111 files changed, 1297 insertions, 1100 deletions
diff --git a/drivers/acpi/sleep/proc.c b/drivers/acpi/sleep/proc.c
index 3839efd5ea..1538355c26 100644
--- a/drivers/acpi/sleep/proc.c
+++ b/drivers/acpi/sleep/proc.c
@@ -194,6 +194,23 @@ static int get_date_field(char **p, u32 * value)
        return result;
 }
+/* Read a possibly BCD register, always return binary */
+static u32 cmos_bcd_read(int offset, int rtc_control)
+{
+        u32 val = CMOS_READ(offset);
+        if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD)
+                BCD_TO_BIN(val);
+        return val;
+}
+/* Write binary value into possibly BCD register */
+static void cmos_bcd_write(u32 val, int offset, int rtc_control)
+{
+        if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD)
+                BIN_TO_BCD(val);
+        CMOS_WRITE(val, offset);
+}
 static ssize_t
 acpi_system_write_alarm(struct file *file,
                        const char __user * buffer, size_t count, loff_t * ppos)
@@ -258,35 +275,18 @@ acpi_system_write_alarm(struct file *file,
        spin_lock_irq(&rtc_lock);
        rtc_control = CMOS_READ(RTC_CONTROL);
-        if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD) {
-                BIN_TO_BCD(yr);
-                BIN_TO_BCD(mo);
-                BIN_TO_BCD(day);
-                BIN_TO_BCD(hr);
-                BIN_TO_BCD(min);
-                BIN_TO_BCD(sec);
-        }
        if (adjust) {
-                yr += CMOS_READ(RTC_YEAR);
+                yr += cmos_bcd_read(RTC_YEAR, rtc_control);
-                mo += CMOS_READ(RTC_MONTH);
+                mo += cmos_bcd_read(RTC_MONTH, rtc_control);
-                day += CMOS_READ(RTC_DAY_OF_MONTH);
+                day += cmos_bcd_read(RTC_DAY_OF_MONTH, rtc_control);
-                hr += CMOS_READ(RTC_HOURS);
+                hr += cmos_bcd_read(RTC_HOURS, rtc_control);
-                min += CMOS_READ(RTC_MINUTES);
+                min += cmos_bcd_read(RTC_MINUTES, rtc_control);
-                sec += CMOS_READ(RTC_SECONDS);
+                sec += cmos_bcd_read(RTC_SECONDS, rtc_control);
        }
        spin_unlock_irq(&rtc_lock);
-        if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD) {
-                BCD_TO_BIN(yr);
-                BCD_TO_BIN(mo);
-                BCD_TO_BIN(day);
-                BCD_TO_BIN(hr);
-                BCD_TO_BIN(min);
-                BCD_TO_BIN(sec);
-        }
        if (sec > 59) {
                min++;
                sec -= 60;
@@ -307,14 +307,6 @@ acpi_system_write_alarm(struct file *file,
                yr++;
                mo -= 12;
        }
-        if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD) {
-                BIN_TO_BCD(yr);
-                BIN_TO_BCD(mo);
-                BIN_TO_BCD(day);
-                BIN_TO_BCD(hr);
-                BIN_TO_BCD(min);
-                BIN_TO_BCD(sec);
-        }
        spin_lock_irq(&rtc_lock);
        /*
@@ -326,9 +318,9 @@ acpi_system_write_alarm(struct file *file,
        CMOS_READ(RTC_INTR_FLAGS);
        /* write the fields the rtc knows about */
-        CMOS_WRITE(hr, RTC_HOURS_ALARM);
+        cmos_bcd_write(hr, RTC_HOURS_ALARM, rtc_control);
-        CMOS_WRITE(min, RTC_MINUTES_ALARM);
+        cmos_bcd_write(min, RTC_MINUTES_ALARM, rtc_control);
-        CMOS_WRITE(sec, RTC_SECONDS_ALARM);
+        cmos_bcd_write(sec, RTC_SECONDS_ALARM, rtc_control);
        /*
         * If the system supports an enhanced alarm it will have non-zero
@@ -336,11 +328,11 @@ acpi_system_write_alarm(struct file *file,
         * to the RTC area of memory.
         */
        if (acpi_gbl_FADT.day_alarm)
-                CMOS_WRITE(day, acpi_gbl_FADT.day_alarm);
+                cmos_bcd_write(day, acpi_gbl_FADT.day_alarm, rtc_control);
        if (acpi_gbl_FADT.month_alarm)
-                CMOS_WRITE(mo, acpi_gbl_FADT.month_alarm);
+                cmos_bcd_write(mo, acpi_gbl_FADT.month_alarm, rtc_control);
        if (acpi_gbl_FADT.century)
-                CMOS_WRITE(yr / 100, acpi_gbl_FADT.century);
+                cmos_bcd_write(yr / 100, acpi_gbl_FADT.century, rtc_control);
        /* enable the rtc alarm interrupt */
        rtc_control |= RTC_AIE;
        CMOS_WRITE(rtc_control, RTC_CONTROL);
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 95229e77bf..49cf4cf1a5 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -41,6 +41,7 @@
 #include <linux/interrupt.h>
 #include <linux/dma-mapping.h>
 #include <linux/device.h>
+#include <linux/dmi.h>
 #include <scsi/scsi_host.h>
 #include <scsi/scsi_cmnd.h>
 #include <linux/libata.h>
@@ -241,6 +242,7 @@ static void ahci_pmp_attach(struct ata_port *ap);
 static void ahci_pmp_detach(struct ata_port *ap);
 static void ahci_error_handler(struct ata_port *ap);
 static void ahci_vt8251_error_handler(struct ata_port *ap);
+static void ahci_p5wdh_error_handler(struct ata_port *ap);
 static void ahci_post_internal_cmd(struct ata_queued_cmd *qc);
 static int ahci_port_resume(struct ata_port *ap);
 static unsigned int ahci_fill_sg(struct ata_queued_cmd *qc, void *cmd_tbl);
@@ -339,6 +341,40 @@ static const struct ata_port_operations ahci_vt8251_ops = {
        .port_stop              = ahci_port_stop,
 };
+static const struct ata_port_operations ahci_p5wdh_ops = {
+        .check_status           = ahci_check_status,
+        .check_altstatus        = ahci_check_status,
+        .dev_select             = ata_noop_dev_select,
+        .tf_read                = ahci_tf_read,
+        .qc_defer               = sata_pmp_qc_defer_cmd_switch,
+        .qc_prep                = ahci_qc_prep,
+        .qc_issue               = ahci_qc_issue,
+        .irq_clear              = ahci_irq_clear,
+        .scr_read               = ahci_scr_read,
+        .scr_write              = ahci_scr_write,
+        .freeze                 = ahci_freeze,
+        .thaw                   = ahci_thaw,
+        .error_handler          = ahci_p5wdh_error_handler,
+        .post_internal_cmd      = ahci_post_internal_cmd,
+        .pmp_attach             = ahci_pmp_attach,
+        .pmp_detach             = ahci_pmp_detach,
+#ifdef CONFIG_PM
+        .port_suspend           = ahci_port_suspend,
+        .port_resume            = ahci_port_resume,
+#endif
+        .port_start             = ahci_port_start,
+        .port_stop              = ahci_port_stop,
+};
 #define AHCI_HFLAGS(flags)      .private_data   = (void *)(flags)
 static const struct ata_port_info ahci_port_info[] = {
@@ -1213,6 +1249,53 @@ static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class,
        return rc ?: -EAGAIN;
 }
+static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class,
+                                unsigned long deadline)
+{
+        struct ata_port *ap = link->ap;
+        struct ahci_port_priv *pp = ap->private_data;
+        u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG;
+        struct ata_taskfile tf;
+        int rc;
+        ahci_stop_engine(ap);
+        /* clear D2H reception area to properly wait for D2H FIS */
+        ata_tf_init(link->device, &tf);
+        tf.command = 0x80;
+        ata_tf_to_fis(&tf, 0, 0, d2h_fis);
+        rc = sata_link_hardreset(link, sata_ehc_deb_timing(&link->eh_context),
+                                 deadline);
+        ahci_start_engine(ap);
+        if (rc || ata_link_offline(link))
+                return rc;
+        /* spec mandates ">= 2ms" before checking status */
+        msleep(150);
+        /* The pseudo configuration device on SIMG4726 attached to
+         * ASUS P5W-DH Deluxe doesn't send signature FIS after
+         * hardreset if no device is attached to the first downstream
+         * port && the pseudo device locks up on SRST w/ PMP==0.  To
+         * work around this, wait for !BSY only briefly.  If BSY isn't
+         * cleared, perform CLO and proceed to IDENTIFY (achieved by
+         * ATA_LFLAG_NO_SRST and ATA_LFLAG_ASSUME_ATA).
+         *
+         * Wait for two seconds.  Devices attached to downstream port
+         * which can't process the following IDENTIFY after this will
+         * have to be reset again.  For most cases, this should
+         * suffice while making probing snappish enough.
+         */
+        rc = ata_wait_ready(ap, jiffies + 2 * HZ);
+        if (rc)
+                ahci_kick_engine(ap, 0);
+        return 0;
+}
 static void ahci_postreset(struct ata_link *link, unsigned int *class)
 {
        struct ata_port *ap = link->ap;
@@ -1670,6 +1753,19 @@ static void ahci_vt8251_error_handler(struct ata_port *ap)
                  ahci_postreset);
 }
+static void ahci_p5wdh_error_handler(struct ata_port *ap)
+{
+        if (!(ap->pflags & ATA_PFLAG_FROZEN)) {
+                /* restart engine */
+                ahci_stop_engine(ap);
+                ahci_start_engine(ap);
+        }
+        /* perform recovery */
+        ata_do_eh(ap, ata_std_prereset, ahci_softreset, ahci_p5wdh_hardreset,
+                  ahci_postreset);
+}
 static void ahci_post_internal_cmd(struct ata_queued_cmd *qc)
 {
        struct ata_port *ap = qc->ap;
@@ -1955,6 +2051,51 @@ static void ahci_print_info(struct ata_host *host)
                );
 }
+/* On ASUS P5W DH Deluxe, the second port of PCI device 00:1f.2 is
+ * hardwired to on-board SIMG 4726.  The chipset is ICH8 and doesn't
+ * support PMP and the 4726 either directly exports the device
+ * attached to the first downstream port or acts as a hardware storage
+ * controller and emulate a single ATA device (can be RAID 0/1 or some
+ * other configuration).
+ *
+ * When there's no device attached to the first downstream port of the
+ * 4726, "Config Disk" appears, which is a pseudo ATA device to
+ * configure the 4726.  However, ATA emulation of the device is very
+ * lame.  It doesn't send signature D2H Reg FIS after the initial
+ * hardreset, pukes on SRST w/ PMP==0 and has bunch of other issues.
+ *
+ * The following function works around the problem by always using
+ * hardreset on the port and not depending on receiving signature FIS
+ * afterward.  If signature FIS isn't received soon, ATA class is
+ * assumed without follow-up softreset.
+ */
+static void ahci_p5wdh_workaround(struct ata_host *host)
+{
+        static struct dmi_system_id sysids[] = {
+                {
+                        .ident = "P5W DH Deluxe",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR,
+                                          "ASUSTEK COMPUTER INC"),
+                                DMI_MATCH(DMI_PRODUCT_NAME, "P5W DH Deluxe"),
+                        },
+                },
+                { }
+        };
+        struct pci_dev *pdev = to_pci_dev(host->dev);
+        if (pdev->bus->number == 0 && pdev->devfn == PCI_DEVFN(0x1f, 2) &&
+            dmi_check_system(sysids)) {
+                struct ata_port *ap = host->ports[1];
+                dev_printk(KERN_INFO, &pdev->dev, "enabling ASUS P5W DH "
+                           "Deluxe on-board SIMG4726 workaround\n");
+                ap->ops = &ahci_p5wdh_ops;
+                ap->link.flags |= ATA_LFLAG_NO_SRST | ATA_LFLAG_ASSUME_ATA;
+        }
+}
 static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
        static int printed_version;
@@ -2024,6 +2165,9 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                        ap->ops = &ata_dummy_port_ops;
        }
+        /* apply workaround for ASUS P5W DH Deluxe mainboard */
+        ahci_p5wdh_workaround(host);
        /* initialize adapter */
        rc = ahci_configure_dma_masks(pdev, hpriv->cap & HOST_CAP_64);
        if (rc)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 2d147b51c9..081e3dfb64 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -68,7 +68,8 @@ const unsigned long sata_deb_timing_long[]		= { 100, 2000, 5000 };
 static unsigned int ata_dev_init_params(struct ata_device *dev,
                                        u16 heads, u16 sectors);
 static unsigned int ata_dev_set_xfermode(struct ata_device *dev);
-static unsigned int ata_dev_set_AN(struct ata_device *dev, u8 enable);
+static unsigned int ata_dev_set_feature(struct ata_device *dev,
+                                        u8 enable, u8 feature);
 static void ata_dev_xfermask(struct ata_device *dev);
 static unsigned long ata_dev_blacklisted(const struct ata_device *dev);
@@ -1799,13 +1800,7 @@ int ata_dev_read_id(struct ata_device *dev, unsigned int *p_class,
                 * SET_FEATURES spin-up subcommand before it will accept
                 * anything other than the original IDENTIFY command.
                 */
-                ata_tf_init(dev, &tf);
+                err_mask = ata_dev_set_feature(dev, SETFEATURES_SPINUP, 0);
-                tf.command = ATA_CMD_SET_FEATURES;
-                tf.feature = SETFEATURES_SPINUP;
-                tf.protocol = ATA_PROT_NODATA;
-                tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
-                err_mask = ata_exec_internal(dev, &tf, NULL,
-                                             DMA_NONE, NULL, 0, 0);
                if (err_mask && id[2] != 0x738c) {
                        rc = -EIO;
                        reason = "SPINUP failed";
@@ -2075,7 +2070,8 @@ int ata_dev_configure(struct ata_device *dev)
                        unsigned int err_mask;
                        /* issue SET feature command to turn this on */
-                        err_mask = ata_dev_set_AN(dev, SETFEATURES_SATA_ENABLE);
+                        err_mask = ata_dev_set_feature(dev,
+                                        SETFEATURES_SATA_ENABLE, SATA_AN);
                        if (err_mask)
                                ata_dev_printk(dev, KERN_ERR,
                                        "failed to enable ATAPI AN "
@@ -2886,6 +2882,13 @@ static int ata_dev_set_mode(struct ata_device *dev)
                        dev->pio_mode <= XFER_PIO_2)
                err_mask &= ~AC_ERR_DEV;
+        /* Early MWDMA devices do DMA but don't allow DMA mode setting.
+           Don't fail an MWDMA0 set IFF the device indicates it is in MWDMA0 */
+        if (dev->xfer_shift == ATA_SHIFT_MWDMA && 
+            dev->dma_mode == XFER_MW_DMA_0 &&
+            (dev->id[63] >> 8) & 1)
+                err_mask &= ~AC_ERR_DEV;
        if (err_mask) {
                ata_dev_printk(dev, KERN_ERR, "failed to set xfermode "
                               "(err_mask=0x%x)\n", err_mask);
@@ -3947,9 +3950,6 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "_NEC DV5800A",       NULL,           ATA_HORKAGE_NODMA },
        { "SAMSUNG CD-ROM SN-124", "N001",      ATA_HORKAGE_NODMA },
        { "Seagate STT20000A", NULL,            ATA_HORKAGE_NODMA },
-        { "IOMEGA  ZIP 250       ATAPI", NULL,  ATA_HORKAGE_NODMA }, /* temporary fix */
-        { "IOMEGA  ZIP 250       ATAPI       Floppy",
-                                NULL,           ATA_HORKAGE_NODMA },
        /* Odd clown on sil3726/4726 PMPs */
        { "Config  Disk",       NULL,           ATA_HORKAGE_NODMA |
                                                ATA_HORKAGE_SKIP_PM },
@@ -4007,7 +4007,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { }
 };
-int strn_pattern_cmp(const char *patt, const char *name, int wildchar)
+static int strn_pattern_cmp(const char *patt, const char *name, int wildchar)
 {
        const char *p;
        int len;
@@ -4181,15 +4181,14 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev)
        DPRINTK("EXIT, err_mask=%x\n", err_mask);
        return err_mask;
 }
 /**
- *      ata_dev_set_AN - Issue SET FEATURES - SATA FEATURES
+ *      ata_dev_set_feature - Issue SET FEATURES - SATA FEATURES
 *      @dev: Device to which command will be sent
 *      @enable: Whether to enable or disable the feature
+ *      @feature: The sector count represents the feature to set
 *
 *      Issue SET FEATURES - SATA FEATURES command to device @dev
- *      on port @ap with sector count set to indicate Asynchronous
+ *      on port @ap with sector count
- *      Notification feature
 *
 *      LOCKING:
 *      PCI/etc. bus probe sem.
@@ -4197,7 +4196,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev)
 *      RETURNS:
 *      0 on success, AC_ERR_* mask otherwise.
 */
-static unsigned int ata_dev_set_AN(struct ata_device *dev, u8 enable)
+static unsigned int ata_dev_set_feature(struct ata_device *dev, u8 enable,
+                                        u8 feature)
 {
        struct ata_taskfile tf;
        unsigned int err_mask;
@@ -4210,7 +4210,7 @@ static unsigned int ata_dev_set_AN(struct ata_device *dev, u8 enable)
        tf.feature = enable;
        tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
        tf.protocol = ATA_PROT_NODATA;
-        tf.nsect = SATA_AN;
+        tf.nsect = feature;
        err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0);
@@ -4689,8 +4689,8 @@ static int ata_sg_setup(struct ata_queued_cmd *qc)
                 * data in this function or read data in ata_sg_clean.
                 */
                offset = lsg->offset + lsg->length - qc->pad_len;
-                sg_set_page(psg, nth_page(sg_page(lsg), offset >> PAGE_SHIFT));
+                sg_set_page(psg, nth_page(sg_page(lsg), offset >> PAGE_SHIFT),
-                psg->offset = offset_in_page(offset);
+                                qc->pad_len, offset_in_page(offset));
                if (qc->tf.flags & ATA_TFLAG_WRITE) {
                        void *addr = kmap_atomic(sg_page(psg), KM_IRQ0);
@@ -6921,7 +6921,7 @@ int ata_host_activate(struct ata_host *host, int irq,
 *      LOCKING:
 *      Kernel thread context (may sleep).
 */
-void ata_port_detach(struct ata_port *ap)
+static void ata_port_detach(struct ata_port *ap)
 {
        unsigned long flags;
        struct ata_link *link;
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 93e2b545b4..8cb35bb876 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2071,7 +2071,7 @@ int ata_eh_reset(struct ata_link *link, int classify,
        int try = 0;
        struct ata_device *dev;
        unsigned long deadline;
-        unsigned int action;
+        unsigned int tmp_action;
        ata_reset_fn_t reset;
        unsigned long flags;
        int rc;
@@ -2086,14 +2086,14 @@ int ata_eh_reset(struct ata_link *link, int classify,
        /* Determine which reset to use and record in ehc->i.action.
         * prereset() may examine and modify it.
         */
-        action = ehc->i.action;
-        ehc->i.action &= ~ATA_EH_RESET_MASK;
        if (softreset && (!hardreset || (!(link->flags & ATA_LFLAG_NO_SRST) &&
                                         !sata_set_spd_needed(link) &&
-                                         !(action & ATA_EH_HARDRESET))))
+                                         !(ehc->i.action & ATA_EH_HARDRESET))))
-                ehc->i.action |= ATA_EH_SOFTRESET;
+                tmp_action = ATA_EH_SOFTRESET;
        else
-                ehc->i.action |= ATA_EH_HARDRESET;
+                tmp_action = ATA_EH_HARDRESET;
+        ehc->i.action = (ehc->i.action & ~ATA_EH_RESET_MASK) | tmp_action;
        if (prereset) {
                rc = prereset(link, jiffies + ATA_EH_PRERESET_TIMEOUT);
diff --git a/drivers/ata/pata_icside.c b/drivers/ata/pata_icside.c
index be30923566..842fe08a3c 100644
--- a/drivers/ata/pata_icside.c
+++ b/drivers/ata/pata_icside.c
@@ -332,12 +332,13 @@ static void ata_dummy_noret(struct ata_port *port)
 {
 }
-static void pata_icside_postreset(struct ata_port *ap, unsigned int *classes)
+static void pata_icside_postreset(struct ata_link *link, unsigned int *classes)
 {
+        struct ata_port *ap = link->ap;
        struct pata_icside_state *state = ap->host->private_data;
        if (classes[0] != ATA_DEV_NONE || classes[1] != ATA_DEV_NONE)
-                return ata_std_postreset(ap, classes);
+                return ata_std_postreset(link, classes);
        state->port[ap->port_no].disabled = 1;
@@ -395,29 +396,30 @@ static struct ata_port_operations pata_icside_port_ops = {
 static void __devinit
 pata_icside_setup_ioaddr(struct ata_port *ap, void __iomem *base,
-                         const struct portinfo *info)
+                         struct pata_icside_info *info,
+                         const struct portinfo *port)
 {
        struct ata_ioports *ioaddr = &ap->ioaddr;
-        void __iomem *cmd = base + info->dataoffset;
+        void __iomem *cmd = base + port->dataoffset;
        ioaddr->cmd_addr        = cmd;
-        ioaddr->data_addr       = cmd + (ATA_REG_DATA    << info->stepping);
+        ioaddr->data_addr       = cmd + (ATA_REG_DATA    << port->stepping);
-        ioaddr->error_addr      = cmd + (ATA_REG_ERR     << info->stepping);
+        ioaddr->error_addr      = cmd + (ATA_REG_ERR     << port->stepping);
-        ioaddr->feature_addr    = cmd + (ATA_REG_FEATURE << info->stepping);
+        ioaddr->feature_addr    = cmd + (ATA_REG_FEATURE << port->stepping);
-        ioaddr->nsect_addr      = cmd + (ATA_REG_NSECT   << info->stepping);
+        ioaddr->nsect_addr      = cmd + (ATA_REG_NSECT   << port->stepping);
-        ioaddr->lbal_addr       = cmd + (ATA_REG_LBAL    << info->stepping);
+        ioaddr->lbal_addr       = cmd + (ATA_REG_LBAL    << port->stepping);
-        ioaddr->lbam_addr       = cmd + (ATA_REG_LBAM    << info->stepping);
+        ioaddr->lbam_addr       = cmd + (ATA_REG_LBAM    << port->stepping);
-        ioaddr->lbah_addr       = cmd + (ATA_REG_LBAH    << info->stepping);
+        ioaddr->lbah_addr       = cmd + (ATA_REG_LBAH    << port->stepping);
-        ioaddr->device_addr     = cmd + (ATA_REG_DEVICE  << info->stepping);
+        ioaddr->device_addr     = cmd + (ATA_REG_DEVICE  << port->stepping);
-        ioaddr->status_addr     = cmd + (ATA_REG_STATUS  << info->stepping);
+        ioaddr->status_addr     = cmd + (ATA_REG_STATUS  << port->stepping);
-        ioaddr->command_addr    = cmd + (ATA_REG_CMD     << info->stepping);
+        ioaddr->command_addr    = cmd + (ATA_REG_CMD     << port->stepping);
-        ioaddr->ctl_addr        = base + info->ctrloffset;
+        ioaddr->ctl_addr        = base + port->ctrloffset;
        ioaddr->altstatus_addr  = ioaddr->ctl_addr;
        ata_port_desc(ap, "cmd 0x%lx ctl 0x%lx",
-                      info->raw_base + info->dataoffset,
+                      info->raw_base + port->dataoffset,
-                      info->raw_base + info->ctrloffset);
+                      info->raw_base + port->ctrloffset);
        if (info->raw_ioc_base)
                ata_port_desc(ap, "iocbase 0x%lx", info->raw_ioc_base);
@@ -441,7 +443,7 @@ static int __devinit pata_icside_register_v5(struct pata_icside_info *info)
        info->nr_ports = 1;
        info->port[0] = &pata_icside_portinfo_v5;
-        info->raw_base = ecard_resource_start(ec, ECARD_RES_MEMC);
+        info->raw_base = ecard_resource_start(info->ec, ECARD_RES_MEMC);
        return 0;
 }
@@ -522,7 +524,7 @@ static int __devinit pata_icside_add_ports(struct pata_icside_info *info)
                ap->flags |= ATA_FLAG_SLAVE_POSS;
                ap->ops = &pata_icside_port_ops;
-                pata_icside_setup_ioaddr(ap, info->base, info->port[i]);
+                pata_icside_setup_ioaddr(ap, info->base, info, info->port[i]);
        }
        return ata_host_activate(host, ec->irq, ata_interrupt, 0,
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index 2e0279fdd7..f1b422f7c7 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -365,9 +365,9 @@ static const struct pci_device_id nv_pci_tbl[] = {
        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA2), SWNCQ },
        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA), SWNCQ },
        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA2), SWNCQ },
-        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA), SWNCQ },
+        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA), GENERIC },
-        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA2), SWNCQ },
+        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA2), GENERIC },
-        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA3), SWNCQ },
+        { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA3), GENERIC },
        { } /* terminate list */
 };
diff --git a/drivers/block/cryptoloop.c b/drivers/block/cryptoloop.c
index 1b58b01079..241167878e 100644
--- a/drivers/block/cryptoloop.c
+++ b/drivers/block/cryptoloop.c
@@ -150,13 +150,8 @@ cryptoloop_transfer(struct loop_device *lo, int cmd,
                u32 iv[4] = { 0, };
                iv[0] = cpu_to_le32(IV & 0xffffffff);
-                sg_set_page(&sg_in, in_page);
+                sg_set_page(&sg_in, in_page, sz, in_offs);
-                sg_in.offset = in_offs;
+                sg_set_page(&sg_out, out_page, sz, out_offs);
-                sg_in.length = sz;
-                sg_set_page(&sg_out, out_page);
-                sg_out.offset = out_offs;
-                sg_out.length = sz;
                desc.info = iv;
                err = encdecfunc(&desc, &sg_out, &sg_in, sz);
diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c
index 7276f7d207..fac4c6cd04 100644
--- a/drivers/block/sunvdc.c
+++ b/drivers/block/sunvdc.c
@@ -15,6 +15,7 @@
 #include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/list.h>
+#include <linux/scatterlist.h>
 #include <asm/vio.h>
 #include <asm/ldc.h>
diff --git a/drivers/block/ub.c b/drivers/block/ub.c
index 14143f2c48..08e909dc79 100644
--- a/drivers/block/ub.c
+++ b/drivers/block/ub.c
@@ -1428,9 +1428,9 @@ static void ub_state_sense(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
        scmd->state = UB_CMDST_INIT;
        scmd->nsg = 1;
        sg = &scmd->sgv[0];
-        sg_set_page(sg, virt_to_page(sc->top_sense));
+        sg_init_table(sg, UB_MAX_REQ_SG);
-        sg->offset = (unsigned long)sc->top_sense & (PAGE_SIZE-1);
+        sg_set_page(sg, virt_to_page(sc->top_sense), UB_SENSE_SIZE,
-        sg->length = UB_SENSE_SIZE;
+                        (unsigned long)sc->top_sense & (PAGE_SIZE-1));
        scmd->len = UB_SENSE_SIZE;
        scmd->lun = cmd->lun;
        scmd->done = ub_top_sense_done;
@@ -1864,9 +1864,8 @@ static int ub_sync_read_cap(struct ub_dev *sc, struct ub_lun *lun,
        cmd->state = UB_CMDST_INIT;
        cmd->nsg = 1;
        sg = &cmd->sgv[0];
-        sg_set_page(sg, virt_to_page(p));
+        sg_init_table(sg, UB_MAX_REQ_SG);
-        sg->offset = (unsigned long)p & (PAGE_SIZE-1);
+        sg_set_page(sg, virt_to_page(p), 8, (unsigned long)p & (PAGE_SIZE-1));
-        sg->length = 8;
        cmd->len = 8;
        cmd->lun = lun;
        cmd->done = ub_probe_done;
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index a901eee64b..3cf7129d83 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -4,7 +4,9 @@
 #include <linux/hdreg.h>
 #include <linux/virtio.h>
 #include <linux/virtio_blk.h>
-#include <linux/virtio_blk.h>
+#include <linux/scatterlist.h>
+#define VIRTIO_MAX_SG   (3+MAX_PHYS_SEGMENTS)
 static unsigned char virtblk_index = 'a';
 struct virtio_blk
@@ -23,7 +25,7 @@ struct virtio_blk
        mempool_t *pool;
        /* Scatterlist: can be too big for stack. */
-        struct scatterlist sg[3+MAX_PHYS_SEGMENTS];
+        struct scatterlist sg[VIRTIO_MAX_SG];
 };
 struct virtblk_req
@@ -94,8 +96,8 @@ static bool do_req(struct request_queue *q, struct virtio_blk *vblk,
        if (blk_barrier_rq(vbr->req))
                vbr->out_hdr.type |= VIRTIO_BLK_T_BARRIER;
-        /* We have to zero this, otherwise blk_rq_map_sg gets upset. */
+        /* This init could be done at vblk creation time */
-        memset(vblk->sg, 0, sizeof(vblk->sg));
+        sg_init_table(vblk->sg, VIRTIO_MAX_SG);
        sg_set_buf(&vblk->sg[0], &vbr->out_hdr, sizeof(vbr->out_hdr));
        num = blk_rq_map_sg(q, vbr->req, vblk->sg+1);
        sg_set_buf(&vblk->sg[num+1], &vbr->in_hdr, sizeof(vbr->in_hdr));
diff --git a/drivers/cdrom/viocd.c b/drivers/cdrom/viocd.c
index 880b5dce3a..d8bb44b98a 100644
--- a/drivers/cdrom/viocd.c
+++ b/drivers/cdrom/viocd.c
@@ -41,9 +41,9 @@
 #include <linux/completion.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/scatterlist.h>
 #include <asm/vio.h>
-#include <asm/scatterlist.h>
 #include <asm/iseries/hv_types.h>
 #include <asm/iseries/hv_lp_event.h>
 #include <asm/iseries/vio.h>
@@ -258,6 +258,7 @@ static int send_request(struct request *req)
                cmd = viomajorsubtype_cdio | viocdwrite;
        }
+        sg_init_table(&sg, 1);
        if (blk_rq_map_sg(req->q, req, &sg) == 0) {
                printk(VIOCD_KERN_WARNING
                                "error setting up scatter/gather list\n");
diff --git a/drivers/crypto/padlock-sha.c b/drivers/crypto/padlock-sha.c
index 4e8de162fc..c666b4e093 100644
--- a/drivers/crypto/padlock-sha.c
+++ b/drivers/crypto/padlock-sha.c
@@ -55,7 +55,7 @@ static void padlock_sha_bypass(struct crypto_tfm *tfm)
        if (ctx(tfm)->data && ctx(tfm)->used) {
                struct scatterlist sg;
-                sg_set_buf(&sg, ctx(tfm)->data, ctx(tfm)->used);
+                sg_init_one(&sg, ctx(tfm)->data, ctx(tfm)->used);
                crypto_hash_update(&ctx(tfm)->fallback, &sg, sg.length);
        }
@@ -79,7 +79,7 @@ static void padlock_sha_update(struct crypto_tfm *tfm,
        if (unlikely(ctx(tfm)->bypass)) {
                struct scatterlist sg;
-                sg_set_buf(&sg, (uint8_t *)data, length);
+                sg_init_one(&sg, (uint8_t *)data, length);
                crypto_hash_update(&ctx(tfm)->fallback, &sg, length);
                return;
        }
diff --git a/drivers/ide/arm/icside.c b/drivers/ide/arm/icside.c
index 410a0d13e3..93f71fcfc0 100644
--- a/drivers/ide/arm/icside.c
+++ b/drivers/ide/arm/icside.c
@@ -316,13 +316,13 @@ static int icside_dma_end(ide_drive_t *drive)
        drive->waiting_for_dma = 0;
-        disable_dma(state->dev->dma);
+        disable_dma(ECARD_DEV(state->dev)->dma);
        /* Teardown mappings after DMA has completed. */
        dma_unmap_sg(state->dev, hwif->sg_table, hwif->sg_nents,
                     hwif->sg_dma_direction);
-        return get_dma_residue(state->dev->dma) != 0;
+        return get_dma_residue(ECARD_DEV(state->dev)->dma) != 0;
 }
 static void icside_dma_start(ide_drive_t *drive)
@@ -331,8 +331,8 @@ static void icside_dma_start(ide_drive_t *drive)
        struct icside_state *state = hwif->hwif_data;
        /* We can not enable DMA on both channels simultaneously. */
-        BUG_ON(dma_channel_active(state->dev->dma));
+        BUG_ON(dma_channel_active(ECARD_DEV(state->dev)->dma));
-        enable_dma(state->dev->dma);
+        enable_dma(ECARD_DEV(state->dev)->dma);
 }
 static int icside_dma_setup(ide_drive_t *drive)
@@ -350,7 +350,7 @@ static int icside_dma_setup(ide_drive_t *drive)
        /*
         * We can not enable DMA on both channels.
         */
-        BUG_ON(dma_channel_active(state->dev->dma));
+        BUG_ON(dma_channel_active(ECARD_DEV(state->dev)->dma));
        icside_build_sglist(drive, rq);
@@ -367,14 +367,14 @@ static int icside_dma_setup(ide_drive_t *drive)
        /*
         * Select the correct timing for this drive.
         */
-        set_dma_speed(state->dev->dma, drive->drive_data);
+        set_dma_speed(ECARD_DEV(state->dev)->dma, drive->drive_data);
        /*
         * Tell the DMA engine about the SG table and
         * data direction.
         */
-        set_dma_sg(state->dev->dma, hwif->sg_table, hwif->sg_nents);
+        set_dma_sg(ECARD_DEV(state->dev)->dma, hwif->sg_table, hwif->sg_nents);
-        set_dma_mode(state->dev->dma, dma_mode);
+        set_dma_mode(ECARD_DEV(state->dev)->dma, dma_mode);
        drive->waiting_for_dma = 1;
diff --git a/drivers/ide/ide-iops.c b/drivers/ide/ide-iops.c
index 95168833d0..dcda0f109d 100644
--- a/drivers/ide/ide-iops.c
+++ b/drivers/ide/ide-iops.c
@@ -582,9 +582,12 @@ EXPORT_SYMBOL_GPL(ide_in_drive_list);
 /*
 * Early UDMA66 devices don't set bit14 to 1, only bit13 is valid.
 * We list them here and depend on the device side cable detection for them.
+ *
+ * Some optical devices with the buggy firmwares have the same problem.
 */
 static const struct drive_list_entry ivb_list[] = {
        { "QUANTUM FIREBALLlct10 05"    , "A03.0900"    },
+        { "TSSTcorp CDDVDW SH-S202J"    , "SB00"        },
        { NULL                          , NULL          }
 };
diff --git a/drivers/ide/pci/cy82c693.c b/drivers/ide/pci/cy82c693.c
index 3ef4fc10fe..1cd4e9cb05 100644
--- a/drivers/ide/pci/cy82c693.c
+++ b/drivers/ide/pci/cy82c693.c
@@ -1,5 +1,5 @@
 /*
- * linux/drivers/ide/pci/cy82c693.c             Version 0.41    Aug 27, 2007
+ * linux/drivers/ide/pci/cy82c693.c             Version 0.42    Oct 23, 2007
 *
 *  Copyright (C) 1998-2000 Andreas S. Krebs (akrebs@altavista.net), Maintainer
 *  Copyright (C) 1998-2002 Andre Hedrick <andre@linux-ide.org>, Integrator
@@ -436,10 +436,10 @@ static void __devinit init_hwif_cy82c693(ide_hwif_t *hwif)
        hwif->ide_dma_on = &cy82c693_ide_dma_on;
 }
-static __devinitdata ide_hwif_t *primary;
 static void __devinit init_iops_cy82c693(ide_hwif_t *hwif)
 {
+        static ide_hwif_t *primary;
        if (PCI_FUNC(hwif->pci_dev->devfn) == 1)
                primary = hwif;
        else {
diff --git a/drivers/ide/pci/generic.c b/drivers/ide/pci/generic.c
index f44d70852c..06885697ed 100644
--- a/drivers/ide/pci/generic.c
+++ b/drivers/ide/pci/generic.c
@@ -49,7 +49,7 @@ static int __init ide_generic_all_on(char *unused)
        printk(KERN_INFO "IDE generic will claim all unknown PCI IDE storage controllers.\n");
        return 1;
 }
-__setup("all-generic-ide", ide_generic_all_on);
+const __setup("all-generic-ide", ide_generic_all_on);
 #endif
 module_param_named(all_generic_ide, ide_generic_all, bool, 0444);
 MODULE_PARM_DESC(all_generic_ide, "IDE generic will claim all unknown PCI IDE storage controllers.");
diff --git a/drivers/ide/pci/hpt366.c b/drivers/ide/pci/hpt366.c
index 612b795241..5682895d36 100644
--- a/drivers/ide/pci/hpt366.c
+++ b/drivers/ide/pci/hpt366.c
@@ -1,5 +1,5 @@
 /*
- * linux/drivers/ide/pci/hpt366.c               Version 1.20    Oct 1, 2007
+ * linux/drivers/ide/pci/hpt366.c               Version 1.21    Oct 23, 2007
 *
 * Copyright (C) 1999-2003              Andre Hedrick <andre@linux-ide.org>
 * Portions Copyright (C) 2001          Sun Microsystems, Inc.
@@ -433,7 +433,7 @@ static u32 *hpt37x_settings[NUM_ATA_CLOCKS] = {
        sixty_six_base_hpt37x
 };
-static struct hpt_info hpt36x __devinitdata = {
+static const struct hpt_info hpt36x __devinitdata = {
        .chip_name      = "HPT36x",
        .chip_type      = HPT36x,
        .udma_mask      = HPT366_ALLOW_ATA66_3 ? (HPT366_ALLOW_ATA66_4 ? ATA_UDMA4 : ATA_UDMA3) : ATA_UDMA2,
@@ -441,7 +441,7 @@ static struct hpt_info hpt36x __devinitdata = {
        .settings       = hpt36x_settings
 };
-static struct hpt_info hpt370 __devinitdata = {
+static const struct hpt_info hpt370 __devinitdata = {
        .chip_name      = "HPT370",
        .chip_type      = HPT370,
        .udma_mask      = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
@@ -449,7 +449,7 @@ static struct hpt_info hpt370 __devinitdata = {
        .settings       = hpt37x_settings
 };
-static struct hpt_info hpt370a __devinitdata = {
+static const struct hpt_info hpt370a __devinitdata = {
        .chip_name      = "HPT370A",
        .chip_type      = HPT370A,
        .udma_mask      = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
@@ -457,7 +457,7 @@ static struct hpt_info hpt370a __devinitdata = {
        .settings       = hpt37x_settings
 };
-static struct hpt_info hpt374 __devinitdata = {
+static const struct hpt_info hpt374 __devinitdata = {
        .chip_name      = "HPT374",
        .chip_type      = HPT374,
        .udma_mask      = ATA_UDMA5,
@@ -465,7 +465,7 @@ static struct hpt_info hpt374 __devinitdata = {
        .settings       = hpt37x_settings
 };
-static struct hpt_info hpt372 __devinitdata = {
+static const struct hpt_info hpt372 __devinitdata = {
        .chip_name      = "HPT372",
        .chip_type      = HPT372,
        .udma_mask      = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
@@ -473,7 +473,7 @@ static struct hpt_info hpt372 __devinitdata = {
        .settings       = hpt37x_settings
 };
-static struct hpt_info hpt372a __devinitdata = {
+static const struct hpt_info hpt372a __devinitdata = {
        .chip_name      = "HPT372A",
        .chip_type      = HPT372A,
        .udma_mask      = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
@@ -481,7 +481,7 @@ static struct hpt_info hpt372a __devinitdata = {
        .settings       = hpt37x_settings
 };
-static struct hpt_info hpt302 __devinitdata = {
+static const struct hpt_info hpt302 __devinitdata = {
        .chip_name      = "HPT302",
        .chip_type      = HPT302,
        .udma_mask      = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
@@ -489,7 +489,7 @@ static struct hpt_info hpt302 __devinitdata = {
        .settings       = hpt37x_settings
 };
-static struct hpt_info hpt371 __devinitdata = {
+static const struct hpt_info hpt371 __devinitdata = {
        .chip_name      = "HPT371",
        .chip_type      = HPT371,
        .udma_mask      = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
@@ -497,7 +497,7 @@ static struct hpt_info hpt371 __devinitdata = {
        .settings       = hpt37x_settings
 };
-static struct hpt_info hpt372n __devinitdata = {
+static const struct hpt_info hpt372n __devinitdata = {
        .chip_name      = "HPT372N",
        .chip_type      = HPT372N,
        .udma_mask      = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
@@ -505,7 +505,7 @@ static struct hpt_info hpt372n __devinitdata = {
        .settings       = hpt37x_settings
 };
-static struct hpt_info hpt302n __devinitdata = {
+static const struct hpt_info hpt302n __devinitdata = {
        .chip_name      = "HPT302N",
        .chip_type      = HPT302N,
        .udma_mask      = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
@@ -513,7 +513,7 @@ static struct hpt_info hpt302n __devinitdata = {
        .settings       = hpt37x_settings
 };
-static struct hpt_info hpt371n __devinitdata = {
+static const struct hpt_info hpt371n __devinitdata = {
        .chip_name      = "HPT371N",
        .chip_type      = HPT371N,
        .udma_mask      = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
@@ -1508,7 +1508,7 @@ static const struct ide_port_info hpt366_chipsets[] __devinitdata = {
 */
 static int __devinit hpt366_init_one(struct pci_dev *dev, const struct pci_device_id *id)
 {
-        struct hpt_info *info = NULL;
+        const struct hpt_info *info = NULL;
        struct pci_dev *dev2 = NULL;
        struct ide_port_info d;
        u8 idx = id->driver_data;
@@ -1522,7 +1522,7 @@ static int __devinit hpt366_init_one(struct pci_dev *dev, const struct pci_devic
                if (rev < 3)
                        info = &hpt36x;
                else {
-                        static struct hpt_info *hpt37x_info[] =
+                        static const struct hpt_info *hpt37x_info[] =
                                { &hpt370, &hpt370a, &hpt372, &hpt372n };
                        info = hpt37x_info[min_t(u8, rev, 6) - 3];
@@ -1552,7 +1552,7 @@ static int __devinit hpt366_init_one(struct pci_dev *dev, const struct pci_devic
        d.name = info->chip_name;
        d.udma_mask = info->udma_mask;
-        pci_set_drvdata(dev, info);
+        pci_set_drvdata(dev, (void *)info);
        if (info == &hpt36x || info == &hpt374)
                dev2 = pci_get_slot(dev->bus, dev->devfn + 1);
@@ -1560,7 +1560,7 @@ static int __devinit hpt366_init_one(struct pci_dev *dev, const struct pci_devic
        if (dev2) {
                int ret;
-                pci_set_drvdata(dev2, info);
+                pci_set_drvdata(dev2, (void *)info);
                if (info == &hpt374)
                        hpt374_init(dev, dev2);
diff --git a/drivers/ide/pci/sc1200.c b/drivers/ide/pci/sc1200.c
index d2c8b5524f..0a7b320206 100644
--- a/drivers/ide/pci/sc1200.c
+++ b/drivers/ide/pci/sc1200.c
@@ -324,17 +324,18 @@ static int sc1200_suspend (struct pci_dev *dev, pm_message_t state)
        pci_disable_device(dev);
        pci_set_power_state(dev, pci_choose_state(dev, state));
-        dev->current_state = state.event;
        return 0;
 }
 static int sc1200_resume (struct pci_dev *dev)
 {
        ide_hwif_t      *hwif = NULL;
+        int             i;
+        i = pci_enable_device(dev);
+        if (i)
+                return i;
-        pci_set_power_state(dev, PCI_D0);       // bring chip back from sleep state
-        dev->current_state = PM_EVENT_ON;
-        pci_enable_device(dev);
        //
        // loop over all interfaces that are part of this pci device:
        //
diff --git a/drivers/ieee1394/dma.c b/drivers/ieee1394/dma.c
index 3051e312fd..f5f4983dfb 100644
--- a/drivers/ieee1394/dma.c
+++ b/drivers/ieee1394/dma.c
@@ -111,8 +111,8 @@ int dma_region_alloc(struct dma_region *dma, unsigned long n_bytes,
                unsigned long va =
                    (unsigned long)dma->kvirt + (i << PAGE_SHIFT);
-                sg_set_page(&dma->sglist[i], vmalloc_to_page((void *)va));
+                sg_set_page(&dma->sglist[i], vmalloc_to_page((void *)va),
-                dma->sglist[i].length = PAGE_SIZE;
+                                PAGE_SIZE, 0);
        }
        /* map sglist to the IOMMU */
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 14159ff294..4e3128ff73 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -171,9 +171,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
                                if (vma_list &&
                                    !is_vm_hugetlb_page(vma_list[i + off]))
                                        umem->hugetlb = 0;
-                                sg_set_page(&chunk->page_list[i], page_list[i + off]);
+                                sg_set_page(&chunk->page_list[i], page_list[i + off], PAGE_SIZE, 0);
-                                chunk->page_list[i].offset = 0;
-                                chunk->page_list[i].length = PAGE_SIZE;
                        }
                        chunk->nmap = ib_dma_map_sg(context->device,
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index 007b38157f..1f4d27d7c1 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -113,9 +113,7 @@ static int mthca_alloc_icm_pages(struct scatterlist *mem, int order, gfp_t gfp_m
        if (!page)
                return -ENOMEM;
-        sg_set_page(mem, page);
+        sg_set_page(mem, page, PAGE_SIZE << order, 0);
-        mem->length = PAGE_SIZE << order;
-        mem->offset = 0;
        return 0;
 }
@@ -481,9 +479,8 @@ int mthca_map_user_db(struct mthca_dev *dev, struct mthca_uar *uar,
        if (ret < 0)
                goto out;
-        sg_set_page(&db_tab->page[i].mem, pages[0]);
+        sg_set_page(&db_tab->page[i].mem, pages[0], MTHCA_ICM_PAGE_SIZE,
-        db_tab->page[i].mem.length = MTHCA_ICM_PAGE_SIZE;
+                        uaddr & ~PAGE_MASK);
-        db_tab->page[i].mem.offset = uaddr & ~PAGE_MASK;
        ret = pci_map_sg(dev->pdev, &db_tab->page[i].mem, 1, PCI_DMA_TODEVICE);
        if (ret < 0) {
diff --git a/drivers/isdn/sc/shmem.c b/drivers/isdn/sc/shmem.c
index 034d41a61a..e0331e0094 100644
--- a/drivers/isdn/sc/shmem.c
+++ b/drivers/isdn/sc/shmem.c
@@ -28,15 +28,15 @@ void memcpy_toshmem(int card, void *dest, const void *src, size_t n)
 {
        unsigned long flags;
        unsigned char ch;
+        unsigned long dest_rem = ((unsigned long) dest) % 0x4000;
-        if(!IS_VALID_CARD(card)) {
+        if (!IS_VALID_CARD(card)) {
                pr_debug("Invalid param: %d is not a valid card id\n", card);
                return;
        }
-        if(n > SRAM_PAGESIZE) {
+        if (n > SRAM_PAGESIZE)
                return;
-        }
        /*
         * determine the page to load from the address
@@ -50,8 +50,7 @@ void memcpy_toshmem(int card, void *dest, const void *src, size_t n)
        outb(((sc_adapter[card]->shmem_magic + ch * SRAM_PAGESIZE) >> 14) | 0x80,
                sc_adapter[card]->ioport[sc_adapter[card]->shmem_pgport]);
-        memcpy_toio(sc_adapter[card]->rambase +
+        memcpy_toio(sc_adapter[card]->rambase + dest_rem, src, n);
-                ((unsigned long) dest % 0x4000), src, n);
        spin_unlock_irqrestore(&sc_adapter[card]->lock, flags);
        pr_debug("%s: set page to %#x\n",sc_adapter[card]->devicename,
                ((sc_adapter[card]->shmem_magic + ch * SRAM_PAGESIZE)>>14)|0x80);
diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
index 35d19ae58d..cb4c67025d 100644
--- a/drivers/lguest/core.c
+++ b/drivers/lguest/core.c
@@ -128,9 +128,12 @@ static void unmap_switcher(void)
                __free_pages(switcher_page[i], 0);
 }
-/*L:305
+/*H:032
 * Dealing With Guest Memory.
 *
+ * Before we go too much further into the Host, we need to grok the routines
+ * we use to deal with Guest memory.
+ *
 * When the Guest gives us (what it thinks is) a physical address, we can use
 * the normal copy_from_user() & copy_to_user() on the corresponding place in
 * the memory region allocated by the Launcher.
diff --git a/drivers/lguest/hypercalls.c b/drivers/lguest/hypercalls.c
index 9d5184c7c1..b478affe8f 100644
--- a/drivers/lguest/hypercalls.c
+++ b/drivers/lguest/hypercalls.c
@@ -90,6 +90,7 @@ static void do_hcall(struct lguest *lg, struct hcall_args *args)
                lg->pending_notify = args->arg1;
                break;
        default:
+                /* It should be an architecture-specific hypercall. */
                if (lguest_arch_do_hcall(lg, args))
                        kill_guest(lg, "Bad hypercall %li\n", args->arg0);
        }
@@ -157,7 +158,6 @@ static void do_async_hcalls(struct lguest *lg)
 * Guest makes a hypercall, we end up here to set things up: */
 static void initialize(struct lguest *lg)
 {
        /* You can't do anything until you're initialized.  The Guest knows the
         * rules, so we're unforgiving here. */
        if (lg->hcall->arg0 != LHCALL_LGUEST_INIT) {
@@ -174,7 +174,8 @@ static void initialize(struct lguest *lg)
            || get_user(lg->noirq_end, &lg->lguest_data->noirq_end))
                kill_guest(lg, "bad guest page %p", lg->lguest_data);
-        /* We write the current time into the Guest's data page once now. */
+        /* We write the current time into the Guest's data page once so it can
+         * set its clock. */
        write_timestamp(lg);
        /* page_tables.c will also do some setup. */
@@ -182,8 +183,8 @@ static void initialize(struct lguest *lg)
        /* This is the one case where the above accesses might have been the
         * first write to a Guest page.  This may have caused a copy-on-write
-         * fault, but the Guest might be referring to the old (read-only)
+         * fault, but the old page might be (read-only) in the Guest
-         * page. */
+         * pagetable. */
        guest_pagetable_clear_all(lg);
 }
@@ -220,7 +221,7 @@ void do_hypercalls(struct lguest *lg)
                 * Normally it doesn't matter: the Guest will run again and
                 * update the trap number before we come back here.
                 *
-                 * However, if we are signalled or the Guest sends DMA to the
+                 * However, if we are signalled or the Guest sends I/O to the
                 * Launcher, the run_guest() loop will exit without running the
                 * Guest.  When it comes back it would try to re-run the
                 * hypercall. */
diff --git a/drivers/lguest/interrupts_and_traps.c b/drivers/lguest/interrupts_and_traps.c
index 82966982cb..2b66f79c20 100644
--- a/drivers/lguest/interrupts_and_traps.c
+++ b/drivers/lguest/interrupts_and_traps.c
@@ -92,8 +92,8 @@ static void set_guest_interrupt(struct lguest *lg, u32 lo, u32 hi, int has_err)
        /* Remember that we never let the Guest actually disable interrupts, so
         * the "Interrupt Flag" bit is always set.  We copy that bit from the
-         * Guest's "irq_enabled" field into the eflags word: the Guest copies
+         * Guest's "irq_enabled" field into the eflags word: we saw the Guest
-         * it back in "lguest_iret". */
+         * copy it back in "lguest_iret". */
        eflags = lg->regs->eflags;
        if (get_user(irq_enable, &lg->lguest_data->irq_enabled) == 0
            && !(irq_enable & X86_EFLAGS_IF))
@@ -124,7 +124,7 @@ static void set_guest_interrupt(struct lguest *lg, u32 lo, u32 hi, int has_err)
                        kill_guest(lg, "Disabling interrupts");
 }
-/*H:200
+/*H:205
 * Virtual Interrupts.
 *
 * maybe_do_interrupt() gets called before every entry to the Guest, to see if
@@ -256,19 +256,21 @@ int deliver_trap(struct lguest *lg, unsigned int num)
         * bogus one in): if we fail here, the Guest will be killed. */
        if (!idt_present(lg->arch.idt[num].a, lg->arch.idt[num].b))
                return 0;
-        set_guest_interrupt(lg, lg->arch.idt[num].a, lg->arch.idt[num].b, has_err(num));
+        set_guest_interrupt(lg, lg->arch.idt[num].a, lg->arch.idt[num].b,
+                            has_err(num));
        return 1;
 }
 /*H:250 Here's the hard part: returning to the Host every time a trap happens
 * and then calling deliver_trap() and re-entering the Guest is slow.
- * Particularly because Guest userspace system calls are traps (trap 128).
+ * Particularly because Guest userspace system calls are traps (usually trap
+ * 128).
 *
 * So we'd like to set up the IDT to tell the CPU to deliver traps directly
 * into the Guest.  This is possible, but the complexities cause the size of
 * this file to double!  However, 150 lines of code is worth writing for taking
 * system calls down from 1750ns to 270ns.  Plus, if lguest didn't do it, all
- * the other hypervisors would tease it.
+ * the other hypervisors would beat it up at lunchtime.
 *
 * This routine indicates if a particular trap number could be delivered
 * directly. */
@@ -331,7 +333,7 @@ void pin_stack_pages(struct lguest *lg)
 * change stacks on each context switch. */
 void guest_set_stack(struct lguest *lg, u32 seg, u32 esp, unsigned int pages)
 {
-        /* You are not allowd have a stack segment with privilege level 0: bad
+        /* You are not allowed have a stack segment with privilege level 0: bad
         * Guest! */
        if ((seg & 0x3) != GUEST_PL)
                kill_guest(lg, "bad stack segment %i", seg);
@@ -350,7 +352,7 @@ void guest_set_stack(struct lguest *lg, u32 seg, u32 esp, unsigned int pages)
 * part of the Host: page table handling. */
 /*H:235 This is the routine which actually checks the Guest's IDT entry and
- * transfers it into our entry in "struct lguest": */
+ * transfers it into the entry in "struct lguest": */
 static void set_trap(struct lguest *lg, struct desc_struct *trap,
                     unsigned int num, u32 lo, u32 hi)
 {
@@ -456,6 +458,18 @@ void copy_traps(const struct lguest *lg, struct desc_struct *idt,
        }
 }
+/*H:200
+ * The Guest Clock.
+ *
+ * There are two sources of virtual interrupts.  We saw one in lguest_user.c:
+ * the Launcher sending interrupts for virtual devices.  The other is the Guest
+ * timer interrupt.
+ *
+ * The Guest uses the LHCALL_SET_CLOCKEVENT hypercall to tell us how long to
+ * the next timer interrupt (in nanoseconds).  We use the high-resolution timer
+ * infrastructure to set a callback at that time.
+ *
+ * 0 means "turn off the clock". */
 void guest_set_clockevent(struct lguest *lg, unsigned long delta)
 {
        ktime_t expires;
@@ -466,20 +480,27 @@ void guest_set_clockevent(struct lguest *lg, unsigned long delta)
                return;
        }
+        /* We use wallclock time here, so the Guest might not be running for
+         * all the time between now and the timer interrupt it asked for.  This
+         * is almost always the right thing to do. */
        expires = ktime_add_ns(ktime_get_real(), delta);
        hrtimer_start(&lg->hrt, expires, HRTIMER_MODE_ABS);
 }
+/* This is the function called when the Guest's timer expires. */
 static enum hrtimer_restart clockdev_fn(struct hrtimer *timer)
 {
        struct lguest *lg = container_of(timer, struct lguest, hrt);
+        /* Remember the first interrupt is the timer interrupt. */
        set_bit(0, lg->irqs_pending);
+        /* If the Guest is actually stopped, we need to wake it up. */
        if (lg->halted)
                wake_up_process(lg->tsk);
        return HRTIMER_NORESTART;
 }
+/* This sets up the timer for this Guest. */
 void init_clockdev(struct lguest *lg)
 {
        hrtimer_init(&lg->hrt, CLOCK_REALTIME, HRTIMER_MODE_ABS);
diff --git a/drivers/lguest/lg.h b/drivers/lguest/lg.h
index d9144beca8..86924891b5 100644
--- a/drivers/lguest/lg.h
+++ b/drivers/lguest/lg.h
@@ -74,9 +74,6 @@ struct lguest
        u32 pgdidx;
        struct pgdir pgdirs[4];
-        /* Cached wakeup: we hold a reference to this task. */
-        struct task_struct *wake;
        unsigned long noirq_start, noirq_end;
        unsigned long pending_notify; /* pfn from LHCALL_NOTIFY */
@@ -103,7 +100,7 @@ int lguest_address_ok(const struct lguest *lg,
 void __lgread(struct lguest *, void *, unsigned long, unsigned);
 void __lgwrite(struct lguest *, unsigned long, const void *, unsigned);
-/*L:306 Using memory-copy operations like that is usually inconvient, so we
+/*H:035 Using memory-copy operations like that is usually inconvient, so we
 * have the following helper macros which read and write a specific type (often
 * an unsigned long).
 *
@@ -191,7 +188,7 @@ void write_timestamp(struct lguest *lg);
 * Let's step aside for the moment, to study one important routine that's used
 * widely in the Host code.
 *
- * There are many cases where the Guest does something invalid, like pass crap
+ * There are many cases where the Guest can do something invalid, like pass crap
 * to a hypercall.  Since only the Guest kernel can make hypercalls, it's quite
 * acceptable to simply terminate the Guest and give the Launcher a nicely
 * formatted reason.  It's also simpler for the Guest itself, which doesn't
diff --git a/drivers/lguest/lguest_device.c b/drivers/lguest/lguest_device.c
index 71c64837b4..8904f72f97 100644
--- a/drivers/lguest/lguest_device.c
+++ b/drivers/lguest/lguest_device.c
@@ -53,7 +53,8 @@ struct lguest_device {
 * Device configurations
 *
 * The configuration information for a device consists of a series of fields.
- * The device will look for these fields during setup.
+ * We don't really care what they are: the Launcher set them up, and the driver
+ * will look at them during setup.
 *
 * For us these fields come immediately after that device's descriptor in the
 * lguest_devices page.
@@ -122,8 +123,8 @@ static void lg_set_status(struct virtio_device *vdev, u8 status)
 * The other piece of infrastructure virtio needs is a "virtqueue": a way of
 * the Guest device registering buffers for the other side to read from or
 * write into (ie. send and receive buffers).  Each device can have multiple
- * virtqueues: for example the console has one queue for sending and one for
+ * virtqueues: for example the console driver uses one queue for sending and
- * receiving.
+ * another for receiving.
 *
 * Fortunately for us, a very fast shared-memory-plus-descriptors virtqueue
 * already exists in virtio_ring.c.  We just need to connect it up.
@@ -158,7 +159,7 @@ static void lg_notify(struct virtqueue *vq)
 *
 * This is kind of an ugly duckling.  It'd be nicer to have a standard
 * representation of a virtqueue in the configuration space, but it seems that
- * everyone wants to do it differently.  The KVM guys want the Guest to
+ * everyone wants to do it differently.  The KVM coders want the Guest to
 * allocate its own pages and tell the Host where they are, but for lguest it's
 * simpler for the Host to simply tell us where the pages are.
 *
@@ -284,6 +285,8 @@ static void add_lguest_device(struct lguest_device_desc *d)
 {
        struct lguest_device *ldev;
+        /* Start with zeroed memory; Linux's device layer seems to count on
+         * it. */
        ldev = kzalloc(sizeof(*ldev), GFP_KERNEL);
        if (!ldev) {
                printk(KERN_EMERG "Cannot allocate lguest dev %u\n",
diff --git a/drivers/lguest/lguest_user.c b/drivers/lguest/lguest_user.c
index ee405b3838..9d716fa42c 100644
--- a/drivers/lguest/lguest_user.c
+++ b/drivers/lguest/lguest_user.c
@@ -8,20 +8,22 @@
 #include <linux/fs.h>
 #include "lg.h"
-/*L:315 To force the Guest to stop running and return to the Launcher, the
+/*L:055 When something happens, the Waker process needs a way to stop the
- * Waker sets writes LHREQ_BREAK and the value "1" to /dev/lguest.  The
+ * kernel running the Guest and return to the Launcher.  So the Waker writes
- * Launcher then writes LHREQ_BREAK and "0" to release the Waker. */
+ * LHREQ_BREAK and the value "1" to /dev/lguest to do this.  Once the Launcher
+ * has done whatever needs attention, it writes LHREQ_BREAK and "0" to release
+ * the Waker. */
 static int break_guest_out(struct lguest *lg, const unsigned long __user *input)
 {
        unsigned long on;
-        /* Fetch whether they're turning break on or off.. */
+        /* Fetch whether they're turning break on or off. */
        if (get_user(on, input) != 0)
                return -EFAULT;
        if (on) {
                lg->break_out = 1;
-                /* Pop it out (may be running on different CPU) */
+                /* Pop it out of the Guest (may be running on different CPU) */
                wake_up_process(lg->tsk);
                /* Wait for them to reset it */
                return wait_event_interruptible(lg->break_wq, !lg->break_out);
@@ -58,7 +60,7 @@ static ssize_t read(struct file *file, char __user *user, size_t size,loff_t*o)
        if (!lg)
                return -EINVAL;
-        /* If you're not the task which owns the guest, go away. */
+        /* If you're not the task which owns the Guest, go away. */
        if (current != lg->tsk)
                return -EPERM;
@@ -92,8 +94,8 @@ static ssize_t read(struct file *file, char __user *user, size_t size,loff_t*o)
 * base: The start of the Guest-physical memory inside the Launcher memory.
 *
 * pfnlimit: The highest (Guest-physical) page number the Guest should be
- * allowed to access.  The Launcher has to live in Guest memory, so it sets
+ * allowed to access.  The Guest memory lives inside the Launcher, so it sets
- * this to ensure the Guest can't reach it.
+ * this to ensure the Guest can only reach its own memory.
 *
 * pgdir: The (Guest-physical) address of the top of the initial Guest
 * pagetables (which are set up by the Launcher).
@@ -189,7 +191,7 @@ unlock:
 }
 /*L:010 The first operation the Launcher does must be a write.  All writes
- * start with a 32 bit number: for the first write this must be
+ * start with an unsigned long number: for the first write this must be
 * LHREQ_INITIALIZE to set up the Guest.  After that the Launcher can use
 * writes of other values to send interrupts. */
 static ssize_t write(struct file *file, const char __user *in,
@@ -275,8 +277,7 @@ static int close(struct inode *inode, struct file *file)
 * The Launcher is the Host userspace program which sets up, runs and services
 * the Guest.  In fact, many comments in the Drivers which refer to "the Host"
 * doing things are inaccurate: the Launcher does all the device handling for
- * the Guest.  The Guest can't tell what's done by the the Launcher and what by
+ * the Guest, but the Guest can't know that.
- * the Host.
 *
 * Just to confuse you: to the Host kernel, the Launcher *is* the Guest and we
 * shall see more of that later.
diff --git a/drivers/lguest/page_tables.c b/drivers/lguest/page_tables.c
index 2a45f0691c..fffabb3271 100644
--- a/drivers/lguest/page_tables.c
+++ b/drivers/lguest/page_tables.c
@@ -26,7 +26,8 @@
 *
 * We use two-level page tables for the Guest.  If you're not entirely
 * comfortable with virtual addresses, physical addresses and page tables then
- * I recommend you review lguest.c's "Page Table Handling" (with diagrams!).
+ * I recommend you review arch/x86/lguest/boot.c's "Page Table Handling" (with
+ * diagrams!).
 *
 * The Guest keeps page tables, but we maintain the actual ones here: these are
 * called "shadow" page tables.  Which is a very Guest-centric name: these are
@@ -36,11 +37,11 @@
 *
 * Anyway, this is the most complicated part of the Host code.  There are seven
 * parts to this:
- *  (i) Setting up a page table entry for the Guest when it faults,
+ *  (i) Looking up a page table entry when the Guest faults,
- *  (ii) Setting up the page table entry for the Guest stack,
+ *  (ii) Making sure the Guest stack is mapped,
- *  (iii) Setting up a page table entry when the Guest tells us it has changed,
+ *  (iii) Setting up a page table entry when the Guest tells us one has changed,
 *  (iv) Switching page tables,
- *  (v) Flushing (thowing away) page tables,
+ *  (v) Flushing (throwing away) page tables,
 *  (vi) Mapping the Switcher when the Guest is about to run,
 *  (vii) Setting up the page tables initially.
 :*/
@@ -57,16 +58,15 @@
 static DEFINE_PER_CPU(pte_t *, switcher_pte_pages);
 #define switcher_pte_page(cpu) per_cpu(switcher_pte_pages, cpu)
-/*H:320 With our shadow and Guest types established, we need to deal with
+/*H:320 The page table code is curly enough to need helper functions to keep it
- * them: the page table code is curly enough to need helper functions to keep
+ * clear and clean.
- * it clear and clean.
 *
 * There are two functions which return pointers to the shadow (aka "real")
 * page tables.
 *
 * spgd_addr() takes the virtual address and returns a pointer to the top-level
- * page directory entry for that address.  Since we keep track of several page
+ * page directory entry (PGD) for that address.  Since we keep track of several
- * tables, the "i" argument tells us which one we're interested in (it's
+ * page tables, the "i" argument tells us which one we're interested in (it's
 * usually the current one). */
 static pgd_t *spgd_addr(struct lguest *lg, u32 i, unsigned long vaddr)
 {
@@ -81,9 +81,9 @@ static pgd_t *spgd_addr(struct lguest *lg, u32 i, unsigned long vaddr)
        return &lg->pgdirs[i].pgdir[index];
 }
-/* This routine then takes the PGD entry given above, which contains the
+/* This routine then takes the page directory entry returned above, which
- * address of the PTE page.  It then returns a pointer to the PTE entry for the
+ * contains the address of the page table entry (PTE) page.  It then returns a
- * given address. */
+ * pointer to the PTE entry for the given address. */
 static pte_t *spte_addr(struct lguest *lg, pgd_t spgd, unsigned long vaddr)
 {
        pte_t *page = __va(pgd_pfn(spgd) << PAGE_SHIFT);
@@ -191,7 +191,7 @@ static void check_gpgd(struct lguest *lg, pgd_t gpgd)
 }
 /*H:330
- * (i) Setting up a page table entry for the Guest when it faults
+ * (i) Looking up a page table entry when the Guest faults.
 *
 * We saw this call in run_guest(): when we see a page fault in the Guest, we
 * come here.  That's because we only set up the shadow page tables lazily as
@@ -199,7 +199,7 @@ static void check_gpgd(struct lguest *lg, pgd_t gpgd)
 * and return to the Guest without it knowing.
 *
 * If we fixed up the fault (ie. we mapped the address), this routine returns
- * true. */
+ * true.  Otherwise, it was a real fault and we need to tell the Guest. */
 int demand_page(struct lguest *lg, unsigned long vaddr, int errcode)
 {
        pgd_t gpgd;
@@ -246,16 +246,16 @@ int demand_page(struct lguest *lg, unsigned long vaddr, int errcode)
        if ((errcode & 2) && !(pte_flags(gpte) & _PAGE_RW))
                return 0;
-        /* User access to a kernel page? (bit 3 == user access) */
+        /* User access to a kernel-only page? (bit 3 == user access) */
        if ((errcode & 4) && !(pte_flags(gpte) & _PAGE_USER))
                return 0;
        /* Check that the Guest PTE flags are OK, and the page number is below
         * the pfn_limit (ie. not mapping the Launcher binary). */
        check_gpte(lg, gpte);
        /* Add the _PAGE_ACCESSED and (for a write) _PAGE_DIRTY flag */
        gpte = pte_mkyoung(gpte);
        if (errcode & 2)
                gpte = pte_mkdirty(gpte);
@@ -272,23 +272,28 @@ int demand_page(struct lguest *lg, unsigned long vaddr, int errcode)
        else
                /* If this is a read, don't set the "writable" bit in the page
                 * table entry, even if the Guest says it's writable.  That way
-                 * we come back here when a write does actually ocur, so we can
+                 * we will come back here when a write does actually occur, so
-                 * update the Guest's _PAGE_DIRTY flag. */
+                 * we can update the Guest's _PAGE_DIRTY flag. */
                *spte = gpte_to_spte(lg, pte_wrprotect(gpte), 0);
        /* Finally, we write the Guest PTE entry back: we've set the
         * _PAGE_ACCESSED and maybe the _PAGE_DIRTY flags. */
        lgwrite(lg, gpte_ptr, pte_t, gpte);
-        /* We succeeded in mapping the page! */
+        /* The fault is fixed, the page table is populated, the mapping
+         * manipulated, the result returned and the code complete.  A small
+         * delay and a trace of alliteration are the only indications the Guest
+         * has that a page fault occurred at all. */
        return 1;
 }
-/*H:360 (ii) Setting up the page table entry for the Guest stack.
+/*H:360
+ * (ii) Making sure the Guest stack is mapped.
 *
- * Remember pin_stack_pages() which makes sure the stack is mapped?  It could
+ * Remember that direct traps into the Guest need a mapped Guest kernel stack.
- * simply call demand_page(), but as we've seen that logic is quite long, and
+ * pin_stack_pages() calls us here: we could simply call demand_page(), but as
- * usually the stack pages are already mapped anyway, so it's not required.
+ * we've seen that logic is quite long, and usually the stack pages are already
+ * mapped, so it's overkill.
 *
 * This is a quick version which answers the question: is this virtual address
 * mapped by the shadow page tables, and is it writable? */
@@ -297,7 +302,7 @@ static int page_writable(struct lguest *lg, unsigned long vaddr)
        pgd_t *spgd;
        unsigned long flags;
-        /* Look at the top level entry: is it present? */
+        /* Look at the current top level entry: is it present? */
        spgd = spgd_addr(lg, lg->pgdidx, vaddr);
        if (!(pgd_flags(*spgd) & _PAGE_PRESENT))
                return 0;
@@ -333,15 +338,14 @@ static void release_pgd(struct lguest *lg, pgd_t *spgd)
                        release_pte(ptepage[i]);
                /* Now we can free the page of PTEs */
                free_page((long)ptepage);
-                /* And zero out the PGD entry we we never release it twice. */
+                /* And zero out the PGD entry so we never release it twice. */
                *spgd = __pgd(0);
        }
 }
-/*H:440 (v) Flushing (thowing away) page tables,
+/*H:445 We saw flush_user_mappings() twice: once from the flush_user_mappings()
- *
+ * hypercall and once in new_pgdir() when we re-used a top-level pgdir page.
- * We saw flush_user_mappings() called when we re-used a top-level pgdir page.
+ * It simply releases every PTE page from 0 up to the Guest's kernel address. */
- * It simply releases every PTE page from 0 up to the kernel address. */
 static void flush_user_mappings(struct lguest *lg, int idx)
 {
        unsigned int i;
@@ -350,8 +354,10 @@ static void flush_user_mappings(struct lguest *lg, int idx)
                release_pgd(lg, lg->pgdirs[idx].pgdir + i);
 }
-/* The Guest also has a hypercall to do this manually: it's used when a large
+/*H:440 (v) Flushing (throwing away) page tables,
- * number of mappings have been changed. */
+ *
+ * The Guest has a hypercall to throw away the page tables: it's used when a
+ * large number of mappings have been changed. */
 void guest_pagetable_flush_user(struct lguest *lg)
 {
        /* Drop the userspace part of the current page table. */
@@ -423,8 +429,9 @@ static unsigned int new_pgdir(struct lguest *lg,
 /*H:430 (iv) Switching page tables
 *
- * This is what happens when the Guest changes page tables (ie. changes the
+ * Now we've seen all the page table setting and manipulation, let's see what
- * top-level pgdir).  This happens on almost every context switch. */
+ * what happens when the Guest changes page tables (ie. changes the top-level
+ * pgdir).  This occurs on almost every context switch. */
 void guest_new_pagetable(struct lguest *lg, unsigned long pgtable)
 {
        int newpgdir, repin = 0;
@@ -443,7 +450,8 @@ void guest_new_pagetable(struct lguest *lg, unsigned long pgtable)
 }
 /*H:470 Finally, a routine which throws away everything: all PGD entries in all
- * the shadow page tables.  This is used when we destroy the Guest. */
+ * the shadow page tables, including the Guest's kernel mappings.  This is used
+ * when we destroy the Guest. */
 static void release_all_pagetables(struct lguest *lg)
 {
        unsigned int i, j;
@@ -458,13 +466,22 @@ static void release_all_pagetables(struct lguest *lg)
 /* We also throw away everything when a Guest tells us it's changed a kernel
 * mapping.  Since kernel mappings are in every page table, it's easiest to
- * throw them all away.  This is amazingly slow, but thankfully rare. */
+ * throw them all away.  This traps the Guest in amber for a while as
+ * everything faults back in, but it's rare. */
 void guest_pagetable_clear_all(struct lguest *lg)
 {
        release_all_pagetables(lg);
        /* We need the Guest kernel stack mapped again. */
        pin_stack_pages(lg);
 }
+/*:*/
+/*M:009 Since we throw away all mappings when a kernel mapping changes, our
+ * performance sucks for guests using highmem.  In fact, a guest with
+ * PAGE_OFFSET 0xc0000000 (the default) and more than about 700MB of RAM is
+ * usually slower than a Guest with less memory.
+ *
+ * This, of course, cannot be fixed.  It would take some kind of... well, I
+ * don't know, but the term "puissant code-fu" comes to mind. :*/
 /*H:420 This is the routine which actually sets the page table entry for then
 * "idx"'th shadow page table.
@@ -483,7 +500,7 @@ void guest_pagetable_clear_all(struct lguest *lg)
 static void do_set_pte(struct lguest *lg, int idx,
                       unsigned long vaddr, pte_t gpte)
 {
-        /* Look up the matching shadow page directot entry. */
+        /* Look up the matching shadow page directory entry. */
        pgd_t *spgd = spgd_addr(lg, idx, vaddr);
        /* If the top level isn't present, there's no entry to update. */
@@ -500,7 +517,8 @@ static void do_set_pte(struct lguest *lg, int idx,
                        *spte = gpte_to_spte(lg, gpte,
                                             pte_flags(gpte) & _PAGE_DIRTY);
                } else
-                        /* Otherwise we can demand_page() it in later. */
+                        /* Otherwise kill it and we can demand_page() it in
+                         * later. */
                        *spte = __pte(0);
        }
 }
@@ -535,7 +553,7 @@ void guest_set_pte(struct lguest *lg,
 }
 /*H:400
- * (iii) Setting up a page table entry when the Guest tells us it has changed.
+ * (iii) Setting up a page table entry when the Guest tells us one has changed.
 *
 * Just like we did in interrupts_and_traps.c, it makes sense for us to deal
 * with the other side of page tables while we're here: what happens when the
@@ -612,9 +630,10 @@ void free_guest_pagetable(struct lguest *lg)
 /*H:480 (vi) Mapping the Switcher when the Guest is about to run.
 *
- * The Switcher and the two pages for this CPU need to be available to the
+ * The Switcher and the two pages for this CPU need to be visible in the
 * Guest (and not the pages for other CPUs).  We have the appropriate PTE pages
- * for each CPU already set up, we just need to hook them in. */
+ * for each CPU already set up, we just need to hook them in now we know which
+ * Guest is about to run on this CPU. */
 void map_switcher_in_guest(struct lguest *lg, struct lguest_pages *pages)
 {
        pte_t *switcher_pte_page = __get_cpu_var(switcher_pte_pages);
@@ -677,6 +696,18 @@ static __init void populate_switcher_pte_page(unsigned int cpu,
                           __pgprot(_PAGE_PRESENT|_PAGE_ACCESSED));
 }
+/* We've made it through the page table code.  Perhaps our tired brains are
+ * still processing the details, or perhaps we're simply glad it's over.
+ *
+ * If nothing else, note that all this complexity in juggling shadow page
+ * tables in sync with the Guest's page tables is for one reason: for most
+ * Guests this page table dance determines how bad performance will be.  This
+ * is why Xen uses exotic direct Guest pagetable manipulation, and why both
+ * Intel and AMD have implemented shadow page table support directly into
+ * hardware.
+ *
+ * There is just one file remaining in the Host. */
 /*H:510 At boot or module load time, init_pagetables() allocates and populates
 * the Switcher PTE page for each CPU. */
 __init int init_pagetables(struct page **switcher_page, unsigned int pages)
diff --git a/drivers/lguest/segments.c b/drivers/lguest/segments.c
index c2434ec99f..9e189cbec7 100644
--- a/drivers/lguest/segments.c
+++ b/drivers/lguest/segments.c
@@ -12,8 +12,6 @@
 #include "lg.h"
 /*H:600
- * We've almost completed the Host; there's just one file to go!
- *
 * Segments & The Global Descriptor Table
 *
 * (That title sounds like a bad Nerdcore group.  Not to suggest that there are
@@ -55,7 +53,7 @@ static int ignored_gdt(unsigned int num)
                || num == GDT_ENTRY_DOUBLEFAULT_TSS);
 }
-/*H:610 Once the GDT has been changed, we fix the new entries up a little.  We
+/*H:630 Once the Guest gave us new GDT entries, we fix them up a little.  We
 * don't care if they're invalid: the worst that can happen is a General
 * Protection Fault in the Switcher when it restores a Guest segment register
 * which tries to use that entry.  Then we kill the Guest for causing such a
@@ -84,25 +82,33 @@ static void fixup_gdt_table(struct lguest *lg, unsigned start, unsigned end)
        }
 }
-/* This routine is called at boot or modprobe time for each CPU to set up the
+/*H:610 Like the IDT, we never simply use the GDT the Guest gives us.  We keep
- * "constant" GDT entries for Guests running on that CPU. */
+ * a GDT for each CPU, and copy across the Guest's entries each time we want to
+ * run the Guest on that CPU.
+ *
+ * This routine is called at boot or modprobe time for each CPU to set up the
+ * constant GDT entries: the ones which are the same no matter what Guest we're
+ * running. */
 void setup_default_gdt_entries(struct lguest_ro_state *state)
 {
        struct desc_struct *gdt = state->guest_gdt;
        unsigned long tss = (unsigned long)&state->guest_tss;
-        /* The hypervisor segments are full 0-4G segments, privilege level 0 */
+        /* The Switcher segments are full 0-4G segments, privilege level 0 */
        gdt[GDT_ENTRY_LGUEST_CS] = FULL_EXEC_SEGMENT;
        gdt[GDT_ENTRY_LGUEST_DS] = FULL_SEGMENT;
-        /* The TSS segment refers to the TSS entry for this CPU, so we cannot
+        /* The TSS segment refers to the TSS entry for this particular CPU.
-         * copy it from the Guest.  Forgive the magic flags */
+         * Forgive the magic flags: the 0x8900 means the entry is Present, it's
+         * privilege level 0 Available 386 TSS system segment, and the 0x67
+         * means Saturn is eclipsed by Mercury in the twelfth house. */
        gdt[GDT_ENTRY_TSS].a = 0x00000067 | (tss << 16);
        gdt[GDT_ENTRY_TSS].b = 0x00008900 | (tss & 0xFF000000)
                | ((tss >> 16) & 0x000000FF);
 }
-/* This routine is called before the Guest is run for the first time. */
+/* This routine sets up the initial Guest GDT for booting.  All entries start
+ * as 0 (unusable). */
 void setup_guest_gdt(struct lguest *lg)
 {
        /* Start with full 0-4G segments... */
@@ -114,13 +120,8 @@ void setup_guest_gdt(struct lguest *lg)
        lg->arch.gdt[GDT_ENTRY_KERNEL_DS].b |= (GUEST_PL << 13);
 }
-/* Like the IDT, we never simply use the GDT the Guest gives us.  We set up the
+/*H:650 An optimization of copy_gdt(), for just the three "thead-local storage"
- * GDTs for each CPU, then we copy across the entries each time we want to run
+ * entries. */
- * a different Guest on that CPU. */
-/* A partial GDT load, for the three "thead-local storage" entries.  Otherwise
- * it's just like load_guest_gdt().  So much, in fact, it would probably be
- * neater to have a single hypercall to cover both. */
 void copy_gdt_tls(const struct lguest *lg, struct desc_struct *gdt)
 {
        unsigned int i;
@@ -129,7 +130,9 @@ void copy_gdt_tls(const struct lguest *lg, struct desc_struct *gdt)
                gdt[i] = lg->arch.gdt[i];
 }
-/* This is the full version */
+/*H:640 When the Guest is run on a different CPU, or the GDT entries have
+ * changed, copy_gdt() is called to copy the Guest's GDT entries across to this
+ * CPU's GDT. */
 void copy_gdt(const struct lguest *lg, struct desc_struct *gdt)
 {
        unsigned int i;
@@ -141,7 +144,8 @@ void copy_gdt(const struct lguest *lg, struct desc_struct *gdt)
                        gdt[i] = lg->arch.gdt[i];
 }
-/* This is where the Guest asks us to load a new GDT (LHCALL_LOAD_GDT). */
+/*H:620 This is where the Guest asks us to load a new GDT (LHCALL_LOAD_GDT).
+ * We copy it from the Guest and tweak the entries. */
 void load_guest_gdt(struct lguest *lg, unsigned long table, u32 num)
 {
        /* We assume the Guest has the same number of GDT entries as the
@@ -157,16 +161,22 @@ void load_guest_gdt(struct lguest *lg, unsigned long table, u32 num)
        lg->changed |= CHANGED_GDT;
 }
+/* This is the fast-track version for just changing the three TLS entries.
+ * Remember that this happens on every context switch, so it's worth
+ * optimizing.  But wouldn't it be neater to have a single hypercall to cover
+ * both cases? */
 void guest_load_tls(struct lguest *lg, unsigned long gtls)
 {
        struct desc_struct *tls = &lg->arch.gdt[GDT_ENTRY_TLS_MIN];
        __lgread(lg, tls, gtls, sizeof(*tls)*GDT_ENTRY_TLS_ENTRIES);
        fixup_gdt_table(lg, GDT_ENTRY_TLS_MIN, GDT_ENTRY_TLS_MAX+1);
+        /* Note that just the TLS entries have changed. */
        lg->changed |= CHANGED_GDT_TLS;
 }
+/*:*/
-/*
+/*H:660
 * With this, we have finished the Host.
 *
 * Five of the seven parts of our task are complete.  You have made it through
diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
index 9eed12d5a3..482aec2a96 100644
--- a/drivers/lguest/x86/core.c
+++ b/drivers/lguest/x86/core.c
@@ -63,7 +63,7 @@ static struct lguest_pages *lguest_pages(unsigned int cpu)
 static DEFINE_PER_CPU(struct lguest *, last_guest);
 /*S:010
- * We are getting close to the Switcher.
+ * We approach the Switcher.
 *
 * Remember that each CPU has two pages which are visible to the Guest when it
 * runs on that CPU.  This has to contain the state for that Guest: we copy the
@@ -134,7 +134,7 @@ static void run_guest_once(struct lguest *lg, struct lguest_pages *pages)
         *
         * The lcall also pushes the old code segment (KERNEL_CS) onto the
         * stack, then the address of this call.  This stack layout happens to
-         * exactly match the stack of an interrupt... */
+         * exactly match the stack layout created by an interrupt... */
        asm volatile("pushf; lcall *lguest_entry"
                     /* This is how we tell GCC that %eax ("a") and %ebx ("b")
                      * are changed by this routine.  The "=" means output. */
@@ -151,40 +151,46 @@ static void run_guest_once(struct lguest *lg, struct lguest_pages *pages)
 }
 /*:*/
+/*M:002 There are hooks in the scheduler which we can register to tell when we
+ * get kicked off the CPU (preempt_notifier_register()).  This would allow us
+ * to lazily disable SYSENTER which would regain some performance, and should
+ * also simplify copy_in_guest_info().  Note that we'd still need to restore
+ * things when we exit to Launcher userspace, but that's fairly easy.
+ *
+ * The hooks were designed for KVM, but we can also put them to good use. :*/
 /*H:040 This is the i386-specific code to setup and run the Guest.  Interrupts
 * are disabled: we own the CPU. */
 void lguest_arch_run_guest(struct lguest *lg)
 {
-        /* Remember the awfully-named TS bit?  If the Guest has asked
+        /* Remember the awfully-named TS bit?  If the Guest has asked to set it
-         * to set it we set it now, so we can trap and pass that trap
+         * we set it now, so we can trap and pass that trap to the Guest if it
-         * to the Guest if it uses the FPU. */
+         * uses the FPU. */
        if (lg->ts)
                lguest_set_ts();
-        /* SYSENTER is an optimized way of doing system calls.  We
+        /* SYSENTER is an optimized way of doing system calls.  We can't allow
-         * can't allow it because it always jumps to privilege level 0.
+         * it because it always jumps to privilege level 0.  A normal Guest
-         * A normal Guest won't try it because we don't advertise it in
+         * won't try it because we don't advertise it in CPUID, but a malicious
-         * CPUID, but a malicious Guest (or malicious Guest userspace
+         * Guest (or malicious Guest userspace program) could, so we tell the
-         * program) could, so we tell the CPU to disable it before
+         * CPU to disable it before running the Guest. */
-         * running the Guest. */
        if (boot_cpu_has(X86_FEATURE_SEP))
                wrmsr(MSR_IA32_SYSENTER_CS, 0, 0);
-        /* Now we actually run the Guest.  It will pop back out when
+        /* Now we actually run the Guest.  It will return when something
-         * something interesting happens, and we can examine its
+         * interesting happens, and we can examine its registers to see what it
-         * registers to see what it was doing. */
+         * was doing. */
        run_guest_once(lg, lguest_pages(raw_smp_processor_id()));
-        /* The "regs" pointer contains two extra entries which are not
+        /* Note that the "regs" pointer contains two extra entries which are
-         * really registers: a trap number which says what interrupt or
+         * not really registers: a trap number which says what interrupt or
-         * trap made the switcher code come back, and an error code
+         * trap made the switcher code come back, and an error code which some
-         * which some traps set.  */
+         * traps set.  */
-        /* If the Guest page faulted, then the cr2 register will tell
+        /* If the Guest page faulted, then the cr2 register will tell us the
-         * us the bad virtual address.  We have to grab this now,
+         * bad virtual address.  We have to grab this now, because once we
-         * because once we re-enable interrupts an interrupt could
+         * re-enable interrupts an interrupt could fault and thus overwrite
-         * fault and thus overwrite cr2, or we could even move off to a
+         * cr2, or we could even move off to a different CPU. */
-         * different CPU. */
        if (lg->regs->trapnum == 14)
                lg->arch.last_pagefault = read_cr2();
        /* Similarly, if we took a trap because the Guest used the FPU,
@@ -197,14 +203,15 @@ void lguest_arch_run_guest(struct lguest *lg)
                wrmsr(MSR_IA32_SYSENTER_CS, __KERNEL_CS, 0);
 }
-/*H:130 Our Guest is usually so well behaved; it never tries to do things it
+/*H:130 Now we've examined the hypercall code; our Guest can make requests.
- * isn't allowed to.  Unfortunately, Linux's paravirtual infrastructure isn't
+ * Our Guest is usually so well behaved; it never tries to do things it isn't
- * quite complete, because it doesn't contain replacements for the Intel I/O
+ * allowed to, and uses hypercalls instead.  Unfortunately, Linux's paravirtual
- * instructions.  As a result, the Guest sometimes fumbles across one during
+ * infrastructure isn't quite complete, because it doesn't contain replacements
- * the boot process as it probes for various things which are usually attached
+ * for the Intel I/O instructions.  As a result, the Guest sometimes fumbles
- * to a PC.
+ * across one during the boot process as it probes for various things which are
+ * usually attached to a PC.
 *
- * When the Guest uses one of these instructions, we get trap #13 (General
+ * When the Guest uses one of these instructions, we get a trap (General
 * Protection Fault) and come here.  We see if it's one of those troublesome
 * instructions and skip over it.  We return true if we did. */
 static int emulate_insn(struct lguest *lg)
@@ -275,43 +282,43 @@ static int emulate_insn(struct lguest *lg)
 void lguest_arch_handle_trap(struct lguest *lg)
 {
        switch (lg->regs->trapnum) {
-        case 13: /* We've intercepted a GPF. */
+        case 13: /* We've intercepted a General Protection Fault. */
-                 /* Check if this was one of those annoying IN or OUT
+                /* Check if this was one of those annoying IN or OUT
-                  * instructions which we need to emulate.  If so, we
+                 * instructions which we need to emulate.  If so, we just go
-                  * just go back into the Guest after we've done it. */
+                 * back into the Guest after we've done it. */
                if (lg->regs->errcode == 0) {
                        if (emulate_insn(lg))
                                return;
                }
                break;
-        case 14: /* We've intercepted a page fault. */
+        case 14: /* We've intercepted a Page Fault. */
-                 /* The Guest accessed a virtual address that wasn't
+                /* The Guest accessed a virtual address that wasn't mapped.
-                  * mapped.  This happens a lot: we don't actually set
+                 * This happens a lot: we don't actually set up most of the
-                  * up most of the page tables for the Guest at all when
+                 * page tables for the Guest at all when we start: as it runs
-                  * we start: as it runs it asks for more and more, and
+                 * it asks for more and more, and we set them up as
-                  * we set them up as required. In this case, we don't
+                 * required. In this case, we don't even tell the Guest that
-                  * even tell the Guest that the fault happened.
+                 * the fault happened.
-                  *
+                 *
-                  * The errcode tells whether this was a read or a
+                 * The errcode tells whether this was a read or a write, and
-                  * write, and whether kernel or userspace code. */
+                 * whether kernel or userspace code. */
                if (demand_page(lg, lg->arch.last_pagefault, lg->regs->errcode))
                        return;
-                 /* OK, it's really not there (or not OK): the Guest
+                /* OK, it's really not there (or not OK): the Guest needs to
-                  * needs to know.  We write out the cr2 value so it
+                 * know.  We write out the cr2 value so it knows where the
-                  * knows where the fault occurred.
+                 * fault occurred.
-                  *
+                 *
-                  * Note that if the Guest were really messed up, this
+                 * Note that if the Guest were really messed up, this could
-                  * could happen before it's done the INITIALIZE
+                 * happen before it's done the LHCALL_LGUEST_INIT hypercall, so
-                  * hypercall, so lg->lguest_data will be NULL */
+                 * lg->lguest_data could be NULL */
                if (lg->lguest_data &&
                    put_user(lg->arch.last_pagefault, &lg->lguest_data->cr2))
                        kill_guest(lg, "Writing cr2");
                break;
        case 7: /* We've intercepted a Device Not Available fault. */
-                /* If the Guest doesn't want to know, we already
+                /* If the Guest doesn't want to know, we already restored the
-                 * restored the Floating Point Unit, so we just
+                 * Floating Point Unit, so we just continue without telling
-                 * continue without telling it. */
+                 * it. */
                if (!lg->ts)
                        return;
                break;
@@ -536,9 +543,6 @@ int lguest_arch_init_hypercalls(struct lguest *lg)
        return 0;
 }
-/* Now we've examined the hypercall code; our Guest can make requests.  There
- * is one other way we can do things for the Guest, as we see in
- * emulate_insn(). :*/
 /*L:030 lguest_arch_setup_regs()
 *
@@ -562,7 +566,7 @@ void lguest_arch_setup_regs(struct lguest *lg, unsigned long start)
         * is supposed to always be "1".  Bit 9 (0x200) controls whether
         * interrupts are enabled.  We always leave interrupts enabled while
         * running the Guest. */
-        regs->eflags = 0x202;
+        regs->eflags = X86_EFLAGS_IF | 0x2;
        /* The "Extended Instruction Pointer" register says where the Guest is
         * running. */
@@ -570,8 +574,8 @@ void lguest_arch_setup_regs(struct lguest *lg, unsigned long start)
        /* %esi points to our boot information, at physical address 0, so don't
         * touch it. */
        /* There are a couple of GDT entries the Guest expects when first
         * booting. */
        setup_guest_gdt(lg);
 }
diff --git a/drivers/lguest/x86/switcher_32.S b/drivers/lguest/x86/switcher_32.S
index 1010b90b11..0af8baaa0d 100644
--- a/drivers/lguest/x86/switcher_32.S
+++ b/drivers/lguest/x86/switcher_32.S
@@ -6,6 +6,37 @@
 * are feeling invigorated and refreshed then the next, more challenging stage
 * can be found in "make Guest". :*/
+/*M:012 Lguest is meant to be simple: my rule of thumb is that 1% more LOC must
+ * gain at least 1% more performance.  Since neither LOC nor performance can be
+ * measured beforehand, it generally means implementing a feature then deciding
+ * if it's worth it.  And once it's implemented, who can say no?
+ *
+ * This is why I haven't implemented this idea myself.  I want to, but I
+ * haven't.  You could, though.
+ *
+ * The main place where lguest performance sucks is Guest page faulting.  When
+ * a Guest userspace process hits an unmapped page we switch back to the Host,
+ * walk the page tables, find it's not mapped, switch back to the Guest page
+ * fault handler, which calls a hypercall to set the page table entry, then
+ * finally returns to userspace.  That's two round-trips.
+ *
+ * If we had a small walker in the Switcher, we could quickly check the Guest
+ * page table and if the page isn't mapped, immediately reflect the fault back
+ * into the Guest.  This means the Switcher would have to know the top of the
+ * Guest page table and the page fault handler address.
+ *
+ * For simplicity, the Guest should only handle the case where the privilege
+ * level of the fault is 3 and probably only not present or write faults.  It
+ * should also detect recursive faults, and hand the original fault to the
+ * Host (which is actually really easy).
+ *
+ * Two questions remain.  Would the performance gain outweigh the complexity?
+ * And who would write the verse documenting it? :*/
+/*M:011 Lguest64 handles NMI.  This gave me NMI envy (until I looked at their
+ * code).  It's worth doing though, since it would let us use oprofile in the
+ * Host when a Guest is running. :*/
 /*S:100
 * Welcome to the Switcher itself!
 *
@@ -88,7 +119,7 @@ ENTRY(switch_to_guest)
        // All saved and there's now five steps before us:
        // Stack, GDT, IDT, TSS
-        // And last of all the page tables are flipped.
+        // Then last of all the page tables are flipped.
        // Yet beware that our stack pointer must be
        // Always valid lest an NMI hits
@@ -103,25 +134,25 @@ ENTRY(switch_to_guest)
        lgdt    LGUEST_PAGES_guest_gdt_desc(%eax)
        // The Guest's IDT we did partially
-        // Move to the "struct lguest_pages" as well.
+        // Copy to "struct lguest_pages" as well.
        lidt    LGUEST_PAGES_guest_idt_desc(%eax)
        // The TSS entry which controls traps
        // Must be loaded up with "ltr" now:
+        // The GDT entry that TSS uses 
+        // Changes type when we load it: damn Intel!
        // For after we switch over our page tables
-        // It (as the rest) will be writable no more.
+        // That entry will be read-only: we'd crash.
-        // (The GDT entry TSS needs
-        // Changes type when we load it: damn Intel!)
        movl    $(GDT_ENTRY_TSS*8), %edx
        ltr     %dx
        // Look back now, before we take this last step!
        // The Host's TSS entry was also marked used;
-        // Let's clear it again, ere we return.
+        // Let's clear it again for our return.
        // The GDT descriptor of the Host
        // Points to the table after two "size" bytes
        movl    (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
-        // Clear the type field of "used" (byte 5, bit 2)
+        // Clear "used" from type field (byte 5, bit 2)
        andb    $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
        // Once our page table's switched, the Guest is live!
@@ -131,7 +162,7 @@ ENTRY(switch_to_guest)
        // The page table change did one tricky thing:
        // The Guest's register page has been mapped
-        // Writable onto our %esp (stack) --
+        // Writable under our %esp (stack) --
        // We can simply pop off all Guest regs.
        popl    %eax
        popl    %ebx
@@ -152,16 +183,15 @@ ENTRY(switch_to_guest)
        addl    $8, %esp
        // The last five stack slots hold return address
-        // And everything needed to change privilege
+        // And everything needed to switch privilege
-        // Into the Guest privilege level of 1,
+        // From Switcher's level 0 to Guest's 1,
        // And the stack where the Guest had last left it.
        // Interrupts are turned back on: we are Guest.
        iret
-// There are two paths where we switch to the Host
+// We treat two paths to switch back to the Host
+// Yet both must save Guest state and restore Host
 // So we put the routine in a macro.
-// We are on our way home, back to the Host
-// Interrupted out of the Guest, we come here.
 #define SWITCH_TO_HOST                                                  \
        /* We save the Guest state: all registers first                 \
         * Laid out just as "struct lguest_regs" defines */             \
@@ -194,7 +224,7 @@ ENTRY(switch_to_guest)
        movl    %esp, %eax;                                             \
        andl    $(~(1 << PAGE_SHIFT - 1)), %eax;                        \
        /* Save our trap number: the switch will obscure it             \
-         * (The Guest regs are not mapped here in the Host)             \
+         * (In the Host the Guest regs are not mapped here)             \
         * %ebx holds it safe for deliver_to_host */                    \
        movl    LGUEST_PAGES_regs_trapnum(%eax), %ebx;                  \
        /* The Host GDT, IDT and stack!                                 \
@@ -210,9 +240,9 @@ ENTRY(switch_to_guest)
        /* Switch to Host's GDT, IDT. */                                \
        lgdt    LGUEST_PAGES_host_gdt_desc(%eax);                       \
        lidt    LGUEST_PAGES_host_idt_desc(%eax);                       \
-        /* Restore the Host's stack where it's saved regs lie */        \
+        /* Restore the Host's stack where its saved regs lie */         \
        movl    LGUEST_PAGES_host_sp(%eax), %esp;                       \
-        /* Last the TSS: our Host is complete */                        \
+        /* Last the TSS: our Host is returned */                        \
        movl    $(GDT_ENTRY_TSS*8), %edx;                               \
        ltr     %dx;                                                    \
        /* Restore now the regs saved right at the first. */            \
@@ -222,14 +252,15 @@ ENTRY(switch_to_guest)
        popl    %ds;                                                    \
        popl    %es
-// Here's where we come when the Guest has just trapped:
+// The first path is trod when the Guest has trapped:
-// (Which trap we'll see has been pushed on the stack).
+// (Which trap it was has been pushed on the stack).
 // We need only switch back, and the Host will decode
 // Why we came home, and what needs to be done.
 return_to_host:
        SWITCH_TO_HOST
        iret
+// We are lead to the second path like so:
 // An interrupt, with some cause external
 // Has ajerked us rudely from the Guest's code
 // Again we must return home to the Host
@@ -238,7 +269,7 @@ deliver_to_host:
        // But now we must go home via that place
        // Where that interrupt was supposed to go
        // Had we not been ensconced, running the Guest.
-        // Here we see the cleverness of our stack:
+        // Here we see the trickness of run_guest_once():
        // The Host stack is formed like an interrupt
        // With EIP, CS and EFLAGS layered.
        // Interrupt handlers end with "iret"
@@ -263,7 +294,7 @@ deliver_to_host:
        xorw    %ax, %ax
        orl     %eax, %edx
        // Now the address of the handler's in %edx
-        // We call it now: its "iret" takes us home.
+        // We call it now: its "iret" drops us home.
        jmp     *%edx
 // Every interrupt can come to us here
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index ac54f697c5..28c6ae095c 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -168,7 +168,7 @@ static int crypt_iv_essiv_ctr(struct crypt_config *cc, struct dm_target *ti,
                return -ENOMEM;
        }
-        sg_set_buf(&sg, cc->key, cc->key_size);
+        sg_init_one(&sg, cc->key, cc->key_size);
        desc.tfm = hash_tfm;
        desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP;
        err = crypto_hash_digest(&desc, &sg, cc->key_size, salt);
@@ -351,14 +351,10 @@ static int crypt_convert(struct crypt_config *cc,
                struct scatterlist sg_in, sg_out;
                sg_init_table(&sg_in, 1);
-                sg_set_page(&sg_in, bv_in->bv_page);
+                sg_set_page(&sg_in, bv_in->bv_page, 1 << SECTOR_SHIFT, bv_in->bv_offset + ctx->offset_in);
-                sg_in.offset = bv_in->bv_offset + ctx->offset_in;
-                sg_in.length = 1 << SECTOR_SHIFT;
                sg_init_table(&sg_out, 1);
-                sg_set_page(&sg_out, bv_out->bv_page);
+                sg_set_page(&sg_out, bv_out->bv_page, 1 << SECTOR_SHIFT, bv_out->bv_offset + ctx->offset_out);
-                sg_out.offset = bv_out->bv_offset + ctx->offset_out;
-                sg_out.length = 1 << SECTOR_SHIFT;
                ctx->offset_in += sg_in.length;
                if (ctx->offset_in >= bv_in->bv_len) {
diff --git a/drivers/media/common/saa7146_core.c b/drivers/media/common/saa7146_core.c
index 2b1f8b4be0..cb034ead95 100644
--- a/drivers/media/common/saa7146_core.c
+++ b/drivers/media/common/saa7146_core.c
@@ -118,8 +118,7 @@ static struct scatterlist* vmalloc_to_sg(unsigned char *virt, int nr_pages)
                if (NULL == pg)
                        goto err;
                BUG_ON(PageHighMem(pg));
-                sg_set_page(&sglist[i], pg);
+                sg_set_page(&sglist[i], pg, PAGE_SIZE, 0);
-                sglist[i].length = PAGE_SIZE;
        }
        return sglist;
diff --git a/drivers/media/video/ivtv/ivtv-udma.c b/drivers/media/video/ivtv/ivtv-udma.c
index 912b424e52..460db03b0b 100644
--- a/drivers/media/video/ivtv/ivtv-udma.c
+++ b/drivers/media/video/ivtv/ivtv-udma.c
@@ -49,8 +49,6 @@ int ivtv_udma_fill_sg_list (struct ivtv_user_dma *dma, struct ivtv_dma_page_info
                unsigned int len = (i == dma_page->page_count - 1) ?
                        dma_page->tail : PAGE_SIZE - offset;
-                dma->SGlist[map_offset].length = len;
-                dma->SGlist[map_offset].offset = offset;
                if (PageHighMem(dma->map[map_offset])) {
                        void *src;
@@ -63,10 +61,10 @@ int ivtv_udma_fill_sg_list (struct ivtv_user_dma *dma, struct ivtv_dma_page_info
                        memcpy(page_address(dma->bouncemap[map_offset]) + offset, src, len);
                        kunmap_atomic(src, KM_BOUNCE_READ);
                        local_irq_restore(flags);
-                        sg_set_page(&dma->SGlist[map_offset], dma->bouncemap[map_offset]);
+                        sg_set_page(&dma->SGlist[map_offset], dma->bouncemap[map_offset], len, offset);
                }
                else {
-                        sg_set_page(&dma->SGlist[map_offset], dma->map[map_offset]);
+                        sg_set_page(&dma->SGlist[map_offset], dma->map[map_offset], len, offset);
                }
                offset = 0;
                map_offset++;
diff --git a/drivers/media/video/videobuf-dma-sg.c b/drivers/media/video/videobuf-dma-sg.c
index 9ab94a749d..44ee408e14 100644
--- a/drivers/media/video/videobuf-dma-sg.c
+++ b/drivers/media/video/videobuf-dma-sg.c
@@ -67,8 +67,7 @@ videobuf_vmalloc_to_sg(unsigned char *virt, int nr_pages)
                if (NULL == pg)
                        goto err;
                BUG_ON(PageHighMem(pg));
-                sg_set_page(&sglist[i], pg);
+                sg_set_page(&sglist[i], pg, PAGE_SIZE, 0);
-                sglist[i].length = PAGE_SIZE;
        }
        return sglist;
@@ -95,16 +94,13 @@ videobuf_pages_to_sg(struct page **pages, int nr_pages, int offset)
        if (PageHighMem(pages[0]))
                /* DMA to highmem pages might not work */
                goto highmem;
-        sg_set_page(&sglist[0], pages[0]);
+        sg_set_page(&sglist[0], pages[0], PAGE_SIZE - offset, offset);
-        sglist[0].offset = offset;
-        sglist[0].length = PAGE_SIZE - offset;
        for (i = 1; i < nr_pages; i++) {
                if (NULL == pages[i])
                        goto nopage;
                if (PageHighMem(pages[i]))
                        goto highmem;
-                sg_set_page(&sglist[i], pages[i]);
+                sg_set_page(&sglist[i], pages[i], PAGE_SIZE, 0);
-                sglist[i].length = PAGE_SIZE;
        }
        return sglist;
diff --git a/drivers/message/i2o/i2o_block.c b/drivers/message/i2o/i2o_block.c
index d602ba6d54..682406168d 100644
--- a/drivers/message/i2o/i2o_block.c
+++ b/drivers/message/i2o/i2o_block.c
@@ -284,6 +284,7 @@ static inline struct i2o_block_request *i2o_block_request_alloc(void)
                return ERR_PTR(-ENOMEM);
        INIT_LIST_HEAD(&ireq->queue);
+        sg_init_table(ireq->sg_table, I2O_MAX_PHYS_SEGMENTS);
        return ireq;
 };
diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
index bf4bc6adcf..7471d49909 100644
--- a/drivers/mmc/core/mmc_ops.c
+++ b/drivers/mmc/core/mmc_ops.c
@@ -267,15 +267,26 @@ mmc_send_cxd_data(struct mmc_card *card, struct mmc_host *host,
 int mmc_send_csd(struct mmc_card *card, u32 *csd)
 {
+        int ret, i;
        if (!mmc_host_is_spi(card->host))
                return mmc_send_cxd_native(card->host, card->rca << 16,
                                csd, MMC_SEND_CSD);
-        return mmc_send_cxd_data(card, card->host, MMC_SEND_CSD, csd, 16);
+        ret = mmc_send_cxd_data(card, card->host, MMC_SEND_CSD, csd, 16);
+        if (ret)
+                return ret;
+        for (i = 0;i < 4;i++)
+                csd[i] = be32_to_cpu(csd[i]);
+        return 0;
 }
 int mmc_send_cid(struct mmc_host *host, u32 *cid)
 {
+        int ret, i;
        if (!mmc_host_is_spi(host)) {
                if (!host->card)
                        return -EINVAL;
@@ -283,7 +294,14 @@ int mmc_send_cid(struct mmc_host *host, u32 *cid)
                                cid, MMC_SEND_CID);
        }
-        return mmc_send_cxd_data(NULL, host, MMC_SEND_CID, cid, 16);
+        ret = mmc_send_cxd_data(NULL, host, MMC_SEND_CID, cid, 16);
+        if (ret)
+                return ret;
+        for (i = 0;i < 4;i++)
+                cid[i] = be32_to_cpu(cid[i]);
+        return 0;
 }
 int mmc_send_ext_csd(struct mmc_card *card, u8 *ext_csd)
diff --git a/drivers/mmc/core/sd_ops.c b/drivers/mmc/core/sd_ops.c
index ee4029a24e..a6dafe62b9 100644
--- a/drivers/mmc/core/sd_ops.c
+++ b/drivers/mmc/core/sd_ops.c
@@ -294,8 +294,8 @@ int mmc_app_send_scr(struct mmc_card *card, u32 *scr)
        if (data.error)
                return data.error;
-        scr[0] = ntohl(scr[0]);
+        scr[0] = be32_to_cpu(scr[0]);
-        scr[1] = ntohl(scr[1]);
+        scr[1] = be32_to_cpu(scr[1]);
        return 0;
 }
diff --git a/drivers/mmc/host/au1xmmc.c b/drivers/mmc/host/au1xmmc.c
index bcbb6d247b..c3926eb3bf 100644
--- a/drivers/mmc/host/au1xmmc.c
+++ b/drivers/mmc/host/au1xmmc.c
@@ -40,13 +40,13 @@
 #include <linux/mm.h>
 #include <linux/interrupt.h>
 #include <linux/dma-mapping.h>
+#include <linux/scatterlist.h>
 #include <linux/mmc/host.h>
 #include <asm/io.h>
 #include <asm/mach-au1x00/au1000.h>
 #include <asm/mach-au1x00/au1xxx_dbdma.h>
 #include <asm/mach-au1x00/au1100_mmc.h>
-#include <asm/scatterlist.h>
 #include <au1xxx.h>
 #include "au1xmmc.h"
@@ -212,12 +212,12 @@ static int au1xmmc_send_command(struct au1xmmc_host *host, int wait,
        }
        if (data) {
-                if (flags & MMC_DATA_READ) {
+                if (data->flags & MMC_DATA_READ) {
                        if (data->blocks > 1)
                                mmccmd |= SD_CMD_CT_4;
                        else
                                mmccmd |= SD_CMD_CT_2;
-                } else if (flags & MMC_DATA_WRITE) {
+                } else if (data->flags & MMC_DATA_WRITE) {
                        if (data->blocks > 1)
                                mmccmd |= SD_CMD_CT_3;
                        else
diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c
index 12c2d807c1..a6469218f1 100644
--- a/drivers/mmc/host/mmc_spi.c
+++ b/drivers/mmc/host/mmc_spi.c
@@ -1165,6 +1165,23 @@ mmc_spi_detect_irq(int irq, void *mmc)
        return IRQ_HANDLED;
 }
+struct count_children {
+        unsigned        n;
+        struct bus_type *bus;
+};
+static int maybe_count_child(struct device *dev, void *c)
+{
+        struct count_children *ccp = c;
+        if (dev->bus == ccp->bus) {
+                if (ccp->n)
+                        return -EBUSY;
+                ccp->n++;
+        }
+        return 0;
+}
 static int mmc_spi_probe(struct spi_device *spi)
 {
        void                    *ones;
@@ -1188,33 +1205,30 @@ static int mmc_spi_probe(struct spi_device *spi)
                return status;
        }
-        /* We can use the bus safely iff nobody else will interfere with
+        /* We can use the bus safely iff nobody else will interfere with us.
-         * us.  That is, either we have the experimental exclusive access
+         * Most commands consist of one SPI message to issue a command, then
-         * primitives ... or else there's nobody to share it with.
+         * several more to collect its response, then possibly more for data
+         * transfer.  Clocking access to other devices during that period will
+         * corrupt the command execution.
+         *
+         * Until we have software primitives which guarantee non-interference,
+         * we'll aim for a hardware-level guarantee.
+         *
+         * REVISIT we can't guarantee another device won't be added later...
         */
        if (spi->master->num_chipselect > 1) {
-                struct device   *parent = spi->dev.parent;
+                struct count_children cc;
-                /* If there are multiple devices on this bus, we
+                cc.n = 0;
-                 * can't proceed.
+                cc.bus = spi->dev.bus;
-                 */
+                status = device_for_each_child(spi->dev.parent, &cc,
-                spin_lock(&parent->klist_children.k_lock);
+                                maybe_count_child);
-                if (parent->klist_children.k_list.next
-                                != parent->klist_children.k_list.prev)
-                        status = -EMLINK;
-                else
-                        status = 0;
-                spin_unlock(&parent->klist_children.k_lock);
                if (status < 0) {
                        dev_err(&spi->dev, "can't share SPI bus\n");
                        return status;
                }
-                /* REVISIT we can't guarantee another device won't
+                dev_warn(&spi->dev, "ASSUMING SPI bus stays unshared!\n");
-                 * be added later.  It's uncommon though ... for now,
-                 * work as if this is safe.
-                 */
-                dev_warn(&spi->dev, "ASSUMING unshared SPI bus!\n");
        }
        /* We need a supply of ones to transmit.  This is the only time
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index d0eb0a2abf..95244a7e73 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -20,11 +20,11 @@
 #include <linux/mmc/host.h>
 #include <linux/amba/bus.h>
 #include <linux/clk.h>
+#include <linux/scatterlist.h>
 #include <asm/cacheflush.h>
 #include <asm/div64.h>
 #include <asm/io.h>
-#include <asm/scatterlist.h>
 #include <asm/sizes.h>
 #include <asm/mach/mmc.h>
@@ -167,7 +167,7 @@ mmci_data_irq(struct mmci_host *host, struct mmc_data *data,
                 * partially written to a page is properly coherent.
                 */
                if (host->sg_len && data->flags & MMC_DATA_READ)
-                        flush_dcache_page(host->sg_ptr->page);
+                        flush_dcache_page(sg_page(host->sg_ptr));
        }
        if (status & MCI_DATAEND) {
                mmci_stop_data(host);
@@ -319,7 +319,7 @@ static irqreturn_t mmci_pio_irq(int irq, void *dev_id)
                 * page, ensure that the data cache is coherent.
                 */
                if (status & MCI_RXACTIVE)
-                        flush_dcache_page(host->sg_ptr->page);
+                        flush_dcache_page(sg_page(host->sg_ptr));
                if (!mmci_next_sg(host))
                        break;
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index 0601e01aa2..a25ee71998 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -29,7 +29,6 @@
 #include <asm/dma.h>
 #include <asm/io.h>
-#include <asm/scatterlist.h>
 #include <asm/sizes.h>
 #include <asm/arch/pxa-regs.h>
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index d7c5b94d8c..6b80bf77a4 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -17,8 +17,6 @@
 #include <linux/mmc/host.h>
-#include <asm/scatterlist.h>
 #include "sdhci.h"
 #define DRIVER_NAME "sdhci"
diff --git a/drivers/mmc/host/wbsd.c b/drivers/mmc/host/wbsd.c
index fa4c8c53cc..4d5f374218 100644
--- a/drivers/mmc/host/wbsd.c
+++ b/drivers/mmc/host/wbsd.c
@@ -33,10 +33,10 @@
 #include <linux/pnp.h>
 #include <linux/highmem.h>
 #include <linux/mmc/host.h>
+#include <linux/scatterlist.h>
 #include <asm/io.h>
 #include <asm/dma.h>
-#include <asm/scatterlist.h>
 #include "wbsd.h"
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index d2499bb07c..473f78de4b 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -122,7 +122,8 @@ struct e1000_buffer {
                        u16 next_to_watch;
                };
                /* RX */
-                struct page *page;
+                /* arrays of page information for packet split */
+                struct e1000_ps_page *ps_pages;
        };
 };
@@ -142,8 +143,6 @@ struct e1000_ring {
        /* array of buffer information structs */
        struct e1000_buffer *buffer_info;
-        /* arrays of page information for packet split */
-        struct e1000_ps_page *ps_pages;
        struct sk_buff *rx_skb_top;
        struct e1000_queue_stats stats;
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 033e124d1c..4fd2e23720 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -245,37 +245,36 @@ static void e1000_alloc_rx_buffers_ps(struct e1000_adapter *adapter,
                rx_desc = E1000_RX_DESC_PS(*rx_ring, i);
                for (j = 0; j < PS_PAGE_BUFFERS; j++) {
-                        ps_page = &rx_ring->ps_pages[(i * PS_PAGE_BUFFERS)
+                        ps_page = &buffer_info->ps_pages[j];
-                                                     + j];
+                        if (j >= adapter->rx_ps_pages) {
-                        if (j < adapter->rx_ps_pages) {
+                                /* all unused desc entries get hw null ptr */
+                                rx_desc->read.buffer_addr[j+1] = ~0;
+                                continue;
+                        }
+                        if (!ps_page->page) {
+                                ps_page->page = alloc_page(GFP_ATOMIC);
                                if (!ps_page->page) {
-                                        ps_page->page = alloc_page(GFP_ATOMIC);
+                                        adapter->alloc_rx_buff_failed++;
-                                        if (!ps_page->page) {
+                                        goto no_buffers;
-                                                adapter->alloc_rx_buff_failed++;
+                                }
-                                                goto no_buffers;
+                                ps_page->dma = pci_map_page(pdev,
-                                        }
+                                                   ps_page->page,
-                                        ps_page->dma = pci_map_page(pdev,
+                                                   0, PAGE_SIZE,
-                                                           ps_page->page,
+                                                   PCI_DMA_FROMDEVICE);
-                                                           0, PAGE_SIZE,
+                                if (pci_dma_mapping_error(ps_page->dma)) {
-                                                           PCI_DMA_FROMDEVICE);
+                                        dev_err(&adapter->pdev->dev,
-                                        if (pci_dma_mapping_error(
+                                          "RX DMA page map failed\n");
-                                                        ps_page->dma)) {
+                                        adapter->rx_dma_failed++;
-                                                dev_err(&adapter->pdev->dev,
+                                        goto no_buffers;
-                                                  "RX DMA page map failed\n");
-                                                adapter->rx_dma_failed++;
-                                                goto no_buffers;
-                                        }
                                }
-                                /*
-                                 * Refresh the desc even if buffer_addrs
-                                 * didn't change because each write-back
-                                 * erases this info.
-                                 */
-                                rx_desc->read.buffer_addr[j+1] =
-                                     cpu_to_le64(ps_page->dma);
-                        } else {
-                                rx_desc->read.buffer_addr[j+1] = ~0;
                        }
+                        /*
+                         * Refresh the desc even if buffer_addrs
+                         * didn't change because each write-back
+                         * erases this info.
+                         */
+                        rx_desc->read.buffer_addr[j+1] =
+                             cpu_to_le64(ps_page->dma);
                }
                skb = netdev_alloc_skb(netdev,
@@ -334,94 +333,6 @@ no_buffers:
 }
 /**
- * e1000_alloc_rx_buffers_jumbo - Replace used jumbo receive buffers
- *
- * @adapter: address of board private structure
- * @cleaned_count: number of buffers to allocate this pass
- **/
-static void e1000_alloc_rx_buffers_jumbo(struct e1000_adapter *adapter,
-                                         int cleaned_count)
-{
-        struct net_device *netdev = adapter->netdev;
-        struct pci_dev *pdev = adapter->pdev;
-        struct e1000_ring *rx_ring = adapter->rx_ring;
-        struct e1000_rx_desc *rx_desc;
-        struct e1000_buffer *buffer_info;
-        struct sk_buff *skb;
-        unsigned int i;
-        unsigned int bufsz = 256 -
-                             16 /*for skb_reserve */ -
-                             NET_IP_ALIGN;
-        i = rx_ring->next_to_use;
-        buffer_info = &rx_ring->buffer_info[i];
-        while (cleaned_count--) {
-                skb = buffer_info->skb;
-                if (skb) {
-                        skb_trim(skb, 0);
-                        goto check_page;
-                }
-                skb = netdev_alloc_skb(netdev, bufsz);
-                if (!skb) {
-                        /* Better luck next round */
-                        adapter->alloc_rx_buff_failed++;
-                        break;
-                }
-                /* Make buffer alignment 2 beyond a 16 byte boundary
-                 * this will result in a 16 byte aligned IP header after
-                 * the 14 byte MAC header is removed
-                 */
-                skb_reserve(skb, NET_IP_ALIGN);
-                buffer_info->skb = skb;
-check_page:
-                /* allocate a new page if necessary */
-                if (!buffer_info->page) {
-                        buffer_info->page = alloc_page(GFP_ATOMIC);
-                        if (!buffer_info->page) {
-                                adapter->alloc_rx_buff_failed++;
-                                break;
-                        }
-                }
-                if (!buffer_info->dma)
-                        buffer_info->dma = pci_map_page(pdev,
-                                                        buffer_info->page, 0,
-                                                        PAGE_SIZE,
-                                                        PCI_DMA_FROMDEVICE);
-                if (pci_dma_mapping_error(buffer_info->dma)) {
-                        dev_err(&adapter->pdev->dev, "RX DMA page map failed\n");
-                        adapter->rx_dma_failed++;
-                        break;
-                }
-                rx_desc = E1000_RX_DESC(*rx_ring, i);
-                rx_desc->buffer_addr = cpu_to_le64(buffer_info->dma);
-                i++;
-                if (i == rx_ring->count)
-                        i = 0;
-                buffer_info = &rx_ring->buffer_info[i];
-        }
-        if (rx_ring->next_to_use != i) {
-                rx_ring->next_to_use = i;
-                if (i-- == 0)
-                        i = (rx_ring->count - 1);
-                /* Force memory writes to complete before letting h/w
-                 * know there are new descriptors to fetch.  (Only
-                 * applicable for weak-ordered memory model archs,
-                 * such as IA-64). */
-                wmb();
-                writel(i, adapter->hw.hw_addr + rx_ring->tail);
-        }
-}
-/**
 * e1000_clean_rx_irq - Send received data up the network stack; legacy
 * @adapter: board private structure
 *
@@ -495,10 +406,6 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
                        goto next_desc;
                }
-                /* adjust length to remove Ethernet CRC */
-                length -= 4;
-                /* probably a little skewed due to removing CRC */
                total_rx_bytes += length;
                total_rx_packets++;
@@ -554,15 +461,6 @@ next_desc:
        return cleaned;
 }
-static void e1000_consume_page(struct e1000_buffer *bi, struct sk_buff *skb,
-                               u16 length)
-{
-        bi->page = NULL;
-        skb->len += length;
-        skb->data_len += length;
-        skb->truesize += length;
-}
 static void e1000_put_txbuf(struct e1000_adapter *adapter,
                             struct e1000_buffer *buffer_info)
 {
@@ -699,174 +597,6 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter)
 }
 /**
- * e1000_clean_rx_irq_jumbo - Send received data up the network stack; legacy
- * @adapter: board private structure
- *
- * the return value indicates whether actual cleaning was done, there
- * is no guarantee that everything was cleaned
- **/
-static bool e1000_clean_rx_irq_jumbo(struct e1000_adapter *adapter,
-                                     int *work_done, int work_to_do)
-{
-        struct net_device *netdev = adapter->netdev;
-        struct pci_dev *pdev = adapter->pdev;
-        struct e1000_ring *rx_ring = adapter->rx_ring;
-        struct e1000_rx_desc *rx_desc, *next_rxd;
-        struct e1000_buffer *buffer_info, *next_buffer;
-        u32 length;
-        unsigned int i;
-        int cleaned_count = 0;
-        bool cleaned = 0;
-        unsigned int total_rx_bytes = 0, total_rx_packets = 0;
-        i = rx_ring->next_to_clean;
-        rx_desc = E1000_RX_DESC(*rx_ring, i);
-        buffer_info = &rx_ring->buffer_info[i];
-        while (rx_desc->status & E1000_RXD_STAT_DD) {
-                struct sk_buff *skb;
-                u8 status;
-                if (*work_done >= work_to_do)
-                        break;
-                (*work_done)++;
-                status = rx_desc->status;
-                skb = buffer_info->skb;
-                buffer_info->skb = NULL;
-                i++;
-                if (i == rx_ring->count)
-                        i = 0;
-                next_rxd = E1000_RX_DESC(*rx_ring, i);
-                prefetch(next_rxd);
-                next_buffer = &rx_ring->buffer_info[i];
-                cleaned = 1;
-                cleaned_count++;
-                pci_unmap_page(pdev,
-                               buffer_info->dma,
-                               PAGE_SIZE,
-                               PCI_DMA_FROMDEVICE);
-                buffer_info->dma = 0;
-                length = le16_to_cpu(rx_desc->length);
-                /* errors is only valid for DD + EOP descriptors */
-                if ((status & E1000_RXD_STAT_EOP) &&
-                    (rx_desc->errors & E1000_RXD_ERR_FRAME_ERR_MASK)) {
-                        /* recycle both page and skb */
-                        buffer_info->skb = skb;
-                        /* an error means any chain goes out the window too */
-                        if (rx_ring->rx_skb_top)
-                                dev_kfree_skb(rx_ring->rx_skb_top);
-                        rx_ring->rx_skb_top = NULL;
-                        goto next_desc;
-                }
-#define rxtop rx_ring->rx_skb_top
-                if (!(status & E1000_RXD_STAT_EOP)) {
-                        /* this descriptor is only the beginning (or middle) */
-                        if (!rxtop) {
-                                /* this is the beginning of a chain */
-                                rxtop = skb;
-                                skb_fill_page_desc(rxtop, 0, buffer_info->page,
-                                                   0, length);
-                        } else {
-                                /* this is the middle of a chain */
-                                skb_fill_page_desc(rxtop,
-                                                   skb_shinfo(rxtop)->nr_frags,
-                                                   buffer_info->page, 0,
-                                                   length);
-                                /* re-use the skb, only consumed the page */
-                                buffer_info->skb = skb;
-                        }
-                        e1000_consume_page(buffer_info, rxtop, length);
-                        goto next_desc;
-                } else {
-                        if (rxtop) {
-                                /* end of the chain */
-                                skb_fill_page_desc(rxtop,
-                                    skb_shinfo(rxtop)->nr_frags,
-                                    buffer_info->page, 0, length);
-                                /* re-use the current skb, we only consumed the
-                                 * page */
-                                buffer_info->skb = skb;
-                                skb = rxtop;
-                                rxtop = NULL;
-                                e1000_consume_page(buffer_info, skb, length);
-                        } else {
-                                /* no chain, got EOP, this buf is the packet
-                                 * copybreak to save the put_page/alloc_page */
-                                if (length <= copybreak &&
-                                    skb_tailroom(skb) >= length) {
-                                        u8 *vaddr;
-                                        vaddr = kmap_atomic(buffer_info->page,
-                                                           KM_SKB_DATA_SOFTIRQ);
-                                        memcpy(skb_tail_pointer(skb),
-                                               vaddr, length);
-                                        kunmap_atomic(vaddr,
-                                                      KM_SKB_DATA_SOFTIRQ);
-                                        /* re-use the page, so don't erase
-                                         * buffer_info->page */
-                                        skb_put(skb, length);
-                                } else {
-                                        skb_fill_page_desc(skb, 0,
-                                                           buffer_info->page, 0,
-                                                           length);
-                                        e1000_consume_page(buffer_info, skb,
-                                                           length);
-                                }
-                        }
-                }
-                /* Receive Checksum Offload XXX recompute due to CRC strip? */
-                e1000_rx_checksum(adapter,
-                                  (u32)(status) |
-                                  ((u32)(rx_desc->errors) << 24),
-                                  le16_to_cpu(rx_desc->csum), skb);
-                pskb_trim(skb, skb->len - 4);
-                /* probably a little skewed due to removing CRC */
-                total_rx_bytes += skb->len;
-                total_rx_packets++;
-                /* eth type trans needs skb->data to point to something */
-                if (!pskb_may_pull(skb, ETH_HLEN)) {
-                        ndev_err(netdev, "__pskb_pull_tail failed.\n");
-                        dev_kfree_skb(skb);
-                        goto next_desc;
-                }
-                e1000_receive_skb(adapter, netdev, skb,status,rx_desc->special);
-next_desc:
-                rx_desc->status = 0;
-                /* return some buffers to hardware, one at a time is too slow */
-                if (cleaned_count >= E1000_RX_BUFFER_WRITE) {
-                        adapter->alloc_rx_buf(adapter, cleaned_count);
-                        cleaned_count = 0;
-                }
-                /* use prefetched values */
-                rx_desc = next_rxd;
-                buffer_info = next_buffer;
-        }
-        rx_ring->next_to_clean = i;
-        cleaned_count = e1000_desc_unused(rx_ring);
-        if (cleaned_count)
-                adapter->alloc_rx_buf(adapter, cleaned_count);
-        adapter->total_rx_packets += total_rx_packets;
-        adapter->total_rx_bytes += total_rx_bytes;
-        return cleaned;
-}
-/**
 * e1000_clean_rx_irq_ps - Send received data up the network stack; packet split
 * @adapter: board private structure
 *
@@ -953,7 +683,7 @@ static bool e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                    ((length + l1) <= adapter->rx_ps_bsize0)) {
                        u8 *vaddr;
-                        ps_page = &rx_ring->ps_pages[i * PS_PAGE_BUFFERS];
+                        ps_page = &buffer_info->ps_pages[0];
                        /* there is no documentation about how to call
                         * kmap_atomic, so we can't hold the mapping
@@ -965,8 +695,7 @@ static bool e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                        kunmap_atomic(vaddr, KM_SKB_DATA_SOFTIRQ);
                        pci_dma_sync_single_for_device(pdev, ps_page->dma,
                                PAGE_SIZE, PCI_DMA_FROMDEVICE);
-                        /* remove the CRC */
-                        l1 -= 4;
                        skb_put(skb, l1);
                        goto copydone;
                } /* if */
@@ -977,7 +706,7 @@ static bool e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                        if (!length)
                                break;
-                        ps_page = &rx_ring->ps_pages[(i * PS_PAGE_BUFFERS) + j];
+                        ps_page = &buffer_info->ps_pages[j];
                        pci_unmap_page(pdev, ps_page->dma, PAGE_SIZE,
                                       PCI_DMA_FROMDEVICE);
                        ps_page->dma = 0;
@@ -988,10 +717,6 @@ static bool e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                        skb->truesize += length;
                }
-                /* strip the ethernet crc, problem is we're using pages now so
-                 * this whole operation can get a little cpu intensive */
-                pskb_trim(skb, skb->len - 4);
 copydone:
                total_rx_bytes += skb->len;
                total_rx_packets++;
@@ -1043,7 +768,6 @@ static void e1000_clean_rx_ring(struct e1000_adapter *adapter)
        struct e1000_buffer *buffer_info;
        struct e1000_ps_page *ps_page;
        struct pci_dev *pdev = adapter->pdev;
-        unsigned long size;
        unsigned int i, j;
        /* Free all the Rx ring sk_buffs */
@@ -1054,9 +778,6 @@ static void e1000_clean_rx_ring(struct e1000_adapter *adapter)
                                pci_unmap_single(pdev, buffer_info->dma,
                                                 adapter->rx_buffer_len,
                                                 PCI_DMA_FROMDEVICE);
-                        else if (adapter->clean_rx == e1000_clean_rx_irq_jumbo)
-                                pci_unmap_page(pdev, buffer_info->dma,
-                                               PAGE_SIZE, PCI_DMA_FROMDEVICE);
                        else if (adapter->clean_rx == e1000_clean_rx_irq_ps)
                                pci_unmap_single(pdev, buffer_info->dma,
                                                 adapter->rx_ps_bsize0,
@@ -1064,19 +785,13 @@ static void e1000_clean_rx_ring(struct e1000_adapter *adapter)
                        buffer_info->dma = 0;
                }
-                if (buffer_info->page) {
-                        put_page(buffer_info->page);
-                        buffer_info->page = NULL;
-                }
                if (buffer_info->skb) {
                        dev_kfree_skb(buffer_info->skb);
                        buffer_info->skb = NULL;
                }
                for (j = 0; j < PS_PAGE_BUFFERS; j++) {
-                        ps_page = &rx_ring->ps_pages[(i * PS_PAGE_BUFFERS)
+                        ps_page = &buffer_info->ps_pages[j];
-                                                     + j];
                        if (!ps_page->page)
                                break;
                        pci_unmap_page(pdev, ps_page->dma, PAGE_SIZE,
@@ -1093,12 +808,6 @@ static void e1000_clean_rx_ring(struct e1000_adapter *adapter)
                rx_ring->rx_skb_top = NULL;
        }
-        size = sizeof(struct e1000_buffer) * rx_ring->count;
-        memset(rx_ring->buffer_info, 0, size);
-        size = sizeof(struct e1000_ps_page)
-               * (rx_ring->count * PS_PAGE_BUFFERS);
-        memset(rx_ring->ps_pages, 0, size);
        /* Zero out the descriptor ring */
        memset(rx_ring->desc, 0, rx_ring->size);
@@ -1421,7 +1130,8 @@ err:
 int e1000e_setup_rx_resources(struct e1000_adapter *adapter)
 {
        struct e1000_ring *rx_ring = adapter->rx_ring;
-        int size, desc_len, err = -ENOMEM;
+        struct e1000_buffer *buffer_info;
+        int i, size, desc_len, err = -ENOMEM;
        size = sizeof(struct e1000_buffer) * rx_ring->count;
        rx_ring->buffer_info = vmalloc(size);
@@ -1429,11 +1139,14 @@ int e1000e_setup_rx_resources(struct e1000_adapter *adapter)
                goto err;
        memset(rx_ring->buffer_info, 0, size);
-        rx_ring->ps_pages = kcalloc(rx_ring->count * PS_PAGE_BUFFERS,
+        for (i = 0; i < rx_ring->count; i++) {
-                                    sizeof(struct e1000_ps_page),
+                buffer_info = &rx_ring->buffer_info[i];
-                                    GFP_KERNEL);
+                buffer_info->ps_pages = kcalloc(PS_PAGE_BUFFERS,
-        if (!rx_ring->ps_pages)
+                                                sizeof(struct e1000_ps_page),
-                goto err;
+                                                GFP_KERNEL);
+                if (!buffer_info->ps_pages)
+                        goto err_pages;
+        }
        desc_len = sizeof(union e1000_rx_desc_packet_split);
@@ -1443,16 +1156,21 @@ int e1000e_setup_rx_resources(struct e1000_adapter *adapter)
        err = e1000_alloc_ring_dma(adapter, rx_ring);
        if (err)
-                goto err;
+                goto err_pages;
        rx_ring->next_to_clean = 0;
        rx_ring->next_to_use = 0;
        rx_ring->rx_skb_top = NULL;
        return 0;
+err_pages:
+        for (i = 0; i < rx_ring->count; i++) {
+                buffer_info = &rx_ring->buffer_info[i];
+                kfree(buffer_info->ps_pages);
+        }
 err:
        vfree(rx_ring->buffer_info);
-        kfree(rx_ring->ps_pages);
        ndev_err(adapter->netdev,
        "Unable to allocate memory for the transmit descriptor ring\n");
        return err;
@@ -1518,15 +1236,17 @@ void e1000e_free_rx_resources(struct e1000_adapter *adapter)
 {
        struct pci_dev *pdev = adapter->pdev;
        struct e1000_ring *rx_ring = adapter->rx_ring;
+        int i;
        e1000_clean_rx_ring(adapter);
+        for (i = 0; i < rx_ring->count; i++) {
+                kfree(rx_ring->buffer_info[i].ps_pages);
+        }
        vfree(rx_ring->buffer_info);
        rx_ring->buffer_info = NULL;
-        kfree(rx_ring->ps_pages);
-        rx_ring->ps_pages = NULL;
        dma_free_coherent(&pdev->dev, rx_ring->size, rx_ring->desc,
                          rx_ring->dma);
        rx_ring->desc = NULL;
@@ -2032,9 +1752,11 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
                ew32(RFCTL, rfctl);
-                /* disable the stripping of CRC because it breaks
+                /* Enable Packet split descriptors */
-                 * BMC firmware connected over SMBUS */
+                rctl |= E1000_RCTL_DTYP_PS;
-                rctl |= E1000_RCTL_DTYP_PS /* | E1000_RCTL_SECRC */;
+                
+                /* Enable hardware CRC frame stripping */
+                rctl |= E1000_RCTL_SECRC;
                psrctl |= adapter->rx_ps_bsize0 >>
                        E1000_PSRCTL_BSIZE0_SHIFT;
@@ -2077,11 +1799,6 @@ static void e1000_configure_rx(struct e1000_adapter *adapter)
                        sizeof(union e1000_rx_desc_packet_split);
                adapter->clean_rx = e1000_clean_rx_irq_ps;
                adapter->alloc_rx_buf = e1000_alloc_rx_buffers_ps;
-        } else if (adapter->netdev->mtu > ETH_FRAME_LEN + VLAN_HLEN + 4) {
-                rdlen = rx_ring->count *
-                        sizeof(struct e1000_rx_desc);
-                adapter->clean_rx = e1000_clean_rx_irq_jumbo;
-                adapter->alloc_rx_buf = e1000_alloc_rx_buffers_jumbo;
        } else {
                rdlen = rx_ring->count *
                        sizeof(struct e1000_rx_desc);
@@ -2326,8 +2043,11 @@ void e1000e_reset(struct e1000_adapter *adapter)
        struct e1000_mac_info *mac = &adapter->hw.mac;
        struct e1000_hw *hw = &adapter->hw;
        u32 tx_space, min_tx_space, min_rx_space;
+        u32 pba;
        u16 hwm;
+        ew32(PBA, adapter->pba);
        if (mac->max_frame_size > ETH_FRAME_LEN + ETH_FCS_LEN ) {
                /* To maintain wire speed transmits, the Tx FIFO should be
                 * large enough to accommodate two full transmit packets,
@@ -2335,11 +2055,11 @@ void e1000e_reset(struct e1000_adapter *adapter)
                 * the Rx FIFO should be large enough to accommodate at least
                 * one full receive packet and is similarly rounded up and
                 * expressed in KB. */
-                adapter->pba = er32(PBA);
+                pba = er32(PBA);
                /* upper 16 bits has Tx packet buffer allocation size in KB */
-                tx_space = adapter->pba >> 16;
+                tx_space = pba >> 16;
                /* lower 16 bits has Rx packet buffer allocation size in KB */
-                adapter->pba &= 0xffff;
+                pba &= 0xffff;
                /* the tx fifo also stores 16 bytes of information about the tx
                 * but don't include ethernet FCS because hardware appends it */
                min_tx_space = (mac->max_frame_size +
@@ -2355,20 +2075,21 @@ void e1000e_reset(struct e1000_adapter *adapter)
                /* If current Tx allocation is less than the min Tx FIFO size,
                 * and the min Tx FIFO size is less than the current Rx FIFO
                 * allocation, take space away from current Rx allocation */
-                if (tx_space < min_tx_space &&
+                if ((tx_space < min_tx_space) &&
-                    ((min_tx_space - tx_space) < adapter->pba)) {
+                    ((min_tx_space - tx_space) < pba)) {
-                        adapter->pba -= - (min_tx_space - tx_space);
+                        pba -= min_tx_space - tx_space;
                        /* if short on rx space, rx wins and must trump tx
                         * adjustment or use Early Receive if available */
-                        if ((adapter->pba < min_rx_space) &&
+                        if ((pba < min_rx_space) &&
                            (!(adapter->flags & FLAG_HAS_ERT)))
                                /* ERT enabled in e1000_configure_rx */
-                                adapter->pba = min_rx_space;
+                                pba = min_rx_space;
                }
+                ew32(PBA, pba);
        }
-        ew32(PBA, adapter->pba);
        /* flow control settings */
        /* The high water mark must be low enough to fit one full frame
@@ -3624,9 +3345,7 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
        /* NOTE: netdev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN
         * means we reserve 2 more, this pushes us to allocate from the next
         * larger slab size.
-         * i.e. RXBUFFER_2048 --> size-4096 slab
+         * i.e. RXBUFFER_2048 --> size-4096 slab */
-         *  however with the new *_jumbo* routines, jumbo receives will use
-         *  fragmented skbs */
        if (max_frame <= 256)
                adapter->rx_buffer_len = 256;
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 4b4b74e47a..f78e5bf7cb 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -40,7 +40,7 @@
 #include <asm/io.h>
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0079"
+#define DRV_VERSION     "EHEA_0080"
 /* eHEA capability flags */
 #define DLPAR_PORT_ADD_REM 1
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 0a7e789255..f0319f1e8e 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -33,6 +33,9 @@
 #include <linux/if.h>
 #include <linux/list.h>
 #include <linux/if_ether.h>
+#include <linux/notifier.h>
+#include <linux/reboot.h>
 #include <net/ip.h>
 #include "ehea.h"
@@ -3295,6 +3298,20 @@ static int __devexit ehea_remove(struct of_device *dev)
        return 0;
 }
+static int ehea_reboot_notifier(struct notifier_block *nb,
+                                unsigned long action, void *unused)
+{
+        if (action == SYS_RESTART) {
+                ehea_info("Reboot: freeing all eHEA resources");
+                ibmebus_unregister_driver(&ehea_driver);
+        }
+        return NOTIFY_DONE;
+}
+static struct notifier_block ehea_reboot_nb = {
+        .notifier_call = ehea_reboot_notifier,
+};
 static int check_module_parm(void)
 {
        int ret = 0;
@@ -3351,6 +3368,8 @@ int __init ehea_module_init(void)
        if (ret)
                goto out;
+        register_reboot_notifier(&ehea_reboot_nb);
        ret = ibmebus_register_driver(&ehea_driver);
        if (ret) {
                ehea_error("failed registering eHEA device driver on ebus");
@@ -3362,6 +3381,7 @@ int __init ehea_module_init(void)
        if (ret) {
                ehea_error("failed to register capabilities attribute, ret=%d",
                           ret);
+                unregister_reboot_notifier(&ehea_reboot_nb);
                ibmebus_unregister_driver(&ehea_driver);
                goto out;
        }
@@ -3375,6 +3395,7 @@ static void __exit ehea_module_exit(void)
        flush_scheduled_work();
        driver_remove_file(&ehea_driver.driver, &driver_attr_capabilities);
        ibmebus_unregister_driver(&ehea_driver);
+        unregister_reboot_notifier(&ehea_reboot_nb);
        ehea_destroy_busmap();
 }
diff --git a/drivers/net/irda/au1k_ir.c b/drivers/net/irda/au1k_ir.c
index 4dbdfaaf37..a1e4508717 100644
--- a/drivers/net/irda/au1k_ir.c
+++ b/drivers/net/irda/au1k_ir.c
@@ -627,19 +627,16 @@ static int au1k_irda_rx(struct net_device *dev)
 }
-void au1k_irda_interrupt(int irq, void *dev_id)
+static irqreturn_t au1k_irda_interrupt(int dummy, void *dev_id)
 {
-        struct net_device *dev = (struct net_device *) dev_id;
+        struct net_device *dev = dev_id;
-        if (dev == NULL) {
-                printk(KERN_ERR "%s: isr: null dev ptr\n", dev->name);
-                return;
-        }
        writel(0, IR_INT_CLEAR); /* ack irda interrupts */
        au1k_irda_rx(dev);
        au1k_tx_ack(dev);
+        return IRQ_HANDLED;
 }
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index 662b8d1680..45f30a2974 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -284,7 +284,7 @@ static __net_exit void loopback_net_exit(struct net *net)
        unregister_netdev(dev);
 }
-static struct pernet_operations __net_initdata loopback_net_ops = {
+static struct pernet_operations loopback_net_ops = {
       .init = loopback_net_init,
       .exit = loopback_net_exit,
 };
diff --git a/drivers/net/mlx4/icm.c b/drivers/net/mlx4/icm.c
index 887633b207..2a5bef6388 100644
--- a/drivers/net/mlx4/icm.c
+++ b/drivers/net/mlx4/icm.c
@@ -101,9 +101,7 @@ static int mlx4_alloc_icm_pages(struct scatterlist *mem, int order, gfp_t gfp_ma
        if (!page)
                return -ENOMEM;
-        sg_set_page(mem, page);
+        sg_set_page(mem, page, PAGE_SIZE << order, 0);
-        mem->length = PAGE_SIZE << order;
-        mem->offset = 0;
        return 0;
 }
diff --git a/drivers/net/ppp_mppe.c b/drivers/net/ppp_mppe.c
index bcb0885011..b35d794495 100644
--- a/drivers/net/ppp_mppe.c
+++ b/drivers/net/ppp_mppe.c
@@ -68,7 +68,7 @@ MODULE_VERSION("1.0.2");
 static unsigned int
 setup_sg(struct scatterlist *sg, const void *address, unsigned int length)
 {
-        sg_init_one(sg, address, length);
+        sg_set_buf(sg, address, length);
        return length;
 }
@@ -140,6 +140,8 @@ static void get_new_key_from_sha(struct ppp_mppe_state * state)
        struct scatterlist sg[4];
        unsigned int nbytes;
+        sg_init_table(sg, 4);
        nbytes = setup_sg(&sg[0], state->master_key, state->keylen);
        nbytes += setup_sg(&sg[1], sha_pad->sha_pad1,
                           sizeof(sha_pad->sha_pad1));
@@ -166,6 +168,8 @@ static void mppe_rekey(struct ppp_mppe_state * state, int initial_key)
        if (!initial_key) {
                crypto_blkcipher_setkey(state->arc4, state->sha1_digest,
                                        state->keylen);
+                sg_init_table(sg_in, 1);
+                sg_init_table(sg_out, 1);
                setup_sg(sg_in, state->sha1_digest, state->keylen);
                setup_sg(sg_out, state->session_key, state->keylen);
                if (crypto_blkcipher_encrypt(&desc, sg_out, sg_in,
@@ -421,6 +425,8 @@ mppe_compress(void *arg, unsigned char *ibuf, unsigned char *obuf,
        isize -= 2;
        /* Encrypt packet */
+        sg_init_table(sg_in, 1);
+        sg_init_table(sg_out, 1);
        setup_sg(sg_in, ibuf, isize);
        setup_sg(sg_out, obuf, osize);
        if (crypto_blkcipher_encrypt(&desc, sg_out, sg_in, isize) != 0) {
@@ -608,6 +614,8 @@ mppe_decompress(void *arg, unsigned char *ibuf, int isize, unsigned char *obuf,
         * Decrypt the first byte in order to check if it is
         * a compressed or uncompressed protocol field.
         */
+        sg_init_table(sg_in, 1);
+        sg_init_table(sg_out, 1);
        setup_sg(sg_in, ibuf, 1);
        setup_sg(sg_out, obuf, 1);
        if (crypto_blkcipher_decrypt(&desc, sg_out, sg_in, 1) != 0) {
diff --git a/drivers/net/rrunner.c b/drivers/net/rrunner.c
index 19152f54ef..b822859c8d 100644
--- a/drivers/net/rrunner.c
+++ b/drivers/net/rrunner.c
@@ -79,12 +79,10 @@ static char version[] __devinitdata = "rrunner.c: v0.50 11/11/2002  Jes Sorensen
 */
 /*
- * These are checked at init time to see if they are at least 256KB
+ * sysctl_[wr]mem_max are checked at init time to see if they are at
- * and increased to 256KB if they are not. This is done to avoid ending
+ * least 256KB and increased to 256KB if they are not. This is done to
- * up with socket buffers smaller than the MTU size,
+ * avoid ending up with socket buffers smaller than the MTU size,
 */
-extern __u32 sysctl_wmem_max;
-extern __u32 sysctl_rmem_max;
 static int __devinit rr_init_one(struct pci_dev *pdev,
        const struct pci_device_id *ent)
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 9d9ff76a9b..5058e60e57 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2391,7 +2391,7 @@ out_requeue:
        if (b43_debug(dev, B43_DBG_PWORK_FAST))
                delay = msecs_to_jiffies(50);
        else
-                delay = round_jiffies(HZ * 15);
+                delay = round_jiffies_relative(HZ * 15);
        queue_delayed_work(wl->hw->workqueue, &dev->periodic_work, delay);
 out:
        mutex_unlock(&wl->mutex);
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index d09479e816..f0e56dfc9e 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -2260,7 +2260,7 @@ out_requeue:
        if (b43legacy_debug(dev, B43legacy_DBG_PWORK_FAST))
                delay = msecs_to_jiffies(50);
        else
-                delay = round_jiffies(HZ);
+                delay = round_jiffies_relative(HZ);
        queue_delayed_work(dev->wl->hw->workqueue,
                           &dev->periodic_work, delay);
 out:
diff --git a/drivers/net/wireless/ipw2100.c b/drivers/net/wireless/ipw2100.c
index a6c7904de2..8d53d08b96 100644
--- a/drivers/net/wireless/ipw2100.c
+++ b/drivers/net/wireless/ipw2100.c
@@ -1769,7 +1769,7 @@ static int ipw2100_up(struct ipw2100_priv *priv, int deferred)
                if (priv->stop_rf_kill) {
                        priv->stop_rf_kill = 0;
                        queue_delayed_work(priv->workqueue, &priv->rf_kill,
-                                           round_jiffies(HZ));
+                                           round_jiffies_relative(HZ));
                }
                deferred = 1;
@@ -2086,7 +2086,8 @@ static void isr_indicate_rf_kill(struct ipw2100_priv *priv, u32 status)
        /* Make sure the RF Kill check timer is running */
        priv->stop_rf_kill = 0;
        cancel_delayed_work(&priv->rf_kill);
-        queue_delayed_work(priv->workqueue, &priv->rf_kill, round_jiffies(HZ));
+        queue_delayed_work(priv->workqueue, &priv->rf_kill,
+                           round_jiffies_relative(HZ));
 }
 static void send_scan_event(void *data)
@@ -2123,7 +2124,7 @@ static void isr_scan_complete(struct ipw2100_priv *priv, u32 status)
                if (!delayed_work_pending(&priv->scan_event_later))
                        queue_delayed_work(priv->workqueue,
                                        &priv->scan_event_later,
-                                        round_jiffies(msecs_to_jiffies(4000)));
+                                        round_jiffies_relative(msecs_to_jiffies(4000)));
        } else {
                priv->user_requested_scan = 0;
                cancel_delayed_work(&priv->scan_event_later);
@@ -4242,7 +4243,7 @@ static int ipw_radio_kill_sw(struct ipw2100_priv *priv, int disable_radio)
                        priv->stop_rf_kill = 0;
                        cancel_delayed_work(&priv->rf_kill);
                        queue_delayed_work(priv->workqueue, &priv->rf_kill,
-                                           round_jiffies(HZ));
+                                           round_jiffies_relative(HZ));
                } else
                        schedule_reset(priv);
        }
@@ -5981,7 +5982,7 @@ static void ipw2100_rf_kill(struct work_struct *work)
                IPW_DEBUG_RF_KILL("RF Kill active, rescheduling GPIO check\n");
                if (!priv->stop_rf_kill)
                        queue_delayed_work(priv->workqueue, &priv->rf_kill,
-                                           round_jiffies(HZ));
+                                           round_jiffies_relative(HZ));
                goto exit_unlock;
        }
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index e3c828401b..54f44e5473 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -1753,7 +1753,7 @@ static int ipw_radio_kill_sw(struct ipw_priv *priv, int disable_radio)
                        /* Make sure the RF_KILL check timer is running */
                        cancel_delayed_work(&priv->rf_kill);
                        queue_delayed_work(priv->workqueue, &priv->rf_kill,
-                                           round_jiffies(2 * HZ));
+                                           round_jiffies_relative(2 * HZ));
                } else
                        queue_work(priv->workqueue, &priv->up);
        }
@@ -4364,7 +4364,7 @@ static void handle_scan_event(struct ipw_priv *priv)
        if (!priv->user_requested_scan) {
                if (!delayed_work_pending(&priv->scan_event))
                        queue_delayed_work(priv->workqueue, &priv->scan_event,
-                                         round_jiffies(msecs_to_jiffies(4000)));
+                                         round_jiffies_relative(msecs_to_jiffies(4000)));
        } else {
                union iwreq_data wrqu;
@@ -4728,7 +4728,7 @@ static void ipw_rx_notification(struct ipw_priv *priv,
                                 && priv->status & STATUS_ASSOCIATED)
                                queue_delayed_work(priv->workqueue,
                                                   &priv->request_scan,
-                                                   round_jiffies(HZ));
+                                                   round_jiffies_relative(HZ));
                        /* Send an empty event to user space.
                         * We don't send the received data on the event because
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 557deebca1..891f90d2f0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -3232,9 +3232,7 @@ int iwl4965_tx_cmd(struct iwl_priv *priv, struct iwl_cmd *out_cmd,
        tx->rate_n_flags = iwl_hw_set_rate_n_flags(iwl_rates[rate_index].plcp,
                                                rate_flags);
-        if (ieee80211_is_probe_request(fc))
+        if (ieee80211_is_back_request(fc))
-                tx->tx_flags |= TX_CMD_FLG_TSF_MSK;
-        else if (ieee80211_is_back_request(fc))
                tx->tx_flags |= TX_CMD_FLG_ACK_MSK |
                        TX_CMD_FLG_IMM_BA_RSP_MASK;
 #ifdef CONFIG_IWLWIFI_HT
@@ -3872,7 +3870,7 @@ static void iwl4965_rx_reply_rx(struct iwl_priv *priv,
                         */
                case IEEE80211_STYPE_ASSOC_RESP:
                case IEEE80211_STYPE_REASSOC_RESP:
-                        if (network_packet && iwl_is_associated(priv)) {
+                        if (network_packet) {
 #ifdef CONFIG_IWLWIFI_HT
                                u8 *pos = NULL;
                                struct ieee802_11_elems elems;
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 83019d1d7c..4f22a7174c 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -6478,8 +6478,9 @@ static void iwl_bg_scan_check(struct work_struct *data)
                IWL_DEBUG(IWL_DL_INFO | IWL_DL_SCAN,
                          "Scan completion watchdog resetting adapter (%dms)\n",
                          jiffies_to_msecs(IWL_SCAN_CHECK_WATCHDOG));
                if (!test_bit(STATUS_EXIT_PENDING, &priv->status))
-                        queue_work(priv->workqueue, &priv->restart);
+                        iwl_send_scan_abort(priv);
        }
        mutex_unlock(&priv->mutex);
 }
@@ -6575,7 +6576,7 @@ static void iwl_bg_request_scan(struct work_struct *data)
                spin_unlock_irqrestore(&priv->lock, flags);
                scan->suspend_time = 0;
-                scan->max_out_time = cpu_to_le32(600 * 1024);
+                scan->max_out_time = cpu_to_le32(200 * 1024);
                if (!interval)
                        interval = suspend_time;
                /*
@@ -6605,7 +6606,7 @@ static void iwl_bg_request_scan(struct work_struct *data)
                memcpy(scan->direct_scan[0].ssid,
                       priv->direct_ssid, priv->direct_ssid_len);
                direct_mask = 1;
-        } else if (!iwl_is_associated(priv)) {
+        } else if (!iwl_is_associated(priv) && priv->essid_len) {
                scan->direct_scan[0].id = WLAN_EID_SSID;
                scan->direct_scan[0].len = priv->essid_len;
                memcpy(scan->direct_scan[0].ssid, priv->essid, priv->essid_len);
@@ -6744,6 +6745,12 @@ static void iwl_bg_post_associate(struct work_struct *data)
        mutex_lock(&priv->mutex);
+        if (!priv->interface_id || !priv->is_open) {
+                mutex_unlock(&priv->mutex);
+                return;
+        }
+        iwl_scan_cancel_timeout(priv, 200);
        conf = ieee80211_get_hw_conf(priv->hw);
        priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
@@ -6882,9 +6889,19 @@ static void iwl_mac_stop(struct ieee80211_hw *hw)
        struct iwl_priv *priv = hw->priv;
        IWL_DEBUG_MAC80211("enter\n");
+        mutex_lock(&priv->mutex);
+        /* stop mac, cancel any scan request and clear
+         * RXON_FILTER_ASSOC_MSK BIT
+         */
        priv->is_open = 0;
-        /*netif_stop_queue(dev); */
+        iwl_scan_cancel_timeout(priv, 100);
-        flush_workqueue(priv->workqueue);
+        cancel_delayed_work(&priv->post_associate);
+        priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+        iwl_commit_rxon(priv);
+        mutex_unlock(&priv->mutex);
        IWL_DEBUG_MAC80211("leave\n");
 }
@@ -7169,8 +7186,6 @@ static int iwl_mac_config_interface(struct ieee80211_hw *hw, int if_id,
                if (priv->iw_mode == IEEE80211_IF_TYPE_AP)
                        iwl_config_ap(priv);
                else {
-                        priv->staging_rxon.filter_flags |=
-                                                RXON_FILTER_ASSOC_MSK;
                        rc = iwl_commit_rxon(priv);
                        if ((priv->iw_mode == IEEE80211_IF_TYPE_STA) && rc)
                                iwl_add_station(priv,
@@ -7178,6 +7193,7 @@ static int iwl_mac_config_interface(struct ieee80211_hw *hw, int if_id,
                }
        } else {
+                iwl_scan_cancel_timeout(priv, 100);
                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
                iwl_commit_rxon(priv);
        }
@@ -7217,6 +7233,12 @@ static void iwl_mac_remove_interface(struct ieee80211_hw *hw,
        IWL_DEBUG_MAC80211("enter\n");
        mutex_lock(&priv->mutex);
+        iwl_scan_cancel_timeout(priv, 100);
+        cancel_delayed_work(&priv->post_associate);
+        priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+        iwl_commit_rxon(priv);
        if (priv->interface_id == conf->if_id) {
                priv->interface_id = 0;
                memset(priv->bssid, 0, ETH_ALEN);
@@ -7238,6 +7260,7 @@ static int iwl_mac_hw_scan(struct ieee80211_hw *hw, u8 *ssid, size_t len)
        IWL_DEBUG_MAC80211("enter\n");
+        mutex_lock(&priv->mutex);
        spin_lock_irqsave(&priv->lock, flags);
        if (!iwl_is_ready_rf(priv)) {
@@ -7268,7 +7291,8 @@ static int iwl_mac_hw_scan(struct ieee80211_hw *hw, u8 *ssid, size_t len)
                priv->direct_ssid_len = (u8)
                    min((u8) len, (u8) IW_ESSID_MAX_SIZE);
                memcpy(priv->direct_ssid, ssid, priv->direct_ssid_len);
-        }
+        } else
+                priv->one_direct_scan = 0;
        rc = iwl_scan_initiate(priv);
@@ -7276,6 +7300,7 @@ static int iwl_mac_hw_scan(struct ieee80211_hw *hw, u8 *ssid, size_t len)
 out_unlock:
        spin_unlock_irqrestore(&priv->lock, flags);
+        mutex_unlock(&priv->mutex);
        return rc;
 }
@@ -7310,6 +7335,8 @@ static int iwl_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
        mutex_lock(&priv->mutex);
+        iwl_scan_cancel_timeout(priv, 100);
        switch (cmd) {
        case  SET_KEY:
                rc = iwl_update_sta_key_info(priv, key, sta_id);
@@ -7479,8 +7506,18 @@ static void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
        spin_unlock_irqrestore(&priv->lock, flags);
+        /* we are restarting association process
+         * clear RXON_FILTER_ASSOC_MSK bit
+        */
+        if (priv->iw_mode != IEEE80211_IF_TYPE_AP) {
+                iwl_scan_cancel_timeout(priv, 100);
+                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+                iwl_commit_rxon(priv);
+        }
        /* Per mac80211.h: This is only used in IBSS mode... */
        if (priv->iw_mode != IEEE80211_IF_TYPE_IBSS) {
                IWL_DEBUG_MAC80211("leave - not in IBSS\n");
                mutex_unlock(&priv->mutex);
                return;
@@ -8558,6 +8595,9 @@ static void iwl_pci_remove(struct pci_dev *pdev)
                iwl_rate_control_unregister(priv->hw);
        }
+        /*netif_stop_queue(dev); */
+        flush_workqueue(priv->workqueue);
        /* ieee80211_unregister_hw calls iwl_mac_stop, which flushes
         * priv->workqueue... so we can't take down the workqueue
         * until now... */
diff --git a/drivers/net/wireless/iwlwifi/iwl4965-base.c b/drivers/net/wireless/iwlwifi/iwl4965-base.c
index 5e1279263b..d60adcb9bd 100644
--- a/drivers/net/wireless/iwlwifi/iwl4965-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl4965-base.c
@@ -6845,8 +6845,9 @@ static void iwl_bg_scan_check(struct work_struct *data)
                IWL_DEBUG(IWL_DL_INFO | IWL_DL_SCAN,
                          "Scan completion watchdog resetting adapter (%dms)\n",
                          jiffies_to_msecs(IWL_SCAN_CHECK_WATCHDOG));
                if (!test_bit(STATUS_EXIT_PENDING, &priv->status))
-                        queue_work(priv->workqueue, &priv->restart);
+                        iwl_send_scan_abort(priv);
        }
        mutex_unlock(&priv->mutex);
 }
@@ -6942,7 +6943,7 @@ static void iwl_bg_request_scan(struct work_struct *data)
                spin_unlock_irqrestore(&priv->lock, flags);
                scan->suspend_time = 0;
-                scan->max_out_time = cpu_to_le32(600 * 1024);
+                scan->max_out_time = cpu_to_le32(200 * 1024);
                if (!interval)
                        interval = suspend_time;
@@ -6965,7 +6966,7 @@ static void iwl_bg_request_scan(struct work_struct *data)
                memcpy(scan->direct_scan[0].ssid,
                       priv->direct_ssid, priv->direct_ssid_len);
                direct_mask = 1;
-        } else if (!iwl_is_associated(priv)) {
+        } else if (!iwl_is_associated(priv) && priv->essid_len) {
                scan->direct_scan[0].id = WLAN_EID_SSID;
                scan->direct_scan[0].len = priv->essid_len;
                memcpy(scan->direct_scan[0].ssid, priv->essid, priv->essid_len);
@@ -7118,6 +7119,12 @@ static void iwl_bg_post_associate(struct work_struct *data)
        mutex_lock(&priv->mutex);
+        if (!priv->interface_id || !priv->is_open) {
+                mutex_unlock(&priv->mutex);
+                return;
+        }
+        iwl_scan_cancel_timeout(priv, 200);
        conf = ieee80211_get_hw_conf(priv->hw);
        priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
@@ -7271,9 +7278,19 @@ static void iwl_mac_stop(struct ieee80211_hw *hw)
        struct iwl_priv *priv = hw->priv;
        IWL_DEBUG_MAC80211("enter\n");
+        mutex_lock(&priv->mutex);
+        /* stop mac, cancel any scan request and clear
+         * RXON_FILTER_ASSOC_MSK BIT
+         */
        priv->is_open = 0;
-        /*netif_stop_queue(dev); */
+        iwl_scan_cancel_timeout(priv, 100);
-        flush_workqueue(priv->workqueue);
+        cancel_delayed_work(&priv->post_associate);
+        priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+        iwl_commit_rxon(priv);
+        mutex_unlock(&priv->mutex);
        IWL_DEBUG_MAC80211("leave\n");
 }
@@ -7573,8 +7590,6 @@ static int iwl_mac_config_interface(struct ieee80211_hw *hw, int if_id,
                if (priv->iw_mode == IEEE80211_IF_TYPE_AP)
                        iwl_config_ap(priv);
                else {
-                        priv->staging_rxon.filter_flags |=
-                                                RXON_FILTER_ASSOC_MSK;
                        rc = iwl_commit_rxon(priv);
                        if ((priv->iw_mode == IEEE80211_IF_TYPE_STA) && rc)
                                iwl_rxon_add_station(
@@ -7582,6 +7597,7 @@ static int iwl_mac_config_interface(struct ieee80211_hw *hw, int if_id,
                }
        } else {
+                iwl_scan_cancel_timeout(priv, 100);
                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
                iwl_commit_rxon(priv);
        }
@@ -7621,6 +7637,12 @@ static void iwl_mac_remove_interface(struct ieee80211_hw *hw,
        IWL_DEBUG_MAC80211("enter\n");
        mutex_lock(&priv->mutex);
+        iwl_scan_cancel_timeout(priv, 100);
+        cancel_delayed_work(&priv->post_associate);
+        priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+        iwl_commit_rxon(priv);
        if (priv->interface_id == conf->if_id) {
                priv->interface_id = 0;
                memset(priv->bssid, 0, ETH_ALEN);
@@ -7642,6 +7664,7 @@ static int iwl_mac_hw_scan(struct ieee80211_hw *hw, u8 *ssid, size_t len)
        IWL_DEBUG_MAC80211("enter\n");
+        mutex_lock(&priv->mutex);
        spin_lock_irqsave(&priv->lock, flags);
        if (!iwl_is_ready_rf(priv)) {
@@ -7672,7 +7695,8 @@ static int iwl_mac_hw_scan(struct ieee80211_hw *hw, u8 *ssid, size_t len)
                priv->direct_ssid_len = (u8)
                    min((u8) len, (u8) IW_ESSID_MAX_SIZE);
                memcpy(priv->direct_ssid, ssid, priv->direct_ssid_len);
-        }
+        } else
+                priv->one_direct_scan = 0;
        rc = iwl_scan_initiate(priv);
@@ -7680,6 +7704,7 @@ static int iwl_mac_hw_scan(struct ieee80211_hw *hw, u8 *ssid, size_t len)
 out_unlock:
        spin_unlock_irqrestore(&priv->lock, flags);
+        mutex_unlock(&priv->mutex);
        return rc;
 }
@@ -7713,6 +7738,8 @@ static int iwl_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
        mutex_lock(&priv->mutex);
+        iwl_scan_cancel_timeout(priv, 100);
        switch (cmd) {
        case  SET_KEY:
                rc = iwl_update_sta_key_info(priv, key, sta_id);
@@ -7903,8 +7930,18 @@ static void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
        spin_unlock_irqrestore(&priv->lock, flags);
+        /* we are restarting association process
+         * clear RXON_FILTER_ASSOC_MSK bit
+         */
+        if (priv->iw_mode != IEEE80211_IF_TYPE_AP) {
+                iwl_scan_cancel_timeout(priv, 100);
+                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+                iwl_commit_rxon(priv);
+        }
        /* Per mac80211.h: This is only used in IBSS mode... */
        if (priv->iw_mode != IEEE80211_IF_TYPE_IBSS) {
                IWL_DEBUG_MAC80211("leave - not in IBSS\n");
                mutex_unlock(&priv->mutex);
                return;
@@ -9152,6 +9189,9 @@ static void iwl_pci_remove(struct pci_dev *pdev)
                iwl_rate_control_unregister(priv->hw);
        }
+        /*netif_stop_queue(dev); */
+        flush_workqueue(priv->workqueue);
        /* ieee80211_unregister_hw calls iwl_mac_stop, which flushes
         * priv->workqueue... so we can't take down the workqueue
         * until now... */
diff --git a/drivers/net/wireless/rt2x00/rt2x00lib.h b/drivers/net/wireless/rt2x00/rt2x00lib.h
index 298faa9d3f..06d9bc0015 100644
--- a/drivers/net/wireless/rt2x00/rt2x00lib.h
+++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
@@ -30,7 +30,7 @@
 * Interval defines
 * Both the link tuner as the rfkill will be called once per second.
 */
-#define LINK_TUNE_INTERVAL      ( round_jiffies(HZ) )
+#define LINK_TUNE_INTERVAL      ( round_jiffies_relative(HZ) )
 #define RFKILL_POLL_INTERVAL    ( 1000 )
 /*
diff --git a/drivers/net/wireless/rtl8187_dev.c b/drivers/net/wireless/rtl8187_dev.c
index de61c8fe64..e454ae83e9 100644
--- a/drivers/net/wireless/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl8187_dev.c
@@ -433,6 +433,9 @@ static int rtl8187_start(struct ieee80211_hw *dev)
        rtl818x_iowrite16(priv, &priv->map->INT_MASK, 0xFFFF);
+        rtl818x_iowrite32(priv, &priv->map->MAR[0], ~0);
+        rtl818x_iowrite32(priv, &priv->map->MAR[1], ~0);
        rtl8187_init_urbs(dev);
        reg = RTL818X_RX_CONF_ONLYERLPKT |
@@ -582,32 +585,31 @@ static int rtl8187_config_interface(struct ieee80211_hw *dev, int if_id,
 static void rtl8187_configure_filter(struct ieee80211_hw *dev,
                                     unsigned int changed_flags,
                                     unsigned int *total_flags,
-                                     int mc_count, struct dev_addr_list *mc_list)
+                                     int mc_count, struct dev_addr_list *mclist)
 {
        struct rtl8187_priv *priv = dev->priv;
-        *total_flags = 0;
-        if (changed_flags & FIF_ALLMULTI)
-                priv->rx_conf ^= RTL818X_RX_CONF_MULTICAST;
        if (changed_flags & FIF_FCSFAIL)
                priv->rx_conf ^= RTL818X_RX_CONF_FCS;
        if (changed_flags & FIF_CONTROL)
                priv->rx_conf ^= RTL818X_RX_CONF_CTRL;
        if (changed_flags & FIF_OTHER_BSS)
                priv->rx_conf ^= RTL818X_RX_CONF_MONITOR;
+        if (*total_flags & FIF_ALLMULTI || mc_count > 0)
-        if (mc_count > 0)
                priv->rx_conf |= RTL818X_RX_CONF_MULTICAST;
+        else
+                priv->rx_conf &= ~RTL818X_RX_CONF_MULTICAST;
+        *total_flags = 0;
-        if (priv->rx_conf & RTL818X_RX_CONF_MULTICAST)
-                *total_flags |= FIF_ALLMULTI;
        if (priv->rx_conf & RTL818X_RX_CONF_FCS)
                *total_flags |= FIF_FCSFAIL;
        if (priv->rx_conf & RTL818X_RX_CONF_CTRL)
                *total_flags |= FIF_CONTROL;
        if (priv->rx_conf & RTL818X_RX_CONF_MONITOR)
                *total_flags |= FIF_OTHER_BSS;
+        if (priv->rx_conf & RTL818X_RX_CONF_MULTICAST)
+                *total_flags |= FIF_ALLMULTI;
        rtl818x_iowrite32_async(priv, &priv->map->RX_CONF, priv->rx_conf);
 }
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index fd5d0c1570..0011849901 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -562,8 +562,6 @@ zfcp_sg_list_alloc(struct zfcp_sg_list *sg_list, size_t size)
        sg_init_table(sg_list->sg, sg_list->count);
        for (i = 0, sg = sg_list->sg; i < sg_list->count; i++, sg++) {
-                sg->length = min(size, PAGE_SIZE);
-                sg->offset = 0;
                address = (void *) get_zeroed_page(GFP_KERNEL);
                if (address == NULL) {
                        sg_list->count = i;
@@ -571,7 +569,7 @@ zfcp_sg_list_alloc(struct zfcp_sg_list *sg_list, size_t size)
                        retval = -ENOMEM;
                        goto out;
                }
-                zfcp_address_to_sg(address, sg);
+                zfcp_address_to_sg(address, sg, min(size, PAGE_SIZE));
                size -= sg->length;
        }
@@ -1518,13 +1516,13 @@ zfcp_gid_pn_buffers_alloc(struct zfcp_gid_pn_data **gid_pn, mempool_t *pool)
                return -ENOMEM;
        memset(data, 0, sizeof(*data));
+        sg_init_table(&data->req , 1);
+        sg_init_table(&data->resp , 1);
        data->ct.req = &data->req;
        data->ct.resp = &data->resp;
        data->ct.req_count = data->ct.resp_count = 1;
-        zfcp_address_to_sg(&data->ct_iu_req, &data->req);
+        zfcp_address_to_sg(&data->ct_iu_req, &data->req, sizeof(struct ct_iu_gid_pn_req));
-        zfcp_address_to_sg(&data->ct_iu_resp, &data->resp);
+        zfcp_address_to_sg(&data->ct_iu_resp, &data->resp, sizeof(struct ct_iu_gid_pn_resp));
-        data->req.length = sizeof(struct ct_iu_gid_pn_req);
-        data->resp.length = sizeof(struct ct_iu_gid_pn_resp);
        *gid_pn = data;
        return 0;
diff --git a/drivers/s390/scsi/zfcp_def.h b/drivers/s390/scsi/zfcp_def.h
index 326e7ee232..0754542978 100644
--- a/drivers/s390/scsi/zfcp_def.h
+++ b/drivers/s390/scsi/zfcp_def.h
@@ -74,8 +74,7 @@ zfcp_sg_to_address(struct scatterlist *list)
 static inline void
 zfcp_address_to_sg(void *address, struct scatterlist *list)
 {
-        sg_set_page(list, virt_to_page(address));
+        sg_set_buf(list, address, 0);
-        list->offset = ((unsigned long) address) & (PAGE_SIZE - 1);
 }
 #define REQUEST_LIST_SIZE 128
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index 9438d0b287..5552b755c0 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -322,9 +322,9 @@ zfcp_erp_adisc(struct zfcp_port *port)
        if (address == NULL)
                goto nomem;
-        zfcp_address_to_sg(address, send_els->req);
+        zfcp_address_to_sg(address, send_els->req, sizeof(struct zfcp_ls_adisc));
        address += PAGE_SIZE >> 1;
-        zfcp_address_to_sg(address, send_els->resp);
+        zfcp_address_to_sg(address, send_els->resp, sizeof(struct zfcp_ls_adisc_acc));
        send_els->req_count = send_els->resp_count = 1;
        send_els->adapter = adapter;
@@ -336,9 +336,6 @@ zfcp_erp_adisc(struct zfcp_port *port)
        adisc = zfcp_sg_to_address(send_els->req);
        send_els->ls_code = adisc->code = ZFCP_LS_ADISC;
-        send_els->req->length = sizeof(struct zfcp_ls_adisc);
-        send_els->resp->length = sizeof(struct zfcp_ls_adisc_acc);
        /* acc. to FC-FS, hard_nport_id in ADISC should not be set for ports
           without FC-AL-2 capability, so we don't set it */
        adisc->wwpn = fc_host_port_name(adapter->scsi_host);
diff --git a/drivers/scsi/atari_NCR5380.c b/drivers/scsi/atari_NCR5380.c
index d1780980fb..a9680b5e8a 100644
--- a/drivers/scsi/atari_NCR5380.c
+++ b/drivers/scsi/atari_NCR5380.c
@@ -477,10 +477,9 @@ static void merge_contiguous_buffers(Scsi_Cmnd *cmd)
        for (endaddr = virt_to_phys(cmd->SCp.ptr + cmd->SCp.this_residual - 1) + 1;
             cmd->SCp.buffers_residual &&
-             virt_to_phys(page_address(cmd->SCp.buffer[1].page) +
+             virt_to_phys(sg_virt(&cmd->SCp.buffer[1])) == endaddr;) {
-                          cmd->SCp.buffer[1].offset) == endaddr;) {
                MER_PRINTK("VTOP(%p) == %08lx -> merging\n",
-                           page_address(cmd->SCp.buffer[1].page), endaddr);
+                           page_address(sg_page(&cmd->SCp.buffer[1])), endaddr);
 #if (NDEBUG & NDEBUG_MERGING)
                ++cnt;
 #endif
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 439b97a6a2..0841df01bc 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -2890,7 +2890,7 @@ static struct ipr_sglist *ipr_alloc_ucode_buffer(int buf_len)
                        return NULL;
                }
-                sg_set_page(&scatterlist[i], page);
+                sg_set_page(&scatterlist[i], page, 0, 0);
        }
        return sglist;
diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
index 6ce4109efd..4bcf916c21 100644
--- a/drivers/scsi/iscsi_tcp.c
+++ b/drivers/scsi/iscsi_tcp.c
@@ -79,9 +79,7 @@ static inline void
 iscsi_buf_init_sg(struct iscsi_buf *ibuf, struct scatterlist *sg)
 {
        sg_init_table(&ibuf->sg, 1);
-        sg_set_page(&ibuf->sg, sg_page(sg));
+        sg_set_page(&ibuf->sg, sg_page(sg), sg->length, sg->offset);
-        ibuf->sg.offset = sg->offset;
-        ibuf->sg.length = sg->length;
        /*
         * Fastpath: sg element fits into single page
         */
@@ -676,9 +674,8 @@ partial_sg_digest_update(struct hash_desc *desc, struct scatterlist *sg,
 {
        struct scatterlist temp;
-        memcpy(&temp, sg, sizeof(struct scatterlist));
+        sg_init_table(&temp, 1);
-        temp.offset = offset;
+        sg_set_page(&temp, sg_page(sg), length, offset);
-        temp.length = length;
        crypto_hash_update(desc, &temp, length);
 }
diff --git a/drivers/scsi/osst.c b/drivers/scsi/osst.c
index 1c5c4b68f2..4652ad2251 100644
--- a/drivers/scsi/osst.c
+++ b/drivers/scsi/osst.c
@@ -5256,8 +5256,7 @@ static int enlarge_buffer(struct osst_buffer *STbuffer, int need_dma)
                STbuffer->sg[0].offset = 0;
                if (page != NULL) {
-                    sg_set_page(&STbuffer->sg[0], page);
+                    sg_set_page(&STbuffer->sg[0], page, b_size, 0);
-                    STbuffer->sg[0].length = b_size;
                    STbuffer->b_data = page_address(page);
                    break;
                }
@@ -5285,8 +5284,7 @@ static int enlarge_buffer(struct osst_buffer *STbuffer, int need_dma)
                        normalize_buffer(STbuffer);
                        return 0;
                }
-                sg_set_page(&STbuffer->sg[segs], page);
+                sg_set_page(&STbuffer->sg[segs], page, (OS_FRAME_SIZE - got <= PAGE_SIZE / 2) ? (OS_FRAME_SIZE - got) : b_size, 0);
-                STbuffer->sg[segs].length = (OS_FRAME_SIZE - got <= PAGE_SIZE / 2) ? (OS_FRAME_SIZE - got) : b_size;
                got += STbuffer->sg[segs].length;
                STbuffer->buffer_size = got;
                STbuffer->sg_segs = ++segs;
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index cc19710028..b5fa4f0913 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1717,16 +1717,12 @@ st_map_user_pages(struct scatterlist *sgl, const unsigned int max_pages,
                   goto out_unlock; */
        }
-        sg_set_page(sgl, pages[0]);
+        sg_set_page(sgl, pages[0], 0, uaddr & ~PAGE_MASK);
-        sgl[0].offset = uaddr & ~PAGE_MASK;
        if (nr_pages > 1) {
                sgl[0].length = PAGE_SIZE - sgl[0].offset;
                count -= sgl[0].length;
-                for (i=1; i < nr_pages ; i++) {
+                for (i=1; i < nr_pages ; i++)
-                        sg_set_page(&sgl[i], pages[i]);
+                        sg_set_page(&sgl[i], pages[i], count < PAGE_SIZE ? count : PAGE_SIZE, 0);
-                        sgl[i].length = count < PAGE_SIZE ? count : PAGE_SIZE;
-                        count -= PAGE_SIZE;
-                }
        }
        else {
                sgl[0].length = count;
@@ -1854,8 +1850,7 @@ sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size)
                                scatter_elem_sz_prev = ret_sz;
                        }
                }
-                sg_set_page(sg, p);
+                sg_set_page(sg, p, (ret_sz > num) ? num : ret_sz, 0);
-                sg->length = (ret_sz > num) ? num : ret_sz;
                SCSI_LOG_TIMEOUT(5, printk("sg_build_indirect: k=%d, num=%d, "
                                 "ret_sz=%d\n", k, num, ret_sz));
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index ce69b9efc1..98dfd6ea20 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -3797,13 +3797,11 @@ static void buf_to_sg(struct st_buffer *STbp, unsigned int length)
        sg = &(STbp->sg[0]);
        frp = STbp->frp;
        for (i=count=0; count < length; i++) {
-                sg_set_page(&sg[i], frp[i].page);
                if (length - count > frp[i].length)
-                        sg[i].length = frp[i].length;
+                        sg_set_page(&sg[i], frp[i].page, frp[i].length, 0);
                else
-                        sg[i].length = length - count;
+                        sg_set_page(&sg[i], frp[i].page, length - count, 0);
                count += sg[i].length;
-                sg[i].offset = 0;
        }
        STbp->sg_segs = i;
        STbp->frp_sg_current = length;
@@ -4446,15 +4444,13 @@ static int sgl_map_user_pages(struct scatterlist *sgl, const unsigned int max_pa
        }
        /* Populate the scatter/gather list */
-        sg_set_page(&sgl[0], pages[0]);
+        sg_set_page(&sgl[0], pages[0], 0, uaddr & ~PAGE_MASK);
-        sgl[0].offset = uaddr & ~PAGE_MASK;
        if (nr_pages > 1) {
                sgl[0].length = PAGE_SIZE - sgl[0].offset;
                count -= sgl[0].length;
                for (i=1; i < nr_pages ; i++) {
-                        sg_set_page(&sgl[i], pages[i]);;
+                        sg_set_page(&sgl[i], pages[i],
-                        sgl[i].offset = 0;
+                                    count < PAGE_SIZE ? count : PAGE_SIZE, 0);;
-                        sgl[i].length = count < PAGE_SIZE ? count : PAGE_SIZE;
                        count -= PAGE_SIZE;
                }
        }
diff --git a/drivers/scsi/sun3x_esp.c b/drivers/scsi/sun3x_esp.c
index 80fb3f88af..1bc41907a0 100644
--- a/drivers/scsi/sun3x_esp.c
+++ b/drivers/scsi/sun3x_esp.c
@@ -332,8 +332,8 @@ static void dma_mmu_get_scsi_sgl (struct NCR_ESP *esp, Scsi_Cmnd *sp)
    struct scatterlist *sg = sp->SCp.buffer;
    while (sz >= 0) {
-            sg[sz].dma_address = dvma_map((unsigned long)page_address(sg[sz].page) +
+            sg[sz].dma_address = dvma_map((unsigned long)sg_virt(&sg[sz]),
-                                           sg[sz].offset, sg[sz].length);
+                                          sg[sz].length);
            sz--;
    }
    sp->SCp.ptr=(char *)((unsigned long)sp->SCp.buffer->dma_address);
diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
index 103189095c..3bb5d241dd 100644
--- a/drivers/serial/serial_core.c
+++ b/drivers/serial/serial_core.c
@@ -1875,6 +1875,7 @@ uart_set_options(struct uart_port *port, struct console *co,
                 int baud, int parity, int bits, int flow)
 {
        struct ktermios termios;
+        static struct ktermios dummy;
        int i;
        /*
@@ -1920,7 +1921,7 @@ uart_set_options(struct uart_port *port, struct console *co,
         */
        port->mctrl |= TIOCM_DTR;
-        port->ops->set_termios(port, &termios, NULL);
+        port->ops->set_termios(port, &termios, &dummy);
        co->cflag = termios.c_cflag;
        return 0;
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 8bdaa157ff..eb4ac47612 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1641,7 +1641,13 @@ free_interfaces:
                                intf->dev.bus_id, ret);
                        continue;
                }
-                usb_create_sysfs_intf_files (intf);
+                /* The driver's probe method can call usb_set_interface(),
+                 * which would mean the interface's sysfs files are already
+                 * created.  Just in case, we'll remove them first.
+                 */
+                usb_remove_sysfs_intf_files(intf);
+                usb_create_sysfs_intf_files(intf);
        }
        usb_autosuspend_device(dev);
diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
index c20c03aaf0..d05ead2008 100644
--- a/drivers/usb/core/urb.c
+++ b/drivers/usb/core/urb.c
@@ -372,7 +372,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
        /* enforce simple/standard policy */
        allowed = (URB_NO_TRANSFER_DMA_MAP | URB_NO_SETUP_DMA_MAP |
-                        URB_NO_INTERRUPT | URB_DIR_MASK);
+                        URB_NO_INTERRUPT | URB_DIR_MASK | URB_FREE_BUFFER);
        switch (xfertype) {
        case USB_ENDPOINT_XFER_BULK:
                if (is_out)
diff --git a/drivers/usb/gadget/amd5536udc.c b/drivers/usb/gadget/amd5536udc.c
index 1c80406025..c72e9620bf 100644
--- a/drivers/usb/gadget/amd5536udc.c
+++ b/drivers/usb/gadget/amd5536udc.c
@@ -3289,7 +3289,7 @@ static int udc_pci_probe(
        dev->chiprev = pdev->revision;
        pci_set_master(pdev);
-        pci_set_mwi(pdev);
+        pci_try_set_mwi(pdev);
        /* init dma pools */
        if (use_dma) {
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index c978d622fa..177e78ed24 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -156,7 +156,7 @@ config USB_OHCI_HCD_PCI
 config USB_OHCI_HCD_SSB
        bool "OHCI support for Broadcom SSB OHCI core"
-        depends on USB_OHCI_HCD && SSB && EXPERIMENTAL
+        depends on USB_OHCI_HCD && (SSB = y || SSB = CONFIG_USB_OHCI_HCD) && EXPERIMENTAL
        default n
        ---help---
          Support for the Sonics Silicon Backplane (SSB) attached
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 240c7f5075..704f33fdd2 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -80,7 +80,10 @@ static const char	hcd_name [] = "ohci_hcd";
 static void ohci_dump (struct ohci_hcd *ohci, int verbose);
 static int ohci_init (struct ohci_hcd *ohci);
 static void ohci_stop (struct usb_hcd *hcd);
+#if defined(CONFIG_PM) || defined(CONFIG_PCI)
 static int ohci_restart (struct ohci_hcd *ohci);
+#endif
 #include "ohci-hub.c"
 #include "ohci-dbg.c"
@@ -396,7 +399,7 @@ static int check_ed(struct ohci_hcd *ohci, struct ed *ed)
 */
 static void unlink_watchdog_func(unsigned long _ohci)
 {
-        long            flags;
+        unsigned long   flags;
        unsigned        max;
        unsigned        seen_count = 0;
        unsigned        i;
@@ -893,6 +896,8 @@ static void ohci_stop (struct usb_hcd *hcd)
 /*-------------------------------------------------------------------------*/
+#if defined(CONFIG_PM) || defined(CONFIG_PCI)
 /* must not be called from interrupt context */
 static int ohci_restart (struct ohci_hcd *ohci)
 {
@@ -954,6 +959,8 @@ static int ohci_restart (struct ohci_hcd *ohci)
        return 0;
 }
+#endif
 /*-------------------------------------------------------------------------*/
 #define DRIVER_INFO DRIVER_VERSION " " DRIVER_DESC
diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
index e5d60d5b10..60379b17bb 100644
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -1271,7 +1271,8 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
        } else if (qh->period != urb->interval) {
                return -EINVAL;         /* Can't change the period */
-        } else {        /* Pick up where the last URB leaves off */
+        } else {
+                /* Find the next unused frame */
                if (list_empty(&qh->queue)) {
                        frame = qh->iso_frame;
                } else {
@@ -1283,10 +1284,18 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
                                        lurb->number_of_packets *
                                        lurb->interval;
                }
-                if (urb->transfer_flags & URB_ISO_ASAP)
+                if (urb->transfer_flags & URB_ISO_ASAP) {
-                        urb->start_frame = frame;
+                        /* Skip some frames if necessary to insure
-                else if (urb->start_frame != frame)
+                         * the start frame is in the future.
-                        return -EINVAL;
+                         */
+                        uhci_get_current_frame_number(uhci);
+                        if (uhci_frame_before_eq(frame, uhci->frame_number)) {
+                                frame = uhci->frame_number + 1;
+                                frame += ((qh->phase - frame) &
+                                        (qh->period - 1));
+                        }
+                }       /* Otherwise pick up where the last URB leaves off */
+                urb->start_frame = frame;
        }
        /* Make sure we won't have to go too far into the future */
diff --git a/drivers/usb/misc/cytherm.c b/drivers/usb/misc/cytherm.c
index 2677fea147..1cd9e7eba9 100644
--- a/drivers/usb/misc/cytherm.c
+++ b/drivers/usb/misc/cytherm.c
@@ -399,7 +399,6 @@ static void cytherm_disconnect(struct usb_interface *interface)
        struct usb_cytherm *dev;
        dev = usb_get_intfdata (interface);
-        usb_set_intfdata (interface, NULL);
        device_remove_file(&interface->dev, &dev_attr_brightness);
        device_remove_file(&interface->dev, &dev_attr_temp);
@@ -407,6 +406,9 @@ static void cytherm_disconnect(struct usb_interface *interface)
        device_remove_file(&interface->dev, &dev_attr_port0);
        device_remove_file(&interface->dev, &dev_attr_port1);
+        /* first remove the files, then NULL the pointer */
+        usb_set_intfdata (interface, NULL);
        usb_put_dev(dev->udev);
        kfree(dev);
diff --git a/drivers/usb/misc/emi26.c b/drivers/usb/misc/emi26.c
index cd137577bb..4a09b87bdd 100644
--- a/drivers/usb/misc/emi26.c
+++ b/drivers/usb/misc/emi26.c
@@ -114,6 +114,10 @@ static int emi26_load_firmware (struct usb_device *dev)
        /* De-assert reset (let the CPU run) */
        err = emi26_set_reset(dev,0);
+        if (err < 0) {
+                err("%s - error loading firmware: error = %d", __FUNCTION__, err);
+                goto wraperr;
+        }
        msleep(250);    /* let device settle */
        /* 2. We upload the FPGA firmware into the EMI
diff --git a/drivers/usb/misc/emi62.c b/drivers/usb/misc/emi62.c
index 4758cc5cce..d136241592 100644
--- a/drivers/usb/misc/emi62.c
+++ b/drivers/usb/misc/emi62.c
@@ -123,6 +123,10 @@ static int emi62_load_firmware (struct usb_device *dev)
        /* De-assert reset (let the CPU run) */
        err = emi62_set_reset(dev,0);
+        if (err < 0) {
+                err("%s - error loading firmware: error = %d", __FUNCTION__, err);
+                goto wraperr;
+        }
        msleep(250);    /* let device settle */
        /* 2. We upload the FPGA firmware into the EMI
diff --git a/drivers/usb/misc/ftdi-elan.c b/drivers/usb/misc/ftdi-elan.c
index d3d8cd6ff1..148b7fe639 100644
--- a/drivers/usb/misc/ftdi-elan.c
+++ b/drivers/usb/misc/ftdi-elan.c
@@ -147,7 +147,7 @@ struct u132_target {
 /* Structure to hold all of our device specific stuff*/
 struct usb_ftdi {
        struct list_head ftdi_list;
-        struct semaphore u132_lock;
+        struct mutex u132_lock;
        int command_next;
        int command_head;
        struct u132_command command[COMMAND_SIZE];
@@ -330,39 +330,39 @@ static int ftdi_elan_hcd_init(struct usb_ftdi *ftdi)
 static void ftdi_elan_abandon_completions(struct usb_ftdi *ftdi)
 {
-        down(&ftdi->u132_lock);
+        mutex_lock(&ftdi->u132_lock);
        while (ftdi->respond_next > ftdi->respond_head) {
                struct u132_respond *respond = &ftdi->respond[RESPOND_MASK &
                        ftdi->respond_head++];
                *respond->result = -ESHUTDOWN;
                *respond->value = 0;
                complete(&respond->wait_completion);
-        } up(&ftdi->u132_lock);
+        } mutex_unlock(&ftdi->u132_lock);
 }
 static void ftdi_elan_abandon_targets(struct usb_ftdi *ftdi)
 {
        int ed_number = 4;
-        down(&ftdi->u132_lock);
+        mutex_lock(&ftdi->u132_lock);
        while (ed_number-- > 0) {
                struct u132_target *target = &ftdi->target[ed_number];
                if (target->active == 1) {
                        target->condition_code = TD_DEVNOTRESP;
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        ftdi_elan_do_callback(ftdi, target, NULL, 0);
-                        down(&ftdi->u132_lock);
+                        mutex_lock(&ftdi->u132_lock);
                }
        }
        ftdi->recieved = 0;
        ftdi->expected = 4;
        ftdi->ed_found = 0;
-        up(&ftdi->u132_lock);
+        mutex_unlock(&ftdi->u132_lock);
 }
 static void ftdi_elan_flush_targets(struct usb_ftdi *ftdi)
 {
        int ed_number = 4;
-        down(&ftdi->u132_lock);
+        mutex_lock(&ftdi->u132_lock);
        while (ed_number-- > 0) {
                struct u132_target *target = &ftdi->target[ed_number];
                target->abandoning = 1;
@@ -382,9 +382,9 @@ static void ftdi_elan_flush_targets(struct usb_ftdi *ftdi)
                                ftdi->command_next += 1;
                                ftdi_elan_kick_command_queue(ftdi);
                        } else {
-                                up(&ftdi->u132_lock);
+                                mutex_unlock(&ftdi->u132_lock);
                                msleep(100);
-                                down(&ftdi->u132_lock);
+                                mutex_lock(&ftdi->u132_lock);
                                goto wait_1;
                        }
                }
@@ -404,9 +404,9 @@ static void ftdi_elan_flush_targets(struct usb_ftdi *ftdi)
                                ftdi->command_next += 1;
                                ftdi_elan_kick_command_queue(ftdi);
                        } else {
-                                up(&ftdi->u132_lock);
+                                mutex_unlock(&ftdi->u132_lock);
                                msleep(100);
-                                down(&ftdi->u132_lock);
+                                mutex_lock(&ftdi->u132_lock);
                                goto wait_2;
                        }
                }
@@ -414,13 +414,13 @@ static void ftdi_elan_flush_targets(struct usb_ftdi *ftdi)
        ftdi->recieved = 0;
        ftdi->expected = 4;
        ftdi->ed_found = 0;
-        up(&ftdi->u132_lock);
+        mutex_unlock(&ftdi->u132_lock);
 }
 static void ftdi_elan_cancel_targets(struct usb_ftdi *ftdi)
 {
        int ed_number = 4;
-        down(&ftdi->u132_lock);
+        mutex_lock(&ftdi->u132_lock);
        while (ed_number-- > 0) {
                struct u132_target *target = &ftdi->target[ed_number];
                target->abandoning = 1;
@@ -440,9 +440,9 @@ static void ftdi_elan_cancel_targets(struct usb_ftdi *ftdi)
                                ftdi->command_next += 1;
                                ftdi_elan_kick_command_queue(ftdi);
                        } else {
-                                up(&ftdi->u132_lock);
+                                mutex_unlock(&ftdi->u132_lock);
                                msleep(100);
-                                down(&ftdi->u132_lock);
+                                mutex_lock(&ftdi->u132_lock);
                                goto wait;
                        }
                }
@@ -450,7 +450,7 @@ static void ftdi_elan_cancel_targets(struct usb_ftdi *ftdi)
        ftdi->recieved = 0;
        ftdi->expected = 4;
        ftdi->ed_found = 0;
-        up(&ftdi->u132_lock);
+        mutex_unlock(&ftdi->u132_lock);
 }
 static void ftdi_elan_kick_command_queue(struct usb_ftdi *ftdi)
@@ -886,14 +886,14 @@ static char *have_ed_set_response(struct usb_ftdi *ftdi,
        char *b)
 {
        int payload = (ed_length >> 0) & 0x07FF;
-        down(&ftdi->u132_lock);
+        mutex_lock(&ftdi->u132_lock);
        target->actual = 0;
        target->non_null = (ed_length >> 15) & 0x0001;
        target->repeat_number = (ed_length >> 11) & 0x000F;
        if (ed_type == 0x02) {
                if (payload == 0 || target->abandoning > 0) {
                        target->abandoning = 0;
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        ftdi_elan_do_callback(ftdi, target, 4 + ftdi->response,
                                payload);
                        ftdi->recieved = 0;
@@ -903,13 +903,13 @@ static char *have_ed_set_response(struct usb_ftdi *ftdi,
                } else {
                        ftdi->expected = 4 + payload;
                        ftdi->ed_found = 1;
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        return b;
                }
        } else if (ed_type == 0x03) {
                if (payload == 0 || target->abandoning > 0) {
                        target->abandoning = 0;
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        ftdi_elan_do_callback(ftdi, target, 4 + ftdi->response,
                                payload);
                        ftdi->recieved = 0;
@@ -919,12 +919,12 @@ static char *have_ed_set_response(struct usb_ftdi *ftdi,
                } else {
                        ftdi->expected = 4 + payload;
                        ftdi->ed_found = 1;
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        return b;
                }
        } else if (ed_type == 0x01) {
                target->abandoning = 0;
-                up(&ftdi->u132_lock);
+                mutex_unlock(&ftdi->u132_lock);
                ftdi_elan_do_callback(ftdi, target, 4 + ftdi->response,
                        payload);
                ftdi->recieved = 0;
@@ -933,7 +933,7 @@ static char *have_ed_set_response(struct usb_ftdi *ftdi,
                return ftdi->response;
        } else {
                target->abandoning = 0;
-                up(&ftdi->u132_lock);
+                mutex_unlock(&ftdi->u132_lock);
                ftdi_elan_do_callback(ftdi, target, 4 + ftdi->response,
                        payload);
                ftdi->recieved = 0;
@@ -947,12 +947,12 @@ static char *have_ed_get_response(struct usb_ftdi *ftdi,
        struct u132_target *target, u16 ed_length, int ed_number, int ed_type,
        char *b)
 {
-        down(&ftdi->u132_lock);
+        mutex_lock(&ftdi->u132_lock);
        target->condition_code = TD_DEVNOTRESP;
        target->actual = (ed_length >> 0) & 0x01FF;
        target->non_null = (ed_length >> 15) & 0x0001;
        target->repeat_number = (ed_length >> 11) & 0x000F;
-        up(&ftdi->u132_lock);
+        mutex_unlock(&ftdi->u132_lock);
        if (target->active)
                ftdi_elan_do_callback(ftdi, target, NULL, 0);
        target->abandoning = 0;
@@ -1278,7 +1278,7 @@ static int ftdi_elan_write_reg(struct usb_ftdi *ftdi, u32 data)
                return -ENODEV;
        } else {
                int command_size;
-                down(&ftdi->u132_lock);
+                mutex_lock(&ftdi->u132_lock);
                command_size = ftdi->command_next - ftdi->command_head;
                if (command_size < COMMAND_SIZE) {
                        struct u132_command *command = &ftdi->command[
@@ -1292,10 +1292,10 @@ static int ftdi_elan_write_reg(struct usb_ftdi *ftdi, u32 data)
                        command->buffer = &command->value;
                        ftdi->command_next += 1;
                        ftdi_elan_kick_command_queue(ftdi);
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        return 0;
                } else {
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        msleep(100);
                        goto wait;
                }
@@ -1310,7 +1310,7 @@ static int ftdi_elan_write_config(struct usb_ftdi *ftdi, int config_offset,
                return -ENODEV;
        } else {
                int command_size;
-                down(&ftdi->u132_lock);
+                mutex_lock(&ftdi->u132_lock);
                command_size = ftdi->command_next - ftdi->command_head;
                if (command_size < COMMAND_SIZE) {
                        struct u132_command *command = &ftdi->command[
@@ -1324,10 +1324,10 @@ static int ftdi_elan_write_config(struct usb_ftdi *ftdi, int config_offset,
                        command->buffer = &command->value;
                        ftdi->command_next += 1;
                        ftdi_elan_kick_command_queue(ftdi);
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        return 0;
                } else {
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        msleep(100);
                        goto wait;
                }
@@ -1342,7 +1342,7 @@ static int ftdi_elan_write_pcimem(struct usb_ftdi *ftdi, int mem_offset,
                return -ENODEV;
        } else {
                int command_size;
-                down(&ftdi->u132_lock);
+                mutex_lock(&ftdi->u132_lock);
                command_size = ftdi->command_next - ftdi->command_head;
                if (command_size < COMMAND_SIZE) {
                        struct u132_command *command = &ftdi->command[
@@ -1356,10 +1356,10 @@ static int ftdi_elan_write_pcimem(struct usb_ftdi *ftdi, int mem_offset,
                        command->buffer = &command->value;
                        ftdi->command_next += 1;
                        ftdi_elan_kick_command_queue(ftdi);
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        return 0;
                } else {
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        msleep(100);
                        goto wait;
                }
@@ -1382,7 +1382,7 @@ static int ftdi_elan_read_reg(struct usb_ftdi *ftdi, u32 *data)
        } else {
                int command_size;
                int respond_size;
-                down(&ftdi->u132_lock);
+                mutex_lock(&ftdi->u132_lock);
                command_size = ftdi->command_next - ftdi->command_head;
                respond_size = ftdi->respond_next - ftdi->respond_head;
                if (command_size < COMMAND_SIZE && respond_size < RESPOND_SIZE)
@@ -1405,11 +1405,11 @@ static int ftdi_elan_read_reg(struct usb_ftdi *ftdi, u32 *data)
                        ftdi->command_next += 1;
                        ftdi->respond_next += 1;
                        ftdi_elan_kick_command_queue(ftdi);
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        wait_for_completion(&respond->wait_completion);
                        return result;
                } else {
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        msleep(100);
                        goto wait;
                }
@@ -1425,7 +1425,7 @@ static int ftdi_elan_read_config(struct usb_ftdi *ftdi, int config_offset,
        } else {
                int command_size;
                int respond_size;
-                down(&ftdi->u132_lock);
+                mutex_lock(&ftdi->u132_lock);
                command_size = ftdi->command_next - ftdi->command_head;
                respond_size = ftdi->respond_next - ftdi->respond_head;
                if (command_size < COMMAND_SIZE && respond_size < RESPOND_SIZE)
@@ -1449,11 +1449,11 @@ static int ftdi_elan_read_config(struct usb_ftdi *ftdi, int config_offset,
                        ftdi->command_next += 1;
                        ftdi->respond_next += 1;
                        ftdi_elan_kick_command_queue(ftdi);
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        wait_for_completion(&respond->wait_completion);
                        return result;
                } else {
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        msleep(100);
                        goto wait;
                }
@@ -1469,7 +1469,7 @@ static int ftdi_elan_read_pcimem(struct usb_ftdi *ftdi, int mem_offset,
        } else {
                int command_size;
                int respond_size;
-                down(&ftdi->u132_lock);
+                mutex_lock(&ftdi->u132_lock);
                command_size = ftdi->command_next - ftdi->command_head;
                respond_size = ftdi->respond_next - ftdi->respond_head;
                if (command_size < COMMAND_SIZE && respond_size < RESPOND_SIZE)
@@ -1493,11 +1493,11 @@ static int ftdi_elan_read_pcimem(struct usb_ftdi *ftdi, int mem_offset,
                        ftdi->command_next += 1;
                        ftdi->respond_next += 1;
                        ftdi_elan_kick_command_queue(ftdi);
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        wait_for_completion(&respond->wait_completion);
                        return result;
                } else {
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        msleep(100);
                        goto wait;
                }
@@ -1529,7 +1529,7 @@ static int ftdi_elan_edset_setup(struct usb_ftdi *ftdi, u8 ed_number,
                return -ENODEV;
        } else {
                int command_size;
-                down(&ftdi->u132_lock);
+                mutex_lock(&ftdi->u132_lock);
                command_size = ftdi->command_next - ftdi->command_head;
                if (command_size < COMMAND_SIZE) {
                        struct u132_target *target = &ftdi->target[ed];
@@ -1550,10 +1550,10 @@ static int ftdi_elan_edset_setup(struct usb_ftdi *ftdi, u8 ed_number,
                        target->active = 1;
                        ftdi->command_next += 1;
                        ftdi_elan_kick_command_queue(ftdi);
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        return 0;
                } else {
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        msleep(100);
                        goto wait;
                }
@@ -1586,7 +1586,7 @@ static int ftdi_elan_edset_input(struct usb_ftdi *ftdi, u8 ed_number,
                return -ENODEV;
        } else {
                int command_size;
-                down(&ftdi->u132_lock);
+                mutex_lock(&ftdi->u132_lock);
                command_size = ftdi->command_next - ftdi->command_head;
                if (command_size < COMMAND_SIZE) {
                        struct u132_target *target = &ftdi->target[ed];
@@ -1615,10 +1615,10 @@ static int ftdi_elan_edset_input(struct usb_ftdi *ftdi, u8 ed_number,
                        target->active = 1;
                        ftdi->command_next += 1;
                        ftdi_elan_kick_command_queue(ftdi);
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        return 0;
                } else {
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        msleep(100);
                        goto wait;
                }
@@ -1651,7 +1651,7 @@ static int ftdi_elan_edset_empty(struct usb_ftdi *ftdi, u8 ed_number,
                return -ENODEV;
        } else {
                int command_size;
-                down(&ftdi->u132_lock);
+                mutex_lock(&ftdi->u132_lock);
                command_size = ftdi->command_next - ftdi->command_head;
                if (command_size < COMMAND_SIZE) {
                        struct u132_target *target = &ftdi->target[ed];
@@ -1672,10 +1672,10 @@ static int ftdi_elan_edset_empty(struct usb_ftdi *ftdi, u8 ed_number,
                        target->active = 1;
                        ftdi->command_next += 1;
                        ftdi_elan_kick_command_queue(ftdi);
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        return 0;
                } else {
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        msleep(100);
                        goto wait;
                }
@@ -1708,7 +1708,7 @@ static int ftdi_elan_edset_output(struct usb_ftdi *ftdi, u8 ed_number,
                return -ENODEV;
        } else {
                int command_size;
-                down(&ftdi->u132_lock);
+                mutex_lock(&ftdi->u132_lock);
                command_size = ftdi->command_next - ftdi->command_head;
                if (command_size < COMMAND_SIZE) {
                        u8 *b;
@@ -1751,10 +1751,10 @@ static int ftdi_elan_edset_output(struct usb_ftdi *ftdi, u8 ed_number,
                        target->active = 1;
                        ftdi->command_next += 1;
                        ftdi_elan_kick_command_queue(ftdi);
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        return 0;
                } else {
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        msleep(100);
                        goto wait;
                }
@@ -1787,7 +1787,7 @@ static int ftdi_elan_edset_single(struct usb_ftdi *ftdi, u8 ed_number,
                return -ENODEV;
        } else {
                int command_size;
-                down(&ftdi->u132_lock);
+                mutex_lock(&ftdi->u132_lock);
                command_size = ftdi->command_next - ftdi->command_head;
                if (command_size < COMMAND_SIZE) {
                        int remaining_length = urb->transfer_buffer_length -
@@ -1816,10 +1816,10 @@ static int ftdi_elan_edset_single(struct usb_ftdi *ftdi, u8 ed_number,
                        target->active = 1;
                        ftdi->command_next += 1;
                        ftdi_elan_kick_command_queue(ftdi);
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        return 0;
                } else {
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        msleep(100);
                        goto wait;
                }
@@ -1849,9 +1849,9 @@ static int ftdi_elan_edset_flush(struct usb_ftdi *ftdi, u8 ed_number,
                return -ENODEV;
        } else {
                struct u132_target *target = &ftdi->target[ed];
-                down(&ftdi->u132_lock);
+                mutex_lock(&ftdi->u132_lock);
                if (target->abandoning > 0) {
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        return 0;
                } else {
                        target->abandoning = 1;
@@ -1873,13 +1873,13 @@ static int ftdi_elan_edset_flush(struct usb_ftdi *ftdi, u8 ed_number,
                                        ftdi->command_next += 1;
                                        ftdi_elan_kick_command_queue(ftdi);
                                } else {
-                                        up(&ftdi->u132_lock);
+                                        mutex_unlock(&ftdi->u132_lock);
                                        msleep(100);
-                                        down(&ftdi->u132_lock);
+                                        mutex_lock(&ftdi->u132_lock);
                                        goto wait_1;
                                }
                        }
-                        up(&ftdi->u132_lock);
+                        mutex_unlock(&ftdi->u132_lock);
                        return 0;
                }
        }
@@ -2793,7 +2793,7 @@ static int ftdi_elan_probe(struct usb_interface *interface,
        init_MUTEX(&ftdi->sw_lock);
        ftdi->udev = usb_get_dev(interface_to_usbdev(interface));
        ftdi->interface = interface;
-        init_MUTEX(&ftdi->u132_lock);
+        mutex_init(&ftdi->u132_lock);
        ftdi->expected = 4;
        iface_desc = interface->cur_altsetting;
        for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c
index e6fd024024..4bcf7fb4e5 100644
--- a/drivers/usb/misc/idmouse.c
+++ b/drivers/usb/misc/idmouse.c
@@ -66,6 +66,7 @@ static struct usb_device_id idmouse_table[] = {
        USB_TYPE_VENDOR | USB_RECIP_ENDPOINT | USB_DIR_OUT, value, index, NULL, 0, 1000)
 MODULE_DEVICE_TABLE(usb, idmouse_table);
+static DEFINE_MUTEX(open_disc_mutex);
 /* structure to hold all of our device specific stuff */
 struct usb_idmouse {
@@ -80,7 +81,7 @@ struct usb_idmouse {
        int open; /* if the port is open or not */
        int present; /* if the device is not disconnected */
-        struct semaphore sem; /* locks this structure */
+        struct mutex lock; /* locks this structure */
 };
@@ -213,13 +214,17 @@ static int idmouse_open(struct inode *inode, struct file *file)
        if (!interface)
                return -ENODEV;
+        mutex_lock(&open_disc_mutex);
        /* get the device information block from the interface */
        dev = usb_get_intfdata(interface);
-        if (!dev)
+        if (!dev) {
+                mutex_unlock(&open_disc_mutex);
                return -ENODEV;
+        }
        /* lock this device */
-        down(&dev->sem);
+        mutex_lock(&dev->lock);
+        mutex_unlock(&open_disc_mutex);
        /* check if already open */
        if (dev->open) {
@@ -245,7 +250,7 @@ static int idmouse_open(struct inode *inode, struct file *file)
 error:
        /* unlock this device */
-        up(&dev->sem);
+        mutex_unlock(&dev->lock);
        return result;
 }
@@ -258,12 +263,14 @@ static int idmouse_release(struct inode *inode, struct file *file)
        if (dev == NULL)
                return -ENODEV;
+        mutex_lock(&open_disc_mutex);
        /* lock our device */
-        down(&dev->sem);
+        mutex_lock(&dev->lock);
        /* are we really open? */
        if (dev->open <= 0) {
-                up(&dev->sem);
+                mutex_unlock(&dev->lock);
+                mutex_unlock(&open_disc_mutex);
                return -ENODEV;
        }
@@ -271,10 +278,12 @@ static int idmouse_release(struct inode *inode, struct file *file)
        if (!dev->present) {
                /* the device was unplugged before the file was released */
-                up(&dev->sem);
+                mutex_unlock(&dev->lock);
+                mutex_unlock(&open_disc_mutex);
                idmouse_delete(dev);
        } else {
-                up(&dev->sem);
+                mutex_unlock(&dev->lock);
+                mutex_unlock(&open_disc_mutex);
        }
        return 0;
 }
@@ -286,18 +295,18 @@ static ssize_t idmouse_read(struct file *file, char __user *buffer, size_t count
        int result;
        /* lock this object */
-        down(&dev->sem);
+        mutex_lock(&dev->lock);
        /* verify that the device wasn't unplugged */
        if (!dev->present) {
-                up(&dev->sem);
+                mutex_unlock(&dev->lock);
                return -ENODEV;
        }
        result = simple_read_from_buffer(buffer, count, ppos,
                                        dev->bulk_in_buffer, IMGSIZE);
        /* unlock the device */
-        up(&dev->sem);
+        mutex_unlock(&dev->lock);
        return result;
 }
@@ -320,7 +329,7 @@ static int idmouse_probe(struct usb_interface *interface,
        if (dev == NULL)
                return -ENOMEM;
-        init_MUTEX(&dev->sem);
+        mutex_init(&dev->lock);
        dev->udev = udev;
        dev->interface = interface;
@@ -372,24 +381,26 @@ static void idmouse_disconnect(struct usb_interface *interface)
        /* get device structure */
        dev = usb_get_intfdata(interface);
-        usb_set_intfdata(interface, NULL);
        /* give back our minor */
        usb_deregister_dev(interface, &idmouse_class);
-        /* lock it */
+        mutex_lock(&open_disc_mutex);
-        down(&dev->sem);
+        usb_set_intfdata(interface, NULL);
+        /* lock the device */
+        mutex_lock(&dev->lock);
+        mutex_unlock(&open_disc_mutex);
        /* prevent device read, write and ioctl */
        dev->present = 0;
        /* if the device is opened, idmouse_release will clean this up */
        if (!dev->open) {
-                up(&dev->sem);
+                mutex_unlock(&dev->lock);
                idmouse_delete(dev);
        } else {
                /* unlock */
-                up(&dev->sem);
+                mutex_unlock(&dev->lock);
        }
        info("%s disconnected", DRIVER_DESC);
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index d372fbc4ef..764696ff1e 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -66,6 +66,7 @@ module_param(debug, bool, 0644);
 MODULE_PARM_DESC(debug, "debug=1 enables debugging messages");
 static struct usb_driver iowarrior_driver;
+static DEFINE_MUTEX(iowarrior_open_disc_lock);
 /*--------------*/
 /*     data     */
@@ -351,7 +352,7 @@ static ssize_t iowarrior_write(struct file *file,
        mutex_lock(&dev->mutex);
        /* verify that the device wasn't unplugged */
-        if (dev == NULL || !dev->present) {
+        if (!dev->present) {
                retval = -ENODEV;
                goto exit;
        }
@@ -608,11 +609,15 @@ static int iowarrior_open(struct inode *inode, struct file *file)
                return -ENODEV;
        }
+        mutex_lock(&iowarrior_open_disc_lock);
        dev = usb_get_intfdata(interface);
-        if (!dev)
+        if (!dev) {
+                mutex_unlock(&iowarrior_open_disc_lock);
                return -ENODEV;
+        }
        mutex_lock(&dev->mutex);
+        mutex_unlock(&iowarrior_open_disc_lock);
        /* Only one process can open each device, no sharing. */
        if (dev->opened) {
@@ -866,6 +871,7 @@ static void iowarrior_disconnect(struct usb_interface *interface)
        int minor;
        dev = usb_get_intfdata(interface);
+        mutex_lock(&iowarrior_open_disc_lock);
        usb_set_intfdata(interface, NULL);
        minor = dev->minor;
@@ -879,6 +885,7 @@ static void iowarrior_disconnect(struct usb_interface *interface)
        dev->present = 0;
        mutex_unlock(&dev->mutex);
+        mutex_unlock(&iowarrior_open_disc_lock);
        if (dev->opened) {
                /* There is a process that holds a filedescriptor to the device ,
diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
index 561970b889..aab320085e 100644
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -198,6 +198,7 @@ static struct usb_device_id tower_table [] = {
 };
 MODULE_DEVICE_TABLE (usb, tower_table);
+static DEFINE_MUTEX(open_disc_mutex);
 #define LEGO_USB_TOWER_MINOR_BASE       160
@@ -350,25 +351,31 @@ static int tower_open (struct inode *inode, struct file *file)
                goto exit;
        }
+        mutex_lock(&open_disc_mutex);
        dev = usb_get_intfdata(interface);
        if (!dev) {
+                mutex_unlock(&open_disc_mutex);
                retval = -ENODEV;
                goto exit;
        }
        /* lock this device */
        if (down_interruptible (&dev->sem)) {
+                mutex_unlock(&open_disc_mutex);
                retval = -ERESTARTSYS;
                goto exit;
        }
        /* allow opening only once */
        if (dev->open_count) {
+                mutex_unlock(&open_disc_mutex);
                retval = -EBUSY;
                goto unlock_exit;
        }
        dev->open_count = 1;
+        mutex_unlock(&open_disc_mutex);
        /* reset the tower */
        result = usb_control_msg (dev->udev,
@@ -437,9 +444,10 @@ static int tower_release (struct inode *inode, struct file *file)
        if (dev == NULL) {
                dbg(1, "%s: object is NULL", __FUNCTION__);
                retval = -ENODEV;
-                goto exit;
+                goto exit_nolock;
        }
+        mutex_lock(&open_disc_mutex);
        if (down_interruptible (&dev->sem)) {
                retval = -ERESTARTSYS;
                goto exit;
@@ -468,6 +476,8 @@ unlock_exit:
        up (&dev->sem);
 exit:
+        mutex_unlock(&open_disc_mutex);
+exit_nolock:
        dbg(2, "%s: leave, return value %d", __FUNCTION__, retval);
        return retval;
 }
@@ -989,6 +999,7 @@ static void tower_disconnect (struct usb_interface *interface)
        dbg(2, "%s: enter", __FUNCTION__);
        dev = usb_get_intfdata (interface);
+        mutex_lock(&open_disc_mutex);
        usb_set_intfdata (interface, NULL);
        minor = dev->minor;
@@ -997,6 +1008,7 @@ static void tower_disconnect (struct usb_interface *interface)
        usb_deregister_dev (interface, &tower_class);
        down (&dev->sem);
+        mutex_unlock(&open_disc_mutex);
        /* if the device is not opened, then we clean up right now */
        if (!dev->open_count) {
diff --git a/drivers/usb/misc/rio500.c b/drivers/usb/misc/rio500.c
index 88f6abe736..330c18e390 100644
--- a/drivers/usb/misc/rio500.c
+++ b/drivers/usb/misc/rio500.c
@@ -118,10 +118,7 @@ ioctl_rio(struct inode *inode, struct file *file, unsigned int cmd,
        mutex_lock(&(rio->lock));
        /* Sanity check to make sure rio is connected, powered, etc */
-        if ( rio == NULL ||
+        if (rio->present == 0 || rio->rio_dev == NULL) {
-             rio->present == 0 ||
-             rio->rio_dev == NULL )
-        {
                retval = -ENODEV;
                goto err_out;
        }
@@ -280,10 +277,7 @@ write_rio(struct file *file, const char __user *buffer,
        if (intr)
                return -EINTR;
        /* Sanity check to make sure rio is connected, powered, etc */
-        if ( rio == NULL ||
+        if (rio->present == 0 || rio->rio_dev == NULL) {
-             rio->present == 0 ||
-             rio->rio_dev == NULL )
-        {
                mutex_unlock(&(rio->lock));
                return -ENODEV;
        }
@@ -369,10 +363,7 @@ read_rio(struct file *file, char __user *buffer, size_t count, loff_t * ppos)
        if (intr)
                return -EINTR;
        /* Sanity check to make sure rio is connected, powered, etc */
-        if ( rio == NULL ||
+        if (rio->present == 0 || rio->rio_dev == NULL) {
-             rio->present == 0 ||
-             rio->rio_dev == NULL )
-        {
                mutex_unlock(&(rio->lock));
                return -ENODEV;
        }
diff --git a/drivers/usb/misc/usblcd.c b/drivers/usb/misc/usblcd.c
index 7198420327..20777d01db 100644
--- a/drivers/usb/misc/usblcd.c
+++ b/drivers/usb/misc/usblcd.c
@@ -17,6 +17,7 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/errno.h>
+#include <linux/mutex.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
@@ -34,6 +35,8 @@ static struct usb_device_id id_table [] = {
 };
 MODULE_DEVICE_TABLE (usb, id_table);
+static DEFINE_MUTEX(open_disc_mutex);
 struct usb_lcd {
        struct usb_device *     udev;                   /* init: probe_lcd */
@@ -79,12 +82,16 @@ static int lcd_open(struct inode *inode, struct file *file)
                return -ENODEV;
        }
+        mutex_lock(&open_disc_mutex);
        dev = usb_get_intfdata(interface);
-        if (!dev)
+        if (!dev) {
+                mutex_unlock(&open_disc_mutex);
                return -ENODEV;
+        }
        /* increment our usage count for the device */
        kref_get(&dev->kref);
+        mutex_unlock(&open_disc_mutex);
        /* grab a power reference */
        r = usb_autopm_get_interface(interface);
@@ -393,8 +400,10 @@ static void lcd_disconnect(struct usb_interface *interface)
        struct usb_lcd *dev;
        int minor = interface->minor;
+        mutex_lock(&open_disc_mutex);
        dev = usb_get_intfdata(interface);
        usb_set_intfdata(interface, NULL);
+        mutex_unlock(&open_disc_mutex);
        /* give back our minor */
        usb_deregister_dev(interface, &lcd_class);
diff --git a/drivers/usb/serial/ark3116.c b/drivers/usb/serial/ark3116.c
index 2a8e537cb0..ddfee91800 100644
--- a/drivers/usb/serial/ark3116.c
+++ b/drivers/usb/serial/ark3116.c
@@ -161,7 +161,8 @@ static void ark3116_set_termios(struct usb_serial_port *port,
 {
        struct usb_serial *serial = port->serial;
        struct ark3116_private *priv = usb_get_serial_port_data(port);
-        unsigned int cflag = port->tty->termios->c_cflag;
+        struct ktermios *termios = port->tty->termios;
+        unsigned int cflag = termios->c_cflag;
        unsigned long flags;
        int baud;
        int ark3116_baud;
@@ -177,11 +178,14 @@ static void ark3116_set_termios(struct usb_serial_port *port,
                *(port->tty->termios) = tty_std_termios;
                port->tty->termios->c_cflag = B9600 | CS8
                                              | CREAD | HUPCL | CLOCAL;
+                termios->c_ispeed = 9600;
+                termios->c_ospeed = 9600;
                priv->termios_initialized = 1;
        }
        spin_unlock_irqrestore(&priv->lock, flags);
-        cflag = port->tty->termios->c_cflag;
+        cflag = termios->c_cflag;
+        termios->c_cflag &= ~(CMSPAR|CRTSCTS);
        buf = kmalloc(1, GFP_KERNEL);
        if (!buf) {
@@ -254,9 +258,13 @@ static void ark3116_set_termios(struct usb_serial_port *port,
                case 115200:
                case 230400:
                case 460800:
+                        /* Report the resulting rate back to the caller */
+                        tty_encode_baud_rate(port->tty, baud, baud);
                        break;
                /* set 9600 as default (if given baudrate is invalid for example) */
                default:
+                        tty_encode_baud_rate(port->tty, 9600, 9600);
+                case 0:
                        baud = 9600;
        }
@@ -302,6 +310,7 @@ static void ark3116_set_termios(struct usb_serial_port *port,
        /* TEST ARK3116_SND(154, 0xFE, 0x40, 0xFFFF, 0x0006); */
        kfree(buf);
        return;
 }
diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index 6b252ceb39..42582d49b6 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -272,9 +272,6 @@ static void ch341_set_termios(struct usb_serial_port *port,
        dbg("ch341_set_termios()");
-        if (!tty || !tty->termios)
-                return;
        baud_rate = tty_get_baud_rate(tty);
        switch (baud_rate) {
@@ -299,6 +296,11 @@ static void ch341_set_termios(struct usb_serial_port *port,
         * (cflag & PARENB) : parity {NONE, EVEN, ODD}
         * (cflag & CSTOPB) : stop bits [1, 2]
         */
+         /* Copy back the old hardware settings */
+         tty_termios_copy_hw(tty->termios, old_termios);
+         /* And re-encode with the new baud */
+         tty_encode_baud_rate(tty, baud_rate, baud_rate);
 }
 static struct usb_driver ch341_driver = {
diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
index 9386e216d6..0362654d3b 100644
--- a/drivers/usb/serial/console.c
+++ b/drivers/usb/serial/console.c
@@ -164,6 +164,7 @@ static int usb_console_setup(struct console *co, char *options)
        }
        if (serial->type->set_termios) {
+                struct ktermios dummy;
                /* build up a fake tty structure so that the open call has something
                 * to look at to get the cflag value */
                tty = kzalloc(sizeof(*tty), GFP_KERNEL);
@@ -177,12 +178,13 @@ static int usb_console_setup(struct console *co, char *options)
                        kfree (tty);
                        return -ENOMEM;
                }
+                memset(&dummy, 0, sizeof(struct ktermios));
                termios->c_cflag = cflag;
                tty->termios = termios;
                port->tty = tty;
                /* set up the initial termios settings */
-                serial->type->set_termios(port, NULL);
+                serial->type->set_termios(port, &dummy);
                port->tty = NULL;
                kfree (termios);
                kfree (tty);
diff --git a/drivers/usb/serial/cp2101.c b/drivers/usb/serial/cp2101.c
index eb7df1835c..3a83cb4c4b 100644
--- a/drivers/usb/serial/cp2101.c
+++ b/drivers/usb/serial/cp2101.c
@@ -361,7 +361,6 @@ static void cp2101_get_termios (struct usb_serial_port *port)
                dbg("%s - no tty structures", __FUNCTION__);
                return;
        }
-        cflag = port->tty->termios->c_cflag;
        cp2101_get_config(port, CP2101_BAUDRATE, &baud, 2);
        /* Convert to baudrate */
@@ -369,40 +368,9 @@ static void cp2101_get_termios (struct usb_serial_port *port)
                baud = BAUD_RATE_GEN_FREQ / baud;
        dbg("%s - baud rate = %d", __FUNCTION__, baud);
-        cflag &= ~CBAUD;
-        switch (baud) {
+        tty_encode_baud_rate(port->tty, baud, baud);
-                /*
+        cflag = port->tty->termios->c_cflag;
-                 * The baud rates which are commented out below
-                 * appear to be supported by the device
-                 * but are non-standard
-                 */
-                case 600:       cflag |= B600;          break;
-                case 1200:      cflag |= B1200;         break;
-                case 1800:      cflag |= B1800;         break;
-                case 2400:      cflag |= B2400;         break;
-                case 4800:      cflag |= B4800;         break;
-                /*case 7200:    cflag |= B7200;         break;*/
-                case 9600:      cflag |= B9600;         break;
-                /*case 14400:   cflag |= B14400;        break;*/
-                case 19200:     cflag |= B19200;        break;
-                /*case 28800:   cflag |= B28800;        break;*/
-                case 38400:     cflag |= B38400;        break;
-                /*case 55854:   cflag |= B55054;        break;*/
-                case 57600:     cflag |= B57600;        break;
-                case 115200:    cflag |= B115200;       break;
-                /*case 127117:  cflag |= B127117;       break;*/
-                case 230400:    cflag |= B230400;       break;
-                case 460800:    cflag |= B460800;       break;
-                case 921600:    cflag |= B921600;       break;
-                /*case 3686400: cflag |= B3686400;      break;*/
-                default:
-                        dbg("%s - Baud rate is not supported, "
-                                        "using 9600 baud", __FUNCTION__);
-                        cflag |= B9600;
-                        cp2101_set_config_single(port, CP2101_BAUDRATE,
-                                        (BAUD_RATE_GEN_FREQ/9600));
-                        break;
-        }
        cp2101_get_config(port, CP2101_BITS, &bits, 2);
        cflag &= ~CSIZE;
@@ -516,7 +484,7 @@ static void cp2101_get_termios (struct usb_serial_port *port)
 static void cp2101_set_termios (struct usb_serial_port *port,
                struct ktermios *old_termios)
 {
-        unsigned int cflag, old_cflag=0;
+        unsigned int cflag, old_cflag;
        int baud=0, bits;
        unsigned int modem_ctl[4];
@@ -526,6 +494,8 @@ static void cp2101_set_termios (struct usb_serial_port *port,
                dbg("%s - no tty structures", __FUNCTION__);
                return;
        }
+        port->tty->termios->c_cflag &= ~CMSPAR;
        cflag = port->tty->termios->c_cflag;
        old_cflag = old_termios->c_cflag;
        baud = tty_get_baud_rate(port->tty);
@@ -563,11 +533,15 @@ static void cp2101_set_termios (struct usb_serial_port *port,
                        dbg("%s - Setting baud rate to %d baud", __FUNCTION__,
                                        baud);
                        if (cp2101_set_config_single(port, CP2101_BAUDRATE,
-                                                (BAUD_RATE_GEN_FREQ / baud)))
+                                                (BAUD_RATE_GEN_FREQ / baud))) {
                                dev_err(&port->dev, "Baud rate requested not "
                                                "supported by device\n");
+                                baud = tty_termios_baud_rate(old_termios);
+                        }
                }
        }
+        /* Report back the resulting baud rate */
+        tty_encode_baud_rate(port->tty, baud, baud);
        /* If the number of data bits is to be updated */
        if ((cflag & CSIZE) != (old_cflag & CSIZE)) {
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index dab2e66d11..ae410c4678 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -973,6 +973,8 @@ static void digi_set_termios(struct usb_serial_port *port,
                }
        }
        /* set parity */
+        tty->termios->c_cflag &= ~CMSPAR;
        if ((cflag&(PARENB|PARODD)) != (old_cflag&(PARENB|PARODD))) {
                if (cflag&PARENB) {
                        if (cflag&PARODD)
@@ -1054,15 +1056,15 @@ static void digi_set_termios(struct usb_serial_port *port,
        }
        /* set output flow control */
-        if ((iflag&IXON) != (old_iflag&IXON)
+        if ((iflag & IXON) != (old_iflag & IXON)
-            || (cflag&CRTSCTS) != (old_cflag&CRTSCTS)) {
+            || (cflag & CRTSCTS) != (old_cflag & CRTSCTS)) {
                arg = 0;
-                if (iflag&IXON)
+                if (iflag & IXON)
                        arg |= DIGI_OUTPUT_FLOW_CONTROL_XON_XOFF;
                else
                        arg &= ~DIGI_OUTPUT_FLOW_CONTROL_XON_XOFF;
-                if (cflag&CRTSCTS) {
+                if (cflag & CRTSCTS) {
                        arg |= DIGI_OUTPUT_FLOW_CONTROL_CTS;
                } else {
                        arg &= ~DIGI_OUTPUT_FLOW_CONTROL_CTS;
@@ -1076,8 +1078,8 @@ static void digi_set_termios(struct usb_serial_port *port,
        }
        /* set receive enable/disable */
-        if ((cflag&CREAD) != (old_cflag&CREAD)) {
+        if ((cflag & CREAD) != (old_cflag & CREAD)) {
-                if (cflag&CREAD)
+                if (cflag & CREAD)
                        arg = DIGI_ENABLE;
                else
                        arg = DIGI_DISABLE;
@@ -1089,7 +1091,7 @@ static void digi_set_termios(struct usb_serial_port *port,
        }
        if ((ret = digi_write_oob_command(port, buf, i, 1)) != 0)
                dbg("digi_set_termios: write oob failed, ret=%d", ret);
+        tty_encode_baud_rate(tty, baud, baud);
 }
diff --git a/drivers/usb/serial/empeg.c b/drivers/usb/serial/empeg.c
index 050fcc996f..a5c8e1e17e 100644
--- a/drivers/usb/serial/empeg.c
+++ b/drivers/usb/serial/empeg.c
@@ -449,14 +449,9 @@ static int empeg_ioctl (struct usb_serial_port *port, struct file * file, unsign
 static void empeg_set_termios (struct usb_serial_port *port, struct ktermios *old_termios)
 {
+        struct ktermios *termios = port->tty->termios;
        dbg("%s - port %d", __FUNCTION__, port->number);
-        if ((!port->tty) || (!port->tty->termios)) {
-                dbg("%s - no tty structures", __FUNCTION__);
-                return;
-        }
        /*
         * The empeg-car player wants these particular tty settings.
         * You could, for example, change the baud rate, however the
@@ -466,7 +461,7 @@ static void empeg_set_termios (struct usb_serial_port *port, struct ktermios *ol
         *
         * The default requirements for this device are:
         */
-        port->tty->termios->c_iflag
+        termios->c_iflag
                &= ~(IGNBRK     /* disable ignore break */
                | BRKINT        /* disable break causes interrupt */
                | PARMRK        /* disable mark parity errors */
@@ -476,24 +471,23 @@ static void empeg_set_termios (struct usb_serial_port *port, struct ktermios *ol
                | ICRNL         /* disable translate CR to NL */
                | IXON);        /* disable enable XON/XOFF flow control */
-        port->tty->termios->c_oflag
+        termios->c_oflag
                &= ~OPOST;      /* disable postprocess output characters */
-        port->tty->termios->c_lflag
+        termios->c_lflag
                &= ~(ECHO       /* disable echo input characters */
                | ECHONL        /* disable echo new line */
                | ICANON        /* disable erase, kill, werase, and rprnt special characters */
                | ISIG          /* disable interrupt, quit, and suspend special characters */
                | IEXTEN);      /* disable non-POSIX special characters */
-        port->tty->termios->c_cflag
+        termios->c_cflag
                &= ~(CSIZE      /* no size */
                | PARENB        /* disable parity bit */
                | CBAUD);       /* clear current baud rate */
-        port->tty->termios->c_cflag
+        termios->c_cflag
-                |= (CS8         /* character size 8 bits */
+                |= CS8;         /* character size 8 bits */
-                | B115200);     /* baud rate 115200 */
        /*
         * Force low_latency on; otherwise the pushes are scheduled;
@@ -501,8 +495,7 @@ static void empeg_set_termios (struct usb_serial_port *port, struct ktermios *ol
         * on the floor.  We don't want to drop bytes on the floor. :)
         */
        port->tty->low_latency = 1;
+        tty_encode_baud_rate(port->tty, 115200, 115200);
-        return;
 }
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 8a8a6b9fb0..c40e77dccf 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -294,7 +294,7 @@ struct ftdi_private {
        __u16 interface;        /* FT2232C port interface (0 for FT232/245) */
-        int force_baud;         /* if non-zero, force the baud rate to this value */
+        speed_t force_baud;     /* if non-zero, force the baud rate to this value */
        int force_rtscts;       /* if non-zero, force RTS-CTS to always be enabled */
        spinlock_t tx_lock;     /* spinlock for transmit state */
@@ -878,6 +878,7 @@ static __u32 get_ftdi_divisor(struct usb_serial_port * port)
                if (div_value == 0) {
                        dbg("%s - Baudrate (%d) requested is not supported", __FUNCTION__,  baud);
                        div_value = ftdi_sio_b9600;
+                        baud = 9600;
                        div_okay = 0;
                }
                break;
@@ -886,6 +887,7 @@ static __u32 get_ftdi_divisor(struct usb_serial_port * port)
                        div_value = ftdi_232am_baud_to_divisor(baud);
                } else {
                        dbg("%s - Baud rate too high!", __FUNCTION__);
+                        baud = 9600;
                        div_value = ftdi_232am_baud_to_divisor(9600);
                        div_okay = 0;
                }
@@ -899,6 +901,7 @@ static __u32 get_ftdi_divisor(struct usb_serial_port * port)
                        dbg("%s - Baud rate too high!", __FUNCTION__);
                        div_value = ftdi_232bm_baud_to_divisor(9600);
                        div_okay = 0;
+                        baud = 9600;
                }
                break;
        } /* priv->chip_type */
@@ -909,6 +912,7 @@ static __u32 get_ftdi_divisor(struct usb_serial_port * port)
                        ftdi_chip_name[priv->chip_type]);
        }
+        tty_encode_baud_rate(port->tty, baud, baud);
        return(div_value);
 }
@@ -1263,7 +1267,7 @@ static void ftdi_USB_UIRT_setup (struct ftdi_private *priv)
        priv->flags |= ASYNC_SPD_CUST;
        priv->custom_divisor = 77;
-        priv->force_baud = B38400;
+        priv->force_baud = 38400;
 } /* ftdi_USB_UIRT_setup */
 /* Setup for the HE-TIRA1 device, which requires hardwired
@@ -1274,7 +1278,7 @@ static void ftdi_HE_TIRA1_setup (struct ftdi_private *priv)
        priv->flags |= ASYNC_SPD_CUST;
        priv->custom_divisor = 240;
-        priv->force_baud = B38400;
+        priv->force_baud = 38400;
        priv->force_rtscts = 1;
 } /* ftdi_HE_TIRA1_setup */
@@ -1363,7 +1367,7 @@ static int  ftdi_open (struct usb_serial_port *port, struct file *filp)
        /* ftdi_set_termios  will send usb control messages */
        if (port->tty)
-                ftdi_set_termios(port, NULL);
+                ftdi_set_termios(port, port->tty->termios);
        /* FIXME: Flow control might be enabled, so it should be checked -
           we have no control of defaults! */
@@ -1933,32 +1937,33 @@ static void ftdi_break_ctl( struct usb_serial_port *port, int break_state )
 static void ftdi_set_termios (struct usb_serial_port *port, struct ktermios *old_termios)
 { /* ftdi_termios */
        struct usb_device *dev = port->serial->dev;
-        unsigned int cflag = port->tty->termios->c_cflag;
        struct ftdi_private *priv = usb_get_serial_port_data(port);
+        struct ktermios *termios = port->tty->termios;
+        unsigned int cflag = termios->c_cflag;
        __u16 urb_value; /* will hold the new flags */
        char buf[1]; /* Perhaps I should dynamically alloc this? */
        // Added for xon/xoff support
-        unsigned int iflag = port->tty->termios->c_iflag;
+        unsigned int iflag = termios->c_iflag;
        unsigned char vstop;
        unsigned char vstart;
        dbg("%s", __FUNCTION__);
        /* Force baud rate if this device requires it, unless it is set to B0. */
-        if (priv->force_baud && ((port->tty->termios->c_cflag & CBAUD) != B0)) {
+        if (priv->force_baud && ((termios->c_cflag & CBAUD) != B0)) {
                dbg("%s: forcing baud rate for this device", __FUNCTION__);
-                port->tty->termios->c_cflag &= ~CBAUD;
+                tty_encode_baud_rate(port->tty, priv->force_baud,
-                port->tty->termios->c_cflag |= priv->force_baud;
+                                        priv->force_baud);
        }
        /* Force RTS-CTS if this device requires it. */
        if (priv->force_rtscts) {
                dbg("%s: forcing rtscts for this device", __FUNCTION__);
-                port->tty->termios->c_cflag |= CRTSCTS;
+                termios->c_cflag |= CRTSCTS;
        }
-        cflag = port->tty->termios->c_cflag;
+        cflag = termios->c_cflag;
        /* FIXME -For this cut I don't care if the line is really changing or
           not  - so just do the change regardless  - should be able to
@@ -1969,6 +1974,8 @@ static void ftdi_set_termios (struct usb_serial_port *port, struct ktermios *old
        /* Set number of data bits, parity, stop bits */
+        termios->c_cflag &= ~CMSPAR;
        urb_value = 0;
        urb_value |= (cflag & CSTOPB ? FTDI_SIO_SET_DATA_STOP_BITS_2 :
                      FTDI_SIO_SET_DATA_STOP_BITS_1);
@@ -2048,8 +2055,8 @@ static void ftdi_set_termios (struct usb_serial_port *port, struct ktermios *old
                        // Set the vstart and vstop -- could have been done up above where
                        // a lot of other dereferencing is done but that would be very
                        // inefficient as vstart and vstop are not always needed
-                        vstart=port->tty->termios->c_cc[VSTART];
+                        vstart = termios->c_cc[VSTART];
-                        vstop=port->tty->termios->c_cc[VSTOP];
+                        vstop = termios->c_cc[VSTOP];
                        urb_value=(vstop << 8) | (vstart);
                        if (usb_control_msg(dev,
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index 88a2c7dce3..9eb4a65ee4 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -208,14 +208,15 @@ int usb_serial_generic_write(struct usb_serial_port *port, const unsigned char *
        /* only do something if we have a bulk out endpoint */
        if (serial->num_bulk_out) {
-                spin_lock_bh(&port->lock);
+                unsigned long flags;
+                spin_lock_irqsave(&port->lock, flags);
                if (port->write_urb_busy) {
-                        spin_unlock_bh(&port->lock);
+                        spin_unlock_irqrestore(&port->lock, flags);
                        dbg("%s - already writing", __FUNCTION__);
                        return 0;
                }
                port->write_urb_busy = 1;
-                spin_unlock_bh(&port->lock);
+                spin_unlock_irqrestore(&port->lock, flags);
                count = (count > port->bulk_out_size) ? port->bulk_out_size : count;
diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index 8dd3abc99d..a5d2e115e1 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -1503,22 +1503,16 @@ static void edge_unthrottle (struct usb_serial_port *port)
 *****************************************************************************/
 static void edge_set_termios (struct usb_serial_port *port, struct ktermios *old_termios)
 {
+        /* FIXME: This function appears unused ?? */
        struct edgeport_port *edge_port = usb_get_serial_port_data(port);
        struct tty_struct *tty = port->tty;
        unsigned int cflag;
-        if (!port->tty || !port->tty->termios) {
-                dbg ("%s - no tty or termios", __FUNCTION__);
-                return;
-        }
        cflag = tty->termios->c_cflag;
        dbg("%s - clfag %08x iflag %08x", __FUNCTION__, 
            tty->termios->c_cflag, tty->termios->c_iflag);
-        if (old_termios) {
+        dbg("%s - old clfag %08x old iflag %08x", __FUNCTION__,
-                dbg("%s - old clfag %08x old iflag %08x", __FUNCTION__,
+            old_termios->c_cflag, old_termios->c_iflag);
-                    old_termios->c_cflag, old_termios->c_iflag);
-        }
        dbg("%s - port %d", __FUNCTION__, port->number);
@@ -2653,7 +2647,11 @@ static void change_port_settings (struct edgeport_port *edge_port, struct ktermi
        dbg("%s - baud rate = %d", __FUNCTION__, baud);
        status = send_cmd_write_baud_rate (edge_port, baud);
+        if (status == -1) {
+                /* Speed change was not possible - put back the old speed */
+                baud = tty_termios_baud_rate(old_termios);
+                tty_encode_baud_rate(tty, baud, baud);
+        }
        return;
 }
diff --git a/drivers/usb/serial/ir-usb.c b/drivers/usb/serial/ir-usb.c
index 5ab6a0c5ac..6b803ab985 100644
--- a/drivers/usb/serial/ir-usb.c
+++ b/drivers/usb/serial/ir-usb.c
@@ -504,11 +504,6 @@ static void ir_set_termios (struct usb_serial_port *port, struct ktermios *old_t
        dbg("%s - port %d", __FUNCTION__, port->number);
-        if ((!port->tty) || (!port->tty->termios)) {
-                dbg("%s - no tty structures", __FUNCTION__);
-                return;
-        }
        baud = tty_get_baud_rate(port->tty);
        /*
@@ -531,8 +526,6 @@ static void ir_set_termios (struct usb_serial_port *port, struct ktermios *old_t
                default:
                        ir_baud = SPEED_9600;
                        baud = 9600;
-                        /* And once the new tty stuff is all done we need to
-                           call back to correct the baud bits */
        }
        if (xbof == -1)
@@ -562,6 +555,10 @@ static void ir_set_termios (struct usb_serial_port *port, struct ktermios *old_t
        result = usb_submit_urb (port->write_urb, GFP_KERNEL);
        if (result)
                dev_err(&port->dev, "%s - failed submitting write urb, error %d\n", __FUNCTION__, result);
+        /* Only speed changes are supported */
+        tty_termios_copy_hw(port->tty->termios, old_termios);
+        tty_encode_baud_rate(port->tty, baud, baud);
 }
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index f2a6fce5de..6bfdba6a21 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -278,29 +278,35 @@ static void keyspan_set_termios (struct usb_serial_port *port,
        struct keyspan_port_private     *p_priv;
        const struct keyspan_device_details     *d_details;
        unsigned int                    cflag;
+        struct tty_struct               *tty = port->tty;
        dbg("%s", __FUNCTION__); 
        p_priv = usb_get_serial_port_data(port);
        d_details = p_priv->device_details;
-        cflag = port->tty->termios->c_cflag;
+        cflag = tty->termios->c_cflag;
        device_port = port->number - port->serial->minor;
        /* Baud rate calculation takes baud rate as an integer
           so other rates can be generated if desired. */
-        baud_rate = tty_get_baud_rate(port->tty);
+        baud_rate = tty_get_baud_rate(tty);
        /* If no match or invalid, don't change */              
-        if (baud_rate >= 0
+        if (d_details->calculate_baud_rate(baud_rate, d_details->baudclk,
-            && d_details->calculate_baud_rate(baud_rate, d_details->baudclk,
                                NULL, NULL, NULL, device_port) == KEYSPAN_BAUD_RATE_OK) {
                /* FIXME - more to do here to ensure rate changes cleanly */
+                /* FIXME - calcuate exact rate from divisor ? */
                p_priv->baud = baud_rate;
-        }
+        } else
+                baud_rate = tty_termios_baud_rate(old_termios);
+        tty_encode_baud_rate(tty, baud_rate, baud_rate);
        /* set CTS/RTS handshake etc. */
        p_priv->cflag = cflag;
        p_priv->flow_control = (cflag & CRTSCTS)? flow_cts: flow_none;
+        /* Mark/Space not supported */
+        tty->termios->c_cflag &= ~CMSPAR;
        keyspan_send_setup(port, 0);
 }
diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
index 6f224195bd..aee450246b 100644
--- a/drivers/usb/serial/kobil_sct.c
+++ b/drivers/usb/serial/kobil_sct.c
@@ -616,8 +616,9 @@ static void kobil_set_termios(struct usb_serial_port *port, struct ktermios *old
                case 1200:
                        urb_val = SUSBCR_SBR_1200;
                        break;
-                case 9600:
                default:
+                        speed = 9600;
+                case 9600:
                        urb_val = SUSBCR_SBR_9600;
                        break;
        }
@@ -641,6 +642,8 @@ static void kobil_set_termios(struct usb_serial_port *port, struct ktermios *old
                urb_val |= SUSBCR_SPASB_NoParity;
                strcat(settings, "No Parity");
        }
+        port->tty->termios->c_cflag &= ~CMSPAR;
+        tty_encode_baud_rate(port->tty, speed, speed);
        result = usb_control_msg( port->serial->dev,
                                  usb_rcvctrlpipe(port->serial->dev, 0 ),
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index f76480f145..a5ced7e08c 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -1977,11 +1977,6 @@ static void mos7840_change_port_settings(struct moschip_port *mos7840_port,
        tty = mos7840_port->port->tty;
-        if ((!tty) || (!tty->termios)) {
-                dbg("%s - no tty structures", __FUNCTION__);
-                return;
-        }
        dbg("%s", "Entering .......... \n");
        lData = LCR_BITS_8;
@@ -2151,11 +2146,6 @@ static void mos7840_set_termios(struct usb_serial_port *port,
        tty = port->tty;
-        if (!port->tty || !port->tty->termios) {
-                dbg("%s - no tty or termios", __FUNCTION__);
-                return;
-        }
        if (!mos7840_port->open) {
                dbg("%s - port not opened", __FUNCTION__);
                return;
@@ -2165,19 +2155,10 @@ static void mos7840_set_termios(struct usb_serial_port *port,
        cflag = tty->termios->c_cflag;
-        if (!cflag) {
-                dbg("%s %s\n", __FUNCTION__, "cflag is NULL");
-                return;
-        }
        dbg("%s - clfag %08x iflag %08x", __FUNCTION__,
            tty->termios->c_cflag, RELEVANT_IFLAG(tty->termios->c_iflag));
+        dbg("%s - old clfag %08x old iflag %08x", __FUNCTION__,
-        if (old_termios) {
+            old_termios->c_cflag, RELEVANT_IFLAG(old_termios->c_iflag));
-                dbg("%s - old clfag %08x old iflag %08x", __FUNCTION__,
-                    old_termios->c_cflag, RELEVANT_IFLAG(old_termios->c_iflag));
-        }
        dbg("%s - port %d", __FUNCTION__, port->number);
        /* change the port settings to the new ones specified */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index a18659e070..4590124cf8 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -172,6 +172,8 @@ static struct usb_device_id option_ids[] = {
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x2110) }, /* Novatel Merlin ES620 / Merlin ES720 / Ovation U720 */
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x2130) }, /* Novatel Merlin ES620 SM Bus */
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x2410) }, /* Novatel EU740 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x4100) }, /* Novatel U727 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x4400) }, /* Novatel MC950 */
        { USB_DEVICE(DELL_VENDOR_ID, 0x8114) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite EV620 CDMA/EV-DO */
        { USB_DEVICE(DELL_VENDOR_ID, 0x8115) }, /* Dell Wireless 5500 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
        { USB_DEVICE(DELL_VENDOR_ID, 0x8116) }, /* Dell Wireless 5505 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
@@ -311,7 +313,8 @@ static void option_set_termios(struct usb_serial_port *port,
                        struct ktermios *old_termios)
 {
        dbg("%s", __FUNCTION__);
+        /* Doesn't support option setting */
+        tty_termios_copy_hw(port->tty->termios, old_termios);
        option_send_setup(port);
 }
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 1da57fd9ea..2cd3f1d4b6 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -56,6 +56,7 @@ static struct usb_device_id id_table [] = {
        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_RSAQ3) },
        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_PHAROS) },
        { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
+        { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
        { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
        { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) },
        { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) },
@@ -470,16 +471,13 @@ static void pl2303_set_termios(struct usb_serial_port *port,
        dbg("%s -  port %d", __FUNCTION__, port->number);
-        if ((!port->tty) || (!port->tty->termios)) {
-                dbg("%s - no tty structures", __FUNCTION__);
-                return;
-        }
        spin_lock_irqsave(&priv->lock, flags);
        if (!priv->termios_initialized) {
                *(port->tty->termios) = tty_std_termios;
                port->tty->termios->c_cflag = B9600 | CS8 | CREAD |
                                              HUPCL | CLOCAL;
+                port->tty->termios->c_ispeed = 9600;
+                port->tty->termios->c_ospeed = 9600;
                priv->termios_initialized = 1;
        }
        spin_unlock_irqrestore(&priv->lock, flags);
@@ -596,6 +594,10 @@ static void pl2303_set_termios(struct usb_serial_port *port,
                dbg ("0x40:0x1:0x0:0x0  %d", i);
        }
+        /* FIXME: Need to read back resulting baud rate */
+        if (baud)
+                tty_encode_baud_rate(port->tty, baud, baud);
        kfree(buf);
 }
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index c39bace5cb..ed603e3dec 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -20,6 +20,7 @@
 #define IODATA_VENDOR_ID        0x04bb
 #define IODATA_PRODUCT_ID       0x0a03
+#define IODATA_PRODUCT_ID_RSAQ5 0x0a0e
 #define ELCOM_VENDOR_ID         0x056e
 #define ELCOM_PRODUCT_ID        0x5003
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index 959b3e4e90..833f6e1e37 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -224,7 +224,7 @@ static void sierra_set_termios(struct usb_serial_port *port,
                        struct ktermios *old_termios)
 {
        dbg("%s", __FUNCTION__);
+        tty_termios_copy_hw(port->tty->termios, old_termios);
        sierra_send_setup(port);
 }
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 4b1bd7def4..497e29a700 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -429,6 +429,8 @@ static void serial_set_termios (struct tty_struct *tty, struct ktermios * old)
        /* pass on to the driver specific version of this function if it is available */
        if (port->serial->type->set_termios)
                port->serial->type->set_termios(port, old);
+        else
+                tty_termios_copy_hw(tty->termios, old);
 }
 static void serial_break (struct tty_struct *tty, int break_state)
@@ -1121,7 +1123,9 @@ int usb_serial_resume(struct usb_interface *intf)
 {
        struct usb_serial *serial = usb_get_intfdata(intf);
-        return serial->type->resume(serial);
+        if (serial->type->resume)
+                return serial->type->resume(serial);
+        return 0;
 }
 EXPORT_SYMBOL(usb_serial_resume);
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index cc8b44c087..ee5dd8b5a7 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -885,16 +885,7 @@ static int whiteheat_ioctl (struct usb_serial_port *port, struct file * file, un
 static void whiteheat_set_termios(struct usb_serial_port *port, struct ktermios *old_termios)
 {
        dbg("%s -port %d", __FUNCTION__, port->number);
-        if ((!port->tty) || (!port->tty->termios)) {
-                dbg("%s - no tty structures", __FUNCTION__);
-                goto exit;
-        }
-        
        firm_setup_port(port);
-exit:
-        return;
 }
@@ -1244,6 +1235,8 @@ static int firm_setup_port(struct usb_serial_port *port) {
        port_settings.baud = tty_get_baud_rate(port->tty);
        dbg("%s - baud rate = %d", __FUNCTION__, port_settings.baud);
+        /* fixme: should set validated settings */
+        tty_encode_baud_rate(port->tty, port_settings.baud, port_settings.baud);
        /* handle any settings that aren't specified in the tty structure */
        port_settings.lloop = 0;
        
diff --git a/drivers/usb/storage/Kconfig b/drivers/usb/storage/Kconfig
index fe2c4cd53f..7e53333be0 100644
--- a/drivers/usb/storage/Kconfig
+++ b/drivers/usb/storage/Kconfig
@@ -48,7 +48,6 @@ config USB_STORAGE_FREECOM
 config USB_STORAGE_ISD200
        bool "ISD-200 USB/ATA Bridge support"
        depends on USB_STORAGE
-        depends on BLK_DEV_IDE=y || BLK_DEV_IDE=USB_STORAGE
        ---help---
          Say Y here if you want to use USB Mass Store devices based
          on the In-Systems Design ISD-200 USB/ATA bridge.
diff --git a/drivers/usb/storage/isd200.c b/drivers/usb/storage/isd200.c
index 93a7724e16..49ba6c0ff1 100644
--- a/drivers/usb/storage/isd200.c
+++ b/drivers/usb/storage/isd200.c
@@ -977,6 +977,109 @@ static int isd200_manual_enum(struct us_data *us)
        return(retStatus);
 }
+/*
+ *      We are the last non IDE user of the legacy IDE ident structures
+ *      and we thus want to keep a private copy of this function so the
+ *      driver can be used without the obsolete drivers/ide layer
+ */
+static void isd200_fix_driveid (struct hd_driveid *id)
+{
+#ifndef __LITTLE_ENDIAN
+# ifdef __BIG_ENDIAN
+        int i;
+        u16 *stringcast;
+        id->config         = __le16_to_cpu(id->config);
+        id->cyls           = __le16_to_cpu(id->cyls);
+        id->reserved2      = __le16_to_cpu(id->reserved2);
+        id->heads          = __le16_to_cpu(id->heads);
+        id->track_bytes    = __le16_to_cpu(id->track_bytes);
+        id->sector_bytes   = __le16_to_cpu(id->sector_bytes);
+        id->sectors        = __le16_to_cpu(id->sectors);
+        id->vendor0        = __le16_to_cpu(id->vendor0);
+        id->vendor1        = __le16_to_cpu(id->vendor1);
+        id->vendor2        = __le16_to_cpu(id->vendor2);
+        stringcast = (u16 *)&id->serial_no[0];
+        for (i = 0; i < (20/2); i++)
+                stringcast[i] = __le16_to_cpu(stringcast[i]);
+        id->buf_type       = __le16_to_cpu(id->buf_type);
+        id->buf_size       = __le16_to_cpu(id->buf_size);
+        id->ecc_bytes      = __le16_to_cpu(id->ecc_bytes);
+        stringcast = (u16 *)&id->fw_rev[0];
+        for (i = 0; i < (8/2); i++)
+                stringcast[i] = __le16_to_cpu(stringcast[i]);
+        stringcast = (u16 *)&id->model[0];
+        for (i = 0; i < (40/2); i++)
+                stringcast[i] = __le16_to_cpu(stringcast[i]);
+        id->dword_io       = __le16_to_cpu(id->dword_io);
+        id->reserved50     = __le16_to_cpu(id->reserved50);
+        id->field_valid    = __le16_to_cpu(id->field_valid);
+        id->cur_cyls       = __le16_to_cpu(id->cur_cyls);
+        id->cur_heads      = __le16_to_cpu(id->cur_heads);
+        id->cur_sectors    = __le16_to_cpu(id->cur_sectors);
+        id->cur_capacity0  = __le16_to_cpu(id->cur_capacity0);
+        id->cur_capacity1  = __le16_to_cpu(id->cur_capacity1);
+        id->lba_capacity   = __le32_to_cpu(id->lba_capacity);
+        id->dma_1word      = __le16_to_cpu(id->dma_1word);
+        id->dma_mword      = __le16_to_cpu(id->dma_mword);
+        id->eide_pio_modes = __le16_to_cpu(id->eide_pio_modes);
+        id->eide_dma_min   = __le16_to_cpu(id->eide_dma_min);
+        id->eide_dma_time  = __le16_to_cpu(id->eide_dma_time);
+        id->eide_pio       = __le16_to_cpu(id->eide_pio);
+        id->eide_pio_iordy = __le16_to_cpu(id->eide_pio_iordy);
+        for (i = 0; i < 2; ++i)
+                id->words69_70[i] = __le16_to_cpu(id->words69_70[i]);
+        for (i = 0; i < 4; ++i)
+                id->words71_74[i] = __le16_to_cpu(id->words71_74[i]);
+        id->queue_depth    = __le16_to_cpu(id->queue_depth);
+        for (i = 0; i < 4; ++i)
+                id->words76_79[i] = __le16_to_cpu(id->words76_79[i]);
+        id->major_rev_num  = __le16_to_cpu(id->major_rev_num);
+        id->minor_rev_num  = __le16_to_cpu(id->minor_rev_num);
+        id->command_set_1  = __le16_to_cpu(id->command_set_1);
+        id->command_set_2  = __le16_to_cpu(id->command_set_2);
+        id->cfsse          = __le16_to_cpu(id->cfsse);
+        id->cfs_enable_1   = __le16_to_cpu(id->cfs_enable_1);
+        id->cfs_enable_2   = __le16_to_cpu(id->cfs_enable_2);
+        id->csf_default    = __le16_to_cpu(id->csf_default);
+        id->dma_ultra      = __le16_to_cpu(id->dma_ultra);
+        id->trseuc         = __le16_to_cpu(id->trseuc);
+        id->trsEuc         = __le16_to_cpu(id->trsEuc);
+        id->CurAPMvalues   = __le16_to_cpu(id->CurAPMvalues);
+        id->mprc           = __le16_to_cpu(id->mprc);
+        id->hw_config      = __le16_to_cpu(id->hw_config);
+        id->acoustic       = __le16_to_cpu(id->acoustic);
+        id->msrqs          = __le16_to_cpu(id->msrqs);
+        id->sxfert         = __le16_to_cpu(id->sxfert);
+        id->sal            = __le16_to_cpu(id->sal);
+        id->spg            = __le32_to_cpu(id->spg);
+        id->lba_capacity_2 = __le64_to_cpu(id->lba_capacity_2);
+        for (i = 0; i < 22; i++)
+                id->words104_125[i]   = __le16_to_cpu(id->words104_125[i]);
+        id->last_lun       = __le16_to_cpu(id->last_lun);
+        id->word127        = __le16_to_cpu(id->word127);
+        id->dlf            = __le16_to_cpu(id->dlf);
+        id->csfo           = __le16_to_cpu(id->csfo);
+        for (i = 0; i < 26; i++)
+                id->words130_155[i] = __le16_to_cpu(id->words130_155[i]);
+        id->word156        = __le16_to_cpu(id->word156);
+        for (i = 0; i < 3; i++)
+                id->words157_159[i] = __le16_to_cpu(id->words157_159[i]);
+        id->cfa_power      = __le16_to_cpu(id->cfa_power);
+        for (i = 0; i < 14; i++)
+                id->words161_175[i] = __le16_to_cpu(id->words161_175[i]);
+        for (i = 0; i < 31; i++)
+                id->words176_205[i] = __le16_to_cpu(id->words176_205[i]);
+        for (i = 0; i < 48; i++)
+                id->words206_254[i] = __le16_to_cpu(id->words206_254[i]);
+        id->integrity_word  = __le16_to_cpu(id->integrity_word);
+# else
+#  error "Please fix <asm/byteorder.h>"
+# endif
+#endif
+}
 /**************************************************************************
 * isd200_get_inquiry_data
@@ -1018,7 +1121,7 @@ static int isd200_get_inquiry_data( struct us_data *us )
                                int i;
                                __be16 *src;
                                __u16 *dest;
-                                ide_fix_driveid(id);
+                                isd200_fix_driveid(id);
                                US_DEBUGP("   Identify Data Structure:\n");
                                US_DEBUGP("      config = 0x%x\n", id->config);
diff --git a/drivers/video/cirrusfb.c b/drivers/video/cirrusfb.c
index f99cb77e7b..f7e2d5add8 100644
--- a/drivers/video/cirrusfb.c
+++ b/drivers/video/cirrusfb.c
@@ -2509,8 +2509,7 @@ static int cirrusfb_zorro_register(struct zorro_dev *z,
        cinfo = info->par;
        cinfo->btype = btype;
-        assert(z > 0);
+        assert(z);
-        assert(z2 >= 0);
        assert(btype != BT_NONE);
        cinfo->zdev = z;