0;
+        struct device_driver *drv = dev->driver;
+
+        if (drv && drv->suspend) {
+                ret = drv->suspend(dev, state, SUSPEND_DISABLE);
+                if (ret == 0)
+                        ret = drv->suspend(dev, state, SUSPEND_SAVE_STATE);
+                if (ret == 0)
+                        ret = drv->suspend(dev, state, SUSPEND_POWER_DOWN);
+        }
+        return ret;
+}
+
+static int mdio_bus_resume(struct device * dev)
+{
+        int ret = 0;
+        struct device_driver *drv = dev->driver;
+
+        if (drv && drv->resume) {
+                ret = drv->resume(dev, RESUME_POWER_ON);
+                if (ret == 0)
+                        ret = drv->resume(dev, RESUME_RESTORE_STATE);
+                if (ret == 0)
+                        ret = drv->resume(dev, RESUME_ENABLE);
+        }
+        return ret;
+}
+
+struct bus_type mdio_bus_type = {
+        .name           = "mdio_bus",
+        .match          = mdio_bus_match,
+        .suspend        = mdio_bus_suspend,
+        .resume         = mdio_bus_resume,
+};
+
+int __init mdio_bus_init(void)
+{
+        return bus_register(&mdio_bus_type);
+}
+
+void __exit mdio_bus_exit(void)
+{
+        bus_unregister(&mdio_bus_type);
+}
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
new file mode 100644
index 000000000000..d9e11f93bf3a
--- /dev/null
+++ b/drivers/net/phy/phy.c
@@ -0,0 +1,871 @@
+/*
+ * drivers/net/phy/phy.c
+ *
+ * Framework for configuring and reading PHY devices
+ * Based on code in sungem_phy.c and gianfar_phy.c
+ *
+ * Author: Andy Fleming
+ *
+ * Copyright (c) 2004 Freescale Semiconductor, Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ */
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/unistd.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/version.h>
+#include <linux/mii.h>
+#include <linux/ethtool.h>
+#include <linux/phy.h>
+
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/uaccess.h>
+
+/* Convenience function to print out the current phy status
+ */
+void phy_print_status(struct phy_device *phydev)
+{
+        pr_info("%s: Link is %s", phydev->dev.bus_id,
+                        phydev->link ? "Up" : "Down");
+        if (phydev->link)
+                printk(" - %d/%s", phydev->speed,
+                                DUPLEX_FULL == phydev->duplex ?
+                                "Full" : "Half");
+
+        printk("\n");
+}
+EXPORT_SYMBOL(phy_print_status);
+
+
+/* Convenience functions for reading/writing a given PHY
+ * register. They MUST NOT be called from interrupt context,
+ * because the bus read/write functions may wait for an interrupt
+ * to conclude the operation. */
+int phy_read(struct phy_device *phydev, u16 regnum)
+{
+        int retval;
+        struct mii_bus *bus = phydev->bus;
+
+        spin_lock_bh(&bus->mdio_lock);
+        retval = bus->read(bus, phydev->addr, regnum);
+        spin_unlock_bh(&bus->mdio_lock);
+
+        return retval;
+}
+EXPORT_SYMBOL(phy_read);
+
+int phy_write(struct phy_device *phydev, u16 regnum, u16 val)
+{
+        int err;
+        struct mii_bus *bus = phydev->bus;
+
+        spin_lock_bh(&bus->mdio_lock);
+        err = bus->write(bus, phydev->addr, regnum, val);
+        spin_unlock_bh(&bus->mdio_lock);
+
+        return err;
+}
+EXPORT_SYMBOL(phy_write);
+
+
+int phy_clear_interrupt(struct phy_device *phydev)
+{
+        int err = 0;
+
+        if (phydev->drv->ack_interrupt)
+                err = phydev->drv->ack_interrupt(phydev);
+
+        return err;
+}
+
+
+int phy_config_interrupt(struct phy_device *phydev, u32 interrupts)
+{
+        int err = 0;
+
+        phydev->interrupts = interrupts;
+        if (phydev->drv->config_intr)
+                err = phydev->drv->config_intr(phydev);
+
+        return err;
+}
+
+
+/* phy_aneg_done
+ *
+ * description: Reads the status register and returns 0 either if
+ *   auto-negotiation is incomplete, or if there was an error.
+ *   Returns BMSR_ANEGCOMPLETE if auto-negotiation is done.
+ */
+static inline int phy_aneg_done(struct phy_device *phydev)
+{
+        int retval;
+
+        retval = phy_read(phydev, MII_BMSR);
+
+        return (retval < 0) ? retval : (retval & BMSR_ANEGCOMPLETE);
+}
+
+/* A structure for mapping a particular speed and duplex
+ * combination to a particular SUPPORTED and ADVERTISED value */
+struct phy_setting {
+        int speed;
+        int duplex;
+        u32 setting;
+};
+
+/* A mapping of all SUPPORTED settings to speed/duplex */
+static struct phy_setting settings[] = {
+        {
+                .speed = 10000,
+                .duplex = DUPLEX_FULL,
+                .setting = SUPPORTED_10000baseT_Full,
+        },
+        {
+                .speed = SPEED_1000,
+                .duplex = DUPLEX_FULL,
+                .setting = SUPPORTED_1000baseT_Full,
+        },
+        {
+                .speed = SPEED_1000,
+                .duplex = DUPLEX_HALF,
+                .setting = SUPPORTED_1000baseT_Half,
+        },
+        {
+                .speed = SPEED_100,
+                .duplex = DUPLEX_FULL,
+                .setting = SUPPORTED_100baseT_Full,
+        },
+        {
+                .speed = SPEED_100,
+                .duplex = DUPLEX_HALF,
+                .setting = SUPPORTED_100baseT_Half,
+        },
+        {
+                .speed = SPEED_10,
+                .duplex = DUPLEX_FULL,
+                .setting = SUPPORTED_10baseT_Full,
+        },
+        {
+                .speed = SPEED_10,
+                .duplex = DUPLEX_HALF,
+                .setting = SUPPORTED_10baseT_Half,
+        },
+};
+
+#define MAX_NUM_SETTINGS (sizeof(settings)/sizeof(struct phy_setting))
+
+/* phy_find_setting
+ *
+ * description: Searches the settings array for the setting which
+ *   matches the desired speed and duplex, and returns the index
+ *   of that setting.  Returns the index of the last setting if
+ *   none of the others match.
+ */
+static inline int phy_find_setting(int speed, int duplex)
+{
+        int idx = 0;
+
+        while (idx < ARRAY_SIZE(settings) &&
+                        (settings[idx].speed != speed ||
+                        settings[idx].duplex != duplex))
+                idx++;
+
+        return idx < MAX_NUM_SETTINGS ? idx : MAX_NUM_SETTINGS - 1;
+}
+
+/* phy_find_valid
+ * idx: The first index in settings[] to search
+ * features: A mask of the valid settings
+ *
+ * description: Returns the index of the first valid setting less
+ *   than or equal to the one pointed to by idx, as determined by
+ *   the mask in features.  Returns the index of the last setting
+ *   if nothing else matches.
+ */
+static inline int phy_find_valid(int idx, u32 features)
+{
+        while (idx < MAX_NUM_SETTINGS && !(settings[idx].setting & features))
+                idx++;
+
+        return idx < MAX_NUM_SETTINGS ? idx : MAX_NUM_SETTINGS - 1;
+}
+
+/* phy_sanitize_settings
+ *
+ * description: Make sure the PHY is set to supported speeds and
+ *   duplexes.  Drop down by one in this order:  1000/FULL,
+ *   1000/HALF, 100/FULL, 100/HALF, 10/FULL, 10/HALF
+ */
+void phy_sanitize_settings(struct phy_device *phydev)
+{
+        u32 features = phydev->supported;
+        int idx;
+
+        /* Sanitize settings based on PHY capabilities */
+        if ((features & SUPPORTED_Autoneg) == 0)
+                phydev->autoneg = 0;
+
+        idx = phy_find_valid(phy_find_setting(phydev->speed, phydev->duplex),
+                        features);
+
+        phydev->speed = settings[idx].speed;
+        phydev->duplex = settings[idx].duplex;
+}
+EXPORT_SYMBOL(phy_sanitize_settings);
+
+/* phy_ethtool_sset:
+ * A generic ethtool sset function.  Handles all the details
+ *
+ * A few notes about parameter checking:
+ * - We don't set port or transceiver, so we don't care what they
+ *   were set to.
+ * - phy_start_aneg() will make sure forced settings are sane, and
+ *   choose the next best ones from the ones selected, so we don't
+ *   care if ethtool tries to give us bad values
+ *
+ * A note about the PHYCONTROL Layer.  If you turn off
+ * CONFIG_PHYCONTROL, you will need to read the PHY status
+ * registers after this function completes, and update your
+ * controller manually.
+ */
+int phy_ethtool_sset(struct phy_device *phydev, struct ethtool_cmd *cmd)
+{
+        if (cmd->phy_address != phydev->addr)
+                return -EINVAL;
+
+        /* We make sure that we don't pass unsupported
+         * values in to the PHY */
+        cmd->advertising &= phydev->supported;
+
+        /* Verify the settings we care about. */
+        if (cmd->autoneg != AUTONEG_ENABLE && cmd->autoneg != AUTONEG_DISABLE)
+                return -EINVAL;
+
+        if (cmd->autoneg == AUTONEG_ENABLE && cmd->advertising == 0)
+                return -EINVAL;
+
+        if (cmd->autoneg == AUTONEG_DISABLE
+                        && ((cmd->speed != SPEED_1000
+                                        && cmd->speed != SPEED_100
+                                        && cmd->speed != SPEED_10)
+                                || (cmd->duplex != DUPLEX_HALF
+                                        && cmd->duplex != DUPLEX_FULL)))
+                return -EINVAL;
+
+        phydev->autoneg = cmd->autoneg;
+
+        phydev->speed = cmd->speed;
+
+        phydev->advertising = cmd->advertising;
+
+        if (AUTONEG_ENABLE == cmd->autoneg)
+                phydev->advertising |= ADVERTISED_Autoneg;
+        else
+                phydev->advertising &= ~ADVERTISED_Autoneg;
+
+        phydev->duplex = cmd->duplex;
+
+        /* Restart the PHY */
+        phy_start_aneg(phydev);
+
+        return 0;
+}
+
+int phy_ethtool_gset(struct phy_device *phydev, struct ethtool_cmd *cmd)
+{
+        cmd->supported = phydev->supported;
+
+        cmd->advertising = phydev->advertising;
+
+        cmd->speed = phydev->speed;
+        cmd->duplex = phydev->duplex;
+        cmd->port = PORT_MII;
+        cmd->phy_address = phydev->addr;
+        cmd->transceiver = XCVR_EXTERNAL;
+        cmd->autoneg = phydev->autoneg;
+
+        return 0;
+}
+
+
+/* Note that this function is currently incompatible with the
+ * PHYCONTROL layer.  It changes registers without regard to
+ * current state.  Use at own risk
+ */
+int phy_mii_ioctl(struct phy_device *phydev,
+                struct mii_ioctl_data *mii_data, int cmd)
+{
+        u16 val = mii_data->val_in;
+
+        switch (cmd) {
+        case SIOCGMIIPHY:
+                mii_data->phy_id = phydev->addr;
+                break;
+        case SIOCGMIIREG:
+                mii_data->val_out = phy_read(phydev, mii_data->reg_num);
+                break;
+
+        case SIOCSMIIREG:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EPERM;
+
+                if (mii_data->phy_id == phydev->addr) {
+                        switch(mii_data->reg_num) {
+                        case MII_BMCR:
+                                if (val & (BMCR_RESET|BMCR_ANENABLE))
+                                        phydev->autoneg = AUTONEG_DISABLE;
+                                else
+                                        phydev->autoneg = AUTONEG_ENABLE;
+                                if ((!phydev->autoneg) && (val & BMCR_FULLDPLX))
+                                        phydev->duplex = DUPLEX_FULL;
+                                else
+                                        phydev->duplex = DUPLEX_HALF;
+                                break;
+                        case MII_ADVERTISE:
+                                phydev->advertising = val;
+                                break;
+                        default:
+                                /* do nothing */
+                                break;
+                        }
+                }
+
+                phy_write(phydev, mii_data->reg_num, val);
+                
+                if (mii_data->reg_num == MII_BMCR 
+                                && val & BMCR_RESET
+                                && phydev->drv->config_init)
+                        phydev->drv->config_init(phydev);
+                break;
+        }
+
+        return 0;
+}
+
+/* phy_start_aneg
+ *
+ * description: Sanitizes the settings (if we're not
+ *   autonegotiating them), and then calls the driver's
+ *   config_aneg function.  If the PHYCONTROL Layer is operating,
+ *   we change the state to reflect the beginning of
+ *   Auto-negotiation or forcing.
+ */
+int phy_start_aneg(struct phy_device *phydev)
+{
+        int err;
+
+        spin_lock(&phydev->lock);
+
+        if (AUTONEG_DISABLE == phydev->autoneg)
+                phy_sanitize_settings(phydev);
+
+        err = phydev->drv->config_aneg(phydev);
+
+#ifdef CONFIG_PHYCONTROL
+        if (err < 0)
+                goto out_unlock;
+
+        if (phydev->state != PHY_HALTED) {
+                if (AUTONEG_ENABLE == phydev->autoneg) {
+                        phydev->state = PHY_AN;
+                        phydev->link_timeout = PHY_AN_TIMEOUT;
+                } else {
+                        phydev->state = PHY_FORCING;
+                        phydev->link_timeout = PHY_FORCE_TIMEOUT;
+                }
+        }
+
+out_unlock:
+#endif
+        spin_unlock(&phydev->lock);
+        return err;
+}
+EXPORT_SYMBOL(phy_start_aneg);
+
+
+#ifdef CONFIG_PHYCONTROL
+static void phy_change(void *data);
+static void phy_timer(unsigned long data);
+
+/* phy_start_machine:
+ *
+ * description: The PHY infrastructure can run a state machine
+ *   which tracks whether the PHY is starting up, negotiating,
+ *   etc.  This function starts the timer which tracks the state
+ *   of the PHY.  If you want to be notified when the state
+ *   changes, pass in the callback, otherwise, pass NULL.  If you
+ *   want to maintain your own state machine, do not call this
+ *   function. */
+void phy_start_machine(struct phy_device *phydev,
+                void (*handler)(struct net_device *))
+{
+        phydev->adjust_state = handler;
+
+        init_timer(&phydev->phy_timer);
+        phydev->phy_timer.function = &phy_timer;
+        phydev->phy_timer.data = (unsigned long) phydev;
+        mod_timer(&phydev->phy_timer, jiffies + HZ);
+}
+
+/* phy_stop_machine
+ *
+ * description: Stops the state machine timer, sets the state to
+ *   UP (unless it wasn't up yet), and then frees the interrupt,
+ *   if it is in use. This function must be called BEFORE
+ *   phy_detach.
+ */
+void phy_stop_machine(struct phy_device *phydev)
+{
+        del_timer_sync(&phydev->phy_timer);
+
+        spin_lock(&phydev->lock);
+        if (phydev->state > PHY_UP)
+                phydev->state = PHY_UP;
+        spin_unlock(&phydev->lock);
+
+        if (phydev->irq != PHY_POLL)
+                phy_stop_interrupts(phydev);
+
+        phydev->adjust_state = NULL;
+}
+
+/* phy_force_reduction
+ *
+ * description: Reduces the speed/duplex settings by
+ *   one notch.  The order is so:
+ *   1000/FULL, 1000/HALF, 100/FULL, 100/HALF,
+ *   10/FULL, 10/HALF.  The function bottoms out at 10/HALF.
+ */
+static void phy_force_reduction(struct phy_device *phydev)
+{
+        int idx;
+
+        idx = phy_find_setting(phydev->speed, phydev->duplex);
+        
+        idx++;
+
+        idx = phy_find_valid(idx, phydev->supported);
+
+        phydev->speed = settings[idx].speed;
+        phydev->duplex = settings[idx].duplex;
+
+        pr_info("Trying %d/%s\n", phydev->speed,
+                        DUPLEX_FULL == phydev->duplex ?
+                        "FULL" : "HALF");
+}
+
+
+/* phy_error:
+ *
+ * Moves the PHY to the HALTED state in response to a read
+ * or write error, and tells the controller the link is down.
+ * Must not be called from interrupt context, or while the
+ * phydev->lock is held.
+ */
+void phy_error(struct phy_device *phydev)
+{
+        spin_lock(&phydev->lock);
+        phydev->state = PHY_HALTED;
+        spin_unlock(&phydev->lock);
+}
+
+/* phy_interrupt
+ *
+ * description: When a PHY interrupt occurs, the handler disables
+ * interrupts, and schedules a work task to clear the interrupt.
+ */
+static irqreturn_t phy_interrupt(int irq, void *phy_dat, struct pt_regs *regs)
+{
+        struct phy_device *phydev = phy_dat;
+
+        /* The MDIO bus is not allowed to be written in interrupt
+         * context, so we need to disable the irq here.  A work
+         * queue will write the PHY to disable and clear the
+         * interrupt, and then reenable the irq line. */
+        disable_irq_nosync(irq);
+
+        schedule_work(&phydev->phy_queue);
+
+        return IRQ_HANDLED;
+}
+
+/* Enable the interrupts from the PHY side */
+int phy_enable_interrupts(struct phy_device *phydev)
+{
+        int err;
+
+        err = phy_clear_interrupt(phydev);
+
+        if (err < 0)
+                return err;
+
+        err = phy_config_interrupt(phydev, PHY_INTERRUPT_ENABLED);
+
+        return err;
+}
+EXPORT_SYMBOL(phy_enable_interrupts);
+
+/* Disable the PHY interrupts from the PHY side */
+int phy_disable_interrupts(struct phy_device *phydev)
+{
+        int err;
+
+        /* Disable PHY interrupts */
+        err = phy_config_interrupt(phydev, PHY_INTERRUPT_DISABLED);
+
+        if (err)
+                goto phy_err;
+
+        /* Clear the interrupt */
+        err = phy_clear_interrupt(phydev);
+
+        if (err)
+                goto phy_err;
+
+        return 0;
+
+phy_err:
+        phy_error(phydev);
+
+        return err;
+}
+EXPORT_SYMBOL(phy_disable_interrupts);
+
+/* phy_start_interrupts
+ *
+ * description: Request the interrupt for the given PHY.  If
+ *   this fails, then we set irq to PHY_POLL.
+ *   Otherwise, we enable the interrupts in the PHY.
+ *   Returns 0 on success.
+ *   This should only be called with a valid IRQ number.
+ */
+int phy_start_interrupts(struct phy_device *phydev)
+{
+        int err = 0;
+
+        INIT_WORK(&phydev->phy_queue, phy_change, phydev);
+
+        if (request_irq(phydev->irq, phy_interrupt,
+                                SA_SHIRQ,
+                                "phy_interrupt",
+                                phydev) < 0) {
+                printk(KERN_WARNING "%s: Can't get IRQ %d (PHY)\n",
+                                phydev->bus->name,
+                                phydev->irq);
+                phydev->irq = PHY_POLL;
+                return 0;
+        }
+
+        err = phy_enable_interrupts(phydev);
+
+        return err;
+}
+EXPORT_SYMBOL(phy_start_interrupts);
+
+int phy_stop_interrupts(struct phy_device *phydev)
+{
+        int err;
+
+        err = phy_disable_interrupts(phydev);
+
+        if (err)
+                phy_error(phydev);
+
+        free_irq(phydev->irq, phydev);
+
+        return err;
+}
+EXPORT_SYMBOL(phy_stop_interrupts);
+
+
+/* Scheduled by the phy_interrupt/timer to handle PHY changes */
+static void phy_change(void *data)
+{
+        int err;
+        struct phy_device *phydev = data;
+
+        err = phy_disable_interrupts(phydev);
+
+        if (err)
+                goto phy_err;
+
+        spin_lock(&phydev->lock);
+        if ((PHY_RUNNING == phydev->state) || (PHY_NOLINK == phydev->state))
+                phydev->state = PHY_CHANGELINK;
+        spin_unlock(&phydev->lock);
+
+        enable_irq(phydev->irq);
+
+        /* Reenable interrupts */
+        err = phy_config_interrupt(phydev, PHY_INTERRUPT_ENABLED);
+
+        if (err)
+                goto irq_enable_err;
+
+        return;
+
+irq_enable_err:
+        disable_irq(phydev->irq);
+phy_err:
+        phy_error(phydev);
+}
+
+/* Bring down the PHY link, and stop checking the status. */
+void phy_stop(struct phy_device *phydev)
+{
+        spin_lock(&phydev->lock);
+
+        if (PHY_HALTED == phydev->state)
+                goto out_unlock;
+
+        if (phydev->irq != PHY_POLL) {
+                /* Clear any pending interrupts */
+                phy_clear_interrupt(phydev);
+
+                /* Disable PHY Interrupts */
+                phy_config_interrupt(phydev, PHY_INTERRUPT_DISABLED);
+        }
+
+        phydev->state = PHY_HALTED;
+
+out_unlock:
+        spin_unlock(&phydev->lock);
+}
+
+
+/* phy_start
+ *
+ * description: Indicates the attached device's readiness to
+ *   handle PHY-related work.  Used during startup to start the
+ *   PHY, and after a call to phy_stop() to resume operation.
+ *   Also used to indicate the MDIO bus has cleared an error
+ *   condition.
+ */
+void phy_start(struct phy_device *phydev)
+{
+        spin_lock(&phydev->lock);
+
+        switch (phydev->state) {
+                case PHY_STARTING:
+                        phydev->state = PHY_PENDING;
+                        break;
+                case PHY_READY:
+                        phydev->state = PHY_UP;
+                        break;
+                case PHY_HALTED:
+                        phydev->state = PHY_RESUMING;
+                default:
+                        break;
+        }
+        spin_unlock(&phydev->lock);
+}
+EXPORT_SYMBOL(phy_stop);
+EXPORT_SYMBOL(phy_start);
+
+/* PHY timer which handles the state machine */
+static void phy_timer(unsigned long data)
+{
+        struct phy_device *phydev = (struct phy_device *)data;
+        int needs_aneg = 0;
+        int err = 0;
+
+        spin_lock(&phydev->lock);
+
+        if (phydev->adjust_state)
+                phydev->adjust_state(phydev->attached_dev);
+
+        switch(phydev->state) {
+                case PHY_DOWN:
+                case PHY_STARTING:
+                case PHY_READY:
+                case PHY_PENDING:
+                        break;
+                case PHY_UP:
+                        needs_aneg = 1;
+
+                        phydev->link_timeout = PHY_AN_TIMEOUT;
+
+                        break;
+                case PHY_AN:
+                        /* Check if negotiation is done.  Break
+                         * if there's an error */
+                        err = phy_aneg_done(phydev);
+                        if (err < 0)
+                                break;
+
+                        /* If auto-negotiation is done, we change to
+                         * either RUNNING, or NOLINK */
+                        if (err > 0) {
+                                err = phy_read_status(phydev);
+
+                                if (err)
+                                        break;
+
+                                if (phydev->link) {
+                                        phydev->state = PHY_RUNNING;
+                                        netif_carrier_on(phydev->attached_dev);
+                                } else {
+                                        phydev->state = PHY_NOLINK;
+                                        netif_carrier_off(phydev->attached_dev);
+                                }
+
+                                phydev->adjust_link(phydev->attached_dev);
+
+                        } else if (0 == phydev->link_timeout--) {
+                                /* The counter expired, so either we
+                                 * switch to forced mode, or the
+                                 * magic_aneg bit exists, and we try aneg
+                                 * again */
+                                if (!(phydev->drv->flags & PHY_HAS_MAGICANEG)) {
+                                        int idx;
+
+                                        /* We'll start from the
+                                         * fastest speed, and work
+                                         * our way down */
+                                        idx = phy_find_valid(0,
+                                                        phydev->supported);
+
+                                        phydev->speed = settings[idx].speed;
+                                        phydev->duplex = settings[idx].duplex;
+                                        
+                                        phydev->autoneg = AUTONEG_DISABLE;
+                                        phydev->state = PHY_FORCING;
+                                        phydev->link_timeout =
+                                                PHY_FORCE_TIMEOUT;
+
+                                        pr_info("Trying %d/%s\n",
+                                                        phydev->speed,
+                                                        DUPLEX_FULL ==
+                                                        phydev->duplex ?
+                                                        "FULL" : "HALF");
+                                }
+
+                                needs_aneg = 1;
+                        }
+                        break;
+                case PHY_NOLINK:
+                        err = phy_read_status(phydev);
+
+                        if (err)
+                                break;
+
+                        if (phydev->link) {
+                                phydev->state = PHY_RUNNING;
+                                netif_carrier_on(phydev->attached_dev);
+                                phydev->adjust_link(phydev->attached_dev);
+                        }
+                        break;
+                case PHY_FORCING:
+                        err = phy_read_status(phydev);
+
+                        if (err)
+                                break;
+
+                        if (phydev->link) {
+                                phydev->state = PHY_RUNNING;
+                                netif_carrier_on(phydev->attached_dev);
+                        } else {
+                                if (0 == phydev->link_timeout--) {
+                                        phy_force_reduction(phydev);
+                                        needs_aneg = 1;
+                                }
+                        }
+
+                        phydev->adjust_link(phydev->attached_dev);
+                        break;
+                case PHY_RUNNING:
+                        /* Only register a CHANGE if we are
+                         * polling */
+                        if (PHY_POLL == phydev->irq)
+                                phydev->state = PHY_CHANGELINK;
+                        break;
+                case PHY_CHANGELINK:
+                        err = phy_read_status(phydev);
+
+                        if (err)
+                                break;
+
+                        if (phydev->link) {
+                                phydev->state = PHY_RUNNING;
+                                netif_carrier_on(phydev->attached_dev);
+                        } else {
+                                phydev->state = PHY_NOLINK;
+                                netif_carrier_off(phydev->attached_dev);
+                        }
+
+                        phydev->adjust_link(phydev->attached_dev);
+
+                        if (PHY_POLL != phydev->irq)
+                                err = phy_config_interrupt(phydev,
+                                                PHY_INTERRUPT_ENABLED);
+                        break;
+                case PHY_HALTED:
+                        if (phydev->link) {
+                                phydev->link = 0;
+                                netif_carrier_off(phydev->attached_dev);
+                                phydev->adjust_link(phydev->attached_dev);
+                        }
+                        break;
+                case PHY_RESUMING:
+
+                        err = phy_clear_interrupt(phydev);
+
+                        if (err)
+                                break;
+
+                        err = phy_config_interrupt(phydev,
+                                        PHY_INTERRUPT_ENABLED);
+
+                        if (err)
+                                break;
+
+                        if (AUTONEG_ENABLE == phydev->autoneg) {
+                                err = phy_aneg_done(phydev);
+                                if (err < 0)
+                                        break;
+
+                                /* err > 0 if AN is done.
+                                 * Otherwise, it's 0, and we're
+                                 * still waiting for AN */
+                                if (err > 0) {
+                                        phydev->state = PHY_RUNNING;
+                                } else {
+                                        phydev->state = PHY_AN;
+                                        phydev->link_timeout = PHY_AN_TIMEOUT;
+                                }
+                        } else
+                                phydev->state = PHY_RUNNING;
+                        break;
+        }
+
+        spin_unlock(&phydev->lock);
+
+        if (needs_aneg)
+                err = phy_start_aneg(phydev);
+
+        if (err < 0)
+                phy_error(phydev);
+
+        mod_timer(&phydev->phy_timer, jiffies + PHY_STATE_TIME * HZ);
+}
+
+#endif /* CONFIG_PHYCONTROL */
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
new file mode 100644
index 000000000000..33f7bdb5857c
--- /dev/null
+++ b/drivers/net/phy/phy_device.c
@@ -0,0 +1,696 @@
+/*
+ * drivers/net/phy/phy_device.c
+ *
+ * Framework for finding and configuring PHYs.
+ * Also contains generic PHY driver
+ *
+ * Author: Andy Fleming
+ *
+ * Copyright (c) 2004 Freescale Semiconductor, Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ */
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/unistd.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/version.h>
+#include <linux/mii.h>
+#include <linux/ethtool.h>
+#include <linux/phy.h>
+
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/uaccess.h>
+
+static struct phy_driver genphy_driver;
+extern int mdio_bus_init(void);
+extern void mdio_bus_exit(void);
+
+/* get_phy_device
+ *
+ * description: Reads the ID registers of the PHY at addr on the
+ *   bus, then allocates and returns the phy_device to
+ *   represent it.
+ */
+struct phy_device * get_phy_device(struct mii_bus *bus, int addr)
+{
+        int phy_reg;
+        u32 phy_id;
+        struct phy_device *dev = NULL;
+
+        /* Grab the bits from PHYIR1, and put them
+         * in the upper half */
+        phy_reg = bus->read(bus, addr, MII_PHYSID1);
+
+        if (phy_reg < 0)
+                return ERR_PTR(phy_reg);
+
+        phy_id = (phy_reg & 0xffff) << 16;
+
+        /* Grab the bits from PHYIR2, and put them in the lower half */
+        phy_reg = bus->read(bus, addr, MII_PHYSID2);
+
+        if (phy_reg < 0)
+                return ERR_PTR(phy_reg);
+
+        phy_id |= (phy_reg & 0xffff);
+
+        /* If the phy_id is all Fs, there is no device there */
+        if (0xffffffff == phy_id)
+                return NULL;
+
+        /* Otherwise, we allocate the device, and initialize the
+         * default values */
+        dev = kcalloc(1, sizeof(*dev), GFP_KERNEL);
+
+        if (NULL == dev)
+                return ERR_PTR(-ENOMEM);
+
+        dev->speed = 0;
+        dev->duplex = -1;
+        dev->pause = dev->asym_pause = 0;
+        dev->link = 1;
+
+        dev->autoneg = AUTONEG_ENABLE;
+
+        dev->addr = addr;
+        dev->phy_id = phy_id;
+        dev->bus = bus;
+
+        dev->state = PHY_DOWN;
+
+        spin_lock_init(&dev->lock);
+
+        return dev;
+}
+
+#ifdef CONFIG_PHYCONTROL
+/* phy_prepare_link:
+ *
+ * description: Tells the PHY infrastructure to handle the
+ *   gory details on monitoring link status (whether through
+ *   polling or an interrupt), and to call back to the
+ *   connected device driver when the link status changes.
+ *   If you want to monitor your own link state, don't call
+ *   this function */
+void phy_prepare_link(struct phy_device *phydev,
+                void (*handler)(struct net_device *))
+{
+        phydev->adjust_link = handler;
+}
+
+/* phy_connect:
+ *
+ * description: Convenience function for connecting ethernet
+ *   devices to PHY devices.  The default behavior is for
+ *   the PHY infrastructure to handle everything, and only notify
+ *   the connected driver when the link status changes.  If you
+ *   don't want, or can't use the provided functionality, you may
+ *   choose to call only the subset of functions which provide
+ *   the desired functionality.
+ */
+struct phy_device * phy_connect(struct net_device *dev, const char *phy_id,
+                void (*handler)(struct net_device *), u32 flags)
+{
+        struct phy_device *phydev;
+
+        phydev = phy_attach(dev, phy_id, flags);
+
+        if (IS_ERR(phydev))
+                return phydev;
+
+        phy_prepare_link(phydev, handler);
+
+        phy_start_machine(phydev, NULL);
+
+        if (phydev->irq > 0)
+                phy_start_interrupts(phydev);
+
+        return phydev;
+}
+EXPORT_SYMBOL(phy_connect);
+
+void phy_disconnect(struct phy_device *phydev)
+{
+        if (phydev->irq > 0)
+                phy_stop_interrupts(phydev);
+
+        phy_stop_machine(phydev);
+        
+        phydev->adjust_link = NULL;
+
+        phy_detach(phydev);
+}
+EXPORT_SYMBOL(phy_disconnect);
+
+#endif /* CONFIG_PHYCONTROL */
+
+/* phy_attach:
+ *
+ *   description: Called by drivers to attach to a particular PHY
+ *     device. The phy_device is found, and properly hooked up
+ *     to the phy_driver.  If no driver is attached, then the
+ *     genphy_driver is used.  The phy_device is given a ptr to
+ *     the attaching device, and given a callback for link status
+ *     change.  The phy_device is returned to the attaching
+ *     driver.
+ */
+static int phy_compare_id(struct device *dev, void *data)
+{
+        return strcmp((char *)data, dev->bus_id) ? 0 : 1;
+}
+
+struct phy_device *phy_attach(struct net_device *dev,
+                const char *phy_id, u32 flags)
+{
+        struct bus_type *bus = &mdio_bus_type;
+        struct phy_device *phydev;
+        struct device *d;
+
+        /* Search the list of PHY devices on the mdio bus for the
+         * PHY with the requested name */
+        d = bus_find_device(bus, NULL, (void *)phy_id, phy_compare_id);
+
+        if (d) {
+                phydev = to_phy_device(d);
+        } else {
+                printk(KERN_ERR "%s not found\n", phy_id);
+                return ERR_PTR(-ENODEV);
+        }
+
+        /* Assume that if there is no driver, that it doesn't
+         * exist, and we should use the genphy driver. */
+        if (NULL == d->driver) {
+                int err;
+                down_write(&d->bus->subsys.rwsem);
+                d->driver = &genphy_driver.driver;
+
+                err = d->driver->probe(d);
+
+                if (err < 0)
+                        return ERR_PTR(err);
+
+                device_bind_driver(d);
+                up_write(&d->bus->subsys.rwsem);
+        }
+
+        if (phydev->attached_dev) {
+                printk(KERN_ERR "%s: %s already attached\n",
+                                dev->name, phy_id);
+                return ERR_PTR(-EBUSY);
+        }
+
+        phydev->attached_dev = dev;
+
+        phydev->dev_flags = flags;
+
+        return phydev;
+}
+EXPORT_SYMBOL(phy_attach);
+
+void phy_detach(struct phy_device *phydev)
+{
+        phydev->attached_dev = NULL;
+
+        /* If the device had no specific driver before (i.e. - it
+         * was using the generic driver), we unbind the device
+         * from the generic driver so that there's a chance a
+         * real driver could be loaded */
+        if (phydev->dev.driver == &genphy_driver.driver) {
+                down_write(&phydev->dev.bus->subsys.rwsem);
+                device_release_driver(&phydev->dev);
+                up_write(&phydev->dev.bus->subsys.rwsem);
+        }
+}
+EXPORT_SYMBOL(phy_detach);
+
+
+/* Generic PHY support and helper functions */
+
+/* genphy_config_advert
+ *
+ * description: Writes MII_ADVERTISE with the appropriate values,
+ *   after sanitizing the values to make sure we only advertise
+ *   what is supported
+ */
+int genphy_config_advert(struct phy_device *phydev)
+{
+        u32 advertise;
+        int adv;
+        int err;
+
+        /* Only allow advertising what
+         * this PHY supports */
+        phydev->advertising &= phydev->supported;
+        advertise = phydev->advertising;
+
+        /* Setup standard advertisement */
+        adv = phy_read(phydev, MII_ADVERTISE);
+
+        if (adv < 0)
+                return adv;
+
+        adv &= ~(ADVERTISE_ALL | ADVERTISE_100BASE4 | ADVERTISE_PAUSE_CAP | 
+                 ADVERTISE_PAUSE_ASYM);
+        if (advertise & ADVERTISED_10baseT_Half)
+                adv |= ADVERTISE_10HALF;
+        if (advertise & ADVERTISED_10baseT_Full)
+                adv |= ADVERTISE_10FULL;
+        if (advertise & ADVERTISED_100baseT_Half)
+                adv |= ADVERTISE_100HALF;
+        if (advertise & ADVERTISED_100baseT_Full)
+                adv |= ADVERTISE_100FULL;
+        if (advertise & ADVERTISED_Pause)
+                adv |= ADVERTISE_PAUSE_CAP;
+        if (advertise & ADVERTISED_Asym_Pause)
+                adv |= ADVERTISE_PAUSE_ASYM;
+
+        err = phy_write(phydev, MII_ADVERTISE, adv);
+
+        if (err < 0)
+                return err;
+
+        /* Configure gigabit if it's supported */
+        if (phydev->supported & (SUPPORTED_1000baseT_Half |
+                                SUPPORTED_1000baseT_Full)) {
+                adv = phy_read(phydev, MII_CTRL1000);
+
+                if (adv < 0)
+                        return adv;
+
+                adv &= ~(ADVERTISE_1000FULL | ADVERTISE_1000HALF);
+                if (advertise & SUPPORTED_1000baseT_Half)
+                        adv |= ADVERTISE_1000HALF;
+                if (advertise & SUPPORTED_1000baseT_Full)
+                        adv |= ADVERTISE_1000FULL;
+                err = phy_write(phydev, MII_CTRL1000, adv);
+
+                if (err < 0)
+                        return err;
+        }
+
+        return adv;
+}
+EXPORT_SYMBOL(genphy_config_advert);
+
+/* genphy_setup_forced
+ *
+ * description: Configures MII_BMCR to force speed/duplex
+ *   to the values in phydev. Assumes that the values are valid.
+ *   Please see phy_sanitize_settings() */
+int genphy_setup_forced(struct phy_device *phydev)
+{
+        int ctl = BMCR_RESET;
+
+        phydev->pause = phydev->asym_pause = 0;
+
+        if (SPEED_1000 == phydev->speed)
+                ctl |= BMCR_SPEED1000;
+        else if (SPEED_100 == phydev->speed)
+                ctl |= BMCR_SPEED100;
+
+        if (DUPLEX_FULL == phydev->duplex)
+                ctl |= BMCR_FULLDPLX;
+        
+        ctl = phy_write(phydev, MII_BMCR, ctl);
+
+        if (ctl < 0)
+                return ctl;
+
+        /* We just reset the device, so we'd better configure any
+         * settings the PHY requires to operate */
+        if (phydev->drv->config_init)
+                ctl = phydev->drv->config_init(phydev);
+
+        return ctl;
+}
+
+
+/* Enable and Restart Autonegotiation */
+int genphy_restart_aneg(struct phy_device *phydev)
+{
+        int ctl;
+
+        ctl = phy_read(phydev, MII_BMCR);
+
+        if (ctl < 0)
+                return ctl;
+
+        ctl |= (BMCR_ANENABLE | BMCR_ANRESTART);
+
+        /* Don't isolate the PHY if we're negotiating */
+        ctl &= ~(BMCR_ISOLATE);
+
+        ctl = phy_write(phydev, MII_BMCR, ctl);
+
+        return ctl;
+}
+
+
+/* genphy_config_aneg
+ *
+ * description: If auto-negotiation is enabled, we configure the
+ *   advertising, and then restart auto-negotiation.  If it is not
+ *   enabled, then we write the BMCR
+ */
+int genphy_config_aneg(struct phy_device *phydev)
+{
+        int err = 0;
+
+        if (AUTONEG_ENABLE == phydev->autoneg) {
+                err = genphy_config_advert(phydev);
+
+                if (err < 0)
+                        return err;
+
+                err = genphy_restart_aneg(phydev);
+        } else
+                err = genphy_setup_forced(phydev);
+
+        return err;
+}
+EXPORT_SYMBOL(genphy_config_aneg);
+
+/* genphy_update_link
+ *
+ * description: Update the value in phydev->link to reflect the
+ *   current link value.  In order to do this, we need to read
+ *   the status register twice, keeping the second value
+ */
+int genphy_update_link(struct phy_device *phydev)
+{
+        int status;
+
+        /* Do a fake read */
+        status = phy_read(phydev, MII_BMSR);
+
+        if (status < 0)
+                return status;
+
+        /* Read link and autonegotiation status */
+        status = phy_read(phydev, MII_BMSR);
+
+        if (status < 0)
+                return status;
+
+        if ((status & BMSR_LSTATUS) == 0)
+                phydev->link = 0;
+        else
+                phydev->link = 1;
+
+        return 0;
+}
+
+/* genphy_read_status
+ *
+ * description: Check the link, then figure out the current state
+ *   by comparing what we advertise with what the link partner
+ *   advertises.  Start by checking the gigabit possibilities,
+ *   then move on to 10/100.
+ */
+int genphy_read_status(struct phy_device *phydev)
+{
+        int adv;
+        int err;
+        int lpa;
+        int lpagb = 0;
+
+        /* Update the link, but return if there
+         * was an error */
+        err = genphy_update_link(phydev);
+        if (err)
+                return err;
+
+        if (AUTONEG_ENABLE == phydev->autoneg) {
+                if (phydev->supported & (SUPPORTED_1000baseT_Half
+                                        | SUPPORTED_1000baseT_Full)) {
+                        lpagb = phy_read(phydev, MII_STAT1000);
+
+                        if (lpagb < 0)
+                                return lpagb;
+
+                        adv = phy_read(phydev, MII_CTRL1000);
+
+                        if (adv < 0)
+                                return adv;
+
+                        lpagb &= adv << 2;
+                }
+
+                lpa = phy_read(phydev, MII_LPA);
+
+                if (lpa < 0)
+                        return lpa;
+
+                adv = phy_read(phydev, MII_ADVERTISE);
+
+                if (adv < 0)
+                        return adv;
+
+                lpa &= adv;
+
+                phydev->speed = SPEED_10;
+                phydev->duplex = DUPLEX_HALF;
+                phydev->pause = phydev->asym_pause = 0;
+
+                if (lpagb & (LPA_1000FULL | LPA_1000HALF)) {
+                        phydev->speed = SPEED_1000;
+
+                        if (lpagb & LPA_1000FULL)
+                                phydev->duplex = DUPLEX_FULL;
+                } else if (lpa & (LPA_100FULL | LPA_100HALF)) {
+                        phydev->speed = SPEED_100;
+                        
+                        if (lpa & LPA_100FULL)
+                                phydev->duplex = DUPLEX_FULL;
+                } else
+                        if (lpa & LPA_10FULL)
+                                phydev->duplex = DUPLEX_FULL;
+
+                if (phydev->duplex == DUPLEX_FULL){
+                        phydev->pause = lpa & LPA_PAUSE_CAP ? 1 : 0;
+                        phydev->asym_pause = lpa & LPA_PAUSE_ASYM ? 1 : 0;
+                }
+        } else {
+                int bmcr = phy_read(phydev, MII_BMCR);
+                if (bmcr < 0)
+                        return bmcr;
+
+                if (bmcr & BMCR_FULLDPLX)
+                        phydev->duplex = DUPLEX_FULL;
+                else
+                        phydev->duplex = DUPLEX_HALF;
+
+                if (bmcr & BMCR_SPEED1000)
+                        phydev->speed = SPEED_1000;
+                else if (bmcr & BMCR_SPEED100)
+                        phydev->speed = SPEED_100;
+                else
+                        phydev->speed = SPEED_10;
+
+                phydev->pause = phydev->asym_pause = 0;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(genphy_read_status);
+
+static int genphy_config_init(struct phy_device *phydev)
+{
+        u32 val;
+        u32 features;
+
+        /* For now, I'll claim that the generic driver supports
+         * all possible port types */
+        features = (SUPPORTED_TP | SUPPORTED_MII
+                        | SUPPORTED_AUI | SUPPORTED_FIBRE |
+                        SUPPORTED_BNC);
+
+        /* Do we support autonegotiation? */
+        val = phy_read(phydev, MII_BMSR);
+
+        if (val < 0)
+                return val;
+
+        if (val & BMSR_ANEGCAPABLE)
+                features |= SUPPORTED_Autoneg;
+
+        if (val & BMSR_100FULL)
+                features |= SUPPORTED_100baseT_Full;
+        if (val & BMSR_100HALF)
+                features |= SUPPORTED_100baseT_Half;
+        if (val & BMSR_10FULL)
+                features |= SUPPORTED_10baseT_Full;
+        if (val & BMSR_10HALF)
+                features |= SUPPORTED_10baseT_Half;
+
+        if (val & BMSR_ESTATEN) {
+                val = phy_read(phydev, MII_ESTATUS);
+
+                if (val < 0)
+                        return val;
+
+                if (val & ESTATUS_1000_TFULL)
+                        features |= SUPPORTED_1000baseT_Full;
+                if (val & ESTATUS_1000_THALF)
+                        features |= SUPPORTED_1000baseT_Half;
+        }
+
+        phydev->supported = features;
+        phydev->advertising = features;
+
+        return 0;
+}
+
+
+/* phy_probe
+ *
+ * description: Take care of setting up the phy_device structure,
+ *   set the state to READY (the driver's init function should
+ *   set it to STARTING if needed).
+ */
+static int phy_probe(struct device *dev)
+{
+        struct phy_device *phydev;
+        struct phy_driver *phydrv;
+        struct device_driver *drv;
+        int err = 0;
+
+        phydev = to_phy_device(dev);
+
+        /* Make sure the driver is held.
+         * XXX -- Is this correct? */
+        drv = get_driver(phydev->dev.driver);
+        phydrv = to_phy_driver(drv);
+        phydev->drv = phydrv;
+
+        /* Disable the interrupt if the PHY doesn't support it */
+        if (!(phydrv->flags & PHY_HAS_INTERRUPT))
+                phydev->irq = PHY_POLL;
+
+        spin_lock(&phydev->lock);
+
+        /* Start out supporting everything. Eventually,
+         * a controller will attach, and may modify one
+         * or both of these values */
+        phydev->supported = phydrv->features;
+        phydev->advertising = phydrv->features;
+
+        /* Set the state to READY by default */
+        phydev->state = PHY_READY;
+
+        if (phydev->drv->probe)
+                err = phydev->drv->probe(phydev);
+
+        spin_unlock(&phydev->lock);
+
+        if (err < 0)
+                return err;
+
+        if (phydev->drv->config_init)
+                err = phydev->drv->config_init(phydev);
+
+        return err;
+}
+
+static int phy_remove(struct device *dev)
+{
+        struct phy_device *phydev;
+
+        phydev = to_phy_device(dev);
+
+        spin_lock(&phydev->lock);
+        phydev->state = PHY_DOWN;
+        spin_unlock(&phydev->lock);
+
+        if (phydev->drv->remove)
+                phydev->drv->remove(phydev);
+
+        put_driver(dev->driver);
+        phydev->drv = NULL;
+
+        return 0;
+}
+
+int phy_driver_register(struct phy_driver *new_driver)
+{
+        int retval;
+
+        memset(&new_driver->driver, 0, sizeof(new_driver->driver));
+        new_driver->driver.name = new_driver->name;
+        new_driver->driver.bus = &mdio_bus_type;
+        new_driver->driver.probe = phy_probe;
+        new_driver->driver.remove = phy_remove;
+
+        retval = driver_register(&new_driver->driver);
+
+        if (retval) {
+                printk(KERN_ERR "%s: Error %d in registering driver\n",
+                                new_driver->name, retval);
+
+                return retval;
+        }
+
+        pr_info("%s: Registered new driver\n", new_driver->name);
+
+        return 0;
+}
+EXPORT_SYMBOL(phy_driver_register);
+
+void phy_driver_unregister(struct phy_driver *drv)
+{
+        driver_unregister(&drv->driver);
+}
+EXPORT_SYMBOL(phy_driver_unregister);
+
+static struct phy_driver genphy_driver = {
+        .phy_id         = 0xffffffff,
+        .phy_id_mask    = 0xffffffff,
+        .name           = "Generic PHY",
+        .config_init    = genphy_config_init,
+        .features       = 0,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = {.owner= THIS_MODULE, },
+};
+
+static int __init phy_init(void)
+{
+        int rc;
+
+        rc = mdio_bus_init();
+        if (rc)
+                return rc;
+
+        rc = phy_driver_register(&genphy_driver);
+        if (rc)
+                mdio_bus_exit();
+
+        return rc;
+}
+
+static void __exit phy_exit(void)
+{
+        phy_driver_unregister(&genphy_driver);
+        mdio_bus_exit();
+}
+
+subsys_initcall(phy_init);
+module_exit(phy_exit);
diff --git a/drivers/net/phy/qsemi.c b/drivers/net/phy/qsemi.c
new file mode 100644
index 000000000000..d461ba457631
--- /dev/null
+++ b/drivers/net/phy/qsemi.c
@@ -0,0 +1,143 @@
+/*
+ * drivers/net/phy/qsemi.c
+ *
+ * Driver for Quality Semiconductor PHYs
+ *
+ * Author: Andy Fleming
+ *
+ * Copyright (c) 2004 Freescale Semiconductor, Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ */
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/unistd.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/version.h>
+#include <linux/mii.h>
+#include <linux/ethtool.h>
+#include <linux/phy.h>
+
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/uaccess.h>
+
+/* ------------------------------------------------------------------------- */
+/* The Quality Semiconductor QS6612 is used on the RPX CLLF                  */
+
+/* register definitions */
+
+#define MII_QS6612_MCR          17  /* Mode Control Register      */
+#define MII_QS6612_FTR          27  /* Factory Test Register      */
+#define MII_QS6612_MCO          28  /* Misc. Control Register     */
+#define MII_QS6612_ISR          29  /* Interrupt Source Register  */
+#define MII_QS6612_IMR          30  /* Interrupt Mask Register    */
+#define MII_QS6612_IMR_INIT     0x003a
+#define MII_QS6612_PCR          31  /* 100BaseTx PHY Control Reg. */
+
+#define QS6612_PCR_AN_COMPLETE  0x1000
+#define QS6612_PCR_RLBEN        0x0200
+#define QS6612_PCR_DCREN        0x0100
+#define QS6612_PCR_4B5BEN       0x0040
+#define QS6612_PCR_TX_ISOLATE   0x0020
+#define QS6612_PCR_MLT3_DIS     0x0002
+#define QS6612_PCR_SCRM_DESCRM  0x0001
+
+MODULE_DESCRIPTION("Quality Semiconductor PHY driver");
+MODULE_AUTHOR("Andy Fleming");
+MODULE_LICENSE("GPL");
+
+/* Returns 0, unless there's a write error */
+static int qs6612_config_init(struct phy_device *phydev)
+{
+        /* The PHY powers up isolated on the RPX,
+         * so send a command to allow operation.
+         * XXX - My docs indicate this should be 0x0940
+         * ...or something.  The current value sets three
+         * reserved bits, bit 11, which specifies it should be
+         * set to one, bit 10, which specifies it should be set
+         * to 0, and bit 7, which doesn't specify.  However, my
+         * docs are preliminary, and I will leave it like this
+         * until someone more knowledgable corrects me or it.
+         * -- Andy Fleming
+         */
+        return phy_write(phydev, MII_QS6612_PCR, 0x0dc0);
+}
+
+static int qs6612_ack_interrupt(struct phy_device *phydev)
+{
+        int err;
+
+        err = phy_read(phydev, MII_QS6612_ISR);
+
+        if (err < 0)
+                return err;
+
+        err = phy_read(phydev, MII_BMSR);
+
+        if (err < 0)
+                return err;
+
+        err = phy_read(phydev, MII_EXPANSION);
+
+        if (err < 0)
+                return err;
+
+        return 0;
+}
+
+static int qs6612_config_intr(struct phy_device *phydev)
+{
+        int err;
+        if (phydev->interrupts == PHY_INTERRUPT_ENABLED)
+                err = phy_write(phydev, MII_QS6612_IMR,
+                                MII_QS6612_IMR_INIT);
+        else
+                err = phy_write(phydev, MII_QS6612_IMR, 0);
+
+        return err;
+
+}
+
+static struct phy_driver qs6612_driver = {
+        .phy_id         = 0x00181440,
+        .name           = "QS6612",
+        .phy_id_mask    = 0xfffffff0,
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = qs6612_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .ack_interrupt  = qs6612_ack_interrupt,
+        .config_intr    = qs6612_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+};
+
+static int __init qs6612_init(void)
+{
+        return phy_driver_register(&qs6612_driver);
+}
+
+static void __exit qs6612_exit(void)
+{
+        phy_driver_unregister(&qs6612_driver);
+}
+
+module_init(qs6612_init);
+module_exit(qs6612_exit);
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index a32668e88e09..bb71638a7c44 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1657,7 +1657,6 @@ ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb)
                         skb->dev = ppp->dev;
                         skb->protocol = htons(npindex_to_ethertype[npi]);
                         skb->mac.raw = skb->data;
-                        skb->input_dev = ppp->dev;
                         netif_rx(skb);
                         ppp->dev->last_rx = jiffies;
                 }
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index ce1a9bf7b9a7..82f236cc3b9b 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -377,7 +377,8 @@ abort_kfree:
  ***********************************************************************/
 static int pppoe_rcv(struct sk_buff *skb,
                      struct net_device *dev,
-                     struct packet_type *pt)
+                     struct packet_type *pt,
+                     struct net_device *orig_dev)
 
 {
         struct pppoe_hdr *ph;
@@ -426,7 +427,8 @@ out:
  ***********************************************************************/
 static int pppoe_disc_rcv(struct sk_buff *skb,
                           struct net_device *dev,
-                          struct packet_type *pt)
+                          struct packet_type *pt,
+                          struct net_device *orig_dev)
 
 {
         struct pppoe_hdr *ph;
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index d5afe05cd826..f0471d102e3c 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -187,6 +187,7 @@ static struct pci_device_id rtl8169_pci_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_REALTEK,     0x8169), },
         { PCI_DEVICE(PCI_VENDOR_ID_DLINK,       0x4300), },
         { PCI_DEVICE(0x16ec,                    0x0116), },
+        { PCI_VENDOR_ID_LINKSYS,                0x1032, PCI_ANY_ID, 0x0024, },
         {0,},
 };
 
diff --git a/drivers/net/rrunner.c b/drivers/net/rrunner.c
index 12a86f96d973..ec1a18d189a1 100644
--- a/drivers/net/rrunner.c
+++ b/drivers/net/rrunner.c
@@ -1429,6 +1429,7 @@ static int rr_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct rr_private *rrpriv = netdev_priv(dev);
         struct rr_regs __iomem *regs = rrpriv->regs;
+        struct hippi_cb *hcb = (struct hippi_cb *) skb->cb;
         struct ring_ctrl *txctrl;
         unsigned long flags;
         u32 index, len = skb->len;
@@ -1460,7 +1461,7 @@ static int rr_start_xmit(struct sk_buff *skb, struct net_device *dev)
         ifield = (u32 *)skb_push(skb, 8);
 
         ifield[0] = 0;
-        ifield[1] = skb->private.ifield;
+        ifield[1] = hcb->ifield;
 
         /*
          * We don't need the lock before we are actually going to start
diff --git a/drivers/net/s2io-regs.h b/drivers/net/s2io-regs.h
index 7092ca6b277e..2234a8f05eb2 100644
--- a/drivers/net/s2io-regs.h
+++ b/drivers/net/s2io-regs.h
@@ -62,6 +62,7 @@ typedef struct _XENA_dev_config {
 #define ADAPTER_STATUS_RMAC_REMOTE_FAULT   BIT(6)
 #define ADAPTER_STATUS_RMAC_LOCAL_FAULT    BIT(7)
 #define ADAPTER_STATUS_RMAC_PCC_IDLE       vBIT(0xFF,8,8)
+#define ADAPTER_STATUS_RMAC_PCC_FOUR_IDLE  vBIT(0x0F,8,8)
 #define ADAPTER_STATUS_RC_PRC_QUIESCENT    vBIT(0xFF,16,8)
 #define ADAPTER_STATUS_MC_DRAM_READY       BIT(24)
 #define ADAPTER_STATUS_MC_QUEUES_READY     BIT(25)
@@ -77,21 +78,34 @@ typedef struct _XENA_dev_config {
 #define ADAPTER_ECC_EN                     BIT(55)
 
         u64 serr_source;
-#define SERR_SOURCE_PIC                                 BIT(0)
-#define SERR_SOURCE_TXDMA                               BIT(1)
-#define SERR_SOURCE_RXDMA                               BIT(2)
+#define SERR_SOURCE_PIC                 BIT(0)
+#define SERR_SOURCE_TXDMA               BIT(1)
+#define SERR_SOURCE_RXDMA               BIT(2)
 #define SERR_SOURCE_MAC                 BIT(3)
 #define SERR_SOURCE_MC                  BIT(4)
 #define SERR_SOURCE_XGXS                BIT(5)
-#define SERR_SOURCE_ANY                                 (SERR_SOURCE_PIC                | \
-                                                                                SERR_SOURCE_TXDMA       | \
-                                                                                SERR_SOURCE_RXDMA       | \
-                                                                                SERR_SOURCE_MAC         | \
-                                                                                SERR_SOURCE_MC      | \
-                                                                                SERR_SOURCE_XGXS)
-
-
-        u8 unused_0[0x800 - 0x120];
+#define SERR_SOURCE_ANY                 (SERR_SOURCE_PIC        | \
+                                        SERR_SOURCE_TXDMA       | \
+                                        SERR_SOURCE_RXDMA       | \
+                                        SERR_SOURCE_MAC         | \
+                                        SERR_SOURCE_MC          | \
+                                        SERR_SOURCE_XGXS)
+
+        u64 pci_mode;
+#define GET_PCI_MODE(val)               ((val & vBIT(0xF, 0, 4)) >> 60)
+#define PCI_MODE_PCI_33                 0
+#define PCI_MODE_PCI_66                 0x1
+#define PCI_MODE_PCIX_M1_66             0x2
+#define PCI_MODE_PCIX_M1_100            0x3
+#define PCI_MODE_PCIX_M1_133            0x4
+#define PCI_MODE_PCIX_M2_66             0x5
+#define PCI_MODE_PCIX_M2_100            0x6
+#define PCI_MODE_PCIX_M2_133            0x7
+#define PCI_MODE_UNSUPPORTED            BIT(0)
+#define PCI_MODE_32_BITS                BIT(8)
+#define PCI_MODE_UNKNOWN_MODE           BIT(9)
+
+        u8 unused_0[0x800 - 0x128];
 
 /* PCI-X Controller registers */
         u64 pic_int_status;
@@ -153,7 +167,11 @@ typedef struct _XENA_dev_config {
         u8 unused4[0x08];
 
         u64 gpio_int_reg;
+#define GPIO_INT_REG_LINK_DOWN                 BIT(1)
+#define GPIO_INT_REG_LINK_UP                   BIT(2)
         u64 gpio_int_mask;
+#define GPIO_INT_MASK_LINK_DOWN                BIT(1)
+#define GPIO_INT_MASK_LINK_UP                  BIT(2)
         u64 gpio_alarms;
 
         u8 unused5[0x38];
@@ -223,19 +241,16 @@ typedef struct _XENA_dev_config {
         u64 xmsi_data;
 
         u64 rx_mat;
+#define RX_MAT_SET(ring, msi)                   vBIT(msi, (8 * ring), 8)
 
         u8 unused6[0x8];
 
-        u64 tx_mat0_7;
-        u64 tx_mat8_15;
-        u64 tx_mat16_23;
-        u64 tx_mat24_31;
-        u64 tx_mat32_39;
-        u64 tx_mat40_47;
-        u64 tx_mat48_55;
-        u64 tx_mat56_63;
+        u64 tx_mat0_n[0x8];
+#define TX_MAT_SET(fifo, msi)                   vBIT(msi, (8 * fifo), 8)
 
-        u8 unused_1[0x10];
+        u8 unused_1[0x8];
+        u64 stat_byte_cnt;
+#define STAT_BC(n)                              vBIT(n,4,12)
 
         /* Automated statistics collection */
         u64 stat_cfg;
@@ -246,6 +261,7 @@ typedef struct _XENA_dev_config {
 #define STAT_TRSF_PER(n)           TBD
 #define PER_SEC                                    0x208d5
 #define SET_UPDT_PERIOD(n)                 vBIT((PER_SEC*n),32,32)
+#define SET_UPDT_CLICKS(val)               vBIT(val, 32, 32)
 
         u64 stat_addr;
 
@@ -267,8 +283,15 @@ typedef struct _XENA_dev_config {
 
         u64 gpio_control;
 #define GPIO_CTRL_GPIO_0                BIT(8)
+        u64 misc_control;
+#define MISC_LINK_STABILITY_PRD(val)   vBIT(val,29,3)
+
+        u8 unused7_1[0x240 - 0x208];
+
+        u64 wreq_split_mask;
+#define WREQ_SPLIT_MASK_SET_MASK(val)   vBIT(val, 52, 12)
 
-        u8 unused7[0x600];
+        u8 unused7_2[0x800 - 0x248];
 
 /* TxDMA registers */
         u64 txdma_int_status;
@@ -290,6 +313,7 @@ typedef struct _XENA_dev_config {
 
         u64 pcc_err_reg;
 #define PCC_FB_ECC_DB_ERR               vBIT(0xFF, 16, 8)
+#define PCC_ENABLE_FOUR                 vBIT(0x0F,0,8)
 
         u64 pcc_err_mask;
         u64 pcc_err_alarm;
@@ -468,6 +492,7 @@ typedef struct _XENA_dev_config {
 #define PRC_CTRL_NO_SNOOP                      (BIT(22)|BIT(23))
 #define PRC_CTRL_NO_SNOOP_DESC                 BIT(22)
 #define PRC_CTRL_NO_SNOOP_BUFF                 BIT(23)
+#define PRC_CTRL_BIMODAL_INTERRUPT             BIT(37)
 #define PRC_CTRL_RXD_BACKOFF_INTERVAL(val)     vBIT(val,40,24)
 
         u64 prc_alarm_action;
@@ -691,6 +716,10 @@ typedef struct _XENA_dev_config {
 #define MC_ERR_REG_MIRI_CRI_ERR_0          BIT(22)
 #define MC_ERR_REG_MIRI_CRI_ERR_1          BIT(23)
 #define MC_ERR_REG_SM_ERR                  BIT(31)
+#define MC_ERR_REG_ECC_ALL_SNG             (BIT(6) | \
+                                        BIT(7) | BIT(17) | BIT(19))
+#define MC_ERR_REG_ECC_ALL_DBL             (BIT(14) | \
+                                        BIT(15) | BIT(18) | BIT(20))
         u64 mc_err_mask;
         u64 mc_err_alarm;
 
@@ -736,7 +765,19 @@ typedef struct _XENA_dev_config {
         u64 mc_rldram_test_d1;
         u8 unused24[0x300 - 0x288];
         u64 mc_rldram_test_d2;
-        u8 unused25[0x700 - 0x308];
+
+        u8 unused24_1[0x360 - 0x308];
+        u64 mc_rldram_ctrl;
+#define MC_RLDRAM_ENABLE_ODT            BIT(7)
+
+        u8 unused24_2[0x640 - 0x368];
+        u64 mc_rldram_ref_per_herc;
+#define MC_RLDRAM_SET_REF_PERIOD(val)   vBIT(val, 0, 16)
+
+        u8 unused24_3[0x660 - 0x648];
+        u64 mc_rldram_mrs_herc;
+
+        u8 unused25[0x700 - 0x668];
         u64 mc_debug_ctrl;
 
         u8 unused26[0x3000 - 0x2f08];
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index ea638b162d3f..7ca78228b104 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -11,29 +11,28 @@
  * See the file COPYING in this distribution for more information.
  *
  * Credits:
- * Jeff Garzik          : For pointing out the improper error condition 
- *                        check in the s2io_xmit routine and also some 
- *                        issues in the Tx watch dog function. Also for
- *                        patiently answering all those innumerable 
+ * Jeff Garzik          : For pointing out the improper error condition
+ *                        check in the s2io_xmit routine and also some
+ *                        issues in the Tx watch dog function. Also for
+ *                        patiently answering all those innumerable
  *                        questions regaring the 2.6 porting issues.
  * Stephen Hemminger    : Providing proper 2.6 porting mechanism for some
  *                        macros available only in 2.6 Kernel.
- * Francois Romieu      : For pointing out all code part that were 
+ * Francois Romieu      : For pointing out all code part that were
  *                        deprecated and also styling related comments.
- * Grant Grundler       : For helping me get rid of some Architecture 
+ * Grant Grundler       : For helping me get rid of some Architecture
  *                        dependent code.
  * Christopher Hellwig  : Some more 2.6 specific issues in the driver.
- *                              
+ *
  * The module loadable parameters that are supported by the driver and a brief
  * explaination of all the variables.
- * rx_ring_num : This can be used to program the number of receive rings used 
- * in the driver.                                       
- * rx_ring_len: This defines the number of descriptors each ring can have. This 
+ * rx_ring_num : This can be used to program the number of receive rings used
+ * in the driver.
+ * rx_ring_len: This defines the number of descriptors each ring can have. This
  * is also an array of size 8.
  * tx_fifo_num: This defines the number of Tx FIFOs thats used int the driver.
- * tx_fifo_len: This too is an array of 8. Each element defines the number of 
+ * tx_fifo_len: This too is an array of 8. Each element defines the number of
  * Tx descriptors that can be associated with each corresponding FIFO.
- * in PCI Configuration space.
  ************************************************************************/
 
 #include <linux/config.h>
@@ -56,27 +55,39 @@
 #include <linux/ethtool.h>
 #include <linux/version.h>
 #include <linux/workqueue.h>
+#include <linux/if_vlan.h>
 
-#include <asm/io.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
+#include <asm/io.h>
 
 /* local include */
 #include "s2io.h"
 #include "s2io-regs.h"
 
 /* S2io Driver name & version. */
-static char s2io_driver_name[] = "s2io";
-static char s2io_driver_version[] = "Version 1.7.7.1";
+static char s2io_driver_name[] = "Neterion";
+static char s2io_driver_version[] = "Version 2.0.3.1";
+
+static inline int RXD_IS_UP2DT(RxD_t *rxdp)
+{
+        int ret;
+
+        ret = ((!(rxdp->Control_1 & RXD_OWN_XENA)) &&
+                (GET_RXD_MARKER(rxdp->Control_2) != THE_RXD_MARK));
 
-/* 
+        return ret;
+}
+
+/*
  * Cards with following subsystem_id have a link state indication
  * problem, 600B, 600C, 600D, 640B, 640C and 640D.
  * macro below identifies these cards given the subsystem_id.
  */
-#define CARDS_WITH_FAULTY_LINK_INDICATORS(subid) \
-                (((subid >= 0x600B) && (subid <= 0x600D)) || \
-                 ((subid >= 0x640B) && (subid <= 0x640D))) ? 1 : 0
+#define CARDS_WITH_FAULTY_LINK_INDICATORS(dev_type, subid) \
+        (dev_type == XFRAME_I_DEVICE) ?                 \
+                ((((subid >= 0x600B) && (subid <= 0x600D)) || \
+                 ((subid >= 0x640B) && (subid <= 0x640D))) ? 1 : 0) : 0
 
 #define LINK_IS_UP(val64) (!(val64 & (ADAPTER_STATUS_RMAC_REMOTE_FAULT | \
                                       ADAPTER_STATUS_RMAC_LOCAL_FAULT)))
@@ -86,9 +97,12 @@ static char s2io_driver_version[] = "Version 1.7.7.1";
 static inline int rx_buffer_level(nic_t * sp, int rxb_size, int ring)
 {
         int level = 0;
-        if ((sp->pkt_cnt[ring] - rxb_size) > 16) {
+        mac_info_t *mac_control;
+
+        mac_control = &sp->mac_control;
+        if ((mac_control->rings[ring].pkt_cnt - rxb_size) > 16) {
                 level = LOW;
-                if ((sp->pkt_cnt[ring] - rxb_size) < MAX_RXDS_PER_BLOCK) {
+                if (rxb_size <= MAX_RXDS_PER_BLOCK) {
                         level = PANIC;
                 }
         }
@@ -145,6 +159,9 @@ static char ethtool_stats_keys[][ETH_GSTRING_LEN] = {
         {"rmac_pause_cnt"},
         {"rmac_accepted_ip"},
         {"rmac_err_tcp"},
+        {"\n DRIVER STATISTICS"},
+        {"single_bit_ecc_errs"},
+        {"double_bit_ecc_errs"},
 };
 
 #define S2IO_STAT_LEN sizeof(ethtool_stats_keys)/ ETH_GSTRING_LEN
@@ -153,8 +170,37 @@ static char ethtool_stats_keys[][ETH_GSTRING_LEN] = {
 #define S2IO_TEST_LEN   sizeof(s2io_gstrings) / ETH_GSTRING_LEN
 #define S2IO_STRINGS_LEN        S2IO_TEST_LEN * ETH_GSTRING_LEN
 
+#define S2IO_TIMER_CONF(timer, handle, arg, exp)                \
+                        init_timer(&timer);                     \
+                        timer.function = handle;                \
+                        timer.data = (unsigned long) arg;       \
+                        mod_timer(&timer, (jiffies + exp))      \
+
+/* Add the vlan */
+static void s2io_vlan_rx_register(struct net_device *dev,
+                                        struct vlan_group *grp)
+{
+        nic_t *nic = dev->priv;
+        unsigned long flags;
+
+        spin_lock_irqsave(&nic->tx_lock, flags);
+        nic->vlgrp = grp;
+        spin_unlock_irqrestore(&nic->tx_lock, flags);
+}
+
+/* Unregister the vlan */
+static void s2io_vlan_rx_kill_vid(struct net_device *dev, unsigned long vid)
+{
+        nic_t *nic = dev->priv;
+        unsigned long flags;
+
+        spin_lock_irqsave(&nic->tx_lock, flags);
+        if (nic->vlgrp)
+                nic->vlgrp->vlan_devices[vid] = NULL;
+        spin_unlock_irqrestore(&nic->tx_lock, flags);
+}
 
-/* 
+/*
  * Constants to be programmed into the Xena's registers, to configure
  * the XAUI.
  */
@@ -162,7 +208,28 @@ static char ethtool_stats_keys[][ETH_GSTRING_LEN] = {
 #define SWITCH_SIGN     0xA5A5A5A5A5A5A5A5ULL
 #define END_SIGN        0x0
 
-static u64 default_mdio_cfg[] = {
+static u64 herc_act_dtx_cfg[] = {
+        /* Set address */
+        0x8000051536750000ULL, 0x80000515367500E0ULL,
+        /* Write data */
+        0x8000051536750004ULL, 0x80000515367500E4ULL,
+        /* Set address */
+        0x80010515003F0000ULL, 0x80010515003F00E0ULL,
+        /* Write data */
+        0x80010515003F0004ULL, 0x80010515003F00E4ULL,
+        /* Set address */
+        0x801205150D440000ULL, 0x801205150D4400E0ULL,
+        /* Write data */
+        0x801205150D440004ULL, 0x801205150D4400E4ULL,
+        /* Set address */
+        0x80020515F2100000ULL, 0x80020515F21000E0ULL,
+        /* Write data */
+        0x80020515F2100004ULL, 0x80020515F21000E4ULL,
+        /* Done */
+        END_SIGN
+};
+
+static u64 xena_mdio_cfg[] = {
         /* Reset PMA PLL */
         0xC001010000000000ULL, 0xC0010100000000E0ULL,
         0xC0010100008000E4ULL,
@@ -172,7 +239,7 @@ static u64 default_mdio_cfg[] = {
         END_SIGN
 };
 
-static u64 default_dtx_cfg[] = {
+static u64 xena_dtx_cfg[] = {
         0x8000051500000000ULL, 0x80000515000000E0ULL,
         0x80000515D93500E4ULL, 0x8001051500000000ULL,
         0x80010515000000E0ULL, 0x80010515001E00E4ULL,
@@ -196,8 +263,7 @@ static u64 default_dtx_cfg[] = {
         END_SIGN
 };
 
-
-/* 
+/*
  * Constants for Fixing the MacAddress problem seen mostly on
  * Alpha machines.
  */
@@ -226,20 +292,25 @@ static unsigned int tx_fifo_len[MAX_TX_FIFOS] =
 static unsigned int rx_ring_num = 1;
 static unsigned int rx_ring_sz[MAX_RX_RINGS] =
     {[0 ...(MAX_RX_RINGS - 1)] = 0 };
-static unsigned int Stats_refresh_time = 4;
+static unsigned int rts_frm_len[MAX_RX_RINGS] =
+    {[0 ...(MAX_RX_RINGS - 1)] = 0 };
+static unsigned int use_continuous_tx_intrs = 1;
 static unsigned int rmac_pause_time = 65535;
 static unsigned int mc_pause_threshold_q0q3 = 187;
 static unsigned int mc_pause_threshold_q4q7 = 187;
 static unsigned int shared_splits;
 static unsigned int tmac_util_period = 5;
 static unsigned int rmac_util_period = 5;
+static unsigned int bimodal = 0;
 #ifndef CONFIG_S2IO_NAPI
 static unsigned int indicate_max_pkts;
 #endif
+/* Frequency of Rx desc syncs expressed as power of 2 */
+static unsigned int rxsync_frequency = 3;
 
-/* 
+/*
  * S2IO device table.
- * This table lists all the devices that this driver supports. 
+ * This table lists all the devices that this driver supports.
  */
 static struct pci_device_id s2io_tbl[] __devinitdata = {
         {PCI_VENDOR_ID_S2IO, PCI_DEVICE_ID_S2IO_WIN,
@@ -247,9 +318,9 @@ static struct pci_device_id s2io_tbl[] __devinitdata = {
         {PCI_VENDOR_ID_S2IO, PCI_DEVICE_ID_S2IO_UNI,
          PCI_ANY_ID, PCI_ANY_ID},
         {PCI_VENDOR_ID_S2IO, PCI_DEVICE_ID_HERC_WIN,
-         PCI_ANY_ID, PCI_ANY_ID},
-        {PCI_VENDOR_ID_S2IO, PCI_DEVICE_ID_HERC_UNI,
-         PCI_ANY_ID, PCI_ANY_ID},
+         PCI_ANY_ID, PCI_ANY_ID},
+        {PCI_VENDOR_ID_S2IO, PCI_DEVICE_ID_HERC_UNI,
+         PCI_ANY_ID, PCI_ANY_ID},
         {0,}
 };
 
@@ -268,8 +339,8 @@ static struct pci_driver s2io_driver = {
 /**
  * init_shared_mem - Allocation and Initialization of Memory
  * @nic: Device private variable.
- * Description: The function allocates all the memory areas shared 
- * between the NIC and the driver. This includes Tx descriptors, 
+ * Description: The function allocates all the memory areas shared
+ * between the NIC and the driver. This includes Tx descriptors,
  * Rx descriptors and the statistics block.
  */
 
@@ -279,11 +350,11 @@ static int init_shared_mem(struct s2io_nic *nic)
         void *tmp_v_addr, *tmp_v_addr_next;
         dma_addr_t tmp_p_addr, tmp_p_addr_next;
         RxD_block_t *pre_rxd_blk = NULL;
-        int i, j, blk_cnt;
+        int i, j, blk_cnt, rx_sz, tx_sz;
         int lst_size, lst_per_page;
         struct net_device *dev = nic->dev;
 #ifdef CONFIG_2BUFF_MODE
-        unsigned long tmp;
+        u64 tmp;
         buffAdd_t *ba;
 #endif
 
@@ -300,36 +371,41 @@ static int init_shared_mem(struct s2io_nic *nic)
                 size += config->tx_cfg[i].fifo_len;
         }
         if (size > MAX_AVAILABLE_TXDS) {
-                DBG_PRINT(ERR_DBG, "%s: Total number of Tx FIFOs ",
-                          dev->name);
-                DBG_PRINT(ERR_DBG, "exceeds the maximum value ");
-                DBG_PRINT(ERR_DBG, "that can be used\n");
+                DBG_PRINT(ERR_DBG, "%s: Requested TxDs too high, ",
+                          __FUNCTION__);
+                DBG_PRINT(ERR_DBG, "Requested: %d, max supported: 8192\n", size);
                 return FAILURE;
         }
 
         lst_size = (sizeof(TxD_t) * config->max_txds);
+        tx_sz = lst_size * size;
         lst_per_page = PAGE_SIZE / lst_size;
 
         for (i = 0; i < config->tx_fifo_num; i++) {
                 int fifo_len = config->tx_cfg[i].fifo_len;
                 int list_holder_size = fifo_len * sizeof(list_info_hold_t);
-                nic->list_info[i] = kmalloc(list_holder_size, GFP_KERNEL);
-                if (!nic->list_info[i]) {
+                mac_control->fifos[i].list_info = kmalloc(list_holder_size,
+                                                          GFP_KERNEL);
+                if (!mac_control->fifos[i].list_info) {
                         DBG_PRINT(ERR_DBG,
                                   "Malloc failed for list_info\n");
                         return -ENOMEM;
                 }
-                memset(nic->list_info[i], 0, list_holder_size);
+                memset(mac_control->fifos[i].list_info, 0, list_holder_size);
         }
         for (i = 0; i < config->tx_fifo_num; i++) {
                 int page_num = TXD_MEM_PAGE_CNT(config->tx_cfg[i].fifo_len,
                                                 lst_per_page);
-                mac_control->tx_curr_put_info[i].offset = 0;
-                mac_control->tx_curr_put_info[i].fifo_len =
+                mac_control->fifos[i].tx_curr_put_info.offset = 0;
+                mac_control->fifos[i].tx_curr_put_info.fifo_len =
                     config->tx_cfg[i].fifo_len - 1;
-                mac_control->tx_curr_get_info[i].offset = 0;
-                mac_control->tx_curr_get_info[i].fifo_len =
+                mac_control->fifos[i].tx_curr_get_info.offset = 0;
+                mac_control->fifos[i].tx_curr_get_info.fifo_len =
                     config->tx_cfg[i].fifo_len - 1;
+                mac_control->fifos[i].fifo_no = i;
+                mac_control->fifos[i].nic = nic;
+                mac_control->fifos[i].max_txds = MAX_SKB_FRAGS;
+
                 for (j = 0; j < page_num; j++) {
                         int k = 0;
                         dma_addr_t tmp_p;
@@ -345,16 +421,15 @@ static int init_shared_mem(struct s2io_nic *nic)
                         while (k < lst_per_page) {
                                 int l = (j * lst_per_page) + k;
                                 if (l == config->tx_cfg[i].fifo_len)
-                                        goto end_txd_alloc;
-                                nic->list_info[i][l].list_virt_addr =
+                                        break;
+                                mac_control->fifos[i].list_info[l].list_virt_addr =
                                     tmp_v + (k * lst_size);
-                                nic->list_info[i][l].list_phy_addr =
+                                mac_control->fifos[i].list_info[l].list_phy_addr =
                                     tmp_p + (k * lst_size);
                                 k++;
                         }
                 }
         }
-      end_txd_alloc:
 
         /* Allocation and initialization of RXDs in Rings */
         size = 0;
@@ -367,21 +442,26 @@ static int init_shared_mem(struct s2io_nic *nic)
                         return FAILURE;
                 }
                 size += config->rx_cfg[i].num_rxd;
-                nic->block_count[i] =
+                mac_control->rings[i].block_count =
                     config->rx_cfg[i].num_rxd / (MAX_RXDS_PER_BLOCK + 1);
-                nic->pkt_cnt[i] =
-                    config->rx_cfg[i].num_rxd - nic->block_count[i];
+                mac_control->rings[i].pkt_cnt =
+                    config->rx_cfg[i].num_rxd - mac_control->rings[i].block_count;
         }
+        size = (size * (sizeof(RxD_t)));
+        rx_sz = size;
 
         for (i = 0; i < config->rx_ring_num; i++) {
-                mac_control->rx_curr_get_info[i].block_index = 0;
-                mac_control->rx_curr_get_info[i].offset = 0;
-                mac_control->rx_curr_get_info[i].ring_len =
+                mac_control->rings[i].rx_curr_get_info.block_index = 0;
+                mac_control->rings[i].rx_curr_get_info.offset = 0;
+                mac_control->rings[i].rx_curr_get_info.ring_len =
                     config->rx_cfg[i].num_rxd - 1;
-                mac_control->rx_curr_put_info[i].block_index = 0;
-                mac_control->rx_curr_put_info[i].offset = 0;
-                mac_control->rx_curr_put_info[i].ring_len =
+                mac_control->rings[i].rx_curr_put_info.block_index = 0;
+                mac_control->rings[i].rx_curr_put_info.offset = 0;
+                mac_control->rings[i].rx_curr_put_info.ring_len =
                     config->rx_cfg[i].num_rxd - 1;
+                mac_control->rings[i].nic = nic;
+                mac_control->rings[i].ring_no = i;
+
                 blk_cnt =
                     config->rx_cfg[i].num_rxd / (MAX_RXDS_PER_BLOCK + 1);
                 /*  Allocating all the Rx blocks */
@@ -395,32 +475,36 @@ static int init_shared_mem(struct s2io_nic *nic)
                                                           &tmp_p_addr);
                         if (tmp_v_addr == NULL) {
                                 /*
-                                 * In case of failure, free_shared_mem() 
-                                 * is called, which should free any 
-                                 * memory that was alloced till the 
+                                 * In case of failure, free_shared_mem()
+                                 * is called, which should free any
+                                 * memory that was alloced till the
                                  * failure happened.
                                  */
-                                nic->rx_blocks[i][j].block_virt_addr =
+                                mac_control->rings[i].rx_blocks[j].block_virt_addr =
                                     tmp_v_addr;
                                 return -ENOMEM;
                         }
                         memset(tmp_v_addr, 0, size);
-                        nic->rx_blocks[i][j].block_virt_addr = tmp_v_addr;
-                        nic->rx_blocks[i][j].block_dma_addr = tmp_p_addr;
+                        mac_control->rings[i].rx_blocks[j].block_virt_addr =
+                                tmp_v_addr;
+                        mac_control->rings[i].rx_blocks[j].block_dma_addr =
+                                tmp_p_addr;
                 }
                 /* Interlinking all Rx Blocks */
                 for (j = 0; j < blk_cnt; j++) {
-                        tmp_v_addr = nic->rx_blocks[i][j].block_virt_addr;
+                        tmp_v_addr =
+                                mac_control->rings[i].rx_blocks[j].block_virt_addr;
                         tmp_v_addr_next =
-                            nic->rx_blocks[i][(j + 1) %
+                                mac_control->rings[i].rx_blocks[(j + 1) %
                                               blk_cnt].block_virt_addr;
-                        tmp_p_addr = nic->rx_blocks[i][j].block_dma_addr;
+                        tmp_p_addr =
+                                mac_control->rings[i].rx_blocks[j].block_dma_addr;
                         tmp_p_addr_next =
-                            nic->rx_blocks[i][(j + 1) %
+                                mac_control->rings[i].rx_blocks[(j + 1) %
                                               blk_cnt].block_dma_addr;
 
                         pre_rxd_blk = (RxD_block_t *) tmp_v_addr;
-                        pre_rxd_blk->reserved_1 = END_OF_BLOCK; /* last RxD 
+                        pre_rxd_blk->reserved_1 = END_OF_BLOCK; /* last RxD
                                                                  * marker.
                                                                  */
 #ifndef CONFIG_2BUFF_MODE
@@ -433,43 +517,43 @@ static int init_shared_mem(struct s2io_nic *nic)
         }
 
 #ifdef CONFIG_2BUFF_MODE
-        /* 
+        /*
          * Allocation of Storages for buffer addresses in 2BUFF mode
          * and the buffers as well.
          */
         for (i = 0; i < config->rx_ring_num; i++) {
                 blk_cnt =
                     config->rx_cfg[i].num_rxd / (MAX_RXDS_PER_BLOCK + 1);
-                nic->ba[i] = kmalloc((sizeof(buffAdd_t *) * blk_cnt),
+                mac_control->rings[i].ba = kmalloc((sizeof(buffAdd_t *) * blk_cnt),
                                      GFP_KERNEL);
-                if (!nic->ba[i])
+                if (!mac_control->rings[i].ba)
                         return -ENOMEM;
                 for (j = 0; j < blk_cnt; j++) {
                         int k = 0;
-                        nic->ba[i][j] = kmalloc((sizeof(buffAdd_t) *
+                        mac_control->rings[i].ba[j] = kmalloc((sizeof(buffAdd_t) *
                                                  (MAX_RXDS_PER_BLOCK + 1)),
                                                 GFP_KERNEL);
-                        if (!nic->ba[i][j])
+                        if (!mac_control->rings[i].ba[j])
                                 return -ENOMEM;
                         while (k != MAX_RXDS_PER_BLOCK) {
-                                ba = &nic->ba[i][j][k];
+                                ba = &mac_control->rings[i].ba[j][k];
 
-                                ba->ba_0_org = kmalloc
+                                ba->ba_0_org = (void *) kmalloc
                                     (BUF0_LEN + ALIGN_SIZE, GFP_KERNEL);
                                 if (!ba->ba_0_org)
                                         return -ENOMEM;
-                                tmp = (unsigned long) ba->ba_0_org;
+                                tmp = (u64) ba->ba_0_org;
                                 tmp += ALIGN_SIZE;
-                                tmp &= ~((unsigned long) ALIGN_SIZE);
+                                tmp &= ~((u64) ALIGN_SIZE);
                                 ba->ba_0 = (void *) tmp;
 
-                                ba->ba_1_org = kmalloc
+                                ba->ba_1_org = (void *) kmalloc
                                     (BUF1_LEN + ALIGN_SIZE, GFP_KERNEL);
                                 if (!ba->ba_1_org)
                                         return -ENOMEM;
-                                tmp = (unsigned long) ba->ba_1_org;
+                                tmp = (u64) ba->ba_1_org;
                                 tmp += ALIGN_SIZE;
-                                tmp &= ~((unsigned long) ALIGN_SIZE);
+                                tmp &= ~((u64) ALIGN_SIZE);
                                 ba->ba_1 = (void *) tmp;
                                 k++;
                         }
@@ -483,9 +567,9 @@ static int init_shared_mem(struct s2io_nic *nic)
             (nic->pdev, size, &mac_control->stats_mem_phy);
 
         if (!mac_control->stats_mem) {
-                /* 
-                 * In case of failure, free_shared_mem() is called, which 
-                 * should free any memory that was alloced till the 
+                /*
+                 * In case of failure, free_shared_mem() is called, which
+                 * should free any memory that was alloced till the
                  * failure happened.
                  */
                 return -ENOMEM;
@@ -495,15 +579,14 @@ static int init_shared_mem(struct s2io_nic *nic)
         tmp_v_addr = mac_control->stats_mem;
         mac_control->stats_info = (StatInfo_t *) tmp_v_addr;
         memset(tmp_v_addr, 0, size);
-
         DBG_PRINT(INIT_DBG, "%s:Ring Mem PHY: 0x%llx\n", dev->name,
                   (unsigned long long) tmp_p_addr);
 
         return SUCCESS;
 }
 
-/**  
- * free_shared_mem - Free the allocated Memory 
+/**
+ * free_shared_mem - Free the allocated Memory
  * @nic:  Device private variable.
  * Description: This function is to free all memory locations allocated by
  * the init_shared_mem() function and return it to the kernel.
@@ -533,15 +616,19 @@ static void free_shared_mem(struct s2io_nic *nic)
                                                 lst_per_page);
                 for (j = 0; j < page_num; j++) {
                         int mem_blks = (j * lst_per_page);
-                        if (!nic->list_info[i][mem_blks].list_virt_addr)
+                        if ((!mac_control->fifos[i].list_info) ||
+                                (!mac_control->fifos[i].list_info[mem_blks].
+                                 list_virt_addr))
                                 break;
                         pci_free_consistent(nic->pdev, PAGE_SIZE,
-                                            nic->list_info[i][mem_blks].
+                                            mac_control->fifos[i].
+                                            list_info[mem_blks].
                                             list_virt_addr,
-                                            nic->list_info[i][mem_blks].
+                                            mac_control->fifos[i].
+                                            list_info[mem_blks].
                                             list_phy_addr);
                 }
-                kfree(nic->list_info[i]);
+                kfree(mac_control->fifos[i].list_info);
         }
 
 #ifndef CONFIG_2BUFF_MODE
@@ -550,10 +637,12 @@ static void free_shared_mem(struct s2io_nic *nic)
         size = SIZE_OF_BLOCK;
 #endif
         for (i = 0; i < config->rx_ring_num; i++) {
-                blk_cnt = nic->block_count[i];
+                blk_cnt = mac_control->rings[i].block_count;
                 for (j = 0; j < blk_cnt; j++) {
-                        tmp_v_addr = nic->rx_blocks[i][j].block_virt_addr;
-                        tmp_p_addr = nic->rx_blocks[i][j].block_dma_addr;
+                        tmp_v_addr = mac_control->rings[i].rx_blocks[j].
+                                block_virt_addr;
+                        tmp_p_addr = mac_control->rings[i].rx_blocks[j].
+                                block_dma_addr;
                         if (tmp_v_addr == NULL)
                                 break;
                         pci_free_consistent(nic->pdev, size,
@@ -566,35 +655,21 @@ static void free_shared_mem(struct s2io_nic *nic)
         for (i = 0; i < config->rx_ring_num; i++) {
                 blk_cnt =
                     config->rx_cfg[i].num_rxd / (MAX_RXDS_PER_BLOCK + 1);
-                if (!nic->ba[i])
-                        goto end_free;
                 for (j = 0; j < blk_cnt; j++) {
                         int k = 0;
-                        if (!nic->ba[i][j]) {
-                                kfree(nic->ba[i]);
-                                goto end_free;
-                        }
+                        if (!mac_control->rings[i].ba[j])
+                                continue;
                         while (k != MAX_RXDS_PER_BLOCK) {
-                                buffAdd_t *ba = &nic->ba[i][j][k];
-                                if (!ba || !ba->ba_0_org || !ba->ba_1_org)
-                                {
-                                        kfree(nic->ba[i]);
-                                        kfree(nic->ba[i][j]);
-                                        if(ba->ba_0_org)
-                                                kfree(ba->ba_0_org);
-                                        if(ba->ba_1_org)
-                                                kfree(ba->ba_1_org);
-                                        goto end_free;
-                                }
+                                buffAdd_t *ba = &mac_control->rings[i].ba[j][k];
                                 kfree(ba->ba_0_org);
                                 kfree(ba->ba_1_org);
                                 k++;
                         }
-                        kfree(nic->ba[i][j]);
+                        kfree(mac_control->rings[i].ba[j]);
                 }
-                kfree(nic->ba[i]);
+                if (mac_control->rings[i].ba)
+                        kfree(mac_control->rings[i].ba);
         }
-end_free:
 #endif
 
         if (mac_control->stats_mem) {
@@ -605,12 +680,93 @@ end_free:
         }
 }
 
-/**  
- *  init_nic - Initialization of hardware 
+/**
+ * s2io_verify_pci_mode -
+ */
+
+static int s2io_verify_pci_mode(nic_t *nic)
+{
+        XENA_dev_config_t *bar0 = (XENA_dev_config_t *) nic->bar0;
+        register u64 val64 = 0;
+        int     mode;
+
+        val64 = readq(&bar0->pci_mode);
+        mode = (u8)GET_PCI_MODE(val64);
+
+        if ( val64 & PCI_MODE_UNKNOWN_MODE)
+                return -1;      /* Unknown PCI mode */
+        return mode;
+}
+
+
+/**
+ * s2io_print_pci_mode -
+ */
+static int s2io_print_pci_mode(nic_t *nic)
+{
+        XENA_dev_config_t *bar0 = (XENA_dev_config_t *) nic->bar0;
+        register u64 val64 = 0;
+        int     mode;
+        struct config_param *config = &nic->config;
+
+        val64 = readq(&bar0->pci_mode);
+        mode = (u8)GET_PCI_MODE(val64);
+
+        if ( val64 & PCI_MODE_UNKNOWN_MODE)
+                return -1;      /* Unknown PCI mode */
+
+        if (val64 & PCI_MODE_32_BITS) {
+                DBG_PRINT(ERR_DBG, "%s: Device is on 32 bit ", nic->dev->name);
+        } else {
+                DBG_PRINT(ERR_DBG, "%s: Device is on 64 bit ", nic->dev->name);
+        }
+
+        switch(mode) {
+                case PCI_MODE_PCI_33:
+                        DBG_PRINT(ERR_DBG, "33MHz PCI bus\n");
+                        config->bus_speed = 33;
+                        break;
+                case PCI_MODE_PCI_66:
+                        DBG_PRINT(ERR_DBG, "66MHz PCI bus\n");
+                        config->bus_speed = 133;
+                        break;
+                case PCI_MODE_PCIX_M1_66:
+                        DBG_PRINT(ERR_DBG, "66MHz PCIX(M1) bus\n");
+                        config->bus_speed = 133; /* Herc doubles the clock rate */
+                        break;
+                case PCI_MODE_PCIX_M1_100:
+                        DBG_PRINT(ERR_DBG, "100MHz PCIX(M1) bus\n");
+                        config->bus_speed = 200;
+                        break;
+                case PCI_MODE_PCIX_M1_133:
+                        DBG_PRINT(ERR_DBG, "133MHz PCIX(M1) bus\n");
+                        config->bus_speed = 266;
+                        break;
+                case PCI_MODE_PCIX_M2_66:
+                        DBG_PRINT(ERR_DBG, "133MHz PCIX(M2) bus\n");
+                        config->bus_speed = 133;
+                        break;
+                case PCI_MODE_PCIX_M2_100:
+                        DBG_PRINT(ERR_DBG, "200MHz PCIX(M2) bus\n");
+                        config->bus_speed = 200;
+                        break;
+                case PCI_MODE_PCIX_M2_133:
+                        DBG_PRINT(ERR_DBG, "266MHz PCIX(M2) bus\n");
+                        config->bus_speed = 266;
+                        break;
+                default:
+                        return -1;      /* Unsupported bus speed */
+        }
+
+        return mode;
+}
+
+/**
+ *  init_nic - Initialization of hardware
  *  @nic: device peivate variable
- *  Description: The function sequentially configures every block 
- *  of the H/W from their reset values. 
- *  Return Value:  SUCCESS on success and 
+ *  Description: The function sequentially configures every block
+ *  of the H/W from their reset values.
+ *  Return Value:  SUCCESS on success and
  *  '-1' on failure (endian settings incorrect).
  */
 
@@ -626,21 +782,32 @@ static int init_nic(struct s2io_nic *nic)
         struct config_param *config;
         int mdio_cnt = 0, dtx_cnt = 0;
         unsigned long long mem_share;
+        int mem_size;
 
         mac_control = &nic->mac_control;
         config = &nic->config;
 
-        /* Initialize swapper control register */
-        if (s2io_set_swapper(nic)) {
+        /* to set the swapper controle on the card */
+        if(s2io_set_swapper(nic)) {
                 DBG_PRINT(ERR_DBG,"ERROR: Setting Swapper failed\n");
                 return -1;
         }
 
+        /*
+         * Herc requires EOI to be removed from reset before XGXS, so..
+         */
+        if (nic->device_type & XFRAME_II_DEVICE) {
+                val64 = 0xA500000000ULL;
+                writeq(val64, &bar0->sw_reset);
+                msleep(500);
+                val64 = readq(&bar0->sw_reset);
+        }
+
         /* Remove XGXS from reset state */
         val64 = 0;
         writeq(val64, &bar0->sw_reset);
-        val64 = readq(&bar0->sw_reset);
         msleep(500);
+        val64 = readq(&bar0->sw_reset);
 
         /*  Enable Receiving broadcasts */
         add = &bar0->mac_cfg;
@@ -660,48 +827,58 @@ static int init_nic(struct s2io_nic *nic)
         val64 = dev->mtu;
         writeq(vBIT(val64, 2, 14), &bar0->rmac_max_pyld_len);
 
-        /* 
-         * Configuring the XAUI Interface of Xena. 
+        /*
+         * Configuring the XAUI Interface of Xena.
          * ***************************************
-         * To Configure the Xena's XAUI, one has to write a series 
-         * of 64 bit values into two registers in a particular 
-         * sequence. Hence a macro 'SWITCH_SIGN' has been defined 
-         * which will be defined in the array of configuration values 
-         * (default_dtx_cfg & default_mdio_cfg) at appropriate places 
-         * to switch writing from one regsiter to another. We continue 
+         * To Configure the Xena's XAUI, one has to write a series
+         * of 64 bit values into two registers in a particular
+         * sequence. Hence a macro 'SWITCH_SIGN' has been defined
+         * which will be defined in the array of configuration values
+         * (xena_dtx_cfg & xena_mdio_cfg) at appropriate places
+         * to switch writing from one regsiter to another. We continue
          * writing these values until we encounter the 'END_SIGN' macro.
-         * For example, After making a series of 21 writes into 
-         * dtx_control register the 'SWITCH_SIGN' appears and hence we 
+         * For example, After making a series of 21 writes into
+         * dtx_control register the 'SWITCH_SIGN' appears and hence we
          * start writing into mdio_control until we encounter END_SIGN.
          */
-        while (1) {
-              dtx_cfg:
-                while (default_dtx_cfg[dtx_cnt] != END_SIGN) {
-                        if (default_dtx_cfg[dtx_cnt] == SWITCH_SIGN) {
-                                dtx_cnt++;
-                                goto mdio_cfg;
-                        }
-                        SPECIAL_REG_WRITE(default_dtx_cfg[dtx_cnt],
+        if (nic->device_type & XFRAME_II_DEVICE) {
+                while (herc_act_dtx_cfg[dtx_cnt] != END_SIGN) {
+                        SPECIAL_REG_WRITE(herc_act_dtx_cfg[dtx_cnt],
                                           &bar0->dtx_control, UF);
-                        val64 = readq(&bar0->dtx_control);
+                        if (dtx_cnt & 0x1)
+                                msleep(1); /* Necessary!! */
                         dtx_cnt++;
                 }
-              mdio_cfg:
-                while (default_mdio_cfg[mdio_cnt] != END_SIGN) {
-                        if (default_mdio_cfg[mdio_cnt] == SWITCH_SIGN) {
+        } else {
+                while (1) {
+                      dtx_cfg:
+                        while (xena_dtx_cfg[dtx_cnt] != END_SIGN) {
+                                if (xena_dtx_cfg[dtx_cnt] == SWITCH_SIGN) {
+                                        dtx_cnt++;
+                                        goto mdio_cfg;
+                                }
+                                SPECIAL_REG_WRITE(xena_dtx_cfg[dtx_cnt],
+                                                  &bar0->dtx_control, UF);
+                                val64 = readq(&bar0->dtx_control);
+                                dtx_cnt++;
+                        }
+                      mdio_cfg:
+                        while (xena_mdio_cfg[mdio_cnt] != END_SIGN) {
+                                if (xena_mdio_cfg[mdio_cnt] == SWITCH_SIGN) {
+                                        mdio_cnt++;
+                                        goto dtx_cfg;
+                                }
+                                SPECIAL_REG_WRITE(xena_mdio_cfg[mdio_cnt],
+                                                  &bar0->mdio_control, UF);
+                                val64 = readq(&bar0->mdio_control);
                                 mdio_cnt++;
+                        }
+                        if ((xena_dtx_cfg[dtx_cnt] == END_SIGN) &&
+                            (xena_mdio_cfg[mdio_cnt] == END_SIGN)) {
+                                break;
+                        } else {
                                 goto dtx_cfg;
                         }
-                        SPECIAL_REG_WRITE(default_mdio_cfg[mdio_cnt],
-                                          &bar0->mdio_control, UF);
-                        val64 = readq(&bar0->mdio_control);
-                        mdio_cnt++;
-                }
-                if ((default_dtx_cfg[dtx_cnt] == END_SIGN) &&
-                    (default_mdio_cfg[mdio_cnt] == END_SIGN)) {
-                        break;
-                } else {
-                        goto dtx_cfg;
                 }
         }
 
@@ -748,12 +925,20 @@ static int init_nic(struct s2io_nic *nic)
         val64 |= BIT(0);        /* To enable the FIFO partition. */
         writeq(val64, &bar0->tx_fifo_partition_0);
 
+        /*
+         * Disable 4 PCCs for Xena1, 2 and 3 as per H/W bug
+         * SXE-008 TRANSMIT DMA ARBITRATION ISSUE.
+         */
+        if ((nic->device_type == XFRAME_I_DEVICE) &&
+                (get_xena_rev_id(nic->pdev) < 4))
+                writeq(PCC_ENABLE_FOUR, &bar0->pcc_enable);
+
         val64 = readq(&bar0->tx_fifo_partition_0);
         DBG_PRINT(INIT_DBG, "Fifo partition at: 0x%p is: 0x%llx\n",
                   &bar0->tx_fifo_partition_0, (unsigned long long) val64);
 
-        /* 
-         * Initialization of Tx_PA_CONFIG register to ignore packet 
+        /*
+         * Initialization of Tx_PA_CONFIG register to ignore packet
          * integrity checking.
          */
         val64 = readq(&bar0->tx_pa_cfg);
@@ -770,85 +955,304 @@ static int init_nic(struct s2io_nic *nic)
         }
         writeq(val64, &bar0->rx_queue_priority);
 
-        /* 
-         * Allocating equal share of memory to all the 
+        /*
+         * Allocating equal share of memory to all the
          * configured Rings.
          */
         val64 = 0;
+        if (nic->device_type & XFRAME_II_DEVICE)
+                mem_size = 32;
+        else
+                mem_size = 64;
+
         for (i = 0; i < config->rx_ring_num; i++) {
                 switch (i) {
                 case 0:
-                        mem_share = (64 / config->rx_ring_num +
-                                     64 % config->rx_ring_num);
+                        mem_share = (mem_size / config->rx_ring_num +
+                                     mem_size % config->rx_ring_num);
                         val64 |= RX_QUEUE_CFG_Q0_SZ(mem_share);
                         continue;
                 case 1:
-                        mem_share = (64 / config->rx_ring_num);
+                        mem_share = (mem_size / config->rx_ring_num);
                         val64 |= RX_QUEUE_CFG_Q1_SZ(mem_share);
                         continue;
                 case 2:
-                        mem_share = (64 / config->rx_ring_num);
+                        mem_share = (mem_size / config->rx_ring_num);
                         val64 |= RX_QUEUE_CFG_Q2_SZ(mem_share);
                         continue;
                 case 3:
-                        mem_share = (64 / config->rx_ring_num);
+                        mem_share = (mem_size / config->rx_ring_num);
                         val64 |= RX_QUEUE_CFG_Q3_SZ(mem_share);
                         continue;
                 case 4:
-                        mem_share = (64 / config->rx_ring_num);
+                        mem_share = (mem_size / config->rx_ring_num);
                         val64 |= RX_QUEUE_CFG_Q4_SZ(mem_share);
                         continue;
                 case 5:
-                        mem_share = (64 / config->rx_ring_num);
+                        mem_share = (mem_size / config->rx_ring_num);
                         val64 |= RX_QUEUE_CFG_Q5_SZ(mem_share);
                         continue;
                 case 6:
-                        mem_share = (64 / config->rx_ring_num);
+                        mem_share = (mem_size / config->rx_ring_num);
                         val64 |= RX_QUEUE_CFG_Q6_SZ(mem_share);
                         continue;
                 case 7:
-                        mem_share = (64 / config->rx_ring_num);
+                        mem_share = (mem_size / config->rx_ring_num);
                         val64 |= RX_QUEUE_CFG_Q7_SZ(mem_share);
                         continue;
                 }
         }
         writeq(val64, &bar0->rx_queue_cfg);
 
-        /* 
-         * Initializing the Tx round robin registers to 0.
-         * Filling Tx and Rx round robin registers as per the 
-         * number of FIFOs and Rings is still TODO.
-         */
-        writeq(0, &bar0->tx_w_round_robin_0);
-        writeq(0, &bar0->tx_w_round_robin_1);
-        writeq(0, &bar0->tx_w_round_robin_2);
-        writeq(0, &bar0->tx_w_round_robin_3);
-        writeq(0, &bar0->tx_w_round_robin_4);
-
-        /* 
-         * TODO
-         * Disable Rx steering. Hard coding all packets be steered to
-         * Queue 0 for now. 
+        /*
+         * Filling Tx round robin registers
+         * as per the number of FIFOs
          */
-        val64 = 0x8080808080808080ULL;
-        writeq(val64, &bar0->rts_qos_steering);
+        switch (config->tx_fifo_num) {
+        case 1:
+                val64 = 0x0000000000000000ULL;
+                writeq(val64, &bar0->tx_w_round_robin_0);
+                writeq(val64, &bar0->tx_w_round_robin_1);
+                writeq(val64, &bar0->tx_w_round_robin_2);
+                writeq(val64, &bar0->tx_w_round_robin_3);
+                writeq(val64, &bar0->tx_w_round_robin_4);
+                break;
+        case 2:
+                val64 = 0x0000010000010000ULL;
+                writeq(val64, &bar0->tx_w_round_robin_0);
+                val64 = 0x0100000100000100ULL;
+                writeq(val64, &bar0->tx_w_round_robin_1);
+                val64 = 0x0001000001000001ULL;
+                writeq(val64, &bar0->tx_w_round_robin_2);
+                val64 = 0x0000010000010000ULL;
+                writeq(val64, &bar0->tx_w_round_robin_3);
+                val64 = 0x0100000000000000ULL;
+                writeq(val64, &bar0->tx_w_round_robin_4);
+                break;
+        case 3:
+                val64 = 0x0001000102000001ULL;
+                writeq(val64, &bar0->tx_w_round_robin_0);
+                val64 = 0x0001020000010001ULL;
+                writeq(val64, &bar0->tx_w_round_robin_1);
+                val64 = 0x0200000100010200ULL;
+                writeq(val64, &bar0->tx_w_round_robin_2);
+                val64 = 0x0001000102000001ULL;
+                writeq(val64, &bar0->tx_w_round_robin_3);
+                val64 = 0x0001020000000000ULL;
+                writeq(val64, &bar0->tx_w_round_robin_4);
+                break;
+        case 4:
+                val64 = 0x0001020300010200ULL;
+                writeq(val64, &bar0->tx_w_round_robin_0);
+                val64 = 0x0100000102030001ULL;
+                writeq(val64, &bar0->tx_w_round_robin_1);
+                val64 = 0x0200010000010203ULL;
+                writeq(val64, &bar0->tx_w_round_robin_2);
+                val64 = 0x0001020001000001ULL;
+                writeq(val64, &bar0->tx_w_round_robin_3);
+                val64 = 0x0203000100000000ULL;
+                writeq(val64, &bar0->tx_w_round_robin_4);
+                break;
+        case 5:
+                val64 = 0x0001000203000102ULL;
+                writeq(val64, &bar0->tx_w_round_robin_0);
+                val64 = 0x0001020001030004ULL;
+                writeq(val64, &bar0->tx_w_round_robin_1);
+                val64 = 0x0001000203000102ULL;
+                writeq(val64, &bar0->tx_w_round_robin_2);
+                val64 = 0x0001020001030004ULL;
+                writeq(val64, &bar0->tx_w_round_robin_3);
+                val64 = 0x0001000000000000ULL;
+                writeq(val64, &bar0->tx_w_round_robin_4);
+                break;
+        case 6:
+                val64 = 0x0001020304000102ULL;
+                writeq(val64, &bar0->tx_w_round_robin_0);
+                val64 = 0x0304050001020001ULL;
+                writeq(val64, &bar0->tx_w_round_robin_1);
+                val64 = 0x0203000100000102ULL;
+                writeq(val64, &bar0->tx_w_round_robin_2);
+                val64 = 0x0304000102030405ULL;
+                writeq(val64, &bar0->tx_w_round_robin_3);
+                val64 = 0x0001000200000000ULL;
+                writeq(val64, &bar0->tx_w_round_robin_4);
+                break;
+        case 7:
+                val64 = 0x0001020001020300ULL;
+                writeq(val64, &bar0->tx_w_round_robin_0);
+                val64 = 0x0102030400010203ULL;
+                writeq(val64, &bar0->tx_w_round_robin_1);
+                val64 = 0x0405060001020001ULL;
+                writeq(val64, &bar0->tx_w_round_robin_2);
+                val64 = 0x0304050000010200ULL;
+                writeq(val64, &bar0->tx_w_round_robin_3);
+                val64 = 0x0102030000000000ULL;
+                writeq(val64, &bar0->tx_w_round_robin_4);
+                break;
+        case 8:
+                val64 = 0x0001020300040105ULL;
+                writeq(val64, &bar0->tx_w_round_robin_0);
+                val64 = 0x0200030106000204ULL;
+                writeq(val64, &bar0->tx_w_round_robin_1);
+                val64 = 0x0103000502010007ULL;
+                writeq(val64, &bar0->tx_w_round_robin_2);
+                val64 = 0x0304010002060500ULL;
+                writeq(val64, &bar0->tx_w_round_robin_3);
+                val64 = 0x0103020400000000ULL;
+                writeq(val64, &bar0->tx_w_round_robin_4);
+                break;
+        }
+
+        /* Filling the Rx round robin registers as per the
+         * number of Rings and steering based on QoS.
+         */
+        switch (config->rx_ring_num) {
+        case 1:
+                val64 = 0x8080808080808080ULL;
+                writeq(val64, &bar0->rts_qos_steering);
+                break;
+        case 2:
+                val64 = 0x0000010000010000ULL;
+                writeq(val64, &bar0->rx_w_round_robin_0);
+                val64 = 0x0100000100000100ULL;
+                writeq(val64, &bar0->rx_w_round_robin_1);
+                val64 = 0x0001000001000001ULL;
+                writeq(val64, &bar0->rx_w_round_robin_2);
+                val64 = 0x0000010000010000ULL;
+                writeq(val64, &bar0->rx_w_round_robin_3);
+                val64 = 0x0100000000000000ULL;
+                writeq(val64, &bar0->rx_w_round_robin_4);
+
+                val64 = 0x8080808040404040ULL;
+                writeq(val64, &bar0->rts_qos_steering);
+                break;
+        case 3:
+                val64 = 0x0001000102000001ULL;
+                writeq(val64, &bar0->rx_w_round_robin_0);
+                val64 = 0x0001020000010001ULL;
+                writeq(val64, &bar0->rx_w_round_robin_1);
+                val64 = 0x0200000100010200ULL;
+                writeq(val64, &bar0->rx_w_round_robin_2);
+                val64 = 0x0001000102000001ULL;
+                writeq(val64, &bar0->rx_w_round_robin_3);
+                val64 = 0x0001020000000000ULL;
+                writeq(val64, &bar0->rx_w_round_robin_4);
+
+                val64 = 0x8080804040402020ULL;
+                writeq(val64, &bar0->rts_qos_steering);
+                break;
+        case 4:
+                val64 = 0x0001020300010200ULL;
+                writeq(val64, &bar0->rx_w_round_robin_0);
+                val64 = 0x0100000102030001ULL;
+                writeq(val64, &bar0->rx_w_round_robin_1);
+                val64 = 0x0200010000010203ULL;
+                writeq(val64, &bar0->rx_w_round_robin_2);
+                val64 = 0x0001020001000001ULL;  
+                writeq(val64, &bar0->rx_w_round_robin_3);
+                val64 = 0x0203000100000000ULL;
+                writeq(val64, &bar0->rx_w_round_robin_4);
+
+                val64 = 0x8080404020201010ULL;
+                writeq(val64, &bar0->rts_qos_steering);
+                break;
+        case 5:
+                val64 = 0x0001000203000102ULL;
+                writeq(val64, &bar0->rx_w_round_robin_0);
+                val64 = 0x0001020001030004ULL;
+                writeq(val64, &bar0->rx_w_round_robin_1);
+                val64 = 0x0001000203000102ULL;
+                writeq(val64, &bar0->rx_w_round_robin_2);
+                val64 = 0x0001020001030004ULL;
+                writeq(val64, &bar0->rx_w_round_robin_3);
+                val64 = 0x0001000000000000ULL;
+                writeq(val64, &bar0->rx_w_round_robin_4);
+
+                val64 = 0x8080404020201008ULL;
+                writeq(val64, &bar0->rts_qos_steering);
+                break;
+        case 6:
+                val64 = 0x0001020304000102ULL;
+                writeq(val64, &bar0->rx_w_round_robin_0);
+                val64 = 0x0304050001020001ULL;
+                writeq(val64, &bar0->rx_w_round_robin_1);
+                val64 = 0x0203000100000102ULL;
+                writeq(val64, &bar0->rx_w_round_robin_2);
+                val64 = 0x0304000102030405ULL;
+                writeq(val64, &bar0->rx_w_round_robin_3);
+                val64 = 0x0001000200000000ULL;
+                writeq(val64, &bar0->rx_w_round_robin_4);
+
+                val64 = 0x8080404020100804ULL;
+                writeq(val64, &bar0->rts_qos_steering);
+                break;
+        case 7:
+                val64 = 0x0001020001020300ULL;
+                writeq(val64, &bar0->rx_w_round_robin_0);
+                val64 = 0x0102030400010203ULL;
+                writeq(val64, &bar0->rx_w_round_robin_1);
+                val64 = 0x0405060001020001ULL;
+                writeq(val64, &bar0->rx_w_round_robin_2);
+                val64 = 0x0304050000010200ULL;
+                writeq(val64, &bar0->rx_w_round_robin_3);
+                val64 = 0x0102030000000000ULL;
+                writeq(val64, &bar0->rx_w_round_robin_4);
+
+                val64 = 0x8080402010080402ULL;
+                writeq(val64, &bar0->rts_qos_steering);
+                break;
+        case 8:
+                val64 = 0x0001020300040105ULL;
+                writeq(val64, &bar0->rx_w_round_robin_0);
+                val64 = 0x0200030106000204ULL;
+                writeq(val64, &bar0->rx_w_round_robin_1);
+                val64 = 0x0103000502010007ULL;
+                writeq(val64, &bar0->rx_w_round_robin_2);
+                val64 = 0x0304010002060500ULL;
+                writeq(val64, &bar0->rx_w_round_robin_3);
+                val64 = 0x0103020400000000ULL;
+                writeq(val64, &bar0->rx_w_round_robin_4);
+
+                val64 = 0x8040201008040201ULL;
+                writeq(val64, &bar0->rts_qos_steering);
+                break;
+        }
 
         /* UDP Fix */
         val64 = 0;
-        for (i = 1; i < 8; i++)
+        for (i = 0; i < 8; i++)
+                writeq(val64, &bar0->rts_frm_len_n[i]);
+
+        /* Set the default rts frame length for the rings configured */
+        val64 = MAC_RTS_FRM_LEN_SET(dev->mtu+22);
+        for (i = 0 ; i < config->rx_ring_num ; i++)
                 writeq(val64, &bar0->rts_frm_len_n[i]);
 
-        /* Set rts_frm_len register for fifo 0 */
-        writeq(MAC_RTS_FRM_LEN_SET(dev->mtu + 22),
-               &bar0->rts_frm_len_n[0]);
+        /* Set the frame length for the configured rings
+         * desired by the user
+         */
+        for (i = 0; i < config->rx_ring_num; i++) {
+                /* If rts_frm_len[i] == 0 then it is assumed that user not
+                 * specified frame length steering.
+                 * If the user provides the frame length then program
+                 * the rts_frm_len register for those values or else
+                 * leave it as it is.
+                 */
+                if (rts_frm_len[i] != 0) {
+                        writeq(MAC_RTS_FRM_LEN_SET(rts_frm_len[i]),
+                                &bar0->rts_frm_len_n[i]);
+                }
+        }
 
-        /* Enable statistics */
+        /* Program statistics memory */
         writeq(mac_control->stats_mem_phy, &bar0->stat_addr);
-        val64 = SET_UPDT_PERIOD(Stats_refresh_time) |
-            STAT_CFG_STAT_RO | STAT_CFG_STAT_EN;
-        writeq(val64, &bar0->stat_cfg);
 
-        /* 
+        if (nic->device_type == XFRAME_II_DEVICE) {
+                val64 = STAT_BC(0x320);
+                writeq(val64, &bar0->stat_byte_cnt);
+        }
+
+        /*
          * Initializing the sampling rate for the device to calculate the
          * bandwidth utilization.
          */
@@ -857,30 +1261,38 @@ static int init_nic(struct s2io_nic *nic)
         writeq(val64, &bar0->mac_link_util);
 
 
-        /* 
-         * Initializing the Transmit and Receive Traffic Interrupt 
+        /*
+         * Initializing the Transmit and Receive Traffic Interrupt
          * Scheme.
          */
-        /* TTI Initialization. Default Tx timer gets us about
+        /*
+         * TTI Initialization. Default Tx timer gets us about
          * 250 interrupts per sec. Continuous interrupts are enabled
          * by default.
          */
-        val64 = TTI_DATA1_MEM_TX_TIMER_VAL(0x2078) |
-            TTI_DATA1_MEM_TX_URNG_A(0xA) |
+        if (nic->device_type == XFRAME_II_DEVICE) {
+                int count = (nic->config.bus_speed * 125)/2;
+                val64 = TTI_DATA1_MEM_TX_TIMER_VAL(count);
+        } else {
+
+                val64 = TTI_DATA1_MEM_TX_TIMER_VAL(0x2078);
+        }
+        val64 |= TTI_DATA1_MEM_TX_URNG_A(0xA) |
             TTI_DATA1_MEM_TX_URNG_B(0x10) |
-            TTI_DATA1_MEM_TX_URNG_C(0x30) | TTI_DATA1_MEM_TX_TIMER_AC_EN |
-                TTI_DATA1_MEM_TX_TIMER_CI_EN;
+            TTI_DATA1_MEM_TX_URNG_C(0x30) | TTI_DATA1_MEM_TX_TIMER_AC_EN;
+                if (use_continuous_tx_intrs)
+                        val64 |= TTI_DATA1_MEM_TX_TIMER_CI_EN;
         writeq(val64, &bar0->tti_data1_mem);
 
         val64 = TTI_DATA2_MEM_TX_UFC_A(0x10) |
             TTI_DATA2_MEM_TX_UFC_B(0x20) |
-            TTI_DATA2_MEM_TX_UFC_C(0x40) | TTI_DATA2_MEM_TX_UFC_D(0x80);
+            TTI_DATA2_MEM_TX_UFC_C(0x70) | TTI_DATA2_MEM_TX_UFC_D(0x80);
         writeq(val64, &bar0->tti_data2_mem);
 
         val64 = TTI_CMD_MEM_WE | TTI_CMD_MEM_STROBE_NEW_CMD;
         writeq(val64, &bar0->tti_command_mem);
 
-        /* 
+        /*
          * Once the operation completes, the Strobe bit of the command
          * register will be reset. We poll for this particular condition
          * We wait for a maximum of 500ms for the operation to complete,
@@ -901,52 +1313,97 @@ static int init_nic(struct s2io_nic *nic)
                 time++;
         }
 
-        /* RTI Initialization */
-        val64 = RTI_DATA1_MEM_RX_TIMER_VAL(0xFFF) |
-            RTI_DATA1_MEM_RX_URNG_A(0xA) |
-            RTI_DATA1_MEM_RX_URNG_B(0x10) |
-            RTI_DATA1_MEM_RX_URNG_C(0x30) | RTI_DATA1_MEM_RX_TIMER_AC_EN;
+        if (nic->config.bimodal) {
+                int k = 0;
+                for (k = 0; k < config->rx_ring_num; k++) {
+                        val64 = TTI_CMD_MEM_WE | TTI_CMD_MEM_STROBE_NEW_CMD;
+                        val64 |= TTI_CMD_MEM_OFFSET(0x38+k);
+                        writeq(val64, &bar0->tti_command_mem);
+
+                /*
+                 * Once the operation completes, the Strobe bit of the command
+                 * register will be reset. We poll for this particular condition
+                 * We wait for a maximum of 500ms for the operation to complete,
+                 * if it's not complete by then we return error.
+                */
+                        time = 0;
+                        while (TRUE) {
+                                val64 = readq(&bar0->tti_command_mem);
+                                if (!(val64 & TTI_CMD_MEM_STROBE_NEW_CMD)) {
+                                        break;
+                                }
+                                if (time > 10) {
+                                        DBG_PRINT(ERR_DBG,
+                                                "%s: TTI init Failed\n",
+                                        dev->name);
+                                        return -1;
+                                }
+                                time++;
+                                msleep(50);
+                        }
+                }
+        } else {
 
-        writeq(val64, &bar0->rti_data1_mem);
+                /* RTI Initialization */
+                if (nic->device_type == XFRAME_II_DEVICE) {
+                        /*
+                         * Programmed to generate Apprx 500 Intrs per
+                         * second
+                         */
+                        int count = (nic->config.bus_speed * 125)/4;
+                        val64 = RTI_DATA1_MEM_RX_TIMER_VAL(count);
+                } else {
+                        val64 = RTI_DATA1_MEM_RX_TIMER_VAL(0xFFF);
+                }
+                val64 |= RTI_DATA1_MEM_RX_URNG_A(0xA) |
+                    RTI_DATA1_MEM_RX_URNG_B(0x10) |
+                    RTI_DATA1_MEM_RX_URNG_C(0x30) | RTI_DATA1_MEM_RX_TIMER_AC_EN;
 
-        val64 = RTI_DATA2_MEM_RX_UFC_A(0x1) |
-            RTI_DATA2_MEM_RX_UFC_B(0x2) |
-            RTI_DATA2_MEM_RX_UFC_C(0x40) | RTI_DATA2_MEM_RX_UFC_D(0x80);
-        writeq(val64, &bar0->rti_data2_mem);
+                writeq(val64, &bar0->rti_data1_mem);
 
-        val64 = RTI_CMD_MEM_WE | RTI_CMD_MEM_STROBE_NEW_CMD;
-        writeq(val64, &bar0->rti_command_mem);
+                val64 = RTI_DATA2_MEM_RX_UFC_A(0x1) |
+                    RTI_DATA2_MEM_RX_UFC_B(0x2) |
+                    RTI_DATA2_MEM_RX_UFC_C(0x40) | RTI_DATA2_MEM_RX_UFC_D(0x80);
+                writeq(val64, &bar0->rti_data2_mem);
 
-        /* 
-         * Once the operation completes, the Strobe bit of the command
-         * register will be reset. We poll for this particular condition
-         * We wait for a maximum of 500ms for the operation to complete,
-         * if it's not complete by then we return error.
-         */
-        time = 0;
-        while (TRUE) {
-                val64 = readq(&bar0->rti_command_mem);
-                if (!(val64 & TTI_CMD_MEM_STROBE_NEW_CMD)) {
-                        break;
-                }
-                if (time > 10) {
-                        DBG_PRINT(ERR_DBG, "%s: RTI init Failed\n",
-                                  dev->name);
-                        return -1;
+                for (i = 0; i < config->rx_ring_num; i++) {
+                        val64 = RTI_CMD_MEM_WE | RTI_CMD_MEM_STROBE_NEW_CMD
+                                        | RTI_CMD_MEM_OFFSET(i);
+                        writeq(val64, &bar0->rti_command_mem);
+
+                        /*
+                         * Once the operation completes, the Strobe bit of the
+                         * command register will be reset. We poll for this
+                         * particular condition. We wait for a maximum of 500ms
+                         * for the operation to complete, if it's not complete
+                         * by then we return error.
+                         */
+                        time = 0;
+                        while (TRUE) {
+                                val64 = readq(&bar0->rti_command_mem);
+                                if (!(val64 & RTI_CMD_MEM_STROBE_NEW_CMD)) {
+                                        break;
+                                }
+                                if (time > 10) {
+                                        DBG_PRINT(ERR_DBG, "%s: RTI init Failed\n",
+                                                  dev->name);
+                                        return -1;
+                                }
+                                time++;
+                                msleep(50);
+                        }
                 }
-                time++;
-                msleep(50);
         }
 
-        /* 
-         * Initializing proper values as Pause threshold into all 
+        /*
+         * Initializing proper values as Pause threshold into all
          * the 8 Queues on Rx side.
          */
         writeq(0xffbbffbbffbbffbbULL, &bar0->mc_pause_thresh_q0q3);
         writeq(0xffbbffbbffbbffbbULL, &bar0->mc_pause_thresh_q4q7);
 
         /* Disable RMAC PAD STRIPPING */
-        add = &bar0->mac_cfg;
+        add = (void *) &bar0->mac_cfg;
         val64 = readq(&bar0->mac_cfg);
         val64 &= ~(MAC_CFG_RMAC_STRIP_PAD);
         writeq(RMAC_CFG_KEY(0x4C0D), &bar0->rmac_cfg_key);
@@ -955,8 +1412,8 @@ static int init_nic(struct s2io_nic *nic)
         writel((u32) (val64 >> 32), (add + 4));
         val64 = readq(&bar0->mac_cfg);
 
-        /* 
-         * Set the time value to be inserted in the pause frame 
+        /*
+         * Set the time value to be inserted in the pause frame
          * generated by xena.
          */
         val64 = readq(&bar0->rmac_pause_cfg);
@@ -964,7 +1421,7 @@ static int init_nic(struct s2io_nic *nic)
         val64 |= RMAC_PAUSE_HG_PTIME(nic->mac_control.rmac_pause_time);
         writeq(val64, &bar0->rmac_pause_cfg);
 
-        /* 
+        /*
          * Set the Threshold Limit for Generating the pause frame
          * If the amount of data in any Queue exceeds ratio of
          * (mac_control.mc_pause_threshold_q0q3 or q4q7)/256
@@ -988,25 +1445,54 @@ static int init_nic(struct s2io_nic *nic)
         }
         writeq(val64, &bar0->mc_pause_thresh_q4q7);
 
-        /* 
-         * TxDMA will stop Read request if the number of read split has 
+        /*
+         * TxDMA will stop Read request if the number of read split has
          * exceeded the limit pointed by shared_splits
          */
         val64 = readq(&bar0->pic_control);
         val64 |= PIC_CNTL_SHARED_SPLITS(shared_splits);
         writeq(val64, &bar0->pic_control);
 
+        /*
+         * Programming the Herc to split every write transaction
+         * that does not start on an ADB to reduce disconnects.
+         */
+        if (nic->device_type == XFRAME_II_DEVICE) {
+                val64 = WREQ_SPLIT_MASK_SET_MASK(255);
+                writeq(val64, &bar0->wreq_split_mask);
+        }
+
+        /* Setting Link stability period to 64 ms */ 
+        if (nic->device_type == XFRAME_II_DEVICE) {
+                val64 = MISC_LINK_STABILITY_PRD(3);
+                writeq(val64, &bar0->misc_control);
+        }
+
         return SUCCESS;
 }
+#define LINK_UP_DOWN_INTERRUPT          1
+#define MAC_RMAC_ERR_TIMER              2
 
-/**  
- *  en_dis_able_nic_intrs - Enable or Disable the interrupts 
+#if defined(CONFIG_MSI_MODE) || defined(CONFIG_MSIX_MODE)
+#define s2io_link_fault_indication(x) MAC_RMAC_ERR_TIMER
+#else
+int s2io_link_fault_indication(nic_t *nic)
+{
+        if (nic->device_type == XFRAME_II_DEVICE)
+                return LINK_UP_DOWN_INTERRUPT;
+        else
+                return MAC_RMAC_ERR_TIMER;
+}
+#endif
+
+/**
+ *  en_dis_able_nic_intrs - Enable or Disable the interrupts
  *  @nic: device private variable,
  *  @mask: A mask indicating which Intr block must be modified and,
  *  @flag: A flag indicating whether to enable or disable the Intrs.
  *  Description: This function will either disable or enable the interrupts
- *  depending on the flag argument. The mask argument can be used to 
- *  enable/disable any Intr block. 
+ *  depending on the flag argument. The mask argument can be used to
+ *  enable/disable any Intr block.
  *  Return Value: NONE.
  */
 
@@ -1024,20 +1510,31 @@ static void en_dis_able_nic_intrs(struct s2io_nic *nic, u16 mask, int flag)
                         temp64 = readq(&bar0->general_int_mask);
                         temp64 &= ~((u64) val64);
                         writeq(temp64, &bar0->general_int_mask);
-                        /*  
-                         * Disabled all PCIX, Flash, MDIO, IIC and GPIO
-                         * interrupts for now. 
-                         * TODO 
+                        /*
+                         * If Hercules adapter enable GPIO otherwise
+                         * disabled all PCIX, Flash, MDIO, IIC and GPIO
+                         * interrupts for now.
+                         * TODO
                          */
-                        writeq(DISABLE_ALL_INTRS, &bar0->pic_int_mask);
-                        /* 
+                        if (s2io_link_fault_indication(nic) ==
+                                        LINK_UP_DOWN_INTERRUPT ) {
+                                temp64 = readq(&bar0->pic_int_mask);
+                                temp64 &= ~((u64) PIC_INT_GPIO);
+                                writeq(temp64, &bar0->pic_int_mask);
+                                temp64 = readq(&bar0->gpio_int_mask);
+                                temp64 &= ~((u64) GPIO_INT_MASK_LINK_UP);
+                                writeq(temp64, &bar0->gpio_int_mask);
+                        } else {
+                                writeq(DISABLE_ALL_INTRS, &bar0->pic_int_mask);
+                        }
+                        /*
                          * No MSI Support is available presently, so TTI and
                          * RTI interrupts are also disabled.
                          */
                 } else if (flag == DISABLE_INTRS) {
-                        /*  
-                         * Disable PIC Intrs in the general 
-                         * intr mask register 
+                        /*
+                         * Disable PIC Intrs in the general
+                         * intr mask register
                          */
                         writeq(DISABLE_ALL_INTRS, &bar0->pic_int_mask);
                         temp64 = readq(&bar0->general_int_mask);
@@ -1055,27 +1552,27 @@ static void en_dis_able_nic_intrs(struct s2io_nic *nic, u16 mask, int flag)
                         temp64 = readq(&bar0->general_int_mask);
                         temp64 &= ~((u64) val64);
                         writeq(temp64, &bar0->general_int_mask);
-                        /* 
-                         * Keep all interrupts other than PFC interrupt 
+                        /*
+                         * Keep all interrupts other than PFC interrupt
                          * and PCC interrupt disabled in DMA level.
                          */
                         val64 = DISABLE_ALL_INTRS & ~(TXDMA_PFC_INT_M |
                                                       TXDMA_PCC_INT_M);
                         writeq(val64, &bar0->txdma_int_mask);
-                        /* 
-                         * Enable only the MISC error 1 interrupt in PFC block 
+                        /*
+                         * Enable only the MISC error 1 interrupt in PFC block
                          */
                         val64 = DISABLE_ALL_INTRS & (~PFC_MISC_ERR_1);
                         writeq(val64, &bar0->pfc_err_mask);
-                        /* 
-                         * Enable only the FB_ECC error interrupt in PCC block 
+                        /*
+                         * Enable only the FB_ECC error interrupt in PCC block
                          */
                         val64 = DISABLE_ALL_INTRS & (~PCC_FB_ECC_ERR);
                         writeq(val64, &bar0->pcc_err_mask);
                 } else if (flag == DISABLE_INTRS) {
-                        /* 
-                         * Disable TxDMA Intrs in the general intr mask 
-                         * register 
+                        /*
+                         * Disable TxDMA Intrs in the general intr mask
+                         * register
                          */
                         writeq(DISABLE_ALL_INTRS, &bar0->txdma_int_mask);
                         writeq(DISABLE_ALL_INTRS, &bar0->pfc_err_mask);
@@ -1093,15 +1590,15 @@ static void en_dis_able_nic_intrs(struct s2io_nic *nic, u16 mask, int flag)
                         temp64 = readq(&bar0->general_int_mask);
                         temp64 &= ~((u64) val64);
                         writeq(temp64, &bar0->general_int_mask);
-                        /* 
-                         * All RxDMA block interrupts are disabled for now 
-                         * TODO 
+                        /*
+                         * All RxDMA block interrupts are disabled for now
+                         * TODO
                          */
                         writeq(DISABLE_ALL_INTRS, &bar0->rxdma_int_mask);
                 } else if (flag == DISABLE_INTRS) {
-                        /*  
-                         * Disable RxDMA Intrs in the general intr mask 
-                         * register 
+                        /*
+                         * Disable RxDMA Intrs in the general intr mask
+                         * register
                          */
                         writeq(DISABLE_ALL_INTRS, &bar0->rxdma_int_mask);
                         temp64 = readq(&bar0->general_int_mask);
@@ -1118,22 +1615,13 @@ static void en_dis_able_nic_intrs(struct s2io_nic *nic, u16 mask, int flag)
                         temp64 = readq(&bar0->general_int_mask);
                         temp64 &= ~((u64) val64);
                         writeq(temp64, &bar0->general_int_mask);
-                        /* 
-                         * All MAC block error interrupts are disabled for now 
-                         * except the link status change interrupt.
+                        /*
+                         * All MAC block error interrupts are disabled for now
                          * TODO
                          */
-                        val64 = MAC_INT_STATUS_RMAC_INT;
-                        temp64 = readq(&bar0->mac_int_mask);
-                        temp64 &= ~((u64) val64);
-                        writeq(temp64, &bar0->mac_int_mask);
-
-                        val64 = readq(&bar0->mac_rmac_err_mask);
-                        val64 &= ~((u64) RMAC_LINK_STATE_CHANGE_INT);
-                        writeq(val64, &bar0->mac_rmac_err_mask);
                 } else if (flag == DISABLE_INTRS) {
-                        /*  
-                         * Disable MAC Intrs in the general intr mask register 
+                        /*
+                         * Disable MAC Intrs in the general intr mask register
                          */
                         writeq(DISABLE_ALL_INTRS, &bar0->mac_int_mask);
                         writeq(DISABLE_ALL_INTRS,
@@ -1152,14 +1640,14 @@ static void en_dis_able_nic_intrs(struct s2io_nic *nic, u16 mask, int flag)
                         temp64 = readq(&bar0->general_int_mask);
                         temp64 &= ~((u64) val64);
                         writeq(temp64, &bar0->general_int_mask);
-                        /* 
+                        /*
                          * All XGXS block error interrupts are disabled for now
-                         * TODO 
+                         * TODO
                          */
                         writeq(DISABLE_ALL_INTRS, &bar0->xgxs_int_mask);
                 } else if (flag == DISABLE_INTRS) {
-                        /*  
-                         * Disable MC Intrs in the general intr mask register 
+                        /*
+                         * Disable MC Intrs in the general intr mask register
                          */
                         writeq(DISABLE_ALL_INTRS, &bar0->xgxs_int_mask);
                         temp64 = readq(&bar0->general_int_mask);
@@ -1175,11 +1663,11 @@ static void en_dis_able_nic_intrs(struct s2io_nic *nic, u16 mask, int flag)
                         temp64 = readq(&bar0->general_int_mask);
                         temp64 &= ~((u64) val64);
                         writeq(temp64, &bar0->general_int_mask);
-                        /* 
-                         * All MC block error interrupts are disabled for now
-                         * TODO 
+                        /*
+                         * Enable all MC Intrs.
                          */
-                        writeq(DISABLE_ALL_INTRS, &bar0->mc_int_mask);
+                        writeq(0x0, &bar0->mc_int_mask);
+                        writeq(0x0, &bar0->mc_err_mask);
                 } else if (flag == DISABLE_INTRS) {
                         /*
                          * Disable MC Intrs in the general intr mask register
@@ -1199,14 +1687,14 @@ static void en_dis_able_nic_intrs(struct s2io_nic *nic, u16 mask, int flag)
                         temp64 = readq(&bar0->general_int_mask);
                         temp64 &= ~((u64) val64);
                         writeq(temp64, &bar0->general_int_mask);
-                        /* 
+                        /*
                          * Enable all the Tx side interrupts
-                         * writing 0 Enables all 64 TX interrupt levels 
+                         * writing 0 Enables all 64 TX interrupt levels
                          */
                         writeq(0x0, &bar0->tx_traffic_mask);
                 } else if (flag == DISABLE_INTRS) {
-                        /* 
-                         * Disable Tx Traffic Intrs in the general intr mask 
+                        /*
+                         * Disable Tx Traffic Intrs in the general intr mask
                          * register.
                          */
                         writeq(DISABLE_ALL_INTRS, &bar0->tx_traffic_mask);
@@ -1226,8 +1714,8 @@ static void en_dis_able_nic_intrs(struct s2io_nic *nic, u16 mask, int flag)
                         /* writing 0 Enables all 8 RX interrupt levels */
                         writeq(0x0, &bar0->rx_traffic_mask);
                 } else if (flag == DISABLE_INTRS) {
-                        /*  
-                         * Disable Rx Traffic Intrs in the general intr mask 
+                        /*
+                         * Disable Rx Traffic Intrs in the general intr mask
                          * register.
                          */
                         writeq(DISABLE_ALL_INTRS, &bar0->rx_traffic_mask);
@@ -1238,24 +1726,66 @@ static void en_dis_able_nic_intrs(struct s2io_nic *nic, u16 mask, int flag)
         }
 }
 
-/**  
- *  verify_xena_quiescence - Checks whether the H/W is ready 
+static int check_prc_pcc_state(u64 val64, int flag, int rev_id, int herc)
+{
+        int ret = 0;
+
+        if (flag == FALSE) {
+                if ((!herc && (rev_id >= 4)) || herc) {
+                        if (!(val64 & ADAPTER_STATUS_RMAC_PCC_IDLE) &&
+                            ((val64 & ADAPTER_STATUS_RC_PRC_QUIESCENT) ==
+                             ADAPTER_STATUS_RC_PRC_QUIESCENT)) {
+                                ret = 1;
+                        }
+                }else {
+                        if (!(val64 & ADAPTER_STATUS_RMAC_PCC_FOUR_IDLE) &&
+                            ((val64 & ADAPTER_STATUS_RC_PRC_QUIESCENT) ==
+                             ADAPTER_STATUS_RC_PRC_QUIESCENT)) {
+                                ret = 1;
+                        }
+                }
+        } else {
+                if ((!herc && (rev_id >= 4)) || herc) {
+                        if (((val64 & ADAPTER_STATUS_RMAC_PCC_IDLE) ==
+                             ADAPTER_STATUS_RMAC_PCC_IDLE) &&
+                            (!(val64 & ADAPTER_STATUS_RC_PRC_QUIESCENT) ||
+                             ((val64 & ADAPTER_STATUS_RC_PRC_QUIESCENT) ==
+                              ADAPTER_STATUS_RC_PRC_QUIESCENT))) {
+                                ret = 1;
+                        }
+                } else {
+                        if (((val64 & ADAPTER_STATUS_RMAC_PCC_FOUR_IDLE) ==
+                             ADAPTER_STATUS_RMAC_PCC_FOUR_IDLE) &&
+                            (!(val64 & ADAPTER_STATUS_RC_PRC_QUIESCENT) ||
+                             ((val64 & ADAPTER_STATUS_RC_PRC_QUIESCENT) ==
+                              ADAPTER_STATUS_RC_PRC_QUIESCENT))) {
+                                ret = 1;
+                        }
+                }
+        }
+
+        return ret;
+}
+/**
+ *  verify_xena_quiescence - Checks whether the H/W is ready
  *  @val64 :  Value read from adapter status register.
  *  @flag : indicates if the adapter enable bit was ever written once
  *  before.
  *  Description: Returns whether the H/W is ready to go or not. Depending
- *  on whether adapter enable bit was written or not the comparison 
+ *  on whether adapter enable bit was written or not the comparison
  *  differs and the calling function passes the input argument flag to
  *  indicate this.
- *  Return: 1 If xena is quiescence 
+ *  Return: 1 If xena is quiescence
  *          0 If Xena is not quiescence
  */
 
-static int verify_xena_quiescence(u64 val64, int flag)
+static int verify_xena_quiescence(nic_t *sp, u64 val64, int flag)
 {
-        int ret = 0;
+        int ret = 0, herc;
         u64 tmp64 = ~((u64) val64);
+        int rev_id = get_xena_rev_id(sp->pdev);
 
+        herc = (sp->device_type == XFRAME_II_DEVICE);
         if (!
             (tmp64 &
              (ADAPTER_STATUS_TDMA_READY | ADAPTER_STATUS_RDMA_READY |
@@ -1263,25 +1793,7 @@ static int verify_xena_quiescence(u64 val64, int flag)
               ADAPTER_STATUS_PIC_QUIESCENT | ADAPTER_STATUS_MC_DRAM_READY |
               ADAPTER_STATUS_MC_QUEUES_READY | ADAPTER_STATUS_M_PLL_LOCK |
               ADAPTER_STATUS_P_PLL_LOCK))) {
-                if (flag == FALSE) {
-                        if (!(val64 & ADAPTER_STATUS_RMAC_PCC_IDLE) &&
-                            ((val64 & ADAPTER_STATUS_RC_PRC_QUIESCENT) ==
-                             ADAPTER_STATUS_RC_PRC_QUIESCENT)) {
-
-                                ret = 1;
-
-                        }
-                } else {
-                        if (((val64 & ADAPTER_STATUS_RMAC_PCC_IDLE) ==
-                             ADAPTER_STATUS_RMAC_PCC_IDLE) &&
-                            (!(val64 & ADAPTER_STATUS_RC_PRC_QUIESCENT) ||
-                             ((val64 & ADAPTER_STATUS_RC_PRC_QUIESCENT) ==
-                              ADAPTER_STATUS_RC_PRC_QUIESCENT))) {
-
-                                ret = 1;
-
-                        }
-                }
+                ret = check_prc_pcc_state(val64, flag, rev_id, herc);
         }
 
         return ret;
@@ -1290,12 +1802,12 @@ static int verify_xena_quiescence(u64 val64, int flag)
 /**
  * fix_mac_address -  Fix for Mac addr problem on Alpha platforms
  * @sp: Pointer to device specifc structure
- * Description : 
+ * Description :
  * New procedure to clear mac address reading  problems on Alpha platforms
  *
  */
 
-static void fix_mac_address(nic_t * sp)
+void fix_mac_address(nic_t * sp)
 {
         XENA_dev_config_t __iomem *bar0 = sp->bar0;
         u64 val64;
@@ -1303,20 +1815,21 @@ static void fix_mac_address(nic_t * sp)
 
         while (fix_mac[i] != END_SIGN) {
                 writeq(fix_mac[i++], &bar0->gpio_control);
+                udelay(10);
                 val64 = readq(&bar0->gpio_control);
         }
 }
 
 /**
- *  start_nic - Turns the device on   
+ *  start_nic - Turns the device on
  *  @nic : device private variable.
- *  Description: 
- *  This function actually turns the device on. Before this  function is 
- *  called,all Registers are configured from their reset states 
- *  and shared memory is allocated but the NIC is still quiescent. On 
+ *  Description:
+ *  This function actually turns the device on. Before this  function is
+ *  called,all Registers are configured from their reset states
+ *  and shared memory is allocated but the NIC is still quiescent. On
  *  calling this function, the device interrupts are cleared and the NIC is
  *  literally switched on by writing into the adapter control register.
- *  Return Value: 
+ *  Return Value:
  *  SUCCESS on success and -1 on failure.
  */
 
@@ -1325,8 +1838,8 @@ static int start_nic(struct s2io_nic *nic)
         XENA_dev_config_t __iomem *bar0 = nic->bar0;
         struct net_device *dev = nic->dev;
         register u64 val64 = 0;
-        u16 interruptible, i;
-        u16 subid;
+        u16 interruptible;
+        u16 subid, i;
         mac_info_t *mac_control;
         struct config_param *config;
 
@@ -1335,10 +1848,12 @@ static int start_nic(struct s2io_nic *nic)
 
         /*  PRC Initialization and configuration */
         for (i = 0; i < config->rx_ring_num; i++) {
-                writeq((u64) nic->rx_blocks[i][0].block_dma_addr,
+                writeq((u64) mac_control->rings[i].rx_blocks[0].block_dma_addr,
                        &bar0->prc_rxd0_n[i]);
 
                 val64 = readq(&bar0->prc_ctrl_n[i]);
+                if (nic->config.bimodal)
+                        val64 |= PRC_CTRL_BIMODAL_INTERRUPT;
 #ifndef CONFIG_2BUFF_MODE
                 val64 |= PRC_CTRL_RC_ENABLED;
 #else
@@ -1354,7 +1869,7 @@ static int start_nic(struct s2io_nic *nic)
         writeq(val64, &bar0->rx_pa_cfg);
 #endif
 
-        /* 
+        /*
          * Enabling MC-RLDRAM. After enabling the device, we timeout
          * for around 100ms, which is approximately the time required
          * for the device to be ready for operation.
@@ -1364,27 +1879,27 @@ static int start_nic(struct s2io_nic *nic)
         SPECIAL_REG_WRITE(val64, &bar0->mc_rldram_mrs, UF);
         val64 = readq(&bar0->mc_rldram_mrs);
 
-        msleep(100);                    /* Delay by around 100 ms. */
+        msleep(100);    /* Delay by around 100 ms. */
 
         /* Enabling ECC Protection. */
         val64 = readq(&bar0->adapter_control);
         val64 &= ~ADAPTER_ECC_EN;
         writeq(val64, &bar0->adapter_control);
 
-        /* 
-         * Clearing any possible Link state change interrupts that 
+        /*
+         * Clearing any possible Link state change interrupts that
          * could have popped up just before Enabling the card.
          */
         val64 = readq(&bar0->mac_rmac_err_reg);
         if (val64)
                 writeq(val64, &bar0->mac_rmac_err_reg);
 
-        /* 
-         * Verify if the device is ready to be enabled, if so enable 
+        /*
+         * Verify if the device is ready to be enabled, if so enable
          * it.
          */
         val64 = readq(&bar0->adapter_status);
-        if (!verify_xena_quiescence(val64, nic->device_enabled_once)) {
+        if (!verify_xena_quiescence(nic, val64, nic->device_enabled_once)) {
                 DBG_PRINT(ERR_DBG, "%s: device is not ready, ", dev->name);
                 DBG_PRINT(ERR_DBG, "Adapter status reads: 0x%llx\n",
                           (unsigned long long) val64);
@@ -1392,16 +1907,18 @@ static int start_nic(struct s2io_nic *nic)
         }
 
         /*  Enable select interrupts */
-        interruptible = TX_TRAFFIC_INTR | RX_TRAFFIC_INTR | TX_MAC_INTR |
-            RX_MAC_INTR;
+        interruptible = TX_TRAFFIC_INTR | RX_TRAFFIC_INTR;
+        interruptible |= TX_PIC_INTR | RX_PIC_INTR;
+        interruptible |= TX_MAC_INTR | RX_MAC_INTR;
+
         en_dis_able_nic_intrs(nic, interruptible, ENABLE_INTRS);
 
-        /* 
+        /*
          * With some switches, link might be already up at this point.
-         * Because of this weird behavior, when we enable laser, 
-         * we may not get link. We need to handle this. We cannot 
-         * figure out which switch is misbehaving. So we are forced to 
-         * make a global change. 
+         * Because of this weird behavior, when we enable laser,
+         * we may not get link. We need to handle this. We cannot
+         * figure out which switch is misbehaving. So we are forced to
+         * make a global change.
          */
 
         /* Enabling Laser. */
@@ -1411,44 +1928,30 @@ static int start_nic(struct s2io_nic *nic)
 
         /* SXE-002: Initialize link and activity LED */
         subid = nic->pdev->subsystem_device;
-        if ((subid & 0xFF) >= 0x07) {
+        if (((subid & 0xFF) >= 0x07) &&
+            (nic->device_type == XFRAME_I_DEVICE)) {
                 val64 = readq(&bar0->gpio_control);
                 val64 |= 0x0000800000000000ULL;
                 writeq(val64, &bar0->gpio_control);
                 val64 = 0x0411040400000000ULL;
-                writeq(val64, (void __iomem *) bar0 + 0x2700);
+                writeq(val64, (void __iomem *) ((u8 *) bar0 + 0x2700));
         }
 
-        /* 
-         * Don't see link state interrupts on certain switches, so 
+        /*
+         * Don't see link state interrupts on certain switches, so
          * directly scheduling a link state task from here.
          */
         schedule_work(&nic->set_link_task);
 
-        /* 
-         * Here we are performing soft reset on XGXS to 
-         * force link down. Since link is already up, we will get
-         * link state change interrupt after this reset
-         */
-        SPECIAL_REG_WRITE(0x80010515001E0000ULL, &bar0->dtx_control, UF);
-        val64 = readq(&bar0->dtx_control);
-        udelay(50);
-        SPECIAL_REG_WRITE(0x80010515001E00E0ULL, &bar0->dtx_control, UF);
-        val64 = readq(&bar0->dtx_control);
-        udelay(50);
-        SPECIAL_REG_WRITE(0x80070515001F00E4ULL, &bar0->dtx_control, UF);
-        val64 = readq(&bar0->dtx_control);
-        udelay(50);
-
         return SUCCESS;
 }
 
-/** 
- *  free_tx_buffers - Free all queued Tx buffers 
+/**
+ *  free_tx_buffers - Free all queued Tx buffers
  *  @nic : device private variable.
- *  Description: 
+ *  Description:
  *  Free all queued Tx buffers.
- *  Return Value: void 
+ *  Return Value: void
 */
 
 static void free_tx_buffers(struct s2io_nic *nic)
@@ -1459,39 +1962,61 @@ static void free_tx_buffers(struct s2io_nic *nic)
         int i, j;
         mac_info_t *mac_control;
         struct config_param *config;
-        int cnt = 0;
+        int cnt = 0, frg_cnt;
 
         mac_control = &nic->mac_control;
         config = &nic->config;
 
         for (i = 0; i < config->tx_fifo_num; i++) {
                 for (j = 0; j < config->tx_cfg[i].fifo_len - 1; j++) {
-                        txdp = (TxD_t *) nic->list_info[i][j].
+                        txdp = (TxD_t *) mac_control->fifos[i].list_info[j].
                             list_virt_addr;
                         skb =
                             (struct sk_buff *) ((unsigned long) txdp->
                                                 Host_Control);
                         if (skb == NULL) {
-                                memset(txdp, 0, sizeof(TxD_t));
+                                memset(txdp, 0, sizeof(TxD_t) *
+                                       config->max_txds);
                                 continue;
                         }
+                        frg_cnt = skb_shinfo(skb)->nr_frags;
+                        pci_unmap_single(nic->pdev, (dma_addr_t)
+                                         txdp->Buffer_Pointer,
+                                         skb->len - skb->data_len,
+                                         PCI_DMA_TODEVICE);
+                        if (frg_cnt) {
+                                TxD_t *temp;
+                                temp = txdp;
+                                txdp++;
+                                for (j = 0; j < frg_cnt; j++, txdp++) {
+                                        skb_frag_t *frag =
+                                            &skb_shinfo(skb)->frags[j];
+                                        pci_unmap_page(nic->pdev,
+                                                       (dma_addr_t)
+                                                       txdp->
+                                                       Buffer_Pointer,
+                                                       frag->size,
+                                                       PCI_DMA_TODEVICE);
+                                }
+                                txdp = temp;
+                        }
                         dev_kfree_skb(skb);
-                        memset(txdp, 0, sizeof(TxD_t));
+                        memset(txdp, 0, sizeof(TxD_t) * config->max_txds);
                         cnt++;
                 }
                 DBG_PRINT(INTR_DBG,
                           "%s:forcibly freeing %d skbs on FIFO%d\n",
                           dev->name, cnt, i);
-                mac_control->tx_curr_get_info[i].offset = 0;
-                mac_control->tx_curr_put_info[i].offset = 0;
+                mac_control->fifos[i].tx_curr_get_info.offset = 0;
+                mac_control->fifos[i].tx_curr_put_info.offset = 0;
         }
 }
 
-/**  
- *   stop_nic -  To stop the nic  
+/**
+ *   stop_nic -  To stop the nic
  *   @nic ; device private variable.
- *   Description: 
- *   This function does exactly the opposite of what the start_nic() 
+ *   Description:
+ *   This function does exactly the opposite of what the start_nic()
  *   function does. This function is called to stop the device.
  *   Return Value:
  *   void.
@@ -1509,8 +2034,9 @@ static void stop_nic(struct s2io_nic *nic)
         config = &nic->config;
 
         /*  Disable all interrupts */
-        interruptible = TX_TRAFFIC_INTR | RX_TRAFFIC_INTR | TX_MAC_INTR |
-            RX_MAC_INTR;
+        interruptible = TX_TRAFFIC_INTR | RX_TRAFFIC_INTR;
+        interruptible |= TX_PIC_INTR | RX_PIC_INTR;
+        interruptible |= TX_MAC_INTR | RX_MAC_INTR;
         en_dis_able_nic_intrs(nic, interruptible, DISABLE_INTRS);
 
         /*  Disable PRCs */
@@ -1521,11 +2047,11 @@ static void stop_nic(struct s2io_nic *nic)
         }
 }
 
-/**  
- *  fill_rx_buffers - Allocates the Rx side skbs 
+/**
+ *  fill_rx_buffers - Allocates the Rx side skbs
  *  @nic:  device private variable
- *  @ring_no: ring number 
- *  Description: 
+ *  @ring_no: ring number
+ *  Description:
  *  The function allocates Rx side skbs and puts the physical
  *  address of these buffers into the RxD buffer pointers, so that the NIC
  *  can DMA the received frame into these locations.
@@ -1533,8 +2059,8 @@ static void stop_nic(struct s2io_nic *nic)
  *  1. single buffer,
  *  2. three buffer and
  *  3. Five buffer modes.
- *  Each mode defines how many fragments the received frame will be split 
- *  up into by the NIC. The frame is split into L3 header, L4 Header, 
+ *  Each mode defines how many fragments the received frame will be split
+ *  up into by the NIC. The frame is split into L3 header, L4 Header,
  *  L4 payload in three buffer mode and in 5 buffer mode, L4 payload itself
  *  is split into 3 fragments. As of now only single buffer mode is
  *  supported.
@@ -1542,7 +2068,7 @@ static void stop_nic(struct s2io_nic *nic)
  *  SUCCESS on success or an appropriate -ve value on failure.
  */
 
-static int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
+int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
 {
         struct net_device *dev = nic->dev;
         struct sk_buff *skb;
@@ -1550,34 +2076,35 @@ static int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
         int off, off1, size, block_no, block_no1;
         int offset, offset1;
         u32 alloc_tab = 0;
-        u32 alloc_cnt = nic->pkt_cnt[ring_no] -
-            atomic_read(&nic->rx_bufs_left[ring_no]);
+        u32 alloc_cnt;
         mac_info_t *mac_control;
         struct config_param *config;
 #ifdef CONFIG_2BUFF_MODE
         RxD_t *rxdpnext;
         int nextblk;
-        unsigned long tmp;
+        u64 tmp;
         buffAdd_t *ba;
         dma_addr_t rxdpphys;
 #endif
 #ifndef CONFIG_S2IO_NAPI
         unsigned long flags;
 #endif
+        RxD_t *first_rxdp = NULL;
 
         mac_control = &nic->mac_control;
         config = &nic->config;
-
+        alloc_cnt = mac_control->rings[ring_no].pkt_cnt -
+            atomic_read(&nic->rx_bufs_left[ring_no]);
         size = dev->mtu + HEADER_ETHERNET_II_802_3_SIZE +
             HEADER_802_2_SIZE + HEADER_SNAP_SIZE;
 
         while (alloc_tab < alloc_cnt) {
-                block_no = mac_control->rx_curr_put_info[ring_no].
+                block_no = mac_control->rings[ring_no].rx_curr_put_info.
                     block_index;
-                block_no1 = mac_control->rx_curr_get_info[ring_no].
+                block_no1 = mac_control->rings[ring_no].rx_curr_get_info.
                     block_index;
-                off = mac_control->rx_curr_put_info[ring_no].offset;
-                off1 = mac_control->rx_curr_get_info[ring_no].offset;
+                off = mac_control->rings[ring_no].rx_curr_put_info.offset;
+                off1 = mac_control->rings[ring_no].rx_curr_get_info.offset;
 #ifndef CONFIG_2BUFF_MODE
                 offset = block_no * (MAX_RXDS_PER_BLOCK + 1) + off;
                 offset1 = block_no1 * (MAX_RXDS_PER_BLOCK + 1) + off1;
@@ -1586,7 +2113,7 @@ static int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
                 offset1 = block_no1 * (MAX_RXDS_PER_BLOCK) + off1;
 #endif
 
-                rxdp = nic->rx_blocks[ring_no][block_no].
+                rxdp = mac_control->rings[ring_no].rx_blocks[block_no].
                     block_virt_addr + off;
                 if ((offset == offset1) && (rxdp->Host_Control)) {
                         DBG_PRINT(INTR_DBG, "%s: Get and Put", dev->name);
@@ -1595,15 +2122,15 @@ static int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
                 }
 #ifndef CONFIG_2BUFF_MODE
                 if (rxdp->Control_1 == END_OF_BLOCK) {
-                        mac_control->rx_curr_put_info[ring_no].
+                        mac_control->rings[ring_no].rx_curr_put_info.
                             block_index++;
-                        mac_control->rx_curr_put_info[ring_no].
-                            block_index %= nic->block_count[ring_no];
-                        block_no = mac_control->rx_curr_put_info
-                            [ring_no].block_index;
+                        mac_control->rings[ring_no].rx_curr_put_info.
+                            block_index %= mac_control->rings[ring_no].block_count;
+                        block_no = mac_control->rings[ring_no].rx_curr_put_info.
+                                block_index;
                         off++;
                         off %= (MAX_RXDS_PER_BLOCK + 1);
-                        mac_control->rx_curr_put_info[ring_no].offset =
+                        mac_control->rings[ring_no].rx_curr_put_info.offset =
                             off;
                         rxdp = (RxD_t *) ((unsigned long) rxdp->Control_2);
                         DBG_PRINT(INTR_DBG, "%s: Next block at: %p\n",
@@ -1611,30 +2138,30 @@ static int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
                 }
 #ifndef CONFIG_S2IO_NAPI
                 spin_lock_irqsave(&nic->put_lock, flags);
-                nic->put_pos[ring_no] =
+                mac_control->rings[ring_no].put_pos =
                     (block_no * (MAX_RXDS_PER_BLOCK + 1)) + off;
                 spin_unlock_irqrestore(&nic->put_lock, flags);
 #endif
 #else
                 if (rxdp->Host_Control == END_OF_BLOCK) {
-                        mac_control->rx_curr_put_info[ring_no].
+                        mac_control->rings[ring_no].rx_curr_put_info.
                             block_index++;
-                        mac_control->rx_curr_put_info[ring_no].
-                            block_index %= nic->block_count[ring_no];
-                        block_no = mac_control->rx_curr_put_info
-                            [ring_no].block_index;
+                        mac_control->rings[ring_no].rx_curr_put_info.block_index
+                            %= mac_control->rings[ring_no].block_count;
+                        block_no = mac_control->rings[ring_no].rx_curr_put_info
+                            .block_index;
                         off = 0;
                         DBG_PRINT(INTR_DBG, "%s: block%d at: 0x%llx\n",
                                   dev->name, block_no,
                                   (unsigned long long) rxdp->Control_1);
-                        mac_control->rx_curr_put_info[ring_no].offset =
+                        mac_control->rings[ring_no].rx_curr_put_info.offset =
                             off;
-                        rxdp = nic->rx_blocks[ring_no][block_no].
+                        rxdp = mac_control->rings[ring_no].rx_blocks[block_no].
                             block_virt_addr;
                 }
 #ifndef CONFIG_S2IO_NAPI
                 spin_lock_irqsave(&nic->put_lock, flags);
-                nic->put_pos[ring_no] = (block_no *
+                mac_control->rings[ring_no].put_pos = (block_no *
                                          (MAX_RXDS_PER_BLOCK + 1)) + off;
                 spin_unlock_irqrestore(&nic->put_lock, flags);
 #endif
@@ -1646,27 +2173,27 @@ static int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
                 if (rxdp->Control_2 & BIT(0))
 #endif
                 {
-                        mac_control->rx_curr_put_info[ring_no].
+                        mac_control->rings[ring_no].rx_curr_put_info.
                             offset = off;
                         goto end;
                 }
 #ifdef  CONFIG_2BUFF_MODE
-                /* 
-                 * RxDs Spanning cache lines will be replenished only 
-                 * if the succeeding RxD is also owned by Host. It 
-                 * will always be the ((8*i)+3) and ((8*i)+6) 
-                 * descriptors for the 48 byte descriptor. The offending 
+                /*
+                 * RxDs Spanning cache lines will be replenished only
+                 * if the succeeding RxD is also owned by Host. It
+                 * will always be the ((8*i)+3) and ((8*i)+6)
+                 * descriptors for the 48 byte descriptor. The offending
                  * decsriptor is of-course the 3rd descriptor.
                  */
-                rxdpphys = nic->rx_blocks[ring_no][block_no].
+                rxdpphys = mac_control->rings[ring_no].rx_blocks[block_no].
                     block_dma_addr + (off * sizeof(RxD_t));
                 if (((u64) (rxdpphys)) % 128 > 80) {
-                        rxdpnext = nic->rx_blocks[ring_no][block_no].
+                        rxdpnext = mac_control->rings[ring_no].rx_blocks[block_no].
                             block_virt_addr + (off + 1);
                         if (rxdpnext->Host_Control == END_OF_BLOCK) {
                                 nextblk = (block_no + 1) %
-                                    (nic->block_count[ring_no]);
-                                rxdpnext = nic->rx_blocks[ring_no]
+                                    (mac_control->rings[ring_no].block_count);
+                                rxdpnext = mac_control->rings[ring_no].rx_blocks
                                     [nextblk].block_virt_addr;
                         }
                         if (rxdpnext->Control_2 & BIT(0))
@@ -1682,6 +2209,10 @@ static int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
                 if (!skb) {
                         DBG_PRINT(ERR_DBG, "%s: Out of ", dev->name);
                         DBG_PRINT(ERR_DBG, "memory to allocate SKBs\n");
+                        if (first_rxdp) {
+                                wmb();
+                                first_rxdp->Control_1 |= RXD_OWN_XENA;
+                        }
                         return -ENOMEM;
                 }
 #ifndef CONFIG_2BUFF_MODE
@@ -1692,12 +2223,13 @@ static int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
                 rxdp->Control_2 &= (~MASK_BUFFER0_SIZE);
                 rxdp->Control_2 |= SET_BUFFER0_SIZE(size);
                 rxdp->Host_Control = (unsigned long) (skb);
-                rxdp->Control_1 |= RXD_OWN_XENA;
+                if (alloc_tab & ((1 << rxsync_frequency) - 1))
+                        rxdp->Control_1 |= RXD_OWN_XENA;
                 off++;
                 off %= (MAX_RXDS_PER_BLOCK + 1);
-                mac_control->rx_curr_put_info[ring_no].offset = off;
+                mac_control->rings[ring_no].rx_curr_put_info.offset = off;
 #else
-                ba = &nic->ba[ring_no][block_no][off];
+                ba = &mac_control->rings[ring_no].ba[block_no][off];
                 skb_reserve(skb, BUF0_LEN);
                 tmp = ((unsigned long) skb->data & ALIGN_SIZE);
                 if (tmp)
@@ -1719,22 +2251,41 @@ static int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
                 rxdp->Control_2 |= SET_BUFFER1_SIZE(1); /* dummy. */
                 rxdp->Control_2 |= BIT(0);      /* Set Buffer_Empty bit. */
                 rxdp->Host_Control = (u64) ((unsigned long) (skb));
-                rxdp->Control_1 |= RXD_OWN_XENA;
+                if (alloc_tab & ((1 << rxsync_frequency) - 1))
+                        rxdp->Control_1 |= RXD_OWN_XENA;
                 off++;
-                mac_control->rx_curr_put_info[ring_no].offset = off;
+                mac_control->rings[ring_no].rx_curr_put_info.offset = off;
 #endif
+                rxdp->Control_2 |= SET_RXD_MARKER;
+
+                if (!(alloc_tab & ((1 << rxsync_frequency) - 1))) {
+                        if (first_rxdp) {
+                                wmb();
+                                first_rxdp->Control_1 |= RXD_OWN_XENA;
+                        }
+                        first_rxdp = rxdp;
+                }
                 atomic_inc(&nic->rx_bufs_left[ring_no]);
                 alloc_tab++;
         }
 
       end:
+        /* Transfer ownership of first descriptor to adapter just before
+         * exiting. Before that, use memory barrier so that ownership
+         * and other fields are seen by adapter correctly.
+         */
+        if (first_rxdp) {
+                wmb();
+                first_rxdp->Control_1 |= RXD_OWN_XENA;
+        }
+
         return SUCCESS;
 }
 
 /**
- *  free_rx_buffers - Frees all Rx buffers   
+ *  free_rx_buffers - Frees all Rx buffers
  *  @sp: device private variable.
- *  Description: 
+ *  Description:
  *  This function will free all Rx buffers allocated by host.
  *  Return Value:
  *  NONE.
@@ -1758,7 +2309,8 @@ static void free_rx_buffers(struct s2io_nic *sp)
         for (i = 0; i < config->rx_ring_num; i++) {
                 for (j = 0, blk = 0; j < config->rx_cfg[i].num_rxd; j++) {
                         off = j % (MAX_RXDS_PER_BLOCK + 1);
-                        rxdp = sp->rx_blocks[i][blk].block_virt_addr + off;
+                        rxdp = mac_control->rings[i].rx_blocks[blk].
+                                block_virt_addr + off;
 
 #ifndef CONFIG_2BUFF_MODE
                         if (rxdp->Control_1 == END_OF_BLOCK) {
@@ -1793,7 +2345,7 @@ static void free_rx_buffers(struct s2io_nic *sp)
                                                  HEADER_SNAP_SIZE,
                                                  PCI_DMA_FROMDEVICE);
 #else
-                                ba = &sp->ba[i][blk][off];
+                                ba = &mac_control->rings[i].ba[blk][off];
                                 pci_unmap_single(sp->pdev, (dma_addr_t)
                                                  rxdp->Buffer0_ptr,
                                                  BUF0_LEN,
@@ -1813,10 +2365,10 @@ static void free_rx_buffers(struct s2io_nic *sp)
                         }
                         memset(rxdp, 0, sizeof(RxD_t));
                 }
-                mac_control->rx_curr_put_info[i].block_index = 0;
-                mac_control->rx_curr_get_info[i].block_index = 0;
-                mac_control->rx_curr_put_info[i].offset = 0;
-                mac_control->rx_curr_get_info[i].offset = 0;
+                mac_control->rings[i].rx_curr_put_info.block_index = 0;
+                mac_control->rings[i].rx_curr_get_info.block_index = 0;
+                mac_control->rings[i].rx_curr_put_info.offset = 0;
+                mac_control->rings[i].rx_curr_get_info.offset = 0;
                 atomic_set(&sp->rx_bufs_left[i], 0);
                 DBG_PRINT(INIT_DBG, "%s:Freed 0x%x Rx Buffers on ring%d\n",
                           dev->name, buf_cnt, i);
@@ -1826,7 +2378,7 @@ static void free_rx_buffers(struct s2io_nic *sp)
 /**
  * s2io_poll - Rx interrupt handler for NAPI support
  * @dev : pointer to the device structure.
- * @budget : The number of packets that were budgeted to be processed 
+ * @budget : The number of packets that were budgeted to be processed
  * during  one pass through the 'Poll" function.
  * Description:
  * Comes into picture only if NAPI support has been incorporated. It does
@@ -1836,160 +2388,36 @@ static void free_rx_buffers(struct s2io_nic *sp)
  * 0 on success and 1 if there are No Rx packets to be processed.
  */
 
-#ifdef CONFIG_S2IO_NAPI
+#if defined(CONFIG_S2IO_NAPI)
 static int s2io_poll(struct net_device *dev, int *budget)
 {
         nic_t *nic = dev->priv;
-        XENA_dev_config_t __iomem *bar0 = nic->bar0;
-        int pkts_to_process = *budget, pkt_cnt = 0;
-        register u64 val64 = 0;
-        rx_curr_get_info_t get_info, put_info;
-        int i, get_block, put_block, get_offset, put_offset, ring_bufs;
-#ifndef CONFIG_2BUFF_MODE
-        u16 val16, cksum;
-#endif
-        struct sk_buff *skb;
-        RxD_t *rxdp;
+        int pkt_cnt = 0, org_pkts_to_process;
         mac_info_t *mac_control;
         struct config_param *config;
-#ifdef CONFIG_2BUFF_MODE
-        buffAdd_t *ba;
-#endif
+        XENA_dev_config_t *bar0 = (XENA_dev_config_t *) nic->bar0;
+        u64 val64;
+        int i;
 
+        atomic_inc(&nic->isr_cnt);
         mac_control = &nic->mac_control;
         config = &nic->config;
 
-        if (pkts_to_process > dev->quota)
-                pkts_to_process = dev->quota;
+        nic->pkts_to_process = *budget;
+        if (nic->pkts_to_process > dev->quota)
+                nic->pkts_to_process = dev->quota;
+        org_pkts_to_process = nic->pkts_to_process;
 
         val64 = readq(&bar0->rx_traffic_int);
         writeq(val64, &bar0->rx_traffic_int);
 
         for (i = 0; i < config->rx_ring_num; i++) {
-                get_info = mac_control->rx_curr_get_info[i];
-                get_block = get_info.block_index;
-                put_info = mac_control->rx_curr_put_info[i];
-                put_block = put_info.block_index;
-                ring_bufs = config->rx_cfg[i].num_rxd;
-                rxdp = nic->rx_blocks[i][get_block].block_virt_addr +
-                    get_info.offset;
-#ifndef CONFIG_2BUFF_MODE
-                get_offset = (get_block * (MAX_RXDS_PER_BLOCK + 1)) +
-                    get_info.offset;
-                put_offset = (put_block * (MAX_RXDS_PER_BLOCK + 1)) +
-                    put_info.offset;
-                while ((!(rxdp->Control_1 & RXD_OWN_XENA)) &&
-                       (((get_offset + 1) % ring_bufs) != put_offset)) {
-                        if (--pkts_to_process < 0) {
-                                goto no_rx;
-                        }
-                        if (rxdp->Control_1 == END_OF_BLOCK) {
-                                rxdp =
-                                    (RxD_t *) ((unsigned long) rxdp->
-                                               Control_2);
-                                get_info.offset++;
-                                get_info.offset %=
-                                    (MAX_RXDS_PER_BLOCK + 1);
-                                get_block++;
-                                get_block %= nic->block_count[i];
-                                mac_control->rx_curr_get_info[i].
-                                    offset = get_info.offset;
-                                mac_control->rx_curr_get_info[i].
-                                    block_index = get_block;
-                                continue;
-                        }
-                        get_offset =
-                            (get_block * (MAX_RXDS_PER_BLOCK + 1)) +
-                            get_info.offset;
-                        skb =
-                            (struct sk_buff *) ((unsigned long) rxdp->
-                                                Host_Control);
-                        if (skb == NULL) {
-                                DBG_PRINT(ERR_DBG, "%s: The skb is ",
-                                          dev->name);
-                                DBG_PRINT(ERR_DBG, "Null in Rx Intr\n");
-                                goto no_rx;
-                        }
-                        val64 = RXD_GET_BUFFER0_SIZE(rxdp->Control_2);
-                        val16 = (u16) (val64 >> 48);
-                        cksum = RXD_GET_L4_CKSUM(rxdp->Control_1);
-                        pci_unmap_single(nic->pdev, (dma_addr_t)
-                                         rxdp->Buffer0_ptr,
-                                         dev->mtu +
-                                         HEADER_ETHERNET_II_802_3_SIZE +
-                                         HEADER_802_2_SIZE +
-                                         HEADER_SNAP_SIZE,
-                                         PCI_DMA_FROMDEVICE);
-                        rx_osm_handler(nic, val16, rxdp, i);
-                        pkt_cnt++;
-                        get_info.offset++;
-                        get_info.offset %= (MAX_RXDS_PER_BLOCK + 1);
-                        rxdp =
-                            nic->rx_blocks[i][get_block].block_virt_addr +
-                            get_info.offset;
-                        mac_control->rx_curr_get_info[i].offset =
-                            get_info.offset;
+                rx_intr_handler(&mac_control->rings[i]);
+                pkt_cnt = org_pkts_to_process - nic->pkts_to_process;
+                if (!nic->pkts_to_process) {
+                        /* Quota for the current iteration has been met */
+                        goto no_rx;
                 }
-#else
-                get_offset = (get_block * (MAX_RXDS_PER_BLOCK + 1)) +
-                    get_info.offset;
-                put_offset = (put_block * (MAX_RXDS_PER_BLOCK + 1)) +
-                    put_info.offset;
-                while (((!(rxdp->Control_1 & RXD_OWN_XENA)) &&
-                        !(rxdp->Control_2 & BIT(0))) &&
-                       (((get_offset + 1) % ring_bufs) != put_offset)) {
-                        if (--pkts_to_process < 0) {
-                                goto no_rx;
-                        }
-                        skb = (struct sk_buff *) ((unsigned long)
-                                                  rxdp->Host_Control);
-                        if (skb == NULL) {
-                                DBG_PRINT(ERR_DBG, "%s: The skb is ",
-                                          dev->name);
-                                DBG_PRINT(ERR_DBG, "Null in Rx Intr\n");
-                                goto no_rx;
-                        }
-
-                        pci_unmap_single(nic->pdev, (dma_addr_t)
-                                         rxdp->Buffer0_ptr,
-                                         BUF0_LEN, PCI_DMA_FROMDEVICE);
-                        pci_unmap_single(nic->pdev, (dma_addr_t)
-                                         rxdp->Buffer1_ptr,
-                                         BUF1_LEN, PCI_DMA_FROMDEVICE);
-                        pci_unmap_single(nic->pdev, (dma_addr_t)
-                                         rxdp->Buffer2_ptr,
-                                         dev->mtu + BUF0_LEN + 4,
-                                         PCI_DMA_FROMDEVICE);
-                        ba = &nic->ba[i][get_block][get_info.offset];
-
-                        rx_osm_handler(nic, rxdp, i, ba);
-
-                        get_info.offset++;
-                        mac_control->rx_curr_get_info[i].offset =
-                            get_info.offset;
-                        rxdp =
-                            nic->rx_blocks[i][get_block].block_virt_addr +
-                            get_info.offset;
-
-                        if (get_info.offset &&
-                            (!(get_info.offset % MAX_RXDS_PER_BLOCK))) {
-                                get_info.offset = 0;
-                                mac_control->rx_curr_get_info[i].
-                                    offset = get_info.offset;
-                                get_block++;
-                                get_block %= nic->block_count[i];
-                                mac_control->rx_curr_get_info[i].
-                                    block_index = get_block;
-                                rxdp =
-                                    nic->rx_blocks[i][get_block].
-                                    block_virt_addr;
-                        }
-                        get_offset =
-                            (get_block * (MAX_RXDS_PER_BLOCK + 1)) +
-                            get_info.offset;
-                        pkt_cnt++;
-                }
-#endif
         }
         if (!pkt_cnt)
                 pkt_cnt = 1;
@@ -2007,9 +2435,10 @@ static int s2io_poll(struct net_device *dev, int *budget)
         }
         /* Re enable the Rx interrupts. */
         en_dis_able_nic_intrs(nic, RX_TRAFFIC_INTR, ENABLE_INTRS);
+        atomic_dec(&nic->isr_cnt);
         return 0;
 
-      no_rx:
+no_rx:
         dev->quota -= pkt_cnt;
         *budget -= pkt_cnt;
 
@@ -2020,279 +2449,204 @@ static int s2io_poll(struct net_device *dev, int *budget)
                         break;
                 }
         }
+        atomic_dec(&nic->isr_cnt);
         return 1;
 }
-#else
-/**  
+#endif
+
+/**
  *  rx_intr_handler - Rx interrupt handler
  *  @nic: device private variable.
- *  Description: 
- *  If the interrupt is because of a received frame or if the 
+ *  Description:
+ *  If the interrupt is because of a received frame or if the
  *  receive ring contains fresh as yet un-processed frames,this function is
- *  called. It picks out the RxD at which place the last Rx processing had 
- *  stopped and sends the skb to the OSM's Rx handler and then increments 
+ *  called. It picks out the RxD at which place the last Rx processing had
+ *  stopped and sends the skb to the OSM's Rx handler and then increments
  *  the offset.
  *  Return Value:
  *  NONE.
  */
-
-static void rx_intr_handler(struct s2io_nic *nic)
+static void rx_intr_handler(ring_info_t *ring_data)
 {
+        nic_t *nic = ring_data->nic;
         struct net_device *dev = (struct net_device *) nic->dev;
-        XENA_dev_config_t *bar0 = (XENA_dev_config_t *) nic->bar0;
+        int get_block, get_offset, put_block, put_offset, ring_bufs;
         rx_curr_get_info_t get_info, put_info;
         RxD_t *rxdp;
         struct sk_buff *skb;
-#ifndef CONFIG_2BUFF_MODE
-        u16 val16, cksum;
-#endif
-        register u64 val64 = 0;
-        int get_block, get_offset, put_block, put_offset, ring_bufs;
-        int i, pkt_cnt = 0;
-        mac_info_t *mac_control;
-        struct config_param *config;
-#ifdef CONFIG_2BUFF_MODE
-        buffAdd_t *ba;
+#ifndef CONFIG_S2IO_NAPI
+        int pkt_cnt = 0;
 #endif
+        spin_lock(&nic->rx_lock);
+        if (atomic_read(&nic->card_state) == CARD_DOWN) {
+                DBG_PRINT(ERR_DBG, "%s: %s going down for reset\n",
+                          __FUNCTION__, dev->name);
+                spin_unlock(&nic->rx_lock);
+        }
 
-        mac_control = &nic->mac_control;
-        config = &nic->config;
-
-        /* 
-         * rx_traffic_int reg is an R1 register, hence we read and write back 
-         * the samevalue in the register to clear it.
-         */
-        val64 = readq(&bar0->rx_traffic_int);
-        writeq(val64, &bar0->rx_traffic_int);
-
-        for (i = 0; i < config->rx_ring_num; i++) {
-                get_info = mac_control->rx_curr_get_info[i];
-                get_block = get_info.block_index;
-                put_info = mac_control->rx_curr_put_info[i];
-                put_block = put_info.block_index;
-                ring_bufs = config->rx_cfg[i].num_rxd;
-                rxdp = nic->rx_blocks[i][get_block].block_virt_addr +
-                    get_info.offset;
-#ifndef CONFIG_2BUFF_MODE
-                get_offset = (get_block * (MAX_RXDS_PER_BLOCK + 1)) +
+        get_info = ring_data->rx_curr_get_info;
+        get_block = get_info.block_index;
+        put_info = ring_data->rx_curr_put_info;
+        put_block = put_info.block_index;
+        ring_bufs = get_info.ring_len+1;
+        rxdp = ring_data->rx_blocks[get_block].block_virt_addr +
                     get_info.offset;
-                spin_lock(&nic->put_lock);
-                put_offset = nic->put_pos[i];
-                spin_unlock(&nic->put_lock);
-                while ((!(rxdp->Control_1 & RXD_OWN_XENA)) &&
-                       (((get_offset + 1) % ring_bufs) != put_offset)) {
-                        if (rxdp->Control_1 == END_OF_BLOCK) {
-                                rxdp = (RxD_t *) ((unsigned long)
-                                                  rxdp->Control_2);
-                                get_info.offset++;
-                                get_info.offset %=
-                                    (MAX_RXDS_PER_BLOCK + 1);
-                                get_block++;
-                                get_block %= nic->block_count[i];
-                                mac_control->rx_curr_get_info[i].
-                                    offset = get_info.offset;
-                                mac_control->rx_curr_get_info[i].
-                                    block_index = get_block;
-                                continue;
-                        }
-                        get_offset =
-                            (get_block * (MAX_RXDS_PER_BLOCK + 1)) +
-                            get_info.offset;
-                        skb = (struct sk_buff *) ((unsigned long)
-                                                  rxdp->Host_Control);
-                        if (skb == NULL) {
-                                DBG_PRINT(ERR_DBG, "%s: The skb is ",
-                                          dev->name);
-                                DBG_PRINT(ERR_DBG, "Null in Rx Intr\n");
-                                return;
-                        }
-                        val64 = RXD_GET_BUFFER0_SIZE(rxdp->Control_2);
-                        val16 = (u16) (val64 >> 48);
-                        cksum = RXD_GET_L4_CKSUM(rxdp->Control_1);
-                        pci_unmap_single(nic->pdev, (dma_addr_t)
-                                         rxdp->Buffer0_ptr,
-                                         dev->mtu +
-                                         HEADER_ETHERNET_II_802_3_SIZE +
-                                         HEADER_802_2_SIZE +
-                                         HEADER_SNAP_SIZE,
-                                         PCI_DMA_FROMDEVICE);
-                        rx_osm_handler(nic, val16, rxdp, i);
-                        get_info.offset++;
-                        get_info.offset %= (MAX_RXDS_PER_BLOCK + 1);
-                        rxdp =
-                            nic->rx_blocks[i][get_block].block_virt_addr +
-                            get_info.offset;
-                        mac_control->rx_curr_get_info[i].offset =
-                            get_info.offset;
-                        pkt_cnt++;
-                        if ((indicate_max_pkts)
-                            && (pkt_cnt > indicate_max_pkts))
-                                break;
+        get_offset = (get_block * (MAX_RXDS_PER_BLOCK + 1)) +
+                get_info.offset;
+#ifndef CONFIG_S2IO_NAPI
+        spin_lock(&nic->put_lock);
+        put_offset = ring_data->put_pos;
+        spin_unlock(&nic->put_lock);
+#else
+        put_offset = (put_block * (MAX_RXDS_PER_BLOCK + 1)) +
+                put_info.offset;
+#endif
+        while (RXD_IS_UP2DT(rxdp) &&
+               (((get_offset + 1) % ring_bufs) != put_offset)) {
+                skb = (struct sk_buff *) ((unsigned long)rxdp->Host_Control);
+                if (skb == NULL) {
+                        DBG_PRINT(ERR_DBG, "%s: The skb is ",
+                                  dev->name);
+                        DBG_PRINT(ERR_DBG, "Null in Rx Intr\n");
+                        spin_unlock(&nic->rx_lock);
+                        return;
                 }
+#ifndef CONFIG_2BUFF_MODE
+                pci_unmap_single(nic->pdev, (dma_addr_t)
+                                 rxdp->Buffer0_ptr,
+                                 dev->mtu +
+                                 HEADER_ETHERNET_II_802_3_SIZE +
+                                 HEADER_802_2_SIZE +
+                                 HEADER_SNAP_SIZE,
+                                 PCI_DMA_FROMDEVICE);
 #else
-                get_offset = (get_block * (MAX_RXDS_PER_BLOCK + 1)) +
+                pci_unmap_single(nic->pdev, (dma_addr_t)
+                                 rxdp->Buffer0_ptr,
+                                 BUF0_LEN, PCI_DMA_FROMDEVICE);
+                pci_unmap_single(nic->pdev, (dma_addr_t)
+                                 rxdp->Buffer1_ptr,
+                                 BUF1_LEN, PCI_DMA_FROMDEVICE);
+                pci_unmap_single(nic->pdev, (dma_addr_t)
+                                 rxdp->Buffer2_ptr,
+                                 dev->mtu + BUF0_LEN + 4,
+                                 PCI_DMA_FROMDEVICE);
+#endif
+                rx_osm_handler(ring_data, rxdp);
+                get_info.offset++;
+                ring_data->rx_curr_get_info.offset =
                     get_info.offset;
-                spin_lock(&nic->put_lock);
-                put_offset = nic->put_pos[i];
-                spin_unlock(&nic->put_lock);
-                while (((!(rxdp->Control_1 & RXD_OWN_XENA)) &&
-                        !(rxdp->Control_2 & BIT(0))) &&
-                       (((get_offset + 1) % ring_bufs) != put_offset)) {
-                        skb = (struct sk_buff *) ((unsigned long)
-                                                  rxdp->Host_Control);
-                        if (skb == NULL) {
-                                DBG_PRINT(ERR_DBG, "%s: The skb is ",
-                                          dev->name);
-                                DBG_PRINT(ERR_DBG, "Null in Rx Intr\n");
-                                return;
-                        }
-
-                        pci_unmap_single(nic->pdev, (dma_addr_t)
-                                         rxdp->Buffer0_ptr,
-                                         BUF0_LEN, PCI_DMA_FROMDEVICE);
-                        pci_unmap_single(nic->pdev, (dma_addr_t)
-                                         rxdp->Buffer1_ptr,
-                                         BUF1_LEN, PCI_DMA_FROMDEVICE);
-                        pci_unmap_single(nic->pdev, (dma_addr_t)
-                                         rxdp->Buffer2_ptr,
-                                         dev->mtu + BUF0_LEN + 4,
-                                         PCI_DMA_FROMDEVICE);
-                        ba = &nic->ba[i][get_block][get_info.offset];
-
-                        rx_osm_handler(nic, rxdp, i, ba);
-
-                        get_info.offset++;
-                        mac_control->rx_curr_get_info[i].offset =
-                            get_info.offset;
-                        rxdp =
-                            nic->rx_blocks[i][get_block].block_virt_addr +
-                            get_info.offset;
+                rxdp = ring_data->rx_blocks[get_block].block_virt_addr +
+                    get_info.offset;
+                if (get_info.offset &&
+                    (!(get_info.offset % MAX_RXDS_PER_BLOCK))) {
+                        get_info.offset = 0;
+                        ring_data->rx_curr_get_info.offset
+                            = get_info.offset;
+                        get_block++;
+                        get_block %= ring_data->block_count;
+                        ring_data->rx_curr_get_info.block_index
+                            = get_block;
+                        rxdp = ring_data->rx_blocks[get_block].block_virt_addr;
+                }
 
-                        if (get_info.offset &&
-                            (!(get_info.offset % MAX_RXDS_PER_BLOCK))) {
-                                get_info.offset = 0;
-                                mac_control->rx_curr_get_info[i].
-                                    offset = get_info.offset;
-                                get_block++;
-                                get_block %= nic->block_count[i];
-                                mac_control->rx_curr_get_info[i].
-                                    block_index = get_block;
-                                rxdp =
-                                    nic->rx_blocks[i][get_block].
-                                    block_virt_addr;
-                        }
-                        get_offset =
-                            (get_block * (MAX_RXDS_PER_BLOCK + 1)) +
+                get_offset = (get_block * (MAX_RXDS_PER_BLOCK + 1)) +
                             get_info.offset;
-                        pkt_cnt++;
-                        if ((indicate_max_pkts)
-                            && (pkt_cnt > indicate_max_pkts))
-                                break;
-                }
-#endif
+#ifdef CONFIG_S2IO_NAPI
+                nic->pkts_to_process -= 1;
+                if (!nic->pkts_to_process)
+                        break;
+#else
+                pkt_cnt++;
                 if ((indicate_max_pkts) && (pkt_cnt > indicate_max_pkts))
                         break;
+#endif
         }
+        spin_unlock(&nic->rx_lock);
 }
-#endif
-/**  
+
+/**
  *  tx_intr_handler - Transmit interrupt handler
  *  @nic : device private variable
- *  Description: 
- *  If an interrupt was raised to indicate DMA complete of the 
- *  Tx packet, this function is called. It identifies the last TxD 
- *  whose buffer was freed and frees all skbs whose data have already 
+ *  Description:
+ *  If an interrupt was raised to indicate DMA complete of the
+ *  Tx packet, this function is called. It identifies the last TxD
+ *  whose buffer was freed and frees all skbs whose data have already
  *  DMA'ed into the NICs internal memory.
  *  Return Value:
  *  NONE
  */
 
-static void tx_intr_handler(struct s2io_nic *nic)
+static void tx_intr_handler(fifo_info_t *fifo_data)
 {
-        XENA_dev_config_t __iomem *bar0 = nic->bar0;
+        nic_t *nic = fifo_data->nic;
         struct net_device *dev = (struct net_device *) nic->dev;
         tx_curr_get_info_t get_info, put_info;
         struct sk_buff *skb;
         TxD_t *txdlp;
-        register u64 val64 = 0;
-        int i;
         u16 j, frg_cnt;
-        mac_info_t *mac_control;
-        struct config_param *config;
 
-        mac_control = &nic->mac_control;
-        config = &nic->config;
-
-        /* 
-         * tx_traffic_int reg is an R1 register, hence we read and write 
-         * back the samevalue in the register to clear it.
-         */
-        val64 = readq(&bar0->tx_traffic_int);
-        writeq(val64, &bar0->tx_traffic_int);
+        get_info = fifo_data->tx_curr_get_info;
+        put_info = fifo_data->tx_curr_put_info;
+        txdlp = (TxD_t *) fifo_data->list_info[get_info.offset].
+            list_virt_addr;
+        while ((!(txdlp->Control_1 & TXD_LIST_OWN_XENA)) &&
+               (get_info.offset != put_info.offset) &&
+               (txdlp->Host_Control)) {
+                /* Check for TxD errors */
+                if (txdlp->Control_1 & TXD_T_CODE) {
+                        unsigned long long err;
+                        err = txdlp->Control_1 & TXD_T_CODE;
+                        DBG_PRINT(ERR_DBG, "***TxD error %llx\n",
+                                  err);
+                }
 
-        for (i = 0; i < config->tx_fifo_num; i++) {
-                get_info = mac_control->tx_curr_get_info[i];
-                put_info = mac_control->tx_curr_put_info[i];
-                txdlp = (TxD_t *) nic->list_info[i][get_info.offset].
-                    list_virt_addr;
-                while ((!(txdlp->Control_1 & TXD_LIST_OWN_XENA)) &&
-                       (get_info.offset != put_info.offset) &&
-                       (txdlp->Host_Control)) {
-                        /* Check for TxD errors */
-                        if (txdlp->Control_1 & TXD_T_CODE) {
-                                unsigned long long err;
-                                err = txdlp->Control_1 & TXD_T_CODE;
-                                DBG_PRINT(ERR_DBG, "***TxD error %llx\n",
-                                          err);
-                        }
+                skb = (struct sk_buff *) ((unsigned long)
+                                txdlp->Host_Control);
+                if (skb == NULL) {
+                        DBG_PRINT(ERR_DBG, "%s: Null skb ",
+                        __FUNCTION__);
+                        DBG_PRINT(ERR_DBG, "in Tx Free Intr\n");
+                        return;
+                }
 
-                        skb = (struct sk_buff *) ((unsigned long)
-                                                  txdlp->Host_Control);
-                        if (skb == NULL) {
-                                DBG_PRINT(ERR_DBG, "%s: Null skb ",
-                                          dev->name);
-                                DBG_PRINT(ERR_DBG, "in Tx Free Intr\n");
-                                return;
+                frg_cnt = skb_shinfo(skb)->nr_frags;
+                nic->tx_pkt_count++;
+
+                pci_unmap_single(nic->pdev, (dma_addr_t)
+                                 txdlp->Buffer_Pointer,
+                                 skb->len - skb->data_len,
+                                 PCI_DMA_TODEVICE);
+                if (frg_cnt) {
+                        TxD_t *temp;
+                        temp = txdlp;
+                        txdlp++;
+                        for (j = 0; j < frg_cnt; j++, txdlp++) {
+                                skb_frag_t *frag =
+                                    &skb_shinfo(skb)->frags[j];
+                                if (!txdlp->Buffer_Pointer)
+                                        break;
+                                pci_unmap_page(nic->pdev,
+                                               (dma_addr_t)
+                                               txdlp->
+                                               Buffer_Pointer,
+                                               frag->size,
+                                               PCI_DMA_TODEVICE);
                         }
-                        nic->tx_pkt_count++;
-
-                        frg_cnt = skb_shinfo(skb)->nr_frags;
-
-                        /*  For unfragmented skb */
-                        pci_unmap_single(nic->pdev, (dma_addr_t)
-                                         txdlp->Buffer_Pointer,
-                                         skb->len - skb->data_len,
-                                         PCI_DMA_TODEVICE);
-                        if (frg_cnt) {
-                                TxD_t *temp = txdlp;
-                                txdlp++;
-                                for (j = 0; j < frg_cnt; j++, txdlp++) {
-                                        skb_frag_t *frag =
-                                            &skb_shinfo(skb)->frags[j];
-                                        pci_unmap_page(nic->pdev,
-                                                       (dma_addr_t)
-                                                       txdlp->
-                                                       Buffer_Pointer,
-                                                       frag->size,
-                                                       PCI_DMA_TODEVICE);
-                                }
-                                txdlp = temp;
-                        }
-                        memset(txdlp, 0,
-                               (sizeof(TxD_t) * config->max_txds));
-
-                        /* Updating the statistics block */
-                        nic->stats.tx_packets++;
-                        nic->stats.tx_bytes += skb->len;
-                        dev_kfree_skb_irq(skb);
-
-                        get_info.offset++;
-                        get_info.offset %= get_info.fifo_len + 1;
-                        txdlp = (TxD_t *) nic->list_info[i]
-                            [get_info.offset].list_virt_addr;
-                        mac_control->tx_curr_get_info[i].offset =
-                            get_info.offset;
+                        txdlp = temp;
                 }
+                memset(txdlp, 0,
+                       (sizeof(TxD_t) * fifo_data->max_txds));
+
+                /* Updating the statistics block */
+                nic->stats.tx_bytes += skb->len;
+                dev_kfree_skb_irq(skb);
+
+                get_info.offset++;
+                get_info.offset %= get_info.fifo_len + 1;
+                txdlp = (TxD_t *) fifo_data->list_info
+                    [get_info.offset].list_virt_addr;
+                fifo_data->tx_curr_get_info.offset =
+                    get_info.offset;
         }
 
         spin_lock(&nic->tx_lock);
@@ -2301,13 +2655,13 @@ static void tx_intr_handler(struct s2io_nic *nic)
         spin_unlock(&nic->tx_lock);
 }
 
-/**  
+/**
  *  alarm_intr_handler - Alarm Interrrupt handler
  *  @nic: device private variable
- *  Description: If the interrupt was neither because of Rx packet or Tx 
+ *  Description: If the interrupt was neither because of Rx packet or Tx
  *  complete, this function is called. If the interrupt was to indicate
- *  a loss of link, the OSM link status handler is invoked for any other 
- *  alarm interrupt the block that raised the interrupt is displayed 
+ *  a loss of link, the OSM link status handler is invoked for any other
+ *  alarm interrupt the block that raised the interrupt is displayed
  *  and a H/W reset is issued.
  *  Return Value:
  *  NONE
@@ -2320,10 +2674,32 @@ static void alarm_intr_handler(struct s2io_nic *nic)
         register u64 val64 = 0, err_reg = 0;
 
         /* Handling link status change error Intr */
-        err_reg = readq(&bar0->mac_rmac_err_reg);
-        writeq(err_reg, &bar0->mac_rmac_err_reg);
-        if (err_reg & RMAC_LINK_STATE_CHANGE_INT) {
-                schedule_work(&nic->set_link_task);
+        if (s2io_link_fault_indication(nic) == MAC_RMAC_ERR_TIMER) {
+                err_reg = readq(&bar0->mac_rmac_err_reg);
+                writeq(err_reg, &bar0->mac_rmac_err_reg);
+                if (err_reg & RMAC_LINK_STATE_CHANGE_INT) {
+                        schedule_work(&nic->set_link_task);
+                }
+        }
+
+        /* Handling Ecc errors */
+        val64 = readq(&bar0->mc_err_reg);
+        writeq(val64, &bar0->mc_err_reg);
+        if (val64 & (MC_ERR_REG_ECC_ALL_SNG | MC_ERR_REG_ECC_ALL_DBL)) {
+                if (val64 & MC_ERR_REG_ECC_ALL_DBL) {
+                        nic->mac_control.stats_info->sw_stat.
+                                double_ecc_errs++;
+                        DBG_PRINT(ERR_DBG, "%s: Device indicates ",
+                                  dev->name);
+                        DBG_PRINT(ERR_DBG, "double ECC error!!\n");
+                        if (nic->device_type != XFRAME_II_DEVICE) {
+                                netif_stop_queue(dev);
+                                schedule_work(&nic->rst_timer_task);
+                        }
+                } else {
+                        nic->mac_control.stats_info->sw_stat.
+                                single_ecc_errs++;
+                }
         }
 
         /* In case of a serious error, the device will be Reset. */
@@ -2338,7 +2714,7 @@ static void alarm_intr_handler(struct s2io_nic *nic)
         /*
          * Also as mentioned in the latest Errata sheets if the PCC_FB_ECC
          * Error occurs, the adapter will be recycled by disabling the
-         * adapter enable bit and enabling it again after the device 
+         * adapter enable bit and enabling it again after the device
          * becomes Quiescent.
          */
         val64 = readq(&bar0->pcc_err_reg);
@@ -2354,18 +2730,18 @@ static void alarm_intr_handler(struct s2io_nic *nic)
         /* Other type of interrupts are not being handled now,  TODO */
 }
 
-/** 
+/**
  *  wait_for_cmd_complete - waits for a command to complete.
- *  @sp : private member of the device structure, which is a pointer to the 
+ *  @sp : private member of the device structure, which is a pointer to the
  *  s2io_nic structure.
- *  Description: Function that waits for a command to Write into RMAC 
- *  ADDR DATA registers to be completed and returns either success or 
- *  error depending on whether the command was complete or not. 
+ *  Description: Function that waits for a command to Write into RMAC
+ *  ADDR DATA registers to be completed and returns either success or
+ *  error depending on whether the command was complete or not.
  *  Return value:
  *   SUCCESS on success and FAILURE on failure.
  */
 
-static int wait_for_cmd_complete(nic_t * sp)
+int wait_for_cmd_complete(nic_t * sp)
 {
         XENA_dev_config_t __iomem *bar0 = sp->bar0;
         int ret = FAILURE, cnt = 0;
@@ -2385,29 +2761,32 @@ static int wait_for_cmd_complete(nic_t * sp)
         return ret;
 }
 
-/** 
- *  s2io_reset - Resets the card. 
+/**
+ *  s2io_reset - Resets the card.
  *  @sp : private member of the device structure.
  *  Description: Function to Reset the card. This function then also
- *  restores the previously saved PCI configuration space registers as 
+ *  restores the previously saved PCI configuration space registers as
  *  the card reset also resets the configuration space.
  *  Return value:
  *  void.
  */
 
-static void s2io_reset(nic_t * sp)
+void s2io_reset(nic_t * sp)
 {
         XENA_dev_config_t __iomem *bar0 = sp->bar0;
         u64 val64;
-        u16 subid;
+        u16 subid, pci_cmd;
+
+        /* Back up  the PCI-X CMD reg, dont want to lose MMRBC, OST settings */
+        pci_read_config_word(sp->pdev, PCIX_COMMAND_REGISTER, &(pci_cmd));
 
         val64 = SW_RESET_ALL;
         writeq(val64, &bar0->sw_reset);
 
-        /* 
-         * At this stage, if the PCI write is indeed completed, the 
-         * card is reset and so is the PCI Config space of the device. 
-         * So a read cannot be issued at this stage on any of the 
+        /*
+         * At this stage, if the PCI write is indeed completed, the
+         * card is reset and so is the PCI Config space of the device.
+         * So a read cannot be issued at this stage on any of the
          * registers to ensure the write into "sw_reset" register
          * has gone through.
          * Question: Is there any system call that will explicitly force
@@ -2418,42 +2797,72 @@ static void s2io_reset(nic_t * sp)
          */
         msleep(250);
 
-        /* Restore the PCI state saved during initializarion. */
+        /* Restore the PCI state saved during initialization. */
         pci_restore_state(sp->pdev);
+        pci_write_config_word(sp->pdev, PCIX_COMMAND_REGISTER,
+                                     pci_cmd);
         s2io_init_pci(sp);
 
         msleep(250);
 
+        /* Set swapper to enable I/O register access */
+        s2io_set_swapper(sp);
+
+        /* Clear certain PCI/PCI-X fields after reset */
+        if (sp->device_type == XFRAME_II_DEVICE) {
+                /* Clear parity err detect bit */
+                pci_write_config_word(sp->pdev, PCI_STATUS, 0x8000);
+
+                /* Clearing PCIX Ecc status register */
+                pci_write_config_dword(sp->pdev, 0x68, 0x7C);
+
+                /* Clearing PCI_STATUS error reflected here */
+                writeq(BIT(62), &bar0->txpic_int_reg);
+        }
+
+        /* Reset device statistics maintained by OS */
+        memset(&sp->stats, 0, sizeof (struct net_device_stats));
+
         /* SXE-002: Configure link and activity LED to turn it off */
         subid = sp->pdev->subsystem_device;
-        if ((subid & 0xFF) >= 0x07) {
+        if (((subid & 0xFF) >= 0x07) &&
+            (sp->device_type == XFRAME_I_DEVICE)) {
                 val64 = readq(&bar0->gpio_control);
                 val64 |= 0x0000800000000000ULL;
                 writeq(val64, &bar0->gpio_control);
                 val64 = 0x0411040400000000ULL;
-                writeq(val64, (void __iomem *) bar0 + 0x2700);
+                writeq(val64, (void __iomem *) ((u8 *) bar0 + 0x2700));
+        }
+
+        /*
+         * Clear spurious ECC interrupts that would have occured on
+         * XFRAME II cards after reset.
+         */
+        if (sp->device_type == XFRAME_II_DEVICE) {
+                val64 = readq(&bar0->pcc_err_reg);
+                writeq(val64, &bar0->pcc_err_reg);
         }
 
         sp->device_enabled_once = FALSE;
 }
 
 /**
- *  s2io_set_swapper - to set the swapper controle on the card 
- *  @sp : private member of the device structure, 
+ *  s2io_set_swapper - to set the swapper controle on the card
+ *  @sp : private member of the device structure,
  *  pointer to the s2io_nic structure.
- *  Description: Function to set the swapper control on the card 
+ *  Description: Function to set the swapper control on the card
  *  correctly depending on the 'endianness' of the system.
  *  Return value:
  *  SUCCESS on success and FAILURE on failure.
  */
 
-static int s2io_set_swapper(nic_t * sp)
+int s2io_set_swapper(nic_t * sp)
 {
         struct net_device *dev = sp->dev;
         XENA_dev_config_t __iomem *bar0 = sp->bar0;
         u64 val64, valt, valr;
 
-        /* 
+        /*
          * Set proper endian settings and verify the same by reading
          * the PIF Feed-back register.
          */
@@ -2505,8 +2914,9 @@ static int s2io_set_swapper(nic_t * sp)
                         i++;
                 }
                 if(i == 4) {
+                        unsigned long long x = val64;
                         DBG_PRINT(ERR_DBG, "Write failed, Xmsi_addr ");
-                        DBG_PRINT(ERR_DBG, "reads:0x%llx\n",val64);
+                        DBG_PRINT(ERR_DBG, "reads:0x%llx\n", x);
                         return FAILURE;
                 }
         }
@@ -2514,8 +2924,8 @@ static int s2io_set_swapper(nic_t * sp)
         val64 &= 0xFFFF000000000000ULL;
 
 #ifdef  __BIG_ENDIAN
-        /* 
-         * The device by default set to a big endian format, so a 
+        /*
+         * The device by default set to a big endian format, so a
          * big endian driver need not set anything.
          */
         val64 |= (SWAPPER_CTRL_TXP_FE |
@@ -2531,9 +2941,9 @@ static int s2io_set_swapper(nic_t * sp)
                  SWAPPER_CTRL_STATS_FE | SWAPPER_CTRL_STATS_SE);
         writeq(val64, &bar0->swapper_ctrl);
 #else
-        /* 
+        /*
          * Initially we enable all bits to make it accessible by the
-         * driver, then we selectively enable only those bits that 
+         * driver, then we selectively enable only those bits that
          * we want to set.
          */
         val64 |= (SWAPPER_CTRL_TXP_FE |
@@ -2555,8 +2965,8 @@ static int s2io_set_swapper(nic_t * sp)
 #endif
         val64 = readq(&bar0->swapper_ctrl);
 
-        /* 
-         * Verifying if endian settings are accurate by reading a 
+        /*
+         * Verifying if endian settings are accurate by reading a
          * feedback register.
          */
         val64 = readq(&bar0->pif_rd_swapper_fb);
@@ -2576,55 +2986,63 @@ static int s2io_set_swapper(nic_t * sp)
  * Functions defined below concern the OS part of the driver *
  * ********************************************************* */
 
-/**  
+/**
  *  s2io_open - open entry point of the driver
  *  @dev : pointer to the device structure.
  *  Description:
  *  This function is the open entry point of the driver. It mainly calls a
  *  function to allocate Rx buffers and inserts them into the buffer
- *  descriptors and then enables the Rx part of the NIC. 
+ *  descriptors and then enables the Rx part of the NIC.
  *  Return value:
  *  0 on success and an appropriate (-)ve integer as defined in errno.h
  *   file on failure.
  */
 
-static int s2io_open(struct net_device *dev)
+int s2io_open(struct net_device *dev)
 {
         nic_t *sp = dev->priv;
         int err = 0;
 
-        /* 
-         * Make sure you have link off by default every time 
+        /*
+         * Make sure you have link off by default every time
          * Nic is initialized
          */
         netif_carrier_off(dev);
-        sp->last_link_state = LINK_DOWN;
+        sp->last_link_state = 0;
 
         /* Initialize H/W and enable interrupts */
         if (s2io_card_up(sp)) {
                 DBG_PRINT(ERR_DBG, "%s: H/W initialization failed\n",
                           dev->name);
-                return -ENODEV;
+                err = -ENODEV;
+                goto hw_init_failed;
         }
 
         /* After proper initialization of H/W, register ISR */
-        err = request_irq((int) sp->irq, s2io_isr, SA_SHIRQ,
+        err = request_irq((int) sp->pdev->irq, s2io_isr, SA_SHIRQ,
                           sp->name, dev);
         if (err) {
-                s2io_reset(sp);
                 DBG_PRINT(ERR_DBG, "%s: ISR registration failed\n",
                           dev->name);
-                return err;
+                goto isr_registration_failed;
         }
 
         if (s2io_set_mac_addr(dev, dev->dev_addr) == FAILURE) {
                 DBG_PRINT(ERR_DBG, "Set Mac Address Failed\n");
-                s2io_reset(sp);
-                return -ENODEV;
+                err = -ENODEV;
+                goto setting_mac_address_failed;
         }
 
         netif_start_queue(dev);
         return 0;
+
+setting_mac_address_failed:
+        free_irq(sp->pdev->irq, dev);
+isr_registration_failed:
+        del_timer_sync(&sp->alarm_timer);
+        s2io_reset(sp);
+hw_init_failed:
+        return err;
 }
 
 /**
@@ -2640,16 +3058,15 @@ static int s2io_open(struct net_device *dev)
  *  file on failure.
  */
 
-static int s2io_close(struct net_device *dev)
+int s2io_close(struct net_device *dev)
 {
         nic_t *sp = dev->priv;
-
         flush_scheduled_work();
         netif_stop_queue(dev);
         /* Reset card, kill tasklet and free Tx and Rx buffers. */
         s2io_card_down(sp);
 
-        free_irq(dev->irq, dev);
+        free_irq(sp->pdev->irq, dev);
         sp->device_close_flag = TRUE;   /* Device is shut down. */
         return 0;
 }
@@ -2667,7 +3084,7 @@ static int s2io_close(struct net_device *dev)
  *  0 on success & 1 on failure.
  */
 
-static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
+int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         nic_t *sp = dev->priv;
         u16 frg_cnt, frg_len, i, queue, queue_len, put_off, get_off;
@@ -2678,29 +3095,39 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
 #ifdef NETIF_F_TSO
         int mss;
 #endif
+        u16 vlan_tag = 0;
+        int vlan_priority = 0;
         mac_info_t *mac_control;
         struct config_param *config;
-        XENA_dev_config_t __iomem *bar0 = sp->bar0;
 
         mac_control = &sp->mac_control;
         config = &sp->config;
 
-        DBG_PRINT(TX_DBG, "%s: In S2IO Tx routine\n", dev->name);
+        DBG_PRINT(TX_DBG, "%s: In Neterion Tx routine\n", dev->name);
         spin_lock_irqsave(&sp->tx_lock, flags);
-
         if (atomic_read(&sp->card_state) == CARD_DOWN) {
-                DBG_PRINT(ERR_DBG, "%s: Card going down for reset\n",
+                DBG_PRINT(TX_DBG, "%s: Card going down for reset\n",
                           dev->name);
                 spin_unlock_irqrestore(&sp->tx_lock, flags);
-                return 1;
+                dev_kfree_skb(skb);
+                return 0;
         }
 
         queue = 0;
-        put_off = (u16) mac_control->tx_curr_put_info[queue].offset;
-        get_off = (u16) mac_control->tx_curr_get_info[queue].offset;
-        txdp = (TxD_t *) sp->list_info[queue][put_off].list_virt_addr;
 
-        queue_len = mac_control->tx_curr_put_info[queue].fifo_len + 1;
+        /* Get Fifo number to Transmit based on vlan priority */
+        if (sp->vlgrp && vlan_tx_tag_present(skb)) {
+                vlan_tag = vlan_tx_tag_get(skb);
+                vlan_priority = vlan_tag >> 13;
+                queue = config->fifo_mapping[vlan_priority];
+        }
+
+        put_off = (u16) mac_control->fifos[queue].tx_curr_put_info.offset;
+        get_off = (u16) mac_control->fifos[queue].tx_curr_get_info.offset;
+        txdp = (TxD_t *) mac_control->fifos[queue].list_info[put_off].
+                list_virt_addr;
+
+        queue_len = mac_control->fifos[queue].tx_curr_put_info.fifo_len + 1;
         /* Avoid "put" pointer going beyond "get" pointer */
         if (txdp->Host_Control || (((put_off + 1) % queue_len) == get_off)) {
                 DBG_PRINT(ERR_DBG, "Error in xmit, No free TXDs.\n");
@@ -2709,6 +3136,15 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
                 spin_unlock_irqrestore(&sp->tx_lock, flags);
                 return 0;
         }
+
+        /* A buffer with no data will be dropped */
+        if (!skb->len) {
+                DBG_PRINT(TX_DBG, "%s:Buffer has no data..\n", dev->name);
+                dev_kfree_skb(skb);
+                spin_unlock_irqrestore(&sp->tx_lock, flags);
+                return 0;
+        }
+
 #ifdef NETIF_F_TSO
         mss = skb_shinfo(skb)->tso_size;
         if (mss) {
@@ -2720,9 +3156,9 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
         frg_cnt = skb_shinfo(skb)->nr_frags;
         frg_len = skb->len - skb->data_len;
 
-        txdp->Host_Control = (unsigned long) skb;
         txdp->Buffer_Pointer = pci_map_single
             (sp->pdev, skb->data, frg_len, PCI_DMA_TODEVICE);
+        txdp->Host_Control = (unsigned long) skb;
         if (skb->ip_summed == CHECKSUM_HW) {
                 txdp->Control_2 |=
                     (TXD_TX_CKO_IPV4_EN | TXD_TX_CKO_TCP_EN |
@@ -2731,6 +3167,11 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
 
         txdp->Control_2 |= config->tx_intr_type;
 
+        if (sp->vlgrp && vlan_tx_tag_present(skb)) {
+                txdp->Control_2 |= TXD_VLAN_ENABLE;
+                txdp->Control_2 |= TXD_VLAN_TAG(vlan_tag);
+        }
+
         txdp->Control_1 |= (TXD_BUFFER0_SIZE(frg_len) |
                             TXD_GATHER_CODE_FIRST);
         txdp->Control_1 |= TXD_LIST_OWN_XENA;
@@ -2738,6 +3179,9 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
         /* For fragmented SKB. */
         for (i = 0; i < frg_cnt; i++) {
                 skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+                /* A '0' length fragment will be ignored */
+                if (!frag->size)
+                        continue;
                 txdp++;
                 txdp->Buffer_Pointer = (u64) pci_map_page
                     (sp->pdev, frag->page, frag->page_offset,
@@ -2747,23 +3191,23 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
         txdp->Control_1 |= TXD_GATHER_CODE_LAST;
 
         tx_fifo = mac_control->tx_FIFO_start[queue];
-        val64 = sp->list_info[queue][put_off].list_phy_addr;
+        val64 = mac_control->fifos[queue].list_info[put_off].list_phy_addr;
         writeq(val64, &tx_fifo->TxDL_Pointer);
 
         val64 = (TX_FIFO_LAST_TXD_NUM(frg_cnt) | TX_FIFO_FIRST_LIST |
                  TX_FIFO_LAST_LIST);
+
 #ifdef NETIF_F_TSO
         if (mss)
                 val64 |= TX_FIFO_SPECIAL_FUNC;
 #endif
         writeq(val64, &tx_fifo->List_Control);
 
-        /* Perform a PCI read to flush previous writes */
-        val64 = readq(&bar0->general_int_status);
+        mmiowb();
 
         put_off++;
-        put_off %= mac_control->tx_curr_put_info[queue].fifo_len + 1;
-        mac_control->tx_curr_put_info[queue].offset = put_off;
+        put_off %= mac_control->fifos[queue].tx_curr_put_info.fifo_len + 1;
+        mac_control->fifos[queue].tx_curr_put_info.offset = put_off;
 
         /* Avoid "put" pointer going beyond "get" pointer */
         if (((put_off + 1) % queue_len) == get_off) {
@@ -2779,18 +3223,74 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
         return 0;
 }
 
+static void
+s2io_alarm_handle(unsigned long data)
+{
+        nic_t *sp = (nic_t *)data;
+
+        alarm_intr_handler(sp);
+        mod_timer(&sp->alarm_timer, jiffies + HZ / 2);
+}
+
+static void s2io_txpic_intr_handle(nic_t *sp)
+{
+        XENA_dev_config_t *bar0 = (XENA_dev_config_t *) sp->bar0;
+        u64 val64;
+
+        val64 = readq(&bar0->pic_int_status);
+        if (val64 & PIC_INT_GPIO) {
+                val64 = readq(&bar0->gpio_int_reg);
+                if ((val64 & GPIO_INT_REG_LINK_DOWN) &&
+                    (val64 & GPIO_INT_REG_LINK_UP)) {
+                        val64 |=  GPIO_INT_REG_LINK_DOWN;
+                        val64 |= GPIO_INT_REG_LINK_UP;
+                        writeq(val64, &bar0->gpio_int_reg);
+                        goto masking;
+                }
+
+                if (((sp->last_link_state == LINK_UP) &&
+                        (val64 & GPIO_INT_REG_LINK_DOWN)) ||
+                ((sp->last_link_state == LINK_DOWN) &&
+                (val64 & GPIO_INT_REG_LINK_UP))) {
+                        val64 = readq(&bar0->gpio_int_mask);
+                        val64 |=  GPIO_INT_MASK_LINK_DOWN;
+                        val64 |= GPIO_INT_MASK_LINK_UP;
+                        writeq(val64, &bar0->gpio_int_mask);
+                        s2io_set_link((unsigned long)sp);
+                }
+masking:
+                if (sp->last_link_state == LINK_UP) {
+                        /*enable down interrupt */
+                        val64 = readq(&bar0->gpio_int_mask);
+                        /* unmasks link down intr */
+                        val64 &=  ~GPIO_INT_MASK_LINK_DOWN;
+                        /* masks link up intr */
+                        val64 |= GPIO_INT_MASK_LINK_UP;
+                        writeq(val64, &bar0->gpio_int_mask);
+                } else {
+                        /*enable UP Interrupt */
+                        val64 = readq(&bar0->gpio_int_mask);
+                        /* unmasks link up interrupt */
+                        val64 &= ~GPIO_INT_MASK_LINK_UP;
+                        /* masks link down interrupt */
+                        val64 |=  GPIO_INT_MASK_LINK_DOWN;
+                        writeq(val64, &bar0->gpio_int_mask);
+                }
+        }
+}
+
 /**
  *  s2io_isr - ISR handler of the device .
  *  @irq: the irq of the device.
  *  @dev_id: a void pointer to the dev structure of the NIC.
  *  @pt_regs: pointer to the registers pushed on the stack.
- *  Description:  This function is the ISR handler of the device. It 
- *  identifies the reason for the interrupt and calls the relevant 
- *  service routines. As a contongency measure, this ISR allocates the 
+ *  Description:  This function is the ISR handler of the device. It
+ *  identifies the reason for the interrupt and calls the relevant
+ *  service routines. As a contongency measure, this ISR allocates the
  *  recv buffers, if their numbers are below the panic value which is
  *  presently set to 25% of the original number of rcv buffers allocated.
  *  Return value:
- *   IRQ_HANDLED: will be returned if IRQ was handled by this routine 
+ *   IRQ_HANDLED: will be returned if IRQ was handled by this routine
  *   IRQ_NONE: will be returned if interrupt is not from our device
  */
 static irqreturn_t s2io_isr(int irq, void *dev_id, struct pt_regs *regs)
@@ -2798,40 +3298,31 @@ static irqreturn_t s2io_isr(int irq, void *dev_id, struct pt_regs *regs)
         struct net_device *dev = (struct net_device *) dev_id;
         nic_t *sp = dev->priv;
         XENA_dev_config_t __iomem *bar0 = sp->bar0;
-#ifndef CONFIG_S2IO_NAPI
-        int i, ret;
-#endif
-        u64 reason = 0;
+        int i;
+        u64 reason = 0, val64;
         mac_info_t *mac_control;
         struct config_param *config;
 
+        atomic_inc(&sp->isr_cnt);
         mac_control = &sp->mac_control;
         config = &sp->config;
 
-        /* 
+        /*
          * Identify the cause for interrupt and call the appropriate
          * interrupt handler. Causes for the interrupt could be;
          * 1. Rx of packet.
          * 2. Tx complete.
          * 3. Link down.
-         * 4. Error in any functional blocks of the NIC. 
+         * 4. Error in any functional blocks of the NIC.
          */
         reason = readq(&bar0->general_int_status);
 
         if (!reason) {
                 /* The interrupt was not raised by Xena. */
+                atomic_dec(&sp->isr_cnt);
                 return IRQ_NONE;
         }
 
-        /* If Intr is because of Tx Traffic */
-        if (reason & GEN_INTR_TXTRAFFIC) {
-                tx_intr_handler(sp);
-        }
-
-        /* If Intr is because of an error */
-        if (reason & (GEN_ERROR_INTR))
-                alarm_intr_handler(sp);
-
 #ifdef CONFIG_S2IO_NAPI
         if (reason & GEN_INTR_RXTRAFFIC) {
                 if (netif_rx_schedule_prep(dev)) {
@@ -2843,17 +3334,43 @@ static irqreturn_t s2io_isr(int irq, void *dev_id, struct pt_regs *regs)
 #else
         /* If Intr is because of Rx Traffic */
         if (reason & GEN_INTR_RXTRAFFIC) {
-                rx_intr_handler(sp);
+                /*
+                 * rx_traffic_int reg is an R1 register, writing all 1's
+                 * will ensure that the actual interrupt causing bit get's
+                 * cleared and hence a read can be avoided.
+                 */
+                val64 = 0xFFFFFFFFFFFFFFFFULL;
+                writeq(val64, &bar0->rx_traffic_int);
+                for (i = 0; i < config->rx_ring_num; i++) {
+                        rx_intr_handler(&mac_control->rings[i]);
+                }
         }
 #endif
 
-        /* 
-         * If the Rx buffer count is below the panic threshold then 
-         * reallocate the buffers from the interrupt handler itself, 
+        /* If Intr is because of Tx Traffic */
+        if (reason & GEN_INTR_TXTRAFFIC) {
+                /*
+                 * tx_traffic_int reg is an R1 register, writing all 1's
+                 * will ensure that the actual interrupt causing bit get's
+                 * cleared and hence a read can be avoided.
+                 */
+                val64 = 0xFFFFFFFFFFFFFFFFULL;
+                writeq(val64, &bar0->tx_traffic_int);
+
+                for (i = 0; i < config->tx_fifo_num; i++)
+                        tx_intr_handler(&mac_control->fifos[i]);
+        }
+
+        if (reason & GEN_INTR_TXPIC)
+                s2io_txpic_intr_handle(sp);
+        /*
+         * If the Rx buffer count is below the panic threshold then
+         * reallocate the buffers from the interrupt handler itself,
          * else schedule a tasklet to reallocate the buffers.
          */
 #ifndef CONFIG_S2IO_NAPI
         for (i = 0; i < config->rx_ring_num; i++) {
+                int ret;
                 int rxb_size = atomic_read(&sp->rx_bufs_left[i]);
                 int level = rx_buffer_level(sp, rxb_size, i);
 
@@ -2865,6 +3382,7 @@ static irqreturn_t s2io_isr(int irq, void *dev_id, struct pt_regs *regs)
                                           dev->name);
                                 DBG_PRINT(ERR_DBG, " in ISR!!\n");
                                 clear_bit(0, (&sp->tasklet_status));
+                                atomic_dec(&sp->isr_cnt);
                                 return IRQ_HANDLED;
                         }
                         clear_bit(0, (&sp->tasklet_status));
@@ -2874,33 +3392,69 @@ static irqreturn_t s2io_isr(int irq, void *dev_id, struct pt_regs *regs)
         }
 #endif
 
+        atomic_dec(&sp->isr_cnt);
         return IRQ_HANDLED;
 }
 
 /**
- *  s2io_get_stats - Updates the device statistics structure. 
+ * s2io_updt_stats -
+ */
+static void s2io_updt_stats(nic_t *sp)
+{
+        XENA_dev_config_t __iomem *bar0 = sp->bar0;
+        u64 val64;
+        int cnt = 0;
+
+        if (atomic_read(&sp->card_state) == CARD_UP) {
+                /* Apprx 30us on a 133 MHz bus */
+                val64 = SET_UPDT_CLICKS(10) |
+                        STAT_CFG_ONE_SHOT_EN | STAT_CFG_STAT_EN;
+                writeq(val64, &bar0->stat_cfg);
+                do {
+                        udelay(100);
+                        val64 = readq(&bar0->stat_cfg);
+                        if (!(val64 & BIT(0)))
+                                break;
+                        cnt++;
+                        if (cnt == 5)
+                                break; /* Updt failed */
+                } while(1);
+        }
+}
+
+/**
+ *  s2io_get_stats - Updates the device statistics structure.
  *  @dev : pointer to the device structure.
  *  Description:
- *  This function updates the device statistics structure in the s2io_nic 
+ *  This function updates the device statistics structure in the s2io_nic
  *  structure and returns a pointer to the same.
  *  Return value:
  *  pointer to the updated net_device_stats structure.
  */
 
-static struct net_device_stats *s2io_get_stats(struct net_device *dev)
+struct net_device_stats *s2io_get_stats(struct net_device *dev)
 {
         nic_t *sp = dev->priv;
         mac_info_t *mac_control;
         struct config_param *config;
 
+
         mac_control = &sp->mac_control;
         config = &sp->config;
 
-        sp->stats.tx_errors = mac_control->stats_info->tmac_any_err_frms;
-        sp->stats.rx_errors = mac_control->stats_info->rmac_drop_frms;
-        sp->stats.multicast = mac_control->stats_info->rmac_vld_mcst_frms;
+        /* Configure Stats for immediate updt */
+        s2io_updt_stats(sp);
+
+        sp->stats.tx_packets =
+                le32_to_cpu(mac_control->stats_info->tmac_frms);
+        sp->stats.tx_errors =
+                le32_to_cpu(mac_control->stats_info->tmac_any_err_frms);
+        sp->stats.rx_errors =
+                le32_to_cpu(mac_control->stats_info->rmac_drop_frms);
+        sp->stats.multicast =
+                le32_to_cpu(mac_control->stats_info->rmac_vld_mcst_frms);
         sp->stats.rx_length_errors =
-            mac_control->stats_info->rmac_long_frms;
+                le32_to_cpu(mac_control->stats_info->rmac_long_frms);
 
         return (&sp->stats);
 }
@@ -2909,8 +3463,8 @@ static struct net_device_stats *s2io_get_stats(struct net_device *dev)
  *  s2io_set_multicast - entry point for multicast address enable/disable.
  *  @dev : pointer to the device structure
  *  Description:
- *  This function is a driver entry point which gets called by the kernel 
- *  whenever multicast addresses must be enabled/disabled. This also gets 
+ *  This function is a driver entry point which gets called by the kernel
+ *  whenever multicast addresses must be enabled/disabled. This also gets
  *  called to set/reset promiscuous mode. Depending on the deivce flag, we
  *  determine, if multicast address must be enabled or if promiscuous mode
  *  is to be disabled etc.
@@ -2948,6 +3502,8 @@ static void s2io_set_multicast(struct net_device *dev)
                 /*  Disable all Multicast addresses */
                 writeq(RMAC_ADDR_DATA0_MEM_ADDR(dis_addr),
                        &bar0->rmac_addr_data0_mem);
+                writeq(RMAC_ADDR_DATA1_MEM_MASK(0x0),
+                       &bar0->rmac_addr_data1_mem);
                 val64 = RMAC_ADDR_CMD_MEM_WE |
                     RMAC_ADDR_CMD_MEM_STROBE_NEW_CMD |
                     RMAC_ADDR_CMD_MEM_OFFSET(sp->all_multi_pos);
@@ -3010,7 +3566,7 @@ static void s2io_set_multicast(struct net_device *dev)
                         writeq(RMAC_ADDR_DATA0_MEM_ADDR(dis_addr),
                                &bar0->rmac_addr_data0_mem);
                         writeq(RMAC_ADDR_DATA1_MEM_MASK(0ULL),
-                                &bar0->rmac_addr_data1_mem);
+                                &bar0->rmac_addr_data1_mem);
                         val64 = RMAC_ADDR_CMD_MEM_WE |
                             RMAC_ADDR_CMD_MEM_STROBE_NEW_CMD |
                             RMAC_ADDR_CMD_MEM_OFFSET
@@ -3039,8 +3595,7 @@ static void s2io_set_multicast(struct net_device *dev)
                         writeq(RMAC_ADDR_DATA0_MEM_ADDR(mac_addr),
                                &bar0->rmac_addr_data0_mem);
                         writeq(RMAC_ADDR_DATA1_MEM_MASK(0ULL),
-                                &bar0->rmac_addr_data1_mem);
-
+                                &bar0->rmac_addr_data1_mem);
                         val64 = RMAC_ADDR_CMD_MEM_WE |
                             RMAC_ADDR_CMD_MEM_STROBE_NEW_CMD |
                             RMAC_ADDR_CMD_MEM_OFFSET
@@ -3059,12 +3614,12 @@ static void s2io_set_multicast(struct net_device *dev)
 }
 
 /**
- *  s2io_set_mac_addr - Programs the Xframe mac address 
+ *  s2io_set_mac_addr - Programs the Xframe mac address
  *  @dev : pointer to the device structure.
  *  @addr: a uchar pointer to the new mac address which is to be set.
- *  Description : This procedure will program the Xframe to receive 
+ *  Description : This procedure will program the Xframe to receive
  *  frames with new Mac Address
- *  Return value: SUCCESS on success and an appropriate (-)ve integer 
+ *  Return value: SUCCESS on success and an appropriate (-)ve integer
  *  as defined in errno.h file on failure.
  */
 
@@ -3075,10 +3630,10 @@ int s2io_set_mac_addr(struct net_device *dev, u8 * addr)
         register u64 val64, mac_addr = 0;
         int i;
 
-        /* 
+        /*
          * Set the new MAC address as the new unicast filter and reflect this
          * change on the device address registered with the OS. It will be
-         * at offset 0. 
+         * at offset 0.
          */
         for (i = 0; i < ETH_ALEN; i++) {
                 mac_addr <<= 8;
@@ -3102,12 +3657,12 @@ int s2io_set_mac_addr(struct net_device *dev, u8 * addr)
 }
 
 /**
- * s2io_ethtool_sset - Sets different link parameters. 
+ * s2io_ethtool_sset - Sets different link parameters.
  * @sp : private member of the device structure, which is a pointer to the  * s2io_nic structure.
  * @info: pointer to the structure with parameters given by ethtool to set
  * link information.
  * Description:
- * The function sets different link parameters provided by the user onto 
+ * The function sets different link parameters provided by the user onto
  * the NIC.
  * Return value:
  * 0 on success.
@@ -3129,7 +3684,7 @@ static int s2io_ethtool_sset(struct net_device *dev,
 }
 
 /**
- * s2io_ethtol_gset - Return link specific information. 
+ * s2io_ethtol_gset - Return link specific information.
  * @sp : private member of the device structure, pointer to the
  *      s2io_nic structure.
  * @info : pointer to the structure with parameters given by ethtool
@@ -3161,8 +3716,8 @@ static int s2io_ethtool_gset(struct net_device *dev, struct ethtool_cmd *info)
 }
 
 /**
- * s2io_ethtool_gdrvinfo - Returns driver specific information. 
- * @sp : private member of the device structure, which is a pointer to the 
+ * s2io_ethtool_gdrvinfo - Returns driver specific information.
+ * @sp : private member of the device structure, which is a pointer to the
  * s2io_nic structure.
  * @info : pointer to the structure with parameters given by ethtool to
  * return driver information.
@@ -3190,9 +3745,9 @@ static void s2io_ethtool_gdrvinfo(struct net_device *dev,
 
 /**
  *  s2io_ethtool_gregs - dumps the entire space of Xfame into the buffer.
- *  @sp: private member of the device structure, which is a pointer to the 
+ *  @sp: private member of the device structure, which is a pointer to the
  *  s2io_nic structure.
- *  @regs : pointer to the structure with parameters given by ethtool for 
+ *  @regs : pointer to the structure with parameters given by ethtool for
  *  dumping the registers.
  *  @reg_space: The input argumnet into which all the registers are dumped.
  *  Description:
@@ -3221,11 +3776,11 @@ static void s2io_ethtool_gregs(struct net_device *dev,
 
 /**
  *  s2io_phy_id  - timer function that alternates adapter LED.
- *  @data : address of the private member of the device structure, which 
+ *  @data : address of the private member of the device structure, which
  *  is a pointer to the s2io_nic structure, provided as an u32.
- * Description: This is actually the timer function that alternates the 
- * adapter LED bit of the adapter control bit to set/reset every time on 
- * invocation. The timer is set for 1/2 a second, hence tha NIC blinks 
+ * Description: This is actually the timer function that alternates the
+ * adapter LED bit of the adapter control bit to set/reset every time on
+ * invocation. The timer is set for 1/2 a second, hence tha NIC blinks
  *  once every second.
 */
 static void s2io_phy_id(unsigned long data)
@@ -3236,7 +3791,8 @@ static void s2io_phy_id(unsigned long data)
         u16 subid;
 
         subid = sp->pdev->subsystem_device;
-        if ((subid & 0xFF) >= 0x07) {
+        if ((sp->device_type == XFRAME_II_DEVICE) ||
+                   ((subid & 0xFF) >= 0x07)) {
                 val64 = readq(&bar0->gpio_control);
                 val64 ^= GPIO_CTRL_GPIO_0;
                 writeq(val64, &bar0->gpio_control);
@@ -3253,12 +3809,12 @@ static void s2io_phy_id(unsigned long data)
  * s2io_ethtool_idnic - To physically identify the nic on the system.
  * @sp : private member of the device structure, which is a pointer to the
  * s2io_nic structure.
- * @id : pointer to the structure with identification parameters given by 
+ * @id : pointer to the structure with identification parameters given by
  * ethtool.
  * Description: Used to physically identify the NIC on the system.
- * The Link LED will blink for a time specified by the user for 
+ * The Link LED will blink for a time specified by the user for
  * identification.
- * NOTE: The Link has to be Up to be able to blink the LED. Hence 
+ * NOTE: The Link has to be Up to be able to blink the LED. Hence
  * identification is possible only if it's link is up.
  * Return value:
  * int , returns 0 on success
@@ -3273,7 +3829,8 @@ static int s2io_ethtool_idnic(struct net_device *dev, u32 data)
 
         subid = sp->pdev->subsystem_device;
         last_gpio_ctrl_val = readq(&bar0->gpio_control);
-        if ((subid & 0xFF) < 0x07) {
+        if ((sp->device_type == XFRAME_I_DEVICE) &&
+                ((subid & 0xFF) < 0x07)) {
                 val64 = readq(&bar0->adapter_control);
                 if (!(val64 & ADAPTER_CNTL_EN)) {
                         printk(KERN_ERR
@@ -3288,12 +3845,12 @@ static int s2io_ethtool_idnic(struct net_device *dev, u32 data)
         }
         mod_timer(&sp->id_timer, jiffies);
         if (data)
-                msleep(data * 1000);
+                msleep_interruptible(data * HZ);
         else
-                msleep(0xFFFFFFFF);
+                msleep_interruptible(MAX_FLICKER_TIME);
         del_timer_sync(&sp->id_timer);
 
-        if (CARDS_WITH_FAULTY_LINK_INDICATORS(subid)) {
+        if (CARDS_WITH_FAULTY_LINK_INDICATORS(sp->device_type, subid)) {
                 writeq(last_gpio_ctrl_val, &bar0->gpio_control);
                 last_gpio_ctrl_val = readq(&bar0->gpio_control);
         }
@@ -3303,7 +3860,8 @@ static int s2io_ethtool_idnic(struct net_device *dev, u32 data)
 
 /**
  * s2io_ethtool_getpause_data -Pause frame frame generation and reception.
- * @sp : private member of the device structure, which is a pointer to the  * s2io_nic structure.
+ * @sp : private member of the device structure, which is a pointer to the
+ *      s2io_nic structure.
  * @ep : pointer to the structure with pause parameters given by ethtool.
  * Description:
  * Returns the Pause frame generation and reception capability of the NIC.
@@ -3327,7 +3885,7 @@ static void s2io_ethtool_getpause_data(struct net_device *dev,
 
 /**
  * s2io_ethtool_setpause_data -  set/reset pause frame generation.
- * @sp : private member of the device structure, which is a pointer to the 
+ * @sp : private member of the device structure, which is a pointer to the
  *      s2io_nic structure.
  * @ep : pointer to the structure with pause parameters given by ethtool.
  * Description:
@@ -3338,7 +3896,7 @@ static void s2io_ethtool_getpause_data(struct net_device *dev,
  */
 
 static int s2io_ethtool_setpause_data(struct net_device *dev,
-                                      struct ethtool_pauseparam *ep)
+                               struct ethtool_pauseparam *ep)
 {
         u64 val64;
         nic_t *sp = dev->priv;
@@ -3359,13 +3917,13 @@ static int s2io_ethtool_setpause_data(struct net_device *dev,
 
 /**
  * read_eeprom - reads 4 bytes of data from user given offset.
- * @sp : private member of the device structure, which is a pointer to the 
+ * @sp : private member of the device structure, which is a pointer to the
  *      s2io_nic structure.
  * @off : offset at which the data must be written
  * @data : Its an output parameter where the data read at the given
- *      offset is stored.
+ *      offset is stored.
  * Description:
- * Will read 4 bytes of data from the user given offset and return the 
+ * Will read 4 bytes of data from the user given offset and return the
  * read data.
  * NOTE: Will allow to read only part of the EEPROM visible through the
  *   I2C bus.
@@ -3406,7 +3964,7 @@ static int read_eeprom(nic_t * sp, int off, u32 * data)
  *       s2io_nic structure.
  *  @off : offset at which the data must be written
  *  @data : The data that is to be written
- *  @cnt : Number of bytes of the data that are actually to be written into 
+ *  @cnt : Number of bytes of the data that are actually to be written into
  *  the Eeprom. (max of 3)
  * Description:
  *  Actually writes the relevant part of the data value into the Eeprom
@@ -3443,7 +4001,7 @@ static int write_eeprom(nic_t * sp, int off, u32 data, int cnt)
 /**
  *  s2io_ethtool_geeprom  - reads the value stored in the Eeprom.
  *  @sp : private member of the device structure, which is a pointer to the *       s2io_nic structure.
- *  @eeprom : pointer to the user level structure provided by ethtool, 
+ *  @eeprom : pointer to the user level structure provided by ethtool,
  *  containing all relevant information.
  *  @data_buf : user defined value to be written into Eeprom.
  *  Description: Reads the values stored in the Eeprom at given offset
@@ -3454,7 +4012,7 @@ static int write_eeprom(nic_t * sp, int off, u32 data, int cnt)
  */
 
 static int s2io_ethtool_geeprom(struct net_device *dev,
-                                struct ethtool_eeprom *eeprom, u8 * data_buf)
+                         struct ethtool_eeprom *eeprom, u8 * data_buf)
 {
         u32 data, i, valid;
         nic_t *sp = dev->priv;
@@ -3479,7 +4037,7 @@ static int s2io_ethtool_geeprom(struct net_device *dev,
  *  s2io_ethtool_seeprom - tries to write the user provided value in Eeprom
  *  @sp : private member of the device structure, which is a pointer to the
  *  s2io_nic structure.
- *  @eeprom : pointer to the user level structure provided by ethtool, 
+ *  @eeprom : pointer to the user level structure provided by ethtool,
  *  containing all relevant information.
  *  @data_buf ; user defined value to be written into Eeprom.
  *  Description:
@@ -3527,8 +4085,8 @@ static int s2io_ethtool_seeprom(struct net_device *dev,
 }
 
 /**
- * s2io_register_test - reads and writes into all clock domains. 
- * @sp : private member of the device structure, which is a pointer to the 
+ * s2io_register_test - reads and writes into all clock domains.
+ * @sp : private member of the device structure, which is a pointer to the
  * s2io_nic structure.
  * @data : variable that returns the result of each of the test conducted b
  * by the driver.
@@ -3545,8 +4103,8 @@ static int s2io_register_test(nic_t * sp, uint64_t * data)
         u64 val64 = 0;
         int fail = 0;
 
-        val64 = readq(&bar0->pcc_enable);
-        if (val64 != 0xff00000000000000ULL) {
+        val64 = readq(&bar0->pif_rd_swapper_fb);
+        if (val64 != 0x123456789abcdefULL) {
                 fail = 1;
                 DBG_PRINT(INFO_DBG, "Read Test level 1 fails\n");
         }
@@ -3590,13 +4148,13 @@ static int s2io_register_test(nic_t * sp, uint64_t * data)
 }
 
 /**
- * s2io_eeprom_test - to verify that EEprom in the xena can be programmed. 
+ * s2io_eeprom_test - to verify that EEprom in the xena can be programmed.
  * @sp : private member of the device structure, which is a pointer to the
  * s2io_nic structure.
  * @data:variable that returns the result of each of the test conducted by
  * the driver.
  * Description:
- * Verify that EEPROM in the xena can be programmed using I2C_CONTROL 
+ * Verify that EEPROM in the xena can be programmed using I2C_CONTROL
  * register.
  * Return value:
  * 0 on success.
@@ -3661,14 +4219,14 @@ static int s2io_eeprom_test(nic_t * sp, uint64_t * data)
 
 /**
  * s2io_bist_test - invokes the MemBist test of the card .
- * @sp : private member of the device structure, which is a pointer to the 
+ * @sp : private member of the device structure, which is a pointer to the
  * s2io_nic structure.
- * @data:variable that returns the result of each of the test conducted by 
+ * @data:variable that returns the result of each of the test conducted by
  * the driver.
  * Description:
  * This invokes the MemBist test of the card. We give around
  * 2 secs time for the Test to complete. If it's still not complete
- * within this peiod, we consider that the test failed. 
+ * within this peiod, we consider that the test failed.
  * Return value:
  * 0 on success and -1 on failure.
  */
@@ -3697,13 +4255,13 @@ static int s2io_bist_test(nic_t * sp, uint64_t * data)
 }
 
 /**
- * s2io-link_test - verifies the link state of the nic  
- * @sp ; private member of the device structure, which is a pointer to the 
+ * s2io-link_test - verifies the link state of the nic
+ * @sp ; private member of the device structure, which is a pointer to the
  * s2io_nic structure.
  * @data: variable that returns the result of each of the test conducted by
  * the driver.
  * Description:
- * The function verifies the link state of the NIC and updates the input 
+ * The function verifies the link state of the NIC and updates the input
  * argument 'data' appropriately.
  * Return value:
  * 0 on success.
@@ -3722,13 +4280,13 @@ static int s2io_link_test(nic_t * sp, uint64_t * data)
 }
 
 /**
- * s2io_rldram_test - offline test for access to the RldRam chip on the NIC 
- * @sp - private member of the device structure, which is a pointer to the  
+ * s2io_rldram_test - offline test for access to the RldRam chip on the NIC
+ * @sp - private member of the device structure, which is a pointer to the
  * s2io_nic structure.
- * @data - variable that returns the result of each of the test 
+ * @data - variable that returns the result of each of the test
  * conducted by the driver.
  * Description:
- *  This is one of the offline test that tests the read and write 
+ *  This is one of the offline test that tests the read and write
  *  access to the RldRam chip on the NIC.
  * Return value:
  *  0 on success.
@@ -3833,7 +4391,7 @@ static int s2io_rldram_test(nic_t * sp, uint64_t * data)
  *  s2io_nic structure.
  *  @ethtest : pointer to a ethtool command specific structure that will be
  *  returned to the user.
- *  @data : variable that returns the result of each of the test 
+ *  @data : variable that returns the result of each of the test
  * conducted by the driver.
  * Description:
  *  This function conducts 6 tests ( 4 offline and 2 online) to determine
@@ -3851,23 +4409,18 @@ static void s2io_ethtool_test(struct net_device *dev,
 
         if (ethtest->flags == ETH_TEST_FL_OFFLINE) {
                 /* Offline Tests. */
-                if (orig_state) {
+                if (orig_state)
                         s2io_close(sp->dev);
-                        s2io_set_swapper(sp);
-                } else
-                        s2io_set_swapper(sp);
 
                 if (s2io_register_test(sp, &data[0]))
                         ethtest->flags |= ETH_TEST_FL_FAILED;
 
                 s2io_reset(sp);
-                s2io_set_swapper(sp);
 
                 if (s2io_rldram_test(sp, &data[3]))
                         ethtest->flags |= ETH_TEST_FL_FAILED;
 
                 s2io_reset(sp);
-                s2io_set_swapper(sp);
 
                 if (s2io_eeprom_test(sp, &data[1]))
                         ethtest->flags |= ETH_TEST_FL_FAILED;
@@ -3910,61 +4463,111 @@ static void s2io_get_ethtool_stats(struct net_device *dev,
         nic_t *sp = dev->priv;
         StatInfo_t *stat_info = sp->mac_control.stats_info;
 
-        tmp_stats[i++] = le32_to_cpu(stat_info->tmac_frms);
-        tmp_stats[i++] = le32_to_cpu(stat_info->tmac_data_octets);
+        s2io_updt_stats(sp);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->tmac_frms_oflow) << 32  |
+                le32_to_cpu(stat_info->tmac_frms);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->tmac_data_octets_oflow) << 32 |
+                le32_to_cpu(stat_info->tmac_data_octets);
         tmp_stats[i++] = le64_to_cpu(stat_info->tmac_drop_frms);
-        tmp_stats[i++] = le32_to_cpu(stat_info->tmac_mcst_frms);
-        tmp_stats[i++] = le32_to_cpu(stat_info->tmac_bcst_frms);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->tmac_mcst_frms_oflow) << 32 |
+                le32_to_cpu(stat_info->tmac_mcst_frms);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->tmac_bcst_frms_oflow) << 32 |
+                le32_to_cpu(stat_info->tmac_bcst_frms);
         tmp_stats[i++] = le64_to_cpu(stat_info->tmac_pause_ctrl_frms);
-        tmp_stats[i++] = le32_to_cpu(stat_info->tmac_any_err_frms);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->tmac_any_err_frms_oflow) << 32 |
+                le32_to_cpu(stat_info->tmac_any_err_frms);
         tmp_stats[i++] = le64_to_cpu(stat_info->tmac_vld_ip_octets);
-        tmp_stats[i++] = le32_to_cpu(stat_info->tmac_vld_ip);
-        tmp_stats[i++] = le32_to_cpu(stat_info->tmac_drop_ip);
-        tmp_stats[i++] = le32_to_cpu(stat_info->tmac_icmp);
-        tmp_stats[i++] = le32_to_cpu(stat_info->tmac_rst_tcp);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->tmac_vld_ip_oflow) << 32 |
+                le32_to_cpu(stat_info->tmac_vld_ip);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->tmac_drop_ip_oflow) << 32 |
+                le32_to_cpu(stat_info->tmac_drop_ip);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->tmac_icmp_oflow) << 32 |
+                le32_to_cpu(stat_info->tmac_icmp);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->tmac_rst_tcp_oflow) << 32 |
+                le32_to_cpu(stat_info->tmac_rst_tcp);
         tmp_stats[i++] = le64_to_cpu(stat_info->tmac_tcp);
-        tmp_stats[i++] = le32_to_cpu(stat_info->tmac_udp);
-        tmp_stats[i++] = le32_to_cpu(stat_info->rmac_vld_frms);
-        tmp_stats[i++] = le32_to_cpu(stat_info->rmac_data_octets);
+        tmp_stats[i++] = (u64)le32_to_cpu(stat_info->tmac_udp_oflow) << 32 |
+                le32_to_cpu(stat_info->tmac_udp);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->rmac_vld_frms_oflow) << 32 |
+                le32_to_cpu(stat_info->rmac_vld_frms);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->rmac_data_octets_oflow) << 32 |
+                le32_to_cpu(stat_info->rmac_data_octets);
         tmp_stats[i++] = le64_to_cpu(stat_info->rmac_fcs_err_frms);
         tmp_stats[i++] = le64_to_cpu(stat_info->rmac_drop_frms);
-        tmp_stats[i++] = le32_to_cpu(stat_info->rmac_vld_mcst_frms);
-        tmp_stats[i++] = le32_to_cpu(stat_info->rmac_vld_bcst_frms);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->rmac_vld_mcst_frms_oflow) << 32 |
+                le32_to_cpu(stat_info->rmac_vld_mcst_frms);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->rmac_vld_bcst_frms_oflow) << 32 |
+                le32_to_cpu(stat_info->rmac_vld_bcst_frms);
         tmp_stats[i++] = le32_to_cpu(stat_info->rmac_in_rng_len_err_frms);
         tmp_stats[i++] = le64_to_cpu(stat_info->rmac_long_frms);
         tmp_stats[i++] = le64_to_cpu(stat_info->rmac_pause_ctrl_frms);
-        tmp_stats[i++] = le32_to_cpu(stat_info->rmac_discarded_frms);
-        tmp_stats[i++] = le32_to_cpu(stat_info->rmac_usized_frms);
-        tmp_stats[i++] = le32_to_cpu(stat_info->rmac_osized_frms);
-        tmp_stats[i++] = le32_to_cpu(stat_info->rmac_frag_frms);
-        tmp_stats[i++] = le32_to_cpu(stat_info->rmac_jabber_frms);
-        tmp_stats[i++] = le32_to_cpu(stat_info->rmac_ip);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->rmac_discarded_frms_oflow) << 32 |
+                le32_to_cpu(stat_info->rmac_discarded_frms);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->rmac_usized_frms_oflow) << 32 |
+                le32_to_cpu(stat_info->rmac_usized_frms);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->rmac_osized_frms_oflow) << 32 |
+                le32_to_cpu(stat_info->rmac_osized_frms);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->rmac_frag_frms_oflow) << 32 |
+                le32_to_cpu(stat_info->rmac_frag_frms);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->rmac_jabber_frms_oflow) << 32 |
+                le32_to_cpu(stat_info->rmac_jabber_frms);
+        tmp_stats[i++] = (u64)le32_to_cpu(stat_info->rmac_ip_oflow) << 32 |
+                le32_to_cpu(stat_info->rmac_ip);
         tmp_stats[i++] = le64_to_cpu(stat_info->rmac_ip_octets);
         tmp_stats[i++] = le32_to_cpu(stat_info->rmac_hdr_err_ip);
-        tmp_stats[i++] = le32_to_cpu(stat_info->rmac_drop_ip);
-        tmp_stats[i++] = le32_to_cpu(stat_info->rmac_icmp);
+        tmp_stats[i++] = (u64)le32_to_cpu(stat_info->rmac_drop_ip_oflow) << 32 |
+                le32_to_cpu(stat_info->rmac_drop_ip);
+        tmp_stats[i++] = (u64)le32_to_cpu(stat_info->rmac_icmp_oflow) << 32 |
+                le32_to_cpu(stat_info->rmac_icmp);
         tmp_stats[i++] = le64_to_cpu(stat_info->rmac_tcp);
-        tmp_stats[i++] = le32_to_cpu(stat_info->rmac_udp);
-        tmp_stats[i++] = le32_to_cpu(stat_info->rmac_err_drp_udp);
-        tmp_stats[i++] = le32_to_cpu(stat_info->rmac_pause_cnt);
-        tmp_stats[i++] = le32_to_cpu(stat_info->rmac_accepted_ip);
+        tmp_stats[i++] = (u64)le32_to_cpu(stat_info->rmac_udp_oflow) << 32 |
+                le32_to_cpu(stat_info->rmac_udp);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->rmac_err_drp_udp_oflow) << 32 |
+                le32_to_cpu(stat_info->rmac_err_drp_udp);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->rmac_pause_cnt_oflow) << 32 |
+                le32_to_cpu(stat_info->rmac_pause_cnt);
+        tmp_stats[i++] =
+                (u64)le32_to_cpu(stat_info->rmac_accepted_ip_oflow) << 32 |
+                le32_to_cpu(stat_info->rmac_accepted_ip);
         tmp_stats[i++] = le32_to_cpu(stat_info->rmac_err_tcp);
+        tmp_stats[i++] = 0;
+        tmp_stats[i++] = stat_info->sw_stat.single_ecc_errs;
+        tmp_stats[i++] = stat_info->sw_stat.double_ecc_errs;
 }
 
-static int s2io_ethtool_get_regs_len(struct net_device *dev)
+int s2io_ethtool_get_regs_len(struct net_device *dev)
 {
         return (XENA_REG_SPACE);
 }
 
 
-static u32 s2io_ethtool_get_rx_csum(struct net_device * dev)
+u32 s2io_ethtool_get_rx_csum(struct net_device * dev)
 {
         nic_t *sp = dev->priv;
 
         return (sp->rx_csum);
 }
-
-static int s2io_ethtool_set_rx_csum(struct net_device *dev, u32 data)
+int s2io_ethtool_set_rx_csum(struct net_device *dev, u32 data)
 {
         nic_t *sp = dev->priv;
 
@@ -3975,19 +4578,17 @@ static int s2io_ethtool_set_rx_csum(struct net_device *dev, u32 data)
 
         return 0;
 }
-
-static int s2io_get_eeprom_len(struct net_device *dev)
+int s2io_get_eeprom_len(struct net_device *dev)
 {
         return (XENA_EEPROM_SPACE);
 }
 
-static int s2io_ethtool_self_test_count(struct net_device *dev)
+int s2io_ethtool_self_test_count(struct net_device *dev)
 {
         return (S2IO_TEST_LEN);
 }
-
-static void s2io_ethtool_get_strings(struct net_device *dev,
-                                     u32 stringset, u8 * data)
+void s2io_ethtool_get_strings(struct net_device *dev,
+                              u32 stringset, u8 * data)
 {
         switch (stringset) {
         case ETH_SS_TEST:
@@ -3998,13 +4599,12 @@ static void s2io_ethtool_get_strings(struct net_device *dev,
                        sizeof(ethtool_stats_keys));
         }
 }
-
 static int s2io_ethtool_get_stats_count(struct net_device *dev)
 {
         return (S2IO_STAT_LEN);
 }
 
-static int s2io_ethtool_op_set_tx_csum(struct net_device *dev, u32 data)
+int s2io_ethtool_op_set_tx_csum(struct net_device *dev, u32 data)
 {
         if (data)
                 dev->features |= NETIF_F_IP_CSUM;
@@ -4046,21 +4646,18 @@ static struct ethtool_ops netdev_ethtool_ops = {
 };
 
 /**
- *  s2io_ioctl - Entry point for the Ioctl 
+ *  s2io_ioctl - Entry point for the Ioctl
  *  @dev :  Device pointer.
  *  @ifr :  An IOCTL specefic structure, that can contain a pointer to
  *  a proprietary structure used to pass information to the driver.
  *  @cmd :  This is used to distinguish between the different commands that
  *  can be passed to the IOCTL functions.
  *  Description:
- *  This function has support for ethtool, adding multiple MAC addresses on 
- *  the NIC and some DBG commands for the util tool.
- *  Return value:
- *  Currently the IOCTL supports no operations, hence by default this
- *  function returns OP NOT SUPPORTED value.
+ *  Currently there are no special functionality supported in IOCTL, hence
+ *  function always return EOPNOTSUPPORTED
  */
 
-static int s2io_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+int s2io_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 {
         return -EOPNOTSUPP;
 }
@@ -4076,17 +4673,9 @@ static int s2io_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
  *   file on failure.
  */
 
-static int s2io_change_mtu(struct net_device *dev, int new_mtu)
+int s2io_change_mtu(struct net_device *dev, int new_mtu)
 {
         nic_t *sp = dev->priv;
-        XENA_dev_config_t __iomem *bar0 = sp->bar0;
-        register u64 val64;
-
-        if (netif_running(dev)) {
-                DBG_PRINT(ERR_DBG, "%s: Must be stopped to ", dev->name);
-                DBG_PRINT(ERR_DBG, "change its MTU \n");
-                return -EBUSY;
-        }
 
         if ((new_mtu < MIN_MTU) || (new_mtu > S2IO_JUMBO_SIZE)) {
                 DBG_PRINT(ERR_DBG, "%s: MTU size is invalid.\n",
@@ -4094,11 +4683,22 @@ static int s2io_change_mtu(struct net_device *dev, int new_mtu)
                 return -EPERM;
         }
 
-        /* Set the new MTU into the PYLD register of the NIC */
-        val64 = new_mtu;
-        writeq(vBIT(val64, 2, 14), &bar0->rmac_max_pyld_len);
-
         dev->mtu = new_mtu;
+        if (netif_running(dev)) {
+                s2io_card_down(sp);
+                netif_stop_queue(dev);
+                if (s2io_card_up(sp)) {
+                        DBG_PRINT(ERR_DBG, "%s: Device bring up failed\n",
+                                  __FUNCTION__);
+                }
+                if (netif_queue_stopped(dev))
+                        netif_wake_queue(dev);
+        } else { /* Device is down */
+                XENA_dev_config_t __iomem *bar0 = sp->bar0;
+                u64 val64 = new_mtu;
+
+                writeq(vBIT(val64, 2, 14), &bar0->rmac_max_pyld_len);
+        }
 
         return 0;
 }
@@ -4108,9 +4708,9 @@ static int s2io_change_mtu(struct net_device *dev, int new_mtu)
  *  @dev_adr : address of the device structure in dma_addr_t format.
  *  Description:
  *  This is the tasklet or the bottom half of the ISR. This is
- *  an extension of the ISR which is scheduled by the scheduler to be run 
+ *  an extension of the ISR which is scheduled by the scheduler to be run
  *  when the load on the CPU is low. All low priority tasks of the ISR can
- *  be pushed into the tasklet. For now the tasklet is used only to 
+ *  be pushed into the tasklet. For now the tasklet is used only to
  *  replenish the Rx buffers in the Rx buffer descriptors.
  *  Return value:
  *  void.
@@ -4166,19 +4766,22 @@ static void s2io_set_link(unsigned long data)
         }
 
         subid = nic->pdev->subsystem_device;
-        /* 
-         * Allow a small delay for the NICs self initiated 
-         * cleanup to complete.
-         */
-        msleep(100);
+        if (s2io_link_fault_indication(nic) == MAC_RMAC_ERR_TIMER) {
+                /*
+                 * Allow a small delay for the NICs self initiated
+                 * cleanup to complete.
+                 */
+                msleep(100);
+        }
 
         val64 = readq(&bar0->adapter_status);
-        if (verify_xena_quiescence(val64, nic->device_enabled_once)) {
+        if (verify_xena_quiescence(nic, val64, nic->device_enabled_once)) {
                 if (LINK_IS_UP(val64)) {
                         val64 = readq(&bar0->adapter_control);
                         val64 |= ADAPTER_CNTL_EN;
                         writeq(val64, &bar0->adapter_control);
-                        if (CARDS_WITH_FAULTY_LINK_INDICATORS(subid)) {
+                        if (CARDS_WITH_FAULTY_LINK_INDICATORS(nic->device_type,
+                                                             subid)) {
                                 val64 = readq(&bar0->gpio_control);
                                 val64 |= GPIO_CTRL_GPIO_0;
                                 writeq(val64, &bar0->gpio_control);
@@ -4187,20 +4790,24 @@ static void s2io_set_link(unsigned long data)
                                 val64 |= ADAPTER_LED_ON;
                                 writeq(val64, &bar0->adapter_control);
                         }
-                        val64 = readq(&bar0->adapter_status);
-                        if (!LINK_IS_UP(val64)) {
-                                DBG_PRINT(ERR_DBG, "%s:", dev->name);
-                                DBG_PRINT(ERR_DBG, " Link down");
-                                DBG_PRINT(ERR_DBG, "after ");
-                                DBG_PRINT(ERR_DBG, "enabling ");
-                                DBG_PRINT(ERR_DBG, "device \n");
+                        if (s2io_link_fault_indication(nic) ==
+                                                MAC_RMAC_ERR_TIMER) {
+                                val64 = readq(&bar0->adapter_status);
+                                if (!LINK_IS_UP(val64)) {
+                                        DBG_PRINT(ERR_DBG, "%s:", dev->name);
+                                        DBG_PRINT(ERR_DBG, " Link down");
+                                        DBG_PRINT(ERR_DBG, "after ");
+                                        DBG_PRINT(ERR_DBG, "enabling ");
+                                        DBG_PRINT(ERR_DBG, "device \n");
+                                }
                         }
                         if (nic->device_enabled_once == FALSE) {
                                 nic->device_enabled_once = TRUE;
                         }
                         s2io_link(nic, LINK_UP);
                 } else {
-                        if (CARDS_WITH_FAULTY_LINK_INDICATORS(subid)) {
+                        if (CARDS_WITH_FAULTY_LINK_INDICATORS(nic->device_type,
+                                                              subid)) {
                                 val64 = readq(&bar0->gpio_control);
                                 val64 &= ~GPIO_CTRL_GPIO_0;
                                 writeq(val64, &bar0->gpio_control);
@@ -4223,9 +4830,11 @@ static void s2io_card_down(nic_t * sp)
         unsigned long flags;
         register u64 val64 = 0;
 
+        del_timer_sync(&sp->alarm_timer);
         /* If s2io_set_link task is executing, wait till it completes. */
-        while (test_and_set_bit(0, &(sp->link_state)))
+        while (test_and_set_bit(0, &(sp->link_state))) {
                 msleep(50);
+        }
         atomic_set(&sp->card_state, CARD_DOWN);
 
         /* disable Tx and Rx traffic on the NIC */
@@ -4237,7 +4846,7 @@ static void s2io_card_down(nic_t * sp)
         /* Check if the device is Quiescent and then Reset the NIC */
         do {
                 val64 = readq(&bar0->adapter_status);
-                if (verify_xena_quiescence(val64, sp->device_enabled_once)) {
+                if (verify_xena_quiescence(sp, val64, sp->device_enabled_once)) {
                         break;
                 }
 
@@ -4251,14 +4860,27 @@ static void s2io_card_down(nic_t * sp)
                         break;
                 }
         } while (1);
-        spin_lock_irqsave(&sp->tx_lock, flags);
         s2io_reset(sp);
 
-        /* Free all unused Tx and Rx buffers */
+        /* Waiting till all Interrupt handlers are complete */
+        cnt = 0;
+        do {
+                msleep(10);
+                if (!atomic_read(&sp->isr_cnt))
+                        break;
+                cnt++;
+        } while(cnt < 5);
+
+        spin_lock_irqsave(&sp->tx_lock, flags);
+        /* Free all Tx buffers */
         free_tx_buffers(sp);
+        spin_unlock_irqrestore(&sp->tx_lock, flags);
+
+        /* Free all Rx buffers */
+        spin_lock_irqsave(&sp->rx_lock, flags);
         free_rx_buffers(sp);
+        spin_unlock_irqrestore(&sp->rx_lock, flags);
 
-        spin_unlock_irqrestore(&sp->tx_lock, flags);
         clear_bit(0, &(sp->link_state));
 }
 
@@ -4276,8 +4898,8 @@ static int s2io_card_up(nic_t * sp)
                 return -ENODEV;
         }
 
-        /* 
-         * Initializing the Rx buffers. For now we are considering only 1 
+        /*
+         * Initializing the Rx buffers. For now we are considering only 1
          * Rx ring and initializing buffers into 30 Rx blocks
          */
         mac_control = &sp->mac_control;
@@ -4311,16 +4933,18 @@ static int s2io_card_up(nic_t * sp)
                 return -ENODEV;
         }
 
+        S2IO_TIMER_CONF(sp->alarm_timer, s2io_alarm_handle, sp, (HZ/2));
+
         atomic_set(&sp->card_state, CARD_UP);
         return 0;
 }
 
-/** 
+/**
  * s2io_restart_nic - Resets the NIC.
  * @data : long pointer to the device private structure
  * Description:
  * This function is scheduled to be run by the s2io_tx_watchdog
- * function after 0.5 secs to reset the NIC. The idea is to reduce 
+ * function after 0.5 secs to reset the NIC. The idea is to reduce
  * the run time of the watch dog routine which is run holding a
  * spin lock.
  */
@@ -4338,10 +4962,11 @@ static void s2io_restart_nic(unsigned long data)
         netif_wake_queue(dev);
         DBG_PRINT(ERR_DBG, "%s: was reset by Tx watchdog timer\n",
                   dev->name);
+
 }
 
-/** 
- *  s2io_tx_watchdog - Watchdog for transmit side. 
+/**
+ *  s2io_tx_watchdog - Watchdog for transmit side.
  *  @dev : Pointer to net device structure
  *  Description:
  *  This function is triggered if the Tx Queue is stopped
@@ -4369,7 +4994,7 @@ static void s2io_tx_watchdog(struct net_device *dev)
  *   @len : length of the packet
  *   @cksum : FCS checksum of the frame.
  *   @ring_no : the ring from which this RxD was extracted.
- *   Description: 
+ *   Description:
  *   This function is called by the Tx interrupt serivce routine to perform
  *   some OS related operations on the SKB before passing it to the upper
  *   layers. It mainly checks if the checksum is OK, if so adds it to the
@@ -4379,35 +5004,68 @@ static void s2io_tx_watchdog(struct net_device *dev)
  *   Return value:
  *   SUCCESS on success and -1 on failure.
  */
-#ifndef CONFIG_2BUFF_MODE
-static int rx_osm_handler(nic_t * sp, u16 len, RxD_t * rxdp, int ring_no)
-#else
-static int rx_osm_handler(nic_t * sp, RxD_t * rxdp, int ring_no,
-                          buffAdd_t * ba)
-#endif
+static int rx_osm_handler(ring_info_t *ring_data, RxD_t * rxdp)
 {
+        nic_t *sp = ring_data->nic;
         struct net_device *dev = (struct net_device *) sp->dev;
-        struct sk_buff *skb =
-            (struct sk_buff *) ((unsigned long) rxdp->Host_Control);
+        struct sk_buff *skb = (struct sk_buff *)
+                ((unsigned long) rxdp->Host_Control);
+        int ring_no = ring_data->ring_no;
         u16 l3_csum, l4_csum;
 #ifdef CONFIG_2BUFF_MODE
-        int buf0_len, buf2_len;
+        int buf0_len = RXD_GET_BUFFER0_SIZE(rxdp->Control_2);
+        int buf2_len = RXD_GET_BUFFER2_SIZE(rxdp->Control_2);
+        int get_block = ring_data->rx_curr_get_info.block_index;
+        int get_off = ring_data->rx_curr_get_info.offset;
+        buffAdd_t *ba = &ring_data->ba[get_block][get_off];
         unsigned char *buff;
+#else
+        u16 len = (u16) ((RXD_GET_BUFFER0_SIZE(rxdp->Control_2)) >> 48);;
 #endif
+        skb->dev = dev;
+        if (rxdp->Control_1 & RXD_T_CODE) {
+                unsigned long long err = rxdp->Control_1 & RXD_T_CODE;
+                DBG_PRINT(ERR_DBG, "%s: Rx error Value: 0x%llx\n",
+                          dev->name, err);
+                dev_kfree_skb(skb);
+                sp->stats.rx_crc_errors++;
+                atomic_dec(&sp->rx_bufs_left[ring_no]);
+                rxdp->Host_Control = 0;
+                return 0;
+        }
 
-        l3_csum = RXD_GET_L3_CKSUM(rxdp->Control_1);
-        if ((rxdp->Control_1 & TCP_OR_UDP_FRAME) && (sp->rx_csum)) {
+        /* Updating statistics */
+        rxdp->Host_Control = 0;
+        sp->rx_pkt_count++;
+        sp->stats.rx_packets++;
+#ifndef CONFIG_2BUFF_MODE
+        sp->stats.rx_bytes += len;
+#else
+        sp->stats.rx_bytes += buf0_len + buf2_len;
+#endif
+
+#ifndef CONFIG_2BUFF_MODE
+        skb_put(skb, len);
+#else
+        buff = skb_push(skb, buf0_len);
+        memcpy(buff, ba->ba_0, buf0_len);
+        skb_put(skb, buf2_len);
+#endif
+
+        if ((rxdp->Control_1 & TCP_OR_UDP_FRAME) &&
+            (sp->rx_csum)) {
+                l3_csum = RXD_GET_L3_CKSUM(rxdp->Control_1);
                 l4_csum = RXD_GET_L4_CKSUM(rxdp->Control_1);
                 if ((l3_csum == L3_CKSUM_OK) && (l4_csum == L4_CKSUM_OK)) {
-                        /* 
+                        /*
                          * NIC verifies if the Checksum of the received
                          * frame is Ok or not and accordingly returns
                          * a flag in the RxD.
                          */
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                 } else {
-                        /* 
-                         * Packet with erroneous checksum, let the 
+                        /*
+                         * Packet with erroneous checksum, let the
                          * upper layers deal with it.
                          */
                         skb->ip_summed = CHECKSUM_NONE;
@@ -4416,44 +5074,26 @@ static int rx_osm_handler(nic_t * sp, RxD_t * rxdp, int ring_no,
                 skb->ip_summed = CHECKSUM_NONE;
         }
 
-        if (rxdp->Control_1 & RXD_T_CODE) {
-                unsigned long long err = rxdp->Control_1 & RXD_T_CODE;
-                DBG_PRINT(ERR_DBG, "%s: Rx error Value: 0x%llx\n",
-                          dev->name, err);
-        }
-#ifdef CONFIG_2BUFF_MODE
-        buf0_len = RXD_GET_BUFFER0_SIZE(rxdp->Control_2);
-        buf2_len = RXD_GET_BUFFER2_SIZE(rxdp->Control_2);
-#endif
-
-        skb->dev = dev;
-#ifndef CONFIG_2BUFF_MODE
-        skb_put(skb, len);
-        skb->protocol = eth_type_trans(skb, dev);
-#else
-        buff = skb_push(skb, buf0_len);
-        memcpy(buff, ba->ba_0, buf0_len);
-        skb_put(skb, buf2_len);
         skb->protocol = eth_type_trans(skb, dev);
-#endif
-
 #ifdef CONFIG_S2IO_NAPI
-        netif_receive_skb(skb);
+        if (sp->vlgrp && RXD_GET_VLAN_TAG(rxdp->Control_2)) {
+                /* Queueing the vlan frame to the upper layer */
+                vlan_hwaccel_receive_skb(skb, sp->vlgrp,
+                        RXD_GET_VLAN_TAG(rxdp->Control_2));
+        } else {
+                netif_receive_skb(skb);
+        }
 #else
-        netif_rx(skb);
+        if (sp->vlgrp && RXD_GET_VLAN_TAG(rxdp->Control_2)) {
+                /* Queueing the vlan frame to the upper layer */
+                vlan_hwaccel_rx(skb, sp->vlgrp,
+                        RXD_GET_VLAN_TAG(rxdp->Control_2));
+        } else {
+                netif_rx(skb);
+        }
 #endif
-
         dev->last_rx = jiffies;
-        sp->rx_pkt_count++;
-        sp->stats.rx_packets++;
-#ifndef CONFIG_2BUFF_MODE
-        sp->stats.rx_bytes += len;
-#else
-        sp->stats.rx_bytes += buf0_len + buf2_len;
-#endif
-
         atomic_dec(&sp->rx_bufs_left[ring_no]);
-        rxdp->Host_Control = 0;
         return SUCCESS;
 }
 
@@ -4464,13 +5104,13 @@ static int rx_osm_handler(nic_t * sp, RxD_t * rxdp, int ring_no,
  *  @link : inidicates whether link is UP/DOWN.
  *  Description:
  *  This function stops/starts the Tx queue depending on whether the link
- *  status of the NIC is is down or up. This is called by the Alarm 
- *  interrupt handler whenever a link change interrupt comes up. 
+ *  status of the NIC is is down or up. This is called by the Alarm
+ *  interrupt handler whenever a link change interrupt comes up.
  *  Return value:
  *  void.
  */
 
-static void s2io_link(nic_t * sp, int link)
+void s2io_link(nic_t * sp, int link)
 {
         struct net_device *dev = (struct net_device *) sp->dev;
 
@@ -4487,8 +5127,25 @@ static void s2io_link(nic_t * sp, int link)
 }
 
 /**
- *  s2io_init_pci -Initialization of PCI and PCI-X configuration registers . 
- *  @sp : private member of the device structure, which is a pointer to the 
+ *  get_xena_rev_id - to identify revision ID of xena.
+ *  @pdev : PCI Dev structure
+ *  Description:
+ *  Function to identify the Revision ID of xena.
+ *  Return value:
+ *  returns the revision ID of the device.
+ */
+
+int get_xena_rev_id(struct pci_dev *pdev)
+{
+        u8 id = 0;
+        int ret;
+        ret = pci_read_config_byte(pdev, PCI_REVISION_ID, (u8 *) & id);
+        return id;
+}
+
+/**
+ *  s2io_init_pci -Initialization of PCI and PCI-X configuration registers .
+ *  @sp : private member of the device structure, which is a pointer to the
  *  s2io_nic structure.
  *  Description:
  *  This function initializes a few of the PCI and PCI-X configuration registers
@@ -4499,15 +5156,15 @@ static void s2io_link(nic_t * sp, int link)
 
 static void s2io_init_pci(nic_t * sp)
 {
-        u16 pci_cmd = 0;
+        u16 pci_cmd = 0, pcix_cmd = 0;
 
         /* Enable Data Parity Error Recovery in PCI-X command register. */
         pci_read_config_word(sp->pdev, PCIX_COMMAND_REGISTER,
-                             &(sp->pcix_cmd));
+                             &(pcix_cmd));
         pci_write_config_word(sp->pdev, PCIX_COMMAND_REGISTER,
-                              (sp->pcix_cmd | 1));
+                              (pcix_cmd | 1));
         pci_read_config_word(sp->pdev, PCIX_COMMAND_REGISTER,
-                             &(sp->pcix_cmd));
+                             &(pcix_cmd));
 
         /* Set the PErr Response bit in PCI command register. */
         pci_read_config_word(sp->pdev, PCI_COMMAND, &pci_cmd);
@@ -4515,53 +5172,43 @@ static void s2io_init_pci(nic_t * sp)
                               (pci_cmd | PCI_COMMAND_PARITY));
         pci_read_config_word(sp->pdev, PCI_COMMAND, &pci_cmd);
 
-        /* Set MMRB count to 1024 in PCI-X Command register. */
-        sp->pcix_cmd &= 0xFFF3;
-        pci_write_config_word(sp->pdev, PCIX_COMMAND_REGISTER, (sp->pcix_cmd | (0x1 << 2)));    /* MMRBC 1K */
-        pci_read_config_word(sp->pdev, PCIX_COMMAND_REGISTER,
-                             &(sp->pcix_cmd));
-
-        /*  Setting Maximum outstanding splits based on system type. */
-        sp->pcix_cmd &= 0xFF8F;
-
-        sp->pcix_cmd |= XENA_MAX_OUTSTANDING_SPLITS(0x1);       /* 2 splits. */
-        pci_write_config_word(sp->pdev, PCIX_COMMAND_REGISTER,
-                              sp->pcix_cmd);
-        pci_read_config_word(sp->pdev, PCIX_COMMAND_REGISTER,
-                             &(sp->pcix_cmd));
         /* Forcibly disabling relaxed ordering capability of the card. */
-        sp->pcix_cmd &= 0xfffd;
+        pcix_cmd &= 0xfffd;
         pci_write_config_word(sp->pdev, PCIX_COMMAND_REGISTER,
-                              sp->pcix_cmd);
+                              pcix_cmd);
         pci_read_config_word(sp->pdev, PCIX_COMMAND_REGISTER,
-                             &(sp->pcix_cmd));
+                             &(pcix_cmd));
 }
 
 MODULE_AUTHOR("Raghavendra Koushik <raghavendra.koushik@neterion.com>");
 MODULE_LICENSE("GPL");
 module_param(tx_fifo_num, int, 0);
-module_param_array(tx_fifo_len, int, NULL, 0);
 module_param(rx_ring_num, int, 0);
-module_param_array(rx_ring_sz, int, NULL, 0);
-module_param(Stats_refresh_time, int, 0);
+module_param_array(tx_fifo_len, uint, NULL, 0);
+module_param_array(rx_ring_sz, uint, NULL, 0);
+module_param_array(rts_frm_len, uint, NULL, 0);
+module_param(use_continuous_tx_intrs, int, 1);
 module_param(rmac_pause_time, int, 0);
 module_param(mc_pause_threshold_q0q3, int, 0);
 module_param(mc_pause_threshold_q4q7, int, 0);
 module_param(shared_splits, int, 0);
 module_param(tmac_util_period, int, 0);
 module_param(rmac_util_period, int, 0);
+module_param(bimodal, bool, 0);
 #ifndef CONFIG_S2IO_NAPI
 module_param(indicate_max_pkts, int, 0);
 #endif
+module_param(rxsync_frequency, int, 0);
+
 /**
- *  s2io_init_nic - Initialization of the adapter . 
+ *  s2io_init_nic - Initialization of the adapter .
  *  @pdev : structure containing the PCI related information of the device.
  *  @pre: List of PCI devices supported by the driver listed in s2io_tbl.
  *  Description:
  *  The function initializes an adapter identified by the pci_dec structure.
- *  All OS related initialization including memory and device structure and 
- *  initlaization of the device private variable is done. Also the swapper 
- *  control register is initialized to enable read and write into the I/O 
+ *  All OS related initialization including memory and device structure and
+ *  initlaization of the device private variable is done. Also the swapper
+ *  control register is initialized to enable read and write into the I/O
  *  registers of the device.
  *  Return value:
  *  returns 0 on success and negative on failure.
@@ -4572,7 +5219,6 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
 {
         nic_t *sp;
         struct net_device *dev;
-        char *dev_name = "S2IO 10GE NIC";
         int i, j, ret;
         int dma_flag = FALSE;
         u32 mac_up, mac_down;
@@ -4581,10 +5227,11 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
         u16 subid;
         mac_info_t *mac_control;
         struct config_param *config;
+        int mode;
 
-
-        DBG_PRINT(ERR_DBG, "Loading S2IO driver with %s\n",
-                s2io_driver_version);
+#ifdef CONFIG_S2IO_NAPI
+        DBG_PRINT(ERR_DBG, "NAPI support has been enabled\n");
+#endif
 
         if ((ret = pci_enable_device(pdev))) {
                 DBG_PRINT(ERR_DBG,
@@ -4595,7 +5242,6 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
         if (!pci_set_dma_mask(pdev, DMA_64BIT_MASK)) {
                 DBG_PRINT(INIT_DBG, "s2io_init_nic: Using 64bit DMA\n");
                 dma_flag = TRUE;
-
                 if (pci_set_consistent_dma_mask
                     (pdev, DMA_64BIT_MASK)) {
                         DBG_PRINT(ERR_DBG,
@@ -4635,34 +5281,41 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
         memset(sp, 0, sizeof(nic_t));
         sp->dev = dev;
         sp->pdev = pdev;
-        sp->vendor_id = pdev->vendor;
-        sp->device_id = pdev->device;
         sp->high_dma_flag = dma_flag;
-        sp->irq = pdev->irq;
         sp->device_enabled_once = FALSE;
-        strcpy(sp->name, dev_name);
+
+        if ((pdev->device == PCI_DEVICE_ID_HERC_WIN) ||
+                (pdev->device == PCI_DEVICE_ID_HERC_UNI))
+                sp->device_type = XFRAME_II_DEVICE;
+        else
+                sp->device_type = XFRAME_I_DEVICE;
 
         /* Initialize some PCI/PCI-X fields of the NIC. */
         s2io_init_pci(sp);
 
-        /* 
+        /*
          * Setting the device configuration parameters.
-         * Most of these parameters can be specified by the user during 
-         * module insertion as they are module loadable parameters. If 
-         * these parameters are not not specified during load time, they 
+         * Most of these parameters can be specified by the user during
+         * module insertion as they are module loadable parameters. If
+         * these parameters are not not specified during load time, they
          * are initialized with default values.
          */
         mac_control = &sp->mac_control;
         config = &sp->config;
 
         /* Tx side parameters. */
-        tx_fifo_len[0] = DEFAULT_FIFO_LEN;      /* Default value. */
+        if (tx_fifo_len[0] == 0)
+                tx_fifo_len[0] = DEFAULT_FIFO_LEN; /* Default value. */
         config->tx_fifo_num = tx_fifo_num;
         for (i = 0; i < MAX_TX_FIFOS; i++) {
                 config->tx_cfg[i].fifo_len = tx_fifo_len[i];
                 config->tx_cfg[i].fifo_priority = i;
         }
 
+        /* mapping the QoS priority to the configured fifos */
+        for (i = 0; i < MAX_TX_FIFOS; i++)
+                config->fifo_mapping[i] = fifo_map[config->tx_fifo_num][i];
+
         config->tx_intr_type = TXD_INT_TYPE_UTILZ;
         for (i = 0; i < config->tx_fifo_num; i++) {
                 config->tx_cfg[i].f_no_snoop =
@@ -4675,7 +5328,8 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
         config->max_txds = MAX_SKB_FRAGS;
 
         /* Rx side parameters. */
-        rx_ring_sz[0] = SMALL_BLK_CNT;  /* Default value. */
+        if (rx_ring_sz[0] == 0)
+                rx_ring_sz[0] = SMALL_BLK_CNT; /* Default value. */
         config->rx_ring_num = rx_ring_num;
         for (i = 0; i < MAX_RX_RINGS; i++) {
                 config->rx_cfg[i].num_rxd = rx_ring_sz[i] *
@@ -4699,10 +5353,13 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
         for (i = 0; i < config->rx_ring_num; i++)
                 atomic_set(&sp->rx_bufs_left[i], 0);
 
+        /* Initialize the number of ISRs currently running */
+        atomic_set(&sp->isr_cnt, 0);
+
         /*  initialize the shared memory used by the NIC and the host */
         if (init_shared_mem(sp)) {
                 DBG_PRINT(ERR_DBG, "%s: Memory allocation failed\n",
-                          dev->name);
+                          __FUNCTION__);
                 ret = -ENOMEM;
                 goto mem_alloc_failed;
         }
@@ -4743,13 +5400,17 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
         dev->do_ioctl = &s2io_ioctl;
         dev->change_mtu = &s2io_change_mtu;
         SET_ETHTOOL_OPS(dev, &netdev_ethtool_ops);
+        dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
+        dev->vlan_rx_register = s2io_vlan_rx_register;
+        dev->vlan_rx_kill_vid = (void *)s2io_vlan_rx_kill_vid;
+
         /*
          * will use eth_mac_addr() for  dev->set_mac_address
          * mac address will be set every time dev->open() is called
          */
-#ifdef CONFIG_S2IO_NAPI
+#if defined(CONFIG_S2IO_NAPI)
         dev->poll = s2io_poll;
-        dev->weight = 90;
+        dev->weight = 32;
 #endif
 
         dev->features |= NETIF_F_SG | NETIF_F_IP_CSUM;
@@ -4776,22 +5437,28 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
                 goto set_swap_failed;
         }
 
-        /* Fix for all "FFs" MAC address problems observed on Alpha platforms */
-        fix_mac_address(sp);
-        s2io_reset(sp);
+        /* Verify if the Herc works on the slot its placed into */
+        if (sp->device_type & XFRAME_II_DEVICE) {
+                mode = s2io_verify_pci_mode(sp);
+                if (mode < 0) {
+                        DBG_PRINT(ERR_DBG, "%s: ", __FUNCTION__);
+                        DBG_PRINT(ERR_DBG, " Unsupported PCI bus mode\n");
+                        ret = -EBADSLT;
+                        goto set_swap_failed;
+                }
+        }
 
-        /*
-         * Setting swapper control on the NIC, so the MAC address can be read.
-         */
-        if (s2io_set_swapper(sp)) {
-                DBG_PRINT(ERR_DBG,
-                          "%s: S2IO: swapper settings are wrong\n",
-                          dev->name);
-                ret = -EAGAIN;
-                goto set_swap_failed;
+        /* Not needed for Herc */
+        if (sp->device_type & XFRAME_I_DEVICE) {
+                /*
+                 * Fix for all "FFs" MAC address problems observed on
+                 * Alpha platforms
+                 */
+                fix_mac_address(sp);
+                s2io_reset(sp);
         }
 
-        /*  
+        /*
          * MAC address initialization.
          * For now only one mac address will be read and used.
          */
@@ -4814,37 +5481,28 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
         sp->def_mac_addr[0].mac_addr[5] = (u8) (mac_down >> 16);
         sp->def_mac_addr[0].mac_addr[4] = (u8) (mac_down >> 24);
 
-        DBG_PRINT(INIT_DBG,
-                  "DEFAULT MAC ADDR:0x%02x-%02x-%02x-%02x-%02x-%02x\n",
-                  sp->def_mac_addr[0].mac_addr[0],
-                  sp->def_mac_addr[0].mac_addr[1],
-                  sp->def_mac_addr[0].mac_addr[2],
-                  sp->def_mac_addr[0].mac_addr[3],
-                  sp->def_mac_addr[0].mac_addr[4],
-                  sp->def_mac_addr[0].mac_addr[5]);
-
         /*  Set the factory defined MAC address initially   */
         dev->addr_len = ETH_ALEN;
         memcpy(dev->dev_addr, sp->def_mac_addr, ETH_ALEN);
 
         /*
-         * Initialize the tasklet status and link state flags 
-         * and the card statte parameter
+         * Initialize the tasklet status and link state flags
+         * and the card state parameter
          */
         atomic_set(&(sp->card_state), 0);
         sp->tasklet_status = 0;
         sp->link_state = 0;
 
-
         /* Initialize spinlocks */
         spin_lock_init(&sp->tx_lock);
 #ifndef CONFIG_S2IO_NAPI
         spin_lock_init(&sp->put_lock);
 #endif
+        spin_lock_init(&sp->rx_lock);
 
-        /* 
-         * SXE-002: Configure link and activity LED to init state 
-         * on driver load. 
+        /*
+         * SXE-002: Configure link and activity LED to init state
+         * on driver load.
          */
         subid = sp->pdev->subsystem_device;
         if ((subid & 0xFF) >= 0x07) {
@@ -4864,13 +5522,61 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
                 goto register_failed;
         }
 
-        /* 
-         * Make Link state as off at this point, when the Link change 
-         * interrupt comes the state will be automatically changed to 
+        if (sp->device_type & XFRAME_II_DEVICE) {
+                DBG_PRINT(ERR_DBG, "%s: Neterion Xframe II 10GbE adapter ",
+                          dev->name);
+                DBG_PRINT(ERR_DBG, "(rev %d), Driver %s\n",
+                                get_xena_rev_id(sp->pdev),
+                                s2io_driver_version);
+                DBG_PRINT(ERR_DBG, "MAC ADDR: %02x:%02x:%02x:%02x:%02x:%02x\n",
+                          sp->def_mac_addr[0].mac_addr[0],
+                          sp->def_mac_addr[0].mac_addr[1],
+                          sp->def_mac_addr[0].mac_addr[2],
+                          sp->def_mac_addr[0].mac_addr[3],
+                          sp->def_mac_addr[0].mac_addr[4],
+                          sp->def_mac_addr[0].mac_addr[5]);
+                mode = s2io_print_pci_mode(sp);
+                if (mode < 0) {
+                        DBG_PRINT(ERR_DBG, " Unsupported PCI bus mode ");
+                        ret = -EBADSLT;
+                        goto set_swap_failed;
+                }
+        } else {
+                DBG_PRINT(ERR_DBG, "%s: Neterion Xframe I 10GbE adapter ",
+                          dev->name);
+                DBG_PRINT(ERR_DBG, "(rev %d), Driver %s\n",
+                                        get_xena_rev_id(sp->pdev),
+                                        s2io_driver_version);
+                DBG_PRINT(ERR_DBG, "MAC ADDR: %02x:%02x:%02x:%02x:%02x:%02x\n",
+                          sp->def_mac_addr[0].mac_addr[0],
+                          sp->def_mac_addr[0].mac_addr[1],
+                          sp->def_mac_addr[0].mac_addr[2],
+                          sp->def_mac_addr[0].mac_addr[3],
+                          sp->def_mac_addr[0].mac_addr[4],
+                          sp->def_mac_addr[0].mac_addr[5]);
+        }
+
+        /* Initialize device name */
+        strcpy(sp->name, dev->name);
+        if (sp->device_type & XFRAME_II_DEVICE)
+                strcat(sp->name, ": Neterion Xframe II 10GbE adapter");
+        else
+                strcat(sp->name, ": Neterion Xframe I 10GbE adapter");
+
+        /* Initialize bimodal Interrupts */
+        sp->config.bimodal = bimodal;
+        if (!(sp->device_type & XFRAME_II_DEVICE) && bimodal) {
+                sp->config.bimodal = 0;
+                DBG_PRINT(ERR_DBG,"%s:Bimodal intr not supported by Xframe I\n",
+                        dev->name);
+        }
+
+        /*
+         * Make Link state as off at this point, when the Link change
+         * interrupt comes the state will be automatically changed to
          * the right state.
          */
         netif_carrier_off(dev);
-        sp->last_link_state = LINK_DOWN;
 
         return 0;
 
@@ -4891,11 +5597,11 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
 }
 
 /**
- * s2io_rem_nic - Free the PCI device 
+ * s2io_rem_nic - Free the PCI device
  * @pdev: structure containing the PCI related information of the device.
- * Description: This function is called by the Pci subsystem to release a 
+ * Description: This function is called by the Pci subsystem to release a
  * PCI device and free up all resource held up by the device. This could
- * be in response to a Hot plug event or when the driver is to be removed 
+ * be in response to a Hot plug event or when the driver is to be removed
  * from memory.
  */
 
@@ -4919,7 +5625,6 @@ static void __devexit s2io_rem_nic(struct pci_dev *pdev)
         pci_disable_device(pdev);
         pci_release_regions(pdev);
         pci_set_drvdata(pdev, NULL);
-
         free_netdev(dev);
 }
 
@@ -4935,11 +5640,11 @@ int __init s2io_starter(void)
 }
 
 /**
- * s2io_closer - Cleanup routine for the driver 
+ * s2io_closer - Cleanup routine for the driver
  * Description: This function is the cleanup routine for the driver. It unregist * ers the driver.
  */
 
-static void s2io_closer(void)
+void s2io_closer(void)
 {
         pci_unregister_driver(&s2io_driver);
         DBG_PRINT(INIT_DBG, "cleanup done\n");
diff --git a/drivers/net/s2io.h b/drivers/net/s2io.h
index 1711c8c3dc99..bc64d967f080 100644
--- a/drivers/net/s2io.h
+++ b/drivers/net/s2io.h
@@ -31,6 +31,9 @@
 #define SUCCESS 0
 #define FAILURE -1
 
+/* Maximum time to flicker LED when asked to identify NIC using ethtool */
+#define MAX_FLICKER_TIME        60000 /* 60 Secs */
+
 /* Maximum outstanding splits to be configured into xena. */
 typedef enum xena_max_outstanding_splits {
         XENA_ONE_SPLIT_TRANSACTION = 0,
@@ -45,10 +48,10 @@ typedef enum xena_max_outstanding_splits {
 #define XENA_MAX_OUTSTANDING_SPLITS(n) (n << 4)
 
 /*  OS concerned variables and constants */
-#define WATCH_DOG_TIMEOUT       5*HZ
-#define EFILL                           0x1234
-#define ALIGN_SIZE                      127
-#define PCIX_COMMAND_REGISTER   0x62
+#define WATCH_DOG_TIMEOUT               15*HZ
+#define EFILL                           0x1234
+#define ALIGN_SIZE                      127
+#define PCIX_COMMAND_REGISTER           0x62
 
 /*
  * Debug related variables.
@@ -61,7 +64,7 @@ typedef enum xena_max_outstanding_splits {
 #define INTR_DBG        4
 
 /* Global variable that defines the present debug level of the driver. */
-static int debug_level = ERR_DBG;       /* Default level. */
+int debug_level = ERR_DBG;      /* Default level. */
 
 /* DEBUG message print. */
 #define DBG_PRINT(dbg_level, args...)  if(!(debug_level<dbg_level)) printk(args)
@@ -71,6 +74,12 @@ static int debug_level = ERR_DBG;	/* Default level. */
 #define L4_CKSUM_OK 0xFFFF
 #define S2IO_JUMBO_SIZE 9600
 
+/* Driver statistics maintained by driver */
+typedef struct {
+        unsigned long long single_ecc_errs;
+        unsigned long long double_ecc_errs;
+} swStat_t;
+
 /* The statistics block of Xena */
 typedef struct stat_block {
 /* Tx MAC statistics counters. */
@@ -186,12 +195,90 @@ typedef struct stat_block {
         u32 rxd_rd_cnt;
         u32 rxf_wr_cnt;
         u32 txf_rd_cnt;
+
+/* Tx MAC statistics overflow counters. */
+        u32 tmac_data_octets_oflow;
+        u32 tmac_frms_oflow;
+        u32 tmac_bcst_frms_oflow;
+        u32 tmac_mcst_frms_oflow;
+        u32 tmac_ucst_frms_oflow;
+        u32 tmac_ttl_octets_oflow;
+        u32 tmac_any_err_frms_oflow;
+        u32 tmac_nucst_frms_oflow;
+        u64 tmac_vlan_frms;
+        u32 tmac_drop_ip_oflow;
+        u32 tmac_vld_ip_oflow;
+        u32 tmac_rst_tcp_oflow;
+        u32 tmac_icmp_oflow;
+        u32 tpa_unknown_protocol;
+        u32 tmac_udp_oflow;
+        u32 reserved_10;
+        u32 tpa_parse_failure;
+
+/* Rx MAC Statistics overflow counters. */
+        u32 rmac_data_octets_oflow;
+        u32 rmac_vld_frms_oflow;
+        u32 rmac_vld_bcst_frms_oflow;
+        u32 rmac_vld_mcst_frms_oflow;
+        u32 rmac_accepted_ucst_frms_oflow;
+        u32 rmac_ttl_octets_oflow;
+        u32 rmac_discarded_frms_oflow;
+        u32 rmac_accepted_nucst_frms_oflow;
+        u32 rmac_usized_frms_oflow;
+        u32 rmac_drop_events_oflow;
+        u32 rmac_frag_frms_oflow;
+        u32 rmac_osized_frms_oflow;
+        u32 rmac_ip_oflow;
+        u32 rmac_jabber_frms_oflow;
+        u32 rmac_icmp_oflow;
+        u32 rmac_drop_ip_oflow;
+        u32 rmac_err_drp_udp_oflow;
+        u32 rmac_udp_oflow;
+        u32 reserved_11;
+        u32 rmac_pause_cnt_oflow;
+        u64 rmac_ttl_1519_4095_frms;
+        u64 rmac_ttl_4096_8191_frms;
+        u64 rmac_ttl_8192_max_frms;
+        u64 rmac_ttl_gt_max_frms;
+        u64 rmac_osized_alt_frms;
+        u64 rmac_jabber_alt_frms;
+        u64 rmac_gt_max_alt_frms;
+        u64 rmac_vlan_frms;
+        u32 rmac_len_discard;
+        u32 rmac_fcs_discard;
+        u32 rmac_pf_discard;
+        u32 rmac_da_discard;
+        u32 rmac_red_discard;
+        u32 rmac_rts_discard;
+        u32 reserved_12;
+        u32 rmac_ingm_full_discard;
+        u32 reserved_13;
+        u32 rmac_accepted_ip_oflow;
+        u32 reserved_14;
+        u32 link_fault_cnt;
+        swStat_t sw_stat;
 } StatInfo_t;
 
-/* Structures representing different init time configuration
+/*
+ * Structures representing different init time configuration
  * parameters of the NIC.
  */
 
+#define MAX_TX_FIFOS 8
+#define MAX_RX_RINGS 8
+
+/* FIFO mappings for all possible number of fifos configured */
+int fifo_map[][MAX_TX_FIFOS] = {
+        {0, 0, 0, 0, 0, 0, 0, 0},
+        {0, 0, 0, 0, 1, 1, 1, 1},
+        {0, 0, 0, 1, 1, 1, 2, 2},
+        {0, 0, 1, 1, 2, 2, 3, 3},
+        {0, 0, 1, 1, 2, 2, 3, 4},
+        {0, 0, 1, 1, 2, 3, 4, 5},
+        {0, 0, 1, 2, 3, 4, 5, 6},
+        {0, 1, 2, 3, 4, 5, 6, 7},
+};
+
 /* Maintains Per FIFO related information. */
 typedef struct tx_fifo_config {
 #define MAX_AVAILABLE_TXDS      8192
@@ -237,14 +324,14 @@ typedef struct rx_ring_config {
 #define NO_SNOOP_RXD_BUFFER         0x02
 } rx_ring_config_t;
 
-/* This structure provides contains values of the tunable parameters 
- * of the H/W 
+/* This structure provides contains values of the tunable parameters
+ * of the H/W
  */
 struct config_param {
 /* Tx Side */
         u32 tx_fifo_num;        /*Number of Tx FIFOs */
-#define MAX_TX_FIFOS 8
 
+        u8 fifo_mapping[MAX_TX_FIFOS];
         tx_fifo_config_t tx_cfg[MAX_TX_FIFOS];  /*Per-Tx FIFO config */
         u32 max_txds;           /*Max no. of Tx buffer descriptor per TxDL */
         u64 tx_intr_type;
@@ -252,10 +339,10 @@ struct config_param {
 
 /* Rx Side */
         u32 rx_ring_num;        /*Number of receive rings */
-#define MAX_RX_RINGS 8
 #define MAX_RX_BLOCKS_PER_RING  150
 
         rx_ring_config_t rx_cfg[MAX_RX_RINGS];  /*Per-Rx Ring config */
+        u8 bimodal;             /*Flag for setting bimodal interrupts*/
 
 #define HEADER_ETHERNET_II_802_3_SIZE 14
 #define HEADER_802_2_SIZE              3
@@ -269,6 +356,7 @@ struct config_param {
 #define MAX_PYLD_JUMBO              9600
 #define MAX_MTU_JUMBO               (MAX_PYLD_JUMBO+18)
 #define MAX_MTU_JUMBO_VLAN          (MAX_PYLD_JUMBO+22)
+        u16 bus_speed;
 };
 
 /* Structure representing MAC Addrs */
@@ -277,7 +365,7 @@ typedef struct mac_addr {
 } macaddr_t;
 
 /* Structure that represent every FIFO element in the BAR1
- * Address location. 
+ * Address location.
  */
 typedef struct _TxFIFO_element {
         u64 TxDL_Pointer;
@@ -339,6 +427,7 @@ typedef struct _RxD_t {
 #define RXD_FRAME_PROTO         vBIT(0xFFFF,24,8)
 #define RXD_FRAME_PROTO_IPV4    BIT(27)
 #define RXD_FRAME_PROTO_IPV6    BIT(28)
+#define RXD_FRAME_IP_FRAG       BIT(29)
 #define RXD_FRAME_PROTO_TCP     BIT(30)
 #define RXD_FRAME_PROTO_UDP     BIT(31)
 #define TCP_OR_UDP_FRAME        (RXD_FRAME_PROTO_TCP | RXD_FRAME_PROTO_UDP)
@@ -346,11 +435,15 @@ typedef struct _RxD_t {
 #define RXD_GET_L4_CKSUM(val)   ((u16)(val) & 0xFFFF)
 
         u64 Control_2;
+#define THE_RXD_MARK            0x3
+#define SET_RXD_MARKER          vBIT(THE_RXD_MARK, 0, 2)
+#define GET_RXD_MARKER(ctrl)    ((ctrl & SET_RXD_MARKER) >> 62)
+
 #ifndef CONFIG_2BUFF_MODE
-#define MASK_BUFFER0_SIZE       vBIT(0xFFFF,0,16)
-#define SET_BUFFER0_SIZE(val)   vBIT(val,0,16)
+#define MASK_BUFFER0_SIZE       vBIT(0x3FFF,2,14)
+#define SET_BUFFER0_SIZE(val)   vBIT(val,2,14)
 #else
-#define MASK_BUFFER0_SIZE       vBIT(0xFF,0,16)
+#define MASK_BUFFER0_SIZE       vBIT(0xFF,2,14)
 #define MASK_BUFFER1_SIZE       vBIT(0xFFFF,16,16)
 #define MASK_BUFFER2_SIZE       vBIT(0xFFFF,32,16)
 #define SET_BUFFER0_SIZE(val)   vBIT(val,8,8)
@@ -363,7 +456,7 @@ typedef struct _RxD_t {
 #define SET_NUM_TAG(val)       vBIT(val,16,32)
 
 #ifndef CONFIG_2BUFF_MODE
-#define RXD_GET_BUFFER0_SIZE(Control_2) (u64)((Control_2 & vBIT(0xFFFF,0,16)))
+#define RXD_GET_BUFFER0_SIZE(Control_2) (u64)((Control_2 & vBIT(0x3FFF,2,14)))
 #else
 #define RXD_GET_BUFFER0_SIZE(Control_2) (u8)((Control_2 & MASK_BUFFER0_SIZE) \
                                                         >> 48)
@@ -382,7 +475,7 @@ typedef struct _RxD_t {
 #endif
 } RxD_t;
 
-/* Structure that represents the Rx descriptor block which contains 
+/* Structure that represents the Rx descriptor block which contains
  * 128 Rx descriptors.
  */
 #ifndef CONFIG_2BUFF_MODE
@@ -392,11 +485,11 @@ typedef struct _RxD_block {
 
         u64 reserved_0;
 #define END_OF_BLOCK    0xFEFFFFFFFFFFFFFFULL
-        u64 reserved_1;         /* 0xFEFFFFFFFFFFFFFF to mark last 
+        u64 reserved_1;         /* 0xFEFFFFFFFFFFFFFF to mark last
                                  * Rxd in this blk */
         u64 reserved_2_pNext_RxD_block; /* Logical ptr to next */
         u64 pNext_RxD_Blk_physical;     /* Buff0_ptr.In a 32 bit arch
-                                         * the upper 32 bits should 
+                                         * the upper 32 bits should
                                          * be 0 */
 } RxD_block_t;
 #else
@@ -405,13 +498,13 @@ typedef struct _RxD_block {
         RxD_t rxd[MAX_RXDS_PER_BLOCK];
 
 #define END_OF_BLOCK    0xFEFFFFFFFFFFFFFFULL
-        u64 reserved_1;         /* 0xFEFFFFFFFFFFFFFF to mark last Rxd 
+        u64 reserved_1;         /* 0xFEFFFFFFFFFFFFFF to mark last Rxd
                                  * in this blk */
         u64 pNext_RxD_Blk_physical;     /* Phy ponter to next blk. */
 } RxD_block_t;
 #define SIZE_OF_BLOCK   4096
 
-/* Structure to hold virtual addresses of Buf0 and Buf1 in 
+/* Structure to hold virtual addresses of Buf0 and Buf1 in
  * 2buf mode. */
 typedef struct bufAdd {
         void *ba_0_org;
@@ -423,8 +516,8 @@ typedef struct bufAdd {
 
 /* Structure which stores all the MAC control parameters */
 
-/* This structure stores the offset of the RxD in the ring 
- * from which the Rx Interrupt processor can start picking 
+/* This structure stores the offset of the RxD in the ring
+ * from which the Rx Interrupt processor can start picking
  * up the RxDs for processing.
  */
 typedef struct _rx_curr_get_info_t {
@@ -436,7 +529,7 @@ typedef struct _rx_curr_get_info_t {
 typedef rx_curr_get_info_t rx_curr_put_info_t;
 
 /* This structure stores the offset of the TxDl in the FIFO
- * from which the Tx Interrupt processor can start picking 
+ * from which the Tx Interrupt processor can start picking
  * up the TxDLs for send complete interrupt processing.
  */
 typedef struct {
@@ -446,32 +539,96 @@ typedef struct {
 
 typedef tx_curr_get_info_t tx_curr_put_info_t;
 
-/* Infomation related to the Tx and Rx FIFOs and Rings of Xena
- * is maintained in this structure.
- */
-typedef struct mac_info {
-/* rx side stuff */
-        /* Put pointer info which indictes which RxD has to be replenished 
+/* Structure that holds the Phy and virt addresses of the Blocks */
+typedef struct rx_block_info {
+        RxD_t *block_virt_addr;
+        dma_addr_t block_dma_addr;
+} rx_block_info_t;
+
+/* pre declaration of the nic structure */
+typedef struct s2io_nic nic_t;
+
+/* Ring specific structure */
+typedef struct ring_info {
+        /* The ring number */
+        int ring_no;
+
+        /*
+         *  Place holders for the virtual and physical addresses of
+         *  all the Rx Blocks
+         */
+        rx_block_info_t rx_blocks[MAX_RX_BLOCKS_PER_RING];
+        int block_count;
+        int pkt_cnt;
+
+        /*
+         * Put pointer info which indictes which RxD has to be replenished
          * with a new buffer.
          */
-        rx_curr_put_info_t rx_curr_put_info[MAX_RX_RINGS];
+        rx_curr_put_info_t rx_curr_put_info;
 
-        /* Get pointer info which indictes which is the last RxD that was 
+        /*
+         * Get pointer info which indictes which is the last RxD that was
          * processed by the driver.
          */
-        rx_curr_get_info_t rx_curr_get_info[MAX_RX_RINGS];
+        rx_curr_get_info_t rx_curr_get_info;
 
-        u16 rmac_pause_time;
-        u16 mc_pause_threshold_q0q3;
-        u16 mc_pause_threshold_q4q7;
+#ifndef CONFIG_S2IO_NAPI
+        /* Index to the absolute position of the put pointer of Rx ring */
+        int put_pos;
+#endif
+
+#ifdef CONFIG_2BUFF_MODE
+        /* Buffer Address store. */
+        buffAdd_t **ba;
+#endif
+        nic_t *nic;
+} ring_info_t;
 
+/* Fifo specific structure */
+typedef struct fifo_info {
+        /* FIFO number */
+        int fifo_no;
+
+        /* Maximum TxDs per TxDL */
+        int max_txds;
+
+        /* Place holder of all the TX List's Phy and Virt addresses. */
+        list_info_hold_t *list_info;
+
+        /*
+         * Current offset within the tx FIFO where driver would write
+         * new Tx frame
+         */
+        tx_curr_put_info_t tx_curr_put_info;
+
+        /*
+         * Current offset within tx FIFO from where the driver would start freeing
+         * the buffers
+         */
+        tx_curr_get_info_t tx_curr_get_info;
+
+        nic_t *nic;
+}fifo_info_t;
+
+/* Infomation related to the Tx and Rx FIFOs and Rings of Xena
+ * is maintained in this structure.
+ */
+typedef struct mac_info {
 /* tx side stuff */
         /* logical pointer of start of each Tx FIFO */
         TxFIFO_element_t __iomem *tx_FIFO_start[MAX_TX_FIFOS];
 
-/* Current offset within tx_FIFO_start, where driver would write new Tx frame*/
-        tx_curr_put_info_t tx_curr_put_info[MAX_TX_FIFOS];
-        tx_curr_get_info_t tx_curr_get_info[MAX_TX_FIFOS];
+        /* Fifo specific structure */
+        fifo_info_t fifos[MAX_TX_FIFOS];
+
+/* rx side stuff */
+        /* Ring specific structure */
+        ring_info_t rings[MAX_RX_RINGS];
+
+        u16 rmac_pause_time;
+        u16 mc_pause_threshold_q0q3;
+        u16 mc_pause_threshold_q4q7;
 
         void *stats_mem;        /* orignal pointer to allocated mem */
         dma_addr_t stats_mem_phy;       /* Physical address of the stat block */
@@ -485,12 +642,6 @@ typedef struct {
         int usage_cnt;
 } usr_addr_t;
 
-/* Structure that holds the Phy and virt addresses of the Blocks */
-typedef struct rx_block_info {
-        RxD_t *block_virt_addr;
-        dma_addr_t block_dma_addr;
-} rx_block_info_t;
-
 /* Default Tunable parameters of the NIC. */
 #define DEFAULT_FIFO_LEN 4096
 #define SMALL_RXD_CNT   30 * (MAX_RXDS_PER_BLOCK+1)
@@ -499,7 +650,20 @@ typedef struct rx_block_info {
 #define LARGE_BLK_CNT   100
 
 /* Structure representing one instance of the NIC */
-typedef struct s2io_nic {
+struct s2io_nic {
+#ifdef CONFIG_S2IO_NAPI
+        /*
+         * Count of packets to be processed in a given iteration, it will be indicated
+         * by the quota field of the device structure when NAPI is enabled.
+         */
+        int pkts_to_process;
+#endif
+        struct net_device *dev;
+        mac_info_t mac_control;
+        struct config_param config;
+        struct pci_dev *pdev;
+        void __iomem *bar0;
+        void __iomem *bar1;
 #define MAX_MAC_SUPPORTED   16
 #define MAX_SUPPORTED_MULTICASTS MAX_MAC_SUPPORTED
 
@@ -507,33 +671,20 @@ typedef struct s2io_nic {
         macaddr_t pre_mac_addr[MAX_MAC_SUPPORTED];
 
         struct net_device_stats stats;
-        void __iomem *bar0;
-        void __iomem *bar1;
-        struct config_param config;
-        mac_info_t mac_control;
         int high_dma_flag;
         int device_close_flag;
         int device_enabled_once;
 
-        char name[32];
+        char name[50];
         struct tasklet_struct task;
         volatile unsigned long tasklet_status;
-        struct timer_list timer;
-        struct net_device *dev;
-        struct pci_dev *pdev;
 
-        u16 vendor_id;
-        u16 device_id;
-        u16 ccmd;
-        u32 cbar0_1;
-        u32 cbar0_2;
-        u32 cbar1_1;
-        u32 cbar1_2;
-        u32 cirq;
-        u8 cache_line;
-        u32 rom_expansion;
-        u16 pcix_cmd;
-        u32 irq;
+        /* Timer that handles I/O errors/exceptions */
+        struct timer_list alarm_timer;
+
+        /* Space to back up the PCI config space */
+        u32 config_space[256 / sizeof(u32)];
+
         atomic_t rx_bufs_left[MAX_RX_RINGS];
 
         spinlock_t tx_lock;
@@ -558,27 +709,11 @@ typedef struct s2io_nic {
         u16 tx_err_count;
         u16 rx_err_count;
 
-#ifndef CONFIG_S2IO_NAPI
-        /* Index to the absolute position of the put pointer of Rx ring. */
-        int put_pos[MAX_RX_RINGS];
-#endif
-
-        /*
-         *  Place holders for the virtual and physical addresses of 
-         *  all the Rx Blocks
-         */
-        rx_block_info_t rx_blocks[MAX_RX_RINGS][MAX_RX_BLOCKS_PER_RING];
-        int block_count[MAX_RX_RINGS];
-        int pkt_cnt[MAX_RX_RINGS];
-
-        /* Place holder of all the TX List's Phy and Virt addresses. */
-        list_info_hold_t *list_info[MAX_TX_FIFOS];
-
         /*  Id timer, used to blink NIC to physically identify NIC. */
         struct timer_list id_timer;
 
         /*  Restart timer, used to restart NIC if the device is stuck and
-         *  a schedule task that will set the correct Link state once the 
+         *  a schedule task that will set the correct Link state once the
          *  NIC's PHY has stabilized after a state change.
          */
 #ifdef INIT_TQUEUE
@@ -589,12 +724,12 @@ typedef struct s2io_nic {
         struct work_struct set_link_task;
 #endif
 
-        /* Flag that can be used to turn on or turn off the Rx checksum 
+        /* Flag that can be used to turn on or turn off the Rx checksum
          * offload feature.
          */
         int rx_csum;
 
-        /*  after blink, the adapter must be restored with original 
+        /*  after blink, the adapter must be restored with original
          *  values.
          */
         u64 adapt_ctrl_org;
@@ -604,16 +739,19 @@ typedef struct s2io_nic {
 #define LINK_DOWN       1
 #define LINK_UP         2
 
-#ifdef CONFIG_2BUFF_MODE
-        /* Buffer Address store. */
-        buffAdd_t **ba[MAX_RX_RINGS];
-#endif
         int task_flag;
 #define CARD_DOWN 1
 #define CARD_UP 2
         atomic_t card_state;
         volatile unsigned long link_state;
-} nic_t;
+        struct vlan_group *vlgrp;
+#define XFRAME_I_DEVICE         1
+#define XFRAME_II_DEVICE        2
+        u8 device_type;
+
+        spinlock_t      rx_lock;
+        atomic_t        isr_cnt;
+};
 
 #define RESET_ERROR 1;
 #define CMD_ERROR   2;
@@ -622,7 +760,8 @@ typedef struct s2io_nic {
 #ifndef readq
 static inline u64 readq(void __iomem *addr)
 {
-        u64 ret = readl(addr + 4);
+        u64 ret = 0;
+        ret = readl(addr + 4);
         ret <<= 32;
         ret |= readl(addr);
 
@@ -637,10 +776,10 @@ static inline void writeq(u64 val, void __iomem *addr)
         writel((u32) (val >> 32), (addr + 4));
 }
 
-/* In 32 bit modes, some registers have to be written in a 
+/* In 32 bit modes, some registers have to be written in a
  * particular order to expect correct hardware operation. The
- * macro SPECIAL_REG_WRITE is used to perform such ordered 
- * writes. Defines UF (Upper First) and LF (Lower First) will 
+ * macro SPECIAL_REG_WRITE is used to perform such ordered
+ * writes. Defines UF (Upper First) and LF (Lower First) will
  * be used to specify the required write order.
  */
 #define UF      1
@@ -716,6 +855,7 @@ static inline void SPECIAL_REG_WRITE(u64 val, void __iomem *addr, int order)
 #define PCC_FB_ECC_ERR     vBIT(0xff, 16, 8)    /* Interrupt to indicate
                                                    PCC_FB_ECC Error. */
 
+#define RXD_GET_VLAN_TAG(Control_2) (u16)(Control_2 & MASK_VLAN_TAG)
 /*
  * Prototype declaration.
  */
@@ -725,36 +865,30 @@ static void __devexit s2io_rem_nic(struct pci_dev *pdev);
 static int init_shared_mem(struct s2io_nic *sp);
 static void free_shared_mem(struct s2io_nic *sp);
 static int init_nic(struct s2io_nic *nic);
-#ifndef CONFIG_S2IO_NAPI
-static void rx_intr_handler(struct s2io_nic *sp);
-#endif
-static void tx_intr_handler(struct s2io_nic *sp);
+static void rx_intr_handler(ring_info_t *ring_data);
+static void tx_intr_handler(fifo_info_t *fifo_data);
 static void alarm_intr_handler(struct s2io_nic *sp);
 
 static int s2io_starter(void);
-static void s2io_closer(void);
+void s2io_closer(void);
 static void s2io_tx_watchdog(struct net_device *dev);
 static void s2io_tasklet(unsigned long dev_addr);
 static void s2io_set_multicast(struct net_device *dev);
-#ifndef CONFIG_2BUFF_MODE
-static int rx_osm_handler(nic_t * sp, u16 len, RxD_t * rxdp, int ring_no);
-#else
-static int rx_osm_handler(nic_t * sp, RxD_t * rxdp, int ring_no,
-                          buffAdd_t * ba);
-#endif
-static void s2io_link(nic_t * sp, int link);
-static void s2io_reset(nic_t * sp);
-#ifdef CONFIG_S2IO_NAPI
+static int rx_osm_handler(ring_info_t *ring_data, RxD_t * rxdp);
+void s2io_link(nic_t * sp, int link);
+void s2io_reset(nic_t * sp);
+#if defined(CONFIG_S2IO_NAPI)
 static int s2io_poll(struct net_device *dev, int *budget);
 #endif
 static void s2io_init_pci(nic_t * sp);
-static int s2io_set_mac_addr(struct net_device *dev, u8 * addr);
+int s2io_set_mac_addr(struct net_device *dev, u8 * addr);
+static void s2io_alarm_handle(unsigned long data);
 static irqreturn_t s2io_isr(int irq, void *dev_id, struct pt_regs *regs);
-static int verify_xena_quiescence(u64 val64, int flag);
+static int verify_xena_quiescence(nic_t *sp, u64 val64, int flag);
 static struct ethtool_ops netdev_ethtool_ops;
 static void s2io_set_link(unsigned long data);
-static int s2io_set_swapper(nic_t * sp);
-static void s2io_card_down(nic_t * nic);
-static int s2io_card_up(nic_t * nic);
-
+int s2io_set_swapper(nic_t * sp);
+static void s2io_card_down(nic_t *nic);
+static int s2io_card_up(nic_t *nic);
+int get_xena_rev_id(struct pci_dev *pdev);
 #endif                          /* _S2IO_H */
diff --git a/drivers/net/shaper.c b/drivers/net/shaper.c
index 3ad0b6751f6f..221354eea21f 100644
--- a/drivers/net/shaper.c
+++ b/drivers/net/shaper.c
@@ -156,52 +156,6 @@ static int shaper_start_xmit(struct sk_buff *skb, struct net_device *dev)
          
         SHAPERCB(skb)->shapelen= shaper_clocks(shaper,skb);
         
-#ifdef SHAPER_COMPLEX /* and broken.. */
-
-        while(ptr && ptr!=(struct sk_buff *)&shaper->sendq)
-        {
-                if(ptr->pri<skb->pri 
-                        && jiffies - SHAPERCB(ptr)->shapeclock < SHAPER_MAXSLIP)
-                {
-                        struct sk_buff *tmp=ptr->prev;
-
-                        /*
-                         *      It goes before us therefore we slip the length
-                         *      of the new frame.
-                         */
-
-                        SHAPERCB(ptr)->shapeclock+=SHAPERCB(skb)->shapelen;
-                        SHAPERCB(ptr)->shapelatency+=SHAPERCB(skb)->shapelen;
-
-                        /*
-                         *      The packet may have slipped so far back it
-                         *      fell off.
-                         */
-                        if(SHAPERCB(ptr)->shapelatency > SHAPER_LATENCY)
-                        {
-                                skb_unlink(ptr);
-                                dev_kfree_skb(ptr);
-                        }
-                        ptr=tmp;
-                }
-                else
-                        break;
-        }
-        if(ptr==NULL || ptr==(struct sk_buff *)&shaper->sendq)
-                skb_queue_head(&shaper->sendq,skb);
-        else
-        {
-                struct sk_buff *tmp;
-                /*
-                 *      Set the packet clock out time according to the
-                 *      frames ahead. Im sure a bit of thought could drop
-                 *      this loop.
-                 */
-                for(tmp=skb_peek(&shaper->sendq); tmp!=NULL && tmp!=ptr; tmp=tmp->next)
-                        SHAPERCB(skb)->shapeclock+=tmp->shapelen;
-                skb_append(ptr,skb);
-        }
-#else
         {
                 struct sk_buff *tmp;
                 /*
@@ -220,7 +174,7 @@ static int shaper_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 } else
                         skb_queue_tail(&shaper->sendq, skb);
         }
-#endif  
+
         if(sh_debug)
                 printk("Frame queued.\n");
         if(skb_queue_len(&shaper->sendq)>SHAPER_QLEN)
@@ -302,7 +256,7 @@ static void shaper_kick(struct shaper *shaper)
                          *      Pull the frame and get interrupts back on.
                          */
                          
-                        skb_unlink(skb);
+                        skb_unlink(skb, &shaper->sendq);
                         if (shaper->recovery < 
                             SHAPERCB(skb)->shapeclock + SHAPERCB(skb)->shapelen)
                                 shaper->recovery = SHAPERCB(skb)->shapeclock + SHAPERCB(skb)->shapelen;
diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c
new file mode 100644
index 000000000000..bf3440aa6c24
--- /dev/null
+++ b/drivers/net/sis190.c
@@ -0,0 +1,1843 @@
+/*
+   sis190.c: Silicon Integrated Systems SiS190 ethernet driver
+
+   Copyright (c) 2003 K.M. Liu <kmliu@sis.com>
+   Copyright (c) 2003, 2004 Jeff Garzik <jgarzik@pobox.com>
+   Copyright (c) 2003, 2004, 2005 Francois Romieu <romieu@fr.zoreil.com>
+
+   Based on r8169.c, tg3.c, 8139cp.c, skge.c, epic100.c and SiS 190/191
+   genuine driver.
+
+   This software may be used and distributed according to the terms of
+   the GNU General Public License (GPL), incorporated herein by reference.
+   Drivers based on or derived from this code fall under the GPL and must
+   retain the authorship, copyright and license notice.  This file is not
+   a complete program and may only be used when the entire operating
+   system is licensed under the GPL.
+
+   See the file COPYING in this distribution for more information.
+
+ */
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/netdevice.h>
+#include <linux/rtnetlink.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/pci.h>
+#include <linux/mii.h>
+#include <linux/delay.h>
+#include <linux/crc32.h>
+#include <linux/dma-mapping.h>
+#include <asm/irq.h>
+
+#define net_drv(p, arg...)      if (netif_msg_drv(p)) \
+                                        printk(arg)
+#define net_probe(p, arg...)    if (netif_msg_probe(p)) \
+                                        printk(arg)
+#define net_link(p, arg...)     if (netif_msg_link(p)) \
+                                        printk(arg)
+#define net_intr(p, arg...)     if (netif_msg_intr(p)) \
+                                        printk(arg)
+#define net_tx_err(p, arg...)   if (netif_msg_tx_err(p)) \
+                                        printk(arg)
+
+#define PHY_MAX_ADDR            32
+#define PHY_ID_ANY              0x1f
+#define MII_REG_ANY             0x1f
+
+#ifdef CONFIG_SIS190_NAPI
+#define NAPI_SUFFIX     "-NAPI"
+#else
+#define NAPI_SUFFIX     ""
+#endif
+
+#define DRV_VERSION             "1.2" NAPI_SUFFIX
+#define DRV_NAME                "sis190"
+#define SIS190_DRIVER_NAME      DRV_NAME " Gigabit Ethernet driver " DRV_VERSION
+#define PFX DRV_NAME ": "
+
+#ifdef CONFIG_SIS190_NAPI
+#define sis190_rx_skb                   netif_receive_skb
+#define sis190_rx_quota(count, quota)   min(count, quota)
+#else
+#define sis190_rx_skb                   netif_rx
+#define sis190_rx_quota(count, quota)   count
+#endif
+
+#define MAC_ADDR_LEN            6
+
+#define NUM_TX_DESC             64      /* [8..1024] */
+#define NUM_RX_DESC             64      /* [8..8192] */
+#define TX_RING_BYTES           (NUM_TX_DESC * sizeof(struct TxDesc))
+#define RX_RING_BYTES           (NUM_RX_DESC * sizeof(struct RxDesc))
+#define RX_BUF_SIZE             1536
+#define RX_BUF_MASK             0xfff8
+
+#define SIS190_REGS_SIZE        0x80
+#define SIS190_TX_TIMEOUT       (6*HZ)
+#define SIS190_PHY_TIMEOUT      (10*HZ)
+#define SIS190_MSG_DEFAULT      (NETIF_MSG_DRV | NETIF_MSG_PROBE | \
+                                 NETIF_MSG_LINK | NETIF_MSG_IFUP | \
+                                 NETIF_MSG_IFDOWN)
+
+/* Enhanced PHY access register bit definitions */
+#define EhnMIIread              0x0000
+#define EhnMIIwrite             0x0020
+#define EhnMIIdataShift         16
+#define EhnMIIpmdShift          6       /* 7016 only */
+#define EhnMIIregShift          11
+#define EhnMIIreq               0x0010
+#define EhnMIInotDone           0x0010
+
+/* Write/read MMIO register */
+#define SIS_W8(reg, val)        writeb ((val), ioaddr + (reg))
+#define SIS_W16(reg, val)       writew ((val), ioaddr + (reg))
+#define SIS_W32(reg, val)       writel ((val), ioaddr + (reg))
+#define SIS_R8(reg)             readb (ioaddr + (reg))
+#define SIS_R16(reg)            readw (ioaddr + (reg))
+#define SIS_R32(reg)            readl (ioaddr + (reg))
+
+#define SIS_PCI_COMMIT()        SIS_R32(IntrControl)
+
+enum sis190_registers {
+        TxControl               = 0x00,
+        TxDescStartAddr         = 0x04,
+        rsv0                    = 0x08, // reserved
+        TxSts                   = 0x0c, // unused (Control/Status)
+        RxControl               = 0x10,
+        RxDescStartAddr         = 0x14,
+        rsv1                    = 0x18, // reserved
+        RxSts                   = 0x1c, // unused
+        IntrStatus              = 0x20,
+        IntrMask                = 0x24,
+        IntrControl             = 0x28,
+        IntrTimer               = 0x2c, // unused (Interupt Timer)
+        PMControl               = 0x30, // unused (Power Mgmt Control/Status)
+        rsv2                    = 0x34, // reserved
+        ROMControl              = 0x38,
+        ROMInterface            = 0x3c,
+        StationControl          = 0x40,
+        GMIIControl             = 0x44,
+        GIoCR                   = 0x48, // unused (GMAC IO Compensation)
+        GIoCtrl                 = 0x4c, // unused (GMAC IO Control)
+        TxMacControl            = 0x50,
+        TxLimit                 = 0x54, // unused (Tx MAC Timer/TryLimit)
+        RGDelay                 = 0x58, // unused (RGMII Tx Internal Delay)
+        rsv3                    = 0x5c, // reserved
+        RxMacControl            = 0x60,
+        RxMacAddr               = 0x62,
+        RxHashTable             = 0x68,
+        // Undocumented         = 0x6c,
+        RxWolCtrl               = 0x70,
+        RxWolData               = 0x74, // unused (Rx WOL Data Access)
+        RxMPSControl            = 0x78, // unused (Rx MPS Control)
+        rsv4                    = 0x7c, // reserved
+};
+
+enum sis190_register_content {
+        /* IntrStatus */
+        SoftInt                 = 0x40000000,   // unused
+        Timeup                  = 0x20000000,   // unused
+        PauseFrame              = 0x00080000,   // unused
+        MagicPacket             = 0x00040000,   // unused
+        WakeupFrame             = 0x00020000,   // unused
+        LinkChange              = 0x00010000,
+        RxQEmpty                = 0x00000080,
+        RxQInt                  = 0x00000040,
+        TxQ1Empty               = 0x00000020,   // unused
+        TxQ1Int                 = 0x00000010,
+        TxQ0Empty               = 0x00000008,   // unused
+        TxQ0Int                 = 0x00000004,
+        RxHalt                  = 0x00000002,
+        TxHalt                  = 0x00000001,
+
+        /* {Rx/Tx}CmdBits */
+        CmdReset                = 0x10,
+        CmdRxEnb                = 0x08,         // unused
+        CmdTxEnb                = 0x01,
+        RxBufEmpty              = 0x01,         // unused
+
+        /* Cfg9346Bits */
+        Cfg9346_Lock            = 0x00,         // unused
+        Cfg9346_Unlock          = 0xc0,         // unused
+
+        /* RxMacControl */
+        AcceptErr               = 0x20,         // unused
+        AcceptRunt              = 0x10,         // unused
+        AcceptBroadcast         = 0x0800,
+        AcceptMulticast         = 0x0400,
+        AcceptMyPhys            = 0x0200,
+        AcceptAllPhys           = 0x0100,
+
+        /* RxConfigBits */
+        RxCfgFIFOShift          = 13,
+        RxCfgDMAShift           = 8,            // 0x1a in RxControl ?
+
+        /* TxConfigBits */
+        TxInterFrameGapShift    = 24,
+        TxDMAShift              = 8, /* DMA burst value (0-7) is shift this many bits */
+
+        /* StationControl */
+        _1000bpsF               = 0x1c00,
+        _1000bpsH               = 0x0c00,
+        _100bpsF                = 0x1800,
+        _100bpsH                = 0x0800,
+        _10bpsF                 = 0x1400,
+        _10bpsH                 = 0x0400,
+
+        LinkStatus              = 0x02,         // unused
+        FullDup                 = 0x01,         // unused
+
+        /* TBICSRBit */
+        TBILinkOK               = 0x02000000,   // unused
+};
+
+struct TxDesc {
+        __le32 PSize;
+        __le32 status;
+        __le32 addr;
+        __le32 size;
+};
+
+struct RxDesc {
+        __le32 PSize;
+        __le32 status;
+        __le32 addr;
+        __le32 size;
+};
+
+enum _DescStatusBit {
+        /* _Desc.status */
+        OWNbit          = 0x80000000, // RXOWN/TXOWN
+        INTbit          = 0x40000000, // RXINT/TXINT
+        CRCbit          = 0x00020000, // CRCOFF/CRCEN
+        PADbit          = 0x00010000, // PREADD/PADEN
+        /* _Desc.size */
+        RingEnd         = 0x80000000,
+        /* TxDesc.status */
+        LSEN            = 0x08000000, // TSO ? -- FR
+        IPCS            = 0x04000000,
+        TCPCS           = 0x02000000,
+        UDPCS           = 0x01000000,
+        BSTEN           = 0x00800000,
+        EXTEN           = 0x00400000,
+        DEFEN           = 0x00200000,
+        BKFEN           = 0x00100000,
+        CRSEN           = 0x00080000,
+        COLEN           = 0x00040000,
+        THOL3           = 0x30000000,
+        THOL2           = 0x20000000,
+        THOL1           = 0x10000000,
+        THOL0           = 0x00000000,
+        /* RxDesc.status */
+        IPON            = 0x20000000,
+        TCPON           = 0x10000000,
+        UDPON           = 0x08000000,
+        Wakup           = 0x00400000,
+        Magic           = 0x00200000,
+        Pause           = 0x00100000,
+        DEFbit          = 0x00200000,
+        BCAST           = 0x000c0000,
+        MCAST           = 0x00080000,
+        UCAST           = 0x00040000,
+        /* RxDesc.PSize */
+        TAGON           = 0x80000000,
+        RxDescCountMask = 0x7f000000, // multi-desc pkt when > 1 ? -- FR
+        ABORT           = 0x00800000,
+        SHORT           = 0x00400000,
+        LIMIT           = 0x00200000,
+        MIIER           = 0x00100000,
+        OVRUN           = 0x00080000,
+        NIBON           = 0x00040000,
+        COLON           = 0x00020000,
+        CRCOK           = 0x00010000,
+        RxSizeMask      = 0x0000ffff
+        /*
+         * The asic could apparently do vlan, TSO, jumbo (sis191 only) and
+         * provide two (unused with Linux) Tx queues. No publically
+         * available documentation alas.
+         */
+};
+
+enum sis190_eeprom_access_register_bits {
+        EECS    = 0x00000001,   // unused
+        EECLK   = 0x00000002,   // unused
+        EEDO    = 0x00000008,   // unused
+        EEDI    = 0x00000004,   // unused
+        EEREQ   = 0x00000080,
+        EEROP   = 0x00000200,
+        EEWOP   = 0x00000100    // unused
+};
+
+/* EEPROM Addresses */
+enum sis190_eeprom_address {
+        EEPROMSignature = 0x00,
+        EEPROMCLK       = 0x01, // unused
+        EEPROMInfo      = 0x02,
+        EEPROMMACAddr   = 0x03
+};
+
+struct sis190_private {
+        void __iomem *mmio_addr;
+        struct pci_dev *pci_dev;
+        struct net_device_stats stats;
+        spinlock_t lock;
+        u32 rx_buf_sz;
+        u32 cur_rx;
+        u32 cur_tx;
+        u32 dirty_rx;
+        u32 dirty_tx;
+        dma_addr_t rx_dma;
+        dma_addr_t tx_dma;
+        struct RxDesc *RxDescRing;
+        struct TxDesc *TxDescRing;
+        struct sk_buff *Rx_skbuff[NUM_RX_DESC];
+        struct sk_buff *Tx_skbuff[NUM_TX_DESC];
+        struct work_struct phy_task;
+        struct timer_list timer;
+        u32 msg_enable;
+        struct mii_if_info mii_if;
+        struct list_head first_phy;
+};
+
+struct sis190_phy {
+        struct list_head list;
+        int phy_id;
+        u16 id[2];
+        u16 status;
+        u8  type;
+};
+
+enum sis190_phy_type {
+        UNKNOWN = 0x00,
+        HOME    = 0x01,
+        LAN     = 0x02,
+        MIX     = 0x03
+};
+
+static struct mii_chip_info {
+        const char *name;
+        u16 id[2];
+        unsigned int type;
+} mii_chip_table[] = {
+        { "Broadcom PHY BCM5461", { 0x0020, 0x60c0 }, LAN },
+        { "Agere PHY ET1101B",    { 0x0282, 0xf010 }, LAN },
+        { "Marvell PHY 88E1111",  { 0x0141, 0x0cc0 }, LAN },
+        { "Realtek PHY RTL8201",  { 0x0000, 0x8200 }, LAN },
+        { NULL, }
+};
+
+const static struct {
+        const char *name;
+        u8 version;             /* depend on docs */
+        u32 RxConfigMask;       /* clear the bits supported by this chip */
+} sis_chip_info[] = {
+        { DRV_NAME, 0x00, 0xff7e1880, },
+};
+
+static struct pci_device_id sis190_pci_tbl[] __devinitdata = {
+        { PCI_DEVICE(PCI_VENDOR_ID_SI, 0x0190), 0, 0, 0 },
+        { 0, },
+};
+
+MODULE_DEVICE_TABLE(pci, sis190_pci_tbl);
+
+static int rx_copybreak = 200;
+
+static struct {
+        u32 msg_enable;
+} debug = { -1 };
+
+MODULE_DESCRIPTION("SiS sis190 Gigabit Ethernet driver");
+module_param(rx_copybreak, int, 0);
+MODULE_PARM_DESC(rx_copybreak, "Copy breakpoint for copy-only-tiny-frames");
+module_param_named(debug, debug.msg_enable, int, 0);
+MODULE_PARM_DESC(debug, "Debug verbosity level (0=none, ..., 16=all)");
+MODULE_AUTHOR("K.M. Liu <kmliu@sis.com>, Ueimor <romieu@fr.zoreil.com>");
+MODULE_VERSION(DRV_VERSION);
+MODULE_LICENSE("GPL");
+
+static const u32 sis190_intr_mask =
+        RxQEmpty | RxQInt | TxQ1Int | TxQ0Int | RxHalt | TxHalt;
+
+/*
+ * Maximum number of multicast addresses to filter (vs. Rx-all-multicast).
+ * The chips use a 64 element hash table based on the Ethernet CRC.
+ */
+static int multicast_filter_limit = 32;
+
+static void __mdio_cmd(void __iomem *ioaddr, u32 ctl)
+{
+        unsigned int i;
+
+        SIS_W32(GMIIControl, ctl);
+
+        msleep(1);
+
+        for (i = 0; i < 100; i++) {
+                if (!(SIS_R32(GMIIControl) & EhnMIInotDone))
+                        break;
+                msleep(1);
+        }
+
+        if (i > 999)
+                printk(KERN_ERR PFX "PHY command failed !\n");
+}
+
+static void mdio_write(void __iomem *ioaddr, int phy_id, int reg, int val)
+{
+        __mdio_cmd(ioaddr, EhnMIIreq | EhnMIIwrite |
+                (((u32) reg) << EhnMIIregShift) | (phy_id << EhnMIIpmdShift) |
+                (((u32) val) << EhnMIIdataShift));
+}
+
+static int mdio_read(void __iomem *ioaddr, int phy_id, int reg)
+{
+        __mdio_cmd(ioaddr, EhnMIIreq | EhnMIIread |
+                (((u32) reg) << EhnMIIregShift) | (phy_id << EhnMIIpmdShift));
+
+        return (u16) (SIS_R32(GMIIControl) >> EhnMIIdataShift);
+}
+
+static void __mdio_write(struct net_device *dev, int phy_id, int reg, int val)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+
+        mdio_write(tp->mmio_addr, phy_id, reg, val);
+}
+
+static int __mdio_read(struct net_device *dev, int phy_id, int reg)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+
+        return mdio_read(tp->mmio_addr, phy_id, reg);
+}
+
+static u16 mdio_read_latched(void __iomem *ioaddr, int phy_id, int reg)
+{
+        mdio_read(ioaddr, phy_id, reg);
+        return mdio_read(ioaddr, phy_id, reg);
+}
+
+static u16 __devinit sis190_read_eeprom(void __iomem *ioaddr, u32 reg)
+{
+        u16 data = 0xffff;
+        unsigned int i;
+
+        if (!(SIS_R32(ROMControl) & 0x0002))
+                return 0;
+
+        SIS_W32(ROMInterface, EEREQ | EEROP | (reg << 10));
+
+        for (i = 0; i < 200; i++) {
+                if (!(SIS_R32(ROMInterface) & EEREQ)) {
+                        data = (SIS_R32(ROMInterface) & 0xffff0000) >> 16;
+                        break;
+                }
+                msleep(1);
+        }
+
+        return data;
+}
+
+static void sis190_irq_mask_and_ack(void __iomem *ioaddr)
+{
+        SIS_W32(IntrMask, 0x00);
+        SIS_W32(IntrStatus, 0xffffffff);
+        SIS_PCI_COMMIT();
+}
+
+static void sis190_asic_down(void __iomem *ioaddr)
+{
+        /* Stop the chip's Tx and Rx DMA processes. */
+
+        SIS_W32(TxControl, 0x1a00);
+        SIS_W32(RxControl, 0x1a00);
+
+        sis190_irq_mask_and_ack(ioaddr);
+}
+
+static void sis190_mark_as_last_descriptor(struct RxDesc *desc)
+{
+        desc->size |= cpu_to_le32(RingEnd);
+}
+
+static inline void sis190_give_to_asic(struct RxDesc *desc, u32 rx_buf_sz)
+{
+        u32 eor = le32_to_cpu(desc->size) & RingEnd;
+
+        desc->PSize = 0x0;
+        desc->size = cpu_to_le32((rx_buf_sz & RX_BUF_MASK) | eor);
+        wmb();
+        desc->status = cpu_to_le32(OWNbit | INTbit);
+}
+
+static inline void sis190_map_to_asic(struct RxDesc *desc, dma_addr_t mapping,
+                                      u32 rx_buf_sz)
+{
+        desc->addr = cpu_to_le32(mapping);
+        sis190_give_to_asic(desc, rx_buf_sz);
+}
+
+static inline void sis190_make_unusable_by_asic(struct RxDesc *desc)
+{
+        desc->PSize = 0x0;
+        desc->addr = 0xdeadbeef;
+        desc->size &= cpu_to_le32(RingEnd);
+        wmb();
+        desc->status = 0x0;
+}
+
+static int sis190_alloc_rx_skb(struct pci_dev *pdev, struct sk_buff **sk_buff,
+                               struct RxDesc *desc, u32 rx_buf_sz)
+{
+        struct sk_buff *skb;
+        dma_addr_t mapping;
+        int ret = 0;
+
+        skb = dev_alloc_skb(rx_buf_sz);
+        if (!skb)
+                goto err_out;
+
+        *sk_buff = skb;
+
+        mapping = pci_map_single(pdev, skb->data, rx_buf_sz,
+                                 PCI_DMA_FROMDEVICE);
+
+        sis190_map_to_asic(desc, mapping, rx_buf_sz);
+out:
+        return ret;
+
+err_out:
+        ret = -ENOMEM;
+        sis190_make_unusable_by_asic(desc);
+        goto out;
+}
+
+static u32 sis190_rx_fill(struct sis190_private *tp, struct net_device *dev,
+                          u32 start, u32 end)
+{
+        u32 cur;
+
+        for (cur = start; cur < end; cur++) {
+                int ret, i = cur % NUM_RX_DESC;
+
+                if (tp->Rx_skbuff[i])
+                        continue;
+
+                ret = sis190_alloc_rx_skb(tp->pci_dev, tp->Rx_skbuff + i,
+                                          tp->RxDescRing + i, tp->rx_buf_sz);
+                if (ret < 0)
+                        break;
+        }
+        return cur - start;
+}
+
+static inline int sis190_try_rx_copy(struct sk_buff **sk_buff, int pkt_size,
+                                     struct RxDesc *desc, int rx_buf_sz)
+{
+        int ret = -1;
+
+        if (pkt_size < rx_copybreak) {
+                struct sk_buff *skb;
+
+                skb = dev_alloc_skb(pkt_size + NET_IP_ALIGN);
+                if (skb) {
+                        skb_reserve(skb, NET_IP_ALIGN);
+                        eth_copy_and_sum(skb, sk_buff[0]->data, pkt_size, 0);
+                        *sk_buff = skb;
+                        sis190_give_to_asic(desc, rx_buf_sz);
+                        ret = 0;
+                }
+        }
+        return ret;
+}
+
+static inline int sis190_rx_pkt_err(u32 status, struct net_device_stats *stats)
+{
+#define ErrMask (OVRUN | SHORT | LIMIT | MIIER | NIBON | COLON | ABORT)
+
+        if ((status & CRCOK) && !(status & ErrMask))
+                return 0;
+
+        if (!(status & CRCOK))
+                stats->rx_crc_errors++;
+        else if (status & OVRUN)
+                stats->rx_over_errors++;
+        else if (status & (SHORT | LIMIT))
+                stats->rx_length_errors++;
+        else if (status & (MIIER | NIBON | COLON))
+                stats->rx_frame_errors++;
+
+        stats->rx_errors++;
+        return -1;
+}
+
+static int sis190_rx_interrupt(struct net_device *dev,
+                               struct sis190_private *tp, void __iomem *ioaddr)
+{
+        struct net_device_stats *stats = &tp->stats;
+        u32 rx_left, cur_rx = tp->cur_rx;
+        u32 delta, count;
+
+        rx_left = NUM_RX_DESC + tp->dirty_rx - cur_rx;
+        rx_left = sis190_rx_quota(rx_left, (u32) dev->quota);
+
+        for (; rx_left > 0; rx_left--, cur_rx++) {
+                unsigned int entry = cur_rx % NUM_RX_DESC;
+                struct RxDesc *desc = tp->RxDescRing + entry;
+                u32 status;
+
+                if (desc->status & OWNbit)
+                        break;
+
+                status = le32_to_cpu(desc->PSize);
+
+                // net_intr(tp, KERN_INFO "%s: Rx PSize = %08x.\n", dev->name,
+                //       status);
+
+                if (sis190_rx_pkt_err(status, stats) < 0)
+                        sis190_give_to_asic(desc, tp->rx_buf_sz);
+                else {
+                        struct sk_buff *skb = tp->Rx_skbuff[entry];
+                        int pkt_size = (status & RxSizeMask) - 4;
+                        void (*pci_action)(struct pci_dev *, dma_addr_t,
+                                size_t, int) = pci_dma_sync_single_for_device;
+
+                        if (unlikely(pkt_size > tp->rx_buf_sz)) {
+                                net_intr(tp, KERN_INFO
+                                         "%s: (frag) status = %08x.\n",
+                                         dev->name, status);
+                                stats->rx_dropped++;
+                                stats->rx_length_errors++;
+                                sis190_give_to_asic(desc, tp->rx_buf_sz);
+                                continue;
+                        }
+
+                        pci_dma_sync_single_for_cpu(tp->pci_dev,
+                                le32_to_cpu(desc->addr), tp->rx_buf_sz,
+                                PCI_DMA_FROMDEVICE);
+
+                        if (sis190_try_rx_copy(&skb, pkt_size, desc,
+                                               tp->rx_buf_sz)) {
+                                pci_action = pci_unmap_single;
+                                tp->Rx_skbuff[entry] = NULL;
+                                sis190_make_unusable_by_asic(desc);
+                        }
+
+                        pci_action(tp->pci_dev, le32_to_cpu(desc->addr),
+                                   tp->rx_buf_sz, PCI_DMA_FROMDEVICE);
+
+                        skb->dev = dev;
+                        skb_put(skb, pkt_size);
+                        skb->protocol = eth_type_trans(skb, dev);
+
+                        sis190_rx_skb(skb);
+
+                        dev->last_rx = jiffies;
+                        stats->rx_packets++;
+                        stats->rx_bytes += pkt_size;
+                        if ((status & BCAST) == MCAST)
+                                stats->multicast++;
+                }
+        }
+        count = cur_rx - tp->cur_rx;
+        tp->cur_rx = cur_rx;
+
+        delta = sis190_rx_fill(tp, dev, tp->dirty_rx, tp->cur_rx);
+        if (!delta && count && netif_msg_intr(tp))
+                printk(KERN_INFO "%s: no Rx buffer allocated.\n", dev->name);
+        tp->dirty_rx += delta;
+
+        if (((tp->dirty_rx + NUM_RX_DESC) == tp->cur_rx) && netif_msg_intr(tp))
+                printk(KERN_EMERG "%s: Rx buffers exhausted.\n", dev->name);
+
+        return count;
+}
+
+static void sis190_unmap_tx_skb(struct pci_dev *pdev, struct sk_buff *skb,
+                                struct TxDesc *desc)
+{
+        unsigned int len;
+
+        len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len;
+
+        pci_unmap_single(pdev, le32_to_cpu(desc->addr), len, PCI_DMA_TODEVICE);
+
+        memset(desc, 0x00, sizeof(*desc));
+}
+
+static void sis190_tx_interrupt(struct net_device *dev,
+                                struct sis190_private *tp, void __iomem *ioaddr)
+{
+        u32 pending, dirty_tx = tp->dirty_tx;
+        /*
+         * It would not be needed if queueing was allowed to be enabled
+         * again too early (hint: think preempt and unclocked smp systems).
+         */
+        unsigned int queue_stopped;
+
+        smp_rmb();
+        pending = tp->cur_tx - dirty_tx;
+        queue_stopped = (pending == NUM_TX_DESC);
+
+        for (; pending; pending--, dirty_tx++) {
+                unsigned int entry = dirty_tx % NUM_TX_DESC;
+                struct TxDesc *txd = tp->TxDescRing + entry;
+                struct sk_buff *skb;
+
+                if (le32_to_cpu(txd->status) & OWNbit)
+                        break;
+
+                skb = tp->Tx_skbuff[entry];
+
+                tp->stats.tx_packets++;
+                tp->stats.tx_bytes += skb->len;
+
+                sis190_unmap_tx_skb(tp->pci_dev, skb, txd);
+                tp->Tx_skbuff[entry] = NULL;
+                dev_kfree_skb_irq(skb);
+        }
+
+        if (tp->dirty_tx != dirty_tx) {
+                tp->dirty_tx = dirty_tx;
+                smp_wmb();
+                if (queue_stopped)
+                        netif_wake_queue(dev);
+        }
+}
+
+/*
+ * The interrupt handler does all of the Rx thread work and cleans up after
+ * the Tx thread.
+ */
+static irqreturn_t sis190_interrupt(int irq, void *__dev, struct pt_regs *regs)
+{
+        struct net_device *dev = __dev;
+        struct sis190_private *tp = netdev_priv(dev);
+        void __iomem *ioaddr = tp->mmio_addr;
+        unsigned int handled = 0;
+        u32 status;
+
+        status = SIS_R32(IntrStatus);
+
+        if ((status == 0xffffffff) || !status)
+                goto out;
+
+        handled = 1;
+
+        if (unlikely(!netif_running(dev))) {
+                sis190_asic_down(ioaddr);
+                goto out;
+        }
+
+        SIS_W32(IntrStatus, status);
+
+        // net_intr(tp, KERN_INFO "%s: status = %08x.\n", dev->name, status);
+
+        if (status & LinkChange) {
+                net_intr(tp, KERN_INFO "%s: link change.\n", dev->name);
+                schedule_work(&tp->phy_task);
+        }
+
+        if (status & RxQInt)
+                sis190_rx_interrupt(dev, tp, ioaddr);
+
+        if (status & TxQ0Int)
+                sis190_tx_interrupt(dev, tp, ioaddr);
+out:
+        return IRQ_RETVAL(handled);
+}
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static void sis190_netpoll(struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+        struct pci_dev *pdev = tp->pci_dev;
+
+        disable_irq(pdev->irq);
+        sis190_interrupt(pdev->irq, dev, NULL);
+        enable_irq(pdev->irq);
+}
+#endif
+
+static void sis190_free_rx_skb(struct sis190_private *tp,
+                               struct sk_buff **sk_buff, struct RxDesc *desc)
+{
+        struct pci_dev *pdev = tp->pci_dev;
+
+        pci_unmap_single(pdev, le32_to_cpu(desc->addr), tp->rx_buf_sz,
+                         PCI_DMA_FROMDEVICE);
+        dev_kfree_skb(*sk_buff);
+        *sk_buff = NULL;
+        sis190_make_unusable_by_asic(desc);
+}
+
+static void sis190_rx_clear(struct sis190_private *tp)
+{
+        unsigned int i;
+
+        for (i = 0; i < NUM_RX_DESC; i++) {
+                if (!tp->Rx_skbuff[i])
+                        continue;
+                sis190_free_rx_skb(tp, tp->Rx_skbuff + i, tp->RxDescRing + i);
+        }
+}
+
+static void sis190_init_ring_indexes(struct sis190_private *tp)
+{
+        tp->dirty_tx = tp->dirty_rx = tp->cur_tx = tp->cur_rx = 0;
+}
+
+static int sis190_init_ring(struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+
+        sis190_init_ring_indexes(tp);
+
+        memset(tp->Tx_skbuff, 0x0, NUM_TX_DESC * sizeof(struct sk_buff *));
+        memset(tp->Rx_skbuff, 0x0, NUM_RX_DESC * sizeof(struct sk_buff *));
+
+        if (sis190_rx_fill(tp, dev, 0, NUM_RX_DESC) != NUM_RX_DESC)
+                goto err_rx_clear;
+
+        sis190_mark_as_last_descriptor(tp->RxDescRing + NUM_RX_DESC - 1);
+
+        return 0;
+
+err_rx_clear:
+        sis190_rx_clear(tp);
+        return -ENOMEM;
+}
+
+static void sis190_set_rx_mode(struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+        void __iomem *ioaddr = tp->mmio_addr;
+        unsigned long flags;
+        u32 mc_filter[2];       /* Multicast hash filter */
+        u16 rx_mode;
+
+        if (dev->flags & IFF_PROMISC) {
+                /* Unconditionally log net taps. */
+                net_drv(tp, KERN_NOTICE "%s: Promiscuous mode enabled.\n",
+                        dev->name);
+                rx_mode =
+                        AcceptBroadcast | AcceptMulticast | AcceptMyPhys |
+                        AcceptAllPhys;
+                mc_filter[1] = mc_filter[0] = 0xffffffff;
+        } else if ((dev->mc_count > multicast_filter_limit) ||
+                   (dev->flags & IFF_ALLMULTI)) {
+                /* Too many to filter perfectly -- accept all multicasts. */
+                rx_mode = AcceptBroadcast | AcceptMulticast | AcceptMyPhys;
+                mc_filter[1] = mc_filter[0] = 0xffffffff;
+        } else {
+                struct dev_mc_list *mclist;
+                unsigned int i;
+
+                rx_mode = AcceptBroadcast | AcceptMyPhys;
+                mc_filter[1] = mc_filter[0] = 0;
+                for (i = 0, mclist = dev->mc_list; mclist && i < dev->mc_count;
+                     i++, mclist = mclist->next) {
+                        int bit_nr =
+                                ether_crc(ETH_ALEN, mclist->dmi_addr) >> 26;
+                        mc_filter[bit_nr >> 5] |= 1 << (bit_nr & 31);
+                        rx_mode |= AcceptMulticast;
+                }
+        }
+
+        spin_lock_irqsave(&tp->lock, flags);
+
+        SIS_W16(RxMacControl, rx_mode | 0x2);
+        SIS_W32(RxHashTable, mc_filter[0]);
+        SIS_W32(RxHashTable + 4, mc_filter[1]);
+
+        spin_unlock_irqrestore(&tp->lock, flags);
+}
+
+static void sis190_soft_reset(void __iomem *ioaddr)
+{
+        SIS_W32(IntrControl, 0x8000);
+        SIS_PCI_COMMIT();
+        msleep(1);
+        SIS_W32(IntrControl, 0x0);
+        sis190_asic_down(ioaddr);
+        msleep(1);
+}
+
+static void sis190_hw_start(struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+        void __iomem *ioaddr = tp->mmio_addr;
+
+        sis190_soft_reset(ioaddr);
+
+        SIS_W32(TxDescStartAddr, tp->tx_dma);
+        SIS_W32(RxDescStartAddr, tp->rx_dma);
+
+        SIS_W32(IntrStatus, 0xffffffff);
+        SIS_W32(IntrMask, 0x0);
+        /*
+         * Default is 100Mbps.
+         * A bit strange: 100Mbps is 0x1801 elsewhere -- FR 2005/06/09
+         */
+        SIS_W16(StationControl, 0x1901);
+        SIS_W32(GMIIControl, 0x0);
+        SIS_W32(TxMacControl, 0x60);
+        SIS_W16(RxMacControl, 0x02);
+        SIS_W32(RxHashTable, 0x0);
+        SIS_W32(0x6c, 0x0);
+        SIS_W32(RxWolCtrl, 0x0);
+        SIS_W32(RxWolData, 0x0);
+
+        SIS_PCI_COMMIT();
+
+        sis190_set_rx_mode(dev);
+
+        /* Enable all known interrupts by setting the interrupt mask. */
+        SIS_W32(IntrMask, sis190_intr_mask);
+
+        SIS_W32(TxControl, 0x1a00 | CmdTxEnb);
+        SIS_W32(RxControl, 0x1a1d);
+
+        netif_start_queue(dev);
+}
+
+static void sis190_phy_task(void * data)
+{
+        struct net_device *dev = data;
+        struct sis190_private *tp = netdev_priv(dev);
+        void __iomem *ioaddr = tp->mmio_addr;
+        int phy_id = tp->mii_if.phy_id;
+        u16 val;
+
+        rtnl_lock();
+
+        val = mdio_read(ioaddr, phy_id, MII_BMCR);
+        if (val & BMCR_RESET) {
+                // FIXME: needlessly high ?  -- FR 02/07/2005
+                mod_timer(&tp->timer, jiffies + HZ/10);
+        } else if (!(mdio_read_latched(ioaddr, phy_id, MII_BMSR) &
+                     BMSR_ANEGCOMPLETE)) {
+                net_link(tp, KERN_WARNING "%s: PHY reset until link up.\n",
+                         dev->name);
+                mdio_write(ioaddr, phy_id, MII_BMCR, val | BMCR_RESET);
+                mod_timer(&tp->timer, jiffies + SIS190_PHY_TIMEOUT);
+        } else {
+                /* Rejoice ! */
+                struct {
+                        int val;
+                        const char *msg;
+                        u16 ctl;
+                } reg31[] = {
+                        { LPA_1000XFULL | LPA_SLCT,
+                                "1000 Mbps Full Duplex",
+                                0x01 | _1000bpsF },
+                        { LPA_1000XHALF | LPA_SLCT,
+                                "1000 Mbps Half Duplex",
+                                0x01 | _1000bpsH },
+                        { LPA_100FULL,
+                                "100 Mbps Full Duplex",
+                                0x01 | _100bpsF },
+                        { LPA_100HALF,
+                                "100 Mbps Half Duplex",
+                                0x01 | _100bpsH },
+                        { LPA_10FULL,
+                                "10 Mbps Full Duplex",
+                                0x01 | _10bpsF },
+                        { LPA_10HALF,
+                                "10 Mbps Half Duplex",
+                                0x01 | _10bpsH },
+                        { 0, "unknown", 0x0000 }
+                }, *p;
+                u16 adv;
+
+                val = mdio_read(ioaddr, phy_id, 0x1f);
+                net_link(tp, KERN_INFO "%s: mii ext = %04x.\n", dev->name, val);
+
+                val = mdio_read(ioaddr, phy_id, MII_LPA);
+                adv = mdio_read(ioaddr, phy_id, MII_ADVERTISE);
+                net_link(tp, KERN_INFO "%s: mii lpa = %04x adv = %04x.\n",
+                         dev->name, val, adv);
+
+                val &= adv;
+
+                for (p = reg31; p->ctl; p++) {
+                        if ((val & p->val) == p->val)
+                                break;
+                }
+                if (p->ctl)
+                        SIS_W16(StationControl, p->ctl);
+                net_link(tp, KERN_INFO "%s: link on %s mode.\n", dev->name,
+                         p->msg);
+                netif_carrier_on(dev);
+        }
+
+        rtnl_unlock();
+}
+
+static void sis190_phy_timer(unsigned long __opaque)
+{
+        struct net_device *dev = (struct net_device *)__opaque;
+        struct sis190_private *tp = netdev_priv(dev);
+
+        if (likely(netif_running(dev)))
+                schedule_work(&tp->phy_task);
+}
+
+static inline void sis190_delete_timer(struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+
+        del_timer_sync(&tp->timer);
+}
+
+static inline void sis190_request_timer(struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+        struct timer_list *timer = &tp->timer;
+
+        init_timer(timer);
+        timer->expires = jiffies + SIS190_PHY_TIMEOUT;
+        timer->data = (unsigned long)dev;
+        timer->function = sis190_phy_timer;
+        add_timer(timer);
+}
+
+static void sis190_set_rxbufsize(struct sis190_private *tp,
+                                 struct net_device *dev)
+{
+        unsigned int mtu = dev->mtu;
+
+        tp->rx_buf_sz = (mtu > RX_BUF_SIZE) ? mtu + ETH_HLEN + 8 : RX_BUF_SIZE;
+        /* RxDesc->size has a licence to kill the lower bits */
+        if (tp->rx_buf_sz & 0x07) {
+                tp->rx_buf_sz += 8;
+                tp->rx_buf_sz &= RX_BUF_MASK;
+        }
+}
+
+static int sis190_open(struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+        struct pci_dev *pdev = tp->pci_dev;
+        int rc = -ENOMEM;
+
+        sis190_set_rxbufsize(tp, dev);
+
+        /*
+         * Rx and Tx descriptors need 256 bytes alignment.
+         * pci_alloc_consistent() guarantees a stronger alignment.
+         */
+        tp->TxDescRing = pci_alloc_consistent(pdev, TX_RING_BYTES, &tp->tx_dma);
+        if (!tp->TxDescRing)
+                goto out;
+
+        tp->RxDescRing = pci_alloc_consistent(pdev, RX_RING_BYTES, &tp->rx_dma);
+        if (!tp->RxDescRing)
+                goto err_free_tx_0;
+
+        rc = sis190_init_ring(dev);
+        if (rc < 0)
+                goto err_free_rx_1;
+
+        INIT_WORK(&tp->phy_task, sis190_phy_task, dev);
+
+        sis190_request_timer(dev);
+
+        rc = request_irq(dev->irq, sis190_interrupt, SA_SHIRQ, dev->name, dev);
+        if (rc < 0)
+                goto err_release_timer_2;
+
+        sis190_hw_start(dev);
+out:
+        return rc;
+
+err_release_timer_2:
+        sis190_delete_timer(dev);
+        sis190_rx_clear(tp);
+err_free_rx_1:
+        pci_free_consistent(tp->pci_dev, RX_RING_BYTES, tp->RxDescRing,
+                tp->rx_dma);
+err_free_tx_0:
+        pci_free_consistent(tp->pci_dev, TX_RING_BYTES, tp->TxDescRing,
+                tp->tx_dma);
+        goto out;
+}
+
+static void sis190_tx_clear(struct sis190_private *tp)
+{
+        unsigned int i;
+
+        for (i = 0; i < NUM_TX_DESC; i++) {
+                struct sk_buff *skb = tp->Tx_skbuff[i];
+
+                if (!skb)
+                        continue;
+
+                sis190_unmap_tx_skb(tp->pci_dev, skb, tp->TxDescRing + i);
+                tp->Tx_skbuff[i] = NULL;
+                dev_kfree_skb(skb);
+
+                tp->stats.tx_dropped++;
+        }
+        tp->cur_tx = tp->dirty_tx = 0;
+}
+
+static void sis190_down(struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+        void __iomem *ioaddr = tp->mmio_addr;
+        unsigned int poll_locked = 0;
+
+        sis190_delete_timer(dev);
+
+        netif_stop_queue(dev);
+
+        flush_scheduled_work();
+
+        do {
+                spin_lock_irq(&tp->lock);
+
+                sis190_asic_down(ioaddr);
+
+                spin_unlock_irq(&tp->lock);
+
+                synchronize_irq(dev->irq);
+
+                if (!poll_locked) {
+                        netif_poll_disable(dev);
+                        poll_locked++;
+                }
+
+                synchronize_sched();
+
+        } while (SIS_R32(IntrMask));
+
+        sis190_tx_clear(tp);
+        sis190_rx_clear(tp);
+}
+
+static int sis190_close(struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+        struct pci_dev *pdev = tp->pci_dev;
+
+        sis190_down(dev);
+
+        free_irq(dev->irq, dev);
+
+        netif_poll_enable(dev);
+
+        pci_free_consistent(pdev, TX_RING_BYTES, tp->TxDescRing, tp->tx_dma);
+        pci_free_consistent(pdev, RX_RING_BYTES, tp->RxDescRing, tp->rx_dma);
+
+        tp->TxDescRing = NULL;
+        tp->RxDescRing = NULL;
+
+        return 0;
+}
+
+static int sis190_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+        void __iomem *ioaddr = tp->mmio_addr;
+        u32 len, entry, dirty_tx;
+        struct TxDesc *desc;
+        dma_addr_t mapping;
+
+        if (unlikely(skb->len < ETH_ZLEN)) {
+                skb = skb_padto(skb, ETH_ZLEN);
+                if (!skb) {
+                        tp->stats.tx_dropped++;
+                        goto out;
+                }
+                len = ETH_ZLEN;
+        } else {
+                len = skb->len;
+        }
+
+        entry = tp->cur_tx % NUM_TX_DESC;
+        desc = tp->TxDescRing + entry;
+
+        if (unlikely(le32_to_cpu(desc->status) & OWNbit)) {
+                netif_stop_queue(dev);
+                net_tx_err(tp, KERN_ERR PFX
+                           "%s: BUG! Tx Ring full when queue awake!\n",
+                           dev->name);
+                return NETDEV_TX_BUSY;
+        }
+
+        mapping = pci_map_single(tp->pci_dev, skb->data, len, PCI_DMA_TODEVICE);
+
+        tp->Tx_skbuff[entry] = skb;
+
+        desc->PSize = cpu_to_le32(len);
+        desc->addr = cpu_to_le32(mapping);
+
+        desc->size = cpu_to_le32(len);
+        if (entry == (NUM_TX_DESC - 1))
+                desc->size |= cpu_to_le32(RingEnd);
+
+        wmb();
+
+        desc->status = cpu_to_le32(OWNbit | INTbit | DEFbit | CRCbit | PADbit);
+
+        tp->cur_tx++;
+
+        smp_wmb();
+
+        SIS_W32(TxControl, 0x1a00 | CmdReset | CmdTxEnb);
+
+        dev->trans_start = jiffies;
+
+        dirty_tx = tp->dirty_tx;
+        if ((tp->cur_tx - NUM_TX_DESC) == dirty_tx) {
+                netif_stop_queue(dev);
+                smp_rmb();
+                if (dirty_tx != tp->dirty_tx)
+                        netif_wake_queue(dev);
+        }
+out:
+        return NETDEV_TX_OK;
+}
+
+static struct net_device_stats *sis190_get_stats(struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+
+        return &tp->stats;
+}
+
+static void sis190_free_phy(struct list_head *first_phy)
+{
+        struct sis190_phy *cur, *next;
+
+        list_for_each_entry_safe(cur, next, first_phy, list) {
+                kfree(cur);
+        }
+}
+
+/**
+ *      sis190_default_phy - Select default PHY for sis190 mac.
+ *      @dev: the net device to probe for
+ *
+ *      Select first detected PHY with link as default.
+ *      If no one is link on, select PHY whose types is HOME as default.
+ *      If HOME doesn't exist, select LAN.
+ */
+static u16 sis190_default_phy(struct net_device *dev)
+{
+        struct sis190_phy *phy, *phy_home, *phy_default, *phy_lan;
+        struct sis190_private *tp = netdev_priv(dev);
+        struct mii_if_info *mii_if = &tp->mii_if;
+        void __iomem *ioaddr = tp->mmio_addr;
+        u16 status;
+
+        phy_home = phy_default = phy_lan = NULL;
+
+        list_for_each_entry(phy, &tp->first_phy, list) {
+                status = mdio_read_latched(ioaddr, phy->phy_id, MII_BMSR);
+
+                // Link ON & Not select default PHY & not ghost PHY.
+                if ((status & BMSR_LSTATUS) &&
+                    !phy_default &&
+                    (phy->type != UNKNOWN)) {
+                        phy_default = phy;
+                } else {
+                        status = mdio_read(ioaddr, phy->phy_id, MII_BMCR);
+                        mdio_write(ioaddr, phy->phy_id, MII_BMCR,
+                                   status | BMCR_ANENABLE | BMCR_ISOLATE);
+                        if (phy->type == HOME)
+                                phy_home = phy;
+                        else if (phy->type == LAN)
+                                phy_lan = phy;
+                }
+        }
+
+        if (!phy_default) {
+                if (phy_home)
+                        phy_default = phy_home;
+                else if (phy_lan)
+                        phy_default = phy_lan;
+                else
+                        phy_default = list_entry(&tp->first_phy,
+                                                 struct sis190_phy, list);
+        }
+
+        if (mii_if->phy_id != phy_default->phy_id) {
+                mii_if->phy_id = phy_default->phy_id;
+                net_probe(tp, KERN_INFO
+                       "%s: Using transceiver at address %d as default.\n",
+                       pci_name(tp->pci_dev), mii_if->phy_id);
+        }
+
+        status = mdio_read(ioaddr, mii_if->phy_id, MII_BMCR);
+        status &= (~BMCR_ISOLATE);
+
+        mdio_write(ioaddr, mii_if->phy_id, MII_BMCR, status);
+        status = mdio_read_latched(ioaddr, mii_if->phy_id, MII_BMSR);
+
+        return status;
+}
+
+static void sis190_init_phy(struct net_device *dev, struct sis190_private *tp,
+                            struct sis190_phy *phy, unsigned int phy_id,
+                            u16 mii_status)
+{
+        void __iomem *ioaddr = tp->mmio_addr;
+        struct mii_chip_info *p;
+
+        INIT_LIST_HEAD(&phy->list);
+        phy->status = mii_status;
+        phy->phy_id = phy_id;
+
+        phy->id[0] = mdio_read(ioaddr, phy_id, MII_PHYSID1);
+        phy->id[1] = mdio_read(ioaddr, phy_id, MII_PHYSID2);
+
+        for (p = mii_chip_table; p->type; p++) {
+                if ((p->id[0] == phy->id[0]) &&
+                    (p->id[1] == (phy->id[1] & 0xfff0))) {
+                        break;
+                }
+        }
+
+        if (p->id[1]) {
+                phy->type = (p->type == MIX) ?
+                        ((mii_status & (BMSR_100FULL | BMSR_100HALF)) ?
+                                LAN : HOME) : p->type;
+        } else
+                phy->type = UNKNOWN;
+
+        net_probe(tp, KERN_INFO "%s: %s transceiver at address %d.\n",
+                  pci_name(tp->pci_dev),
+                  (phy->type == UNKNOWN) ? "Unknown PHY" : p->name, phy_id);
+}
+
+/**
+ *      sis190_mii_probe - Probe MII PHY for sis190
+ *      @dev: the net device to probe for
+ *
+ *      Search for total of 32 possible mii phy addresses.
+ *      Identify and set current phy if found one,
+ *      return error if it failed to found.
+ */
+static int __devinit sis190_mii_probe(struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+        struct mii_if_info *mii_if = &tp->mii_if;
+        void __iomem *ioaddr = tp->mmio_addr;
+        int phy_id;
+        int rc = 0;
+
+        INIT_LIST_HEAD(&tp->first_phy);
+
+        for (phy_id = 0; phy_id < PHY_MAX_ADDR; phy_id++) {
+                struct sis190_phy *phy;
+                u16 status;
+
+                status = mdio_read_latched(ioaddr, phy_id, MII_BMSR);
+
+                // Try next mii if the current one is not accessible.
+                if (status == 0xffff || status == 0x0000)
+                        continue;
+
+                phy = kmalloc(sizeof(*phy), GFP_KERNEL);
+                if (!phy) {
+                        sis190_free_phy(&tp->first_phy);
+                        rc = -ENOMEM;
+                        goto out;
+                }
+
+                sis190_init_phy(dev, tp, phy, phy_id, status);
+
+                list_add(&tp->first_phy, &phy->list);
+        }
+
+        if (list_empty(&tp->first_phy)) {
+                net_probe(tp, KERN_INFO "%s: No MII transceivers found!\n",
+                          pci_name(tp->pci_dev));
+                rc = -EIO;
+                goto out;
+        }
+
+        /* Select default PHY for mac */
+        sis190_default_phy(dev);
+
+        mii_if->dev = dev;
+        mii_if->mdio_read = __mdio_read;
+        mii_if->mdio_write = __mdio_write;
+        mii_if->phy_id_mask = PHY_ID_ANY;
+        mii_if->reg_num_mask = MII_REG_ANY;
+out:
+        return rc;
+}
+
+static void __devexit sis190_mii_remove(struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+
+        sis190_free_phy(&tp->first_phy);
+}
+
+static void sis190_release_board(struct pci_dev *pdev)
+{
+        struct net_device *dev = pci_get_drvdata(pdev);
+        struct sis190_private *tp = netdev_priv(dev);
+
+        iounmap(tp->mmio_addr);
+        pci_release_regions(pdev);
+        pci_disable_device(pdev);
+        free_netdev(dev);
+}
+
+static struct net_device * __devinit sis190_init_board(struct pci_dev *pdev)
+{
+        struct sis190_private *tp;
+        struct net_device *dev;
+        void __iomem *ioaddr;
+        int rc;
+
+        dev = alloc_etherdev(sizeof(*tp));
+        if (!dev) {
+                net_drv(&debug, KERN_ERR PFX "unable to alloc new ethernet\n");
+                rc = -ENOMEM;
+                goto err_out_0;
+        }
+
+        SET_MODULE_OWNER(dev);
+        SET_NETDEV_DEV(dev, &pdev->dev);
+
+        tp = netdev_priv(dev);
+        tp->msg_enable = netif_msg_init(debug.msg_enable, SIS190_MSG_DEFAULT);
+
+        rc = pci_enable_device(pdev);
+        if (rc < 0) {
+                net_probe(tp, KERN_ERR "%s: enable failure\n", pci_name(pdev));
+                goto err_free_dev_1;
+        }
+
+        rc = -ENODEV;
+
+        if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM)) {
+                net_probe(tp, KERN_ERR "%s: region #0 is no MMIO resource.\n",
+                          pci_name(pdev));
+                goto err_pci_disable_2;
+        }
+        if (pci_resource_len(pdev, 0) < SIS190_REGS_SIZE) {
+                net_probe(tp, KERN_ERR "%s: invalid PCI region size(s).\n",
+                          pci_name(pdev));
+                goto err_pci_disable_2;
+        }
+
+        rc = pci_request_regions(pdev, DRV_NAME);
+        if (rc < 0) {
+                net_probe(tp, KERN_ERR PFX "%s: could not request regions.\n",
+                          pci_name(pdev));
+                goto err_pci_disable_2;
+        }
+
+        rc = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
+        if (rc < 0) {
+                net_probe(tp, KERN_ERR "%s: DMA configuration failed.\n",
+                          pci_name(pdev));
+                goto err_free_res_3;
+        }
+
+        pci_set_master(pdev);
+
+        ioaddr = ioremap(pci_resource_start(pdev, 0), SIS190_REGS_SIZE);
+        if (!ioaddr) {
+                net_probe(tp, KERN_ERR "%s: cannot remap MMIO, aborting\n",
+                          pci_name(pdev));
+                rc = -EIO;
+                goto err_free_res_3;
+        }
+
+        tp->pci_dev = pdev;
+        tp->mmio_addr = ioaddr;
+
+        sis190_irq_mask_and_ack(ioaddr);
+
+        sis190_soft_reset(ioaddr);
+out:
+        return dev;
+
+err_free_res_3:
+        pci_release_regions(pdev);
+err_pci_disable_2:
+        pci_disable_device(pdev);
+err_free_dev_1:
+        free_netdev(dev);
+err_out_0:
+        dev = ERR_PTR(rc);
+        goto out;
+}
+
+static void sis190_tx_timeout(struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+        void __iomem *ioaddr = tp->mmio_addr;
+        u8 tmp8;
+
+        /* Disable Tx, if not already */
+        tmp8 = SIS_R8(TxControl);
+        if (tmp8 & CmdTxEnb)
+                SIS_W8(TxControl, tmp8 & ~CmdTxEnb);
+
+
+        net_tx_err(tp, KERN_INFO "%s: Transmit timeout, status %08x %08x.\n",
+                   dev->name, SIS_R32(TxControl), SIS_R32(TxSts));
+
+        /* Disable interrupts by clearing the interrupt mask. */
+        SIS_W32(IntrMask, 0x0000);
+
+        /* Stop a shared interrupt from scavenging while we are. */
+        spin_lock_irq(&tp->lock);
+        sis190_tx_clear(tp);
+        spin_unlock_irq(&tp->lock);
+
+        /* ...and finally, reset everything. */
+        sis190_hw_start(dev);
+
+        netif_wake_queue(dev);
+}
+
+static int __devinit sis190_get_mac_addr_from_eeprom(struct pci_dev *pdev,
+                                                     struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+        void __iomem *ioaddr = tp->mmio_addr;
+        u16 sig;
+        int i;
+
+        net_probe(tp, KERN_INFO "%s: Read MAC address from EEPROM\n",
+                  pci_name(pdev));
+
+        /* Check to see if there is a sane EEPROM */
+        sig = (u16) sis190_read_eeprom(ioaddr, EEPROMSignature);
+
+        if ((sig == 0xffff) || (sig == 0x0000)) {
+                net_probe(tp, KERN_INFO "%s: Error EEPROM read %x.\n",
+                          pci_name(pdev), sig);
+                return -EIO;
+        }
+
+        /* Get MAC address from EEPROM */
+        for (i = 0; i < MAC_ADDR_LEN / 2; i++) {
+                __le16 w = sis190_read_eeprom(ioaddr, EEPROMMACAddr + i);
+
+                ((u16 *)dev->dev_addr)[0] = le16_to_cpu(w);
+        }
+
+        return 0;
+}
+
+/**
+ *      sis190_get_mac_addr_from_apc - Get MAC address for SiS965 model
+ *      @pdev: PCI device
+ *      @dev:  network device to get address for
+ *
+ *      SiS965 model, use APC CMOS RAM to store MAC address.
+ *      APC CMOS RAM is accessed through ISA bridge.
+ *      MAC address is read into @net_dev->dev_addr.
+ */
+static int __devinit sis190_get_mac_addr_from_apc(struct pci_dev *pdev,
+                                                  struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+        struct pci_dev *isa_bridge;
+        u8 reg, tmp8;
+        int i;
+
+        net_probe(tp, KERN_INFO "%s: Read MAC address from APC.\n",
+                  pci_name(pdev));
+
+        isa_bridge = pci_get_device(PCI_VENDOR_ID_SI, 0x0965, NULL);
+        if (!isa_bridge) {
+                net_probe(tp, KERN_INFO "%s: Can not find ISA bridge.\n",
+                          pci_name(pdev));
+                return -EIO;
+        }
+
+        /* Enable port 78h & 79h to access APC Registers. */
+        pci_read_config_byte(isa_bridge, 0x48, &tmp8);
+        reg = (tmp8 & ~0x02);
+        pci_write_config_byte(isa_bridge, 0x48, reg);
+        udelay(50);
+        pci_read_config_byte(isa_bridge, 0x48, &reg);
+
+        for (i = 0; i < MAC_ADDR_LEN; i++) {
+                outb(0x9 + i, 0x78);
+                dev->dev_addr[i] = inb(0x79);
+        }
+
+        outb(0x12, 0x78);
+        reg = inb(0x79);
+
+        /* Restore the value to ISA Bridge */
+        pci_write_config_byte(isa_bridge, 0x48, tmp8);
+        pci_dev_put(isa_bridge);
+
+        return 0;
+}
+
+/**
+ *      sis190_init_rxfilter - Initialize the Rx filter
+ *      @dev: network device to initialize
+ *
+ *      Set receive filter address to our MAC address
+ *      and enable packet filtering.
+ */
+static inline void sis190_init_rxfilter(struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+        void __iomem *ioaddr = tp->mmio_addr;
+        u16 ctl;
+        int i;
+
+        ctl = SIS_R16(RxMacControl);
+        /*
+         * Disable packet filtering before setting filter.
+         * Note: SiS's driver writes 32 bits but RxMacControl is 16 bits
+         * only and followed by RxMacAddr (6 bytes). Strange. -- FR
+         */
+        SIS_W16(RxMacControl, ctl & ~0x0f00);
+
+        for (i = 0; i < MAC_ADDR_LEN; i++)
+                SIS_W8(RxMacAddr + i, dev->dev_addr[i]);
+
+        SIS_W16(RxMacControl, ctl);
+        SIS_PCI_COMMIT();
+}
+
+static int sis190_get_mac_addr(struct pci_dev *pdev, struct net_device *dev)
+{
+        u8 from;
+
+        pci_read_config_byte(pdev, 0x73, &from);
+
+        return (from & 0x00000001) ?
+                sis190_get_mac_addr_from_apc(pdev, dev) :
+                sis190_get_mac_addr_from_eeprom(pdev, dev);
+}
+
+static void sis190_set_speed_auto(struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+        void __iomem *ioaddr = tp->mmio_addr;
+        int phy_id = tp->mii_if.phy_id;
+        int val;
+
+        net_link(tp, KERN_INFO "%s: Enabling Auto-negotiation.\n", dev->name);
+
+        val = mdio_read(ioaddr, phy_id, MII_ADVERTISE);
+
+        // Enable 10/100 Full/Half Mode, leave MII_ADVERTISE bit4:0
+        // unchanged.
+        mdio_write(ioaddr, phy_id, MII_ADVERTISE, (val & ADVERTISE_SLCT) |
+                   ADVERTISE_100FULL | ADVERTISE_10FULL |
+                   ADVERTISE_100HALF | ADVERTISE_10HALF);
+
+        // Enable 1000 Full Mode.
+        mdio_write(ioaddr, phy_id, MII_CTRL1000, ADVERTISE_1000FULL);
+
+        // Enable auto-negotiation and restart auto-negotiation.
+        mdio_write(ioaddr, phy_id, MII_BMCR,
+                   BMCR_ANENABLE | BMCR_ANRESTART | BMCR_RESET);
+}
+
+static int sis190_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+
+        return mii_ethtool_gset(&tp->mii_if, cmd);
+}
+
+static int sis190_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+
+        return mii_ethtool_sset(&tp->mii_if, cmd);
+}
+
+static void sis190_get_drvinfo(struct net_device *dev,
+                               struct ethtool_drvinfo *info)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+
+        strcpy(info->driver, DRV_NAME);
+        strcpy(info->version, DRV_VERSION);
+        strcpy(info->bus_info, pci_name(tp->pci_dev));
+}
+
+static int sis190_get_regs_len(struct net_device *dev)
+{
+        return SIS190_REGS_SIZE;
+}
+
+static void sis190_get_regs(struct net_device *dev, struct ethtool_regs *regs,
+                            void *p)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+        unsigned long flags;
+
+        if (regs->len > SIS190_REGS_SIZE)
+                regs->len = SIS190_REGS_SIZE;
+
+        spin_lock_irqsave(&tp->lock, flags);
+        memcpy_fromio(p, tp->mmio_addr, regs->len);
+        spin_unlock_irqrestore(&tp->lock, flags);
+}
+
+static int sis190_nway_reset(struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+
+        return mii_nway_restart(&tp->mii_if);
+}
+
+static u32 sis190_get_msglevel(struct net_device *dev)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+
+        return tp->msg_enable;
+}
+
+static void sis190_set_msglevel(struct net_device *dev, u32 value)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+
+        tp->msg_enable = value;
+}
+
+static struct ethtool_ops sis190_ethtool_ops = {
+        .get_settings   = sis190_get_settings,
+        .set_settings   = sis190_set_settings,
+        .get_drvinfo    = sis190_get_drvinfo,
+        .get_regs_len   = sis190_get_regs_len,
+        .get_regs       = sis190_get_regs,
+        .get_link       = ethtool_op_get_link,
+        .get_msglevel   = sis190_get_msglevel,
+        .set_msglevel   = sis190_set_msglevel,
+        .nway_reset     = sis190_nway_reset,
+};
+
+static int sis190_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+{
+        struct sis190_private *tp = netdev_priv(dev);
+
+        return !netif_running(dev) ? -EINVAL :
+                generic_mii_ioctl(&tp->mii_if, if_mii(ifr), cmd, NULL);
+}
+
+static int __devinit sis190_init_one(struct pci_dev *pdev,
+                                     const struct pci_device_id *ent)
+{
+        static int printed_version = 0;
+        struct sis190_private *tp;
+        struct net_device *dev;
+        void __iomem *ioaddr;
+        int rc;
+
+        if (!printed_version) {
+                net_drv(&debug, KERN_INFO SIS190_DRIVER_NAME " loaded.\n");
+                printed_version = 1;
+        }
+
+        dev = sis190_init_board(pdev);
+        if (IS_ERR(dev)) {
+                rc = PTR_ERR(dev);
+                goto out;
+        }
+
+        tp = netdev_priv(dev);
+        ioaddr = tp->mmio_addr;
+
+        rc = sis190_get_mac_addr(pdev, dev);
+        if (rc < 0)
+                goto err_release_board;
+
+        sis190_init_rxfilter(dev);
+
+        INIT_WORK(&tp->phy_task, sis190_phy_task, dev);
+
+        dev->open = sis190_open;
+        dev->stop = sis190_close;
+        dev->do_ioctl = sis190_ioctl;
+        dev->get_stats = sis190_get_stats;
+        dev->tx_timeout = sis190_tx_timeout;
+        dev->watchdog_timeo = SIS190_TX_TIMEOUT;
+        dev->hard_start_xmit = sis190_start_xmit;
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        dev->poll_controller = sis190_netpoll;
+#endif
+        dev->set_multicast_list = sis190_set_rx_mode;
+        SET_ETHTOOL_OPS(dev, &sis190_ethtool_ops);
+        dev->irq = pdev->irq;
+        dev->base_addr = (unsigned long) 0xdead;
+
+        spin_lock_init(&tp->lock);
+
+        rc = sis190_mii_probe(dev);
+        if (rc < 0)
+                goto err_release_board;
+
+        rc = register_netdev(dev);
+        if (rc < 0)
+                goto err_remove_mii;
+
+        pci_set_drvdata(pdev, dev);
+
+        net_probe(tp, KERN_INFO "%s: %s at %p (IRQ: %d), "
+               "%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
+               pci_name(pdev), sis_chip_info[ent->driver_data].name,
+               ioaddr, dev->irq,
+               dev->dev_addr[0], dev->dev_addr[1],
+               dev->dev_addr[2], dev->dev_addr[3],
+               dev->dev_addr[4], dev->dev_addr[5]);
+
+        netif_carrier_off(dev);
+
+        sis190_set_speed_auto(dev);
+out:
+        return rc;
+
+err_remove_mii:
+        sis190_mii_remove(dev);
+err_release_board:
+        sis190_release_board(pdev);
+        goto out;
+}
+
+static void __devexit sis190_remove_one(struct pci_dev *pdev)
+{
+        struct net_device *dev = pci_get_drvdata(pdev);
+
+        sis190_mii_remove(dev);
+        unregister_netdev(dev);
+        sis190_release_board(pdev);
+        pci_set_drvdata(pdev, NULL);
+}
+
+static struct pci_driver sis190_pci_driver = {
+        .name           = DRV_NAME,
+        .id_table       = sis190_pci_tbl,
+        .probe          = sis190_init_one,
+        .remove         = __devexit_p(sis190_remove_one),
+};
+
+static int __init sis190_init_module(void)
+{
+        return pci_module_init(&sis190_pci_driver);
+}
+
+static void __exit sis190_cleanup_module(void)
+{
+        pci_unregister_driver(&sis190_pci_driver);
+}
+
+module_init(sis190_init_module);
+module_exit(sis190_cleanup_module);
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index f15739481d62..d7c98515fdfd 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -42,7 +42,7 @@
 #include "skge.h"
 
 #define DRV_NAME                "skge"
-#define DRV_VERSION             "0.8"
+#define DRV_VERSION             "0.9"
 #define PFX                     DRV_NAME " "
 
 #define DEFAULT_TX_RING_SIZE    128
@@ -79,8 +79,8 @@ static const struct pci_device_id skge_id_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4320) },
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x5005) }, /* Belkin */
         { PCI_DEVICE(PCI_VENDOR_ID_CNET, PCI_DEVICE_ID_CNET_GIGACARD) },
-        { PCI_DEVICE(PCI_VENDOR_ID_LINKSYS, PCI_DEVICE_ID_LINKSYS_EG1032) },
         { PCI_DEVICE(PCI_VENDOR_ID_LINKSYS, PCI_DEVICE_ID_LINKSYS_EG1064) },
+        { PCI_VENDOR_ID_LINKSYS, 0x1032, PCI_ANY_ID, 0x0015, },
         { 0 }
 };
 MODULE_DEVICE_TABLE(pci, skge_id_table);
@@ -189,7 +189,7 @@ static u32 skge_supported_modes(const struct skge_hw *hw)
 {
         u32 supported;
 
-        if (iscopper(hw)) {
+        if (hw->copper) {
                 supported = SUPPORTED_10baseT_Half
                         | SUPPORTED_10baseT_Full
                         | SUPPORTED_100baseT_Half
@@ -222,7 +222,7 @@ static int skge_get_settings(struct net_device *dev,
         ecmd->transceiver = XCVR_INTERNAL;
         ecmd->supported = skge_supported_modes(hw);
 
-        if (iscopper(hw)) {
+        if (hw->copper) {
                 ecmd->port = PORT_TP;
                 ecmd->phy_address = hw->phy_addr;
         } else
@@ -876,6 +876,9 @@ static int skge_rx_fill(struct skge_port *skge)
 
 static void skge_link_up(struct skge_port *skge)
 {
+        skge_write8(skge->hw, SK_REG(skge->port, LNK_LED_REG), 
+                    LED_BLK_OFF|LED_SYNC_OFF|LED_ON);
+
         netif_carrier_on(skge->netdev);
         if (skge->tx_avail > MAX_SKB_FRAGS + 1)
                 netif_wake_queue(skge->netdev);
@@ -894,6 +897,7 @@ static void skge_link_up(struct skge_port *skge)
 
 static void skge_link_down(struct skge_port *skge)
 {
+        skge_write8(skge->hw, SK_REG(skge->port, LNK_LED_REG), LED_OFF);
         netif_carrier_off(skge->netdev);
         netif_stop_queue(skge->netdev);
 
@@ -1599,7 +1603,7 @@ static void yukon_init(struct skge_hw *hw, int port)
         adv = PHY_AN_CSMA;
 
         if (skge->autoneg == AUTONEG_ENABLE) {
-                if (iscopper(hw)) {
+                if (hw->copper) {
                         if (skge->advertising & ADVERTISED_1000baseT_Full)
                                 ct1000 |= PHY_M_1000C_AFD;
                         if (skge->advertising & ADVERTISED_1000baseT_Half)
@@ -1691,7 +1695,7 @@ static void yukon_mac_init(struct skge_hw *hw, int port)
         /* Set hardware config mode */
         reg = GPC_INT_POL_HI | GPC_DIS_FC | GPC_DIS_SLEEP |
                 GPC_ENA_XC | GPC_ANEG_ADV_ALL_M | GPC_ENA_PAUSE;
-        reg |= iscopper(hw) ? GPC_HWCFG_GMII_COP : GPC_HWCFG_GMII_FIB;
+        reg |= hw->copper ? GPC_HWCFG_GMII_COP : GPC_HWCFG_GMII_FIB;
 
         /* Clear GMC reset */
         skge_write32(hw, SK_REG(port, GPHY_CTRL), reg | GPC_RST_SET);
@@ -1780,7 +1784,12 @@ static void yukon_mac_init(struct skge_hw *hw, int port)
                 reg &= ~GMF_RX_F_FL_ON;
         skge_write8(hw, SK_REG(port, RX_GMF_CTRL_T), GMF_RST_CLR);
         skge_write16(hw, SK_REG(port, RX_GMF_CTRL_T), reg);
-        skge_write16(hw, SK_REG(port, RX_GMF_FL_THR), RX_GMF_FL_THR_DEF);
+        /*
+         * because Pause Packet Truncation in GMAC is not working
+         * we have to increase the Flush Threshold to 64 bytes
+         * in order to flush pause packets in Rx FIFO on Yukon-1
+         */
+        skge_write16(hw, SK_REG(port, RX_GMF_FL_THR), RX_GMF_FL_THR_DEF+1);
 
         /* Configure Tx MAC FIFO */
         skge_write8(hw, SK_REG(port, TX_GMF_CTRL_T), GMF_RST_CLR);
@@ -2670,18 +2679,6 @@ static void skge_error_irq(struct skge_hw *hw)
                 /* Timestamp (unused) overflow */
                 if (hwstatus & IS_IRQ_TIST_OV)
                         skge_write8(hw, GMAC_TI_ST_CTRL, GMT_ST_CLR_IRQ);
-
-                if (hwstatus & IS_IRQ_SENSOR) {
-                        /* no sensors on 32-bit Yukon */
-                        if (!(skge_read16(hw, B0_CTST) & CS_BUS_SLOT_SZ)) {
-                                printk(KERN_ERR PFX "ignoring bogus sensor interrups\n");
-                                skge_write32(hw, B0_HWE_IMSK,
-                                             IS_ERR_MSK & ~IS_IRQ_SENSOR);
-                        } else
-                                printk(KERN_WARNING PFX "sensor interrupt\n");
-                }
-
-
         }
 
         if (hwstatus & IS_RAM_RD_PAR) {
@@ -2712,9 +2709,10 @@ static void skge_error_irq(struct skge_hw *hw)
 
                 skge_pci_clear(hw);
 
+                /* if error still set then just ignore it */
                 hwstatus = skge_read32(hw, B0_HWE_ISRC);
                 if (hwstatus & IS_IRQ_STAT) {
-                        printk(KERN_WARNING PFX "IRQ status %x: still set ignoring hardware errors\n",
+                        pr_debug("IRQ status %x: still set ignoring hardware errors\n",
                                hwstatus);
                         hw->intr_mask &= ~IS_HW_ERR;
                 }
@@ -2876,7 +2874,7 @@ static const char *skge_board_name(const struct skge_hw *hw)
 static int skge_reset(struct skge_hw *hw)
 {
         u16 ctst;
-        u8 t8, mac_cfg;
+        u8 t8, mac_cfg, pmd_type, phy_type;
         int i;
 
         ctst = skge_read16(hw, B0_CTST);
@@ -2895,18 +2893,19 @@ static int skge_reset(struct skge_hw *hw)
                      ctst & (CS_CLK_RUN_HOT|CS_CLK_RUN_RST|CS_CLK_RUN_ENA));
 
         hw->chip_id = skge_read8(hw, B2_CHIP_ID);
-        hw->phy_type = skge_read8(hw, B2_E_1) & 0xf;
-        hw->pmd_type = skge_read8(hw, B2_PMD_TYP);
+        phy_type = skge_read8(hw, B2_E_1) & 0xf;
+        pmd_type = skge_read8(hw, B2_PMD_TYP);
+        hw->copper = (pmd_type == 'T' || pmd_type == '1');
 
         switch (hw->chip_id) {
         case CHIP_ID_GENESIS:
-                switch (hw->phy_type) {
+                switch (phy_type) {
                 case SK_PHY_BCOM:
                         hw->phy_addr = PHY_ADDR_BCOM;
                         break;
                 default:
                         printk(KERN_ERR PFX "%s: unsupported phy type 0x%x\n",
-                               pci_name(hw->pdev), hw->phy_type);
+                               pci_name(hw->pdev), phy_type);
                         return -EOPNOTSUPP;
                 }
                 break;
@@ -2914,13 +2913,10 @@ static int skge_reset(struct skge_hw *hw)
         case CHIP_ID_YUKON:
         case CHIP_ID_YUKON_LITE:
         case CHIP_ID_YUKON_LP:
-                if (hw->phy_type < SK_PHY_MARV_COPPER && hw->pmd_type != 'S')
-                        hw->phy_type = SK_PHY_MARV_COPPER;
+                if (phy_type < SK_PHY_MARV_COPPER && pmd_type != 'S')
+                        hw->copper = 1;
 
                 hw->phy_addr = PHY_ADDR_MARV;
-                if (!iscopper(hw))
-                        hw->phy_type = SK_PHY_MARV_FIBER;
-
                 break;
 
         default:
@@ -2948,12 +2944,20 @@ static int skge_reset(struct skge_hw *hw)
         else
                 hw->ram_size = t8 * 4096;
 
+        hw->intr_mask = IS_HW_ERR | IS_EXT_REG;
         if (hw->chip_id == CHIP_ID_GENESIS)
                 genesis_init(hw);
         else {
                 /* switch power to VCC (WA for VAUX problem) */
                 skge_write8(hw, B0_POWER_CTRL,
                             PC_VAUX_ENA | PC_VCC_ENA | PC_VAUX_OFF | PC_VCC_ON);
+                /* avoid boards with stuck Hardware error bits */
+                if ((skge_read32(hw, B0_ISRC) & IS_HW_ERR) &&
+                    (skge_read32(hw, B0_HWE_ISRC) & IS_IRQ_SENSOR)) {
+                        printk(KERN_WARNING PFX "stuck hardware sensor bit\n");
+                        hw->intr_mask &= ~IS_HW_ERR;
+                }
+
                 for (i = 0; i < hw->ports; i++) {
                         skge_write16(hw, SK_REG(i, GMAC_LINK_CTRL), GMLC_RST_SET);
                         skge_write16(hw, SK_REG(i, GMAC_LINK_CTRL), GMLC_RST_CLR);
@@ -2994,7 +2998,6 @@ static int skge_reset(struct skge_hw *hw)
         skge_write32(hw, B2_IRQM_INI, skge_usecs2clk(hw, 100));
         skge_write32(hw, B2_IRQM_CTRL, TIM_START);
 
-        hw->intr_mask = IS_HW_ERR | IS_EXT_REG;
         skge_write32(hw, B0_IMSK, hw->intr_mask);
 
         if (hw->chip_id != CHIP_ID_GENESIS)
diff --git a/drivers/net/skge.h b/drivers/net/skge.h
index b432f1bb8168..f1680beb8e68 100644
--- a/drivers/net/skge.h
+++ b/drivers/net/skge.h
@@ -214,8 +214,6 @@ enum {
 
 /*      B2_IRQM_HWE_MSK 32 bit  IRQ Moderation HW Error Mask */
 enum {
-        IS_ERR_MSK      = 0x00003fff,/*                 All Error bits */
-
         IS_IRQ_TIST_OV  = 1<<13, /* Time Stamp Timer Overflow (YUKON only) */
         IS_IRQ_SENSOR   = 1<<12, /* IRQ from Sensor (YUKON only) */
         IS_IRQ_MST_ERR  = 1<<11, /* IRQ master error detected */
@@ -230,6 +228,12 @@ enum {
         IS_M2_PAR_ERR   = 1<<2, /* MAC 2 Parity Error */
         IS_R1_PAR_ERR   = 1<<1, /* Queue R1 Parity Error */
         IS_R2_PAR_ERR   = 1<<0, /* Queue R2 Parity Error */
+
+        IS_ERR_MSK      = IS_IRQ_MST_ERR | IS_IRQ_STAT
+                        | IS_NO_STAT_M1 | IS_NO_STAT_M2
+                        | IS_RAM_RD_PAR | IS_RAM_WR_PAR
+                        | IS_M1_PAR_ERR | IS_M2_PAR_ERR
+                        | IS_R1_PAR_ERR | IS_R2_PAR_ERR,
 };
 
 /*      B2_TST_CTRL1     8 bit  Test Control Register 1 */
@@ -2456,24 +2460,17 @@ struct skge_hw {
 
         u8                   chip_id;
         u8                   chip_rev;
-        u8                   phy_type;
-        u8                   pmd_type;
-        u16                  phy_addr;
+        u8                   copper;
         u8                   ports;
 
         u32                  ram_size;
         u32                  ram_offset;
+        u16                  phy_addr;
 
         struct tasklet_struct ext_tasklet;
         spinlock_t           phy_lock;
 };
 
-
-static inline int iscopper(const struct skge_hw *hw)
-{
-        return (hw->pmd_type == 'T');
-}
-
 enum {
         FLOW_MODE_NONE          = 0, /* No Flow-Control */
         FLOW_MODE_LOC_SEND      = 1, /* Local station sends PAUSE */
diff --git a/drivers/net/smc-ultra.c b/drivers/net/smc-ultra.c
index 6d9dae60a697..ba8593ac3f8a 100644
--- a/drivers/net/smc-ultra.c
+++ b/drivers/net/smc-ultra.c
@@ -68,6 +68,7 @@ static const char version[] =
 #include <linux/etherdevice.h>
 
 #include <asm/io.h>
+#include <asm/irq.h>
 #include <asm/system.h>
 
 #include "8390.h"
diff --git a/drivers/net/sonic.c b/drivers/net/sonic.c
index cdc9cc873e06..90b818a8de6e 100644
--- a/drivers/net/sonic.c
+++ b/drivers/net/sonic.c
@@ -1,6 +1,11 @@
 /*
  * sonic.c
  *
+ * (C) 2005 Finn Thain
+ *
+ * Converted to DMA API, added zero-copy buffer handling, and
+ * (from the mac68k project) introduced dhd's support for 16-bit cards.
+ *
  * (C) 1996,1998 by Thomas Bogendoerfer (tsbogend@alpha.franken.de)
  * 
  * This driver is based on work from Andreas Busse, but most of
@@ -9,12 +14,23 @@
  * (C) 1995 by Andreas Busse (andy@waldorf-gmbh.de)
  *
  *    Core code included by system sonic drivers
+ *
+ * And... partially rewritten again by David Huggins-Daines in order
+ * to cope with screwed up Macintosh NICs that may or may not use
+ * 16-bit DMA.
+ *
+ * (C) 1999 David Huggins-Daines <dhd@debian.org>
+ *
  */
 
 /*
  * Sources: Olivetti M700-10 Risc Personal Computer hardware handbook,
  * National Semiconductors data sheet for the DP83932B Sonic Ethernet
  * controller, and the files "8390.c" and "skeleton.c" in this directory.
+ *
+ * Additional sources: Nat Semi data sheet for the DP83932C and Nat Semi
+ * Application Note AN-746, the files "lance.c" and "ibmlana.c". See also
+ * the NetBSD file "sys/arch/mac68k/dev/if_sn.c".
  */
 
 
@@ -28,6 +44,9 @@
  */
 static int sonic_open(struct net_device *dev)
 {
+        struct sonic_local *lp = netdev_priv(dev);
+        int i;
+        
         if (sonic_debug > 2)
                 printk("sonic_open: initializing sonic driver.\n");
 
@@ -40,14 +59,59 @@ static int sonic_open(struct net_device *dev)
  * This means that during execution of the handler interrupt are disabled
  * covering another bug otherwise corrupting data.  This doesn't mean
  * this glue works ok under all situations.
+ *
+ * Note (dhd): this also appears to prevent lockups on the Macintrash
+ * when more than one Ethernet card is installed (knock on wood)
+ *
+ * Note (fthain): whether the above is still true is anyones guess. Certainly
+ * the buffer handling algorithms will not tolerate re-entrance without some
+ * mutual exclusion added. Anyway, the memcpy has now been eliminated from the
+ * rx code to make this a faster "fast interrupt".
  */
-//    if (sonic_request_irq(dev->irq, &sonic_interrupt, 0, "sonic", dev)) {
-        if (sonic_request_irq(dev->irq, &sonic_interrupt, SA_INTERRUPT,
-                              "sonic", dev)) {
-                printk("\n%s: unable to get IRQ %d .\n", dev->name, dev->irq);
+        if (request_irq(dev->irq, &sonic_interrupt, SONIC_IRQ_FLAG, "sonic", dev)) {
+                printk(KERN_ERR "\n%s: unable to get IRQ %d .\n", dev->name, dev->irq);
                 return -EAGAIN;
         }
 
+        for (i = 0; i < SONIC_NUM_RRS; i++) {
+                struct sk_buff *skb = dev_alloc_skb(SONIC_RBSIZE + 2);
+                if (skb == NULL) {
+                        while(i > 0) { /* free any that were allocated successfully */
+                                i--;
+                                dev_kfree_skb(lp->rx_skb[i]);
+                                lp->rx_skb[i] = NULL;
+                        }
+                        printk(KERN_ERR "%s: couldn't allocate receive buffers\n",
+                               dev->name);
+                        return -ENOMEM;
+                }
+                skb->dev = dev;
+                /* align IP header unless DMA requires otherwise */
+                if (SONIC_BUS_SCALE(lp->dma_bitmode) == 2)
+                        skb_reserve(skb, 2);
+                lp->rx_skb[i] = skb;
+        }
+
+        for (i = 0; i < SONIC_NUM_RRS; i++) {
+                dma_addr_t laddr = dma_map_single(lp->device, skb_put(lp->rx_skb[i], SONIC_RBSIZE),
+                                                  SONIC_RBSIZE, DMA_FROM_DEVICE);
+                if (!laddr) {
+                        while(i > 0) { /* free any that were mapped successfully */
+                                i--;
+                                dma_unmap_single(lp->device, lp->rx_laddr[i], SONIC_RBSIZE, DMA_FROM_DEVICE);
+                                lp->rx_laddr[i] = (dma_addr_t)0;
+                        }
+                        for (i = 0; i < SONIC_NUM_RRS; i++) {
+                                dev_kfree_skb(lp->rx_skb[i]);
+                                lp->rx_skb[i] = NULL;
+                        }
+                        printk(KERN_ERR "%s: couldn't map rx DMA buffers\n",
+                               dev->name);
+                        return -ENOMEM;
+                }
+                lp->rx_laddr[i] = laddr;
+        }
+
         /*
          * Initialize the SONIC
          */
@@ -67,7 +131,8 @@ static int sonic_open(struct net_device *dev)
  */
 static int sonic_close(struct net_device *dev)
 {
-        unsigned int base_addr = dev->base_addr;
+        struct sonic_local *lp = netdev_priv(dev);
+        int i;
 
         if (sonic_debug > 2)
                 printk("sonic_close\n");
@@ -77,20 +142,56 @@ static int sonic_close(struct net_device *dev)
         /*
          * stop the SONIC, disable interrupts
          */
-        SONIC_WRITE(SONIC_ISR, 0x7fff);
         SONIC_WRITE(SONIC_IMR, 0);
+        SONIC_WRITE(SONIC_ISR, 0x7fff);
         SONIC_WRITE(SONIC_CMD, SONIC_CR_RST);
 
-        sonic_free_irq(dev->irq, dev);  /* release the IRQ */
+        /* unmap and free skbs that haven't been transmitted */
+        for (i = 0; i < SONIC_NUM_TDS; i++) {
+                if(lp->tx_laddr[i]) {
+                        dma_unmap_single(lp->device, lp->tx_laddr[i], lp->tx_len[i], DMA_TO_DEVICE);
+                        lp->tx_laddr[i] = (dma_addr_t)0;
+                }
+                if(lp->tx_skb[i]) {
+                        dev_kfree_skb(lp->tx_skb[i]);
+                        lp->tx_skb[i] = NULL;
+                }
+        }
+
+        /* unmap and free the receive buffers */
+        for (i = 0; i < SONIC_NUM_RRS; i++) {
+                if(lp->rx_laddr[i]) {
+                        dma_unmap_single(lp->device, lp->rx_laddr[i], SONIC_RBSIZE, DMA_FROM_DEVICE);
+                        lp->rx_laddr[i] = (dma_addr_t)0;
+                }
+                if(lp->rx_skb[i]) {
+                        dev_kfree_skb(lp->rx_skb[i]);
+                        lp->rx_skb[i] = NULL;
+                }
+        }
+
+        free_irq(dev->irq, dev);        /* release the IRQ */
 
         return 0;
 }
 
 static void sonic_tx_timeout(struct net_device *dev)
 {
-        struct sonic_local *lp = (struct sonic_local *) dev->priv;
-        printk("%s: transmit timed out.\n", dev->name);
-
+        struct sonic_local *lp = netdev_priv(dev);
+        int i;
+        /* Stop the interrupts for this */
+        SONIC_WRITE(SONIC_IMR, 0);
+        /* We could resend the original skbs. Easier to re-initialise. */
+        for (i = 0; i < SONIC_NUM_TDS; i++) {
+                if(lp->tx_laddr[i]) {
+                        dma_unmap_single(lp->device, lp->tx_laddr[i], lp->tx_len[i], DMA_TO_DEVICE);
+                        lp->tx_laddr[i] = (dma_addr_t)0;
+                }
+                if(lp->tx_skb[i]) {
+                        dev_kfree_skb(lp->tx_skb[i]);
+                        lp->tx_skb[i] = NULL;
+                }
+        }
         /* Try to restart the adaptor. */
         sonic_init(dev);
         lp->stats.tx_errors++;
@@ -100,60 +201,92 @@ static void sonic_tx_timeout(struct net_device *dev)
 
 /*
  * transmit packet
+ *
+ * Appends new TD during transmission thus avoiding any TX interrupts
+ * until we run out of TDs.
+ * This routine interacts closely with the ISR in that it may,
+ *   set tx_skb[i]
+ *   reset the status flags of the new TD
+ *   set and reset EOL flags
+ *   stop the tx queue
+ * The ISR interacts with this routine in various ways. It may,
+ *   reset tx_skb[i]
+ *   test the EOL and status flags of the TDs
+ *   wake the tx queue
+ * Concurrently with all of this, the SONIC is potentially writing to
+ * the status flags of the TDs.
+ * Until some mutual exclusion is added, this code will not work with SMP. However,
+ * MIPS Jazz machines and m68k Macs were all uni-processor machines.
  */
+
 static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
 {
-        struct sonic_local *lp = (struct sonic_local *) dev->priv;
-        unsigned int base_addr = dev->base_addr;
-        unsigned int laddr;
-        int entry, length;
-
-        netif_stop_queue(dev);
+        struct sonic_local *lp = netdev_priv(dev);
+        dma_addr_t laddr;
+        int length;
+        int entry = lp->next_tx;
 
         if (sonic_debug > 2)
                 printk("sonic_send_packet: skb=%p, dev=%p\n", skb, dev);
 
+        length = skb->len;
+        if (length < ETH_ZLEN) {
+                skb = skb_padto(skb, ETH_ZLEN);
+                if (skb == NULL)
+                        return 0;
+                length = ETH_ZLEN;
+        }
+
         /*
          * Map the packet data into the logical DMA address space
          */
-        if ((laddr = vdma_alloc(CPHYSADDR(skb->data), skb->len)) == ~0UL) {
-                printk("%s: no VDMA entry for transmit available.\n",
-                       dev->name);
+
+        laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
+        if (!laddr) {
+                printk(KERN_ERR "%s: failed to map tx DMA buffer.\n", dev->name);
                 dev_kfree_skb(skb);
-                netif_start_queue(dev);
                 return 1;
         }
-        entry = lp->cur_tx & SONIC_TDS_MASK;
+   
+        sonic_tda_put(dev, entry, SONIC_TD_STATUS, 0);       /* clear status */
+        sonic_tda_put(dev, entry, SONIC_TD_FRAG_COUNT, 1);   /* single fragment */
+        sonic_tda_put(dev, entry, SONIC_TD_PKTSIZE, length); /* length of packet */
+        sonic_tda_put(dev, entry, SONIC_TD_FRAG_PTR_L, laddr & 0xffff);
+        sonic_tda_put(dev, entry, SONIC_TD_FRAG_PTR_H, laddr >> 16);
+        sonic_tda_put(dev, entry, SONIC_TD_FRAG_SIZE, length);
+        sonic_tda_put(dev, entry, SONIC_TD_LINK,
+                sonic_tda_get(dev, entry, SONIC_TD_LINK) | SONIC_EOL);
+
+        /*
+         * Must set tx_skb[entry] only after clearing status, and
+         * before clearing EOL and before stopping queue
+         */
+        wmb();
+        lp->tx_len[entry] = length;
         lp->tx_laddr[entry] = laddr;
         lp->tx_skb[entry] = skb;
 
-        length = (skb->len < ETH_ZLEN) ? ETH_ZLEN : skb->len;
-        flush_cache_all();
+        wmb();
+        sonic_tda_put(dev, lp->eol_tx, SONIC_TD_LINK,
+                                  sonic_tda_get(dev, lp->eol_tx, SONIC_TD_LINK) & ~SONIC_EOL);
+        lp->eol_tx = entry;
 
-        /*
-         * Setup the transmit descriptor and issue the transmit command.
-         */
-        lp->tda[entry].tx_status = 0;   /* clear status */
-        lp->tda[entry].tx_frag_count = 1;       /* single fragment */
-        lp->tda[entry].tx_pktsize = length;     /* length of packet */
-        lp->tda[entry].tx_frag_ptr_l = laddr & 0xffff;
-        lp->tda[entry].tx_frag_ptr_h = laddr >> 16;
-        lp->tda[entry].tx_frag_size = length;
-        lp->cur_tx++;
-        lp->stats.tx_bytes += length;
+        lp->next_tx = (entry + 1) & SONIC_TDS_MASK;
+        if (lp->tx_skb[lp->next_tx] != NULL) {
+                /* The ring is full, the ISR has yet to process the next TD. */
+                if (sonic_debug > 3)
+                        printk("%s: stopping queue\n", dev->name);
+                netif_stop_queue(dev);
+                /* after this packet, wait for ISR to free up some TDAs */
+        } else netif_start_queue(dev);
 
         if (sonic_debug > 2)
-                printk("sonic_send_packet: issueing Tx command\n");
+                printk("sonic_send_packet: issuing Tx command\n");
 
         SONIC_WRITE(SONIC_CMD, SONIC_CR_TXP);
 
         dev->trans_start = jiffies;
 
-        if (lp->cur_tx < lp->dirty_tx + SONIC_NUM_TDS)
-                netif_start_queue(dev);
-        else
-                lp->tx_full = 1;
-
         return 0;
 }
 
@@ -164,175 +297,199 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
 static irqreturn_t sonic_interrupt(int irq, void *dev_id, struct pt_regs *regs)
 {
         struct net_device *dev = (struct net_device *) dev_id;
-        unsigned int base_addr = dev->base_addr;
-        struct sonic_local *lp;
+        struct sonic_local *lp = netdev_priv(dev);
         int status;
 
         if (dev == NULL) {
-                printk("sonic_interrupt: irq %d for unknown device.\n", irq);
+                printk(KERN_ERR "sonic_interrupt: irq %d for unknown device.\n", irq);
                 return IRQ_NONE;
         }
 
-        lp = (struct sonic_local *) dev->priv;
-
-        status = SONIC_READ(SONIC_ISR);
-        SONIC_WRITE(SONIC_ISR, 0x7fff); /* clear all bits */
-
-        if (sonic_debug > 2)
-                printk("sonic_interrupt: ISR=%x\n", status);
-
-        if (status & SONIC_INT_PKTRX) {
-                sonic_rx(dev);  /* got packet(s) */
-        }
-
-        if (status & SONIC_INT_TXDN) {
-                int dirty_tx = lp->dirty_tx;
-
-                while (dirty_tx < lp->cur_tx) {
-                        int entry = dirty_tx & SONIC_TDS_MASK;
-                        int status = lp->tda[entry].tx_status;
+        if (!(status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT))
+                return IRQ_NONE;
 
-                        if (sonic_debug > 3)
-                                printk
-                                    ("sonic_interrupt: status %d, cur_tx %d, dirty_tx %d\n",
-                                     status, lp->cur_tx, lp->dirty_tx);
+        do {
+                if (status & SONIC_INT_PKTRX) {
+                        if (sonic_debug > 2)
+                                printk("%s: packet rx\n", dev->name);
+                        sonic_rx(dev);  /* got packet(s) */
+                        SONIC_WRITE(SONIC_ISR, SONIC_INT_PKTRX); /* clear the interrupt */
+                }
 
-                        if (status == 0) {
-                                /* It still hasn't been Txed, kick the sonic again */
-                                SONIC_WRITE(SONIC_CMD, SONIC_CR_TXP);
-                                break;
-                        }
+                if (status & SONIC_INT_TXDN) {
+                        int entry = lp->cur_tx;
+                        int td_status;
+                        int freed_some = 0;
 
-                        /* put back EOL and free descriptor */
-                        lp->tda[entry].tx_frag_count = 0;
-                        lp->tda[entry].tx_status = 0;
-
-                        if (status & 0x0001)
-                                lp->stats.tx_packets++;
-                        else {
-                                lp->stats.tx_errors++;
-                                if (status & 0x0642)
-                                        lp->stats.tx_aborted_errors++;
-                                if (status & 0x0180)
-                                        lp->stats.tx_carrier_errors++;
-                                if (status & 0x0020)
-                                        lp->stats.tx_window_errors++;
-                                if (status & 0x0004)
-                                        lp->stats.tx_fifo_errors++;
-                        }
+                        /* At this point, cur_tx is the index of a TD that is one of:
+                         *   unallocated/freed                          (status set   & tx_skb[entry] clear)
+                         *   allocated and sent                         (status set   & tx_skb[entry] set  )
+                         *   allocated and not yet sent                 (status clear & tx_skb[entry] set  )
+                         *   still being allocated by sonic_send_packet (status clear & tx_skb[entry] clear)
+                         */
 
-                        /* We must free the original skb */
-                        if (lp->tx_skb[entry]) {
+                        if (sonic_debug > 2)
+                                printk("%s: tx done\n", dev->name);
+
+                        while (lp->tx_skb[entry] != NULL) {
+                                if ((td_status = sonic_tda_get(dev, entry, SONIC_TD_STATUS)) == 0)
+                                        break;
+
+                                if (td_status & 0x0001) {
+                                        lp->stats.tx_packets++;
+                                        lp->stats.tx_bytes += sonic_tda_get(dev, entry, SONIC_TD_PKTSIZE);
+                                } else {
+                                        lp->stats.tx_errors++;
+                                        if (td_status & 0x0642)
+                                                lp->stats.tx_aborted_errors++;
+                                        if (td_status & 0x0180)
+                                                lp->stats.tx_carrier_errors++;
+                                        if (td_status & 0x0020)
+                                                lp->stats.tx_window_errors++;
+                                        if (td_status & 0x0004)
+                                                lp->stats.tx_fifo_errors++;
+                                }
+
+                                /* We must free the original skb */
                                 dev_kfree_skb_irq(lp->tx_skb[entry]);
-                                lp->tx_skb[entry] = 0;
+                                lp->tx_skb[entry] = NULL;
+                                /* and unmap DMA buffer */
+                                dma_unmap_single(lp->device, lp->tx_laddr[entry], lp->tx_len[entry], DMA_TO_DEVICE);
+                                lp->tx_laddr[entry] = (dma_addr_t)0;
+                                freed_some = 1;
+
+                                if (sonic_tda_get(dev, entry, SONIC_TD_LINK) & SONIC_EOL) {
+                                        entry = (entry + 1) & SONIC_TDS_MASK;
+                                        break;
+                                }
+                                entry = (entry + 1) & SONIC_TDS_MASK;
                         }
-                        /* and the VDMA address */
-                        vdma_free(lp->tx_laddr[entry]);
-                        dirty_tx++;
-                }
 
-                if (lp->tx_full
-                    && dirty_tx + SONIC_NUM_TDS > lp->cur_tx + 2) {
-                        /* The ring is no longer full, clear tbusy. */
-                        lp->tx_full = 0;
-                        netif_wake_queue(dev);
+                        if (freed_some || lp->tx_skb[entry] == NULL)
+                                netif_wake_queue(dev);  /* The ring is no longer full */
+                        lp->cur_tx = entry;
+                        SONIC_WRITE(SONIC_ISR, SONIC_INT_TXDN); /* clear the interrupt */
                 }
 
-                lp->dirty_tx = dirty_tx;
-        }
+                /*
+                 * check error conditions
+                 */
+                if (status & SONIC_INT_RFO) {
+                        if (sonic_debug > 1)
+                                printk("%s: rx fifo overrun\n", dev->name);
+                        lp->stats.rx_fifo_errors++;
+                        SONIC_WRITE(SONIC_ISR, SONIC_INT_RFO); /* clear the interrupt */
+                }
+                if (status & SONIC_INT_RDE) {
+                        if (sonic_debug > 1)
+                                printk("%s: rx descriptors exhausted\n", dev->name);
+                        lp->stats.rx_dropped++;
+                        SONIC_WRITE(SONIC_ISR, SONIC_INT_RDE); /* clear the interrupt */
+                }
+                if (status & SONIC_INT_RBAE) {
+                        if (sonic_debug > 1)
+                                printk("%s: rx buffer area exceeded\n", dev->name);
+                        lp->stats.rx_dropped++;
+                        SONIC_WRITE(SONIC_ISR, SONIC_INT_RBAE); /* clear the interrupt */
+                }
 
-        /*
-         * check error conditions
-         */
-        if (status & SONIC_INT_RFO) {
-                printk("%s: receive fifo underrun\n", dev->name);
-                lp->stats.rx_fifo_errors++;
-        }
-        if (status & SONIC_INT_RDE) {
-                printk("%s: receive descriptors exhausted\n", dev->name);
-                lp->stats.rx_dropped++;
-        }
-        if (status & SONIC_INT_RBE) {
-                printk("%s: receive buffer exhausted\n", dev->name);
-                lp->stats.rx_dropped++;
-        }
-        if (status & SONIC_INT_RBAE) {
-                printk("%s: receive buffer area exhausted\n", dev->name);
-                lp->stats.rx_dropped++;
-        }
+                /* counter overruns; all counters are 16bit wide */
+                if (status & SONIC_INT_FAE) {
+                        lp->stats.rx_frame_errors += 65536;
+                        SONIC_WRITE(SONIC_ISR, SONIC_INT_FAE); /* clear the interrupt */
+                }
+                if (status & SONIC_INT_CRC) {
+                        lp->stats.rx_crc_errors += 65536;
+                        SONIC_WRITE(SONIC_ISR, SONIC_INT_CRC); /* clear the interrupt */
+                }
+                if (status & SONIC_INT_MP) {
+                        lp->stats.rx_missed_errors += 65536;
+                        SONIC_WRITE(SONIC_ISR, SONIC_INT_MP); /* clear the interrupt */
+                }
 
-        /* counter overruns; all counters are 16bit wide */
-        if (status & SONIC_INT_FAE)
-                lp->stats.rx_frame_errors += 65536;
-        if (status & SONIC_INT_CRC)
-                lp->stats.rx_crc_errors += 65536;
-        if (status & SONIC_INT_MP)
-                lp->stats.rx_missed_errors += 65536;
+                /* transmit error */
+                if (status & SONIC_INT_TXER) {
+                        if ((SONIC_READ(SONIC_TCR) & SONIC_TCR_FU) && (sonic_debug > 2))
+                                printk(KERN_ERR "%s: tx fifo underrun\n", dev->name);
+                        SONIC_WRITE(SONIC_ISR, SONIC_INT_TXER); /* clear the interrupt */
+                }
 
-        /* transmit error */
-        if (status & SONIC_INT_TXER)
-                lp->stats.tx_errors++;
+                /* bus retry */
+                if (status & SONIC_INT_BR) {
+                        printk(KERN_ERR "%s: Bus retry occurred! Device interrupt disabled.\n",
+                                dev->name);
+                        /* ... to help debug DMA problems causing endless interrupts. */
+                        /* Bounce the eth interface to turn on the interrupt again. */
+                        SONIC_WRITE(SONIC_IMR, 0);
+                        SONIC_WRITE(SONIC_ISR, SONIC_INT_BR); /* clear the interrupt */
+                }
 
-        /*
-         * clear interrupt bits and return
-         */
-        SONIC_WRITE(SONIC_ISR, status);
+                /* load CAM done */
+                if (status & SONIC_INT_LCD)
+                        SONIC_WRITE(SONIC_ISR, SONIC_INT_LCD); /* clear the interrupt */
+        } while((status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT));
         return IRQ_HANDLED;
 }
 
 /*
- * We have a good packet(s), get it/them out of the buffers.
+ * We have a good packet(s), pass it/them up the network stack.
  */
 static void sonic_rx(struct net_device *dev)
 {
-        unsigned int base_addr = dev->base_addr;
-        struct sonic_local *lp = (struct sonic_local *) dev->priv;
-        sonic_rd_t *rd = &lp->rda[lp->cur_rx & SONIC_RDS_MASK];
+        struct sonic_local *lp = netdev_priv(dev);
         int status;
-
-        while (rd->in_use == 0) {
-                struct sk_buff *skb;
+        int entry = lp->cur_rx;
+
+        while (sonic_rda_get(dev, entry, SONIC_RD_IN_USE) == 0) {
+                struct sk_buff *used_skb;
+                struct sk_buff *new_skb;
+                dma_addr_t new_laddr;
+                u16 bufadr_l;
+                u16 bufadr_h;
                 int pkt_len;
-                unsigned char *pkt_ptr;
 
-                status = rd->rx_status;
-                if (sonic_debug > 3)
-                        printk("status %x, cur_rx %d, cur_rra %x\n",
-                               status, lp->cur_rx, lp->cur_rra);
+                status = sonic_rda_get(dev, entry, SONIC_RD_STATUS);
                 if (status & SONIC_RCR_PRX) {
-                        pkt_len = rd->rx_pktlen;
-                        pkt_ptr =
-                            (char *)
-                            sonic_chiptomem((rd->rx_pktptr_h << 16) +
-                                            rd->rx_pktptr_l);
-
-                        if (sonic_debug > 3)
-                                printk
-                                    ("pktptr %p (rba %p) h:%x l:%x, bsize h:%x l:%x\n",
-                                     pkt_ptr, lp->rba, rd->rx_pktptr_h,
-                                     rd->rx_pktptr_l,
-                                     SONIC_READ(SONIC_RBWC1),
-                                     SONIC_READ(SONIC_RBWC0));
-
                         /* Malloc up new buffer. */
-                        skb = dev_alloc_skb(pkt_len + 2);
-                        if (skb == NULL) {
-                                printk
-                                    ("%s: Memory squeeze, dropping packet.\n",
-                                     dev->name);
+                        new_skb = dev_alloc_skb(SONIC_RBSIZE + 2);
+                        if (new_skb == NULL) {
+                                printk(KERN_ERR "%s: Memory squeeze, dropping packet.\n", dev->name);
+                                lp->stats.rx_dropped++;
+                                break;
+                        }
+                        new_skb->dev = dev;
+                        /* provide 16 byte IP header alignment unless DMA requires otherwise */
+                        if(SONIC_BUS_SCALE(lp->dma_bitmode) == 2)
+                                skb_reserve(new_skb, 2); 
+
+                        new_laddr = dma_map_single(lp->device, skb_put(new_skb, SONIC_RBSIZE),
+                                               SONIC_RBSIZE, DMA_FROM_DEVICE);
+                        if (!new_laddr) {
+                                dev_kfree_skb(new_skb);
+                                printk(KERN_ERR "%s: Failed to map rx buffer, dropping packet.\n", dev->name);
                                 lp->stats.rx_dropped++;
                                 break;
                         }
-                        skb->dev = dev;
-                        skb_reserve(skb, 2);    /* 16 byte align */
-                        skb_put(skb, pkt_len);  /* Make room */
-                        eth_copy_and_sum(skb, pkt_ptr, pkt_len, 0);
-                        skb->protocol = eth_type_trans(skb, dev);
-                        netif_rx(skb);  /* pass the packet to upper layers */
+
+                        /* now we have a new skb to replace it, pass the used one up the stack */
+                        dma_unmap_single(lp->device, lp->rx_laddr[entry], SONIC_RBSIZE, DMA_FROM_DEVICE);
+                        used_skb = lp->rx_skb[entry];
+                        pkt_len = sonic_rda_get(dev, entry, SONIC_RD_PKTLEN);
+                        skb_trim(used_skb, pkt_len);
+                        used_skb->protocol = eth_type_trans(used_skb, dev);
+                        netif_rx(used_skb);
                         dev->last_rx = jiffies;
                         lp->stats.rx_packets++;
                         lp->stats.rx_bytes += pkt_len;
 
+                        /* and insert the new skb */
+                        lp->rx_laddr[entry] = new_laddr;
+                        lp->rx_skb[entry] = new_skb;
+
+                        bufadr_l = (unsigned long)new_laddr & 0xffff;
+                        bufadr_h = (unsigned long)new_laddr >> 16;
+                        sonic_rra_put(dev, entry, SONIC_RR_BUFADR_L, bufadr_l);
+                        sonic_rra_put(dev, entry, SONIC_RR_BUFADR_H, bufadr_h);
                 } else {
                         /* This should only happen, if we enable accepting broken packets. */
                         lp->stats.rx_errors++;
@@ -341,29 +498,35 @@ static void sonic_rx(struct net_device *dev)
                         if (status & SONIC_RCR_CRCR)
                                 lp->stats.rx_crc_errors++;
                 }
-
-                rd->in_use = 1;
-                rd = &lp->rda[(++lp->cur_rx) & SONIC_RDS_MASK];
-                /* now give back the buffer to the receive buffer area */
                 if (status & SONIC_RCR_LPKT) {
                         /*
-                         * this was the last packet out of the current receice buffer
+                         * this was the last packet out of the current receive buffer
                          * give the buffer back to the SONIC
                          */
-                        lp->cur_rra += sizeof(sonic_rr_t);
-                        if (lp->cur_rra >
-                            (lp->rra_laddr +
-                             (SONIC_NUM_RRS -
-                              1) * sizeof(sonic_rr_t))) lp->cur_rra =
-                                    lp->rra_laddr;
-                        SONIC_WRITE(SONIC_RWP, lp->cur_rra & 0xffff);
+                        lp->cur_rwp += SIZEOF_SONIC_RR * SONIC_BUS_SCALE(lp->dma_bitmode);
+                        if (lp->cur_rwp >= lp->rra_end) lp->cur_rwp = lp->rra_laddr & 0xffff;
+                        SONIC_WRITE(SONIC_RWP, lp->cur_rwp);
+                        if (SONIC_READ(SONIC_ISR) & SONIC_INT_RBE) {
+                                if (sonic_debug > 2)
+                                        printk("%s: rx buffer exhausted\n", dev->name);
+                                SONIC_WRITE(SONIC_ISR, SONIC_INT_RBE); /* clear the flag */
+                        }
                 } else
-                        printk
-                            ("%s: rx desc without RCR_LPKT. Shouldn't happen !?\n",
+                        printk(KERN_ERR "%s: rx desc without RCR_LPKT. Shouldn't happen !?\n",
                              dev->name);
+                /*
+                 * give back the descriptor
+                 */
+                sonic_rda_put(dev, entry, SONIC_RD_LINK,
+                        sonic_rda_get(dev, entry, SONIC_RD_LINK) | SONIC_EOL);
+                sonic_rda_put(dev, entry, SONIC_RD_IN_USE, 1);
+                sonic_rda_put(dev, lp->eol_rx, SONIC_RD_LINK,
+                        sonic_rda_get(dev, lp->eol_rx, SONIC_RD_LINK) & ~SONIC_EOL);
+                lp->eol_rx = entry;
+                lp->cur_rx = entry = (entry + 1) & SONIC_RDS_MASK;
         }
         /*
-         * If any worth-while packets have been received, dev_rint()
+         * If any worth-while packets have been received, netif_rx()
          * has done a mark_bh(NET_BH) for us and will work on them
          * when we get to the bottom-half routine.
          */
@@ -376,8 +539,7 @@ static void sonic_rx(struct net_device *dev)
  */
 static struct net_device_stats *sonic_get_stats(struct net_device *dev)
 {
-        struct sonic_local *lp = (struct sonic_local *) dev->priv;
-        unsigned int base_addr = dev->base_addr;
+        struct sonic_local *lp = netdev_priv(dev);
 
         /* read the tally counter from the SONIC and reset them */
         lp->stats.rx_crc_errors += SONIC_READ(SONIC_CRCT);
@@ -396,8 +558,7 @@ static struct net_device_stats *sonic_get_stats(struct net_device *dev)
  */
 static void sonic_multicast_list(struct net_device *dev)
 {
-        struct sonic_local *lp = (struct sonic_local *) dev->priv;
-        unsigned int base_addr = dev->base_addr;
+        struct sonic_local *lp = netdev_priv(dev);
         unsigned int rcr;
         struct dev_mc_list *dmi = dev->mc_list;
         unsigned char *addr;
@@ -413,20 +574,15 @@ static void sonic_multicast_list(struct net_device *dev)
                         rcr |= SONIC_RCR_AMC;
                 } else {
                         if (sonic_debug > 2)
-                                printk
-                                    ("sonic_multicast_list: mc_count %d\n",
-                                     dev->mc_count);
-                        lp->cda.cam_enable = 1; /* always enable our own address */
+                                printk("sonic_multicast_list: mc_count %d\n", dev->mc_count);
+                        sonic_set_cam_enable(dev, 1);  /* always enable our own address */
                         for (i = 1; i <= dev->mc_count; i++) {
                                 addr = dmi->dmi_addr;
                                 dmi = dmi->next;
-                                lp->cda.cam_desc[i].cam_cap0 =
-                                    addr[1] << 8 | addr[0];
-                                lp->cda.cam_desc[i].cam_cap1 =
-                                    addr[3] << 8 | addr[2];
-                                lp->cda.cam_desc[i].cam_cap2 =
-                                    addr[5] << 8 | addr[4];
-                                lp->cda.cam_enable |= (1 << i);
+                                sonic_cda_put(dev, i, SONIC_CD_CAP0, addr[1] << 8 | addr[0]);
+                                sonic_cda_put(dev, i, SONIC_CD_CAP1, addr[3] << 8 | addr[2]);
+                                sonic_cda_put(dev, i, SONIC_CD_CAP2, addr[5] << 8 | addr[4]);
+                                sonic_set_cam_enable(dev, sonic_get_cam_enable(dev) | (1 << i));
                         }
                         SONIC_WRITE(SONIC_CDC, 16);
                         /* issue Load CAM command */
@@ -447,19 +603,16 @@ static void sonic_multicast_list(struct net_device *dev)
  */
 static int sonic_init(struct net_device *dev)
 {
-        unsigned int base_addr = dev->base_addr;
         unsigned int cmd;
-        struct sonic_local *lp = (struct sonic_local *) dev->priv;
-        unsigned int rra_start;
-        unsigned int rra_end;
+        struct sonic_local *lp = netdev_priv(dev);
         int i;
 
         /*
          * put the Sonic into software-reset mode and
          * disable all interrupts
          */
-        SONIC_WRITE(SONIC_ISR, 0x7fff);
         SONIC_WRITE(SONIC_IMR, 0);
+        SONIC_WRITE(SONIC_ISR, 0x7fff);
         SONIC_WRITE(SONIC_CMD, SONIC_CR_RST);
 
         /*
@@ -475,34 +628,32 @@ static int sonic_init(struct net_device *dev)
         if (sonic_debug > 2)
                 printk("sonic_init: initialize receive resource area\n");
 
-        rra_start = lp->rra_laddr & 0xffff;
-        rra_end =
-            (rra_start + (SONIC_NUM_RRS * sizeof(sonic_rr_t))) & 0xffff;
-
         for (i = 0; i < SONIC_NUM_RRS; i++) {
-                lp->rra[i].rx_bufadr_l =
-                    (lp->rba_laddr + i * SONIC_RBSIZE) & 0xffff;
-                lp->rra[i].rx_bufadr_h =
-                    (lp->rba_laddr + i * SONIC_RBSIZE) >> 16;
-                lp->rra[i].rx_bufsize_l = SONIC_RBSIZE >> 1;
-                lp->rra[i].rx_bufsize_h = 0;
+                u16 bufadr_l = (unsigned long)lp->rx_laddr[i] & 0xffff;
+                u16 bufadr_h = (unsigned long)lp->rx_laddr[i] >> 16;
+                sonic_rra_put(dev, i, SONIC_RR_BUFADR_L, bufadr_l);
+                sonic_rra_put(dev, i, SONIC_RR_BUFADR_H, bufadr_h);
+                sonic_rra_put(dev, i, SONIC_RR_BUFSIZE_L, SONIC_RBSIZE >> 1);
+                sonic_rra_put(dev, i, SONIC_RR_BUFSIZE_H, 0);
         }
 
         /* initialize all RRA registers */
-        SONIC_WRITE(SONIC_RSA, rra_start);
-        SONIC_WRITE(SONIC_REA, rra_end);
-        SONIC_WRITE(SONIC_RRP, rra_start);
-        SONIC_WRITE(SONIC_RWP, rra_end);
+        lp->rra_end = (lp->rra_laddr + SONIC_NUM_RRS * SIZEOF_SONIC_RR *
+                                        SONIC_BUS_SCALE(lp->dma_bitmode)) & 0xffff;
+        lp->cur_rwp = (lp->rra_laddr + (SONIC_NUM_RRS - 1) * SIZEOF_SONIC_RR *
+                                        SONIC_BUS_SCALE(lp->dma_bitmode)) & 0xffff;
+  
+        SONIC_WRITE(SONIC_RSA, lp->rra_laddr & 0xffff);
+        SONIC_WRITE(SONIC_REA, lp->rra_end);
+        SONIC_WRITE(SONIC_RRP, lp->rra_laddr & 0xffff);
+        SONIC_WRITE(SONIC_RWP, lp->cur_rwp);
         SONIC_WRITE(SONIC_URRA, lp->rra_laddr >> 16);
-        SONIC_WRITE(SONIC_EOBC, (SONIC_RBSIZE - 2) >> 1);
-
-        lp->cur_rra =
-            lp->rra_laddr + (SONIC_NUM_RRS - 1) * sizeof(sonic_rr_t);
+        SONIC_WRITE(SONIC_EOBC, (SONIC_RBSIZE >> 1) - (lp->dma_bitmode ? 2 : 1));
 
         /* load the resource pointers */
         if (sonic_debug > 3)
-                printk("sonic_init: issueing RRRA command\n");
-
+                printk("sonic_init: issuing RRRA command\n");
+  
         SONIC_WRITE(SONIC_CMD, SONIC_CR_RRRA);
         i = 0;
         while (i++ < 100) {
@@ -511,27 +662,30 @@ static int sonic_init(struct net_device *dev)
         }
 
         if (sonic_debug > 2)
-                printk("sonic_init: status=%x\n", SONIC_READ(SONIC_CMD));
-
+                printk("sonic_init: status=%x i=%d\n", SONIC_READ(SONIC_CMD), i);
+    
         /*
          * Initialize the receive descriptors so that they
          * become a circular linked list, ie. let the last
          * descriptor point to the first again.
          */
         if (sonic_debug > 2)
-                printk("sonic_init: initialize receive descriptors\n");
-        for (i = 0; i < SONIC_NUM_RDS; i++) {
-                lp->rda[i].rx_status = 0;
-                lp->rda[i].rx_pktlen = 0;
-                lp->rda[i].rx_pktptr_l = 0;
-                lp->rda[i].rx_pktptr_h = 0;
-                lp->rda[i].rx_seqno = 0;
-                lp->rda[i].in_use = 1;
-                lp->rda[i].link =
-                    lp->rda_laddr + (i + 1) * sizeof(sonic_rd_t);
+                printk("sonic_init: initialize receive descriptors\n");      
+        for (i=0; i<SONIC_NUM_RDS; i++) {
+                sonic_rda_put(dev, i, SONIC_RD_STATUS, 0);
+                sonic_rda_put(dev, i, SONIC_RD_PKTLEN, 0);
+                sonic_rda_put(dev, i, SONIC_RD_PKTPTR_L, 0);
+                sonic_rda_put(dev, i, SONIC_RD_PKTPTR_H, 0);
+                sonic_rda_put(dev, i, SONIC_RD_SEQNO, 0);
+                sonic_rda_put(dev, i, SONIC_RD_IN_USE, 1);
+                sonic_rda_put(dev, i, SONIC_RD_LINK,
+                        lp->rda_laddr +
+                        ((i+1) * SIZEOF_SONIC_RD * SONIC_BUS_SCALE(lp->dma_bitmode)));
         }
         /* fix last descriptor */
-        lp->rda[SONIC_NUM_RDS - 1].link = lp->rda_laddr;
+        sonic_rda_put(dev, SONIC_NUM_RDS - 1, SONIC_RD_LINK,
+                (lp->rda_laddr & 0xffff) | SONIC_EOL);
+        lp->eol_rx = SONIC_NUM_RDS - 1;
         lp->cur_rx = 0;
         SONIC_WRITE(SONIC_URDA, lp->rda_laddr >> 16);
         SONIC_WRITE(SONIC_CRDA, lp->rda_laddr & 0xffff);
@@ -542,34 +696,34 @@ static int sonic_init(struct net_device *dev)
         if (sonic_debug > 2)
                 printk("sonic_init: initialize transmit descriptors\n");
         for (i = 0; i < SONIC_NUM_TDS; i++) {
-                lp->tda[i].tx_status = 0;
-                lp->tda[i].tx_config = 0;
-                lp->tda[i].tx_pktsize = 0;
-                lp->tda[i].tx_frag_count = 0;
-                lp->tda[i].link =
-                    (lp->tda_laddr +
-                     (i + 1) * sizeof(sonic_td_t)) | SONIC_END_OF_LINKS;
+                sonic_tda_put(dev, i, SONIC_TD_STATUS, 0);
+                sonic_tda_put(dev, i, SONIC_TD_CONFIG, 0);
+                sonic_tda_put(dev, i, SONIC_TD_PKTSIZE, 0);
+                sonic_tda_put(dev, i, SONIC_TD_FRAG_COUNT, 0);
+                sonic_tda_put(dev, i, SONIC_TD_LINK,
+                        (lp->tda_laddr & 0xffff) +
+                        (i + 1) * SIZEOF_SONIC_TD * SONIC_BUS_SCALE(lp->dma_bitmode));
+                lp->tx_skb[i] = NULL;
         }
-        lp->tda[SONIC_NUM_TDS - 1].link =
-            (lp->tda_laddr & 0xffff) | SONIC_END_OF_LINKS;
+        /* fix last descriptor */
+        sonic_tda_put(dev, SONIC_NUM_TDS - 1, SONIC_TD_LINK,
+                (lp->tda_laddr & 0xffff));
 
         SONIC_WRITE(SONIC_UTDA, lp->tda_laddr >> 16);
         SONIC_WRITE(SONIC_CTDA, lp->tda_laddr & 0xffff);
-        lp->cur_tx = lp->dirty_tx = 0;
-
+        lp->cur_tx = lp->next_tx = 0;
+        lp->eol_tx = SONIC_NUM_TDS - 1;
+    
         /*
          * put our own address to CAM desc[0]
          */
-        lp->cda.cam_desc[0].cam_cap0 =
-            dev->dev_addr[1] << 8 | dev->dev_addr[0];
-        lp->cda.cam_desc[0].cam_cap1 =
-            dev->dev_addr[3] << 8 | dev->dev_addr[2];
-        lp->cda.cam_desc[0].cam_cap2 =
-            dev->dev_addr[5] << 8 | dev->dev_addr[4];
-        lp->cda.cam_enable = 1;
+        sonic_cda_put(dev, 0, SONIC_CD_CAP0, dev->dev_addr[1] << 8 | dev->dev_addr[0]);
+        sonic_cda_put(dev, 0, SONIC_CD_CAP1, dev->dev_addr[3] << 8 | dev->dev_addr[2]);
+        sonic_cda_put(dev, 0, SONIC_CD_CAP2, dev->dev_addr[5] << 8 | dev->dev_addr[4]);
+        sonic_set_cam_enable(dev, 1);
 
         for (i = 0; i < 16; i++)
-                lp->cda.cam_desc[i].cam_entry_pointer = i;
+                sonic_cda_put(dev, i, SONIC_CD_ENTRY_POINTER, i);
 
         /*
          * initialize CAM registers
@@ -588,8 +742,8 @@ static int sonic_init(struct net_device *dev)
                         break;
         }
         if (sonic_debug > 2) {
-                printk("sonic_init: CMD=%x, ISR=%x\n",
-                       SONIC_READ(SONIC_CMD), SONIC_READ(SONIC_ISR));
+                printk("sonic_init: CMD=%x, ISR=%x\n, i=%d",
+                       SONIC_READ(SONIC_CMD), SONIC_READ(SONIC_ISR), i);
         }
 
         /*
@@ -604,7 +758,7 @@ static int sonic_init(struct net_device *dev)
 
         cmd = SONIC_READ(SONIC_CMD);
         if ((cmd & SONIC_CR_RXEN) == 0 || (cmd & SONIC_CR_STP) == 0)
-                printk("sonic_init: failed, status=%x\n", cmd);
+                printk(KERN_ERR "sonic_init: failed, status=%x\n", cmd);
 
         if (sonic_debug > 2)
                 printk("sonic_init: new status=%x\n",
diff --git a/drivers/net/sonic.h b/drivers/net/sonic.h
index c4a6d58e4afb..cede969a8baa 100644
--- a/drivers/net/sonic.h
+++ b/drivers/net/sonic.h
@@ -1,5 +1,5 @@
 /*
- * Helpfile for sonic.c
+ * Header file for sonic.c
  *
  * (C) Waldorf Electronics, Germany
  * Written by Andreas Busse
@@ -9,10 +9,16 @@
  * and pad structure members must be exchanged. Also, the structures
  * need to be changed accordingly to the bus size. 
  *
- * 981229 MSch: did just that for the 68k Mac port (32 bit, big endian),
- *              see CONFIG_MACSONIC branch below.
+ * 981229 MSch: did just that for the 68k Mac port (32 bit, big endian)
  *
+ * 990611 David Huggins-Daines <dhd@debian.org>: This machine abstraction
+ * does not cope with 16-bit bus sizes very well.  Therefore I have
+ * rewritten it with ugly macros and evil inlines.
+ *
+ * 050625 Finn Thain: introduced more 32-bit cards and dhd's support
+ *        for 16-bit cards (from the mac68k project).
  */
+
 #ifndef SONIC_H
 #define SONIC_H
 
@@ -83,6 +89,7 @@
 /*
  * Error counters
  */
+
 #define SONIC_CRCT              0x2c
 #define SONIC_FAET              0x2d
 #define SONIC_MPT               0x2e
@@ -182,14 +189,14 @@
 
 #define SONIC_INT_BR            0x4000
 #define SONIC_INT_HBL           0x2000
-#define SONIC_INT_LCD           0x1000
-#define SONIC_INT_PINT          0x0800
-#define SONIC_INT_PKTRX         0x0400
-#define SONIC_INT_TXDN          0x0200
-#define SONIC_INT_TXER          0x0100
-#define SONIC_INT_TC            0x0080
-#define SONIC_INT_RDE           0x0040
-#define SONIC_INT_RBE           0x0020
+#define SONIC_INT_LCD           0x1000
+#define SONIC_INT_PINT          0x0800
+#define SONIC_INT_PKTRX         0x0400
+#define SONIC_INT_TXDN          0x0200
+#define SONIC_INT_TXER          0x0100
+#define SONIC_INT_TC            0x0080
+#define SONIC_INT_RDE           0x0040
+#define SONIC_INT_RBE           0x0020
 #define SONIC_INT_RBAE          0x0010
 #define SONIC_INT_CRC           0x0008
 #define SONIC_INT_FAE           0x0004
@@ -201,224 +208,61 @@
  * The interrupts we allow.
  */
 
-#define SONIC_IMR_DEFAULT       (SONIC_INT_BR | \
-                                SONIC_INT_LCD | \
-                                SONIC_INT_PINT | \
+#define SONIC_IMR_DEFAULT     ( SONIC_INT_BR | \
+                                SONIC_INT_LCD | \
+                                SONIC_INT_RFO | \
                                 SONIC_INT_PKTRX | \
                                 SONIC_INT_TXDN | \
                                 SONIC_INT_TXER | \
                                 SONIC_INT_RDE | \
-                                SONIC_INT_RBE | \
                                 SONIC_INT_RBAE | \
                                 SONIC_INT_CRC | \
                                 SONIC_INT_FAE | \
                                 SONIC_INT_MP)
 
 
-#define SONIC_END_OF_LINKS      0x0001
-
-
-#ifdef CONFIG_MACSONIC
-/*
- * Big endian like structures on 680x0 Macs
- */
-
-typedef struct {
-        u32 rx_bufadr_l;        /* receive buffer ptr */
-        u32 rx_bufadr_h;
-
-        u32 rx_bufsize_l;       /* no. of words in the receive buffer */
-        u32 rx_bufsize_h;
-} sonic_rr_t;
-
-/*
- * Sonic receive descriptor. Receive descriptors are
- * kept in a linked list of these structures.
- */
-
-typedef struct {
-        SREGS_PAD(pad0);
-        u16 rx_status;          /* status after reception of a packet */
-         SREGS_PAD(pad1);
-        u16 rx_pktlen;          /* length of the packet incl. CRC */
-
-        /*
-         * Pointers to the location in the receive buffer area (RBA)
-         * where the packet resides. A packet is always received into
-         * a contiguous piece of memory.
-         */
-         SREGS_PAD(pad2);
-        u16 rx_pktptr_l;
-         SREGS_PAD(pad3);
-        u16 rx_pktptr_h;
-
-         SREGS_PAD(pad4);
-        u16 rx_seqno;           /* sequence no. */
-
-         SREGS_PAD(pad5);
-        u16 link;               /* link to next RDD (end if EOL bit set) */
-
-        /*
-         * Owner of this descriptor, 0= driver, 1=sonic
-         */
-
-         SREGS_PAD(pad6);
-        u16 in_use;
-
-        caddr_t rda_next;       /* pointer to next RD */
-} sonic_rd_t;
-
-
-/*
- * Describes a Transmit Descriptor
- */
-typedef struct {
-        SREGS_PAD(pad0);
-        u16 tx_status;          /* status after transmission of a packet */
-         SREGS_PAD(pad1);
-        u16 tx_config;          /* transmit configuration for this packet */
-         SREGS_PAD(pad2);
-        u16 tx_pktsize;         /* size of the packet to be transmitted */
-         SREGS_PAD(pad3);
-        u16 tx_frag_count;      /* no. of fragments */
-
-         SREGS_PAD(pad4);
-        u16 tx_frag_ptr_l;
-         SREGS_PAD(pad5);
-        u16 tx_frag_ptr_h;
-         SREGS_PAD(pad6);
-        u16 tx_frag_size;
-
-         SREGS_PAD(pad7);
-        u16 link;               /* ptr to next descriptor */
-} sonic_td_t;
-
-
-/*
- * Describes an entry in the CAM Descriptor Area.
- */
-
-typedef struct {
-        SREGS_PAD(pad0);
-        u16 cam_entry_pointer;
-         SREGS_PAD(pad1);
-        u16 cam_cap0;
-         SREGS_PAD(pad2);
-        u16 cam_cap1;
-         SREGS_PAD(pad3);
-        u16 cam_cap2;
-} sonic_cd_t;
-
+#define SONIC_EOL       0x0001
 #define CAM_DESCRIPTORS 16
 
-
-typedef struct {
-        sonic_cd_t cam_desc[CAM_DESCRIPTORS];
-         SREGS_PAD(pad);
-        u16 cam_enable;
-} sonic_cda_t;
-
-#else                           /* original declarations, little endian 32 bit */
-
-/*
- * structure definitions
- */
-
-typedef struct {
-        u32 rx_bufadr_l;        /* receive buffer ptr */
-        u32 rx_bufadr_h;
-
-        u32 rx_bufsize_l;       /* no. of words in the receive buffer */
-        u32 rx_bufsize_h;
-} sonic_rr_t;
-
-/*
- * Sonic receive descriptor. Receive descriptors are
- * kept in a linked list of these structures.
- */
-
-typedef struct {
-        u16 rx_status;          /* status after reception of a packet */
-         SREGS_PAD(pad0);
-        u16 rx_pktlen;          /* length of the packet incl. CRC */
-         SREGS_PAD(pad1);
-
-        /*
-         * Pointers to the location in the receive buffer area (RBA)
-         * where the packet resides. A packet is always received into
-         * a contiguous piece of memory.
-         */
-        u16 rx_pktptr_l;
-         SREGS_PAD(pad2);
-        u16 rx_pktptr_h;
-         SREGS_PAD(pad3);
-
-        u16 rx_seqno;           /* sequence no. */
-         SREGS_PAD(pad4);
-
-        u16 link;               /* link to next RDD (end if EOL bit set) */
-         SREGS_PAD(pad5);
-
-        /*
-         * Owner of this descriptor, 0= driver, 1=sonic
-         */
-
-        u16 in_use;
-         SREGS_PAD(pad6);
-
-        caddr_t rda_next;       /* pointer to next RD */
-} sonic_rd_t;
-
-
-/*
- * Describes a Transmit Descriptor
- */
-typedef struct {
-        u16 tx_status;          /* status after transmission of a packet */
-         SREGS_PAD(pad0);
-        u16 tx_config;          /* transmit configuration for this packet */
-         SREGS_PAD(pad1);
-        u16 tx_pktsize;         /* size of the packet to be transmitted */
-         SREGS_PAD(pad2);
-        u16 tx_frag_count;      /* no. of fragments */
-         SREGS_PAD(pad3);
-
-        u16 tx_frag_ptr_l;
-         SREGS_PAD(pad4);
-        u16 tx_frag_ptr_h;
-         SREGS_PAD(pad5);
-        u16 tx_frag_size;
-         SREGS_PAD(pad6);
-
-        u16 link;               /* ptr to next descriptor */
-         SREGS_PAD(pad7);
-} sonic_td_t;
-
-
-/*
- * Describes an entry in the CAM Descriptor Area.
- */
-
-typedef struct {
-        u16 cam_entry_pointer;
-         SREGS_PAD(pad0);
-        u16 cam_cap0;
-         SREGS_PAD(pad1);
-        u16 cam_cap1;
-         SREGS_PAD(pad2);
-        u16 cam_cap2;
-         SREGS_PAD(pad3);
-} sonic_cd_t;
-
-#define CAM_DESCRIPTORS 16
-
-
-typedef struct {
-        sonic_cd_t cam_desc[CAM_DESCRIPTORS];
-        u16 cam_enable;
-         SREGS_PAD(pad);
-} sonic_cda_t;
-#endif                          /* endianness */
+/* Offsets in the various DMA buffers accessed by the SONIC */
+
+#define SONIC_BITMODE16 0
+#define SONIC_BITMODE32 1
+#define SONIC_BUS_SCALE(bitmode) ((bitmode) ? 4 : 2)
+/* Note!  These are all measured in bus-size units, so use SONIC_BUS_SCALE */
+#define SIZEOF_SONIC_RR 4
+#define SONIC_RR_BUFADR_L  0
+#define SONIC_RR_BUFADR_H  1
+#define SONIC_RR_BUFSIZE_L 2
+#define SONIC_RR_BUFSIZE_H 3
+
+#define SIZEOF_SONIC_RD 7
+#define SONIC_RD_STATUS   0
+#define SONIC_RD_PKTLEN   1
+#define SONIC_RD_PKTPTR_L 2
+#define SONIC_RD_PKTPTR_H 3
+#define SONIC_RD_SEQNO    4
+#define SONIC_RD_LINK     5
+#define SONIC_RD_IN_USE   6
+
+#define SIZEOF_SONIC_TD 8
+#define SONIC_TD_STATUS       0
+#define SONIC_TD_CONFIG       1
+#define SONIC_TD_PKTSIZE      2
+#define SONIC_TD_FRAG_COUNT   3
+#define SONIC_TD_FRAG_PTR_L   4
+#define SONIC_TD_FRAG_PTR_H   5
+#define SONIC_TD_FRAG_SIZE    6
+#define SONIC_TD_LINK         7
+
+#define SIZEOF_SONIC_CD 4
+#define SONIC_CD_ENTRY_POINTER 0
+#define SONIC_CD_CAP0          1
+#define SONIC_CD_CAP1          2
+#define SONIC_CD_CAP2          3
+
+#define SIZEOF_SONIC_CDA ((CAM_DESCRIPTORS * SIZEOF_SONIC_CD) + 1)
+#define SONIC_CDA_CAM_ENABLE   (CAM_DESCRIPTORS * SIZEOF_SONIC_CD)
 
 /*
  * Some tunables for the buffer areas. Power of 2 is required
@@ -426,44 +270,60 @@ typedef struct {
  *
  * MSch: use more buffer space for the slow m68k Macs!
  */
-#ifdef CONFIG_MACSONIC
-#define SONIC_NUM_RRS    32     /* number of receive resources */
-#define SONIC_NUM_RDS    SONIC_NUM_RRS  /* number of receive descriptors */
-#define SONIC_NUM_TDS    32     /* number of transmit descriptors */
-#else
-#define SONIC_NUM_RRS    16     /* number of receive resources */
-#define SONIC_NUM_RDS    SONIC_NUM_RRS  /* number of receive descriptors */
-#define SONIC_NUM_TDS    16     /* number of transmit descriptors */
-#endif
-#define SONIC_RBSIZE   1520     /* size of one resource buffer */
+#define SONIC_NUM_RRS   16            /* number of receive resources */
+#define SONIC_NUM_RDS   SONIC_NUM_RRS /* number of receive descriptors */
+#define SONIC_NUM_TDS   16            /* number of transmit descriptors */
 
-#define SONIC_RDS_MASK   (SONIC_NUM_RDS-1)
-#define SONIC_TDS_MASK   (SONIC_NUM_TDS-1)
+#define SONIC_RDS_MASK  (SONIC_NUM_RDS-1)
+#define SONIC_TDS_MASK  (SONIC_NUM_TDS-1)
 
+#define SONIC_RBSIZE    1520          /* size of one resource buffer */
+
+/* Again, measured in bus size units! */
+#define SIZEOF_SONIC_DESC (SIZEOF_SONIC_CDA     \
+        + (SIZEOF_SONIC_TD * SONIC_NUM_TDS)     \
+        + (SIZEOF_SONIC_RD * SONIC_NUM_RDS)     \
+        + (SIZEOF_SONIC_RR * SONIC_NUM_RRS))
 
 /* Information that need to be kept for each board. */
 struct sonic_local {
-        sonic_cda_t cda;        /* virtual CPU address of CDA */
-        sonic_td_t tda[SONIC_NUM_TDS];  /* transmit descriptor area */
-        sonic_rr_t rra[SONIC_NUM_RRS];  /* receive resource area */
-        sonic_rd_t rda[SONIC_NUM_RDS];  /* receive descriptor area */
-        struct sk_buff *tx_skb[SONIC_NUM_TDS];  /* skbuffs for packets to transmit */
-        unsigned int tx_laddr[SONIC_NUM_TDS];   /* logical DMA address fro skbuffs */
-        unsigned char *rba;     /* start of receive buffer areas */
-        unsigned int cda_laddr; /* logical DMA address of CDA */
-        unsigned int tda_laddr; /* logical DMA address of TDA */
-        unsigned int rra_laddr; /* logical DMA address of RRA */
-        unsigned int rda_laddr; /* logical DMA address of RDA */
-        unsigned int rba_laddr; /* logical DMA address of RBA */
-        unsigned int cur_rra;   /* current indexes to resource areas */
+        /* Bus size.  0 == 16 bits, 1 == 32 bits. */
+        int dma_bitmode;
+        /* Register offset within the longword (independent of endianness,
+           and varies from one type of Macintosh SONIC to another
+           (Aarrgh)) */
+        int reg_offset;
+        void *descriptors;
+        /* Crud.  These areas have to be within the same 64K.  Therefore
+       we allocate a desriptors page, and point these to places within it. */
+        void *cda;  /* CAM descriptor area */
+        void *tda;  /* Transmit descriptor area */
+        void *rra;  /* Receive resource area */
+        void *rda;  /* Receive descriptor area */
+        struct sk_buff* volatile rx_skb[SONIC_NUM_RRS]; /* packets to be received */
+        struct sk_buff* volatile tx_skb[SONIC_NUM_TDS]; /* packets to be transmitted */
+        unsigned int tx_len[SONIC_NUM_TDS]; /* lengths of tx DMA mappings */
+        /* Logical DMA addresses on MIPS, bus addresses on m68k
+         * (so "laddr" is a bit misleading) */
+        dma_addr_t descriptors_laddr;
+        u32 cda_laddr;              /* logical DMA address of CDA */
+        u32 tda_laddr;              /* logical DMA address of TDA */
+        u32 rra_laddr;              /* logical DMA address of RRA */
+        u32 rda_laddr;              /* logical DMA address of RDA */
+        dma_addr_t rx_laddr[SONIC_NUM_RRS]; /* logical DMA addresses of rx skbuffs */
+        dma_addr_t tx_laddr[SONIC_NUM_TDS]; /* logical DMA addresses of tx skbuffs */
+        unsigned int rra_end;
+        unsigned int cur_rwp;
         unsigned int cur_rx;
-        unsigned int cur_tx;
-        unsigned int dirty_tx;  /* last unacked transmit packet */
-        char tx_full;
+        unsigned int cur_tx;           /* first unacked transmit packet */
+        unsigned int eol_rx;
+        unsigned int eol_tx;           /* last unacked transmit packet */
+        unsigned int next_tx;          /* next free TD */
+        struct device *device;         /* generic device */
         struct net_device_stats stats;
 };
 
-#define TX_TIMEOUT 6
+#define TX_TIMEOUT (3 * HZ)
 
 /* Index to functions, as function prototypes. */
 
@@ -477,6 +337,114 @@ static void sonic_multicast_list(struct net_device *dev);
 static int sonic_init(struct net_device *dev);
 static void sonic_tx_timeout(struct net_device *dev);
 
+/* Internal inlines for reading/writing DMA buffers.  Note that bus
+   size and endianness matter here, whereas they don't for registers,
+   as far as we can tell. */
+/* OpenBSD calls this "SWO".  I'd like to think that sonic_buf_put()
+   is a much better name. */
+static inline void sonic_buf_put(void* base, int bitmode,
+                                 int offset, __u16 val)
+{
+        if (bitmode)
+#ifdef __BIG_ENDIAN
+                ((__u16 *) base + (offset*2))[1] = val;
+#else
+                ((__u16 *) base + (offset*2))[0] = val;
+#endif
+        else
+                ((__u16 *) base)[offset] = val;
+}
+
+static inline __u16 sonic_buf_get(void* base, int bitmode,
+                                  int offset)
+{
+        if (bitmode)
+#ifdef __BIG_ENDIAN
+                return ((volatile __u16 *) base + (offset*2))[1];
+#else
+                return ((volatile __u16 *) base + (offset*2))[0];
+#endif
+        else
+                return ((volatile __u16 *) base)[offset];
+}
+
+/* Inlines that you should actually use for reading/writing DMA buffers */
+static inline void sonic_cda_put(struct net_device* dev, int entry,
+                                 int offset, __u16 val)
+{
+        struct sonic_local* lp = (struct sonic_local *) dev->priv;
+        sonic_buf_put(lp->cda, lp->dma_bitmode,
+                      (entry * SIZEOF_SONIC_CD) + offset, val);
+}
+
+static inline __u16 sonic_cda_get(struct net_device* dev, int entry,
+                                  int offset)
+{
+        struct sonic_local* lp = (struct sonic_local *) dev->priv;
+        return sonic_buf_get(lp->cda, lp->dma_bitmode,
+                             (entry * SIZEOF_SONIC_CD) + offset);
+}
+
+static inline void sonic_set_cam_enable(struct net_device* dev, __u16 val)
+{
+        struct sonic_local* lp = (struct sonic_local *) dev->priv;
+        sonic_buf_put(lp->cda, lp->dma_bitmode, SONIC_CDA_CAM_ENABLE, val);
+}
+
+static inline __u16 sonic_get_cam_enable(struct net_device* dev)
+{
+        struct sonic_local* lp = (struct sonic_local *) dev->priv;
+        return sonic_buf_get(lp->cda, lp->dma_bitmode, SONIC_CDA_CAM_ENABLE);
+}
+
+static inline void sonic_tda_put(struct net_device* dev, int entry,
+                                 int offset, __u16 val)
+{
+        struct sonic_local* lp = (struct sonic_local *) dev->priv;
+        sonic_buf_put(lp->tda, lp->dma_bitmode,
+                      (entry * SIZEOF_SONIC_TD) + offset, val);
+}
+
+static inline __u16 sonic_tda_get(struct net_device* dev, int entry,
+                                  int offset)
+{
+        struct sonic_local* lp = (struct sonic_local *) dev->priv;
+        return sonic_buf_get(lp->tda, lp->dma_bitmode,
+                             (entry * SIZEOF_SONIC_TD) + offset);
+}
+
+static inline void sonic_rda_put(struct net_device* dev, int entry,
+                                 int offset, __u16 val)
+{
+        struct sonic_local* lp = (struct sonic_local *) dev->priv;
+        sonic_buf_put(lp->rda, lp->dma_bitmode,
+                      (entry * SIZEOF_SONIC_RD) + offset, val);
+}
+
+static inline __u16 sonic_rda_get(struct net_device* dev, int entry,
+                                  int offset)
+{
+        struct sonic_local* lp = (struct sonic_local *) dev->priv;
+        return sonic_buf_get(lp->rda, lp->dma_bitmode,
+                             (entry * SIZEOF_SONIC_RD) + offset);
+}
+
+static inline void sonic_rra_put(struct net_device* dev, int entry,
+                                 int offset, __u16 val)
+{
+        struct sonic_local* lp = (struct sonic_local *) dev->priv;
+        sonic_buf_put(lp->rra, lp->dma_bitmode,
+                      (entry * SIZEOF_SONIC_RR) + offset, val);
+}
+
+static inline __u16 sonic_rra_get(struct net_device* dev, int entry,
+                                  int offset)
+{
+        struct sonic_local* lp = (struct sonic_local *) dev->priv;
+        return sonic_buf_get(lp->rra, lp->dma_bitmode,
+                             (entry * SIZEOF_SONIC_RR) + offset);
+}
+
 static const char *version =
     "sonic.c:v0.92 20.9.98 tsbogend@alpha.franken.de\n";
 
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 201a550f0bcc..af8263a1580e 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -66,8 +66,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.34"
-#define DRV_MODULE_RELDATE      "July 25, 2005"
+#define DRV_MODULE_VERSION      "3.37"
+#define DRV_MODULE_RELDATE      "August 25, 2005"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -340,41 +340,92 @@ static struct {
 
 static void tg3_write_indirect_reg32(struct tg3 *tp, u32 off, u32 val)
 {
-        if ((tp->tg3_flags & TG3_FLAG_PCIX_TARGET_HWBUG) != 0) {
-                spin_lock_bh(&tp->indirect_lock);
-                pci_write_config_dword(tp->pdev, TG3PCI_REG_BASE_ADDR, off);
-                pci_write_config_dword(tp->pdev, TG3PCI_REG_DATA, val);
-                spin_unlock_bh(&tp->indirect_lock);
-        } else {
-                writel(val, tp->regs + off);
-                if ((tp->tg3_flags & TG3_FLAG_5701_REG_WRITE_BUG) != 0)
-                        readl(tp->regs + off);
+        unsigned long flags;
+
+        spin_lock_irqsave(&tp->indirect_lock, flags);
+        pci_write_config_dword(tp->pdev, TG3PCI_REG_BASE_ADDR, off);
+        pci_write_config_dword(tp->pdev, TG3PCI_REG_DATA, val);
+        spin_unlock_irqrestore(&tp->indirect_lock, flags);
+}
+
+static void tg3_write_flush_reg32(struct tg3 *tp, u32 off, u32 val)
+{
+        writel(val, tp->regs + off);
+        readl(tp->regs + off);
+}
+
+static u32 tg3_read_indirect_reg32(struct tg3 *tp, u32 off)
+{
+        unsigned long flags;
+        u32 val;
+
+        spin_lock_irqsave(&tp->indirect_lock, flags);
+        pci_write_config_dword(tp->pdev, TG3PCI_REG_BASE_ADDR, off);
+        pci_read_config_dword(tp->pdev, TG3PCI_REG_DATA, &val);
+        spin_unlock_irqrestore(&tp->indirect_lock, flags);
+        return val;
+}
+
+static void tg3_write_indirect_mbox(struct tg3 *tp, u32 off, u32 val)
+{
+        unsigned long flags;
+
+        if (off == (MAILBOX_RCVRET_CON_IDX_0 + TG3_64BIT_REG_LOW)) {
+                pci_write_config_dword(tp->pdev, TG3PCI_RCV_RET_RING_CON_IDX +
+                                       TG3_64BIT_REG_LOW, val);
+                return;
         }
+        if (off == (MAILBOX_RCV_STD_PROD_IDX + TG3_64BIT_REG_LOW)) {
+                pci_write_config_dword(tp->pdev, TG3PCI_STD_RING_PROD_IDX +
+                                       TG3_64BIT_REG_LOW, val);
+                return;
+        }
+
+        spin_lock_irqsave(&tp->indirect_lock, flags);
+        pci_write_config_dword(tp->pdev, TG3PCI_REG_BASE_ADDR, off + 0x5600);
+        pci_write_config_dword(tp->pdev, TG3PCI_REG_DATA, val);
+        spin_unlock_irqrestore(&tp->indirect_lock, flags);
+
+        /* In indirect mode when disabling interrupts, we also need
+         * to clear the interrupt bit in the GRC local ctrl register.
+         */
+        if ((off == (MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW)) &&
+            (val == 0x1)) {
+                pci_write_config_dword(tp->pdev, TG3PCI_MISC_LOCAL_CTRL,
+                                       tp->grc_local_ctrl|GRC_LCLCTRL_CLEARINT);
+        }
+}
+
+static u32 tg3_read_indirect_mbox(struct tg3 *tp, u32 off)
+{
+        unsigned long flags;
+        u32 val;
+
+        spin_lock_irqsave(&tp->indirect_lock, flags);
+        pci_write_config_dword(tp->pdev, TG3PCI_REG_BASE_ADDR, off + 0x5600);
+        pci_read_config_dword(tp->pdev, TG3PCI_REG_DATA, &val);
+        spin_unlock_irqrestore(&tp->indirect_lock, flags);
+        return val;
 }
 
 static void _tw32_flush(struct tg3 *tp, u32 off, u32 val)
 {
-        if ((tp->tg3_flags & TG3_FLAG_PCIX_TARGET_HWBUG) != 0) {
-                spin_lock_bh(&tp->indirect_lock);
-                pci_write_config_dword(tp->pdev, TG3PCI_REG_BASE_ADDR, off);
-                pci_write_config_dword(tp->pdev, TG3PCI_REG_DATA, val);
-                spin_unlock_bh(&tp->indirect_lock);
-        } else {
-                void __iomem *dest = tp->regs + off;
-                writel(val, dest);
-                readl(dest);    /* always flush PCI write */
-        }
+        tp->write32(tp, off, val);
+        if (!(tp->tg3_flags & TG3_FLAG_PCIX_TARGET_HWBUG) &&
+            !(tp->tg3_flags & TG3_FLAG_5701_REG_WRITE_BUG) &&
+            !(tp->tg3_flags2 & TG3_FLG2_ICH_WORKAROUND))
+                tp->read32(tp, off);    /* flush */
 }
 
-static inline void _tw32_rx_mbox(struct tg3 *tp, u32 off, u32 val)
+static inline void tw32_mailbox_flush(struct tg3 *tp, u32 off, u32 val)
 {
-        void __iomem *mbox = tp->regs + off;
-        writel(val, mbox);
-        if (tp->tg3_flags & TG3_FLAG_MBOX_WRITE_REORDER)
-                readl(mbox);
+        tp->write32_mbox(tp, off, val);
+        if (!(tp->tg3_flags & TG3_FLAG_MBOX_WRITE_REORDER) &&
+            !(tp->tg3_flags2 & TG3_FLG2_ICH_WORKAROUND))
+                tp->read32_mbox(tp, off);
 }
 
-static inline void _tw32_tx_mbox(struct tg3 *tp, u32 off, u32 val)
+static void tg3_write32_tx_mbox(struct tg3 *tp, u32 off, u32 val)
 {
         void __iomem *mbox = tp->regs + off;
         writel(val, mbox);
@@ -384,46 +435,57 @@ static inline void _tw32_tx_mbox(struct tg3 *tp, u32 off, u32 val)
                 readl(mbox);
 }
 
-#define tw32_mailbox(reg, val)  writel(((val) & 0xffffffff), tp->regs + (reg))
-#define tw32_rx_mbox(reg, val)  _tw32_rx_mbox(tp, reg, val)
-#define tw32_tx_mbox(reg, val)  _tw32_tx_mbox(tp, reg, val)
+static void tg3_write32(struct tg3 *tp, u32 off, u32 val)
+{
+        writel(val, tp->regs + off);
+}
+
+static u32 tg3_read32(struct tg3 *tp, u32 off)
+{
+        return (readl(tp->regs + off)); 
+}
+
+#define tw32_mailbox(reg, val)  tp->write32_mbox(tp, reg, val)
+#define tw32_mailbox_f(reg, val)        tw32_mailbox_flush(tp, (reg), (val))
+#define tw32_rx_mbox(reg, val)  tp->write32_rx_mbox(tp, reg, val)
+#define tw32_tx_mbox(reg, val)  tp->write32_tx_mbox(tp, reg, val)
+#define tr32_mailbox(reg)       tp->read32_mbox(tp, reg)
 
-#define tw32(reg,val)           tg3_write_indirect_reg32(tp,(reg),(val))
+#define tw32(reg,val)           tp->write32(tp, reg, val)
 #define tw32_f(reg,val)         _tw32_flush(tp,(reg),(val))
-#define tw16(reg,val)           writew(((val) & 0xffff), tp->regs + (reg))
-#define tw8(reg,val)            writeb(((val) & 0xff), tp->regs + (reg))
-#define tr32(reg)               readl(tp->regs + (reg))
-#define tr16(reg)               readw(tp->regs + (reg))
-#define tr8(reg)                readb(tp->regs + (reg))
+#define tr32(reg)               tp->read32(tp, reg)
 
 static void tg3_write_mem(struct tg3 *tp, u32 off, u32 val)
 {
-        spin_lock_bh(&tp->indirect_lock);
+        unsigned long flags;
+
+        spin_lock_irqsave(&tp->indirect_lock, flags);
         pci_write_config_dword(tp->pdev, TG3PCI_MEM_WIN_BASE_ADDR, off);
         pci_write_config_dword(tp->pdev, TG3PCI_MEM_WIN_DATA, val);
 
         /* Always leave this as zero. */
         pci_write_config_dword(tp->pdev, TG3PCI_MEM_WIN_BASE_ADDR, 0);
-        spin_unlock_bh(&tp->indirect_lock);
+        spin_unlock_irqrestore(&tp->indirect_lock, flags);
 }
 
 static void tg3_read_mem(struct tg3 *tp, u32 off, u32 *val)
 {
-        spin_lock_bh(&tp->indirect_lock);
+        unsigned long flags;
+
+        spin_lock_irqsave(&tp->indirect_lock, flags);
         pci_write_config_dword(tp->pdev, TG3PCI_MEM_WIN_BASE_ADDR, off);
         pci_read_config_dword(tp->pdev, TG3PCI_MEM_WIN_DATA, val);
 
         /* Always leave this as zero. */
         pci_write_config_dword(tp->pdev, TG3PCI_MEM_WIN_BASE_ADDR, 0);
-        spin_unlock_bh(&tp->indirect_lock);
+        spin_unlock_irqrestore(&tp->indirect_lock, flags);
 }
 
 static void tg3_disable_ints(struct tg3 *tp)
 {
         tw32(TG3PCI_MISC_HOST_CTRL,
              (tp->misc_host_ctrl | MISC_HOST_CTRL_MASK_PCI_INT));
-        tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW, 0x00000001);
-        tr32(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW);
+        tw32_mailbox_f(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW, 0x00000001);
 }
 
 static inline void tg3_cond_int(struct tg3 *tp)
@@ -439,9 +501,8 @@ static void tg3_enable_ints(struct tg3 *tp)
 
         tw32(TG3PCI_MISC_HOST_CTRL,
              (tp->misc_host_ctrl & ~MISC_HOST_CTRL_MASK_PCI_INT));
-        tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
-                     (tp->last_tag << 24));
-        tr32(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW);
+        tw32_mailbox_f(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
+                       (tp->last_tag << 24));
         tg3_cond_int(tp);
 }
 
@@ -472,8 +533,6 @@ static inline unsigned int tg3_has_work(struct tg3 *tp)
  */
 static void tg3_restart_ints(struct tg3 *tp)
 {
-        tw32(TG3PCI_MISC_HOST_CTRL,
-                (tp->misc_host_ctrl & ~MISC_HOST_CTRL_MASK_PCI_INT));
         tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
                      tp->last_tag << 24);
         mmiowb();
@@ -3278,9 +3337,8 @@ static irqreturn_t tg3_interrupt(int irq, void *dev_id, struct pt_regs *regs)
                         /* No work, shared interrupt perhaps?  re-enable
                          * interrupts, and flush that PCI write
                          */
-                        tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
+                        tw32_mailbox_f(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
                                 0x00000000);
-                        tr32(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW);
                 }
         } else {        /* shared interrupt */
                 handled = 0;
@@ -3323,9 +3381,8 @@ static irqreturn_t tg3_interrupt_tagged(int irq, void *dev_id, struct pt_regs *r
                         /* no work, shared interrupt perhaps?  re-enable
                          * interrupts, and flush that PCI write
                          */
-                        tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
-                                     tp->last_tag << 24);
-                        tr32(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW);
+                        tw32_mailbox_f(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
+                                       tp->last_tag << 24);
                 }
         } else {        /* shared interrupt */
                 handled = 0;
@@ -4216,7 +4273,7 @@ static void tg3_stop_fw(struct tg3 *);
 static int tg3_chip_reset(struct tg3 *tp)
 {
         u32 val;
-        u32 flags_save;
+        void (*write_op)(struct tg3 *, u32, u32);
         int i;
 
         if (!(tp->tg3_flags2 & TG3_FLG2_SUN_570X))
@@ -4228,8 +4285,9 @@ static int tg3_chip_reset(struct tg3 *tp)
          * fun things.  So, temporarily disable the 5701
          * hardware workaround, while we do the reset.
          */
-        flags_save = tp->tg3_flags;
-        tp->tg3_flags &= ~TG3_FLAG_5701_REG_WRITE_BUG;
+        write_op = tp->write32;
+        if (write_op == tg3_write_flush_reg32)
+                tp->write32 = tg3_write32;
 
         /* do the reset */
         val = GRC_MISC_CFG_CORECLK_RESET;
@@ -4248,8 +4306,8 @@ static int tg3_chip_reset(struct tg3 *tp)
                 val |= GRC_MISC_CFG_KEEP_GPHY_POWER;
         tw32(GRC_MISC_CFG, val);
 
-        /* restore 5701 hardware bug workaround flag */
-        tp->tg3_flags = flags_save;
+        /* restore 5701 hardware bug workaround write method */
+        tp->write32 = write_op;
 
         /* Unfortunately, we have to delay before the PCI read back.
          * Some 575X chips even will not respond to a PCI cfg access
@@ -4635,7 +4693,6 @@ static int tg3_load_firmware_cpu(struct tg3 *tp, u32 cpu_base, u32 cpu_scratch_b
                                  int cpu_scratch_size, struct fw_info *info)
 {
         int err, i;
-        u32 orig_tg3_flags = tp->tg3_flags;
         void (*write_op)(struct tg3 *, u32, u32);
 
         if (cpu_base == TX_CPU_BASE &&
@@ -4651,11 +4708,6 @@ static int tg3_load_firmware_cpu(struct tg3 *tp, u32 cpu_base, u32 cpu_scratch_b
         else
                 write_op = tg3_write_indirect_reg32;
 
-        /* Force use of PCI config space for indirect register
-         * write calls.
-         */
-        tp->tg3_flags |= TG3_FLAG_PCIX_TARGET_HWBUG;
-
         /* It is possible that bootcode is still loading at this point.
          * Get the nvram lock first before halting the cpu.
          */
@@ -4691,7 +4743,6 @@ static int tg3_load_firmware_cpu(struct tg3 *tp, u32 cpu_base, u32 cpu_scratch_b
         err = 0;
 
 out:
-        tp->tg3_flags = orig_tg3_flags;
         return err;
 }
 
@@ -5808,8 +5859,7 @@ static int tg3_reset_hw(struct tg3 *tp)
         tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl);
         udelay(100);
 
-        tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW, 0);
-        tr32(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW);
+        tw32_mailbox_f(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW, 0);
         tp->last_tag = 0;
 
         if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS)) {
@@ -6198,7 +6248,8 @@ static int tg3_test_interrupt(struct tg3 *tp)
                HOSTCC_MODE_NOW);
 
         for (i = 0; i < 5; i++) {
-                int_mbox = tr32(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW);
+                int_mbox = tr32_mailbox(MAILBOX_INTERRUPT_0 +
+                                        TG3_64BIT_REG_LOW);
                 if (int_mbox != 0)
                         break;
                 msleep(10);
@@ -6598,10 +6649,10 @@ static int tg3_open(struct net_device *dev)
 
         /* Mailboxes */
         printk("DEBUG: SNDHOST_PROD[%08x%08x] SNDNIC_PROD[%08x%08x]\n",
-               tr32(MAILBOX_SNDHOST_PROD_IDX_0 + 0x0),
-               tr32(MAILBOX_SNDHOST_PROD_IDX_0 + 0x4),
-               tr32(MAILBOX_SNDNIC_PROD_IDX_0 + 0x0),
-               tr32(MAILBOX_SNDNIC_PROD_IDX_0 + 0x4));
+               tr32_mailbox(MAILBOX_SNDHOST_PROD_IDX_0 + 0x0),
+               tr32_mailbox(MAILBOX_SNDHOST_PROD_IDX_0 + 0x4),
+               tr32_mailbox(MAILBOX_SNDNIC_PROD_IDX_0 + 0x0),
+               tr32_mailbox(MAILBOX_SNDNIC_PROD_IDX_0 + 0x4));
 
         /* NIC side send descriptors. */
         for (i = 0; i < 6; i++) {
@@ -7865,8 +7916,6 @@ static int tg3_test_loopback(struct tg3 *tp)
 
         err = -EIO;
 
-        tg3_abort_hw(tp, 1);
-
         tg3_reset_hw(tp);
 
         mac_mode = (tp->mac_mode & ~MAC_MODE_PORT_MODE_MASK) |
@@ -7903,7 +7952,7 @@ static int tg3_test_loopback(struct tg3 *tp)
         num_pkts++;
 
         tw32_tx_mbox(MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW, send_idx);
-        tr32(MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW);
+        tr32_mailbox(MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW);
 
         udelay(10);
 
@@ -8970,6 +9019,8 @@ static int __devinit tg3_phy_probe(struct tg3 *tp)
                 tp->phy_id = hw_phy_id;
                 if (hw_phy_id_masked == PHY_ID_BCM8002)
                         tp->tg3_flags2 |= TG3_FLG2_PHY_SERDES;
+                else
+                        tp->tg3_flags2 &= ~TG3_FLG2_PHY_SERDES;
         } else {
                 if (tp->phy_id != PHY_ID_INVALID) {
                         /* Do nothing, phy ID already set up in
@@ -9153,14 +9204,6 @@ static int __devinit tg3_is_sun_570X(struct tg3 *tp)
 static int __devinit tg3_get_invariants(struct tg3 *tp)
 {
         static struct pci_device_id write_reorder_chipsets[] = {
-                { PCI_DEVICE(PCI_VENDOR_ID_INTEL,
-                             PCI_DEVICE_ID_INTEL_82801AA_8) },
-                { PCI_DEVICE(PCI_VENDOR_ID_INTEL,
-                             PCI_DEVICE_ID_INTEL_82801AB_8) },
-                { PCI_DEVICE(PCI_VENDOR_ID_INTEL,
-                             PCI_DEVICE_ID_INTEL_82801BA_11) },
-                { PCI_DEVICE(PCI_VENDOR_ID_INTEL,
-                             PCI_DEVICE_ID_INTEL_82801BA_6) },
                 { PCI_DEVICE(PCI_VENDOR_ID_AMD,
                              PCI_DEVICE_ID_AMD_FE_GATE_700C) },
                 { },
@@ -9177,7 +9220,7 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
                 tp->tg3_flags2 |= TG3_FLG2_SUN_570X;
 #endif
 
-        /* If we have an AMD 762 or Intel ICH/ICH0/ICH2 chipset, write
+        /* If we have an AMD 762 chipset, write
          * reordering to the mailbox registers done by the host
          * controller can cause major troubles.  We read back from
          * every mailbox register write to force the writes to be
@@ -9215,6 +9258,69 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         if (tp->pci_chip_rev_id == CHIPREV_ID_5752_A0_HW)
                 tp->pci_chip_rev_id = CHIPREV_ID_5752_A0;
 
+        /* If we have 5702/03 A1 or A2 on certain ICH chipsets,
+         * we need to disable memory and use config. cycles
+         * only to access all registers. The 5702/03 chips
+         * can mistakenly decode the special cycles from the
+         * ICH chipsets as memory write cycles, causing corruption
+         * of register and memory space. Only certain ICH bridges
+         * will drive special cycles with non-zero data during the
+         * address phase which can fall within the 5703's address
+         * range. This is not an ICH bug as the PCI spec allows
+         * non-zero address during special cycles. However, only
+         * these ICH bridges are known to drive non-zero addresses
+         * during special cycles.
+         *
+         * Since special cycles do not cross PCI bridges, we only
+         * enable this workaround if the 5703 is on the secondary
+         * bus of these ICH bridges.
+         */
+        if ((tp->pci_chip_rev_id == CHIPREV_ID_5703_A1) ||
+            (tp->pci_chip_rev_id == CHIPREV_ID_5703_A2)) {
+                static struct tg3_dev_id {
+                        u32     vendor;
+                        u32     device;
+                        u32     rev;
+                } ich_chipsets[] = {
+                        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801AA_8,
+                          PCI_ANY_ID },
+                        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801AB_8,
+                          PCI_ANY_ID },
+                        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801BA_11,
+                          0xa },
+                        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801BA_6,
+                          PCI_ANY_ID },
+                        { },
+                };
+                struct tg3_dev_id *pci_id = &ich_chipsets[0];
+                struct pci_dev *bridge = NULL;
+
+                while (pci_id->vendor != 0) {
+                        bridge = pci_get_device(pci_id->vendor, pci_id->device,
+                                                bridge);
+                        if (!bridge) {
+                                pci_id++;
+                                continue;
+                        }
+                        if (pci_id->rev != PCI_ANY_ID) {
+                                u8 rev;
+
+                                pci_read_config_byte(bridge, PCI_REVISION_ID,
+                                                     &rev);
+                                if (rev > pci_id->rev)
+                                        continue;
+                        }
+                        if (bridge->subordinate &&
+                            (bridge->subordinate->number ==
+                             tp->pdev->bus->number)) {
+
+                                tp->tg3_flags2 |= TG3_FLG2_ICH_WORKAROUND;
+                                pci_dev_put(bridge);
+                                break;
+                        }
+                }
+        }
+
         /* Find msi capability. */
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5780)
                 tp->msi_cap = pci_find_capability(tp->pdev, PCI_CAP_ID_MSI);
@@ -9302,6 +9408,12 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
                 }
         }
 
+        /* 5700 BX chips need to have their TX producer index mailboxes
+         * written twice to workaround a bug.
+         */
+        if (GET_CHIP_REV(tp->pci_chip_rev_id) == CHIPREV_5700_BX)
+                tp->tg3_flags |= TG3_FLAG_TXD_MBOX_HWBUG;
+
         /* Back to back register writes can cause problems on this chip,
          * the workaround is to read back all reg writes except those to
          * mailbox regs.  See tg3_write_indirect_reg32().
@@ -9325,6 +9437,43 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
                 pci_write_config_dword(tp->pdev, TG3PCI_PCISTATE, pci_state_reg);
         }
 
+        /* Default fast path register access methods */
+        tp->read32 = tg3_read32;
+        tp->write32 = tg3_write32;
+        tp->read32_mbox = tg3_read32;
+        tp->write32_mbox = tg3_write32;
+        tp->write32_tx_mbox = tg3_write32;
+        tp->write32_rx_mbox = tg3_write32;
+
+        /* Various workaround register access methods */
+        if (tp->tg3_flags & TG3_FLAG_PCIX_TARGET_HWBUG)
+                tp->write32 = tg3_write_indirect_reg32;
+        else if (tp->tg3_flags & TG3_FLAG_5701_REG_WRITE_BUG)
+                tp->write32 = tg3_write_flush_reg32;
+
+        if ((tp->tg3_flags & TG3_FLAG_TXD_MBOX_HWBUG) ||
+            (tp->tg3_flags & TG3_FLAG_MBOX_WRITE_REORDER)) {
+                tp->write32_tx_mbox = tg3_write32_tx_mbox;
+                if (tp->tg3_flags & TG3_FLAG_MBOX_WRITE_REORDER)
+                        tp->write32_rx_mbox = tg3_write_flush_reg32;
+        }
+
+        if (tp->tg3_flags2 & TG3_FLG2_ICH_WORKAROUND) {
+                tp->read32 = tg3_read_indirect_reg32;
+                tp->write32 = tg3_write_indirect_reg32;
+                tp->read32_mbox = tg3_read_indirect_mbox;
+                tp->write32_mbox = tg3_write_indirect_mbox;
+                tp->write32_tx_mbox = tg3_write_indirect_mbox;
+                tp->write32_rx_mbox = tg3_write_indirect_mbox;
+
+                iounmap(tp->regs);
+                tp->regs = 0;
+
+                pci_read_config_word(tp->pdev, PCI_COMMAND, &pci_cmd);
+                pci_cmd &= ~PCI_COMMAND_MEMORY;
+                pci_write_config_word(tp->pdev, PCI_COMMAND, pci_cmd);
+        }
+
         /* Get eeprom hw config before calling tg3_set_power_state().
          * In particular, the TG3_FLAG_EEPROM_WRITE_PROT flag must be
          * determined before calling tg3_set_power_state() so that
@@ -9539,14 +9688,6 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         else
                 tp->tg3_flags &= ~TG3_FLAG_POLL_SERDES;
 
-        /* 5700 BX chips need to have their TX producer index mailboxes
-         * written twice to workaround a bug.
-         */
-        if (GET_CHIP_REV(tp->pci_chip_rev_id) == CHIPREV_5700_BX)
-                tp->tg3_flags |= TG3_FLAG_TXD_MBOX_HWBUG;
-        else
-                tp->tg3_flags &= ~TG3_FLAG_TXD_MBOX_HWBUG;
-
         /* It seems all chips can get confused if TX buffers
          * straddle the 4GB address boundary in some cases.
          */
@@ -10421,6 +10562,12 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
 
         tg3_init_coal(tp);
 
+        /* Now that we have fully setup the chip, save away a snapshot
+         * of the PCI config space.  We need to restore this after
+         * GRC_MISC_CFG core clock resets and some resume events.
+         */
+        pci_save_state(tp->pdev);
+
         err = register_netdev(dev);
         if (err) {
                 printk(KERN_ERR PFX "Cannot register net device, "
@@ -10430,12 +10577,6 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
 
         pci_set_drvdata(pdev, dev);
 
-        /* Now that we have fully setup the chip, save away a snapshot
-         * of the PCI config space.  We need to restore this after
-         * GRC_MISC_CFG core clock resets and some resume events.
-         */
-        pci_save_state(tp->pdev);
-
         printk(KERN_INFO "%s: Tigon3 [partno(%s) rev %04x PHY(%s)] (PCI%s:%s:%s) %sBaseT Ethernet ",
                dev->name,
                tp->board_part_number,
@@ -10469,7 +10610,10 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
         return 0;
 
 err_out_iounmap:
-        iounmap(tp->regs);
+        if (tp->regs) {
+                iounmap(tp->regs);
+                tp->regs = 0;
+        }
 
 err_out_free_dev:
         free_netdev(dev);
@@ -10491,7 +10635,10 @@ static void __devexit tg3_remove_one(struct pci_dev *pdev)
                 struct tg3 *tp = netdev_priv(dev);
 
                 unregister_netdev(dev);
-                iounmap(tp->regs);
+                if (tp->regs) {
+                        iounmap(tp->regs);
+                        tp->regs = 0;
+                }
                 free_netdev(dev);
                 pci_release_regions(pdev);
                 pci_disable_device(pdev);
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index 5c4433c147fa..c184b773e585 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2049,6 +2049,11 @@ struct tg3 {
         spinlock_t                      lock;
         spinlock_t                      indirect_lock;
 
+        u32                             (*read32) (struct tg3 *, u32);
+        void                            (*write32) (struct tg3 *, u32, u32);
+        u32                             (*read32_mbox) (struct tg3 *, u32);
+        void                            (*write32_mbox) (struct tg3 *, u32,
+                                                         u32);
         void __iomem                    *regs;
         struct net_device               *dev;
         struct pci_dev                  *pdev;
@@ -2060,6 +2065,8 @@ struct tg3 {
         u32                             msg_enable;
 
         /* begin "tx thread" cacheline section */
+        void                            (*write32_tx_mbox) (struct tg3 *, u32,
+                                                            u32);
         u32                             tx_prod;
         u32                             tx_cons;
         u32                             tx_pending;
@@ -2071,6 +2078,8 @@ struct tg3 {
         dma_addr_t                      tx_desc_mapping;
 
         /* begin "rx thread" cacheline section */
+        void                            (*write32_rx_mbox) (struct tg3 *, u32,
+                                                            u32);
         u32                             rx_rcb_ptr;
         u32                             rx_std_ptr;
         u32                             rx_jumbo_ptr;
@@ -2165,6 +2174,7 @@ struct tg3 {
 #define TG3_FLG2_ANY_SERDES             (TG3_FLG2_PHY_SERDES |  \
                                         TG3_FLG2_MII_SERDES)
 #define TG3_FLG2_PARALLEL_DETECT        0x01000000
+#define TG3_FLG2_ICH_WORKAROUND         0x02000000
 
         u32                             split_mode_max_reqs;
 #define SPLIT_MODE_5704_MAX_REQ         3
diff --git a/drivers/net/tokenring/Kconfig b/drivers/net/tokenring/Kconfig
index 23d0fa4bbceb..e4cfc80b283b 100644
--- a/drivers/net/tokenring/Kconfig
+++ b/drivers/net/tokenring/Kconfig
@@ -84,7 +84,7 @@ config 3C359
 
 config TMS380TR
         tristate "Generic TMS380 Token Ring ISA/PCI adapter support"
-        depends on TR && (PCI || ISA)
+        depends on TR && (PCI || ISA && ISA_DMA_API || MCA)
         select FW_LOADER
         ---help---
           This driver provides generic support for token ring adapters
@@ -158,7 +158,7 @@ config ABYSS
 
 config MADGEMC
         tristate "Madge Smart 16/4 Ringnode MicroChannel"
-        depends on TR && TMS380TR && MCA_LEGACY
+        depends on TR && TMS380TR && MCA
         help
           This tms380 module supports the Madge Smart 16/4 MC16 and MC32
           MicroChannel adapters.
diff --git a/drivers/net/tokenring/abyss.c b/drivers/net/tokenring/abyss.c
index 87103c400999..9345e68c451e 100644
--- a/drivers/net/tokenring/abyss.c
+++ b/drivers/net/tokenring/abyss.c
@@ -139,7 +139,7 @@ static int __devinit abyss_attach(struct pci_dev *pdev, const struct pci_device_
          */
         dev->base_addr += 0x10;
                 
-        ret = tmsdev_init(dev, PCI_MAX_ADDRESS, pdev);
+        ret = tmsdev_init(dev, &pdev->dev);
         if (ret) {
                 printk("%s: unable to get memory for dev->priv.\n", 
                        dev->name);
diff --git a/drivers/net/tokenring/madgemc.c b/drivers/net/tokenring/madgemc.c
index 659cbdbef7f3..3a25d191ea4a 100644
--- a/drivers/net/tokenring/madgemc.c
+++ b/drivers/net/tokenring/madgemc.c
@@ -20,7 +20,7 @@
 static const char version[] = "madgemc.c: v0.91 23/01/2000 by Adam Fritzler\n";
 
 #include <linux/module.h>
-#include <linux/mca-legacy.h>
+#include <linux/mca.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/pci.h>
@@ -38,9 +38,7 @@ static const char version[] = "madgemc.c: v0.91 23/01/2000 by Adam Fritzler\n";
 #define MADGEMC_IO_EXTENT 32
 #define MADGEMC_SIF_OFFSET 0x08
 
-struct madgemc_card {
-        struct net_device *dev;
-
+struct card_info {
         /*
          * These are read from the BIA ROM.
          */
@@ -57,16 +55,12 @@ struct madgemc_card {
         unsigned int arblevel:4;
         unsigned int ringspeed:2; /* 0 = 4mb, 1 = 16, 2 = Auto/none */
         unsigned int cabletype:1; /* 0 = RJ45, 1 = DB9 */
-
-        struct madgemc_card *next;
 };
-static struct madgemc_card *madgemc_card_list;
-
 
 static int madgemc_open(struct net_device *dev);
 static int madgemc_close(struct net_device *dev);
 static int madgemc_chipset_init(struct net_device *dev);
-static void madgemc_read_rom(struct madgemc_card *card);
+static void madgemc_read_rom(struct net_device *dev, struct card_info *card);
 static unsigned short madgemc_setnselout_pins(struct net_device *dev);
 static void madgemc_setcabletype(struct net_device *dev, int type);
 
@@ -151,261 +145,237 @@ static void madgemc_sifwritew(struct net_device *dev, unsigned short val, unsign
 
 
 
-static int __init madgemc_probe(void)
+static int __devinit madgemc_probe(struct device *device)
 {       
         static int versionprinted;
         struct net_device *dev;
         struct net_local *tp;
-        struct madgemc_card *card;
-        int i,slot = 0;
-        __u8 posreg[4];
-
-        if (!MCA_bus)
-                return -1;      
- 
-        while (slot != MCA_NOTFOUND) {
-                /*
-                 * Currently we only support the MC16/32 (MCA ID 002d)
-                 */
-                slot = mca_find_unused_adapter(0x002d, slot);
-                if (slot == MCA_NOTFOUND)
-                        break;
-
-                /*
-                 * If we get here, we have an adapter.
-                 */
-                if (versionprinted++ == 0)
-                        printk("%s", version);
-
-                dev = alloc_trdev(sizeof(struct net_local));
-                if (dev == NULL) {
-                        printk("madgemc: unable to allocate dev space\n");
-                        if (madgemc_card_list)
-                                return 0;
-                        return -1;
-                }
+        struct card_info *card;
+        struct mca_device *mdev = to_mca_device(device);
+        int ret = 0, i = 0;
+
+        if (versionprinted++ == 0)
+                printk("%s", version);
+
+        if(mca_device_claimed(mdev))
+                return -EBUSY;
+        mca_device_set_claim(mdev, 1);
+
+        dev = alloc_trdev(sizeof(struct net_local));
+        if (!dev) {
+                printk("madgemc: unable to allocate dev space\n");
+                mca_device_set_claim(mdev, 0);
+                ret = -ENOMEM;
+                goto getout;
+        }
 
-                SET_MODULE_OWNER(dev);
-                dev->dma = 0;
+        SET_MODULE_OWNER(dev);
+        dev->dma = 0;
 
-                /*
-                 * Fetch MCA config registers
-                 */
-                for(i=0;i<4;i++)
-                        posreg[i] = mca_read_stored_pos(slot, i+2);
-                
-                card = kmalloc(sizeof(struct madgemc_card), GFP_KERNEL);
-                if (card==NULL) {
-                        printk("madgemc: unable to allocate card struct\n");
-                        free_netdev(dev);
-                        if (madgemc_card_list)
-                                return 0;
-                        return -1;
-                }
-                card->dev = dev;
-
-                /*
-                 * Parse configuration information.  This all comes
-                 * directly from the publicly available @002d.ADF.
-                 * Get it from Madge or your local ADF library.
-                 */
-
-                /*
-                 * Base address 
-                 */
-                dev->base_addr = 0x0a20 + 
-                        ((posreg[2] & MC16_POS2_ADDR2)?0x0400:0) +
-                        ((posreg[0] & MC16_POS0_ADDR1)?0x1000:0) +
-                        ((posreg[3] & MC16_POS3_ADDR3)?0x2000:0);
-
-                /*
-                 * Interrupt line
-                 */
-                switch(posreg[0] >> 6) { /* upper two bits */
+        card = kmalloc(sizeof(struct card_info), GFP_KERNEL);
+        if (card==NULL) {
+                printk("madgemc: unable to allocate card struct\n");
+                ret = -ENOMEM;
+                goto getout1;
+        }
+
+        /*
+         * Parse configuration information.  This all comes
+         * directly from the publicly available @002d.ADF.
+         * Get it from Madge or your local ADF library.
+         */
+
+        /*
+         * Base address 
+         */
+        dev->base_addr = 0x0a20 + 
+                ((mdev->pos[2] & MC16_POS2_ADDR2)?0x0400:0) +
+                ((mdev->pos[0] & MC16_POS0_ADDR1)?0x1000:0) +
+                ((mdev->pos[3] & MC16_POS3_ADDR3)?0x2000:0);
+
+        /*
+         * Interrupt line
+         */
+        switch(mdev->pos[0] >> 6) { /* upper two bits */
                 case 0x1: dev->irq = 3; break;
                 case 0x2: dev->irq = 9; break; /* IRQ 2 = IRQ 9 */
                 case 0x3: dev->irq = 10; break;
                 default: dev->irq = 0; break;
-                }
+        }
 
-                if (dev->irq == 0) {
-                        printk("%s: invalid IRQ\n", dev->name);
-                        goto getout1;
-                }
+        if (dev->irq == 0) {
+                printk("%s: invalid IRQ\n", dev->name);
+                ret = -EBUSY;
+                goto getout2;
+        }
 
-                if (!request_region(dev->base_addr, MADGEMC_IO_EXTENT, 
-                                   "madgemc")) {
-                        printk(KERN_INFO "madgemc: unable to setup Smart MC in slot %d because of I/O base conflict at 0x%04lx\n", slot, dev->base_addr);
-                        dev->base_addr += MADGEMC_SIF_OFFSET;
-                        goto getout1;
-                }
+        if (!request_region(dev->base_addr, MADGEMC_IO_EXTENT, 
+                           "madgemc")) {
+                printk(KERN_INFO "madgemc: unable to setup Smart MC in slot %d because of I/O base conflict at 0x%04lx\n", mdev->slot, dev->base_addr);
                 dev->base_addr += MADGEMC_SIF_OFFSET;
+                ret = -EBUSY;
+                goto getout2;
+        }
+        dev->base_addr += MADGEMC_SIF_OFFSET;
+        
+        /*
+         * Arbitration Level
+         */
+        card->arblevel = ((mdev->pos[0] >> 1) & 0x7) + 8;
+
+        /*
+         * Burst mode and Fairness
+         */
+        card->burstmode = ((mdev->pos[2] >> 6) & 0x3);
+        card->fairness = ((mdev->pos[2] >> 4) & 0x1);
+
+        /*
+         * Ring Speed
+         */
+        if ((mdev->pos[1] >> 2)&0x1)
+                card->ringspeed = 2; /* not selected */
+        else if ((mdev->pos[2] >> 5) & 0x1)
+                card->ringspeed = 1; /* 16Mb */
+        else
+                card->ringspeed = 0; /* 4Mb */
+
+        /* 
+         * Cable type
+         */
+        if ((mdev->pos[1] >> 6)&0x1)
+                card->cabletype = 1; /* STP/DB9 */
+        else
+                card->cabletype = 0; /* UTP/RJ-45 */
+
+
+        /* 
+         * ROM Info. This requires us to actually twiddle
+         * bits on the card, so we must ensure above that 
+         * the base address is free of conflict (request_region above).
+         */
+        madgemc_read_rom(dev, card);
                 
-                /*
-                 * Arbitration Level
-                 */
-                card->arblevel = ((posreg[0] >> 1) & 0x7) + 8;
-
-                /*
-                 * Burst mode and Fairness
-                 */
-                card->burstmode = ((posreg[2] >> 6) & 0x3);
-                card->fairness = ((posreg[2] >> 4) & 0x1);
-
-                /*
-                 * Ring Speed
-                 */
-                if ((posreg[1] >> 2)&0x1)
-                        card->ringspeed = 2; /* not selected */
-                else if ((posreg[2] >> 5) & 0x1)
-                        card->ringspeed = 1; /* 16Mb */
-                else
-                        card->ringspeed = 0; /* 4Mb */
-
-                /* 
-                 * Cable type
-                 */
-                if ((posreg[1] >> 6)&0x1)
-                        card->cabletype = 1; /* STP/DB9 */
-                else
-                        card->cabletype = 0; /* UTP/RJ-45 */
-
-
-                /* 
-                 * ROM Info. This requires us to actually twiddle
-                 * bits on the card, so we must ensure above that 
-                 * the base address is free of conflict (request_region above).
-                 */
-                madgemc_read_rom(card);
-                
-                if (card->manid != 0x4d) { /* something went wrong */
-                        printk(KERN_INFO "%s: Madge MC ROM read failed (unknown manufacturer ID %02x)\n", dev->name, card->manid);
-                        goto getout;
-                }
+        if (card->manid != 0x4d) { /* something went wrong */
+                printk(KERN_INFO "%s: Madge MC ROM read failed (unknown manufacturer ID %02x)\n", dev->name, card->manid);
+                goto getout3;
+        }
                 
-                if ((card->cardtype != 0x08) && (card->cardtype != 0x0d)) {
-                        printk(KERN_INFO "%s: Madge MC ROM read failed (unknown card ID %02x)\n", dev->name, card->cardtype);
-                        goto getout;
-                }
+        if ((card->cardtype != 0x08) && (card->cardtype != 0x0d)) {
+                printk(KERN_INFO "%s: Madge MC ROM read failed (unknown card ID %02x)\n", dev->name, card->cardtype);
+                ret = -EIO;
+                goto getout3;
+        }
                
-                /* All cards except Rev 0 and 1 MC16's have 256kb of RAM */
-                if ((card->cardtype == 0x08) && (card->cardrev <= 0x01))
-                        card->ramsize = 128;
-                else
-                        card->ramsize = 256;
-
-                printk("%s: %s Rev %d at 0x%04lx IRQ %d\n", 
-                       dev->name, 
-                       (card->cardtype == 0x08)?MADGEMC16_CARDNAME:
-                       MADGEMC32_CARDNAME, card->cardrev, 
-                       dev->base_addr, dev->irq);
-
-                if (card->cardtype == 0x0d)
-                        printk("%s:     Warning: MC32 support is experimental and highly untested\n", dev->name);
-                
-                if (card->ringspeed==2) { /* Unknown */
-                        printk("%s:     Warning: Ring speed not set in POS -- Please run the reference disk and set it!\n", dev->name);
-                        card->ringspeed = 1; /* default to 16mb */
-                }
+        /* All cards except Rev 0 and 1 MC16's have 256kb of RAM */
+        if ((card->cardtype == 0x08) && (card->cardrev <= 0x01))
+                card->ramsize = 128;
+        else
+                card->ramsize = 256;
+
+        printk("%s: %s Rev %d at 0x%04lx IRQ %d\n", 
+               dev->name, 
+               (card->cardtype == 0x08)?MADGEMC16_CARDNAME:
+               MADGEMC32_CARDNAME, card->cardrev, 
+               dev->base_addr, dev->irq);
+
+        if (card->cardtype == 0x0d)
+                printk("%s:     Warning: MC32 support is experimental and highly untested\n", dev->name);
+        
+        if (card->ringspeed==2) { /* Unknown */
+                printk("%s:     Warning: Ring speed not set in POS -- Please run the reference disk and set it!\n", dev->name);
+                card->ringspeed = 1; /* default to 16mb */
+        }
                 
-                printk("%s:     RAM Size: %dKB\n", dev->name, card->ramsize);
+        printk("%s:     RAM Size: %dKB\n", dev->name, card->ramsize);
 
-                printk("%s:     Ring Speed: %dMb/sec on %s\n", dev->name, 
-                       (card->ringspeed)?16:4, 
-                       card->cabletype?"STP/DB9":"UTP/RJ-45");
-                printk("%s:     Arbitration Level: %d\n", dev->name, 
-                       card->arblevel);
+        printk("%s:     Ring Speed: %dMb/sec on %s\n", dev->name, 
+               (card->ringspeed)?16:4, 
+               card->cabletype?"STP/DB9":"UTP/RJ-45");
+        printk("%s:     Arbitration Level: %d\n", dev->name, 
+               card->arblevel);
 
-                printk("%s:     Burst Mode: ", dev->name);
-                switch(card->burstmode) {
+        printk("%s:     Burst Mode: ", dev->name);
+        switch(card->burstmode) {
                 case 0: printk("Cycle steal"); break;
                 case 1: printk("Limited burst"); break;
                 case 2: printk("Delayed release"); break;
                 case 3: printk("Immediate release"); break;
-                }
-                printk(" (%s)\n", (card->fairness)?"Unfair":"Fair");
-
-
-                /* 
-                 * Enable SIF before we assign the interrupt handler,
-                 * just in case we get spurious interrupts that need
-                 * handling.
-                 */ 
-                outb(0, dev->base_addr + MC_CONTROL_REG0); /* sanity */
-                madgemc_setsifsel(dev, 1);
-                if (request_irq(dev->irq, madgemc_interrupt, SA_SHIRQ,
-                               "madgemc", dev)) 
-                        goto getout;
-                
-                madgemc_chipset_init(dev); /* enables interrupts! */
-                madgemc_setcabletype(dev, card->cabletype);
+        }
+        printk(" (%s)\n", (card->fairness)?"Unfair":"Fair");
 
-                /* Setup MCA structures */
-                mca_set_adapter_name(slot, (card->cardtype == 0x08)?MADGEMC16_CARDNAME:MADGEMC32_CARDNAME);
-                mca_set_adapter_procfn(slot, madgemc_mcaproc, dev);
-                mca_mark_as_used(slot);
 
-                printk("%s:     Ring Station Address: ", dev->name);
-                printk("%2.2x", dev->dev_addr[0]);
-                for (i = 1; i < 6; i++)
-                        printk(":%2.2x", dev->dev_addr[i]);
-                printk("\n");
-
-                /* XXX is ISA_MAX_ADDRESS correct here? */
-                if (tmsdev_init(dev, ISA_MAX_ADDRESS, NULL)) {
-                        printk("%s: unable to get memory for dev->priv.\n", 
-                               dev->name);
-                        release_region(dev->base_addr-MADGEMC_SIF_OFFSET, 
-                               MADGEMC_IO_EXTENT); 
-                        
-                        kfree(card);
-                        tmsdev_term(dev);
-                        free_netdev(dev);
-                        if (madgemc_card_list)
-                                return 0;
-                        return -1;
-                }
-                tp = netdev_priv(dev);
-
-                /* 
-                 * The MC16 is physically a 32bit card.  However, Madge
-                 * insists on calling it 16bit, so I'll assume here that
-                 * they know what they're talking about.  Cut off DMA
-                 * at 16mb.
-                 */
-                tp->setnselout = madgemc_setnselout_pins;
-                tp->sifwriteb = madgemc_sifwriteb;
-                tp->sifreadb = madgemc_sifreadb;
-                tp->sifwritew = madgemc_sifwritew;
-                tp->sifreadw = madgemc_sifreadw;
-                tp->DataRate = (card->ringspeed)?SPEED_16:SPEED_4;
-
-                memcpy(tp->ProductID, "Madge MCA 16/4    ", PROD_ID_SIZE + 1);
-
-                dev->open = madgemc_open;
-                dev->stop = madgemc_close;
-
-                if (register_netdev(dev) == 0) {
-                        /* Enlist in the card list */
-                        card->next = madgemc_card_list;
-                        madgemc_card_list = card;
-                        slot++;
-                        continue; /* successful, try to find another */
-                }
-                
-                free_irq(dev->irq, dev);
-        getout:
-                release_region(dev->base_addr-MADGEMC_SIF_OFFSET, 
-                               MADGEMC_IO_EXTENT); 
-        getout1:
-                kfree(card);
-                free_netdev(dev);
-                slot++;
+        /* 
+         * Enable SIF before we assign the interrupt handler,
+         * just in case we get spurious interrupts that need
+         * handling.
+         */ 
+        outb(0, dev->base_addr + MC_CONTROL_REG0); /* sanity */
+        madgemc_setsifsel(dev, 1);
+        if (request_irq(dev->irq, madgemc_interrupt, SA_SHIRQ,
+                       "madgemc", dev)) {
+                ret = -EBUSY;
+                goto getout3;
         }
 
-        if (madgemc_card_list)
+        madgemc_chipset_init(dev); /* enables interrupts! */
+        madgemc_setcabletype(dev, card->cabletype);
+
+        /* Setup MCA structures */
+        mca_device_set_name(mdev, (card->cardtype == 0x08)?MADGEMC16_CARDNAME:MADGEMC32_CARDNAME);
+        mca_set_adapter_procfn(mdev->slot, madgemc_mcaproc, dev);
+
+        printk("%s:     Ring Station Address: ", dev->name);
+        printk("%2.2x", dev->dev_addr[0]);
+        for (i = 1; i < 6; i++)
+                printk(":%2.2x", dev->dev_addr[i]);
+        printk("\n");
+
+        if (tmsdev_init(dev, device)) {
+                printk("%s: unable to get memory for dev->priv.\n", 
+                       dev->name);
+                ret = -ENOMEM;
+                goto getout4;
+        }
+        tp = netdev_priv(dev);
+
+        /* 
+         * The MC16 is physically a 32bit card.  However, Madge
+         * insists on calling it 16bit, so I'll assume here that
+         * they know what they're talking about.  Cut off DMA
+         * at 16mb.
+         */
+        tp->setnselout = madgemc_setnselout_pins;
+        tp->sifwriteb = madgemc_sifwriteb;
+        tp->sifreadb = madgemc_sifreadb;
+        tp->sifwritew = madgemc_sifwritew;
+        tp->sifreadw = madgemc_sifreadw;
+        tp->DataRate = (card->ringspeed)?SPEED_16:SPEED_4;
+
+        memcpy(tp->ProductID, "Madge MCA 16/4    ", PROD_ID_SIZE + 1);
+
+        dev->open = madgemc_open;
+        dev->stop = madgemc_close;
+
+        tp->tmspriv = card;
+        dev_set_drvdata(device, dev);
+
+        if (register_netdev(dev) == 0)
                 return 0;
-        return -1;
+
+        dev_set_drvdata(device, NULL);
+        ret = -ENOMEM;
+getout4:
+        free_irq(dev->irq, dev);
+getout3:
+        release_region(dev->base_addr-MADGEMC_SIF_OFFSET, 
+                       MADGEMC_IO_EXTENT); 
+getout2:
+        kfree(card);
+getout1:
+        free_netdev(dev);
+getout:
+        mca_device_set_claim(mdev, 0);
+        return ret;
 }
 
 /*
@@ -664,12 +634,12 @@ static void madgemc_chipset_close(struct net_device *dev)
  * is complete.
  *
  */
-static void madgemc_read_rom(struct madgemc_card *card)
+static void madgemc_read_rom(struct net_device *dev, struct card_info *card)
 {
         unsigned long ioaddr;
         unsigned char reg0, reg1, tmpreg0, i;
 
-        ioaddr = card->dev->base_addr;
+        ioaddr = dev->base_addr;
 
         reg0 = inb(ioaddr + MC_CONTROL_REG0);
         reg1 = inb(ioaddr + MC_CONTROL_REG1);
@@ -686,9 +656,9 @@ static void madgemc_read_rom(struct madgemc_card *card)
         outb(tmpreg0 | MC_CONTROL_REG0_PAGE, ioaddr + MC_CONTROL_REG0);
 
         /* Read BIA */
-        card->dev->addr_len = 6;
+        dev->addr_len = 6;
         for (i = 0; i < 6; i++)
-                card->dev->dev_addr[i] = inb(ioaddr + MC_ROM_BIA_START + i);
+                dev->dev_addr[i] = inb(ioaddr + MC_ROM_BIA_START + i);
         
         /* Restore original register values */
         outb(reg0, ioaddr + MC_CONTROL_REG0);
@@ -721,14 +691,10 @@ static int madgemc_close(struct net_device *dev)
 static int madgemc_mcaproc(char *buf, int slot, void *d) 
 {       
         struct net_device *dev = (struct net_device *)d;
-        struct madgemc_card *curcard = madgemc_card_list;
+        struct net_local *tp = dev->priv;
+        struct card_info *curcard = tp->tmspriv;
         int len = 0;
         
-        while (curcard) { /* search for card struct */
-                if (curcard->dev == dev)
-                        break;
-                curcard = curcard->next;
-        }
         len += sprintf(buf+len, "-------\n");
         if (curcard) {
                 struct net_local *tp = netdev_priv(dev);
@@ -763,25 +729,56 @@ static int madgemc_mcaproc(char *buf, int slot, void *d)
         return len;
 }
 
-static void __exit madgemc_exit(void)
+static int __devexit madgemc_remove(struct device *device)
 {
-        struct net_device *dev;
-        struct madgemc_card *this_card;
-        
-        while (madgemc_card_list) {
-                dev = madgemc_card_list->dev;
-                unregister_netdev(dev);
-                release_region(dev->base_addr-MADGEMC_SIF_OFFSET, MADGEMC_IO_EXTENT);
-                free_irq(dev->irq, dev);
-                tmsdev_term(dev);
-                free_netdev(dev);
-                this_card = madgemc_card_list;
-                madgemc_card_list = this_card->next;
-                kfree(this_card);
-        }
+        struct net_device *dev = dev_get_drvdata(device);
+        struct net_local *tp;
+        struct card_info *card;
+
+        if (!dev)
+                BUG();
+
+        tp = dev->priv;
+        card = tp->tmspriv;
+        kfree(card);
+        tp->tmspriv = NULL;
+
+        unregister_netdev(dev);
+        release_region(dev->base_addr-MADGEMC_SIF_OFFSET, MADGEMC_IO_EXTENT);
+        free_irq(dev->irq, dev);
+        tmsdev_term(dev);
+        free_netdev(dev);
+        dev_set_drvdata(device, NULL);
+
+        return 0;
+}
+
+static short madgemc_adapter_ids[] __initdata = {
+        0x002d,
+        0x0000
+};
+
+static struct mca_driver madgemc_driver = {
+        .id_table = madgemc_adapter_ids,
+        .driver = {
+                .name = "madgemc",
+                .bus = &mca_bus_type,
+                .probe = madgemc_probe,
+                .remove = __devexit_p(madgemc_remove),
+        },
+};
+
+static int __init madgemc_init (void)
+{
+        return mca_register_driver (&madgemc_driver);
+}
+
+static void __exit madgemc_exit (void)
+{
+        mca_unregister_driver (&madgemc_driver);
 }
 
-module_init(madgemc_probe);
+module_init(madgemc_init);
 module_exit(madgemc_exit);
 
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/tokenring/proteon.c b/drivers/net/tokenring/proteon.c
index 40ad0fde28af..eb1423ede75c 100644
--- a/drivers/net/tokenring/proteon.c
+++ b/drivers/net/tokenring/proteon.c
@@ -62,8 +62,7 @@ static int dmalist[] __initdata = {
 };
 
 static char cardname[] = "Proteon 1392\0";
-
-struct net_device *proteon_probe(int unit);
+static u64 dma_mask = ISA_MAX_ADDRESS;
 static int proteon_open(struct net_device *dev);
 static void proteon_read_eeprom(struct net_device *dev);
 static unsigned short proteon_setnselout_pins(struct net_device *dev);
@@ -116,7 +115,7 @@ nodev:
         return -ENODEV;
 }
 
-static int __init setup_card(struct net_device *dev)
+static int __init setup_card(struct net_device *dev, struct device *pdev)
 {
         struct net_local *tp;
         static int versionprinted;
@@ -137,7 +136,7 @@ static int __init setup_card(struct net_device *dev)
                 }
         }
         if (err)
-                goto out4;
+                goto out5;
 
         /* At this point we have found a valid card. */
 
@@ -145,14 +144,15 @@ static int __init setup_card(struct net_device *dev)
                 printk(KERN_DEBUG "%s", version);
 
         err = -EIO;
-        if (tmsdev_init(dev, ISA_MAX_ADDRESS, NULL))
+        pdev->dma_mask = &dma_mask;
+        if (tmsdev_init(dev, pdev))
                 goto out4;
 
         dev->base_addr &= ~3; 
                 
         proteon_read_eeprom(dev);
 
-        printk(KERN_DEBUG "%s:    Ring Station Address: ", dev->name);
+        printk(KERN_DEBUG "proteon.c:    Ring Station Address: ");
         printk("%2.2x", dev->dev_addr[0]);
         for (j = 1; j < 6; j++)
                 printk(":%2.2x", dev->dev_addr[j]);
@@ -185,7 +185,7 @@ static int __init setup_card(struct net_device *dev)
                 
                 if(irqlist[j] == 0)
                 {
-                        printk(KERN_INFO "%s: AutoSelect no IRQ available\n", dev->name);
+                        printk(KERN_INFO "proteon.c: AutoSelect no IRQ available\n");
                         goto out3;
                 }
         }
@@ -196,15 +196,15 @@ static int __init setup_card(struct net_device *dev)
                                 break;
                 if (irqlist[j] == 0)
                 {
-                        printk(KERN_INFO "%s: Illegal IRQ %d specified\n",
-                                dev->name, dev->irq);
+                        printk(KERN_INFO "proteon.c: Illegal IRQ %d specified\n",
+                                dev->irq);
                         goto out3;
                 }
                 if (request_irq(dev->irq, tms380tr_interrupt, 0, 
                         cardname, dev))
                 {
-                        printk(KERN_INFO "%s: Selected IRQ %d not available\n", 
-                                dev->name, dev->irq);
+                        printk(KERN_INFO "proteon.c: Selected IRQ %d not available\n",
+                                dev->irq);
                         goto out3;
                 }
         }
@@ -220,7 +220,7 @@ static int __init setup_card(struct net_device *dev)
 
                 if(dmalist[j] == 0)
                 {
-                        printk(KERN_INFO "%s: AutoSelect no DMA available\n", dev->name);
+                        printk(KERN_INFO "proteon.c: AutoSelect no DMA available\n");
                         goto out2;
                 }
         }
@@ -231,25 +231,25 @@ static int __init setup_card(struct net_device *dev)
                                 break;
                 if (dmalist[j] == 0)
                 {
-                        printk(KERN_INFO "%s: Illegal DMA %d specified\n", 
-                                dev->name, dev->dma);
+                        printk(KERN_INFO "proteon.c: Illegal DMA %d specified\n",
+                                dev->dma);
                         goto out2;
                 }
                 if (request_dma(dev->dma, cardname))
                 {
-                        printk(KERN_INFO "%s: Selected DMA %d not available\n", 
-                                dev->name, dev->dma);
+                        printk(KERN_INFO "proteon.c: Selected DMA %d not available\n",
+                                dev->dma);
                         goto out2;
                 }
         }
 
-        printk(KERN_DEBUG "%s:    IO: %#4lx  IRQ: %d  DMA: %d\n",
-               dev->name, dev->base_addr, dev->irq, dev->dma);
-                
         err = register_netdev(dev);
         if (err)
                 goto out;
 
+        printk(KERN_DEBUG "%s:    IO: %#4lx  IRQ: %d  DMA: %d\n",
+               dev->name, dev->base_addr, dev->irq, dev->dma);
+
         return 0;
 out:
         free_dma(dev->dma);
@@ -258,34 +258,11 @@ out2:
 out3:
         tmsdev_term(dev);
 out4:
-        release_region(dev->base_addr, PROTEON_IO_EXTENT); 
+        release_region(dev->base_addr, PROTEON_IO_EXTENT);
+out5:
         return err;
 }
 
-struct net_device * __init proteon_probe(int unit)
-{
-        struct net_device *dev = alloc_trdev(sizeof(struct net_local));
-        int err = 0;
-
-        if (!dev)
-                return ERR_PTR(-ENOMEM);
-
-        if (unit >= 0) {
-                sprintf(dev->name, "tr%d", unit);
-                netdev_boot_setup_check(dev);
-        }
-
-        err = setup_card(dev);
-        if (err)
-                goto out;
-
-        return dev;
-
-out:
-        free_netdev(dev);
-        return ERR_PTR(err);
-}
-
 /*
  * Reads MAC address from adapter RAM, which should've read it from
  * the onboard ROM.  
@@ -352,8 +329,6 @@ static int proteon_open(struct net_device *dev)
         return tms380tr_open(dev);
 }
 
-#ifdef MODULE
-
 #define ISATR_MAX_ADAPTERS 3
 
 static int io[ISATR_MAX_ADAPTERS];
@@ -366,13 +341,23 @@ module_param_array(io, int, NULL, 0);
 module_param_array(irq, int, NULL, 0);
 module_param_array(dma, int, NULL, 0);
 
-static struct net_device *proteon_dev[ISATR_MAX_ADAPTERS];
+static struct platform_device *proteon_dev[ISATR_MAX_ADAPTERS];
+
+static struct device_driver proteon_driver = {
+        .name           = "proteon",
+        .bus            = &platform_bus_type,
+};
 
-int init_module(void)
+static int __init proteon_init(void)
 {
         struct net_device *dev;
+        struct platform_device *pdev;
         int i, num = 0, err = 0;
 
+        err = driver_register(&proteon_driver);
+        if (err)
+                return err;
+
         for (i = 0; i < ISATR_MAX_ADAPTERS ; i++) {
                 dev = alloc_trdev(sizeof(struct net_local));
                 if (!dev)
@@ -381,11 +366,15 @@ int init_module(void)
                 dev->base_addr = io[i];
                 dev->irq = irq[i];
                 dev->dma = dma[i];
-                err = setup_card(dev);
+                pdev = platform_device_register_simple("proteon",
+                        i, NULL, 0);
+                err = setup_card(dev, &pdev->dev);
                 if (!err) {
-                        proteon_dev[i] = dev;
+                        proteon_dev[i] = pdev;
+                        dev_set_drvdata(&pdev->dev, dev);
                         ++num;
                 } else {
+                        platform_device_unregister(pdev);
                         free_netdev(dev);
                 }
         }
@@ -399,23 +388,28 @@ int init_module(void)
         return (0);
 }
 
-void cleanup_module(void)
+static void __exit proteon_cleanup(void)
 {
+        struct net_device *dev;
         int i;
 
         for (i = 0; i < ISATR_MAX_ADAPTERS ; i++) {
-                struct net_device *dev = proteon_dev[i];
+                struct platform_device *pdev = proteon_dev[i];
                 
-                if (!dev) 
+                if (!pdev)
                         continue;
-                
+                dev = dev_get_drvdata(&pdev->dev);
                 unregister_netdev(dev);
                 release_region(dev->base_addr, PROTEON_IO_EXTENT);
                 free_irq(dev->irq, dev);
                 free_dma(dev->dma);
                 tmsdev_term(dev);
                 free_netdev(dev);
+                dev_set_drvdata(&pdev->dev, NULL);
+                platform_device_unregister(pdev);
         }
+        driver_unregister(&proteon_driver);
 }
-#endif /* MODULE */
 
+module_init(proteon_init);
+module_exit(proteon_cleanup);
diff --git a/drivers/net/tokenring/skisa.c b/drivers/net/tokenring/skisa.c
index f26796e2d0e5..3c7c66204f74 100644
--- a/drivers/net/tokenring/skisa.c
+++ b/drivers/net/tokenring/skisa.c
@@ -68,8 +68,7 @@ static int dmalist[] __initdata = {
 };
 
 static char isa_cardname[] = "SK NET TR 4/16 ISA\0";
-
-struct net_device *sk_isa_probe(int unit);
+static u64 dma_mask = ISA_MAX_ADDRESS;
 static int sk_isa_open(struct net_device *dev);
 static void sk_isa_read_eeprom(struct net_device *dev);
 static unsigned short sk_isa_setnselout_pins(struct net_device *dev);
@@ -133,7 +132,7 @@ static int __init sk_isa_probe1(struct net_device *dev, int ioaddr)
         return 0;
 }
 
-static int __init setup_card(struct net_device *dev)
+static int __init setup_card(struct net_device *dev, struct device *pdev)
 {
         struct net_local *tp;
         static int versionprinted;
@@ -154,7 +153,7 @@ static int __init setup_card(struct net_device *dev)
                 }
         }
         if (err)
-                goto out4;
+                goto out5;
 
         /* At this point we have found a valid card. */
 
@@ -162,14 +161,15 @@ static int __init setup_card(struct net_device *dev)
                 printk(KERN_DEBUG "%s", version);
 
         err = -EIO;
-        if (tmsdev_init(dev, ISA_MAX_ADDRESS, NULL))
+        pdev->dma_mask = &dma_mask;
+        if (tmsdev_init(dev, pdev))
                 goto out4;
 
         dev->base_addr &= ~3; 
                 
         sk_isa_read_eeprom(dev);
 
-        printk(KERN_DEBUG "%s:    Ring Station Address: ", dev->name);
+        printk(KERN_DEBUG "skisa.c:    Ring Station Address: ");
         printk("%2.2x", dev->dev_addr[0]);
         for (j = 1; j < 6; j++)
                 printk(":%2.2x", dev->dev_addr[j]);
@@ -202,7 +202,7 @@ static int __init setup_card(struct net_device *dev)
                 
                 if(irqlist[j] == 0)
                 {
-                        printk(KERN_INFO "%s: AutoSelect no IRQ available\n", dev->name);
+                        printk(KERN_INFO "skisa.c: AutoSelect no IRQ available\n");
                         goto out3;
                 }
         }
@@ -213,15 +213,15 @@ static int __init setup_card(struct net_device *dev)
                                 break;
                 if (irqlist[j] == 0)
                 {
-                        printk(KERN_INFO "%s: Illegal IRQ %d specified\n",
-                                dev->name, dev->irq);
+                        printk(KERN_INFO "skisa.c: Illegal IRQ %d specified\n",
+                                dev->irq);
                         goto out3;
                 }
                 if (request_irq(dev->irq, tms380tr_interrupt, 0, 
                         isa_cardname, dev))
                 {
-                        printk(KERN_INFO "%s: Selected IRQ %d not available\n", 
-                                dev->name, dev->irq);
+                        printk(KERN_INFO "skisa.c: Selected IRQ %d not available\n",
+                                dev->irq);
                         goto out3;
                 }
         }
@@ -237,7 +237,7 @@ static int __init setup_card(struct net_device *dev)
 
                 if(dmalist[j] == 0)
                 {
-                        printk(KERN_INFO "%s: AutoSelect no DMA available\n", dev->name);
+                        printk(KERN_INFO "skisa.c: AutoSelect no DMA available\n");
                         goto out2;
                 }
         }
@@ -248,25 +248,25 @@ static int __init setup_card(struct net_device *dev)
                                 break;
                 if (dmalist[j] == 0)
                 {
-                        printk(KERN_INFO "%s: Illegal DMA %d specified\n", 
-                                dev->name, dev->dma);
+                        printk(KERN_INFO "skisa.c: Illegal DMA %d specified\n",
+                                dev->dma);
                         goto out2;
                 }
                 if (request_dma(dev->dma, isa_cardname))
                 {
-                        printk(KERN_INFO "%s: Selected DMA %d not available\n", 
-                                dev->name, dev->dma);
+                        printk(KERN_INFO "skisa.c: Selected DMA %d not available\n",
+                                dev->dma);
                         goto out2;
                 }
         }
 
-        printk(KERN_DEBUG "%s:    IO: %#4lx  IRQ: %d  DMA: %d\n",
-               dev->name, dev->base_addr, dev->irq, dev->dma);
-                
         err = register_netdev(dev);
         if (err)
                 goto out;
 
+        printk(KERN_DEBUG "%s:    IO: %#4lx  IRQ: %d  DMA: %d\n",
+               dev->name, dev->base_addr, dev->irq, dev->dma);
+
         return 0;
 out:
         free_dma(dev->dma);
@@ -275,33 +275,11 @@ out2:
 out3:
         tmsdev_term(dev);
 out4:
-        release_region(dev->base_addr, SK_ISA_IO_EXTENT); 
+        release_region(dev->base_addr, SK_ISA_IO_EXTENT);
+out5:
         return err;
 }
 
-struct net_device * __init sk_isa_probe(int unit)
-{
-        struct net_device *dev = alloc_trdev(sizeof(struct net_local));
-        int err = 0;
-
-        if (!dev)
-                return ERR_PTR(-ENOMEM);
-
-        if (unit >= 0) {
-                sprintf(dev->name, "tr%d", unit);
-                netdev_boot_setup_check(dev);
-        }
-
-        err = setup_card(dev);
-        if (err)
-                goto out;
-
-        return dev;
-out:
-        free_netdev(dev);
-        return ERR_PTR(err);
-}
-
 /*
  * Reads MAC address from adapter RAM, which should've read it from
  * the onboard ROM.  
@@ -361,8 +339,6 @@ static int sk_isa_open(struct net_device *dev)
         return tms380tr_open(dev);
 }
 
-#ifdef MODULE
-
 #define ISATR_MAX_ADAPTERS 3
 
 static int io[ISATR_MAX_ADAPTERS];
@@ -375,13 +351,23 @@ module_param_array(io, int, NULL, 0);
 module_param_array(irq, int, NULL, 0);
 module_param_array(dma, int, NULL, 0);
 
-static struct net_device *sk_isa_dev[ISATR_MAX_ADAPTERS];
+static struct platform_device *sk_isa_dev[ISATR_MAX_ADAPTERS];
 
-int init_module(void)
+static struct device_driver sk_isa_driver = {
+        .name           = "skisa",
+        .bus            = &platform_bus_type,
+};
+
+static int __init sk_isa_init(void)
 {
         struct net_device *dev;
+        struct platform_device *pdev;
         int i, num = 0, err = 0;
 
+        err = driver_register(&sk_isa_driver);
+        if (err)
+                return err;
+
         for (i = 0; i < ISATR_MAX_ADAPTERS ; i++) {
                 dev = alloc_trdev(sizeof(struct net_local));
                 if (!dev)
@@ -390,12 +376,15 @@ int init_module(void)
                 dev->base_addr = io[i];
                 dev->irq = irq[i];
                 dev->dma = dma[i];
-                err = setup_card(dev);
-
+                pdev = platform_device_register_simple("skisa",
+                        i, NULL, 0);
+                err = setup_card(dev, &pdev->dev);
                 if (!err) {
-                        sk_isa_dev[i] = dev;
+                        sk_isa_dev[i] = pdev;
+                        dev_set_drvdata(&sk_isa_dev[i]->dev, dev);
                         ++num;
                 } else {
+                        platform_device_unregister(pdev);
                         free_netdev(dev);
                 }
         }
@@ -409,23 +398,28 @@ int init_module(void)
         return (0);
 }
 
-void cleanup_module(void)
+static void __exit sk_isa_cleanup(void)
 {
+        struct net_device *dev;
         int i;
 
         for (i = 0; i < ISATR_MAX_ADAPTERS ; i++) {
-                struct net_device *dev = sk_isa_dev[i];
+                struct platform_device *pdev = sk_isa_dev[i];
 
-                if (!dev) 
+                if (!pdev)
                         continue;
-                
+                dev = dev_get_drvdata(&pdev->dev);
                 unregister_netdev(dev);
                 release_region(dev->base_addr, SK_ISA_IO_EXTENT);
                 free_irq(dev->irq, dev);
                 free_dma(dev->dma);
                 tmsdev_term(dev);
                 free_netdev(dev);
+                dev_set_drvdata(&pdev->dev, NULL);
+                platform_device_unregister(pdev);
         }
+        driver_unregister(&sk_isa_driver);
 }
-#endif /* MODULE */
 
+module_init(sk_isa_init);
+module_exit(sk_isa_cleanup);
diff --git a/drivers/net/tokenring/tms380tr.c b/drivers/net/tokenring/tms380tr.c
index 5e0b0ce98ed7..2e39bf1f7462 100644
--- a/drivers/net/tokenring/tms380tr.c
+++ b/drivers/net/tokenring/tms380tr.c
@@ -62,6 +62,7 @@
  *                              normal operation.
  *      30-Dec-02       JF      Removed incorrect __init from 
  *                              tms380tr_init_card.
+ *      22-Jul-05       JF      Converted to dma-mapping.
  *                              
  *  To do:
  *    1. Multi/Broadcast packet handling (this may have fixed itself)
@@ -89,7 +90,7 @@ static const char version[] = "tms380tr.c: v1.10 30/12/2002 by Christoph Goos, A
 #include <linux/time.h>
 #include <linux/errno.h>
 #include <linux/init.h>
-#include <linux/pci.h>
+#include <linux/dma-mapping.h>
 #include <linux/delay.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
@@ -114,8 +115,6 @@ static const char version[] = "tms380tr.c: v1.10 30/12/2002 by Christoph Goos, A
 #endif
 static unsigned int tms380tr_debug = TMS380TR_DEBUG;
 
-static struct device tms_device;
-
 /* Index to functions, as function prototypes.
  * Alphabetical by function name.
  */
@@ -434,7 +433,7 @@ static void tms380tr_init_net_local(struct net_device *dev)
                         skb_put(tp->Rpl[i].Skb, tp->MaxPacketSize);
 
                         /* data unreachable for DMA ? then use local buffer */
-                        dmabuf = pci_map_single(tp->pdev, tp->Rpl[i].Skb->data, tp->MaxPacketSize, PCI_DMA_FROMDEVICE);
+                        dmabuf = dma_map_single(tp->pdev, tp->Rpl[i].Skb->data, tp->MaxPacketSize, DMA_FROM_DEVICE);
                         if(tp->dmalimit && (dmabuf + tp->MaxPacketSize > tp->dmalimit))
                         {
                                 tp->Rpl[i].SkbStat = SKB_DATA_COPY;
@@ -638,10 +637,10 @@ static int tms380tr_hardware_send_packet(struct sk_buff *skb, struct net_device
         /* Is buffer reachable for Busmaster-DMA? */
 
         length  = skb->len;
-        dmabuf = pci_map_single(tp->pdev, skb->data, length, PCI_DMA_TODEVICE);
+        dmabuf = dma_map_single(tp->pdev, skb->data, length, DMA_TO_DEVICE);
         if(tp->dmalimit && (dmabuf + length > tp->dmalimit)) {
                 /* Copy frame to local buffer */
-                pci_unmap_single(tp->pdev, dmabuf, length, PCI_DMA_TODEVICE);
+                dma_unmap_single(tp->pdev, dmabuf, length, DMA_TO_DEVICE);
                 dmabuf  = 0;
                 i       = tp->TplFree->TPLIndex;
                 buf     = tp->LocalTxBuffers[i];
@@ -1284,9 +1283,7 @@ static int tms380tr_reset_adapter(struct net_device *dev)
         unsigned short count, c, count2;
         const struct firmware *fw_entry = NULL;
 
-        strncpy(tms_device.bus_id,dev->name, BUS_ID_SIZE);
-
-        if (request_firmware(&fw_entry, "tms380tr.bin", &tms_device) != 0) {
+        if (request_firmware(&fw_entry, "tms380tr.bin", tp->pdev) != 0) {
                 printk(KERN_ALERT "%s: firmware %s is missing, cannot start.\n",
                         dev->name, "tms380tr.bin");
                 return (-1);
@@ -2021,7 +2018,7 @@ static void tms380tr_cancel_tx_queue(struct net_local* tp)
 
                 printk(KERN_INFO "Cancel tx (%08lXh).\n", (unsigned long)tpl);
                 if (tpl->DMABuff)
-                        pci_unmap_single(tp->pdev, tpl->DMABuff, tpl->Skb->len, PCI_DMA_TODEVICE);
+                        dma_unmap_single(tp->pdev, tpl->DMABuff, tpl->Skb->len, DMA_TO_DEVICE);
                 dev_kfree_skb_any(tpl->Skb);
         }
 
@@ -2090,7 +2087,7 @@ static void tms380tr_tx_status_irq(struct net_device *dev)
 
                 tp->MacStat.tx_packets++;
                 if (tpl->DMABuff)
-                        pci_unmap_single(tp->pdev, tpl->DMABuff, tpl->Skb->len, PCI_DMA_TODEVICE);
+                        dma_unmap_single(tp->pdev, tpl->DMABuff, tpl->Skb->len, DMA_TO_DEVICE);
                 dev_kfree_skb_irq(tpl->Skb);
                 tpl->BusyFlag = 0;      /* "free" TPL */
         }
@@ -2209,7 +2206,7 @@ static void tms380tr_rcv_status_irq(struct net_device *dev)
                                 tp->MacStat.rx_errors++;
                 }
                 if (rpl->DMABuff)
-                        pci_unmap_single(tp->pdev, rpl->DMABuff, tp->MaxPacketSize, PCI_DMA_TODEVICE);
+                        dma_unmap_single(tp->pdev, rpl->DMABuff, tp->MaxPacketSize, DMA_TO_DEVICE);
                 rpl->DMABuff = 0;
 
                 /* Allocate new skb for rpl */
@@ -2227,7 +2224,7 @@ static void tms380tr_rcv_status_irq(struct net_device *dev)
                         skb_put(rpl->Skb, tp->MaxPacketSize);
 
                         /* Data unreachable for DMA ? then use local buffer */
-                        dmabuf = pci_map_single(tp->pdev, rpl->Skb->data, tp->MaxPacketSize, PCI_DMA_FROMDEVICE);
+                        dmabuf = dma_map_single(tp->pdev, rpl->Skb->data, tp->MaxPacketSize, DMA_FROM_DEVICE);
                         if(tp->dmalimit && (dmabuf + tp->MaxPacketSize > tp->dmalimit))
                         {
                                 rpl->SkbStat = SKB_DATA_COPY;
@@ -2332,23 +2329,26 @@ void tmsdev_term(struct net_device *dev)
         struct net_local *tp;
 
         tp = netdev_priv(dev);
-        pci_unmap_single(tp->pdev, tp->dmabuffer, sizeof(struct net_local),
-                PCI_DMA_BIDIRECTIONAL);
+        dma_unmap_single(tp->pdev, tp->dmabuffer, sizeof(struct net_local),
+                DMA_BIDIRECTIONAL);
 }
 
-int tmsdev_init(struct net_device *dev, unsigned long dmalimit, 
-                struct pci_dev *pdev)
+int tmsdev_init(struct net_device *dev, struct device *pdev)
 {
         struct net_local *tms_local;
 
         memset(dev->priv, 0, sizeof(struct net_local));
         tms_local = netdev_priv(dev);
         init_waitqueue_head(&tms_local->wait_for_tok_int);
-        tms_local->dmalimit = dmalimit;
+        if (pdev->dma_mask)
+                tms_local->dmalimit = *pdev->dma_mask;
+        else
+                return -ENOMEM;
         tms_local->pdev = pdev;
-        tms_local->dmabuffer = pci_map_single(pdev, (void *)tms_local,
-            sizeof(struct net_local), PCI_DMA_BIDIRECTIONAL);
-        if (tms_local->dmabuffer + sizeof(struct net_local) > dmalimit)
+        tms_local->dmabuffer = dma_map_single(pdev, (void *)tms_local,
+            sizeof(struct net_local), DMA_BIDIRECTIONAL);
+        if (tms_local->dmabuffer + sizeof(struct net_local) > 
+                        tms_local->dmalimit)
         {
                 printk(KERN_INFO "%s: Memory not accessible for DMA\n",
                         dev->name);
@@ -2370,8 +2370,6 @@ int tmsdev_init(struct net_device *dev, unsigned long dmalimit,
         return 0;
 }
 
-#ifdef MODULE
-
 EXPORT_SYMBOL(tms380tr_open);
 EXPORT_SYMBOL(tms380tr_close);
 EXPORT_SYMBOL(tms380tr_interrupt);
@@ -2379,6 +2377,8 @@ EXPORT_SYMBOL(tmsdev_init);
 EXPORT_SYMBOL(tmsdev_term);
 EXPORT_SYMBOL(tms380tr_wait);
 
+#ifdef MODULE
+
 static struct module *TMS380_module = NULL;
 
 int init_module(void)
diff --git a/drivers/net/tokenring/tms380tr.h b/drivers/net/tokenring/tms380tr.h
index f2c5ba0f37a5..30452c67bb68 100644
--- a/drivers/net/tokenring/tms380tr.h
+++ b/drivers/net/tokenring/tms380tr.h
@@ -17,8 +17,7 @@
 int tms380tr_open(struct net_device *dev);
 int tms380tr_close(struct net_device *dev);
 irqreturn_t tms380tr_interrupt(int irq, void *dev_id, struct pt_regs *regs);
-int tmsdev_init(struct net_device *dev, unsigned long dmalimit,
-                struct pci_dev *pdev);
+int tmsdev_init(struct net_device *dev, struct device *pdev);
 void tmsdev_term(struct net_device *dev);
 void tms380tr_wait(unsigned long time);
 
@@ -719,7 +718,7 @@ struct s_TPL {	/* Transmit Parameter List (align on even word boundaries) */
         struct sk_buff *Skb;
         unsigned char TPLIndex;
         volatile unsigned char BusyFlag;/* Flag: TPL busy? */
-        dma_addr_t DMABuff;             /* DMA IO bus address from pci_map */
+        dma_addr_t DMABuff;             /* DMA IO bus address from dma_map */
 };
 
 /* ---------------------Receive Functions-------------------------------*
@@ -1060,7 +1059,7 @@ struct s_RPL {	/* Receive Parameter List */
         struct sk_buff *Skb;
         SKB_STAT SkbStat;
         int RPLIndex;
-        dma_addr_t DMABuff;             /* DMA IO bus address from pci_map */
+        dma_addr_t DMABuff;             /* DMA IO bus address from dma_map */
 };
 
 /* Information that need to be kept for each board. */
@@ -1091,7 +1090,7 @@ typedef struct net_local {
         RPL *RplTail;
         unsigned char LocalRxBuffers[RPL_NUM][DEFAULT_PACKET_SIZE];
 
-        struct pci_dev *pdev;
+        struct device *pdev;
         int DataRate;
         unsigned char ScbInUse;
         unsigned short CMDqueue;
diff --git a/drivers/net/tokenring/tmspci.c b/drivers/net/tokenring/tmspci.c
index 2e18c0a46482..ab47c0547a3b 100644
--- a/drivers/net/tokenring/tmspci.c
+++ b/drivers/net/tokenring/tmspci.c
@@ -100,7 +100,7 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
         unsigned int pci_irq_line;
         unsigned long pci_ioaddr;
         struct card_info *cardinfo = &card_info_table[ent->driver_data];
-                
+
         if (versionprinted++ == 0)
                 printk("%s", version);
 
@@ -143,7 +143,7 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
                 printk(":%2.2x", dev->dev_addr[i]);
         printk("\n");
                 
-        ret = tmsdev_init(dev, PCI_MAX_ADDRESS, pdev);
+        ret = tmsdev_init(dev, &pdev->dev);
         if (ret) {
                 printk("%s: unable to get memory for dev->priv.\n", dev->name);
                 goto err_out_irq;
diff --git a/drivers/net/tulip/Kconfig b/drivers/net/tulip/Kconfig
index e2cdaf876201..8c9634a98c11 100644
--- a/drivers/net/tulip/Kconfig
+++ b/drivers/net/tulip/Kconfig
@@ -135,6 +135,18 @@ config DM9102
           <file:Documentation/networking/net-modules.txt>.  The module will
           be called dmfe.
 
+config ULI526X
+        tristate "ULi M526x controller support"
+        depends on NET_TULIP && PCI
+        select CRC32
+        ---help---
+          This driver is for ULi M5261/M5263 10/100M Ethernet Controller
+          (<http://www.uli.com.tw/>).
+
+          To compile this driver as a module, choose M here and read
+          <file:Documentation/networking/net-modules.txt>.  The module will
+          be called uli526x.
+          
 config PCMCIA_XIRCOM
         tristate "Xircom CardBus support (new driver)"
         depends on NET_TULIP && CARDBUS
diff --git a/drivers/net/tulip/Makefile b/drivers/net/tulip/Makefile
index 8bb9b4683979..451090d6fcca 100644
--- a/drivers/net/tulip/Makefile
+++ b/drivers/net/tulip/Makefile
@@ -9,6 +9,7 @@ obj-$(CONFIG_WINBOND_840)	+= winbond-840.o
 obj-$(CONFIG_DE2104X)           += de2104x.o
 obj-$(CONFIG_TULIP)             += tulip.o
 obj-$(CONFIG_DE4X5)             += de4x5.o
+obj-$(CONFIG_ULI526X)           += uli526x.o
 
 # Declare multi-part drivers.
 
diff --git a/drivers/net/tulip/media.c b/drivers/net/tulip/media.c
index e26c31f944bf..f53396fe79c9 100644
--- a/drivers/net/tulip/media.c
+++ b/drivers/net/tulip/media.c
@@ -81,25 +81,6 @@ int tulip_mdio_read(struct net_device *dev, int phy_id, int location)
                 return retval & 0xffff;
         }
 
-        if(tp->chip_id == ULI526X && tp->revision >= 0x40) {
-                int value;
-                int i = 1000;
-                
-                value = ioread32(ioaddr + CSR9);
-                iowrite32(value & 0xFFEFFFFF, ioaddr + CSR9);
-                
-                value = (phy_id << 21) | (location << 16) | 0x08000000;
-                iowrite32(value, ioaddr + CSR10);
-                
-                while(--i > 0) {
-                        mdio_delay();
-                        if(ioread32(ioaddr + CSR10) & 0x10000000)
-                                break;
-                }
-                retval = ioread32(ioaddr + CSR10);
-                spin_unlock_irqrestore(&tp->mii_lock, flags);
-                return retval & 0xFFFF;
-        }
         /* Establish sync by sending at least 32 logic ones. */
         for (i = 32; i >= 0; i--) {
                 iowrite32(MDIO_ENB | MDIO_DATA_WRITE1, mdio_addr);
@@ -159,23 +140,6 @@ void tulip_mdio_write(struct net_device *dev, int phy_id, int location, int val)
                 spin_unlock_irqrestore(&tp->mii_lock, flags);
                 return;
         }
-        if (tp->chip_id == ULI526X && tp->revision >= 0x40) {
-                int value;
-                int i = 1000;
-                
-                value = ioread32(ioaddr + CSR9);
-                iowrite32(value & 0xFFEFFFFF, ioaddr + CSR9);
-                
-                value = (phy_id << 21) | (location << 16) | 0x04000000 | (val & 0xFFFF);
-                iowrite32(value, ioaddr + CSR10);
-                
-                while(--i > 0) {
-                        if (ioread32(ioaddr + CSR10) & 0x10000000)
-                                break;
-                }
-                spin_unlock_irqrestore(&tp->mii_lock, flags);
-                return;
-        }
                 
         /* Establish sync by sending 32 logic ones. */
         for (i = 32; i >= 0; i--) {
diff --git a/drivers/net/tulip/timer.c b/drivers/net/tulip/timer.c
index 691568283553..e058a9fbfe88 100644
--- a/drivers/net/tulip/timer.c
+++ b/drivers/net/tulip/timer.c
@@ -39,7 +39,6 @@ void tulip_timer(unsigned long data)
         case MX98713:
         case COMPEX9881:
         case DM910X:
-        case ULI526X:
         default: {
                 struct medialeaf *mleaf;
                 unsigned char *p;
diff --git a/drivers/net/tulip/tulip.h b/drivers/net/tulip/tulip.h
index 20346d847d9e..05d2d96f7be2 100644
--- a/drivers/net/tulip/tulip.h
+++ b/drivers/net/tulip/tulip.h
@@ -88,7 +88,6 @@ enum chips {
         I21145,
         DM910X,
         CONEXANT,
-        ULI526X
 };
 
 
@@ -482,11 +481,8 @@ static inline void tulip_stop_rxtx(struct tulip_private *tp)
 
 static inline void tulip_restart_rxtx(struct tulip_private *tp)
 {
-        if(!(tp->chip_id == ULI526X && 
-                (tp->revision == 0x40 || tp->revision == 0x50))) {
-                tulip_stop_rxtx(tp);
-                udelay(5);
-        }
+        tulip_stop_rxtx(tp);
+        udelay(5);
         tulip_start_rxtx(tp);
 }
 
diff --git a/drivers/net/tulip/tulip_core.c b/drivers/net/tulip/tulip_core.c
index d45d8f56e5b4..05da5bea564c 100644
--- a/drivers/net/tulip/tulip_core.c
+++ b/drivers/net/tulip/tulip_core.c
@@ -199,9 +199,6 @@ struct tulip_chip_table tulip_tbl[] = {
   { "Conexant LANfinity", 256, 0x0001ebef,
         HAS_MII | HAS_ACPI, tulip_timer },
 
-   /* ULi526X */
-   { "ULi M5261/M5263", 128, 0x0001ebef,
-        HAS_MII | HAS_MEDIA_TABLE | CSR12_IN_SROM | HAS_ACPI, tulip_timer },
 };
 
 
@@ -239,8 +236,6 @@ static struct pci_device_id tulip_pci_tbl[] = {
         { 0x1737, 0xAB09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
         { 0x1737, 0xAB08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
         { 0x17B3, 0xAB08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
-        { 0x10b9, 0x5261, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ULI526X },      /* ALi 1563 integrated ethernet */
-        { 0x10b9, 0x5263, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ULI526X },      /* ALi 1563 integrated ethernet */
         { 0x10b7, 0x9300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, /* 3Com 3CSOHO100B-TX */
         { 0x14ea, 0xab08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, /* Planex FNW-3602-TX */
         { } /* terminate list */
@@ -522,7 +517,7 @@ static void tulip_tx_timeout(struct net_device *dev)
                                    dev->name);
         } else if (tp->chip_id == DC21140 || tp->chip_id == DC21142
                            || tp->chip_id == MX98713 || tp->chip_id == COMPEX9881
-                           || tp->chip_id == DM910X || tp->chip_id == ULI526X) {
+                           || tp->chip_id == DM910X) {
                 printk(KERN_WARNING "%s: 21140 transmit timed out, status %8.8x, "
                            "SIA %8.8x %8.8x %8.8x %8.8x, resetting...\n",
                            dev->name, ioread32(ioaddr + CSR5), ioread32(ioaddr + CSR12),
@@ -1103,18 +1098,16 @@ static void set_rx_mode(struct net_device *dev)
                         entry = tp->cur_tx++ % TX_RING_SIZE;
 
                         if (entry != 0) {
-                                /* Avoid a chip errata by prefixing a dummy entry. Don't do
-                                   this on the ULI526X as it triggers a different problem */
-                                if (!(tp->chip_id == ULI526X && (tp->revision == 0x40 || tp->revision == 0x50))) {
-                                        tp->tx_buffers[entry].skb = NULL;
-                                        tp->tx_buffers[entry].mapping = 0;
-                                        tp->tx_ring[entry].length =
-                                                (entry == TX_RING_SIZE-1) ? cpu_to_le32(DESC_RING_WRAP) : 0;
-                                        tp->tx_ring[entry].buffer1 = 0;
-                                        /* Must set DescOwned later to avoid race with chip */
-                                        dummy = entry;
-                                        entry = tp->cur_tx++ % TX_RING_SIZE;
-                                }
+                                /* Avoid a chip errata by prefixing a dummy entry. */
+                                tp->tx_buffers[entry].skb = NULL;
+                                tp->tx_buffers[entry].mapping = 0;
+                                tp->tx_ring[entry].length =
+                                        (entry == TX_RING_SIZE-1) ? cpu_to_le32(DESC_RING_WRAP) : 0;
+                                tp->tx_ring[entry].buffer1 = 0;
+                                /* Must set DescOwned later to avoid race with chip */
+                                dummy = entry;
+                                entry = tp->cur_tx++ % TX_RING_SIZE;
+
                         }
 
                         tp->tx_buffers[entry].skb = NULL;
@@ -1235,10 +1228,6 @@ static int tulip_uli_dm_quirk(struct pci_dev *pdev)
 {
         if (pdev->vendor == 0x1282 && pdev->device == 0x9102)
                 return 1;
-        if (pdev->vendor == 0x10b9 && pdev->device == 0x5261)
-                return 1;
-        if (pdev->vendor == 0x10b9 && pdev->device == 0x5263)
-                return 1;
         return 0;
 }
 
@@ -1680,7 +1669,6 @@ static int __devinit tulip_init_one (struct pci_dev *pdev,
         switch (chip_idx) {
         case DC21140:
         case DM910X:
-        case ULI526X:
         default:
                 if (tp->mtable)
                         iowrite32(tp->mtable->csr12dir | 0x100, ioaddr + CSR12);
diff --git a/drivers/net/tulip/uli526x.c b/drivers/net/tulip/uli526x.c
new file mode 100644
index 000000000000..5ae22b7bc5ca
--- /dev/null
+++ b/drivers/net/tulip/uli526x.c
@@ -0,0 +1,1749 @@
+/*
+    This program is free software; you can redistribute it and/or
+    modify it under the terms of the GNU General Public License
+    as published by the Free Software Foundation; either version 2
+    of the License, or (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    
+*/
+
+#define DRV_NAME        "uli526x"
+#define DRV_VERSION     "0.9.3"
+#define DRV_RELDATE     "2005-7-29"
+
+#include <linux/module.h>
+
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/ptrace.h>
+#include <linux/errno.h>
+#include <linux/ioport.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/pci.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/skbuff.h>
+#include <linux/delay.h>
+#include <linux/spinlock.h>
+
+#include <asm/processor.h>
+#include <asm/bitops.h>
+#include <asm/io.h>
+#include <asm/dma.h>
+#include <asm/uaccess.h>
+
+
+/* Board/System/Debug information/definition ---------------- */
+#define PCI_ULI5261_ID  0x526110B9      /* ULi M5261 ID*/
+#define PCI_ULI5263_ID  0x526310B9      /* ULi M5263 ID*/
+
+#define ULI526X_IO_SIZE 0x100
+#define TX_DESC_CNT     0x20            /* Allocated Tx descriptors */
+#define RX_DESC_CNT     0x30            /* Allocated Rx descriptors */
+#define TX_FREE_DESC_CNT (TX_DESC_CNT - 2)      /* Max TX packet count */
+#define TX_WAKE_DESC_CNT (TX_DESC_CNT - 3)      /* TX wakeup count */
+#define DESC_ALL_CNT    (TX_DESC_CNT + RX_DESC_CNT)
+#define TX_BUF_ALLOC    0x600
+#define RX_ALLOC_SIZE   0x620
+#define ULI526X_RESET    1
+#define CR0_DEFAULT     0
+#define CR6_DEFAULT     0x22200000
+#define CR7_DEFAULT     0x180c1
+#define CR15_DEFAULT    0x06            /* TxJabber RxWatchdog */
+#define TDES0_ERR_MASK  0x4302          /* TXJT, LC, EC, FUE */
+#define MAX_PACKET_SIZE 1514
+#define ULI5261_MAX_MULTICAST 14
+#define RX_COPY_SIZE    100
+#define MAX_CHECK_PACKET 0x8000
+
+#define ULI526X_10MHF      0
+#define ULI526X_100MHF     1
+#define ULI526X_10MFD      4
+#define ULI526X_100MFD     5
+#define ULI526X_AUTO       8
+
+#define ULI526X_TXTH_72 0x400000        /* TX TH 72 byte */
+#define ULI526X_TXTH_96 0x404000        /* TX TH 96 byte */
+#define ULI526X_TXTH_128        0x0000          /* TX TH 128 byte */
+#define ULI526X_TXTH_256        0x4000          /* TX TH 256 byte */
+#define ULI526X_TXTH_512        0x8000          /* TX TH 512 byte */
+#define ULI526X_TXTH_1K 0xC000          /* TX TH 1K  byte */
+
+#define ULI526X_TIMER_WUT  (jiffies + HZ * 1)/* timer wakeup time : 1 second */
+#define ULI526X_TX_TIMEOUT ((16*HZ)/2)  /* tx packet time-out time 8 s" */
+#define ULI526X_TX_KICK         (4*HZ/2)        /* tx packet Kick-out time 2 s" */
+
+#define ULI526X_DBUG(dbug_now, msg, value) if (uli526x_debug || (dbug_now)) printk(KERN_ERR DRV_NAME ": %s %lx\n", (msg), (long) (value))
+
+#define SHOW_MEDIA_TYPE(mode) printk(KERN_ERR DRV_NAME ": Change Speed to %sMhz %s duplex\n",mode & 1 ?"100":"10", mode & 4 ? "full":"half");
+
+
+/* CR9 definition: SROM/MII */
+#define CR9_SROM_READ   0x4800
+#define CR9_SRCS        0x1
+#define CR9_SRCLK       0x2
+#define CR9_CRDOUT      0x8
+#define SROM_DATA_0     0x0
+#define SROM_DATA_1     0x4
+#define PHY_DATA_1      0x20000
+#define PHY_DATA_0      0x00000
+#define MDCLKH          0x10000
+
+#define PHY_POWER_DOWN  0x800
+
+#define SROM_V41_CODE   0x14
+
+#define SROM_CLK_WRITE(data, ioaddr)                                    \
+                outl(data|CR9_SROM_READ|CR9_SRCS,ioaddr);               \
+                udelay(5);                                              \
+                outl(data|CR9_SROM_READ|CR9_SRCS|CR9_SRCLK,ioaddr);     \
+                udelay(5);                                              \
+                outl(data|CR9_SROM_READ|CR9_SRCS,ioaddr);               \
+                udelay(5);
+
+/* Structure/enum declaration ------------------------------- */
+struct tx_desc {
+        u32 tdes0, tdes1, tdes2, tdes3; /* Data for the card */
+        char *tx_buf_ptr;               /* Data for us */
+        struct tx_desc *next_tx_desc;
+} __attribute__(( aligned(32) ));
+
+struct rx_desc {
+        u32 rdes0, rdes1, rdes2, rdes3; /* Data for the card */
+        struct sk_buff *rx_skb_ptr;     /* Data for us */
+        struct rx_desc *next_rx_desc;
+} __attribute__(( aligned(32) ));
+
+struct uli526x_board_info {
+        u32 chip_id;                    /* Chip vendor/Device ID */
+        struct net_device *next_dev;    /* next device */
+        struct pci_dev *pdev;           /* PCI device */
+        spinlock_t lock;
+
+        long ioaddr;                    /* I/O base address */
+        u32 cr0_data;
+        u32 cr5_data;
+        u32 cr6_data;
+        u32 cr7_data;
+        u32 cr15_data;
+
+        /* pointer for memory physical address */
+        dma_addr_t buf_pool_dma_ptr;    /* Tx buffer pool memory */
+        dma_addr_t buf_pool_dma_start;  /* Tx buffer pool align dword */
+        dma_addr_t desc_pool_dma_ptr;   /* descriptor pool memory */
+        dma_addr_t first_tx_desc_dma;
+        dma_addr_t first_rx_desc_dma;
+
+        /* descriptor pointer */
+        unsigned char *buf_pool_ptr;    /* Tx buffer pool memory */
+        unsigned char *buf_pool_start;  /* Tx buffer pool align dword */
+        unsigned char *desc_pool_ptr;   /* descriptor pool memory */
+        struct tx_desc *first_tx_desc;
+        struct tx_desc *tx_insert_ptr;
+        struct tx_desc *tx_remove_ptr;
+        struct rx_desc *first_rx_desc;
+        struct rx_desc *rx_insert_ptr;
+        struct rx_desc *rx_ready_ptr;   /* packet come pointer */
+        unsigned long tx_packet_cnt;    /* transmitted packet count */
+        unsigned long rx_avail_cnt;     /* available rx descriptor count */
+        unsigned long interval_rx_cnt;  /* rx packet count a callback time */
+
+        u16 dbug_cnt;
+        u16 NIC_capability;             /* NIC media capability */
+        u16 PHY_reg4;                   /* Saved Phyxcer register 4 value */
+
+        u8 media_mode;                  /* user specify media mode */
+        u8 op_mode;                     /* real work media mode */
+        u8 phy_addr;
+        u8 link_failed;                 /* Ever link failed */
+        u8 wait_reset;                  /* Hardware failed, need to reset */
+        struct timer_list timer;
+
+        /* System defined statistic counter */
+        struct net_device_stats stats;
+
+        /* Driver defined statistic counter */
+        unsigned long tx_fifo_underrun;
+        unsigned long tx_loss_carrier;
+        unsigned long tx_no_carrier;
+        unsigned long tx_late_collision;
+        unsigned long tx_excessive_collision;
+        unsigned long tx_jabber_timeout;
+        unsigned long reset_count;
+        unsigned long reset_cr8;
+        unsigned long reset_fatal;
+        unsigned long reset_TXtimeout;
+
+        /* NIC SROM data */
+        unsigned char srom[128];
+        u8 init;        
+};
+
+enum uli526x_offsets {
+        DCR0 = 0x00, DCR1 = 0x08, DCR2 = 0x10, DCR3 = 0x18, DCR4 = 0x20,
+        DCR5 = 0x28, DCR6 = 0x30, DCR7 = 0x38, DCR8 = 0x40, DCR9 = 0x48,
+        DCR10 = 0x50, DCR11 = 0x58, DCR12 = 0x60, DCR13 = 0x68, DCR14 = 0x70,
+        DCR15 = 0x78
+};
+
+enum uli526x_CR6_bits {
+        CR6_RXSC = 0x2, CR6_PBF = 0x8, CR6_PM = 0x40, CR6_PAM = 0x80,
+        CR6_FDM = 0x200, CR6_TXSC = 0x2000, CR6_STI = 0x100000,
+        CR6_SFT = 0x200000, CR6_RXA = 0x40000000, CR6_NO_PURGE = 0x20000000
+};
+
+/* Global variable declaration ----------------------------- */
+static int __devinitdata printed_version;
+static char version[] __devinitdata =
+        KERN_INFO DRV_NAME ": ULi M5261/M5263 net driver, version "
+        DRV_VERSION " (" DRV_RELDATE ")\n";
+
+static int uli526x_debug;
+static unsigned char uli526x_media_mode = ULI526X_AUTO;
+static u32 uli526x_cr6_user_set;
+
+/* For module input parameter */
+static int debug;
+static u32 cr6set;
+static unsigned char mode = 8;
+
+/* function declaration ------------------------------------- */
+static int uli526x_open(struct net_device *);
+static int uli526x_start_xmit(struct sk_buff *, struct net_device *);
+static int uli526x_stop(struct net_device *);
+static struct net_device_stats * uli526x_get_stats(struct net_device *);
+static void uli526x_set_filter_mode(struct net_device *);
+static struct ethtool_ops netdev_ethtool_ops;
+static u16 read_srom_word(long, int);
+static irqreturn_t uli526x_interrupt(int, void *, struct pt_regs *);
+static void uli526x_descriptor_init(struct uli526x_board_info *, unsigned long);
+static void allocate_rx_buffer(struct uli526x_board_info *);
+static void update_cr6(u32, unsigned long);
+static void send_filter_frame(struct net_device *, int);
+static u16 phy_read(unsigned long, u8, u8, u32);
+static u16 phy_readby_cr10(unsigned long, u8, u8);
+static void phy_write(unsigned long, u8, u8, u16, u32);
+static void phy_writeby_cr10(unsigned long, u8, u8, u16);
+static void phy_write_1bit(unsigned long, u32, u32);
+static u16 phy_read_1bit(unsigned long, u32);
+static u8 uli526x_sense_speed(struct uli526x_board_info *);
+static void uli526x_process_mode(struct uli526x_board_info *);
+static void uli526x_timer(unsigned long);
+static void uli526x_rx_packet(struct net_device *, struct uli526x_board_info *);
+static void uli526x_free_tx_pkt(struct net_device *, struct uli526x_board_info *);
+static void uli526x_reuse_skb(struct uli526x_board_info *, struct sk_buff *);
+static void uli526x_dynamic_reset(struct net_device *);
+static void uli526x_free_rxbuffer(struct uli526x_board_info *);
+static void uli526x_init(struct net_device *);
+static void uli526x_set_phyxcer(struct uli526x_board_info *);
+
+/* ULI526X network board routine ---------------------------- */
+
+/*
+ *      Search ULI526X board, allocate space and register it
+ */
+
+static int __devinit uli526x_init_one (struct pci_dev *pdev,
+                                    const struct pci_device_id *ent)
+{
+        struct uli526x_board_info *db;  /* board information structure */
+        struct net_device *dev;
+        int i, err;
+        
+        ULI526X_DBUG(0, "uli526x_init_one()", 0);
+
+        if (!printed_version++)
+                printk(version);
+
+        /* Init network device */
+        dev = alloc_etherdev(sizeof(*db));
+        if (dev == NULL)
+                return -ENOMEM;
+        SET_MODULE_OWNER(dev);
+        SET_NETDEV_DEV(dev, &pdev->dev);
+
+        if (pci_set_dma_mask(pdev, DMA_32BIT_MASK)) {
+                printk(KERN_WARNING DRV_NAME ": 32-bit PCI DMA not available.\n");
+                err = -ENODEV;
+                goto err_out_free;
+        }
+
+        /* Enable Master/IO access, Disable memory access */
+        err = pci_enable_device(pdev);
+        if (err)
+                goto err_out_free;
+
+        if (!pci_resource_start(pdev, 0)) {
+                printk(KERN_ERR DRV_NAME ": I/O base is zero\n");
+                err = -ENODEV;
+                goto err_out_disable;
+        }
+
+        if (pci_resource_len(pdev, 0) < (ULI526X_IO_SIZE) ) {
+                printk(KERN_ERR DRV_NAME ": Allocated I/O size too small\n");
+                err = -ENODEV;
+                goto err_out_disable;
+        }
+
+        if (pci_request_regions(pdev, DRV_NAME)) {
+                printk(KERN_ERR DRV_NAME ": Failed to request PCI regions\n");
+                err = -ENODEV;
+                goto err_out_disable;
+        }
+
+        /* Init system & device */
+        db = netdev_priv(dev);
+
+        /* Allocate Tx/Rx descriptor memory */
+        db->desc_pool_ptr = pci_alloc_consistent(pdev, sizeof(struct tx_desc) * DESC_ALL_CNT + 0x20, &db->desc_pool_dma_ptr);
+        if(db->desc_pool_ptr == NULL)
+        {
+                err = -ENOMEM;
+                goto err_out_nomem;
+        }
+        db->buf_pool_ptr = pci_alloc_consistent(pdev, TX_BUF_ALLOC * TX_DESC_CNT + 4, &db->buf_pool_dma_ptr);
+        if(db->buf_pool_ptr == NULL)
+        {
+                err = -ENOMEM;
+                goto err_out_nomem;
+        }
+        
+        db->first_tx_desc = (struct tx_desc *) db->desc_pool_ptr;
+        db->first_tx_desc_dma = db->desc_pool_dma_ptr;
+        db->buf_pool_start = db->buf_pool_ptr;
+        db->buf_pool_dma_start = db->buf_pool_dma_ptr;
+
+        db->chip_id = ent->driver_data;
+        db->ioaddr = pci_resource_start(pdev, 0);
+        
+        db->pdev = pdev;
+        db->init = 1;
+        
+        dev->base_addr = db->ioaddr;
+        dev->irq = pdev->irq;
+        pci_set_drvdata(pdev, dev);
+        
+        /* Register some necessary functions */
+        dev->open = &uli526x_open;
+        dev->hard_start_xmit = &uli526x_start_xmit;
+        dev->stop = &uli526x_stop;
+        dev->get_stats = &uli526x_get_stats;
+        dev->set_multicast_list = &uli526x_set_filter_mode;
+        dev->ethtool_ops = &netdev_ethtool_ops;
+        spin_lock_init(&db->lock);
+
+                
+        /* read 64 word srom data */
+        for (i = 0; i < 64; i++)
+                ((u16 *) db->srom)[i] = cpu_to_le16(read_srom_word(db->ioaddr, i));
+
+        /* Set Node address */
+        if(((u16 *) db->srom)[0] == 0xffff || ((u16 *) db->srom)[0] == 0)               /* SROM absent, so read MAC address from ID Table */
+        {
+                outl(0x10000, db->ioaddr + DCR0);       //Diagnosis mode
+                outl(0x1c0, db->ioaddr + DCR13);        //Reset dianostic pointer port
+                outl(0, db->ioaddr + DCR14);            //Clear reset port
+                outl(0x10, db->ioaddr + DCR14);         //Reset ID Table pointer
+                outl(0, db->ioaddr + DCR14);            //Clear reset port
+                outl(0, db->ioaddr + DCR13);            //Clear CR13
+                outl(0x1b0, db->ioaddr + DCR13);        //Select ID Table access port
+                //Read MAC address from CR14
+                for (i = 0; i < 6; i++)
+                        dev->dev_addr[i] = inl(db->ioaddr + DCR14);
+                //Read end
+                outl(0, db->ioaddr + DCR13);    //Clear CR13
+                outl(0, db->ioaddr + DCR0);             //Clear CR0
+                udelay(10);
+        }
+        else            /*Exist SROM*/
+        {
+                for (i = 0; i < 6; i++)
+                        dev->dev_addr[i] = db->srom[20 + i];
+        }
+        err = register_netdev (dev);
+        if (err)
+                goto err_out_res;
+
+        printk(KERN_INFO "%s: ULi M%04lx at pci%s,",dev->name,ent->driver_data >> 16,pci_name(pdev));
+        
+        for (i = 0; i < 6; i++)
+                printk("%c%02x", i ? ':' : ' ', dev->dev_addr[i]);
+        printk(", irq %d.\n", dev->irq);
+
+        pci_set_master(pdev);
+
+        return 0;
+
+err_out_res:
+        pci_release_regions(pdev);
+err_out_nomem:
+        if(db->desc_pool_ptr)
+                pci_free_consistent(pdev, sizeof(struct tx_desc) * DESC_ALL_CNT + 0x20,
+                        db->desc_pool_ptr, db->desc_pool_dma_ptr);
+                        
+        if(db->buf_pool_ptr != NULL)
+                pci_free_consistent(pdev, TX_BUF_ALLOC * TX_DESC_CNT + 4,
+                        db->buf_pool_ptr, db->buf_pool_dma_ptr);
+err_out_disable:
+        pci_disable_device(pdev);
+err_out_free:
+        pci_set_drvdata(pdev, NULL);
+        free_netdev(dev);
+
+        return err;
+}
+
+
+static void __devexit uli526x_remove_one (struct pci_dev *pdev)
+{
+        struct net_device *dev = pci_get_drvdata(pdev);
+        struct uli526x_board_info *db = netdev_priv(dev);
+
+        ULI526X_DBUG(0, "uli526x_remove_one()", 0);
+
+        pci_free_consistent(db->pdev, sizeof(struct tx_desc) *
+                                DESC_ALL_CNT + 0x20, db->desc_pool_ptr,
+                                db->desc_pool_dma_ptr);
+        pci_free_consistent(db->pdev, TX_BUF_ALLOC * TX_DESC_CNT + 4,
+                                db->buf_pool_ptr, db->buf_pool_dma_ptr);
+        unregister_netdev(dev);
+        pci_release_regions(pdev);
+        free_netdev(dev);       /* free board information */
+        pci_set_drvdata(pdev, NULL);
+        pci_disable_device(pdev);
+        ULI526X_DBUG(0, "uli526x_remove_one() exit", 0);
+}
+
+
+/*
+ *      Open the interface.
+ *      The interface is opened whenever "ifconfig" activates it.
+ */
+
+static int uli526x_open(struct net_device *dev)
+{
+        int ret;
+        struct uli526x_board_info *db = netdev_priv(dev);
+        
+        ULI526X_DBUG(0, "uli526x_open", 0);
+
+        ret = request_irq(dev->irq, &uli526x_interrupt, SA_SHIRQ, dev->name, dev);
+        if (ret)
+                return ret;
+
+        /* system variable init */
+        db->cr6_data = CR6_DEFAULT | uli526x_cr6_user_set;
+        db->tx_packet_cnt = 0;
+        db->rx_avail_cnt = 0;
+        db->link_failed = 1;
+        netif_carrier_off(dev);
+        db->wait_reset = 0;
+
+        db->NIC_capability = 0xf;       /* All capability*/
+        db->PHY_reg4 = 0x1e0;
+
+        /* CR6 operation mode decision */
+        db->cr6_data |= ULI526X_TXTH_256;
+        db->cr0_data = CR0_DEFAULT;
+        
+        /* Initialize ULI526X board */
+        uli526x_init(dev);
+
+        /* Active System Interface */
+        netif_wake_queue(dev);
+
+        /* set and active a timer process */
+        init_timer(&db->timer);
+        db->timer.expires = ULI526X_TIMER_WUT + HZ * 2;
+        db->timer.data = (unsigned long)dev;
+        db->timer.function = &uli526x_timer;
+        add_timer(&db->timer);
+
+        return 0;
+}
+
+
+/*      Initialize ULI526X board
+ *      Reset ULI526X board
+ *      Initialize TX/Rx descriptor chain structure
+ *      Send the set-up frame
+ *      Enable Tx/Rx machine
+ */
+
+static void uli526x_init(struct net_device *dev)
+{
+        struct uli526x_board_info *db = netdev_priv(dev);
+        unsigned long ioaddr = db->ioaddr;
+        u8      phy_tmp;
+        u16     phy_value;
+        u16 phy_reg_reset;
+
+        ULI526X_DBUG(0, "uli526x_init()", 0);
+
+        /* Reset M526x MAC controller */
+        outl(ULI526X_RESET, ioaddr + DCR0);     /* RESET MAC */
+        udelay(100);
+        outl(db->cr0_data, ioaddr + DCR0);
+        udelay(5);
+
+        /* Phy addr : In some boards,M5261/M5263 phy address != 1 */
+        db->phy_addr = 1;
+        for(phy_tmp=0;phy_tmp<32;phy_tmp++)
+        {
+                phy_value=phy_read(db->ioaddr,phy_tmp,3,db->chip_id);//peer add
+                if(phy_value != 0xffff&&phy_value!=0)
+                {
+                        db->phy_addr = phy_tmp;
+                        break;
+                }
+        }
+        if(phy_tmp == 32)
+                printk(KERN_WARNING "Can not find the phy address!!!");
+        /* Parser SROM and media mode */
+        db->media_mode = uli526x_media_mode;
+
+        /* Phyxcer capability setting */
+        phy_reg_reset = phy_read(db->ioaddr, db->phy_addr, 0, db->chip_id);
+        phy_reg_reset = (phy_reg_reset | 0x8000);
+        phy_write(db->ioaddr, db->phy_addr, 0, phy_reg_reset, db->chip_id);
+        udelay(500);
+
+        /* Process Phyxcer Media Mode */
+        uli526x_set_phyxcer(db);
+
+        /* Media Mode Process */
+        if ( !(db->media_mode & ULI526X_AUTO) )
+                db->op_mode = db->media_mode;   /* Force Mode */
+
+        /* Initialize Transmit/Receive decriptor and CR3/4 */
+        uli526x_descriptor_init(db, ioaddr);
+
+        /* Init CR6 to program M526X operation */
+        update_cr6(db->cr6_data, ioaddr);
+
+        /* Send setup frame */
+        send_filter_frame(dev, dev->mc_count);  /* M5261/M5263 */
+
+        /* Init CR7, interrupt active bit */
+        db->cr7_data = CR7_DEFAULT;
+        outl(db->cr7_data, ioaddr + DCR7);
+
+        /* Init CR15, Tx jabber and Rx watchdog timer */
+        outl(db->cr15_data, ioaddr + DCR15);
+
+        /* Enable ULI526X Tx/Rx function */
+        db->cr6_data |= CR6_RXSC | CR6_TXSC;
+        update_cr6(db->cr6_data, ioaddr);
+}
+
+
+/*
+ *      Hardware start transmission.
+ *      Send a packet to media from the upper layer.
+ */
+
+static int uli526x_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct uli526x_board_info *db = netdev_priv(dev);
+        struct tx_desc *txptr;
+        unsigned long flags;
+
+        ULI526X_DBUG(0, "uli526x_start_xmit", 0);
+
+        /* Resource flag check */
+        netif_stop_queue(dev);
+
+        /* Too large packet check */
+        if (skb->len > MAX_PACKET_SIZE) {
+                printk(KERN_ERR DRV_NAME ": big packet = %d\n", (u16)skb->len);
+                dev_kfree_skb(skb);
+                return 0;
+        }
+
+        spin_lock_irqsave(&db->lock, flags);
+
+        /* No Tx resource check, it never happen nromally */
+        if (db->tx_packet_cnt >= TX_FREE_DESC_CNT) {
+                spin_unlock_irqrestore(&db->lock, flags);
+                printk(KERN_ERR DRV_NAME ": No Tx resource %ld\n", db->tx_packet_cnt);
+                return 1;
+        }
+
+        /* Disable NIC interrupt */
+        outl(0, dev->base_addr + DCR7);
+
+        /* transmit this packet */
+        txptr = db->tx_insert_ptr;
+        memcpy(txptr->tx_buf_ptr, skb->data, skb->len);
+        txptr->tdes1 = cpu_to_le32(0xe1000000 | skb->len);
+
+        /* Point to next transmit free descriptor */
+        db->tx_insert_ptr = txptr->next_tx_desc;
+
+        /* Transmit Packet Process */
+        if ( (db->tx_packet_cnt < TX_DESC_CNT) ) {
+                txptr->tdes0 = cpu_to_le32(0x80000000); /* Set owner bit */
+                db->tx_packet_cnt++;                    /* Ready to send */
+                outl(0x1, dev->base_addr + DCR1);       /* Issue Tx polling */
+                dev->trans_start = jiffies;             /* saved time stamp */
+        }
+
+        /* Tx resource check */
+        if ( db->tx_packet_cnt < TX_FREE_DESC_CNT )
+                netif_wake_queue(dev);
+
+        /* Restore CR7 to enable interrupt */
+        spin_unlock_irqrestore(&db->lock, flags);
+        outl(db->cr7_data, dev->base_addr + DCR7);
+        
+        /* free this SKB */
+        dev_kfree_skb(skb);
+
+        return 0;
+}
+
+
+/*
+ *      Stop the interface.
+ *      The interface is stopped when it is brought.
+ */
+
+static int uli526x_stop(struct net_device *dev)
+{
+        struct uli526x_board_info *db = netdev_priv(dev);
+        unsigned long ioaddr = dev->base_addr;
+
+        ULI526X_DBUG(0, "uli526x_stop", 0);
+
+        /* disable system */
+        netif_stop_queue(dev);
+
+        /* deleted timer */
+        del_timer_sync(&db->timer);
+
+        /* Reset & stop ULI526X board */
+        outl(ULI526X_RESET, ioaddr + DCR0);
+        udelay(5);
+        phy_write(db->ioaddr, db->phy_addr, 0, 0x8000, db->chip_id);
+
+        /* free interrupt */
+        free_irq(dev->irq, dev);
+
+        /* free allocated rx buffer */
+        uli526x_free_rxbuffer(db);
+
+#if 0
+        /* show statistic counter */
+        printk(DRV_NAME ": FU:%lx EC:%lx LC:%lx NC:%lx LOC:%lx TXJT:%lx RESET:%lx RCR8:%lx FAL:%lx TT:%lx\n",
+                db->tx_fifo_underrun, db->tx_excessive_collision,
+                db->tx_late_collision, db->tx_no_carrier, db->tx_loss_carrier,
+                db->tx_jabber_timeout, db->reset_count, db->reset_cr8,
+                db->reset_fatal, db->reset_TXtimeout);
+#endif
+
+        return 0;
+}
+
+
+/*
+ *      M5261/M5263 insterrupt handler
+ *      receive the packet to upper layer, free the transmitted packet
+ */
+
+static irqreturn_t uli526x_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct net_device *dev = dev_id;
+        struct uli526x_board_info *db = netdev_priv(dev);
+        unsigned long ioaddr = dev->base_addr;
+        unsigned long flags;
+
+        if (!dev) {
+                ULI526X_DBUG(1, "uli526x_interrupt() without DEVICE arg", 0);
+                return IRQ_NONE;
+        }
+
+        spin_lock_irqsave(&db->lock, flags);
+        outl(0, ioaddr + DCR7);
+
+        /* Got ULI526X status */
+        db->cr5_data = inl(ioaddr + DCR5);
+        outl(db->cr5_data, ioaddr + DCR5);
+        if ( !(db->cr5_data & 0x180c1) ) {
+                spin_unlock_irqrestore(&db->lock, flags);
+                outl(db->cr7_data, ioaddr + DCR7);
+                return IRQ_HANDLED;
+        }
+
+        /* Check system status */
+        if (db->cr5_data & 0x2000) {
+                /* system bus error happen */
+                ULI526X_DBUG(1, "System bus error happen. CR5=", db->cr5_data);
+                db->reset_fatal++;
+                db->wait_reset = 1;     /* Need to RESET */
+                spin_unlock_irqrestore(&db->lock, flags);
+                return IRQ_HANDLED;
+        }
+
+         /* Received the coming packet */
+        if ( (db->cr5_data & 0x40) && db->rx_avail_cnt )
+                uli526x_rx_packet(dev, db);
+
+        /* reallocate rx descriptor buffer */
+        if (db->rx_avail_cnt<RX_DESC_CNT)
+                allocate_rx_buffer(db);
+
+        /* Free the transmitted descriptor */
+        if ( db->cr5_data & 0x01)
+                uli526x_free_tx_pkt(dev, db);
+
+        /* Restore CR7 to enable interrupt mask */
+        outl(db->cr7_data, ioaddr + DCR7);
+
+        spin_unlock_irqrestore(&db->lock, flags);
+        return IRQ_HANDLED;
+}
+
+
+/*
+ *      Free TX resource after TX complete
+ */
+
+static void uli526x_free_tx_pkt(struct net_device *dev, struct uli526x_board_info * db)
+{
+        struct tx_desc *txptr;
+        u32 tdes0;
+
+        txptr = db->tx_remove_ptr;
+        while(db->tx_packet_cnt) {
+                tdes0 = le32_to_cpu(txptr->tdes0);
+                /* printk(DRV_NAME ": tdes0=%x\n", tdes0); */
+                if (tdes0 & 0x80000000)
+                        break;
+
+                /* A packet sent completed */
+                db->tx_packet_cnt--;
+                db->stats.tx_packets++;
+
+                /* Transmit statistic counter */
+                if ( tdes0 != 0x7fffffff ) {
+                        /* printk(DRV_NAME ": tdes0=%x\n", tdes0); */
+                        db->stats.collisions += (tdes0 >> 3) & 0xf;
+                        db->stats.tx_bytes += le32_to_cpu(txptr->tdes1) & 0x7ff;
+                        if (tdes0 & TDES0_ERR_MASK) {
+                                db->stats.tx_errors++;
+                                if (tdes0 & 0x0002) {   /* UnderRun */
+                                        db->tx_fifo_underrun++;
+                                        if ( !(db->cr6_data & CR6_SFT) ) {
+                                                db->cr6_data = db->cr6_data | CR6_SFT;
+                                                update_cr6(db->cr6_data, db->ioaddr);
+                                        }
+                                }
+                                if (tdes0 & 0x0100)
+                                        db->tx_excessive_collision++;
+                                if (tdes0 & 0x0200)
+                                        db->tx_late_collision++;
+                                if (tdes0 & 0x0400)
+                                        db->tx_no_carrier++;
+                                if (tdes0 & 0x0800)
+                                        db->tx_loss_carrier++;
+                                if (tdes0 & 0x4000)
+                                        db->tx_jabber_timeout++;
+                        }
+                }
+
+                txptr = txptr->next_tx_desc;
+        }/* End of while */
+
+        /* Update TX remove pointer to next */
+        db->tx_remove_ptr = txptr;
+
+        /* Resource available check */
+        if ( db->tx_packet_cnt < TX_WAKE_DESC_CNT )
+                netif_wake_queue(dev);  /* Active upper layer, send again */
+}
+
+
+/*
+ *      Receive the come packet and pass to upper layer
+ */
+
+static void uli526x_rx_packet(struct net_device *dev, struct uli526x_board_info * db)
+{
+        struct rx_desc *rxptr;
+        struct sk_buff *skb;
+        int rxlen;
+        u32 rdes0;
+        
+        rxptr = db->rx_ready_ptr;
+
+        while(db->rx_avail_cnt) {
+                rdes0 = le32_to_cpu(rxptr->rdes0);
+                if (rdes0 & 0x80000000) /* packet owner check */
+                {
+                        break;
+                }
+
+                db->rx_avail_cnt--;
+                db->interval_rx_cnt++;
+
+                pci_unmap_single(db->pdev, le32_to_cpu(rxptr->rdes2), RX_ALLOC_SIZE, PCI_DMA_FROMDEVICE);
+                if ( (rdes0 & 0x300) != 0x300) {
+                        /* A packet without First/Last flag */
+                        /* reuse this SKB */
+                        ULI526X_DBUG(0, "Reuse SK buffer, rdes0", rdes0);
+                        uli526x_reuse_skb(db, rxptr->rx_skb_ptr);
+                } else {
+                        /* A packet with First/Last flag */
+                        rxlen = ( (rdes0 >> 16) & 0x3fff) - 4;
+
+                        /* error summary bit check */
+                        if (rdes0 & 0x8000) {
+                                /* This is a error packet */
+                                //printk(DRV_NAME ": rdes0: %lx\n", rdes0);
+                                db->stats.rx_errors++;
+                                if (rdes0 & 1)
+                                        db->stats.rx_fifo_errors++;
+                                if (rdes0 & 2)
+                                        db->stats.rx_crc_errors++;
+                                if (rdes0 & 0x80)
+                                        db->stats.rx_length_errors++;
+                        }
+
+                        if ( !(rdes0 & 0x8000) ||
+                                ((db->cr6_data & CR6_PM) && (rxlen>6)) ) {
+                                skb = rxptr->rx_skb_ptr;
+                
+                                /* Good packet, send to upper layer */
+                                /* Shorst packet used new SKB */
+                                if ( (rxlen < RX_COPY_SIZE) &&
+                                        ( (skb = dev_alloc_skb(rxlen + 2) )
+                                        != NULL) ) {
+                                        /* size less than COPY_SIZE, allocate a rxlen SKB */
+                                        skb->dev = dev;
+                                        skb_reserve(skb, 2); /* 16byte align */
+                                        memcpy(skb_put(skb, rxlen), rxptr->rx_skb_ptr->tail, rxlen);
+                                        uli526x_reuse_skb(db, rxptr->rx_skb_ptr);
+                                } else {
+                                        skb->dev = dev;
+                                        skb_put(skb, rxlen);
+                                }
+                                skb->protocol = eth_type_trans(skb, dev);
+                                netif_rx(skb);
+                                dev->last_rx = jiffies;
+                                db->stats.rx_packets++;
+                                db->stats.rx_bytes += rxlen;
+                                
+                        } else {
+                                /* Reuse SKB buffer when the packet is error */
+                                ULI526X_DBUG(0, "Reuse SK buffer, rdes0", rdes0);
+                                uli526x_reuse_skb(db, rxptr->rx_skb_ptr);
+                        }
+                }
+
+                rxptr = rxptr->next_rx_desc;
+        }
+
+        db->rx_ready_ptr = rxptr;
+}
+
+
+/*
+ *      Get statistics from driver.
+ */
+
+static struct net_device_stats * uli526x_get_stats(struct net_device *dev)
+{
+        struct uli526x_board_info *db = netdev_priv(dev);
+
+        ULI526X_DBUG(0, "uli526x_get_stats", 0);
+        return &db->stats;
+}
+
+
+/*
+ * Set ULI526X multicast address
+ */
+
+static void uli526x_set_filter_mode(struct net_device * dev)
+{
+        struct uli526x_board_info *db = dev->priv;
+        unsigned long flags;
+
+        ULI526X_DBUG(0, "uli526x_set_filter_mode()", 0);
+        spin_lock_irqsave(&db->lock, flags);
+
+        if (dev->flags & IFF_PROMISC) {
+                ULI526X_DBUG(0, "Enable PROM Mode", 0);
+                db->cr6_data |= CR6_PM | CR6_PBF;
+                update_cr6(db->cr6_data, db->ioaddr);
+                spin_unlock_irqrestore(&db->lock, flags);
+                return;
+        }
+
+        if (dev->flags & IFF_ALLMULTI || dev->mc_count > ULI5261_MAX_MULTICAST) {
+                ULI526X_DBUG(0, "Pass all multicast address", dev->mc_count);
+                db->cr6_data &= ~(CR6_PM | CR6_PBF);
+                db->cr6_data |= CR6_PAM;
+                spin_unlock_irqrestore(&db->lock, flags);
+                return;
+        }
+
+        ULI526X_DBUG(0, "Set multicast address", dev->mc_count);
+        send_filter_frame(dev, dev->mc_count);  /* M5261/M5263 */
+        spin_unlock_irqrestore(&db->lock, flags);
+}
+
+static void
+ULi_ethtool_gset(struct uli526x_board_info *db, struct ethtool_cmd *ecmd)
+{
+        ecmd->supported = (SUPPORTED_10baseT_Half |
+                           SUPPORTED_10baseT_Full |
+                           SUPPORTED_100baseT_Half |
+                           SUPPORTED_100baseT_Full |
+                           SUPPORTED_Autoneg |
+                           SUPPORTED_MII);
+                
+        ecmd->advertising = (ADVERTISED_10baseT_Half |
+                           ADVERTISED_10baseT_Full |
+                           ADVERTISED_100baseT_Half |
+                           ADVERTISED_100baseT_Full |
+                           ADVERTISED_Autoneg |
+                           ADVERTISED_MII);
+
+
+        ecmd->port = PORT_MII;
+        ecmd->phy_address = db->phy_addr;
+
+        ecmd->transceiver = XCVR_EXTERNAL;
+                
+        ecmd->speed = 10;
+        ecmd->duplex = DUPLEX_HALF;
+        
+        if(db->op_mode==ULI526X_100MHF || db->op_mode==ULI526X_100MFD)
+        {
+                ecmd->speed = 100;               
+        }
+        if(db->op_mode==ULI526X_10MFD || db->op_mode==ULI526X_100MFD)
+        {
+                ecmd->duplex = DUPLEX_FULL;
+        }
+        if(db->link_failed)
+        {
+                ecmd->speed = -1;
+                ecmd->duplex = -1;      
+        }
+        
+        if (db->media_mode & ULI526X_AUTO)
+        {       
+                ecmd->autoneg = AUTONEG_ENABLE;
+        }
+}
+
+static void netdev_get_drvinfo(struct net_device *dev,
+                               struct ethtool_drvinfo *info)
+{
+        struct uli526x_board_info *np = netdev_priv(dev);
+
+        strcpy(info->driver, DRV_NAME);
+        strcpy(info->version, DRV_VERSION);
+        if (np->pdev)
+                strcpy(info->bus_info, pci_name(np->pdev));
+        else
+                sprintf(info->bus_info, "EISA 0x%lx %d",
+                        dev->base_addr, dev->irq);
+}
+
+static int netdev_get_settings(struct net_device *dev, struct ethtool_cmd *cmd) {
+        struct uli526x_board_info *np = netdev_priv(dev);
+        
+        ULi_ethtool_gset(np, cmd);
+        
+        return 0;
+}
+
+static u32 netdev_get_link(struct net_device *dev) {
+        struct uli526x_board_info *np = netdev_priv(dev);
+                
+        if(np->link_failed)
+                return 0;
+        else
+                return 1;
+}
+
+static void uli526x_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
+{
+        wol->supported = WAKE_PHY | WAKE_MAGIC;
+        wol->wolopts = 0;
+}
+
+static struct ethtool_ops netdev_ethtool_ops = {
+        .get_drvinfo            = netdev_get_drvinfo,
+        .get_settings           = netdev_get_settings,
+        .get_link               = netdev_get_link,
+        .get_wol                = uli526x_get_wol,
+};
+
+/*
+ *      A periodic timer routine
+ *      Dynamic media sense, allocate Rx buffer...
+ */
+
+static void uli526x_timer(unsigned long data)
+{
+        u32 tmp_cr8;
+        unsigned char tmp_cr12=0;
+        struct net_device *dev = (struct net_device *) data;
+        struct uli526x_board_info *db = netdev_priv(dev);
+        unsigned long flags;
+        u8 TmpSpeed=10;
+        
+        //ULI526X_DBUG(0, "uli526x_timer()", 0);
+        spin_lock_irqsave(&db->lock, flags);
+
+        
+        /* Dynamic reset ULI526X : system error or transmit time-out */
+        tmp_cr8 = inl(db->ioaddr + DCR8);
+        if ( (db->interval_rx_cnt==0) && (tmp_cr8) ) {
+                db->reset_cr8++;
+                db->wait_reset = 1;
+        }
+        db->interval_rx_cnt = 0;
+
+        /* TX polling kick monitor */
+        if ( db->tx_packet_cnt &&
+             time_after(jiffies, dev->trans_start + ULI526X_TX_KICK) ) {
+                outl(0x1, dev->base_addr + DCR1);   // Tx polling again 
+
+                // TX Timeout 
+                if ( time_after(jiffies, dev->trans_start + ULI526X_TX_TIMEOUT) ) {
+                        db->reset_TXtimeout++;
+                        db->wait_reset = 1;
+                        printk( "%s: Tx timeout - resetting\n",
+                               dev->name);
+                }
+        }
+
+        if (db->wait_reset) {
+                ULI526X_DBUG(0, "Dynamic Reset device", db->tx_packet_cnt);
+                db->reset_count++;
+                uli526x_dynamic_reset(dev);
+                db->timer.expires = ULI526X_TIMER_WUT;
+                add_timer(&db->timer);
+                spin_unlock_irqrestore(&db->lock, flags);
+                return;
+        }
+
+        /* Link status check, Dynamic media type change */
+        if((phy_read(db->ioaddr, db->phy_addr, 5, db->chip_id) & 0x01e0)!=0)
+                tmp_cr12 = 3;
+
+        if ( !(tmp_cr12 & 0x3) && !db->link_failed ) {
+                /* Link Failed */
+                ULI526X_DBUG(0, "Link Failed", tmp_cr12);
+                netif_carrier_off(dev);
+                printk(KERN_INFO "uli526x: %s NIC Link is Down\n",dev->name);
+                db->link_failed = 1;
+
+                /* For Force 10/100M Half/Full mode: Enable Auto-Nego mode */
+                /* AUTO don't need */
+                if ( !(db->media_mode & 0x8) )
+                        phy_write(db->ioaddr, db->phy_addr, 0, 0x1000, db->chip_id);
+
+                /* AUTO mode, if INT phyxcer link failed, select EXT device */
+                if (db->media_mode & ULI526X_AUTO) {
+                        db->cr6_data&=~0x00000200;      /* bit9=0, HD mode */
+                        update_cr6(db->cr6_data, db->ioaddr);
+                }
+        } else
+                if ((tmp_cr12 & 0x3) && db->link_failed) {
+                        ULI526X_DBUG(0, "Link link OK", tmp_cr12);
+                        db->link_failed = 0;
+
+                        /* Auto Sense Speed */
+                        if ( (db->media_mode & ULI526X_AUTO) &&
+                                uli526x_sense_speed(db) )
+                                db->link_failed = 1;
+                        uli526x_process_mode(db);
+                        
+                        if(db->link_failed==0)
+                        {
+                                if(db->op_mode==ULI526X_100MHF || db->op_mode==ULI526X_100MFD)
+                                {
+                                        TmpSpeed = 100;
+                                }
+                                if(db->op_mode==ULI526X_10MFD || db->op_mode==ULI526X_100MFD)
+                                {
+                                        printk(KERN_INFO "uli526x: %s NIC Link is Up %d Mbps Full duplex\n",dev->name,TmpSpeed);
+                                }
+                                else
+                                {
+                                        printk(KERN_INFO "uli526x: %s NIC Link is Up %d Mbps Half duplex\n",dev->name,TmpSpeed);
+                                }
+                                netif_carrier_on(dev);
+                        }
+                        /* SHOW_MEDIA_TYPE(db->op_mode); */
+                }
+                else if(!(tmp_cr12 & 0x3) && db->link_failed)
+                {
+                        if(db->init==1)
+                        {
+                                printk(KERN_INFO "uli526x: %s NIC Link is Down\n",dev->name);
+                                netif_carrier_off(dev);
+                        }
+                }
+                db->init=0;
+
+        /* Timer active again */
+        db->timer.expires = ULI526X_TIMER_WUT;
+        add_timer(&db->timer);
+        spin_unlock_irqrestore(&db->lock, flags);
+}
+
+
+/*
+ *      Dynamic reset the ULI526X board
+ *      Stop ULI526X board
+ *      Free Tx/Rx allocated memory
+ *      Reset ULI526X board
+ *      Re-initialize ULI526X board
+ */
+
+static void uli526x_dynamic_reset(struct net_device *dev)
+{
+        struct uli526x_board_info *db = netdev_priv(dev);
+
+        ULI526X_DBUG(0, "uli526x_dynamic_reset()", 0);
+
+        /* Sopt MAC controller */
+        db->cr6_data &= ~(CR6_RXSC | CR6_TXSC); /* Disable Tx/Rx */
+        update_cr6(db->cr6_data, dev->base_addr);
+        outl(0, dev->base_addr + DCR7);         /* Disable Interrupt */
+        outl(inl(dev->base_addr + DCR5), dev->base_addr + DCR5);
+
+        /* Disable upper layer interface */
+        netif_stop_queue(dev);
+
+        /* Free Rx Allocate buffer */
+        uli526x_free_rxbuffer(db);
+
+        /* system variable init */
+        db->tx_packet_cnt = 0;
+        db->rx_avail_cnt = 0;
+        db->link_failed = 1;
+        db->init=1;
+        db->wait_reset = 0;
+
+        /* Re-initialize ULI526X board */
+        uli526x_init(dev);
+
+        /* Restart upper layer interface */
+        netif_wake_queue(dev);
+}
+
+
+/*
+ *      free all allocated rx buffer
+ */
+
+static void uli526x_free_rxbuffer(struct uli526x_board_info * db)
+{
+        ULI526X_DBUG(0, "uli526x_free_rxbuffer()", 0);
+
+        /* free allocated rx buffer */
+        while (db->rx_avail_cnt) {
+                dev_kfree_skb(db->rx_ready_ptr->rx_skb_ptr);
+                db->rx_ready_ptr = db->rx_ready_ptr->next_rx_desc;
+                db->rx_avail_cnt--;
+        }
+}
+
+
+/*
+ *      Reuse the SK buffer
+ */
+
+static void uli526x_reuse_skb(struct uli526x_board_info *db, struct sk_buff * skb)
+{
+        struct rx_desc *rxptr = db->rx_insert_ptr;
+
+        if (!(rxptr->rdes0 & cpu_to_le32(0x80000000))) {
+                rxptr->rx_skb_ptr = skb;
+                rxptr->rdes2 = cpu_to_le32( pci_map_single(db->pdev, skb->tail, RX_ALLOC_SIZE, PCI_DMA_FROMDEVICE) );
+                wmb();
+                rxptr->rdes0 = cpu_to_le32(0x80000000);
+                db->rx_avail_cnt++;
+                db->rx_insert_ptr = rxptr->next_rx_desc;
+        } else
+                ULI526X_DBUG(0, "SK Buffer reuse method error", db->rx_avail_cnt);
+}
+
+
+/*
+ *      Initialize transmit/Receive descriptor
+ *      Using Chain structure, and allocate Tx/Rx buffer
+ */
+
+static void uli526x_descriptor_init(struct uli526x_board_info *db, unsigned long ioaddr)
+{
+        struct tx_desc *tmp_tx;
+        struct rx_desc *tmp_rx;
+        unsigned char *tmp_buf;
+        dma_addr_t tmp_tx_dma, tmp_rx_dma;
+        dma_addr_t tmp_buf_dma;
+        int i;
+
+        ULI526X_DBUG(0, "uli526x_descriptor_init()", 0);
+
+        /* tx descriptor start pointer */
+        db->tx_insert_ptr = db->first_tx_desc;
+        db->tx_remove_ptr = db->first_tx_desc;
+        outl(db->first_tx_desc_dma, ioaddr + DCR4);     /* TX DESC address */
+
+        /* rx descriptor start pointer */
+        db->first_rx_desc = (void *)db->first_tx_desc + sizeof(struct tx_desc) * TX_DESC_CNT;
+        db->first_rx_desc_dma =  db->first_tx_desc_dma + sizeof(struct tx_desc) * TX_DESC_CNT;
+        db->rx_insert_ptr = db->first_rx_desc;
+        db->rx_ready_ptr = db->first_rx_desc;
+        outl(db->first_rx_desc_dma, ioaddr + DCR3);     /* RX DESC address */
+
+        /* Init Transmit chain */
+        tmp_buf = db->buf_pool_start;
+        tmp_buf_dma = db->buf_pool_dma_start;
+        tmp_tx_dma = db->first_tx_desc_dma;
+        for (tmp_tx = db->first_tx_desc, i = 0; i < TX_DESC_CNT; i++, tmp_tx++) {
+                tmp_tx->tx_buf_ptr = tmp_buf;
+                tmp_tx->tdes0 = cpu_to_le32(0);
+                tmp_tx->tdes1 = cpu_to_le32(0x81000000);        /* IC, chain */
+                tmp_tx->tdes2 = cpu_to_le32(tmp_buf_dma);
+                tmp_tx_dma += sizeof(struct tx_desc);
+                tmp_tx->tdes3 = cpu_to_le32(tmp_tx_dma);
+                tmp_tx->next_tx_desc = tmp_tx + 1;
+                tmp_buf = tmp_buf + TX_BUF_ALLOC;
+                tmp_buf_dma = tmp_buf_dma + TX_BUF_ALLOC;
+        }
+        (--tmp_tx)->tdes3 = cpu_to_le32(db->first_tx_desc_dma);
+        tmp_tx->next_tx_desc = db->first_tx_desc;
+
+         /* Init Receive descriptor chain */
+        tmp_rx_dma=db->first_rx_desc_dma;
+        for (tmp_rx = db->first_rx_desc, i = 0; i < RX_DESC_CNT; i++, tmp_rx++) {
+                tmp_rx->rdes0 = cpu_to_le32(0);
+                tmp_rx->rdes1 = cpu_to_le32(0x01000600);
+                tmp_rx_dma += sizeof(struct rx_desc);
+                tmp_rx->rdes3 = cpu_to_le32(tmp_rx_dma);
+                tmp_rx->next_rx_desc = tmp_rx + 1;
+        }
+        (--tmp_rx)->rdes3 = cpu_to_le32(db->first_rx_desc_dma);
+        tmp_rx->next_rx_desc = db->first_rx_desc;
+
+        /* pre-allocate Rx buffer */
+        allocate_rx_buffer(db);
+}
+
+
+/*
+ *      Update CR6 value
+ *      Firstly stop ULI526X, then written value and start
+ */
+
+static void update_cr6(u32 cr6_data, unsigned long ioaddr)
+{
+
+        outl(cr6_data, ioaddr + DCR6);
+        udelay(5);
+}
+
+
+/*
+ *      Send a setup frame for M5261/M5263
+ *      This setup frame initialize ULI526X address filter mode
+ */
+
+static void send_filter_frame(struct net_device *dev, int mc_cnt)
+{
+        struct uli526x_board_info *db = netdev_priv(dev);
+        struct dev_mc_list *mcptr;
+        struct tx_desc *txptr;
+        u16 * addrptr;
+        u32 * suptr;
+        int i;
+
+        ULI526X_DBUG(0, "send_filter_frame()", 0);
+
+        txptr = db->tx_insert_ptr;
+        suptr = (u32 *) txptr->tx_buf_ptr;
+
+        /* Node address */
+        addrptr = (u16 *) dev->dev_addr;
+        *suptr++ = addrptr[0];
+        *suptr++ = addrptr[1];
+        *suptr++ = addrptr[2];
+
+        /* broadcast address */
+        *suptr++ = 0xffff;
+        *suptr++ = 0xffff;
+        *suptr++ = 0xffff;
+
+        /* fit the multicast address */
+        for (mcptr = dev->mc_list, i = 0; i < mc_cnt; i++, mcptr = mcptr->next) {
+                addrptr = (u16 *) mcptr->dmi_addr;
+                *suptr++ = addrptr[0];
+                *suptr++ = addrptr[1];
+                *suptr++ = addrptr[2];
+        }
+
+        for (; i<14; i++) {
+                *suptr++ = 0xffff;
+                *suptr++ = 0xffff;
+                *suptr++ = 0xffff;
+        }
+
+        /* prepare the setup frame */
+        db->tx_insert_ptr = txptr->next_tx_desc;
+        txptr->tdes1 = cpu_to_le32(0x890000c0);
+
+        /* Resource Check and Send the setup packet */
+        if (db->tx_packet_cnt < TX_DESC_CNT) {
+                /* Resource Empty */
+                db->tx_packet_cnt++;
+                txptr->tdes0 = cpu_to_le32(0x80000000);
+                update_cr6(db->cr6_data | 0x2000, dev->base_addr);
+                outl(0x1, dev->base_addr + DCR1);       /* Issue Tx polling */
+                update_cr6(db->cr6_data, dev->base_addr);
+                dev->trans_start = jiffies;
+        } else
+                printk(KERN_ERR DRV_NAME ": No Tx resource - Send_filter_frame!\n");
+}
+
+
+/*
+ *      Allocate rx buffer,
+ *      As possible as allocate maxiumn Rx buffer
+ */
+
+static void allocate_rx_buffer(struct uli526x_board_info *db)
+{
+        struct rx_desc *rxptr;
+        struct sk_buff *skb;
+
+        rxptr = db->rx_insert_ptr;
+
+        while(db->rx_avail_cnt < RX_DESC_CNT) {
+                if ( ( skb = dev_alloc_skb(RX_ALLOC_SIZE) ) == NULL )
+                        break;
+                rxptr->rx_skb_ptr = skb; /* FIXME (?) */
+                rxptr->rdes2 = cpu_to_le32( pci_map_single(db->pdev, skb->tail, RX_ALLOC_SIZE, PCI_DMA_FROMDEVICE) );
+                wmb();
+                rxptr->rdes0 = cpu_to_le32(0x80000000);
+                rxptr = rxptr->next_rx_desc;
+                db->rx_avail_cnt++;
+        }
+
+        db->rx_insert_ptr = rxptr;
+}
+
+
+/*
+ *      Read one word data from the serial ROM
+ */
+
+static u16 read_srom_word(long ioaddr, int offset)
+{
+        int i;
+        u16 srom_data = 0;
+        long cr9_ioaddr = ioaddr + DCR9;
+
+        outl(CR9_SROM_READ, cr9_ioaddr);
+        outl(CR9_SROM_READ | CR9_SRCS, cr9_ioaddr);
+
+        /* Send the Read Command 110b */
+        SROM_CLK_WRITE(SROM_DATA_1, cr9_ioaddr);
+        SROM_CLK_WRITE(SROM_DATA_1, cr9_ioaddr);
+        SROM_CLK_WRITE(SROM_DATA_0, cr9_ioaddr);
+
+        /* Send the offset */
+        for (i = 5; i >= 0; i--) {
+                srom_data = (offset & (1 << i)) ? SROM_DATA_1 : SROM_DATA_0;
+                SROM_CLK_WRITE(srom_data, cr9_ioaddr);
+        }
+
+        outl(CR9_SROM_READ | CR9_SRCS, cr9_ioaddr);
+
+        for (i = 16; i > 0; i--) {
+                outl(CR9_SROM_READ | CR9_SRCS | CR9_SRCLK, cr9_ioaddr);
+                udelay(5);
+                srom_data = (srom_data << 1) | ((inl(cr9_ioaddr) & CR9_CRDOUT) ? 1 : 0);
+                outl(CR9_SROM_READ | CR9_SRCS, cr9_ioaddr);
+                udelay(5);
+        }
+
+        outl(CR9_SROM_READ, cr9_ioaddr);
+        return srom_data;
+}
+
+
+/*
+ *      Auto sense the media mode
+ */
+
+static u8 uli526x_sense_speed(struct uli526x_board_info * db)
+{
+        u8 ErrFlag = 0;
+        u16 phy_mode;
+
+        phy_mode = phy_read(db->ioaddr, db->phy_addr, 1, db->chip_id);
+        phy_mode = phy_read(db->ioaddr, db->phy_addr, 1, db->chip_id);
+
+        if ( (phy_mode & 0x24) == 0x24 ) {
+                
+                phy_mode = ((phy_read(db->ioaddr, db->phy_addr, 5, db->chip_id) & 0x01e0)<<7);
+                if(phy_mode&0x8000)
+                        phy_mode = 0x8000;
+                else if(phy_mode&0x4000)
+                        phy_mode = 0x4000;
+                else if(phy_mode&0x2000)
+                        phy_mode = 0x2000;
+                else
+                        phy_mode = 0x1000;
+                
+                /* printk(DRV_NAME ": Phy_mode %x ",phy_mode); */
+                switch (phy_mode) {
+                case 0x1000: db->op_mode = ULI526X_10MHF; break;
+                case 0x2000: db->op_mode = ULI526X_10MFD; break;
+                case 0x4000: db->op_mode = ULI526X_100MHF; break;
+                case 0x8000: db->op_mode = ULI526X_100MFD; break;
+                default: db->op_mode = ULI526X_10MHF; ErrFlag = 1; break;
+                }
+        } else {
+                db->op_mode = ULI526X_10MHF;
+                ULI526X_DBUG(0, "Link Failed :", phy_mode);
+                ErrFlag = 1;
+        }
+
+        return ErrFlag;
+}
+
+
+/*
+ *      Set 10/100 phyxcer capability
+ *      AUTO mode : phyxcer register4 is NIC capability
+ *      Force mode: phyxcer register4 is the force media
+ */
+
+static void uli526x_set_phyxcer(struct uli526x_board_info *db)
+{
+        u16 phy_reg;
+        
+        /* Phyxcer capability setting */
+        phy_reg = phy_read(db->ioaddr, db->phy_addr, 4, db->chip_id) & ~0x01e0;
+
+        if (db->media_mode & ULI526X_AUTO) {
+                /* AUTO Mode */
+                phy_reg |= db->PHY_reg4;
+        } else {
+                /* Force Mode */
+                switch(db->media_mode) {
+                case ULI526X_10MHF: phy_reg |= 0x20; break;
+                case ULI526X_10MFD: phy_reg |= 0x40; break;
+                case ULI526X_100MHF: phy_reg |= 0x80; break;
+                case ULI526X_100MFD: phy_reg |= 0x100; break;
+                }
+                
+        }
+
+        /* Write new capability to Phyxcer Reg4 */
+        if ( !(phy_reg & 0x01e0)) {
+                phy_reg|=db->PHY_reg4;
+                db->media_mode|=ULI526X_AUTO;
+        }
+        phy_write(db->ioaddr, db->phy_addr, 4, phy_reg, db->chip_id);
+
+        /* Restart Auto-Negotiation */
+        phy_write(db->ioaddr, db->phy_addr, 0, 0x1200, db->chip_id);
+        udelay(50);
+}
+
+
+/*
+ *      Process op-mode
+        AUTO mode : PHY controller in Auto-negotiation Mode
+ *      Force mode: PHY controller in force mode with HUB
+ *                      N-way force capability with SWITCH
+ */
+
+static void uli526x_process_mode(struct uli526x_board_info *db)
+{
+        u16 phy_reg;
+
+        /* Full Duplex Mode Check */
+        if (db->op_mode & 0x4)
+                db->cr6_data |= CR6_FDM;        /* Set Full Duplex Bit */
+        else
+                db->cr6_data &= ~CR6_FDM;       /* Clear Full Duplex Bit */
+
+        update_cr6(db->cr6_data, db->ioaddr);
+
+        /* 10/100M phyxcer force mode need */
+        if ( !(db->media_mode & 0x8)) {
+                /* Forece Mode */
+                phy_reg = phy_read(db->ioaddr, db->phy_addr, 6, db->chip_id);
+                if ( !(phy_reg & 0x1) ) {
+                        /* parter without N-Way capability */
+                        phy_reg = 0x0;
+                        switch(db->op_mode) {
+                        case ULI526X_10MHF: phy_reg = 0x0; break;
+                        case ULI526X_10MFD: phy_reg = 0x100; break;
+                        case ULI526X_100MHF: phy_reg = 0x2000; break;
+                        case ULI526X_100MFD: phy_reg = 0x2100; break;
+                        }
+                        phy_write(db->ioaddr, db->phy_addr, 0, phy_reg, db->chip_id);
+                        phy_write(db->ioaddr, db->phy_addr, 0, phy_reg, db->chip_id);
+                }
+        }
+}
+
+
+/*
+ *      Write a word to Phy register
+ */
+
+static void phy_write(unsigned long iobase, u8 phy_addr, u8 offset, u16 phy_data, u32 chip_id)
+{
+        u16 i;
+        unsigned long ioaddr;
+
+        if(chip_id == PCI_ULI5263_ID)
+        {
+                phy_writeby_cr10(iobase, phy_addr, offset, phy_data);
+                return;
+        }
+        /* M5261/M5263 Chip */
+        ioaddr = iobase + DCR9;
+
+        /* Send 33 synchronization clock to Phy controller */
+        for (i = 0; i < 35; i++)
+                phy_write_1bit(ioaddr, PHY_DATA_1, chip_id);
+
+        /* Send start command(01) to Phy */
+        phy_write_1bit(ioaddr, PHY_DATA_0, chip_id);
+        phy_write_1bit(ioaddr, PHY_DATA_1, chip_id);
+
+        /* Send write command(01) to Phy */
+        phy_write_1bit(ioaddr, PHY_DATA_0, chip_id);
+        phy_write_1bit(ioaddr, PHY_DATA_1, chip_id);
+
+        /* Send Phy address */
+        for (i = 0x10; i > 0; i = i >> 1)
+                phy_write_1bit(ioaddr, phy_addr & i ? PHY_DATA_1 : PHY_DATA_0, chip_id);
+
+        /* Send register address */
+        for (i = 0x10; i > 0; i = i >> 1)
+                phy_write_1bit(ioaddr, offset & i ? PHY_DATA_1 : PHY_DATA_0, chip_id);
+
+        /* written trasnition */
+        phy_write_1bit(ioaddr, PHY_DATA_1, chip_id);
+        phy_write_1bit(ioaddr, PHY_DATA_0, chip_id);
+
+        /* Write a word data to PHY controller */
+        for ( i = 0x8000; i > 0; i >>= 1)
+                phy_write_1bit(ioaddr, phy_data & i ? PHY_DATA_1 : PHY_DATA_0, chip_id);
+        
+}
+
+
+/*
+ *      Read a word data from phy register
+ */
+
+static u16 phy_read(unsigned long iobase, u8 phy_addr, u8 offset, u32 chip_id)
+{
+        int i;
+        u16 phy_data;
+        unsigned long ioaddr;
+
+        if(chip_id == PCI_ULI5263_ID)
+                return phy_readby_cr10(iobase, phy_addr, offset);
+        /* M5261/M5263 Chip */
+        ioaddr = iobase + DCR9;
+        
+        /* Send 33 synchronization clock to Phy controller */
+        for (i = 0; i < 35; i++)
+                phy_write_1bit(ioaddr, PHY_DATA_1, chip_id);
+
+        /* Send start command(01) to Phy */
+        phy_write_1bit(ioaddr, PHY_DATA_0, chip_id);
+        phy_write_1bit(ioaddr, PHY_DATA_1, chip_id);
+
+        /* Send read command(10) to Phy */
+        phy_write_1bit(ioaddr, PHY_DATA_1, chip_id);
+        phy_write_1bit(ioaddr, PHY_DATA_0, chip_id);
+
+        /* Send Phy address */
+        for (i = 0x10; i > 0; i = i >> 1)
+                phy_write_1bit(ioaddr, phy_addr & i ? PHY_DATA_1 : PHY_DATA_0, chip_id);
+
+        /* Send register address */
+        for (i = 0x10; i > 0; i = i >> 1)
+                phy_write_1bit(ioaddr, offset & i ? PHY_DATA_1 : PHY_DATA_0, chip_id);
+
+        /* Skip transition state */
+        phy_read_1bit(ioaddr, chip_id);
+
+        /* read 16bit data */
+        for (phy_data = 0, i = 0; i < 16; i++) {
+                phy_data <<= 1;
+                phy_data |= phy_read_1bit(ioaddr, chip_id);
+        }
+
+        return phy_data;
+}
+
+static u16 phy_readby_cr10(unsigned long iobase, u8 phy_addr, u8 offset)
+{
+        unsigned long ioaddr,cr10_value;
+        
+        ioaddr = iobase + DCR10;
+        cr10_value = phy_addr;
+        cr10_value = (cr10_value<<5) + offset;
+        cr10_value = (cr10_value<<16) + 0x08000000;
+        outl(cr10_value,ioaddr);
+        udelay(1);
+        while(1)
+        {
+                cr10_value = inl(ioaddr);
+                if(cr10_value&0x10000000)
+                        break;
+        }
+        return (cr10_value&0x0ffff);
+}
+
+static void phy_writeby_cr10(unsigned long iobase, u8 phy_addr, u8 offset, u16 phy_data)
+{
+        unsigned long ioaddr,cr10_value;
+        
+        ioaddr = iobase + DCR10;
+        cr10_value = phy_addr;
+        cr10_value = (cr10_value<<5) + offset;
+        cr10_value = (cr10_value<<16) + 0x04000000 + phy_data;
+        outl(cr10_value,ioaddr);
+        udelay(1);
+}
+/*
+ *      Write one bit data to Phy Controller
+ */
+
+static void phy_write_1bit(unsigned long ioaddr, u32 phy_data, u32 chip_id)
+{
+        outl(phy_data , ioaddr);                        /* MII Clock Low */
+        udelay(1);
+        outl(phy_data  | MDCLKH, ioaddr);       /* MII Clock High */
+        udelay(1);
+        outl(phy_data , ioaddr);                        /* MII Clock Low */
+        udelay(1);
+}
+
+
+/*
+ *      Read one bit phy data from PHY controller
+ */
+
+static u16 phy_read_1bit(unsigned long ioaddr, u32 chip_id)
+{
+        u16 phy_data;
+        
+        outl(0x50000 , ioaddr);
+        udelay(1);
+        phy_data = ( inl(ioaddr) >> 19 ) & 0x1;
+        outl(0x40000 , ioaddr);
+        udelay(1);
+
+        return phy_data;
+}
+
+
+static struct pci_device_id uli526x_pci_tbl[] = {
+        { 0x10B9, 0x5261, PCI_ANY_ID, PCI_ANY_ID, 0, 0, PCI_ULI5261_ID },
+        { 0x10B9, 0x5263, PCI_ANY_ID, PCI_ANY_ID, 0, 0, PCI_ULI5263_ID },
+        { 0, }
+};
+MODULE_DEVICE_TABLE(pci, uli526x_pci_tbl);
+
+
+static struct pci_driver uli526x_driver = {
+        .name           = "uli526x",
+        .id_table       = uli526x_pci_tbl,
+        .probe          = uli526x_init_one,
+        .remove         = __devexit_p(uli526x_remove_one),
+};
+
+MODULE_AUTHOR("Peer Chen, peer.chen@uli.com.tw");
+MODULE_DESCRIPTION("ULi M5261/M5263 fast ethernet driver");
+MODULE_LICENSE("GPL");
+
+MODULE_PARM(debug, "i");
+MODULE_PARM(mode, "i");
+MODULE_PARM(cr6set, "i");
+MODULE_PARM_DESC(debug, "ULi M5261/M5263 enable debugging (0-1)");
+MODULE_PARM_DESC(mode, "ULi M5261/M5263: Bit 0: 10/100Mbps, bit 2: duplex, bit 8: HomePNA");
+
+/*      Description:
+ *      when user used insmod to add module, system invoked init_module()
+ *      to register the services.
+ */
+
+static int __init uli526x_init_module(void)
+{
+        int rc;
+
+        printk(version);
+        printed_version = 1;
+
+        ULI526X_DBUG(0, "init_module() ", debug);
+
+        if (debug)
+                uli526x_debug = debug;  /* set debug flag */
+        if (cr6set)
+                uli526x_cr6_user_set = cr6set;
+
+        switch(mode) {
+        case ULI526X_10MHF:
+        case ULI526X_100MHF:
+        case ULI526X_10MFD:
+        case ULI526X_100MFD:
+                uli526x_media_mode = mode;
+                break;
+        default:uli526x_media_mode = ULI526X_AUTO;
+                break;
+        }
+
+        rc = pci_module_init(&uli526x_driver);
+        if (rc < 0)
+                return rc;
+
+        return 0;
+}
+
+
+/*
+ *      Description:
+ *      when user used rmmod to delete module, system invoked clean_module()
+ *      to un-register all registered services.
+ */
+
+static void __exit uli526x_cleanup_module(void)
+{
+        ULI526X_DBUG(0, "uli526x_clean_module() ", debug);
+        pci_unregister_driver(&uli526x_driver);
+}
+
+module_init(uli526x_init_module);
+module_exit(uli526x_cleanup_module);
diff --git a/drivers/net/wan/cycx_drv.c b/drivers/net/wan/cycx_drv.c
index 6e74af62ca08..9e56fc346ba4 100644
--- a/drivers/net/wan/cycx_drv.c
+++ b/drivers/net/wan/cycx_drv.c
@@ -56,7 +56,7 @@
 #include <linux/sched.h>        /* for jiffies, HZ, etc. */
 #include <linux/cycx_drv.h>     /* API definitions */
 #include <linux/cycx_cfm.h>     /* CYCX firmware module definitions */
-#include <linux/delay.h>        /* udelay */
+#include <linux/delay.h>        /* udelay, msleep_interruptible */
 #include <asm/io.h>             /* read[wl], write[wl], ioremap, iounmap */
 
 #define MOD_VERSION     0
@@ -74,7 +74,6 @@ static int reset_cyc2x(void __iomem *addr);
 static int detect_cyc2x(void __iomem *addr);
 
 /* Miscellaneous functions */
-static void delay_cycx(int sec);
 static int get_option_index(long *optlist, long optval);
 static u16 checksum(u8 *buf, u32 len);
 
@@ -259,7 +258,7 @@ static int memory_exists(void __iomem *addr)
                         if (readw(addr + 0x10) == TEST_PATTERN)
                                 return 1;
 
-                delay_cycx(1);
+                msleep_interruptible(1 * 1000);
         }
 
         return 0;
@@ -316,7 +315,7 @@ static void cycx_reset_boot(void __iomem *addr, u8 *code, u32 len)
 
         /* 80186 was in hold, go */
         writeb(0, addr + START_CPU);
-        delay_cycx(1);
+        msleep_interruptible(1 * 1000);
 }
 
 /* Load data.bin file through boot (reset) interface. */
@@ -462,13 +461,13 @@ static int load_cyc2x(struct cycx_hw *hw, struct cycx_firmware *cfm, u32 len)
                 cycx_reset_boot(hw->dpmbase, reset_image, img_hdr->reset_size);
                 /* reset is waiting for boot */
                 writew(GEN_POWER_ON, pt_cycld);
-                delay_cycx(1);
+                msleep_interruptible(1 * 1000);
 
                 for (j = 0 ; j < 3 ; j++)
                         if (!readw(pt_cycld))
                                 goto reset_loaded;
                         else
-                                delay_cycx(1);
+                                msleep_interruptible(1 * 1000);
         }
 
         printk(KERN_ERR "%s: reset not started.\n", modname);
@@ -495,7 +494,7 @@ reset_loaded:
 
         /* Arthur Ganzert's tip: wait a while after the firmware loading...
            seg abr 26 17:17:12 EST 1999 - acme */
-        delay_cycx(7);
+        msleep_interruptible(7 * 1000);
         printk(KERN_INFO "%s: firmware loaded!\n", modname);
 
         /* enable interrupts */
@@ -547,20 +546,13 @@ static int get_option_index(long *optlist, long optval)
 static int reset_cyc2x(void __iomem *addr)
 {
         writeb(0, addr + RST_ENABLE);
-        delay_cycx(2);
+        msleep_interruptible(2 * 1000);
         writeb(0, addr + RST_DISABLE);
-        delay_cycx(2);
+        msleep_interruptible(2 * 1000);
 
         return memory_exists(addr);
 }
 
-/* Delay */
-static void delay_cycx(int sec)
-{
-        set_current_state(TASK_INTERRUPTIBLE);
-        schedule_timeout(sec * HZ);
-}
-
 /* Calculate 16-bit CRC using CCITT polynomial. */
 static u16 checksum(u8 *buf, u32 len)
 {
diff --git a/drivers/net/wan/hdlc_generic.c b/drivers/net/wan/hdlc_generic.c
index a63f6a2cc4f7..cdd4c09c2d90 100644
--- a/drivers/net/wan/hdlc_generic.c
+++ b/drivers/net/wan/hdlc_generic.c
@@ -61,7 +61,7 @@ static struct net_device_stats *hdlc_get_stats(struct net_device *dev)
 
 
 static int hdlc_rcv(struct sk_buff *skb, struct net_device *dev,
-                    struct packet_type *p)
+                    struct packet_type *p, struct net_device *orig_dev)
 {
         hdlc_device *hdlc = dev_to_hdlc(dev);
         if (hdlc->proto.netif_rx)
diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index 7f2e3653c5e5..6c302e9dbca2 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -86,7 +86,7 @@ static __inline__ int dev_is_ethdev(struct net_device *dev)
 /*
  *      Receive a LAPB frame via an ethernet interface.
  */
-static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *ptype)
+static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *ptype, struct net_device *orig_dev)
 {
         int len, err;
         struct lapbethdev *lapbeth;
diff --git a/drivers/net/wan/sdla_fr.c b/drivers/net/wan/sdla_fr.c
index c5f5e62aab8b..0497dbdb8631 100644
--- a/drivers/net/wan/sdla_fr.c
+++ b/drivers/net/wan/sdla_fr.c
@@ -445,7 +445,7 @@ void 	s508_s514_unlock(sdla_t *card, unsigned long *smp_flags);
 void    s508_s514_lock(sdla_t *card, unsigned long *smp_flags);
 
 unsigned short calc_checksum (char *, int);
-static int setup_fr_header(struct sk_buff** skb,
+static int setup_fr_header(struct sk_buff *skb,
                            struct net_device* dev, char op_mode);
 
 
@@ -1372,7 +1372,7 @@ static int if_send(struct sk_buff* skb, struct net_device* dev)
         /* Move the if_header() code to here. By inserting frame
          * relay header in if_header() we would break the
          * tcpdump and other packet sniffers */
-        chan->fr_header_len = setup_fr_header(&skb,dev,chan->common.usedby);
+        chan->fr_header_len = setup_fr_header(skb,dev,chan->common.usedby);
         if (chan->fr_header_len < 0 ){
                 ++chan->ifstats.tx_dropped;
                 ++card->wandev.stats.tx_dropped;
@@ -1597,8 +1597,6 @@ static int setup_for_delayed_transmit(struct net_device* dev,
                 return 1;
         }
 
-        skb_unlink(skb);
-        
         chan->transmit_length = len;
         chan->delay_skb = skb;
         
@@ -4871,18 +4869,15 @@ static void unconfig_fr (sdla_t *card)
         }
 }
 
-static int setup_fr_header(struct sk_buff **skb_orig, struct net_device* dev,
+static int setup_fr_header(struct sk_buff *skb, struct net_device* dev,
                            char op_mode)
 {
-        struct sk_buff *skb = *skb_orig;
         fr_channel_t *chan=dev->priv;
 
-        if (op_mode == WANPIPE){
-
+        if (op_mode == WANPIPE) {
                 chan->fr_header[0]=Q922_UI;
                 
                 switch (htons(skb->protocol)){
-                        
                 case ETH_P_IP:
                         chan->fr_header[1]=NLPID_IP;
                         break;
@@ -4894,16 +4889,14 @@ static int setup_fr_header(struct sk_buff **skb_orig, struct net_device* dev,
         }
 
         /* If we are in bridging mode, we must apply
-         * an Ethernet header */
-        if (op_mode == BRIDGE || op_mode == BRIDGE_NODE){
-
-
+         * an Ethernet header
+         */
+        if (op_mode == BRIDGE || op_mode == BRIDGE_NODE) {
                 /* Encapsulate the packet as a bridged Ethernet frame. */
 #ifdef DEBUG
                 printk(KERN_INFO "%s: encapsulating skb for frame relay\n", 
                         dev->name);
 #endif
-                
                 chan->fr_header[0] = 0x03;
                 chan->fr_header[1] = 0x00;
                 chan->fr_header[2] = 0x80;
@@ -4916,7 +4909,6 @@ static int setup_fr_header(struct sk_buff **skb_orig, struct net_device* dev,
                 /* Yuck. */
                 skb->protocol = ETH_P_802_3;
                 return 8;
-
         }
                 
         return 0;
diff --git a/drivers/net/wan/syncppp.c b/drivers/net/wan/syncppp.c
index 84b65c60c799..f58c794a963a 100644
--- a/drivers/net/wan/syncppp.c
+++ b/drivers/net/wan/syncppp.c
@@ -1447,7 +1447,7 @@ static void sppp_print_bytes (u_char *p, u16 len)
  *      after interrupt servicing to process frames queued via netif_rx.
  */
 
-static int sppp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *p)
+static int sppp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *p, struct net_device *orig_dev)
 {
         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
                 return NET_RX_DROP;
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index 1d3231cc471a..ec3f75a030d2 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -270,7 +270,7 @@ config PCMCIA_HERMES
 
 config AIRO_CS
         tristate "Cisco/Aironet 34X/35X/4500/4800 PCMCIA cards"
-        depends on NET_RADIO && PCMCIA
+        depends on NET_RADIO && PCMCIA && (BROKEN || !M32R)
         ---help---
           This is the standard Linux driver to support Cisco/Aironet PCMCIA
           802.11 wireless cards.  This driver is the same as the Aironet
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
index aabcdc2be05e..9c2d07cde010 100644
--- a/drivers/net/wireless/orinoco.c
+++ b/drivers/net/wireless/orinoco.c
@@ -4322,36 +4322,36 @@ static const struct iw_priv_args orinoco_privtab[] = {
  */
 
 static const iw_handler orinoco_handler[] = {
-        [SIOCSIWCOMMIT-SIOCIWFIRST] (iw_handler) orinoco_ioctl_commit,
-        [SIOCGIWNAME  -SIOCIWFIRST] (iw_handler) orinoco_ioctl_getname,
-        [SIOCSIWFREQ  -SIOCIWFIRST] (iw_handler) orinoco_ioctl_setfreq,
-        [SIOCGIWFREQ  -SIOCIWFIRST] (iw_handler) orinoco_ioctl_getfreq,
-        [SIOCSIWMODE  -SIOCIWFIRST] (iw_handler) orinoco_ioctl_setmode,
-        [SIOCGIWMODE  -SIOCIWFIRST] (iw_handler) orinoco_ioctl_getmode,
-        [SIOCSIWSENS  -SIOCIWFIRST] (iw_handler) orinoco_ioctl_setsens,
-        [SIOCGIWSENS  -SIOCIWFIRST] (iw_handler) orinoco_ioctl_getsens,
-        [SIOCGIWRANGE -SIOCIWFIRST] (iw_handler) orinoco_ioctl_getiwrange,
-        [SIOCSIWSPY   -SIOCIWFIRST] (iw_handler) orinoco_ioctl_setspy,
-        [SIOCGIWSPY   -SIOCIWFIRST] (iw_handler) orinoco_ioctl_getspy,
-        [SIOCSIWAP    -SIOCIWFIRST] (iw_handler) orinoco_ioctl_setwap,
-        [SIOCGIWAP    -SIOCIWFIRST] (iw_handler) orinoco_ioctl_getwap,
-        [SIOCSIWSCAN  -SIOCIWFIRST] (iw_handler) orinoco_ioctl_setscan,
-        [SIOCGIWSCAN  -SIOCIWFIRST] (iw_handler) orinoco_ioctl_getscan,
-        [SIOCSIWESSID -SIOCIWFIRST] (iw_handler) orinoco_ioctl_setessid,
-        [SIOCGIWESSID -SIOCIWFIRST] (iw_handler) orinoco_ioctl_getessid,
-        [SIOCSIWNICKN -SIOCIWFIRST] (iw_handler) orinoco_ioctl_setnick,
-        [SIOCGIWNICKN -SIOCIWFIRST] (iw_handler) orinoco_ioctl_getnick,
-        [SIOCSIWRATE  -SIOCIWFIRST] (iw_handler) orinoco_ioctl_setrate,
-        [SIOCGIWRATE  -SIOCIWFIRST] (iw_handler) orinoco_ioctl_getrate,
-        [SIOCSIWRTS   -SIOCIWFIRST] (iw_handler) orinoco_ioctl_setrts,
-        [SIOCGIWRTS   -SIOCIWFIRST] (iw_handler) orinoco_ioctl_getrts,
-        [SIOCSIWFRAG  -SIOCIWFIRST] (iw_handler) orinoco_ioctl_setfrag,
-        [SIOCGIWFRAG  -SIOCIWFIRST] (iw_handler) orinoco_ioctl_getfrag,
-        [SIOCGIWRETRY -SIOCIWFIRST] (iw_handler) orinoco_ioctl_getretry,
-        [SIOCSIWENCODE-SIOCIWFIRST] (iw_handler) orinoco_ioctl_setiwencode,
-        [SIOCGIWENCODE-SIOCIWFIRST] (iw_handler) orinoco_ioctl_getiwencode,
-        [SIOCSIWPOWER -SIOCIWFIRST] (iw_handler) orinoco_ioctl_setpower,
-        [SIOCGIWPOWER -SIOCIWFIRST] (iw_handler) orinoco_ioctl_getpower,
+        [SIOCSIWCOMMIT-SIOCIWFIRST] = (iw_handler) orinoco_ioctl_commit,
+        [SIOCGIWNAME  -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_getname,
+        [SIOCSIWFREQ  -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_setfreq,
+        [SIOCGIWFREQ  -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_getfreq,
+        [SIOCSIWMODE  -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_setmode,
+        [SIOCGIWMODE  -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_getmode,
+        [SIOCSIWSENS  -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_setsens,
+        [SIOCGIWSENS  -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_getsens,
+        [SIOCGIWRANGE -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_getiwrange,
+        [SIOCSIWSPY   -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_setspy,
+        [SIOCGIWSPY   -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_getspy,
+        [SIOCSIWAP    -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_setwap,
+        [SIOCGIWAP    -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_getwap,
+        [SIOCSIWSCAN  -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_setscan,
+        [SIOCGIWSCAN  -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_getscan,
+        [SIOCSIWESSID -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_setessid,
+        [SIOCGIWESSID -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_getessid,
+        [SIOCSIWNICKN -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_setnick,
+        [SIOCGIWNICKN -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_getnick,
+        [SIOCSIWRATE  -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_setrate,
+        [SIOCGIWRATE  -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_getrate,
+        [SIOCSIWRTS   -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_setrts,
+        [SIOCGIWRTS   -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_getrts,
+        [SIOCSIWFRAG  -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_setfrag,
+        [SIOCGIWFRAG  -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_getfrag,
+        [SIOCGIWRETRY -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_getretry,
+        [SIOCSIWENCODE-SIOCIWFIRST] = (iw_handler) orinoco_ioctl_setiwencode,
+        [SIOCGIWENCODE-SIOCIWFIRST] = (iw_handler) orinoco_ioctl_getiwencode,
+        [SIOCSIWPOWER -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_setpower,
+        [SIOCGIWPOWER -SIOCIWFIRST] = (iw_handler) orinoco_ioctl_getpower,
 };
 
 
@@ -4359,15 +4359,15 @@ static const iw_handler	orinoco_handler[] = {
   Added typecasting since we no longer use iwreq_data -- Moustafa
  */
 static const iw_handler orinoco_private_handler[] = {
-        [0] (iw_handler) orinoco_ioctl_reset,
-        [1] (iw_handler) orinoco_ioctl_reset,
-        [2] (iw_handler) orinoco_ioctl_setport3,
-        [3] (iw_handler) orinoco_ioctl_getport3,
-        [4] (iw_handler) orinoco_ioctl_setpreamble,
-        [5] (iw_handler) orinoco_ioctl_getpreamble,
-        [6] (iw_handler) orinoco_ioctl_setibssport,
-        [7] (iw_handler) orinoco_ioctl_getibssport,
-        [9] (iw_handler) orinoco_ioctl_getrid,
+        [0] = (iw_handler) orinoco_ioctl_reset,
+        [1] = (iw_handler) orinoco_ioctl_reset,
+        [2] = (iw_handler) orinoco_ioctl_setport3,
+        [3] = (iw_handler) orinoco_ioctl_getport3,
+        [4] = (iw_handler) orinoco_ioctl_setpreamble,
+        [5] = (iw_handler) orinoco_ioctl_getpreamble,
+        [6] = (iw_handler) orinoco_ioctl_setibssport,
+        [7] = (iw_handler) orinoco_ioctl_getibssport,
+        [9] = (iw_handler) orinoco_ioctl_getrid,
 };
 
 static const struct iw_handler_def orinoco_handler_def = {
diff --git a/drivers/parport/Kconfig b/drivers/parport/Kconfig
index 16a2e6ae37f4..725a14119f2a 100644
--- a/drivers/parport/Kconfig
+++ b/drivers/parport/Kconfig
@@ -34,7 +34,7 @@ config PARPORT
 
 config PARPORT_PC
         tristate "PC-style hardware"
-        depends on PARPORT && (!SPARC64 || PCI) && !SPARC32
+        depends on PARPORT && (!SPARC64 || PCI) && !SPARC32 && !M32R
         ---help---
           You should say Y here if you have a PC-style parallel port. All
           IBM PC compatible computers and some Alphas have PC-style
diff --git a/drivers/parport/parport_serial.c b/drivers/parport/parport_serial.c
index 00498e2f1205..d3dad0aac7cb 100644
--- a/drivers/parport/parport_serial.c
+++ b/drivers/parport/parport_serial.c
@@ -23,13 +23,8 @@
 #include <linux/pci.h>
 #include <linux/parport.h>
 #include <linux/parport_pc.h>
-#include <linux/serial.h>
-#include <linux/serialP.h>
-#include <linux/list.h>
 #include <linux/8250_pci.h>
 
-#include <asm/serial.h>
-
 enum parport_pc_pci_cards {
         titan_110l = 0,
         titan_210l,
@@ -168,182 +163,147 @@ static struct pci_device_id parport_serial_pci_tbl[] = {
 };
 MODULE_DEVICE_TABLE(pci,parport_serial_pci_tbl);
 
-struct pci_board_no_ids {
-        int flags;
-        int num_ports;
-        int base_baud;
-        int uart_offset;
-        int reg_shift;
-        int (*init_fn)(struct pci_dev *dev, struct pci_board_no_ids *board,
-                        int enable);
-        int first_uart_offset;
-};
-
-static int __devinit siig10x_init_fn(struct pci_dev *dev, struct pci_board_no_ids *board, int enable)
-{
-        return pci_siig10x_fn(dev, enable);
-}
-
-static int __devinit siig20x_init_fn(struct pci_dev *dev, struct pci_board_no_ids *board, int enable)
-{
-        return pci_siig20x_fn(dev, enable);
-}
-
-static int __devinit netmos_serial_init(struct pci_dev *dev, struct pci_board_no_ids *board, int enable)
-{
-        board->num_ports = dev->subsystem_device & 0xf;
-        return 0;
-}
-
-static struct pci_board_no_ids pci_boards[] __devinitdata = {
-        /*
-         * PCI Flags, Number of Ports, Base (Maximum) Baud Rate,
-         * Offset to get to next UART's registers,
-         * Register shift to use for memory-mapped I/O,
-         * Initialization function, first UART offset
-         */
-
-// Cards not tested are marked n/t
-// If you have one of these cards and it works for you, please tell me..
-
-/* titan_110l */        { SPCI_FL_BASE1 | SPCI_FL_BASE_TABLE, 1, 921600 },
-/* titan_210l */        { SPCI_FL_BASE1 | SPCI_FL_BASE_TABLE, 2, 921600 },
-/* netmos_9xx5_combo */ { SPCI_FL_BASE0 | SPCI_FL_BASE_TABLE, 1, 115200, 0, 0, netmos_serial_init },
-/* netmos_9855 */       { SPCI_FL_BASE2 | SPCI_FL_BASE_TABLE, 1, 115200, 0, 0, netmos_serial_init },
-/* avlab_1s1p (n/t) */  { SPCI_FL_BASE0 | SPCI_FL_BASE_TABLE, 1, 115200 },
-/* avlab_1s1p_650 (nt)*/{ SPCI_FL_BASE0 | SPCI_FL_BASE_TABLE, 1, 115200 },
-/* avlab_1s1p_850 (nt)*/{ SPCI_FL_BASE0 | SPCI_FL_BASE_TABLE, 1, 115200 },
-/* avlab_1s2p (n/t) */  { SPCI_FL_BASE0 | SPCI_FL_BASE_TABLE, 1, 115200 },
-/* avlab_1s2p_650 (nt)*/{ SPCI_FL_BASE0 | SPCI_FL_BASE_TABLE, 1, 115200 },
-/* avlab_1s2p_850 (nt)*/{ SPCI_FL_BASE0 | SPCI_FL_BASE_TABLE, 1, 115200 },
-/* avlab_2s1p (n/t) */  { SPCI_FL_BASE0 | SPCI_FL_BASE_TABLE, 2, 115200 },
-/* avlab_2s1p_650 (nt)*/{ SPCI_FL_BASE0 | SPCI_FL_BASE_TABLE, 2, 115200 },
-/* avlab_2s1p_850 (nt)*/{ SPCI_FL_BASE0 | SPCI_FL_BASE_TABLE, 2, 115200 },
-/* siig_1s1p_10x */     { SPCI_FL_BASE2, 1, 460800, 0, 0, siig10x_init_fn },
-/* siig_2s1p_10x */     { SPCI_FL_BASE2, 1, 921600, 0, 0, siig10x_init_fn },
-/* siig_2p1s_20x */     { SPCI_FL_BASE0, 1, 921600, 0, 0, siig20x_init_fn },
-/* siig_1s1p_20x */     { SPCI_FL_BASE0, 1, 921600, 0, 0, siig20x_init_fn },
-/* siig_2s1p_20x */     { SPCI_FL_BASE0, 1, 921600, 0, 0, siig20x_init_fn },
+/*
+ * This table describes the serial "geometry" of these boards.  Any
+ * quirks for these can be found in drivers/serial/8250_pci.c
+ *
+ * Cards not tested are marked n/t
+ * If you have one of these cards and it works for you, please tell me..
+ */
+static struct pciserial_board pci_parport_serial_boards[] __devinitdata = {
+        [titan_110l] = {
+                .flags          = FL_BASE1 | FL_BASE_BARS,
+                .num_ports      = 1,
+                .base_baud      = 921600,
+                .uart_offset    = 8,
+        },
+        [titan_210l] = {
+                .flags          = FL_BASE1 | FL_BASE_BARS,
+                .num_ports      = 2,
+                .base_baud      = 921600,
+                .uart_offset    = 8,
+        },
+        [netmos_9xx5_combo] = {
+                .flags          = FL_BASE0 | FL_BASE_BARS,
+                .num_ports      = 1,
+                .base_baud      = 115200,
+                .uart_offset    = 8,
+        },
+        [netmos_9855] = {
+                .flags          = FL_BASE2 | FL_BASE_BARS,
+                .num_ports      = 1,
+                .base_baud      = 115200,
+                .uart_offset    = 8,
+        },
+        [avlab_1s1p] = { /* n/t */
+                .flags          = FL_BASE0 | FL_BASE_BARS,
+                .num_ports      = 1,
+                .base_baud      = 115200,
+                .uart_offset    = 8,
+        },
+        [avlab_1s1p_650] = { /* nt */
+                .flags          = FL_BASE0 | FL_BASE_BARS,
+                .num_ports      = 1,
+                .base_baud      = 115200,
+                .uart_offset    = 8,
+        },
+        [avlab_1s1p_850] = { /* nt */
+                .flags          = FL_BASE0 | FL_BASE_BARS,
+                .num_ports      = 1,
+                .base_baud      = 115200,
+                .uart_offset    = 8,
+        },
+        [avlab_1s2p] = { /* n/t */
+                .flags          = FL_BASE0 | FL_BASE_BARS,
+                .num_ports      = 1,
+                .base_baud      = 115200,
+                .uart_offset    = 8,
+        },
+        [avlab_1s2p_650] = { /* nt */
+                .flags          = FL_BASE0 | FL_BASE_BARS,
+                .num_ports      = 1,
+                .base_baud      = 115200,
+                .uart_offset    = 8,
+        },
+        [avlab_1s2p_850] = { /* nt */
+                .flags          = FL_BASE0 | FL_BASE_BARS,
+                .num_ports      = 1,
+                .base_baud      = 115200,
+                .uart_offset    = 8,
+        },
+        [avlab_2s1p] = { /* n/t */
+                .flags          = FL_BASE0 | FL_BASE_BARS,
+                .num_ports      = 2,
+                .base_baud      = 115200,
+                .uart_offset    = 8,
+        },
+        [avlab_2s1p_650] = { /* nt */
+                .flags          = FL_BASE0 | FL_BASE_BARS,
+                .num_ports      = 2,
+                .base_baud      = 115200,
+                .uart_offset    = 8,
+        },
+        [avlab_2s1p_850] = { /* nt */
+                .flags          = FL_BASE0 | FL_BASE_BARS,
+                .num_ports      = 2,
+                .base_baud      = 115200,
+                .uart_offset    = 8,
+        },
+        [siig_1s1p_10x] = {
+                .flags          = FL_BASE2,
+                .num_ports      = 1,
+                .base_baud      = 460800,
+                .uart_offset    = 8,
+        },
+        [siig_2s1p_10x] = {
+                .flags          = FL_BASE2,
+                .num_ports      = 1,
+                .base_baud      = 921600,
+                .uart_offset    = 8,
+        },
+        [siig_2p1s_20x] = {
+                .flags          = FL_BASE0,
+                .num_ports      = 1,
+                .base_baud      = 921600,
+                .uart_offset    = 8,
+        },
+        [siig_1s1p_20x] = {
+                .flags          = FL_BASE0,
+                .num_ports      = 1,
+                .base_baud      = 921600,
+                .uart_offset    = 8,
+        },
+        [siig_2s1p_20x] = {
+                .flags          = FL_BASE0,
+                .num_ports      = 1,
+                .base_baud      = 921600,
+                .uart_offset    = 8,
+        },
 };
 
 struct parport_serial_private {
-        int num_ser;
-        int line[20];
-        struct pci_board_no_ids ser;
+        struct serial_private   *serial;
         int num_par;
         struct parport *port[PARPORT_MAX];
         struct parport_pc_pci par;
 };
 
-static int __devinit get_pci_port (struct pci_dev *dev,
-                                   struct pci_board_no_ids *board,
-                                   struct serial_struct *req,
-                                   int idx)
-{
-        unsigned long port;
-        int base_idx;
-        int max_port;
-        int offset;
-
-        base_idx = SPCI_FL_GET_BASE(board->flags);
-        if (board->flags & SPCI_FL_BASE_TABLE)
-                base_idx += idx;
-
-        if (board->flags & SPCI_FL_REGION_SZ_CAP) {
-                max_port = pci_resource_len(dev, base_idx) / 8;
-                if (idx >= max_port)
-                        return 1;
-        }
-                        
-        offset = board->first_uart_offset;
-
-        /* Timedia/SUNIX uses a mixture of BARs and offsets */
-        /* Ugh, this is ugly as all hell --- TYT */
-        if(dev->vendor == PCI_VENDOR_ID_TIMEDIA )  /* 0x1409 */
-                switch(idx) {
-                        case 0: base_idx=0;
-                                break;
-                        case 1: base_idx=0; offset=8;
-                                break;
-                        case 2: base_idx=1; 
-                                break;
-                        case 3: base_idx=1; offset=8;
-                                break;
-                        case 4: /* BAR 2*/
-                        case 5: /* BAR 3 */
-                        case 6: /* BAR 4*/
-                        case 7: base_idx=idx-2; /* BAR 5*/
-                }
-  
-        port =  pci_resource_start(dev, base_idx) + offset;
-
-        if ((board->flags & SPCI_FL_BASE_TABLE) == 0)
-                port += idx * (board->uart_offset ? board->uart_offset : 8);
-
-        if (pci_resource_flags (dev, base_idx) & IORESOURCE_IO) {
-                int high_bits_offset = ((sizeof(long)-sizeof(int))*8);
-                req->port = port;
-                if (high_bits_offset)
-                        req->port_high = port >> high_bits_offset;
-                else
-                        req->port_high = 0;
-                return 0;
-        }
-        req->io_type = SERIAL_IO_MEM;
-        req->iomem_base = ioremap(port, board->uart_offset);
-        req->iomem_reg_shift = board->reg_shift;
-        req->port = 0;
-        return req->iomem_base ? 0 : 1;
-}
-
 /* Register the serial port(s) of a PCI card. */
 static int __devinit serial_register (struct pci_dev *dev,
                                       const struct pci_device_id *id)
 {
-        struct pci_board_no_ids *board;
         struct parport_serial_private *priv = pci_get_drvdata (dev);
-        struct serial_struct serial_req;
-        int base_baud;
-        int k;
-        int success = 0;
-
-        priv->ser = pci_boards[id->driver_data];
-        board = &priv->ser;
-        if (board->init_fn && ((board->init_fn) (dev, board, 1) != 0))
-                return 1;
-
-        base_baud = board->base_baud;
-        if (!base_baud)
-                base_baud = BASE_BAUD;
-        memset (&serial_req, 0, sizeof (serial_req));
-
-        for (k = 0; k < board->num_ports; k++) {
-                int line;
+        struct pciserial_board *board;
+        struct serial_private *serial;
 
-                if (priv->num_ser == ARRAY_SIZE (priv->line)) {
-                        printk (KERN_WARNING
-                                "parport_serial: %s: only %u serial lines "
-                                "supported (%d reported)\n", pci_name (dev),
-                                ARRAY_SIZE (priv->line), board->num_ports);
-                        break;
-                }
+        board = &pci_parport_serial_boards[id->driver_data];
+        serial = pciserial_init_ports(dev, board);
 
-                serial_req.irq = dev->irq;
-                if (get_pci_port (dev, board, &serial_req, k))
-                        break;
-                serial_req.flags = ASYNC_SKIP_TEST | ASYNC_AUTOPROBE;
-                serial_req.baud_base = base_baud;
-                line = register_serial (&serial_req);
-                if (line < 0) {
-                        printk (KERN_DEBUG
-                                "parport_serial: register_serial failed\n");
-                        continue;
-                }
-                priv->line[priv->num_ser++] = line;
-                success = 1;
-        }
+        if (IS_ERR(serial))
+                return PTR_ERR(serial);
 
-        return success ? 0 : 1;
+        priv->serial = serial;
+        return 0;
 }
 
 /* Register the parallel port(s) of a PCI card. */
@@ -411,7 +371,7 @@ static int __devinit parport_serial_pci_probe (struct pci_dev *dev,
         priv = kmalloc (sizeof *priv, GFP_KERNEL);
         if (!priv)
                 return -ENOMEM;
-        priv->num_ser = priv->num_par = 0;
+        memset(priv, 0, sizeof(struct parport_serial_private));
         pci_set_drvdata (dev, priv);
 
         err = pci_enable_device (dev);
@@ -444,15 +404,12 @@ static void __devexit parport_serial_pci_remove (struct pci_dev *dev)
         struct parport_serial_private *priv = pci_get_drvdata (dev);
         int i;
 
+        pci_set_drvdata(dev, NULL);
+
         // Serial ports
-        for (i = 0; i < priv->num_ser; i++) {
-                unregister_serial (priv->line[i]);
+        if (priv->serial)
+                pciserial_remove_ports(priv->serial);
 
-                if (priv->ser.init_fn)
-                        (priv->ser.init_fn) (dev, &priv->ser, 0);
-        }
-        pci_set_drvdata (dev, NULL);
-        
         // Parallel ports
         for (i = 0; i < priv->num_par; i++)
                 parport_pc_unregister_port (priv->port[i]);
@@ -461,11 +418,47 @@ static void __devexit parport_serial_pci_remove (struct pci_dev *dev)
         return;
 }
 
+static int parport_serial_pci_suspend(struct pci_dev *dev, pm_message_t state)
+{
+        struct parport_serial_private *priv = pci_get_drvdata(dev);
+
+        if (priv->serial)
+                pciserial_suspend_ports(priv->serial);
+
+        /* FIXME: What about parport? */
+
+        pci_save_state(dev);
+        pci_set_power_state(dev, pci_choose_state(dev, state));
+        return 0;
+}
+
+static int parport_serial_pci_resume(struct pci_dev *dev)
+{
+        struct parport_serial_private *priv = pci_get_drvdata(dev);
+
+        pci_set_power_state(dev, PCI_D0);
+        pci_restore_state(dev);
+
+        /*
+         * The device may have been disabled.  Re-enable it.
+         */
+        pci_enable_device(dev);
+
+        if (priv->serial)
+                pciserial_resume_ports(priv->serial);
+
+        /* FIXME: What about parport? */
+
+        return 0;
+}
+
 static struct pci_driver parport_serial_pci_driver = {
         .name           = "parport_serial",
         .id_table       = parport_serial_pci_tbl,
         .probe          = parport_serial_pci_probe,
         .remove         = __devexit_p(parport_serial_pci_remove),
+        .suspend        = parport_serial_pci_suspend,
+        .resume         = parport_serial_pci_resume,
 };
 
 
diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
index 46b294a12418..2b92b9e8c910 100644
--- a/drivers/pci/hotplug/pciehp.h
+++ b/drivers/pci/hotplug/pciehp.h
@@ -23,7 +23,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
  *
  */
 #ifndef _PCIEHP_H
diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index df4915dbc321..cafc7eadcf80 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -23,7 +23,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
index 0dbcf04aa35e..0e0947601526 100644
--- a/drivers/pci/hotplug/pciehp_ctrl.c
+++ b/drivers/pci/hotplug/pciehp_ctrl.c
@@ -23,7 +23,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 1cda30bd6e47..7a0e27f0e063 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -23,7 +23,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>,<dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>,<kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/pciehp_pci.c b/drivers/pci/hotplug/pciehp_pci.c
index 723b12c0bb7c..33b539b34f7e 100644
--- a/drivers/pci/hotplug/pciehp_pci.c
+++ b/drivers/pci/hotplug/pciehp_pci.c
@@ -23,7 +23,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/pciehprm.h b/drivers/pci/hotplug/pciehprm.h
index 966775ffb0ff..05f20fbc5f50 100644
--- a/drivers/pci/hotplug/pciehprm.h
+++ b/drivers/pci/hotplug/pciehprm.h
@@ -23,7 +23,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/pciehprm_acpi.c b/drivers/pci/hotplug/pciehprm_acpi.c
index 57f4e6d1b27c..305b47ec2f2c 100644
--- a/drivers/pci/hotplug/pciehprm_acpi.c
+++ b/drivers/pci/hotplug/pciehprm_acpi.c
@@ -20,7 +20,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <dely.l.sy@intel.com>
+ * Send feedback to <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/pciehprm_nonacpi.c b/drivers/pci/hotplug/pciehprm_nonacpi.c
index 79a0aa6238ef..3622965f8961 100644
--- a/drivers/pci/hotplug/pciehprm_nonacpi.c
+++ b/drivers/pci/hotplug/pciehprm_nonacpi.c
@@ -23,7 +23,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/pciehprm_nonacpi.h b/drivers/pci/hotplug/pciehprm_nonacpi.h
index 87c90e85ede9..b10603b0e958 100644
--- a/drivers/pci/hotplug/pciehprm_nonacpi.h
+++ b/drivers/pci/hotplug/pciehprm_nonacpi.h
@@ -23,7 +23,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/shpchp.h b/drivers/pci/hotplug/shpchp.h
index 67b6a3370ceb..fe4d653da188 100644
--- a/drivers/pci/hotplug/shpchp.h
+++ b/drivers/pci/hotplug/shpchp.h
@@ -23,7 +23,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>,<dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>,<kristen.c.accardi@intel.com>
  *
  */
 #ifndef _SHPCHP_H
diff --git a/drivers/pci/hotplug/shpchp_core.c b/drivers/pci/hotplug/shpchp_core.c
index a70a5c5705f2..6f7d8a29957a 100644
--- a/drivers/pci/hotplug/shpchp_core.c
+++ b/drivers/pci/hotplug/shpchp_core.c
@@ -23,7 +23,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/shpchp_ctrl.c b/drivers/pci/hotplug/shpchp_ctrl.c
index 490a9553a062..783b5abb0717 100644
--- a/drivers/pci/hotplug/shpchp_ctrl.c
+++ b/drivers/pci/hotplug/shpchp_ctrl.c
@@ -23,7 +23,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/shpchp_hpc.c b/drivers/pci/hotplug/shpchp_hpc.c
index 38c5d9066697..8d98410bf1c0 100644
--- a/drivers/pci/hotplug/shpchp_hpc.c
+++ b/drivers/pci/hotplug/shpchp_hpc.c
@@ -23,7 +23,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>,<dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>,<kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/shpchp_pci.c b/drivers/pci/hotplug/shpchp_pci.c
index 90113e9cd69b..d867099114ec 100644
--- a/drivers/pci/hotplug/shpchp_pci.c
+++ b/drivers/pci/hotplug/shpchp_pci.c
@@ -23,7 +23,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/shpchprm.h b/drivers/pci/hotplug/shpchprm.h
index 88aeb978c911..057b192ce589 100644
--- a/drivers/pci/hotplug/shpchprm.h
+++ b/drivers/pci/hotplug/shpchprm.h
@@ -23,7 +23,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/shpchprm_acpi.c b/drivers/pci/hotplug/shpchprm_acpi.c
index 7957cdc72cd0..d37b31658edf 100644
--- a/drivers/pci/hotplug/shpchprm_acpi.c
+++ b/drivers/pci/hotplug/shpchprm_acpi.c
@@ -20,7 +20,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <dely.l.sy@intel.com>
+ * Send feedback to <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/shpchprm_legacy.c b/drivers/pci/hotplug/shpchprm_legacy.c
index 37fa77a98289..ba6c549c9b9d 100644
--- a/drivers/pci/hotplug/shpchprm_legacy.c
+++ b/drivers/pci/hotplug/shpchprm_legacy.c
@@ -23,7 +23,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>,<dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>,<kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/shpchprm_legacy.h b/drivers/pci/hotplug/shpchprm_legacy.h
index 29ccea5e57e5..21bda74ddfa5 100644
--- a/drivers/pci/hotplug/shpchprm_legacy.h
+++ b/drivers/pci/hotplug/shpchprm_legacy.h
@@ -23,7 +23,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/shpchprm_nonacpi.c b/drivers/pci/hotplug/shpchprm_nonacpi.c
index 88f4d9f41886..5f75ef7f3df2 100644
--- a/drivers/pci/hotplug/shpchprm_nonacpi.c
+++ b/drivers/pci/hotplug/shpchprm_nonacpi.c
@@ -23,7 +23,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/shpchprm_nonacpi.h b/drivers/pci/hotplug/shpchprm_nonacpi.h
index 6bc8668023c3..cddaaa5ee1b3 100644
--- a/drivers/pci/hotplug/shpchprm_nonacpi.h
+++ b/drivers/pci/hotplug/shpchprm_nonacpi.h
@@ -23,7 +23,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index b5ab9aa6ff7c..2b85aa39f954 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -453,7 +453,7 @@ static void enable_msi_mode(struct pci_dev *dev, int pos, int type)
         }
 }
 
-static void disable_msi_mode(struct pci_dev *dev, int pos, int type)
+void disable_msi_mode(struct pci_dev *dev, int pos, int type)
 {
         u16 control;
 
@@ -699,6 +699,9 @@ int pci_enable_msi(struct pci_dev* dev)
         if (!pci_msi_enable || !dev)
                 return status;
 
+        if (dev->no_msi)
+                return status;
+
         temp = dev->irq;
 
         if ((status = msi_init()) < 0)
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index d94d7af4f7a0..d00168b1f662 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -47,6 +47,12 @@ extern int pci_msi_quirk;
 #define pci_msi_quirk 0
 #endif
 
+#ifdef CONFIG_PCI_MSI
+void disable_msi_mode(struct pci_dev *dev, int pos, int type);
+#else
+static inline void disable_msi_mode(struct pci_dev *dev, int pos, int type) { }
+#endif
+
 extern int pcie_mch_quirk;
 extern struct device_attribute pci_dev_attrs[];
 extern struct class_device_attribute class_device_attr_cpuaffinity;
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 8d0968bd527e..bb36bb69803f 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -373,6 +373,25 @@ static void __devinit quirk_vt82c686_acpi(struct pci_dev *dev)
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,     PCI_DEVICE_ID_VIA_82C686_4,     quirk_vt82c686_acpi );
 
+/*
+ * VIA VT8235 ISA Bridge: Two IO regions pointed to by words at
+ *      0x88 (128 bytes of power management registers)
+ *      0xd0 (16 bytes of SMB registers)
+ */
+static void __devinit quirk_vt8235_acpi(struct pci_dev *dev)
+{
+        u16 pm, smb;
+
+        pci_read_config_word(dev, 0x88, &pm);
+        pm &= PCI_BASE_ADDRESS_IO_MASK;
+        quirk_io_region(dev, pm, 128, PCI_BRIDGE_RESOURCES);
+
+        pci_read_config_word(dev, 0xd0, &smb);
+        smb &= PCI_BASE_ADDRESS_IO_MASK;
+        quirk_io_region(dev, smb, 16, PCI_BRIDGE_RESOURCES + 1);
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,     PCI_DEVICE_ID_VIA_8235, quirk_vt8235_acpi);
+
 
 #ifdef CONFIG_X86_IO_APIC 
 
@@ -1272,6 +1291,27 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_E7520_MCH,	quir
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_E7320_MCH,  quirk_pcie_mch );
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_E7525_MCH,  quirk_pcie_mch );
 
+
+/*
+ * It's possible for the MSI to get corrupted if shpc and acpi
+ * are used together on certain PXH-based systems.
+ */
+static void __devinit quirk_pcie_pxh(struct pci_dev *dev)
+{
+        disable_msi_mode(dev, pci_find_capability(dev, PCI_CAP_ID_MSI),
+                                        PCI_CAP_ID_MSI);
+        dev->no_msi = 1;
+
+        printk(KERN_WARNING "PCI: PXH quirk detected, "
+                "disabling MSI for SHPC device\n");
+}
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_PXHD_0,     quirk_pcie_pxh);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_PXHD_1,     quirk_pcie_pxh);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_PXH_0,      quirk_pcie_pxh);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_PXH_1,      quirk_pcie_pxh);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_PXHV,       quirk_pcie_pxh);
+
+
 static void __devinit quirk_netmos(struct pci_dev *dev)
 {
         unsigned int num_parallel = (dev->subsystem_device & 0xf0) >> 4;
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index a2eebc6eaacc..6b0e6464eb39 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -40,7 +40,7 @@
  * FIXME: IO should be max 256 bytes.  However, since we may
  * have a P2P bridge below a cardbus bridge, we need 4K.
  */
-#define CARDBUS_IO_SIZE         (4096)
+#define CARDBUS_IO_SIZE         (4*1024)
 #define CARDBUS_MEM_SIZE        (32*1024*1024)
 
 static void __devinit
diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
index 1ca21d2ba11c..5598b4714f77 100644
--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -33,6 +33,11 @@ pci_update_resource(struct pci_dev *dev, struct resource *res, int resno)
         u32 new, check, mask;
         int reg;
 
+        /* Ignore resources for unimplemented BARs and unused resource slots
+           for 64 bit BARs. */
+        if (!res->flags)
+                return;
+
         pcibios_resource_to_bus(dev, &region, res);
 
         pr_debug("  got res [%lx:%lx] bus [%lx:%lx] flags %lx for "
@@ -48,7 +53,9 @@ pci_update_resource(struct pci_dev *dev, struct resource *res, int resno)
         if (resno < 6) {
                 reg = PCI_BASE_ADDRESS_0 + 4 * resno;
         } else if (resno == PCI_ROM_RESOURCE) {
-                new |= res->flags & IORESOURCE_ROM_ENABLE;
+                if (!(res->flags & IORESOURCE_ROM_ENABLE))
+                        return;
+                new |= PCI_ROM_ADDRESS_ENABLE;
                 reg = dev->rom_base_reg;
         } else {
                 /* Hmm, non-standard resource. */
@@ -67,7 +74,7 @@ pci_update_resource(struct pci_dev *dev, struct resource *res, int resno)
 
         if ((new & (PCI_BASE_ADDRESS_SPACE|PCI_BASE_ADDRESS_MEM_TYPE_MASK)) ==
             (PCI_BASE_ADDRESS_SPACE_MEMORY|PCI_BASE_ADDRESS_MEM_TYPE_64)) {
-                new = 0; /* currently everyone zeros the high address */
+                new = region.start >> 16 >> 16;
                 pci_write_config_dword(dev, reg + 4, new);
                 pci_read_config_dword(dev, reg + 4, &check);
                 if (check != new) {
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index 6f9fdb276402..599b116d9747 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -41,6 +41,7 @@ module_param(io_speed, int, 0444);
 
 
 #ifdef CONFIG_PCMCIA_PROBE
+#include <asm/irq.h>
 /* mask of IRQs already reserved by other cards, we should avoid using them */
 static u8 pcmcia_used_irq[NR_IRQS];
 #endif
diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c
index 91e7457d5b04..62fd705203fb 100644
--- a/drivers/pcmcia/yenta_socket.c
+++ b/drivers/pcmcia/yenta_socket.c
@@ -605,9 +605,8 @@ static int yenta_search_res(struct yenta_socket *socket, struct resource *res,
 
 static void yenta_allocate_res(struct yenta_socket *socket, int nr, unsigned type, int addr_start, int addr_end)
 {
-        struct pci_bus *bus;
         struct resource *root, *res;
-        u32 start, end;
+        struct pci_bus_region region;
         unsigned mask;
 
         res = socket->dev->resource + PCI_BRIDGE_RESOURCES + nr;
@@ -620,15 +619,13 @@ static void yenta_allocate_res(struct yenta_socket *socket, int nr, unsigned typ
         if (type & IORESOURCE_IO)
                 mask = ~3;
 
-        bus = socket->dev->subordinate;
-        res->name = bus->name;
+        res->name = socket->dev->subordinate->name;
         res->flags = type;
 
-        start = config_readl(socket, addr_start) & mask;
-        end = config_readl(socket, addr_end) | ~mask;
-        if (start && end > start && !override_bios) {
-                res->start = start;
-                res->end = end;
+        region.start = config_readl(socket, addr_start) & mask;
+        region.end = config_readl(socket, addr_end) | ~mask;
+        if (region.start && region.end > region.start && !override_bios) {
+                pcibios_bus_to_resource(socket->dev, res, &region);
                 root = pci_find_parent_resource(socket->dev, res);
                 if (root && (request_resource(root, res) == 0))
                         return;
diff --git a/drivers/pnp/card.c b/drivers/pnp/card.c
index add12f7c489a..6e5229e92fbc 100644
--- a/drivers/pnp/card.c
+++ b/drivers/pnp/card.c
@@ -312,6 +312,8 @@ found:
         if (drv->link.driver.probe) {
                 if (drv->link.driver.probe(&dev->dev)) {
                         dev->dev.driver = NULL;
+                        dev->card_link = NULL;
+                        up_write(&dev->dev.bus->subsys.rwsem);
                         return NULL;
                 }
         }
diff --git a/drivers/s390/cio/qdio.c b/drivers/s390/cio/qdio.c
index d36258d6665f..381f339e3200 100644
--- a/drivers/s390/cio/qdio.c
+++ b/drivers/s390/cio/qdio.c
@@ -112,7 +112,7 @@ qdio_min(int a,int b)
 
 /***************** SCRUBBER HELPER ROUTINES **********************/
 
-static inline volatile __u64 
+static inline __u64 
 qdio_get_micros(void)
 {
         return (get_clock() >> 10); /* time>>12 is microseconds */
@@ -230,7 +230,7 @@ qdio_siga_input(struct qdio_q *q)
 }
 
 /* locked by the locks in qdio_activate and qdio_cleanup */
-static __u32 * volatile 
+static __u32 volatile *
 qdio_get_indicator(void)
 {
         int i;
diff --git a/drivers/s390/crypto/z90crypt.h b/drivers/s390/crypto/z90crypt.h
index 82a1d97001d7..0a3bb5a10dd4 100644
--- a/drivers/s390/crypto/z90crypt.h
+++ b/drivers/s390/crypto/z90crypt.h
@@ -36,15 +36,6 @@
 #define z90crypt_VARIANT 2      // 2 = added PCIXCC MCL3 and CEX2C support
 
 /**
- * If we are not using the sparse checker, __user has no use.
- */
-#ifdef __CHECKER__
-# define __user         __attribute__((noderef, address_space(1)))
-#else
-# define __user
-#endif
-
-/**
  * struct ica_rsa_modexpo
  *
  * Requirements:
diff --git a/drivers/s390/net/qeth_main.c b/drivers/s390/net/qeth_main.c
index 8f4d2999af8e..79c74f3a11f5 100644
--- a/drivers/s390/net/qeth_main.c
+++ b/drivers/s390/net/qeth_main.c
@@ -8120,20 +8120,22 @@ static struct notifier_block qeth_ip6_notifier = {
 #endif
 
 static int
-qeth_reboot_event(struct notifier_block *this, unsigned long event, void *ptr)
+__qeth_reboot_event_card(struct device *dev, void *data)
 {
-
-        struct device *entry;
         struct qeth_card *card;
 
-        down_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
-               list_for_each_entry(entry, &qeth_ccwgroup_driver.driver.devices,
-                                   driver_list) {
-                       card = (struct qeth_card *) entry->driver_data;
-                       qeth_clear_ip_list(card, 0, 0);
-                       qeth_qdio_clear_card(card, 0);
-               }
-        up_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
+        card = (struct qeth_card *) dev->driver_data;
+        qeth_clear_ip_list(card, 0, 0);
+        qeth_qdio_clear_card(card, 0);
+        return 0;
+}
+
+static int
+qeth_reboot_event(struct notifier_block *this, unsigned long event, void *ptr)
+{
+
+        driver_for_each_device(&qeth_ccwgroup_driver.driver, NULL, NULL,
+                               __qeth_reboot_event_card);
         return NOTIFY_DONE;
 }
 
diff --git a/drivers/s390/net/qeth_proc.c b/drivers/s390/net/qeth_proc.c
index 04719196fd20..f2ccfea8fdb8 100644
--- a/drivers/s390/net/qeth_proc.c
+++ b/drivers/s390/net/qeth_proc.c
@@ -27,23 +27,33 @@ const char *VERSION_QETH_PROC_C = "$Revision: 1.13 $";
 #define QETH_PROCFILE_NAME "qeth"
 static struct proc_dir_entry *qeth_procfile;
 
+static int
+qeth_procfile_seq_match(struct device *dev, void *data)
+{
+        return 1;
+}
+
 static void *
 qeth_procfile_seq_start(struct seq_file *s, loff_t *offset)
 {
-        struct list_head *next_card = NULL;
-        int i = 0;
+        struct device *dev;
+        loff_t nr;
 
         down_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
 
-        if (*offset == 0)
+        nr = *offset;
+        if (nr == 0)
                 return SEQ_START_TOKEN;
 
-        /* get card at pos *offset */
-        list_for_each(next_card, &qeth_ccwgroup_driver.driver.devices)
-                if (++i == *offset)
-                        return next_card;
+        dev = driver_find_device(&qeth_ccwgroup_driver.driver, NULL,
+                                 NULL, qeth_procfile_seq_match);
 
-        return NULL;
+        /* get card at pos *offset */
+        nr = *offset;
+        while (nr-- > 1 && dev)
+                dev = driver_find_device(&qeth_ccwgroup_driver.driver, dev,
+                                         NULL, qeth_procfile_seq_match);
+        return (void *) dev;
 }
 
 static void
@@ -55,23 +65,21 @@ qeth_procfile_seq_stop(struct seq_file *s, void* it)
 static void *
 qeth_procfile_seq_next(struct seq_file *s, void *it, loff_t *offset)
 {
-        struct list_head *next_card = NULL;
-        struct list_head *current_card;
+        struct device *prev, *next;
 
         if (it == SEQ_START_TOKEN) {
-                next_card = qeth_ccwgroup_driver.driver.devices.next;
-                if (next_card->next == next_card) /* list empty */
-                        return NULL;
-                (*offset)++;
-        } else {
-                current_card = (struct list_head *)it;
-                if (current_card->next == &qeth_ccwgroup_driver.driver.devices)
-                        return NULL; /* end of list reached */
-                next_card = current_card->next;
-                (*offset)++;
+                next = driver_find_device(&qeth_ccwgroup_driver.driver,
+                                          NULL, NULL, qeth_procfile_seq_match);
+                if (next)
+                        (*offset)++;
+                return (void *) next;
         }
-
-        return next_card;
+        prev = (struct device *) it;
+        next = driver_find_device(&qeth_ccwgroup_driver.driver,
+                                  prev, NULL, qeth_procfile_seq_match);
+        if (next)
+                (*offset)++;
+        return (void *) next;
 }
 
 static inline const char *
@@ -126,7 +134,7 @@ qeth_procfile_seq_show(struct seq_file *s, void *it)
                               "-------------- ---- ------ ---------- ---- "
                               "---- ----- -----\n");
         } else {
-                device = list_entry(it, struct device, driver_list);
+                device = (struct device *) it;
                 card = device->driver_data;
                 seq_printf(s, "%s/%s/%s x%02X   %-10s %-14s %-4i ",
                                 CARD_RDEV_ID(card),
@@ -180,17 +188,20 @@ static struct proc_dir_entry *qeth_perf_procfile;
 static void *
 qeth_perf_procfile_seq_start(struct seq_file *s, loff_t *offset)
 {
-        struct list_head *next_card = NULL;
-        int i = 0;
+        struct device *dev = NULL;
+        int nr;
 
         down_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
         /* get card at pos *offset */
-        list_for_each(next_card, &qeth_ccwgroup_driver.driver.devices){
-                if (i == *offset)
-                        return next_card;
-                i++;
-        }
-        return NULL;
+        dev = driver_find_device(&qeth_ccwgroup_driver.driver, NULL, NULL,
+                                 qeth_procfile_seq_match);
+
+        /* get card at pos *offset */
+        nr = *offset;
+        while (nr-- > 1 && dev)
+                dev = driver_find_device(&qeth_ccwgroup_driver.driver, dev,
+                                         NULL, qeth_procfile_seq_match);
+        return (void *) dev;
 }
 
 static void
@@ -202,12 +213,14 @@ qeth_perf_procfile_seq_stop(struct seq_file *s, void* it)
 static void *
 qeth_perf_procfile_seq_next(struct seq_file *s, void *it, loff_t *offset)
 {
-        struct list_head *current_card = (struct list_head *)it;
+        struct device *prev, *next;
 
-        if (current_card->next == &qeth_ccwgroup_driver.driver.devices)
-                return NULL; /* end of list reached */
-        (*offset)++;
-        return current_card->next;
+        prev = (struct device *) it;
+        next = driver_find_device(&qeth_ccwgroup_driver.driver, prev,
+                                  NULL, qeth_procfile_seq_match);
+        if (next)
+                (*offset)++;
+        return (void *) next;
 }
 
 static int
@@ -216,7 +229,7 @@ qeth_perf_procfile_seq_show(struct seq_file *s, void *it)
         struct device *device;
         struct qeth_card *card;
 
-        device = list_entry(it, struct device, driver_list);
+        device = (struct device *) it;
         card = device->driver_data;
         seq_printf(s, "For card with devnos %s/%s/%s (%s):\n",
                         CARD_RDEV_ID(card),
@@ -318,8 +331,8 @@ static struct proc_dir_entry *qeth_ipato_procfile;
 static void *
 qeth_ipato_procfile_seq_start(struct seq_file *s, loff_t *offset)
 {
-        struct list_head *next_card = NULL;
-        int i = 0;
+        struct device *dev;
+        loff_t nr;
 
         down_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
         /* TODO: finish this */
@@ -328,13 +341,16 @@ qeth_ipato_procfile_seq_start(struct seq_file *s, loff_t *offset)
          * output driver settings then;
          * else output setting for respective card
          */
+
+        dev = driver_find_device(&qeth_ccwgroup_driver.driver, NULL, NULL,
+                                 qeth_procfile_seq_match);
+
         /* get card at pos *offset */
-        list_for_each(next_card, &qeth_ccwgroup_driver.driver.devices){
-                if (i == *offset)
-                        return next_card;
-                i++;
-        }
-        return NULL;
+        nr = *offset;
+        while (nr-- > 1 && dev)
+                dev = driver_find_device(&qeth_ccwgroup_driver.driver, dev,
+                                         NULL, qeth_procfile_seq_match);
+        return (void *) dev;
 }
 
 static void
@@ -346,18 +362,14 @@ qeth_ipato_procfile_seq_stop(struct seq_file *s, void* it)
 static void *
 qeth_ipato_procfile_seq_next(struct seq_file *s, void *it, loff_t *offset)
 {
-        struct list_head *current_card = (struct list_head *)it;
+        struct device *prev, *next;
 
-        /* TODO: finish this */
-        /*
-         * maybe SEQ_SATRT_TOKEN can be returned for offset 0
-         * output driver settings then;
-         * else output setting for respective card
-         */
-        if (current_card->next == &qeth_ccwgroup_driver.driver.devices)
-                return NULL; /* end of list reached */
-        (*offset)++;
-        return current_card->next;
+        prev = (struct device *) it;
+        next = driver_find_device(&qeth_ccwgroup_driver.driver, prev,
+                                  NULL, qeth_procfile_seq_match);
+        if (next)
+                (*offset)++;
+        return (void *) next;
 }
 
 static int
@@ -372,7 +384,7 @@ qeth_ipato_procfile_seq_show(struct seq_file *s, void *it)
          * output driver settings then;
          * else output setting for respective card
          */
-        device = list_entry(it, struct device, driver_list);
+        device = (struct device *) it;
         card = device->driver_data;
 
         return 0;
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index e17b4d58a9f6..bfe3ba73bc0f 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -1299,13 +1299,10 @@ struct zfcp_port *
 zfcp_port_enqueue(struct zfcp_adapter *adapter, wwn_t wwpn, u32 status,
                   u32 d_id)
 {
-        struct zfcp_port *port, *tmp_port;
+        struct zfcp_port *port;
         int check_wwpn;
-        scsi_id_t scsi_id;
-        int found;
 
         check_wwpn = !(status & ZFCP_STATUS_PORT_NO_WWPN);
-
         /*
          * check that there is no port with this WWPN already in list
          */
@@ -1368,7 +1365,7 @@ zfcp_port_enqueue(struct zfcp_adapter *adapter, wwn_t wwpn, u32 status,
         } else {
                 snprintf(port->sysfs_device.bus_id,
                          BUS_ID_SIZE, "0x%016llx", wwpn);
-        port->sysfs_device.parent = &adapter->ccw_device->dev;
+                port->sysfs_device.parent = &adapter->ccw_device->dev;
         }
         port->sysfs_device.release = zfcp_sysfs_port_release;
         dev_set_drvdata(&port->sysfs_device, port);
@@ -1388,24 +1385,8 @@ zfcp_port_enqueue(struct zfcp_adapter *adapter, wwn_t wwpn, u32 status,
 
         zfcp_port_get(port);
 
-        scsi_id = 1;
-        found = 0;
         write_lock_irq(&zfcp_data.config_lock);
-        list_for_each_entry(tmp_port, &adapter->port_list_head, list) {
-                if (atomic_test_mask(ZFCP_STATUS_PORT_NO_SCSI_ID,
-                                     &tmp_port->status))
-                        continue;
-                if (tmp_port->scsi_id != scsi_id) {
-                        found = 1;
-                        break;
-                }
-                scsi_id++;
-        }
-        port->scsi_id = scsi_id;
-        if (found)
-                list_add_tail(&port->list, &tmp_port->list);
-        else
-                list_add_tail(&port->list, &adapter->port_list_head);
+        list_add_tail(&port->list, &adapter->port_list_head);
         atomic_clear_mask(ZFCP_STATUS_COMMON_REMOVE, &port->status);
         atomic_set_mask(ZFCP_STATUS_COMMON_RUNNING, &port->status);
         if (d_id == ZFCP_DID_DIRECTORY_SERVICE)
@@ -1427,6 +1408,9 @@ zfcp_port_dequeue(struct zfcp_port *port)
         list_del(&port->list);
         port->adapter->ports--;
         write_unlock_irq(&zfcp_data.config_lock);
+        if (port->rport)
+                fc_remote_port_delete(port->rport);
+        port->rport = NULL;
         zfcp_adapter_put(port->adapter);
         zfcp_sysfs_port_remove_files(&port->sysfs_device,
                                      atomic_read(&port->status));
diff --git a/drivers/s390/scsi/zfcp_ccw.c b/drivers/s390/scsi/zfcp_ccw.c
index 0fc46381fc22..b30abab77da3 100644
--- a/drivers/s390/scsi/zfcp_ccw.c
+++ b/drivers/s390/scsi/zfcp_ccw.c
@@ -202,9 +202,19 @@ static int
 zfcp_ccw_set_offline(struct ccw_device *ccw_device)
 {
         struct zfcp_adapter *adapter;
+        struct zfcp_port *port;
+        struct fc_rport *rport;
 
         down(&zfcp_data.config_sema);
         adapter = dev_get_drvdata(&ccw_device->dev);
+        /* might be racy, but we cannot take config_lock due to the fact that
+           fc_remote_port_delete might sleep */
+        list_for_each_entry(port, &adapter->port_list_head, list)
+                if (port->rport) {
+                        rport = port->rport;
+                        port->rport = NULL;
+                        fc_remote_port_delete(rport);
+                }
         zfcp_erp_adapter_shutdown(adapter, 0);
         zfcp_erp_wait(adapter);
         zfcp_adapter_scsi_unregister(adapter);
diff --git a/drivers/s390/scsi/zfcp_def.h b/drivers/s390/scsi/zfcp_def.h
index 4103b5be7683..455e902533a9 100644
--- a/drivers/s390/scsi/zfcp_def.h
+++ b/drivers/s390/scsi/zfcp_def.h
@@ -906,6 +906,7 @@ struct zfcp_adapter {
  */
 struct zfcp_port {
         struct device          sysfs_device;   /* sysfs device */
+        struct fc_rport        *rport;         /* rport of fc transport class */
         struct list_head       list;           /* list of remote ports */
         atomic_t               refcount;       /* reference count */
         wait_queue_head_t      remove_wq;      /* can be used to wait for
@@ -916,7 +917,6 @@ struct zfcp_port {
                                                   list */
         u32                    units;          /* # of logical units in list */
         atomic_t               status;         /* status of this remote port */
-        scsi_id_t              scsi_id;        /* own SCSI ID */
         wwn_t                  wwnn;           /* WWNN if known */
         wwn_t                  wwpn;           /* WWPN */
         fc_id_t                d_id;           /* D_ID */
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index 0cf31f7d1c0f..cb4f612550ba 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -3360,13 +3360,32 @@ zfcp_erp_action_cleanup(int action, struct zfcp_adapter *adapter,
                 if ((result == ZFCP_ERP_SUCCEEDED)
                     && (!atomic_test_mask(ZFCP_STATUS_UNIT_TEMPORARY,
                                           &unit->status))
-                    && (!unit->device))
-                        scsi_add_device(unit->port->adapter->scsi_host, 0,
-                                        unit->port->scsi_id, unit->scsi_lun);
+                    && !unit->device
+                    && port->rport)
+                        scsi_add_device(port->adapter->scsi_host, 0,
+                                        port->rport->scsi_target_id,
+                                        unit->scsi_lun);
                 zfcp_unit_put(unit);
                 break;
         case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
         case ZFCP_ERP_ACTION_REOPEN_PORT:
+                if ((result == ZFCP_ERP_SUCCEEDED)
+                    && !atomic_test_mask(ZFCP_STATUS_PORT_NO_WWPN,
+                                         &port->status)
+                    && !port->rport) {
+                        struct fc_rport_identifiers ids;
+                        ids.node_name = port->wwnn;
+                        ids.port_name = port->wwpn;
+                        ids.port_id = port->d_id;
+                        ids.roles = FC_RPORT_ROLE_FCP_TARGET;
+                        port->rport =
+                                fc_remote_port_add(adapter->scsi_host, 0, &ids);
+                        if (!port->rport)
+                                ZFCP_LOG_NORMAL("failed registration of rport"
+                                                "(adapter %s, wwpn=0x%016Lx)\n",
+                                                zfcp_get_busid_by_port(port),
+                                                port->wwpn);
+                }
                 zfcp_port_put(port);
                 break;
         case ZFCP_ERP_ACTION_REOPEN_ADAPTER:
diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
index 42df7e57eeae..cd98a2de9f8f 100644
--- a/drivers/s390/scsi/zfcp_ext.h
+++ b/drivers/s390/scsi/zfcp_ext.h
@@ -143,6 +143,8 @@ extern int zfcp_scsi_command_async(struct zfcp_adapter *,struct zfcp_unit *,
                                    struct scsi_cmnd *, struct timer_list *);
 extern int zfcp_scsi_command_sync(struct zfcp_unit *, struct scsi_cmnd *,
                                   struct timer_list *);
+extern void zfcp_set_fc_host_attrs(struct zfcp_adapter *);
+extern void zfcp_set_fc_rport_attrs(struct zfcp_port *);
 extern struct scsi_transport_template *zfcp_transport_template;
 extern struct fc_function_template zfcp_transport_functions;
 
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index 0d9f20edc490..c007b6424e74 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -2062,6 +2062,7 @@ zfcp_fsf_exchange_config_evaluate(struct zfcp_fsf_req *fsf_req, int xchg_ok)
                 zfcp_erp_adapter_shutdown(adapter, 0);
                 return -EIO;
         }
+        zfcp_set_fc_host_attrs(adapter);
         return 0;
 }
 
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index b61d309352c3..31a76065cf28 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -389,7 +389,7 @@ zfcp_unit_lookup(struct zfcp_adapter *adapter, int channel, scsi_id_t id,
         struct zfcp_unit *unit, *retval = NULL;
 
         list_for_each_entry(port, &adapter->port_list_head, list) {
-                if (id != port->scsi_id)
+                if (!port->rport || (id != port->rport->scsi_target_id))
                         continue;
                 list_for_each_entry(unit, &port->unit_list_head, list) {
                         if (lun == unit->scsi_lun) {
@@ -408,7 +408,7 @@ zfcp_port_lookup(struct zfcp_adapter *adapter, int channel, scsi_id_t id)
         struct zfcp_port *port;
 
         list_for_each_entry(port, &adapter->port_list_head, list) {
-                if (id == port->scsi_id)
+                if (port->rport && (id == port->rport->scsi_target_id))
                         return port;
         }
         return (struct zfcp_port *) NULL;
@@ -634,7 +634,6 @@ zfcp_scsi_eh_device_reset_handler(struct scsi_cmnd *scpnt)
 {
         int retval;
         struct zfcp_unit *unit = (struct zfcp_unit *) scpnt->device->hostdata;
-        struct Scsi_Host *scsi_host = scpnt->device->host;
 
         if (!unit) {
                 ZFCP_LOG_NORMAL("bug: Tried reset for nonexistent unit\n");
@@ -729,7 +728,6 @@ zfcp_scsi_eh_bus_reset_handler(struct scsi_cmnd *scpnt)
 {
         int retval = 0;
         struct zfcp_unit *unit;
-        struct Scsi_Host *scsi_host = scpnt->device->host;
 
         unit = (struct zfcp_unit *) scpnt->device->hostdata;
         ZFCP_LOG_NORMAL("bus reset because of problems with "
@@ -753,7 +751,6 @@ zfcp_scsi_eh_host_reset_handler(struct scsi_cmnd *scpnt)
 {
         int retval = 0;
         struct zfcp_unit *unit;
-        struct Scsi_Host *scsi_host = scpnt->device->host;
 
         unit = (struct zfcp_unit *) scpnt->device->hostdata;
         ZFCP_LOG_NORMAL("host reset because of problems with "
@@ -833,6 +830,7 @@ zfcp_adapter_scsi_unregister(struct zfcp_adapter *adapter)
         shost = adapter->scsi_host;
         if (!shost)
                 return;
+        fc_remove_host(shost);
         scsi_remove_host(shost);
         scsi_host_put(shost);
         adapter->scsi_host = NULL;
@@ -906,6 +904,18 @@ zfcp_get_node_name(struct scsi_target *starget)
         read_unlock_irqrestore(&zfcp_data.config_lock, flags);
 }
 
+void
+zfcp_set_fc_host_attrs(struct zfcp_adapter *adapter)
+{
+        struct Scsi_Host *shost = adapter->scsi_host;
+
+        fc_host_node_name(shost) = adapter->wwnn;
+        fc_host_port_name(shost) = adapter->wwpn;
+        strncpy(fc_host_serial_number(shost), adapter->serial_number,
+                min(FC_SERIAL_NUMBER_SIZE, 32));
+        fc_host_supported_classes(shost) = FC_COS_CLASS2 | FC_COS_CLASS3;
+}
+
 struct fc_function_template zfcp_transport_functions = {
         .get_starget_port_id = zfcp_get_port_id,
         .get_starget_port_name = zfcp_get_port_name,
@@ -913,6 +923,11 @@ struct fc_function_template zfcp_transport_functions = {
         .show_starget_port_id = 1,
         .show_starget_port_name = 1,
         .show_starget_node_name = 1,
+        .show_rport_supported_classes = 1,
+        .show_host_node_name = 1,
+        .show_host_port_name = 1,
+        .show_host_supported_classes = 1,
+        .show_host_serial_number = 1,
 };
 
 /**
diff --git a/drivers/s390/scsi/zfcp_sysfs_port.c b/drivers/s390/scsi/zfcp_sysfs_port.c
index 7a84c7d474d9..c55e82d91deb 100644
--- a/drivers/s390/scsi/zfcp_sysfs_port.c
+++ b/drivers/s390/scsi/zfcp_sysfs_port.c
@@ -67,7 +67,6 @@ static DEVICE_ATTR(_name, S_IRUGO, zfcp_sysfs_port_##_name##_show, NULL);
 ZFCP_DEFINE_PORT_ATTR(status, "0x%08x\n", atomic_read(&port->status));
 ZFCP_DEFINE_PORT_ATTR(wwnn, "0x%016llx\n", port->wwnn);
 ZFCP_DEFINE_PORT_ATTR(d_id, "0x%06x\n", port->d_id);
-ZFCP_DEFINE_PORT_ATTR(scsi_id, "0x%x\n", port->scsi_id);
 ZFCP_DEFINE_PORT_ATTR(in_recovery, "%d\n", atomic_test_mask
                       (ZFCP_STATUS_COMMON_ERP_INUSE, &port->status));
 ZFCP_DEFINE_PORT_ATTR(access_denied, "%d\n", atomic_test_mask
@@ -263,7 +262,6 @@ static struct attribute_group zfcp_port_common_attr_group = {
 static struct attribute *zfcp_port_no_ns_attrs[] = {
         &dev_attr_unit_add.attr,
         &dev_attr_unit_remove.attr,
-        &dev_attr_scsi_id.attr,
         NULL
 };
 
diff --git a/drivers/sbus/char/bbc_envctrl.c b/drivers/sbus/char/bbc_envctrl.c
index b8a2c7353b0a..d44205d52bf3 100644
--- a/drivers/sbus/char/bbc_envctrl.c
+++ b/drivers/sbus/char/bbc_envctrl.c
@@ -7,6 +7,7 @@
 #define __KERNEL_SYSCALLS__
 
 #include <linux/kernel.h>
+#include <linux/kthread.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
@@ -459,10 +460,6 @@ static struct task_struct *kenvctrld_task;
 
 static int kenvctrld(void *__unused)
 {
-        daemonize("kenvctrld");
-        allow_signal(SIGKILL);
-        kenvctrld_task = current;
-
         printk(KERN_INFO "bbc_envctrl: kenvctrld starting...\n");
         last_warning_jiffies = jiffies - WARN_INTERVAL;
         for (;;) {
@@ -470,7 +467,7 @@ static int kenvctrld(void *__unused)
                 struct bbc_fan_control *fp;
 
                 msleep_interruptible(POLL_INTERVAL);
-                if (signal_pending(current))
+                if (kthread_should_stop())
                         break;
 
                 for (tp = all_bbc_temps; tp; tp = tp->next) {
@@ -577,7 +574,6 @@ int bbc_envctrl_init(void)
         int temp_index = 0;
         int fan_index = 0;
         int devidx = 0;
-        int err = 0;
 
         while ((echild = bbc_i2c_getdev(devidx++)) != NULL) {
                 if (!strcmp(echild->prom_name, "temperature"))
@@ -585,9 +581,13 @@ int bbc_envctrl_init(void)
                 if (!strcmp(echild->prom_name, "fan-control"))
                         attach_one_fan(echild, fan_index++);
         }
-        if (temp_index != 0 && fan_index != 0)
-                err = kernel_thread(kenvctrld, NULL, CLONE_FS | CLONE_FILES);
-        return err;
+        if (temp_index != 0 && fan_index != 0) {
+                kenvctrld_task = kthread_run(kenvctrld, NULL, "kenvctrld");
+                if (IS_ERR(kenvctrld_task))
+                        return PTR_ERR(kenvctrld_task);
+        }
+
+        return 0;
 }
 
 static void destroy_one_temp(struct bbc_cpu_temperature *tp)
@@ -607,26 +607,7 @@ void bbc_envctrl_cleanup(void)
         struct bbc_cpu_temperature *tp;
         struct bbc_fan_control *fp;
 
-        if (kenvctrld_task != NULL) {
-                force_sig(SIGKILL, kenvctrld_task);
-                for (;;) {
-                        struct task_struct *p;
-                        int found = 0;
-
-                        read_lock(&tasklist_lock);
-                        for_each_process(p) {
-                                if (p == kenvctrld_task) {
-                                        found = 1;
-                                        break;
-                                }
-                        }
-                        read_unlock(&tasklist_lock);
-                        if (!found)
-                                break;
-                        msleep(1000);
-                }
-                kenvctrld_task = NULL;
-        }
+        kthread_stop(kenvctrld_task);
 
         tp = all_bbc_temps;
         while (tp != NULL) {
diff --git a/drivers/sbus/char/envctrl.c b/drivers/sbus/char/envctrl.c
index 9a8c572554f5..d765cc1bf060 100644
--- a/drivers/sbus/char/envctrl.c
+++ b/drivers/sbus/char/envctrl.c
@@ -24,6 +24,7 @@
 #include <linux/config.h>
 #include <linux/module.h>
 #include <linux/sched.h>
+#include <linux/kthread.h>
 #include <linux/errno.h>
 #include <linux/delay.h>
 #include <linux/ioport.h>
@@ -1010,16 +1011,13 @@ static int kenvctrld(void *__unused)
 
         poll_interval = 5000; /* TODO env_mon_interval */
 
-        daemonize("kenvctrld");
-        allow_signal(SIGKILL);
-
-        kenvctrld_task = current;
-
         printk(KERN_INFO "envctrl: %s starting...\n", current->comm);
         for (;;) {
-                if(msleep_interruptible(poll_interval))
-                        break;
+                msleep_interruptible(poll_interval);
 
+                if (kthread_should_stop())
+                        break;
+                
                 for (whichcpu = 0; whichcpu < ENVCTRL_MAX_CPU; ++whichcpu) {
                         if (0 < envctrl_read_cpu_info(whichcpu, cputemp,
                                                       ENVCTRL_CPUTEMP_MON,
@@ -1041,7 +1039,6 @@ static int kenvctrld(void *__unused)
 
 static int __init envctrl_init(void)
 {
-#ifdef CONFIG_PCI
         struct linux_ebus *ebus = NULL;
         struct linux_ebus_device *edev = NULL;
         struct linux_ebus_child *edev_child = NULL;
@@ -1118,9 +1115,11 @@ done:
                         i2c_childlist[i].addr, (0 == i) ? ("\n") : (" "));
         }
 
-        err = kernel_thread(kenvctrld, NULL, CLONE_FS | CLONE_FILES);
-        if (err < 0)
+        kenvctrld_task = kthread_run(kenvctrld, NULL, "kenvctrld");
+        if (IS_ERR(kenvctrld_task)) {
+                err = PTR_ERR(kenvctrld_task);
                 goto out_deregister;
+        }
 
         return 0;
 
@@ -1133,37 +1132,13 @@ out_iounmap:
                         kfree(i2c_childlist[i].tables);
         }
         return err;
-#else
-        return -ENODEV;
-#endif
 }
 
 static void __exit envctrl_cleanup(void)
 {
         int i;
 
-        if (NULL != kenvctrld_task) {
-                force_sig(SIGKILL, kenvctrld_task);
-                for (;;) {
-                        struct task_struct *p;
-                        int found = 0;
-
-                        read_lock(&tasklist_lock);
-                        for_each_process(p) {
-                                if (p == kenvctrld_task) {
-                                        found = 1;
-                                        break;
-                                }
-                        }
-                        read_unlock(&tasklist_lock);
-
-                        if (!found)
-                                break;
-
-                        msleep(1000);
-                }
-                kenvctrld_task = NULL;
-        }
+        kthread_stop(kenvctrld_task);
 
         iounmap(i2c);
         misc_deregister(&envctrl_dev);
diff --git a/drivers/sbus/char/vfc.h b/drivers/sbus/char/vfc.h
index e56a43af0f62..a7782e7da42e 100644
--- a/drivers/sbus/char/vfc.h
+++ b/drivers/sbus/char/vfc.h
@@ -129,8 +129,6 @@ struct vfc_dev {
         struct vfc_regs *phys_regs;
         unsigned int control_reg;
         struct semaphore device_lock_sem;
-        struct timer_list poll_timer;
-        wait_queue_head_t poll_wait;
         int instance;
         int busy;
         unsigned long which_io;
diff --git a/drivers/sbus/char/vfc_dev.c b/drivers/sbus/char/vfc_dev.c
index 86ce54130954..7a103698fa3c 100644
--- a/drivers/sbus/char/vfc_dev.c
+++ b/drivers/sbus/char/vfc_dev.c
@@ -137,7 +137,6 @@ int init_vfc_devstruct(struct vfc_dev *dev, int instance)
         dev->instance=instance;
         init_MUTEX(&dev->device_lock_sem);
         dev->control_reg=0;
-        init_waitqueue_head(&dev->poll_wait);
         dev->busy=0;
         return 0;
 }
diff --git a/drivers/sbus/char/vfc_i2c.c b/drivers/sbus/char/vfc_i2c.c
index 1faf1e75f71f..739cad9b19a1 100644
--- a/drivers/sbus/char/vfc_i2c.c
+++ b/drivers/sbus/char/vfc_i2c.c
@@ -79,25 +79,10 @@ int vfc_pcf8584_init(struct vfc_dev *dev)
         return 0;
 }
 
-void vfc_i2c_delay_wakeup(struct vfc_dev *dev) 
-{
-        /* Used to profile code and eliminate too many delays */
-        VFC_I2C_DEBUG_PRINTK(("vfc%d: Delaying\n", dev->instance));
-        wake_up(&dev->poll_wait);
-}
-
 void vfc_i2c_delay_no_busy(struct vfc_dev *dev, unsigned long usecs) 
 {
-        DEFINE_WAIT(wait);
-        init_timer(&dev->poll_timer);
-        dev->poll_timer.expires = jiffies + usecs_to_jiffies(usecs);
-        dev->poll_timer.data=(unsigned long)dev;
-        dev->poll_timer.function=(void *)(unsigned long)vfc_i2c_delay_wakeup;
-        add_timer(&dev->poll_timer);
-        prepare_to_wait(&dev->poll_wait, &wait, TASK_UNINTERRUPTIBLE);
-        schedule();
-        del_timer(&dev->poll_timer);
-        finish_wait(&dev->poll_wait, &wait);
+        set_current_state(TASK_UNINTERRUPTIBLE);
+        schedule_timeout(usecs_to_jiffies(usecs));
 }
 
 void inline vfc_i2c_delay(struct vfc_dev *dev) 
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index f1e8c4223ed1..12c208fb18c5 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -1696,7 +1696,7 @@ config TT_DMA_EMUL
 
 config MAC_SCSI
         bool "Macintosh NCR5380 SCSI"
-        depends on MAC && SCSI
+        depends on MAC && SCSI=y
         help
           This is the NCR 5380 SCSI controller included on most of the 68030
           based Macintoshes.  If you have one of these say Y and read the
@@ -1717,7 +1717,7 @@ config SCSI_MAC_ESP
 
 config MVME147_SCSI
         bool "WD33C93 SCSI driver for MVME147"
-        depends on MVME147 && SCSI
+        depends on MVME147 && SCSI=y
         help
           Support for the on-board SCSI controller on the Motorola MVME147
           single-board computer.
@@ -1758,7 +1758,7 @@ config SUN3_SCSI
 
 config SUN3X_ESP
         bool "Sun3x ESP SCSI"
-        depends on SUN3X && SCSI
+        depends on SUN3X && SCSI=y
         help
           The ESP was an on-board SCSI controller used on Sun 3/80
           machines.  Say Y here to compile in support for it.
diff --git a/drivers/scsi/ahci.c b/drivers/scsi/ahci.c
index c5623694d10f..179c95c878ac 100644
--- a/drivers/scsi/ahci.c
+++ b/drivers/scsi/ahci.c
@@ -1,26 +1,34 @@
 /*
  *  ahci.c - AHCI SATA support
  *
- *  Copyright 2004 Red Hat, Inc.
+ *  Maintained by:  Jeff Garzik <jgarzik@pobox.com>
+ *                  Please ALWAYS copy linux-ide@vger.kernel.org
+ *                  on emails.
  *
- *  The contents of this file are subject to the Open
- *  Software License version 1.1 that can be found at
- *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
- *  by reference.
+ *  Copyright 2004-2005 Red Hat, Inc.
  *
- *  Alternatively, the contents of this file may be used under the terms
- *  of the GNU General Public License version 2 (the "GPL") as distributed
- *  in the kernel source COPYING file, in which case the provisions of
- *  the GPL are applicable instead of the above.  If you wish to allow
- *  the use of your version of this file only under the terms of the
- *  GPL and not to allow others to use your version of this file under
- *  the OSL, indicate your decision by deleting the provisions above and
- *  replace them with the notice and other provisions required by the GPL.
- *  If you do not delete the provisions above, a recipient may use your
- *  version of this file under either the OSL or the GPL.
  *
- * Version 1.0 of the AHCI specification:
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2, or (at your option)
+ *  any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; see the file COPYING.  If not, write to
+ *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *
+ * libata documentation is available via 'make {ps|pdf}docs',
+ * as Documentation/DocBook/libata.*
+ *
+ * AHCI hardware documentation:
  * http://www.intel.com/technology/serialata/pdf/rev1_0.pdf
+ * http://www.intel.com/technology/serialata/pdf/rev1_1.pdf
  *
  */
 
@@ -269,6 +277,8 @@ static struct pci_device_id ahci_pci_tbl[] = {
           board_ahci }, /* ESB2 */
         { PCI_VENDOR_ID_INTEL, 0x2683, PCI_ANY_ID, PCI_ANY_ID, 0, 0,
           board_ahci }, /* ESB2 */
+        { PCI_VENDOR_ID_INTEL, 0x27c6, PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+          board_ahci }, /* ICH7-M DH */
         { }     /* terminate list */
 };
 
@@ -584,12 +594,16 @@ static void ahci_intr_error(struct ata_port *ap, u32 irq_stat)
 
 static void ahci_eng_timeout(struct ata_port *ap)
 {
-        void *mmio = ap->host_set->mmio_base;
+        struct ata_host_set *host_set = ap->host_set;
+        void *mmio = host_set->mmio_base;
         void *port_mmio = ahci_port_base(mmio, ap->port_no);
         struct ata_queued_cmd *qc;
+        unsigned long flags;
 
         DPRINTK("ENTER\n");
 
+        spin_lock_irqsave(&host_set->lock, flags);
+
         ahci_intr_error(ap, readl(port_mmio + PORT_IRQ_STAT));
 
         qc = ata_qc_from_tag(ap, ap->active_tag);
@@ -607,6 +621,7 @@ static void ahci_eng_timeout(struct ata_port *ap)
                 ata_qc_complete(qc, ATA_ERR);
         }
 
+        spin_unlock_irqrestore(&host_set->lock, flags);
 }
 
 static inline int ahci_host_intr(struct ata_port *ap, struct ata_queued_cmd *qc)
@@ -696,9 +711,6 @@ static int ahci_qc_issue(struct ata_queued_cmd *qc)
         struct ata_port *ap = qc->ap;
         void *port_mmio = (void *) ap->ioaddr.cmd_addr;
 
-        writel(1, port_mmio + PORT_SCR_ACT);
-        readl(port_mmio + PORT_SCR_ACT);        /* flush */
-
         writel(1, port_mmio + PORT_CMD_ISSUE);
         readl(port_mmio + PORT_CMD_ISSUE);      /* flush */
 
@@ -1105,6 +1117,7 @@ MODULE_AUTHOR("Jeff Garzik");
 MODULE_DESCRIPTION("AHCI SATA low-level driver");
 MODULE_LICENSE("GPL");
 MODULE_DEVICE_TABLE(pci, ahci_pci_tbl);
+MODULE_VERSION(DRV_VERSION);
 
 module_init(ahci_init);
 module_exit(ahci_exit);
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.c b/drivers/scsi/aic7xxx/aic7xxx_osm.c
index 116d0f51ca2c..687f19e9cf03 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm.c
@@ -1264,14 +1264,12 @@ ahc_platform_set_tags(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
         }
         switch ((dev->flags & (AHC_DEV_Q_BASIC|AHC_DEV_Q_TAGGED))) {
         case AHC_DEV_Q_BASIC:
-                scsi_adjust_queue_depth(sdev,
-                                        MSG_SIMPLE_TASK,
-                                        dev->openings + dev->active);
+                scsi_set_tag_type(sdev, MSG_SIMPLE_TAG);
+                scsi_activate_tcq(sdev, dev->openings + dev->active);
                 break;
         case AHC_DEV_Q_TAGGED:
-                scsi_adjust_queue_depth(sdev,
-                                        MSG_ORDERED_TASK,
-                                        dev->openings + dev->active);
+                scsi_set_tag_type(sdev, MSG_ORDERED_TAG);
+                scsi_activate_tcq(sdev, dev->openings + dev->active);
                 break;
         default:
                 /*
@@ -1280,9 +1278,7 @@ ahc_platform_set_tags(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
                  * serially on the controller/device.  This should
                  * remove some latency.
                  */
-                scsi_adjust_queue_depth(sdev,
-                                        /*NON-TAGGED*/0,
-                                        /*queue depth*/2);
+                scsi_deactivate_tcq(sdev, 2);
                 break;
         }
 }
@@ -1635,9 +1631,9 @@ ahc_send_async(struct ahc_softc *ahc, char channel,
                 spi_period(starget) = tinfo->curr.period;
                 spi_width(starget) = tinfo->curr.width;
                 spi_offset(starget) = tinfo->curr.offset;
-                spi_dt(starget) = tinfo->curr.ppr_options & MSG_EXT_PPR_DT_REQ;
-                spi_qas(starget) = tinfo->curr.ppr_options & MSG_EXT_PPR_QAS_REQ;
-                spi_iu(starget) = tinfo->curr.ppr_options & MSG_EXT_PPR_IU_REQ;
+                spi_dt(starget) = tinfo->curr.ppr_options & MSG_EXT_PPR_DT_REQ ? 1 : 0;
+                spi_qas(starget) = tinfo->curr.ppr_options & MSG_EXT_PPR_QAS_REQ ? 1 : 0;
+                spi_iu(starget) = tinfo->curr.ppr_options & MSG_EXT_PPR_IU_REQ ? 1 : 0;
                 spi_display_xfer_agreement(starget);
                 break;
         }
@@ -2429,12 +2425,14 @@ static void ahc_linux_set_dt(struct scsi_target *starget, int dt)
         unsigned int ppr_options = tinfo->goal.ppr_options
                 & ~MSG_EXT_PPR_DT_REQ;
         unsigned int period = tinfo->goal.period;
+        unsigned int width = tinfo->goal.width;
         unsigned long flags;
         struct ahc_syncrate *syncrate;
 
         if (dt) {
-                period = 9;     /* 12.5ns is the only period valid for DT */
                 ppr_options |= MSG_EXT_PPR_DT_REQ;
+                if (!width)
+                        ahc_linux_set_width(starget, 1);
         } else if (period == 9)
                 period = 10;    /* if resetting DT, period must be >= 25ns */
 
diff --git a/drivers/scsi/arm/Kconfig b/drivers/scsi/arm/Kconfig
index 54b32868aaf7..13f23043c8a3 100644
--- a/drivers/scsi/arm/Kconfig
+++ b/drivers/scsi/arm/Kconfig
@@ -3,7 +3,7 @@
 #
 config SCSI_ACORNSCSI_3
         tristate "Acorn SCSI card (aka30) support"
-        depends on ARCH_ACORN && SCSI
+        depends on ARCH_ACORN && SCSI && BROKEN
         help
           This enables support for the Acorn SCSI card (aka30). If you have an
           Acorn system with one of these, say Y. If unsure, say N.
diff --git a/drivers/scsi/ata_piix.c b/drivers/scsi/ata_piix.c
index a2cfade2c1c6..fb28c1261848 100644
--- a/drivers/scsi/ata_piix.c
+++ b/drivers/scsi/ata_piix.c
@@ -1,24 +1,42 @@
 /*
-
-    ata_piix.c - Intel PATA/SATA controllers
-
-    Maintained by:  Jeff Garzik <jgarzik@pobox.com>
-                    Please ALWAYS copy linux-ide@vger.kernel.org
-                    on emails.
-
-
-        Copyright 2003-2004 Red Hat Inc
-        Copyright 2003-2004 Jeff Garzik
-
-
-        Copyright header from piix.c:
-
-    Copyright (C) 1998-1999 Andrzej Krzysztofowicz, Author and Maintainer
-    Copyright (C) 1998-2000 Andre Hedrick <andre@linux-ide.org>
-    Copyright (C) 2003 Red Hat Inc <alan@redhat.com>
-
-    May be copied or modified under the terms of the GNU General Public License
-
+ *    ata_piix.c - Intel PATA/SATA controllers
+ *
+ *    Maintained by:  Jeff Garzik <jgarzik@pobox.com>
+ *                  Please ALWAYS copy linux-ide@vger.kernel.org
+ *                  on emails.
+ *
+ *
+ *      Copyright 2003-2005 Red Hat Inc
+ *      Copyright 2003-2005 Jeff Garzik
+ *
+ *
+ *      Copyright header from piix.c:
+ *
+ *  Copyright (C) 1998-1999 Andrzej Krzysztofowicz, Author and Maintainer
+ *  Copyright (C) 1998-2000 Andre Hedrick <andre@linux-ide.org>
+ *  Copyright (C) 2003 Red Hat Inc <alan@redhat.com>
+ *
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2, or (at your option)
+ *  any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; see the file COPYING.  If not, write to
+ *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *
+ *  libata documentation is available via 'make {ps|pdf}docs',
+ *  as Documentation/DocBook/libata.*
+ *
+ *  Hardware documentation available at http://developer.intel.com/
+ *
  */
 
 #include <linux/kernel.h>
@@ -32,7 +50,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME        "ata_piix"
-#define DRV_VERSION     "1.03"
+#define DRV_VERSION     "1.04"
 
 enum {
         PIIX_IOCFG              = 0x54, /* IDE I/O configuration register */
@@ -629,13 +647,13 @@ static int piix_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         port_info[1] = NULL;
 
         if (port_info[0]->host_flags & PIIX_FLAG_AHCI) {
-               u8 tmp;
-               pci_read_config_byte(pdev, PIIX_SCC, &tmp);
-               if (tmp == PIIX_AHCI_DEVICE) {
-                       int rc = piix_disable_ahci(pdev);
-                       if (rc)
-                           return rc;
-               }
+                u8 tmp;
+                pci_read_config_byte(pdev, PIIX_SCC, &tmp);
+                if (tmp == PIIX_AHCI_DEVICE) {
+                        int rc = piix_disable_ahci(pdev);
+                        if (rc)
+                                return rc;
+                }
         }
 
         if (port_info[0]->host_flags & PIIX_FLAG_COMBINED) {
diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
index 929170dcd3cb..600ba1202864 100644
--- a/drivers/scsi/dc395x.c
+++ b/drivers/scsi/dc395x.c
@@ -183,7 +183,7 @@
  * cross a page boundy.
  */
 #define SEGMENTX_LEN    (sizeof(struct SGentry)*DC395x_MAX_SG_LISTENTRY)
-#define VIRTX_LEN       (sizeof(void *) * DC395x_MAX_SG_LISTENTRY)
+
 
 struct SGentry {
         u32 address;            /* bus! address */
@@ -235,7 +235,6 @@ struct ScsiReqBlk {
         u8 sg_count;                    /* No of HW sg entries for this request */
         u8 sg_index;                    /* Index of HW sg entry for this request */
         u32 total_xfer_length;          /* Total number of bytes remaining to be transfered */
-        void **virt_map;
         unsigned char *virt_addr;       /* Virtual address of current transfer position */
 
         /*
@@ -1022,14 +1021,14 @@ static void build_srb(struct scsi_cmnd *cmd, struct DeviceCtlBlk *dcb,
                         reqlen, cmd->request_buffer, cmd->use_sg,
                         srb->sg_count);
 
+                srb->virt_addr = page_address(sl->page);
                 for (i = 0; i < srb->sg_count; i++) {
-                        u32 seglen = (u32)sg_dma_len(sl + i);
-                        sgp[i].address = (u32)sg_dma_address(sl + i);
+                        u32 busaddr = (u32)sg_dma_address(&sl[i]);
+                        u32 seglen = (u32)sl[i].length;
+                        sgp[i].address = busaddr;
                         sgp[i].length = seglen;
                         srb->total_xfer_length += seglen;
-                        srb->virt_map[i] = kmap(sl[i].page);
                 }
-                srb->virt_addr = srb->virt_map[0];
                 sgp += srb->sg_count - 1;
 
                 /*
@@ -1976,7 +1975,6 @@ static void sg_update_list(struct ScsiReqBlk *srb, u32 left)
         int segment = cmd->use_sg;
         u32 xferred = srb->total_xfer_length - left; /* bytes transfered */
         struct SGentry *psge = srb->segment_x + srb->sg_index;
-        void **virt = srb->virt_map;
 
         dprintkdbg(DBG_0,
                 "sg_update_list: Transfered %i of %i bytes, %i remain\n",
@@ -2016,16 +2014,16 @@ static void sg_update_list(struct ScsiReqBlk *srb, u32 left)
 
         /* We have to walk the scatterlist to find it */
         sg = (struct scatterlist *)cmd->request_buffer;
-        idx = 0;
         while (segment--) {
                 unsigned long mask =
                     ~((unsigned long)sg->length - 1) & PAGE_MASK;
                 if ((sg_dma_address(sg) & mask) == (psge->address & mask)) {
-                        srb->virt_addr = virt[idx] + (psge->address & ~PAGE_MASK);
+                        srb->virt_addr = (page_address(sg->page)
+                                           + psge->address -
+                                           (psge->address & PAGE_MASK));
                         return;
                 }
                 ++sg;
-                ++idx;
         }
 
         dprintkl(KERN_ERR, "sg_update_list: sg_to_virt failed\n");
@@ -2151,7 +2149,7 @@ static void data_out_phase0(struct AdapterCtlBlk *acb, struct ScsiReqBlk *srb,
                                 DC395x_read32(acb, TRM_S1040_DMA_CXCNT));
                 }
                 /*
-                 * calculate all the residue data that not yet transfered
+                 * calculate all the residue data that not yet tranfered
                  * SCSI transfer counter + left in SCSI FIFO data
                  *
                  * .....TRM_S1040_SCSI_COUNTER (24bits)
@@ -3269,7 +3267,6 @@ static void pci_unmap_srb(struct AdapterCtlBlk *acb, struct ScsiReqBlk *srb)
         struct scsi_cmnd *cmd = srb->cmd;
         enum dma_data_direction dir = cmd->sc_data_direction;
         if (cmd->use_sg && dir != PCI_DMA_NONE) {
-                int i;
                 /* unmap DC395x SG list */
                 dprintkdbg(DBG_SG, "pci_unmap_srb: list=%08x(%05x)\n",
                         srb->sg_bus_addr, SEGMENTX_LEN);
@@ -3279,8 +3276,6 @@ static void pci_unmap_srb(struct AdapterCtlBlk *acb, struct ScsiReqBlk *srb)
                 dprintkdbg(DBG_SG, "pci_unmap_srb: segs=%i buffer=%p\n",
                         cmd->use_sg, cmd->request_buffer);
                 /* unmap the sg segments */
-                for (i = 0; i < srb->sg_count; i++)
-                        kunmap(virt_to_page(srb->virt_map[i]));
                 pci_unmap_sg(acb->dev,
                              (struct scatterlist *)cmd->request_buffer,
                              cmd->use_sg, dir);
@@ -3327,7 +3322,7 @@ static void srb_done(struct AdapterCtlBlk *acb, struct DeviceCtlBlk *dcb,
 
         if (cmd->use_sg) {
                 struct scatterlist* sg = (struct scatterlist *)cmd->request_buffer;
-                ptr = (struct ScsiInqData *)(srb->virt_map[0] + sg->offset);
+                ptr = (struct ScsiInqData *)(page_address(sg->page) + sg->offset);
         } else {
                 ptr = (struct ScsiInqData *)(cmd->request_buffer);
         }
@@ -4262,9 +4257,8 @@ static void adapter_sg_tables_free(struct AdapterCtlBlk *acb)
         const unsigned srbs_per_page = PAGE_SIZE/SEGMENTX_LEN;
 
         for (i = 0; i < DC395x_MAX_SRB_CNT; i += srbs_per_page)
-                kfree(acb->srb_array[i].segment_x);
-
-        vfree(acb->srb_array[0].virt_map);
+                if (acb->srb_array[i].segment_x)
+                        kfree(acb->srb_array[i].segment_x);
 }
 
 
@@ -4280,12 +4274,9 @@ static int __devinit adapter_sg_tables_alloc(struct AdapterCtlBlk *acb)
         int srb_idx = 0;
         unsigned i = 0;
         struct SGentry *ptr;
-        void **virt_array;
 
-        for (i = 0; i < DC395x_MAX_SRB_CNT; i++) {
+        for (i = 0; i < DC395x_MAX_SRB_CNT; i++)
                 acb->srb_array[i].segment_x = NULL;
-                acb->srb_array[i].virt_map = NULL;
-        }
 
         dprintkdbg(DBG_1, "Allocate %i pages for SG tables\n", pages);
         while (pages--) {
@@ -4306,19 +4297,6 @@ static int __devinit adapter_sg_tables_alloc(struct AdapterCtlBlk *acb)
                     ptr + (i * DC395x_MAX_SG_LISTENTRY);
         else
                 dprintkl(KERN_DEBUG, "No space for tmsrb SG table reserved?!\n");
-
-        virt_array = vmalloc((DC395x_MAX_SRB_CNT + 1) * DC395x_MAX_SG_LISTENTRY * sizeof(void*));
-
-        if (!virt_array) {
-                adapter_sg_tables_free(acb);
-                return 1;
-        }
-
-        for (i = 0; i < DC395x_MAX_SRB_CNT + 1; i++) {
-                acb->srb_array[i].virt_map = virt_array;
-                virt_array += DC395x_MAX_SG_LISTENTRY;
-        }
-
         return 0;
 }
 
diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
index e2370529c632..7235f94f1191 100644
--- a/drivers/scsi/dpt_i2o.c
+++ b/drivers/scsi/dpt_i2o.c
@@ -907,9 +907,13 @@ static int adpt_install_hba(struct scsi_host_template* sht, struct pci_dev* pDev
                 raptorFlag = TRUE;
         }
 
-
+        if (pci_request_regions(pDev, "dpt_i2o")) {
+                PERROR("dpti: adpt_config_hba: pci request region failed\n");
+                return -EINVAL;
+        }
         base_addr_virt = ioremap(base_addr0_phys,hba_map0_area_size);
         if (!base_addr_virt) {
+                pci_release_regions(pDev);
                 PERROR("dpti: adpt_config_hba: io remap failed\n");
                 return -EINVAL;
         }
@@ -919,6 +923,7 @@ static int adpt_install_hba(struct scsi_host_template* sht, struct pci_dev* pDev
                 if (!msg_addr_virt) {
                         PERROR("dpti: adpt_config_hba: io remap failed on BAR1\n");
                         iounmap(base_addr_virt);
+                        pci_release_regions(pDev);
                         return -EINVAL;
                 }
         } else {
@@ -932,6 +937,7 @@ static int adpt_install_hba(struct scsi_host_template* sht, struct pci_dev* pDev
                         iounmap(msg_addr_virt);
                 }
                 iounmap(base_addr_virt);
+                pci_release_regions(pDev);
                 return -ENOMEM;
         }
         memset(pHba, 0, sizeof(adpt_hba));
@@ -1027,6 +1033,7 @@ static void adpt_i2o_delete_hba(adpt_hba* pHba)
         up(&adpt_configuration_lock);
 
         iounmap(pHba->base_addr_virt);
+        pci_release_regions(pHba->pDev);
         if(pHba->msg_addr_virt != pHba->base_addr_virt){
                 iounmap(pHba->msg_addr_virt);
         }
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index fe09d145542a..2cb3c8340ca8 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -1442,7 +1442,7 @@ static int ibmvscsi_remove(struct vio_dev *vdev)
  */
 static struct vio_device_id ibmvscsi_device_table[] __devinitdata = {
         {"vscsi", "IBM,v-scsi"},
-        {0,}
+        { "", "" }
 };
 
 MODULE_DEVICE_TABLE(vio, ibmvscsi_device_table);
diff --git a/drivers/scsi/ibmvscsi/rpa_vscsi.c b/drivers/scsi/ibmvscsi/rpa_vscsi.c
index 035f615817d7..8bf5652f1060 100644
--- a/drivers/scsi/ibmvscsi/rpa_vscsi.c
+++ b/drivers/scsi/ibmvscsi/rpa_vscsi.c
@@ -28,6 +28,7 @@
  */
 
 #include <asm/vio.h>
+#include <asm/prom.h>
 #include <asm/iommu.h>
 #include <asm/hvcall.h>
 #include <linux/dma-mapping.h>
diff --git a/drivers/scsi/ibmvscsi/srp.h b/drivers/scsi/ibmvscsi/srp.h
index 2ae5154fd89c..7d8e4c4accb9 100644
--- a/drivers/scsi/ibmvscsi/srp.h
+++ b/drivers/scsi/ibmvscsi/srp.h
@@ -35,7 +35,7 @@
 enum srp_types {
         SRP_LOGIN_REQ_TYPE = 0x00,
         SRP_LOGIN_RSP_TYPE = 0xC0,
-        SRP_LOGIN_REJ_TYPE = 0x80,
+        SRP_LOGIN_REJ_TYPE = 0xC2,
         SRP_I_LOGOUT_TYPE = 0x03,
         SRP_T_LOGOUT_TYPE = 0x80,
         SRP_TSK_MGMT_TYPE = 0x01,
diff --git a/drivers/scsi/ips.c b/drivers/scsi/ips.c
index 6dfcb4fbccdd..4cdd891781b1 100644
--- a/drivers/scsi/ips.c
+++ b/drivers/scsi/ips.c
@@ -133,10 +133,12 @@
 /* 6.10.00  - Remove 1G Addressing Limitations                               */
 /* 6.11.xx  - Get VersionInfo buffer off the stack !              DDTS 60401 */
 /* 6.11.xx  - Make Logical Drive Info structure safe for DMA      DDTS 60639 */
-/* 7.10.xx  - Add highmem_io flag in SCSI Templete for 2.4 kernels           */
+/* 7.10.18  - Add highmem_io flag in SCSI Templete for 2.4 kernels           */
 /*          - Fix path/name for scsi_hosts.h include for 2.6 kernels         */
 /*          - Fix sort order of 7k                                           */
 /*          - Remove 3 unused "inline" functions                             */
+/* 7.12.xx  - Use STATIC functions whereever possible                        */
+/*          - Clean up deprecated MODULE_PARM calls                          */
 /*****************************************************************************/
 
 /*
@@ -207,8 +209,8 @@ module_param(ips, charp, 0);
 /*
  * DRIVER_VER
  */
-#define IPS_VERSION_HIGH        "7.10"
-#define IPS_VERSION_LOW         ".18 "
+#define IPS_VERSION_HIGH        "7.12"
+#define IPS_VERSION_LOW         ".02 "
 
 #if !defined(__i386__) && !defined(__ia64__) && !defined(__x86_64__)
 #warning "This driver has only been tested on the x86/ia64/x86_64 platforms"
diff --git a/drivers/scsi/ips.h b/drivers/scsi/ips.h
index 480e06f4d6ae..505e967013de 100644
--- a/drivers/scsi/ips.h
+++ b/drivers/scsi/ips.h
@@ -87,15 +87,14 @@
       #define scsi_set_pci_device(sh,dev) (0)
    #endif
 
-   #if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
-   
-      #ifndef irqreturn_t
-         typedef void irqreturn_t;
-      #endif 
-      
+   #ifndef IRQ_NONE
+      typedef void irqreturn_t;
       #define IRQ_NONE
       #define IRQ_HANDLED
       #define IRQ_RETVAL(x)
+   #endif
+   
+   #if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
       #define IPS_REGISTER_HOSTS(SHT)      scsi_register_module(MODULE_SCSI_HA,SHT)
       #define IPS_UNREGISTER_HOSTS(SHT)    scsi_unregister_module(MODULE_SCSI_HA,SHT)
       #define IPS_ADD_HOST(shost,device)
@@ -123,6 +122,10 @@
    #ifndef min
       #define min(x,y) ((x) < (y) ? x : y)
    #endif
+   
+   #ifndef __iomem       /* For clean compiles in earlier kernels without __iomem annotations */
+      #define __iomem
+   #endif
 
    #define pci_dma_hi32(a)         ((a >> 16) >> 16)
    #define pci_dma_lo32(a)         (a & 0xffffffff)
@@ -1206,13 +1209,13 @@ typedef struct {
 
 #define IPS_VER_MAJOR 7
 #define IPS_VER_MAJOR_STRING "7"
-#define IPS_VER_MINOR 10
-#define IPS_VER_MINOR_STRING "10"
-#define IPS_VER_BUILD 18
-#define IPS_VER_BUILD_STRING "18"
-#define IPS_VER_STRING "7.10.18"
+#define IPS_VER_MINOR 12
+#define IPS_VER_MINOR_STRING "12"
+#define IPS_VER_BUILD 02
+#define IPS_VER_BUILD_STRING "02"
+#define IPS_VER_STRING "7.12.02"
 #define IPS_RELEASE_ID 0x00020000
-#define IPS_BUILD_IDENT 731
+#define IPS_BUILD_IDENT 761
 #define IPS_LEGALCOPYRIGHT_STRING "(C) Copyright IBM Corp. 1994, 2002. All Rights Reserved."
 #define IPS_ADAPTECCOPYRIGHT_STRING "(c) Copyright Adaptec, Inc. 2002 to 2004. All Rights Reserved."
 #define IPS_DELLCOPYRIGHT_STRING "(c) Copyright Dell 2004. All Rights Reserved."
@@ -1223,12 +1226,12 @@ typedef struct {
 #define IPS_VER_SERVERAID2 "2.88.13"
 #define IPS_VER_NAVAJO "2.88.13"
 #define IPS_VER_SERVERAID3 "6.10.24"
-#define IPS_VER_SERVERAID4H "7.10.11"
-#define IPS_VER_SERVERAID4MLx "7.10.18"
-#define IPS_VER_SARASOTA "7.10.18"
-#define IPS_VER_MARCO "7.10.18"
-#define IPS_VER_SEBRING "7.10.18"
-#define IPS_VER_KEYWEST "7.10.18"
+#define IPS_VER_SERVERAID4H "7.12.02"
+#define IPS_VER_SERVERAID4MLx "7.12.02"
+#define IPS_VER_SARASOTA "7.12.02"
+#define IPS_VER_MARCO "7.12.02"
+#define IPS_VER_SEBRING "7.12.02"
+#define IPS_VER_KEYWEST "7.12.02"
 
 /* Compatability IDs for various adapters */
 #define IPS_COMPAT_UNKNOWN ""
diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
index 73b1f72b7e43..dee4b12b0342 100644
--- a/drivers/scsi/libata-core.c
+++ b/drivers/scsi/libata-core.c
@@ -1,25 +1,35 @@
 /*
-   libata-core.c - helper library for ATA
-
-   Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
-   Copyright 2003-2004 Jeff Garzik
-
-   The contents of this file are subject to the Open
-   Software License version 1.1 that can be found at
-   http://www.opensource.org/licenses/osl-1.1.txt and is included herein
-   by reference.
-
-   Alternatively, the contents of this file may be used under the terms
-   of the GNU General Public License version 2 (the "GPL") as distributed
-   in the kernel source COPYING file, in which case the provisions of
-   the GPL are applicable instead of the above.  If you wish to allow
-   the use of your version of this file only under the terms of the
-   GPL and not to allow others to use your version of this file under
-   the OSL, indicate your decision by deleting the provisions above and
-   replace them with the notice and other provisions required by the GPL.
-   If you do not delete the provisions above, a recipient may use your
-   version of this file under either the OSL or the GPL.
-
+ *  libata-core.c - helper library for ATA
+ *
+ *  Maintained by:  Jeff Garzik <jgarzik@pobox.com>
+ *                  Please ALWAYS copy linux-ide@vger.kernel.org
+ *                  on emails.
+ *
+ *  Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
+ *  Copyright 2003-2004 Jeff Garzik
+ *
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2, or (at your option)
+ *  any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; see the file COPYING.  If not, write to
+ *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *
+ *  libata documentation is available via 'make {ps|pdf}docs',
+ *  as Documentation/DocBook/libata.*
+ *
+ *  Hardware documentation available from http://www.t13.org/ and
+ *  http://www.sata-io.org/
+ *
  */
 
 #include <linux/config.h>
@@ -1304,12 +1314,12 @@ static inline u8 ata_dev_knobble(struct ata_port *ap)
 /**
  *      ata_dev_config - Run device specific handlers and check for
  *                       SATA->PATA bridges
- *      @ap: Bus 
+ *      @ap: Bus
  *      @i:  Device
  *
  *      LOCKING:
  */
- 
+
 void ata_dev_config(struct ata_port *ap, unsigned int i)
 {
         /* limit bridge transfers to udma5, 200 sectors */
@@ -2268,19 +2278,6 @@ void ata_qc_prep(struct ata_queued_cmd *qc)
  *      spin_lock_irqsave(host_set lock)
  */
 
-
-
-/**
- *      ata_sg_init_one - Prepare a one-entry scatter-gather list.
- *      @qc:  Queued command
- *      @buf:  transfer buffer
- *      @buflen:  length of buf
- *
- *      Builds a single-entry scatter-gather list to initiate a
- *      transfer utilizing the specified buffer.
- *
- *      LOCKING:
- */
 void ata_sg_init_one(struct ata_queued_cmd *qc, void *buf, unsigned int buflen)
 {
         struct scatterlist *sg;
@@ -2312,18 +2309,6 @@ void ata_sg_init_one(struct ata_queued_cmd *qc, void *buf, unsigned int buflen)
  *      spin_lock_irqsave(host_set lock)
  */
 
-
-/**
- *      ata_sg_init - Assign a scatter gather list to a queued command
- *      @qc:  Queued command
- *      @sg:  Scatter-gather list
- *      @n_elem:  length of sg list
- *
- *      Attaches a scatter-gather list to a queued command.
- *
- *      LOCKING:
- */
-
 void ata_sg_init(struct ata_queued_cmd *qc, struct scatterlist *sg,
                  unsigned int n_elem)
 {
@@ -2402,6 +2387,27 @@ static int ata_sg_setup(struct ata_queued_cmd *qc)
 }
 
 /**
+ *      ata_poll_qc_complete - turn irq back on and finish qc
+ *      @qc: Command to complete
+ *      @drv_stat: ATA status register content
+ *
+ *      LOCKING:
+ *      None.  (grabs host lock)
+ */
+
+void ata_poll_qc_complete(struct ata_queued_cmd *qc, u8 drv_stat)
+{
+        struct ata_port *ap = qc->ap;
+        unsigned long flags;
+
+        spin_lock_irqsave(&ap->host_set->lock, flags);
+        ap->flags &= ~ATA_FLAG_NOINTR;
+        ata_irq_on(ap);
+        ata_qc_complete(qc, drv_stat);
+        spin_unlock_irqrestore(&ap->host_set->lock, flags);
+}
+
+/**
  *      ata_pio_poll -
  *      @ap:
  *
@@ -2463,11 +2469,10 @@ static void ata_pio_complete (struct ata_port *ap)
         u8 drv_stat;
 
         /*
-         * This is purely hueristic.  This is a fast path.
-         * Sometimes when we enter, BSY will be cleared in
-         * a chk-status or two.  If not, the drive is probably seeking
-         * or something.  Snooze for a couple msecs, then
-         * chk-status again.  If still busy, fall back to
+         * This is purely heuristic.  This is a fast path.  Sometimes when
+         * we enter, BSY will be cleared in a chk-status or two.  If not,
+         * the drive is probably seeking or something.  Snooze for a couple
+         * msecs, then chk-status again.  If still busy, fall back to
          * PIO_ST_POLL state.
          */
         drv_stat = ata_busy_wait(ap, ATA_BUSY | ATA_DRQ, 10);
@@ -2492,9 +2497,7 @@ static void ata_pio_complete (struct ata_port *ap)
 
         ap->pio_task_state = PIO_ST_IDLE;
 
-        ata_irq_on(ap);
-
-        ata_qc_complete(qc, drv_stat);
+        ata_poll_qc_complete(qc, drv_stat);
 }
 
 
@@ -2519,6 +2522,20 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
 #endif /* __BIG_ENDIAN */
 }
 
+/**
+ *      ata_mmio_data_xfer - Transfer data by MMIO
+ *      @ap: port to read/write
+ *      @buf: data buffer
+ *      @buflen: buffer length
+ *      @do_write: read/write
+ *
+ *      Transfer data from/to the device data register by MMIO.
+ *
+ *      LOCKING:
+ *      Inherited from caller.
+ *
+ */
+
 static void ata_mmio_data_xfer(struct ata_port *ap, unsigned char *buf,
                                unsigned int buflen, int write_data)
 {
@@ -2527,6 +2544,7 @@ static void ata_mmio_data_xfer(struct ata_port *ap, unsigned char *buf,
         u16 *buf16 = (u16 *) buf;
         void __iomem *mmio = (void __iomem *)ap->ioaddr.data_addr;
 
+        /* Transfer multiple of 2 bytes */
         if (write_data) {
                 for (i = 0; i < words; i++)
                         writew(le16_to_cpu(buf16[i]), mmio);
@@ -2534,19 +2552,76 @@ static void ata_mmio_data_xfer(struct ata_port *ap, unsigned char *buf,
                 for (i = 0; i < words; i++)
                         buf16[i] = cpu_to_le16(readw(mmio));
         }
+
+        /* Transfer trailing 1 byte, if any. */
+        if (unlikely(buflen & 0x01)) {
+                u16 align_buf[1] = { 0 };
+                unsigned char *trailing_buf = buf + buflen - 1;
+
+                if (write_data) {
+                        memcpy(align_buf, trailing_buf, 1);
+                        writew(le16_to_cpu(align_buf[0]), mmio);
+                } else {
+                        align_buf[0] = cpu_to_le16(readw(mmio));
+                        memcpy(trailing_buf, align_buf, 1);
+                }
+        }
 }
 
+/**
+ *      ata_pio_data_xfer - Transfer data by PIO
+ *      @ap: port to read/write
+ *      @buf: data buffer
+ *      @buflen: buffer length
+ *      @do_write: read/write
+ *
+ *      Transfer data from/to the device data register by PIO.
+ *
+ *      LOCKING:
+ *      Inherited from caller.
+ *
+ */
+
 static void ata_pio_data_xfer(struct ata_port *ap, unsigned char *buf,
                               unsigned int buflen, int write_data)
 {
-        unsigned int dwords = buflen >> 1;
+        unsigned int words = buflen >> 1;
 
+        /* Transfer multiple of 2 bytes */
         if (write_data)
-                outsw(ap->ioaddr.data_addr, buf, dwords);
+                outsw(ap->ioaddr.data_addr, buf, words);
         else
-                insw(ap->ioaddr.data_addr, buf, dwords);
+                insw(ap->ioaddr.data_addr, buf, words);
+
+        /* Transfer trailing 1 byte, if any. */
+        if (unlikely(buflen & 0x01)) {
+                u16 align_buf[1] = { 0 };
+                unsigned char *trailing_buf = buf + buflen - 1;
+
+                if (write_data) {
+                        memcpy(align_buf, trailing_buf, 1);
+                        outw(le16_to_cpu(align_buf[0]), ap->ioaddr.data_addr);
+                } else {
+                        align_buf[0] = cpu_to_le16(inw(ap->ioaddr.data_addr));
+                        memcpy(trailing_buf, align_buf, 1);
+                }
+        }
 }
 
+/**
+ *      ata_data_xfer - Transfer data from/to the data register.
+ *      @ap: port to read/write
+ *      @buf: data buffer
+ *      @buflen: buffer length
+ *      @do_write: read/write
+ *
+ *      Transfer data from/to the device data register.
+ *
+ *      LOCKING:
+ *      Inherited from caller.
+ *
+ */
+
 static void ata_data_xfer(struct ata_port *ap, unsigned char *buf,
                           unsigned int buflen, int do_write)
 {
@@ -2556,6 +2631,16 @@ static void ata_data_xfer(struct ata_port *ap, unsigned char *buf,
                 ata_pio_data_xfer(ap, buf, buflen, do_write);
 }
 
+/**
+ *      ata_pio_sector - Transfer ATA_SECT_SIZE (512 bytes) of data.
+ *      @qc: Command on going
+ *
+ *      Transfer ATA_SECT_SIZE of data from/to the ATA device.
+ *
+ *      LOCKING:
+ *      Inherited from caller.
+ */
+
 static void ata_pio_sector(struct ata_queued_cmd *qc)
 {
         int do_write = (qc->tf.flags & ATA_TFLAG_WRITE);
@@ -2594,6 +2679,18 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
         kunmap(page);
 }
 
+/**
+ *      __atapi_pio_bytes - Transfer data from/to the ATAPI device.
+ *      @qc: Command on going
+ *      @bytes: number of bytes
+ *
+ *      Transfer Transfer data from/to the ATAPI device.
+ *
+ *      LOCKING:
+ *      Inherited from caller.
+ *
+ */
+
 static void __atapi_pio_bytes(struct ata_queued_cmd *qc, unsigned int bytes)
 {
         int do_write = (qc->tf.flags & ATA_TFLAG_WRITE);
@@ -2603,10 +2700,33 @@ static void __atapi_pio_bytes(struct ata_queued_cmd *qc, unsigned int bytes)
         unsigned char *buf;
         unsigned int offset, count;
 
-        if (qc->curbytes == qc->nbytes - bytes)
+        if (qc->curbytes + bytes >= qc->nbytes)
                 ap->pio_task_state = PIO_ST_LAST;
 
 next_sg:
+        if (unlikely(qc->cursg >= qc->n_elem)) {
+                /* 
+                 * The end of qc->sg is reached and the device expects
+                 * more data to transfer. In order not to overrun qc->sg
+                 * and fulfill length specified in the byte count register,
+                 *    - for read case, discard trailing data from the device
+                 *    - for write case, padding zero data to the device
+                 */
+                u16 pad_buf[1] = { 0 };
+                unsigned int words = bytes >> 1;
+                unsigned int i;
+
+                if (words) /* warning if bytes > 1 */
+                        printk(KERN_WARNING "ata%u: %u bytes trailing data\n", 
+                               ap->id, bytes);
+
+                for (i = 0; i < words; i++)
+                        ata_data_xfer(ap, (unsigned char*)pad_buf, 2, do_write);
+
+                ap->pio_task_state = PIO_ST_LAST;
+                return;
+        }
+
         sg = &qc->sg[qc->cursg];
 
         page = sg->page;
@@ -2640,11 +2760,21 @@ next_sg:
 
         kunmap(page);
 
-        if (bytes) {
+        if (bytes)
                 goto next_sg;
-        }
 }
 
+/**
+ *      atapi_pio_bytes - Transfer data from/to the ATAPI device.
+ *      @qc: Command on going
+ *
+ *      Transfer Transfer data from/to the ATAPI device.
+ *
+ *      LOCKING:
+ *      Inherited from caller.
+ *
+ */
+
 static void atapi_pio_bytes(struct ata_queued_cmd *qc)
 {
         struct ata_port *ap = qc->ap;
@@ -2717,9 +2847,7 @@ static void ata_pio_block(struct ata_port *ap)
                 if ((status & ATA_DRQ) == 0) {
                         ap->pio_task_state = PIO_ST_IDLE;
 
-                        ata_irq_on(ap);
-
-                        ata_qc_complete(qc, status);
+                        ata_poll_qc_complete(qc, status);
                         return;
                 }
 
@@ -2749,9 +2877,7 @@ static void ata_pio_error(struct ata_port *ap)
 
         ap->pio_task_state = PIO_ST_IDLE;
 
-        ata_irq_on(ap);
-
-        ata_qc_complete(qc, drv_stat | ATA_ERR);
+        ata_poll_qc_complete(qc, drv_stat | ATA_ERR);
 }
 
 static void ata_pio_task(void *_data)
@@ -2857,8 +2983,10 @@ static void atapi_request_sense(struct ata_port *ap, struct ata_device *dev,
 static void ata_qc_timeout(struct ata_queued_cmd *qc)
 {
         struct ata_port *ap = qc->ap;
+        struct ata_host_set *host_set = ap->host_set;
         struct ata_device *dev = qc->dev;
         u8 host_stat = 0, drv_stat;
+        unsigned long flags;
 
         DPRINTK("ENTER\n");
 
@@ -2869,7 +2997,9 @@ static void ata_qc_timeout(struct ata_queued_cmd *qc)
                 if (!(cmd->eh_eflags & SCSI_EH_CANCEL_CMD)) {
 
                         /* finish completing original command */
+                        spin_lock_irqsave(&host_set->lock, flags);
                         __ata_qc_complete(qc);
+                        spin_unlock_irqrestore(&host_set->lock, flags);
 
                         atapi_request_sense(ap, dev, cmd);
 
@@ -2880,6 +3010,8 @@ static void ata_qc_timeout(struct ata_queued_cmd *qc)
                 }
         }
 
+        spin_lock_irqsave(&host_set->lock, flags);
+
         /* hack alert!  We cannot use the supplied completion
          * function from inside the ->eh_strategy_handler() thread.
          * libata is the only user of ->eh_strategy_handler() in
@@ -2895,7 +3027,7 @@ static void ata_qc_timeout(struct ata_queued_cmd *qc)
                 host_stat = ap->ops->bmdma_status(ap);
 
                 /* before we do anything else, clear DMA-Start bit */
-                ap->ops->bmdma_stop(ap);
+                ap->ops->bmdma_stop(qc);
 
                 /* fall through */
 
@@ -2913,6 +3045,9 @@ static void ata_qc_timeout(struct ata_queued_cmd *qc)
                 ata_qc_complete(qc, drv_stat);
                 break;
         }
+
+        spin_unlock_irqrestore(&host_set->lock, flags);
+
 out:
         DPRINTK("EXIT\n");
 }
@@ -3086,9 +3221,14 @@ void ata_qc_complete(struct ata_queued_cmd *qc, u8 drv_stat)
         if (likely(qc->flags & ATA_QCFLAG_DMAMAP))
                 ata_sg_clean(qc);
 
+        /* atapi: mark qc as inactive to prevent the interrupt handler
+         * from completing the command twice later, before the error handler
+         * is called. (when rc != 0 and atapi request sense is needed)
+         */
+        qc->flags &= ~ATA_QCFLAG_ACTIVE;
+
         /* call completion callback */
         rc = qc->complete_fn(qc, drv_stat);
-        qc->flags &= ~ATA_QCFLAG_ACTIVE;
 
         /* if callback indicates not to complete command (non-zero),
          * return immediately
@@ -3218,11 +3358,13 @@ int ata_qc_issue_prot(struct ata_queued_cmd *qc)
                 break;
 
         case ATA_PROT_ATAPI_NODATA:
+                ap->flags |= ATA_FLAG_NOINTR;
                 ata_tf_to_host_nolock(ap, &qc->tf);
                 queue_work(ata_wq, &ap->packet_task);
                 break;
 
         case ATA_PROT_ATAPI_DMA:
+                ap->flags |= ATA_FLAG_NOINTR;
                 ap->ops->tf_load(ap, &qc->tf);   /* load tf registers */
                 ap->ops->bmdma_setup(qc);           /* set up bmdma */
                 queue_work(ata_wq, &ap->packet_task);
@@ -3267,7 +3409,7 @@ static void ata_bmdma_setup_mmio (struct ata_queued_cmd *qc)
 }
 
 /**
- *      ata_bmdma_start - Start a PCI IDE BMDMA transaction
+ *      ata_bmdma_start_mmio - Start a PCI IDE BMDMA transaction
  *      @qc: Info associated with this ATA transaction.
  *
  *      LOCKING:
@@ -3438,7 +3580,7 @@ u8 ata_bmdma_status(struct ata_port *ap)
 
 /**
  *      ata_bmdma_stop - Stop PCI IDE BMDMA transfer
- *      @ap: Port associated with this ATA transaction.
+ *      @qc: Command we are ending DMA for
  *
  *      Clears the ATA_DMA_START flag in the dma control register
  *
@@ -3448,8 +3590,9 @@ u8 ata_bmdma_status(struct ata_port *ap)
  *      spin_lock_irqsave(host_set lock)
  */
 
-void ata_bmdma_stop(struct ata_port *ap)
+void ata_bmdma_stop(struct ata_queued_cmd *qc)
 {
+        struct ata_port *ap = qc->ap;
         if (ap->flags & ATA_FLAG_MMIO) {
                 void __iomem *mmio = (void __iomem *) ap->ioaddr.bmdma_addr;
 
@@ -3501,7 +3644,7 @@ inline unsigned int ata_host_intr (struct ata_port *ap,
                         goto idle_irq;
 
                 /* before we do anything else, clear DMA-Start bit */
-                ap->ops->bmdma_stop(ap);
+                ap->ops->bmdma_stop(qc);
 
                 /* fall through */
 
@@ -3576,7 +3719,8 @@ irqreturn_t ata_interrupt (int irq, void *dev_instance, struct pt_regs *regs)
                 struct ata_port *ap;
 
                 ap = host_set->ports[i];
-                if (ap && (!(ap->flags & ATA_FLAG_PORT_DISABLED))) {
+                if (ap &&
+                    !(ap->flags & (ATA_FLAG_PORT_DISABLED | ATA_FLAG_NOINTR))) {
                         struct ata_queued_cmd *qc;
 
                         qc = ata_qc_from_tag(ap, ap->active_tag);
@@ -3628,19 +3772,27 @@ static void atapi_packet_task(void *_data)
         /* send SCSI cdb */
         DPRINTK("send cdb\n");
         assert(ap->cdb_len >= 12);
-        ata_data_xfer(ap, qc->cdb, ap->cdb_len, 1);
 
-        /* if we are DMA'ing, irq handler takes over from here */
-        if (qc->tf.protocol == ATA_PROT_ATAPI_DMA)
-                ap->ops->bmdma_start(qc);           /* initiate bmdma */
+        if (qc->tf.protocol == ATA_PROT_ATAPI_DMA ||
+            qc->tf.protocol == ATA_PROT_ATAPI_NODATA) {
+                unsigned long flags;
 
-        /* non-data commands are also handled via irq */
-        else if (qc->tf.protocol == ATA_PROT_ATAPI_NODATA) {
-                /* do nothing */
-        }
+                /* Once we're done issuing command and kicking bmdma,
+                 * irq handler takes over.  To not lose irq, we need
+                 * to clear NOINTR flag before sending cdb, but
+                 * interrupt handler shouldn't be invoked before we're
+                 * finished.  Hence, the following locking.
+                 */
+                spin_lock_irqsave(&ap->host_set->lock, flags);
+                ap->flags &= ~ATA_FLAG_NOINTR;
+                ata_data_xfer(ap, qc->cdb, ap->cdb_len, 1);
+                if (qc->tf.protocol == ATA_PROT_ATAPI_DMA)
+                        ap->ops->bmdma_start(qc);       /* initiate bmdma */
+                spin_unlock_irqrestore(&ap->host_set->lock, flags);
+        } else {
+                ata_data_xfer(ap, qc->cdb, ap->cdb_len, 1);
 
-        /* PIO commands are handled by polling */
-        else {
+                /* PIO commands are handled by polling */
                 ap->pio_task_state = PIO_ST;
                 queue_work(ata_wq, &ap->pio_task);
         }
@@ -3648,7 +3800,7 @@ static void atapi_packet_task(void *_data)
         return;
 
 err_out:
-        ata_qc_complete(qc, ATA_ERR);
+        ata_poll_qc_complete(qc, ATA_ERR);
 }
 
 
diff --git a/drivers/scsi/libata-scsi.c b/drivers/scsi/libata-scsi.c
index 794fb559efb0..346eb36b1e31 100644
--- a/drivers/scsi/libata-scsi.c
+++ b/drivers/scsi/libata-scsi.c
@@ -1,25 +1,36 @@
 /*
-   libata-scsi.c - helper library for ATA
-
-   Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
-   Copyright 2003-2004 Jeff Garzik
-
-   The contents of this file are subject to the Open
-   Software License version 1.1 that can be found at
-   http://www.opensource.org/licenses/osl-1.1.txt and is included herein
-   by reference.
-
-   Alternatively, the contents of this file may be used under the terms
-   of the GNU General Public License version 2 (the "GPL") as distributed
-   in the kernel source COPYING file, in which case the provisions of
-   the GPL are applicable instead of the above.  If you wish to allow
-   the use of your version of this file only under the terms of the
-   GPL and not to allow others to use your version of this file under
-   the OSL, indicate your decision by deleting the provisions above and
-   replace them with the notice and other provisions required by the GPL.
-   If you do not delete the provisions above, a recipient may use your
-   version of this file under either the OSL or the GPL.
-
+ *  libata-scsi.c - helper library for ATA
+ *
+ *  Maintained by:  Jeff Garzik <jgarzik@pobox.com>
+ *                  Please ALWAYS copy linux-ide@vger.kernel.org
+ *                  on emails.
+ *
+ *  Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
+ *  Copyright 2003-2004 Jeff Garzik
+ *
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2, or (at your option)
+ *  any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; see the file COPYING.  If not, write to
+ *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *
+ *  libata documentation is available via 'make {ps|pdf}docs',
+ *  as Documentation/DocBook/libata.*
+ *
+ *  Hardware documentation available from
+ *  - http://www.t10.org/
+ *  - http://www.t13.org/
+ *
  */
 
 #include <linux/kernel.h>
@@ -385,12 +396,67 @@ int ata_scsi_error(struct Scsi_Host *host)
          * appropriate place
          */
         host->host_failed--;
+        INIT_LIST_HEAD(&host->eh_cmd_q);
 
         DPRINTK("EXIT\n");
         return 0;
 }
 
 /**
+ *      ata_scsi_start_stop_xlat - Translate SCSI START STOP UNIT command
+ *      @qc: Storage for translated ATA taskfile
+ *      @scsicmd: SCSI command to translate
+ *
+ *      Sets up an ATA taskfile to issue STANDBY (to stop) or READ VERIFY
+ *      (to start). Perhaps these commands should be preceded by
+ *      CHECK POWER MODE to see what power mode the device is already in.
+ *      [See SAT revision 5 at www.t10.org]
+ *
+ *      LOCKING:
+ *      spin_lock_irqsave(host_set lock)
+ *
+ *      RETURNS:
+ *      Zero on success, non-zero on error.
+ */
+
+static unsigned int ata_scsi_start_stop_xlat(struct ata_queued_cmd *qc,
+                                             u8 *scsicmd)
+{
+        struct ata_taskfile *tf = &qc->tf;
+
+        tf->flags |= ATA_TFLAG_DEVICE | ATA_TFLAG_ISADDR;
+        tf->protocol = ATA_PROT_NODATA;
+        if (scsicmd[1] & 0x1) {
+                ;       /* ignore IMMED bit, violates sat-r05 */
+        }
+        if (scsicmd[4] & 0x2)
+                return 1;       /* LOEJ bit set not supported */
+        if (((scsicmd[4] >> 4) & 0xf) != 0)
+                return 1;       /* power conditions not supported */
+        if (scsicmd[4] & 0x1) {
+                tf->nsect = 1;  /* 1 sector, lba=0 */
+                tf->lbah = 0x0;
+                tf->lbam = 0x0;
+                tf->lbal = 0x0;
+                tf->device |= ATA_LBA;
+                tf->command = ATA_CMD_VERIFY;   /* READ VERIFY */
+        } else {
+                tf->nsect = 0;  /* time period value (0 implies now) */
+                tf->command = ATA_CMD_STANDBY;
+                /* Consider: ATA STANDBY IMMEDIATE command */
+        }
+        /*
+         * Standby and Idle condition timers could be implemented but that
+         * would require libata to implement the Power condition mode page
+         * and allow the user to change it. Changing mode pages requires
+         * MODE SELECT to be implemented.
+         */
+
+        return 0;
+}
+
+
+/**
  *      ata_scsi_flush_xlat - Translate SCSI SYNCHRONIZE CACHE command
  *      @qc: Storage for translated ATA taskfile
  *      @scsicmd: SCSI command to translate (ignored)
@@ -575,11 +641,19 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc, u8 *scsicmd)
                 tf->lbah = scsicmd[3];
 
                 VPRINTK("ten-byte command\n");
+                if (qc->nsect == 0) /* we don't support length==0 cmds */
+                        return 1;
                 return 0;
         }
 
         if (scsicmd[0] == READ_6 || scsicmd[0] == WRITE_6) {
                 qc->nsect = tf->nsect = scsicmd[4];
+                if (!qc->nsect) {
+                        qc->nsect = 256;
+                        if (lba48)
+                                tf->hob_nsect = 1;
+                }
+
                 tf->lbal = scsicmd[3];
                 tf->lbam = scsicmd[2];
                 tf->lbah = scsicmd[1] & 0x1f; /* mask out reserved bits */
@@ -619,6 +693,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc, u8 *scsicmd)
                 tf->lbah = scsicmd[7];
 
                 VPRINTK("sixteen-byte command\n");
+                if (qc->nsect == 0) /* we don't support length==0 cmds */
+                        return 1;
                 return 0;
         }
 
@@ -1434,6 +1510,8 @@ static inline ata_xlat_func_t ata_get_xlat_func(struct ata_device *dev, u8 cmd)
         case VERIFY:
         case VERIFY_16:
                 return ata_scsi_verify_xlat;
+        case START_STOP:
+                return ata_scsi_start_stop_xlat;
         }
 
         return NULL;
diff --git a/drivers/scsi/libata.h b/drivers/scsi/libata.h
index d90430bbb0de..809c634afbcd 100644
--- a/drivers/scsi/libata.h
+++ b/drivers/scsi/libata.h
@@ -1,32 +1,35 @@
 /*
-   libata.h - helper library for ATA
-
-   Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
-   Copyright 2003-2004 Jeff Garzik
-
-   The contents of this file are subject to the Open
-   Software License version 1.1 that can be found at
-   http://www.opensource.org/licenses/osl-1.1.txt and is included herein
-   by reference.
-
-   Alternatively, the contents of this file may be used under the terms
-   of the GNU General Public License version 2 (the "GPL") as distributed
-   in the kernel source COPYING file, in which case the provisions of
-   the GPL are applicable instead of the above.  If you wish to allow
-   the use of your version of this file only under the terms of the
-   GPL and not to allow others to use your version of this file under
-   the OSL, indicate your decision by deleting the provisions above and
-   replace them with the notice and other provisions required by the GPL.
-   If you do not delete the provisions above, a recipient may use your
-   version of this file under either the OSL or the GPL.
-
+ *  libata.h - helper library for ATA
+ *
+ *  Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
+ *  Copyright 2003-2004 Jeff Garzik
+ *
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2, or (at your option)
+ *  any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; see the file COPYING.  If not, write to
+ *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *
+ *  libata documentation is available via 'make {ps|pdf}docs',
+ *  as Documentation/DocBook/libata.*
+ *
  */
 
 #ifndef __LIBATA_H__
 #define __LIBATA_H__
 
 #define DRV_NAME        "libata"
-#define DRV_VERSION     "1.11"  /* must be exactly four chars */
+#define DRV_VERSION     "1.12"  /* must be exactly four chars */
 
 struct ata_scsi_args {
         u16                     *id;
@@ -72,7 +75,7 @@ extern unsigned int ata_scsiop_report_luns(struct ata_scsi_args *args, u8 *rbuf,
 extern void ata_scsi_badcmd(struct scsi_cmnd *cmd,
                             void (*done)(struct scsi_cmnd *),
                             u8 asc, u8 ascq);
-extern void ata_scsi_rbuf_fill(struct ata_scsi_args *args, 
+extern void ata_scsi_rbuf_fill(struct ata_scsi_args *args,
                         unsigned int (*actor) (struct ata_scsi_args *args,
                                            u8 *rbuf, unsigned int buflen));
 
diff --git a/drivers/scsi/sata_nv.c b/drivers/scsi/sata_nv.c
index b0403ccd8a25..03d9bc6e69df 100644
--- a/drivers/scsi/sata_nv.c
+++ b/drivers/scsi/sata_nv.c
@@ -4,21 +4,37 @@
  *  Copyright 2004 NVIDIA Corp.  All rights reserved.
  *  Copyright 2004 Andrew Chew
  *
- *  The contents of this file are subject to the Open
- *  Software License version 1.1 that can be found at
- *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
- *  by reference.
  *
- *  Alternatively, the contents of this file may be used under the terms
- *  of the GNU General Public License version 2 (the "GPL") as distributed
- *  in the kernel source COPYING file, in which case the provisions of
- *  the GPL are applicable instead of the above.  If you wish to allow
- *  the use of your version of this file only under the terms of the
- *  GPL and not to allow others to use your version of this file under
- *  the OSL, indicate your decision by deleting the provisions above and
- *  replace them with the notice and other provisions required by the GPL.
- *  If you do not delete the provisions above, a recipient may use your
- *  version of this file under either the OSL or the GPL.
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2, or (at your option)
+ *  any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; see the file COPYING.  If not, write to
+ *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *
+ *  libata documentation is available via 'make {ps|pdf}docs',
+ *  as Documentation/DocBook/libata.*
+ *
+ *  No hardware documentation available outside of NVIDIA.
+ *  This driver programs the NVIDIA SATA controller in a similar
+ *  fashion as with other PCI IDE BMDMA controllers, with a few
+ *  NV-specific details such as register offsets, SATA phy location,
+ *  hotplug info, etc.
+ *
+ *
+ *  0.08
+ *     - Added support for MCP51 and MCP55.
+ *
+ *  0.07
+ *     - Added support for RAID class code.
  *
  *  0.06
  *     - Added generic SATA support by using a pci_device_id that filters on
@@ -48,7 +64,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME                        "sata_nv"
-#define DRV_VERSION                     "0.6"
+#define DRV_VERSION                     "0.8"
 
 #define NV_PORTS                        2
 #define NV_PIO_MASK                     0x1f
@@ -116,7 +132,9 @@ enum nv_host_type
         GENERIC,
         NFORCE2,
         NFORCE3,
-        CK804
+        CK804,
+        MCP51,
+        MCP55
 };
 
 static struct pci_device_id nv_pci_tbl[] = {
@@ -134,9 +152,18 @@ static struct pci_device_id nv_pci_tbl[] = {
                 PCI_ANY_ID, PCI_ANY_ID, 0, 0, CK804 },
         { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_SATA2,
                 PCI_ANY_ID, PCI_ANY_ID, 0, 0, CK804 },
+        { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0, MCP51 },
+        { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0, MCP51 },
+        { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0, MCP55 },
         { PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
                 PCI_ANY_ID, PCI_ANY_ID,
                 PCI_CLASS_STORAGE_IDE<<8, 0xffff00, GENERIC },
+        { PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
+                PCI_ANY_ID, PCI_ANY_ID,
+                PCI_CLASS_STORAGE_RAID<<8, 0xffff00, GENERIC },
         { 0, } /* terminate list */
 };
 
@@ -274,7 +301,8 @@ static irqreturn_t nv_interrupt (int irq, void *dev_instance,
                 struct ata_port *ap;
 
                 ap = host_set->ports[i];
-                if (ap && (!(ap->flags & ATA_FLAG_PORT_DISABLED))) {
+                if (ap &&
+                    !(ap->flags & (ATA_FLAG_PORT_DISABLED | ATA_FLAG_NOINTR))) {
                         struct ata_queued_cmd *qc;
 
                         qc = ata_qc_from_tag(ap, ap->active_tag);
diff --git a/drivers/scsi/sata_promise.c b/drivers/scsi/sata_promise.c
index 5c1d4411457a..7c4f6ecc1cc9 100644
--- a/drivers/scsi/sata_promise.c
+++ b/drivers/scsi/sata_promise.c
@@ -7,21 +7,26 @@
  *
  *  Copyright 2003-2004 Red Hat, Inc.
  *
- *  The contents of this file are subject to the Open
- *  Software License version 1.1 that can be found at
- *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
- *  by reference.
  *
- *  Alternatively, the contents of this file may be used under the terms
- *  of the GNU General Public License version 2 (the "GPL") as distributed
- *  in the kernel source COPYING file, in which case the provisions of
- *  the GPL are applicable instead of the above.  If you wish to allow
- *  the use of your version of this file only under the terms of the
- *  GPL and not to allow others to use your version of this file under
- *  the OSL, indicate your decision by deleting the provisions above and
- *  replace them with the notice and other provisions required by the GPL.
- *  If you do not delete the provisions above, a recipient may use your
- *  version of this file under either the OSL or the GPL.
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2, or (at your option)
+ *  any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; see the file COPYING.  If not, write to
+ *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *
+ *  libata documentation is available via 'make {ps|pdf}docs',
+ *  as Documentation/DocBook/libata.*
+ *
+ *  Hardware information only available under NDA.
  *
  */
 
@@ -40,7 +45,7 @@
 #include "sata_promise.h"
 
 #define DRV_NAME        "sata_promise"
-#define DRV_VERSION     "1.01"
+#define DRV_VERSION     "1.02"
 
 
 enum {
@@ -79,7 +84,8 @@ static irqreturn_t pdc_interrupt (int irq, void *dev_instance, struct pt_regs *r
 static void pdc_eng_timeout(struct ata_port *ap);
 static int pdc_port_start(struct ata_port *ap);
 static void pdc_port_stop(struct ata_port *ap);
-static void pdc_phy_reset(struct ata_port *ap);
+static void pdc_pata_phy_reset(struct ata_port *ap);
+static void pdc_sata_phy_reset(struct ata_port *ap);
 static void pdc_qc_prep(struct ata_queued_cmd *qc);
 static void pdc_tf_load_mmio(struct ata_port *ap, struct ata_taskfile *tf);
 static void pdc_exec_command_mmio(struct ata_port *ap, struct ata_taskfile *tf);
@@ -106,19 +112,22 @@ static Scsi_Host_Template pdc_ata_sht = {
         .ordered_flush          = 1,
 };
 
-static struct ata_port_operations pdc_ata_ops = {
+static struct ata_port_operations pdc_sata_ops = {
         .port_disable           = ata_port_disable,
         .tf_load                = pdc_tf_load_mmio,
         .tf_read                = ata_tf_read,
         .check_status           = ata_check_status,
         .exec_command           = pdc_exec_command_mmio,
         .dev_select             = ata_std_dev_select,
-        .phy_reset              = pdc_phy_reset,
+
+        .phy_reset              = pdc_sata_phy_reset,
+
         .qc_prep                = pdc_qc_prep,
         .qc_issue               = pdc_qc_issue_prot,
         .eng_timeout            = pdc_eng_timeout,
         .irq_handler            = pdc_interrupt,
         .irq_clear              = pdc_irq_clear,
+
         .scr_read               = pdc_sata_scr_read,
         .scr_write              = pdc_sata_scr_write,
         .port_start             = pdc_port_start,
@@ -126,6 +135,27 @@ static struct ata_port_operations pdc_ata_ops = {
         .host_stop              = ata_host_stop,
 };
 
+static struct ata_port_operations pdc_pata_ops = {
+        .port_disable           = ata_port_disable,
+        .tf_load                = pdc_tf_load_mmio,
+        .tf_read                = ata_tf_read,
+        .check_status           = ata_check_status,
+        .exec_command           = pdc_exec_command_mmio,
+        .dev_select             = ata_std_dev_select,
+
+        .phy_reset              = pdc_pata_phy_reset,
+
+        .qc_prep                = pdc_qc_prep,
+        .qc_issue               = pdc_qc_issue_prot,
+        .eng_timeout            = pdc_eng_timeout,
+        .irq_handler            = pdc_interrupt,
+        .irq_clear              = pdc_irq_clear,
+
+        .port_start             = pdc_port_start,
+        .port_stop              = pdc_port_stop,
+        .host_stop              = ata_host_stop,
+};
+
 static struct ata_port_info pdc_port_info[] = {
         /* board_2037x */
         {
@@ -135,7 +165,7 @@ static struct ata_port_info pdc_port_info[] = {
                 .pio_mask       = 0x1f, /* pio0-4 */
                 .mwdma_mask     = 0x07, /* mwdma0-2 */
                 .udma_mask      = 0x7f, /* udma0-6 ; FIXME */
-                .port_ops       = &pdc_ata_ops,
+                .port_ops       = &pdc_sata_ops,
         },
 
         /* board_20319 */
@@ -146,7 +176,7 @@ static struct ata_port_info pdc_port_info[] = {
                 .pio_mask       = 0x1f, /* pio0-4 */
                 .mwdma_mask     = 0x07, /* mwdma0-2 */
                 .udma_mask      = 0x7f, /* udma0-6 ; FIXME */
-                .port_ops       = &pdc_ata_ops,
+                .port_ops       = &pdc_sata_ops,
         },
 
         /* board_20619 */
@@ -157,7 +187,7 @@ static struct ata_port_info pdc_port_info[] = {
                 .pio_mask       = 0x1f, /* pio0-4 */
                 .mwdma_mask     = 0x07, /* mwdma0-2 */
                 .udma_mask      = 0x7f, /* udma0-6 ; FIXME */
-                .port_ops       = &pdc_ata_ops,
+                .port_ops       = &pdc_pata_ops,
         },
 };
 
@@ -181,6 +211,10 @@ static struct pci_device_id pdc_ata_pci_tbl[] = {
           board_20319 },
         { PCI_VENDOR_ID_PROMISE, 0x3319, PCI_ANY_ID, PCI_ANY_ID, 0, 0,
           board_20319 },
+        { PCI_VENDOR_ID_PROMISE, 0x3519, PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+          board_20319 },
+        { PCI_VENDOR_ID_PROMISE, 0x3d17, PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+          board_20319 },
         { PCI_VENDOR_ID_PROMISE, 0x3d18, PCI_ANY_ID, PCI_ANY_ID, 0, 0,
           board_20319 },
 
@@ -268,12 +302,23 @@ static void pdc_reset_port(struct ata_port *ap)
         readl(mmio);    /* flush */
 }
 
-static void pdc_phy_reset(struct ata_port *ap)
+static void pdc_sata_phy_reset(struct ata_port *ap)
 {
         pdc_reset_port(ap);
         sata_phy_reset(ap);
 }
 
+static void pdc_pata_phy_reset(struct ata_port *ap)
+{
+        /* FIXME: add cable detect.  Don't assume 40-pin cable */
+        ap->cbl = ATA_CBL_PATA40;
+        ap->udma_mask &= ATA_UDMA_MASK_40C;
+
+        pdc_reset_port(ap);
+        ata_port_probe(ap);
+        ata_bus_reset(ap);
+}
+
 static u32 pdc_sata_scr_read (struct ata_port *ap, unsigned int sc_reg)
 {
         if (sc_reg > SCR_CONTROL)
@@ -321,11 +366,15 @@ static void pdc_qc_prep(struct ata_queued_cmd *qc)
 
 static void pdc_eng_timeout(struct ata_port *ap)
 {
+        struct ata_host_set *host_set = ap->host_set;
         u8 drv_stat;
         struct ata_queued_cmd *qc;
+        unsigned long flags;
 
         DPRINTK("ENTER\n");
 
+        spin_lock_irqsave(&host_set->lock, flags);
+
         qc = ata_qc_from_tag(ap, ap->active_tag);
         if (!qc) {
                 printk(KERN_ERR "ata%u: BUG: timeout without command\n",
@@ -359,6 +408,7 @@ static void pdc_eng_timeout(struct ata_port *ap)
         }
 
 out:
+        spin_unlock_irqrestore(&host_set->lock, flags);
         DPRINTK("EXIT\n");
 }
 
@@ -441,7 +491,8 @@ static irqreturn_t pdc_interrupt (int irq, void *dev_instance, struct pt_regs *r
                 VPRINTK("port %u\n", i);
                 ap = host_set->ports[i];
                 tmp = mask & (1 << (i + 1));
-                if (tmp && ap && (!(ap->flags & ATA_FLAG_PORT_DISABLED))) {
+                if (tmp && ap &&
+                    !(ap->flags & (ATA_FLAG_PORT_DISABLED | ATA_FLAG_NOINTR))) {
                         struct ata_queued_cmd *qc;
 
                         qc = ata_qc_from_tag(ap, ap->active_tag);
diff --git a/drivers/scsi/sata_promise.h b/drivers/scsi/sata_promise.h
index 6e7e96b9ee13..6ee5e190262d 100644
--- a/drivers/scsi/sata_promise.h
+++ b/drivers/scsi/sata_promise.h
@@ -3,21 +3,24 @@
  *
  *  Copyright 2003-2004 Red Hat, Inc.
  *
- *  The contents of this file are subject to the Open
- *  Software License version 1.1 that can be found at
- *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
- *  by reference.
  *
- *  Alternatively, the contents of this file may be used under the terms
- *  of the GNU General Public License version 2 (the "GPL") as distributed
- *  in the kernel source COPYING file, in which case the provisions of
- *  the GPL are applicable instead of the above.  If you wish to allow
- *  the use of your version of this file only under the terms of the
- *  GPL and not to allow others to use your version of this file under
- *  the OSL, indicate your decision by deleting the provisions above and
- *  replace them with the notice and other provisions required by the GPL.
- *  If you do not delete the provisions above, a recipient may use your
- *  version of this file under either the OSL or the GPL.
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2, or (at your option)
+ *  any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; see the file COPYING.  If not, write to
+ *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *
+ *  libata documentation is available via 'make {ps|pdf}docs',
+ *  as Documentation/DocBook/libata.*
  *
  */
 
diff --git a/drivers/scsi/sata_qstor.c b/drivers/scsi/sata_qstor.c
index 1383e8a28d72..9c99ab433bd3 100644
--- a/drivers/scsi/sata_qstor.c
+++ b/drivers/scsi/sata_qstor.c
@@ -6,21 +6,24 @@
  *  Copyright 2005 Pacific Digital Corporation.
  *  (OSL/GPL code release authorized by Jalil Fadavi).
  *
- *  The contents of this file are subject to the Open
- *  Software License version 1.1 that can be found at
- *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
- *  by reference.
  *
- *  Alternatively, the contents of this file may be used under the terms
- *  of the GNU General Public License version 2 (the "GPL") as distributed
- *  in the kernel source COPYING file, in which case the provisions of
- *  the GPL are applicable instead of the above.  If you wish to allow
- *  the use of your version of this file only under the terms of the
- *  GPL and not to allow others to use your version of this file under
- *  the OSL, indicate your decision by deleting the provisions above and
- *  replace them with the notice and other provisions required by the GPL.
- *  If you do not delete the provisions above, a recipient may use your
- *  version of this file under either the OSL or the GPL.
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2, or (at your option)
+ *  any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; see the file COPYING.  If not, write to
+ *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *
+ *  libata documentation is available via 'make {ps|pdf}docs',
+ *  as Documentation/DocBook/libata.*
  *
  */
 
@@ -117,7 +120,7 @@ static void qs_phy_reset(struct ata_port *ap);
 static void qs_qc_prep(struct ata_queued_cmd *qc);
 static int qs_qc_issue(struct ata_queued_cmd *qc);
 static int qs_check_atapi_dma(struct ata_queued_cmd *qc);
-static void qs_bmdma_stop(struct ata_port *ap);
+static void qs_bmdma_stop(struct ata_queued_cmd *qc);
 static u8 qs_bmdma_status(struct ata_port *ap);
 static void qs_irq_clear(struct ata_port *ap);
 static void qs_eng_timeout(struct ata_port *ap);
@@ -198,7 +201,7 @@ static int qs_check_atapi_dma(struct ata_queued_cmd *qc)
         return 1;       /* ATAPI DMA not supported */
 }
 
-static void qs_bmdma_stop(struct ata_port *ap)
+static void qs_bmdma_stop(struct ata_queued_cmd *qc)
 {
         /* nothing */
 }
@@ -386,7 +389,8 @@ static inline unsigned int qs_intr_pkt(struct ata_host_set *host_set)
                         DPRINTK("SFF=%08x%08x: sCHAN=%u sHST=%d sDST=%02x\n",
                                         sff1, sff0, port_no, sHST, sDST);
                         handled = 1;
-                        if (ap && (!(ap->flags & ATA_FLAG_PORT_DISABLED))) {
+                        if (ap && !(ap->flags &
+                                    (ATA_FLAG_PORT_DISABLED|ATA_FLAG_NOINTR))) {
                                 struct ata_queued_cmd *qc;
                                 struct qs_port_priv *pp = ap->private_data;
                                 if (!pp || pp->state != qs_state_pkt)
@@ -417,7 +421,8 @@ static inline unsigned int qs_intr_mmio(struct ata_host_set *host_set)
         for (port_no = 0; port_no < host_set->n_ports; ++port_no) {
                 struct ata_port *ap;
                 ap = host_set->ports[port_no];
-                if (ap && (!(ap->flags & ATA_FLAG_PORT_DISABLED))) {
+                if (ap &&
+                    !(ap->flags & (ATA_FLAG_PORT_DISABLED | ATA_FLAG_NOINTR))) {
                         struct ata_queued_cmd *qc;
                         struct qs_port_priv *pp = ap->private_data;
                         if (!pp || pp->state != qs_state_mmio)
@@ -431,7 +436,7 @@ static inline unsigned int qs_intr_mmio(struct ata_host_set *host_set)
                                         continue;
                                 DPRINTK("ata%u: protocol %d (dev_stat 0x%X)\n",
                                         ap->id, qc->tf.protocol, status);
-                
+
                                 /* complete taskfile transaction */
                                 pp->state = qs_state_idle;
                                 ata_qc_complete(qc, status);
diff --git a/drivers/scsi/sata_sil.c b/drivers/scsi/sata_sil.c
index 49ed557a4b66..71d49548f0a3 100644
--- a/drivers/scsi/sata_sil.c
+++ b/drivers/scsi/sata_sil.c
@@ -5,24 +5,32 @@
  *                  Please ALWAYS copy linux-ide@vger.kernel.org
  *                  on emails.
  *
- *  Copyright 2003 Red Hat, Inc.
+ *  Copyright 2003-2005 Red Hat, Inc.
  *  Copyright 2003 Benjamin Herrenschmidt
  *
- *  The contents of this file are subject to the Open
- *  Software License version 1.1 that can be found at
- *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
- *  by reference.
  *
- *  Alternatively, the contents of this file may be used under the terms
- *  of the GNU General Public License version 2 (the "GPL") as distributed
- *  in the kernel source COPYING file, in which case the provisions of
- *  the GPL are applicable instead of the above.  If you wish to allow
- *  the use of your version of this file only under the terms of the
- *  GPL and not to allow others to use your version of this file under
- *  the OSL, indicate your decision by deleting the provisions above and
- *  replace them with the notice and other provisions required by the GPL.
- *  If you do not delete the provisions above, a recipient may use your
- *  version of this file under either the OSL or the GPL.
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2, or (at your option)
+ *  any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; see the file COPYING.  If not, write to
+ *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *
+ *  libata documentation is available via 'make {ps|pdf}docs',
+ *  as Documentation/DocBook/libata.*
+ *
+ *  Documentation for SiI 3112:
+ *  http://gkernel.sourceforge.net/specs/sii/3112A_SiI-DS-0095-B2.pdf.bz2
+ *
+ *  Other errata and documentation available under NDA.
  *
  */
 
@@ -41,8 +49,11 @@
 #define DRV_VERSION     "0.9"
 
 enum {
+        SIL_FLAG_MOD15WRITE     = (1 << 30),
+
         sil_3112                = 0,
-        sil_3114                = 1,
+        sil_3112_m15w           = 1,
+        sil_3114                = 2,
 
         SIL_FIFO_R0             = 0x40,
         SIL_FIFO_W0             = 0x41,
@@ -76,13 +87,13 @@ static void sil_scr_write (struct ata_port *ap, unsigned int sc_reg, u32 val);
 static void sil_post_set_mode (struct ata_port *ap);
 
 static struct pci_device_id sil_pci_tbl[] = {
-        { 0x1095, 0x3112, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112 },
-        { 0x1095, 0x0240, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112 },
+        { 0x1095, 0x3112, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112_m15w },
+        { 0x1095, 0x0240, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112_m15w },
         { 0x1095, 0x3512, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112 },
         { 0x1095, 0x3114, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3114 },
-        { 0x1002, 0x436e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112 },
-        { 0x1002, 0x4379, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112 },
-        { 0x1002, 0x437a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112 },
+        { 0x1002, 0x436e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112_m15w },
+        { 0x1002, 0x4379, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112_m15w },
+        { 0x1002, 0x437a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112_m15w },
         { }     /* terminate list */
 };
 
@@ -174,6 +185,16 @@ static struct ata_port_info sil_port_info[] = {
                 .mwdma_mask     = 0x07,                 /* mwdma0-2 */
                 .udma_mask      = 0x3f,                 /* udma0-5 */
                 .port_ops       = &sil_ops,
+        }, /* sil_3112_15w - keep it sync'd w/ sil_3112 */
+        {
+                .sht            = &sil_sht,
+                .host_flags     = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
+                                  ATA_FLAG_SRST | ATA_FLAG_MMIO |
+                                  SIL_FLAG_MOD15WRITE,
+                .pio_mask       = 0x1f,                 /* pio0-4 */
+                .mwdma_mask     = 0x07,                 /* mwdma0-2 */
+                .udma_mask      = 0x3f,                 /* udma0-5 */
+                .port_ops       = &sil_ops,
         }, /* sil_3114 */
         {
                 .sht            = &sil_sht,
@@ -323,15 +344,15 @@ static void sil_dev_config(struct ata_port *ap, struct ata_device *dev)
         while ((len > 0) && (s[len - 1] == ' '))
                 len--;
 
-        for (n = 0; sil_blacklist[n].product; n++) 
+        for (n = 0; sil_blacklist[n].product; n++)
                 if (!memcmp(sil_blacklist[n].product, s,
                             strlen(sil_blacklist[n].product))) {
                         quirks = sil_blacklist[n].quirk;
                         break;
                 }
-        
+
         /* limit requests to 15 sectors */
-        if (quirks & SIL_QUIRK_MOD15WRITE) {
+        if ((ap->flags & SIL_FLAG_MOD15WRITE) && (quirks & SIL_QUIRK_MOD15WRITE)) {
                 printk(KERN_INFO "ata%u(%u): applying Seagate errata fix\n",
                        ap->id, dev->devno);
                 ap->host->max_sectors = 15;
diff --git a/drivers/scsi/sata_sis.c b/drivers/scsi/sata_sis.c
index e418b89c6b9d..43af445b3ad2 100644
--- a/drivers/scsi/sata_sis.c
+++ b/drivers/scsi/sata_sis.c
@@ -7,21 +7,26 @@
  *
  *  Copyright 2004 Uwe Koziolek
  *
- *  The contents of this file are subject to the Open
- *  Software License version 1.1 that can be found at
- *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
- *  by reference.
  *
- *  Alternatively, the contents of this file may be used under the terms
- *  of the GNU General Public License version 2 (the "GPL") as distributed
- *  in the kernel source COPYING file, in which case the provisions of
- *  the GPL are applicable instead of the above.  If you wish to allow
- *  the use of your version of this file only under the terms of the
- *  GPL and not to allow others to use your version of this file under
- *  the OSL, indicate your decision by deleting the provisions above and
- *  replace them with the notice and other provisions required by the GPL.
- *  If you do not delete the provisions above, a recipient may use your
- *  version of this file under either the OSL or the GPL.
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2, or (at your option)
+ *  any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; see the file COPYING.  If not, write to
+ *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *
+ *  libata documentation is available via 'make {ps|pdf}docs',
+ *  as Documentation/DocBook/libata.*
+ *
+ *  Hardware documentation available under NDA.
  *
  */
 
@@ -234,7 +239,7 @@ static int sis_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         pci_read_config_dword(pdev, SIS_GENCTL, &genctl);
         if ((genctl & GENCTL_IOMAPPED_SCR) == 0)
                 probe_ent->host_flags |= SIS_FLAG_CFGSCR;
-        
+
         /* if hardware thinks SCRs are in IO space, but there are
          * no IO resources assigned, change to PCI cfg space.
          */
diff --git a/drivers/scsi/sata_svw.c b/drivers/scsi/sata_svw.c
index 858e07185dbd..19d3bb3b0fb6 100644
--- a/drivers/scsi/sata_svw.c
+++ b/drivers/scsi/sata_svw.c
@@ -13,21 +13,26 @@
  *  This driver probably works with non-Apple versions of the
  *  Broadcom chipset...
  *
- *  The contents of this file are subject to the Open
- *  Software License version 1.1 that can be found at
- *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
- *  by reference.
  *
- *  Alternatively, the contents of this file may be used under the terms
- *  of the GNU General Public License version 2 (the "GPL") as distributed
- *  in the kernel source COPYING file, in which case the provisions of
- *  the GPL are applicable instead of the above.  If you wish to allow
- *  the use of your version of this file only under the terms of the
- *  GPL and not to allow others to use your version of this file under
- *  the OSL, indicate your decision by deleting the provisions above and
- *  replace them with the notice and other provisions required by the GPL.
- *  If you do not delete the provisions above, a recipient may use your
- *  version of this file under either the OSL or the GPL.
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2, or (at your option)
+ *  any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; see the file COPYING.  If not, write to
+ *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *
+ *  libata documentation is available via 'make {ps|pdf}docs',
+ *  as Documentation/DocBook/libata.*
+ *
+ *  Hardware documentation available under NDA.
  *
  */
 
@@ -195,18 +200,18 @@ static void k2_bmdma_start_mmio (struct ata_queued_cmd *qc)
         /* start host DMA transaction */
         dmactl = readb(mmio + ATA_DMA_CMD);
         writeb(dmactl | ATA_DMA_START, mmio + ATA_DMA_CMD);
-        /* There is a race condition in certain SATA controllers that can 
-           be seen when the r/w command is given to the controller before the 
+        /* There is a race condition in certain SATA controllers that can
+           be seen when the r/w command is given to the controller before the
            host DMA is started. On a Read command, the controller would initiate
            the command to the drive even before it sees the DMA start. When there
-           are very fast drives connected to the controller, or when the data request 
+           are very fast drives connected to the controller, or when the data request
            hits in the drive cache, there is the possibility that the drive returns a part
            or all of the requested data to the controller before the DMA start is issued.
            In this case, the controller would become confused as to what to do with the data.
            In the worst case when all the data is returned back to the controller, the
            controller could hang. In other cases it could return partial data returning
            in data corruption. This problem has been seen in PPC systems and can also appear
-           on an system with very fast disks, where the SATA controller is sitting behind a 
+           on an system with very fast disks, where the SATA controller is sitting behind a
            number of bridges, and hence there is significant latency between the r/w command
            and the start command. */
         /* issue r/w command if the access is to ATA*/
@@ -214,7 +219,7 @@ static void k2_bmdma_start_mmio (struct ata_queued_cmd *qc)
                 ap->ops->exec_command(ap, &qc->tf);
 }
 
-                                                                              
+
 static u8 k2_stat_check_status(struct ata_port *ap)
 {
         return readl((void *) ap->ioaddr.status_addr);
diff --git a/drivers/scsi/sata_sx4.c b/drivers/scsi/sata_sx4.c
index 140cea05de3f..c72fcc46f0fa 100644
--- a/drivers/scsi/sata_sx4.c
+++ b/drivers/scsi/sata_sx4.c
@@ -7,21 +7,26 @@
  *
  *  Copyright 2003-2004 Red Hat, Inc.
  *
- *  The contents of this file are subject to the Open
- *  Software License version 1.1 that can be found at
- *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
- *  by reference.
  *
- *  Alternatively, the contents of this file may be used under the terms
- *  of the GNU General Public License version 2 (the "GPL") as distributed
- *  in the kernel source COPYING file, in which case the provisions of
- *  the GPL are applicable instead of the above.  If you wish to allow
- *  the use of your version of this file only under the terms of the
- *  GPL and not to allow others to use your version of this file under
- *  the OSL, indicate your decision by deleting the provisions above and
- *  replace them with the notice and other provisions required by the GPL.
- *  If you do not delete the provisions above, a recipient may use your
- *  version of this file under either the OSL or the GPL.
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2, or (at your option)
+ *  any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; see the file COPYING.  If not, write to
+ *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *
+ *  libata documentation is available via 'make {ps|pdf}docs',
+ *  as Documentation/DocBook/libata.*
+ *
+ *  Hardware documentation available under NDA.
  *
  */
 
@@ -94,7 +99,7 @@ enum {
         PDC_DIMM1_CONTROL_OFFSET      = 0x84,
         PDC_SDRAM_CONTROL_OFFSET      = 0x88,
         PDC_I2C_WRITE                 = 0x00000000,
-        PDC_I2C_READ                  = 0x00000040,     
+        PDC_I2C_READ                  = 0x00000040,
         PDC_I2C_START                 = 0x00000080,
         PDC_I2C_MASK_INT              = 0x00000020,
         PDC_I2C_COMPLETE              = 0x00010000,
@@ -105,16 +110,16 @@ enum {
         PDC_DIMM_SPD_COLUMN_NUM       = 4,
         PDC_DIMM_SPD_MODULE_ROW       = 5,
         PDC_DIMM_SPD_TYPE             = 11,
-        PDC_DIMM_SPD_FRESH_RATE       = 12,         
-        PDC_DIMM_SPD_BANK_NUM         = 17,     
+        PDC_DIMM_SPD_FRESH_RATE       = 12,
+        PDC_DIMM_SPD_BANK_NUM         = 17,
         PDC_DIMM_SPD_CAS_LATENCY      = 18,
-        PDC_DIMM_SPD_ATTRIBUTE        = 21,    
+        PDC_DIMM_SPD_ATTRIBUTE        = 21,
         PDC_DIMM_SPD_ROW_PRE_CHARGE   = 27,
-        PDC_DIMM_SPD_ROW_ACTIVE_DELAY = 28,      
+        PDC_DIMM_SPD_ROW_ACTIVE_DELAY = 28,
         PDC_DIMM_SPD_RAS_CAS_DELAY    = 29,
         PDC_DIMM_SPD_ACTIVE_PRECHARGE = 30,
         PDC_DIMM_SPD_SYSTEM_FREQ      = 126,
-        PDC_CTL_STATUS                = 0x08,   
+        PDC_CTL_STATUS                = 0x08,
         PDC_DIMM_WINDOW_CTLR          = 0x0C,
         PDC_TIME_CONTROL              = 0x3C,
         PDC_TIME_PERIOD               = 0x40,
@@ -157,15 +162,15 @@ static void pdc_exec_command_mmio(struct ata_port *ap, struct ata_taskfile *tf);
 static void pdc20621_host_stop(struct ata_host_set *host_set);
 static unsigned int pdc20621_dimm_init(struct ata_probe_ent *pe);
 static int pdc20621_detect_dimm(struct ata_probe_ent *pe);
-static unsigned int pdc20621_i2c_read(struct ata_probe_ent *pe, 
+static unsigned int pdc20621_i2c_read(struct ata_probe_ent *pe,
                                       u32 device, u32 subaddr, u32 *pdata);
 static int pdc20621_prog_dimm0(struct ata_probe_ent *pe);
 static unsigned int pdc20621_prog_dimm_global(struct ata_probe_ent *pe);
 #ifdef ATA_VERBOSE_DEBUG
-static void pdc20621_get_from_dimm(struct ata_probe_ent *pe, 
+static void pdc20621_get_from_dimm(struct ata_probe_ent *pe,
                                    void *psource, u32 offset, u32 size);
 #endif
-static void pdc20621_put_to_dimm(struct ata_probe_ent *pe, 
+static void pdc20621_put_to_dimm(struct ata_probe_ent *pe,
                                  void *psource, u32 offset, u32 size);
 static void pdc20621_irq_clear(struct ata_port *ap);
 static int pdc20621_qc_issue_prot(struct ata_queued_cmd *qc);
@@ -468,7 +473,7 @@ static void pdc20621_dma_prep(struct ata_queued_cmd *qc)
         for (i = 0; i < last; i++) {
                 buf[idx++] = cpu_to_le32(sg_dma_address(&sg[i]));
                 buf[idx++] = cpu_to_le32(sg_dma_len(&sg[i]));
-                total_len += sg[i].length;
+                total_len += sg_dma_len(&sg[i]);
         }
         buf[idx - 1] |= cpu_to_le32(ATA_PRD_EOT);
         sgt_len = idx * 4;
@@ -825,7 +830,8 @@ static irqreturn_t pdc20621_interrupt (int irq, void *dev_instance, struct pt_re
                         ap = host_set->ports[port_no];
                 tmp = mask & (1 << i);
                 VPRINTK("seq %u, port_no %u, ap %p, tmp %x\n", i, port_no, ap, tmp);
-                if (tmp && ap && (!(ap->flags & ATA_FLAG_PORT_DISABLED))) {
+                if (tmp && ap &&
+                    !(ap->flags & (ATA_FLAG_PORT_DISABLED | ATA_FLAG_NOINTR))) {
                         struct ata_queued_cmd *qc;
 
                         qc = ata_qc_from_tag(ap, ap->active_tag);
@@ -847,10 +853,14 @@ static irqreturn_t pdc20621_interrupt (int irq, void *dev_instance, struct pt_re
 static void pdc_eng_timeout(struct ata_port *ap)
 {
         u8 drv_stat;
+        struct ata_host_set *host_set = ap->host_set;
         struct ata_queued_cmd *qc;
+        unsigned long flags;
 
         DPRINTK("ENTER\n");
 
+        spin_lock_irqsave(&host_set->lock, flags);
+
         qc = ata_qc_from_tag(ap, ap->active_tag);
         if (!qc) {
                 printk(KERN_ERR "ata%u: BUG: timeout without command\n",
@@ -884,6 +894,7 @@ static void pdc_eng_timeout(struct ata_port *ap)
         }
 
 out:
+        spin_unlock_irqrestore(&host_set->lock, flags);
         DPRINTK("EXIT\n");
 }
 
@@ -922,7 +933,7 @@ static void pdc_sata_setup_port(struct ata_ioports *port, unsigned long base)
 
 
 #ifdef ATA_VERBOSE_DEBUG
-static void pdc20621_get_from_dimm(struct ata_probe_ent *pe, void *psource, 
+static void pdc20621_get_from_dimm(struct ata_probe_ent *pe, void *psource,
                                    u32 offset, u32 size)
 {
         u32 window_size;
@@ -936,9 +947,9 @@ static void pdc20621_get_from_dimm(struct ata_probe_ent *pe, void *psource,
         /* hard-code chip #0 */
         mmio += PDC_CHIP0_OFS;
 
-        page_mask = 0x00;       
-        window_size = 0x2000 * 4; /* 32K byte uchar size */  
-        idx = (u16) (offset / window_size); 
+        page_mask = 0x00;
+        window_size = 0x2000 * 4; /* 32K byte uchar size */
+        idx = (u16) (offset / window_size);
 
         writel(0x01, mmio + PDC_GENERAL_CTLR);
         readl(mmio + PDC_GENERAL_CTLR);
@@ -947,19 +958,19 @@ static void pdc20621_get_from_dimm(struct ata_probe_ent *pe, void *psource,
 
         offset -= (idx * window_size);
         idx++;
-        dist = ((long) (window_size - (offset + size))) >= 0 ? size : 
+        dist = ((long) (window_size - (offset + size))) >= 0 ? size :
                 (long) (window_size - offset);
-        memcpy_fromio((char *) psource, (char *) (dimm_mmio + offset / 4), 
+        memcpy_fromio((char *) psource, (char *) (dimm_mmio + offset / 4),
                       dist);
 
-        psource += dist;    
+        psource += dist;
         size -= dist;
         for (; (long) size >= (long) window_size ;) {
                 writel(0x01, mmio + PDC_GENERAL_CTLR);
                 readl(mmio + PDC_GENERAL_CTLR);
                 writel(((idx) << page_mask), mmio + PDC_DIMM_WINDOW_CTLR);
                 readl(mmio + PDC_DIMM_WINDOW_CTLR);
-                memcpy_fromio((char *) psource, (char *) (dimm_mmio), 
+                memcpy_fromio((char *) psource, (char *) (dimm_mmio),
                               window_size / 4);
                 psource += window_size;
                 size -= window_size;
@@ -971,14 +982,14 @@ static void pdc20621_get_from_dimm(struct ata_probe_ent *pe, void *psource,
                 readl(mmio + PDC_GENERAL_CTLR);
                 writel(((idx) << page_mask), mmio + PDC_DIMM_WINDOW_CTLR);
                 readl(mmio + PDC_DIMM_WINDOW_CTLR);
-                memcpy_fromio((char *) psource, (char *) (dimm_mmio), 
+                memcpy_fromio((char *) psource, (char *) (dimm_mmio),
                               size / 4);
         }
 }
 #endif
 
 
-static void pdc20621_put_to_dimm(struct ata_probe_ent *pe, void *psource, 
+static void pdc20621_put_to_dimm(struct ata_probe_ent *pe, void *psource,
                                  u32 offset, u32 size)
 {
         u32 window_size;
@@ -989,16 +1000,16 @@ static void pdc20621_put_to_dimm(struct ata_probe_ent *pe, void *psource,
         struct pdc_host_priv *hpriv = pe->private_data;
         void *dimm_mmio = hpriv->dimm_mmio;
 
-        /* hard-code chip #0 */   
+        /* hard-code chip #0 */
         mmio += PDC_CHIP0_OFS;
 
-        page_mask = 0x00;       
-        window_size = 0x2000 * 4;       /* 32K byte uchar size */  
+        page_mask = 0x00;
+        window_size = 0x2000 * 4;       /* 32K byte uchar size */
         idx = (u16) (offset / window_size);
 
         writel(((idx) << page_mask), mmio + PDC_DIMM_WINDOW_CTLR);
         readl(mmio + PDC_DIMM_WINDOW_CTLR);
-        offset -= (idx * window_size); 
+        offset -= (idx * window_size);
         idx++;
         dist = ((long)(s32)(window_size - (offset + size))) >= 0 ? size :
                 (long) (window_size - offset);
@@ -1006,12 +1017,12 @@ static void pdc20621_put_to_dimm(struct ata_probe_ent *pe, void *psource,
         writel(0x01, mmio + PDC_GENERAL_CTLR);
         readl(mmio + PDC_GENERAL_CTLR);
 
-        psource += dist;    
+        psource += dist;
         size -= dist;
         for (; (long) size >= (long) window_size ;) {
                 writel(((idx) << page_mask), mmio + PDC_DIMM_WINDOW_CTLR);
                 readl(mmio + PDC_DIMM_WINDOW_CTLR);
-                memcpy_toio((char *) (dimm_mmio), (char *) psource, 
+                memcpy_toio((char *) (dimm_mmio), (char *) psource,
                             window_size / 4);
                 writel(0x01, mmio + PDC_GENERAL_CTLR);
                 readl(mmio + PDC_GENERAL_CTLR);
@@ -1019,7 +1030,7 @@ static void pdc20621_put_to_dimm(struct ata_probe_ent *pe, void *psource,
                 size -= window_size;
                 idx ++;
         }
-    
+
         if (size) {
                 writel(((idx) << page_mask), mmio + PDC_DIMM_WINDOW_CTLR);
                 readl(mmio + PDC_DIMM_WINDOW_CTLR);
@@ -1030,12 +1041,12 @@ static void pdc20621_put_to_dimm(struct ata_probe_ent *pe, void *psource,
 }
 
 
-static unsigned int pdc20621_i2c_read(struct ata_probe_ent *pe, u32 device, 
+static unsigned int pdc20621_i2c_read(struct ata_probe_ent *pe, u32 device,
                                       u32 subaddr, u32 *pdata)
 {
         void *mmio = pe->mmio_base;
         u32 i2creg  = 0;
-        u32 status;     
+        u32 status;
         u32 count =0;
 
         /* hard-code chip #0 */
@@ -1049,7 +1060,7 @@ static unsigned int pdc20621_i2c_read(struct ata_probe_ent *pe, u32 device,
         readl(mmio + PDC_I2C_ADDR_DATA_OFFSET);
 
         /* Write Control to perform read operation, mask int */
-        writel(PDC_I2C_READ | PDC_I2C_START | PDC_I2C_MASK_INT, 
+        writel(PDC_I2C_READ | PDC_I2C_START | PDC_I2C_MASK_INT,
                mmio + PDC_I2C_CONTROL_OFFSET);
 
         for (count = 0; count <= 1000; count ++) {
@@ -1062,26 +1073,26 @@ static unsigned int pdc20621_i2c_read(struct ata_probe_ent *pe, u32 device,
         }
 
         *pdata = (status >> 8) & 0x000000ff;
-        return 1;           
+        return 1;
 }
 
 
 static int pdc20621_detect_dimm(struct ata_probe_ent *pe)
 {
         u32 data=0 ;
-        if (pdc20621_i2c_read(pe, PDC_DIMM0_SPD_DEV_ADDRESS, 
+        if (pdc20621_i2c_read(pe, PDC_DIMM0_SPD_DEV_ADDRESS,
                              PDC_DIMM_SPD_SYSTEM_FREQ, &data)) {
                 if (data == 100)
                         return 100;
         } else
                 return 0;
-        
+
         if (pdc20621_i2c_read(pe, PDC_DIMM0_SPD_DEV_ADDRESS, 9, &data)) {
-                if(data <= 0x75) 
+                if(data <= 0x75)
                         return 133;
         } else
                 return 0;
-        
+
         return 0;
 }
 
@@ -1091,15 +1102,15 @@ static int pdc20621_prog_dimm0(struct ata_probe_ent *pe)
         u32 spd0[50];
         u32 data = 0;
         int size, i;
-        u8 bdimmsize; 
+        u8 bdimmsize;
         void *mmio = pe->mmio_base;
         static const struct {
                 unsigned int reg;
                 unsigned int ofs;
         } pdc_i2c_read_data [] = {
-                { PDC_DIMM_SPD_TYPE, 11 },              
+                { PDC_DIMM_SPD_TYPE, 11 },
                 { PDC_DIMM_SPD_FRESH_RATE, 12 },
-                { PDC_DIMM_SPD_COLUMN_NUM, 4 }, 
+                { PDC_DIMM_SPD_COLUMN_NUM, 4 },
                 { PDC_DIMM_SPD_ATTRIBUTE, 21 },
                 { PDC_DIMM_SPD_ROW_NUM, 3 },
                 { PDC_DIMM_SPD_BANK_NUM, 17 },
@@ -1108,7 +1119,7 @@ static int pdc20621_prog_dimm0(struct ata_probe_ent *pe)
                 { PDC_DIMM_SPD_ROW_ACTIVE_DELAY, 28 },
                 { PDC_DIMM_SPD_RAS_CAS_DELAY, 29 },
                 { PDC_DIMM_SPD_ACTIVE_PRECHARGE, 30 },
-                { PDC_DIMM_SPD_CAS_LATENCY, 18 },       
+                { PDC_DIMM_SPD_CAS_LATENCY, 18 },
         };
 
         /* hard-code chip #0 */
@@ -1116,17 +1127,17 @@ static int pdc20621_prog_dimm0(struct ata_probe_ent *pe)
 
         for(i=0; i<ARRAY_SIZE(pdc_i2c_read_data); i++)
                 pdc20621_i2c_read(pe, PDC_DIMM0_SPD_DEV_ADDRESS,
-                                  pdc_i2c_read_data[i].reg, 
+                                  pdc_i2c_read_data[i].reg,
                                   &spd0[pdc_i2c_read_data[i].ofs]);
-  
+
         data |= (spd0[4] - 8) | ((spd0[21] != 0) << 3) | ((spd0[3]-11) << 4);
-        data |= ((spd0[17] / 4) << 6) | ((spd0[5] / 2) << 7) | 
+        data |= ((spd0[17] / 4) << 6) | ((spd0[5] / 2) << 7) |
                 ((((spd0[27] + 9) / 10) - 1) << 8) ;
-        data |= (((((spd0[29] > spd0[28]) 
-                    ? spd0[29] : spd0[28]) + 9) / 10) - 1) << 10; 
+        data |= (((((spd0[29] > spd0[28])
+                    ? spd0[29] : spd0[28]) + 9) / 10) - 1) << 10;
         data |= ((spd0[30] - spd0[29] + 9) / 10 - 2) << 12;
-   
-        if (spd0[18] & 0x08) 
+
+        if (spd0[18] & 0x08)
                 data |= ((0x03) << 14);
         else if (spd0[18] & 0x04)
                 data |= ((0x02) << 14);
@@ -1135,7 +1146,7 @@ static int pdc20621_prog_dimm0(struct ata_probe_ent *pe)
         else
                 data |= (0 << 14);
 
-        /* 
+        /*
            Calculate the size of bDIMMSize (power of 2) and
            merge the DIMM size by program start/end address.
         */
@@ -1145,9 +1156,9 @@ static int pdc20621_prog_dimm0(struct ata_probe_ent *pe)
         data |= (((size / 16) - 1) << 16);
         data |= (0 << 23);
         data |= 8;
-        writel(data, mmio + PDC_DIMM0_CONTROL_OFFSET); 
+        writel(data, mmio + PDC_DIMM0_CONTROL_OFFSET);
         readl(mmio + PDC_DIMM0_CONTROL_OFFSET);
-        return size;                          
+        return size;
 }
 
 
@@ -1167,12 +1178,12 @@ static unsigned int pdc20621_prog_dimm_global(struct ata_probe_ent *pe)
           Refresh Enable (bit 17)
         */
 
-        data = 0x022259F1;   
+        data = 0x022259F1;
         writel(data, mmio + PDC_SDRAM_CONTROL_OFFSET);
         readl(mmio + PDC_SDRAM_CONTROL_OFFSET);
 
         /* Turn on for ECC */
-        pdc20621_i2c_read(pe, PDC_DIMM0_SPD_DEV_ADDRESS, 
+        pdc20621_i2c_read(pe, PDC_DIMM0_SPD_DEV_ADDRESS,
                           PDC_DIMM_SPD_TYPE, &spd0);
         if (spd0 == 0x02) {
                 data |= (0x01 << 16);
@@ -1186,22 +1197,22 @@ static unsigned int pdc20621_prog_dimm_global(struct ata_probe_ent *pe)
         data |= (1<<19);
         writel(data, mmio + PDC_SDRAM_CONTROL_OFFSET);
 
-        error = 1;                     
+        error = 1;
         for (i = 1; i <= 10; i++) {   /* polling ~5 secs */
                 data = readl(mmio + PDC_SDRAM_CONTROL_OFFSET);
                 if (!(data & (1<<19))) {
                         error = 0;
-                        break;     
+                        break;
                 }
                 msleep(i*100);
         }
         return error;
 }
-        
+
 
 static unsigned int pdc20621_dimm_init(struct ata_probe_ent *pe)
 {
-        int speed, size, length; 
+        int speed, size, length;
         u32 addr,spd0,pci_status;
         u32 tmp=0;
         u32 time_period=0;
@@ -1228,7 +1239,7 @@ static unsigned int pdc20621_dimm_init(struct ata_probe_ent *pe)
         /* Wait 3 seconds */
         msleep(3000);
 
-        /* 
+        /*
            When timer is enabled, counter is decreased every internal
            clock cycle.
         */
@@ -1236,24 +1247,24 @@ static unsigned int pdc20621_dimm_init(struct ata_probe_ent *pe)
         tcount = readl(mmio + PDC_TIME_COUNTER);
         VPRINTK("Time Counter Register (0x44): 0x%x\n", tcount);
 
-        /* 
+        /*
            If SX4 is on PCI-X bus, after 3 seconds, the timer counter
            register should be >= (0xffffffff - 3x10^8).
         */
         if(tcount >= PCI_X_TCOUNT) {
                 ticks = (time_period - tcount);
                 VPRINTK("Num counters 0x%x (%d)\n", ticks, ticks);
-        
+
                 clock = (ticks / 300000);
                 VPRINTK("10 * Internal clk = 0x%x (%d)\n", clock, clock);
-                
+
                 clock = (clock * 33);
                 VPRINTK("10 * Internal clk * 33 = 0x%x (%d)\n", clock, clock);
 
                 /* PLL F Param (bit 22:16) */
                 fparam = (1400000 / clock) - 2;
                 VPRINTK("PLL F Param: 0x%x (%d)\n", fparam, fparam);
-                
+
                 /* OD param = 0x2 (bit 31:30), R param = 0x5 (bit 29:25) */
                 pci_status = (0x8a001824 | (fparam << 16));
         } else
@@ -1264,21 +1275,21 @@ static unsigned int pdc20621_dimm_init(struct ata_probe_ent *pe)
         writel(pci_status, mmio + PDC_CTL_STATUS);
         readl(mmio + PDC_CTL_STATUS);
 
-        /* 
+        /*
            Read SPD of DIMM by I2C interface,
            and program the DIMM Module Controller.
         */
         if (!(speed = pdc20621_detect_dimm(pe))) {
-                printk(KERN_ERR "Detect Local DIMM Fail\n");  
+                printk(KERN_ERR "Detect Local DIMM Fail\n");
                 return 1;       /* DIMM error */
         }
         VPRINTK("Local DIMM Speed = %d\n", speed);
 
-        /* Programming DIMM0 Module Control Register (index_CID0:80h) */ 
+        /* Programming DIMM0 Module Control Register (index_CID0:80h) */
         size = pdc20621_prog_dimm0(pe);
         VPRINTK("Local DIMM Size = %dMB\n",size);
 
-        /* Programming DIMM Module Global Control Register (index_CID0:88h) */ 
+        /* Programming DIMM Module Global Control Register (index_CID0:88h) */
         if (pdc20621_prog_dimm_global(pe)) {
                 printk(KERN_ERR "Programming DIMM Module Global Control Register Fail\n");
                 return 1;
@@ -1297,30 +1308,30 @@ static unsigned int pdc20621_dimm_init(struct ata_probe_ent *pe)
 
                 pdc20621_put_to_dimm(pe, (void *) test_parttern1, 0x10040, 40);
                 pdc20621_get_from_dimm(pe, (void *) test_parttern2, 0x40, 40);
-                printk(KERN_ERR "%x, %x, %s\n", test_parttern2[0], 
+                printk(KERN_ERR "%x, %x, %s\n", test_parttern2[0],
                        test_parttern2[1], &(test_parttern2[2]));
-                pdc20621_get_from_dimm(pe, (void *) test_parttern2, 0x10040, 
+                pdc20621_get_from_dimm(pe, (void *) test_parttern2, 0x10040,
                                        40);
-                printk(KERN_ERR "%x, %x, %s\n", test_parttern2[0], 
+                printk(KERN_ERR "%x, %x, %s\n", test_parttern2[0],
                        test_parttern2[1], &(test_parttern2[2]));
 
                 pdc20621_put_to_dimm(pe, (void *) test_parttern1, 0x40, 40);
                 pdc20621_get_from_dimm(pe, (void *) test_parttern2, 0x40, 40);
-                printk(KERN_ERR "%x, %x, %s\n", test_parttern2[0], 
+                printk(KERN_ERR "%x, %x, %s\n", test_parttern2[0],
                        test_parttern2[1], &(test_parttern2[2]));
         }
 #endif
 
         /* ECC initiliazation. */
 
-        pdc20621_i2c_read(pe, PDC_DIMM0_SPD_DEV_ADDRESS, 
+        pdc20621_i2c_read(pe, PDC_DIMM0_SPD_DEV_ADDRESS,
                           PDC_DIMM_SPD_TYPE, &spd0);
         if (spd0 == 0x02) {
                 VPRINTK("Start ECC initialization\n");
                 addr = 0;
                 length = size * 1024 * 1024;
                 while (addr < length) {
-                        pdc20621_put_to_dimm(pe, (void *) &tmp, addr, 
+                        pdc20621_put_to_dimm(pe, (void *) &tmp, addr,
                                              sizeof(u32));
                         addr += sizeof(u32);
                 }
diff --git a/drivers/scsi/sata_uli.c b/drivers/scsi/sata_uli.c
index a71fb54eebd3..1566886815fb 100644
--- a/drivers/scsi/sata_uli.c
+++ b/drivers/scsi/sata_uli.c
@@ -1,21 +1,26 @@
 /*
  *  sata_uli.c - ULi Electronics SATA
  *
- *  The contents of this file are subject to the Open
- *  Software License version 1.1 that can be found at
- *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
- *  by reference.
  *
- *  Alternatively, the contents of this file may be used under the terms
- *  of the GNU General Public License version 2 (the "GPL") as distributed
- *  in the kernel source COPYING file, in which case the provisions of
- *  the GPL are applicable instead of the above.  If you wish to allow
- *  the use of your version of this file only under the terms of the
- *  GPL and not to allow others to use your version of this file under
- *  the OSL, indicate your decision by deleting the provisions above and
- *  replace them with the notice and other provisions required by the GPL.
- *  If you do not delete the provisions above, a recipient may use your
- *  version of this file under either the OSL or the GPL.
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2, or (at your option)
+ *  any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; see the file COPYING.  If not, write to
+ *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *
+ *  libata documentation is available via 'make {ps|pdf}docs',
+ *  as Documentation/DocBook/libata.*
+ *
+ *  Hardware documentation available under NDA.
  *
  */
 
@@ -214,7 +219,7 @@ static int uli_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
                 rc = -ENOMEM;
                 goto err_out_regions;
         }
-        
+
         switch (board_idx) {
         case uli_5287:
                 probe_ent->port[0].scr_addr = ULI5287_BASE;
diff --git a/drivers/scsi/sata_via.c b/drivers/scsi/sata_via.c
index f43183c19a12..128b996b07b7 100644
--- a/drivers/scsi/sata_via.c
+++ b/drivers/scsi/sata_via.c
@@ -1,34 +1,38 @@
 /*
-   sata_via.c - VIA Serial ATA controllers
-
-   Maintained by:  Jeff Garzik <jgarzik@pobox.com>
-                   Please ALWAYS copy linux-ide@vger.kernel.org
+ *  sata_via.c - VIA Serial ATA controllers
+ *
+ *  Maintained by:  Jeff Garzik <jgarzik@pobox.com>
+ *                 Please ALWAYS copy linux-ide@vger.kernel.org
                    on emails.
-
-   Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
-   Copyright 2003-2004 Jeff Garzik
-
-   The contents of this file are subject to the Open
-   Software License version 1.1 that can be found at
-   http://www.opensource.org/licenses/osl-1.1.txt and is included herein
-   by reference.
-
-   Alternatively, the contents of this file may be used under the terms
-   of the GNU General Public License version 2 (the "GPL") as distributed
-   in the kernel source COPYING file, in which case the provisions of
-   the GPL are applicable instead of the above.  If you wish to allow
-   the use of your version of this file only under the terms of the
-   GPL and not to allow others to use your version of this file under
-   the OSL, indicate your decision by deleting the provisions above and
-   replace them with the notice and other provisions required by the GPL.
-   If you do not delete the provisions above, a recipient may use your
-   version of this file under either the OSL or the GPL.
-
-   ----------------------------------------------------------------------
-
-   To-do list:
-   * VT6421 PATA support
-
+ *
+ *  Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
+ *  Copyright 2003-2004 Jeff Garzik
+ *
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2, or (at your option)
+ *  any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; see the file COPYING.  If not, write to
+ *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *
+ *  libata documentation is available via 'make {ps|pdf}docs',
+ *  as Documentation/DocBook/libata.*
+ *
+ *  Hardware documentation available under NDA.
+ *
+ *
+ *  To-do list:
+ *  - VT6421 PATA support
+ *
  */
 
 #include <linux/kernel.h>
@@ -347,7 +351,7 @@ static int svia_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
                 probe_ent = vt6420_init_probe_ent(pdev);
         else
                 probe_ent = vt6421_init_probe_ent(pdev);
-        
+
         if (!probe_ent) {
                 printk(KERN_ERR DRV_NAME "(%s): out of memory\n",
                        pci_name(pdev));
diff --git a/drivers/scsi/sata_vsc.c b/drivers/scsi/sata_vsc.c
index c5e09dc6f3de..3985f344da4d 100644
--- a/drivers/scsi/sata_vsc.c
+++ b/drivers/scsi/sata_vsc.c
@@ -9,9 +9,29 @@
  *
  *  Bits from Jeff Garzik, Copyright RedHat, Inc.
  *
- *  This file is subject to the terms and conditions of the GNU General Public
- *  License.  See the file "COPYING" in the main directory of this archive
- *  for more details.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2, or (at your option)
+ *  any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; see the file COPYING.  If not, write to
+ *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *
+ *  libata documentation is available via 'make {ps|pdf}docs',
+ *  as Documentation/DocBook/libata.*
+ *
+ *  Vitesse hardware documentation presumably available under NDA.
+ *  Intel 31244 (same hardware interface) documentation presumably
+ *  available from http://developer.intel.com/
+ *
  */
 
 #include <linux/kernel.h>
@@ -173,7 +193,8 @@ static irqreturn_t vsc_sata_interrupt (int irq, void *dev_instance,
                         struct ata_port *ap;
 
                         ap = host_set->ports[i];
-                        if (ap && (!(ap->flags & ATA_FLAG_PORT_DISABLED))) {
+                        if (ap && !(ap->flags &
+                                    (ATA_FLAG_PORT_DISABLED|ATA_FLAG_NOINTR))) {
                                 struct ata_queued_cmd *qc;
 
                                 qc = ata_qc_from_tag(ap, ap->active_tag);
@@ -342,7 +363,7 @@ static int __devinit vsc_sata_init_one (struct pci_dev *pdev, const struct pci_d
 
         pci_set_master(pdev);
 
-        /* 
+        /*
          * Config offset 0x98 is "Extended Control and Status Register 0"
          * Default value is (1 << 28).  All bits except bit 28 are reserved in
          * DPA mode.  If bit 28 is set, LED 0 reflects all ports' activity.
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 2d3c4ac475f2..48edd67982a5 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -336,9 +336,23 @@ static struct scsi_target *scsi_alloc_target(struct device *parent,
         unsigned long flags;
         const int size = sizeof(struct scsi_target)
                 + shost->transportt->target_size;
-        struct scsi_target *starget = kmalloc(size, GFP_ATOMIC);
+        struct scsi_target *starget;
         struct scsi_target *found_target;
 
+        /*
+         * Obtain the real parent from the transport. The transport
+         * is allowed to fail (no error) if there is nothing at that
+         * target id.
+         */
+        if (shost->transportt->target_parent) {
+                spin_lock_irqsave(shost->host_lock, flags);
+                parent = shost->transportt->target_parent(shost, channel, id);
+                spin_unlock_irqrestore(shost->host_lock, flags);
+                if (!parent)
+                        return NULL;
+        }
+
+        starget = kmalloc(size, GFP_KERNEL);
         if (!starget) {
                 printk(KERN_ERR "%s: allocation failure\n", __FUNCTION__);
                 return NULL;
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 35d1c1e8e345..e6412fce423c 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -1022,6 +1022,23 @@ static int fc_rport_match(struct attribute_container *cont,
         return &i->rport_attr_cont.ac == cont;
 }
 
+
+/*
+ * Must be called with shost->host_lock held
+ */
+static struct device *fc_target_parent(struct Scsi_Host *shost,
+                                        int channel, uint id)
+{
+        struct fc_rport *rport;
+
+        list_for_each_entry(rport, &fc_host_rports(shost), peers)
+                if ((rport->channel == channel) &&
+                    (rport->scsi_target_id == id))
+                        return &rport->dev;
+
+        return NULL;
+}
+
 struct scsi_transport_template *
 fc_attach_transport(struct fc_function_template *ft)
 {
@@ -1057,6 +1074,8 @@ fc_attach_transport(struct fc_function_template *ft)
 
         /* Transport uses the shost workq for scsi scanning */
         i->t.create_work_queue = 1;
+
+        i->t.target_parent = fc_target_parent;
         
         /*
          * Setup SCSI Target Attributes.
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 51292f269ce5..e822ca0e97cf 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -2971,23 +2971,22 @@ static void * dev_seq_start(struct seq_file *s, loff_t *pos)
 {
         struct sg_proc_deviter * it = kmalloc(sizeof(*it), GFP_KERNEL);
 
+        s->private = it;
         if (! it)
                 return NULL;
+
         if (NULL == sg_dev_arr)
-                goto err1;
+                return NULL;
         it->index = *pos;
         it->max = sg_last_dev();
         if (it->index >= it->max)
-                goto err1;
+                return NULL;
         return it;
-err1:
-        kfree(it);
-        return NULL;
 }
 
 static void * dev_seq_next(struct seq_file *s, void *v, loff_t *pos)
 {
-        struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
+        struct sg_proc_deviter * it = s->private;
 
         *pos = ++it->index;
         return (it->index < it->max) ? it : NULL;
@@ -2995,7 +2994,7 @@ static void * dev_seq_next(struct seq_file *s, void *v, loff_t *pos)
 
 static void dev_seq_stop(struct seq_file *s, void *v)
 {
-        kfree (v);
+        kfree(s->private);
 }
 
 static int sg_proc_open_dev(struct inode *inode, struct file *file)
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 0291a8fb654d..0a7839db5752 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4149,12 +4149,10 @@ static int __init init_st(void)
                         do_create_driverfs_files();
                         return 0;
                 }
-                if (st_sysfs_class)
-                        class_destroy(st_sysfs_class);
                 unregister_chrdev_region(MKDEV(SCSI_TAPE_MAJOR, 0),
-
                                          ST_MAX_TAPE_ENTRIES);
         }
+        class_destroy(st_sysfs_class);
 
         printk(KERN_ERR "Unable to get major %d for SCSI tapes\n", SCSI_TAPE_MAJOR);
         return 1;
@@ -4162,13 +4160,11 @@ static int __init init_st(void)
 
 static void __exit exit_st(void)
 {
-        if (st_sysfs_class)
-                class_destroy(st_sysfs_class);
-        st_sysfs_class = NULL;
         do_remove_driverfs_files();
         scsi_unregister_driver(&st_template.gendrv);
         unregister_chrdev_region(MKDEV(SCSI_TAPE_MAJOR, 0),
                                  ST_MAX_TAPE_ENTRIES);
+        class_destroy(st_sysfs_class);
         kfree(scsi_tapes);
         printk(KERN_INFO "st: Unloaded.\n");
 }
diff --git a/drivers/serial/21285.c b/drivers/serial/21285.c
index 0b10169961eb..aec39fb261ca 100644
--- a/drivers/serial/21285.c
+++ b/drivers/serial/21285.c
@@ -58,8 +58,7 @@ static const char serial21285_name[] = "Footbridge UART";
  *  int((BAUD_BASE - (baud >> 1)) / baud)
  */
 
-static void
-serial21285_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void serial21285_stop_tx(struct uart_port *port)
 {
         if (tx_enabled(port)) {
                 disable_irq(IRQ_CONTX);
@@ -67,8 +66,7 @@ serial21285_stop_tx(struct uart_port *port, unsigned int tty_stop)
         }
 }
 
-static void
-serial21285_start_tx(struct uart_port *port, unsigned int tty_start)
+static void serial21285_start_tx(struct uart_port *port)
 {
         if (!tx_enabled(port)) {
                 enable_irq(IRQ_CONTX);
@@ -148,7 +146,7 @@ static irqreturn_t serial21285_tx_chars(int irq, void *dev_id, struct pt_regs *r
                 goto out;
         }
         if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
-                serial21285_stop_tx(port, 0);
+                serial21285_stop_tx(port);
                 goto out;
         }
 
@@ -164,7 +162,7 @@ static irqreturn_t serial21285_tx_chars(int irq, void *dev_id, struct pt_regs *r
                 uart_write_wakeup(port);
 
         if (uart_circ_empty(xmit))
-                serial21285_stop_tx(port, 0);
+                serial21285_stop_tx(port);
 
  out:
         return IRQ_HANDLED;
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index 7e8fc7c1d4cc..cedb5f2f35cc 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -1001,7 +1001,7 @@ static inline void __stop_tx(struct uart_8250_port *p)
         }
 }
 
-static void serial8250_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void serial8250_stop_tx(struct uart_port *port)
 {
         struct uart_8250_port *up = (struct uart_8250_port *)port;
 
@@ -1018,7 +1018,7 @@ static void serial8250_stop_tx(struct uart_port *port, unsigned int tty_stop)
 
 static void transmit_chars(struct uart_8250_port *up);
 
-static void serial8250_start_tx(struct uart_port *port, unsigned int tty_start)
+static void serial8250_start_tx(struct uart_port *port)
 {
         struct uart_8250_port *up = (struct uart_8250_port *)port;
 
@@ -1158,7 +1158,11 @@ static _INLINE_ void transmit_chars(struct uart_8250_port *up)
                 up->port.x_char = 0;
                 return;
         }
-        if (uart_circ_empty(xmit) || uart_tx_stopped(&up->port)) {
+        if (uart_tx_stopped(&up->port)) {
+                serial8250_stop_tx(&up->port);
+                return;
+        }
+        if (uart_circ_empty(xmit)) {
                 __stop_tx(up);
                 return;
         }
diff --git a/drivers/serial/8250_pci.c b/drivers/serial/8250_pci.c
index 07f05e9d0955..0e21f583690e 100644
--- a/drivers/serial/8250_pci.c
+++ b/drivers/serial/8250_pci.c
@@ -34,36 +34,6 @@
 #undef SERIAL_DEBUG_PCI
 
 /*
- * Definitions for PCI support.
- */
-#define FL_BASE_MASK            0x0007
-#define FL_BASE0                0x0000
-#define FL_BASE1                0x0001
-#define FL_BASE2                0x0002
-#define FL_BASE3                0x0003
-#define FL_BASE4                0x0004
-#define FL_GET_BASE(x)          (x & FL_BASE_MASK)
-
-/* Use successive BARs (PCI base address registers),
-   else use offset into some specified BAR */
-#define FL_BASE_BARS            0x0008
-
-/* do not assign an irq */
-#define FL_NOIRQ                0x0080
-
-/* Use the Base address register size to cap number of ports */
-#define FL_REGION_SZ_CAP        0x0100
-
-struct pci_board {
-        unsigned int flags;
-        unsigned int num_ports;
-        unsigned int base_baud;
-        unsigned int uart_offset;
-        unsigned int reg_shift;
-        unsigned int first_offset;
-};
-
-/*
  * init function returns:
  *  > 0 - number of ports
  *  = 0 - use board->num_ports
@@ -75,14 +45,15 @@ struct pci_serial_quirk {
         u32     subvendor;
         u32     subdevice;
         int     (*init)(struct pci_dev *dev);
-        int     (*setup)(struct pci_dev *dev, struct pci_board *board,
-                         struct uart_port *port, int idx);
+        int     (*setup)(struct serial_private *, struct pciserial_board *,
+                         struct uart_port *, int);
         void    (*exit)(struct pci_dev *dev);
 };
 
 #define PCI_NUM_BAR_RESOURCES   6
 
 struct serial_private {
+        struct pci_dev          *dev;
         unsigned int            nr;
         void __iomem            *remapped_bar[PCI_NUM_BAR_RESOURCES];
         struct pci_serial_quirk *quirk;
@@ -101,17 +72,18 @@ static void moan_device(const char *str, struct pci_dev *dev)
 }
 
 static int
-setup_port(struct pci_dev *dev, struct uart_port *port,
+setup_port(struct serial_private *priv, struct uart_port *port,
            int bar, int offset, int regshift)
 {
-        struct serial_private *priv = pci_get_drvdata(dev);
+        struct pci_dev *dev = priv->dev;
         unsigned long base, len;
 
         if (bar >= PCI_NUM_BAR_RESOURCES)
                 return -EINVAL;
 
+        base = pci_resource_start(dev, bar);
+
         if (pci_resource_flags(dev, bar) & IORESOURCE_MEM) {
-                base = pci_resource_start(dev, bar);
                 len =  pci_resource_len(dev, bar);
 
                 if (!priv->remapped_bar[bar])
@@ -120,13 +92,16 @@ setup_port(struct pci_dev *dev, struct uart_port *port,
                         return -ENOMEM;
 
                 port->iotype = UPIO_MEM;
+                port->iobase = 0;
                 port->mapbase = base + offset;
                 port->membase = priv->remapped_bar[bar] + offset;
                 port->regshift = regshift;
         } else {
-                base = pci_resource_start(dev, bar) + offset;
                 port->iotype = UPIO_PORT;
-                port->iobase = base;
+                port->iobase = base + offset;
+                port->mapbase = 0;
+                port->membase = NULL;
+                port->regshift = 0;
         }
         return 0;
 }
@@ -136,7 +111,7 @@ setup_port(struct pci_dev *dev, struct uart_port *port,
  * Not that ugly ;) -- HW
  */
 static int
-afavlab_setup(struct pci_dev *dev, struct pci_board *board,
+afavlab_setup(struct serial_private *priv, struct pciserial_board *board,
               struct uart_port *port, int idx)
 {
         unsigned int bar, offset = board->first_offset;
@@ -149,7 +124,7 @@ afavlab_setup(struct pci_dev *dev, struct pci_board *board,
                 offset += (idx - 4) * board->uart_offset;
         }
 
-        return setup_port(dev, port, bar, offset, board->reg_shift);
+        return setup_port(priv, port, bar, offset, board->reg_shift);
 }
 
 /*
@@ -189,13 +164,13 @@ static int __devinit pci_hp_diva_init(struct pci_dev *dev)
  * some serial ports are supposed to be hidden on certain models.
  */
 static int
-pci_hp_diva_setup(struct pci_dev *dev, struct pci_board *board,
+pci_hp_diva_setup(struct serial_private *priv, struct pciserial_board *board,
               struct uart_port *port, int idx)
 {
         unsigned int offset = board->first_offset;
         unsigned int bar = FL_GET_BASE(board->flags);
 
-        switch (dev->subsystem_device) {
+        switch (priv->dev->subsystem_device) {
         case PCI_DEVICE_ID_HP_DIVA_MAESTRO:
                 if (idx == 3)
                         idx++;
@@ -212,7 +187,7 @@ pci_hp_diva_setup(struct pci_dev *dev, struct pci_board *board,
 
         offset += idx * board->uart_offset;
 
-        return setup_port(dev, port, bar, offset, board->reg_shift);
+        return setup_port(priv, port, bar, offset, board->reg_shift);
 }
 
 /*
@@ -307,7 +282,7 @@ static void __devexit pci_plx9050_exit(struct pci_dev *dev)
 
 /* SBS Technologies Inc. PMC-OCTPRO and P-OCTAL cards */
 static int
-sbs_setup(struct pci_dev *dev, struct pci_board *board,
+sbs_setup(struct serial_private *priv, struct pciserial_board *board,
                 struct uart_port *port, int idx)
 {
         unsigned int bar, offset = board->first_offset;
@@ -323,7 +298,7 @@ sbs_setup(struct pci_dev *dev, struct pci_board *board,
         } else /* we have only 8 ports on PMC-OCTALPRO */
                 return 1;
 
-        return setup_port(dev, port, bar, offset, board->reg_shift);
+        return setup_port(priv, port, bar, offset, board->reg_shift);
 }
 
 /*
@@ -389,6 +364,9 @@ static void __devexit sbs_exit(struct pci_dev *dev)
  *     - 10x cards have control registers in IO and/or memory space;
  *     - 20x cards have control registers in standard PCI configuration space.
  *
+ * Note: all 10x cards have PCI device ids 0x10..
+ *       all 20x cards have PCI device ids 0x20..
+ *
  * There are also Quartet Serial cards which use Oxford Semiconductor
  * 16954 quad UART PCI chip clocked by 18.432 MHz quartz.
  *
@@ -445,24 +423,18 @@ static int pci_siig20x_init(struct pci_dev *dev)
         return 0;
 }
 
-int pci_siig10x_fn(struct pci_dev *dev, int enable)
+static int pci_siig_init(struct pci_dev *dev)
 {
-        int ret = 0;
-        if (enable)
-                ret = pci_siig10x_init(dev);
-        return ret;
-}
+        unsigned int type = dev->device & 0xff00;
 
-int pci_siig20x_fn(struct pci_dev *dev, int enable)
-{
-        int ret = 0;
-        if (enable)
-                ret = pci_siig20x_init(dev);
-        return ret;
-}
+        if (type == 0x1000)
+                return pci_siig10x_init(dev);
+        else if (type == 0x2000)
+                return pci_siig20x_init(dev);
 
-EXPORT_SYMBOL(pci_siig10x_fn);
-EXPORT_SYMBOL(pci_siig20x_fn);
+        moan_device("Unknown SIIG card", dev);
+        return -ENODEV;
+}
 
 /*
  * Timedia has an explosion of boards, and to avoid the PCI table from
@@ -523,7 +495,7 @@ static int __devinit pci_timedia_init(struct pci_dev *dev)
  * Ugh, this is ugly as all hell --- TYT
  */
 static int
-pci_timedia_setup(struct pci_dev *dev, struct pci_board *board,
+pci_timedia_setup(struct serial_private *priv, struct pciserial_board *board,
                   struct uart_port *port, int idx)
 {
         unsigned int bar = 0, offset = board->first_offset;
@@ -549,14 +521,15 @@ pci_timedia_setup(struct pci_dev *dev, struct pci_board *board,
                 bar = idx - 2;
         }
 
-        return setup_port(dev, port, bar, offset, board->reg_shift);
+        return setup_port(priv, port, bar, offset, board->reg_shift);
 }
 
 /*
  * Some Titan cards are also a little weird
  */
 static int
-titan_400l_800l_setup(struct pci_dev *dev, struct pci_board *board,
+titan_400l_800l_setup(struct serial_private *priv,
+                      struct pciserial_board *board,
                       struct uart_port *port, int idx)
 {
         unsigned int bar, offset = board->first_offset;
@@ -573,7 +546,7 @@ titan_400l_800l_setup(struct pci_dev *dev, struct pci_board *board,
                 offset = (idx - 2) * board->uart_offset;
         }
 
-        return setup_port(dev, port, bar, offset, board->reg_shift);
+        return setup_port(priv, port, bar, offset, board->reg_shift);
 }
 
 static int __devinit pci_xircom_init(struct pci_dev *dev)
@@ -593,7 +566,7 @@ static int __devinit pci_netmos_init(struct pci_dev *dev)
 }
 
 static int
-pci_default_setup(struct pci_dev *dev, struct pci_board *board,
+pci_default_setup(struct serial_private *priv, struct pciserial_board *board,
                   struct uart_port *port, int idx)
 {
         unsigned int bar, offset = board->first_offset, maxnr;
@@ -604,13 +577,13 @@ pci_default_setup(struct pci_dev *dev, struct pci_board *board,
         else
                 offset += idx * board->uart_offset;
 
-        maxnr = (pci_resource_len(dev, bar) - board->first_offset) /
+        maxnr = (pci_resource_len(priv->dev, bar) - board->first_offset) /
                 (8 << board->reg_shift);
 
         if (board->flags & FL_REGION_SZ_CAP && idx >= maxnr)
                 return 1;
                         
-        return setup_port(dev, port, bar, offset, board->reg_shift);
+        return setup_port(priv, port, bar, offset, board->reg_shift);
 }
 
 /* This should be in linux/pci_ids.h */
@@ -754,152 +727,15 @@ static struct pci_serial_quirk pci_serial_quirks[] = {
                 .setup          = sbs_setup,
                 .exit           = __devexit_p(sbs_exit),
         },
-
         /*
          * SIIG cards.
-         *  It is not clear whether these could be collapsed.
          */
         {
                 .vendor         = PCI_VENDOR_ID_SIIG,
-                .device         = PCI_DEVICE_ID_SIIG_1S_10x_550,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .init           = pci_siig10x_init,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_SIIG,
-                .device         = PCI_DEVICE_ID_SIIG_1S_10x_650,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .init           = pci_siig10x_init,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_SIIG,
-                .device         = PCI_DEVICE_ID_SIIG_1S_10x_850,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .init           = pci_siig10x_init,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_SIIG,
-                .device         = PCI_DEVICE_ID_SIIG_2S_10x_550,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .init           = pci_siig10x_init,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_SIIG,
-                .device         = PCI_DEVICE_ID_SIIG_2S_10x_650,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .init           = pci_siig10x_init,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_SIIG,
-                .device         = PCI_DEVICE_ID_SIIG_2S_10x_850,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .init           = pci_siig10x_init,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_SIIG,
-                .device         = PCI_DEVICE_ID_SIIG_4S_10x_550,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .init           = pci_siig10x_init,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_SIIG,
-                .device         = PCI_DEVICE_ID_SIIG_4S_10x_650,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .init           = pci_siig10x_init,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_SIIG,
-                .device         = PCI_DEVICE_ID_SIIG_4S_10x_850,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .init           = pci_siig10x_init,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_SIIG,
-                .device         = PCI_DEVICE_ID_SIIG_1S_20x_550,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .init           = pci_siig20x_init,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_SIIG,
-                .device         = PCI_DEVICE_ID_SIIG_1S_20x_650,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .init           = pci_siig20x_init,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_SIIG,
-                .device         = PCI_DEVICE_ID_SIIG_1S_20x_850,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .init           = pci_siig20x_init,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_SIIG,
-                .device         = PCI_DEVICE_ID_SIIG_2S_20x_550,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .init           = pci_siig20x_init,
-                .setup          = pci_default_setup,
-        },
-        {       .vendor         = PCI_VENDOR_ID_SIIG,
-                .device         = PCI_DEVICE_ID_SIIG_2S_20x_650,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .init           = pci_siig20x_init,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_SIIG,
-                .device         = PCI_DEVICE_ID_SIIG_2S_20x_850,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .init           = pci_siig20x_init,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_SIIG,
-                .device         = PCI_DEVICE_ID_SIIG_4S_20x_550,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .init           = pci_siig20x_init,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_SIIG,
-                .device         = PCI_DEVICE_ID_SIIG_4S_20x_650,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .init           = pci_siig20x_init,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_SIIG,
-                .device         = PCI_DEVICE_ID_SIIG_4S_20x_850,
+                .device         = PCI_ANY_ID,
                 .subvendor      = PCI_ANY_ID,
                 .subdevice      = PCI_ANY_ID,
-                .init           = pci_siig20x_init,
+                .init           = pci_siig_init,
                 .setup          = pci_default_setup,
         },
         /*
@@ -990,7 +826,7 @@ static struct pci_serial_quirk *find_quirk(struct pci_dev *dev)
 }
 
 static _INLINE_ int
-get_pci_irq(struct pci_dev *dev, struct pci_board *board, int idx)
+get_pci_irq(struct pci_dev *dev, struct pciserial_board *board)
 {
         if (board->flags & FL_NOIRQ)
                 return 0;
@@ -1115,7 +951,7 @@ enum pci_board_num_t {
  * see first lines of serial_in() and serial_out() in 8250.c
 */
 
-static struct pci_board pci_boards[] __devinitdata = {
+static struct pciserial_board pci_boards[] __devinitdata = {
         [pbn_default] = {
                 .flags          = FL_BASE0,
                 .num_ports      = 1,
@@ -1575,7 +1411,7 @@ static struct pci_board pci_boards[] __devinitdata = {
  * serial specs.  Returns 0 on success, 1 on failure.
  */
 static int __devinit
-serial_pci_guess_board(struct pci_dev *dev, struct pci_board *board)
+serial_pci_guess_board(struct pci_dev *dev, struct pciserial_board *board)
 {
         int num_iomem, num_port, first_port = -1, i;
         
@@ -1640,7 +1476,8 @@ serial_pci_guess_board(struct pci_dev *dev, struct pci_board *board)
 }
 
 static inline int
-serial_pci_matches(struct pci_board *board, struct pci_board *guessed)
+serial_pci_matches(struct pciserial_board *board,
+                   struct pciserial_board *guessed)
 {
         return
             board->num_ports == guessed->num_ports &&
@@ -1650,58 +1487,14 @@ serial_pci_matches(struct pci_board *board, struct pci_board *guessed)
             board->first_offset == guessed->first_offset;
 }
 
-/*
- * Probe one serial board.  Unfortunately, there is no rhyme nor reason
- * to the arrangement of serial ports on a PCI card.
- */
-static int __devinit
-pciserial_init_one(struct pci_dev *dev, const struct pci_device_id *ent)
+struct serial_private *
+pciserial_init_ports(struct pci_dev *dev, struct pciserial_board *board)
 {
+        struct uart_port serial_port;
         struct serial_private *priv;
-        struct pci_board *board, tmp;
         struct pci_serial_quirk *quirk;
         int rc, nr_ports, i;
 
-        if (ent->driver_data >= ARRAY_SIZE(pci_boards)) {
-                printk(KERN_ERR "pci_init_one: invalid driver_data: %ld\n",
-                        ent->driver_data);
-                return -EINVAL;
-        }
-
-        board = &pci_boards[ent->driver_data];
-
-        rc = pci_enable_device(dev);
-        if (rc)
-                return rc;
-
-        if (ent->driver_data == pbn_default) {
-                /*
-                 * Use a copy of the pci_board entry for this;
-                 * avoid changing entries in the table.
-                 */
-                memcpy(&tmp, board, sizeof(struct pci_board));
-                board = &tmp;
-
-                /*
-                 * We matched one of our class entries.  Try to
-                 * determine the parameters of this board.
-                 */
-                rc = serial_pci_guess_board(dev, board);
-                if (rc)
-                        goto disable;
-        } else {
-                /*
-                 * We matched an explicit entry.  If we are able to
-                 * detect this boards settings with our heuristic,
-                 * then we no longer need this entry.
-                 */
-                memcpy(&tmp, &pci_boards[pbn_default], sizeof(struct pci_board));
-                rc = serial_pci_guess_board(dev, &tmp);
-                if (rc == 0 && serial_pci_matches(board, &tmp))
-                        moan_device("Redundant entry in serial pci_table.",
-                                    dev);
-        }
-
         nr_ports = board->num_ports;
 
         /*
@@ -1718,8 +1511,10 @@ pciserial_init_one(struct pci_dev *dev, const struct pci_device_id *ent)
          */
         if (quirk->init) {
                 rc = quirk->init(dev);
-                if (rc < 0)
-                        goto disable;
+                if (rc < 0) {
+                        priv = ERR_PTR(rc);
+                        goto err_out;
+                }
                 if (rc)
                         nr_ports = rc;
         }
@@ -1728,27 +1523,26 @@ pciserial_init_one(struct pci_dev *dev, const struct pci_device_id *ent)
                        sizeof(unsigned int) * nr_ports,
                        GFP_KERNEL);
         if (!priv) {
-                rc = -ENOMEM;
-                goto deinit;
+                priv = ERR_PTR(-ENOMEM);
+                goto err_deinit;
         }
 
         memset(priv, 0, sizeof(struct serial_private) +
                         sizeof(unsigned int) * nr_ports);
 
+        priv->dev = dev;
         priv->quirk = quirk;
-        pci_set_drvdata(dev, priv);
+
+        memset(&serial_port, 0, sizeof(struct uart_port));
+        serial_port.flags = UPF_SKIP_TEST | UPF_BOOT_AUTOCONF | UPF_SHARE_IRQ;
+        serial_port.uartclk = board->base_baud * 16;
+        serial_port.irq = get_pci_irq(dev, board);
+        serial_port.dev = &dev->dev;
 
         for (i = 0; i < nr_ports; i++) {
-                struct uart_port serial_port;
-                memset(&serial_port, 0, sizeof(struct uart_port));
-
-                serial_port.flags = UPF_SKIP_TEST | UPF_BOOT_AUTOCONF |
-                                    UPF_SHARE_IRQ;
-                serial_port.uartclk = board->base_baud * 16;
-                serial_port.irq = get_pci_irq(dev, board, i);
-                serial_port.dev = &dev->dev;
-                if (quirk->setup(dev, board, &serial_port, i))
+                if (quirk->setup(priv, board, &serial_port, i))
                         break;
+
 #ifdef SERIAL_DEBUG_PCI
                 printk("Setup PCI port: port %x, irq %d, type %d\n",
                        serial_port.iobase, serial_port.irq, serial_port.iotype);
@@ -1763,24 +1557,21 @@ pciserial_init_one(struct pci_dev *dev, const struct pci_device_id *ent)
 
         priv->nr = i;
 
-        return 0;
+        return priv;
 
- deinit:
+ err_deinit:
         if (quirk->exit)
                 quirk->exit(dev);
- disable:
-        pci_disable_device(dev);
-        return rc;
+ err_out:
+        return priv;
 }
+EXPORT_SYMBOL_GPL(pciserial_init_ports);
 
-static void __devexit pciserial_remove_one(struct pci_dev *dev)
+void pciserial_remove_ports(struct serial_private *priv)
 {
-        struct serial_private *priv = pci_get_drvdata(dev);
         struct pci_serial_quirk *quirk;
         int i;
 
-        pci_set_drvdata(dev, NULL);
-
         for (i = 0; i < priv->nr; i++)
                 serial8250_unregister_port(priv->line[i]);
 
@@ -1793,25 +1584,123 @@ static void __devexit pciserial_remove_one(struct pci_dev *dev)
         /*
          * Find the exit quirks.
          */
-        quirk = find_quirk(dev);
+        quirk = find_quirk(priv->dev);
         if (quirk->exit)
-                quirk->exit(dev);
+                quirk->exit(priv->dev);
+
+        kfree(priv);
+}
+EXPORT_SYMBOL_GPL(pciserial_remove_ports);
+
+void pciserial_suspend_ports(struct serial_private *priv)
+{
+        int i;
+
+        for (i = 0; i < priv->nr; i++)
+                if (priv->line[i] >= 0)
+                        serial8250_suspend_port(priv->line[i]);
+}
+EXPORT_SYMBOL_GPL(pciserial_suspend_ports);
+
+void pciserial_resume_ports(struct serial_private *priv)
+{
+        int i;
+
+        /*
+         * Ensure that the board is correctly configured.
+         */
+        if (priv->quirk->init)
+                priv->quirk->init(priv->dev);
+
+        for (i = 0; i < priv->nr; i++)
+                if (priv->line[i] >= 0)
+                        serial8250_resume_port(priv->line[i]);
+}
+EXPORT_SYMBOL_GPL(pciserial_resume_ports);
+
+/*
+ * Probe one serial board.  Unfortunately, there is no rhyme nor reason
+ * to the arrangement of serial ports on a PCI card.
+ */
+static int __devinit
+pciserial_init_one(struct pci_dev *dev, const struct pci_device_id *ent)
+{
+        struct serial_private *priv;
+        struct pciserial_board *board, tmp;
+        int rc;
+
+        if (ent->driver_data >= ARRAY_SIZE(pci_boards)) {
+                printk(KERN_ERR "pci_init_one: invalid driver_data: %ld\n",
+                        ent->driver_data);
+                return -EINVAL;
+        }
+
+        board = &pci_boards[ent->driver_data];
+
+        rc = pci_enable_device(dev);
+        if (rc)
+                return rc;
+
+        if (ent->driver_data == pbn_default) {
+                /*
+                 * Use a copy of the pci_board entry for this;
+                 * avoid changing entries in the table.
+                 */
+                memcpy(&tmp, board, sizeof(struct pciserial_board));
+                board = &tmp;
+
+                /*
+                 * We matched one of our class entries.  Try to
+                 * determine the parameters of this board.
+                 */
+                rc = serial_pci_guess_board(dev, board);
+                if (rc)
+                        goto disable;
+        } else {
+                /*
+                 * We matched an explicit entry.  If we are able to
+                 * detect this boards settings with our heuristic,
+                 * then we no longer need this entry.
+                 */
+                memcpy(&tmp, &pci_boards[pbn_default],
+                       sizeof(struct pciserial_board));
+                rc = serial_pci_guess_board(dev, &tmp);
+                if (rc == 0 && serial_pci_matches(board, &tmp))
+                        moan_device("Redundant entry in serial pci_table.",
+                                    dev);
+        }
 
+        priv = pciserial_init_ports(dev, board);
+        if (!IS_ERR(priv)) {
+                pci_set_drvdata(dev, priv);
+                return 0;
+        }
+
+        rc = PTR_ERR(priv);
+
+ disable:
         pci_disable_device(dev);
+        return rc;
+}
 
-        kfree(priv);
+static void __devexit pciserial_remove_one(struct pci_dev *dev)
+{
+        struct serial_private *priv = pci_get_drvdata(dev);
+
+        pci_set_drvdata(dev, NULL);
+
+        pciserial_remove_ports(priv);
+
+        pci_disable_device(dev);
 }
 
 static int pciserial_suspend_one(struct pci_dev *dev, pm_message_t state)
 {
         struct serial_private *priv = pci_get_drvdata(dev);
 
-        if (priv) {
-                int i;
+        if (priv)
+                pciserial_suspend_ports(priv);
 
-                for (i = 0; i < priv->nr; i++)
-                        serial8250_suspend_port(priv->line[i]);
-        }
         pci_save_state(dev);
         pci_set_power_state(dev, pci_choose_state(dev, state));
         return 0;
@@ -1825,21 +1714,12 @@ static int pciserial_resume_one(struct pci_dev *dev)
         pci_restore_state(dev);
 
         if (priv) {
-                int i;
-
                 /*
                  * The device may have been disabled.  Re-enable it.
                  */
                 pci_enable_device(dev);
 
-                /*
-                 * Ensure that the board is correctly configured.
-                 */
-                if (priv->quirk->init)
-                        priv->quirk->init(dev);
-
-                for (i = 0; i < priv->nr; i++)
-                        serial8250_resume_port(priv->line[i]);
+                pciserial_resume_ports(priv);
         }
         return 0;
 }
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index 97034d3937fd..d5797618a3b9 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -211,7 +211,7 @@ comment "Non-8250 serial port support"
 
 config SERIAL_AMBA_PL010
         tristate "ARM AMBA PL010 serial port support"
-        depends on ARM_AMBA
+        depends on ARM_AMBA && (BROKEN || !ARCH_VERSATILE)
         select SERIAL_CORE
         help
           This selects the ARM(R) AMBA(R) PrimeCell PL010 UART.  If you have
@@ -819,7 +819,7 @@ config SERIAL_M32R_SIO_CONSOLE
 
 config SERIAL_M32R_PLDSIO
         bool "M32R SIO I/F on a PLD"
-        depends on SERIAL_M32R_SIO=y
+        depends on SERIAL_M32R_SIO=y && (PLAT_OPSPUT || PALT_USRV || PLAT_M32700UT)
         default n
         help
           Say Y here if you want to use the M32R serial controller
diff --git a/drivers/serial/amba-pl010.c b/drivers/serial/amba-pl010.c
index 2884b310e54d..978e12437e61 100644
--- a/drivers/serial/amba-pl010.c
+++ b/drivers/serial/amba-pl010.c
@@ -105,7 +105,7 @@ struct uart_amba_port {
         unsigned int            old_status;
 };
 
-static void pl010_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void pl010_stop_tx(struct uart_port *port)
 {
         unsigned int cr;
 
@@ -114,7 +114,7 @@ static void pl010_stop_tx(struct uart_port *port, unsigned int tty_stop)
         UART_PUT_CR(port, cr);
 }
 
-static void pl010_start_tx(struct uart_port *port, unsigned int tty_start)
+static void pl010_start_tx(struct uart_port *port)
 {
         unsigned int cr;
 
@@ -219,7 +219,7 @@ static void pl010_tx_chars(struct uart_port *port)
                 return;
         }
         if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
-                pl010_stop_tx(port, 0);
+                pl010_stop_tx(port);
                 return;
         }
 
@@ -236,7 +236,7 @@ static void pl010_tx_chars(struct uart_port *port)
                 uart_write_wakeup(port);
 
         if (uart_circ_empty(xmit))
-                pl010_stop_tx(port, 0);
+                pl010_stop_tx(port);
 }
 
 static void pl010_modem_status(struct uart_port *port)
diff --git a/drivers/serial/amba-pl011.c b/drivers/serial/amba-pl011.c
index 7db88ee18f75..56071309744c 100644
--- a/drivers/serial/amba-pl011.c
+++ b/drivers/serial/amba-pl011.c
@@ -74,7 +74,7 @@ struct uart_amba_port {
         unsigned int            old_status;
 };
 
-static void pl011_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void pl011_stop_tx(struct uart_port *port)
 {
         struct uart_amba_port *uap = (struct uart_amba_port *)port;
 
@@ -82,7 +82,7 @@ static void pl011_stop_tx(struct uart_port *port, unsigned int tty_stop)
         writew(uap->im, uap->port.membase + UART011_IMSC);
 }
 
-static void pl011_start_tx(struct uart_port *port, unsigned int tty_start)
+static void pl011_start_tx(struct uart_port *port)
 {
         struct uart_amba_port *uap = (struct uart_amba_port *)port;
 
@@ -184,7 +184,7 @@ static void pl011_tx_chars(struct uart_amba_port *uap)
                 return;
         }
         if (uart_circ_empty(xmit) || uart_tx_stopped(&uap->port)) {
-                pl011_stop_tx(&uap->port, 0);
+                pl011_stop_tx(&uap->port);
                 return;
         }
 
@@ -201,7 +201,7 @@ static void pl011_tx_chars(struct uart_amba_port *uap)
                 uart_write_wakeup(&uap->port);
 
         if (uart_circ_empty(xmit))
-                pl011_stop_tx(&uap->port, 0);
+                pl011_stop_tx(&uap->port);
 }
 
 static void pl011_modem_status(struct uart_amba_port *uap)
diff --git a/drivers/serial/au1x00_uart.c b/drivers/serial/au1x00_uart.c
index 6104aeef1243..a274ebf256a1 100644
--- a/drivers/serial/au1x00_uart.c
+++ b/drivers/serial/au1x00_uart.c
@@ -200,7 +200,7 @@ static void autoconfig(struct uart_8250_port *up, unsigned int probeflags)
         DEBUG_AUTOCONF("type=%s\n", uart_config[up->port.type].name);
 }
 
-static void serial8250_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void serial8250_stop_tx(struct uart_port *port)
 {
         struct uart_8250_port *up = (struct uart_8250_port *)port;
 
@@ -210,7 +210,7 @@ static void serial8250_stop_tx(struct uart_port *port, unsigned int tty_stop)
         }
 }
 
-static void serial8250_start_tx(struct uart_port *port, unsigned int tty_start)
+static void serial8250_start_tx(struct uart_port *port)
 {
         struct uart_8250_port *up = (struct uart_8250_port *)port;
 
@@ -337,7 +337,7 @@ static _INLINE_ void transmit_chars(struct uart_8250_port *up)
                 return;
         }
         if (uart_circ_empty(xmit) || uart_tx_stopped(&up->port)) {
-                serial8250_stop_tx(&up->port, 0);
+                serial8250_stop_tx(&up->port);
                 return;
         }
 
@@ -356,7 +356,7 @@ static _INLINE_ void transmit_chars(struct uart_8250_port *up)
         DEBUG_INTR("THRE...");
 
         if (uart_circ_empty(xmit))
-                serial8250_stop_tx(&up->port, 0);
+                serial8250_stop_tx(&up->port);
 }
 
 static _INLINE_ void check_modem_status(struct uart_8250_port *up)
diff --git a/drivers/serial/clps711x.c b/drivers/serial/clps711x.c
index e92522b33c48..d822896b488c 100644
--- a/drivers/serial/clps711x.c
+++ b/drivers/serial/clps711x.c
@@ -69,8 +69,7 @@
 
 #define tx_enabled(port)        ((port)->unused[0])
 
-static void
-clps711xuart_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void clps711xuart_stop_tx(struct uart_port *port)
 {
         if (tx_enabled(port)) {
                 disable_irq(TX_IRQ(port));
@@ -78,8 +77,7 @@ clps711xuart_stop_tx(struct uart_port *port, unsigned int tty_stop)
         }
 }
 
-static void
-clps711xuart_start_tx(struct uart_port *port, unsigned int tty_start)
+static void clps711xuart_start_tx(struct uart_port *port)
 {
         if (!tx_enabled(port)) {
                 enable_irq(TX_IRQ(port));
@@ -165,7 +163,7 @@ static irqreturn_t clps711xuart_int_tx(int irq, void *dev_id, struct pt_regs *re
                 return IRQ_HANDLED;
         }
         if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
-                clps711xuart_stop_tx(port, 0);
+                clps711xuart_stop_tx(port);
                 return IRQ_HANDLED;
         }
 
@@ -182,7 +180,7 @@ static irqreturn_t clps711xuart_int_tx(int irq, void *dev_id, struct pt_regs *re
                 uart_write_wakeup(port);
 
         if (uart_circ_empty(xmit))
-                clps711xuart_stop_tx(port, 0);
+                clps711xuart_stop_tx(port);
 
         return IRQ_HANDLED;
 }
diff --git a/drivers/serial/cpm_uart/cpm_uart.h b/drivers/serial/cpm_uart/cpm_uart.h
index 5f6187baad86..73c8a088c160 100644
--- a/drivers/serial/cpm_uart/cpm_uart.h
+++ b/drivers/serial/cpm_uart/cpm_uart.h
@@ -40,13 +40,15 @@
 #define TX_NUM_FIFO     4
 #define TX_BUF_SIZE     32
 
+#define SCC_WAIT_CLOSING 100
+
 struct uart_cpm_port {
         struct uart_port        port;
-        u16                     rx_nrfifos;     
+        u16                     rx_nrfifos;
         u16                     rx_fifosize;
-        u16                     tx_nrfifos;     
+        u16                     tx_nrfifos;
         u16                     tx_fifosize;
-        smc_t                   *smcp;  
+        smc_t                   *smcp;
         smc_uart_t              *smcup;
         scc_t                   *sccp;
         scc_uart_t              *sccup;
@@ -67,6 +69,8 @@ struct uart_cpm_port {
         int                      bits;
         /* Keep track of 'odd' SMC2 wirings */
         int                     is_portb;
+        /* wait on close if needed */
+        int                     wait_closing;
 };
 
 extern int cpm_uart_port_map[UART_NR];
diff --git a/drivers/serial/cpm_uart/cpm_uart_core.c b/drivers/serial/cpm_uart/cpm_uart_core.c
index 29db677d4284..282b32351d8e 100644
--- a/drivers/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/serial/cpm_uart/cpm_uart_core.c
@@ -9,9 +9,10 @@
  *
  *  Maintainer: Kumar Gala (kumar.gala@freescale.com) (CPM2)
  *              Pantelis Antoniou (panto@intracom.gr) (CPM1)
- * 
+ *
  *  Copyright (C) 2004 Freescale Semiconductor, Inc.
  *            (C) 2004 Intracom, S.A.
+ *            (C) 2005 MontaVista Software, Inc. by Vitaly Bordug <vbordug@ru.mvista.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -70,8 +71,22 @@ static void cpm_uart_initbd(struct uart_cpm_port *pinfo);
 
 /**************************************************************/
 
+static inline unsigned long cpu2cpm_addr(void *addr)
+{
+        if ((unsigned long)addr >= CPM_ADDR)
+                return (unsigned long)addr;
+        return virt_to_bus(addr);
+}
+
+static inline void *cpm2cpu_addr(unsigned long addr)
+{
+        if (addr >= CPM_ADDR)
+                return (void *)addr;
+        return bus_to_virt(addr);
+}
+
 /*
- * Check, if transmit buffers are processed             
+ * Check, if transmit buffers are processed
 */
 static unsigned int cpm_uart_tx_empty(struct uart_port *port)
 {
@@ -109,7 +124,7 @@ static unsigned int cpm_uart_get_mctrl(struct uart_port *port)
 /*
  * Stop transmitter
  */
-static void cpm_uart_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void cpm_uart_stop_tx(struct uart_port *port)
 {
         struct uart_cpm_port *pinfo = (struct uart_cpm_port *)port;
         volatile smc_t *smcp = pinfo->smcp;
@@ -126,7 +141,7 @@ static void cpm_uart_stop_tx(struct uart_port *port, unsigned int tty_stop)
 /*
  * Start transmitter
  */
-static void cpm_uart_start_tx(struct uart_port *port, unsigned int tty_start)
+static void cpm_uart_start_tx(struct uart_port *port)
 {
         struct uart_cpm_port *pinfo = (struct uart_cpm_port *)port;
         volatile smc_t *smcp = pinfo->smcp;
@@ -143,15 +158,18 @@ static void cpm_uart_start_tx(struct uart_port *port, unsigned int tty_start)
         }
 
         if (cpm_uart_tx_pump(port) != 0) {
-                if (IS_SMC(pinfo))
+                if (IS_SMC(pinfo)) {
                         smcp->smc_smcm |= SMCM_TX;
-                else
+                        smcp->smc_smcmr |= SMCMR_TEN;
+                } else {
                         sccp->scc_sccm |= UART_SCCM_TX;
+                        pinfo->sccp->scc_gsmrl |= SCC_GSMRL_ENT;
+                }
         }
 }
 
 /*
- * Stop receiver 
+ * Stop receiver
  */
 static void cpm_uart_stop_rx(struct uart_port *port)
 {
@@ -176,7 +194,7 @@ static void cpm_uart_enable_ms(struct uart_port *port)
 }
 
 /*
- * Generate a break. 
+ * Generate a break.
  */
 static void cpm_uart_break_ctl(struct uart_port *port, int break_state)
 {
@@ -231,7 +249,7 @@ static void cpm_uart_int_rx(struct uart_port *port, struct pt_regs *regs)
                 /* get number of characters, and check spce in flip-buffer */
                 i = bdp->cbd_datlen;
 
-                /* If we have not enough room in tty flip buffer, then we try 
+                /* If we have not enough room in tty flip buffer, then we try
                  * later, which will be the next rx-interrupt or a timeout
                  */
                 if ((tty->flip.count + i) >= TTY_FLIPBUF_SIZE) {
@@ -243,7 +261,7 @@ static void cpm_uart_int_rx(struct uart_port *port, struct pt_regs *regs)
                 }
 
                 /* get pointer */
-                cp = (unsigned char *)bus_to_virt(bdp->cbd_bufaddr);
+                cp = cpm2cpu_addr(bdp->cbd_bufaddr);
 
                 /* loop through the buffer */
                 while (i-- > 0) {
@@ -265,13 +283,14 @@ static void cpm_uart_int_rx(struct uart_port *port, struct pt_regs *regs)
                 }               /* End while (i--) */
 
                 /* This BD is ready to be used again. Clear status. get next */
-                bdp->cbd_sc &= ~(BD_SC_BR | BD_SC_FR | BD_SC_PR | BD_SC_OV);
+                bdp->cbd_sc &= ~(BD_SC_BR | BD_SC_FR | BD_SC_PR | BD_SC_OV | BD_SC_ID);
                 bdp->cbd_sc |= BD_SC_EMPTY;
 
                 if (bdp->cbd_sc & BD_SC_WRAP)
                         bdp = pinfo->rx_bd_base;
                 else
                         bdp++;
+
         } /* End for (;;) */
 
         /* Write back buffer pointer */
@@ -336,22 +355,22 @@ static irqreturn_t cpm_uart_int(int irq, void *data, struct pt_regs *regs)
 
         if (IS_SMC(pinfo)) {
                 events = smcp->smc_smce;
+                smcp->smc_smce = events;
                 if (events & SMCM_BRKE)
                         uart_handle_break(port);
                 if (events & SMCM_RX)
                         cpm_uart_int_rx(port, regs);
                 if (events & SMCM_TX)
                         cpm_uart_int_tx(port, regs);
-                smcp->smc_smce = events;
         } else {
                 events = sccp->scc_scce;
+                sccp->scc_scce = events;
                 if (events & UART_SCCM_BRKE)
                         uart_handle_break(port);
                 if (events & UART_SCCM_RX)
                         cpm_uart_int_rx(port, regs);
                 if (events & UART_SCCM_TX)
                         cpm_uart_int_tx(port, regs);
-                sccp->scc_scce = events;
         }
         return (events) ? IRQ_HANDLED : IRQ_NONE;
 }
@@ -360,6 +379,7 @@ static int cpm_uart_startup(struct uart_port *port)
 {
         int retval;
         struct uart_cpm_port *pinfo = (struct uart_cpm_port *)port;
+        int line = pinfo - cpm_uart_ports;
 
         pr_debug("CPM uart[%d]:startup\n", port->line);
 
@@ -376,9 +396,19 @@ static int cpm_uart_startup(struct uart_port *port)
                 pinfo->sccp->scc_sccm |= UART_SCCM_RX;
         }
 
+        if (!(pinfo->flags & FLAG_CONSOLE))
+                cpm_line_cr_cmd(line,CPM_CR_INIT_TRX);
         return 0;
 }
 
+inline void cpm_uart_wait_until_send(struct uart_cpm_port *pinfo)
+{
+        unsigned long target_jiffies = jiffies + pinfo->wait_closing;
+
+        while (!time_after(jiffies, target_jiffies))
+                schedule();
+}
+
 /*
  * Shutdown the uart
  */
@@ -394,6 +424,12 @@ static void cpm_uart_shutdown(struct uart_port *port)
 
         /* If the port is not the console, disable Rx and Tx. */
         if (!(pinfo->flags & FLAG_CONSOLE)) {
+                /* Wait for all the BDs marked sent */
+                while(!cpm_uart_tx_empty(port))
+                        schedule_timeout(2);
+                if(pinfo->wait_closing)
+                        cpm_uart_wait_until_send(pinfo);
+
                 /* Stop uarts */
                 if (IS_SMC(pinfo)) {
                         volatile smc_t *smcp = pinfo->smcp;
@@ -502,7 +538,7 @@ static void cpm_uart_set_termios(struct uart_port *port,
          */
         if ((termios->c_cflag & CREAD) == 0)
                 port->read_status_mask &= ~BD_SC_EMPTY;
-        
+
         spin_lock_irqsave(&port->lock, flags);
 
         /* Start bit has not been added (so don't, because we would just
@@ -569,7 +605,8 @@ static int cpm_uart_tx_pump(struct uart_port *port)
                 /* Pick next descriptor and fill from buffer */
                 bdp = pinfo->tx_cur;
 
-                p = bus_to_virt(bdp->cbd_bufaddr);
+                p = cpm2cpu_addr(bdp->cbd_bufaddr);
+
                 *p++ = xmit->buf[xmit->tail];
                 bdp->cbd_datlen = 1;
                 bdp->cbd_sc |= BD_SC_READY;
@@ -586,7 +623,7 @@ static int cpm_uart_tx_pump(struct uart_port *port)
         }
 
         if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
-                cpm_uart_stop_tx(port, 0);
+                cpm_uart_stop_tx(port);
                 return 0;
         }
 
@@ -595,7 +632,7 @@ static int cpm_uart_tx_pump(struct uart_port *port)
 
         while (!(bdp->cbd_sc & BD_SC_READY) && (xmit->tail != xmit->head)) {
                 count = 0;
-                p = bus_to_virt(bdp->cbd_bufaddr);
+                p = cpm2cpu_addr(bdp->cbd_bufaddr);
                 while (count < pinfo->tx_fifosize) {
                         *p++ = xmit->buf[xmit->tail];
                         xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
@@ -606,6 +643,7 @@ static int cpm_uart_tx_pump(struct uart_port *port)
                 }
                 bdp->cbd_datlen = count;
                 bdp->cbd_sc |= BD_SC_READY;
+                __asm__("eieio");
                 /* Get next BD. */
                 if (bdp->cbd_sc & BD_SC_WRAP)
                         bdp = pinfo->tx_bd_base;
@@ -618,7 +656,7 @@ static int cpm_uart_tx_pump(struct uart_port *port)
                 uart_write_wakeup(port);
 
         if (uart_circ_empty(xmit)) {
-                cpm_uart_stop_tx(port, 0);
+                cpm_uart_stop_tx(port);
                 return 0;
         }
 
@@ -643,12 +681,12 @@ static void cpm_uart_initbd(struct uart_cpm_port *pinfo)
         mem_addr = pinfo->mem_addr;
         bdp = pinfo->rx_cur = pinfo->rx_bd_base;
         for (i = 0; i < (pinfo->rx_nrfifos - 1); i++, bdp++) {
-                bdp->cbd_bufaddr = virt_to_bus(mem_addr);
+                bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
                 bdp->cbd_sc = BD_SC_EMPTY | BD_SC_INTRPT;
                 mem_addr += pinfo->rx_fifosize;
         }
-        
-        bdp->cbd_bufaddr = virt_to_bus(mem_addr);
+
+        bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
         bdp->cbd_sc = BD_SC_WRAP | BD_SC_EMPTY | BD_SC_INTRPT;
 
         /* Set the physical address of the host memory
@@ -658,12 +696,12 @@ static void cpm_uart_initbd(struct uart_cpm_port *pinfo)
         mem_addr = pinfo->mem_addr + L1_CACHE_ALIGN(pinfo->rx_nrfifos * pinfo->rx_fifosize);
         bdp = pinfo->tx_cur = pinfo->tx_bd_base;
         for (i = 0; i < (pinfo->tx_nrfifos - 1); i++, bdp++) {
-                bdp->cbd_bufaddr = virt_to_bus(mem_addr);
+                bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
                 bdp->cbd_sc = BD_SC_INTRPT;
                 mem_addr += pinfo->tx_fifosize;
         }
-        
-        bdp->cbd_bufaddr = virt_to_bus(mem_addr);
+
+        bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
         bdp->cbd_sc = BD_SC_WRAP | BD_SC_INTRPT;
 }
 
@@ -763,6 +801,8 @@ static void cpm_uart_init_smc(struct uart_cpm_port *pinfo)
         /* Using idle charater time requires some additional tuning.  */
         up->smc_mrblr = pinfo->rx_fifosize;
         up->smc_maxidl = pinfo->rx_fifosize;
+        up->smc_brklen = 0;
+        up->smc_brkec = 0;
         up->smc_brkcr = 1;
 
         cpm_line_cr_cmd(line, CPM_CR_INIT_TRX);
@@ -796,7 +836,7 @@ static int cpm_uart_request_port(struct uart_port *port)
         /*
          * Setup any port IO, connect any baud rate generators,
          * etc.  This is expected to be handled by board
-         * dependant code 
+         * dependant code
          */
         if (pinfo->set_lineif)
                 pinfo->set_lineif(pinfo);
@@ -815,6 +855,10 @@ static int cpm_uart_request_port(struct uart_port *port)
                 return ret;
 
         cpm_uart_initbd(pinfo);
+        if (IS_SMC(pinfo))
+                cpm_uart_init_smc(pinfo);
+        else
+                cpm_uart_init_scc(pinfo);
 
         return 0;
 }
@@ -869,7 +913,7 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                 .flags = FLAG_SMC,
                 .tx_nrfifos = TX_NUM_FIFO,
                 .tx_fifosize = TX_BUF_SIZE,
-                .rx_nrfifos = RX_NUM_FIFO, 
+                .rx_nrfifos = RX_NUM_FIFO,
                 .rx_fifosize = RX_BUF_SIZE,
                 .set_lineif = smc1_lineif,
         },
@@ -883,7 +927,7 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                 .flags = FLAG_SMC,
                 .tx_nrfifos = TX_NUM_FIFO,
                 .tx_fifosize = TX_BUF_SIZE,
-                .rx_nrfifos = RX_NUM_FIFO, 
+                .rx_nrfifos = RX_NUM_FIFO,
                 .rx_fifosize = RX_BUF_SIZE,
                 .set_lineif = smc2_lineif,
 #ifdef CONFIG_SERIAL_CPM_ALT_SMC2
@@ -899,9 +943,10 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                 },
                 .tx_nrfifos = TX_NUM_FIFO,
                 .tx_fifosize = TX_BUF_SIZE,
-                .rx_nrfifos = RX_NUM_FIFO, 
+                .rx_nrfifos = RX_NUM_FIFO,
                 .rx_fifosize = RX_BUF_SIZE,
                 .set_lineif = scc1_lineif,
+                .wait_closing = SCC_WAIT_CLOSING,
         },
         [UART_SCC2] = {
                 .port = {
@@ -912,9 +957,10 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                 },
                 .tx_nrfifos = TX_NUM_FIFO,
                 .tx_fifosize = TX_BUF_SIZE,
-                .rx_nrfifos = RX_NUM_FIFO, 
+                .rx_nrfifos = RX_NUM_FIFO,
                 .rx_fifosize = RX_BUF_SIZE,
                 .set_lineif = scc2_lineif,
+                .wait_closing = SCC_WAIT_CLOSING,
         },
         [UART_SCC3] = {
                 .port = {
@@ -925,9 +971,10 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                 },
                 .tx_nrfifos = TX_NUM_FIFO,
                 .tx_fifosize = TX_BUF_SIZE,
-                .rx_nrfifos = RX_NUM_FIFO, 
+                .rx_nrfifos = RX_NUM_FIFO,
                 .rx_fifosize = RX_BUF_SIZE,
                 .set_lineif = scc3_lineif,
+                .wait_closing = SCC_WAIT_CLOSING,
         },
         [UART_SCC4] = {
                 .port = {
@@ -938,9 +985,10 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                 },
                 .tx_nrfifos = TX_NUM_FIFO,
                 .tx_fifosize = TX_BUF_SIZE,
-                .rx_nrfifos = RX_NUM_FIFO, 
+                .rx_nrfifos = RX_NUM_FIFO,
                 .rx_fifosize = RX_BUF_SIZE,
                 .set_lineif = scc4_lineif,
+                .wait_closing = SCC_WAIT_CLOSING,
         },
 };
 
@@ -983,11 +1031,8 @@ static void cpm_uart_console_write(struct console *co, const char *s,
                  * If the buffer address is in the CPM DPRAM, don't
                  * convert it.
                  */
-                if ((uint) (bdp->cbd_bufaddr) > (uint) CPM_ADDR)
-                        cp = (unsigned char *) (bdp->cbd_bufaddr);
-                else
-                        cp = bus_to_virt(bdp->cbd_bufaddr);
-                
+                cp = cpm2cpu_addr(bdp->cbd_bufaddr);
+
                 *cp = *s;
 
                 bdp->cbd_datlen = 1;
@@ -1003,10 +1048,7 @@ static void cpm_uart_console_write(struct console *co, const char *s,
                         while ((bdp->cbd_sc & BD_SC_READY) != 0)
                                 ;
 
-                        if ((uint) (bdp->cbd_bufaddr) > (uint) CPM_ADDR)
-                                cp = (unsigned char *) (bdp->cbd_bufaddr);
-                        else
-                                cp = bus_to_virt(bdp->cbd_bufaddr);
+                        cp = cpm2cpu_addr(bdp->cbd_bufaddr);
 
                         *cp = 13;
                         bdp->cbd_datlen = 1;
@@ -1045,7 +1087,7 @@ static int __init cpm_uart_console_setup(struct console *co, char *options)
         port =
             (struct uart_port *)&cpm_uart_ports[cpm_uart_port_map[co->index]];
         pinfo = (struct uart_cpm_port *)port;
-        
+
         pinfo->flags |= FLAG_CONSOLE;
 
         if (options) {
@@ -1062,7 +1104,7 @@ static int __init cpm_uart_console_setup(struct console *co, char *options)
         /*
          * Setup any port IO, connect any baud rate generators,
          * etc.  This is expected to be handled by board
-         * dependant code 
+         * dependant code
          */
         if (pinfo->set_lineif)
                 pinfo->set_lineif(pinfo);
@@ -1092,14 +1134,14 @@ static int __init cpm_uart_console_setup(struct console *co, char *options)
         return 0;
 }
 
-extern struct uart_driver cpm_reg;
+static struct uart_driver cpm_reg;
 static struct console cpm_scc_uart_console = {
-        .name           "ttyCPM",
-        .write          cpm_uart_console_write,
-        .device         uart_console_device,
-        .setup          cpm_uart_console_setup,
-        .flags          CON_PRINTBUFFER,
-        .index          -1,
+        .name           = "ttyCPM",
+        .write          = cpm_uart_console_write,
+        .device         = uart_console_device,
+        .setup          = cpm_uart_console_setup,
+        .flags          = CON_PRINTBUFFER,
+        .index          = -1,
         .data           = &cpm_reg,
 };
 
diff --git a/drivers/serial/cpm_uart/cpm_uart_cpm1.c b/drivers/serial/cpm_uart/cpm_uart_cpm1.c
index 8efbd6d1d6a4..4b0786e7eb7f 100644
--- a/drivers/serial/cpm_uart/cpm_uart_cpm1.c
+++ b/drivers/serial/cpm_uart/cpm_uart_cpm1.c
@@ -5,7 +5,7 @@
  *
  *  Maintainer: Kumar Gala (kumar.gala@freescale.com) (CPM2)
  *              Pantelis Antoniou (panto@intracom.gr) (CPM1)
- * 
+ *
  *  Copyright (C) 2004 Freescale Semiconductor, Inc.
  *            (C) 2004 Intracom, S.A.
  *
@@ -82,6 +82,17 @@ void cpm_line_cr_cmd(int line, int cmd)
 void smc1_lineif(struct uart_cpm_port *pinfo)
 {
         volatile cpm8xx_t *cp = cpmp;
+
+        (void)cp;       /* fix warning */
+#if defined (CONFIG_MPC885ADS)
+        /* Enable SMC1 transceivers */
+        {
+                cp->cp_pepar |= 0x000000c0;
+                cp->cp_pedir &= ~0x000000c0;
+                cp->cp_peso &= ~0x00000040;
+                cp->cp_peso |= 0x00000080;
+        }
+#elif defined (CONFIG_MPC86XADS)
         unsigned int iobits = 0x000000c0;
 
         if (!pinfo->is_portb) {
@@ -93,41 +104,33 @@ void smc1_lineif(struct uart_cpm_port *pinfo)
                 ((immap_t *)IMAP_ADDR)->im_ioport.iop_padir &= ~iobits;
                 ((immap_t *)IMAP_ADDR)->im_ioport.iop_paodr &= ~iobits;
         }
-
-#ifdef CONFIG_MPC885ADS
-        /* Enable SMC1 transceivers */
-        {
-                volatile uint __iomem *bcsr1 = ioremap(BCSR1, 4);
-                uint tmp;
-
-                tmp = in_be32(bcsr1);
-                tmp &= ~BCSR1_RS232EN_1;
-                out_be32(bcsr1, tmp);
-                iounmap(bcsr1);
-        }
 #endif
-
         pinfo->brg = 1;
 }
 
 void smc2_lineif(struct uart_cpm_port *pinfo)
 {
-#ifdef CONFIG_MPC885ADS
         volatile cpm8xx_t *cp = cpmp;
-        volatile uint __iomem *bcsr1;
-        uint tmp;
 
+        (void)cp;       /* fix warning */
+#if defined (CONFIG_MPC885ADS)
         cp->cp_pepar |= 0x00000c00;
         cp->cp_pedir &= ~0x00000c00;
         cp->cp_peso &= ~0x00000400;
         cp->cp_peso |= 0x00000800;
+#elif defined (CONFIG_MPC86XADS)
+        unsigned int iobits = 0x00000c00;
+
+        if (!pinfo->is_portb) {
+                cp->cp_pbpar |= iobits;
+                cp->cp_pbdir &= ~iobits;
+                cp->cp_pbodr &= ~iobits;
+        } else {
+                ((immap_t *)IMAP_ADDR)->im_ioport.iop_papar |= iobits;
+                ((immap_t *)IMAP_ADDR)->im_ioport.iop_padir &= ~iobits;
+                ((immap_t *)IMAP_ADDR)->im_ioport.iop_paodr &= ~iobits;
+        }
 
-        /* Enable SMC2 transceivers */
-        bcsr1 = ioremap(BCSR1, 4);
-        tmp = in_be32(bcsr1);
-        tmp &= ~BCSR1_RS232EN_2;
-        out_be32(bcsr1, tmp);
-        iounmap(bcsr1);
 #endif
 
         pinfo->brg = 2;
@@ -158,7 +161,7 @@ void scc4_lineif(struct uart_cpm_port *pinfo)
 }
 
 /*
- * Allocate DP-Ram and memory buffers. We need to allocate a transmit and 
+ * Allocate DP-Ram and memory buffers. We need to allocate a transmit and
  * receive buffer descriptors from dual port ram, and a character
  * buffer area from host mem. If we are allocating for the console we need
  * to do it from bootmem
@@ -185,6 +188,8 @@ int cpm_uart_allocbuf(struct uart_cpm_port *pinfo, unsigned int is_con)
         memsz = L1_CACHE_ALIGN(pinfo->rx_nrfifos * pinfo->rx_fifosize) +
             L1_CACHE_ALIGN(pinfo->tx_nrfifos * pinfo->tx_fifosize);
         if (is_con) {
+                /* was hostalloc but changed cause it blows away the */
+                /* large tlb mapping when pinning the kernel area    */
                 mem_addr = (u8 *) cpm_dpram_addr(cpm_dpalloc(memsz, 8));
                 dma_addr = 0;
         } else
diff --git a/drivers/serial/dz.c b/drivers/serial/dz.c
index 97824eeeafae..e63b9dffc8d7 100644
--- a/drivers/serial/dz.c
+++ b/drivers/serial/dz.c
@@ -112,7 +112,7 @@ static inline void dz_out(struct dz_port *dport, unsigned offset,
  * ------------------------------------------------------------
  */
 
-static void dz_stop_tx(struct uart_port *uport, unsigned int tty_stop)
+static void dz_stop_tx(struct uart_port *uport)
 {
         struct dz_port *dport = (struct dz_port *)uport;
         unsigned short tmp, mask = 1 << dport->port.line;
@@ -125,7 +125,7 @@ static void dz_stop_tx(struct uart_port *uport, unsigned int tty_stop)
         spin_unlock_irqrestore(&dport->port.lock, flags);
 }
 
-static void dz_start_tx(struct uart_port *uport, unsigned int tty_start)
+static void dz_start_tx(struct uart_port *uport)
 {
         struct dz_port *dport = (struct dz_port *)uport;
         unsigned short tmp, mask = 1 << dport->port.line;
@@ -290,7 +290,7 @@ static inline void dz_transmit_chars(struct dz_port *dport)
         }
         /* if nothing to do or stopped or hardware stopped */
         if (uart_circ_empty(xmit) || uart_tx_stopped(&dport->port)) {
-                dz_stop_tx(&dport->port, 0);
+                dz_stop_tx(&dport->port);
                 return;
         }
 
@@ -308,7 +308,7 @@ static inline void dz_transmit_chars(struct dz_port *dport)
 
         /* Are we done */
         if (uart_circ_empty(xmit))
-                dz_stop_tx(&dport->port, 0);
+                dz_stop_tx(&dport->port);
 }
 
 /*
@@ -440,7 +440,7 @@ static int dz_startup(struct uart_port *uport)
  */
 static void dz_shutdown(struct uart_port *uport)
 {
-        dz_stop_tx(uport, 0);
+        dz_stop_tx(uport);
 }
 
 /*
diff --git a/drivers/serial/icom.c b/drivers/serial/icom.c
index c112b32764e8..79f8df4d66b7 100644
--- a/drivers/serial/icom.c
+++ b/drivers/serial/icom.c
@@ -989,18 +989,16 @@ static unsigned int icom_get_mctrl(struct uart_port *port)
         return result;
 }
 
-static void icom_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void icom_stop_tx(struct uart_port *port)
 {
         unsigned char cmdReg;
 
-        if (tty_stop) {
-                trace(ICOM_PORT, "STOP", 0);
-                cmdReg = readb(&ICOM_PORT->dram->CmdReg);
-                writeb(cmdReg | CMD_HOLD_XMIT, &ICOM_PORT->dram->CmdReg);
-        }
+        trace(ICOM_PORT, "STOP", 0);
+        cmdReg = readb(&ICOM_PORT->dram->CmdReg);
+        writeb(cmdReg | CMD_HOLD_XMIT, &ICOM_PORT->dram->CmdReg);
 }
 
-static void icom_start_tx(struct uart_port *port, unsigned int tty_start)
+static void icom_start_tx(struct uart_port *port)
 {
         unsigned char cmdReg;
 
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index 01a8726a3f97..8861bcf84adf 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -124,7 +124,7 @@ static void imx_timeout(unsigned long data)
 /*
  * interrupts disabled on entry
  */
-static void imx_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void imx_stop_tx(struct uart_port *port)
 {
         struct imx_port *sport = (struct imx_port *)port;
         UCR1((u32)sport->port.membase) &= ~UCR1_TXMPTYEN;
@@ -165,13 +165,13 @@ static inline void imx_transmit_buffer(struct imx_port *sport)
         } while (!(UTS((u32)sport->port.membase) & UTS_TXFULL));
 
         if (uart_circ_empty(xmit))
-                imx_stop_tx(&sport->port, 0);
+                imx_stop_tx(&sport->port);
 }
 
 /*
  * interrupts disabled on entry
  */
-static void imx_start_tx(struct uart_port *port, unsigned int tty_start)
+static void imx_start_tx(struct uart_port *port)
 {
         struct imx_port *sport = (struct imx_port *)port;
 
@@ -196,7 +196,7 @@ static irqreturn_t imx_txint(int irq, void *dev_id, struct pt_regs *regs)
         }
 
         if (uart_circ_empty(xmit) || uart_tx_stopped(&sport->port)) {
-                imx_stop_tx(&sport->port, 0);
+                imx_stop_tx(&sport->port);
                 goto out;
         }
 
diff --git a/drivers/serial/ioc4_serial.c b/drivers/serial/ioc4_serial.c
index 793c3a7cbe47..0c5c96a582b3 100644
--- a/drivers/serial/ioc4_serial.c
+++ b/drivers/serial/ioc4_serial.c
@@ -2373,10 +2373,9 @@ static unsigned int ic4_tx_empty(struct uart_port *the_port)
 /**
  * ic4_stop_tx - stop the transmitter
  * @port: Port to operate on
- * @tty_stop: Set to 1 if called via uart_stop
  *
  */
-static void ic4_stop_tx(struct uart_port *the_port, unsigned int tty_stop)
+static void ic4_stop_tx(struct uart_port *the_port)
 {
 }
 
@@ -2471,10 +2470,9 @@ static unsigned int ic4_get_mctrl(struct uart_port *the_port)
 /**
  * ic4_start_tx - Start transmitter, flush any output
  * @port: Port to operate on
- * @tty_stop: Set to 1 if called via uart_start
  *
  */
-static void ic4_start_tx(struct uart_port *the_port, unsigned int tty_stop)
+static void ic4_start_tx(struct uart_port *the_port)
 {
         struct ioc4_port *port = get_ioc4_port(the_port);
         unsigned long flags;
diff --git a/drivers/serial/ip22zilog.c b/drivers/serial/ip22zilog.c
index ea5bf4d4daa3..ef132349f310 100644
--- a/drivers/serial/ip22zilog.c
+++ b/drivers/serial/ip22zilog.c
@@ -592,7 +592,7 @@ static void ip22zilog_set_mctrl(struct uart_port *port, unsigned int mctrl)
 }
 
 /* The port lock is held and interrupts are disabled.  */
-static void ip22zilog_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void ip22zilog_stop_tx(struct uart_port *port)
 {
         struct uart_ip22zilog_port *up = (struct uart_ip22zilog_port *) port;
 
@@ -600,7 +600,7 @@ static void ip22zilog_stop_tx(struct uart_port *port, unsigned int tty_stop)
 }
 
 /* The port lock is held and interrupts are disabled.  */
-static void ip22zilog_start_tx(struct uart_port *port, unsigned int tty_start)
+static void ip22zilog_start_tx(struct uart_port *port)
 {
         struct uart_ip22zilog_port *up = (struct uart_ip22zilog_port *) port;
         struct zilog_channel *channel = ZILOG_CHANNEL_FROM_PORT(port);
diff --git a/drivers/serial/jsm/jsm_tty.c b/drivers/serial/jsm/jsm_tty.c
index 98de2258fd06..6fa0d62d6f68 100644
--- a/drivers/serial/jsm/jsm_tty.c
+++ b/drivers/serial/jsm/jsm_tty.c
@@ -113,7 +113,7 @@ static void jsm_tty_set_mctrl(struct uart_port *port, unsigned int mctrl)
         udelay(10);
 }
 
-static void jsm_tty_start_tx(struct uart_port *port, unsigned int tty_start)
+static void jsm_tty_start_tx(struct uart_port *port)
 {
         struct jsm_channel *channel = (struct jsm_channel *)port;
 
@@ -125,7 +125,7 @@ static void jsm_tty_start_tx(struct uart_port *port, unsigned int tty_start)
         jsm_printk(IOCTL, INFO, &channel->ch_bd->pci_dev, "finish\n");
 }
 
-static void jsm_tty_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void jsm_tty_stop_tx(struct uart_port *port)
 {
         struct jsm_channel *channel = (struct jsm_channel *)port;
 
diff --git a/drivers/serial/m32r_sio.c b/drivers/serial/m32r_sio.c
index 0301feacbde4..b0ecc7537ce5 100644
--- a/drivers/serial/m32r_sio.c
+++ b/drivers/serial/m32r_sio.c
@@ -275,7 +275,7 @@ serial_out(struct uart_sio_port *up, int offset, int value)
         __sio_out(value, offset);
 }
 
-static void m32r_sio_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void m32r_sio_stop_tx(struct uart_port *port)
 {
         struct uart_sio_port *up = (struct uart_sio_port *)port;
 
@@ -285,7 +285,7 @@ static void m32r_sio_stop_tx(struct uart_port *port, unsigned int tty_stop)
         }
 }
 
-static void m32r_sio_start_tx(struct uart_port *port, unsigned int tty_start)
+static void m32r_sio_start_tx(struct uart_port *port)
 {
 #ifdef CONFIG_SERIAL_M32R_PLDSIO
         struct uart_sio_port *up = (struct uart_sio_port *)port;
@@ -425,7 +425,7 @@ static _INLINE_ void transmit_chars(struct uart_sio_port *up)
                 return;
         }
         if (uart_circ_empty(xmit) || uart_tx_stopped(&up->port)) {
-                m32r_sio_stop_tx(&up->port, 0);
+                m32r_sio_stop_tx(&up->port);
                 return;
         }
 
@@ -446,7 +446,7 @@ static _INLINE_ void transmit_chars(struct uart_sio_port *up)
         DEBUG_INTR("THRE...");
 
         if (uart_circ_empty(xmit))
-                m32r_sio_stop_tx(&up->port, 0);
+                m32r_sio_stop_tx(&up->port);
 }
 
 /*
@@ -1123,7 +1123,7 @@ static int __init m32r_sio_console_setup(struct console *co, char *options)
         return uart_set_options(port, co, baud, parity, bits, flow);
 }
 
-extern struct uart_driver m32r_sio_reg;
+static struct uart_driver m32r_sio_reg;
 static struct console m32r_sio_console = {
         .name           = "ttyS",
         .write          = m32r_sio_console_write,
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index 2a5cf174ca30..a3cd0ee8486d 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -119,7 +119,7 @@ mpc52xx_uart_get_mctrl(struct uart_port *port)
 }
 
 static void 
-mpc52xx_uart_stop_tx(struct uart_port *port, unsigned int tty_stop)
+mpc52xx_uart_stop_tx(struct uart_port *port)
 {
         /* port->lock taken by caller */
         port->read_status_mask &= ~MPC52xx_PSC_IMR_TXRDY;
@@ -127,7 +127,7 @@ mpc52xx_uart_stop_tx(struct uart_port *port, unsigned int tty_stop)
 }
 
 static void 
-mpc52xx_uart_start_tx(struct uart_port *port, unsigned int tty_start)
+mpc52xx_uart_start_tx(struct uart_port *port)
 {
         /* port->lock taken by caller */
         port->read_status_mask |= MPC52xx_PSC_IMR_TXRDY;
@@ -485,7 +485,7 @@ mpc52xx_uart_int_tx_chars(struct uart_port *port)
 
         /* Nothing to do ? */
         if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
-                mpc52xx_uart_stop_tx(port,0);
+                mpc52xx_uart_stop_tx(port);
                 return 0;
         }
 
@@ -504,7 +504,7 @@ mpc52xx_uart_int_tx_chars(struct uart_port *port)
 
         /* Maybe we're done after all */
         if (uart_circ_empty(xmit)) {
-                mpc52xx_uart_stop_tx(port,0);
+                mpc52xx_uart_stop_tx(port);
                 return 0;
         }
 
diff --git a/drivers/serial/mpsc.c b/drivers/serial/mpsc.c
index e43276c6a954..efe79b1fd431 100644
--- a/drivers/serial/mpsc.c
+++ b/drivers/serial/mpsc.c
@@ -1072,18 +1072,18 @@ mpsc_get_mctrl(struct uart_port *port)
 }
 
 static void
-mpsc_stop_tx(struct uart_port *port, uint tty_start)
+mpsc_stop_tx(struct uart_port *port)
 {
         struct mpsc_port_info *pi = (struct mpsc_port_info *)port;
 
-        pr_debug("mpsc_stop_tx[%d]: tty_start: %d\n", port->line, tty_start);
+        pr_debug("mpsc_stop_tx[%d]\n", port->line);
 
         mpsc_freeze(pi);
         return;
 }
 
 static void
-mpsc_start_tx(struct uart_port *port, uint tty_start)
+mpsc_start_tx(struct uart_port *port)
 {
         struct mpsc_port_info *pi = (struct mpsc_port_info *)port;
 
@@ -1091,7 +1091,7 @@ mpsc_start_tx(struct uart_port *port, uint tty_start)
         mpsc_copy_tx_data(pi);
         mpsc_sdma_start_tx(pi);
 
-        pr_debug("mpsc_start_tx[%d]: tty_start: %d\n", port->line, tty_start);
+        pr_debug("mpsc_start_tx[%d]\n", port->line);
         return;
 }
 
diff --git a/drivers/serial/mux.c b/drivers/serial/mux.c
index dadd7e19714e..189064607709 100644
--- a/drivers/serial/mux.c
+++ b/drivers/serial/mux.c
@@ -111,22 +111,20 @@ static unsigned int mux_get_mctrl(struct uart_port *port)
 /**
  * mux_stop_tx - Stop transmitting characters.
  * @port: Ptr to the uart_port.
- * @tty_stop: tty layer issue this command?
  *
  * The Serial MUX does not support this function.
  */
-static void mux_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void mux_stop_tx(struct uart_port *port)
 {
 }
 
 /**
  * mux_start_tx - Start transmitting characters.
  * @port: Ptr to the uart_port.
- * @tty_start: tty layer issue this command?
  *
  * The Serial Mux does not support this function.
  */
-static void mux_start_tx(struct uart_port *port, unsigned int tty_start)
+static void mux_start_tx(struct uart_port *port)
 {
 }
 
@@ -181,7 +179,7 @@ static void mux_write(struct uart_port *port)
         }
 
         if(uart_circ_empty(xmit) || uart_tx_stopped(port)) {
-                mux_stop_tx(port, 0);
+                mux_stop_tx(port);
                 return;
         }
 
@@ -202,7 +200,7 @@ static void mux_write(struct uart_port *port)
                 uart_write_wakeup(port);
 
         if (uart_circ_empty(xmit))
-                mux_stop_tx(port, 0);
+                mux_stop_tx(port);
 }
 
 /**
diff --git a/drivers/serial/pmac_zilog.c b/drivers/serial/pmac_zilog.c
index 7db2f37532cf..5bfde99e245e 100644
--- a/drivers/serial/pmac_zilog.c
+++ b/drivers/serial/pmac_zilog.c
@@ -630,11 +630,10 @@ static unsigned int pmz_get_mctrl(struct uart_port *port)
 
 /* 
  * Stop TX side. Dealt like sunzilog at next Tx interrupt,
- * though for DMA, we will have to do a bit more. What is
- * the meaning of the tty_stop bit ? XXX
+ * though for DMA, we will have to do a bit more.
  * The port lock is held and interrupts are disabled.
  */
-static void pmz_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void pmz_stop_tx(struct uart_port *port)
 {
         to_pmz(port)->flags |= PMACZILOG_FLAG_TX_STOPPED;
 }
@@ -643,7 +642,7 @@ static void pmz_stop_tx(struct uart_port *port, unsigned int tty_stop)
  * Kick the Tx side.
  * The port lock is held and interrupts are disabled.
  */
-static void pmz_start_tx(struct uart_port *port, unsigned int tty_start)
+static void pmz_start_tx(struct uart_port *port)
 {
         struct uart_pmac_port *uap = to_pmz(port);
         unsigned char status;
diff --git a/drivers/serial/pxa.c b/drivers/serial/pxa.c
index 461c81c93207..eaa0af835290 100644
--- a/drivers/serial/pxa.c
+++ b/drivers/serial/pxa.c
@@ -80,7 +80,7 @@ static void serial_pxa_enable_ms(struct uart_port *port)
         serial_out(up, UART_IER, up->ier);
 }
 
-static void serial_pxa_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void serial_pxa_stop_tx(struct uart_port *port)
 {
         struct uart_pxa_port *up = (struct uart_pxa_port *)port;
 
@@ -185,7 +185,7 @@ static void transmit_chars(struct uart_pxa_port *up)
                 return;
         }
         if (uart_circ_empty(xmit) || uart_tx_stopped(&up->port)) {
-                serial_pxa_stop_tx(&up->port, 0);
+                serial_pxa_stop_tx(&up->port);
                 return;
         }
 
@@ -203,10 +203,10 @@ static void transmit_chars(struct uart_pxa_port *up)
 
 
         if (uart_circ_empty(xmit))
-                serial_pxa_stop_tx(&up->port, 0);
+                serial_pxa_stop_tx(&up->port);
 }
 
-static void serial_pxa_start_tx(struct uart_port *port, unsigned int tty_start)
+static void serial_pxa_start_tx(struct uart_port *port)
 {
         struct uart_pxa_port *up = (struct uart_pxa_port *)port;
 
diff --git a/drivers/serial/s3c2410.c b/drivers/serial/s3c2410.c
index 7365d4b50b95..c361c6fb0809 100644
--- a/drivers/serial/s3c2410.c
+++ b/drivers/serial/s3c2410.c
@@ -246,8 +246,7 @@ static void s3c24xx_serial_rx_disable(struct uart_port *port)
         spin_unlock_irqrestore(&port->lock, flags);
 }
 
-static void
-s3c24xx_serial_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void s3c24xx_serial_stop_tx(struct uart_port *port)
 {
         if (tx_enabled(port)) {
                 disable_irq(TX_IRQ(port));
@@ -257,8 +256,7 @@ s3c24xx_serial_stop_tx(struct uart_port *port, unsigned int tty_stop)
         }
 }
 
-static void
-s3c24xx_serial_start_tx(struct uart_port *port, unsigned int tty_start)
+static void s3c24xx_serial_start_tx(struct uart_port *port)
 {
         if (!tx_enabled(port)) {
                 if (port->flags & UPF_CONS_FLOW)
@@ -424,7 +422,7 @@ static irqreturn_t s3c24xx_serial_tx_chars(int irq, void *id, struct pt_regs *re
         */
 
         if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
-                s3c24xx_serial_stop_tx(port, 0);
+                s3c24xx_serial_stop_tx(port);
                 goto out;
         }
 
@@ -443,7 +441,7 @@ static irqreturn_t s3c24xx_serial_tx_chars(int irq, void *id, struct pt_regs *re
                 uart_write_wakeup(port);
 
         if (uart_circ_empty(xmit))
-                s3c24xx_serial_stop_tx(port, 0);
+                s3c24xx_serial_stop_tx(port);
 
  out:
         return IRQ_HANDLED;
diff --git a/drivers/serial/sa1100.c b/drivers/serial/sa1100.c
index 98641c3f5ab9..1225b14f6e9d 100644
--- a/drivers/serial/sa1100.c
+++ b/drivers/serial/sa1100.c
@@ -145,7 +145,7 @@ static void sa1100_timeout(unsigned long data)
 /*
  * interrupts disabled on entry
  */
-static void sa1100_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void sa1100_stop_tx(struct uart_port *port)
 {
         struct sa1100_port *sport = (struct sa1100_port *)port;
         u32 utcr3;
@@ -158,7 +158,7 @@ static void sa1100_stop_tx(struct uart_port *port, unsigned int tty_stop)
 /*
  * interrupts may not be disabled on entry
  */
-static void sa1100_start_tx(struct uart_port *port, unsigned int tty_start)
+static void sa1100_start_tx(struct uart_port *port)
 {
         struct sa1100_port *sport = (struct sa1100_port *)port;
         unsigned long flags;
@@ -264,7 +264,7 @@ static void sa1100_tx_chars(struct sa1100_port *sport)
         sa1100_mctrl_check(sport);
 
         if (uart_circ_empty(xmit) || uart_tx_stopped(&sport->port)) {
-                sa1100_stop_tx(&sport->port, 0);
+                sa1100_stop_tx(&sport->port);
                 return;
         }
 
@@ -284,7 +284,7 @@ static void sa1100_tx_chars(struct sa1100_port *sport)
                 uart_write_wakeup(&sport->port);
 
         if (uart_circ_empty(xmit))
-                sa1100_stop_tx(&sport->port, 0);
+                sa1100_stop_tx(&sport->port);
 }
 
 static irqreturn_t sa1100_int(int irq, void *dev_id, struct pt_regs *regs)
diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
index 54699c3a00ab..ac3a0bf924db 100644
--- a/drivers/serial/serial_core.c
+++ b/drivers/serial/serial_core.c
@@ -80,7 +80,7 @@ static void uart_stop(struct tty_struct *tty)
         unsigned long flags;
 
         spin_lock_irqsave(&port->lock, flags);
-        port->ops->stop_tx(port, 1);
+        port->ops->stop_tx(port);
         spin_unlock_irqrestore(&port->lock, flags);
 }
 
@@ -91,7 +91,7 @@ static void __uart_start(struct tty_struct *tty)
 
         if (!uart_circ_empty(&state->info->xmit) && state->info->xmit.buf &&
             !tty->stopped && !tty->hw_stopped)
-                port->ops->start_tx(port, 1);
+                port->ops->start_tx(port);
 }
 
 static void uart_start(struct tty_struct *tty)
@@ -542,7 +542,7 @@ static void uart_send_xchar(struct tty_struct *tty, char ch)
                 port->x_char = ch;
                 if (ch) {
                         spin_lock_irqsave(&port->lock, flags);
-                        port->ops->start_tx(port, 0);
+                        port->ops->start_tx(port);
                         spin_unlock_irqrestore(&port->lock, flags);
                 }
         }
@@ -1146,7 +1146,7 @@ static void uart_set_termios(struct tty_struct *tty, struct termios *old_termios
                 spin_lock_irqsave(&state->port->lock, flags);
                 if (!(state->port->ops->get_mctrl(state->port) & TIOCM_CTS)) {
                         tty->hw_stopped = 1;
-                        state->port->ops->stop_tx(state->port, 0);
+                        state->port->ops->stop_tx(state->port);
                 }
                 spin_unlock_irqrestore(&state->port->lock, flags);
         }
@@ -1869,7 +1869,7 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *port)
                 struct uart_ops *ops = port->ops;
 
                 spin_lock_irq(&port->lock);
-                ops->stop_tx(port, 0);
+                ops->stop_tx(port);
                 ops->set_mctrl(port, 0);
                 ops->stop_rx(port);
                 spin_unlock_irq(&port->lock);
@@ -1935,7 +1935,7 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *port)
                 uart_change_speed(state, NULL);
                 spin_lock_irq(&port->lock);
                 ops->set_mctrl(port, port->mctrl);
-                ops->start_tx(port, 0);
+                ops->start_tx(port);
                 spin_unlock_irq(&port->lock);
         }
 
diff --git a/drivers/serial/serial_lh7a40x.c b/drivers/serial/serial_lh7a40x.c
index 56f269b6bfb1..32f808d157a1 100644
--- a/drivers/serial/serial_lh7a40x.c
+++ b/drivers/serial/serial_lh7a40x.c
@@ -112,13 +112,12 @@ struct uart_port_lh7a40x {
         unsigned int statusPrev; /* Most recently read modem status */
 };
 
-static void lh7a40xuart_stop_tx (struct uart_port* port, unsigned int tty_stop)
+static void lh7a40xuart_stop_tx (struct uart_port* port)
 {
         BIT_CLR (port, UART_R_INTEN, TxInt);
 }
 
-static void lh7a40xuart_start_tx (struct uart_port* port,
-                                  unsigned int tty_start)
+static void lh7a40xuart_start_tx (struct uart_port* port)
 {
         BIT_SET (port, UART_R_INTEN, TxInt);
 
diff --git a/drivers/serial/serial_txx9.c b/drivers/serial/serial_txx9.c
index d085030df70b..49afadbe461b 100644
--- a/drivers/serial/serial_txx9.c
+++ b/drivers/serial/serial_txx9.c
@@ -253,7 +253,7 @@ sio_quot_set(struct uart_txx9_port *up, int quot)
                 sio_out(up, TXX9_SIBGR, 0xff | TXX9_SIBGR_BCLK_T6);
 }
 
-static void serial_txx9_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void serial_txx9_stop_tx(struct uart_port *port)
 {
         struct uart_txx9_port *up = (struct uart_txx9_port *)port;
         unsigned long flags;
@@ -263,7 +263,7 @@ static void serial_txx9_stop_tx(struct uart_port *port, unsigned int tty_stop)
         spin_unlock_irqrestore(&up->port.lock, flags);
 }
 
-static void serial_txx9_start_tx(struct uart_port *port, unsigned int tty_start)
+static void serial_txx9_start_tx(struct uart_port *port)
 {
         struct uart_txx9_port *up = (struct uart_txx9_port *)port;
         unsigned long flags;
@@ -372,7 +372,7 @@ static inline void transmit_chars(struct uart_txx9_port *up)
                 return;
         }
         if (uart_circ_empty(xmit) || uart_tx_stopped(&up->port)) {
-                serial_txx9_stop_tx(&up->port, 0);
+                serial_txx9_stop_tx(&up->port);
                 return;
         }
 
@@ -389,7 +389,7 @@ static inline void transmit_chars(struct uart_txx9_port *up)
                 uart_write_wakeup(&up->port);
 
         if (uart_circ_empty(xmit))
-                serial_txx9_stop_tx(&up->port, 0);
+                serial_txx9_stop_tx(&up->port);
 }
 
 static irqreturn_t serial_txx9_interrupt(int irq, void *dev_id, struct pt_regs *regs)
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index ad5b776d779b..512266307866 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -79,8 +79,8 @@ static struct sci_port *serial_console_port = 0;
 #endif /* CONFIG_SERIAL_SH_SCI_CONSOLE */
 
 /* Function prototypes */
-static void sci_stop_tx(struct uart_port *port, unsigned int tty_stop);
-static void sci_start_tx(struct uart_port *port, unsigned int tty_start);
+static void sci_stop_tx(struct uart_port *port);
+static void sci_start_tx(struct uart_port *port);
 static void sci_start_rx(struct uart_port *port, unsigned int tty_start);
 static void sci_stop_rx(struct uart_port *port);
 static int sci_request_irq(struct sci_port *port);
@@ -455,7 +455,7 @@ static void sci_transmit_chars(struct uart_port *port)
         if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
                 uart_write_wakeup(port);
         if (uart_circ_empty(xmit)) {
-                sci_stop_tx(port, 0);
+                sci_stop_tx(port);
         } else {
                 local_irq_save(flags);
                 ctrl = sci_in(port, SCSCR);
@@ -900,7 +900,7 @@ static unsigned int sci_get_mctrl(struct uart_port *port)
         return TIOCM_DTR | TIOCM_RTS | TIOCM_DSR;
 }
 
-static void sci_start_tx(struct uart_port *port, unsigned int tty_start)
+static void sci_start_tx(struct uart_port *port)
 {
         struct sci_port *s = &sci_ports[port->line];
 
@@ -909,7 +909,7 @@ static void sci_start_tx(struct uart_port *port, unsigned int tty_start)
         enable_irq(s->irqs[SCIx_TXI_IRQ]);
 }
 
-static void sci_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void sci_stop_tx(struct uart_port *port)
 {
         unsigned long flags;
         unsigned short ctrl;
@@ -978,7 +978,7 @@ static void sci_shutdown(struct uart_port *port)
         struct sci_port *s = &sci_ports[port->line];
 
         sci_stop_rx(port);
-        sci_stop_tx(port, 1);
+        sci_stop_tx(port);
         sci_free_irq(s);
 
 #if defined(__H8300S__)
diff --git a/drivers/serial/sn_console.c b/drivers/serial/sn_console.c
index 840815fde49b..313f9df24a2d 100644
--- a/drivers/serial/sn_console.c
+++ b/drivers/serial/sn_console.c
@@ -259,10 +259,9 @@ static unsigned int snp_tx_empty(struct uart_port *port)
 /**
  * snp_stop_tx - stop the transmitter - no-op for us
  * @port: Port to operat eon - we ignore - no-op function
- * @tty_stop: Set to 1 if called via uart_stop
  *
  */
-static void snp_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void snp_stop_tx(struct uart_port *port)
 {
 }
 
@@ -325,10 +324,9 @@ static void snp_stop_rx(struct uart_port *port)
 /**
  * snp_start_tx - Start transmitter
  * @port: Port to operate on
- * @tty_stop: Set to 1 if called via uart_start
  *
  */
-static void snp_start_tx(struct uart_port *port, unsigned int tty_stop)
+static void snp_start_tx(struct uart_port *port)
 {
         if (sal_console_port.sc_ops->sal_wakeup_transmit)
                 sal_console_port.sc_ops->sal_wakeup_transmit(&sal_console_port,
@@ -615,7 +613,7 @@ static void sn_transmit_chars(struct sn_cons_port *port, int raw)
                 uart_write_wakeup(&port->sc_port);
 
         if (uart_circ_empty(xmit))
-                snp_stop_tx(&port->sc_port, 0); /* no-op for us */
+                snp_stop_tx(&port->sc_port);    /* no-op for us */
 }
 
 /**
@@ -1093,6 +1091,7 @@ int __init sn_serial_console_early_setup(void)
                 return -1;
 
         sal_console_port.sc_ops = &poll_ops;
+        spin_lock_init(&sal_console_port.sc_port.lock);
         early_sn_setup();       /* Find SAL entry points */
         register_console(&sal_console_early);
 
diff --git a/drivers/serial/sunsab.c b/drivers/serial/sunsab.c
index 8d198880756a..e971156daa60 100644
--- a/drivers/serial/sunsab.c
+++ b/drivers/serial/sunsab.c
@@ -245,7 +245,7 @@ receive_chars(struct uart_sunsab_port *up,
         return tty;
 }
 
-static void sunsab_stop_tx(struct uart_port *, unsigned int);
+static void sunsab_stop_tx(struct uart_port *);
 static void sunsab_tx_idle(struct uart_sunsab_port *);
 
 static void transmit_chars(struct uart_sunsab_port *up,
@@ -301,7 +301,7 @@ static void transmit_chars(struct uart_sunsab_port *up,
                 uart_write_wakeup(&up->port);
 
         if (uart_circ_empty(xmit))
-                sunsab_stop_tx(&up->port, 0);
+                sunsab_stop_tx(&up->port);
 }
 
 static void check_status(struct uart_sunsab_port *up,
@@ -448,7 +448,7 @@ static unsigned int sunsab_get_mctrl(struct uart_port *port)
 }
 
 /* port->lock held by caller.  */
-static void sunsab_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void sunsab_stop_tx(struct uart_port *port)
 {
         struct uart_sunsab_port *up = (struct uart_sunsab_port *) port;
 
@@ -476,7 +476,7 @@ static void sunsab_tx_idle(struct uart_sunsab_port *up)
 }
 
 /* port->lock held by caller.  */
-static void sunsab_start_tx(struct uart_port *port, unsigned int tty_start)
+static void sunsab_start_tx(struct uart_port *port)
 {
         struct uart_sunsab_port *up = (struct uart_sunsab_port *) port;
         struct circ_buf *xmit = &up->port.info->xmit;
diff --git a/drivers/serial/sunsu.c b/drivers/serial/sunsu.c
index d57a3553aea3..0cc879eb1c02 100644
--- a/drivers/serial/sunsu.c
+++ b/drivers/serial/sunsu.c
@@ -255,21 +255,27 @@ static void disable_rsa(struct uart_sunsu_port *up)
 }
 #endif /* CONFIG_SERIAL_8250_RSA */
 
-static void sunsu_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static inline void __stop_tx(struct uart_sunsu_port *p)
+{
+        if (p->ier & UART_IER_THRI) {
+                p->ier &= ~UART_IER_THRI;
+                serial_out(p, UART_IER, p->ier);
+        }
+}
+
+static void sunsu_stop_tx(struct uart_port *port)
 {
         struct uart_sunsu_port *up = (struct uart_sunsu_port *) port;
 
-        if (up->ier & UART_IER_THRI) {
-                up->ier &= ~UART_IER_THRI;
-                serial_out(up, UART_IER, up->ier);
-        }
-        if (up->port.type == PORT_16C950 && tty_stop) {
+        __stop_tx(up);
+
+        if (up->port.type == PORT_16C950 && tty_stop /*FIXME*/) {
                 up->acr |= UART_ACR_TXDIS;
                 serial_icr_write(up, UART_ACR, up->acr);
         }
 }
 
-static void sunsu_start_tx(struct uart_port *port, unsigned int tty_start)
+static void sunsu_start_tx(struct uart_port *port)
 {
         struct uart_sunsu_port *up = (struct uart_sunsu_port *) port;
 
@@ -280,7 +286,7 @@ static void sunsu_start_tx(struct uart_port *port, unsigned int tty_start)
         /*
          * We only do this from uart_start
          */
-        if (tty_start && up->port.type == PORT_16C950) {
+        if (tty_start && up->port.type == PORT_16C950 /*FIXME*/) {
                 up->acr &= ~UART_ACR_TXDIS;
                 serial_icr_write(up, UART_ACR, up->acr);
         }
@@ -413,8 +419,12 @@ static _INLINE_ void transmit_chars(struct uart_sunsu_port *up)
                 up->port.x_char = 0;
                 return;
         }
-        if (uart_circ_empty(xmit) || uart_tx_stopped(&up->port)) {
-                sunsu_stop_tx(&up->port, 0);
+        if (uart_tx_stopped(&up->port)) {
+                sunsu_stop_tx(&up->port);
+                return;
+        }
+        if (uart_circ_empty(xmit)) {
+                __stop_tx(up);
                 return;
         }
 
@@ -431,7 +441,7 @@ static _INLINE_ void transmit_chars(struct uart_sunsu_port *up)
                 uart_write_wakeup(&up->port);
 
         if (uart_circ_empty(xmit))
-                sunsu_stop_tx(&up->port, 0);
+                __stop_tx(up);
 }
 
 static _INLINE_ void check_modem_status(struct uart_sunsu_port *up)
diff --git a/drivers/serial/sunzilog.c b/drivers/serial/sunzilog.c
index bff42a7b89d0..d75445738c88 100644
--- a/drivers/serial/sunzilog.c
+++ b/drivers/serial/sunzilog.c
@@ -684,7 +684,7 @@ static void sunzilog_set_mctrl(struct uart_port *port, unsigned int mctrl)
 }
 
 /* The port lock is held and interrupts are disabled.  */
-static void sunzilog_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void sunzilog_stop_tx(struct uart_port *port)
 {
         struct uart_sunzilog_port *up = (struct uart_sunzilog_port *) port;
 
@@ -692,7 +692,7 @@ static void sunzilog_stop_tx(struct uart_port *port, unsigned int tty_stop)
 }
 
 /* The port lock is held and interrupts are disabled.  */
-static void sunzilog_start_tx(struct uart_port *port, unsigned int tty_start)
+static void sunzilog_start_tx(struct uart_port *port)
 {
         struct uart_sunzilog_port *up = (struct uart_sunzilog_port *) port;
         struct zilog_channel __iomem *channel = ZILOG_CHANNEL_FROM_PORT(port);
diff --git a/drivers/serial/uart00.c b/drivers/serial/uart00.c
index 186f1300cead..47b504ff38b2 100644
--- a/drivers/serial/uart00.c
+++ b/drivers/serial/uart00.c
@@ -87,7 +87,7 @@
 #define UART_TX_READY(s)        (((s) & UART_TSR_TX_LEVEL_MSK) < 15)
 //#define UART_TX_EMPTY(p)      ((UART_GET_FR(p) & UART00_UARTFR_TMSK) == 0)
 
-static void uart00_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void uart00_stop_tx(struct uart_port *port)
 {
         UART_PUT_IEC(port, UART_IEC_TIE_MSK);
 }
@@ -199,7 +199,7 @@ static void uart00_tx_chars(struct uart_port *port)
                 return;
         }
         if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
-                uart00_stop_tx(port, 0);
+                uart00_stop_tx(port);
                 return;
         }
 
@@ -218,10 +218,10 @@ static void uart00_tx_chars(struct uart_port *port)
                 uart_write_wakeup(port);
 
         if (uart_circ_empty(xmit))
-                uart00_stop_tx(port, 0);
+                uart00_stop_tx(port);
 }
 
-static void uart00_start_tx(struct uart_port *port, unsigned int tty_start)
+static void uart00_start_tx(struct uart_port *port)
 {
         UART_PUT_IES(port, UART_IES_TIE_MSK);
         uart00_tx_chars(port);
diff --git a/drivers/serial/v850e_uart.c b/drivers/serial/v850e_uart.c
index bb482780a41d..9378895a8d56 100644
--- a/drivers/serial/v850e_uart.c
+++ b/drivers/serial/v850e_uart.c
@@ -240,7 +240,7 @@ console_initcall(v850e_uart_console_init);
 
 /* TX/RX interrupt handlers.  */
 
-static void v850e_uart_stop_tx (struct uart_port *port, unsigned tty_stop);
+static void v850e_uart_stop_tx (struct uart_port *port);
 
 void v850e_uart_tx (struct uart_port *port)
 {
@@ -339,14 +339,14 @@ static unsigned v850e_uart_get_mctrl (struct uart_port *port)
         return mctrl;
 }
 
-static void v850e_uart_start_tx (struct uart_port *port, unsigned tty_start)
+static void v850e_uart_start_tx (struct uart_port *port)
 {
         v850e_intc_disable_irq (V850E_UART_TX_IRQ (port->line));
         v850e_uart_tx (port);
         v850e_intc_enable_irq (V850E_UART_TX_IRQ (port->line));
 }
 
-static void v850e_uart_stop_tx (struct uart_port *port, unsigned tty_stop)
+static void v850e_uart_stop_tx (struct uart_port *port)
 {
         v850e_intc_disable_irq (V850E_UART_TX_IRQ (port->line));
 }
diff --git a/drivers/serial/vr41xx_siu.c b/drivers/serial/vr41xx_siu.c
index 1f985327b0d4..0c5d65a08f6e 100644
--- a/drivers/serial/vr41xx_siu.c
+++ b/drivers/serial/vr41xx_siu.c
@@ -284,7 +284,7 @@ static unsigned int siu_get_mctrl(struct uart_port *port)
         return mctrl;
 }
 
-static void siu_stop_tx(struct uart_port *port, unsigned int tty_stop)
+static void siu_stop_tx(struct uart_port *port)
 {
         unsigned long flags;
         uint8_t ier;
@@ -298,7 +298,7 @@ static void siu_stop_tx(struct uart_port *port, unsigned int tty_stop)
         spin_unlock_irqrestore(&port->lock, flags);
 }
 
-static void siu_start_tx(struct uart_port *port, unsigned int tty_start)
+static void siu_start_tx(struct uart_port *port)
 {
         unsigned long flags;
         uint8_t ier;
@@ -458,7 +458,7 @@ static inline void transmit_chars(struct uart_port *port)
         }
 
         if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
-                siu_stop_tx(port, 0);
+                siu_stop_tx(port);
                 return;
         }
 
@@ -474,7 +474,7 @@ static inline void transmit_chars(struct uart_port *port)
                 uart_write_wakeup(port);
 
         if (uart_circ_empty(xmit))
-                siu_stop_tx(port, 0);
+                siu_stop_tx(port);
 }
 
 static irqreturn_t siu_interrupt(int irq, void *dev_id, struct pt_regs *regs)
diff --git a/drivers/usb/host/ehci-dbg.c b/drivers/usb/host/ehci-dbg.c
index 50cb01831075..b01efb6b36f6 100644
--- a/drivers/usb/host/ehci-dbg.c
+++ b/drivers/usb/host/ehci-dbg.c
@@ -527,7 +527,7 @@ show_periodic (struct class_device *class_dev, char *buf)
                                                 p.qh->period,
                                                 le32_to_cpup (&p.qh->hw_info2)
                                                         /* uframe masks */
-                                                        & 0xffff,
+                                                        & (QH_CMASK | QH_SMASK),
                                                 p.qh);
                                 size -= temp;
                                 next += temp;
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 4f97a4ad1ed3..20df01a79b2e 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -222,7 +222,7 @@ __acquires(ehci->lock)
                 struct ehci_qh  *qh = (struct ehci_qh *) urb->hcpriv;
 
                 /* S-mask in a QH means it's an interrupt urb */
-                if ((qh->hw_info2 & __constant_cpu_to_le32 (0x00ff)) != 0) {
+                if ((qh->hw_info2 & __constant_cpu_to_le32 (QH_SMASK)) != 0) {
 
                         /* ... update hc-wide periodic stats (for usbfs) */
                         ehci_to_hcd(ehci)->self.bandwidth_int_reqs--;
@@ -428,7 +428,8 @@ halt:
                         /* should be rare for periodic transfers,
                          * except maybe high bandwidth ...
                          */
-                        if (qh->period) {
+                        if ((__constant_cpu_to_le32 (QH_SMASK)
+                                        & qh->hw_info2) != 0) {
                                 intr_deschedule (ehci, qh);
                                 (void) qh_schedule (ehci, qh);
                         } else
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index 9af4f64532a9..b56f25864ed6 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -301,7 +301,7 @@ static int qh_link_periodic (struct ehci_hcd *ehci, struct ehci_qh *qh)
 
         dev_dbg (&qh->dev->dev,
                 "link qh%d-%04x/%p start %d [%d/%d us]\n",
-                period, le32_to_cpup (&qh->hw_info2) & 0xffff,
+                period, le32_to_cpup (&qh->hw_info2) & (QH_CMASK | QH_SMASK),
                 qh, qh->start, qh->usecs, qh->c_usecs);
 
         /* high bandwidth, or otherwise every microframe */
@@ -385,7 +385,8 @@ static void qh_unlink_periodic (struct ehci_hcd *ehci, struct ehci_qh *qh)
 
         dev_dbg (&qh->dev->dev,
                 "unlink qh%d-%04x/%p start %d [%d/%d us]\n",
-                qh->period, le32_to_cpup (&qh->hw_info2) & 0xffff,
+                qh->period,
+                le32_to_cpup (&qh->hw_info2) & (QH_CMASK | QH_SMASK),
                 qh, qh->start, qh->usecs, qh->c_usecs);
 
         /* qh->qh_next still "live" to HC */
@@ -411,7 +412,7 @@ static void intr_deschedule (struct ehci_hcd *ehci, struct ehci_qh *qh)
          * active high speed queues may need bigger delays...
          */
         if (list_empty (&qh->qtd_list)
-                        || (__constant_cpu_to_le32 (0x0ff << 8)
+                        || (__constant_cpu_to_le32 (QH_CMASK)
                                         & qh->hw_info2) != 0)
                 wait = 2;
         else
@@ -533,7 +534,7 @@ static int qh_schedule (struct ehci_hcd *ehci, struct ehci_qh *qh)
 
         /* reuse the previous schedule slots, if we can */
         if (frame < qh->period) {
-                uframe = ffs (le32_to_cpup (&qh->hw_info2) & 0x00ff);
+                uframe = ffs (le32_to_cpup (&qh->hw_info2) & QH_SMASK);
                 status = check_intr_schedule (ehci, frame, --uframe,
                                 qh, &c_mask);
         } else {
@@ -569,10 +570,10 @@ static int qh_schedule (struct ehci_hcd *ehci, struct ehci_qh *qh)
                 qh->start = frame;
 
                 /* reset S-frame and (maybe) C-frame masks */
-                qh->hw_info2 &= __constant_cpu_to_le32 (~0xffff);
+                qh->hw_info2 &= __constant_cpu_to_le32(~(QH_CMASK | QH_SMASK));
                 qh->hw_info2 |= qh->period
                         ? cpu_to_le32 (1 << uframe)
-                        : __constant_cpu_to_le32 (0xff);
+                        : __constant_cpu_to_le32 (QH_SMASK);
                 qh->hw_info2 |= c_mask;
         } else
                 ehci_dbg (ehci, "reused qh %p schedule\n", qh);
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index 4df498231752..a7542157534c 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -385,6 +385,11 @@ struct ehci_qh {
         __le32                  hw_info1;        /* see EHCI 3.6.2 */
 #define QH_HEAD         0x00008000
         __le32                  hw_info2;        /* see EHCI 3.6.2 */
+#define QH_SMASK        0x000000ff
+#define QH_CMASK        0x0000ff00
+#define QH_HUBADDR      0x007f0000
+#define QH_HUBPORT      0x3f800000
+#define QH_MULT         0xc0000000
         __le32                  hw_current;      /* qtd list - see EHCI 3.6.4 */
         
         /* qtd overlay (hardware parts of a struct ehci_qtd) */
diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
index 50b1970fe6b6..76cb496c5836 100644
--- a/drivers/usb/host/isp116x-hcd.c
+++ b/drivers/usb/host/isp116x-hcd.c
@@ -229,9 +229,11 @@ static void preproc_atl_queue(struct isp116x *isp116x)
         struct isp116x_ep *ep;
         struct urb *urb;
         struct ptd *ptd;
-        u16 toggle = 0, dir = PTD_DIR_SETUP, len;
+        u16 len;
 
         for (ep = isp116x->atl_active; ep; ep = ep->active) {
+                u16 toggle = 0, dir = PTD_DIR_SETUP;
+
                 BUG_ON(list_empty(&ep->hep->urb_list));
                 urb = container_of(ep->hep->urb_list.next,
                                    struct urb, urb_list);
diff --git a/drivers/usb/input/wacom.c b/drivers/usb/input/wacom.c
index 02412e31a46b..3b266af3048a 100644
--- a/drivers/usb/input/wacom.c
+++ b/drivers/usb/input/wacom.c
@@ -342,9 +342,6 @@ static void wacom_graphire_irq(struct urb *urb, struct pt_regs *regs)
                 goto exit;
         }
 
-        x = le16_to_cpu(*(__le16 *) &data[2]);
-        y = le16_to_cpu(*(__le16 *) &data[4]);
-
         input_regs(dev, regs);
 
         if (data[1] & 0x10) { /* in prox */
@@ -373,15 +370,17 @@ static void wacom_graphire_irq(struct urb *urb, struct pt_regs *regs)
                 }
         }
 
-        if (data[1] & 0x80) {
+        if (data[1] & 0x90) {
+                x = le16_to_cpu(*(__le16 *) &data[2]);
+                y = le16_to_cpu(*(__le16 *) &data[4]);
                 input_report_abs(dev, ABS_X, x);
                 input_report_abs(dev, ABS_Y, y);
-        }
-        if (wacom->tool[0] != BTN_TOOL_MOUSE) {
-                input_report_abs(dev, ABS_PRESSURE, le16_to_cpu(*(__le16 *) &data[6]));
-                input_report_key(dev, BTN_TOUCH, data[1] & 0x01);
-                input_report_key(dev, BTN_STYLUS, data[1] & 0x02);
-                input_report_key(dev, BTN_STYLUS2, data[1] & 0x04);
+                if (wacom->tool[0] != BTN_TOOL_MOUSE) {
+                        input_report_abs(dev, ABS_PRESSURE, le16_to_cpu(*(__le16 *) &data[6]));
+                        input_report_key(dev, BTN_TOUCH, data[1] & 0x01);
+                        input_report_key(dev, BTN_STYLUS, data[1] & 0x02);
+                        input_report_key(dev, BTN_STYLUS2, data[1] & 0x04);
+                }
         }
 
         input_report_key(dev, wacom->tool[0], data[1] & 0x10);
@@ -568,7 +567,7 @@ static void wacom_intuos_irq(struct urb *urb, struct pt_regs *regs)
 
         /* Cintiq doesn't send data when RDY bit isn't set */
         if ((wacom->features->type == CINTIQ) && !(data[1] & 0x40))
-                return;
+                goto exit;
 
         if (wacom->features->type >= INTUOS3) {
                 input_report_abs(dev, ABS_X, (data[2] << 9) | (data[3] << 1) | ((data[9] >> 1) & 1));
diff --git a/drivers/usb/mon/Kconfig b/drivers/usb/mon/Kconfig
index 777642e26b9a..deb9ddffa402 100644
--- a/drivers/usb/mon/Kconfig
+++ b/drivers/usb/mon/Kconfig
@@ -9,9 +9,8 @@ config USB_MON
         help
           If you say Y here, a component which captures the USB traffic
           between peripheral-specific drivers and HC drivers will be built.
-          The USB_MON is similar in spirit and may be compatible with Dave
-          Harding's USBMon.
+          For more information, see <file:Documentation/usb/usbmon.txt>.
 
-          This is somewhat experimental at this time, but it should be safe,
-          as long as you aren't using modular USB and try to remove this
-          module.
+          This is somewhat experimental at this time, but it should be safe.
+
+          If unsure, say Y.
diff --git a/drivers/usb/mon/Makefile b/drivers/usb/mon/Makefile
index f18d10ce91f9..b0015b8a1d1f 100644
--- a/drivers/usb/mon/Makefile
+++ b/drivers/usb/mon/Makefile
@@ -4,4 +4,5 @@
 
 usbmon-objs     := mon_main.o mon_stat.o mon_text.o
 
+# This does not use CONFIG_USB_MON because we want this to use a tristate.
 obj-$(CONFIG_USB)       += usbmon.o
diff --git a/drivers/usb/mon/mon_main.c b/drivers/usb/mon/mon_main.c
index aa9d00808e4e..508a21028db4 100644
--- a/drivers/usb/mon/mon_main.c
+++ b/drivers/usb/mon/mon_main.c
@@ -2,6 +2,8 @@
  * The USB Monitor, inspired by Dave Harding's USBMon.
  *
  * mon_main.c: Main file, module initiation and exit, registrations, etc.
+ *
+ * Copyright (C) 2005 Pete Zaitcev (zaitcev@redhat.com)
  */
 
 #include <linux/kernel.h>
@@ -311,7 +313,7 @@ static int __init mon_init(void)
 
         mondir = debugfs_create_dir("usbmon", NULL);
         if (IS_ERR(mondir)) {
-                printk(KERN_NOTICE TAG ": debugs is not available\n");
+                printk(KERN_NOTICE TAG ": debugfs is not available\n");
                 return -ENODEV;
         }
         if (mondir == NULL) {
diff --git a/drivers/usb/mon/usb_mon.h b/drivers/usb/mon/usb_mon.h
index ed35c18a5c44..9b06784d2c48 100644
--- a/drivers/usb/mon/usb_mon.h
+++ b/drivers/usb/mon/usb_mon.h
@@ -1,5 +1,7 @@
 /*
  * The USB Monitor, inspired by Dave Harding's USBMon.
+ *
+ * Copyright (C) 2005 Pete Zaitcev (zaitcev@redhat.com)
  */
 
 #ifndef __USB_MON_H
diff --git a/drivers/usb/net/usbnet.c b/drivers/usb/net/usbnet.c
index 576f3b852fce..a2f67245f6da 100644
--- a/drivers/usb/net/usbnet.c
+++ b/drivers/usb/net/usbnet.c
@@ -1922,7 +1922,7 @@ static int genelink_rx_fixup (struct usbnet *dev, struct sk_buff *skb)
 
                         // copy the packet data to the new skb
                         memcpy(skb_put(gl_skb, size), packet->packet_data, size);
-                        skb_return (dev, skb);
+                        skb_return (dev, gl_skb);
                 }
 
                 // advance to the next packet
@@ -2903,19 +2903,18 @@ static struct net_device_stats *usbnet_get_stats (struct net_device *net)
  * completion callbacks.  2.5 should have fixed those bugs...
  */
 
-static void defer_bh (struct usbnet *dev, struct sk_buff *skb)
+static void defer_bh(struct usbnet *dev, struct sk_buff *skb, struct sk_buff_head *list)
 {
-        struct sk_buff_head     *list = skb->list;
         unsigned long           flags;
 
-        spin_lock_irqsave (&list->lock, flags);
-        __skb_unlink (skb, list);
-        spin_unlock (&list->lock);
-        spin_lock (&dev->done.lock);
-        __skb_queue_tail (&dev->done, skb);
+        spin_lock_irqsave(&list->lock, flags);
+        __skb_unlink(skb, list);
+        spin_unlock(&list->lock);
+        spin_lock(&dev->done.lock);
+        __skb_queue_tail(&dev->done, skb);
         if (dev->done.qlen == 1)
-                tasklet_schedule (&dev->bh);
-        spin_unlock_irqrestore (&dev->done.lock, flags);
+                tasklet_schedule(&dev->bh);
+        spin_unlock_irqrestore(&dev->done.lock, flags);
 }
 
 /* some work can't be done in tasklets, so we use keventd
@@ -3120,7 +3119,7 @@ block:
                 break;
         }
 
-        defer_bh (dev, skb);
+        defer_bh(dev, skb, &dev->rxq);
 
         if (urb) {
                 if (netif_running (dev->net)
@@ -3490,7 +3489,7 @@ static void tx_complete (struct urb *urb, struct pt_regs *regs)
 
         urb->dev = NULL;
         entry->state = tx_done;
-        defer_bh (dev, skb);
+        defer_bh(dev, skb, &dev->txq);
 }
 
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/net/zd1201.c b/drivers/usb/net/zd1201.c
index 29cd801eb958..e32a80b39182 100644
--- a/drivers/usb/net/zd1201.c
+++ b/drivers/usb/net/zd1201.c
@@ -346,8 +346,7 @@ static void zd1201_usbrx(struct urb *urb, struct pt_regs *regs)
                         if (datalen<14)
                                 goto resubmit;
                         if ((seq & IEEE802_11_SCTL_FRAG) == 0) {
-                                frag = kmalloc(sizeof(struct zd1201_frag*),
-                                    GFP_ATOMIC);
+                                frag = kmalloc(sizeof(*frag), GFP_ATOMIC);
                                 if (!frag)
                                         goto resubmit;
                                 skb = dev_alloc_skb(IEEE802_11_DATA_LEN +14+2);
diff --git a/drivers/video/console/Kconfig b/drivers/video/console/Kconfig
index cbff98337aa6..5fe182d6e4ab 100644
--- a/drivers/video/console/Kconfig
+++ b/drivers/video/console/Kconfig
@@ -6,7 +6,7 @@ menu "Console display driver support"
 
 config VGA_CONSOLE
         bool "VGA text console" if EMBEDDED || !X86
-        depends on !ARCH_ACORN && !ARCH_EBSA110 && !4xx && !8xx && !SPARC32 && !SPARC64 && !M68K && !PARISC
+        depends on !ARCH_ACORN && !ARCH_EBSA110 && !4xx && !8xx && !SPARC32 && !SPARC64 && !M68K && !PARISC && !ARCH_VERSATILE
         default y
         help
           Saying Y here will allow you to use Linux in text mode through a
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index d2e19f6dd72c..4ff853fbe0be 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -628,7 +628,7 @@ fb_pan_display(struct fb_info *info, struct fb_var_screeninfo *var)
 int
 fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
 {
-        int err;
+        int err, flags = info->flags;
 
         if (var->activate & FB_ACTIVATE_INV_MODE) {
                 struct fb_videomode mode1, mode2;
@@ -682,7 +682,7 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
                             !list_empty(&info->modelist))
                                 err = fb_add_videomode(&mode, &info->modelist);
 
-                        if (!err && info->flags & FBINFO_MISC_USEREVENT) {
+                        if (!err && (flags & FBINFO_MISC_USEREVENT)) {
                                 struct fb_event event;
 
                                 info->flags &= ~FBINFO_MISC_USEREVENT;
diff --git a/drivers/video/intelfb/intelfbdrv.c b/drivers/video/intelfb/intelfbdrv.c
index 298bc9cd99e7..a112a1786855 100644
--- a/drivers/video/intelfb/intelfbdrv.c
+++ b/drivers/video/intelfb/intelfbdrv.c
@@ -583,23 +583,6 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                 return -ENODEV;
         }
 
-        /* Map the fb and MMIO regions */
-        dinfo->aperture.virtual = (u8 __iomem *)ioremap_nocache
-                (dinfo->aperture.physical, dinfo->aperture.size);
-        if (!dinfo->aperture.virtual) {
-                ERR_MSG("Cannot remap FB region.\n");
-                cleanup(dinfo);
-                return -ENODEV;
-        }
-        dinfo->mmio_base =
-                (u8 __iomem *)ioremap_nocache(dinfo->mmio_base_phys,
-                                               INTEL_REG_SIZE);
-        if (!dinfo->mmio_base) {
-                ERR_MSG("Cannot remap MMIO region.\n");
-                cleanup(dinfo);
-                return -ENODEV;
-        }
-
         /* Get the chipset info. */
         dinfo->pci_chipset = pdev->device;
 
@@ -630,9 +613,15 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                 dinfo->accel = 0;
         }
 
+        if (MB(voffset) < stolen_size)
+                offset = (stolen_size >> 12);
+        else
+                offset = ROUND_UP_TO_PAGE(MB(voffset))/GTT_PAGE_SIZE;
+
         /* Framebuffer parameters - Use all the stolen memory if >= vram */
-        if (ROUND_UP_TO_PAGE(stolen_size) >= MB(vram)) {
+        if (ROUND_UP_TO_PAGE(stolen_size) >= ((offset << 12) +  MB(vram))) {
                 dinfo->fb.size = ROUND_UP_TO_PAGE(stolen_size);
+                dinfo->fb.offset = 0;
                 dinfo->fbmem_gart = 0;
         } else {
                 dinfo->fb.size =  MB(vram);
@@ -663,11 +652,6 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                 return -ENODEV;
         }
 
-        if (MB(voffset) < stolen_size)
-                offset = (stolen_size >> 12);
-        else
-                offset = ROUND_UP_TO_PAGE(MB(voffset))/GTT_PAGE_SIZE;
-
         /* set the mem offsets - set them after the already used pages */
         if (dinfo->accel) {
                 dinfo->ring.offset = offset + gtt_info.current_memory;
@@ -682,6 +666,26 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                         + (dinfo->cursor.size >> 12);
         }
 
+        /* Map the fb and MMIO regions */
+        /* ioremap only up to the end of used aperture */
+        dinfo->aperture.virtual = (u8 __iomem *)ioremap_nocache
+                (dinfo->aperture.physical, (dinfo->fb.offset << 12)
+                 + dinfo->fb.size);
+        if (!dinfo->aperture.virtual) {
+                ERR_MSG("Cannot remap FB region.\n");
+                cleanup(dinfo);
+                return -ENODEV;
+        }
+
+        dinfo->mmio_base =
+                (u8 __iomem *)ioremap_nocache(dinfo->mmio_base_phys,
+                                               INTEL_REG_SIZE);
+        if (!dinfo->mmio_base) {
+                ERR_MSG("Cannot remap MMIO region.\n");
+                cleanup(dinfo);
+                return -ENODEV;
+        }
+
         /* Allocate memories (which aren't stolen) */
         if (dinfo->accel) {
                 if (!(dinfo->gtt_ring_mem =
diff --git a/drivers/video/modedb.c b/drivers/video/modedb.c
index fbf659b6dab0..3edc9f49344b 100644
--- a/drivers/video/modedb.c
+++ b/drivers/video/modedb.c
@@ -246,6 +246,11 @@ static const struct fb_videomode modedb[] = {
         /* 480x300 @ 72 Hz, 48.0 kHz hsync */
         NULL, 72, 480, 300, 33386, 40, 24, 11, 19, 80, 3,
         0, FB_VMODE_DOUBLE
+    }, {
+        /* 1920x1200 @ 60 Hz, 74.5 Khz hsync */
+        NULL, 60, 1920, 1200, 5177, 128, 336, 1, 38, 208, 3,
+        FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
+        FB_VMODE_NONINTERLACED
     },
 };
 
diff --git a/drivers/video/nvidia/nvidia.c b/drivers/video/nvidia/nvidia.c
index b2e6b2407869..52b16850a54e 100644
--- a/drivers/video/nvidia/nvidia.c
+++ b/drivers/video/nvidia/nvidia.c
@@ -1324,6 +1324,13 @@ static int __devinit nvidia_set_fbinfo(struct fb_info *info)
 
                 fb_videomode_to_var(&nvidiafb_default_var, &modedb);
                 nvidiafb_default_var.bits_per_pixel = 8;
+        } else if (par->fpWidth && par->fpHeight) {
+                char buf[16];
+
+                memset(buf, 0, 16);
+                snprintf(buf, 15, "%dx%d", par->fpWidth, par->fpHeight);
+                fb_find_mode(&nvidiafb_default_var, info, buf, specs->modedb,
+                             specs->modedb_len, &modedb, 8);
         }
 
         if (mode_option)
diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c
index 16e37a535d85..30112816420c 100644
--- a/drivers/video/pxafb.c
+++ b/drivers/video/pxafb.c
@@ -717,6 +717,9 @@ static void pxafb_enable_controller(struct pxafb_info *fbi)
         DPRINTK("reg_lccr2 0x%08x\n", (unsigned int) fbi->reg_lccr2);
         DPRINTK("reg_lccr3 0x%08x\n", (unsigned int) fbi->reg_lccr3);
 
+        /* enable LCD controller clock */
+        pxa_set_cken(CKEN16_LCD, 1);
+
         /* Sequence from 11.7.10 */
         LCCR3 = fbi->reg_lccr3;
         LCCR2 = fbi->reg_lccr2;
@@ -750,6 +753,9 @@ static void pxafb_disable_controller(struct pxafb_info *fbi)
 
         schedule_timeout(20 * HZ / 1000);
         remove_wait_queue(&fbi->ctrlr_wait, &wait);
+
+        /* disable LCD controller clock */
+        pxa_set_cken(CKEN16_LCD, 0);
 }
 
 /*
@@ -1299,8 +1305,6 @@ int __init pxafb_probe(struct device *dev)
                 ret = -ENOMEM;
                 goto failed;
         }
-        /* enable LCD controller clock */
-        pxa_set_cken(CKEN16_LCD, 1);
 
         ret = request_irq(IRQ_LCD, pxafb_handle_irq, SA_INTERRUPT, "LCD", fbi);
         if (ret) {
diff --git a/drivers/video/radeonfb.c b/drivers/video/radeonfb.c
index c46387024b1d..a78b9bd8f897 100644
--- a/drivers/video/radeonfb.c
+++ b/drivers/video/radeonfb.c
@@ -80,7 +80,7 @@
 #include <video/radeon.h>
 #include <linux/radeonfb.h>
 
-#define DEBUG   1
+#define DEBUG  0
 
 #if DEBUG
 #define RTRACE          printk
diff --git a/drivers/video/sa1100fb.c b/drivers/video/sa1100fb.c
index 2d29db7ef800..beeec7b51425 100644
--- a/drivers/video/sa1100fb.c
+++ b/drivers/video/sa1100fb.c
@@ -598,7 +598,7 @@ sa1100fb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
  *    requests for the LCD controller.  If we hit this, it means we're
  *    doing nothing but LCD DMA.
  */
-static unsigned int sa1100fb_display_dma_period(struct fb_var_screeninfo *var)
+static inline unsigned int sa1100fb_display_dma_period(struct fb_var_screeninfo *var)
 {
         /*
          * Period = pixclock * bits_per_byte * bytes_per_transfer
diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
index 8a9c42822502..0bbf029b1ef1 100644
--- a/drivers/w1/w1.c
+++ b/drivers/w1/w1.c
@@ -593,7 +593,7 @@ void w1_search(struct w1_master *dev, w1_slave_found_callback cb)
                  * Return 0 - device(s) present, 1 - no devices present.
                  */
                 if (w1_reset_bus(dev)) {
-                        dev_info(&dev->dev, "No devices present on the wire.\n");
+                        dev_dbg(&dev->dev, "No devices present on the wire.\n");
                         break;
                 }
 
diff --git a/drivers/w1/w1_int.c b/drivers/w1/w1_int.c
index b5a5e04b6d37..498ad505fa5f 100644
--- a/drivers/w1/w1_int.c
+++ b/drivers/w1/w1_int.c
@@ -86,9 +86,9 @@ static struct w1_master * w1_alloc_dev(u32 id, int slave_count, int slave_ttl,
 
         dev->driver = driver;
 
-        dev->groups = 23;
+        dev->groups = 1;
         dev->seq = 1;
-        dev->nls = netlink_kernel_create(NETLINK_W1, NULL);
+        dev->nls = netlink_kernel_create(NETLINK_W1, 1, NULL, THIS_MODULE);
         if (!dev->nls) {
                 printk(KERN_ERR "Failed to create new netlink socket(%u) for w1 master %s.\n",
                         NETLINK_NFLOG, dev->dev.bus_id);
@@ -225,3 +225,5 @@ void w1_remove_master_device(struct w1_bus_master *bm)
 
 EXPORT_SYMBOL(w1_add_master_device);
 EXPORT_SYMBOL(w1_remove_master_device);
+
+MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_W1);
diff --git a/drivers/w1/w1_netlink.c b/drivers/w1/w1_netlink.c
index 2a82fb055c70..e7b774423dd6 100644
--- a/drivers/w1/w1_netlink.c
+++ b/drivers/w1/w1_netlink.c
@@ -51,7 +51,7 @@ void w1_netlink_send(struct w1_master *dev, struct w1_netlink_msg *msg)
 
         memcpy(data, msg, sizeof(struct w1_netlink_msg));
 
-        NETLINK_CB(skb).dst_groups = dev->groups;
+        NETLINK_CB(skb).dst_group = dev->groups;
         netlink_broadcast(dev->nls, skb, 0, dev->groups, GFP_ATOMIC);
 
 nlmsg_failure: