Merge git://git.kernel.org/pub/scm/linux/kernel/git/lwfinger/linux-staging into staging-next

* git://git.kernel.org/pub/scm/linux/kernel/git/lwfinger/linux-staging:
  staging: rt2860sta and rt2870sta: Remove drivers replaced in net/wireless

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 274b32d..492e81d 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -387,26 +387,6 @@
 
 ----------------------------
 
-What:	Support for lcd_switch and display_get in asus-laptop driver
-When:	March 2010
-Why:	These two features use non-standard interfaces. There are the
-	only features that really need multiple path to guess what's
-	the right method name on a specific laptop.
-
-	Removing them will allow to remove a lot of code an significantly
-	clean the drivers.
-
-	This will affect the backlight code which won't be able to know
-	if the backlight is on or off. The platform display file will also be
-	write only (like the one in eeepc-laptop).
-
-	This should'nt affect a lot of user because they usually know
-	when their display is on or off.
-
-Who:	Corentin Chary <corentin.chary@gmail.com>
-
-----------------------------
-
 What:	sysfs-class-rfkill state file
 When:	Feb 2014
 Files:	net/rfkill/core.c
diff --git a/Documentation/input/event-codes.txt b/Documentation/input/event-codes.txt
new file mode 100644
index 0000000..23fcb05
--- /dev/null
+++ b/Documentation/input/event-codes.txt
@@ -0,0 +1,262 @@
+The input protocol uses a map of types and codes to express input device values
+to userspace. This document describes the types and codes and how and when they
+may be used.
+
+A single hardware event generates multiple input events. Each input event
+contains the new value of a single data item. A special event type, EV_SYN, is
+used to separate input events into packets of input data changes occurring at
+the same moment in time. In the following, the term "event" refers to a single
+input event encompassing a type, code, and value.
+
+The input protocol is a stateful protocol. Events are emitted only when values
+of event codes have changed. However, the state is maintained within the Linux
+input subsystem; drivers do not need to maintain the state and may attempt to
+emit unchanged values without harm. Userspace may obtain the current state of
+event code values using the EVIOCG* ioctls defined in linux/input.h. The event
+reports supported by a device are also provided by sysfs in
+class/input/event*/device/capabilities/, and the properties of a device are
+provided in class/input/event*/device/properties.
+
+Types:
+==========
+Types are groupings of codes under a logical input construct. Each type has a
+set of applicable codes to be used in generating events. See the Codes section
+for details on valid codes for each type.
+
+* EV_SYN:
+  - Used as markers to separate events. Events may be separated in time or in
+    space, such as with the multitouch protocol.
+
+* EV_KEY:
+  - Used to describe state changes of keyboards, buttons, or other key-like
+    devices.
+
+* EV_REL:
+  - Used to describe relative axis value changes, e.g. moving the mouse 5 units
+    to the left.
+
+* EV_ABS:
+  - Used to describe absolute axis value changes, e.g. describing the
+    coordinates of a touch on a touchscreen.
+
+* EV_MSC:
+  - Used to describe miscellaneous input data that do not fit into other types.
+
+* EV_SW:
+  - Used to describe binary state input switches.
+
+* EV_LED:
+  - Used to turn LEDs on devices on and off.
+
+* EV_SND:
+  - Used to output sound to devices.
+
+* EV_REP:
+  - Used for autorepeating devices.
+
+* EV_FF:
+  - Used to send force feedback commands to an input device.
+
+* EV_PWR:
+  - A special type for power button and switch input.
+
+* EV_FF_STATUS:
+  - Used to receive force feedback device status.
+
+Codes:
+==========
+Codes define the precise type of event.
+
+EV_SYN:
+----------
+EV_SYN event values are undefined. Their usage is defined only by when they are
+sent in the evdev event stream.
+
+* SYN_REPORT:
+  - Used to synchronize and separate events into packets of input data changes
+    occurring at the same moment in time. For example, motion of a mouse may set
+    the REL_X and REL_Y values for one motion, then emit a SYN_REPORT. The next
+    motion will emit more REL_X and REL_Y values and send another SYN_REPORT.
+
+* SYN_CONFIG:
+  - TBD
+
+* SYN_MT_REPORT:
+  - Used to synchronize and separate touch events. See the
+    multi-touch-protocol.txt document for more information.
+
+* SYN_DROPPED:
+  - Used to indicate buffer overrun in the evdev client's event queue.
+    Client should ignore all events up to and including next SYN_REPORT
+    event and query the device (using EVIOCG* ioctls) to obtain its
+    current state.
+
+EV_KEY:
+----------
+EV_KEY events take the form KEY_<name> or BTN_<name>. For example, KEY_A is used
+to represent the 'A' key on a keyboard. When a key is depressed, an event with
+the key's code is emitted with value 1. When the key is released, an event is
+emitted with value 0. Some hardware send events when a key is repeated. These
+events have a value of 2. In general, KEY_<name> is used for keyboard keys, and
+BTN_<name> is used for other types of momentary switch events.
+
+A few EV_KEY codes have special meanings:
+
+* BTN_TOOL_<name>:
+  - These codes are used in conjunction with input trackpads, tablets, and
+    touchscreens. These devices may be used with fingers, pens, or other tools.
+    When an event occurs and a tool is used, the corresponding BTN_TOOL_<name>
+    code should be set to a value of 1. When the tool is no longer interacting
+    with the input device, the BTN_TOOL_<name> code should be reset to 0. All
+    trackpads, tablets, and touchscreens should use at least one BTN_TOOL_<name>
+    code when events are generated.
+
+* BTN_TOUCH:
+    BTN_TOUCH is used for touch contact. While an input tool is determined to be
+    within meaningful physical contact, the value of this property must be set
+    to 1. Meaningful physical contact may mean any contact, or it may mean
+    contact conditioned by an implementation defined property. For example, a
+    touchpad may set the value to 1 only when the touch pressure rises above a
+    certain value. BTN_TOUCH may be combined with BTN_TOOL_<name> codes. For
+    example, a pen tablet may set BTN_TOOL_PEN to 1 and BTN_TOUCH to 0 while the
+    pen is hovering over but not touching the tablet surface.
+
+Note: For appropriate function of the legacy mousedev emulation driver,
+BTN_TOUCH must be the first evdev code emitted in a synchronization frame.
+
+Note: Historically a touch device with BTN_TOOL_FINGER and BTN_TOUCH was
+interpreted as a touchpad by userspace, while a similar device without
+BTN_TOOL_FINGER was interpreted as a touchscreen. For backwards compatibility
+with current userspace it is recommended to follow this distinction. In the
+future, this distinction will be deprecated and the device properties ioctl
+EVIOCGPROP, defined in linux/input.h, will be used to convey the device type.
+
+* BTN_TOOL_FINGER, BTN_TOOL_DOUBLETAP, BTN_TOOL_TRIPLETAP, BTN_TOOL_QUADTAP:
+  - These codes denote one, two, three, and four finger interaction on a
+    trackpad or touchscreen. For example, if the user uses two fingers and moves
+    them on the touchpad in an effort to scroll content on screen,
+    BTN_TOOL_DOUBLETAP should be set to value 1 for the duration of the motion.
+    Note that all BTN_TOOL_<name> codes and the BTN_TOUCH code are orthogonal in
+    purpose. A trackpad event generated by finger touches should generate events
+    for one code from each group. At most only one of these BTN_TOOL_<name>
+    codes should have a value of 1 during any synchronization frame.
+
+Note: Historically some drivers emitted multiple of the finger count codes with
+a value of 1 in the same synchronization frame. This usage is deprecated.
+
+Note: In multitouch drivers, the input_mt_report_finger_count() function should
+be used to emit these codes. Please see multi-touch-protocol.txt for details.
+
+EV_REL:
+----------
+EV_REL events describe relative changes in a property. For example, a mouse may
+move to the left by a certain number of units, but its absolute position in
+space is unknown. If the absolute position is known, EV_ABS codes should be used
+instead of EV_REL codes.
+
+A few EV_REL codes have special meanings:
+
+* REL_WHEEL, REL_HWHEEL:
+  - These codes are used for vertical and horizontal scroll wheels,
+    respectively.
+
+EV_ABS:
+----------
+EV_ABS events describe absolute changes in a property. For example, a touchpad
+may emit coordinates for a touch location.
+
+A few EV_ABS codes have special meanings:
+
+* ABS_DISTANCE:
+  - Used to describe the distance of a tool from an interaction surface. This
+    event should only be emitted while the tool is hovering, meaning in close
+    proximity of the device and while the value of the BTN_TOUCH code is 0. If
+    the input device may be used freely in three dimensions, consider ABS_Z
+    instead.
+
+* ABS_MT_<name>:
+  - Used to describe multitouch input events. Please see
+    multi-touch-protocol.txt for details.
+
+EV_SW:
+----------
+EV_SW events describe stateful binary switches. For example, the SW_LID code is
+used to denote when a laptop lid is closed.
+
+Upon binding to a device or resuming from suspend, a driver must report
+the current switch state. This ensures that the device, kernel, and userspace
+state is in sync.
+
+Upon resume, if the switch state is the same as before suspend, then the input
+subsystem will filter out the duplicate switch state reports. The driver does
+not need to keep the state of the switch at any time.
+
+EV_MSC:
+----------
+EV_MSC events are used for input and output events that do not fall under other
+categories.
+
+EV_LED:
+----------
+EV_LED events are used for input and output to set and query the state of
+various LEDs on devices.
+
+EV_REP:
+----------
+EV_REP events are used for specifying autorepeating events.
+
+EV_SND:
+----------
+EV_SND events are used for sending sound commands to simple sound output
+devices.
+
+EV_FF:
+----------
+EV_FF events are used to initialize a force feedback capable device and to cause
+such device to feedback.
+
+EV_PWR:
+----------
+EV_PWR events are a special type of event used specifically for power
+mangement. Its usage is not well defined. To be addressed later.
+
+Guidelines:
+==========
+The guidelines below ensure proper single-touch and multi-finger functionality.
+For multi-touch functionality, see the multi-touch-protocol.txt document for
+more information.
+
+Mice:
+----------
+REL_{X,Y} must be reported when the mouse moves. BTN_LEFT must be used to report
+the primary button press. BTN_{MIDDLE,RIGHT,4,5,etc.} should be used to report
+further buttons of the device. REL_WHEEL and REL_HWHEEL should be used to report
+scroll wheel events where available.
+
+Touchscreens:
+----------
+ABS_{X,Y} must be reported with the location of the touch. BTN_TOUCH must be
+used to report when a touch is active on the screen.
+BTN_{MOUSE,LEFT,MIDDLE,RIGHT} must not be reported as the result of touch
+contact. BTN_TOOL_<name> events should be reported where possible.
+
+Trackpads:
+----------
+Legacy trackpads that only provide relative position information must report
+events like mice described above.
+
+Trackpads that provide absolute touch position must report ABS_{X,Y} for the
+location of the touch. BTN_TOUCH should be used to report when a touch is active
+on the trackpad. Where multi-finger support is available, BTN_TOOL_<name> should
+be used to report the number of touches active on the trackpad.
+
+Tablets:
+----------
+BTN_TOOL_<name> events must be reported when a stylus or other tool is active on
+the tablet. ABS_{X,Y} must be reported with the location of the tool. BTN_TOUCH
+should be used to report when the tool is in contact with the tablet.
+BTN_{STYLUS,STYLUS2} should be used to report buttons on the tool itself. Any
+button may be used for buttons on the tablet except BTN_{MOUSE,LEFT}.
+BTN_{0,1,2,etc} are good generic codes for unlabeled buttons. Do not use
+meaningful buttons, like BTN_FORWARD, unless the button is labeled for that
+purpose on the device.
diff --git a/MAINTAINERS b/MAINTAINERS
index 6b4b9cd..ec36003 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -184,10 +184,9 @@
 F:	fs/9p/
 
 A2232 SERIAL BOARD DRIVER
-M:	Enver Haase <A2232@gmx.net>
 L:	linux-m68k@lists.linux-m68k.org
-S:	Maintained
-F:	drivers/char/ser_a2232*
+S:	Orphan
+F:	drivers/staging/generic_serial/ser_a2232*
 
 AACRAID SCSI RAID DRIVER
 M:	Adaptec OEM Raid Solutions <aacraid@adaptec.com>
@@ -877,6 +876,13 @@
 F:	arch/arm/mach-orion5x/
 F:	arch/arm/plat-orion/
 
+ARM/Orion SoC/Technologic Systems TS-78xx platform support
+M:	Alexander Clouter <alex@digriz.org.uk>
+L:	linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+W:	http://www.digriz.org.uk/ts78xx/kernel
+S:	Maintained
+F:	arch/arm/mach-orion5x/ts78xx-*
+
 ARM/MIOA701 MACHINE SUPPORT
 M:	Robert Jarzmik <robert.jarzmik@free.fr>
 L:	linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -1063,7 +1069,7 @@
 F:	drivers/sh/
 
 ARM/TELECHIPS ARM ARCHITECTURE
-M:	"Hans J. Koch" <hjk@linutronix.de>
+M:	"Hans J. Koch" <hjk@hansjkoch.de>
 L:	linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:	Maintained
 F:	arch/arm/plat-tcc/
@@ -1823,11 +1829,10 @@
 F:	drivers/platform/x86/compal-laptop.c
 
 COMPUTONE INTELLIPORT MULTIPORT CARD
-M:	"Michael H. Warfield" <mhw@wittsend.com>
 W:	http://www.wittsend.com/computone.html
-S:	Maintained
+S:	Orphan
 F:	Documentation/serial/computone.txt
-F:	drivers/char/ip2/
+F:	drivers/staging/tty/ip2/
 
 CONEXANT ACCESSRUNNER USB DRIVER
 M:	Simon Arlott <cxacru@fire.lp0.eu>
@@ -2010,7 +2015,7 @@
 CYCLADES ASYNC MUX DRIVER
 W:	http://www.cyclades.com/
 S:	Orphan
-F:	drivers/char/cyclades.c
+F:	drivers/tty/cyclades.c
 F:	include/linux/cyclades.h
 
 CYCLADES PC300 DRIVER
@@ -2124,8 +2129,8 @@
 W:	http://www.digi.com
 S:	Orphan
 F:	Documentation/serial/digiepca.txt
-F:	drivers/char/epca*
-F:	drivers/char/digi*
+F:	drivers/staging/tty/epca*
+F:	drivers/staging/tty/digi*
 
 DIOLAN U2C-12 I2C DRIVER
 M:	Guenter Roeck <guenter.roeck@ericsson.com>
@@ -4077,7 +4082,7 @@
 F:	include/linux/matroxfb.h
 
 MAX6650 HARDWARE MONITOR AND FAN CONTROLLER DRIVER
-M:	"Hans J. Koch" <hjk@linutronix.de>
+M:	"Hans J. Koch" <hjk@hansjkoch.de>
 L:	lm-sensors@lm-sensors.org
 S:	Maintained
 F:	Documentation/hwmon/max6650
@@ -4192,7 +4197,7 @@
 M:	Jiri Slaby <jirislaby@gmail.com>
 S:	Maintained
 F:	Documentation/serial/moxa-smartio
-F:	drivers/char/mxser.*
+F:	drivers/tty/mxser.*
 
 MSI LAPTOP SUPPORT
 M:	"Lee, Chun-Yi" <jlee@novell.com>
@@ -4234,7 +4239,7 @@
 
 MULTITECH MULTIPORT CARD (ISICOM)
 S:	Orphan
-F:	drivers/char/isicom.c
+F:	drivers/tty/isicom.c
 F:	include/linux/isicom.h
 
 MUSB MULTIPOINT HIGH SPEED DUAL-ROLE CONTROLLER
@@ -5273,14 +5278,14 @@
 RISCOM8 DRIVER
 S:	Orphan
 F:	Documentation/serial/riscom8.txt
-F:	drivers/char/riscom8*
+F:	drivers/staging/tty/riscom8*
 
 ROCKETPORT DRIVER
 P:	Comtrol Corp.
 W:	http://www.comtrol.com
 S:	Maintained
 F:	Documentation/serial/rocket.txt
-F:	drivers/char/rocket*
+F:	drivers/tty/rocket*
 
 ROSE NETWORK LAYER
 M:	Ralf Baechle <ralf@linux-mips.org>
@@ -5916,10 +5921,9 @@
 F:	arch/arm/mach-spear6xx/spear600_evb.c
 
 SPECIALIX IO8+ MULTIPORT SERIAL CARD DRIVER
-M:	Roger Wolff <R.E.Wolff@BitWizard.nl>
-S:	Supported
+S:	Orphan
 F:	Documentation/serial/specialix.txt
-F:	drivers/char/specialix*
+F:	drivers/staging/tty/specialix*
 
 SPI SUBSYSTEM
 M:	David Brownell <dbrownell@users.sourceforge.net>
@@ -5964,7 +5968,6 @@
 
 STABLE BRANCH
 M:	Greg Kroah-Hartman <greg@kroah.com>
-M:	Chris Wright <chrisw@sous-sol.org>
 L:	stable@kernel.org
 S:	Maintained
 
@@ -6248,7 +6251,8 @@
 W:	http://www.uclinux.org/
 L:	uclinux-dev@uclinux.org  (subscribers-only)
 S:	Maintained
-F:	arch/m68knommu/
+F:	arch/m68k/*/*_no.*
+F:	arch/m68k/include/asm/*_no.*
 
 UCLINUX FOR RENESAS H8/300 (H8300)
 M:	Yoshinori Sato <ysato@users.sourceforge.jp>
@@ -6618,7 +6622,7 @@
 F:	fs/hppfs/
 
 USERSPACE I/O (UIO)
-M:	"Hans J. Koch" <hjk@linutronix.de>
+M:	"Hans J. Koch" <hjk@hansjkoch.de>
 M:	Greg Kroah-Hartman <gregkh@suse.de>
 S:	Maintained
 F:	Documentation/DocBook/uio-howto.tmpl
@@ -6916,6 +6920,13 @@
 S:	Maintained
 F:	drivers/platform/x86
 
+XEN NETWORK BACKEND DRIVER
+M:	Ian Campbell <ian.campbell@citrix.com>
+L:	xen-devel@lists.xensource.com (moderated for non-subscribers)
+L:	netdev@vger.kernel.org
+S:	Supported
+F:	drivers/net/xen-netback/*
+
 XEN PCI SUBSYSTEM
 M:	Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
 L:	xen-devel@lists.xensource.com (moderated for non-subscribers)
diff --git a/Makefile b/Makefile
index 8392b64..b967b96 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 39
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc4
 NAME = Flesh-Eating Bats with Fangs
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/kernel/Makefile b/arch/alpha/kernel/Makefile
index 9bb7b858..7a6d908 100644
--- a/arch/alpha/kernel/Makefile
+++ b/arch/alpha/kernel/Makefile
@@ -4,7 +4,7 @@
 
 extra-y		:= head.o vmlinux.lds
 asflags-y	:= $(KBUILD_CFLAGS)
-ccflags-y	:= -Werror -Wno-sign-compare
+ccflags-y	:= -Wno-sign-compare
 
 obj-y    := entry.o traps.o process.o init_task.o osf_sys.o irq.o \
 	    irq_alpha.o signal.o setup.o ptrace.o time.o \
diff --git a/arch/alpha/kernel/core_mcpcia.c b/arch/alpha/kernel/core_mcpcia.c
index 381fec0..da7bcc3 100644
--- a/arch/alpha/kernel/core_mcpcia.c
+++ b/arch/alpha/kernel/core_mcpcia.c
@@ -88,7 +88,7 @@
 {
 	unsigned long flags;
 	unsigned long mid = MCPCIA_HOSE2MID(hose->index);
-	unsigned int stat0, value, temp, cpu;
+	unsigned int stat0, value, cpu;
 
 	cpu = smp_processor_id();
 
@@ -101,7 +101,7 @@
 	stat0 = *(vuip)MCPCIA_CAP_ERR(mid);
 	*(vuip)MCPCIA_CAP_ERR(mid) = stat0;
 	mb();
-	temp = *(vuip)MCPCIA_CAP_ERR(mid);
+	*(vuip)MCPCIA_CAP_ERR(mid);
 	DBG_CFG(("conf_read: MCPCIA_CAP_ERR(%d) was 0x%x\n", mid, stat0));
 
 	mb();
@@ -136,7 +136,7 @@
 {
 	unsigned long flags;
 	unsigned long mid = MCPCIA_HOSE2MID(hose->index);
-	unsigned int stat0, temp, cpu;
+	unsigned int stat0, cpu;
 
 	cpu = smp_processor_id();
 
@@ -145,7 +145,7 @@
 	/* Reset status register to avoid losing errors.  */
 	stat0 = *(vuip)MCPCIA_CAP_ERR(mid);
 	*(vuip)MCPCIA_CAP_ERR(mid) = stat0; mb();
-	temp = *(vuip)MCPCIA_CAP_ERR(mid);
+	*(vuip)MCPCIA_CAP_ERR(mid);
 	DBG_CFG(("conf_write: MCPCIA CAP_ERR(%d) was 0x%x\n", mid, stat0));
 
 	draina();
@@ -157,7 +157,7 @@
 	*((vuip)addr) = value;
 	mb();
 	mb();  /* magic */
-	temp = *(vuip)MCPCIA_CAP_ERR(mid); /* read to force the write */
+	*(vuip)MCPCIA_CAP_ERR(mid); /* read to force the write */
 	mcheck_expected(cpu) = 0;
 	mb();
 
@@ -572,12 +572,10 @@
 void
 mcpcia_machine_check(unsigned long vector, unsigned long la_ptr)
 {
-	struct el_common *mchk_header;
 	struct el_MCPCIA_uncorrected_frame_mcheck *mchk_logout;
 	unsigned int cpu = smp_processor_id();
 	int expected;
 
-	mchk_header = (struct el_common *)la_ptr;
 	mchk_logout = (struct el_MCPCIA_uncorrected_frame_mcheck *)la_ptr;
 	expected = mcheck_expected(cpu);
 
diff --git a/arch/alpha/kernel/err_titan.c b/arch/alpha/kernel/err_titan.c
index c3b3781..14b26c4 100644
--- a/arch/alpha/kernel/err_titan.c
+++ b/arch/alpha/kernel/err_titan.c
@@ -533,8 +533,6 @@
 static struct el_subpacket *
 el_process_regatta_subpacket(struct el_subpacket *header)
 {
-	int status;
-
 	if (header->class != EL_CLASS__REGATTA_FAMILY) {
 		printk("%s  ** Unexpected header CLASS %d TYPE %d, aborting\n",
 		       err_print_prefix,
@@ -551,7 +549,7 @@
 		printk("%s  ** Occurred on CPU %d:\n", 
 		       err_print_prefix,
 		       (int)header->by_type.regatta_frame.cpuid);
-		status = privateer_process_logout_frame((struct el_common *)
+		privateer_process_logout_frame((struct el_common *)
 			header->by_type.regatta_frame.data_start, 1);
 		break;
 	default:
diff --git a/arch/alpha/kernel/irq_alpha.c b/arch/alpha/kernel/irq_alpha.c
index 1479dc6..51b7fbd 100644
--- a/arch/alpha/kernel/irq_alpha.c
+++ b/arch/alpha/kernel/irq_alpha.c
@@ -228,7 +228,7 @@
 void __init
 init_rtc_irq(void)
 {
-	irq_set_chip_and_handler_name(RTC_IRQ, &no_irq_chip,
+	irq_set_chip_and_handler_name(RTC_IRQ, &dummy_irq_chip,
 				      handle_simple_irq, "RTC");
 	setup_irq(RTC_IRQ, &timer_irqaction);
 }
diff --git a/arch/alpha/kernel/setup.c b/arch/alpha/kernel/setup.c
index d2634e4..edbddcb 100644
--- a/arch/alpha/kernel/setup.c
+++ b/arch/alpha/kernel/setup.c
@@ -1404,8 +1404,6 @@
 	case PCA56_CPU:
 	case PCA57_CPU:
 	  {
-		unsigned long cbox_config, size;
-
 		if (cpu_type == PCA56_CPU) {
 			L1I = CSHAPE(16*1024, 6, 1);
 			L1D = CSHAPE(8*1024, 5, 1);
@@ -1415,10 +1413,12 @@
 		}
 		L3 = -1;
 
+#if 0
+		unsigned long cbox_config, size;
+
 		cbox_config = *(vulp) phys_to_virt (0xfffff00008UL);
 		size = 512*1024 * (1 << ((cbox_config >> 12) & 3));
 
-#if 0
 		L2 = ((cbox_config >> 31) & 1 ? CSHAPE (size, 6, 1) : -1);
 #else
 		L2 = external_cache_probe(512*1024, 6);
diff --git a/arch/alpha/kernel/smc37c93x.c b/arch/alpha/kernel/smc37c93x.c
index 3e6a289..6886b83 100644
--- a/arch/alpha/kernel/smc37c93x.c
+++ b/arch/alpha/kernel/smc37c93x.c
@@ -79,7 +79,6 @@
 static unsigned long __init SMCConfigState(unsigned long baseAddr)
 {
 	unsigned char devId;
-	unsigned char devRev;
 
 	unsigned long configPort;
 	unsigned long indexPort;
@@ -100,7 +99,7 @@
 		devId = inb(dataPort);
 		if (devId == VALID_DEVICE_ID) {
 			outb(DEVICE_REV, indexPort);
-			devRev = inb(dataPort);
+			/* unsigned char devRev = */ inb(dataPort);
 			break;
 		}
 		else
diff --git a/arch/alpha/kernel/sys_wildfire.c b/arch/alpha/kernel/sys_wildfire.c
index d3cb28b..d92cdc7 100644
--- a/arch/alpha/kernel/sys_wildfire.c
+++ b/arch/alpha/kernel/sys_wildfire.c
@@ -156,7 +156,6 @@
 wildfire_init_irq_per_pca(int qbbno, int pcano)
 {
 	int i, irq_bias;
-	unsigned long io_bias;
 	static struct irqaction isa_enable = {
 		.handler	= no_action,
 		.name		= "isa_enable",
@@ -165,10 +164,12 @@
 	irq_bias = qbbno * (WILDFIRE_PCA_PER_QBB * WILDFIRE_IRQ_PER_PCA)
 		 + pcano * WILDFIRE_IRQ_PER_PCA;
 
+#if 0
+	unsigned long io_bias;
+
 	/* Only need the following for first PCI bus per PCA. */
 	io_bias = WILDFIRE_IO(qbbno, pcano<<1) - WILDFIRE_IO_BIAS;
 
-#if 0
 	outb(0, DMA1_RESET_REG + io_bias);
 	outb(0, DMA2_RESET_REG + io_bias);
 	outb(DMA_MODE_CASCADE, DMA2_MODE_REG + io_bias);
diff --git a/arch/alpha/kernel/time.c b/arch/alpha/kernel/time.c
index a58e84f..918e8e0 100644
--- a/arch/alpha/kernel/time.c
+++ b/arch/alpha/kernel/time.c
@@ -153,6 +153,7 @@
 		year += 100;
 
 	ts->tv_sec = mktime(year, mon, day, hour, min, sec);
+	ts->tv_nsec = 0;
 }
 
 
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index fdc9d4d..377a7a5 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1540,7 +1540,6 @@
 config HIGHPTE
 	bool "Allocate 2nd-level pagetables from highmem"
 	depends on HIGHMEM
-	depends on !OUTER_CACHE
 
 config HW_PERF_EVENTS
 	bool "Enable hardware performance counter support for perf events"
@@ -2012,6 +2011,8 @@
 
 config ARCH_SUSPEND_POSSIBLE
 	depends on !ARCH_S5P64X0 && !ARCH_S5P6442
+	depends on CPU_ARM920T || CPU_ARM926T || CPU_SA1100 || \
+		CPU_V6 || CPU_V6K || CPU_V7 || CPU_XSC3 || CPU_XSCALE
 	def_bool y
 
 endmenu
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index 494224a..03d01d7 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -63,17 +63,6 @@
 	      8 - SIGSEGV faults
 	     16 - SIGBUS faults
 
-config DEBUG_ERRORS
-	bool "Verbose kernel error messages"
-	depends on DEBUG_KERNEL
-	help
-	  This option controls verbose debugging information which can be
-	  printed when the kernel detects an internal error. This debugging
-	  information is useful to kernel hackers when tracking down problems,
-	  but mostly meaningless to other people. It's safe to say Y unless
-	  you are concerned with the code size or don't want to see these
-	  messages.
-
 config DEBUG_STACK_USAGE
 	bool "Enable stack utilization instrumentation"
 	depends on DEBUG_KERNEL
diff --git a/arch/arm/common/Makefile b/arch/arm/common/Makefile
index e7521bca..6ea9b6f 100644
--- a/arch/arm/common/Makefile
+++ b/arch/arm/common/Makefile
@@ -16,5 +16,4 @@
 obj-$(CONFIG_ARCH_IXP2000)	+= uengine.o
 obj-$(CONFIG_ARCH_IXP23XX)	+= uengine.o
 obj-$(CONFIG_PCI_HOST_ITE8152)  += it8152.o
-obj-$(CONFIG_COMMON_CLKDEV)	+= clkdev.o
 obj-$(CONFIG_ARM_TIMER_SP804)	+= timer-sp.o
diff --git a/arch/arm/include/asm/thread_notify.h b/arch/arm/include/asm/thread_notify.h
index c4391ba..1dc9806 100644
--- a/arch/arm/include/asm/thread_notify.h
+++ b/arch/arm/include/asm/thread_notify.h
@@ -43,6 +43,7 @@
 #define THREAD_NOTIFY_FLUSH	0
 #define THREAD_NOTIFY_EXIT	1
 #define THREAD_NOTIFY_SWITCH	2
+#define THREAD_NOTIFY_COPY	3
 
 #endif
 #endif
diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile
index 74554f1..8d95446 100644
--- a/arch/arm/kernel/Makefile
+++ b/arch/arm/kernel/Makefile
@@ -29,7 +29,7 @@
 obj-$(CONFIG_ARTHUR)		+= arthur.o
 obj-$(CONFIG_ISA_DMA)		+= dma-isa.o
 obj-$(CONFIG_PCI)		+= bios32.o isa.o
-obj-$(CONFIG_PM)		+= sleep.o
+obj-$(CONFIG_PM_SLEEP)		+= sleep.o
 obj-$(CONFIG_HAVE_SCHED_CLOCK)	+= sched_clock.o
 obj-$(CONFIG_SMP)		+= smp.o smp_tlb.o
 obj-$(CONFIG_HAVE_ARM_SCU)	+= smp_scu.o
diff --git a/arch/arm/kernel/elf.c b/arch/arm/kernel/elf.c
index d4a0da1..9b05c6a 100644
--- a/arch/arm/kernel/elf.c
+++ b/arch/arm/kernel/elf.c
@@ -40,15 +40,22 @@
 void elf_set_personality(const struct elf32_hdr *x)
 {
 	unsigned int eflags = x->e_flags;
-	unsigned int personality = PER_LINUX_32BIT;
+	unsigned int personality = current->personality & ~PER_MASK;
+
+	/*
+	 * We only support Linux ELF executables, so always set the
+	 * personality to LINUX.
+	 */
+	personality |= PER_LINUX;
 
 	/*
 	 * APCS-26 is only valid for OABI executables
 	 */
-	if ((eflags & EF_ARM_EABI_MASK) == EF_ARM_EABI_UNKNOWN) {
-		if (eflags & EF_ARM_APCS_26)
-			personality = PER_LINUX;
-	}
+	if ((eflags & EF_ARM_EABI_MASK) == EF_ARM_EABI_UNKNOWN &&
+	    (eflags & EF_ARM_APCS_26))
+		personality &= ~ADDR_LIMIT_32BIT;
+	else
+		personality |= ADDR_LIMIT_32BIT;
 
 	set_personality(personality);
 
diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
index 8dbc126..87acc25 100644
--- a/arch/arm/kernel/hw_breakpoint.c
+++ b/arch/arm/kernel/hw_breakpoint.c
@@ -868,6 +868,13 @@
 		 */
 		asm volatile("mcr p14, 0, %0, c1, c0, 4" : : "r" (0));
 		isb();
+
+		/*
+		 * Clear any configured vector-catch events before
+		 * enabling monitor mode.
+		 */
+		asm volatile("mcr p14, 0, %0, c0, c7, 0" : : "r" (0));
+		isb();
 	}
 
 	if (enable_monitor_mode())
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index 69cfee0..979da39 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -221,7 +221,7 @@
 	prev_raw_count &= armpmu->max_period;
 
 	if (overflow)
-		delta = armpmu->max_period - prev_raw_count + new_raw_count;
+		delta = armpmu->max_period - prev_raw_count + new_raw_count + 1;
 	else
 		delta = new_raw_count - prev_raw_count;
 
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 94bbedb..5e1e541 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -372,6 +372,8 @@
 	if (clone_flags & CLONE_SETTLS)
 		thread->tp_value = regs->ARM_r3;
 
+	thread_notify(THREAD_NOTIFY_COPY, thread);
+
 	return 0;
 }
 
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index f0000e1..3b54ad1 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -410,8 +410,7 @@
 	struct thread_info *thread = current_thread_info();
 	siginfo_t info;
 
-	if (current->personality != PER_LINUX &&
-	    current->personality != PER_LINUX_32BIT &&
+	if ((current->personality & PER_MASK) != PER_LINUX &&
 	    thread->exec_domain->handler) {
 		thread->exec_domain->handler(n, regs);
 		return regs->ARM_r0;
diff --git a/arch/arm/mach-mmp/include/mach/gpio.h b/arch/arm/mach-mmp/include/mach/gpio.h
index ee8b02e..7bfb827 100644
--- a/arch/arm/mach-mmp/include/mach/gpio.h
+++ b/arch/arm/mach-mmp/include/mach/gpio.h
@@ -10,7 +10,7 @@
 #define BANK_OFF(n)	(((n) < 3) ? (n) << 2 : 0x100 + (((n) - 3) << 2))
 #define GPIO_REG(x)	(*((volatile u32 *)(GPIO_REGS_VIRT + (x))))
 
-#define NR_BUILTIN_GPIO	(192)
+#define NR_BUILTIN_GPIO		IRQ_GPIO_NUM
 
 #define gpio_to_bank(gpio)	((gpio) >> 5)
 #define gpio_to_irq(gpio)	(IRQ_GPIO_START + (gpio))
diff --git a/arch/arm/mach-mmp/include/mach/mfp-pxa168.h b/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
index 4621067..713be15 100644
--- a/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
+++ b/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
@@ -8,6 +8,15 @@
 #define MFP_DRIVE_MEDIUM	(0x2 << 13)
 #define MFP_DRIVE_FAST		(0x3 << 13)
 
+#undef MFP_CFG
+#undef MFP_CFG_DRV
+
+#define MFP_CFG(pin, af)		\
+	(MFP_LPM_INPUT | MFP_PIN(MFP_PIN_##pin) | MFP_##af | MFP_DRIVE_MEDIUM)
+
+#define MFP_CFG_DRV(pin, af, drv)	\
+	(MFP_LPM_INPUT | MFP_PIN(MFP_PIN_##pin) | MFP_##af | MFP_DRIVE_##drv)
+
 /* GPIO */
 #define GPIO0_GPIO		MFP_CFG(GPIO0, AF5)
 #define GPIO1_GPIO		MFP_CFG(GPIO1, AF5)
diff --git a/arch/arm/mach-msm/board-qsd8x50.c b/arch/arm/mach-msm/board-qsd8x50.c
index 7f56861..6a96911 100644
--- a/arch/arm/mach-msm/board-qsd8x50.c
+++ b/arch/arm/mach-msm/board-qsd8x50.c
@@ -160,10 +160,7 @@
 
 static void __init qsd8x50_init_mmc(void)
 {
-	if (machine_is_qsd8x50_ffa() || machine_is_qsd8x50a_ffa())
-		vreg_mmc = vreg_get(NULL, "gp6");
-	else
-		vreg_mmc = vreg_get(NULL, "gp5");
+	vreg_mmc = vreg_get(NULL, "gp5");
 
 	if (IS_ERR(vreg_mmc)) {
 		pr_err("vreg get for vreg_mmc failed (%ld)\n",
diff --git a/arch/arm/mach-msm/timer.c b/arch/arm/mach-msm/timer.c
index 56f920c..38b95e9 100644
--- a/arch/arm/mach-msm/timer.c
+++ b/arch/arm/mach-msm/timer.c
@@ -269,7 +269,7 @@
 
 	/* Use existing clock_event for cpu 0 */
 	if (!smp_processor_id())
-		return;
+		return 0;
 
 	writel(DGT_CLK_CTL_DIV_4, MSM_TMR_BASE + DGT_CLK_CTL);
 
diff --git a/arch/arm/mach-pxa/include/mach/gpio.h b/arch/arm/mach-pxa/include/mach/gpio.h
index b024a8b..c463950 100644
--- a/arch/arm/mach-pxa/include/mach/gpio.h
+++ b/arch/arm/mach-pxa/include/mach/gpio.h
@@ -99,11 +99,24 @@
 #define GAFR(x)		GPIO_REG(0x54 + (((x) & 0x70) >> 2))
 
 
-#define NR_BUILTIN_GPIO 128
+#define NR_BUILTIN_GPIO		PXA_GPIO_IRQ_NUM
 
 #define gpio_to_bank(gpio)	((gpio) >> 5)
 #define gpio_to_irq(gpio)	IRQ_GPIO(gpio)
-#define irq_to_gpio(irq)	IRQ_TO_GPIO(irq)
+
+static inline int irq_to_gpio(unsigned int irq)
+{
+	int gpio;
+
+	if (irq == IRQ_GPIO0 || irq == IRQ_GPIO1)
+		return irq - IRQ_GPIO0;
+
+	gpio = irq - PXA_GPIO_IRQ_BASE;
+	if (gpio >= 2 && gpio < NR_BUILTIN_GPIO)
+		return gpio;
+
+	return -1;
+}
 
 #ifdef CONFIG_CPU_PXA26x
 /* GPIO86/87/88/89 on PXA26x have their direction bits in GPDR2 inverted,
diff --git a/arch/arm/mach-pxa/include/mach/irqs.h b/arch/arm/mach-pxa/include/mach/irqs.h
index a4285fc..0384024 100644
--- a/arch/arm/mach-pxa/include/mach/irqs.h
+++ b/arch/arm/mach-pxa/include/mach/irqs.h
@@ -93,9 +93,6 @@
 #define GPIO_2_x_TO_IRQ(x)	(PXA_GPIO_IRQ_BASE + (x))
 #define IRQ_GPIO(x)	(((x) < 2) ? (IRQ_GPIO0 + (x)) : GPIO_2_x_TO_IRQ(x))
 
-#define IRQ_TO_GPIO_2_x(i)	((i) - PXA_GPIO_IRQ_BASE)
-#define IRQ_TO_GPIO(i)	(((i) < IRQ_GPIO(2)) ? ((i) - IRQ_GPIO0) : IRQ_TO_GPIO_2_x(i))
-
 /*
  * The following interrupts are for board specific purposes. Since
  * the kernel can only run on one machine at a time, we can re-use
diff --git a/arch/arm/mach-pxa/pxa25x.c b/arch/arm/mach-pxa/pxa25x.c
index 6bde595..a4af8c5 100644
--- a/arch/arm/mach-pxa/pxa25x.c
+++ b/arch/arm/mach-pxa/pxa25x.c
@@ -285,7 +285,7 @@
 
 static int pxa25x_set_wake(struct irq_data *d, unsigned int on)
 {
-	int gpio = IRQ_TO_GPIO(d->irq);
+	int gpio = irq_to_gpio(d->irq);
 	uint32_t mask = 0;
 
 	if (gpio >= 0 && gpio < 85)
diff --git a/arch/arm/mach-pxa/pxa27x.c b/arch/arm/mach-pxa/pxa27x.c
index 1cb5d0f..909756e 100644
--- a/arch/arm/mach-pxa/pxa27x.c
+++ b/arch/arm/mach-pxa/pxa27x.c
@@ -345,7 +345,7 @@
  */
 static int pxa27x_set_wake(struct irq_data *d, unsigned int on)
 {
-	int gpio = IRQ_TO_GPIO(d->irq);
+	int gpio = irq_to_gpio(d->irq);
 	uint32_t mask;
 
 	if (gpio >= 0 && gpio < 128)
diff --git a/arch/arm/mach-tegra/gpio.c b/arch/arm/mach-tegra/gpio.c
index 76a3f65..65a1aba 100644
--- a/arch/arm/mach-tegra/gpio.c
+++ b/arch/arm/mach-tegra/gpio.c
@@ -257,7 +257,8 @@
 void tegra_gpio_resume(void)
 {
 	unsigned long flags;
-	int b, p, i;
+	int b;
+	int p;
 
 	local_irq_save(flags);
 
@@ -280,7 +281,8 @@
 void tegra_gpio_suspend(void)
 {
 	unsigned long flags;
-	int b, p, i;
+	int b;
+	int p;
 
 	local_irq_save(flags);
 	for (b = 0; b < ARRAY_SIZE(tegra_gpio_banks); b++) {
diff --git a/arch/arm/mach-tegra/tegra2_clocks.c b/arch/arm/mach-tegra/tegra2_clocks.c
index 6d7c4ee..4459470 100644
--- a/arch/arm/mach-tegra/tegra2_clocks.c
+++ b/arch/arm/mach-tegra/tegra2_clocks.c
@@ -1362,14 +1362,15 @@
 {
 	unsigned long flags;
 	int ret;
+	long new_rate = rate;
 
-	rate = clk_round_rate(c->parent, rate);
-	if (rate < 0)
-		return rate;
+	new_rate = clk_round_rate(c->parent, new_rate);
+	if (new_rate < 0)
+		return new_rate;
 
 	spin_lock_irqsave(&c->parent->spinlock, flags);
 
-	c->u.shared_bus_user.rate = rate;
+	c->u.shared_bus_user.rate = new_rate;
 	ret = tegra_clk_shared_bus_update(c->parent);
 
 	spin_unlock_irqrestore(&c->parent->spinlock, flags);
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index afe209e..74be05f 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -7,6 +7,7 @@
 #include <linux/shm.h>
 #include <linux/sched.h>
 #include <linux/io.h>
+#include <linux/personality.h>
 #include <linux/random.h>
 #include <asm/cputype.h>
 #include <asm/system.h>
@@ -82,7 +83,8 @@
 	        mm->cached_hole_size = 0;
 	}
 	/* 8 bits of randomness in 20 address space bits */
-	if (current->flags & PF_RANDOMIZE)
+	if ((current->flags & PF_RANDOMIZE) &&
+	    !(current->personality & ADDR_NO_RANDOMIZE))
 		addr += (get_random_int() % (1 << 8)) << PAGE_SHIFT;
 
 full_search:
diff --git a/arch/arm/mm/proc-arm920.S b/arch/arm/mm/proc-arm920.S
index b46eb21..bf8a1d1 100644
--- a/arch/arm/mm/proc-arm920.S
+++ b/arch/arm/mm/proc-arm920.S
@@ -390,7 +390,7 @@
 /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
 .globl	cpu_arm920_suspend_size
 .equ	cpu_arm920_suspend_size, 4 * 3
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_arm920_do_suspend)
 	stmfd	sp!, {r4 - r7, lr}
 	mrc	p15, 0, r4, c13, c0, 0	@ PID
diff --git a/arch/arm/mm/proc-arm926.S b/arch/arm/mm/proc-arm926.S
index 6a4bdb2..0ed85d9 100644
--- a/arch/arm/mm/proc-arm926.S
+++ b/arch/arm/mm/proc-arm926.S
@@ -404,7 +404,7 @@
 /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
 .globl	cpu_arm926_suspend_size
 .equ	cpu_arm926_suspend_size, 4 * 3
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_arm926_do_suspend)
 	stmfd	sp!, {r4 - r7, lr}
 	mrc	p15, 0, r4, c13, c0, 0	@ PID
diff --git a/arch/arm/mm/proc-sa1100.S b/arch/arm/mm/proc-sa1100.S
index 74483d1..184a9c9 100644
--- a/arch/arm/mm/proc-sa1100.S
+++ b/arch/arm/mm/proc-sa1100.S
@@ -171,7 +171,7 @@
 
 .globl	cpu_sa1100_suspend_size
 .equ	cpu_sa1100_suspend_size, 4*4
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_sa1100_do_suspend)
 	stmfd	sp!, {r4 - r7, lr}
 	mrc	p15, 0, r4, c3, c0, 0		@ domain ID
diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S
index bfa0c9f..7c99cb4 100644
--- a/arch/arm/mm/proc-v6.S
+++ b/arch/arm/mm/proc-v6.S
@@ -124,7 +124,7 @@
 /* Suspend/resume support: taken from arch/arm/mach-s3c64xx/sleep.S */
 .globl	cpu_v6_suspend_size
 .equ	cpu_v6_suspend_size, 4 * 8
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_v6_do_suspend)
 	stmfd	sp!, {r4 - r11, lr}
 	mrc	p15, 0, r4, c13, c0, 0	@ FCSE/PID
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index c35618e..babfba09 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -211,7 +211,7 @@
 /* Suspend/resume support: derived from arch/arm/mach-s5pv210/sleep.S */
 .globl	cpu_v7_suspend_size
 .equ	cpu_v7_suspend_size, 4 * 8
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_v7_do_suspend)
 	stmfd	sp!, {r4 - r11, lr}
 	mrc	p15, 0, r4, c13, c0, 0	@ FCSE/PID
diff --git a/arch/arm/mm/proc-xsc3.S b/arch/arm/mm/proc-xsc3.S
index 63d8b20..5962136 100644
--- a/arch/arm/mm/proc-xsc3.S
+++ b/arch/arm/mm/proc-xsc3.S
@@ -417,7 +417,7 @@
 
 .globl	cpu_xsc3_suspend_size
 .equ	cpu_xsc3_suspend_size, 4 * 8
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_xsc3_do_suspend)
 	stmfd	sp!, {r4 - r10, lr}
 	mrc	p14, 0, r4, c6, c0, 0	@ clock configuration, for turbo mode
diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
index 086038c..ce233bc 100644
--- a/arch/arm/mm/proc-xscale.S
+++ b/arch/arm/mm/proc-xscale.S
@@ -518,7 +518,7 @@
 
 .globl	cpu_xscale_suspend_size
 .equ	cpu_xscale_suspend_size, 4 * 7
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_xscale_do_suspend)
 	stmfd	sp!, {r4 - r10, lr}
 	mrc	p14, 0, r4, c6, c0, 0	@ clock configuration, for turbo mode
diff --git a/arch/arm/plat-s5p/pm.c b/arch/arm/plat-s5p/pm.c
index d592b63..d15dc47 100644
--- a/arch/arm/plat-s5p/pm.c
+++ b/arch/arm/plat-s5p/pm.c
@@ -19,17 +19,6 @@
 
 #define PFX "s5p pm: "
 
-/* s3c_pm_check_resume_pin
- *
- * check to see if the pin is configured correctly for sleep mode, and
- * make any necessary adjustments if it is not
-*/
-
-static void s3c_pm_check_resume_pin(unsigned int pin, unsigned int irqoffs)
-{
-	/* nothing here yet */
-}
-
 /* s3c_pm_configure_extint
  *
  * configure all external interrupt pins
diff --git a/arch/arm/plat-samsung/pm-check.c b/arch/arm/plat-samsung/pm-check.c
index e4baf76..6b733fa 100644
--- a/arch/arm/plat-samsung/pm-check.c
+++ b/arch/arm/plat-samsung/pm-check.c
@@ -164,7 +164,6 @@
  */
 static u32 *s3c_pm_runcheck(struct resource *res, u32 *val)
 {
-	void *save_at = phys_to_virt(s3c_sleep_save_phys);
 	unsigned long addr;
 	unsigned long left;
 	void *stkpage;
@@ -192,11 +191,6 @@
 			goto skip_check;
 		}
 
-		if (in_region(ptr, left, save_at, 32*4 )) {
-			S3C_PMDBG("skipping %08lx, has save block in\n", addr);
-			goto skip_check;
-		}
-
 		/* calculate and check the checksum */
 
 		calc = crc32_le(~0, ptr, left);
diff --git a/arch/arm/plat-samsung/pm.c b/arch/arm/plat-samsung/pm.c
index d5b58d3..5c0a440 100644
--- a/arch/arm/plat-samsung/pm.c
+++ b/arch/arm/plat-samsung/pm.c
@@ -214,8 +214,9 @@
  *
  * print any IRQs asserted at resume time (ie, we woke from)
 */
-static void s3c_pm_show_resume_irqs(int start, unsigned long which,
-				    unsigned long mask)
+static void __maybe_unused s3c_pm_show_resume_irqs(int start,
+						   unsigned long which,
+						   unsigned long mask)
 {
 	int i;
 
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index bbf3da0..f746950 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -78,6 +78,14 @@
 	put_cpu();
 }
 
+static void vfp_thread_copy(struct thread_info *thread)
+{
+	struct thread_info *parent = current_thread_info();
+
+	vfp_sync_hwstate(parent);
+	thread->vfpstate = parent->vfpstate;
+}
+
 /*
  * When this function is called with the following 'cmd's, the following
  * is true while this function is being run:
@@ -104,12 +112,17 @@
 static int vfp_notifier(struct notifier_block *self, unsigned long cmd, void *v)
 {
 	struct thread_info *thread = v;
+	u32 fpexc;
+#ifdef CONFIG_SMP
+	unsigned int cpu;
+#endif
 
-	if (likely(cmd == THREAD_NOTIFY_SWITCH)) {
-		u32 fpexc = fmrx(FPEXC);
+	switch (cmd) {
+	case THREAD_NOTIFY_SWITCH:
+		fpexc = fmrx(FPEXC);
 
 #ifdef CONFIG_SMP
-		unsigned int cpu = thread->cpu;
+		cpu = thread->cpu;
 
 		/*
 		 * On SMP, if VFP is enabled, save the old state in
@@ -134,13 +147,20 @@
 		 * old state.
 		 */
 		fmxr(FPEXC, fpexc & ~FPEXC_EN);
-		return NOTIFY_DONE;
-	}
+		break;
 
-	if (cmd == THREAD_NOTIFY_FLUSH)
+	case THREAD_NOTIFY_FLUSH:
 		vfp_thread_flush(thread);
-	else
+		break;
+
+	case THREAD_NOTIFY_EXIT:
 		vfp_thread_exit(thread);
+		break;
+
+	case THREAD_NOTIFY_COPY:
+		vfp_thread_copy(thread);
+		break;
+	}
 
 	return NOTIFY_DONE;
 }
diff --git a/arch/avr32/include/asm/setup.h b/arch/avr32/include/asm/setup.h
index ff5b7cf..160543d 100644
--- a/arch/avr32/include/asm/setup.h
+++ b/arch/avr32/include/asm/setup.h
@@ -94,6 +94,13 @@
 
 #define ETH_INVALID_PHY	0xff
 
+/* board information */
+#define ATAG_BOARDINFO	0x54410008
+
+struct tag_boardinfo {
+	u32	board_number;
+};
+
 struct tag {
 	struct tag_header hdr;
 	union {
@@ -102,6 +109,7 @@
 		struct tag_cmdline cmdline;
 		struct tag_clock clock;
 		struct tag_ethernet ethernet;
+		struct tag_boardinfo boardinfo;
 	} u;
 };
 
@@ -128,6 +136,7 @@
 
 extern resource_size_t fbmem_start;
 extern resource_size_t fbmem_size;
+extern u32 board_number;
 
 void setup_processor(void);
 
diff --git a/arch/avr32/kernel/setup.c b/arch/avr32/kernel/setup.c
index 5c70839..bb0974c 100644
--- a/arch/avr32/kernel/setup.c
+++ b/arch/avr32/kernel/setup.c
@@ -391,6 +391,21 @@
 __tagtable(ATAG_CLOCK, parse_tag_clock);
 
 /*
+ * The board_number correspond to the bd->bi_board_number in U-Boot. This
+ * parameter is only available during initialisation and can be used in some
+ * kind of board identification.
+ */
+u32 __initdata board_number;
+
+static int __init parse_tag_boardinfo(struct tag *tag)
+{
+	board_number = tag->u.boardinfo.board_number;
+
+	return 0;
+}
+__tagtable(ATAG_BOARDINFO, parse_tag_boardinfo);
+
+/*
  * Scan the tag table for this tag, and call its parse function. The
  * tag table is built by the linker from all the __tagtable
  * declarations.
diff --git a/arch/avr32/kernel/traps.c b/arch/avr32/kernel/traps.c
index b91b204..7aa2575 100644
--- a/arch/avr32/kernel/traps.c
+++ b/arch/avr32/kernel/traps.c
@@ -95,28 +95,6 @@
 	info.si_code = code;
 	info.si_addr = (void __user *)addr;
 	force_sig_info(signr, &info, current);
-
-	/*
-	 * Init gets no signals that it doesn't have a handler for.
-	 * That's all very well, but if it has caused a synchronous
-	 * exception and we ignore the resulting signal, it will just
-	 * generate the same exception over and over again and we get
-	 * nowhere.  Better to kill it and let the kernel panic.
-	 */
-	if (is_global_init(current)) {
-		__sighandler_t handler;
-
-		spin_lock_irq(&current->sighand->siglock);
-		handler = current->sighand->action[signr-1].sa.sa_handler;
-		spin_unlock_irq(&current->sighand->siglock);
-		if (handler == SIG_DFL) {
-			/* init has generated a synchronous exception
-			   and it doesn't have a handler for the signal */
-			printk(KERN_CRIT "init has generated signal %ld "
-			       "but has no handler for it\n", signr);
-			do_exit(signr);
-		}
-	}
 }
 
 asmlinkage void do_nmi(unsigned long ecr, struct pt_regs *regs)
diff --git a/arch/avr32/mach-at32ap/clock.c b/arch/avr32/mach-at32ap/clock.c
index 442f08c..86925fd 100644
--- a/arch/avr32/mach-at32ap/clock.c
+++ b/arch/avr32/mach-at32ap/clock.c
@@ -35,22 +35,30 @@
 	spin_unlock(&clk_list_lock);
 }
 
+static struct clk *__clk_get(struct device *dev, const char *id)
+{
+	struct clk *clk;
+
+	list_for_each_entry(clk, &at32_clock_list, list) {
+		if (clk->dev == dev && strcmp(id, clk->name) == 0) {
+			return clk;
+		}
+	}
+
+	return ERR_PTR(-ENOENT);
+}
+
 struct clk *clk_get(struct device *dev, const char *id)
 {
 	struct clk *clk;
 
 	spin_lock(&clk_list_lock);
-
-	list_for_each_entry(clk, &at32_clock_list, list) {
-		if (clk->dev == dev && strcmp(id, clk->name) == 0) {
-			spin_unlock(&clk_list_lock);
-			return clk;
-		}
-	}
-
+	clk = __clk_get(dev, id);
 	spin_unlock(&clk_list_lock);
-	return ERR_PTR(-ENOENT);
+
+	return clk;
 }
+
 EXPORT_SYMBOL(clk_get);
 
 void clk_put(struct clk *clk)
@@ -257,15 +265,15 @@
 	spin_lock(&clk_list_lock);
 
 	/* show clock tree as derived from the three oscillators */
-	clk = clk_get(NULL, "osc32k");
+	clk = __clk_get(NULL, "osc32k");
 	dump_clock(clk, &r);
 	clk_put(clk);
 
-	clk = clk_get(NULL, "osc0");
+	clk = __clk_get(NULL, "osc0");
 	dump_clock(clk, &r);
 	clk_put(clk);
 
-	clk = clk_get(NULL, "osc1");
+	clk = __clk_get(NULL, "osc1");
 	dump_clock(clk, &r);
 	clk_put(clk);
 
diff --git a/arch/avr32/mach-at32ap/extint.c b/arch/avr32/mach-at32ap/extint.c
index 47ba4b9..fbc2aea 100644
--- a/arch/avr32/mach-at32ap/extint.c
+++ b/arch/avr32/mach-at32ap/extint.c
@@ -61,34 +61,34 @@
 static struct eic *nmi_eic;
 static bool nmi_enabled;
 
-static void eic_ack_irq(struct irq_chip *d)
+static void eic_ack_irq(struct irq_data *d)
 {
-	struct eic *eic = irq_data_get_irq_chip_data(data);
+	struct eic *eic = irq_data_get_irq_chip_data(d);
 	eic_writel(eic, ICR, 1 << (d->irq - eic->first_irq));
 }
 
-static void eic_mask_irq(struct irq_chip *d)
+static void eic_mask_irq(struct irq_data *d)
 {
-	struct eic *eic = irq_data_get_irq_chip_data(data);
+	struct eic *eic = irq_data_get_irq_chip_data(d);
 	eic_writel(eic, IDR, 1 << (d->irq - eic->first_irq));
 }
 
-static void eic_mask_ack_irq(struct irq_chip *d)
+static void eic_mask_ack_irq(struct irq_data *d)
 {
-	struct eic *eic = irq_data_get_irq_chip_data(data);
+	struct eic *eic = irq_data_get_irq_chip_data(d);
 	eic_writel(eic, ICR, 1 << (d->irq - eic->first_irq));
 	eic_writel(eic, IDR, 1 << (d->irq - eic->first_irq));
 }
 
-static void eic_unmask_irq(struct irq_chip *d)
+static void eic_unmask_irq(struct irq_data *d)
 {
-	struct eic *eic = irq_data_get_irq_chip_data(data);
+	struct eic *eic = irq_data_get_irq_chip_data(d);
 	eic_writel(eic, IER, 1 << (d->irq - eic->first_irq));
 }
 
-static int eic_set_irq_type(struct irq_chip *d, unsigned int flow_type)
+static int eic_set_irq_type(struct irq_data *d, unsigned int flow_type)
 {
-	struct eic *eic = irq_data_get_irq_chip_data(data);
+	struct eic *eic = irq_data_get_irq_chip_data(d);
 	unsigned int irq = d->irq;
 	unsigned int i = irq - eic->first_irq;
 	u32 mode, edge, level;
@@ -191,7 +191,7 @@
 
 	regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	int_irq = platform_get_irq(pdev, 0);
-	if (!regs || !int_irq) {
+	if (!regs || (int)int_irq <= 0) {
 		dev_dbg(&pdev->dev, "missing regs and/or irq resource\n");
 		return -ENXIO;
 	}
diff --git a/arch/avr32/mach-at32ap/pio.c b/arch/avr32/mach-at32ap/pio.c
index f308e1d..2e0aa85 100644
--- a/arch/avr32/mach-at32ap/pio.c
+++ b/arch/avr32/mach-at32ap/pio.c
@@ -257,7 +257,7 @@
 	pio_writel(pio, IDR, 1 << (gpio & 0x1f));
 }
 
-static void gpio_irq_unmask(struct irq_data *d))
+static void gpio_irq_unmask(struct irq_data *d)
 {
 	unsigned		gpio = irq_to_gpio(d->irq);
 	struct pio_device	*pio = &pio_dev[gpio >> 5];
diff --git a/arch/avr32/mach-at32ap/pm-at32ap700x.S b/arch/avr32/mach-at32ap/pm-at32ap700x.S
index 17503b0..f868f4c 100644
--- a/arch/avr32/mach-at32ap/pm-at32ap700x.S
+++ b/arch/avr32/mach-at32ap/pm-at32ap700x.S
@@ -53,7 +53,7 @@
 	st.w	r8[TI_flags], r9
 	unmask_interrupts
 	sleep	CPU_SLEEP_IDLE
-	.size	cpu_idle_sleep, . - cpu_idle_sleep
+	.size	cpu_enter_idle, . - cpu_enter_idle
 
 	/*
 	 * Common return path for PM functions that don't run from
diff --git a/arch/blackfin/include/asm/system.h b/arch/blackfin/include/asm/system.h
index 19e2c7c..44bd0cc 100644
--- a/arch/blackfin/include/asm/system.h
+++ b/arch/blackfin/include/asm/system.h
@@ -19,11 +19,11 @@
  * Force strict CPU ordering.
  */
 #define nop()  __asm__ __volatile__ ("nop;\n\t" : : )
-#define mb()   __asm__ __volatile__ (""   : : : "memory")
-#define rmb()  __asm__ __volatile__ (""   : : : "memory")
-#define wmb()  __asm__ __volatile__ (""   : : : "memory")
-#define set_mb(var, value) do { (void) xchg(&var, value); } while (0)
-#define read_barrier_depends() 		do { } while(0)
+#define smp_mb()  mb()
+#define smp_rmb() rmb()
+#define smp_wmb() wmb()
+#define set_mb(var, value) do { var = value; mb(); } while (0)
+#define smp_read_barrier_depends()	read_barrier_depends()
 
 #ifdef CONFIG_SMP
 asmlinkage unsigned long __raw_xchg_1_asm(volatile void *ptr, unsigned long value);
@@ -37,16 +37,16 @@
 					unsigned long new, unsigned long old);
 
 #ifdef __ARCH_SYNC_CORE_DCACHE
-# define smp_mb()	do { barrier(); smp_check_barrier(); smp_mark_barrier(); } while (0)
-# define smp_rmb()	do { barrier(); smp_check_barrier(); } while (0)
-# define smp_wmb()	do { barrier(); smp_mark_barrier(); } while (0)
-#define smp_read_barrier_depends()	do { barrier(); smp_check_barrier(); } while (0)
-
+/* Force Core data cache coherence */
+# define mb()	do { barrier(); smp_check_barrier(); smp_mark_barrier(); } while (0)
+# define rmb()	do { barrier(); smp_check_barrier(); } while (0)
+# define wmb()	do { barrier(); smp_mark_barrier(); } while (0)
+# define read_barrier_depends()	do { barrier(); smp_check_barrier(); } while (0)
 #else
-# define smp_mb()	barrier()
-# define smp_rmb()	barrier()
-# define smp_wmb()	barrier()
-#define smp_read_barrier_depends()	barrier()
+# define mb()	barrier()
+# define rmb()	barrier()
+# define wmb()	barrier()
+# define read_barrier_depends()	do { } while (0)
 #endif
 
 static inline unsigned long __xchg(unsigned long x, volatile void *ptr,
@@ -99,10 +99,10 @@
 
 #else /* !CONFIG_SMP */
 
-#define smp_mb()	barrier()
-#define smp_rmb()	barrier()
-#define smp_wmb()	barrier()
-#define smp_read_barrier_depends()	do { } while(0)
+#define mb()	barrier()
+#define rmb()	barrier()
+#define wmb()	barrier()
+#define read_barrier_depends()	do { } while (0)
 
 struct __xchg_dummy {
 	unsigned long a[100];
diff --git a/arch/blackfin/kernel/gptimers.c b/arch/blackfin/kernel/gptimers.c
index cdbe075..8b81dc0 100644
--- a/arch/blackfin/kernel/gptimers.c
+++ b/arch/blackfin/kernel/gptimers.c
@@ -268,7 +268,7 @@
 	_disable_gptimers(mask);
 	for (i = 0; i < MAX_BLACKFIN_GPTIMERS; ++i)
 		if (mask & (1 << i))
-			group_regs[BFIN_TIMER_OCTET(i)]->status |= trun_mask[i];
+			group_regs[BFIN_TIMER_OCTET(i)]->status = trun_mask[i];
 	SSYNC();
 }
 EXPORT_SYMBOL(disable_gptimers);
diff --git a/arch/blackfin/kernel/time-ts.c b/arch/blackfin/kernel/time-ts.c
index 8c9a43d..cdb4beb 100644
--- a/arch/blackfin/kernel/time-ts.c
+++ b/arch/blackfin/kernel/time-ts.c
@@ -206,8 +206,14 @@
 {
 	struct clock_event_device *evt = dev_id;
 	smp_mb();
-	evt->event_handler(evt);
+	/*
+	 * We want to ACK before we handle so that we can handle smaller timer
+	 * intervals.  This way if the timer expires again while we're handling
+	 * things, we're more likely to see that 2nd int rather than swallowing
+	 * it by ACKing the int at the end of this handler.
+	 */
 	bfin_gptmr0_ack();
+	evt->event_handler(evt);
 	return IRQ_HANDLED;
 }
 
diff --git a/arch/blackfin/mach-common/smp.c b/arch/blackfin/mach-common/smp.c
index 6e17a26..8bce5ed 100644
--- a/arch/blackfin/mach-common/smp.c
+++ b/arch/blackfin/mach-common/smp.c
@@ -109,10 +109,23 @@
 	struct blackfin_flush_data *fdata = info;
 
 	/* Invalidate the memory holding the bounds of the flushed region. */
-	invalidate_dcache_range((unsigned long)fdata,
-		(unsigned long)fdata + sizeof(*fdata));
+	blackfin_dcache_invalidate_range((unsigned long)fdata,
+					 (unsigned long)fdata + sizeof(*fdata));
 
-	flush_icache_range(fdata->start, fdata->end);
+	/* Make sure all write buffers in the data side of the core
+	 * are flushed before trying to invalidate the icache.  This
+	 * needs to be after the data flush and before the icache
+	 * flush so that the SSYNC does the right thing in preventing
+	 * the instruction prefetcher from hitting things in cached
+	 * memory at the wrong time -- it runs much further ahead than
+	 * the pipeline.
+	 */
+	SSYNC();
+
+	/* ipi_flaush_icache is invoked by generic flush_icache_range,
+	 * so call blackfin arch icache flush directly here.
+	 */
+	blackfin_icache_flush_range(fdata->start, fdata->end);
 }
 
 static void ipi_call_function(unsigned int cpu, struct ipi_message *msg)
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index 26d851d..29e1790 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -343,10 +343,14 @@
 #define __NR_fanotify_init	337
 #define __NR_fanotify_mark	338
 #define __NR_prlimit64		339
+#define __NR_name_to_handle_at	340
+#define __NR_open_by_handle_at	341
+#define __NR_clock_adjtime	342
+#define __NR_syncfs		343
 
 #ifdef __KERNEL__
 
-#define NR_syscalls		340
+#define NR_syscalls		344
 
 #define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
diff --git a/arch/m68k/kernel/entry_mm.S b/arch/m68k/kernel/entry_mm.S
index 1559dea..1359ee6 100644
--- a/arch/m68k/kernel/entry_mm.S
+++ b/arch/m68k/kernel/entry_mm.S
@@ -750,4 +750,8 @@
 	.long sys_fanotify_init
 	.long sys_fanotify_mark
 	.long sys_prlimit64
+	.long sys_name_to_handle_at	/* 340 */
+	.long sys_open_by_handle_at
+	.long sys_clock_adjtime
+	.long sys_syncfs
 
diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S
index 79b1ed1..9b8393d 100644
--- a/arch/m68k/kernel/syscalltable.S
+++ b/arch/m68k/kernel/syscalltable.S
@@ -358,6 +358,10 @@
 	.long sys_fanotify_init
 	.long sys_fanotify_mark
 	.long sys_prlimit64
+	.long sys_name_to_handle_at	/* 340 */
+	.long sys_open_by_handle_at
+	.long sys_clock_adjtime
+	.long sys_syncfs
 
 	.rept NR_syscalls-(.-sys_call_table)/4
 		.long sys_ni_syscall
diff --git a/arch/microblaze/Kconfig b/arch/microblaze/Kconfig
index 851b3bf..eccdefe 100644
--- a/arch/microblaze/Kconfig
+++ b/arch/microblaze/Kconfig
@@ -6,7 +6,6 @@
 	select HAVE_FUNCTION_GRAPH_TRACER
 	select HAVE_DYNAMIC_FTRACE
 	select HAVE_FTRACE_MCOUNT_RECORD
-	select USB_ARCH_HAS_EHCI
 	select ARCH_WANT_OPTIONAL_GPIOLIB
 	select HAVE_OPROFILE
 	select HAVE_ARCH_KGDB
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index b6ff882..8f4d50b 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -209,7 +209,7 @@
 config ARCH_SUSPEND_POSSIBLE
 	def_bool y
 	depends on ADB_PMU || PPC_EFIKA || PPC_LITE5200 || PPC_83xx || \
-		   PPC_85xx || PPC_86xx || PPC_PSERIES || 44x || 40x
+		   (PPC_85xx && !SMP) || PPC_86xx || PPC_PSERIES || 44x || 40x
 
 config PPC_DCR_NATIVE
 	bool
diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
index be3cdf9..1833d1a 100644
--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -382,10 +382,12 @@
 #define CPU_FTRS_E500_2	(CPU_FTR_MAYBE_CAN_DOZE | CPU_FTR_USE_TB | \
 	    CPU_FTR_SPE_COMP | CPU_FTR_MAYBE_CAN_NAP | \
 	    CPU_FTR_NODSISRALIGN | CPU_FTR_NOEXECUTE)
-#define CPU_FTRS_E500MC	(CPU_FTR_MAYBE_CAN_DOZE | CPU_FTR_USE_TB | \
-	    CPU_FTR_MAYBE_CAN_NAP | CPU_FTR_NODSISRALIGN | \
+#define CPU_FTRS_E500MC	(CPU_FTR_USE_TB | CPU_FTR_NODSISRALIGN | \
 	    CPU_FTR_L2CSR | CPU_FTR_LWSYNC | CPU_FTR_NOEXECUTE | \
 	    CPU_FTR_DBELL)
+#define CPU_FTRS_E5500	(CPU_FTR_USE_TB | CPU_FTR_NODSISRALIGN | \
+	    CPU_FTR_L2CSR | CPU_FTR_LWSYNC | CPU_FTR_NOEXECUTE | \
+	    CPU_FTR_DBELL | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD)
 #define CPU_FTRS_GENERIC_32	(CPU_FTR_COMMON | CPU_FTR_NODSISRALIGN)
 
 /* 64-bit CPUs */
@@ -435,11 +437,15 @@
 #define CPU_FTRS_COMPATIBLE	(CPU_FTR_USE_TB | CPU_FTR_PPCAS_ARCH_V2)
 
 #ifdef __powerpc64__
+#ifdef CONFIG_PPC_BOOK3E
+#define CPU_FTRS_POSSIBLE	(CPU_FTRS_E5500)
+#else
 #define CPU_FTRS_POSSIBLE	\
 	    (CPU_FTRS_POWER3 | CPU_FTRS_RS64 | CPU_FTRS_POWER4 |	\
 	    CPU_FTRS_PPC970 | CPU_FTRS_POWER5 | CPU_FTRS_POWER6 |	\
 	    CPU_FTRS_POWER7 | CPU_FTRS_CELL | CPU_FTRS_PA6T |		\
 	    CPU_FTR_1T_SEGMENT | CPU_FTR_VSX)
+#endif
 #else
 enum {
 	CPU_FTRS_POSSIBLE =
@@ -473,16 +479,21 @@
 #endif
 #ifdef CONFIG_E500
 	    CPU_FTRS_E500 | CPU_FTRS_E500_2 | CPU_FTRS_E500MC |
+	    CPU_FTRS_E5500 |
 #endif
 	    0,
 };
 #endif /* __powerpc64__ */
 
 #ifdef __powerpc64__
+#ifdef CONFIG_PPC_BOOK3E
+#define CPU_FTRS_ALWAYS		(CPU_FTRS_E5500)
+#else
 #define CPU_FTRS_ALWAYS		\
 	    (CPU_FTRS_POWER3 & CPU_FTRS_RS64 & CPU_FTRS_POWER4 &	\
 	    CPU_FTRS_PPC970 & CPU_FTRS_POWER5 & CPU_FTRS_POWER6 &	\
 	    CPU_FTRS_POWER7 & CPU_FTRS_CELL & CPU_FTRS_PA6T & CPU_FTRS_POSSIBLE)
+#endif
 #else
 enum {
 	CPU_FTRS_ALWAYS =
@@ -513,6 +524,7 @@
 #endif
 #ifdef CONFIG_E500
 	    CPU_FTRS_E500 & CPU_FTRS_E500_2 & CPU_FTRS_E500MC &
+	    CPU_FTRS_E5500 &
 #endif
 	    CPU_FTRS_POSSIBLE,
 };
diff --git a/arch/powerpc/include/asm/pte-common.h b/arch/powerpc/include/asm/pte-common.h
index 811f04a..8d1569c 100644
--- a/arch/powerpc/include/asm/pte-common.h
+++ b/arch/powerpc/include/asm/pte-common.h
@@ -162,7 +162,7 @@
  * on platforms where such control is possible.
  */
 #if defined(CONFIG_KGDB) || defined(CONFIG_XMON) || defined(CONFIG_BDI_SWITCH) ||\
-	defined(CONFIG_KPROBES)
+	defined(CONFIG_KPROBES) || defined(CONFIG_DYNAMIC_FTRACE)
 #define PAGE_KERNEL_TEXT	PAGE_KERNEL_X
 #else
 #define PAGE_KERNEL_TEXT	PAGE_KERNEL_ROX
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index c9b68d0..b9602ee 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -1973,7 +1973,7 @@
 		.pvr_mask		= 0xffff0000,
 		.pvr_value		= 0x80240000,
 		.cpu_name		= "e5500",
-		.cpu_features		= CPU_FTRS_E500MC,
+		.cpu_features		= CPU_FTRS_E5500,
 		.cpu_user_features	= COMMON_USER_BOOKE,
 		.mmu_features		= MMU_FTR_TYPE_FSL_E | MMU_FTR_BIG_PHYS |
 			MMU_FTR_USE_TLBILX,
diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c
index 3d3d416..5b5e1f0 100644
--- a/arch/powerpc/kernel/crash.c
+++ b/arch/powerpc/kernel/crash.c
@@ -163,7 +163,7 @@
 }
 
 /* wait for all the CPUs to hit real mode but timeout if they don't come in */
-#if defined(CONFIG_PPC_STD_MMU_64) && defined(CONFIG_SMP)
+#ifdef CONFIG_PPC_STD_MMU_64
 static void crash_kexec_wait_realmode(int cpu)
 {
 	unsigned int msecs;
@@ -188,9 +188,7 @@
 	}
 	mb();
 }
-#else
-static inline void crash_kexec_wait_realmode(int cpu) {}
-#endif
+#endif	/* CONFIG_PPC_STD_MMU_64 */
 
 /*
  * This function will be called by secondary cpus or by kexec cpu
@@ -235,7 +233,9 @@
 	crash_ipi_callback(regs);
 }
 
-#else
+#else	/* ! CONFIG_SMP */
+static inline void crash_kexec_wait_realmode(int cpu) {}
+
 static void crash_kexec_prepare_cpus(int cpu)
 {
 	/*
@@ -255,7 +255,7 @@
 {
 	cpus_in_sr = CPU_MASK_NONE;
 }
-#endif
+#endif	/* CONFIG_SMP */
 
 /*
  * Register a function to be called on shutdown.  Only use this if you
diff --git a/arch/powerpc/kernel/ibmebus.c b/arch/powerpc/kernel/ibmebus.c
index c00d4ca..28581f1 100644
--- a/arch/powerpc/kernel/ibmebus.c
+++ b/arch/powerpc/kernel/ibmebus.c
@@ -527,7 +527,7 @@
 
 #endif /* !CONFIG_SUSPEND */
 
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
 
 static int ibmebus_bus_pm_freeze(struct device *dev)
 {
@@ -665,7 +665,7 @@
 	return ret;
 }
 
-#else /* !CONFIG_HIBERNATION */
+#else /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #define ibmebus_bus_pm_freeze		NULL
 #define ibmebus_bus_pm_thaw		NULL
@@ -676,7 +676,7 @@
 #define ibmebus_bus_pm_poweroff_noirq	NULL
 #define ibmebus_bus_pm_restore_noirq	NULL
 
-#endif /* !CONFIG_HIBERNATION */
+#endif /* !CONFIG_HIBERNATE_CALLBACKS */
 
 static struct dev_pm_ops ibmebus_bus_dev_pm_ops = {
 	.prepare = ibmebus_bus_pm_prepare,
diff --git a/arch/powerpc/kernel/legacy_serial.c b/arch/powerpc/kernel/legacy_serial.c
index c834757..2b97b80 100644
--- a/arch/powerpc/kernel/legacy_serial.c
+++ b/arch/powerpc/kernel/legacy_serial.c
@@ -330,9 +330,11 @@
 		if (!parent)
 			continue;
 		if (of_match_node(legacy_serial_parents, parent) != NULL) {
-			index = add_legacy_soc_port(np, np);
-			if (index >= 0 && np == stdout)
-				legacy_serial_console = index;
+			if (of_device_is_available(np)) {
+				index = add_legacy_soc_port(np, np);
+				if (index >= 0 && np == stdout)
+					legacy_serial_console = index;
+			}
 		}
 		of_node_put(parent);
 	}
diff --git a/arch/powerpc/kernel/perf_event.c b/arch/powerpc/kernel/perf_event.c
index c4063b7..822f630 100644
--- a/arch/powerpc/kernel/perf_event.c
+++ b/arch/powerpc/kernel/perf_event.c
@@ -398,6 +398,25 @@
 	return 0;
 }
 
+static u64 check_and_compute_delta(u64 prev, u64 val)
+{
+	u64 delta = (val - prev) & 0xfffffffful;
+
+	/*
+	 * POWER7 can roll back counter values, if the new value is smaller
+	 * than the previous value it will cause the delta and the counter to
+	 * have bogus values unless we rolled a counter over.  If a coutner is
+	 * rolled back, it will be smaller, but within 256, which is the maximum
+	 * number of events to rollback at once.  If we dectect a rollback
+	 * return 0.  This can lead to a small lack of precision in the
+	 * counters.
+	 */
+	if (prev > val && (prev - val) < 256)
+		delta = 0;
+
+	return delta;
+}
+
 static void power_pmu_read(struct perf_event *event)
 {
 	s64 val, delta, prev;
@@ -416,10 +435,11 @@
 		prev = local64_read(&event->hw.prev_count);
 		barrier();
 		val = read_pmc(event->hw.idx);
+		delta = check_and_compute_delta(prev, val);
+		if (!delta)
+			return;
 	} while (local64_cmpxchg(&event->hw.prev_count, prev, val) != prev);
 
-	/* The counters are only 32 bits wide */
-	delta = (val - prev) & 0xfffffffful;
 	local64_add(delta, &event->count);
 	local64_sub(delta, &event->hw.period_left);
 }
@@ -449,8 +469,9 @@
 		val = (event->hw.idx == 5) ? pmc5 : pmc6;
 		prev = local64_read(&event->hw.prev_count);
 		event->hw.idx = 0;
-		delta = (val - prev) & 0xfffffffful;
-		local64_add(delta, &event->count);
+		delta = check_and_compute_delta(prev, val);
+		if (delta)
+			local64_add(delta, &event->count);
 	}
 }
 
@@ -458,14 +479,16 @@
 				  unsigned long pmc5, unsigned long pmc6)
 {
 	struct perf_event *event;
-	u64 val;
+	u64 val, prev;
 	int i;
 
 	for (i = 0; i < cpuhw->n_limited; ++i) {
 		event = cpuhw->limited_counter[i];
 		event->hw.idx = cpuhw->limited_hwidx[i];
 		val = (event->hw.idx == 5) ? pmc5 : pmc6;
-		local64_set(&event->hw.prev_count, val);
+		prev = local64_read(&event->hw.prev_count);
+		if (check_and_compute_delta(prev, val))
+			local64_set(&event->hw.prev_count, val);
 		perf_event_update_userpage(event);
 	}
 }
@@ -1197,7 +1220,7 @@
 
 	/* we don't have to worry about interrupts here */
 	prev = local64_read(&event->hw.prev_count);
-	delta = (val - prev) & 0xfffffffful;
+	delta = check_and_compute_delta(prev, val);
 	local64_add(delta, &event->count);
 
 	/*
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 375480c..f33acfd 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -229,6 +229,9 @@
 	u64 stolen = 0;
 	u64 dtb;
 
+	if (!dtl)
+		return 0;
+
 	if (i == vpa->dtl_idx)
 		return 0;
 	while (i < vpa->dtl_idx) {
diff --git a/arch/powerpc/platforms/powermac/smp.c b/arch/powerpc/platforms/powermac/smp.c
index a830c5e..bc5f0dc 100644
--- a/arch/powerpc/platforms/powermac/smp.c
+++ b/arch/powerpc/platforms/powermac/smp.c
@@ -842,6 +842,7 @@
 	mpic_setup_this_cpu();
 }
 
+#ifdef CONFIG_PPC64
 #ifdef CONFIG_HOTPLUG_CPU
 static int smp_core99_cpu_notify(struct notifier_block *self,
 				 unsigned long action, void *hcpu)
@@ -879,7 +880,6 @@
 
 static void __init smp_core99_bringup_done(void)
 {
-#ifdef CONFIG_PPC64
 	extern void g5_phy_disable_cpu1(void);
 
 	/* Close i2c bus if it was used for tb sync */
@@ -894,14 +894,14 @@
 		set_cpu_present(1, false);
 		g5_phy_disable_cpu1();
 	}
-#endif /* CONFIG_PPC64 */
-
 #ifdef CONFIG_HOTPLUG_CPU
 	register_cpu_notifier(&smp_core99_cpu_nb);
 #endif
+
 	if (ppc_md.progress)
 		ppc_md.progress("smp_core99_bringup_done", 0x349);
 }
+#endif /* CONFIG_PPC64 */
 
 #ifdef CONFIG_HOTPLUG_CPU
 
@@ -975,7 +975,9 @@
 struct smp_ops_t core99_smp_ops = {
 	.message_pass	= smp_mpic_message_pass,
 	.probe		= smp_core99_probe,
+#ifdef CONFIG_PPC64
 	.bringup_done	= smp_core99_bringup_done,
+#endif
 	.kick_cpu	= smp_core99_kick_cpu,
 	.setup_cpu	= smp_core99_setup_cpu,
 	.give_timebase	= smp_core99_give_timebase,
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 0007241..6c42cfd 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -287,14 +287,22 @@
 	int cpu, ret;
 	struct paca_struct *pp;
 	struct dtl_entry *dtl;
+	struct kmem_cache *dtl_cache;
 
 	if (!firmware_has_feature(FW_FEATURE_SPLPAR))
 		return 0;
 
+	dtl_cache = kmem_cache_create("dtl", DISPATCH_LOG_BYTES,
+						DISPATCH_LOG_BYTES, 0, NULL);
+	if (!dtl_cache) {
+		pr_warn("Failed to create dispatch trace log buffer cache\n");
+		pr_warn("Stolen time statistics will be unreliable\n");
+		return 0;
+	}
+
 	for_each_possible_cpu(cpu) {
 		pp = &paca[cpu];
-		dtl = kmalloc_node(DISPATCH_LOG_BYTES, GFP_KERNEL,
-				   cpu_to_node(cpu));
+		dtl = kmem_cache_alloc(dtl_cache, GFP_KERNEL);
 		if (!dtl) {
 			pr_warn("Failed to allocate dispatch trace log for cpu %d\n",
 				cpu);
diff --git a/arch/powerpc/sysdev/fsl_pci.c b/arch/powerpc/sysdev/fsl_pci.c
index f8f7f28..68ca929 100644
--- a/arch/powerpc/sysdev/fsl_pci.c
+++ b/arch/powerpc/sysdev/fsl_pci.c
@@ -324,6 +324,11 @@
 	struct resource rsrc;
 	const int *bus_range;
 
+	if (!of_device_is_available(dev)) {
+		pr_warning("%s: disabled\n", dev->full_name);
+		return -ENODEV;
+	}
+
 	pr_debug("Adding PCI host bridge %s\n", dev->full_name);
 
 	/* Fetch host bridge registers address */
diff --git a/arch/powerpc/sysdev/fsl_rio.c b/arch/powerpc/sysdev/fsl_rio.c
index 14232d5..4979853 100644
--- a/arch/powerpc/sysdev/fsl_rio.c
+++ b/arch/powerpc/sysdev/fsl_rio.c
@@ -1457,7 +1457,6 @@
 	port->ops = ops;
 	port->priv = priv;
 	port->phys_efptr = 0x100;
-	rio_register_mport(port);
 
 	priv->regs_win = ioremap(regs.start, regs.end - regs.start + 1);
 	rio_regs_win = priv->regs_win;
@@ -1504,6 +1503,9 @@
 	dev_info(&dev->dev, "RapidIO Common Transport System size: %d\n",
 			port->sys_size ? 65536 : 256);
 
+	if (rio_register_mport(port))
+		goto err;
+
 	if (port->host_deviceid >= 0)
 		out_be32(priv->regs_win + RIO_GCCSR, RIO_PORT_GEN_HOST |
 			RIO_PORT_GEN_MASTER | RIO_PORT_GEN_DISCOVERED);
diff --git a/arch/um/Kconfig.x86 b/arch/um/Kconfig.x86
index 02fb017..a9da516 100644
--- a/arch/um/Kconfig.x86
+++ b/arch/um/Kconfig.x86
@@ -4,6 +4,10 @@
 
 menu "Host processor type and features"
 
+config CMPXCHG_LOCAL
+	bool
+	default n
+
 source "arch/x86/Kconfig.cpu"
 
 endmenu
diff --git a/arch/um/include/asm/bug.h b/arch/um/include/asm/bug.h
new file mode 100644
index 0000000..9e33b86
--- /dev/null
+++ b/arch/um/include/asm/bug.h
@@ -0,0 +1,6 @@
+#ifndef __UM_BUG_H
+#define __UM_BUG_H
+
+#include <asm-generic/bug.h>
+
+#endif
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index fd5a1f3..3cce714 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -96,11 +96,15 @@
 #define MSR_IA32_MC0_ADDR		0x00000402
 #define MSR_IA32_MC0_MISC		0x00000403
 
+#define MSR_AMD64_MC0_MASK		0xc0010044
+
 #define MSR_IA32_MCx_CTL(x)		(MSR_IA32_MC0_CTL + 4*(x))
 #define MSR_IA32_MCx_STATUS(x)		(MSR_IA32_MC0_STATUS + 4*(x))
 #define MSR_IA32_MCx_ADDR(x)		(MSR_IA32_MC0_ADDR + 4*(x))
 #define MSR_IA32_MCx_MISC(x)		(MSR_IA32_MC0_MISC + 4*(x))
 
+#define MSR_AMD64_MCx_MASK(x)		(MSR_AMD64_MC0_MASK + (x))
+
 /* These are consecutive and not in the normal 4er MCE bank block */
 #define MSR_IA32_MC0_CTL2		0x00000280
 #define MSR_IA32_MCx_CTL2(x)		(MSR_IA32_MC0_CTL2 + (x))
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 3ecece0..3532d3b 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -615,6 +615,25 @@
 	/* As a rule processors have APIC timer running in deep C states */
 	if (c->x86 >= 0xf && !cpu_has_amd_erratum(amd_erratum_400))
 		set_cpu_cap(c, X86_FEATURE_ARAT);
+
+	/*
+	 * Disable GART TLB Walk Errors on Fam10h. We do this here
+	 * because this is always needed when GART is enabled, even in a
+	 * kernel which has no MCE support built in.
+	 */
+	if (c->x86 == 0x10) {
+		/*
+		 * BIOS should disable GartTlbWlk Errors themself. If
+		 * it doesn't do it here as suggested by the BKDG.
+		 *
+		 * Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=33012
+		 */
+		u64 mask;
+
+		rdmsrl(MSR_AMD64_MCx_MASK(4), mask);
+		mask |= (1 << 10);
+		wrmsrl(MSR_AMD64_MCx_MASK(4), mask);
+	}
 }
 
 #ifdef CONFIG_X86_32
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index c2871d3..8ed8908 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -312,6 +312,26 @@
 		identify_secondary_cpu(c);
 }
 
+static void __cpuinit check_cpu_siblings_on_same_node(int cpu1, int cpu2)
+{
+	int node1 = early_cpu_to_node(cpu1);
+	int node2 = early_cpu_to_node(cpu2);
+
+	/*
+	 * Our CPU scheduler assumes all logical cpus in the same physical cpu
+	 * share the same node. But, buggy ACPI or NUMA emulation might assign
+	 * them to different node. Fix it.
+	 */
+	if (node1 != node2) {
+		pr_warning("CPU %d in node %d and CPU %d in node %d are in the same physical CPU. forcing same node %d\n",
+			   cpu1, node1, cpu2, node2, node2);
+
+		numa_remove_cpu(cpu1);
+		numa_set_node(cpu1, node2);
+		numa_add_cpu(cpu1);
+	}
+}
+
 static void __cpuinit link_thread_siblings(int cpu1, int cpu2)
 {
 	cpumask_set_cpu(cpu1, cpu_sibling_mask(cpu2));
@@ -320,6 +340,7 @@
 	cpumask_set_cpu(cpu2, cpu_core_mask(cpu1));
 	cpumask_set_cpu(cpu1, cpu_llc_shared_mask(cpu2));
 	cpumask_set_cpu(cpu2, cpu_llc_shared_mask(cpu1));
+	check_cpu_siblings_on_same_node(cpu1, cpu2);
 }
 
 
@@ -361,10 +382,12 @@
 		    per_cpu(cpu_llc_id, cpu) == per_cpu(cpu_llc_id, i)) {
 			cpumask_set_cpu(i, cpu_llc_shared_mask(cpu));
 			cpumask_set_cpu(cpu, cpu_llc_shared_mask(i));
+			check_cpu_siblings_on_same_node(cpu, i);
 		}
 		if (c->phys_proc_id == cpu_data(i).phys_proc_id) {
 			cpumask_set_cpu(i, cpu_core_mask(cpu));
 			cpumask_set_cpu(cpu, cpu_core_mask(i));
+			check_cpu_siblings_on_same_node(cpu, i);
 			/*
 			 *  Does this new cpu bringup a new core?
 			 */
diff --git a/arch/x86/platform/ce4100/falconfalls.dts b/arch/x86/platform/ce4100/falconfalls.dts
index dc701ea5..2d6d226 100644
--- a/arch/x86/platform/ce4100/falconfalls.dts
+++ b/arch/x86/platform/ce4100/falconfalls.dts
@@ -74,6 +74,7 @@
 				compatible = "intel,ce4100-pci", "pci";
 				device_type = "pci";
 				bus-range = <1 1>;
+				reg = <0x0800 0x0 0x0 0x0 0x0>;
 				ranges = <0x2000000 0 0xdffe0000 0x2000000 0 0xdffe0000 0 0x1000>;
 
 				interrupt-parent = <&ioapic2>;
@@ -412,6 +413,7 @@
 				#address-cells = <2>;
 				#size-cells = <1>;
 				compatible = "isa";
+				reg = <0xf800 0x0 0x0 0x0 0x0>;
 				ranges = <1 0 0 0 0 0x100>;
 
 				rtc@70 {
diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c
index 5c0207b..275dbc1 100644
--- a/arch/x86/platform/mrst/mrst.c
+++ b/arch/x86/platform/mrst/mrst.c
@@ -97,11 +97,11 @@
 			pentry->freq_hz, pentry->irq);
 			if (!pentry->irq)
 				continue;
-			mp_irq.type = MP_IOAPIC;
+			mp_irq.type = MP_INTSRC;
 			mp_irq.irqtype = mp_INT;
 /* triggering mode edge bit 2-3, active high polarity bit 0-1 */
 			mp_irq.irqflag = 5;
-			mp_irq.srcbus = 0;
+			mp_irq.srcbus = MP_BUS_ISA;
 			mp_irq.srcbusirq = pentry->irq;	/* IRQ */
 			mp_irq.dstapic = MP_APIC_ALL;
 			mp_irq.dstirq = pentry->irq;
@@ -168,10 +168,10 @@
 	for (totallen = 0; totallen < sfi_mrtc_num; totallen++, pentry++) {
 		pr_debug("RTC[%d]: paddr = 0x%08x, irq = %d\n",
 			totallen, (u32)pentry->phys_addr, pentry->irq);
-		mp_irq.type = MP_IOAPIC;
+		mp_irq.type = MP_INTSRC;
 		mp_irq.irqtype = mp_INT;
 		mp_irq.irqflag = 0xf;	/* level trigger and active low */
-		mp_irq.srcbus = 0;
+		mp_irq.srcbus = MP_BUS_ISA;
 		mp_irq.srcbusirq = pentry->irq;	/* IRQ */
 		mp_irq.dstapic = MP_APIC_ALL;
 		mp_irq.dstirq = pentry->irq;
@@ -282,7 +282,7 @@
 	/* Avoid searching for BIOS MP tables */
 	x86_init.mpparse.find_smp_config = x86_init_noop;
 	x86_init.mpparse.get_smp_config = x86_init_uint_noop;
-
+	set_bit(MP_BUS_ISA, mp_bus_not_pci);
 }
 
 /*
diff --git a/arch/x86/xen/Kconfig b/arch/x86/xen/Kconfig
index 1c7121ba..5cc821c 100644
--- a/arch/x86/xen/Kconfig
+++ b/arch/x86/xen/Kconfig
@@ -39,6 +39,7 @@
 config XEN_SAVE_RESTORE
        bool
        depends on XEN
+       select HIBERNATE_CALLBACKS
        default y
 
 config XEN_DEBUG_FS
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 49dbd78..e3c6a06 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -238,6 +238,7 @@
 static __init void xen_init_cpuid_mask(void)
 {
 	unsigned int ax, bx, cx, dx;
+	unsigned int xsave_mask;
 
 	cpuid_leaf1_edx_mask =
 		~((1 << X86_FEATURE_MCE)  |  /* disable MCE */
@@ -249,24 +250,16 @@
 		cpuid_leaf1_edx_mask &=
 			~((1 << X86_FEATURE_APIC) |  /* disable local APIC */
 			  (1 << X86_FEATURE_ACPI));  /* disable ACPI */
-
 	ax = 1;
-	cx = 0;
 	xen_cpuid(&ax, &bx, &cx, &dx);
 
-	/* cpuid claims we support xsave; try enabling it to see what happens */
-	if (cx & (1 << (X86_FEATURE_XSAVE % 32))) {
-		unsigned long cr4;
+	xsave_mask =
+		(1 << (X86_FEATURE_XSAVE % 32)) |
+		(1 << (X86_FEATURE_OSXSAVE % 32));
 
-		set_in_cr4(X86_CR4_OSXSAVE);
-		
-		cr4 = read_cr4();
-
-		if ((cr4 & X86_CR4_OSXSAVE) == 0)
-			cpuid_leaf1_ecx_mask &= ~(1 << (X86_FEATURE_XSAVE % 32));
-
-		clear_in_cr4(X86_CR4_OSXSAVE);
-	}
+	/* Xen will set CR4.OSXSAVE if supported and not disabled by force */
+	if ((cx & xsave_mask) != xsave_mask)
+		cpuid_leaf1_ecx_mask &= ~xsave_mask; /* disable XSAVE & OSXSAVE */
 }
 
 static void xen_set_debugreg(int reg, unsigned long val)
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index c82df6c..a991b57 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -565,13 +565,13 @@
 	if (io_page &&
 	    (xen_initial_domain() || addr >= ISA_END_ADDRESS)) {
 		other_addr = pfn_to_mfn(addr >> PAGE_SHIFT) << PAGE_SHIFT;
-		WARN(addr != other_addr,
+		WARN_ONCE(addr != other_addr,
 			"0x%lx is using VM_IO, but it is 0x%lx!\n",
 			(unsigned long)addr, (unsigned long)other_addr);
 	} else {
 		pteval_t iomap_set = (_pte.pte & PTE_FLAGS_MASK) & _PAGE_IOMAP;
 		other_addr = (_pte.pte & PTE_PFN_MASK);
-		WARN((addr == other_addr) && (!io_page) && (!iomap_set),
+		WARN_ONCE((addr == other_addr) && (!io_page) && (!iomap_set),
 			"0x%lx is missing VM_IO (and wasn't fixed)!\n",
 			(unsigned long)addr);
 	}
diff --git a/block/blk-core.c b/block/blk-core.c
index 90f22cc..5fa3dd2 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -198,26 +198,13 @@
 }
 EXPORT_SYMBOL(blk_dump_rq_flags);
 
-/*
- * Make sure that plugs that were pending when this function was entered,
- * are now complete and requests pushed to the queue.
-*/
-static inline void queue_sync_plugs(struct request_queue *q)
-{
-	/*
-	 * If the current process is plugged and has barriers submitted,
-	 * we will livelock if we don't unplug first.
-	 */
-	blk_flush_plug(current);
-}
-
 static void blk_delay_work(struct work_struct *work)
 {
 	struct request_queue *q;
 
 	q = container_of(work, struct request_queue, delay_work.work);
 	spin_lock_irq(q->queue_lock);
-	__blk_run_queue(q, false);
+	__blk_run_queue(q);
 	spin_unlock_irq(q->queue_lock);
 }
 
@@ -233,7 +220,8 @@
  */
 void blk_delay_queue(struct request_queue *q, unsigned long msecs)
 {
-	schedule_delayed_work(&q->delay_work, msecs_to_jiffies(msecs));
+	queue_delayed_work(kblockd_workqueue, &q->delay_work,
+				msecs_to_jiffies(msecs));
 }
 EXPORT_SYMBOL(blk_delay_queue);
 
@@ -251,7 +239,7 @@
 	WARN_ON(!irqs_disabled());
 
 	queue_flag_clear(QUEUE_FLAG_STOPPED, q);
-	__blk_run_queue(q, false);
+	__blk_run_queue(q);
 }
 EXPORT_SYMBOL(blk_start_queue);
 
@@ -298,7 +286,6 @@
 {
 	del_timer_sync(&q->timeout);
 	cancel_delayed_work_sync(&q->delay_work);
-	queue_sync_plugs(q);
 }
 EXPORT_SYMBOL(blk_sync_queue);
 
@@ -310,9 +297,8 @@
  * Description:
  *    See @blk_run_queue. This variant must be called with the queue lock
  *    held and interrupts disabled.
- *
  */
-void __blk_run_queue(struct request_queue *q, bool force_kblockd)
+void __blk_run_queue(struct request_queue *q)
 {
 	if (unlikely(blk_queue_stopped(q)))
 		return;
@@ -321,7 +307,7 @@
 	 * Only recurse once to avoid overrunning the stack, let the unplug
 	 * handling reinvoke the handler shortly if we already got there.
 	 */
-	if (!force_kblockd && !queue_flag_test_and_set(QUEUE_FLAG_REENTER, q)) {
+	if (!queue_flag_test_and_set(QUEUE_FLAG_REENTER, q)) {
 		q->request_fn(q);
 		queue_flag_clear(QUEUE_FLAG_REENTER, q);
 	} else
@@ -330,6 +316,20 @@
 EXPORT_SYMBOL(__blk_run_queue);
 
 /**
+ * blk_run_queue_async - run a single device queue in workqueue context
+ * @q:	The queue to run
+ *
+ * Description:
+ *    Tells kblockd to perform the equivalent of @blk_run_queue on behalf
+ *    of us.
+ */
+void blk_run_queue_async(struct request_queue *q)
+{
+	if (likely(!blk_queue_stopped(q)))
+		queue_delayed_work(kblockd_workqueue, &q->delay_work, 0);
+}
+
+/**
  * blk_run_queue - run a single device queue
  * @q: The queue to run
  *
@@ -342,7 +342,7 @@
 	unsigned long flags;
 
 	spin_lock_irqsave(q->queue_lock, flags);
-	__blk_run_queue(q, false);
+	__blk_run_queue(q);
 	spin_unlock_irqrestore(q->queue_lock, flags);
 }
 EXPORT_SYMBOL(blk_run_queue);
@@ -991,7 +991,7 @@
 		blk_queue_end_tag(q, rq);
 
 	add_acct_request(q, rq, where);
-	__blk_run_queue(q, false);
+	__blk_run_queue(q);
 	spin_unlock_irqrestore(q->queue_lock, flags);
 }
 EXPORT_SYMBOL(blk_insert_request);
@@ -1311,7 +1311,15 @@
 
 	plug = current->plug;
 	if (plug) {
-		if (!plug->should_sort && !list_empty(&plug->list)) {
+		/*
+		 * If this is the first request added after a plug, fire
+		 * of a plug trace. If others have been added before, check
+		 * if we have multiple devices in this plug. If so, make a
+		 * note to sort the list before dispatch.
+		 */
+		if (list_empty(&plug->list))
+			trace_block_plug(q);
+		else if (!plug->should_sort) {
 			struct request *__rq;
 
 			__rq = list_entry_rq(plug->list.prev);
@@ -1327,7 +1335,7 @@
 	} else {
 		spin_lock_irq(q->queue_lock);
 		add_acct_request(q, req, where);
-		__blk_run_queue(q, false);
+		__blk_run_queue(q);
 out_unlock:
 		spin_unlock_irq(q->queue_lock);
 	}
@@ -2644,6 +2652,7 @@
 
 	plug->magic = PLUG_MAGIC;
 	INIT_LIST_HEAD(&plug->list);
+	INIT_LIST_HEAD(&plug->cb_list);
 	plug->should_sort = 0;
 
 	/*
@@ -2668,33 +2677,93 @@
 	return !(rqa->q <= rqb->q);
 }
 
-static void flush_plug_list(struct blk_plug *plug)
+/*
+ * If 'from_schedule' is true, then postpone the dispatch of requests
+ * until a safe kblockd context. We due this to avoid accidental big
+ * additional stack usage in driver dispatch, in places where the originally
+ * plugger did not intend it.
+ */
+static void queue_unplugged(struct request_queue *q, unsigned int depth,
+			    bool from_schedule)
+	__releases(q->queue_lock)
+{
+	trace_block_unplug(q, depth, !from_schedule);
+
+	/*
+	 * If we are punting this to kblockd, then we can safely drop
+	 * the queue_lock before waking kblockd (which needs to take
+	 * this lock).
+	 */
+	if (from_schedule) {
+		spin_unlock(q->queue_lock);
+		blk_run_queue_async(q);
+	} else {
+		__blk_run_queue(q);
+		spin_unlock(q->queue_lock);
+	}
+
+}
+
+static void flush_plug_callbacks(struct blk_plug *plug)
+{
+	LIST_HEAD(callbacks);
+
+	if (list_empty(&plug->cb_list))
+		return;
+
+	list_splice_init(&plug->cb_list, &callbacks);
+
+	while (!list_empty(&callbacks)) {
+		struct blk_plug_cb *cb = list_first_entry(&callbacks,
+							  struct blk_plug_cb,
+							  list);
+		list_del(&cb->list);
+		cb->callback(cb);
+	}
+}
+
+void blk_flush_plug_list(struct blk_plug *plug, bool from_schedule)
 {
 	struct request_queue *q;
 	unsigned long flags;
 	struct request *rq;
+	LIST_HEAD(list);
+	unsigned int depth;
 
 	BUG_ON(plug->magic != PLUG_MAGIC);
 
+	flush_plug_callbacks(plug);
 	if (list_empty(&plug->list))
 		return;
 
-	if (plug->should_sort)
-		list_sort(NULL, &plug->list, plug_rq_cmp);
+	list_splice_init(&plug->list, &list);
+
+	if (plug->should_sort) {
+		list_sort(NULL, &list, plug_rq_cmp);
+		plug->should_sort = 0;
+	}
 
 	q = NULL;
+	depth = 0;
+
+	/*
+	 * Save and disable interrupts here, to avoid doing it for every
+	 * queue lock we have to take.
+	 */
 	local_irq_save(flags);
-	while (!list_empty(&plug->list)) {
-		rq = list_entry_rq(plug->list.next);
+	while (!list_empty(&list)) {
+		rq = list_entry_rq(list.next);
 		list_del_init(&rq->queuelist);
 		BUG_ON(!(rq->cmd_flags & REQ_ON_PLUG));
 		BUG_ON(!rq->q);
 		if (rq->q != q) {
-			if (q) {
-				__blk_run_queue(q, false);
-				spin_unlock(q->queue_lock);
-			}
+			/*
+			 * This drops the queue lock
+			 */
+			if (q)
+				queue_unplugged(q, depth, from_schedule);
 			q = rq->q;
+			depth = 0;
 			spin_lock(q->queue_lock);
 		}
 		rq->cmd_flags &= ~REQ_ON_PLUG;
@@ -2706,39 +2775,29 @@
 			__elv_add_request(q, rq, ELEVATOR_INSERT_FLUSH);
 		else
 			__elv_add_request(q, rq, ELEVATOR_INSERT_SORT_MERGE);
+
+		depth++;
 	}
 
-	if (q) {
-		__blk_run_queue(q, false);
-		spin_unlock(q->queue_lock);
-	}
+	/*
+	 * This drops the queue lock
+	 */
+	if (q)
+		queue_unplugged(q, depth, from_schedule);
 
-	BUG_ON(!list_empty(&plug->list));
 	local_irq_restore(flags);
 }
-
-static void __blk_finish_plug(struct task_struct *tsk, struct blk_plug *plug)
-{
-	flush_plug_list(plug);
-
-	if (plug == tsk->plug)
-		tsk->plug = NULL;
-}
+EXPORT_SYMBOL(blk_flush_plug_list);
 
 void blk_finish_plug(struct blk_plug *plug)
 {
-	if (plug)
-		__blk_finish_plug(current, plug);
+	blk_flush_plug_list(plug, false);
+
+	if (plug == current->plug)
+		current->plug = NULL;
 }
 EXPORT_SYMBOL(blk_finish_plug);
 
-void __blk_flush_plug(struct task_struct *tsk, struct blk_plug *plug)
-{
-	__blk_finish_plug(tsk, plug);
-	tsk->plug = plug;
-}
-EXPORT_SYMBOL(__blk_flush_plug);
-
 int __init blk_dev_init(void)
 {
 	BUILD_BUG_ON(__REQ_NR_BITS > 8 *
diff --git a/block/blk-exec.c b/block/blk-exec.c
index 7482b7f..81e3181 100644
--- a/block/blk-exec.c
+++ b/block/blk-exec.c
@@ -55,7 +55,7 @@
 	WARN_ON(irqs_disabled());
 	spin_lock_irq(q->queue_lock);
 	__elv_add_request(q, rq, where);
-	__blk_run_queue(q, false);
+	__blk_run_queue(q);
 	/* the queue is stopped so it won't be plugged+unplugged */
 	if (rq->cmd_type == REQ_TYPE_PM_RESUME)
 		q->request_fn(q);
diff --git a/block/blk-flush.c b/block/blk-flush.c
index eba4a27..6c9b5e1 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -218,7 +218,7 @@
 	 * request_fn may confuse the driver.  Always use kblockd.
 	 */
 	if (queued)
-		__blk_run_queue(q, true);
+		blk_run_queue_async(q);
 }
 
 /**
@@ -274,7 +274,7 @@
 	 * the comment in flush_end_io().
 	 */
 	if (blk_flush_complete_seq(rq, REQ_FSEQ_DATA, error))
-		__blk_run_queue(q, true);
+		blk_run_queue_async(q);
 }
 
 /**
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 261c75c..6d73512 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -498,7 +498,6 @@
 {
 	int ret;
 	struct device *dev = disk_to_dev(disk);
-
 	struct request_queue *q = disk->queue;
 
 	if (WARN_ON(!q))
@@ -521,7 +520,7 @@
 	if (ret) {
 		kobject_uevent(&q->kobj, KOBJ_REMOVE);
 		kobject_del(&q->kobj);
-		blk_trace_remove_sysfs(disk_to_dev(disk));
+		blk_trace_remove_sysfs(dev);
 		kobject_put(&dev->kobj);
 		return ret;
 	}
diff --git a/block/blk.h b/block/blk.h
index 6126346..c9df8fc 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -22,6 +22,7 @@
 void blk_delete_timer(struct request *);
 void blk_add_timer(struct request *);
 void __generic_unplug_device(struct request_queue *);
+void blk_run_queue_async(struct request_queue *q);
 
 /*
  * Internal atomic flags for request handling
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 3be881e..46b0a1d 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -3368,7 +3368,7 @@
 			    cfqd->busy_queues > 1) {
 				cfq_del_timer(cfqd, cfqq);
 				cfq_clear_cfqq_wait_request(cfqq);
-				__blk_run_queue(cfqd->queue, false);
+				__blk_run_queue(cfqd->queue);
 			} else {
 				cfq_blkiocg_update_idle_time_stats(
 						&cfqq->cfqg->blkg);
@@ -3383,7 +3383,7 @@
 		 * this new queue is RT and the current one is BE
 		 */
 		cfq_preempt_queue(cfqd, cfqq);
-		__blk_run_queue(cfqd->queue, false);
+		__blk_run_queue(cfqd->queue);
 	}
 }
 
@@ -3743,7 +3743,7 @@
 	struct request_queue *q = cfqd->queue;
 
 	spin_lock_irq(q->queue_lock);
-	__blk_run_queue(cfqd->queue, false);
+	__blk_run_queue(cfqd->queue);
 	spin_unlock_irq(q->queue_lock);
 }
 
diff --git a/block/elevator.c b/block/elevator.c
index 0cdb4e7..6f6abc0 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -642,7 +642,7 @@
 	 */
 	elv_drain_elevator(q);
 	while (q->rq.elvpriv) {
-		__blk_run_queue(q, false);
+		__blk_run_queue(q);
 		spin_unlock_irq(q->queue_lock);
 		msleep(10);
 		spin_lock_irq(q->queue_lock);
@@ -695,7 +695,7 @@
 		 *   with anything.  There's no point in delaying queue
 		 *   processing.
 		 */
-		__blk_run_queue(q, false);
+		__blk_run_queue(q);
 		break;
 
 	case ELEVATOR_INSERT_SORT_MERGE:
diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
index 8210405..7025593 100644
--- a/drivers/amba/bus.c
+++ b/drivers/amba/bus.c
@@ -214,7 +214,7 @@
 
 #endif /* !CONFIG_SUSPEND */
 
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
 
 static int amba_pm_freeze(struct device *dev)
 {
@@ -352,7 +352,7 @@
 	return ret;
 }
 
-#else /* !CONFIG_HIBERNATION */
+#else /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #define amba_pm_freeze		NULL
 #define amba_pm_thaw		NULL
@@ -363,7 +363,7 @@
 #define amba_pm_poweroff_noirq	NULL
 #define amba_pm_restore_noirq	NULL
 
-#endif /* !CONFIG_HIBERNATION */
+#endif /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #ifdef CONFIG_PM
 
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index f051cff..9e0e4fc 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -149,6 +149,7 @@
 
 	of_device_node_put(&pa->pdev.dev);
 	kfree(pa->pdev.dev.platform_data);
+	kfree(pa->pdev.mfd_cell);
 	kfree(pa->pdev.resource);
 	kfree(pa);
 }
@@ -771,7 +772,7 @@
 
 #endif /* !CONFIG_SUSPEND */
 
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
 
 static int platform_pm_freeze(struct device *dev)
 {
@@ -909,7 +910,7 @@
 	return ret;
 }
 
-#else /* !CONFIG_HIBERNATION */
+#else /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #define platform_pm_freeze		NULL
 #define platform_pm_thaw		NULL
@@ -920,7 +921,7 @@
 #define platform_pm_poweroff_noirq	NULL
 #define platform_pm_restore_noirq	NULL
 
-#endif /* !CONFIG_HIBERNATION */
+#endif /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #ifdef CONFIG_PM_RUNTIME
 
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 052dc53..fbc5b6e 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -233,7 +233,7 @@
 		}
 		break;
 #endif /* CONFIG_SUSPEND */
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
 	case PM_EVENT_FREEZE:
 	case PM_EVENT_QUIESCE:
 		if (ops->freeze) {
@@ -260,7 +260,7 @@
 			suspend_report_result(ops->restore, error);
 		}
 		break;
-#endif /* CONFIG_HIBERNATION */
+#endif /* CONFIG_HIBERNATE_CALLBACKS */
 	default:
 		error = -EINVAL;
 	}
@@ -308,7 +308,7 @@
 		}
 		break;
 #endif /* CONFIG_SUSPEND */
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
 	case PM_EVENT_FREEZE:
 	case PM_EVENT_QUIESCE:
 		if (ops->freeze_noirq) {
@@ -335,7 +335,7 @@
 			suspend_report_result(ops->restore_noirq, error);
 		}
 		break;
-#endif /* CONFIG_HIBERNATION */
+#endif /* CONFIG_HIBERNATE_CALLBACKS */
 	default:
 		error = -EINVAL;
 	}
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 6b39675..8a78154 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -1448,7 +1448,7 @@
 	{}
 };
 
-static struct of_platform_driver fsldma_of_driver = {
+static struct platform_driver fsldma_of_driver = {
 	.driver = {
 		.name = "fsl-elo-dma",
 		.owner = THIS_MODULE,
diff --git a/drivers/gpio/ml_ioh_gpio.c b/drivers/gpio/ml_ioh_gpio.c
index 7f6f01a..0a775f7 100644
--- a/drivers/gpio/ml_ioh_gpio.c
+++ b/drivers/gpio/ml_ioh_gpio.c
@@ -116,6 +116,7 @@
 		reg_val |= (1 << nr);
 	else
 		reg_val &= ~(1 << nr);
+	iowrite32(reg_val, &chip->reg->regs[chip->ch].po);
 
 	mutex_unlock(&chip->lock);
 
diff --git a/drivers/gpio/pca953x.c b/drivers/gpio/pca953x.c
index 583e925..7630ab7b 100644
--- a/drivers/gpio/pca953x.c
+++ b/drivers/gpio/pca953x.c
@@ -558,7 +558,7 @@
 
 	ret = gpiochip_add(&chip->gpio_chip);
 	if (ret)
-		goto out_failed;
+		goto out_failed_irq;
 
 	if (pdata->setup) {
 		ret = pdata->setup(client, chip->gpio_chip.base,
@@ -570,8 +570,9 @@
 	i2c_set_clientdata(client, chip);
 	return 0;
 
-out_failed:
+out_failed_irq:
 	pca953x_irq_teardown(chip);
+out_failed:
 	kfree(chip->dyn_pdata);
 	kfree(chip);
 	return ret;
diff --git a/drivers/gpio/pch_gpio.c b/drivers/gpio/pch_gpio.c
index 2c6af87..f970a5f 100644
--- a/drivers/gpio/pch_gpio.c
+++ b/drivers/gpio/pch_gpio.c
@@ -105,6 +105,7 @@
 		reg_val |= (1 << nr);
 	else
 		reg_val &= ~(1 << nr);
+	iowrite32(reg_val, &chip->reg->po);
 
 	mutex_unlock(&chip->lock);
 
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index a6feb78c..c58f691 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -96,6 +96,7 @@
 	# i915 depends on ACPI_VIDEO when ACPI is enabled
 	# but for select to work, need to select ACPI_VIDEO's dependencies, ick
 	select BACKLIGHT_CLASS_DEVICE if ACPI
+	select VIDEO_OUTPUT_CONTROL if ACPI
 	select INPUT if ACPI
 	select ACPI_VIDEO if ACPI
 	select ACPI_BUTTON if ACPI
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
index 8314a49..90aef64 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -269,7 +269,7 @@
 	int (*handler)(struct nvbios *, uint16_t, struct init_exec *);
 };
 
-static int parse_init_table(struct nvbios *, unsigned int, struct init_exec *);
+static int parse_init_table(struct nvbios *, uint16_t, struct init_exec *);
 
 #define MACRO_INDEX_SIZE	2
 #define MACRO_SIZE		8
@@ -2011,6 +2011,27 @@
 }
 
 static int
+init_jump(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_JUMP   opcode: 0x5C ('\')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (16 bit): offset (in bios)
+	 *
+	 * Continue execution of init table from 'offset'
+	 */
+
+	uint16_t jmp_offset = ROM16(bios->data[offset + 1]);
+
+	if (!iexec->execute)
+		return 3;
+
+	BIOSLOG(bios, "0x%04X: Jump to 0x%04X\n", offset, jmp_offset);
+	return jmp_offset - offset;
+}
+
+static int
 init_i2c_if(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
 {
 	/*
@@ -3659,6 +3680,7 @@
 	{ "INIT_ZM_REG_SEQUENCE"              , 0x58, init_zm_reg_sequence            },
 	/* INIT_INDIRECT_REG (0x5A, 7, 0, 0) removed due to no example of use */
 	{ "INIT_SUB_DIRECT"                   , 0x5B, init_sub_direct                 },
+	{ "INIT_JUMP"                         , 0x5C, init_jump                       },
 	{ "INIT_I2C_IF"                       , 0x5E, init_i2c_if                     },
 	{ "INIT_COPY_NV_REG"                  , 0x5F, init_copy_nv_reg                },
 	{ "INIT_ZM_INDEX_IO"                  , 0x62, init_zm_index_io                },
@@ -3700,8 +3722,7 @@
 #define MAX_TABLE_OPS 1000
 
 static int
-parse_init_table(struct nvbios *bios, unsigned int offset,
-		 struct init_exec *iexec)
+parse_init_table(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
 {
 	/*
 	 * Parses all commands in an init table.
@@ -6333,6 +6354,32 @@
 		}
 	}
 
+	/* XFX GT-240X-YA
+	 *
+	 * So many things wrong here, replace the entire encoder table..
+	 */
+	if (nv_match_device(dev, 0x0ca3, 0x1682, 0x3003)) {
+		if (idx == 0) {
+			*conn = 0x02001300; /* VGA, connector 1 */
+			*conf = 0x00000028;
+		} else
+		if (idx == 1) {
+			*conn = 0x01010312; /* DVI, connector 0 */
+			*conf = 0x00020030;
+		} else
+		if (idx == 2) {
+			*conn = 0x01010310; /* VGA, connector 0 */
+			*conf = 0x00000028;
+		} else
+		if (idx == 3) {
+			*conn = 0x02022362; /* HDMI, connector 2 */
+			*conf = 0x00020010;
+		} else {
+			*conn = 0x0000000e; /* EOL */
+			*conf = 0x00000000;
+		}
+	}
+
 	return true;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index 57e5302..856d56a 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -1190,7 +1190,7 @@
 extern int  nv50_graph_unload_context(struct drm_device *);
 extern int  nv50_grctx_init(struct nouveau_grctx *);
 extern void nv50_graph_tlb_flush(struct drm_device *dev);
-extern void nv86_graph_tlb_flush(struct drm_device *dev);
+extern void nv84_graph_tlb_flush(struct drm_device *dev);
 extern struct nouveau_enum nv50_data_error_names[];
 
 /* nvc0_graph.c */
diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c b/drivers/gpu/drm/nouveau/nouveau_mem.c
index 2683377..78f467f 100644
--- a/drivers/gpu/drm/nouveau/nouveau_mem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
@@ -552,6 +552,7 @@
 	u8 tRC;		/* Byte 9 */
 	u8 tUNK_10, tUNK_11, tUNK_12, tUNK_13, tUNK_14;
 	u8 tUNK_18, tUNK_19, tUNK_20, tUNK_21;
+	u8 magic_number = 0; /* Yeah... sorry*/
 	u8 *mem = NULL, *entry;
 	int i, recordlen, entries;
 
@@ -596,6 +597,12 @@
 	if (!memtimings->timing)
 		return;
 
+	/* Get "some number" from the timing reg for NV_40
+	 * Used in calculations later */
+	if(dev_priv->card_type == NV_40) {
+		magic_number = (nv_rd32(dev,0x100228) & 0x0f000000) >> 24;
+	}
+
 	entry = mem + mem[1];
 	for (i = 0; i < entries; i++, entry += recordlen) {
 		struct nouveau_pm_memtiming *timing = &pm->memtimings.timing[i];
@@ -635,36 +642,51 @@
 
 		/* XXX: I don't trust the -1's and +1's... they must come
 		 *      from somewhere! */
-		timing->reg_100224 = ((tUNK_0 + tUNK_19 + 1) << 24 |
+		timing->reg_100224 = (tUNK_0 + tUNK_19 + 1 + magic_number) << 24 |
 				      tUNK_18 << 16 |
-				      (tUNK_1 + tUNK_19 + 1) << 8 |
-				      (tUNK_2 - 1));
+				      (tUNK_1 + tUNK_19 + 1 + magic_number) << 8;
+		if(dev_priv->chipset == 0xa8) {
+			timing->reg_100224 |= (tUNK_2 - 1);
+		} else {
+			timing->reg_100224 |= (tUNK_2 + 2 - magic_number);
+		}
 
 		timing->reg_100228 = (tUNK_12 << 16 | tUNK_11 << 8 | tUNK_10);
-		if(recordlen > 19) {
-			timing->reg_100228 += (tUNK_19 - 1) << 24;
-		}/* I cannot back-up this else-statement right now
-			 else {
-			timing->reg_100228 += tUNK_12 << 24;
-		}*/
+		if(dev_priv->chipset >= 0xa3 && dev_priv->chipset < 0xaa) {
+			timing->reg_100228 |= (tUNK_19 - 1) << 24;
+		}
 
-		/* XXX: reg_10022c */
-		timing->reg_10022c = tUNK_2 - 1;
+		if(dev_priv->card_type == NV_40) {
+			/* NV40: don't know what the rest of the regs are..
+			 * And don't need to know either */
+			timing->reg_100228 |= 0x20200000 | magic_number << 24;
+		} else if(dev_priv->card_type >= NV_50) {
+			/* XXX: reg_10022c */
+			timing->reg_10022c = tUNK_2 - 1;
 
-		timing->reg_100230 = (tUNK_20 << 24 | tUNK_21 << 16 |
-				      tUNK_13 << 8  | tUNK_13);
+			timing->reg_100230 = (tUNK_20 << 24 | tUNK_21 << 16 |
+						  tUNK_13 << 8  | tUNK_13);
 
-		/* XXX: +6? */
-		timing->reg_100234 = (tRAS << 24 | (tUNK_19 + 6) << 8 | tRC);
-		timing->reg_100234 += max(tUNK_10,tUNK_11) << 16;
+			timing->reg_100234 = (tRAS << 24 | tRC);
+			timing->reg_100234 += max(tUNK_10,tUNK_11) << 16;
 
-		/* XXX; reg_100238, reg_10023c
-		 * reg: 0x00??????
-		 * reg_10023c:
-		 *      0 for pre-NV50 cards
-		 *      0x????0202 for NV50+ cards (empirical evidence) */
-		if(dev_priv->card_type >= NV_50) {
+			if(dev_priv->chipset < 0xa3) {
+				timing->reg_100234 |= (tUNK_2 + 2) << 8;
+			} else {
+				/* XXX: +6? */
+				timing->reg_100234 |= (tUNK_19 + 6) << 8;
+			}
+
+			/* XXX; reg_100238, reg_10023c
+			 * reg_100238: 0x00??????
+			 * reg_10023c: 0x!!??0202 for NV50+ cards (empirical evidence) */
 			timing->reg_10023c = 0x202;
+			if(dev_priv->chipset < 0xa3) {
+				timing->reg_10023c |= 0x4000000 | (tUNK_2 - 1) << 16;
+			} else {
+				/* currently unknown
+				 * 10023c seen as 06xxxxxx, 0bxxxxxx or 0fxxxxxx */
+			}
 		}
 
 		NV_DEBUG(dev, "Entry %d: 220: %08x %08x %08x %08x\n", i,
@@ -675,7 +697,7 @@
 			 timing->reg_100238, timing->reg_10023c);
 	}
 
-	memtimings->nr_timing  = entries;
+	memtimings->nr_timing = entries;
 	memtimings->supported = true;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_perf.c b/drivers/gpu/drm/nouveau/nouveau_perf.c
index ac62a1b..670e3cb 100644
--- a/drivers/gpu/drm/nouveau/nouveau_perf.c
+++ b/drivers/gpu/drm/nouveau/nouveau_perf.c
@@ -134,7 +134,7 @@
 		case 0x13:
 		case 0x15:
 			perflvl->fanspeed = entry[55];
-			perflvl->voltage = entry[56];
+			perflvl->voltage = (recordlen > 56) ? entry[56] : 0;
 			perflvl->core = ROM32(entry[1]) * 10;
 			perflvl->memory = ROM32(entry[5]) * 20;
 			break;
diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
index 5bb28590..6e2b1a6 100644
--- a/drivers/gpu/drm/nouveau/nouveau_state.c
+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
@@ -376,15 +376,11 @@
 		engine->graph.destroy_context	= nv50_graph_destroy_context;
 		engine->graph.load_context	= nv50_graph_load_context;
 		engine->graph.unload_context	= nv50_graph_unload_context;
-		if (dev_priv->chipset != 0x86)
+		if (dev_priv->chipset == 0x50 ||
+		    dev_priv->chipset == 0xac)
 			engine->graph.tlb_flush	= nv50_graph_tlb_flush;
-		else {
-			/* from what i can see nvidia do this on every
-			 * pre-NVA3 board except NVAC, but, we've only
-			 * ever seen problems on NV86
-			 */
-			engine->graph.tlb_flush	= nv86_graph_tlb_flush;
-		}
+		else
+			engine->graph.tlb_flush	= nv84_graph_tlb_flush;
 		engine->fifo.channels		= 128;
 		engine->fifo.init		= nv50_fifo_init;
 		engine->fifo.takedown		= nv50_fifo_takedown;
diff --git a/drivers/gpu/drm/nouveau/nv04_dfp.c b/drivers/gpu/drm/nouveau/nv04_dfp.c
index c82db37..12098bf 100644
--- a/drivers/gpu/drm/nouveau/nv04_dfp.c
+++ b/drivers/gpu/drm/nouveau/nv04_dfp.c
@@ -581,12 +581,13 @@
 	int head = nv_encoder->restore.head;
 
 	if (nv_encoder->dcb->type == OUTPUT_LVDS) {
-		struct drm_display_mode *native_mode = nouveau_encoder_connector_get(nv_encoder)->native_mode;
-		if (native_mode)
-			call_lvds_script(dev, nv_encoder->dcb, head, LVDS_PANEL_ON,
-					 native_mode->clock);
-		else
-			NV_ERROR(dev, "Not restoring LVDS without native mode\n");
+		struct nouveau_connector *connector =
+			nouveau_encoder_connector_get(nv_encoder);
+
+		if (connector && connector->native_mode)
+			call_lvds_script(dev, nv_encoder->dcb, head,
+					 LVDS_PANEL_ON,
+					 connector->native_mode->clock);
 
 	} else if (nv_encoder->dcb->type == OUTPUT_TMDS) {
 		int clock = nouveau_hw_pllvals_to_clk
diff --git a/drivers/gpu/drm/nouveau/nv50_crtc.c b/drivers/gpu/drm/nouveau/nv50_crtc.c
index 2b99840..a19ccaa 100644
--- a/drivers/gpu/drm/nouveau/nv50_crtc.c
+++ b/drivers/gpu/drm/nouveau/nv50_crtc.c
@@ -469,9 +469,6 @@
 
 	start = ptimer->read(dev);
 	do {
-		nv_wr32(dev, 0x61002c, 0x370);
-		nv_wr32(dev, 0x000140, 1);
-
 		if (nv_ro32(disp->ntfy, 0x000))
 			return 0;
 	} while (ptimer->read(dev) - start < 2000000000ULL);
diff --git a/drivers/gpu/drm/nouveau/nv50_evo.c b/drivers/gpu/drm/nouveau/nv50_evo.c
index a2cfaa6..c8e83c1 100644
--- a/drivers/gpu/drm/nouveau/nv50_evo.c
+++ b/drivers/gpu/drm/nouveau/nv50_evo.c
@@ -186,6 +186,7 @@
 	nv_mask(dev, 0x610028, 0x00000000, 0x00010001 << id);
 
 	evo->dma.max = (4096/4) - 2;
+	evo->dma.max &= ~7;
 	evo->dma.put = 0;
 	evo->dma.cur = evo->dma.put;
 	evo->dma.free = evo->dma.max - evo->dma.cur;
diff --git a/drivers/gpu/drm/nouveau/nv50_graph.c b/drivers/gpu/drm/nouveau/nv50_graph.c
index 8675b00..b02a5b1 100644
--- a/drivers/gpu/drm/nouveau/nv50_graph.c
+++ b/drivers/gpu/drm/nouveau/nv50_graph.c
@@ -503,7 +503,7 @@
 }
 
 void
-nv86_graph_tlb_flush(struct drm_device *dev)
+nv84_graph_tlb_flush(struct drm_device *dev)
 {
 	struct drm_nouveau_private *dev_priv = dev->dev_private;
 	struct nouveau_timer_engine *ptimer = &dev_priv->engine.timer;
diff --git a/drivers/gpu/drm/nouveau/nvc0_vm.c b/drivers/gpu/drm/nouveau/nvc0_vm.c
index 69af0ba..a0a2a02 100644
--- a/drivers/gpu/drm/nouveau/nvc0_vm.c
+++ b/drivers/gpu/drm/nouveau/nvc0_vm.c
@@ -104,20 +104,26 @@
 	struct nouveau_instmem_engine *pinstmem = &dev_priv->engine.instmem;
 	struct drm_device *dev = vm->dev;
 	struct nouveau_vm_pgd *vpgd;
-	u32 r100c80, engine;
+	u32 engine = (dev_priv->chan_vm == vm) ? 1 : 5;
 
 	pinstmem->flush(vm->dev);
 
-	if (vm == dev_priv->chan_vm)
-		engine = 1;
-	else
-		engine = 5;
-
+	spin_lock(&dev_priv->ramin_lock);
 	list_for_each_entry(vpgd, &vm->pgd_list, head) {
-		r100c80 = nv_rd32(dev, 0x100c80);
+		/* looks like maybe a "free flush slots" counter, the
+		 * faster you write to 0x100cbc to more it decreases
+		 */
+		if (!nv_wait_ne(dev, 0x100c80, 0x00ff0000, 0x00000000)) {
+			NV_ERROR(dev, "vm timeout 0: 0x%08x %d\n",
+				 nv_rd32(dev, 0x100c80), engine);
+		}
 		nv_wr32(dev, 0x100cb8, vpgd->obj->vinst >> 8);
 		nv_wr32(dev, 0x100cbc, 0x80000000 | engine);
-		if (!nv_wait(dev, 0x100c80, 0xffffffff, r100c80))
-			NV_ERROR(dev, "vm flush timeout eng %d\n", engine);
+		/* wait for flush to be queued? */
+		if (!nv_wait(dev, 0x100c80, 0x00008000, 0x00008000)) {
+			NV_ERROR(dev, "vm timeout 1: 0x%08x %d\n",
+				 nv_rd32(dev, 0x100c80), engine);
+		}
 	}
+	spin_unlock(&dev_priv->ramin_lock);
 }
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index 258fa5e..d71d375 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -32,6 +32,7 @@
 #include "atom.h"
 #include "atom-names.h"
 #include "atom-bits.h"
+#include "radeon.h"
 
 #define ATOM_COND_ABOVE		0
 #define ATOM_COND_ABOVEOREQUAL	1
@@ -101,7 +102,9 @@
 static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
 				 uint32_t index, uint32_t data)
 {
+	struct radeon_device *rdev = ctx->card->dev->dev_private;
 	uint32_t temp = 0xCDCDCDCD;
+
 	while (1)
 		switch (CU8(base)) {
 		case ATOM_IIO_NOP:
@@ -112,7 +115,8 @@
 			base += 3;
 			break;
 		case ATOM_IIO_WRITE:
-			(void)ctx->card->ioreg_read(ctx->card, CU16(base + 1));
+			if (rdev->family == CHIP_RV515)
+				(void)ctx->card->ioreg_read(ctx->card, CU16(base + 1));
 			ctx->card->ioreg_write(ctx->card, CU16(base + 1), temp);
 			base += 3;
 			break;
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index b41ec59..9d516a8 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -531,6 +531,12 @@
 			pll->flags |= RADEON_PLL_PREFER_HIGH_FB_DIV;
 		else
 			pll->flags |= RADEON_PLL_PREFER_LOW_REF_DIV;
+
+		if ((rdev->family == CHIP_R600) ||
+		    (rdev->family == CHIP_RV610) ||
+		    (rdev->family == CHIP_RV630) ||
+		    (rdev->family == CHIP_RV670))
+			pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
 	} else {
 		pll->flags |= RADEON_PLL_LEGACY;
 
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 0b0cc74..3453910 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -120,11 +120,16 @@
 	struct radeon_power_state *ps = &rdev->pm.power_state[req_ps_idx];
 	struct radeon_voltage *voltage = &ps->clock_info[req_cm_idx].voltage;
 
-	if ((voltage->type == VOLTAGE_SW) && voltage->voltage) {
-		if (voltage->voltage != rdev->pm.current_vddc) {
-			radeon_atom_set_voltage(rdev, voltage->voltage);
+	if (voltage->type == VOLTAGE_SW) {
+		if (voltage->voltage && (voltage->voltage != rdev->pm.current_vddc)) {
+			radeon_atom_set_voltage(rdev, voltage->voltage, SET_VOLTAGE_TYPE_ASIC_VDDC);
 			rdev->pm.current_vddc = voltage->voltage;
-			DRM_DEBUG("Setting: v: %d\n", voltage->voltage);
+			DRM_DEBUG("Setting: vddc: %d\n", voltage->voltage);
+		}
+		if (voltage->vddci && (voltage->vddci != rdev->pm.current_vddci)) {
+			radeon_atom_set_voltage(rdev, voltage->vddci, SET_VOLTAGE_TYPE_ASIC_VDDCI);
+			rdev->pm.current_vddci = voltage->vddci;
+			DRM_DEBUG("Setting: vddci: %d\n", voltage->vddci);
 		}
 	}
 }
@@ -3036,9 +3041,6 @@
 {
 	int r;
 
-	r = radeon_dummy_page_init(rdev);
-	if (r)
-		return r;
 	/* This don't do much */
 	r = radeon_gem_init(rdev);
 	if (r)
@@ -3150,7 +3152,6 @@
 	radeon_atombios_fini(rdev);
 	kfree(rdev->bios);
 	rdev->bios = NULL;
-	radeon_dummy_page_fini(rdev);
 }
 
 static void evergreen_pcie_gen2_enable(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index be271c4..15d5829 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -587,7 +587,7 @@
 
 	if ((voltage->type == VOLTAGE_SW) && voltage->voltage) {
 		if (voltage->voltage != rdev->pm.current_vddc) {
-			radeon_atom_set_voltage(rdev, voltage->voltage);
+			radeon_atom_set_voltage(rdev, voltage->voltage, SET_VOLTAGE_TYPE_ASIC_VDDC);
 			rdev->pm.current_vddc = voltage->voltage;
 			DRM_DEBUG_DRIVER("Setting: v: %d\n", voltage->voltage);
 		}
@@ -2509,9 +2509,6 @@
 {
 	int r;
 
-	r = radeon_dummy_page_init(rdev);
-	if (r)
-		return r;
 	if (r600_debugfs_mc_info_init(rdev)) {
 		DRM_ERROR("Failed to register debugfs file for mc !\n");
 	}
@@ -2625,7 +2622,6 @@
 	radeon_atombios_fini(rdev);
 	kfree(rdev->bios);
 	rdev->bios = NULL;
-	radeon_dummy_page_fini(rdev);
 }
 
 
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 93f5365..ba643b5 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -177,7 +177,7 @@
 void radeon_pm_resume(struct radeon_device *rdev);
 void radeon_combios_get_power_modes(struct radeon_device *rdev);
 void radeon_atombios_get_power_modes(struct radeon_device *rdev);
-void radeon_atom_set_voltage(struct radeon_device *rdev, u16 level);
+void radeon_atom_set_voltage(struct radeon_device *rdev, u16 voltage_level, u8 voltage_type);
 void rs690_pm_info(struct radeon_device *rdev);
 extern int rv6xx_get_temp(struct radeon_device *rdev);
 extern int rv770_get_temp(struct radeon_device *rdev);
@@ -767,7 +767,9 @@
 	u8 vddci_id; /* index into vddci voltage table */
 	bool vddci_enabled;
 	/* r6xx+ sw */
-	u32 voltage;
+	u16 voltage;
+	/* evergreen+ vddci */
+	u16 vddci;
 };
 
 /* clock mode flags */
@@ -835,10 +837,12 @@
 	int                     default_power_state_index;
 	u32                     current_sclk;
 	u32                     current_mclk;
-	u32                     current_vddc;
+	u16                     current_vddc;
+	u16                     current_vddci;
 	u32                     default_sclk;
 	u32                     default_mclk;
-	u32                     default_vddc;
+	u16                     default_vddc;
+	u16                     default_vddci;
 	struct radeon_i2c_chan *i2c_bus;
 	/* selected pm method */
 	enum radeon_pm_method     pm_method;
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index eb888ee..ca57619 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -94,7 +94,7 @@
 		rdev->mc_rreg = &rs600_mc_rreg;
 		rdev->mc_wreg = &rs600_mc_wreg;
 	}
-	if ((rdev->family >= CHIP_R600) && (rdev->family <= CHIP_HEMLOCK)) {
+	if (rdev->family >= CHIP_R600) {
 		rdev->pciep_rreg = &r600_pciep_rreg;
 		rdev->pciep_wreg = &r600_pciep_wreg;
 	}
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 99768d9..f5d12fb 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -2176,24 +2176,27 @@
 	}
 }
 
-static u16 radeon_atombios_get_default_vddc(struct radeon_device *rdev)
+static void radeon_atombios_get_default_voltages(struct radeon_device *rdev,
+						 u16 *vddc, u16 *vddci)
 {
 	struct radeon_mode_info *mode_info = &rdev->mode_info;
 	int index = GetIndexIntoMasterTable(DATA, FirmwareInfo);
 	u8 frev, crev;
 	u16 data_offset;
 	union firmware_info *firmware_info;
-	u16 vddc = 0;
+
+	*vddc = 0;
+	*vddci = 0;
 
 	if (atom_parse_data_header(mode_info->atom_context, index, NULL,
 				   &frev, &crev, &data_offset)) {
 		firmware_info =
 			(union firmware_info *)(mode_info->atom_context->bios +
 						data_offset);
-		vddc = le16_to_cpu(firmware_info->info_14.usBootUpVDDCVoltage);
+		*vddc = le16_to_cpu(firmware_info->info_14.usBootUpVDDCVoltage);
+		if ((frev == 2) && (crev >= 2))
+			*vddci = le16_to_cpu(firmware_info->info_22.usBootUpVDDCIVoltage);
 	}
-
-	return vddc;
 }
 
 static void radeon_atombios_parse_pplib_non_clock_info(struct radeon_device *rdev,
@@ -2203,7 +2206,9 @@
 	int j;
 	u32 misc = le32_to_cpu(non_clock_info->ulCapsAndSettings);
 	u32 misc2 = le16_to_cpu(non_clock_info->usClassification);
-	u16 vddc = radeon_atombios_get_default_vddc(rdev);
+	u16 vddc, vddci;
+
+	radeon_atombios_get_default_voltages(rdev, &vddc, &vddci);
 
 	rdev->pm.power_state[state_index].misc = misc;
 	rdev->pm.power_state[state_index].misc2 = misc2;
@@ -2244,6 +2249,7 @@
 			rdev->pm.default_sclk = rdev->pm.power_state[state_index].clock_info[0].sclk;
 			rdev->pm.default_mclk = rdev->pm.power_state[state_index].clock_info[0].mclk;
 			rdev->pm.default_vddc = rdev->pm.power_state[state_index].clock_info[0].voltage.voltage;
+			rdev->pm.default_vddci = rdev->pm.power_state[state_index].clock_info[0].voltage.vddci;
 		} else {
 			/* patch the table values with the default slck/mclk from firmware info */
 			for (j = 0; j < mode_index; j++) {
@@ -2286,6 +2292,8 @@
 			VOLTAGE_SW;
 		rdev->pm.power_state[state_index].clock_info[mode_index].voltage.voltage =
 			le16_to_cpu(clock_info->evergreen.usVDDC);
+		rdev->pm.power_state[state_index].clock_info[mode_index].voltage.vddci =
+			le16_to_cpu(clock_info->evergreen.usVDDCI);
 	} else {
 		sclk = le16_to_cpu(clock_info->r600.usEngineClockLow);
 		sclk |= clock_info->r600.ucEngineClockHigh << 16;
@@ -2577,25 +2585,25 @@
 	struct _SET_VOLTAGE_PARAMETERS_V2 v2;
 };
 
-void radeon_atom_set_voltage(struct radeon_device *rdev, u16 level)
+void radeon_atom_set_voltage(struct radeon_device *rdev, u16 voltage_level, u8 voltage_type)
 {
 	union set_voltage args;
 	int index = GetIndexIntoMasterTable(COMMAND, SetVoltage);
-	u8 frev, crev, volt_index = level;
+	u8 frev, crev, volt_index = voltage_level;
 
 	if (!atom_parse_cmd_header(rdev->mode_info.atom_context, index, &frev, &crev))
 		return;
 
 	switch (crev) {
 	case 1:
-		args.v1.ucVoltageType = SET_VOLTAGE_TYPE_ASIC_VDDC;
+		args.v1.ucVoltageType = voltage_type;
 		args.v1.ucVoltageMode = SET_ASIC_VOLTAGE_MODE_ALL_SOURCE;
 		args.v1.ucVoltageIndex = volt_index;
 		break;
 	case 2:
-		args.v2.ucVoltageType = SET_VOLTAGE_TYPE_ASIC_VDDC;
+		args.v2.ucVoltageType = voltage_type;
 		args.v2.ucVoltageMode = SET_ASIC_VOLTAGE_MODE_SET_VOLTAGE;
-		args.v2.usVoltageLevel = cpu_to_le16(level);
+		args.v2.usVoltageLevel = cpu_to_le16(voltage_level);
 		break;
 	default:
 		DRM_ERROR("Unknown table version %d, %d\n", frev, crev);
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index 9e59868..bbcd1dd 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -79,7 +79,7 @@
 			scratch_index = R600_WB_EVENT_OFFSET + rdev->fence_drv.scratch_reg - rdev->scratch.reg_base;
 		else
 			scratch_index = RADEON_WB_SCRATCH_OFFSET + rdev->fence_drv.scratch_reg - rdev->scratch.reg_base;
-		seq = rdev->wb.wb[scratch_index/4];
+		seq = le32_to_cpu(rdev->wb.wb[scratch_index/4]);
 	} else
 		seq = RREG32(rdev->fence_drv.scratch_reg);
 	if (seq != rdev->fence_drv.last_seq) {
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index f0534ef..8a955bb 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -285,4 +285,6 @@
 	rdev->gart.pages = NULL;
 	rdev->gart.pages_addr = NULL;
 	rdev->gart.ttm_alloced = NULL;
+
+	radeon_dummy_page_fini(rdev);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_i2c.c b/drivers/gpu/drm/radeon/radeon_i2c.c
index ded2a45..ccbabf7 100644
--- a/drivers/gpu/drm/radeon/radeon_i2c.c
+++ b/drivers/gpu/drm/radeon/radeon_i2c.c
@@ -1062,7 +1062,7 @@
 		*val = in_buf[0];
 		DRM_DEBUG("val = 0x%02x\n", *val);
 	} else {
-		DRM_ERROR("i2c 0x%02x 0x%02x read failed\n",
+		DRM_DEBUG("i2c 0x%02x 0x%02x read failed\n",
 			  addr, *val);
 	}
 }
@@ -1084,7 +1084,7 @@
 	out_buf[1] = val;
 
 	if (i2c_transfer(&i2c_bus->adapter, &msg, 1) != 1)
-		DRM_ERROR("i2c 0x%02x 0x%02x write failed\n",
+		DRM_DEBUG("i2c 0x%02x 0x%02x write failed\n",
 			  addr, val);
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index 5b54268..2f46e0c8 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -269,7 +269,7 @@
 	.disable = radeon_legacy_encoder_disable,
 };
 
-#ifdef CONFIG_BACKLIGHT_CLASS_DEVICE
+#if defined(CONFIG_BACKLIGHT_CLASS_DEVICE) || defined(CONFIG_BACKLIGHT_CLASS_DEVICE_MODULE)
 
 #define MAX_RADEON_LEVEL 0xFF
 
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 08de669..86eda1e 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -23,6 +23,7 @@
 #include "drmP.h"
 #include "radeon.h"
 #include "avivod.h"
+#include "atom.h"
 #ifdef CONFIG_ACPI
 #include <linux/acpi.h>
 #endif
@@ -535,7 +536,11 @@
 	/* set up the default clocks if the MC ucode is loaded */
 	if (ASIC_IS_DCE5(rdev) && rdev->mc_fw) {
 		if (rdev->pm.default_vddc)
-			radeon_atom_set_voltage(rdev, rdev->pm.default_vddc);
+			radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
+						SET_VOLTAGE_TYPE_ASIC_VDDC);
+		if (rdev->pm.default_vddci)
+			radeon_atom_set_voltage(rdev, rdev->pm.default_vddci,
+						SET_VOLTAGE_TYPE_ASIC_VDDCI);
 		if (rdev->pm.default_sclk)
 			radeon_set_engine_clock(rdev, rdev->pm.default_sclk);
 		if (rdev->pm.default_mclk)
@@ -548,6 +553,7 @@
 	rdev->pm.current_sclk = rdev->pm.default_sclk;
 	rdev->pm.current_mclk = rdev->pm.default_mclk;
 	rdev->pm.current_vddc = rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.voltage;
+	rdev->pm.current_vddci = rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.vddci;
 	if (rdev->pm.pm_method == PM_METHOD_DYNPM
 	    && rdev->pm.dynpm_state == DYNPM_STATE_SUSPENDED) {
 		rdev->pm.dynpm_state = DYNPM_STATE_ACTIVE;
@@ -585,7 +591,8 @@
 		/* set up the default clocks if the MC ucode is loaded */
 		if (ASIC_IS_DCE5(rdev) && rdev->mc_fw) {
 			if (rdev->pm.default_vddc)
-				radeon_atom_set_voltage(rdev, rdev->pm.default_vddc);
+				radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
+							SET_VOLTAGE_TYPE_ASIC_VDDC);
 			if (rdev->pm.default_sclk)
 				radeon_set_engine_clock(rdev, rdev->pm.default_sclk);
 			if (rdev->pm.default_mclk)
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index bbc9cd8..c6776e4 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -248,7 +248,7 @@
 void radeon_ring_free_size(struct radeon_device *rdev)
 {
 	if (rdev->wb.enabled)
-		rdev->cp.rptr = rdev->wb.wb[RADEON_WB_CP_RPTR_OFFSET/4];
+		rdev->cp.rptr = le32_to_cpu(rdev->wb.wb[RADEON_WB_CP_RPTR_OFFSET/4]);
 	else {
 		if (rdev->family >= CHIP_R600)
 			rdev->cp.rptr = RREG32(R600_CP_RB_RPTR);
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 876cebc..6e3b11e 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -114,7 +114,7 @@
 				udelay(voltage->delay);
 		}
 	} else if (voltage->type == VOLTAGE_VDDC)
-		radeon_atom_set_voltage(rdev, voltage->vddc_id);
+		radeon_atom_set_voltage(rdev, voltage->vddc_id, SET_VOLTAGE_TYPE_ASIC_VDDC);
 
 	dyn_pwrmgt_sclk_length = RREG32_PLL(DYN_PWRMGT_SCLK_LENGTH);
 	dyn_pwrmgt_sclk_length &= ~REDUCED_POWER_SCLK_HILEN(0xf);
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index b974ac7..ef8a5bab 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -106,7 +106,7 @@
 
 	if ((voltage->type == VOLTAGE_SW) && voltage->voltage) {
 		if (voltage->voltage != rdev->pm.current_vddc) {
-			radeon_atom_set_voltage(rdev, voltage->voltage);
+			radeon_atom_set_voltage(rdev, voltage->voltage, SET_VOLTAGE_TYPE_ASIC_VDDC);
 			rdev->pm.current_vddc = voltage->voltage;
 			DRM_DEBUG("Setting: v: %d\n", voltage->voltage);
 		}
@@ -1255,9 +1255,6 @@
 {
 	int r;
 
-	r = radeon_dummy_page_init(rdev);
-	if (r)
-		return r;
 	/* This don't do much */
 	r = radeon_gem_init(rdev);
 	if (r)
@@ -1372,7 +1369,6 @@
 	radeon_atombios_fini(rdev);
 	kfree(rdev->bios);
 	rdev->bios = NULL;
-	radeon_dummy_page_fini(rdev);
 }
 
 static void rv770_pcie_gen2_enable(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index 737a2a2e..9d9d929 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -683,22 +683,14 @@
 			gfp_flags |= GFP_HIGHUSER;
 
 		for (r = 0; r < count; ++r) {
-			if ((flags & TTM_PAGE_FLAG_DMA32) && dma_address) {
-				void *addr;
-				addr = dma_alloc_coherent(NULL, PAGE_SIZE,
-							  &dma_address[r],
-							  gfp_flags);
-				if (addr == NULL)
-					return -ENOMEM;
-				p = virt_to_page(addr);
-			} else
-				p = alloc_page(gfp_flags);
+			p = alloc_page(gfp_flags);
 			if (!p) {
 
 				printk(KERN_ERR TTM_PFX
 				       "Unable to allocate page.");
 				return -ENOMEM;
 			}
+
 			list_add(&p->lru, pages);
 		}
 		return 0;
@@ -746,24 +738,12 @@
 	unsigned long irq_flags;
 	struct ttm_page_pool *pool = ttm_get_pool(flags, cstate);
 	struct page *p, *tmp;
-	unsigned r;
 
 	if (pool == NULL) {
 		/* No pool for this memory type so free the pages */
 
-		r = page_count-1;
 		list_for_each_entry_safe(p, tmp, pages, lru) {
-			if ((flags & TTM_PAGE_FLAG_DMA32) && dma_address) {
-				void *addr = page_address(p);
-				WARN_ON(!addr || !dma_address[r]);
-				if (addr)
-					dma_free_coherent(NULL, PAGE_SIZE,
-							  addr,
-							  dma_address[r]);
-				dma_address[r] = 0;
-			} else
-				__free_page(p);
-			r--;
+			__free_page(p);
 		}
 		/* Make the pages list empty */
 		INIT_LIST_HEAD(pages);
diff --git a/drivers/gpu/stub/Kconfig b/drivers/gpu/stub/Kconfig
index 70e60a4..4199179 100644
--- a/drivers/gpu/stub/Kconfig
+++ b/drivers/gpu/stub/Kconfig
@@ -5,6 +5,7 @@
 	# Poulsbo stub depends on ACPI_VIDEO when ACPI is enabled
 	# but for select to work, need to select ACPI_VIDEO's dependencies, ick
 	select BACKLIGHT_CLASS_DEVICE if ACPI
+	select VIDEO_OUTPUT_CONTROL if ACPI
 	select INPUT if ACPI
 	select ACPI_VIDEO if ACPI
 	select THERMAL if ACPI
diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c
index 38319a6..d6d5868 100644
--- a/drivers/i2c/algos/i2c-algo-bit.c
+++ b/drivers/i2c/algos/i2c-algo-bit.c
@@ -232,9 +232,17 @@
  * Sanity check for the adapter hardware - check the reaction of
  * the bus lines only if it seems to be idle.
  */
-static int test_bus(struct i2c_algo_bit_data *adap, char *name)
+static int test_bus(struct i2c_adapter *i2c_adap)
 {
-	int scl, sda;
+	struct i2c_algo_bit_data *adap = i2c_adap->algo_data;
+	const char *name = i2c_adap->name;
+	int scl, sda, ret;
+
+	if (adap->pre_xfer) {
+		ret = adap->pre_xfer(i2c_adap);
+		if (ret < 0)
+			return -ENODEV;
+	}
 
 	if (adap->getscl == NULL)
 		pr_info("%s: Testing SDA only, SCL is not readable\n", name);
@@ -297,11 +305,19 @@
 		       "while pulling SCL high!\n", name);
 		goto bailout;
 	}
+
+	if (adap->post_xfer)
+		adap->post_xfer(i2c_adap);
+
 	pr_info("%s: Test OK\n", name);
 	return 0;
 bailout:
 	sdahi(adap);
 	sclhi(adap);
+
+	if (adap->post_xfer)
+		adap->post_xfer(i2c_adap);
+
 	return -ENODEV;
 }
 
@@ -607,7 +623,7 @@
 	int ret;
 
 	if (bit_test) {
-		ret = test_bus(bit_adap, adap->name);
+		ret = test_bus(adap);
 		if (ret < 0)
 			return -ENODEV;
 	}
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 70c30e6..9a58994 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -797,7 +797,8 @@
 
 	/* Let legacy drivers scan this bus for matching devices */
 	if (driver->attach_adapter) {
-		dev_warn(&adap->dev, "attach_adapter method is deprecated\n");
+		dev_warn(&adap->dev, "%s: attach_adapter method is deprecated\n",
+			 driver->driver.name);
 		dev_warn(&adap->dev, "Please use another way to instantiate "
 			 "your i2c_client\n");
 		/* We ignore the return code; if it fails, too bad */
@@ -984,7 +985,8 @@
 
 	if (!driver->detach_adapter)
 		return 0;
-	dev_warn(&adapter->dev, "detach_adapter method is deprecated\n");
+	dev_warn(&adapter->dev, "%s: detach_adapter method is deprecated\n",
+		 driver->driver.name);
 	res = driver->detach_adapter(adapter);
 	if (res)
 		dev_err(&adapter->dev, "detach_adapter failed (%d) "
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 7f42d3a..88d8e4c 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -39,13 +39,13 @@
 };
 
 struct evdev_client {
-	int head;
-	int tail;
+	unsigned int head;
+	unsigned int tail;
 	spinlock_t buffer_lock; /* protects access to buffer, head and tail */
 	struct fasync_struct *fasync;
 	struct evdev *evdev;
 	struct list_head node;
-	int bufsize;
+	unsigned int bufsize;
 	struct input_event buffer[];
 };
 
@@ -55,16 +55,25 @@
 static void evdev_pass_event(struct evdev_client *client,
 			     struct input_event *event)
 {
-	/*
-	 * Interrupts are disabled, just acquire the lock.
-	 * Make sure we don't leave with the client buffer
-	 * "empty" by having client->head == client->tail.
-	 */
+	/* Interrupts are disabled, just acquire the lock. */
 	spin_lock(&client->buffer_lock);
-	do {
-		client->buffer[client->head++] = *event;
-		client->head &= client->bufsize - 1;
-	} while (client->head == client->tail);
+
+	client->buffer[client->head++] = *event;
+	client->head &= client->bufsize - 1;
+
+	if (unlikely(client->head == client->tail)) {
+		/*
+		 * This effectively "drops" all unconsumed events, leaving
+		 * EV_SYN/SYN_DROPPED plus the newest event in the queue.
+		 */
+		client->tail = (client->head - 2) & (client->bufsize - 1);
+
+		client->buffer[client->tail].time = event->time;
+		client->buffer[client->tail].type = EV_SYN;
+		client->buffer[client->tail].code = SYN_DROPPED;
+		client->buffer[client->tail].value = 0;
+	}
+
 	spin_unlock(&client->buffer_lock);
 
 	if (event->type == EV_SYN)
diff --git a/drivers/input/input.c b/drivers/input/input.c
index d6e8bd8..ebbceed 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -1746,6 +1746,42 @@
 }
 EXPORT_SYMBOL(input_set_capability);
 
+static unsigned int input_estimate_events_per_packet(struct input_dev *dev)
+{
+	int mt_slots;
+	int i;
+	unsigned int events;
+
+	if (dev->mtsize) {
+		mt_slots = dev->mtsize;
+	} else if (test_bit(ABS_MT_TRACKING_ID, dev->absbit)) {
+		mt_slots = dev->absinfo[ABS_MT_TRACKING_ID].maximum -
+			   dev->absinfo[ABS_MT_TRACKING_ID].minimum + 1,
+		clamp(mt_slots, 2, 32);
+	} else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
+		mt_slots = 2;
+	} else {
+		mt_slots = 0;
+	}
+
+	events = mt_slots + 1; /* count SYN_MT_REPORT and SYN_REPORT */
+
+	for (i = 0; i < ABS_CNT; i++) {
+		if (test_bit(i, dev->absbit)) {
+			if (input_is_mt_axis(i))
+				events += mt_slots;
+			else
+				events++;
+		}
+	}
+
+	for (i = 0; i < REL_CNT; i++)
+		if (test_bit(i, dev->relbit))
+			events++;
+
+	return events;
+}
+
 #define INPUT_CLEANSE_BITMASK(dev, type, bits)				\
 	do {								\
 		if (!test_bit(EV_##type, dev->evbit))			\
@@ -1793,6 +1829,10 @@
 	/* Make sure that bitmasks not mentioned in dev->evbit are clean. */
 	input_cleanse_bitmasks(dev);
 
+	if (!dev->hint_events_per_packet)
+		dev->hint_events_per_packet =
+				input_estimate_events_per_packet(dev);
+
 	/*
 	 * If delay and period are pre-set by the driver, then autorepeating
 	 * is handled by the driver itself and we don't do it in input.c.
diff --git a/drivers/input/keyboard/twl4030_keypad.c b/drivers/input/keyboard/twl4030_keypad.c
index 09bef79..a26922c 100644
--- a/drivers/input/keyboard/twl4030_keypad.c
+++ b/drivers/input/keyboard/twl4030_keypad.c
@@ -332,18 +332,20 @@
 static int __devinit twl4030_kp_probe(struct platform_device *pdev)
 {
 	struct twl4030_keypad_data *pdata = pdev->dev.platform_data;
-	const struct matrix_keymap_data *keymap_data = pdata->keymap_data;
+	const struct matrix_keymap_data *keymap_data;
 	struct twl4030_keypad *kp;
 	struct input_dev *input;
 	u8 reg;
 	int error;
 
-	if (!pdata || !pdata->rows || !pdata->cols ||
+	if (!pdata || !pdata->rows || !pdata->cols || !pdata->keymap_data ||
 	    pdata->rows > TWL4030_MAX_ROWS || pdata->cols > TWL4030_MAX_COLS) {
 		dev_err(&pdev->dev, "Invalid platform_data\n");
 		return -EINVAL;
 	}
 
+	keymap_data = pdata->keymap_data;
+
 	kp = kzalloc(sizeof(*kp), GFP_KERNEL);
 	input = input_allocate_device();
 	if (!kp || !input) {
diff --git a/drivers/input/misc/xen-kbdfront.c b/drivers/input/misc/xen-kbdfront.c
index 7077f9b..62bae99 100644
--- a/drivers/input/misc/xen-kbdfront.c
+++ b/drivers/input/misc/xen-kbdfront.c
@@ -303,7 +303,7 @@
 				   enum xenbus_state backend_state)
 {
 	struct xenkbd_info *info = dev_get_drvdata(&dev->dev);
-	int val;
+	int ret, val;
 
 	switch (backend_state) {
 	case XenbusStateInitialising:
@@ -316,6 +316,17 @@
 
 	case XenbusStateInitWait:
 InitWait:
+		ret = xenbus_scanf(XBT_NIL, info->xbdev->otherend,
+				   "feature-abs-pointer", "%d", &val);
+		if (ret < 0)
+			val = 0;
+		if (val) {
+			ret = xenbus_printf(XBT_NIL, info->xbdev->nodename,
+					    "request-abs-pointer", "1");
+			if (ret)
+				pr_warning("xenkbd: can't request abs-pointer");
+		}
+
 		xenbus_switch_state(dev, XenbusStateConnected);
 		break;
 
diff --git a/drivers/input/touchscreen/h3600_ts_input.c b/drivers/input/touchscreen/h3600_ts_input.c
index efa0688..45f93d0 100644
--- a/drivers/input/touchscreen/h3600_ts_input.c
+++ b/drivers/input/touchscreen/h3600_ts_input.c
@@ -399,31 +399,34 @@
 			IRQF_SHARED | IRQF_DISABLED, "h3600_action", &ts->dev)) {
 		printk(KERN_ERR "h3600ts.c: Could not allocate Action Button IRQ!\n");
 		err = -EBUSY;
-		goto fail2;
+		goto fail1;
 	}
 
 	if (request_irq(IRQ_GPIO_BITSY_NPOWER_BUTTON, npower_button_handler,
 			IRQF_SHARED | IRQF_DISABLED, "h3600_suspend", &ts->dev)) {
 		printk(KERN_ERR "h3600ts.c: Could not allocate Power Button IRQ!\n");
 		err = -EBUSY;
-		goto fail3;
+		goto fail2;
 	}
 
 	serio_set_drvdata(serio, ts);
 
 	err = serio_open(serio, drv);
 	if (err)
-		return err;
+		goto fail3;
 
 	//h3600_flite_control(1, 25);     /* default brightness */
-	input_register_device(ts->dev);
+	err = input_register_device(ts->dev);
+	if (err)
+		goto fail4;
 
 	return 0;
 
-fail3:	free_irq(IRQ_GPIO_BITSY_NPOWER_BUTTON, ts->dev);
+fail4:	serio_close(serio);
+fail3:	serio_set_drvdata(serio, NULL);
+	free_irq(IRQ_GPIO_BITSY_NPOWER_BUTTON, ts->dev);
 fail2:	free_irq(IRQ_GPIO_BITSY_ACTION_BUTTON, ts->dev);
-fail1:	serio_set_drvdata(serio, NULL);
-	input_free_device(input_dev);
+fail1:	input_free_device(input_dev);
 	kfree(ts);
 	return err;
 }
diff --git a/drivers/leds/leds-regulator.c b/drivers/leds/leds-regulator.c
index 3790816..8497f56 100644
--- a/drivers/leds/leds-regulator.c
+++ b/drivers/leds/leds-regulator.c
@@ -178,6 +178,10 @@
 	led->cdev.flags |= LED_CORE_SUSPENDRESUME;
 	led->vcc = vcc;
 
+	/* to handle correctly an already enabled regulator */
+	if (regulator_is_enabled(led->vcc))
+		led->enabled = 1;
+
 	mutex_init(&led->mutex);
 	INIT_WORK(&led->work, led_work);
 
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 5ef136cd..e5d8904 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -390,13 +390,6 @@
 	return md_raid5_congested(&rs->md, bits);
 }
 
-static void raid_unplug(struct dm_target_callbacks *cb)
-{
-	struct raid_set *rs = container_of(cb, struct raid_set, callbacks);
-
-	md_raid5_kick_device(rs->md.private);
-}
-
 /*
  * Construct a RAID4/5/6 mapping:
  * Args:
@@ -487,7 +480,6 @@
 	}
 
 	rs->callbacks.congested_fn = raid_is_congested;
-	rs->callbacks.unplug_fn = raid_unplug;
 	dm_table_add_target_callbacks(ti->table, &rs->callbacks);
 
 	return 0;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index b12b377..6e853c6 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -447,48 +447,59 @@
 
 /* Support for plugging.
  * This mirrors the plugging support in request_queue, but does not
- * require having a whole queue
+ * require having a whole queue or request structures.
+ * We allocate an md_plug_cb for each md device and each thread it gets
+ * plugged on.  This links tot the private plug_handle structure in the
+ * personality data where we keep a count of the number of outstanding
+ * plugs so other code can see if a plug is active.
  */
-static void plugger_work(struct work_struct *work)
-{
-	struct plug_handle *plug =
-		container_of(work, struct plug_handle, unplug_work);
-	plug->unplug_fn(plug);
-}
-static void plugger_timeout(unsigned long data)
-{
-	struct plug_handle *plug = (void *)data;
-	kblockd_schedule_work(NULL, &plug->unplug_work);
-}
-void plugger_init(struct plug_handle *plug,
-		  void (*unplug_fn)(struct plug_handle *))
-{
-	plug->unplug_flag = 0;
-	plug->unplug_fn = unplug_fn;
-	init_timer(&plug->unplug_timer);
-	plug->unplug_timer.function = plugger_timeout;
-	plug->unplug_timer.data = (unsigned long)plug;
-	INIT_WORK(&plug->unplug_work, plugger_work);
-}
-EXPORT_SYMBOL_GPL(plugger_init);
+struct md_plug_cb {
+	struct blk_plug_cb cb;
+	mddev_t *mddev;
+};
 
-void plugger_set_plug(struct plug_handle *plug)
+static void plugger_unplug(struct blk_plug_cb *cb)
 {
-	if (!test_and_set_bit(PLUGGED_FLAG, &plug->unplug_flag))
-		mod_timer(&plug->unplug_timer, jiffies + msecs_to_jiffies(3)+1);
+	struct md_plug_cb *mdcb = container_of(cb, struct md_plug_cb, cb);
+	if (atomic_dec_and_test(&mdcb->mddev->plug_cnt))
+		md_wakeup_thread(mdcb->mddev->thread);
+	kfree(mdcb);
 }
-EXPORT_SYMBOL_GPL(plugger_set_plug);
 
-int plugger_remove_plug(struct plug_handle *plug)
+/* Check that an unplug wakeup will come shortly.
+ * If not, wakeup the md thread immediately
+ */
+int mddev_check_plugged(mddev_t *mddev)
 {
-	if (test_and_clear_bit(PLUGGED_FLAG, &plug->unplug_flag)) {
-		del_timer(&plug->unplug_timer);
-		return 1;
-	} else
+	struct blk_plug *plug = current->plug;
+	struct md_plug_cb *mdcb;
+
+	if (!plug)
 		return 0;
-}
-EXPORT_SYMBOL_GPL(plugger_remove_plug);
 
+	list_for_each_entry(mdcb, &plug->cb_list, cb.list) {
+		if (mdcb->cb.callback == plugger_unplug &&
+		    mdcb->mddev == mddev) {
+			/* Already on the list, move to top */
+			if (mdcb != list_first_entry(&plug->cb_list,
+						    struct md_plug_cb,
+						    cb.list))
+				list_move(&mdcb->cb.list, &plug->cb_list);
+			return 1;
+		}
+	}
+	/* Not currently on the callback list */
+	mdcb = kmalloc(sizeof(*mdcb), GFP_ATOMIC);
+	if (!mdcb)
+		return 0;
+
+	mdcb->mddev = mddev;
+	mdcb->cb.callback = plugger_unplug;
+	atomic_inc(&mddev->plug_cnt);
+	list_add(&mdcb->cb.list, &plug->cb_list);
+	return 1;
+}
+EXPORT_SYMBOL_GPL(mddev_check_plugged);
 
 static inline mddev_t *mddev_get(mddev_t *mddev)
 {
@@ -538,6 +549,7 @@
 	atomic_set(&mddev->active, 1);
 	atomic_set(&mddev->openers, 0);
 	atomic_set(&mddev->active_io, 0);
+	atomic_set(&mddev->plug_cnt, 0);
 	spin_lock_init(&mddev->write_lock);
 	atomic_set(&mddev->flush_pending, 0);
 	init_waitqueue_head(&mddev->sb_wait);
@@ -4723,7 +4735,6 @@
 	mddev->bitmap_info.chunksize = 0;
 	mddev->bitmap_info.daemon_sleep = 0;
 	mddev->bitmap_info.max_write_behind = 0;
-	mddev->plug = NULL;
 }
 
 static void __md_stop_writes(mddev_t *mddev)
@@ -6688,12 +6699,6 @@
 }
 EXPORT_SYMBOL_GPL(md_allow_write);
 
-void md_unplug(mddev_t *mddev)
-{
-	if (mddev->plug)
-		mddev->plug->unplug_fn(mddev->plug);
-}
-
 #define SYNC_MARKS	10
 #define	SYNC_MARK_STEP	(3*HZ)
 void md_do_sync(mddev_t *mddev)
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 52b4073..0b1fd3f 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -29,26 +29,6 @@
 typedef struct mddev_s mddev_t;
 typedef struct mdk_rdev_s mdk_rdev_t;
 
-/* generic plugging support - like that provided with request_queue,
- * but does not require a request_queue
- */
-struct plug_handle {
-	void			(*unplug_fn)(struct plug_handle *);
-	struct timer_list	unplug_timer;
-	struct work_struct	unplug_work;
-	unsigned long		unplug_flag;
-};
-#define	PLUGGED_FLAG 1
-void plugger_init(struct plug_handle *plug,
-		  void (*unplug_fn)(struct plug_handle *));
-void plugger_set_plug(struct plug_handle *plug);
-int plugger_remove_plug(struct plug_handle *plug);
-static inline void plugger_flush(struct plug_handle *plug)
-{
-	del_timer_sync(&plug->unplug_timer);
-	cancel_work_sync(&plug->unplug_work);
-}
-
 /*
  * MD's 'extended' device
  */
@@ -199,6 +179,9 @@
 	int				delta_disks, new_level, new_layout;
 	int				new_chunk_sectors;
 
+	atomic_t			plug_cnt;	/* If device is expecting
+							 * more bios soon.
+							 */
 	struct mdk_thread_s		*thread;	/* management thread */
 	struct mdk_thread_s		*sync_thread;	/* doing resync or reconstruct */
 	sector_t			curr_resync;	/* last block scheduled */
@@ -336,7 +319,6 @@
 	struct list_head		all_mddevs;
 
 	struct attribute_group		*to_remove;
-	struct plug_handle		*plug; /* if used by personality */
 
 	struct bio_set			*bio_set;
 
@@ -516,7 +498,6 @@
 extern void md_integrity_add_rdev(mdk_rdev_t *rdev, mddev_t *mddev);
 extern int strict_strtoul_scaled(const char *cp, unsigned long *res, int scale);
 extern void restore_bitmap_write_access(struct file *file);
-extern void md_unplug(mddev_t *mddev);
 
 extern void mddev_init(mddev_t *mddev);
 extern int md_run(mddev_t *mddev);
@@ -530,4 +511,5 @@
 				   mddev_t *mddev);
 extern struct bio *bio_alloc_mddev(gfp_t gfp_mask, int nr_iovecs,
 				   mddev_t *mddev);
+extern int mddev_check_plugged(mddev_t *mddev);
 #endif /* _MD_MD_H */
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index c2a21ae5..2b7a7ff 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -565,12 +565,6 @@
 		spin_unlock_irq(&conf->device_lock);
 }
 
-static void md_kick_device(mddev_t *mddev)
-{
-	blk_flush_plug(current);
-	md_wakeup_thread(mddev->thread);
-}
-
 /* Barriers....
  * Sometimes we need to suspend IO while we do something else,
  * either some resync/recovery, or reconfigure the array.
@@ -600,7 +594,7 @@
 
 	/* Wait until no block IO is waiting */
 	wait_event_lock_irq(conf->wait_barrier, !conf->nr_waiting,
-			    conf->resync_lock, md_kick_device(conf->mddev));
+			    conf->resync_lock, );
 
 	/* block any new IO from starting */
 	conf->barrier++;
@@ -608,7 +602,7 @@
 	/* Now wait for all pending IO to complete */
 	wait_event_lock_irq(conf->wait_barrier,
 			    !conf->nr_pending && conf->barrier < RESYNC_DEPTH,
-			    conf->resync_lock, md_kick_device(conf->mddev));
+			    conf->resync_lock, );
 
 	spin_unlock_irq(&conf->resync_lock);
 }
@@ -630,7 +624,7 @@
 		conf->nr_waiting++;
 		wait_event_lock_irq(conf->wait_barrier, !conf->barrier,
 				    conf->resync_lock,
-				    md_kick_device(conf->mddev));
+				    );
 		conf->nr_waiting--;
 	}
 	conf->nr_pending++;
@@ -666,8 +660,7 @@
 	wait_event_lock_irq(conf->wait_barrier,
 			    conf->nr_pending == conf->nr_queued+1,
 			    conf->resync_lock,
-			    ({ flush_pending_writes(conf);
-			       md_kick_device(conf->mddev); }));
+			    flush_pending_writes(conf));
 	spin_unlock_irq(&conf->resync_lock);
 }
 static void unfreeze_array(conf_t *conf)
@@ -729,6 +722,7 @@
 	const unsigned long do_sync = (bio->bi_rw & REQ_SYNC);
 	const unsigned long do_flush_fua = (bio->bi_rw & (REQ_FLUSH | REQ_FUA));
 	mdk_rdev_t *blocked_rdev;
+	int plugged;
 
 	/*
 	 * Register the new request and wait if the reconstruction
@@ -820,6 +814,8 @@
 	 * inc refcount on their rdev.  Record them by setting
 	 * bios[x] to bio
 	 */
+	plugged = mddev_check_plugged(mddev);
+
 	disks = conf->raid_disks;
  retry_write:
 	blocked_rdev = NULL;
@@ -925,7 +921,7 @@
 	/* In case raid1d snuck in to freeze_array */
 	wake_up(&conf->wait_barrier);
 
-	if (do_sync || !bitmap)
+	if (do_sync || !bitmap || !plugged)
 		md_wakeup_thread(mddev->thread);
 
 	return 0;
@@ -1516,13 +1512,16 @@
 	conf_t *conf = mddev->private;
 	struct list_head *head = &conf->retry_list;
 	mdk_rdev_t *rdev;
+	struct blk_plug plug;
 
 	md_check_recovery(mddev);
-	
+
+	blk_start_plug(&plug);
 	for (;;) {
 		char b[BDEVNAME_SIZE];
 
-		flush_pending_writes(conf);
+		if (atomic_read(&mddev->plug_cnt) == 0)
+			flush_pending_writes(conf);
 
 		spin_lock_irqsave(&conf->device_lock, flags);
 		if (list_empty(head)) {
@@ -1593,6 +1592,7 @@
 		}
 		cond_resched();
 	}
+	blk_finish_plug(&plug);
 }
 
 
@@ -2039,7 +2039,6 @@
 
 	md_unregister_thread(mddev->thread);
 	mddev->thread = NULL;
-	blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
 	if (conf->r1bio_pool)
 		mempool_destroy(conf->r1bio_pool);
 	kfree(conf->mirrors);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 2da83d5..8e94626 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -634,12 +634,6 @@
 		spin_unlock_irq(&conf->device_lock);
 }
 
-static void md_kick_device(mddev_t *mddev)
-{
-	blk_flush_plug(current);
-	md_wakeup_thread(mddev->thread);
-}
-
 /* Barriers....
  * Sometimes we need to suspend IO while we do something else,
  * either some resync/recovery, or reconfigure the array.
@@ -669,15 +663,15 @@
 
 	/* Wait until no block IO is waiting (unless 'force') */
 	wait_event_lock_irq(conf->wait_barrier, force || !conf->nr_waiting,
-			    conf->resync_lock, md_kick_device(conf->mddev));
+			    conf->resync_lock, );
 
 	/* block any new IO from starting */
 	conf->barrier++;
 
-	/* No wait for all pending IO to complete */
+	/* Now wait for all pending IO to complete */
 	wait_event_lock_irq(conf->wait_barrier,
 			    !conf->nr_pending && conf->barrier < RESYNC_DEPTH,
-			    conf->resync_lock, md_kick_device(conf->mddev));
+			    conf->resync_lock, );
 
 	spin_unlock_irq(&conf->resync_lock);
 }
@@ -698,7 +692,7 @@
 		conf->nr_waiting++;
 		wait_event_lock_irq(conf->wait_barrier, !conf->barrier,
 				    conf->resync_lock,
-				    md_kick_device(conf->mddev));
+				    );
 		conf->nr_waiting--;
 	}
 	conf->nr_pending++;
@@ -734,8 +728,8 @@
 	wait_event_lock_irq(conf->wait_barrier,
 			    conf->nr_pending == conf->nr_queued+1,
 			    conf->resync_lock,
-			    ({ flush_pending_writes(conf);
-			       md_kick_device(conf->mddev); }));
+			    flush_pending_writes(conf));
+
 	spin_unlock_irq(&conf->resync_lock);
 }
 
@@ -762,6 +756,7 @@
 	const unsigned long do_fua = (bio->bi_rw & REQ_FUA);
 	unsigned long flags;
 	mdk_rdev_t *blocked_rdev;
+	int plugged;
 
 	if (unlikely(bio->bi_rw & REQ_FLUSH)) {
 		md_flush_request(mddev, bio);
@@ -870,6 +865,8 @@
 	 * inc refcount on their rdev.  Record them by setting
 	 * bios[x] to bio
 	 */
+	plugged = mddev_check_plugged(mddev);
+
 	raid10_find_phys(conf, r10_bio);
  retry_write:
 	blocked_rdev = NULL;
@@ -946,9 +943,8 @@
 	/* In case raid10d snuck in to freeze_array */
 	wake_up(&conf->wait_barrier);
 
-	if (do_sync || !mddev->bitmap)
+	if (do_sync || !mddev->bitmap || !plugged)
 		md_wakeup_thread(mddev->thread);
-
 	return 0;
 }
 
@@ -1640,9 +1636,11 @@
 	conf_t *conf = mddev->private;
 	struct list_head *head = &conf->retry_list;
 	mdk_rdev_t *rdev;
+	struct blk_plug plug;
 
 	md_check_recovery(mddev);
 
+	blk_start_plug(&plug);
 	for (;;) {
 		char b[BDEVNAME_SIZE];
 
@@ -1716,6 +1714,7 @@
 		}
 		cond_resched();
 	}
+	blk_finish_plug(&plug);
 }
 
 
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index e867ee4..f301e6a 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -27,12 +27,12 @@
  *
  * We group bitmap updates into batches.  Each batch has a number.
  * We may write out several batches at once, but that isn't very important.
- * conf->bm_write is the number of the last batch successfully written.
- * conf->bm_flush is the number of the last batch that was closed to
+ * conf->seq_write is the number of the last batch successfully written.
+ * conf->seq_flush is the number of the last batch that was closed to
  *    new additions.
  * When we discover that we will need to write to any block in a stripe
  * (in add_stripe_bio) we update the in-memory bitmap and record in sh->bm_seq
- * the number of the batch it will be in. This is bm_flush+1.
+ * the number of the batch it will be in. This is seq_flush+1.
  * When we are ready to do a write, if that batch hasn't been written yet,
  *   we plug the array and queue the stripe for later.
  * When an unplug happens, we increment bm_flush, thus closing the current
@@ -199,14 +199,12 @@
 		BUG_ON(!list_empty(&sh->lru));
 		BUG_ON(atomic_read(&conf->active_stripes)==0);
 		if (test_bit(STRIPE_HANDLE, &sh->state)) {
-			if (test_bit(STRIPE_DELAYED, &sh->state)) {
+			if (test_bit(STRIPE_DELAYED, &sh->state))
 				list_add_tail(&sh->lru, &conf->delayed_list);
-				plugger_set_plug(&conf->plug);
-			} else if (test_bit(STRIPE_BIT_DELAY, &sh->state) &&
-				   sh->bm_seq - conf->seq_write > 0) {
+			else if (test_bit(STRIPE_BIT_DELAY, &sh->state) &&
+				   sh->bm_seq - conf->seq_write > 0)
 				list_add_tail(&sh->lru, &conf->bitmap_list);
-				plugger_set_plug(&conf->plug);
-			} else {
+			else {
 				clear_bit(STRIPE_BIT_DELAY, &sh->state);
 				list_add_tail(&sh->lru, &conf->handle_list);
 			}
@@ -461,7 +459,7 @@
 						     < (conf->max_nr_stripes *3/4)
 						     || !conf->inactive_blocked),
 						    conf->device_lock,
-						    md_raid5_kick_device(conf));
+						    );
 				conf->inactive_blocked = 0;
 			} else
 				init_stripe(sh, sector, previous);
@@ -1470,7 +1468,7 @@
 		wait_event_lock_irq(conf->wait_for_stripe,
 				    !list_empty(&conf->inactive_list),
 				    conf->device_lock,
-				    blk_flush_plug(current));
+				    );
 		osh = get_free_stripe(conf);
 		spin_unlock_irq(&conf->device_lock);
 		atomic_set(&nsh->count, 1);
@@ -3623,8 +3621,7 @@
 				atomic_inc(&conf->preread_active_stripes);
 			list_add_tail(&sh->lru, &conf->hold_list);
 		}
-	} else
-		plugger_set_plug(&conf->plug);
+	}
 }
 
 static void activate_bit_delay(raid5_conf_t *conf)
@@ -3641,21 +3638,6 @@
 	}
 }
 
-void md_raid5_kick_device(raid5_conf_t *conf)
-{
-	blk_flush_plug(current);
-	raid5_activate_delayed(conf);
-	md_wakeup_thread(conf->mddev->thread);
-}
-EXPORT_SYMBOL_GPL(md_raid5_kick_device);
-
-static void raid5_unplug(struct plug_handle *plug)
-{
-	raid5_conf_t *conf = container_of(plug, raid5_conf_t, plug);
-
-	md_raid5_kick_device(conf);
-}
-
 int md_raid5_congested(mddev_t *mddev, int bits)
 {
 	raid5_conf_t *conf = mddev->private;
@@ -3945,6 +3927,7 @@
 	struct stripe_head *sh;
 	const int rw = bio_data_dir(bi);
 	int remaining;
+	int plugged;
 
 	if (unlikely(bi->bi_rw & REQ_FLUSH)) {
 		md_flush_request(mddev, bi);
@@ -3963,6 +3946,7 @@
 	bi->bi_next = NULL;
 	bi->bi_phys_segments = 1;	/* over-loaded to count active stripes */
 
+	plugged = mddev_check_plugged(mddev);
 	for (;logical_sector < last_sector; logical_sector += STRIPE_SECTORS) {
 		DEFINE_WAIT(w);
 		int disks, data_disks;
@@ -4057,7 +4041,7 @@
 				 * add failed due to overlap.  Flush everything
 				 * and wait a while
 				 */
-				md_raid5_kick_device(conf);
+				md_wakeup_thread(mddev->thread);
 				release_stripe(sh);
 				schedule();
 				goto retry;
@@ -4077,6 +4061,9 @@
 		}
 			
 	}
+	if (!plugged)
+		md_wakeup_thread(mddev->thread);
+
 	spin_lock_irq(&conf->device_lock);
 	remaining = raid5_dec_bi_phys_segments(bi);
 	spin_unlock_irq(&conf->device_lock);
@@ -4478,24 +4465,30 @@
 	struct stripe_head *sh;
 	raid5_conf_t *conf = mddev->private;
 	int handled;
+	struct blk_plug plug;
 
 	pr_debug("+++ raid5d active\n");
 
 	md_check_recovery(mddev);
 
+	blk_start_plug(&plug);
 	handled = 0;
 	spin_lock_irq(&conf->device_lock);
 	while (1) {
 		struct bio *bio;
 
-		if (conf->seq_flush != conf->seq_write) {
-			int seq = conf->seq_flush;
+		if (atomic_read(&mddev->plug_cnt) == 0 &&
+		    !list_empty(&conf->bitmap_list)) {
+			/* Now is a good time to flush some bitmap updates */
+			conf->seq_flush++;
 			spin_unlock_irq(&conf->device_lock);
 			bitmap_unplug(mddev->bitmap);
 			spin_lock_irq(&conf->device_lock);
-			conf->seq_write = seq;
+			conf->seq_write = conf->seq_flush;
 			activate_bit_delay(conf);
 		}
+		if (atomic_read(&mddev->plug_cnt) == 0)
+			raid5_activate_delayed(conf);
 
 		while ((bio = remove_bio_from_retry(conf))) {
 			int ok;
@@ -4525,6 +4518,7 @@
 	spin_unlock_irq(&conf->device_lock);
 
 	async_tx_issue_pending_all();
+	blk_finish_plug(&plug);
 
 	pr_debug("--- raid5d inactive\n");
 }
@@ -5141,8 +5135,6 @@
 		       mdname(mddev));
 	md_set_array_sectors(mddev, raid5_size(mddev, 0, 0));
 
-	plugger_init(&conf->plug, raid5_unplug);
-	mddev->plug = &conf->plug;
 	if (mddev->queue) {
 		int chunk_size;
 		/* read-ahead size must cover two whole stripes, which
@@ -5192,7 +5184,6 @@
 	mddev->thread = NULL;
 	if (mddev->queue)
 		mddev->queue->backing_dev_info.congested_fn = NULL;
-	plugger_flush(&conf->plug); /* the unplug fn references 'conf'*/
 	free_conf(conf);
 	mddev->private = NULL;
 	mddev->to_remove = &raid5_attrs_group;
diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
index 8d563a4..3ca77a2 100644
--- a/drivers/md/raid5.h
+++ b/drivers/md/raid5.h
@@ -400,8 +400,6 @@
 					    * Cleared when a sync completes.
 					    */
 
-	struct plug_handle	plug;
-
 	/* per cpu variables */
 	struct raid5_percpu {
 		struct page	*spare_page; /* Used when checking P/Q in raid6 */
diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index d01574d..f4c8c84 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -55,6 +55,19 @@
 }
 EXPORT_SYMBOL(mfd_cell_disable);
 
+static int mfd_platform_add_cell(struct platform_device *pdev,
+				 const struct mfd_cell *cell)
+{
+	if (!cell)
+		return 0;
+
+	pdev->mfd_cell = kmemdup(cell, sizeof(*cell), GFP_KERNEL);
+	if (!pdev->mfd_cell)
+		return -ENOMEM;
+
+	return 0;
+}
+
 static int mfd_add_device(struct device *parent, int id,
 			  const struct mfd_cell *cell,
 			  struct resource *mem_base,
@@ -75,7 +88,7 @@
 
 	pdev->dev.parent = parent;
 
-	ret = platform_device_add_data(pdev, cell, sizeof(*cell));
+	ret = mfd_platform_add_cell(pdev, cell);
 	if (ret)
 		goto fail_res;
 
@@ -123,7 +136,6 @@
 
 	return 0;
 
-/*	platform_device_del(pdev); */
 fail_res:
 	kfree(res);
 fail_device:
diff --git a/drivers/misc/sgi-gru/grufile.c b/drivers/misc/sgi-gru/grufile.c
index 20e4e93..ecafa4b 100644
--- a/drivers/misc/sgi-gru/grufile.c
+++ b/drivers/misc/sgi-gru/grufile.c
@@ -348,15 +348,15 @@
 
 static int gru_irq_count[GRU_CHIPLETS_PER_BLADE];
 
-static void gru_noop(unsigned int irq)
+static void gru_noop(struct irq_data *d)
 {
 }
 
 static struct irq_chip gru_chip[GRU_CHIPLETS_PER_BLADE] = {
 	[0 ... GRU_CHIPLETS_PER_BLADE - 1] {
-		.mask		= gru_noop,
-		.unmask		= gru_noop,
-		.ack		= gru_noop
+		.irq_mask	= gru_noop,
+		.irq_unmask	= gru_noop,
+		.irq_ack	= gru_noop
 	}
 };
 
diff --git a/drivers/mtd/mtdswap.c b/drivers/mtd/mtdswap.c
index 237913c..fed215c 100644
--- a/drivers/mtd/mtdswap.c
+++ b/drivers/mtd/mtdswap.c
@@ -1452,7 +1452,7 @@
 	oinfo = mtd->ecclayout;
 	if (!mtd->oobsize || !oinfo || oinfo->oobavail < MTDSWAP_OOBSIZE) {
 		printk(KERN_ERR "%s: Not enough free bytes in OOB, "
-			"%d available, %lu needed.\n",
+			"%d available, %zu needed.\n",
 			MTDSWAP_PREFIX, oinfo->oobavail, MTDSWAP_OOBSIZE);
 		return;
 	}
diff --git a/drivers/mtd/nand/atmel_nand.c b/drivers/mtd/nand/atmel_nand.c
index 6fae04b..950646a 100644
--- a/drivers/mtd/nand/atmel_nand.c
+++ b/drivers/mtd/nand/atmel_nand.c
@@ -209,22 +209,8 @@
 	int err = -EIO;
 	enum dma_data_direction dir = is_read ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
 
-	if (buf >= high_memory) {
-		struct page *pg;
-
-		if (((size_t)buf & PAGE_MASK) !=
-		    ((size_t)(buf + len - 1) & PAGE_MASK)) {
-			dev_warn(host->dev, "Buffer not fit in one page\n");
-			goto err_buf;
-		}
-
-		pg = vmalloc_to_page(buf);
-		if (pg == 0) {
-			dev_err(host->dev, "Failed to vmalloc_to_page\n");
-			goto err_buf;
-		}
-		p = page_address(pg) + ((size_t)buf & ~PAGE_MASK);
-	}
+	if (buf >= high_memory)
+		goto err_buf;
 
 	dma_dev = host->dma_chan->device;
 
@@ -280,7 +266,8 @@
 	struct nand_chip *chip = mtd->priv;
 	struct atmel_nand_host *host = chip->priv;
 
-	if (use_dma && len >= mtd->oobsize)
+	if (use_dma && len > mtd->oobsize)
+		/* only use DMA for bigger than oob size: better performances */
 		if (atmel_nand_dma_op(mtd, buf, len, 1) == 0)
 			return;
 
@@ -295,7 +282,8 @@
 	struct nand_chip *chip = mtd->priv;
 	struct atmel_nand_host *host = chip->priv;
 
-	if (use_dma && len >= mtd->oobsize)
+	if (use_dma && len > mtd->oobsize)
+		/* only use DMA for bigger than oob size: better performances */
 		if (atmel_nand_dma_op(mtd, (void *)buf, len, 0) == 0)
 			return;
 
@@ -599,7 +587,10 @@
 		nand_chip->options |= NAND_USE_FLASH_BBT;
 	}
 
-	if (cpu_has_dma() && use_dma) {
+	if (!cpu_has_dma())
+		use_dma = 0;
+
+	if (use_dma) {
 		dma_cap_mask_t mask;
 
 		dma_cap_zero(mask);
@@ -611,7 +602,8 @@
 		}
 	}
 	if (use_dma)
-		dev_info(host->dev, "Using DMA for NAND access.\n");
+		dev_info(host->dev, "Using %s for DMA transfers.\n",
+					dma_chan_name(host->dma_chan));
 	else
 		dev_info(host->dev, "No DMA support for NAND access.\n");
 
diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
index f803c58..66823ed 100644
--- a/drivers/net/benet/be.h
+++ b/drivers/net/benet/be.h
@@ -154,7 +154,7 @@
 	u16 min_eqd;		/* in usecs */
 	u16 max_eqd;		/* in usecs */
 	u16 cur_eqd;		/* in usecs */
-	u8  msix_vec_idx;
+	u8  eq_idx;
 
 	struct napi_struct napi;
 };
@@ -291,7 +291,7 @@
 	u32 num_rx_qs;
 	u32 big_page_size;	/* Compounded page size shared by rx wrbs */
 
-	u8 msix_vec_next_idx;
+	u8 eq_next_idx;
 	struct be_drv_stats drv_stats;
 
 	struct vlan_group *vlan_grp;
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 9a54c8b..7cb5a11 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -1497,7 +1497,7 @@
 	if (be_cmd_eq_create(adapter, eq, adapter->tx_eq.cur_eqd))
 		goto tx_eq_free;
 
-	adapter->tx_eq.msix_vec_idx = adapter->msix_vec_next_idx++;
+	adapter->tx_eq.eq_idx = adapter->eq_next_idx++;
 
 
 	/* Alloc TX eth compl queue */
@@ -1590,7 +1590,7 @@
 		if (rc)
 			goto err;
 
-		rxo->rx_eq.msix_vec_idx = adapter->msix_vec_next_idx++;
+		rxo->rx_eq.eq_idx = adapter->eq_next_idx++;
 
 		/* CQ */
 		cq = &rxo->cq;
@@ -1666,11 +1666,11 @@
 		if (!isr)
 			return IRQ_NONE;
 
-		if ((1 << adapter->tx_eq.msix_vec_idx & isr))
+		if ((1 << adapter->tx_eq.eq_idx & isr))
 			event_handle(adapter, &adapter->tx_eq);
 
 		for_all_rx_queues(adapter, rxo, i) {
-			if ((1 << rxo->rx_eq.msix_vec_idx & isr))
+			if ((1 << rxo->rx_eq.eq_idx & isr))
 				event_handle(adapter, &rxo->rx_eq);
 		}
 	}
@@ -1951,7 +1951,7 @@
 static inline int be_msix_vec_get(struct be_adapter *adapter,
 					struct be_eq_obj *eq_obj)
 {
-	return adapter->msix_entries[eq_obj->msix_vec_idx].vector;
+	return adapter->msix_entries[eq_obj->eq_idx].vector;
 }
 
 static int be_request_irq(struct be_adapter *adapter,
@@ -2345,6 +2345,7 @@
 	be_mcc_queues_destroy(adapter);
 	be_rx_queues_destroy(adapter);
 	be_tx_queues_destroy(adapter);
+	adapter->eq_next_idx = 0;
 
 	if (be_physfn(adapter) && adapter->sriov_enabled)
 		for (vf = 0; vf < num_vfs; vf++)
@@ -3141,12 +3142,14 @@
 static void be_shutdown(struct pci_dev *pdev)
 {
 	struct be_adapter *adapter = pci_get_drvdata(pdev);
-	struct net_device *netdev =  adapter->netdev;
 
-	if (netif_running(netdev))
+	if (!adapter)
+		return;
+
+	if (netif_running(adapter->netdev))
 		cancel_delayed_work_sync(&adapter->work);
 
-	netif_device_detach(netdev);
+	netif_device_detach(adapter->netdev);
 
 	be_cmd_reset_function(adapter);
 
diff --git a/drivers/net/bna/bfa_ioc.c b/drivers/net/bna/bfa_ioc.c
index 34933cb..e3de0b8 100644
--- a/drivers/net/bna/bfa_ioc.c
+++ b/drivers/net/bna/bfa_ioc.c
@@ -2219,13 +2219,9 @@
 static void
 bfa_ioc_recover(struct bfa_ioc *ioc)
 {
-	u16 bdf;
-
-	bdf = (ioc->pcidev.pci_slot << 8 | ioc->pcidev.pci_func << 3 |
-					ioc->pcidev.device_id);
-
-	pr_crit("Firmware heartbeat failure at %d", bdf);
-	BUG_ON(1);
+	pr_crit("Heart Beat of IOC has failed\n");
+	bfa_ioc_stats(ioc, ioc_hbfails);
+	bfa_fsm_send_event(ioc, IOC_E_HBFAIL);
 }
 
 static void
diff --git a/drivers/net/can/mcp251x.c b/drivers/net/can/mcp251x.c
index 7513c45..330140e 100644
--- a/drivers/net/can/mcp251x.c
+++ b/drivers/net/can/mcp251x.c
@@ -931,7 +931,8 @@
 	priv->tx_len = 0;
 
 	ret = request_threaded_irq(spi->irq, NULL, mcp251x_can_ist,
-			  IRQF_TRIGGER_FALLING, DEVICE_NAME, priv);
+		  pdata->irq_flags ? pdata->irq_flags : IRQF_TRIGGER_FALLING,
+		  DEVICE_NAME, priv);
 	if (ret) {
 		dev_err(&spi->dev, "failed to acquire irq %d\n", spi->irq);
 		if (pdata->transceiver_enable)
diff --git a/drivers/net/mlx4/en_rx.c b/drivers/net/mlx4/en_rx.c
index cfd50bc..62dd21b 100644
--- a/drivers/net/mlx4/en_rx.c
+++ b/drivers/net/mlx4/en_rx.c
@@ -345,6 +345,8 @@
 		err = mlx4_en_init_allocator(priv, ring);
 		if (err) {
 			en_err(priv, "Failed initializing ring allocator\n");
+			if (ring->stride <= TXBB_SIZE)
+				ring->buf -= TXBB_SIZE;
 			ring_ind--;
 			goto err_allocator;
 		}
@@ -369,6 +371,8 @@
 	ring_ind = priv->rx_ring_num - 1;
 err_allocator:
 	while (ring_ind >= 0) {
+		if (priv->rx_ring[ring_ind].stride <= TXBB_SIZE)
+			priv->rx_ring[ring_ind].buf -= TXBB_SIZE;
 		mlx4_en_destroy_allocator(priv, &priv->rx_ring[ring_ind]);
 		ring_ind--;
 	}
diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
index 62fa7ee..3814fc9 100644
--- a/drivers/net/mlx4/main.c
+++ b/drivers/net/mlx4/main.c
@@ -944,6 +944,10 @@
 	}
 
 	for (port = 1; port <= dev->caps.num_ports; port++) {
+		enum mlx4_port_type port_type = 0;
+		mlx4_SENSE_PORT(dev, port, &port_type);
+		if (port_type)
+			dev->caps.port_type[port] = port_type;
 		ib_port_default_caps = 0;
 		err = mlx4_get_port_ib_caps(dev, port, &ib_port_default_caps);
 		if (err)
@@ -958,6 +962,7 @@
 			goto err_mcg_table_free;
 		}
 	}
+	mlx4_set_port_mask(dev);
 
 	return 0;
 
diff --git a/drivers/net/mlx4/mlx4.h b/drivers/net/mlx4/mlx4.h
index c1e0e5f..dd7d745 100644
--- a/drivers/net/mlx4/mlx4.h
+++ b/drivers/net/mlx4/mlx4.h
@@ -431,6 +431,8 @@
 
 void mlx4_handle_catas_err(struct mlx4_dev *dev);
 
+int mlx4_SENSE_PORT(struct mlx4_dev *dev, int port,
+		    enum mlx4_port_type *type);
 void mlx4_do_sense_ports(struct mlx4_dev *dev,
 			 enum mlx4_port_type *stype,
 			 enum mlx4_port_type *defaults);
diff --git a/drivers/net/mlx4/sense.c b/drivers/net/mlx4/sense.c
index 015fbe78..e2337a7 100644
--- a/drivers/net/mlx4/sense.c
+++ b/drivers/net/mlx4/sense.c
@@ -38,8 +38,8 @@
 
 #include "mlx4.h"
 
-static int mlx4_SENSE_PORT(struct mlx4_dev *dev, int port,
-			   enum mlx4_port_type *type)
+int mlx4_SENSE_PORT(struct mlx4_dev *dev, int port,
+		    enum mlx4_port_type *type)
 {
 	u64 out_param;
 	int err = 0;
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index 693aaef..718879b 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -317,7 +317,7 @@
 			lock_sock(sk);
 
 			if (po->pppoe_dev == dev &&
-			    sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
+			    sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
 				pppox_unbind_sock(sk);
 				sk->sk_state = PPPOX_ZOMBIE;
 				sk->sk_state_change(sk);
diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
index c498b72..4b42ecc 100644
--- a/drivers/net/smsc911x.c
+++ b/drivers/net/smsc911x.c
@@ -1818,6 +1818,7 @@
 	SMSC_TRACE(PROBE, "PHY will be autodetected.");
 
 	spin_lock_init(&pdata->dev_lock);
+	spin_lock_init(&pdata->mac_lock);
 
 	if (pdata->ioaddr == 0) {
 		SMSC_WARNING(PROBE, "pdata->ioaddr: 0x00000000");
@@ -1895,8 +1896,11 @@
 	/* workaround for platforms without an eeprom, where the mac address
 	 * is stored elsewhere and set by the bootloader.  This saves the
 	 * mac address before resetting the device */
-	if (pdata->config.flags & SMSC911X_SAVE_MAC_ADDRESS)
+	if (pdata->config.flags & SMSC911X_SAVE_MAC_ADDRESS) {
+		spin_lock_irq(&pdata->mac_lock);
 		smsc911x_read_mac_address(dev);
+		spin_unlock_irq(&pdata->mac_lock);
+	}
 
 	/* Reset the LAN911x */
 	if (smsc911x_soft_reset(pdata))
@@ -2059,8 +2063,6 @@
 		SMSC_TRACE(PROBE, "Network interface: \"%s\"", dev->name);
 	}
 
-	spin_lock_init(&pdata->mac_lock);
-
 	retval = smsc911x_mii_init(pdev, dev);
 	if (retval) {
 		SMSC_WARNING(PROBE,
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 727874d..47a6c87 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1313,6 +1313,21 @@
 		USB_DEVICE(0x0424, 0x9909),
 		.driver_info = (unsigned long) &smsc95xx_info,
 	},
+	{
+		/* SMSC LAN9530 USB Ethernet Device */
+		USB_DEVICE(0x0424, 0x9530),
+		.driver_info = (unsigned long) &smsc95xx_info,
+	},
+	{
+		/* SMSC LAN9730 USB Ethernet Device */
+		USB_DEVICE(0x0424, 0x9730),
+		.driver_info = (unsigned long) &smsc95xx_info,
+	},
+	{
+		/* SMSC LAN89530 USB Ethernet Device */
+		USB_DEVICE(0x0424, 0x9E08),
+		.driver_info = (unsigned long) &smsc95xx_info,
+	},
 	{ },		/* END */
 };
 MODULE_DEVICE_TABLE(usb, products);
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 338b075..1ec9bcd 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -2546,6 +2546,7 @@
 	{ AR_SREV_VERSION_9287,         "9287" },
 	{ AR_SREV_VERSION_9271,         "9271" },
 	{ AR_SREV_VERSION_9300,         "9300" },
+	{ AR_SREV_VERSION_9485,         "9485" },
 };
 
 /* For devices with external radios */
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 3d5566e..ff0f5ba 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -1536,7 +1536,7 @@
 		dmaaddr = meta->dmaaddr;
 		goto drop_recycle_buffer;
 	}
-	if (unlikely(len > ring->rx_buffersize)) {
+	if (unlikely(len + ring->frameoffset > ring->rx_buffersize)) {
 		/* The data did not fit into one descriptor buffer
 		 * and is split over multiple buffers.
 		 * This should never happen, as we try to allocate buffers
diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h
index a01c210..e8a80a1 100644
--- a/drivers/net/wireless/b43/dma.h
+++ b/drivers/net/wireless/b43/dma.h
@@ -163,7 +163,7 @@
 /* DMA engine tuning knobs */
 #define B43_TXRING_SLOTS		256
 #define B43_RXRING_SLOTS		64
-#define B43_DMA0_RX_BUFFERSIZE		IEEE80211_MAX_FRAME_LEN
+#define B43_DMA0_RX_BUFFERSIZE		(B43_DMA0_RX_FRAMEOFFSET + IEEE80211_MAX_FRAME_LEN)
 
 /* Pointer poison */
 #define B43_DMA_PTR_POISON		((void *)ERR_PTR(-ENOMEM))
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index 98aa8af..20b6646 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -241,7 +241,7 @@
 
 /* 6x00 Specific */
 #define EEPROM_6000_TX_POWER_VERSION    (4)
-#define EEPROM_6000_EEPROM_VERSION	(0x434)
+#define EEPROM_6000_EEPROM_VERSION	(0x423)
 
 /* 6x50 Specific */
 #define EEPROM_6050_TX_POWER_VERSION    (4)
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 9b344a9..e183587 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -56,6 +56,7 @@
 	{USB_DEVICE(0x0846, 0x4210)},	/* Netgear WG121 the second ? */
 	{USB_DEVICE(0x0846, 0x4220)},	/* Netgear WG111 */
 	{USB_DEVICE(0x09aa, 0x1000)},	/* Spinnaker Proto board */
+	{USB_DEVICE(0x0bf8, 0x1007)},	/* Fujitsu E-5400 USB */
 	{USB_DEVICE(0x0cde, 0x0006)},	/* Medion 40900, Roper Europe */
 	{USB_DEVICE(0x0db0, 0x6826)},	/* MSI UB54G (MS-6826) */
 	{USB_DEVICE(0x107b, 0x55f2)},	/* Gateway WGU-210 (Gemtek) */
@@ -68,6 +69,7 @@
 	{USB_DEVICE(0x1915, 0x2235)},	/* Linksys WUSB54G Portable OEM */
 	{USB_DEVICE(0x2001, 0x3701)},	/* DLink DWL-G120 Spinnaker */
 	{USB_DEVICE(0x2001, 0x3703)},	/* DLink DWL-G122 */
+	{USB_DEVICE(0x2001, 0x3762)},	/* Conceptronic C54U */
 	{USB_DEVICE(0x5041, 0x2234)},	/* Linksys WUSB54G */
 	{USB_DEVICE(0x5041, 0x2235)},	/* Linksys WUSB54G Portable */
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 9de9dbe..84eb6ad 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1062,8 +1062,10 @@
 	 * Stop all work.
 	 */
 	cancel_work_sync(&rt2x00dev->intf_work);
-	cancel_work_sync(&rt2x00dev->rxdone_work);
-	cancel_work_sync(&rt2x00dev->txdone_work);
+	if (rt2x00_is_usb(rt2x00dev)) {
+		cancel_work_sync(&rt2x00dev->rxdone_work);
+		cancel_work_sync(&rt2x00dev->txdone_work);
+	}
 	destroy_workqueue(rt2x00dev->workqueue);
 
 	/*
diff --git a/drivers/net/wireless/rtlwifi/efuse.c b/drivers/net/wireless/rtlwifi/efuse.c
index f74a870..590f14f 100644
--- a/drivers/net/wireless/rtlwifi/efuse.c
+++ b/drivers/net/wireless/rtlwifi/efuse.c
@@ -685,7 +685,7 @@
 
 	u8 efuse_data, word_cnts = 0;
 	u16 efuse_addr = 0;
-	u8 hworden;
+	u8 hworden = 0;
 	u8 tmpdata[8];
 
 	if (data == NULL)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
index 5ef9137..28a6ce3 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
@@ -303,7 +303,7 @@
 	u16 box_reg, box_extreg;
 	u8 u1b_tmp;
 	bool isfw_read = false;
-	u8 buf_index;
+	u8 buf_index = 0;
 	bool bwrite_sucess = false;
 	u8 wait_h2c_limmit = 100;
 	u8 wait_writeh2c_limmit = 100;
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index a4b2613..f5d8573 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -246,7 +246,7 @@
 
 static void _rtl_usb_io_handler_release(struct ieee80211_hw *hw)
 {
-	struct rtl_priv *rtlpriv = rtl_priv(hw);
+	struct rtl_priv __maybe_unused *rtlpriv = rtl_priv(hw);
 
 	mutex_destroy(&rtlpriv->io.bb_mutex);
 }
diff --git a/drivers/net/wireless/wl12xx/sdio.c b/drivers/net/wireless/wl12xx/sdio.c
index 5b9dbea..b1c7d03 100644
--- a/drivers/net/wireless/wl12xx/sdio.c
+++ b/drivers/net/wireless/wl12xx/sdio.c
@@ -340,7 +340,7 @@
 module_exit(wl1271_exit);
 
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Luciano Coelho <luciano.coelho@nokia.com>");
+MODULE_AUTHOR("Luciano Coelho <coelho@ti.com>");
 MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
 MODULE_FIRMWARE(WL1271_FW_NAME);
 MODULE_FIRMWARE(WL1271_AP_FW_NAME);
diff --git a/drivers/net/wireless/wl12xx/spi.c b/drivers/net/wireless/wl12xx/spi.c
index 18cf017..ffc745b 100644
--- a/drivers/net/wireless/wl12xx/spi.c
+++ b/drivers/net/wireless/wl12xx/spi.c
@@ -487,7 +487,7 @@
 module_exit(wl1271_exit);
 
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Luciano Coelho <luciano.coelho@nokia.com>");
+MODULE_AUTHOR("Luciano Coelho <coelho@ti.com>");
 MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
 MODULE_FIRMWARE(WL1271_FW_NAME);
 MODULE_FIRMWARE(WL1271_AP_FW_NAME);
diff --git a/drivers/net/wireless/wl12xx/testmode.c b/drivers/net/wireless/wl12xx/testmode.c
index e64403b..6ec06a4 100644
--- a/drivers/net/wireless/wl12xx/testmode.c
+++ b/drivers/net/wireless/wl12xx/testmode.c
@@ -204,7 +204,10 @@
 
 	kfree(wl->nvs);
 
-	wl->nvs = kzalloc(sizeof(struct wl1271_nvs_file), GFP_KERNEL);
+	if (len != sizeof(struct wl1271_nvs_file))
+		return -EINVAL;
+
+	wl->nvs = kzalloc(len, GFP_KERNEL);
 	if (!wl->nvs) {
 		wl1271_error("could not allocate memory for the nvs file");
 		ret = -ENOMEM;
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index 58236e6..ab607bb 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -643,7 +643,7 @@
 	usb = urb->context;
 	rx = &usb->rx;
 
-	zd_usb_reset_rx_idle_timer(usb);
+	tasklet_schedule(&rx->reset_timer_tasklet);
 
 	if (length%rx->usb_packet_size > rx->usb_packet_size-4) {
 		/* If there is an old first fragment, we don't care. */
@@ -812,6 +812,7 @@
 	__zd_usb_disable_rx(usb);
 	mutex_unlock(&rx->setup_mutex);
 
+	tasklet_kill(&rx->reset_timer_tasklet);
 	cancel_delayed_work_sync(&rx->idle_work);
 }
 
@@ -1106,6 +1107,13 @@
 	zd_usb_reset_rx(usb);
 }
 
+static void zd_usb_reset_rx_idle_timer_tasklet(unsigned long param)
+{
+	struct zd_usb *usb = (struct zd_usb *)param;
+
+	zd_usb_reset_rx_idle_timer(usb);
+}
+
 void zd_usb_reset_rx_idle_timer(struct zd_usb *usb)
 {
 	struct zd_usb_rx *rx = &usb->rx;
@@ -1127,6 +1135,7 @@
 static inline void init_usb_rx(struct zd_usb *usb)
 {
 	struct zd_usb_rx *rx = &usb->rx;
+
 	spin_lock_init(&rx->lock);
 	mutex_init(&rx->setup_mutex);
 	if (interface_to_usbdev(usb->intf)->speed == USB_SPEED_HIGH) {
@@ -1136,11 +1145,14 @@
 	}
 	ZD_ASSERT(rx->fragment_length == 0);
 	INIT_DELAYED_WORK(&rx->idle_work, zd_rx_idle_timer_handler);
+	rx->reset_timer_tasklet.func = zd_usb_reset_rx_idle_timer_tasklet;
+	rx->reset_timer_tasklet.data = (unsigned long)usb;
 }
 
 static inline void init_usb_tx(struct zd_usb *usb)
 {
 	struct zd_usb_tx *tx = &usb->tx;
+
 	spin_lock_init(&tx->lock);
 	atomic_set(&tx->enabled, 0);
 	tx->stopped = 0;
@@ -1671,6 +1683,10 @@
 
 	if (urb->status && !usb->cmd_error)
 		usb->cmd_error = urb->status;
+
+	if (!usb->cmd_error &&
+			urb->actual_length != urb->transfer_buffer_length)
+		usb->cmd_error = -EIO;
 }
 
 static int zd_submit_waiting_urb(struct zd_usb *usb, bool last)
@@ -1805,7 +1821,7 @@
 	usb_fill_int_urb(urb, udev, usb_sndintpipe(udev, EP_REGS_OUT),
 			 req, req_len, iowrite16v_urb_complete, usb,
 			 ep->desc.bInterval);
-	urb->transfer_flags |= URB_FREE_BUFFER | URB_SHORT_NOT_OK;
+	urb->transfer_flags |= URB_FREE_BUFFER;
 
 	/* Submit previous URB */
 	r = zd_submit_waiting_urb(usb, false);
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.h b/drivers/net/wireless/zd1211rw/zd_usb.h
index b3df2c8..325d0f9 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.h
+++ b/drivers/net/wireless/zd1211rw/zd_usb.h
@@ -183,6 +183,7 @@
 	spinlock_t lock;
 	struct mutex setup_mutex;
 	struct delayed_work idle_work;
+	struct tasklet_struct reset_timer_tasklet;
 	u8 fragment[2 * USB_MAX_RX_SIZE];
 	unsigned int fragment_length;
 	unsigned int usb_packet_size;
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index d86ea8b..135df16 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -781,7 +781,7 @@
 
 #endif /* !CONFIG_SUSPEND */
 
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
 
 static int pci_pm_freeze(struct device *dev)
 {
@@ -970,7 +970,7 @@
 	return error;
 }
 
-#else /* !CONFIG_HIBERNATION */
+#else /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #define pci_pm_freeze		NULL
 #define pci_pm_freeze_noirq	NULL
@@ -981,7 +981,7 @@
 #define pci_pm_restore		NULL
 #define pci_pm_restore_noirq	NULL
 
-#endif /* !CONFIG_HIBERNATION */
+#endif /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #ifdef CONFIG_PM_RUNTIME
 
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 89d0a6a..ebf51ad 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -676,10 +676,10 @@
 			min_align = align1 >> 1;
 		align += aligns[order];
 	}
-	size0 = calculate_memsize(size, min_size, 0, resource_size(b_res), align);
+	size0 = calculate_memsize(size, min_size, 0, resource_size(b_res), min_align);
 	size1 = !add_size ? size :
 		calculate_memsize(size, min_size+add_size, 0,
-				resource_size(b_res), align);
+				resource_size(b_res), min_align);
 	if (!size0 && !size1) {
 		if (b_res->start || b_res->end)
 			dev_info(&bus->self->dev, "disabling bridge window "
diff --git a/drivers/pcmcia/pxa2xx_balloon3.c b/drivers/pcmcia/pxa2xx_balloon3.c
index 453c54c..4c3e94c 100644
--- a/drivers/pcmcia/pxa2xx_balloon3.c
+++ b/drivers/pcmcia/pxa2xx_balloon3.c
@@ -25,6 +25,8 @@
 
 #include <mach/balloon3.h>
 
+#include <asm/mach-types.h>
+
 #include "soc_common.h"
 
 /*
@@ -127,6 +129,9 @@
 {
 	int ret;
 
+	if (!machine_is_balloon3())
+		return -ENODEV;
+
 	balloon3_pcmcia_device = platform_device_alloc("pxa2xx-pcmcia", -1);
 	if (!balloon3_pcmcia_device)
 		return -ENOMEM;
diff --git a/drivers/pcmcia/pxa2xx_trizeps4.c b/drivers/pcmcia/pxa2xx_trizeps4.c
index b7e5966..b829e65 100644
--- a/drivers/pcmcia/pxa2xx_trizeps4.c
+++ b/drivers/pcmcia/pxa2xx_trizeps4.c
@@ -69,15 +69,15 @@
 	for (i = 0; i < ARRAY_SIZE(irqs); i++) {
 		if (irqs[i].sock != skt->nr)
 			continue;
-		if (gpio_request(IRQ_TO_GPIO(irqs[i].irq), irqs[i].str) < 0) {
+		if (gpio_request(irq_to_gpio(irqs[i].irq), irqs[i].str) < 0) {
 			pr_err("%s: sock %d unable to request gpio %d\n",
-				__func__, skt->nr, IRQ_TO_GPIO(irqs[i].irq));
+				__func__, skt->nr, irq_to_gpio(irqs[i].irq));
 			ret = -EBUSY;
 			goto error;
 		}
-		if (gpio_direction_input(IRQ_TO_GPIO(irqs[i].irq)) < 0) {
+		if (gpio_direction_input(irq_to_gpio(irqs[i].irq)) < 0) {
 			pr_err("%s: sock %d unable to set input gpio %d\n",
-				__func__, skt->nr, IRQ_TO_GPIO(irqs[i].irq));
+				__func__, skt->nr, irq_to_gpio(irqs[i].irq));
 			ret = -EINVAL;
 			goto error;
 		}
@@ -86,7 +86,7 @@
 
 error:
 	for (; i >= 0; i--) {
-		gpio_free(IRQ_TO_GPIO(irqs[i].irq));
+		gpio_free(irq_to_gpio(irqs[i].irq));
 	}
 	return (ret);
 }
@@ -97,7 +97,7 @@
 	/* free allocated gpio's */
 	gpio_free(GPIO_PRDY);
 	for (i = 0; i < ARRAY_SIZE(irqs); i++)
-		gpio_free(IRQ_TO_GPIO(irqs[i].irq));
+		gpio_free(irq_to_gpio(irqs[i].irq));
 }
 
 static unsigned long trizeps_pcmcia_status[2];
@@ -226,6 +226,9 @@
 {
 	int ret;
 
+	if (!machine_is_trizeps4() && !machine_is_trizeps4wl())
+		return -ENODEV;
+
 	trizeps_pcmcia_device = platform_device_alloc("pxa2xx-pcmcia", -1);
 	if (!trizeps_pcmcia_device)
 		return -ENOMEM;
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 2ee442c..0485e39 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -187,7 +187,8 @@
 	depends on ACPI
 	depends on BACKLIGHT_CLASS_DEVICE
 	depends on RFKILL
-	depends on SERIO_I8042
+	depends on INPUT && SERIO_I8042
+	select INPUT_SPARSEKMAP
 	---help---
 	  This is a driver for laptops built by MSI (MICRO-STAR
 	  INTERNATIONAL):
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 5ea6c34..ac4e7f83 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -89,7 +89,7 @@
 #define ACERWMID_EVENT_GUID "676AA15E-6A47-4D9F-A2CC-1E6D18D14026"
 
 MODULE_ALIAS("wmi:67C3371D-95A3-4C37-BB61-DD47B491DAAB");
-MODULE_ALIAS("wmi:6AF4F258-B401-42Fd-BE91-3D4AC2D7C0D3");
+MODULE_ALIAS("wmi:6AF4F258-B401-42FD-BE91-3D4AC2D7C0D3");
 MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026");
 
 enum acer_wmi_event_ids {
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index efc776c..832a3fd7 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -201,8 +201,8 @@
 	if (!asus->inputdev)
 		return -ENOMEM;
 
-	asus->inputdev->name = asus->driver->input_phys;
-	asus->inputdev->phys = asus->driver->input_name;
+	asus->inputdev->name = asus->driver->input_name;
+	asus->inputdev->phys = asus->driver->input_phys;
 	asus->inputdev->id.bustype = BUS_HOST;
 	asus->inputdev->dev.parent = &asus->platform_device->dev;
 
diff --git a/drivers/platform/x86/eeepc-wmi.c b/drivers/platform/x86/eeepc-wmi.c
index 0ddc434..649dcad 100644
--- a/drivers/platform/x86/eeepc-wmi.c
+++ b/drivers/platform/x86/eeepc-wmi.c
@@ -67,9 +67,11 @@
 	{ KE_KEY, 0x82, { KEY_CAMERA } },
 	{ KE_KEY, 0x83, { KEY_CAMERA_ZOOMIN } },
 	{ KE_KEY, 0x88, { KEY_WLAN } },
+	{ KE_KEY, 0xbd, { KEY_CAMERA } },
 	{ KE_KEY, 0xcc, { KEY_SWITCHVIDEOMODE } },
 	{ KE_KEY, 0xe0, { KEY_PROG1 } }, /* Task Manager */
 	{ KE_KEY, 0xe1, { KEY_F14 } }, /* Change Resolution */
+	{ KE_KEY, 0xe8, { KEY_SCREENLOCK } },
 	{ KE_KEY, 0xe9, { KEY_BRIGHTNESS_ZERO } },
 	{ KE_KEY, 0xeb, { KEY_CAMERA_ZOOMOUT } },
 	{ KE_KEY, 0xec, { KEY_CAMERA_UP } },
diff --git a/drivers/platform/x86/intel_pmic_gpio.c b/drivers/platform/x86/intel_pmic_gpio.c
index d653104b..464bb3f 100644
--- a/drivers/platform/x86/intel_pmic_gpio.c
+++ b/drivers/platform/x86/intel_pmic_gpio.c
@@ -74,6 +74,19 @@
 	u32			trigger_type;
 };
 
+static void pmic_program_irqtype(int gpio, int type)
+{
+	if (type & IRQ_TYPE_EDGE_RISING)
+		intel_scu_ipc_update_register(GPIO0 + gpio, 0x20, 0x20);
+	else
+		intel_scu_ipc_update_register(GPIO0 + gpio, 0x00, 0x20);
+
+	if (type & IRQ_TYPE_EDGE_FALLING)
+		intel_scu_ipc_update_register(GPIO0 + gpio, 0x10, 0x10);
+	else
+		intel_scu_ipc_update_register(GPIO0 + gpio, 0x00, 0x10);
+};
+
 static int pmic_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 {
 	if (offset > 8) {
@@ -166,16 +179,38 @@
 	return pg->irq_base + offset;
 }
 
+static void pmic_bus_lock(struct irq_data *data)
+{
+	struct pmic_gpio *pg = irq_data_get_irq_chip_data(data);
+
+	mutex_lock(&pg->buslock);
+}
+
+static void pmic_bus_sync_unlock(struct irq_data *data)
+{
+	struct pmic_gpio *pg = irq_data_get_irq_chip_data(data);
+
+	if (pg->update_type) {
+		unsigned int gpio = pg->update_type & ~GPIO_UPDATE_TYPE;
+
+		pmic_program_irqtype(gpio, pg->trigger_type);
+		pg->update_type = 0;
+	}
+	mutex_unlock(&pg->buslock);
+}
+
 /* the gpiointr register is read-clear, so just do nothing. */
 static void pmic_irq_unmask(struct irq_data *data) { }
 
 static void pmic_irq_mask(struct irq_data *data) { }
 
 static struct irq_chip pmic_irqchip = {
-	.name		= "PMIC-GPIO",
-	.irq_mask	= pmic_irq_mask,
-	.irq_unmask	= pmic_irq_unmask,
-	.irq_set_type	= pmic_irq_type,
+	.name			= "PMIC-GPIO",
+	.irq_mask		= pmic_irq_mask,
+	.irq_unmask		= pmic_irq_unmask,
+	.irq_set_type		= pmic_irq_type,
+	.irq_bus_lock		= pmic_bus_lock,
+	.irq_bus_sync_unlock	= pmic_bus_sync_unlock,
 };
 
 static irqreturn_t pmic_irq_handler(int irq, void *data)
diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
index de434c6..d347116 100644
--- a/drivers/platform/x86/samsung-laptop.c
+++ b/drivers/platform/x86/samsung-laptop.c
@@ -571,6 +571,16 @@
 		.callback = dmi_check_cb,
 	},
 	{
+		.ident = "R410 Plus",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR,
+					"SAMSUNG ELECTRONICS CO., LTD."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "R410P"),
+			DMI_MATCH(DMI_BOARD_NAME, "R460"),
+		},
+		.callback = dmi_check_cb,
+	},
+	{
 		.ident = "R518",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR,
@@ -591,12 +601,12 @@
 		.callback = dmi_check_cb,
 	},
 	{
-		.ident = "N150/N210/N220",
+		.ident = "N150/N210/N220/N230",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR,
 					"SAMSUNG ELECTRONICS CO., LTD."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "N150/N210/N220"),
-			DMI_MATCH(DMI_BOARD_NAME, "N150/N210/N220"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "N150/N210/N220/N230"),
+			DMI_MATCH(DMI_BOARD_NAME, "N150/N210/N220/N230"),
 		},
 		.callback = dmi_check_cb,
 	},
@@ -771,6 +781,7 @@
 
 	/* create a backlight device to talk to this one */
 	memset(&props, 0, sizeof(struct backlight_properties));
+	props.type = BACKLIGHT_PLATFORM;
 	props.max_brightness = sabi_config->max_brightness;
 	backlight_device = backlight_device_register("samsung", &sdev->dev,
 						     NULL, &backlight_ops,
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index e642f5f..8f709ae 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -138,6 +138,8 @@
 		 "1 for 30 seconds, 2 for 60 seconds and 3 to disable timeout "
 		 "(default: 0)");
 
+static void sony_nc_kbd_backlight_resume(void);
+
 enum sony_nc_rfkill {
 	SONY_WIFI,
 	SONY_BLUETOOTH,
@@ -771,11 +773,6 @@
 	if (!handles)
 		return -ENOMEM;
 
-	sysfs_attr_init(&handles->devattr.attr);
-	handles->devattr.attr.name = "handles";
-	handles->devattr.attr.mode = S_IRUGO;
-	handles->devattr.show = sony_nc_handles_show;
-
 	for (i = 0; i < ARRAY_SIZE(handles->cap); i++) {
 		if (!acpi_callsetfunc(sony_nc_acpi_handle,
 					"SN00", i + 0x20, &result)) {
@@ -785,11 +782,18 @@
 		}
 	}
 
-	/* allow reading capabilities via sysfs */
-	if (device_create_file(&pd->dev, &handles->devattr)) {
-		kfree(handles);
-		handles = NULL;
-		return -1;
+	if (debug) {
+		sysfs_attr_init(&handles->devattr.attr);
+		handles->devattr.attr.name = "handles";
+		handles->devattr.attr.mode = S_IRUGO;
+		handles->devattr.show = sony_nc_handles_show;
+
+		/* allow reading capabilities via sysfs */
+		if (device_create_file(&pd->dev, &handles->devattr)) {
+			kfree(handles);
+			handles = NULL;
+			return -1;
+		}
 	}
 
 	return 0;
@@ -798,7 +802,8 @@
 static int sony_nc_handles_cleanup(struct platform_device *pd)
 {
 	if (handles) {
-		device_remove_file(&pd->dev, &handles->devattr);
+		if (debug)
+			device_remove_file(&pd->dev, &handles->devattr);
 		kfree(handles);
 		handles = NULL;
 	}
@@ -808,6 +813,11 @@
 static int sony_find_snc_handle(int handle)
 {
 	int i;
+
+	/* not initialized yet, return early */
+	if (!handles)
+		return -1;
+
 	for (i = 0; i < 0x10; i++) {
 		if (handles->cap[i] == handle) {
 			dprintk("found handle 0x%.4x (offset: 0x%.2x)\n",
@@ -1168,6 +1178,9 @@
 	/* re-read rfkill state */
 	sony_nc_rfkill_update();
 
+	/* restore kbd backlight states */
+	sony_nc_kbd_backlight_resume();
+
 	return 0;
 }
 
@@ -1355,6 +1368,7 @@
 #define KBDBL_HANDLER	0x137
 #define KBDBL_PRESENT	0xB00
 #define	SET_MODE	0xC00
+#define SET_STATE	0xD00
 #define SET_TIMEOUT	0xE00
 
 struct kbd_backlight {
@@ -1377,6 +1391,10 @@
 				(value << 0x10) | SET_MODE, &result))
 		return -EIO;
 
+	/* Try to turn the light on/off immediately */
+	sony_call_snc_handle(KBDBL_HANDLER, (value << 0x10) | SET_STATE,
+			&result);
+
 	kbdbl_handle->mode = value;
 
 	return 0;
@@ -1458,7 +1476,7 @@
 {
 	int result;
 
-	if (sony_call_snc_handle(0x137, KBDBL_PRESENT, &result))
+	if (sony_call_snc_handle(KBDBL_HANDLER, KBDBL_PRESENT, &result))
 		return 0;
 	if (!(result & 0x02))
 		return 0;
@@ -1501,13 +1519,36 @@
 static int sony_nc_kbd_backlight_cleanup(struct platform_device *pd)
 {
 	if (kbdbl_handle) {
+		int result;
+
 		device_remove_file(&pd->dev, &kbdbl_handle->mode_attr);
 		device_remove_file(&pd->dev, &kbdbl_handle->timeout_attr);
+
+		/* restore the default hw behaviour */
+		sony_call_snc_handle(KBDBL_HANDLER, 0x1000 | SET_MODE, &result);
+		sony_call_snc_handle(KBDBL_HANDLER, SET_TIMEOUT, &result);
+
 		kfree(kbdbl_handle);
 	}
 	return 0;
 }
 
+static void sony_nc_kbd_backlight_resume(void)
+{
+	int ignore = 0;
+
+	if (!kbdbl_handle)
+		return;
+
+	if (kbdbl_handle->mode == 0)
+		sony_call_snc_handle(KBDBL_HANDLER, SET_MODE, &ignore);
+
+	if (kbdbl_handle->timeout != 0)
+		sony_call_snc_handle(KBDBL_HANDLER,
+				(kbdbl_handle->timeout << 0x10) | SET_TIMEOUT,
+				&ignore);
+}
+
 static void sony_nc_backlight_setup(void)
 {
 	acpi_handle unused;
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index a08561f..efb3b6b 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -8618,8 +8618,7 @@
 		tpacpi_is_fw_digit(s[1]) &&
 		s[2] == t && s[3] == 'T' &&
 		tpacpi_is_fw_digit(s[4]) &&
-		tpacpi_is_fw_digit(s[5]) &&
-		s[6] == 'W' && s[7] == 'W';
+		tpacpi_is_fw_digit(s[5]);
 }
 
 /* returns 0 - probe ok, or < 0 - probe error.
diff --git a/drivers/rapidio/rio.c b/drivers/rapidio/rio.c
index c29719c..86c9a09 100644
--- a/drivers/rapidio/rio.c
+++ b/drivers/rapidio/rio.c
@@ -1171,16 +1171,17 @@
 
 __setup("riohdid=", rio_hdid_setup);
 
-void rio_register_mport(struct rio_mport *port)
+int rio_register_mport(struct rio_mport *port)
 {
 	if (next_portid >= RIO_MAX_MPORTS) {
 		pr_err("RIO: reached specified max number of mports\n");
-		return;
+		return 1;
 	}
 
 	port->id = next_portid++;
 	port->host_deviceid = rio_get_hdid(port->id);
 	list_add_tail(&port->node, &rio_mports);
+	return 0;
 }
 
 EXPORT_SYMBOL_GPL(rio_local_get_device_id);
diff --git a/drivers/rapidio/switches/idt_gen2.c b/drivers/rapidio/switches/idt_gen2.c
index 095016a..ac2701b 100644
--- a/drivers/rapidio/switches/idt_gen2.c
+++ b/drivers/rapidio/switches/idt_gen2.c
@@ -418,3 +418,4 @@
 DECLARE_RIO_SWITCH_INIT(RIO_VID_IDT, RIO_DID_IDTCPS1616, idtg2_switch_init);
 DECLARE_RIO_SWITCH_INIT(RIO_VID_IDT, RIO_DID_IDTVPS1616, idtg2_switch_init);
 DECLARE_RIO_SWITCH_INIT(RIO_VID_IDT, RIO_DID_IDTSPS1616, idtg2_switch_init);
+DECLARE_RIO_SWITCH_INIT(RIO_VID_IDT, RIO_DID_IDTCPS1432, idtg2_switch_init);
diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c
index 09b4437..3901386 100644
--- a/drivers/rtc/class.c
+++ b/drivers/rtc/class.c
@@ -171,7 +171,7 @@
 	err = __rtc_read_alarm(rtc, &alrm);
 
 	if (!err && !rtc_valid_tm(&alrm.time))
-		rtc_set_alarm(rtc, &alrm);
+		rtc_initialize_alarm(rtc, &alrm);
 
 	strlcpy(rtc->name, name, RTC_DEVICE_NAME_SIZE);
 	dev_set_name(&rtc->dev, "rtc%d", id);
diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index 23719f0..ef6316a 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -375,6 +375,32 @@
 }
 EXPORT_SYMBOL_GPL(rtc_set_alarm);
 
+/* Called once per device from rtc_device_register */
+int rtc_initialize_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+{
+	int err;
+
+	err = rtc_valid_tm(&alarm->time);
+	if (err != 0)
+		return err;
+
+	err = mutex_lock_interruptible(&rtc->ops_lock);
+	if (err)
+		return err;
+
+	rtc->aie_timer.node.expires = rtc_tm_to_ktime(alarm->time);
+	rtc->aie_timer.period = ktime_set(0, 0);
+	if (alarm->enabled) {
+		rtc->aie_timer.enabled = 1;
+		timerqueue_add(&rtc->timerqueue, &rtc->aie_timer.node);
+	}
+	mutex_unlock(&rtc->ops_lock);
+	return err;
+}
+EXPORT_SYMBOL_GPL(rtc_initialize_alarm);
+
+
+
 int rtc_alarm_irq_enable(struct rtc_device *rtc, unsigned int enabled)
 {
 	int err = mutex_lock_interruptible(&rtc->ops_lock);
diff --git a/drivers/rtc/rtc-bfin.c b/drivers/rtc/rtc-bfin.c
index a0fc4cf..90d8662 100644
--- a/drivers/rtc/rtc-bfin.c
+++ b/drivers/rtc/rtc-bfin.c
@@ -250,6 +250,8 @@
 		bfin_rtc_int_set_alarm(rtc);
 	else
 		bfin_rtc_int_clear(~(RTC_ISTAT_ALARM | RTC_ISTAT_ALARM_DAY));
+
+	return 0;
 }
 
 static int bfin_rtc_read_time(struct device *dev, struct rtc_time *tm)
diff --git a/drivers/rtc/rtc-mc13xxx.c b/drivers/rtc/rtc-mc13xxx.c
index c4200646..c5ac037 100644
--- a/drivers/rtc/rtc-mc13xxx.c
+++ b/drivers/rtc/rtc-mc13xxx.c
@@ -401,6 +401,7 @@
 	}, {
 		.name = "mc13892-rtc",
 	},
+	{ }
 };
 
 static struct platform_driver mc13xxx_rtc_driver = {
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index 71496491..b3466c4 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -336,7 +336,6 @@
 
 	/* do not clear AIE here, it may be needed for wake */
 
-	s3c_rtc_setpie(dev, 0);
 	free_irq(s3c_rtc_alarmno, rtc_dev);
 	free_irq(s3c_rtc_tickno, rtc_dev);
 }
@@ -408,7 +407,6 @@
 	platform_set_drvdata(dev, NULL);
 	rtc_device_unregister(rtc);
 
-	s3c_rtc_setpie(&dev->dev, 0);
 	s3c_rtc_setaie(&dev->dev, 0);
 
 	clk_disable(rtc_clk);
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 6d5c7ff..ab55c2f 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -443,7 +443,7 @@
 					&sdev->request_queue->queue_flags);
 		if (flagset)
 			queue_flag_set(QUEUE_FLAG_REENTER, sdev->request_queue);
-		__blk_run_queue(sdev->request_queue, false);
+		__blk_run_queue(sdev->request_queue);
 		if (flagset)
 			queue_flag_clear(QUEUE_FLAG_REENTER, sdev->request_queue);
 		spin_unlock(sdev->request_queue->queue_lock);
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index fdf3fa6..28c3350 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -3829,7 +3829,7 @@
 		  !test_bit(QUEUE_FLAG_REENTER, &rport->rqst_q->queue_flags);
 	if (flagset)
 		queue_flag_set(QUEUE_FLAG_REENTER, rport->rqst_q);
-	__blk_run_queue(rport->rqst_q, false);
+	__blk_run_queue(rport->rqst_q);
 	if (flagset)
 		queue_flag_clear(QUEUE_FLAG_REENTER, rport->rqst_q);
 	spin_unlock_irqrestore(rport->rqst_q->queue_lock, flags);
diff --git a/drivers/spi/amba-pl022.c b/drivers/spi/amba-pl022.c
index 5825370..08de58e 100644
--- a/drivers/spi/amba-pl022.c
+++ b/drivers/spi/amba-pl022.c
@@ -1555,7 +1555,7 @@
 	 * A wait_queue on the pl022->busy could be used, but then the common
 	 * execution path (pump_messages) would be required to call wake_up or
 	 * friends on every SPI message. Do this instead */
-	while (!list_empty(&pl022->queue) && pl022->busy && limit--) {
+	while ((!list_empty(&pl022->queue) || pl022->busy) && limit--) {
 		spin_unlock_irqrestore(&pl022->queue_lock, flags);
 		msleep(10);
 		spin_lock_irqsave(&pl022->queue_lock, flags);
diff --git a/drivers/spi/dw_spi.c b/drivers/spi/dw_spi.c
index b1a4b9f..871e337 100644
--- a/drivers/spi/dw_spi.c
+++ b/drivers/spi/dw_spi.c
@@ -821,7 +821,7 @@
 
 	spin_lock_irqsave(&dws->lock, flags);
 	dws->run = QUEUE_STOPPED;
-	while (!list_empty(&dws->queue) && dws->busy && limit--) {
+	while ((!list_empty(&dws->queue) || dws->busy) && limit--) {
 		spin_unlock_irqrestore(&dws->lock, flags);
 		msleep(10);
 		spin_lock_irqsave(&dws->lock, flags);
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index 9c74aad..dc25bee 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -1493,7 +1493,7 @@
 	 * execution path (pump_messages) would be required to call wake_up or
 	 * friends on every SPI message. Do this instead */
 	drv_data->run = QUEUE_STOPPED;
-	while (!list_empty(&drv_data->queue) && drv_data->busy && limit--) {
+	while ((!list_empty(&drv_data->queue) || drv_data->busy) && limit--) {
 		spin_unlock_irqrestore(&drv_data->lock, flags);
 		msleep(10);
 		spin_lock_irqsave(&drv_data->lock, flags);
diff --git a/drivers/spi/spi_bfin5xx.c b/drivers/spi/spi_bfin5xx.c
index bdb7289..f706dba 100644
--- a/drivers/spi/spi_bfin5xx.c
+++ b/drivers/spi/spi_bfin5xx.c
@@ -1284,7 +1284,7 @@
 	 * friends on every SPI message. Do this instead
 	 */
 	drv_data->running = false;
-	while (!list_empty(&drv_data->queue) && drv_data->busy && limit--) {
+	while ((!list_empty(&drv_data->queue) || drv_data->busy) && limit--) {
 		spin_unlock_irqrestore(&drv_data->lock, flags);
 		msleep(10);
 		spin_lock_irqsave(&drv_data->lock, flags);
diff --git a/drivers/staging/Kconfig b/drivers/staging/Kconfig
index e9254f5..dcd8a76 100644
--- a/drivers/staging/Kconfig
+++ b/drivers/staging/Kconfig
@@ -127,8 +127,6 @@
 
 source "drivers/staging/wlags49_h25/Kconfig"
 
-source "drivers/staging/samsung-laptop/Kconfig"
-
 source "drivers/staging/sm7xx/Kconfig"
 
 source "drivers/staging/dt3155v4l/Kconfig"
diff --git a/drivers/staging/Makefile b/drivers/staging/Makefile
index dc642ab..7d38925 100644
--- a/drivers/staging/Makefile
+++ b/drivers/staging/Makefile
@@ -16,7 +16,8 @@
 obj-$(CONFIG_W35UND)		+= winbond/
 obj-$(CONFIG_PRISM2_USB)	+= wlan-ng/
 obj-$(CONFIG_ECHO)		+= echo/
-obj-$(CONFIG_BRCM80211)		+= brcm80211/
+obj-$(CONFIG_BRCMSMAC)		+= brcm80211/
+obj-$(CONFIG_BRCMFMAC)		+= brcm80211/
 obj-$(CONFIG_COMEDI)		+= comedi/
 obj-$(CONFIG_FB_OLPC_DCON)	+= olpc_dcon/
 obj-$(CONFIG_ASUS_OLED)		+= asus_oled/
@@ -46,7 +47,6 @@
 obj-$(CONFIG_ZCACHE)		+= zcache/
 obj-$(CONFIG_WLAGS49_H2)	+= wlags49_h2/
 obj-$(CONFIG_WLAGS49_H25)	+= wlags49_h25/
-obj-$(CONFIG_SAMSUNG_LAPTOP)	+= samsung-laptop/
 obj-$(CONFIG_FB_SM7XX)		+= sm7xx/
 obj-$(CONFIG_VIDEO_DT3155)	+= dt3155v4l/
 obj-$(CONFIG_CRYSTALHD)		+= crystalhd/
diff --git a/drivers/staging/ath6kl/Kconfig b/drivers/staging/ath6kl/Kconfig
index 8a5caa3..1f15e1f 100644
--- a/drivers/staging/ath6kl/Kconfig
+++ b/drivers/staging/ath6kl/Kconfig
@@ -100,12 +100,6 @@
 	help
 	WLAN GPIO to be used for resetting BT
 
-config ATH6KL_CFG80211
-	bool "CFG80211 support"
-	depends on ATH6K_LEGACY && CFG80211
-	help
-	Enables support for CFG80211 APIs. The default option is to use WEXT. Even with this option enabled, WEXT is not explicitly disabled and the onus of not exercising WEXT lies on the application(s) running in the user space.
-
 config ATH6KL_HTC_RAW_INTERFACE
 	bool "RAW HTC support"
 	depends on ATH6K_LEGACY
diff --git a/drivers/staging/ath6kl/Makefile b/drivers/staging/ath6kl/Makefile
index ab68078..1d3f239 100644
--- a/drivers/staging/ath6kl/Makefile
+++ b/drivers/staging/ath6kl/Makefile
@@ -29,26 +29,6 @@
 ccflags-y += -I$(obj)/bmi/include
 ccflags-y += -I$(obj)/include/common/AR6002/hw4.0
 
-ifeq ($(CONFIG_AR600x_SD31_XXX),y)
-ccflags-y += -DAR600x_SD31_XXX
-endif
-
-ifeq ($(CONFIG_AR600x_WB31_XXX),y)
-ccflags-y += -DAR600x_WB31_XXX
-endif
-
-ifeq ($(CONFIG_AR600x_SD32_XXX),y)
-ccflags-y += -DAR600x_SD32_XXX
-endif
-
-ifeq ($(CONFIG_AR600x_CUSTOM_XXX),y)
-ccflags-y += -DAR600x_CUSTOM_XXX
-endif
-
-ifeq ($(CONFIG_ATH6KL_ENABLE_COEXISTENCE),y)
-ccflags-y += -DENABLE_COEXISTENCE
-endif
-
 ifeq ($(CONFIG_AR600x_DUAL_ANTENNA),y)
 ccflags-y += -DAR600x_DUAL_ANTENNA
 endif
@@ -85,11 +65,6 @@
 ccflags-y += -DATH6KL_CONFIG_GPIO_BT_RESET
 endif
 
-ifeq ($(CONFIG_ATH6KL_CFG80211),y)
-ccflags-y += -DATH6K_CONFIG_CFG80211
-ath6kl-y += os/linux/cfg80211.o
-endif
-
 ifeq ($(CONFIG_ATH6KL_HTC_RAW_INTERFACE),y)
 ccflags-y += -DHTC_RAW_INTERFACE
 endif
@@ -115,18 +90,8 @@
 ccflags-y += -DATH6KL_SKIP_ABI_VERSION_CHECK
 endif
 
-ccflags-y += -DLINUX -DKERNEL_2_6
-ccflags-y += -DTCMD
-ccflags-y += -DSEND_EVENT_TO_APP
-ccflags-y += -DUSER_KEYS
-ccflags-y += -DNO_SYNC_FLUSH
-ccflags-y += -DHTC_EP_STAT_PROFILING
-ccflags-y += -DATH_AR6K_11N_SUPPORT
 ccflags-y += -DWAPI_ENABLE
 ccflags-y += -DCHECKSUM_OFFLOAD
-ccflags-y += -DWLAN_HEADERS
-ccflags-y += -DINIT_MODE_DRV_ENABLED
-ccflags-y += -DBMIENABLE_SET
 
 obj-$(CONFIG_ATH6K_LEGACY) := ath6kl.o
 ath6kl-y += htc2/AR6000/ar6k.o
@@ -136,14 +101,12 @@
 ath6kl-y += htc2/htc_services.o
 ath6kl-y += htc2/htc.o
 ath6kl-y += bmi/src/bmi.o
+ath6kl-y += os/linux/cfg80211.o
 ath6kl-y += os/linux/ar6000_drv.o
 ath6kl-y += os/linux/ar6000_raw_if.o
 ath6kl-y += os/linux/ar6000_pm.o
 ath6kl-y += os/linux/netbuf.o
-ath6kl-y += os/linux/wireless_ext.o
-ath6kl-y += os/linux/ioctl.o
 ath6kl-y += os/linux/hci_bridge.o
-ath6kl-y += os/linux/ar6k_pal.o
 ath6kl-y += miscdrv/common_drv.o
 ath6kl-y += miscdrv/credit_dist.o
 ath6kl-y += wmi/wmi.o
diff --git a/drivers/staging/ath6kl/bmi/src/bmi.c b/drivers/staging/ath6kl/bmi/src/bmi.c
index 9268bf3..f1f085e 100644
--- a/drivers/staging/ath6kl/bmi/src/bmi.c
+++ b/drivers/staging/ath6kl/bmi/src/bmi.c
@@ -95,12 +95,12 @@
 BMICleanup(void)
 {
     if (pBMICmdCredits) {
-        A_FREE(pBMICmdCredits);
+        kfree(pBMICmdCredits);
         pBMICmdCredits = NULL;
     }
 
     if (pBMICmdBuf) {
-        A_FREE(pBMICmdBuf);
+        kfree(pBMICmdBuf);
         pBMICmdBuf = NULL;
     }
 }
@@ -127,12 +127,12 @@
     }
 
     if (pBMICmdCredits) {
-        A_FREE(pBMICmdCredits);
+        kfree(pBMICmdCredits);
         pBMICmdCredits = NULL;
     }
 
     if (pBMICmdBuf) {
-        A_FREE(pBMICmdBuf);
+        kfree(pBMICmdBuf);
         pBMICmdBuf = NULL;
     }
 
diff --git a/drivers/staging/ath6kl/hif/sdio/linux_sdio/src/hif.c b/drivers/staging/ath6kl/hif/sdio/linux_sdio/src/hif.c
index e6d9cd8..c8f1a6e 100644
--- a/drivers/staging/ath6kl/hif/sdio/linux_sdio/src/hif.c
+++ b/drivers/staging/ath6kl/hif/sdio/linux_sdio/src/hif.c
@@ -53,62 +53,189 @@
 #if defined(CONFIG_PM)
 #define dev_to_sdio_func(d)	container_of(d, struct sdio_func, dev)
 #define to_sdio_driver(d)      container_of(d, struct sdio_driver, drv)
-static int hifDeviceSuspend(struct device *dev);
-static int hifDeviceResume(struct device *dev);
 #endif /* CONFIG_PM */
-static int hifDeviceInserted(struct sdio_func *func, const struct sdio_device_id *id);
-static void hifDeviceRemoved(struct sdio_func *func);
-static struct hif_device *addHifDevice(struct sdio_func *func);
-static struct hif_device *getHifDevice(struct sdio_func *func);
 static void delHifDevice(struct hif_device * device);
 static int Func0_CMD52WriteByte(struct mmc_card *card, unsigned int address, unsigned char byte);
 static int Func0_CMD52ReadByte(struct mmc_card *card, unsigned int address, unsigned char *byte);
 
+static int hifEnableFunc(struct hif_device *device, struct sdio_func *func);
+static int hifDisableFunc(struct hif_device *device, struct sdio_func *func);
+OSDRV_CALLBACKS osdrvCallbacks;
+
 int reset_sdio_on_unload = 0;
 module_param(reset_sdio_on_unload, int, 0644);
 
 extern u32 nohifscattersupport;
 
+static struct hif_device *ath6kl_alloc_hifdev(struct sdio_func *func)
+{
+	struct hif_device *hifdevice;
 
-/* ------ Static Variables ------ */
-static const struct sdio_device_id ar6k_id_table[] = {
-    {  SDIO_DEVICE(MANUFACTURER_CODE, (MANUFACTURER_ID_AR6002_BASE | 0x0))  },
-    {  SDIO_DEVICE(MANUFACTURER_CODE, (MANUFACTURER_ID_AR6002_BASE | 0x1))  },
-    {  SDIO_DEVICE(MANUFACTURER_CODE, (MANUFACTURER_ID_AR6003_BASE | 0x0))  },
-    {  SDIO_DEVICE(MANUFACTURER_CODE, (MANUFACTURER_ID_AR6003_BASE | 0x1))  },
-    { /* null */                                         },
-};
-MODULE_DEVICE_TABLE(sdio, ar6k_id_table);
+	hifdevice = kzalloc(sizeof(struct hif_device), GFP_KERNEL);
 
-static struct sdio_driver ar6k_driver = {
-	.name = "ar6k_wlan",
-	.id_table = ar6k_id_table,
-	.probe = hifDeviceInserted,
-	.remove = hifDeviceRemoved,
+#if HIF_USE_DMA_BOUNCE_BUFFER
+	hifdevice->dma_buffer = kmalloc(HIF_DMA_BUFFER_SIZE, GFP_KERNEL);
+#endif
+	hifdevice->func = func;
+	hifdevice->powerConfig = HIF_DEVICE_POWER_UP;
+	sdio_set_drvdata(func, hifdevice);
+
+	return hifdevice;
+}
+
+static struct hif_device *ath6kl_get_hifdev(struct sdio_func *func)
+{
+	return (struct hif_device *) sdio_get_drvdata(func);
+}
+
+static const struct sdio_device_id ath6kl_hifdev_ids[] = {
+	{ SDIO_DEVICE(MANUFACTURER_CODE, (MANUFACTURER_ID_AR6002_BASE | 0x0)) },
+	{ SDIO_DEVICE(MANUFACTURER_CODE, (MANUFACTURER_ID_AR6002_BASE | 0x1)) },
+	{ SDIO_DEVICE(MANUFACTURER_CODE, (MANUFACTURER_ID_AR6003_BASE | 0x0)) },
+	{ SDIO_DEVICE(MANUFACTURER_CODE, (MANUFACTURER_ID_AR6003_BASE | 0x1)) },
+	{ /* null */                                         },
 };
 
+MODULE_DEVICE_TABLE(sdio, ath6kl_hifdev_ids);
+
+static int ath6kl_hifdev_probe(struct sdio_func *func,
+			       const struct sdio_device_id *id)
+{
+	int ret;
+	struct hif_device *device;
+	int count;
+
+	AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
+			("ath6kl: Function: 0x%X, Vendor ID: 0x%X, "
+			 "Device ID: 0x%X, block size: 0x%X/0x%X\n",
+			func->num, func->vendor, func->device,
+			func->max_blksize, func->cur_blksize));
+
+	ath6kl_alloc_hifdev(func);
+	device = ath6kl_get_hifdev(func);
+
+	device->id = id;
+	device->is_disabled = true;
+
+	spin_lock_init(&device->lock);
+	spin_lock_init(&device->asynclock);
+
+	DL_LIST_INIT(&device->ScatterReqHead);
+
+	/* Try to allow scatter unless globally overridden */
+	if (!nohifscattersupport)
+		device->scatter_enabled = true;
+
+	A_MEMZERO(device->busRequest, sizeof(device->busRequest));
+
+	for (count = 0; count < BUS_REQUEST_MAX_NUM; count++) {
+		sema_init(&device->busRequest[count].sem_req, 0);
+		hifFreeBusRequest(device, &device->busRequest[count]);
+	}
+
+	sema_init(&device->sem_async, 0);
+
+	ret = hifEnableFunc(device, func);
+
+	return ret;
+}
+
+static void ath6kl_hifdev_remove(struct sdio_func *func)
+{
+	int status = 0;
+	struct hif_device *device;
+
+	device = ath6kl_get_hifdev(func);
+	if (device->claimedContext != NULL)
+		status = osdrvCallbacks.
+			deviceRemovedHandler(device->claimedContext, device);
+
+	if (device->is_disabled)
+		device->is_disabled = false;
+	else
+		status = hifDisableFunc(device, func);
+
+	CleanupHIFScatterResources(device);
+
+	delHifDevice(device);
+}
+
 #if defined(CONFIG_PM)
-/* New suspend/resume based on linux-2.6.32
- * Need to patch linux-2.6.32 with mmc2.6.32_suspend.patch
- * Need to patch with msmsdcc2.6.29_suspend.patch for msm_sdcc host
-     */
-static struct dev_pm_ops ar6k_device_pm_ops = {
-	.suspend = hifDeviceSuspend,
-	.resume = hifDeviceResume,
+static int ath6kl_hifdev_suspend(struct device *dev)
+{
+	struct sdio_func *func = dev_to_sdio_func(dev);
+	int status = 0;
+	struct hif_device *device;
+
+	device = ath6kl_get_hifdev(func);
+
+	if (device && device->claimedContext &&
+	    osdrvCallbacks.deviceSuspendHandler) {
+		/* set true first for PowerStateChangeNotify(..) */
+		device->is_suspend = true;
+		status = osdrvCallbacks.
+			deviceSuspendHandler(device->claimedContext);
+		if (status)
+			device->is_suspend = false;
+	}
+
+	CleanupHIFScatterResources(device);
+
+	switch (status) {
+	case 0:
+		return 0;
+	case A_EBUSY:
+		/* Hack for kernel in order to support deep sleep and wow */
+		return -EBUSY;
+	default:
+		return -1;
+	}
+}
+
+static int ath6kl_hifdev_resume(struct device *dev)
+{
+	struct sdio_func *func = dev_to_sdio_func(dev);
+	int status = 0;
+	struct hif_device *device;
+
+	device = ath6kl_get_hifdev(func);
+	if (device && device->claimedContext &&
+	    osdrvCallbacks.deviceSuspendHandler) {
+		status = osdrvCallbacks.
+			deviceResumeHandler(device->claimedContext);
+		if (status == 0)
+			device->is_suspend = false;
+	}
+
+	return status;
+}
+
+static const struct dev_pm_ops ath6kl_hifdev_pmops = {
+	.suspend = ath6kl_hifdev_suspend,
+	.resume = ath6kl_hifdev_resume,
 };
 #endif /* CONFIG_PM */
 
+static struct sdio_driver ath6kl_hifdev_driver = {
+	.name = "ath6kl_hifdev",
+	.id_table = ath6kl_hifdev_ids,
+	.probe = ath6kl_hifdev_probe,
+	.remove = ath6kl_hifdev_remove,
+#if defined(CONFIG_PM)
+	.drv = {
+		.pm = &ath6kl_hifdev_pmops,
+	},
+#endif
+};
+
 /* make sure we only unregister when registered. */
 static int registered = 0;
 
-OSDRV_CALLBACKS osdrvCallbacks;
 extern u32 onebitmode;
 extern u32 busspeedlow;
 extern u32 debughif;
 
 static void ResetAllCards(void);
-static int hifDisableFunc(struct hif_device *device, struct sdio_func *func);
-static int hifEnableFunc(struct hif_device *device, struct sdio_func *func);
 
 #ifdef DEBUG
 
@@ -125,31 +252,22 @@
 /* ------ Functions ------ */
 int HIFInit(OSDRV_CALLBACKS *callbacks)
 {
-    int status;
-    AR_DEBUG_ASSERT(callbacks != NULL);
+	int r;
+	AR_DEBUG_ASSERT(callbacks != NULL);
 
-    A_REGISTER_MODULE_DEBUG_INFO(hif);
+	A_REGISTER_MODULE_DEBUG_INFO(hif);
 
-    /* store the callback handlers */
-    osdrvCallbacks = *callbacks;
+	/* store the callback handlers */
+	osdrvCallbacks = *callbacks;
 
-    /* Register with bus driver core */
-    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: HIFInit registering\n"));
-    registered = 1;
-#if defined(CONFIG_PM)
-    if (callbacks->deviceSuspendHandler && callbacks->deviceResumeHandler) {
-        ar6k_driver.drv.pm = &ar6k_device_pm_ops;
-    }
-#endif /* CONFIG_PM */
-    status = sdio_register_driver(&ar6k_driver);
-    AR_DEBUG_ASSERT(status==0);
+	/* Register with bus driver core */
+	registered = 1;
 
-    if (status != 0) {
-        return A_ERROR;
-    }
+	r = sdio_register_driver(&ath6kl_hifdev_driver);
+	if (r < 0)
+		return r;
 
-    return 0;
-
+	return 0;
 }
 
 static int
@@ -763,7 +881,7 @@
             registered = 0;
             AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
                             ("AR6000: Unregistering with the bus driver\n"));
-            sdio_unregister_driver(&ar6k_driver);
+            sdio_unregister_driver(&ath6kl_hifdev_driver);
             AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
                             ("AR6000: Unregistered\n"));
         }
@@ -778,7 +896,7 @@
     struct hif_device *device;
     AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: +hifIRQHandler\n"));
 
-    device = getHifDevice(func);
+    device = ath6kl_get_hifdev(func);
     atomic_set(&device->irqHandling, 1);
     /* release the host during ints so we can pick it back up when we process cmds */
     sdio_release_host(device->func);
@@ -823,48 +941,6 @@
 }
 #endif
 
-static int hifDeviceInserted(struct sdio_func *func, const struct sdio_device_id *id)
-{
-    int ret;
-    struct hif_device * device;
-    int count;
-
-    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-		    ("AR6000: hifDeviceInserted, Function: 0x%X, Vendor ID: 0x%X, Device ID: 0x%X, block size: 0x%X/0x%X\n",
-		     func->num, func->vendor, func->device, func->max_blksize, func->cur_blksize));
-
-    addHifDevice(func);
-    device = getHifDevice(func);
-
-    device->id = id;
-    device->is_disabled = true;
-
-    spin_lock_init(&device->lock);
-
-    spin_lock_init(&device->asynclock);
-    
-    DL_LIST_INIT(&device->ScatterReqHead);
-    
-    if (!nohifscattersupport) {
-            /* try to allow scatter operation on all instances,
-             * unless globally overridden */
-        device->scatter_enabled = true;
-    }
-
-    /* Initialize the bus requests to be used later */
-    A_MEMZERO(device->busRequest, sizeof(device->busRequest));
-    for (count = 0; count < BUS_REQUEST_MAX_NUM; count ++) {
-        sema_init(&device->busRequest[count].sem_req, 0);
-        hifFreeBusRequest(device, &device->busRequest[count]);
-    }
-    sema_init(&device->sem_async, 0);
-    
-    ret  = hifEnableFunc(device, func);
-
-    return ret;
-}
-
-
 void
 HIFAckInterrupt(struct hif_device *device)
 {
@@ -955,7 +1031,7 @@
     int status = 0;
 
     AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: +hifDisableFunc\n"));
-    device = getHifDevice(func);
+    device = ath6kl_get_hifdev(func);
     if (!IS_ERR(device->async_task)) {
         init_completion(&device->async_completion);
         device->async_shutdown = 1;
@@ -1004,7 +1080,7 @@
     int ret = 0;
     
     AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: +hifEnableFunc\n"));
-    device = getHifDevice(func);
+    device = ath6kl_get_hifdev(func);
 
     if (device->is_disabled) {
        /* enable the SDIO function */
@@ -1016,7 +1092,7 @@
             if (ret) {
                 AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("AR6000: failed to enable 4-bit ASYNC IRQ mode %d \n",ret));
                 sdio_release_host(func);
-                return A_ERROR;
+                return ret;
             }
             AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: 4-bit ASYNC IRQ mode enabled\n"));
         }
@@ -1027,14 +1103,14 @@
             AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("AR6000: %s(), Unable to enable AR6K: 0x%X\n",
 					  __FUNCTION__, ret));
             sdio_release_host(func);
-            return A_ERROR;
+            return ret;
         }
         ret = sdio_set_block_size(func, HIF_MBOX_BLOCK_SIZE);
         sdio_release_host(func);
         if (ret) {
             AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("AR6000: %s(), Unable to set block size 0x%x  AR6K: 0x%X\n",
 					  __FUNCTION__, HIF_MBOX_BLOCK_SIZE, ret));
-            return A_ERROR;
+            return ret;
         }
         device->is_disabled = false;
         /* create async I/O thread */
@@ -1045,7 +1121,7 @@
                                            "AR6K Async");
            if (IS_ERR(device->async_task)) {
                AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("AR6000: %s(), to create async task\n", __FUNCTION__));
-                return A_ERROR;
+                return -ENOMEM;
            }
            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: start async task\n"));
            wake_up_process(device->async_task );    
@@ -1060,14 +1136,14 @@
     } else {
         taskFunc = enable_task;
         taskName = "AR6K enable";
-        ret = A_PENDING;
+        ret = -ENOMEM;
 #endif /* CONFIG_PM */
     }
     /* create resume thread */
     pTask = kthread_create(taskFunc, (void *)device, taskName);
     if (IS_ERR(pTask)) {
         AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("AR6000: %s(), to create enabel task\n", __FUNCTION__));
-        return A_ERROR;
+        return -ENOMEM;
     }
     wake_up_process(pTask);
     AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: -hifEnableFunc\n"));
@@ -1076,79 +1152,6 @@
     return ret;
 }
 
-#if defined(CONFIG_PM)
-static int hifDeviceSuspend(struct device *dev)
-{
-    struct sdio_func *func=dev_to_sdio_func(dev);
-    int status = 0;
-    struct hif_device *device;   
-
-    device = getHifDevice(func);
-    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: +hifDeviceSuspend\n"));
-    if (device && device->claimedContext && osdrvCallbacks.deviceSuspendHandler) {
-        device->is_suspend = true; /* set true first for PowerStateChangeNotify(..) */
-        status = osdrvCallbacks.deviceSuspendHandler(device->claimedContext);
-        if (status) {
-            device->is_suspend = false;
-        }
-    }
-    CleanupHIFScatterResources(device);
-    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: -hifDeviceSuspend\n"));
-
-    switch (status) {
-    case 0:
-        return 0;
-    case A_EBUSY:
-        return -EBUSY; /* Hack for kernel in order to support deep sleep and wow */
-    default:
-        return -1;
-    }
-}
-
-static int hifDeviceResume(struct device *dev)
-{
-    struct sdio_func *func=dev_to_sdio_func(dev);
-    int status = 0;
-    struct hif_device *device;   
-
-    device = getHifDevice(func);
-    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: +hifDeviceResume\n"));
-    if (device && device->claimedContext && osdrvCallbacks.deviceSuspendHandler) {
-        status = osdrvCallbacks.deviceResumeHandler(device->claimedContext);
-        if (status == 0) {
-            device->is_suspend = false;
-        }
-    }
-    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: -hifDeviceResume\n"));
-
-    return status;
-}
-#endif /* CONFIG_PM */
-
-static void hifDeviceRemoved(struct sdio_func *func)
-{
-    int status = 0;
-    struct hif_device *device;
-    AR_DEBUG_ASSERT(func != NULL);
-
-    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: +hifDeviceRemoved\n"));
-    device = getHifDevice(func);
-    if (device->claimedContext != NULL) {
-        status = osdrvCallbacks.deviceRemovedHandler(device->claimedContext, device);
-    }
-
-    if (device->is_disabled) {
-        device->is_disabled = false;
-    } else {
-        status = hifDisableFunc(device, func);
-    }
-    CleanupHIFScatterResources(device);
-     
-    delHifDevice(device);
-    AR_DEBUG_ASSERT(status == 0);
-    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: -hifDeviceRemoved\n"));
-}
-
 /*
  * This should be moved to AR6K HTC layer.
  */
@@ -1182,33 +1185,6 @@
     return 0;
 }
     
-
-static struct hif_device *
-addHifDevice(struct sdio_func *func)
-{
-    struct hif_device *hifdevice;
-    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: addHifDevice\n"));
-    AR_DEBUG_ASSERT(func != NULL);
-    hifdevice = kzalloc(sizeof(struct hif_device), GFP_KERNEL);
-    AR_DEBUG_ASSERT(hifdevice != NULL);
-#if HIF_USE_DMA_BOUNCE_BUFFER
-    hifdevice->dma_buffer = kmalloc(HIF_DMA_BUFFER_SIZE, GFP_KERNEL);
-    AR_DEBUG_ASSERT(hifdevice->dma_buffer != NULL);
-#endif
-    hifdevice->func = func;
-    hifdevice->powerConfig = HIF_DEVICE_POWER_UP;
-    sdio_set_drvdata(func, hifdevice);
-    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: addHifDevice; 0x%p\n", hifdevice));
-    return hifdevice;
-}
-
-static struct hif_device *
-getHifDevice(struct sdio_func *func)
-{
-    AR_DEBUG_ASSERT(func != NULL);
-    return (struct hif_device *)sdio_get_drvdata(func);
-}
-
 static void
 delHifDevice(struct hif_device * device)
 {
diff --git a/drivers/staging/ath6kl/hif/sdio/linux_sdio/src/hif_scatter.c b/drivers/staging/ath6kl/hif/sdio/linux_sdio/src/hif_scatter.c
index a1fdcc1..7516d913 100644
--- a/drivers/staging/ath6kl/hif/sdio/linux_sdio/src/hif_scatter.c
+++ b/drivers/staging/ath6kl/hif/sdio/linux_sdio/src/hif_scatter.c
@@ -309,7 +309,7 @@
                                          (MAX_SCATTER_ENTRIES_PER_REQ - 1) * (sizeof(struct hif_scatter_item))); 
            
             if (NULL == pReqPriv->pHifScatterReq) {
-                A_FREE(pReqPriv);
+                kfree(pReqPriv);
                 break;      
             }           
                 /* just zero the main part of the scatter request */
@@ -319,8 +319,8 @@
                 /* allocate a bus request for this scatter request */
             busrequest = hifAllocateBusRequest(device);
             if (NULL == busrequest) {
-                A_FREE(pReqPriv->pHifScatterReq);
-                A_FREE(pReqPriv);
+                kfree(pReqPriv->pHifScatterReq);
+                kfree(pReqPriv);
                 break;    
             }
                 /* assign the scatter request to this bus request */
@@ -382,11 +382,11 @@
         }
         
         if (pReqPriv->pHifScatterReq != NULL) {
-            A_FREE(pReqPriv->pHifScatterReq);   
+            kfree(pReqPriv->pHifScatterReq);   
             pReqPriv->pHifScatterReq = NULL; 
         }
                 
-        A_FREE(pReqPriv);       
+        kfree(pReqPriv);       
     }
 }
 
diff --git a/drivers/staging/ath6kl/htc2/AR6000/ar6k.c b/drivers/staging/ath6kl/htc2/AR6000/ar6k.c
index eeddf60..05f6d15 100644
--- a/drivers/staging/ath6kl/htc2/AR6000/ar6k.c
+++ b/drivers/staging/ath6kl/htc2/AR6000/ar6k.c
@@ -743,7 +743,7 @@
         if (NULL == pReq) {
             break;
         }
-        A_FREE(pReq);
+        kfree(pReq);
     }
 
 }
diff --git a/drivers/staging/ath6kl/htc2/AR6000/ar6k.h b/drivers/staging/ath6kl/htc2/AR6000/ar6k.h
index 1ff2218..e551dbe 100644
--- a/drivers/staging/ath6kl/htc2/AR6000/ar6k.h
+++ b/drivers/staging/ath6kl/htc2/AR6000/ar6k.h
@@ -42,7 +42,6 @@
 
 //#define MBOXHW_UNIT_TEST 1
 
-#include "athstartpack.h"
 PREPACK struct ar6k_irq_proc_registers {
     u8 host_int_status;
     u8 cpu_int_status;
@@ -69,8 +68,6 @@
     u8 int_status_enable;
 } POSTPACK;
 
-#include "athendpack.h"
-
 #define AR6K_IRQ_ENABLE_REGS_SIZE sizeof(struct ar6k_irq_enable_registers)
 
 #define AR6K_REG_IO_BUFFER_SIZE     32
diff --git a/drivers/staging/ath6kl/htc2/AR6000/ar6k_gmbox_hciuart.c b/drivers/staging/ath6kl/htc2/AR6000/ar6k_gmbox_hciuart.c
index 41223f9..2603a92 100644
--- a/drivers/staging/ath6kl/htc2/AR6000/ar6k_gmbox_hciuart.c
+++ b/drivers/staging/ath6kl/htc2/AR6000/ar6k_gmbox_hciuart.c
@@ -108,7 +108,7 @@
     A_MUTEX_DELETE(&pProtocol->HCIRxLock);
     A_MUTEX_DELETE(&pProtocol->HCITxLock);
         
-    A_FREE(pProtocol);    
+    kfree(pProtocol);    
 }
 
 static int InitTxCreditState(struct gmbox_proto_hci_uart *pProt)
diff --git a/drivers/staging/ath6kl/htc2/htc.c b/drivers/staging/ath6kl/htc2/htc.c
index d40bb14..ae54e64 100644
--- a/drivers/staging/ath6kl/htc2/htc.c
+++ b/drivers/staging/ath6kl/htc2/htc.c
@@ -70,7 +70,7 @@
     
     for (i = 0;i < NUM_CONTROL_BUFFERS;i++) {
         if (target->HTCControlBuffers[i].Buffer) {
-            A_FREE(target->HTCControlBuffers[i].Buffer);
+            kfree(target->HTCControlBuffers[i].Buffer);
         }
     }
     
@@ -86,7 +86,7 @@
         A_MUTEX_DELETE(&target->HTCTxLock);
     }
         /* free our instance */
-    A_FREE(target);
+    kfree(target);
 }
 
 /* registered target arrival callback from the HIF layer */
@@ -448,9 +448,7 @@
         pEndpoint->ServiceID = 0;
         pEndpoint->MaxMsgLength = 0;
         pEndpoint->MaxTxQueueDepth = 0;
-#ifdef HTC_EP_STAT_PROFILING
         A_MEMZERO(&pEndpoint->EndPointStats,sizeof(pEndpoint->EndPointStats));
-#endif
         INIT_HTC_PACKET_QUEUE(&pEndpoint->RxBuffers);
         INIT_HTC_PACKET_QUEUE(&pEndpoint->TxQueue);
         INIT_HTC_PACKET_QUEUE(&pEndpoint->RecvIndicationQueue);
@@ -527,7 +525,6 @@
                                 struct htc_endpoint_stats       *pStats)
 {
 
-#ifdef HTC_EP_STAT_PROFILING
     struct htc_target *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
     bool     clearStats = false;
     bool     sample = false;
@@ -568,9 +565,6 @@
     UNLOCK_HTC_TX(target);
 
     return true;
-#else
-    return false;
-#endif
 }
 
 struct ar6k_device  *HTCGetAR6KDevice(void *HTCHandle)
diff --git a/drivers/staging/ath6kl/htc2/htc_internal.h b/drivers/staging/ath6kl/htc2/htc_internal.h
index 9425ed9..1c9aeca 100644
--- a/drivers/staging/ath6kl/htc2/htc_internal.h
+++ b/drivers/staging/ath6kl/htc2/htc_internal.h
@@ -27,7 +27,6 @@
  * processing errors, the last frame header is dump for comparison */
 //#define HTC_CAPTURE_LAST_FRAME
 
-//#define HTC_EP_STAT_PROFILING
 
 #ifdef __cplusplus
 extern "C" {
@@ -82,17 +81,10 @@
     struct htc_target           *target;                /* back pointer to target */
     u8 SeqNo;                  /* TX seq no (helpful) for debugging */
     u32 LocalConnectionFlags;   /* local connection flags */
-#ifdef HTC_EP_STAT_PROFILING
     struct htc_endpoint_stats          EndPointStats;          /* endpoint statistics */
-#endif
 };
 
-#ifdef HTC_EP_STAT_PROFILING
 #define INC_HTC_EP_STAT(p,stat,count) (p)->EndPointStats.stat += (count);
-#else
-#define INC_HTC_EP_STAT(p,stat,count)
-#endif
-
 #define HTC_SERVICE_TX_PACKET_TAG  HTC_TX_PACKET_TAG_INTERNAL
 
 #define NUM_CONTROL_BUFFERS     8
diff --git a/drivers/staging/ath6kl/htc2/htc_recv.c b/drivers/staging/ath6kl/htc2/htc_recv.c
index c208801..974cc8c 100644
--- a/drivers/staging/ath6kl/htc2/htc_recv.c
+++ b/drivers/staging/ath6kl/htc2/htc_recv.c
@@ -36,7 +36,6 @@
                         (pP)->PktInfo.AsRx.ExpectedHdr,        \
                         (pP)->Endpoint))                         
                         
-#ifdef HTC_EP_STAT_PROFILING
 #define HTC_RX_STAT_PROFILE(t,ep,numLookAheads)        \
 {                                                      \
     INC_HTC_EP_STAT((ep), RxReceived, 1);              \
@@ -46,9 +45,6 @@
         INC_HTC_EP_STAT((ep), RxBundleLookAheads, 1);  \
     }                                                  \
 }
-#else
-#define HTC_RX_STAT_PROFILE(t,ep,lookAhead)
-#endif
 
 static void DoRecvCompletion(struct htc_endpoint     *pEndpoint,
                              struct htc_packet_queue *pQueueToIndicate)
@@ -931,12 +927,10 @@
         }
         
         if (!status) {
-#ifdef HTC_EP_STAT_PROFILING
             LOCK_HTC_RX(target);              
             HTC_RX_STAT_PROFILE(target,pEndpoint,numLookAheads);
             INC_HTC_EP_STAT(pEndpoint, RxPacketsBundled, 1);
             UNLOCK_HTC_RX(target);
-#endif      
             if (i == (pScatterReq->ValidScatterEntries - 1)) {
                     /* last packet's more packets flag is set based on the lookahead */
                 SET_MORE_RX_PACKET_INDICATION_FLAG(lookAheads,numLookAheads,pEndpoint,pPacket);
diff --git a/drivers/staging/ath6kl/htc2/htc_send.c b/drivers/staging/ath6kl/htc2/htc_send.c
index 6f4050a..9310d4d 100644
--- a/drivers/staging/ath6kl/htc2/htc_send.c
+++ b/drivers/staging/ath6kl/htc2/htc_send.c
@@ -776,9 +776,6 @@
         AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("  Endpoint %d got %d credits \n",
                 pRpt->EndpointID, pRpt->Credits));
 
-
-#ifdef HTC_EP_STAT_PROFILING
-
         INC_HTC_EP_STAT(pEndpoint, TxCreditRpts, 1);
         INC_HTC_EP_STAT(pEndpoint, TxCreditsReturned, pRpt->Credits);
 
@@ -797,8 +794,6 @@
             INC_HTC_EP_STAT(pEndpoint, TxCreditRptsFromOther, 1);
         }
 
-#endif
-
         if (ENDPOINT_0 == pRpt->EndpointID) {
                 /* always give endpoint 0 credits back */
             pEndpoint->CreditDist.TxCredits += pRpt->Credits;
diff --git a/drivers/staging/ath6kl/include/a_config.h b/drivers/staging/ath6kl/include/a_config.h
index 4a0083c..f7c0931 100644
--- a/drivers/staging/ath6kl/include/a_config.h
+++ b/drivers/staging/ath6kl/include/a_config.h
@@ -26,28 +26,6 @@
 #ifndef _A_CONFIG_H_
 #define _A_CONFIG_H_
 
-#ifdef UNDER_NWIFI
-#include "../os/windows/include/config.h"
-#endif
-
-#ifdef ATHR_CE_LEGACY
-#include "../os/windows/include/config.h"
-#endif
-
-#if defined(__linux__) && !defined(LINUX_EMULATION)
 #include "../os/linux/include/config_linux.h"
-#endif
-
-#ifdef REXOS
-#include "../os/rexos/include/common/config_rexos.h"
-#endif
-
-#ifdef WIN_NWF
-#include "../os/windows/include/win/config_win.h"
-#endif
-
-#ifdef THREADX
-#include "../os/threadx/include/common/config_threadx.h"
-#endif
 
 #endif
diff --git a/drivers/staging/ath6kl/include/a_debug.h b/drivers/staging/ath6kl/include/a_debug.h
index d433942..51cb633 100644
--- a/drivers/staging/ath6kl/include/a_debug.h
+++ b/drivers/staging/ath6kl/include/a_debug.h
@@ -187,35 +187,7 @@
 void a_module_debug_support_init(void);
 void a_module_debug_support_cleanup(void);
 
-#ifdef UNDER_NWIFI
-#include "../os/windows/include/debug.h"
-#endif
-
-#ifdef ATHR_CE_LEGACY
-#include "../os/windows/include/debug.h"
-#endif
-
-#if defined(__linux__) && !defined(LINUX_EMULATION)
 #include "../os/linux/include/debug_linux.h"
-#endif
-
-#ifdef REXOS
-#include "../os/rexos/include/common/debug_rexos.h"
-#endif
-
-#if defined ART_WIN
-#include "../os/win_art/include/debug_win.h"
-#endif
-
-#ifdef WIN_NWF
-#include <debug_win.h>
-#endif
-
-#ifdef THREADX
-#define ATH_DEBUG_MAKE_MODULE_MASK(index)  (1 << (ATH_DEBUG_MODULE_MASK_SHIFT + (index)))
-#include "../os/threadx/include/common/debug_threadx.h"
-#endif  
-
 
 #ifdef __cplusplus
 }
diff --git a/drivers/staging/ath6kl/include/a_drv.h b/drivers/staging/ath6kl/include/a_drv.h
index 6db10f0..1548604 100644
--- a/drivers/staging/ath6kl/include/a_drv.h
+++ b/drivers/staging/ath6kl/include/a_drv.h
@@ -27,28 +27,6 @@
 #ifndef _A_DRV_H_
 #define _A_DRV_H_
 
-#if defined(__linux__) && !defined(LINUX_EMULATION)
 #include "../os/linux/include/athdrv_linux.h"
-#endif
-
-#ifdef UNDER_NWIFI
-#include "../os/windows/include/athdrv.h"
-#endif
-
-#ifdef ATHR_CE_LEGACY
-#include "../os/windows/include/athdrv.h"
-#endif
-
-#ifdef REXOS
-#include "../os/rexos/include/common/athdrv_rexos.h"
-#endif
-
-#ifdef WIN_NWF
-#include "../os/windows/include/athdrv.h"
-#endif
-
-#ifdef THREADX
-#include "../os/threadx/include/common/athdrv_threadx.h"
-#endif
 
 #endif /* _ADRV_H_ */
diff --git a/drivers/staging/ath6kl/include/a_drv_api.h b/drivers/staging/ath6kl/include/a_drv_api.h
index 5e098cb..a40d97a8 100644
--- a/drivers/staging/ath6kl/include/a_drv_api.h
+++ b/drivers/staging/ath6kl/include/a_drv_api.h
@@ -130,34 +130,6 @@
 #define A_WMI_PEER_EVENT(devt, eventCode, bssid)    \
     ar6000_peer_event ((devt), (eventCode), (bssid))
 
-#ifdef CONFIG_HOST_GPIO_SUPPORT
-
-#define A_WMI_GPIO_INTR_RX(intr_mask, input_values) \
-    ar6000_gpio_intr_rx((intr_mask), (input_values))
-
-#define A_WMI_GPIO_DATA_RX(reg_id, value) \
-    ar6000_gpio_data_rx((reg_id), (value))
-
-#define A_WMI_GPIO_ACK_RX() \
-    ar6000_gpio_ack_rx()
-
-#endif
-
-#ifdef SEND_EVENT_TO_APP
-
-#define A_WMI_SEND_EVENT_TO_APP(ar, eventId, datap, len) \
-    ar6000_send_event_to_app((ar), (eventId), (datap), (len))
-
-#define A_WMI_SEND_GENERIC_EVENT_TO_APP(ar, eventId, datap, len) \
-    ar6000_send_generic_event_to_app((ar), (eventId), (datap), (len))
-
-#else
-
-#define A_WMI_SEND_EVENT_TO_APP(ar, eventId, datap, len)
-#define A_WMI_SEND_GENERIC_EVENT_TO_APP(ar, eventId, datap, len)
-
-#endif
-
 #ifdef CONFIG_HOST_TCMD_SUPPORT
 #define A_WMI_TCMD_RX_REPORT_EVENT(devt, results, len) \
     ar6000_tcmd_rx_report_event((devt), (results), (len))
diff --git a/drivers/staging/ath6kl/include/a_osapi.h b/drivers/staging/ath6kl/include/a_osapi.h
index 7bdeeea..fd7ae0d 100644
--- a/drivers/staging/ath6kl/include/a_osapi.h
+++ b/drivers/staging/ath6kl/include/a_osapi.h
@@ -27,35 +27,6 @@
 #ifndef _A_OSAPI_H_
 #define _A_OSAPI_H_
 
-#if defined(__linux__) && !defined(LINUX_EMULATION)
 #include "../os/linux/include/osapi_linux.h"
-#endif
-
-#ifdef UNDER_NWIFI
-#include "../os/windows/include/osapi.h"
-#include "../os/windows/include/netbuf.h"
-#endif
-
-#ifdef ATHR_CE_LEGACY
-#include "../os/windows/include/osapi.h"
-#include "../os/windows/include/netbuf.h"
-#endif
-
-#ifdef REXOS
-#include "../os/rexos/include/common/osapi_rexos.h"
-#endif
-
-#if defined ART_WIN
-#include "../os/win_art/include/osapi_win.h"
-#include "../os/win_art/include/netbuf.h"
-#endif
-
-#ifdef WIN_NWF
-#include <osapi_win.h>
-#endif 
-
-#if defined(THREADX)
-#include "../os/threadx/include/common/osapi_threadx.h"
-#endif 
 
 #endif /* _OSAPI_H_ */
diff --git a/drivers/staging/ath6kl/include/a_types.h b/drivers/staging/ath6kl/include/a_types.h
index 18f4cfe..4b6783f6 100644
--- a/drivers/staging/ath6kl/include/a_types.h
+++ b/drivers/staging/ath6kl/include/a_types.h
@@ -27,32 +27,6 @@
 #ifndef _A_TYPES_H_
 #define _A_TYPES_H_
 
-#if defined(__linux__) && !defined(LINUX_EMULATION)
 #include "../os/linux/include/athtypes_linux.h"
-#endif
-
-#ifdef UNDER_NWIFI
-#include "../os/windows/include/athtypes.h"
-#endif
-
-#ifdef ATHR_CE_LEGACY
-#include "../os/windows/include/athtypes.h"
-#endif
-
-#ifdef REXOS
-#include "../os/rexos/include/common/athtypes_rexos.h"
-#endif
-
-#if defined ART_WIN
-#include "../os/win_art/include/athtypes_win.h"
-#endif
-
-#ifdef WIN_NWF
-#include <athtypes_win.h>
-#endif
-
-#ifdef THREADX
-#include "../os/threadx/include/common/athtypes_threadx.h"
-#endif
 
 #endif /* _ATHTYPES_H_ */
diff --git a/drivers/staging/ath6kl/include/ar6000_api.h b/drivers/staging/ath6kl/include/ar6000_api.h
index 1e1d92a..e946080 100644
--- a/drivers/staging/ath6kl/include/ar6000_api.h
+++ b/drivers/staging/ath6kl/include/ar6000_api.h
@@ -26,29 +26,7 @@
 #ifndef _AR6000_API_H_
 #define _AR6000_API_H_
 
-#if defined(__linux__) && !defined(LINUX_EMULATION)
 #include "../os/linux/include/ar6xapi_linux.h"
-#endif
-
-#ifdef UNDER_NWIFI
-#include "../os/windows/include/ar6xapi.h"
-#endif
-
-#ifdef ATHR_CE_LEGACY
-#include "../os/windows/include/ar6xapi.h"
-#endif
-
-#ifdef REXOS
-#include "../os/rexos/include/common/ar6xapi_rexos.h"
-#endif
-
-#if defined ART_WIN
-#include "../os/win_art/include/ar6xapi_win.h"
-#endif
-
-#ifdef WIN_NWF
-#include "../os/windows/include/ar6xapi.h"
-#endif
 
 #endif /* _AR6000_API_H */
 
diff --git a/drivers/staging/ath6kl/include/athendpack.h b/drivers/staging/ath6kl/include/athendpack.h
deleted file mode 100644
index 1b94050..0000000
--- a/drivers/staging/ath6kl/include/athendpack.h
+++ /dev/null
@@ -1,52 +0,0 @@
-//------------------------------------------------------------------------------
-// <copyright file="athendpack.h" company="Atheros">
-//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
-// 
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-//
-//
-//------------------------------------------------------------------------------
-//==============================================================================
-// end compiler-specific structure packing
-//
-// Author(s): ="Atheros"
-//==============================================================================
-#ifdef VXWORKS
-#endif /* VXWORKS */
-
-#if defined(LINUX) || defined(__linux__)
-#endif /* LINUX */
-
-#ifdef QNX
-#endif /* QNX */
-
-#ifdef INTEGRITY
-#include "integrity/athendpack_integrity.h"
-#endif /* INTEGRITY */
-
-#ifdef NUCLEUS
-#endif /* NUCLEUS */
-
-
-#ifdef UNDER_NWIFI
-#include "../os/windows/include/athendpack.h"
-#endif
-
-#ifdef ATHR_CE_LEGACY
-#include "../os/windows/include/athendpack.h"
-#endif /* WINCE */
-
-#ifdef WIN_NWF
-#include <athendpack_win.h>
-#endif 
diff --git a/drivers/staging/ath6kl/include/athstartpack.h b/drivers/staging/ath6kl/include/athstartpack.h
deleted file mode 100644
index 1c45f66..0000000
--- a/drivers/staging/ath6kl/include/athstartpack.h
+++ /dev/null
@@ -1,55 +0,0 @@
-//------------------------------------------------------------------------------
-// <copyright file="athstartpack.h" company="Atheros">
-//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
-// 
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-//
-//
-//------------------------------------------------------------------------------
-//==============================================================================
-// start compiler-specific structure packing
-//
-// Author(s): ="Atheros"
-//==============================================================================
-#ifdef VXWORKS
-#endif /* VXWORKS */
-
-#if defined(LINUX) || defined(__linux__)
-#endif /* LINUX */
-
-#ifdef QNX
-#endif /* QNX */
-
-#ifdef INTEGRITY
-#include "integrity/athstartpack_integrity.h"
-#endif /* INTEGRITY */
-
-#ifdef NUCLEUS
-#endif /* NUCLEUS */
-
-#ifdef UNDER_NWIFI
-#include "../os/windows/include/athstartpack.h"
-#endif
-
-#ifdef ATHR_CE_LEGACY
-#include "../os/windows/include/athstartpack.h"
-#endif /* WINCE */
-
-#ifdef WIN_NWF
-#include <athstartpack_win.h>
-#endif
-
-#ifdef THREADX
-#include "../os/threadx/include/common/osapi_threadx.h"
-#endif 
diff --git a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/analog_intf_reg.h b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/analog_intf_reg.h
index 01b9eb5..b8de1c9 100644
--- a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/analog_intf_reg.h
+++ b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/analog_intf_reg.h
@@ -21,17 +21,4 @@
 //===================================================================
 
 
-#ifdef WLAN_HEADERS
-
 #include "analog_intf_athr_wlan_reg.h"
-
-
-#ifndef BT_HEADERS
-
-
-
-#endif
-#endif
-
-
-
diff --git a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/apb_map.h b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/apb_map.h
index e4d2d62..0068ca3 100644
--- a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/apb_map.h
+++ b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/apb_map.h
@@ -21,11 +21,8 @@
 //===================================================================
 
 
-#ifdef WLAN_HEADERS
-
 #include "apb_athr_wlan_map.h"
 
-
 #ifndef BT_HEADERS
 
 #define RTC_BASE_ADDRESS WLAN_RTC_BASE_ADDRESS
@@ -40,9 +37,4 @@
 #define MAC_BASE_ADDRESS WLAN_MAC_BASE_ADDRESS
 #define RDMA_BASE_ADDRESS WLAN_RDMA_BASE_ADDRESS
 
-
 #endif
-#endif
-
-
-
diff --git a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/gpio_reg.h b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/gpio_reg.h
index b3e7126..afef47e 100644
--- a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/gpio_reg.h
+++ b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/gpio_reg.h
@@ -21,11 +21,8 @@
 //===================================================================
 
 
-#ifdef WLAN_HEADERS
-
 #include "gpio_athr_wlan_reg.h"
 
-
 #ifndef BT_HEADERS
 
 #define GPIO_OUT_ADDRESS WLAN_GPIO_OUT_ADDRESS
@@ -1086,9 +1083,4 @@
 #define RESET_TUPLE_STATUS_PIN_RESET_TUPLE_GET(x) WLAN_RESET_TUPLE_STATUS_PIN_RESET_TUPLE_GET(x)
 #define RESET_TUPLE_STATUS_PIN_RESET_TUPLE_SET(x) WLAN_RESET_TUPLE_STATUS_PIN_RESET_TUPLE_SET(x)
 
-
 #endif
-#endif
-
-
-
diff --git a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_host_reg.h b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_host_reg.h
index 3af5621..109f24e 100644
--- a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_host_reg.h
+++ b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_host_reg.h
@@ -21,17 +21,4 @@
 //===================================================================
 
 
-#ifdef WLAN_HEADERS
-
 #include "mbox_wlan_host_reg.h"
-
-
-#ifndef BT_HEADERS
-
-
-
-#endif
-#endif
-
-
-
diff --git a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_reg.h b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_reg.h
index cc67585..72fa483 100644
--- a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_reg.h
+++ b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_reg.h
@@ -21,11 +21,8 @@
 //===================================================================
 
 
-#ifdef WLAN_HEADERS
-
 #include "mbox_wlan_reg.h"
 
-
 #ifndef BT_HEADERS
 
 #define MBOX_FIFO_ADDRESS WLAN_MBOX_FIFO_ADDRESS
@@ -552,9 +549,4 @@
 #define HOST_IF_WINDOW_DATA_GET(x) WLAN_HOST_IF_WINDOW_DATA_GET(x)
 #define HOST_IF_WINDOW_DATA_SET(x) WLAN_HOST_IF_WINDOW_DATA_SET(x)
 
-
 #endif
-#endif
-
-
-
diff --git a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/rtc_reg.h b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/rtc_reg.h
index 0855de5..82bd708 100644
--- a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/rtc_reg.h
+++ b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/rtc_reg.h
@@ -21,11 +21,8 @@
 //===================================================================
 
 
-#ifdef WLAN_HEADERS
-
 #include "rtc_wlan_reg.h"
 
-
 #ifndef BT_HEADERS
 
 #define RESET_CONTROL_ADDRESS WLAN_RESET_CONTROL_ADDRESS
@@ -967,9 +964,4 @@
 #define GPIO_WAKEUP_CONTROL_ENABLE_GET(x) WLAN_GPIO_WAKEUP_CONTROL_ENABLE_GET(x)
 #define GPIO_WAKEUP_CONTROL_ENABLE_SET(x) WLAN_GPIO_WAKEUP_CONTROL_ENABLE_SET(x)
 
-
 #endif
-#endif
-
-
-
diff --git a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/umbox_reg.h b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/umbox_reg.h
index b233cbc..b18ff48 100644
--- a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/umbox_reg.h
+++ b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/umbox_reg.h
@@ -20,18 +20,4 @@
 // Author(s): ="Atheros"
 //===================================================================
 
-
-#ifdef WLAN_HEADERS
-
 #include "umbox_wlan_reg.h"
-
-
-#ifndef BT_HEADERS
-
-
-
-#endif
-#endif
-
-
-
diff --git a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/vmc_reg.h b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/vmc_reg.h
index c3d8088..990f2be 100644
--- a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/vmc_reg.h
+++ b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/vmc_reg.h
@@ -21,11 +21,8 @@
 //===================================================================
 
 
-#ifdef WLAN_HEADERS
-
 #include "vmc_wlan_reg.h"
 
-
 #ifndef BT_HEADERS
 
 #define MC_BCAM_VALID_ADDRESS WLAN_MC_BCAM_VALID_ADDRESS
@@ -159,9 +156,4 @@
 #define CPU_RAM4_CONFLICT_CNT_GET(x) WLAN_CPU_RAM4_CONFLICT_CNT_GET(x)
 #define CPU_RAM4_CONFLICT_CNT_SET(x) WLAN_CPU_RAM4_CONFLICT_CNT_SET(x)
 
-
 #endif
-#endif
-
-
-
diff --git a/drivers/staging/ath6kl/include/common/bmi_msg.h b/drivers/staging/ath6kl/include/common/bmi_msg.h
index e76624c..84e8db5 100644
--- a/drivers/staging/ath6kl/include/common/bmi_msg.h
+++ b/drivers/staging/ath6kl/include/common/bmi_msg.h
@@ -22,10 +22,6 @@
 #ifndef __BMI_MSG_H__
 #define __BMI_MSG_H__
 
-#ifndef ATH_TARGET
-#include "athstartpack.h"
-#endif
-
 /*
  * Bootloader Messaging Interface (BMI)
  *
@@ -234,8 +230,4 @@
          * Note: Not supported on all versions of ROM firmware.
          */
 
-#ifndef ATH_TARGET
-#include "athendpack.h"
-#endif
-
 #endif /* __BMI_MSG_H__ */
diff --git a/drivers/staging/ath6kl/include/common/dbglog.h b/drivers/staging/ath6kl/include/common/dbglog.h
index b7a1230..5566e56 100644
--- a/drivers/staging/ath6kl/include/common/dbglog.h
+++ b/drivers/staging/ath6kl/include/common/dbglog.h
@@ -24,10 +24,6 @@
 #ifndef _DBGLOG_H_
 #define _DBGLOG_H_
 
-#ifndef ATH_TARGET
-#include "athstartpack.h"
-#endif
-
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -127,8 +123,4 @@
 }
 #endif
 
-#ifndef ATH_TARGET
-#include "athendpack.h"
-#endif
-
 #endif /* _DBGLOG_H_ */
diff --git a/drivers/staging/ath6kl/include/common/dset_internal.h b/drivers/staging/ath6kl/include/common/dset_internal.h
index 6947533..e3ecd8e 100644
--- a/drivers/staging/ath6kl/include/common/dset_internal.h
+++ b/drivers/staging/ath6kl/include/common/dset_internal.h
@@ -25,10 +25,6 @@
 #ifndef __DSET_INTERNAL_H__
 #define __DSET_INTERNAL_H__
 
-#ifndef ATH_TARGET
-#include "athstartpack.h"
-#endif
-
 /*
  * Internal dset definitions, common for DataSet layer.
  */
@@ -56,8 +52,4 @@
                                               Dataset descriptor for BPatch. */
 } POSTPACK dset_descriptor_t;
 
-#ifndef ATH_TARGET
-#include "athendpack.h"
-#endif
-
 #endif /* __DSET_INTERNAL_H__ */
diff --git a/drivers/staging/ath6kl/include/common/dsetid.h b/drivers/staging/ath6kl/include/common/dsetid.h
index 090e309..cc797ba 100644
--- a/drivers/staging/ath6kl/include/common/dsetid.h
+++ b/drivers/staging/ath6kl/include/common/dsetid.h
@@ -25,10 +25,6 @@
 #ifndef __DSETID_H__
 #define __DSETID_H__
 
-#ifndef ATH_TARGET
-#include "athstartpack.h"
-#endif
-
 /* Well-known DataSet IDs */
 #define DSETID_UNUSED                     0x00000000
 #define DSETID_BOARD_DATA                 0x00000001 /* Cal and board data */
@@ -127,8 +123,4 @@
  */
 #define DSETID_BPATCH_FLAG                0x80000000
 
-#ifndef ATH_TARGET
-#include "athendpack.h"
-#endif
-
 #endif /* __DSETID_H__ */
diff --git a/drivers/staging/ath6kl/include/common/epping_test.h b/drivers/staging/ath6kl/include/common/epping_test.h
index 7027fac..9eb5fdf 100644
--- a/drivers/staging/ath6kl/include/common/epping_test.h
+++ b/drivers/staging/ath6kl/include/common/epping_test.h
@@ -25,10 +25,6 @@
 #ifndef EPPING_TEST_H_
 #define EPPING_TEST_H_
 
-#ifndef ATH_TARGET
-#include "athstartpack.h"
-#endif
-
     /* alignment to 4-bytes */
 #define EPPING_ALIGNMENT_PAD  (((sizeof(struct htc_frame_hdr) + 3) & (~0x3)) - sizeof(struct htc_frame_hdr))
 
@@ -112,9 +108,4 @@
 #define HCI_TRANSPORT_STREAM_NUM  16  /* this number is higher than the define WMM AC classes so we
                                          can use this to distinguish packets */
 
-#ifndef ATH_TARGET
-#include "athendpack.h"
-#endif
-    
-    
 #endif /*EPPING_TEST_H_*/
diff --git a/drivers/staging/ath6kl/include/common/gmboxif.h b/drivers/staging/ath6kl/include/common/gmboxif.h
index dd9afbd..ea11c14 100644
--- a/drivers/staging/ath6kl/include/common/gmboxif.h
+++ b/drivers/staging/ath6kl/include/common/gmboxif.h
@@ -23,10 +23,6 @@
 #ifndef __GMBOXIF_H__
 #define __GMBOXIF_H__
 
-#ifndef ATH_TARGET
-#include "athstartpack.h"
-#endif
-
 /* GMBOX interface definitions */
     
 #define AR6K_GMBOX_CREDIT_COUNTER       1   /* we use credit counter 1 to track credits */
@@ -70,9 +66,5 @@
 #define MBOX_SIG_HCI_BRIDGE_PWR_SAV_OFF   4
 
 
-#ifndef ATH_TARGET
-#include "athendpack.h"
-#endif
-
 #endif /* __GMBOXIF_H__ */
 
diff --git a/drivers/staging/ath6kl/include/common/htc.h b/drivers/staging/ath6kl/include/common/htc.h
index b9d4495..85cbfa8 100644
--- a/drivers/staging/ath6kl/include/common/htc.h
+++ b/drivers/staging/ath6kl/include/common/htc.h
@@ -24,10 +24,6 @@
 #ifndef __HTC_H__
 #define __HTC_H__
 
-#ifndef ATH_TARGET
-#include "athstartpack.h"
-#endif
-
 #define A_OFFSETOF(type,field) (unsigned long)(&(((type *)NULL)->field))
 
 #define ASSEMBLE_UNALIGNED_UINT16(p,highbyte,lowbyte) \
@@ -227,10 +223,5 @@
     u8 LookAhead[4];     /* 4 byte lookahead */
 } POSTPACK HTC_BUNDLED_LOOKAHEAD_REPORT;
 
-#ifndef ATH_TARGET
-#include "athendpack.h"
-#endif
-
-
 #endif /* __HTC_H__ */
 
diff --git a/drivers/staging/ath6kl/include/common/regdump.h b/drivers/staging/ath6kl/include/common/regdump.h
index aa64821..614dfa1 100644
--- a/drivers/staging/ath6kl/include/common/regdump.h
+++ b/drivers/staging/ath6kl/include/common/regdump.h
@@ -24,10 +24,6 @@
 #ifndef __REGDUMP_H__
 #define __REGDUMP_H__
 
-#ifndef ATH_TARGET
-#include "athstartpack.h"
-#endif
-
 #if defined(AR6001)
 #include "AR6001/AR6001_regdump.h"
 #endif
@@ -52,8 +48,4 @@
 } POSTPACK;
 #endif /* __ASSEMBLER__ */
 
-#ifndef ATH_TARGET
-#include "athendpack.h"
-#endif
-
 #endif /* __REGDUMP_H__ */
diff --git a/drivers/staging/ath6kl/include/common/targaddrs.h b/drivers/staging/ath6kl/include/common/targaddrs.h
index 794ae21..b172209 100644
--- a/drivers/staging/ath6kl/include/common/targaddrs.h
+++ b/drivers/staging/ath6kl/include/common/targaddrs.h
@@ -22,10 +22,6 @@
 #ifndef __TARGADDRS_H__
 #define __TARGADDRS_H__
 
-#ifndef ATH_TARGET
-#include "athstartpack.h"
-#endif
-
 #if defined(AR6002)
 #include "AR6002/addrs.h"
 #endif
@@ -91,15 +87,7 @@
     /* Pointer to debug logging header */
     u32 hi_dbglog_hdr;                             /* 0x08 */
 
-    /* Indicates whether or not flash is present on Target.
-     * NB: flash_is_present indicator is here not just
-     * because it might be of interest to the Host; but
-     * also because it's set early on by Target's startup
-     * asm code and we need it to have a special RAM address
-     * so that it doesn't get reinitialized with the rest
-     * of data.
-     */
-    u32 hi_flash_is_present;                       /* 0x0c */
+    u32 hi_unused1;                       /* 0x0c */
 
     /*
      * General-purpose flag bits, similar to AR6000_OPTION_* flags.
@@ -113,7 +101,7 @@
      */
     u32 hi_serial_enable;                          /* 0x14 */
 
-    /* Start address of Flash DataSet index, if any */
+    /* Start address of DataSet index, if any */
     u32 hi_dset_list_head;                         /* 0x18 */
 
     /* Override Target application start address */
@@ -171,35 +159,179 @@
     u32 hi_hci_uart_support_pins;                  /* 0xa4 */
         /* NOTE: byte [0] = RESET pin (bit 7 is polarity), bytes[1]..bytes[3] are for future use */
     u32 hi_hci_uart_pwr_mgmt_params;               /* 0xa8 */
-        /* 0xa8 - [0]: 1 = enable, 0 = disable
-         *        [1]: 0 = UART FC active low, 1 = UART FC active high
-         * 0xa9 - [7:0]: wakeup timeout in ms
-         * 0xaa, 0xab - [15:0]: idle timeout in ms
-         */       
-    /* Pointer to extended board Data  */
-    u32 hi_board_ext_data;                         /* 0xac */
-    u32 hi_board_ext_data_initialized;             /* 0xb0 */
+	/*
+	 * 0xa8   - [1]: 0 = UART FC active low, 1 = UART FC active high
+	 *      [31:16]: wakeup timeout in ms
+	 */
+
+	/* Pointer to extended board data */
+	u32 hi_board_ext_data;                /* 0xac */
+	u32 hi_board_ext_data_config;         /* 0xb0 */
+
+	/*
+         * Bit [0]  :   valid
+         * Bit[31:16:   size
+	*/
+	/*
+	 * hi_reset_flag is used to do some stuff when target reset.
+	 * such as restore app_start after warm reset or
+	 * preserve host Interest area, or preserve ROM data, literals etc.
+	 */
+	u32 hi_reset_flag;                            /* 0xb4 */
+	/* indicate hi_reset_flag is valid */
+	u32 hi_reset_flag_valid;                      /* 0xb8 */
+	u32 hi_hci_uart_pwr_mgmt_params_ext;           /* 0xbc */
+	/*
+	 * 0xbc - [31:0]: idle timeout in ms
+	 */
+	/* ACS flags */
+	u32 hi_acs_flags;                              /* 0xc0 */
+	u32 hi_console_flags;                          /* 0xc4 */
+	u32 hi_nvram_state;                            /* 0xc8 */
+	u32 hi_option_flag2;                           /* 0xcc */
+
+	/* If non-zero, override values sent to Host in WMI_READY event. */
+	u32 hi_sw_version_override;                    /* 0xd0 */
+	u32 hi_abi_version_override;                   /* 0xd4 */
+
+	/*
+	 * Percentage of high priority RX traffic to total expected RX traffic -
+	 * applicable only to ar6004
+	 */
+	u32 hi_hp_rx_traffic_ratio;                    /* 0xd8 */
+
+	/* test applications flags */
+	u32 hi_test_apps_related    ;                  /* 0xdc */
+	/* location of test script */
+	u32 hi_ota_testscript;                         /* 0xe0 */
+	/* location of CAL data */
+	u32 hi_cal_data;                               /* 0xe4 */
+	/* Number of packet log buffers */
+        u32 hi_pktlog_num_buffers;                     /* 0xe8 */
+
 } POSTPACK;
 
 /* Bits defined in hi_option_flag */
 #define HI_OPTION_TIMER_WAR       0x01 /* Enable timer workaround */
 #define HI_OPTION_BMI_CRED_LIMIT  0x02 /* Limit BMI command credits */
 #define HI_OPTION_RELAY_DOT11_HDR 0x04 /* Relay Dot11 hdr to/from host */
-#define HI_OPTION_FW_MODE_LSB     0x08 /* low bit of MODE (see below) */
-#define HI_OPTION_FW_MODE_MSB     0x10 /* high bit of MODE (see below) */
-#define HI_OPTION_ENABLE_PROFILE  0x20 /* Enable CPU profiling */
-#define HI_OPTION_DISABLE_DBGLOG  0x40 /* Disable debug logging */
-#define HI_OPTION_SKIP_ERA_TRACKING  0x80 /* Skip Era Tracking */
-#define HI_OPTION_PAPRD_DISABLE      0x100 /* Disable PAPRD (debug) */
+/* MAC addr method 0-locally administred 1-globally unique addrs */
+#define HI_OPTION_MAC_ADDR_METHOD   0x08
+#define HI_OPTION_FW_BRIDGE         0x10 /* Firmware Bridging */
+#define HI_OPTION_ENABLE_PROFILE    0x20 /* Enable CPU profiling */
+#define HI_OPTION_DISABLE_DBGLOG    0x40 /* Disable debug logging */
+#define HI_OPTION_SKIP_ERA_TRACKING 0x80 /* Skip Era Tracking */
+#define HI_OPTION_PAPRD_DISABLE     0x100 /* Disable PAPRD (debug) */
+#define HI_OPTION_NUM_DEV_LSB       0x200
+#define HI_OPTION_NUM_DEV_MSB       0x800
+#define HI_OPTION_DEV_MODE_LSB      0x1000
+#define HI_OPTION_DEV_MODE_MSB      0x8000000
+/* Disable LowFreq Timer Stabilization */
+#define HI_OPTION_NO_LFT_STBL       0x10000000
+#define HI_OPTION_SKIP_REG_SCAN     0x20000000 /* Skip regulatory scan */
+/* Do regulatory scan during init beforesending WMI ready event to host */
+#define HI_OPTION_INIT_REG_SCAN     0x40000000
+#define HI_OPTION_SKIP_MEMMAP       0x80000000 /* REV6: Do not adjust memory
+                                                map */
+
+/* hi_option_flag2 options */
+#define HI_OPTION_OFFLOAD_AMSDU     0x01
+#define HI_OPTION_DFS_SUPPORT       0x02 /* Enable DFS support */
+
+#define HI_OPTION_MAC_ADDR_METHOD_SHIFT 3
 
 /* 2 bits of hi_option_flag are used to represent 3 modes */
 #define HI_OPTION_FW_MODE_IBSS    0x0 /* IBSS Mode */
 #define HI_OPTION_FW_MODE_BSS_STA 0x1 /* STA Mode */
 #define HI_OPTION_FW_MODE_AP      0x2 /* AP Mode */
 
-/* Fw Mode Mask */
-#define HI_OPTION_FW_MODE_MASK    0x3
-#define HI_OPTION_FW_MODE_SHIFT   0x3
+/* 2 bits of hi_option flag are usedto represent 4 submodes */
+#define HI_OPTION_FW_SUBMODE_NONE    0x0  /* Normal mode */
+#define HI_OPTION_FW_SUBMODE_P2PDEV  0x1  /* p2p device mode */
+#define HI_OPTION_FW_SUBMODE_P2PCLIENT 0x2 /* p2p client mode */
+#define HI_OPTION_FW_SUBMODE_P2PGO   0x3 /* p2p go mode */
+
+/* Num dev Mask */
+#define HI_OPTION_NUM_DEV_MASK    0x7
+#define HI_OPTION_NUM_DEV_SHIFT   0x9
+
+/* firmware bridging */
+#define HI_OPTION_FW_BRIDGE_SHIFT 0x04
+
+/* Fw Mode/SubMode Mask
+|------------------------------------------------------------------------------|
+|   SUB   |   SUB   |   SUB   |  SUB    |         |         |         |
+| MODE[3] | MODE[2] | MODE[1] | MODE[0] | MODE[3] | MODE[2] | MODE[1] | MODE[0|
+|   (2)   |   (2)   |   (2)   |   (2)   |   (2)   |   (2)   |   (2)   |   (2)
+|------------------------------------------------------------------------------|
+*/
+#define HI_OPTION_FW_MODE_BITS         0x2
+#define HI_OPTION_FW_MODE_MASK         0x3
+#define HI_OPTION_FW_MODE_SHIFT        0xC
+#define HI_OPTION_ALL_FW_MODE_MASK     0xFF
+
+#define HI_OPTION_FW_SUBMODE_BITS      0x2
+#define HI_OPTION_FW_SUBMODE_MASK      0x3
+#define HI_OPTION_FW_SUBMODE_SHIFT     0x14
+#define HI_OPTION_ALL_FW_SUBMODE_MASK  0xFF00
+#define HI_OPTION_ALL_FW_SUBMODE_SHIFT 0x8
+
+/* hi_reset_flag */
+
+/* preserve App Start address */
+#define HI_RESET_FLAG_PRESERVE_APP_START         0x01
+/* preserve host interest */
+#define HI_RESET_FLAG_PRESERVE_HOST_INTEREST     0x02
+#define HI_RESET_FLAG_PRESERVE_ROMDATA           0x04  /* preserve ROM data */
+#define HI_RESET_FLAG_PRESERVE_NVRAM_STATE       0x08
+#define HI_RESET_FLAG_PRESERVE_BOOT_INFO         0x10
+
+#define HI_RESET_FLAG_IS_VALID  0x12345678 /* indicate the reset flag is
+valid */
+
+#define ON_RESET_FLAGS_VALID() \
+	(HOST_INTEREST->hi_reset_flag_valid == HI_RESET_FLAG_IS_VALID)
+
+#define RESET_FLAGS_VALIDATE()  \
+	(HOST_INTEREST->hi_reset_flag_valid = HI_RESET_FLAG_IS_VALID)
+
+#define RESET_FLAGS_INVALIDATE() \
+	(HOST_INTEREST->hi_reset_flag_valid = 0)
+
+#define ON_RESET_PRESERVE_APP_START() \
+        (HOST_INTEREST->hi_reset_flag & HI_RESET_FLAG_PRESERVE_APP_START)
+
+#define ON_RESET_PRESERVE_NVRAM_STATE() \
+        (HOST_INTEREST->hi_reset_flag & HI_RESET_FLAG_PRESERVE_NVRAM_STATE)
+
+#define ON_RESET_PRESERVE_HOST_INTEREST() \
+        (HOST_INTEREST->hi_reset_flag & HI_RESET_FLAG_PRESERVE_HOST_INTEREST)
+
+#define ON_RESET_PRESERVE_ROMDATA() \
+        (HOST_INTEREST->hi_reset_flag & HI_RESET_FLAG_PRESERVE_ROMDATA)
+
+#define ON_RESET_PRESERVE_BOOT_INFO() \
+        (HOST_INTEREST->hi_reset_flag & HI_RESET_FLAG_PRESERVE_BOOT_INFO)
+
+#define HI_ACS_FLAGS_ENABLED        (1 << 0)    /* ACS is enabled */
+#define HI_ACS_FLAGS_USE_WWAN       (1 << 1)    /* Use physical WWAN device */
+#define HI_ACS_FLAGS_TEST_VAP       (1 << 2)    /* Use test VAP */
+
+/* CONSOLE FLAGS
+ *
+ * Bit Range  Meaning
+ * ---------  --------------------------------
+ *   2..0     UART ID (0 = Default)
+ *    3       Baud Select (0 = 9600, 1 = 115200)
+ *   30..4    Reserved
+ *    31      Enable Console
+ *
+ */
+
+#define HI_CONSOLE_FLAGS_ENABLE       (1 << 31)
+#define HI_CONSOLE_FLAGS_UART_MASK    (0x7)
+#define HI_CONSOLE_FLAGS_UART_SHIFT   0
+#define HI_CONSOLE_FLAGS_BAUD_SELECT  (1 << 3)
 
 /*
  * Intended for use by Host software, this macro returns the Target RAM
@@ -212,34 +344,52 @@
 #define AR6003_HOST_INTEREST_ITEM_ADDRESS(item) \
     (u32)((unsigned long)&((((struct host_interest_s *)(AR6003_HOST_INTEREST_ADDRESS))->item)))
 
+#define AR6004_HOST_INTEREST_ITEM_ADDRESS(item) \
+        ((A_UINT32)&((((struct host_interest_s *)(AR6004_HOST_INTEREST_ADDRESS))->item)))
+
+
 #define HOST_INTEREST_DBGLOG_IS_ENABLED() \
         (!(HOST_INTEREST->hi_option_flag & HI_OPTION_DISABLE_DBGLOG))
 
+#define HOST_INTEREST_PKTLOG_IS_ENABLED() \
+        ((HOST_INTEREST->hi_pktlog_num_buffers))
+
+
 #define HOST_INTEREST_PROFILE_IS_ENABLED() \
         (HOST_INTEREST->hi_option_flag & HI_OPTION_ENABLE_PROFILE)
 
+#define LF_TIMER_STABILIZATION_IS_ENABLED() \
+        (!(HOST_INTEREST->hi_option_flag & HI_OPTION_NO_LFT_STBL))
+
+#define IS_AMSDU_OFFLAOD_ENABLED() \
+        ((HOST_INTEREST->hi_option_flag2 & HI_OPTION_OFFLOAD_AMSDU))
+
+#define HOST_INTEREST_DFS_IS_ENABLED() \
+        ((HOST_INTEREST->hi_option_flag2 & HI_OPTION_DFS_SUPPORT))
+
 /* Convert a Target virtual address into a Target physical address */
 #define AR6002_VTOP(vaddr) ((vaddr) & 0x001fffff)
 #define AR6003_VTOP(vaddr) ((vaddr) & 0x001fffff)
 #define TARG_VTOP(TargetType, vaddr) \
         (((TargetType) == TARGET_TYPE_AR6002) ? AR6002_VTOP(vaddr) : AR6003_VTOP(vaddr))
 
-/* override REV2 ROM's app start address */
-#define AR6002_REV2_APP_START_OVERRIDE    0x911A00
-#define AR6003_REV1_APP_START_OVERRIDE    0x944c00
-#define AR6003_REV1_OTP_DATA_ADDRESS      0x542800
-#define AR6003_REV2_APP_START_OVERRIDE    0x945000
-#define AR6003_REV2_OTP_DATA_ADDRESS      0x543800
-#define AR6003_BOARD_EXT_DATA_ADDRESS     0x57E600
+#define AR6003_REV2_APP_START_OVERRIDE          0x944C00
+#define AR6003_REV2_APP_LOAD_ADDRESS            0x543180
+#define AR6003_REV2_BOARD_EXT_DATA_ADDRESS      0x57E500
+#define AR6003_REV2_DATASET_PATCH_ADDRESS       0x57e884
+#define AR6003_REV2_RAM_RESERVE_SIZE            6912
 
+#define AR6003_REV3_APP_START_OVERRIDE          0x945d00
+#define AR6003_REV3_APP_LOAD_ADDRESS            0x545000
+#define AR6003_REV3_BOARD_EXT_DATA_ADDRESS      0x542330
+#define AR6003_REV3_DATASET_PATCH_ADDRESS       0x57FF74
+#define AR6003_REV3_RAM_RESERVE_SIZE            512
+
+#define AR6003_BOARD_EXT_DATA_ADDRESS           0x57E600
 
 /* # of u32 entries in targregs, used by DIAG_FETCH_TARG_REGS */
 #define AR6003_FETCH_TARG_REGS_COUNT 64
 
 #endif /* !__ASSEMBLER__ */
 
-#ifndef ATH_TARGET
-#include "athendpack.h"
-#endif
-
 #endif /* __TARGADDRS_H__ */
diff --git a/drivers/staging/ath6kl/include/common/wmi.h b/drivers/staging/ath6kl/include/common/wmi.h
index 4e63434..24636e6 100644
--- a/drivers/staging/ath6kl/include/common/wmi.h
+++ b/drivers/staging/ath6kl/include/common/wmi.h
@@ -34,10 +34,6 @@
 #ifndef _WMI_H_
 #define _WMI_H_
 
-#ifndef ATH_TARGET
-#include "athstartpack.h"
-#endif
-
 #include "wmix.h"
 #include "wlan_defs.h"
 
@@ -118,7 +114,7 @@
 typedef enum {
     WMI_DATA_HDR_DATA_TYPE_802_3 = 0,
     WMI_DATA_HDR_DATA_TYPE_802_11,
-    WMI_DATA_HDR_DATA_TYPE_ACL,
+    WMI_DATA_HDR_DATA_TYPE_ACL, /* used to be used for the PAL */
 } WMI_DATA_HDR_DATA_TYPE;
 
 #define WMI_DATA_HDR_DATA_TYPE_MASK     0x3
@@ -159,6 +155,16 @@
 #define WMI_DATA_HDR_GET_META(h)        (((h)->info2 >> WMI_DATA_HDR_META_SHIFT) & WMI_DATA_HDR_META_MASK)
 #define WMI_DATA_HDR_SET_META(h, _v)    ((h)->info2 = ((h)->info2 & ~(WMI_DATA_HDR_META_MASK << WMI_DATA_HDR_META_SHIFT)) | ((_v) << WMI_DATA_HDR_META_SHIFT))
 
+/* Macros for operating on WMI_DATA_HDR (info3) field */
+#define WMI_DATA_HDR_DEVID_MASK      0xF
+#define WMI_DATA_HDR_DEVID_SHIFT     0
+#define GET_DEVID(_v)                ((_v) & WMI_DATA_HDR_DEVID_MASK)
+
+#define WMI_DATA_HDR_GET_DEVID(h) \
+	(((h)->info3 >> WMI_DATA_HDR_DEVID_SHIFT) & WMI_DATA_HDR_DEVID_MASK)
+#define WMI_DATA_HDR_SET_DEVID(h, _v) \
+	((h)->info3 = ((h)->info3 & ~(WMI_DATA_HDR_DEVID_MASK << WMI_DATA_HDR_DEVID_SHIFT)) | (GET_DEVID(_v) << WMI_DATA_HDR_DEVID_SHIFT))
+
 typedef PREPACK struct {
     s8 rssi;
     u8 info;               /* usage of 'info' field(8-bit):
@@ -175,7 +181,7 @@
                                      * b12          - A-MSDU?
                                      * b15:b13      - META_DATA_VERSION 0 - 7
                                      */
-    u16 reserved;
+    u16 info3;
 } POSTPACK WMI_DATA_HDR;
 
 /*
@@ -259,6 +265,17 @@
 
 
 #define WMI_GET_DEVICE_ID(info1) ((info1) & 0xF)
+/* Macros for operating on WMI_CMD_HDR (info1) field */
+#define WMI_CMD_HDR_DEVID_MASK      0xF
+#define WMI_CMD_HDR_DEVID_SHIFT     0
+#define GET_CMD_DEVID(_v)           ((_v) & WMI_CMD_HDR_DEVID_MASK)
+
+#define WMI_CMD_HDR_GET_DEVID(h) \
+	(((h)->info1 >> WMI_CMD_HDR_DEVID_SHIFT) & WMI_CMD_HDR_DEVID_MASK)
+#define WMI_CMD_HDR_SET_DEVID(h, _v) \
+	((h)->info1 = ((h)->info1 & \
+		~(WMI_CMD_HDR_DEVID_MASK << WMI_CMD_HDR_DEVID_SHIFT)) | \
+		 (GET_CMD_DEVID(_v) << WMI_CMD_HDR_DEVID_SHIFT))
 
 /*
  * Control Path
@@ -433,13 +450,47 @@
     WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID,
     WMI_GET_BTCOEX_STATS_CMDID,
     WMI_GET_BTCOEX_CONFIG_CMDID,
-    WMI_GET_PMK_CMDID,
-    WMI_SET_PASSPHRASE_CMDID,
-    WMI_ENABLE_WAC_CMDID,
-    WMI_WAC_SCAN_REPLY_CMDID,
-    WMI_WAC_CTRL_REQ_CMDID,
-    WMI_SET_DIV_PARAMS_CMDID,
-    WMI_SET_EXCESS_TX_RETRY_THRES_CMDID,
+
+	WMI_SET_DFS_ENABLE_CMDID,   /* F034 */
+	WMI_SET_DFS_MINRSSITHRESH_CMDID,
+	WMI_SET_DFS_MAXPULSEDUR_CMDID,
+	WMI_DFS_RADAR_DETECTED_CMDID,
+
+	/* P2P CMDS */
+	WMI_P2P_SET_CONFIG_CMDID,    /* F038 */
+	WMI_WPS_SET_CONFIG_CMDID,
+	WMI_SET_REQ_DEV_ATTR_CMDID,
+	WMI_P2P_FIND_CMDID,
+	WMI_P2P_STOP_FIND_CMDID,
+	WMI_P2P_GO_NEG_START_CMDID,
+	WMI_P2P_LISTEN_CMDID,
+
+	WMI_CONFIG_TX_MAC_RULES_CMDID,    /* F040 */
+	WMI_SET_PROMISCUOUS_MODE_CMDID,
+	WMI_RX_FRAME_FILTER_CMDID,
+	WMI_SET_CHANNEL_CMDID,
+
+	/* WAC commands */
+	WMI_ENABLE_WAC_CMDID,
+	WMI_WAC_SCAN_REPLY_CMDID,
+	WMI_WAC_CTRL_REQ_CMDID,
+	WMI_SET_DIV_PARAMS_CMDID,
+
+	WMI_GET_PMK_CMDID,
+	WMI_SET_PASSPHRASE_CMDID,
+	WMI_SEND_ASSOC_RES_CMDID,
+	WMI_SET_ASSOC_REQ_RELAY_CMDID,
+	WMI_GET_RFKILL_MODE_CMDID,
+
+	/* ACS command, consists of sub-commands */
+	WMI_ACS_CTRL_CMDID,
+
+	/* Ultra low power store / recall commands */
+	WMI_STORERECALL_CONFIGURE_CMDID,
+	WMI_STORERECALL_RECALL_CMDID,
+	WMI_STORERECALL_HOST_READY_CMDID,
+	WMI_FORCE_TARGET_ASSERT_CMDID,
+	WMI_SET_EXCESS_TX_RETRY_THRES_CMDID,
 } WMI_COMMAND_ID;
 
 /*
@@ -1969,12 +2020,47 @@
 #endif
     WMI_REPORT_BTCOEX_STATS_EVENTID,
     WMI_REPORT_BTCOEX_CONFIG_EVENTID,
-    WMI_ACM_REJECT_EVENTID,
-    WMI_THIN_RESERVED_START_EVENTID = 0x8000,
-    /* Events in this range are reserved for thinmode 
-     * See wmi_thin.h for actual definitions */
-    WMI_THIN_RESERVED_END_EVENTID = 0x8fff,
+	WMI_GET_PMK_EVENTID,
 
+	/* DFS Events */
+	WMI_DFS_HOST_ATTACH_EVENTID,
+	WMI_DFS_HOST_INIT_EVENTID,
+	WMI_DFS_RESET_DELAYLINES_EVENTID,
+	WMI_DFS_RESET_RADARQ_EVENTID,
+	WMI_DFS_RESET_AR_EVENTID,
+	WMI_DFS_RESET_ARQ_EVENTID,
+	WMI_DFS_SET_DUR_MULTIPLIER_EVENTID,
+	WMI_DFS_SET_BANGRADAR_EVENTID,
+	WMI_DFS_SET_DEBUGLEVEL_EVENTID,
+	WMI_DFS_PHYERR_EVENTID,
+	/* CCX Evants */
+	WMI_CCX_RM_STATUS_EVENTID,
+
+	/* P2P Events */
+	WMI_P2P_GO_NEG_RESULT_EVENTID,
+
+	WMI_WAC_SCAN_DONE_EVENTID,
+	WMI_WAC_REPORT_BSS_EVENTID,
+	WMI_WAC_START_WPS_EVENTID,
+	WMI_WAC_CTRL_REQ_REPLY_EVENTID,
+
+	/* RFKILL Events */
+	WMI_RFKILL_STATE_CHANGE_EVENTID,
+	WMI_RFKILL_GET_MODE_CMD_EVENTID,
+	WMI_THIN_RESERVED_START_EVENTID = 0x8000,
+
+	/*
+	 * Events in this range are reserved for thinmode
+	 * See wmi_thin.h for actual definitions
+	 */
+	WMI_THIN_RESERVED_END_EVENTID = 0x8fff,
+
+	WMI_SET_CHANNEL_EVENTID,
+	WMI_ASSOC_REQ_EVENTID,
+
+	/* generic ACS event */
+	WMI_ACS_EVENTID,
+	WMI_REPORT_WMM_PARAMS_EVENTID
 } WMI_EVENT_ID;
 
 
@@ -3122,10 +3208,6 @@
  * End of AP mode definitions
  */
 
-#ifndef ATH_TARGET
-#include "athendpack.h"
-#endif
-
 #ifdef __cplusplus
 }
 #endif
diff --git a/drivers/staging/ath6kl/include/common/wmix.h b/drivers/staging/ath6kl/include/common/wmix.h
index 36acba6..1ab6fc5 100644
--- a/drivers/staging/ath6kl/include/common/wmix.h
+++ b/drivers/staging/ath6kl/include/common/wmix.h
@@ -40,10 +40,6 @@
 extern "C" {
 #endif
 
-#ifndef ATH_TARGET
-#include "athstartpack.h"
-#endif
-
 #include "dbglog.h"
 
 /*
@@ -268,9 +264,6 @@
     u32 count;
 } POSTPACK WMIX_PROF_COUNT_EVENT;
 
-#ifndef ATH_TARGET
-#include "athendpack.h"
-#endif
 
 #ifdef __cplusplus
 }
diff --git a/drivers/staging/ath6kl/include/common_drv.h b/drivers/staging/ath6kl/include/common_drv.h
index b606334..34db299 100644
--- a/drivers/staging/ath6kl/include/common_drv.h
+++ b/drivers/staging/ath6kl/include/common_drv.h
@@ -81,10 +81,6 @@
                                u32 MboxIsrYieldValue,
                                u8 HtcControlBuffers);
 
-int ar6000_prepare_target(struct hif_device *hifDevice,
-                               u32 TargetType,
-                               u32 TargetVersion);
-
 int ar6000_set_hci_bridge_flags(struct hif_device *hifDevice,
                                      u32 TargetType,
                                      u32 Flags);
diff --git a/drivers/staging/ath6kl/miscdrv/ar3kconfig.c b/drivers/staging/ath6kl/miscdrv/ar3kconfig.c
index 4f18f43..5125edc 100644
--- a/drivers/staging/ath6kl/miscdrv/ar3kconfig.c
+++ b/drivers/staging/ath6kl/miscdrv/ar3kconfig.c
@@ -78,7 +78,7 @@
     } while (false);
    
     if (pPacket != NULL) {
-        A_FREE(pPacket);
+        kfree(pPacket);
     }
         
     return status;
@@ -116,7 +116,7 @@
     } while (false);
        
     if (pRecvPacket != NULL) {
-        A_FREE(pRecvPacket);    
+        kfree(pRecvPacket);    
     }
     
     return status;
@@ -203,7 +203,7 @@
     } while (false);
 
     if (pBuffer != NULL) {
-        A_FREE(pBuffer);    
+        kfree(pBuffer);    
     }
     
     return status;    
@@ -268,7 +268,7 @@
     } while (false);
                         
     if (pBufferToFree != NULL) {
-        A_FREE(pBufferToFree);    
+        kfree(pBufferToFree);    
     }
         
     return status;
@@ -304,7 +304,7 @@
     }
     
     if (pBufferToFree != NULL) {
-        A_FREE(pBufferToFree);    
+        kfree(pBufferToFree);    
     }
     
     return status;                                              
@@ -328,7 +328,7 @@
     }
 
     if (pBufferToFree != NULL) {
-        A_FREE(pBufferToFree);
+        kfree(pBufferToFree);
     }
 
     return status;
@@ -382,7 +382,7 @@
                                                &pEvent,
                                                &pBufferToFree);
     if (pBufferToFree != NULL) {
-        A_FREE(pBufferToFree);    
+        kfree(pBufferToFree);    
     }
     if (status) {
         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("HostWakeup Config Failed! \n"));    
@@ -397,7 +397,7 @@
                                                &pEvent,
                                                &pBufferToFree);
     if (pBufferToFree != NULL) {
-        A_FREE(pBufferToFree);    
+        kfree(pBufferToFree);    
     }
     if (status) {
         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Target Wakeup Config Failed! \n"));    
@@ -412,7 +412,7 @@
                                                &pEvent,
                                                &pBufferToFree);
     if (pBufferToFree != NULL) {
-        A_FREE(pBufferToFree);    
+        kfree(pBufferToFree);    
     }
     if (status) {
         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("HostWakeup Enable Failed! \n"));    
@@ -427,7 +427,7 @@
                                                &pEvent,
                                                &pBufferToFree);
     if (pBufferToFree != NULL) {
-        A_FREE(pBufferToFree);    
+        kfree(pBufferToFree);    
     }
     if (status) {
         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Target Wakeup Enable Failed! \n"));    
@@ -442,7 +442,7 @@
                                                &pEvent,
                                                &pBufferToFree);
     if (pBufferToFree != NULL) {
-        A_FREE(pBufferToFree);    
+        kfree(pBufferToFree);    
     }
     if (status) {
         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Sleep Enable Failed! \n"));    
diff --git a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.c b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.c
index 8393efe..282ceac 100644
--- a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.c
+++ b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.c
@@ -222,7 +222,7 @@
         A_RELEASE_FIRMWARE(firmware);
         /* Parse the PS buffer to a global variable */
         status = AthDoParsePS(buffer,len);
-        A_FREE(buffer);
+        kfree(buffer);
     } else {
         A_RELEASE_FIRMWARE(firmware);
     }
@@ -256,7 +256,7 @@
                 A_RELEASE_FIRMWARE(firmware);
                 /* parse and store the Patch file contents to a global variables */
                 status = AthDoParsePatch(buffer,len);
-                A_FREE(buffer);
+                kfree(buffer);
             } else {
                 A_RELEASE_FIRMWARE(firmware);
             }
@@ -283,7 +283,7 @@
     &bufferToFree) == 0) {
         if(ReadPSEvent(event) == 0) { /* Exit if the status is success */
             if(bufferToFree != NULL) {
-                A_FREE(bufferToFree);
+                kfree(bufferToFree);
                 }
 	
 #ifndef HCI_TRANSPORT_SDIO
@@ -295,7 +295,7 @@
                goto complete;
         }
         if(bufferToFree != NULL) {
-               A_FREE(bufferToFree);
+               kfree(bufferToFree);
         }
     } else {
         status = 0;
@@ -312,13 +312,13 @@
         &bufferToFree) == 0) {
             if(ReadPSEvent(event) != 0) { /* Exit if the status is success */
                 if(bufferToFree != NULL) {
-                    A_FREE(bufferToFree);
+                    kfree(bufferToFree);
                     }
                    status = 1;
                     goto complete;
             }
             if(bufferToFree != NULL) {
-                   A_FREE(bufferToFree);
+                   kfree(bufferToFree);
             }
         } else {
             status = 0;
@@ -376,10 +376,10 @@
         AthFreeCommandList(&HciCmdList,numCmds);
     }
     if(path) {
-        A_FREE(path);
+        kfree(path);
     }
     if(config_path) {
-        A_FREE(config_path);
+        kfree(config_path);
     }
     return status;
 }
@@ -511,7 +511,7 @@
 
     }
     if(bufferToFree != NULL) {
-        A_FREE(bufferToFree);
+        kfree(bufferToFree);
    }
     return result;
 
@@ -527,7 +527,7 @@
 
     }
     if(bufferToFree != NULL) {
-        A_FREE(bufferToFree);
+        kfree(bufferToFree);
    }
     return result;
 }
@@ -564,7 +564,7 @@
 
     }
     if(bufferToFree != NULL) {
-        A_FREE(bufferToFree);
+        kfree(bufferToFree);
    }
     return result;
 }
diff --git a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c
index 94a0939..c01c0cb 100644
--- a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c
+++ b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c
@@ -362,7 +362,7 @@
              {
                  AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("error\n"));
                  if(Buffer != NULL) {
-                     A_FREE(Buffer);
+                     kfree(Buffer);
                  }
                  return A_ERROR;
              }
@@ -401,7 +401,7 @@
                     if(uGetInputDataFormat(pCharLine, &stPS_DataFormat)) {
                         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("uGetInputDataFormat fail\n"));
                      if(Buffer != NULL) {
-                             A_FREE(Buffer);
+                             kfree(Buffer);
                      }
                         return A_ERROR;
                     }    
@@ -422,7 +422,7 @@
                     if(uGetInputDataFormat(pCharLine, &stPS_DataFormat)) {
                         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("uGetInputDataFormat fail \n"));
                      if(Buffer != NULL) {
-                             A_FREE(Buffer);
+                             kfree(Buffer);
                      }
                         return A_ERROR;
                     }
@@ -433,7 +433,7 @@
                     if (ByteCount > LINE_SIZE_MAX/2)
                     {
                      if(Buffer != NULL) {
-                             A_FREE(Buffer);
+                             kfree(Buffer);
                      }
                        return A_ERROR;
                     }
@@ -449,7 +449,7 @@
                         if(uGetInputDataFormat(pCharLine,&stPS_DataFormat)) {
                             AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("uGetInputDataFormat Fail\n"));
                             if(Buffer != NULL) {
-                                 A_FREE(Buffer);
+                                 kfree(Buffer);
                          }
                             return A_ERROR;
                         }
@@ -510,7 +510,7 @@
                     {
                        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("\n Buffer over flow PS File too big!!!"));
                        if(Buffer != NULL) {
-                           A_FREE(Buffer);
+                           kfree(Buffer);
                        }
                        return A_ERROR;
                        //Sleep (3000);
@@ -524,7 +524,7 @@
              default:
              {
                    if(Buffer != NULL) {
-                       A_FREE(Buffer);
+                       kfree(Buffer);
                    }
                    return A_ERROR;
              }
@@ -541,13 +541,13 @@
    {
 
       if(Buffer != NULL) {
-           A_FREE(Buffer);
+           kfree(Buffer);
       }
       return A_ERROR;
    }
 
    if(Buffer != NULL) {
-        A_FREE(Buffer);
+        kfree(Buffer);
    }
    return 0;
 
@@ -609,7 +609,7 @@
         /* Handle case when the number of patch buffer is more than the 20K */
         if(MAX_NUM_PATCH_ENTRY == Patch_Count) {
             for(i = 0; i < Patch_Count; i++) {
-                A_FREE(RamPatch[i].Data);
+                kfree(RamPatch[i].Data);
             }
             return A_ERROR;
         }
@@ -812,13 +812,13 @@
     for(count = 0; count < Patch_Count; count++) {
 
         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Freeing Patch Buffer %d \r\n",count));
-        A_FREE(RamPatch[Patch_Count].Data);
+        kfree(RamPatch[Patch_Count].Data);
     }
 
     for(count = 0; count < Tag_Count; count++) {
 
         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Freeing PS Buffer %d \r\n",count));
-        A_FREE(PsTagEntry[count].TagData);
+        kfree(PsTagEntry[count].TagData);
     }
 
 /* 
@@ -962,8 +962,8 @@
         return A_ERROR;
     }
     for(i = 0; i < numPackets;i++) {
-        A_FREE((*HciPacketList)[i].Hcipacket);
+        kfree((*HciPacketList)[i].Hcipacket);
     }  
-    A_FREE(*HciPacketList);
+    kfree(*HciPacketList);
     return 0;
 }
diff --git a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.h b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.h
index 9378efc..cd0a9e8 100644
--- a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.h
+++ b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.h
@@ -60,11 +60,6 @@
 #ifndef A_MALLOC
 #define A_MALLOC(size)  kmalloc((size),GFP_KERNEL)
 #endif /* A_MALLOC */
-
-
-#ifndef A_FREE
-#define A_FREE(addr)  kfree((addr))
-#endif /* A_MALLOC */
 #endif /* HCI_TRANSPORT_UART */
 
 /* String manipulation APIs */
diff --git a/drivers/staging/ath6kl/miscdrv/common_drv.c b/drivers/staging/ath6kl/miscdrv/common_drv.c
index a23a524..2be2ea4 100644
--- a/drivers/staging/ath6kl/miscdrv/common_drv.c
+++ b/drivers/staging/ath6kl/miscdrv/common_drv.c
@@ -683,40 +683,6 @@
     return status;
 }
 
-
-static int prepare_ar6002(struct hif_device *hifDevice, u32 TargetVersion)
-{
-    int status = 0;
-
-    /* placeholder */
-
-    return status;
-}
-
-static int prepare_ar6003(struct hif_device *hifDevice, u32 TargetVersion)
-{
-    int status = 0;
-
-    /* placeholder */
-
-    return status;
-}
-
-/* this function assumes the caller has already initialized the BMI APIs */
-int ar6000_prepare_target(struct hif_device *hifDevice,
-                               u32 TargetType,
-                               u32 TargetVersion)
-{
-    if (TargetType == TARGET_TYPE_AR6002) {
-            /* do any preparations for AR6002 devices */
-        return prepare_ar6002(hifDevice,TargetVersion);
-    } else if (TargetType == TARGET_TYPE_AR6003) {
-        return prepare_ar6003(hifDevice,TargetVersion);
-    }
-
-    return 0;
-}
-
 #if defined(CONFIG_AR6002_REV1_FORCE_HOST)
 /*
  * Call this function just before the call to BMIInit
diff --git a/drivers/staging/ath6kl/os/linux/ar6000_android.c b/drivers/staging/ath6kl/os/linux/ar6000_android.c
deleted file mode 100644
index 4aa75ee2..0000000
--- a/drivers/staging/ath6kl/os/linux/ar6000_android.c
+++ /dev/null
@@ -1,388 +0,0 @@
-//------------------------------------------------------------------------------
-// Copyright (c) 2004-2010 Atheros Communications Inc.
-// All rights reserved.
-//
-// 
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-//
-//
-//
-// Author(s): ="Atheros"
-//------------------------------------------------------------------------------
-#include "ar6000_drv.h"
-#include "htc.h"
-#include <linux/vmalloc.h>
-#include <linux/fs.h>
-
-#ifdef CONFIG_HAS_EARLYSUSPEND
-#include <linux/earlysuspend.h>
-#endif
-
-bool enable_mmc_host_detect_change = false;
-static void ar6000_enable_mmchost_detect_change(int enable);
-
-
-char fwpath[256] = "/system/wifi";
-int wowledon;
-unsigned int enablelogcat;
-
-extern int bmienable;
-extern struct net_device *ar6000_devices[];
-extern char ifname[];
-
-const char def_ifname[] = "wlan0";
-module_param_string(fwpath, fwpath, sizeof(fwpath), 0644);
-module_param(enablelogcat, uint, 0644);
-module_param(wowledon, int, 0644);
-
-#ifdef CONFIG_HAS_EARLYSUSPEND
-static int screen_is_off;
-static struct early_suspend ar6k_early_suspend;
-#endif
-
-static int (*ar6000_avail_ev_p)(void *, void *);
-
-#if defined(CONFIG_ANDROID_LOGGER) && (!defined(CONFIG_MMC_MSM))
-int logger_write(const enum logidx index,
-                const unsigned char prio,
-                const char __kernel * const tag,
-                const char __kernel * const fmt,
-                ...)
-{
-    int ret = 0;
-    va_list vargs;
-    struct file *filp = (struct file *)-ENOENT;
-    mm_segment_t oldfs;
-    struct iovec vec[3];
-    int tag_bytes = strlen(tag) + 1, msg_bytes;
-    char *msg;      
-    va_start(vargs, fmt);
-    msg = kvasprintf(GFP_ATOMIC, fmt, vargs);
-    va_end(vargs);
-    if (!msg)
-        return -ENOMEM;
-    if (in_interrupt()) {
-        /* we have no choice since aio_write may be blocked */
-        printk(KERN_ALERT "%s", msg);
-        goto out_free_message;
-    }
-    msg_bytes = strlen(msg) + 1;
-    if (msg_bytes <= 1) /* empty message? */
-        goto out_free_message; /* don't bother, then */
-    if ((msg_bytes + tag_bytes + 1) > 2048) {
-        ret = -E2BIG;
-        goto out_free_message;
-    }
-            
-    vec[0].iov_base  = (unsigned char *) &prio;
-    vec[0].iov_len    = 1;
-    vec[1].iov_base   = (void *) tag;
-    vec[1].iov_len    = strlen(tag) + 1;
-    vec[2].iov_base   = (void *) msg;
-    vec[2].iov_len    = strlen(msg) + 1; 
-
-    oldfs = get_fs();
-    set_fs(KERNEL_DS);
-    do {
-        filp = filp_open("/dev/log/main", O_WRONLY, S_IRUSR);
-        if (IS_ERR(filp) || !filp->f_op) {
-            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: filp_open /dev/log/main error\n", __FUNCTION__));
-            ret = -ENOENT;
-            break;
-        }
-
-        if (filp->f_op->aio_write) {
-            int nr_segs = sizeof(vec) / sizeof(vec[0]);
-            int len = vec[0].iov_len + vec[1].iov_len + vec[2].iov_len;
-            struct kiocb kiocb;
-            init_sync_kiocb(&kiocb, filp);
-            kiocb.ki_pos = 0;
-            kiocb.ki_left = len;
-            kiocb.ki_nbytes = len;
-            ret = filp->f_op->aio_write(&kiocb, vec, nr_segs, kiocb.ki_pos);
-        }
-        
-    } while (0);
-
-    if (!IS_ERR(filp)) {
-        filp_close(filp, NULL);
-    }
-    set_fs(oldfs);
-out_free_message:
-    kfree(msg);
-    return ret;
-}
-#endif
-
-int android_logger_lv(void *module, int mask)
-{
-    switch (mask) {
-    case ATH_DEBUG_ERR:
-        return 6;
-    case ATH_DEBUG_INFO:
-        return 4;
-    case ATH_DEBUG_WARN:
-        return 5; 
-    case ATH_DEBUG_TRC:        
-        return 3; 
-    default:
-#ifdef DEBUG
-        if (!module) {
-            return 3;
-        } else if (module == &GET_ATH_MODULE_DEBUG_VAR_NAME(driver)) {
-            return (mask <=ATH_DEBUG_MAKE_MODULE_MASK(3)) ? 3 : 2;
-        } else if (module == &GET_ATH_MODULE_DEBUG_VAR_NAME(htc)) {
-            return 2;
-        } else {
-            return 3;
-        }
-#else
-        return 3; /* DEBUG */
-#endif
-    }
-}
-
-static int android_readwrite_file(const char *filename, char *rbuf, const char *wbuf, size_t length)
-{
-    int ret = 0;
-    struct file *filp = (struct file *)-ENOENT;
-    mm_segment_t oldfs;
-    oldfs = get_fs();
-    set_fs(KERNEL_DS);
-    do {
-        int mode = (wbuf) ? O_RDWR : O_RDONLY;
-        filp = filp_open(filename, mode, S_IRUSR);
-        if (IS_ERR(filp) || !filp->f_op) {
-            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: file %s filp_open error\n", __FUNCTION__, filename));
-            ret = -ENOENT;
-            break;
-        }
-    
-        if (length==0) {
-            /* Read the length of the file only */
-            struct inode    *inode;
-
-            inode = GET_INODE_FROM_FILEP(filp);
-            if (!inode) {
-                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Get inode from %s failed\n", __FUNCTION__, filename));
-                ret = -ENOENT;
-                break;
-            }
-            ret = i_size_read(inode->i_mapping->host);
-            break;
-        }
-
-        if (wbuf) {
-            if ( (ret=filp->f_op->write(filp, wbuf, length, &filp->f_pos)) < 0) {
-                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Write %u bytes to file %s error %d\n", __FUNCTION__, 
-                                length, filename, ret));
-                break;
-            }
-        } else {
-            if ( (ret=filp->f_op->read(filp, rbuf, length, &filp->f_pos)) < 0) {
-                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Read %u bytes from file %s error %d\n", __FUNCTION__,
-                                length, filename, ret));
-                break;
-            }
-        }
-    } while (0);
-
-    if (!IS_ERR(filp)) {
-        filp_close(filp, NULL);
-    }
-    set_fs(oldfs);
-
-    return ret;
-}
-
-int android_request_firmware(const struct firmware **firmware_p, const char *name,
-                     struct device *device)
-{
-    int ret = 0;
-    struct firmware *firmware;
-    char filename[256];
-    const char *raw_filename = name;
-	*firmware_p = firmware = kzalloc(sizeof(*firmware), GFP_KERNEL);
-    if (!firmware) 
-		return -ENOMEM;
-	sprintf(filename, "%s/%s", fwpath, raw_filename);
-    do {
-        size_t length, bufsize, bmisize;
-
-        if ( (ret=android_readwrite_file(filename, NULL, NULL, 0)) < 0) {
-            break;
-        } else {
-            length = ret;
-        }
-    
-        bufsize = ALIGN(length, PAGE_SIZE);
-        bmisize = A_ROUND_UP(length, 4);
-        bufsize = max(bmisize, bufsize);
-        firmware->data = vmalloc(bufsize);
-        firmware->size = length;
-        if (!firmware->data) {
-            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s: Cannot allocate buffer for firmware\n", __FUNCTION__));
-            ret = -ENOMEM;
-            break;
-        }
-    
-        if ( (ret=android_readwrite_file(filename, (char*)firmware->data, NULL, length)) != length) {
-            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s: file read error, ret %d request %d\n", __FUNCTION__, ret, length));
-            ret = -1;
-            break;
-        }
-    
-    } while (0);
-
-    if (ret<0) {
-        if (firmware) {
-            if (firmware->data)
-                vfree(firmware->data);
-            kfree(firmware);
-        }
-        *firmware_p = NULL;
-    } else {
-        ret = 0;
-    }
-    return ret;    
-}
-
-void android_release_firmware(const struct firmware *firmware)
-{
-	if (firmware) {
-        if (firmware->data)
-            vfree(firmware->data);
-        kfree(firmware);
-    }
-}
-
-static int ar6000_android_avail_ev(void *context, void *hif_handle)
-{
-    int ret;
-    ar6000_enable_mmchost_detect_change(0);
-    ret = ar6000_avail_ev_p(context, hif_handle);
-    return ret;
-}
-
-/* Useful for qualcom platform to detect our wlan card for mmc stack */
-static void ar6000_enable_mmchost_detect_change(int enable)
-{
-#ifdef CONFIG_MMC_MSM
-#define MMC_MSM_DEV "msm_sdcc.1"
-    char buf[3];
-    int length;
-
-    if (!enable_mmc_host_detect_change) {
-        return;
-    }
-    length = snprintf(buf, sizeof(buf), "%d\n", enable ? 1 : 0);
-    if (android_readwrite_file("/sys/devices/platform/" MMC_MSM_DEV "/detect_change", 
-                               NULL, buf, length) < 0) {
-        /* fall back to polling */
-        android_readwrite_file("/sys/devices/platform/" MMC_MSM_DEV "/polling", NULL, buf, length);
-    }
-#endif
-}
-
-#ifdef CONFIG_HAS_EARLYSUSPEND
-static void android_early_suspend(struct early_suspend *h)
-{
-    screen_is_off = 1;
-}
-
-static void android_late_resume(struct early_suspend *h)
-{
-    screen_is_off = 0;
-}
-#endif
-
-void android_module_init(OSDRV_CALLBACKS *osdrvCallbacks)
-{
-    bmienable = 1;
-    if (ifname[0] == '\0')
-        strcpy(ifname, def_ifname);
-#ifdef CONFIG_HAS_EARLYSUSPEND
-    ar6k_early_suspend.suspend = android_early_suspend;
-    ar6k_early_suspend.resume  = android_late_resume;
-    ar6k_early_suspend.level   = EARLY_SUSPEND_LEVEL_BLANK_SCREEN;
-    register_early_suspend(&ar6k_early_suspend);
-#endif
-
-    ar6000_avail_ev_p = osdrvCallbacks->deviceInsertedHandler;
-    osdrvCallbacks->deviceInsertedHandler = ar6000_android_avail_ev;
-
-    ar6000_enable_mmchost_detect_change(1);
-}
-
-void android_module_exit(void)
-{
-#ifdef CONFIG_HAS_EARLYSUSPEND
-    unregister_early_suspend(&ar6k_early_suspend);
-#endif
-    ar6000_enable_mmchost_detect_change(1);
-}
-
-#ifdef CONFIG_PM
-void android_ar6k_check_wow_status(struct ar6_softc *ar, struct sk_buff *skb, bool isEvent)
-{
-    if (
-#ifdef CONFIG_HAS_EARLYSUSPEND
-        screen_is_off && 
-#endif 
-            skb && ar->arConnected) {
-        bool needWake = false;
-        if (isEvent) {
-            if (A_NETBUF_LEN(skb) >= sizeof(u16)) {
-                u16 cmd = *(const u16 *)A_NETBUF_DATA(skb);
-                switch (cmd) {
-                case WMI_CONNECT_EVENTID:
-                case WMI_DISCONNECT_EVENTID:
-                    needWake = true;
-                    break;
-                default:
-                    /* dont wake lock the system for other event */
-                    break;
-                }
-            }
-        } else if (A_NETBUF_LEN(skb) >= sizeof(ATH_MAC_HDR)) {
-            ATH_MAC_HDR *datap = (ATH_MAC_HDR *)A_NETBUF_DATA(skb);
-            if (!IEEE80211_IS_MULTICAST(datap->dstMac)) {
-                switch (A_BE2CPU16(datap->typeOrLen)) {
-                case 0x0800: /* IP */
-                case 0x888e: /* EAPOL */
-                case 0x88c7: /* RSN_PREAUTH */
-                case 0x88b4: /* WAPI */
-                     needWake = true;
-                     break;
-                case 0x0806: /* ARP is not important to hold wake lock */
-                default:
-                    break;
-                }
-            }
-        }
-        if (needWake) {
-            /* keep host wake up if there is any event and packate coming in*/
-            if (wowledon) {
-                char buf[32];
-                int len = sprintf(buf, "on");
-                android_readwrite_file("/sys/power/state", NULL, buf, len);
-
-                len = sprintf(buf, "%d", 127);
-                android_readwrite_file("/sys/class/leds/lcd-backlight/brightness",
-                                       NULL, buf,len);
-            }
-        }
-    }
-}
-#endif /* CONFIG_PM */
diff --git a/drivers/staging/ath6kl/os/linux/ar6000_drv.c b/drivers/staging/ath6kl/os/linux/ar6000_drv.c
index 97d6ce6..36722ed 100644
--- a/drivers/staging/ath6kl/os/linux/ar6000_drv.c
+++ b/drivers/staging/ath6kl/os/linux/ar6000_drv.c
@@ -27,9 +27,7 @@
  */
 
 #include "ar6000_drv.h"
-#ifdef ATH6K_CONFIG_CFG80211
 #include "cfg80211.h"
-#endif /* ATH6K_CONFIG_CFG80211 */
 #include "htc.h"
 #include "wmi_filter_linux.h"
 #include "epping_test.h"
@@ -118,7 +116,6 @@
 #endif
 
 unsigned int processDot11Hdr = 0;
-int bmienable = BMIENABLE_DEFAULT;
 
 char ifname[IFNAMSIZ] = {0,};
 
@@ -134,6 +131,8 @@
 unsigned int enableuartprint = ENABLEUARTPRINT_DEFAULT;
 unsigned int logWmiRawMsgs = 0;
 unsigned int enabletimerwar = 0;
+unsigned int num_device = 1;
+unsigned int regscanmode;
 unsigned int fwmode = 1;
 unsigned int mbox_yield_limit = 99;
 unsigned int enablerssicompensation = 0;
@@ -148,7 +147,6 @@
 unsigned int nohifscattersupport = NOHIFSCATTERSUPPORT_DEFAULT;
 
 unsigned int setuphci = SETUPHCI_DEFAULT;
-unsigned int setuphcipal = SETUPHCIPAL_DEFAULT;
 unsigned int loghci = 0;
 unsigned int setupbtdev = SETUPBTDEV_DEFAULT;
 #ifndef EXPORT_HCI_BRIDGE_INTERFACE
@@ -156,15 +154,14 @@
 unsigned int hciuartscale = HCIUARTSCALE_DEFAULT;
 unsigned int hciuartstep = HCIUARTSTEP_DEFAULT;
 #endif
-#ifdef CONFIG_CHECKSUM_OFFLOAD
 unsigned int csumOffload=0;
 unsigned int csumOffloadTest=0;
-#endif
 unsigned int eppingtest=0;
+unsigned int mac_addr_method;
+unsigned int firmware_bridge;
 
 module_param_string(ifname, ifname, sizeof(ifname), 0644);
 module_param(wlaninitmode, int, 0644);
-module_param(bmienable, int, 0644);
 module_param(bypasswmi, bool, 0644);
 module_param(debuglevel, uint, 0644);
 module_param(tspecCompliance, int, 0644);
@@ -182,9 +179,7 @@
 module_param(allow_trace_signal, int, 0644);
 module_param(enablerssicompensation, uint, 0644);
 module_param(processDot11Hdr, uint, 0644);
-#ifdef CONFIG_CHECKSUM_OFFLOAD
 module_param(csumOffload, uint, 0644);
-#endif
 #ifdef CONFIG_HOST_TCMD_SUPPORT
 module_param(testmode, uint, 0644);
 #endif
@@ -192,7 +187,6 @@
 module_param(nohifscattersupport, uint, 0644);
 module_param(panic_on_assert, uint, 0644);
 module_param(setuphci, uint, 0644);
-module_param(setuphcipal, uint, 0644);
 module_param(loghci, uint, 0644);
 module_param(setupbtdev, uint, 0644);
 #ifndef EXPORT_HCI_BRIDGE_INTERFACE
@@ -288,20 +282,11 @@
 static void ar6000_detect_error(unsigned long ptr);
 static void	ar6000_set_multicast_list(struct net_device *dev);
 static struct net_device_stats *ar6000_get_stats(struct net_device *dev);
-static struct iw_statistics *ar6000_get_iwstats(struct net_device * dev);
 
 static void disconnect_timer_handler(unsigned long ptr);
 
 void read_rssi_compensation_param(struct ar6_softc *ar);
 
-    /* for android builds we call external APIs that handle firmware download and configuration */
-#ifdef ANDROID_ENV
-/* !!!! Interim android support to make it easier to patch the default driver for
- * android use. You must define an external source file ar6000_android.c that handles the following
- * APIs */
-extern void android_module_init(OSDRV_CALLBACKS *osdrvCallbacks);
-extern void android_module_exit(void);
-#endif
 /*
  * HTC service connection handlers
  */
@@ -321,9 +306,7 @@
 
 static HTC_SEND_FULL_ACTION ar6000_tx_queue_full(void *Context, struct htc_packet *pPacket);
 
-#ifdef ATH_AR6K_11N_SUPPORT
 static void ar6000_alloc_netbufs(A_NETBUF_QUEUE_T *q, u16 num);
-#endif
 static void ar6000_deliver_frames_to_nw_stack(void * dev, void *osbuf);
 //static void ar6000_deliver_frames_to_bt_stack(void * dev, void *osbuf);
 
@@ -346,8 +329,6 @@
 static int
 ar6000_sysfs_bmi_init(struct ar6_softc *ar);
 
-/* HCI PAL callback function declarations */
-int ar6k_setup_hci_pal(struct ar6_softc *ar);
 void  ar6k_cleanup_hci_pal(struct ar6_softc *ar);
 
 static void
@@ -362,16 +343,13 @@
 
 struct net_device *ar6000_devices[MAX_AR6000];
 static int is_netdev_registered;
-extern struct iw_handler_def ath_iw_handler_def;
 DECLARE_WAIT_QUEUE_HEAD(arEvent);
 static void ar6000_cookie_init(struct ar6_softc *ar);
 static void ar6000_cookie_cleanup(struct ar6_softc *ar);
 static void ar6000_free_cookie(struct ar6_softc *ar, struct ar_cookie * cookie);
 static struct ar_cookie *ar6000_alloc_cookie(struct ar6_softc *ar);
 
-#ifdef USER_KEYS
 static int ar6000_reinstall_keys(struct ar6_softc *ar,u8 key_op_ctrl);
-#endif
 
 #ifdef CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT
 struct net_device *arApNetDev;
@@ -389,7 +367,6 @@
     .ndo_open               = ar6000_open,
     .ndo_stop               = ar6000_close,
     .ndo_get_stats          = ar6000_get_stats,
-    .ndo_do_ioctl           = ar6000_ioctl,
     .ndo_start_xmit         = ar6000_data_tx,
     .ndo_set_multicast_list = ar6000_set_multicast_list,
 };
@@ -612,7 +589,6 @@
     send = dbglog_get_debug_fragment(&buffer[sent], length - sent,
                                      MAX_WIRELESS_EVENT_SIZE);
     while (send) {
-        ar6000_send_event_to_app(ar, WMIX_DBGLOG_EVENTID, (u8 *)&buffer[sent], send);
         sent += send;
         send = dbglog_get_debug_fragment(&buffer[sent], length - sent,
                                          MAX_WIRELESS_EVENT_SIZE);
@@ -631,7 +607,7 @@
 ar6000_init_module(void)
 {
     static int probed = 0;
-    int status;
+    int r;
     OSDRV_CALLBACKS osdrvCallbacks;
 
     a_module_debug_support_init();
@@ -664,12 +640,6 @@
     osdrvCallbacks.devicePowerChangeHandler = ar6000_power_change_ev;
 #endif
 
-    ar6000_pm_init();
-
-#ifdef ANDROID_ENV
-    android_module_init(&osdrvCallbacks);
-#endif
-
 #ifdef DEBUG
     /* Set the debug flags if specified at load time */
     if(debugflags != 0)
@@ -687,13 +657,9 @@
     memset(&aptcTR, 0, sizeof(APTC_TRAFFIC_RECORD));
 #endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
 
-#ifdef CONFIG_HOST_GPIO_SUPPORT
-    ar6000_gpio_init();
-#endif /* CONFIG_HOST_GPIO_SUPPORT */
-
-    status = HIFInit(&osdrvCallbacks);
-    if (status)
-        return -ENODEV;
+    r = HIFInit(&osdrvCallbacks);
+    if (r)
+        return r;
 
     return 0;
 }
@@ -723,12 +689,6 @@
 
     a_module_debug_support_cleanup();
 
-    ar6000_pm_exit();
-
-#ifdef ANDROID_ENV    
-    android_module_exit();
-#endif
-
     AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("ar6000_cleanup: success\n"));
 }
 
@@ -769,7 +729,6 @@
 }
 #endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
 
-#ifdef ATH_AR6K_11N_SUPPORT
 static void
 ar6000_alloc_netbufs(A_NETBUF_QUEUE_T *q, u16 num)
 {
@@ -788,7 +747,6 @@
         A_PRINTF("%s(), allocation of netbuf failed", __func__);
     }
 }
-#endif
 
 static struct bin_attribute bmi_attr = {
     .attr = {.name = "bmi", .mode = 0600},
@@ -894,8 +852,6 @@
     } \
 } while(0)
 
-#ifdef INIT_MODE_DRV_ENABLED
-
 #ifdef SOFTMAC_FILE_USED
 #define AR6002_MAC_ADDRESS_OFFSET     0x0A
 #define AR6003_MAC_ADDRESS_OFFSET     0x16
@@ -982,7 +938,7 @@
                 }
                 source = "softmac file";
             }
-            A_FREE(macbuf);
+            kfree(macbuf);
         }
         A_RELEASE_FIRMWARE(softmac_entry);
     }
@@ -1005,6 +961,8 @@
                 filename = AR6003_REV1_OTP_FILE;
             } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
                 filename = AR6003_REV2_OTP_FILE;
+                } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+                        filename = AR6003_REV3_OTP_FILE;
             } else {
                 AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown firmware revision: %d\n", ar->arVersion.target_ver));
                 return A_ERROR;
@@ -1016,6 +974,8 @@
                 filename = AR6003_REV1_FIRMWARE_FILE;
             } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
                 filename = AR6003_REV2_FIRMWARE_FILE;
+                } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+                        filename = AR6003_REV3_FIRMWARE_FILE;
             } else {
                 AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown firmware revision: %d\n", ar->arVersion.target_ver));
                 return A_ERROR;
@@ -1027,6 +987,8 @@
                     filename = AR6003_REV1_EPPING_FIRMWARE_FILE;
                 } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
                     filename = AR6003_REV2_EPPING_FIRMWARE_FILE;
+                } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+                        filename = AR6003_REV3_EPPING_FIRMWARE_FILE;
                 } else {
                     AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("eppingtest : unsupported firmware revision: %d\n", 
                         ar->arVersion.target_ver));
@@ -1041,6 +1003,8 @@
                     filename = AR6003_REV1_TCMD_FIRMWARE_FILE;
                 } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
                     filename = AR6003_REV2_TCMD_FIRMWARE_FILE;
+                } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+                        filename = AR6003_REV3_TCMD_FIRMWARE_FILE;
                 } else {
                     AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown firmware revision: %d\n", ar->arVersion.target_ver));
                     return A_ERROR;
@@ -1068,6 +1032,8 @@
                 filename = AR6003_REV1_PATCH_FILE;
             } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
                 filename = AR6003_REV2_PATCH_FILE;
+                } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+                        filename = AR6003_REV3_PATCH_FILE;
             } else {
                 AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown firmware revision: %d\n", ar->arVersion.target_ver));
                 return A_ERROR;
@@ -1079,6 +1045,8 @@
                 filename = AR6003_REV1_BOARD_DATA_FILE;
             } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
                 filename = AR6003_REV2_BOARD_DATA_FILE;
+                } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+                        filename = AR6003_REV3_BOARD_DATA_FILE;
             } else {
                 AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown firmware revision: %d\n", ar->arVersion.target_ver));
                 return A_ERROR;
@@ -1133,8 +1101,10 @@
             }
 
             /* Record the fact that extended board Data IS initialized */
-            param = 1;
-            bmifn(BMIWriteMemory(ar->arHifDevice, HOST_INTEREST_ITEM_ADDRESS(ar, hi_board_ext_data_initialized), (u8 *)&param, 4));
+            param = (board_ext_data_size << 16) | 1;
+            bmifn(BMIWriteMemory(ar->arHifDevice,
+            HOST_INTEREST_ITEM_ADDRESS(ar, hi_board_ext_data_config),
+				       (unsigned char *)&param, 4));
         }
         fw_entry_size = board_data_size;
     }
@@ -1153,7 +1123,6 @@
     A_RELEASE_FIRMWARE(fw_entry);
     return 0;
 }
-#endif /* INIT_MODE_DRV_ENABLED */
 
 int
 ar6000_update_bdaddr(struct ar6_softc *ar)
@@ -1200,7 +1169,6 @@
         }
 
         A_RELEASE_FIRMWARE(fw_entry);
-#ifdef INIT_MODE_DRV_ENABLED
     } else {
         /* The config is contained within the driver itself */
         int status;
@@ -1293,7 +1261,9 @@
             bmifn(BMIWriteMemory(ar->arHifDevice, HOST_INTEREST_ITEM_ADDRESS(ar, hi_board_data_initialized), (u8 *)&param, 4));
 
             /* Transfer One time Programmable data */
-            AR6K_DATA_DOWNLOAD_ADDRESS(address, ar->arVersion.target_ver);
+	    AR6K_APP_LOAD_ADDRESS(address, ar->arVersion.target_ver);
+	    if (ar->arVersion.target_ver == AR6003_REV3_VERSION)
+		  address = 0x1234;
             status = ar6000_transfer_bin_file(ar, AR6K_OTP_FILE, address, true);
             if (status == 0) {
                 /* Execute the OTP code */
@@ -1309,7 +1279,9 @@
         }
 
         /* Download Target firmware */
-        AR6K_DATA_DOWNLOAD_ADDRESS(address, ar->arVersion.target_ver);
+        AR6K_APP_LOAD_ADDRESS(address, ar->arVersion.target_ver);
+        if (ar->arVersion.target_ver == AR6003_REV3_VERSION)
+                address = 0x1234;
         if ((ar6000_transfer_bin_file(ar, AR6K_FIRMWARE_FILE, address, true)) != 0) {
             return A_ERROR;
         }
@@ -1318,25 +1290,16 @@
         AR6K_APP_START_OVERRIDE_ADDRESS(address, ar->arVersion.target_ver);
         bmifn(BMISetAppStart(ar->arHifDevice, address));
 
-        /* Apply the patches */
-        AR6K_PATCH_DOWNLOAD_ADDRESS(address, ar->arVersion.target_ver);
-        if ((ar6000_transfer_bin_file(ar, AR6K_PATCH_FILE, address, false)) != 0) {
-            return A_ERROR;
-        }
-
-        param = address;
-        bmifn(BMIWriteMemory(ar->arHifDevice, HOST_INTEREST_ITEM_ADDRESS(ar, hi_dset_list_head), (u8 *)&param, 4));
-
-        if (ar->arTargetType == TARGET_TYPE_AR6003) {
-            if (ar->arVersion.target_ver == AR6003_REV1_VERSION) {
-                /* Reserve 5.5K of RAM */
-                param = 5632;
-            } else { /* AR6003_REV2_VERSION */
-                /* Reserve 6.5K of RAM */
-                param = 6656;
-            }
-            bmifn(BMIWriteMemory(ar->arHifDevice, HOST_INTEREST_ITEM_ADDRESS(ar, hi_end_RAM_reserve_sz), (u8 *)&param, 4));
-        }
+	if(ar->arTargetType == TARGET_TYPE_AR6003) {
+		AR6K_DATASET_PATCH_ADDRESS(address, ar->arVersion.target_ver);
+		if ((ar6000_transfer_bin_file(ar, AR6K_PATCH_FILE,
+					      address, false)) != 0)
+			return A_ERROR;
+		param = address;
+		bmifn(BMIWriteMemory(ar->arHifDevice,
+		HOST_INTEREST_ITEM_ADDRESS(ar, hi_dset_list_head),
+					   (unsigned char *)&param, 4));
+	}
 
         /* Restore system sleep */
         address = RTC_BASE_ADDRESS + SYSTEM_SLEEP_ADDRESS;
@@ -1390,8 +1353,6 @@
             msleep(1000);
         }
 #endif /* HTC_RAW_INTERFACE */
-
-#endif /* INIT_MODE_DRV_ENABLED */
     }
 
     return 0;
@@ -1470,7 +1431,11 @@
             return A_ERROR;
         }
 
+        param |= (num_device << HI_OPTION_NUM_DEV_SHIFT);
         param |= (fwmode << HI_OPTION_FW_MODE_SHIFT);
+        param |= (mac_addr_method << HI_OPTION_MAC_ADDR_METHOD_SHIFT);
+        param |= (firmware_bridge << HI_OPTION_FW_BRIDGE_SHIFT);
+
 
         if (BMIWriteMemory(ar->arHifDevice,
             HOST_INTEREST_ITEM_ADDRESS(ar, hi_option_flag),
@@ -1518,18 +1483,34 @@
      * It is difficult to patch the firmware boot code,
      * but possible in theory.
      */
-    if (ar->arTargetType == TARGET_TYPE_AR6003) {
-        param = AR6003_BOARD_EXT_DATA_ADDRESS; 
-        if (BMIWriteMemory(ar->arHifDevice,
-            HOST_INTEREST_ITEM_ADDRESS(ar, hi_board_ext_data),
-            (u8 *)&param,
-            4) != 0)
-        {
-            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIWriteMemory for hi_board_ext_data failed \n"));
-            return A_ERROR;
-        }
-    }
 
+	if (ar->arTargetType == TARGET_TYPE_AR6003) {
+		A_UINT32 ramReservedSz;
+		if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+			param = AR6003_REV2_BOARD_EXT_DATA_ADDRESS;
+			ramReservedSz =  AR6003_REV2_RAM_RESERVE_SIZE;
+                } else {
+			param = AR6003_REV3_BOARD_EXT_DATA_ADDRESS;
+			ramReservedSz =  AR6003_REV3_RAM_RESERVE_SIZE;
+		}
+		if (BMIWriteMemory(ar->arHifDevice,
+			HOST_INTEREST_ITEM_ADDRESS(ar, hi_board_ext_data),
+						   (u8 *)&param, 4) != 0) {
+				AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+						("BMIWriteMemory for "
+						 "hi_board_ext_data failed\n"));
+				return A_ERROR;
+		}
+		if (BMIWriteMemory(ar->arHifDevice,
+				   HOST_INTEREST_ITEM_ADDRESS(ar,
+				   hi_end_RAM_reserve_sz),
+				   (u8 *)&ramReservedSz, 4) != 0) {
+			AR_DEBUG_PRINTF(ATH_DEBUG_ERR ,
+					("BMIWriteMemory for "
+					 "hi_end_RAM_reserve_sz failed\n"));
+			return A_ERROR;
+		}
+	}
 
         /* since BMIInit is called in the driver layer, we have to set the block
          * size here for the target */
@@ -1555,9 +1536,6 @@
 {
     dev->netdev_ops = &ar6000_netdev_ops;
     dev->watchdog_timeo = AR6000_TX_TIMEOUT;
-    dev->wireless_handlers = &ath_iw_handler_def;
-
-    ath_iw_handler_def.get_wireless_stats = ar6000_get_iwstats; /*Displayed via proc fs */
 
    /*
     * We need the OS to provide us with more headroom in order to
@@ -1575,10 +1553,6 @@
         strcpy(dev->name, name);
     }
 
-#ifdef SET_MODULE_OWNER
-    SET_MODULE_OWNER(dev);
-#endif
-
 #ifdef CONFIG_CHECKSUM_OFFLOAD
     if(csumOffload){
         dev->features |= NETIF_F_IP_CSUM; /*advertise kernel capability to do TCP/UDP CSUM offload for IPV4*/
@@ -1588,6 +1562,52 @@
     return;
 }
 
+static int __ath6kl_init_netdev(struct net_device *dev)
+{
+	int r;
+
+	rtnl_lock();
+	r = ar6000_init(dev);
+	rtnl_unlock();
+
+	if (r) {
+		AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_avail: ar6000_init\n"));
+		return r;
+	}
+
+	return 0;
+}
+
+#ifdef HTC_RAW_INTERFACE
+static int ath6kl_init_netdev_wmi(struct net_device *dev)
+{
+	if (!eppingtest && bypasswmi)
+		return 0;
+
+	return __ath6kl_init_netdev(dev);
+}
+#else
+static int ath6kl_init_netdev_wmi(struct net_device *dev)
+{
+	return __ath6kl_init_netdev(dev);
+}
+#endif
+
+static int ath6kl_init_netdev(struct ar6_softc *ar)
+{
+	int r;
+
+        r = ar6000_sysfs_bmi_get_config(ar, wlaninitmode);
+        if (r) {
+		AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+				("ar6000_avail: "
+				 "ar6000_sysfs_bmi_get_config failed\n"));
+		return r;
+        }
+
+	return ath6kl_init_netdev_wmi(ar->arNetDev);
+}
+
 /*
  * HTC Event handlers
  */
@@ -1600,10 +1620,8 @@
     struct ar6_softc *ar;
     int device_index = 0;
     struct htc_init_info  htcInfo;
-#ifdef ATH6K_CONFIG_CFG80211
     struct wireless_dev *wdev;
-#endif /* ATH6K_CONFIG_CFG80211 */
-    int init_status = 0;
+    int r = 0;
     struct hif_device_os_device_info osDevInfo;
 
     memset(&osDevInfo, 0, sizeof(osDevInfo));
@@ -1630,22 +1648,12 @@
     /* we use another local "i" variable below.                      */
     device_index = i;
 
-#ifdef ATH6K_CONFIG_CFG80211
     wdev = ar6k_cfg80211_init(osDevInfo.pOSDevice);
     if (IS_ERR(wdev)) {
         AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: ar6k_cfg80211_init failed\n", __func__));
         return A_ERROR;
     }
     ar_netif = wdev_priv(wdev);
-#else
-    dev = alloc_etherdev(sizeof(struct ar6_softc));
-    if (dev == NULL) {
-        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_available: can't alloc etherdev\n"));
-        return A_ERROR;
-    }
-    ether_setup(dev);
-    ar_netif = ar6k_priv(dev);
-#endif /* ATH6K_CONFIG_CFG80211 */
 
     if (ar_netif == NULL) {
         AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Can't allocate ar6k priv memory\n", __func__));
@@ -1655,7 +1663,6 @@
     A_MEMZERO(ar_netif, sizeof(struct ar6_softc));
     ar = (struct ar6_softc *)ar_netif;
 
-#ifdef ATH6K_CONFIG_CFG80211
     ar->wdev = wdev;
     wdev->iftype = NL80211_IFTYPE_STATION;
 
@@ -1671,15 +1678,9 @@
     wdev->netdev = dev;
     ar->arNetworkType = INFRA_NETWORK;
     ar->smeState = SME_DISCONNECTED;
-#endif /* ATH6K_CONFIG_CFG80211 */
 
     init_netdev(dev, ifname);
 
-#ifdef SET_NETDEV_DEV
-    if (ar_netif) { 
-        SET_NETDEV_DEV(dev, osDevInfo.pOSDevice);
-    }
-#endif 
 
     ar->arNetDev             = dev;
     ar->arHifDevice          = hif_handle;
@@ -1719,35 +1720,22 @@
 
     BMIInit();
 
-    if (bmienable) {
-        ar6000_sysfs_bmi_init(ar);
-    }
+    ar6000_sysfs_bmi_init(ar);
 
     {
         struct bmi_target_info targ_info;
 
-        if (BMIGetTargetInfo(ar->arHifDevice, &targ_info) != 0) {
-            init_status = A_ERROR;
+        r = BMIGetTargetInfo(ar->arHifDevice, &targ_info);
+        if (r)
             goto avail_ev_failed;
-        }
 
         ar->arVersion.target_ver = targ_info.target_ver;
         ar->arTargetType = targ_info.target_type;
-
-            /* do any target-specific preparation that can be done through BMI */
-        if (ar6000_prepare_target(ar->arHifDevice,
-                                  targ_info.target_type,
-                                  targ_info.target_ver) != 0) {
-            init_status = A_ERROR;
-            goto avail_ev_failed;
-        }
-
     }
 
-    if (ar6000_configure_target(ar) != 0) {
-            init_status = A_ERROR;
+    r = ar6000_configure_target(ar);
+    if (r)
             goto avail_ev_failed;
-    }
 
     A_MEMZERO(&htcInfo,sizeof(htcInfo));
     htcInfo.pContext = ar;
@@ -1755,8 +1743,8 @@
 
     ar->arHtcTarget = HTCCreate(ar->arHifDevice,&htcInfo);
 
-    if (ar->arHtcTarget == NULL) {
-        init_status = A_ERROR;
+    if (!ar->arHtcTarget) {
+        r = -ENOMEM;
         goto avail_ev_failed;
     }
 
@@ -1767,22 +1755,19 @@
 #endif
 
 
-#ifdef CONFIG_CHECKSUM_OFFLOAD
     if(csumOffload){
         /*if external frame work is also needed, change and use an extended rxMetaVerion*/
         ar->rxMetaVersion=WMI_META_VERSION_2;
     }
-#endif
 
-#ifdef ATH_AR6K_11N_SUPPORT
-    if((ar->aggr_cntxt = aggr_init(ar6000_alloc_netbufs)) == NULL) {
+    ar->aggr_cntxt = aggr_init(ar6000_alloc_netbufs);
+    if (!ar->aggr_cntxt) {
             AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s() Failed to initialize aggr.\n", __func__));
-            init_status = A_ERROR;
+            r = -ENOMEM;
             goto avail_ev_failed;
     }
 
     aggr_register_rx_dispatcher(ar->aggr_cntxt, (void *)dev, ar6000_deliver_frames_to_nw_stack);
-#endif
 
     HIFClaimDevice(ar->arHifDevice, ar);
 
@@ -1791,46 +1776,20 @@
     /* when the module is unloaded.                                  */
     ar6000_devices[device_index] = dev;
 
-    /* Don't install the init function if BMI is requested */
-    if (!bmienable) {
-        ar6000_netdev_ops.ndo_init = ar6000_init;
-    } else {
-        AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("BMI enabled: %d\n", wlaninitmode));
-        if ((wlaninitmode == WLAN_INIT_MODE_UDEV) ||
-            (wlaninitmode == WLAN_INIT_MODE_DRV))
-        {
-            int status = 0;
-            do {
-                if ((status = ar6000_sysfs_bmi_get_config(ar, wlaninitmode)) != 0)
-                {
-                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_avail: ar6000_sysfs_bmi_get_config failed\n"));
-                    break;
-                }
-#ifdef HTC_RAW_INTERFACE
-                if (!eppingtest && bypasswmi) {
-                    break; /* Don't call ar6000_init for ART */
-                }
-#endif 
-                rtnl_lock();
-                status = (ar6000_init(dev)==0) ? 0 : A_ERROR;
-                rtnl_unlock();
-                if (status) {
-                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_avail: ar6000_init\n"));
-                }
-            } while (false);
-
-            if (status) {
-                init_status = status;
-                goto avail_ev_failed;
-            }
-        }
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("BMI enabled: %d\n", wlaninitmode));
+    if ((wlaninitmode == WLAN_INIT_MODE_UDEV) ||
+        (wlaninitmode == WLAN_INIT_MODE_DRV)) {
+	r = ath6kl_init_netdev(ar);
+	if (r)
+            goto avail_ev_failed;
     }
 
     /* This runs the init function if registered */
-    if (register_netdev(dev)) {
+    r = register_netdev(dev);
+    if (r) {
         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_avail: register_netdev failed\n"));
         ar6000_destroy(dev, 0);
-        return A_ERROR;
+        return r;
     }
 
 	is_netdev_registered = 1;
@@ -1843,13 +1802,10 @@
                     (unsigned long)ar));
 
 avail_ev_failed :
-    if (init_status) {
-        if (bmienable) { 
-            ar6000_sysfs_bmi_deinit(ar);  
-        }
-    }
+    if (r)
+        ar6000_sysfs_bmi_deinit(ar);  
 
-    return init_status;
+    return r;
 }
 
 static void ar6000_target_failure(void *Instance, int Status)
@@ -1880,9 +1836,6 @@
             sip = true;
             errEvent.errorVal = WMI_TARGET_COM_ERR |
                                 WMI_TARGET_FATAL_ERR;
-            ar6000_send_event_to_app(ar, WMI_ERROR_REPORT_EVENTID,
-                                     (u8 *)&errEvent,
-                                     sizeof(WMI_TARGET_ERROR_REPORT_EVENT));
         }
     }
 }
@@ -1980,10 +1933,8 @@
                     ar6000_disconnect_event(ar, DISCONNECT_CMD, ar->arBssid, 0, NULL, 0);
                 }
             }
-#ifdef USER_KEYS
             ar->user_savedkeys_stat = USER_SAVEDKEYS_STAT_INIT;
             ar->user_key_ctrl      = 0;
-#endif
         }
 
          AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("%s(): WMI stopped\n", __func__));
@@ -2025,15 +1976,6 @@
         if (setuphci)
         	ar6000_cleanup_hci(ar);
 #endif
-#ifdef EXPORT_HCI_PAL_INTERFACE
-        if (setuphcipal && (NULL != ar6kHciPalCallbacks_g.cleanupTransport)) {
-           ar6kHciPalCallbacks_g.cleanupTransport(ar);
-        }
-#else
-				/* cleanup hci pal driver data structures */
-        if(setuphcipal)
-          ar6k_cleanup_hci_pal(ar);
-#endif
         AR_DEBUG_PRINTF(ATH_DEBUG_INFO,(" Shutting down HTC .... \n"));
         /* stop HTC */
         HTCStop(ar->arHtcTarget);
@@ -2094,9 +2036,6 @@
     if (ar->arWlanPowerState != WLAN_POWER_STATE_CUT_PWR) {
         /* only stop endpoint if we are not stop it in suspend_ev */
         ar6000_stop_endpoint(dev, false, true);
-    } else {
-        /* clear up the platform power state before rmmod */
-        plat_setup_power(1,0);
     }
 
     ar->arWlanState = WLAN_DISABLED;
@@ -2110,9 +2049,7 @@
         HIFReleaseDevice(ar->arHifDevice);
         HIFShutDownDevice(ar->arHifDevice);
     }
-#ifdef ATH_AR6K_11N_SUPPORT
     aggr_module_destroy(ar->aggr_cntxt);
-#endif
 
        /* Done with cookies */
     ar6000_cookie_cleanup(ar);
@@ -2120,9 +2057,7 @@
         /* cleanup any allocated AMSDU buffers */
     ar6000_cleanup_amsdu_rxbufs(ar);
 
-    if (bmienable) {
-        ar6000_sysfs_bmi_deinit(ar);
-    }
+    ar6000_sysfs_bmi_deinit(ar);
 
     /* Cleanup BMI */
     BMICleanup();
@@ -2134,7 +2069,7 @@
 
 #ifdef HTC_RAW_INTERFACE
     if (ar->arRawHtc) {
-        A_FREE(ar->arRawHtc);
+        kfree(ar->arRawHtc);
         ar->arRawHtc = NULL;
     }
 #endif 
@@ -2145,9 +2080,7 @@
     }
     free_netdev(dev);
 
-#ifdef ATH6K_CONFIG_CFG80211
     ar6k_cfg80211_deinit(ar);
-#endif /* ATH6K_CONFIG_CFG80211 */
 
 #ifdef CONFIG_AP_VIRTUL_ADAPTER_SUPPORT
     ar6000_remove_ap_interface();
@@ -2187,9 +2120,6 @@
         ar->arHBChallengeResp.seqNum = 0;
         errEvent.errorVal = WMI_TARGET_COM_ERR | WMI_TARGET_FATAL_ERR;
         AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-        ar6000_send_event_to_app(ar, WMI_ERROR_REPORT_EVENTID,
-                                 (u8 *)&errEvent,
-                                 sizeof(WMI_TARGET_ERROR_REPORT_EVENT));
         return;
     }
 
@@ -2295,11 +2225,9 @@
 
     spin_lock_irqsave(&ar->arLock, flags);
 
-#ifdef ATH6K_CONFIG_CFG80211
     if(ar->arWlanState == WLAN_DISABLED) {
         ar->arWlanState = WLAN_ENABLED;
     }
-#endif /* ATH6K_CONFIG_CFG80211 */
 
     if( ar->arConnected || bypasswmi) {
         netif_carrier_on(dev);
@@ -2316,12 +2244,9 @@
 static int
 ar6000_close(struct net_device *dev)
 {
-#ifdef ATH6K_CONFIG_CFG80211
     struct ar6_softc    *ar = (struct ar6_softc *)ar6k_priv(dev);
-#endif /* ATH6K_CONFIG_CFG80211 */
     netif_stop_queue(dev);
 
-#ifdef ATH6K_CONFIG_CFG80211
     ar6000_disconnect(ar);
 
     if(ar->arWmiReady == true) {
@@ -2332,7 +2257,6 @@
         ar->arWlanState = WLAN_DISABLED;
     }
 	ar6k_cfg80211_scanComplete_event(ar, A_ECANCELED);
-#endif /* ATH6K_CONFIG_CFG80211 */
 
     return 0;
 }
@@ -2422,16 +2346,52 @@
     return(arEndpoint2Ac(ar, ep ));
 }
 
+#if defined(CONFIG_ATH6KL_ENABLE_COEXISTENCE)
+static int ath6kl_config_btcoex_params(struct ar6_softc *ar)
+{
+	int r;
+	WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD sbcb_cmd;
+	WMI_SET_BTCOEX_FE_ANT_CMD sbfa_cmd;
+
+	/* Configure the type of BT collocated with WLAN */
+	memset(&sbcb_cmd, 0, sizeof(WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD));
+	sbcb_cmd.btcoexCoLocatedBTdev = ATH6KL_BT_DEV;
+
+	r = wmi_set_btcoex_colocated_bt_dev_cmd(ar->arWmi, &sbcb_cmd);
+
+	if (r) {
+		AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+				("Unable to set collocated BT type\n"));
+		return r;
+	}
+
+	/* Configure the type of BT collocated with WLAN */
+	memset(&sbfa_cmd, 0, sizeof(WMI_SET_BTCOEX_FE_ANT_CMD));
+
+	sbfa_cmd.btcoexFeAntType = ATH6KL_BT_ANTENNA;
+
+	r = wmi_set_btcoex_fe_ant_cmd(ar->arWmi, &sbfa_cmd);
+	if (r) {
+		AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+				("Unable to set fornt end antenna configuration\n"));
+		return r;
+	}
+
+	return 0;
+}
+#else
+static int ath6kl_config_btcoex_params(struct ar6_softc *ar)
+{
+	return 0;
+}
+#endif /* CONFIG_ATH6KL_ENABLE_COEXISTENCE */
+
 /*
  * This function applies WLAN specific configuration defined in wlan_config.h
  */
 int ar6000_target_config_wlan_params(struct ar6_softc *ar)
 {
     int status = 0;
-#if defined(INIT_MODE_DRV_ENABLED) && defined(ENABLE_COEXISTENCE)
-    WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD sbcb_cmd;
-    WMI_SET_BTCOEX_FE_ANT_CMD sbfa_cmd;
-#endif /* INIT_MODE_DRV_ENABLED && ENABLE_COEXISTENCE */
 
 #ifdef CONFIG_HOST_TCMD_SUPPORT
     if (ar->arTargetMode != AR6000_WLAN_MODE) {
@@ -2449,39 +2409,9 @@
         status = A_ERROR;
     }
 
-#if defined(INIT_MODE_DRV_ENABLED) && defined(ENABLE_COEXISTENCE)
-    /* Configure the type of BT collocated with WLAN */
-    memset(&sbcb_cmd, 0, sizeof(WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD));
-#ifdef CONFIG_AR600x_BT_QCOM
-    sbcb_cmd.btcoexCoLocatedBTdev = 1;
-#elif defined(CONFIG_AR600x_BT_CSR)
-    sbcb_cmd.btcoexCoLocatedBTdev = 2;
-#elif defined(CONFIG_AR600x_BT_AR3001)
-    sbcb_cmd.btcoexCoLocatedBTdev = 3;
-#else
-#error Unsupported Bluetooth Type
-#endif /* Collocated Bluetooth Type */
-
-    if ((wmi_set_btcoex_colocated_bt_dev_cmd(ar->arWmi, &sbcb_cmd)) != 0) {
-        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to set collocated BT type\n"));
-        status = A_ERROR;
-    }
-
-    /* Configure the type of BT collocated with WLAN */
-    memset(&sbfa_cmd, 0, sizeof(WMI_SET_BTCOEX_FE_ANT_CMD));
-#ifdef CONFIG_AR600x_DUAL_ANTENNA
-    sbfa_cmd.btcoexFeAntType = 2;
-#elif defined(CONFIG_AR600x_SINGLE_ANTENNA)
-    sbfa_cmd.btcoexFeAntType = 1;
-#else
-#error Unsupported Front-End Antenna Configuration
-#endif /* AR600x Front-End Antenna Configuration */
-
-    if ((wmi_set_btcoex_fe_ant_cmd(ar->arWmi, &sbfa_cmd)) != 0) {
-        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to set fornt end antenna configuration\n"));
-        status = A_ERROR;
-    }
-#endif /* INIT_MODE_DRV_ENABLED && ENABLE_COEXISTENCE */
+    status = ath6kl_config_btcoex_params(ar);
+    if (status)
+	return status;
 
 #if WLAN_CONFIG_IGNORE_POWER_SAVE_FAIL_EVENT_DURING_SCAN
     if ((wmi_pmparams_cmd(ar->arWmi, 0, 1, 0, 0, 1, IGNORE_POWER_SAVE_FAIL_EVENT_DURING_SCAN)) != 0) {
@@ -2736,13 +2666,6 @@
             status = ar6000_setup_hci(ar);
         }
 #endif
-#ifdef EXPORT_HCI_PAL_INTERFACE
-        if (setuphcipal && (NULL != ar6kHciPalCallbacks_g.setupTransport))
-          status = ar6kHciPalCallbacks_g.setupTransport(ar);
-#else
-        if(setuphcipal)
-          status = ar6k_setup_hci_pal(ar);
-#endif
 
     } while (false);
 
@@ -2751,6 +2674,38 @@
         goto ar6000_init_done;
     }
 
+	if (regscanmode) {
+		A_UINT32 param;
+
+		if (BMIReadMemory(ar->arHifDevice,
+				  HOST_INTEREST_ITEM_ADDRESS(ar,
+							     hi_option_flag),
+							     (u8 *)&param,
+							     4) != 0) {
+			AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+					("BMIReadMemory forsetting "
+					 "regscanmode failed\n"));
+			return A_ERROR;
+		}
+
+		if (regscanmode == 1)
+			param |= HI_OPTION_SKIP_REG_SCAN;
+		else if (regscanmode == 2)
+			param |= HI_OPTION_INIT_REG_SCAN;
+
+		if (BMIWriteMemory(ar->arHifDevice,
+				   HOST_INTEREST_ITEM_ADDRESS(ar,
+							      hi_option_flag),
+							      (u8 *)&param,
+							      4) != 0) {
+			AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+					("BMIWriteMemory forsetting "
+					"regscanmode failed\n"));
+			return A_ERROR;
+		}
+		AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("Regulatory scan mode set\n"));
+	}
+
     /*
      * give our connected endpoints some buffers
      */
@@ -3095,7 +3050,6 @@
         }
 
         if (ar->arWmiEnabled) {
-#ifdef CONFIG_CHECKSUM_OFFLOAD
         u8 csumStart=0;
         u8 csumDest=0;
         u8 csum=skb->ip_summed;
@@ -3104,7 +3058,6 @@
 			 sizeof(ATH_LLC_SNAP_HDR));
             csumDest=skb->csum_offset+csumStart;
         }
-#endif
             if (A_NETBUF_HEADROOM(skb) < dev->hard_header_len - LINUX_HACK_FUDGE_FACTOR) {
                 struct sk_buff  *newbuf;
 
@@ -3135,7 +3088,6 @@
                     break;
                 }
             }
-#ifdef CONFIG_CHECKSUM_OFFLOAD
             if(csumOffload && (csum ==CHECKSUM_PARTIAL)){
                 WMI_TX_META_V2  metaV2;
                 metaV2.csumStart =csumStart;
@@ -3149,7 +3101,6 @@
 
             }
             else
-#endif
             {
                 if (wmi_data_hdr_add(ar->arWmi, skb, DATA_MSGTYPE, bMoreData, dot11Hdr,0,NULL) != 0) {
                     AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_data_tx - wmi_data_hdr_add failed\n"));
@@ -3704,8 +3655,23 @@
                 WMI_DATA_HDR *dhdr = (WMI_DATA_HDR *)A_NETBUF_DATA(skb);
                 bool is_amsdu;
                 u8 tid;
-                bool is_acl_data_frame;
-                is_acl_data_frame = WMI_DATA_HDR_GET_DATA_TYPE(dhdr) == WMI_DATA_HDR_DATA_TYPE_ACL;
+
+		/*
+		 * This check can be removed if after a while we do not
+		 * see the warning. For now we leave it to ensure
+		 * we drop these frames accordingly in case the
+		 * target generates them for some reason. These
+		 * were used for an internal PAL but that's not
+		 * used or supported anymore. These frames should
+		 * not come up from the target.
+		 */
+                if (WARN_ON(WMI_DATA_HDR_GET_DATA_TYPE(dhdr) ==
+			    WMI_DATA_HDR_DATA_TYPE_ACL)) {
+			AR6000_STAT_INC(ar, rx_errors);
+			A_NETBUF_FREE(skb);
+			return;
+		}
+
 #ifdef CONFIG_PM 
                 ar6000_check_wow_status(ar, NULL, false);
 #endif /* CONFIG_PM */
@@ -3727,7 +3693,7 @@
                  * ACL data frames don't follow ethernet frame bounds for
                  * min length
                  */
-                if (ar->arNetworkType != AP_NETWORK &&  !is_acl_data_frame &&
+                if (ar->arNetworkType != AP_NETWORK &&
                     ((pPacket->ActualLength < minHdrLen) ||
                     (pPacket->ActualLength > AR6000_MAX_RX_MESSAGE_SIZE)))
                 {
@@ -3767,11 +3733,9 @@
                             case WMI_META_VERSION_1:
                                 offset += sizeof(WMI_RX_META_V1);
                                 break;
-#ifdef CONFIG_CHECKSUM_OFFLOAD
                             case WMI_META_VERSION_2:
                                 offset += sizeof(WMI_RX_META_V2);
                                 break;
-#endif
                             default:
                                 break;
                         }
@@ -3841,7 +3805,6 @@
                                 A_NETBUF_PULL((void*)skb, sizeof(WMI_RX_META_V1));
                                 break;
                             }
-#ifdef CONFIG_CHECKSUM_OFFLOAD
                         case WMI_META_VERSION_2:
                             {
                                 WMI_RX_META_V2 *pMeta = (WMI_RX_META_V2 *)A_NETBUF_DATA(skb);
@@ -3852,7 +3815,6 @@
                                 A_NETBUF_PULL((void*)skb, sizeof(WMI_RX_META_V2));
                                 break;
                             }
-#endif
                         default:
                             break;
                     }
@@ -3862,7 +3824,7 @@
                     /* NWF: print the 802.11 hdr bytes */
                     if(containsDot11Hdr) {
                         status = wmi_dot11_hdr_remove(ar->arWmi,skb);
-                    } else if(!is_amsdu && !is_acl_data_frame) {
+                    } else if(!is_amsdu) {
                         status = wmi_dot3_2_dix(skb);
                     }
 
@@ -3872,16 +3834,6 @@
                         goto rx_done;
                     }
 
-                    if (is_acl_data_frame) {
-                        A_NETBUF_PUSH(skb, sizeof(int));
-                        *((short *)A_NETBUF_DATA(skb)) = WMI_ACL_DATA_EVENTID;
-	                /* send the data packet to PAL driver */
-			if(ar6k_pal_config_g.fpar6k_pal_recv_pkt) {
-				if((*ar6k_pal_config_g.fpar6k_pal_recv_pkt)(ar->hcipal_info, skb) == true)
-					goto rx_done;
-			}
-                    }
-
                     if ((ar->arNetDev->flags & IFF_UP) == IFF_UP) {
                         if (ar->arNetworkType == AP_NETWORK) {
                             struct sk_buff *skb1 = NULL;
@@ -3915,9 +3867,7 @@
                             }
                         }
                     }
-#ifdef ATH_AR6K_11N_SUPPORT
                     aggr_process_recv_frm(ar->aggr_cntxt, tid, seq_no, is_amsdu, (void **)&skb);
-#endif
                     ar6000_deliver_frames_to_nw_stack((void *) ar->arNetDev, (void *)skb);
                 }
             }
@@ -4146,93 +4096,6 @@
     return &ar->arNetStats;
 }
 
-static struct iw_statistics *
-ar6000_get_iwstats(struct net_device * dev)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    TARGET_STATS *pStats = &ar->arTargetStats;
-    struct iw_statistics * pIwStats = &ar->arIwStats;
-    int rtnllocked;
-
-    if (ar->bIsDestroyProgress || ar->arWmiReady == false || ar->arWlanState == WLAN_DISABLED)
-    {
-        pIwStats->status = 0;
-        pIwStats->qual.qual = 0;
-        pIwStats->qual.level =0;
-        pIwStats->qual.noise = 0;
-        pIwStats->discard.code =0;
-        pIwStats->discard.retries=0;
-        pIwStats->miss.beacon =0;
-        return pIwStats;
-    }
-
-    /*
-     * The in_atomic function is used to determine if the scheduling is
-     * allowed in the current context or not. This was introduced in 2.6
-     * From what I have read on the differences between 2.4 and 2.6, the
-     * 2.4 kernel did not support preemption and so this check might not
-     * be required for 2.4 kernels.
-     */
-    if (in_atomic())
-    {
-        wmi_get_stats_cmd(ar->arWmi);
-
-        pIwStats->status = 1 ;
-        pIwStats->qual.qual = pStats->cs_aveBeacon_rssi - 161;
-        pIwStats->qual.level =pStats->cs_aveBeacon_rssi; /* noise is -95 dBm */
-        pIwStats->qual.noise = pStats->noise_floor_calibation;
-        pIwStats->discard.code = pStats->rx_decrypt_err;
-        pIwStats->discard.retries = pStats->tx_retry_cnt;
-        pIwStats->miss.beacon = pStats->cs_bmiss_cnt;
-        return pIwStats;
-    }
-
-    dev_hold(dev);   
-    rtnllocked = rtnl_is_locked();
-    if (rtnllocked) {
-        rtnl_unlock();
-    }
-    pIwStats->status = 0;
-
-    if (down_interruptible(&ar->arSem)) {
-        goto err_exit;
-    }
-    
-    do {
-
-        if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
-            break;
-        }
-    
-        ar->statsUpdatePending = true;
-    
-        if(wmi_get_stats_cmd(ar->arWmi) != 0) {
-            break;
-        }
-    
-        wait_event_interruptible_timeout(arEvent, ar->statsUpdatePending == false, wmitimeout * HZ);
-        if (signal_pending(current)) {
-            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000 : WMI get stats timeout \n"));
-            break;
-        }
-        pIwStats->status = 1 ;
-        pIwStats->qual.qual = pStats->cs_aveBeacon_rssi - 161;
-        pIwStats->qual.level =pStats->cs_aveBeacon_rssi;  /* noise is -95 dBm */
-        pIwStats->qual.noise = pStats->noise_floor_calibation;
-        pIwStats->discard.code = pStats->rx_decrypt_err;
-        pIwStats->discard.retries = pStats->tx_retry_cnt;
-        pIwStats->miss.beacon = pStats->cs_bmiss_cnt;
-    } while (0);
-    up(&ar->arSem);
-
-err_exit:
-    if (rtnllocked) {
-        rtnl_lock();
-    }
-    dev_put(dev);
-    return pIwStats;
-}
-
 void
 ar6000_ready_event(void *devt, u8 *datap, u8 phyCap, u32 sw_ver, u32 abi_ver)
 {
@@ -4254,6 +4117,29 @@
     wake_up(&arEvent);
 }
 
+void ar6000_install_static_wep_keys(struct ar6_softc *ar)
+{
+    u8 index;
+    u8 keyUsage;
+
+    for (index = WMI_MIN_KEY_INDEX; index <= WMI_MAX_KEY_INDEX; index++) {
+        if (ar->arWepKeyList[index].arKeyLen) {
+            keyUsage = GROUP_USAGE;
+            if (index == ar->arDefTxKeyIndex) {
+                keyUsage |= TX_USAGE;
+            }
+            wmi_addKey_cmd(ar->arWmi,
+                           index,
+                           WEP_CRYPT,
+                           keyUsage,
+                           ar->arWepKeyList[index].arKeyLen,
+                           NULL,
+                           ar->arWepKeyList[index].arKey, KEY_OP_INIT_VAL, NULL,
+                           NO_SYNC_WMIFLAG);
+        }
+    }
+}
+
 void
 add_new_sta(struct ar6_softc *ar, u8 *mac, u16 aid, u8 *wpaie,
             u8 ielen, u8 keymgmt, u8 ucipher, u8 auth)
@@ -4392,13 +4278,11 @@
         return;
     }
 
-#ifdef ATH6K_CONFIG_CFG80211
     ar6k_cfg80211_connect_event(ar, channel, bssid,
                                 listenInterval, beaconInterval,
                                 networkType, beaconIeLen,
                                 assocReqLen, assocRespLen,
                                 assocInfo);
-#endif /* ATH6K_CONFIG_CFG80211 */
 
     memcpy(ar->arBssid, bssid, sizeof(ar->arBssid));
     ar->arBssChannel = channel;
@@ -4495,7 +4379,6 @@
         wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
     }
 
-#ifdef USER_KEYS
     if (ar->user_savedkeys_stat == USER_SAVEDKEYS_STAT_RUN &&
         ar->user_saved_keys.keyOk == true)
     {
@@ -4508,30 +4391,9 @@
         }
         ar6000_reinstall_keys(ar, key_op_ctrl);
     }
-#endif /* USER_KEYS */
 
     netif_wake_queue(ar->arNetDev);
 
-    /* For CFG80211 the key configuration and the default key comes in after connect so no point in plumbing invalid keys */
-#ifndef ATH6K_CONFIG_CFG80211
-    if ((networkType & ADHOC_NETWORK)      &&
-        (OPEN_AUTH == ar->arDot11AuthMode) &&
-        (NONE_AUTH == ar->arAuthMode)      &&
-        (WEP_CRYPT == ar->arPairwiseCrypto))
-    {
-        if (!ar->arConnected) {
-            wmi_addKey_cmd(ar->arWmi,
-                           ar->arDefTxKeyIndex,
-                           WEP_CRYPT,
-                           GROUP_USAGE | TX_USAGE,
-                           ar->arWepKeyList[ar->arDefTxKeyIndex].arKeyLen,
-                           NULL,
-                           ar->arWepKeyList[ar->arDefTxKeyIndex].arKey, KEY_OP_INIT_VAL, NULL,
-                           NO_SYNC_WMIFLAG);
-        }
-    }
-#endif /* ATH6K_CONFIG_CFG80211 */
-
     /* Update connect & link status atomically */
     spin_lock_irqsave(&ar->arLock, flags);
     ar->arConnected  = true;
@@ -4661,11 +4523,9 @@
         return;
     }
 
-#ifdef ATH6K_CONFIG_CFG80211
     ar6k_cfg80211_disconnect_event(ar, reason, bssid,
                                    assocRespLen, assocInfo,
                                    protocolReasonStatus);
-#endif /* ATH6K_CONFIG_CFG80211 */
 
     /* Send disconnect event to supplicant */
     A_MEMZERO(&wrqu, sizeof(wrqu));
@@ -4751,13 +4611,11 @@
         reconnect_flag = 0;
     }
 
-#ifdef USER_KEYS
     if (reason != CSERV_DISCONNECT)
     {
         ar->user_savedkeys_stat = USER_SAVEDKEYS_STAT_INIT;
         ar->user_key_ctrl      = 0;
     }
-#endif /* USER_KEYS */
 
     netif_stop_queue(ar->arNetDev);
     A_MEMZERO(ar->arBssid, sizeof(ar->arBssid));
@@ -4774,7 +4632,6 @@
     ar->arRegCode = regCode;
 }
 
-#ifdef ATH_AR6K_11N_SUPPORT
 void
 ar6000_aggr_rcv_addba_req_evt(struct ar6_softc *ar, WMI_ADDBA_REQ_EVENT *evt)
 {
@@ -4796,7 +4653,6 @@
 {
     aggr_recv_delba_req_evt(ar->aggr_cntxt, evt->tid);
 }
-#endif
 
 void register_pal_cb(ar6k_pal_config_t *palConfig_p)
 {
@@ -4828,12 +4684,6 @@
     buf += sizeof(int);
     memcpy(buf, cmd->buf, cmd->evt_buf_sz);
 
-    if(ar6k_pal_config_g.fpar6k_pal_recv_pkt)
-    {
-      /* pass the cmd packet to PAL driver */
-      if((*ar6k_pal_config_g.fpar6k_pal_recv_pkt)(ar->hcipal_info, osbuf) == true)
-        return;
-    }
     ar6000_deliver_frames_to_nw_stack(ar->arNetDev, osbuf);
     if(loghci) {
         A_PRINTF_LOG("HCI Event From PAL <-- \n");
@@ -4883,7 +4733,7 @@
         memcpy(pmkcand->bssid.sa_data, info->bssid, ATH_MAC_LEN);
         wrqu.data.length = sizeof(struct iw_pmkid_cand);
         wireless_send_event(ar->arNetDev, IWEVPMKIDCAND, &wrqu, (char *)pmkcand);
-        A_FREE(pmkcand);
+        kfree(pmkcand);
 #else /* WIRELESS_EXT >= 18 */
         snprintf(buf, sizeof(buf), "%s%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x",
                  tag,
@@ -4918,9 +4768,7 @@
             tag, s->mac[0],s->mac[1],s->mac[2],s->mac[3],s->mac[4],s->mac[5]);
     } else {
 
-#ifdef ATH6K_CONFIG_CFG80211
     ar6k_cfg80211_tkip_micerr_event(ar, keyid, ismcast);
-#endif /* ATH6K_CONFIG_CFG80211 */
 
         A_PRINTF("AR6000 TKIP MIC error received for keyid %d %scast\n",
              keyid & 0x3, ismcast ? "multi": "uni");
@@ -4937,9 +4785,7 @@
 ar6000_scanComplete_event(struct ar6_softc *ar, int status)
 {
 
-#ifdef ATH6K_CONFIG_CFG80211
     ar6k_cfg80211_scanComplete_event(ar, status);
-#endif /* ATH6K_CONFIG_CFG80211 */
 
     if (!ar->arUserBssFilter) {
         wmi_bssfilter_cmd(ar->arWmi, NONE_BSS_FILTER, 0);
@@ -5097,19 +4943,13 @@
     userRssiThold.rssi = rssi;
     A_PRINTF("rssi Threshold range = %d tag = %d  rssi = %d\n", newThreshold,
              userRssiThold.tag, userRssiThold.rssi);
-
-    ar6000_send_event_to_app(ar, WMI_RSSI_THRESHOLD_EVENTID,(u8 *)&userRssiThold, sizeof(USER_RSSI_THOLD));
 }
 
 
 void
 ar6000_hbChallengeResp_event(struct ar6_softc *ar, u32 cookie, u32 source)
 {
-    if (source == APP_HB_CHALLENGE) {
-        /* Report it to the app in case it wants a positive acknowledgement */
-        ar6000_send_event_to_app(ar, WMIX_HB_CHALLENGE_RESP_EVENTID,
-                                 (u8 *)&cookie, sizeof(cookie));
-    } else {
+    if (source != APP_HB_CHALLENGE) {
         /* This would ignore the replys that come in after their due time */
         if (cookie == ar->arHBChallengeResp.seqNum) {
             ar->arHBChallengeResp.outstanding = false;
@@ -5562,100 +5402,6 @@
     return cookie;
 }
 
-#ifdef SEND_EVENT_TO_APP
-/*
- * This function is used to send event which come from taget to
- * the application. The buf which send to application is include
- * the event ID and event content.
- */
-#define EVENT_ID_LEN   2
-void ar6000_send_event_to_app(struct ar6_softc *ar, u16 eventId,
-                              u8 *datap, int len)
-{
-
-#if (WIRELESS_EXT >= 15)
-
-/* note: IWEVCUSTOM only exists in wireless extensions after version 15 */
-
-    char *buf;
-    u16 size;
-    union iwreq_data wrqu;
-
-    size = len + EVENT_ID_LEN;
-
-    if (size > IW_CUSTOM_MAX) {
-        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("WMI event ID : 0x%4.4X, len = %d too big for IWEVCUSTOM (max=%d) \n",
-                eventId, size, IW_CUSTOM_MAX));
-        return;
-    }
-
-    buf = A_MALLOC_NOWAIT(size);
-    if (NULL == buf){
-        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s: failed to allocate %d bytes\n", __func__, size));
-        return;
-    }
-
-    A_MEMZERO(buf, size);
-    memcpy(buf, &eventId, EVENT_ID_LEN);
-    memcpy(buf+EVENT_ID_LEN, datap, len);
-
-    //AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("event ID = %d,len = %d\n",*(u16 *)buf, size));
-    A_MEMZERO(&wrqu, sizeof(wrqu));
-    wrqu.data.length = size;
-    wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
-    A_FREE(buf);
-#endif
-
-
-}
-
-/*
- * This function is used to send events larger than 256 bytes
- * to the application. The buf which is sent to application
- * includes the event ID and event content.
- */
-void ar6000_send_generic_event_to_app(struct ar6_softc *ar, u16 eventId,
-                                      u8 *datap, int len)
-{
-
-#if (WIRELESS_EXT >= 18)
-
-/* IWEVGENIE exists in wireless extensions version 18 onwards */
-
-    char *buf;
-    u16 size;
-    union iwreq_data wrqu;
-
-    size = len + EVENT_ID_LEN;
-
-    if (size > IW_GENERIC_IE_MAX) {
-        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("WMI event ID : 0x%4.4X, len = %d too big for IWEVGENIE (max=%d) \n",
-                        eventId, size, IW_GENERIC_IE_MAX));
-        return;
-    }
-
-    buf = A_MALLOC_NOWAIT(size);
-    if (NULL == buf){
-        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s: failed to allocate %d bytes\n", __func__, size));
-        return;
-    }
-
-    A_MEMZERO(buf, size);
-    memcpy(buf, &eventId, EVENT_ID_LEN);
-    memcpy(buf+EVENT_ID_LEN, datap, len);
-
-    A_MEMZERO(&wrqu, sizeof(wrqu));
-    wrqu.data.length = size;
-    wireless_send_event(ar->arNetDev, IWEVGENIE, &wrqu, buf);
-
-    A_FREE(buf);
-
-#endif /* (WIRELESS_EXT >= 18) */
-
-}
-#endif /* SEND_EVENT_TO_APP */
-
-
 void
 ar6000_tx_retry_err_event(void *devt)
 {
@@ -5666,13 +5412,9 @@
 ar6000_snrThresholdEvent_rx(void *devt, WMI_SNR_THRESHOLD_VAL newThreshold, u8 snr)
 {
     WMI_SNR_THRESHOLD_EVENT event;
-    struct ar6_softc *ar = (struct ar6_softc *)devt;
 
     event.range = newThreshold;
     event.snr = snr;
-
-    ar6000_send_event_to_app(ar, WMI_SNR_THRESHOLD_EVENTID, (u8 *)&event,
-                             sizeof(WMI_SNR_THRESHOLD_EVENT));
 }
 
 void
@@ -5999,9 +5741,7 @@
 }
 #endif
 
-#ifdef USER_KEYS
 static int
-
 ar6000_reinstall_keys(struct ar6_softc *ar, u8 key_op_ctrl)
 {
     int status = 0;
@@ -6046,7 +5786,6 @@
 
     return status;
 }
-#endif /* USER_KEYS */
 
 
 void
diff --git a/drivers/staging/ath6kl/os/linux/ar6000_pm.c b/drivers/staging/ath6kl/os/linux/ar6000_pm.c
index 1a90424..1e0ace8 100644
--- a/drivers/staging/ath6kl/os/linux/ar6000_pm.c
+++ b/drivers/staging/ath6kl/os/linux/ar6000_pm.c
@@ -36,9 +36,6 @@
 extern unsigned int wmitimeout;
 extern wait_queue_head_t arEvent;
 
-#ifdef ANDROID_ENV
-extern void android_ar6k_check_wow_status(struct ar6_softc *ar, struct sk_buff *skb, bool isEvent);
-#endif
 #undef ATH_MODULE_NAME
 #define ATH_MODULE_NAME pm
 #define  ATH_DEBUG_PM       ATH_DEBUG_MAKE_MODULE_MASK(0)
@@ -283,10 +280,6 @@
         /* Wow resume from irq interrupt */
         AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("%s: WoW resume from irq thread status %d\n", __func__, ar->arWlanPowerState));
         ar6000_wow_resume(ar);
-    } else {
-#ifdef ANDROID_ENV
-        android_ar6k_check_wow_status(ar, skb, isEvent);
-#endif
     }
 }
 
@@ -309,37 +302,6 @@
     return status;
 }
 
-static int ar6000_pm_probe(struct platform_device *pdev)
-{
-    plat_setup_power(1,1);
-    return 0;
-}
-
-static int ar6000_pm_remove(struct platform_device *pdev)
-{
-    plat_setup_power(0,1);
-    return 0;
-}
-
-static int ar6000_pm_suspend(struct platform_device *pdev, pm_message_t state)
-{
-    return 0;
-}
-
-static int ar6000_pm_resume(struct platform_device *pdev)
-{
-    return 0;
-}
-
-static struct platform_driver ar6000_pm_device = {
-    .probe      = ar6000_pm_probe,
-    .remove     = ar6000_pm_remove,
-    .suspend    = ar6000_pm_suspend,
-    .resume     = ar6000_pm_resume,
-    .driver     = {
-        .name = "wlan_ar6000_pm",
-    },
-};
 #endif /* CONFIG_PM */
 
 int
@@ -359,8 +321,6 @@
                 break;
             }
 
-            plat_setup_power(1,0);
-
             /* Change the state to ON */
             ar->arWlanPowerState = WLAN_POWER_STATE_ON;
 
@@ -373,17 +333,6 @@
                                 sizeof(HIF_DEVICE_POWER_CHANGE_TYPE));
 
             if (status == A_PENDING) {
-#ifdef ANDROID_ENV
-                 /* Wait for WMI ready event */
-                u32 timeleft = wait_event_interruptible_timeout(arEvent,
-                            (ar->arWmiReady == true), wmitimeout * HZ);
-                if (!timeleft || signal_pending(current)) {
-                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000 : Failed to get wmi ready \n"));
-                    status = A_ERROR;
-                    break;
-                }
-#endif
-                status = 0;
             } else if (status == 0) {
                 ar6000_restart_endpoint(ar->arNetDev);
                 status = 0;
@@ -403,8 +352,6 @@
                                 &config,
                                 sizeof(HIF_DEVICE_POWER_CHANGE_TYPE));
 
-            plat_setup_power(0,0);
-
             ar->arWlanPowerState = WLAN_POWER_STATE_CUT_PWR;
         }
     } while (0);
@@ -642,8 +589,6 @@
         }
         if (pSleepEvent) {
             AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("SENT WLAN Sleep Event %d\n", wmiSleepEvent.sleepState));
-            ar6000_send_event_to_app(ar, WMI_REPORT_SLEEP_STATE_EVENTID, (u8 *)pSleepEvent,
-                                     sizeof(WMI_REPORT_SLEEP_STATE_EVENTID));
         }
     }
     up(&ar->arSem);
@@ -679,25 +624,3 @@
     status = ar6000_update_wlan_pwr_state(ar, state, false);
     return status;
 }
-
-void ar6000_pm_init()
-{
-    A_REGISTER_MODULE_DEBUG_INFO(pm);
-#ifdef CONFIG_PM
-    /*
-     * Register ar6000_pm_device into system.
-     * We should also add platform_device into the first item of array
-     * of devices[] in file arch/xxx/mach-xxx/board-xxxx.c
-     */
-    if (platform_driver_register(&ar6000_pm_device)) {
-        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000: fail to register the power control driver.\n"));
-    }
-#endif /* CONFIG_PM */
-}
-
-void ar6000_pm_exit()
-{
-#ifdef CONFIG_PM
-    platform_driver_unregister(&ar6000_pm_device);
-#endif /* CONFIG_PM */
-}
diff --git a/drivers/staging/ath6kl/os/linux/ar6k_pal.c b/drivers/staging/ath6kl/os/linux/ar6k_pal.c
deleted file mode 100644
index 1f7179a..0000000
--- a/drivers/staging/ath6kl/os/linux/ar6k_pal.c
+++ /dev/null
@@ -1,479 +0,0 @@
-//------------------------------------------------------------------------------
-// Copyright (c) 2004-2010 Atheros Communications Inc.
-// All rights reserved.
-//
-// 
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-//
-//
-//
-// Author(s): ="Atheros"
-//------------------------------------------------------------------------------
-
-#include "ar6000_drv.h"
-#ifdef AR6K_ENABLE_HCI_PAL
-#include <net/bluetooth/bluetooth.h>
-#include <net/bluetooth/hci_core.h>
-#include <ar6k_pal.h>
-
-extern unsigned int setupbtdev;
-#define bt_check_bit(val, bit) (val & bit)
-#define bt_set_bit(val, bit) (val |= bit)
-#define bt_clear_bit(val, bit) (val &= ~bit)
-
-/* export ATH_AR6K_DEBUG_HCI_PAL=yes in host/localmake.linux.inc
- * to enable debug information */
-#ifdef HCIPAL_DEBUG
-#define PRIN_LOG(format, args...) printk(KERN_ALERT "%s:%d - %s Msg:" format "\n",__FUNCTION__, __LINE__, __FILE__, ## args) 
-#else
-#define PRIN_LOG(format, args...)
-#endif
-
-/**********************************
- * HCI PAL private info structure 
- *********************************/
-typedef struct ar6k_hci_pal_info_s{
-
-	unsigned long ulFlags;
-#define HCI_NORMAL_MODE (1)
-#define HCI_REGISTERED (1<<1)
-	struct hci_dev *hdev;            /* BT Stack HCI dev */
-	struct ar6_softc *ar;
-
-}ar6k_hci_pal_info_t;
-
-/*** BT Stack Entrypoints *******/
-/***************************************
- * bt_open - open a handle to the device
- ***************************************/
-static int bt_open(struct hci_dev *hdev)
-{
-	PRIN_LOG("HCI PAL: bt_open - enter - x\n");
-	set_bit(HCI_RUNNING, &hdev->flags);
-	set_bit(HCI_UP, &hdev->flags);
-	set_bit(HCI_INIT, &hdev->flags);         
-	return 0;
-}
-
-/***************************************
- * bt_close - close handle to the device
- ***************************************/
-static int bt_close(struct hci_dev *hdev)
-{
-	PRIN_LOG("HCI PAL: bt_close - enter\n");
-	clear_bit(HCI_RUNNING, &hdev->flags);
-	return 0;
-}
-
-/*****************************
- * bt_ioctl - ioctl processing
- *****************************/
-static int bt_ioctl(struct hci_dev *hdev, unsigned int cmd, unsigned long arg)
-{
-	PRIN_LOG("HCI PAL: bt_ioctl - enter\n");
-	return -ENOIOCTLCMD;
-}
-
-/**************************************
- * bt_flush - flush outstanding packets
- **************************************/
-static int bt_flush(struct hci_dev *hdev)
-{
-	PRIN_LOG("HCI PAL: bt_flush - enter\n");
-	return 0;
-}
-
-/***************
- * bt_destruct  
- ***************/
-static void bt_destruct(struct hci_dev *hdev)
-{
-	PRIN_LOG("HCI PAL: bt_destruct - enter\n");
-	/* nothing to do here */
-}
-
-/****************************************************
- * Invoked from bluetooth stack via hdev->send()
- * to send the packet out via ar6k to PAL firmware.
- *
- * For HCI command packet wmi_send_hci_cmd() is invoked.
- * wmi_send_hci_cmd adds WMI_CMD_HDR and sends the packet
- * to PAL firmware.
- *
- * For HCI ACL data packet wmi_data_hdr_add is invoked 
- * to add WMI_DATA_HDR to the packet.  ar6000_acl_data_tx 
- * is then invoked to send the packet to PAL firmware.
- ******************************************************/
-static int btpal_send_frame(struct sk_buff *skb)
-{
-	struct hci_dev *hdev = (struct hci_dev *)skb->dev;
-	HCI_TRANSPORT_PACKET_TYPE type;
-	ar6k_hci_pal_info_t *pHciPalInfo;
-	int status = 0;
-	struct sk_buff *txSkb = NULL;
-	struct ar6_softc *ar;
-
-	if (!hdev) {
-		PRIN_LOG("HCI PAL: btpal_send_frame - no device\n");
-		return -ENODEV;
-	}
-
-	if (!test_bit(HCI_RUNNING, &hdev->flags)) {
-		PRIN_LOG("HCI PAL: btpal_send_frame - not open\n");
-		return -EBUSY;
-	}
-
-	pHciPalInfo = (ar6k_hci_pal_info_t *)hdev->driver_data;   
-	A_ASSERT(pHciPalInfo != NULL);
-	ar = pHciPalInfo->ar;
-
-	PRIN_LOG("+btpal_send_frame type: %d \n",bt_cb(skb)->pkt_type);
-	type = HCI_COMMAND_TYPE;
-
-	switch (bt_cb(skb)->pkt_type) {
-		case HCI_COMMAND_PKT:
-			type = HCI_COMMAND_TYPE;
-			hdev->stat.cmd_tx++;
-			break;
-
-		case HCI_ACLDATA_PKT:
-			type = HCI_ACL_TYPE;
-			hdev->stat.acl_tx++;
-			break;
-
-		case HCI_SCODATA_PKT:
-			/* we don't support SCO over the pal */
-			kfree_skb(skb);
-			return 0;
-		default:
-			A_ASSERT(false);
-			kfree_skb(skb);
-			return 0;
-	} 
-
-	if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_HCI_DUMP)) {
-		A_PRINTF(">>> Send HCI %s packet len: %d\n",
-				(type == HCI_COMMAND_TYPE) ? "COMMAND" : "ACL",
-				skb->len);
-		if (type == HCI_COMMAND_TYPE) {
-			PRIN_LOG("    HCI Command: OGF:0x%X OCF:0x%X \r\n", 
-					HCI_GET_OP_CODE(skb-data) >> 10, HCI_GET_OP_CODE(skb-data) & 0x3FF);
-		}
-		AR_DEBUG_PRINTBUF(skb->data,skb->len,"BT HCI SEND Packet Dump");
-	}
-
-	do {
-		if(type == HCI_COMMAND_TYPE)
-		{
-			PRIN_LOG("HCI command");
-
-			if (ar->arWmiReady == false)
-			{
-				PRIN_LOG("WMI not ready ");
-				break;
-			}
-
-			if (wmi_send_hci_cmd(ar->arWmi, skb->data, skb->len) != 0)
-			{
-				PRIN_LOG("send hci cmd error");
-				break;
-			}
-		}
-		else if(type == HCI_ACL_TYPE)
-		{
-			void *osbuf;
-
-			PRIN_LOG("ACL data");
-			if (ar->arWmiReady == false)
-			{
-				PRIN_LOG("WMI not ready");
-				break;
-			}
-
-			/* need to add WMI header so allocate a skb with more space */
-			txSkb = bt_skb_alloc(TX_PACKET_RSV_OFFSET + WMI_MAX_TX_META_SZ + 
-					sizeof(WMI_DATA_HDR) + skb->len, 
-					GFP_ATOMIC);
-
-			if (txSkb == NULL) {
-				status = A_NO_MEMORY;
-				PRIN_LOG("No memory");
-				break;
-			}
-
-			bt_cb(txSkb)->pkt_type = bt_cb(skb)->pkt_type;
-			txSkb->dev = (void *)pHciPalInfo->hdev;
-			skb_reserve(txSkb, TX_PACKET_RSV_OFFSET + WMI_MAX_TX_META_SZ + sizeof(WMI_DATA_HDR));
-			memcpy(txSkb->data, skb->data, skb->len);
-			skb_put(txSkb,skb->len);
-			/* Add WMI packet type */
-			osbuf = (void *)txSkb;
-
-			if (wmi_data_hdr_add(ar->arWmi, osbuf, DATA_MSGTYPE, 0, WMI_DATA_HDR_DATA_TYPE_ACL,0,NULL) != 0) {
-				PRIN_LOG("XIOCTL_ACL_DATA - wmi_data_hdr_add failed\n");
-			} else {
-				/* Send data buffer over HTC */
-				PRIN_LOG("acl data tx");
-				ar6000_acl_data_tx(osbuf, ar->arNetDev);
-			}
-			txSkb = NULL;
-		}
-	} while (false);
-
-	if (txSkb != NULL) {
-		PRIN_LOG("Free skb");
-		kfree_skb(txSkb);    
-	}
-	kfree_skb(skb);        
-	return 0;
-}
-
-
-/***********************************************
- * Unregister HCI device and free HCI device info
- ***********************************************/
-static void bt_cleanup_hci_pal(ar6k_hci_pal_info_t *pHciPalInfo)
-{   
-	int err;      
-
-	if (bt_check_bit(pHciPalInfo->ulFlags, HCI_REGISTERED)) {
-		bt_clear_bit(pHciPalInfo->ulFlags, HCI_REGISTERED);
-		clear_bit(HCI_RUNNING, &pHciPalInfo->hdev->flags);
-		clear_bit(HCI_UP, &pHciPalInfo->hdev->flags);
-		clear_bit(HCI_INIT, &pHciPalInfo->hdev->flags);   
-		A_ASSERT(pHciPalInfo->hdev != NULL);
-		/* unregister */
-		PRIN_LOG("Unregister PAL device");
-		if ((err = hci_unregister_dev(pHciPalInfo->hdev)) < 0) {
-			PRIN_LOG("HCI PAL: failed to unregister with bluetooth %d\n",err);
-		}          
-	}
-
-	kfree(pHciPalInfo->hdev);
-	pHciPalInfo->hdev = NULL;
-}
-
-/*********************************************************
- * Allocate HCI device and store in PAL private info structure.
- *********************************************************/
-static int bt_setup_hci_pal(ar6k_hci_pal_info_t *pHciPalInfo)
-{
-	int status = 0;
-	struct hci_dev *pHciDev = NULL;
-
-	if (!setupbtdev) {
-		return 0;
-	} 
-
-	do {
-		/* allocate a BT HCI struct for this device */
-		pHciDev = hci_alloc_dev();
-		if (NULL == pHciDev) {
-			PRIN_LOG("HCI PAL driver - failed to allocate BT HCI struct \n");
-			status = A_NO_MEMORY;
-			break;
-		}    
-
-		/* save the device, we'll register this later */
-		pHciPalInfo->hdev = pHciDev;       
-                SET_HCI_BUS_TYPE(pHciDev, HCI_VIRTUAL, HCI_80211);
-		pHciDev->driver_data = pHciPalInfo;
-		pHciDev->open     = bt_open;
-		pHciDev->close    = bt_close;
-		pHciDev->send     = btpal_send_frame;
-		pHciDev->ioctl    = bt_ioctl;
-		pHciDev->flush    = bt_flush;
-		pHciDev->destruct = bt_destruct;
-		pHciDev->owner = THIS_MODULE; 
-		/* driver is running in normal BT mode */
-		PRIN_LOG("Normal mode enabled");
-		bt_set_bit(pHciPalInfo->ulFlags, HCI_NORMAL_MODE);
-
-	} while (false);
-
-	if (status) {
-		bt_cleanup_hci_pal(pHciPalInfo);    
-	}
-	return status;
-}
-
-/**********************************************
- * Cleanup HCI device and free HCI PAL private info
- *********************************************/
-void ar6k_cleanup_hci_pal(void *ar_p)
-{
-	struct ar6_softc *ar = (struct ar6_softc *)ar_p;
-	ar6k_hci_pal_info_t *pHciPalInfo = (ar6k_hci_pal_info_t *)ar->hcipal_info;
-
-	if (pHciPalInfo != NULL) {
-		bt_cleanup_hci_pal(pHciPalInfo);   
-		A_FREE(pHciPalInfo);
-		ar->hcipal_info = NULL;
-	}
-}
-
-/****************************
- *  Register HCI device
- ****************************/
-static bool ar6k_pal_transport_ready(void *pHciPal)
-{
-	ar6k_hci_pal_info_t *pHciPalInfo = (ar6k_hci_pal_info_t *)pHciPal;
-
-	PRIN_LOG("HCI device transport ready");
-	if(pHciPalInfo == NULL)
-		return false;
-
-	if (hci_register_dev(pHciPalInfo->hdev) < 0) {
-		PRIN_LOG("Can't register HCI device");
-		hci_free_dev(pHciPalInfo->hdev);
-		return false;
-	}
-	PRIN_LOG("HCI device registered");
-	pHciPalInfo->ulFlags |= HCI_REGISTERED;
-	return true;
-}
-
-/**************************************************
- * Called from ar6k driver when command or ACL data 
- * packet is received. Pass the packet to bluetooth
- * stack via hci_recv_frame.
- **************************************************/
-bool ar6k_pal_recv_pkt(void *pHciPal, void *osbuf)
-{
-	struct sk_buff *skb = (struct sk_buff *)osbuf;
-	ar6k_hci_pal_info_t *pHciPalInfo;
-	bool success = false;
-	u8 btType = 0;
-	pHciPalInfo = (ar6k_hci_pal_info_t *)pHciPal;
-
-	do {
-
-		/* if normal mode is not enabled pass on to the stack
-		 * by returning failure */
-		if(!(pHciPalInfo->ulFlags & HCI_NORMAL_MODE))
-		{
-			PRIN_LOG("Normal mode not enabled");
-			break;
-		}
-
-		if (!test_bit(HCI_RUNNING, &pHciPalInfo->hdev->flags)) {
-			PRIN_LOG("HCI PAL: HCI - not running\n");
-			break;
-		}
-
-		if(*((short *)A_NETBUF_DATA(skb)) == WMI_ACL_DATA_EVENTID)
-			btType = HCI_ACLDATA_PKT;
-		else
-			btType = HCI_EVENT_PKT;
-		/* pull 4 bytes which contains WMI packet type */
-		A_NETBUF_PULL(skb, sizeof(int));
-		bt_cb(skb)->pkt_type = btType;
-		skb->dev = (void *)pHciPalInfo->hdev;
-
-		/* pass the received event packet up the stack */    
-		if (hci_recv_frame(skb) != 0) {
-			PRIN_LOG("HCI PAL: hci_recv_frame failed \n");
-			break;
-		} else {
-			PRIN_LOG("HCI PAL: Indicated RCV of type:%d, Length:%d \n",HCI_EVENT_PKT, skb->len);
-		}
-		PRIN_LOG("hci recv success");
-		success = true;
-	}while(false);
-	return success;
-}
-
-/**********************************************************
- * HCI PAL init function called from ar6k when it is loaded..
- * Allocates PAL private info, stores the same in ar6k private info.
- * Registers a HCI device.
- * Registers packet receive callback function with ar6k 
- **********************************************************/
-int ar6k_setup_hci_pal(void *ar_p)
-{
-	int status = 0;
-	ar6k_hci_pal_info_t *pHciPalInfo;
-	ar6k_pal_config_t ar6k_pal_config;
-	struct ar6_softc *ar = (struct ar6_softc *)ar_p;
-
-	do {
-
-		pHciPalInfo = (ar6k_hci_pal_info_t *)A_MALLOC(sizeof(ar6k_hci_pal_info_t));
-
-		if (NULL == pHciPalInfo) {
-			status = A_NO_MEMORY;
-			break;    
-		}
-
-		A_MEMZERO(pHciPalInfo, sizeof(ar6k_hci_pal_info_t));
-		ar->hcipal_info = pHciPalInfo;
-		pHciPalInfo->ar = ar;
-
-		status = bt_setup_hci_pal(pHciPalInfo);
-		if (status) {
-			break;    
-		}
-
-		if(bt_check_bit(pHciPalInfo->ulFlags, HCI_NORMAL_MODE))
-			PRIN_LOG("HCI PAL: running in normal mode... \n");    
-		else 
-			PRIN_LOG("HCI PAL: running in test mode... \n");     
-
-		ar6k_pal_config.fpar6k_pal_recv_pkt = ar6k_pal_recv_pkt;
-		register_pal_cb(&ar6k_pal_config);
-		ar6k_pal_transport_ready(ar->hcipal_info);
-	} while (false);
-
-	if (status) {
-		ar6k_cleanup_hci_pal(ar);    
-	}
-	return status;
-}
-#else  /* AR6K_ENABLE_HCI_PAL */
-int ar6k_setup_hci_pal(void *ar_p)
-{
-	return 0;
-}
-void ar6k_cleanup_hci_pal(void *ar_p)
-{
-}
-#endif /* AR6K_ENABLE_HCI_PAL */
-
-#ifdef EXPORT_HCI_PAL_INTERFACE
-/*****************************************************
- * Register init and callback function with ar6k
- * when PAL driver is a separate kernel module.
- ****************************************************/
-int ar6k_register_hci_pal(struct hci_transport_callbacks *hciTransCallbacks);
-static int __init pal_init_module(void)
-{
-	struct hci_transport_callbacks hciTransCallbacks;
-
-	hciTransCallbacks.setupTransport = ar6k_setup_hci_pal;
-	hciTransCallbacks.cleanupTransport = ar6k_cleanup_hci_pal;
-
-	if(ar6k_register_hci_pal(&hciTransCallbacks) != 0)
-		return -ENODEV;
-
-	return 0;
-}
-
-static void __exit pal_cleanup_module(void)
-{
-}
-
-module_init(pal_init_module);
-module_exit(pal_cleanup_module);
-MODULE_LICENSE("Dual BSD/GPL");
-#endif
diff --git a/drivers/staging/ath6kl/os/linux/cfg80211.c b/drivers/staging/ath6kl/os/linux/cfg80211.c
index bcca394..e87d3aa 100644
--- a/drivers/staging/ath6kl/os/linux/cfg80211.c
+++ b/drivers/staging/ath6kl/os/linux/cfg80211.c
@@ -552,7 +552,7 @@
                                         ibss_channel, mgmt,
                                         le16_to_cpu(size),
                                         signal, GFP_KERNEL);
-        A_FREE(ieeemgmtbuf);
+        kfree(ieeemgmtbuf);
         cfg80211_put_bss(bss);
     }
 
@@ -627,6 +627,10 @@
 
     AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: reason=%u\n", __func__, reason));
 
+    if (ar->scan_request) {
+	cfg80211_scan_done(ar->scan_request, true);
+        ar->scan_request = NULL;
+    }
     if((ADHOC_NETWORK & ar->arNetworkType)) {
         if(NL80211_IFTYPE_ADHOC != ar->wdev->iftype) {
             AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
@@ -729,7 +733,7 @@
                               le16_to_cpu(size),
                               signal, GFP_KERNEL);
 
-    A_FREE (ieeemgmtbuf);
+    kfree (ieeemgmtbuf);
 }
 
 static int
@@ -1205,10 +1209,10 @@
 
     if(pmgmt) {
         AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: Max Perf\n", __func__));
-        pwrMode.powerMode = MAX_PERF_POWER;
+        pwrMode.powerMode = REC_POWER;
     } else {
         AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: Rec Power\n", __func__));
-        pwrMode.powerMode = REC_POWER;
+        pwrMode.powerMode = MAX_PERF_POWER;
     }
 
     if(wmi_powermode_cmd(ar->arWmi, pwrMode.powerMode) != 0) {
diff --git a/drivers/staging/ath6kl/os/linux/eeprom.c b/drivers/staging/ath6kl/os/linux/eeprom.c
index 4cff9da..96f1724 100644
--- a/drivers/staging/ath6kl/os/linux/eeprom.c
+++ b/drivers/staging/ath6kl/os/linux/eeprom.c
@@ -359,216 +359,3 @@
     request_4byte_write(offset, data);
     wait_for_eeprom_completion();
 }
-/* ATHENV */
-#ifdef ANDROID_ENV
-void eeprom_ar6000_transfer(struct hif_device *device, char *fake_file, char *p_mac)
-{
-    u32 first_word;
-    u32 board_data_addr;
-    int i;
-
-    printk("%s: Enter\n", __FUNCTION__);
-
-    enable_SI(device);
-    eeprom_type_detect();
-
-    if (fake_file) {
-        /*
-         * Transfer from file to Target RAM.
-         * Fetch source data from file.
-         */
-        mm_segment_t		oldfs;
-        struct file		*filp;
-        struct inode		*inode = NULL;
-        int			length;
-
-        /* open file */
-        oldfs = get_fs();
-        set_fs(KERNEL_DS);
-        filp = filp_open(fake_file, O_RDONLY, S_IRUSR);
-
-        if (IS_ERR(filp)) {
-            printk("%s: file %s filp_open error\n", __FUNCTION__, fake_file);
-            set_fs(oldfs);
-            return;
-        }
-
-        if (!filp->f_op) {
-            printk("%s: File Operation Method Error\n", __FUNCTION__);
-            filp_close(filp, NULL);
-            set_fs(oldfs);
-            return;
-        }
-
-        inode = GET_INODE_FROM_FILEP(filep);
-        if (!inode) {
-            printk("%s: Get inode from filp failed\n", __FUNCTION__);
-            filp_close(filp, NULL);
-            set_fs(oldfs);
-            return;
-        }
-
-        printk("%s file offset opsition: %xh\n", __FUNCTION__, (unsigned)filp->f_pos);
-
-        /* file's size */
-        length = i_size_read(inode->i_mapping->host);
-        printk("%s: length=%d\n", __FUNCTION__, length);
-        if (length != EEPROM_SZ) {
-            printk("%s: The file's size is not as expected\n", __FUNCTION__);
-            filp_close(filp, NULL);
-            set_fs(oldfs);
-            return;
-        }
-
-        /* read data */
-        if (filp->f_op->read(filp, eeprom_data, length, &filp->f_pos) != length) {
-            printk("%s: file read error\n", __FUNCTION__);
-            filp_close(filp, NULL);
-            set_fs(oldfs);
-            return;
-        }
-
-        /* read data out successfully */
-        filp_close(filp, NULL);
-        set_fs(oldfs);
-    } else {
-        /*
-         * Read from EEPROM to file OR transfer from EEPROM to Target RAM.
-         * Fetch EEPROM_SZ Bytes of Board Data, 8 bytes at a time.
-         */
-
-        fetch_8bytes(0, (u32 *)(&eeprom_data[0]));
-
-        /* Check the first word of EEPROM for validity */
-        first_word = *((u32 *)eeprom_data);
-
-        if ((first_word == 0) || (first_word == 0xffffffff)) {
-            printk("Did not find EEPROM with valid Board Data.\n");
-        }
-
-        for (i=8; i<EEPROM_SZ; i+=8) {
-            fetch_8bytes(i, (u32 *)(&eeprom_data[i]));
-        }
-    }
-
-    /* soft mac */
-    if (p_mac) {
-
-        mm_segment_t		oldfs;
-        struct file		*filp;
-        struct inode		*inode = NULL;
-        int			length;
-        
-        /* open file */
-        oldfs = get_fs();
-        set_fs(KERNEL_DS);
-        filp = filp_open(p_mac, O_RDONLY, S_IRUSR);
-        
-        printk("%s try to open file %s\n", __FUNCTION__, p_mac);
-
-        if (IS_ERR(filp)) {
-            printk("%s: file %s filp_open error\n", __FUNCTION__, p_mac);
-            set_fs(oldfs);
-            return;
-        }
-        
-        if (!filp->f_op) {
-            printk("%s: File Operation Method Error\n", __FUNCTION__);
-            filp_close(filp, NULL);
-            set_fs(oldfs);
-            return;
-        }
-        
-        inode = GET_INODE_FROM_FILEP(filep);
-        if (!inode) {
-            printk("%s: Get inode from filp failed\n", __FUNCTION__);
-            filp_close(filp, NULL);
-            set_fs(oldfs);
-            return;
-        }
-        
-        printk("%s file offset opsition: %xh\n", __FUNCTION__, (unsigned)filp->f_pos);
-        
-        /* file's size */
-        length = i_size_read(inode->i_mapping->host);
-        printk("%s: length=%d\n", __FUNCTION__, length);
-        if (length > ATH_SOFT_MAC_TMP_BUF_LEN) {
-            printk("%s: MAC file's size is not as expected\n", __FUNCTION__);
-            filp_close(filp, NULL);
-            set_fs(oldfs);
-            return;
-        }
-        
-        /* read data */
-        if (filp->f_op->read(filp, soft_mac_tmp_buf, length, &filp->f_pos) != length) {
-            printk("%s: file read error\n", __FUNCTION__);
-            filp_close(filp, NULL);
-            set_fs(oldfs);
-            return;
-        }
-
-#if 0
-        /* the data we just read */
-        printk("%s: mac address from the file:\n", __FUNCTION__);
-        for (i = 0; i < length; i++)
-            printk("[%c(0x%x)],", soft_mac_tmp_buf[i], soft_mac_tmp_buf[i]);
-        printk("\n");
-#endif
-
-        /* read data out successfully */
-        filp_close(filp, NULL);
-        set_fs(oldfs);
-
-        /* convert mac address */
-        if (!wmic_ether_aton(soft_mac_tmp_buf, mac_addr)) {
-            printk("%s: convert mac value fail\n", __FUNCTION__);
-            return;
-        }
-
-#if 0
-        /* the converted mac address */
-        printk("%s: the converted mac value\n", __FUNCTION__);
-        for (i = 0; i < ATH_MAC_LEN; i++)
-            printk("[0x%x],", mac_addr[i]);
-        printk("\n");
-#endif
-    }
-    /* soft mac */
-
-    /* Determine where in Target RAM to write Board Data */
-    BMI_read_mem( HOST_INTEREST_ITEM_ADDRESS(hi_board_data), &board_data_addr);
-    if (board_data_addr == 0) {
-        printk("hi_board_data is zero\n");
-    }
-
-    /* soft mac */
-#if 1
-    /* Update MAC address in RAM */
-    if (p_mac) {
-	    update_mac(eeprom_data, EEPROM_SZ, mac_addr);
-    }
-#endif
-#if 0
-    /* mac address in eeprom array */
-    printk("%s: mac values in eeprom array\n", __FUNCTION__);
-    for (i = 10; i < 10 + 6; i++)
-        printk("[0x%x],", eeprom_data[i]);
-    printk("\n");
-#endif
-    /* soft mac */
-
-    /* Write EEPROM data to Target RAM */
-    BMI_write_mem(board_data_addr, ((u8 *)eeprom_data), EEPROM_SZ);
-
-    /* Record the fact that Board Data IS initialized */
-    {
-       u32 one = 1;
-       BMI_write_mem(HOST_INTEREST_ITEM_ADDRESS(hi_board_data_initialized),
-                     (u8 *)&one, sizeof(u32));
-    }
-
-    disable_SI();
-}
-#endif
-/* ATHENV */
-
diff --git a/drivers/staging/ath6kl/os/linux/hci_bridge.c b/drivers/staging/ath6kl/os/linux/hci_bridge.c
index 39e5798..ac08bcb 100644
--- a/drivers/staging/ath6kl/os/linux/hci_bridge.c
+++ b/drivers/staging/ath6kl/os/linux/hci_bridge.c
@@ -582,11 +582,11 @@
         } 
         
         if (pHcidevInfo->pHTCStructAlloc != NULL) {
-            A_FREE(pHcidevInfo->pHTCStructAlloc);
+            kfree(pHcidevInfo->pHTCStructAlloc);
             pHcidevInfo->pHTCStructAlloc = NULL;    
         }
         
-        A_FREE(pHcidevInfo);
+        kfree(pHcidevInfo);
 #ifndef EXPORT_HCI_BRIDGE_INTERFACE
         ar->hcidev_info = NULL;
 #endif
diff --git a/drivers/staging/ath6kl/os/linux/include/ar6000_drv.h b/drivers/staging/ath6kl/os/linux/include/ar6000_drv.h
index 89fd80a..b466e7f5 100644
--- a/drivers/staging/ath6kl/os/linux/include/ar6000_drv.h
+++ b/drivers/staging/ath6kl/os/linux/include/ar6000_drv.h
@@ -33,9 +33,7 @@
 #include <linux/if_arp.h>
 #include <linux/ip.h>
 #include <linux/wireless.h>
-#ifdef ATH6K_CONFIG_CFG80211
 #include <net/cfg80211.h>
-#endif /* ATH6K_CONFIG_CFG80211 */
 #include <linux/module.h>
 #include <asm/io.h>
 
@@ -94,8 +92,6 @@
 #endif
 
 
-#ifdef USER_KEYS
-
 #define USER_SAVEDKEYS_STAT_INIT     0
 #define USER_SAVEDKEYS_STAT_RUN      1
 
@@ -106,7 +102,6 @@
     CRYPTO_TYPE               keyType;
     bool                    keyOk;
 };
-#endif
 
 #define DBG_INFO        0x00000001
 #define DBG_ERROR       0x00000002
@@ -215,35 +210,42 @@
 #define SETUPHCI_DEFAULT           0
 #endif /* SETUPHCI_ENABLED */
 
-#ifdef SETUPHCIPAL_ENABLED
-#define SETUPHCIPAL_DEFAULT           1
-#else
-#define SETUPHCIPAL_DEFAULT           0
-#endif /* SETUPHCIPAL_ENABLED */
-
 #ifdef SETUPBTDEV_ENABLED
 #define SETUPBTDEV_DEFAULT         1
 #else
 #define SETUPBTDEV_DEFAULT         0
 #endif /* SETUPBTDEV_ENABLED */
 
-#ifdef BMIENABLE_SET
-#define BMIENABLE_DEFAULT          1
-#else
-#define BMIENABLE_DEFAULT          0
-#endif /* BMIENABLE_SET */
-
 #ifdef ENABLEUARTPRINT_SET
 #define ENABLEUARTPRINT_DEFAULT    1
 #else
 #define ENABLEUARTPRINT_DEFAULT    0
 #endif /* ENABLEARTPRINT_SET */
 
-#ifdef ATH6K_CONFIG_HIF_VIRTUAL_SCATTER
+#ifdef ATH6KL_CONFIG_HIF_VIRTUAL_SCATTER
 #define NOHIFSCATTERSUPPORT_DEFAULT    1
-#else /* ATH6K_CONFIG_HIF_VIRTUAL_SCATTER */
+#else /* ATH6KL_CONFIG_HIF_VIRTUAL_SCATTER */
 #define NOHIFSCATTERSUPPORT_DEFAULT    0
-#endif /* ATH6K_CONFIG_HIF_VIRTUAL_SCATTER */
+#endif /* ATH6KL_CONFIG_HIF_VIRTUAL_SCATTER */
+
+
+#if defined(CONFIG_ATH6KL_ENABLE_COEXISTENCE)
+
+#ifdef CONFIG_AR600x_BT_QCOM
+#define ATH6KL_BT_DEV 1
+#elif defined(CONFIG_AR600x_BT_CSR)
+#define ATH6KL_BT_DEV 2
+#else
+#define ATH6KL_BT_DEV 3
+#endif
+
+#ifdef CONFIG_AR600x_DUAL_ANTENNA
+#define ATH6KL_BT_ANTENNA 2
+#else
+#define ATH6KL_BT_ANTENNA 1
+#endif
+
+#endif /* CONFIG_ATH6KL_ENABLE_COEXISTENCE */
 
 #ifdef AR600x_BT_AR3001
 #define AR3KHCIBAUD_DEFAULT        3000000
@@ -255,11 +257,7 @@
 #define HCIUARTSTEP_DEFAULT        0
 #endif /* AR600x_BT_AR3001 */
 
-#ifdef INIT_MODE_DRV_ENABLED
 #define WLAN_INIT_MODE_DEFAULT     WLAN_INIT_MODE_DRV
-#else
-#define WLAN_INIT_MODE_DEFAULT     WLAN_INIT_MODE_USR
-#endif /* INIT_MODE_DRV_ENABLED */
 
 #define AR6K_PATCH_DOWNLOAD_ADDRESS(_param, _ver) do { \
     if ((_ver) == AR6003_REV1_VERSION) { \
@@ -283,15 +281,37 @@
     } \
 } while (0)
 
+#define AR6K_DATASET_PATCH_ADDRESS(_param, _ver) do { \
+        if ((_ver) == AR6003_REV2_VERSION) { \
+                (_param) = AR6003_REV2_DATASET_PATCH_ADDRESS; \
+        } else if ((_ver) == AR6003_REV3_VERSION) { \
+                (_param) = AR6003_REV3_DATASET_PATCH_ADDRESS; \
+        } else { \
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown Version: %d\n", _ver)); \
+        A_ASSERT(0); \
+        } \
+} while (0)
+
+#define AR6K_APP_LOAD_ADDRESS(_param, _ver) do { \
+        if ((_ver) == AR6003_REV2_VERSION) { \
+                (_param) = AR6003_REV2_APP_LOAD_ADDRESS; \
+        } else if ((_ver) == AR6003_REV3_VERSION) { \
+                (_param) = AR6003_REV3_APP_LOAD_ADDRESS; \
+        } else { \
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown Version: %d\n", _ver)); \
+        A_ASSERT(0); \
+        } \
+} while (0)
+
 #define AR6K_APP_START_OVERRIDE_ADDRESS(_param, _ver) do { \
-    if ((_ver) == AR6003_REV1_VERSION) { \
-        (_param) = AR6003_REV1_APP_START_OVERRIDE; \
-    } else if ((_ver) == AR6003_REV2_VERSION) { \
-        (_param) = AR6003_REV2_APP_START_OVERRIDE; \
-    } else { \
-       AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown Version: %d\n", _ver)); \
-       A_ASSERT(0); \
-    } \
+        if ((_ver) == AR6003_REV2_VERSION) { \
+                (_param) = AR6003_REV2_APP_START_OVERRIDE; \
+        } else if ((_ver) == AR6003_REV3_VERSION) { \
+                (_param) = AR6003_REV3_APP_START_OVERRIDE; \
+        } else { \
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown Version: %d\n", _ver)); \
+        A_ASSERT(0); \
+        } \
 } while (0)
 
 /* AR6003 1.0 definitions */
@@ -304,11 +324,11 @@
 #define AR6003_REV1_ART_FIRMWARE_FILE       "ath6k/AR6003/hw1.0/device.bin"
 #define AR6003_REV1_PATCH_FILE              "ath6k/AR6003/hw1.0/data.patch.bin"
 #define AR6003_REV1_EPPING_FIRMWARE_FILE    "ath6k/AR6003/hw1.0/endpointping.bin"
-#ifdef AR600x_SD31_XXX
+#ifdef CONFIG_AR600x_SD31_XXX
 #define AR6003_REV1_BOARD_DATA_FILE         "ath6k/AR6003/hw1.0/bdata.SD31.bin"
-#elif defined(AR600x_SD32_XXX)
+#elif defined(CONFIG_AR600x_SD32_XXX)
 #define AR6003_REV1_BOARD_DATA_FILE         "ath6k/AR6003/hw1.0/bdata.SD32.bin"
-#elif defined(AR600x_WB31_XXX)
+#elif defined(CONFIG_AR600x_WB31_XXX)
 #define AR6003_REV1_BOARD_DATA_FILE         "ath6k/AR6003/hw1.0/bdata.WB31.bin"
 #else
 #define AR6003_REV1_BOARD_DATA_FILE         "ath6k/AR6003/hw1.0/bdata.CUSTOM.bin"
@@ -324,16 +344,35 @@
 #define AR6003_REV2_ART_FIRMWARE_FILE       "ath6k/AR6003/hw2.0/device.bin"
 #define AR6003_REV2_PATCH_FILE              "ath6k/AR6003/hw2.0/data.patch.bin"
 #define AR6003_REV2_EPPING_FIRMWARE_FILE    "ath6k/AR6003/hw2.0/endpointping.bin"
-#ifdef AR600x_SD31_XXX
+#ifdef CONFIG_AR600x_SD31_XXX
 #define AR6003_REV2_BOARD_DATA_FILE         "ath6k/AR6003/hw2.0/bdata.SD31.bin"
-#elif defined(AR600x_SD32_XXX)
+#elif defined(CONFIG_AR600x_SD32_XXX)
 #define AR6003_REV2_BOARD_DATA_FILE         "ath6k/AR6003/hw2.0/bdata.SD32.bin"
-#elif defined(AR600x_WB31_XXX)
+#elif defined(CONFIG_AR600x_WB31_XXX)
 #define AR6003_REV2_BOARD_DATA_FILE         "ath6k/AR6003/hw2.0/bdata.WB31.bin"
 #else
 #define AR6003_REV2_BOARD_DATA_FILE         "ath6k/AR6003/hw2.0/bdata.CUSTOM.bin"
 #endif /* Board Data File */
 
+/* AR6003 3.0 definitions */
+#define AR6003_REV3_VERSION                 0x30000582
+#define AR6003_REV3_OTP_FILE                "ath6k/AR6003/hw2.1.1/otp.bin"
+#define AR6003_REV3_FIRMWARE_FILE           "ath6k/AR6003/hw2.1.1/athwlan.bin"
+#define AR6003_REV3_TCMD_FIRMWARE_FILE    "ath6k/AR6003/hw2.1.1/athtcmd_ram.bin"
+#define AR6003_REV3_ART_FIRMWARE_FILE       "ath6k/AR6003/hw2.1.1/device.bin"
+#define AR6003_REV3_PATCH_FILE            "ath6k/AR6003/hw2.1.1/data.patch.bin"
+#define AR6003_REV3_EPPING_FIRMWARE_FILE "ath6k/AR6003/hw2.1.1/endpointping.bin"
+#ifdef CONFIG_AR600x_SD31_XXX
+#define AR6003_REV3_BOARD_DATA_FILE       "ath6k/AR6003/hw2.1.1/bdata.SD31.bin"
+#elif defined(CONFIG_AR600x_SD32_XXX)
+#define AR6003_REV3_BOARD_DATA_FILE        "ath6k/AR6003/hw2.1.1/bdata.SD32.bin"
+#elif defined(CONFIG_AR600x_WB31_XXX)
+#define AR6003_REV3_BOARD_DATA_FILE        "ath6k/AR6003/hw2.1.1/bdata.WB31.bin"
+#else
+#define AR6003_REV3_BOARD_DATA_FILE      "ath6k/AR6003/hw2.1.1/bdata.CUSTOM.bin"
+#endif /* Board Data File */
+
+
 /* Power states */
 enum {
     WLAN_PWR_CTRL_UP = 0,
@@ -385,7 +424,6 @@
     u8 arKey[64];
 } ;
 
-#ifdef ATH6K_CONFIG_CFG80211
 struct ar_key {
     u8 key[WLAN_MAX_KEY_LEN];
     u8 key_len;
@@ -399,8 +437,6 @@
     SME_CONNECTING,
     SME_CONNECTED
 };
-#endif /* ATH6K_CONFIG_CFG80211 */
-
 
 struct ar_node_mapping {
     u8 macAddress[6];
@@ -557,11 +593,9 @@
     u32 log_cnt;
     u32 dbglog_init_done;
     u32 arConnectCtrlFlags;
-#ifdef USER_KEYS
     s32 user_savedkeys_stat;
     u32 user_key_ctrl;
     struct USER_SAVEDKEYS   user_saved_keys;
-#endif
     USER_RSSI_THOLD rssi_map[12];
     u8 arUserBssFilter;
     u16 ap_profile_flag;    /* AP mode */
@@ -577,7 +611,6 @@
 #ifndef EXPORT_HCI_BRIDGE_INTERFACE
     void                    *hcidev_info;
 #endif
-    void                    *hcipal_info;
     WMI_AP_MODE_STAT        arAPStats;
     u8 ap_hidden_ssid;
     u8 ap_country_code[3];
@@ -597,12 +630,10 @@
 	WMI_BTCOEX_STATS_EVENT  arBtcoexStats;
     s32 (*exitCallback)(void *config);  /* generic callback at AR6K exit */
     struct hif_device_os_device_info   osDevInfo;
-#ifdef ATH6K_CONFIG_CFG80211
     struct wireless_dev *wdev;
     struct cfg80211_scan_request    *scan_request;
     struct ar_key   keys[WMI_MAX_KEY_INDEX + 1];
     u32 smeState;
-#endif /* ATH6K_CONFIG_CFG80211 */
     u16 arWlanPowerState;
     bool                  arWlanOff;
 #ifdef CONFIG_PM
@@ -632,30 +663,10 @@
 };
 #endif /* CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT */
 
-#ifdef ATH6K_CONFIG_CFG80211
 static inline void *ar6k_priv(struct net_device *dev)
 {
     return (wdev_priv(dev->ieee80211_ptr));
 }
-#else
-#ifdef CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT
-static inline void *ar6k_priv(struct net_device *dev)
-{
-    extern struct net_device *arApNetDev;
-
-    if (arApNetDev == dev) {
-        /* return arDev saved in virtual interface context */
-        struct ar_virtual_interface *arVirDev;
-        arVirDev = netdev_priv(dev);
-        return arVirDev->arDev;   
-    } else {
-        return netdev_priv(dev);
-    }
-}
-#else
-#define ar6k_priv   netdev_priv
-#endif /* CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT */
-#endif /* ATH6K_CONFIG_CFG80211 */
 
 #define SET_HCI_BUS_TYPE(pHciDev, __bus, __type) do { \
     (pHciDev)->bus = (__bus); \
@@ -701,9 +712,6 @@
     spin_unlock_bh(lock);                                               \
 } while (0)
 
-int ar6000_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
-int ar6000_ioctl_dispatcher(struct net_device *dev, struct ifreq *rq, int cmd);
-void ar6000_gpio_init(void);
 void ar6000_init_profile_info(struct ar6_softc *ar);
 void ar6000_install_static_wep_keys(struct ar6_softc *ar);
 int ar6000_init(struct net_device *dev);
diff --git a/drivers/staging/ath6kl/os/linux/include/ar6xapi_linux.h b/drivers/staging/ath6kl/os/linux/include/ar6xapi_linux.h
index 1acfb9c..184dbdb 100644
--- a/drivers/staging/ath6kl/os/linux/include/ar6xapi_linux.h
+++ b/drivers/staging/ath6kl/os/linux/include/ar6xapi_linux.h
@@ -83,11 +83,6 @@
 
 void ar6000_dbglog_init_done(struct ar6_softc *ar);
 
-#ifdef SEND_EVENT_TO_APP
-void ar6000_send_event_to_app(struct ar6_softc *ar, u16 eventId, u8 *datap, int len);
-void ar6000_send_generic_event_to_app(struct ar6_softc *ar, u16 eventId, u8 *datap, int len);
-#endif
-
 #ifdef CONFIG_HOST_TCMD_SUPPORT
 void ar6000_tcmd_rx_report_event(void *devt, u8 *results, int len);
 #endif
@@ -183,9 +178,6 @@
 void ar6000_check_wow_status(struct ar6_softc *ar, struct sk_buff *skb, bool isEvent);
 #endif
 
-void ar6000_pm_init(void);
-void ar6000_pm_exit(void);
-
 #ifdef CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT
 int ar6000_add_ap_interface(struct ar6_softc *ar, char *ifname);
 int ar6000_remove_ap_interface(struct ar6_softc *ar);
diff --git a/drivers/staging/ath6kl/os/linux/include/athdrv_linux.h b/drivers/staging/ath6kl/os/linux/include/athdrv_linux.h
index 66817c2..3d5f01d 100644
--- a/drivers/staging/ath6kl/os/linux/include/athdrv_linux.h
+++ b/drivers/staging/ath6kl/os/linux/include/athdrv_linux.h
@@ -620,7 +620,6 @@
  */
 #define AR6000_XIOCTL_WMI_SET_TXOP                      57
 
-#ifdef USER_KEYS
 /*
  * arguments:
  * UINT32 cmd (AR6000_XIOCTL_USER_SETKEYS)
@@ -628,7 +627,6 @@
  * uses struct ar6000_user_setkeys_info
  */
 #define AR6000_XIOCTL_USER_SETKEYS                      58
-#endif /* USER_KEYS */
 
 #define AR6000_XIOCTL_WMI_SET_KEEPALIVE                 59
 /*
@@ -942,7 +940,7 @@
 
 #define AR6000_XIOCTL_HCI_CMD                       132
 
-#define AR6000_XIOCTL_ACL_DATA                      133
+#define AR6000_XIOCTL_ACL_DATA                      133 /* used to be used for PAL */
 
 #define AR6000_XIOCTL_WLAN_CONN_PRECEDENCE          134
 
diff --git a/drivers/staging/ath6kl/os/linux/include/config_linux.h b/drivers/staging/ath6kl/os/linux/include/config_linux.h
index 50f53d3..d4030e2 100644
--- a/drivers/staging/ath6kl/os/linux/include/config_linux.h
+++ b/drivers/staging/ath6kl/os/linux/include/config_linux.h
@@ -31,13 +31,6 @@
 #include <linux/version.h>
 
 /*
- * Host-side GPIO support is optional.
- * If run-time access to GPIO pins is not required, then
- * this should be changed to #undef.
- */
-#define CONFIG_HOST_GPIO_SUPPORT
-
-/*
  * Host side Test Command support
  */
 #define CONFIG_HOST_TCMD_SUPPORT
diff --git a/drivers/staging/ath6kl/os/linux/include/osapi_linux.h b/drivers/staging/ath6kl/os/linux/include/osapi_linux.h
index 53b500c..07078b4 100644
--- a/drivers/staging/ath6kl/os/linux/include/osapi_linux.h
+++ b/drivers/staging/ath6kl/os/linux/include/osapi_linux.h
@@ -79,33 +79,10 @@
 #define A_MEMZERO(addr, len)            memset(addr, 0, len)
 #define A_MALLOC(size)                  kmalloc((size), GFP_KERNEL)
 #define A_MALLOC_NOWAIT(size)           kmalloc((size), GFP_ATOMIC)
-#define A_FREE(addr)                    kfree(addr)
 
-#if defined(ANDROID_ENV) && defined(CONFIG_ANDROID_LOGGER)
-extern unsigned int enablelogcat;
-extern int android_logger_lv(void* module, int mask);
-enum logidx { LOG_MAIN_IDX = 0 };
-extern int logger_write(const enum logidx idx, 
-                const unsigned char prio,
-                const char __kernel * const tag,
-                const char __kernel * const fmt,
-                ...);
-#define A_ANDROID_PRINTF(mask, module, tags, args...) do {  \
-    if (enablelogcat) \
-        logger_write(LOG_MAIN_IDX, android_logger_lv(module, mask), tags, args); \
-    else \
-        printk(KERN_ALERT args); \
-} while (0)
-#ifdef DEBUG
-#define A_LOGGER_MODULE_NAME(x) #x
-#define A_LOGGER(mask, mod, args...) \
-    A_ANDROID_PRINTF(mask, &GET_ATH_MODULE_DEBUG_VAR_NAME(mod), "ar6k_" A_LOGGER_MODULE_NAME(mod), args);
-#endif 
-#define A_PRINTF(args...) A_ANDROID_PRINTF(ATH_DEBUG_INFO, NULL, "ar6k_driver", args)
-#else
 #define A_LOGGER(mask, mod, args...)    printk(KERN_ALERT args)
 #define A_PRINTF(args...)               printk(KERN_ALERT args)
-#endif /* ANDROID */
+
 #define A_PRINTF_LOG(args...)           printk(args)
 #define A_SPRINTF(buf, args...)			sprintf (buf, args)
 
@@ -211,17 +188,8 @@
 #define A_ASSERT(expr)
 #endif /* DEBUG */
 
-#ifdef ANDROID_ENV
-struct firmware;
-int android_request_firmware(const struct firmware **firmware_p, const char *filename,
-                     struct device *device);
-void android_release_firmware(const struct firmware *firmware);
-#define A_REQUEST_FIRMWARE(_ppf, _pfile, _dev) android_request_firmware(_ppf, _pfile, _dev)
-#define A_RELEASE_FIRMWARE(_pf) android_release_firmware(_pf)
-#else
 #define A_REQUEST_FIRMWARE(_ppf, _pfile, _dev) request_firmware(_ppf, _pfile, _dev)
 #define A_RELEASE_FIRMWARE(_pf) release_firmware(_pf)
-#endif 
 
 /*
  * Initialization of the network buffer subsystem
@@ -364,19 +332,8 @@
 
 #define A_MEMZERO(addr, len)            memset((addr), 0, (len))
 #define A_MALLOC(size)                  malloc(size)
-#define A_FREE(addr)                    free(addr)
 
-#ifdef ANDROID
-#ifndef err
-#include <errno.h>
-#define err(_s, args...) do { \
-    fprintf(stderr, "%s: line %d ", __FILE__, __LINE__); \
-    fprintf(stderr, args); fprintf(stderr, ": %d\n", errno); \
-    exit(_s); } while (0)
-#endif
-#else
 #include <err.h>
-#endif
 
 #endif /* __KERNEL__ */
 
diff --git a/drivers/staging/ath6kl/os/linux/include/wlan_config.h b/drivers/staging/ath6kl/os/linux/include/wlan_config.h
index 2de5cef..c1fe0c6 100644
--- a/drivers/staging/ath6kl/os/linux/include/wlan_config.h
+++ b/drivers/staging/ath6kl/os/linux/include/wlan_config.h
@@ -56,11 +56,7 @@
  * If the firmware successly roams within the disconnect timeout
  * it sends a new connect event
  */
-#ifdef ANDROID_ENV
-#define WLAN_CONFIG_DISCONNECT_TIMEOUT 3
-#else
 #define WLAN_CONFIG_DISCONNECT_TIMEOUT 10
-#endif /* ANDROID_ENV */ 
 
 /*
  * This configuration item disables 11n support. 
@@ -109,10 +105,4 @@
  */
 #define WLAN_CONFIG_DISABLE_TX_BURSTING     0
 
-/*
- * Platform specific function to power ON/OFF AR6000 
- * and enable/disable SDIO card detection
- */
-#define plat_setup_power(on, detect)
-
 #endif /* _HOST_WLAN_CONFIG_H_ */
diff --git a/drivers/staging/ath6kl/os/linux/include/wmi_filter_linux.h b/drivers/staging/ath6kl/os/linux/include/wmi_filter_linux.h
index d172625..1eb6f82 100644
--- a/drivers/staging/ath6kl/os/linux/include/wmi_filter_linux.h
+++ b/drivers/staging/ath6kl/os/linux/include/wmi_filter_linux.h
@@ -266,7 +266,7 @@
 (0xFF),                                         /* AR6000_XIOCTL_DELE_AGGR                         130  */
 (0xFF),                                         /* AR6000_XIOCTL_FETCH_TARGET_REGS                 131  */
 (0xFF),                                         /* AR6000_XIOCTL_HCI_CMD                           132  */
-(0xFF),                                         /* AR6000_XIOCTL_ACL_DATA                          133  */
+(0xFF),                                         /* AR6000_XIOCTL_ACL_DATA(used to be used for PAL) 133  */
 (0xFF),                                         /* AR6000_XIOCTL_WLAN_CONN_PRECEDENCE              134  */
 (AP_NETWORK),                                   /* AR6000_XIOCTL_AP_SET_11BG_RATESET               135  */
 (0xFF),
diff --git a/drivers/staging/ath6kl/os/linux/ioctl.c b/drivers/staging/ath6kl/os/linux/ioctl.c
deleted file mode 100644
index 0daa201..0000000
--- a/drivers/staging/ath6kl/os/linux/ioctl.c
+++ /dev/null
@@ -1,4767 +0,0 @@
-//------------------------------------------------------------------------------
-// Copyright (c) 2004-2010 Atheros Communications Inc.
-// All rights reserved.
-//
-// 
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-//
-//
-//
-// Author(s): ="Atheros"
-//------------------------------------------------------------------------------
-
-#include "ar6000_drv.h"
-#include "ieee80211_ioctl.h"
-#include "ar6kap_common.h"
-#include "targaddrs.h"
-#include "a_hci.h"
-#include "wlan_config.h"
-
-extern int enablerssicompensation;
-u32 tcmdRxFreq;
-extern unsigned int wmitimeout;
-extern A_WAITQUEUE_HEAD arEvent;
-extern int tspecCompliance;
-extern int bmienable;
-extern int loghci;
-
-static int
-ar6000_ioctl_get_roam_tbl(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if(wmi_get_roam_tbl_cmd(ar->arWmi) != 0) {
-        return -EIO;
-    }
-
-    return 0;
-}
-
-static int
-ar6000_ioctl_get_roam_data(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-
-    /* currently assume only roam times are required */
-    if(wmi_get_roam_data_cmd(ar->arWmi, ROAM_DATA_TIME) != 0) {
-        return -EIO;
-    }
-
-
-    return 0;
-}
-
-static int
-ar6000_ioctl_set_roam_ctrl(struct net_device *dev, char *userdata)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_SET_ROAM_CTRL_CMD cmd;
-    u8 size = sizeof(cmd);
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-
-    if (copy_from_user(&cmd, userdata, size)) {
-        return -EFAULT;
-    }
-
-    if (cmd.roamCtrlType == WMI_SET_HOST_BIAS) {
-        if (cmd.info.bssBiasInfo.numBss > 1) {
-            size += (cmd.info.bssBiasInfo.numBss - 1) * sizeof(WMI_BSS_BIAS);
-        }
-    }
-
-    if (copy_from_user(&cmd, userdata, size)) {
-        return -EFAULT;
-    }
-
-    if(wmi_set_roam_ctrl_cmd(ar->arWmi, &cmd, size) != 0) {
-        return -EIO;
-    }
-
-    return 0;
-}
-
-static int
-ar6000_ioctl_set_powersave_timers(struct net_device *dev, char *userdata)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_POWERSAVE_TIMERS_POLICY_CMD cmd;
-    u8 size = sizeof(cmd);
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (copy_from_user(&cmd, userdata, size)) {
-        return -EFAULT;
-    }
-
-    if (copy_from_user(&cmd, userdata, size)) {
-        return -EFAULT;
-    }
-
-    if(wmi_set_powersave_timers_cmd(ar->arWmi, &cmd, size) != 0) {
-        return -EIO;
-    }
-
-    return 0;
-}
-
-static int
-ar6000_ioctl_set_qos_supp(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_SET_QOS_SUPP_CMD cmd;
-    int ret;
-
-    if ((dev->flags & IFF_UP) != IFF_UP) {
-        return -EIO;
-    }
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (copy_from_user(&cmd, (char *)((unsigned int*)rq->ifr_data + 1),
-                                sizeof(cmd)))
-    {
-        return -EFAULT;
-    }
-
-    ret = wmi_set_qos_supp_cmd(ar->arWmi, cmd.status);
-
-    switch (ret) {
-        case 0:
-            return 0;
-        case A_EBUSY :
-            return -EBUSY;
-        case A_NO_MEMORY:
-            return -ENOMEM;
-        case A_EINVAL:
-        default:
-            return -EFAULT;
-    }
-}
-
-static int
-ar6000_ioctl_set_wmm(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_SET_WMM_CMD cmd;
-    int ret;
-
-    if ((dev->flags & IFF_UP) != IFF_UP) {
-        return -EIO;
-    }
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (copy_from_user(&cmd, (char *)((unsigned int*)rq->ifr_data + 1),
-                                sizeof(cmd)))
-    {
-        return -EFAULT;
-    }
-
-    if (cmd.status == WMI_WMM_ENABLED) {
-        ar->arWmmEnabled = true;
-    } else {
-        ar->arWmmEnabled = false;
-    }
-
-    ret = wmi_set_wmm_cmd(ar->arWmi, cmd.status);
-
-    switch (ret) {
-        case 0:
-            return 0;
-        case A_EBUSY :
-            return -EBUSY;
-        case A_NO_MEMORY:
-            return -ENOMEM;
-        case A_EINVAL:
-        default:
-            return -EFAULT;
-    }
-}
-
-static int
-ar6000_ioctl_set_txop(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_SET_WMM_TXOP_CMD cmd;
-    int ret;
-
-    if ((dev->flags & IFF_UP) != IFF_UP) {
-        return -EIO;
-    }
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (copy_from_user(&cmd, (char *)((unsigned int*)rq->ifr_data + 1),
-                                sizeof(cmd)))
-    {
-        return -EFAULT;
-    }
-
-    ret = wmi_set_wmm_txop(ar->arWmi, cmd.txopEnable);
-
-    switch (ret) {
-        case 0:
-            return 0;
-        case A_EBUSY :
-            return -EBUSY;
-        case A_NO_MEMORY:
-            return -ENOMEM;
-        case A_EINVAL:
-        default:
-            return -EFAULT;
-    }
-}
-
-static int
-ar6000_ioctl_get_rd(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    int ret = 0;
-
-    if ((dev->flags & IFF_UP) != IFF_UP || ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if(copy_to_user((char *)((unsigned int*)rq->ifr_data + 1),
-                            &ar->arRegCode, sizeof(ar->arRegCode)))
-        ret = -EFAULT;
-
-    return ret;
-}
-
-static int
-ar6000_ioctl_set_country(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_AP_SET_COUNTRY_CMD cmd;
-    int ret;
-
-    if ((dev->flags & IFF_UP) != IFF_UP) {
-        return -EIO;
-    }
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (copy_from_user(&cmd, (char *)((unsigned int*)rq->ifr_data + 1),
-                                sizeof(cmd)))
-    {
-        return -EFAULT;
-    }
-
-    ar->ap_profile_flag = 1; /* There is a change in profile */
-
-    ret = wmi_set_country(ar->arWmi, cmd.countryCode);
-    memcpy(ar->ap_country_code, cmd.countryCode, 3);
-
-    switch (ret) {
-        case 0:
-            return 0;
-        case A_EBUSY :
-            return -EBUSY;
-        case A_NO_MEMORY:
-            return -ENOMEM;
-        case A_EINVAL:
-        default:
-            return -EFAULT;
-    }
-}
-
-
-/* Get power mode command */
-static int
-ar6000_ioctl_get_power_mode(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_POWER_MODE_CMD power_mode;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    power_mode.powerMode = wmi_get_power_mode_cmd(ar->arWmi);
-    if (copy_to_user(rq->ifr_data, &power_mode, sizeof(WMI_POWER_MODE_CMD))) {
-        ret = -EFAULT;
-    }
-
-    return ret;
-}
-
-
-static int
-ar6000_ioctl_set_channelParams(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_CHANNEL_PARAMS_CMD cmd, *cmdp;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-
-    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-        return -EFAULT;
-    }
-
-    if( (ar->arNextMode == AP_NETWORK) && (cmd.numChannels || cmd.scanParam) ) {
-        A_PRINTF("ERROR: Only wmode is allowed in AP mode\n");
-        return -EIO;
-    }
-
-    if (cmd.numChannels > 1) {
-        cmdp = A_MALLOC(130);
-        if (copy_from_user(cmdp, rq->ifr_data,
-                           sizeof (*cmdp) +
-                           ((cmd.numChannels - 1) * sizeof(u16))))
-        {
-            kfree(cmdp);
-            return -EFAULT;
-        }
-    } else {
-        cmdp = &cmd;
-    }
-
-    if ((ar->arPhyCapability == WMI_11G_CAPABILITY) &&
-        ((cmdp->phyMode == WMI_11A_MODE) || (cmdp->phyMode == WMI_11AG_MODE)))
-    {
-        ret = -EINVAL;
-    }
-
-    if (!ret &&
-        (wmi_set_channelParams_cmd(ar->arWmi, cmdp->scanParam, cmdp->phyMode,
-                                   cmdp->numChannels, cmdp->channelList)
-         != 0))
-    {
-        ret = -EIO;
-    }
-
-    if (cmd.numChannels > 1) {
-        kfree(cmdp);
-    }
-
-    ar->ap_wmode = cmdp->phyMode;
-    /* Set the profile change flag to allow a commit cmd */
-    ar->ap_profile_flag = 1;
-
-    return ret;
-}
-
-
-static int
-ar6000_ioctl_set_snr_threshold(struct net_device *dev, struct ifreq *rq)
-{
-
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_SNR_THRESHOLD_PARAMS_CMD cmd;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-        return -EFAULT;
-    }
-
-    if( wmi_set_snr_threshold_params(ar->arWmi, &cmd) != 0 ) {
-        ret = -EIO;
-    }
-
-    return ret;
-}
-
-static int
-ar6000_ioctl_set_rssi_threshold(struct net_device *dev, struct ifreq *rq)
-{
-#define SWAP_THOLD(thold1, thold2) do { \
-    USER_RSSI_THOLD tmpThold;           \
-    tmpThold.tag = thold1.tag;          \
-    tmpThold.rssi = thold1.rssi;        \
-    thold1.tag = thold2.tag;            \
-    thold1.rssi = thold2.rssi;          \
-    thold2.tag = tmpThold.tag;          \
-    thold2.rssi = tmpThold.rssi;        \
-} while (0)
-
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_RSSI_THRESHOLD_PARAMS_CMD cmd;
-    USER_RSSI_PARAMS rssiParams;
-    s32 i, j;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (copy_from_user((char *)&rssiParams, (char *)((unsigned int *)rq->ifr_data + 1), sizeof(USER_RSSI_PARAMS))) {
-        return -EFAULT;
-    }
-    cmd.weight = rssiParams.weight;
-    cmd.pollTime = rssiParams.pollTime;
-
-    memcpy(ar->rssi_map, &rssiParams.tholds, sizeof(ar->rssi_map));
-    /*
-     *  only 6 elements, so use bubble sorting, in ascending order
-     */
-    for (i = 5; i > 0; i--) {
-        for (j = 0; j < i; j++) { /* above tholds */
-            if (ar->rssi_map[j+1].rssi < ar->rssi_map[j].rssi) {
-                SWAP_THOLD(ar->rssi_map[j+1], ar->rssi_map[j]);
-            } else if (ar->rssi_map[j+1].rssi == ar->rssi_map[j].rssi) {
-                return -EFAULT;
-            }
-        }
-    }
-    for (i = 11; i > 6; i--) {
-        for (j = 6; j < i; j++) { /* below tholds */
-            if (ar->rssi_map[j+1].rssi < ar->rssi_map[j].rssi) {
-                SWAP_THOLD(ar->rssi_map[j+1], ar->rssi_map[j]);
-            } else if (ar->rssi_map[j+1].rssi == ar->rssi_map[j].rssi) {
-                return -EFAULT;
-            }
-        }
-    }
-
-#ifdef DEBUG
-    for (i = 0; i < 12; i++) {
-        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("thold[%d].tag: %d, thold[%d].rssi: %d \n",
-                i, ar->rssi_map[i].tag, i, ar->rssi_map[i].rssi));
-    }
-#endif
-
-    if (enablerssicompensation) {
-        for (i = 0; i < 6; i++)
-            ar->rssi_map[i].rssi = rssi_compensation_reverse_calc(ar, ar->rssi_map[i].rssi, true);
-        for (i = 6; i < 12; i++)
-            ar->rssi_map[i].rssi = rssi_compensation_reverse_calc(ar, ar->rssi_map[i].rssi, false);
-    }
-
-    cmd.thresholdAbove1_Val = ar->rssi_map[0].rssi;
-    cmd.thresholdAbove2_Val = ar->rssi_map[1].rssi;
-    cmd.thresholdAbove3_Val = ar->rssi_map[2].rssi;
-    cmd.thresholdAbove4_Val = ar->rssi_map[3].rssi;
-    cmd.thresholdAbove5_Val = ar->rssi_map[4].rssi;
-    cmd.thresholdAbove6_Val = ar->rssi_map[5].rssi;
-    cmd.thresholdBelow1_Val = ar->rssi_map[6].rssi;
-    cmd.thresholdBelow2_Val = ar->rssi_map[7].rssi;
-    cmd.thresholdBelow3_Val = ar->rssi_map[8].rssi;
-    cmd.thresholdBelow4_Val = ar->rssi_map[9].rssi;
-    cmd.thresholdBelow5_Val = ar->rssi_map[10].rssi;
-    cmd.thresholdBelow6_Val = ar->rssi_map[11].rssi;
-
-    if( wmi_set_rssi_threshold_params(ar->arWmi, &cmd) != 0 ) {
-        ret = -EIO;
-    }
-
-    return ret;
-}
-
-static int
-ar6000_ioctl_set_lq_threshold(struct net_device *dev, struct ifreq *rq)
-{
-
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_LQ_THRESHOLD_PARAMS_CMD cmd;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (copy_from_user(&cmd, (char *)((unsigned int *)rq->ifr_data + 1), sizeof(cmd))) {
-        return -EFAULT;
-    }
-
-    if( wmi_set_lq_threshold_params(ar->arWmi, &cmd) != 0 ) {
-        ret = -EIO;
-    }
-
-    return ret;
-}
-
-
-static int
-ar6000_ioctl_set_probedSsid(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_PROBED_SSID_CMD cmd;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-        return -EFAULT;
-    }
-
-    if (wmi_probedSsid_cmd(ar->arWmi, cmd.entryIndex, cmd.flag, cmd.ssidLength,
-                                  cmd.ssid) != 0)
-    {
-        ret = -EIO;
-    }
-
-    return ret;
-}
-
-static int
-ar6000_ioctl_set_badAp(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_ADD_BAD_AP_CMD cmd;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-
-    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-        return -EFAULT;
-    }
-
-    if (cmd.badApIndex > WMI_MAX_BAD_AP_INDEX) {
-        return -EIO;
-    }
-
-    if (memcmp(cmd.bssid, null_mac, AR6000_ETH_ADDR_LEN) == 0) {
-        /*
-         * This is a delete badAP.
-         */
-        if (wmi_deleteBadAp_cmd(ar->arWmi, cmd.badApIndex) != 0) {
-            ret = -EIO;
-        }
-    } else {
-        if (wmi_addBadAp_cmd(ar->arWmi, cmd.badApIndex, cmd.bssid) != 0) {
-            ret = -EIO;
-        }
-    }
-
-    return ret;
-}
-
-static int
-ar6000_ioctl_create_qos(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_CREATE_PSTREAM_CMD cmd;
-    int ret;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-
-    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-        return -EFAULT;
-    }
-
-    ret = wmi_verify_tspec_params(&cmd, tspecCompliance);
-    if (ret == 0)
-        ret = wmi_create_pstream_cmd(ar->arWmi, &cmd);
-
-    switch (ret) {
-        case 0:
-            return 0;
-        case A_EBUSY :
-            return -EBUSY;
-        case A_NO_MEMORY:
-            return -ENOMEM;
-        case A_EINVAL:
-        default:
-            return -EFAULT;
-    }
-}
-
-static int
-ar6000_ioctl_delete_qos(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_DELETE_PSTREAM_CMD cmd;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-        return -EFAULT;
-    }
-
-    ret = wmi_delete_pstream_cmd(ar->arWmi, cmd.trafficClass, cmd.tsid);
-
-    switch (ret) {
-        case 0:
-            return 0;
-        case A_EBUSY :
-            return -EBUSY;
-        case A_NO_MEMORY:
-            return -ENOMEM;
-        case A_EINVAL:
-        default:
-            return -EFAULT;
-    }
-}
-
-static int
-ar6000_ioctl_get_qos_queue(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    struct ar6000_queuereq qreq;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if( copy_from_user(&qreq, rq->ifr_data,
-                  sizeof(struct ar6000_queuereq)))
-        return -EFAULT;
-
-    qreq.activeTsids = wmi_get_mapped_qos_queue(ar->arWmi, qreq.trafficClass);
-
-    if (copy_to_user(rq->ifr_data, &qreq,
-                 sizeof(struct ar6000_queuereq)))
-    {
-        ret = -EFAULT;
-    }
-
-    return ret;
-}
-
-#ifdef CONFIG_HOST_TCMD_SUPPORT
-static int
-ar6000_ioctl_tcmd_get_rx_report(struct net_device *dev,
-                                 struct ifreq *rq, u8 *data, u32 len)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    u32 buf[4+TCMD_MAX_RATES];
-    int ret = 0;
-
-    if (ar->bIsDestroyProgress) {
-        return -EBUSY;
-    }
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (down_interruptible(&ar->arSem)) {
-        return -ERESTARTSYS;
-    }
-
-    if (ar->bIsDestroyProgress) {
-        up(&ar->arSem);
-        return -EBUSY;
-    }
-
-    ar->tcmdRxReport = 0;
-    if (wmi_test_cmd(ar->arWmi, data, len) != 0) {
-        up(&ar->arSem);
-        return -EIO;
-    }
-
-    wait_event_interruptible_timeout(arEvent, ar->tcmdRxReport != 0, wmitimeout * HZ);
-
-    if (signal_pending(current)) {
-        ret = -EINTR;
-    }
-
-    buf[0] = ar->tcmdRxTotalPkt;
-    buf[1] = ar->tcmdRxRssi;
-    buf[2] = ar->tcmdRxcrcErrPkt;
-    buf[3] = ar->tcmdRxsecErrPkt;
-    memcpy(((u8 *)buf)+(4*sizeof(u32)), ar->tcmdRateCnt, sizeof(ar->tcmdRateCnt));
-    memcpy(((u8 *)buf)+(4*sizeof(u32))+(TCMD_MAX_RATES *sizeof(u16)), ar->tcmdRateCntShortGuard, sizeof(ar->tcmdRateCntShortGuard));
-
-    if (!ret && copy_to_user(rq->ifr_data, buf, sizeof(buf))) {
-        ret = -EFAULT;
-    }
-
-    up(&ar->arSem);
-
-    return ret;
-}
-
-void
-ar6000_tcmd_rx_report_event(void *devt, u8 *results, int len)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)devt;
-    TCMD_CONT_RX * rx_rep = (TCMD_CONT_RX *)results;
-
-    if (enablerssicompensation) {
-        rx_rep->u.report.rssiInDBm = rssi_compensation_calc_tcmd(tcmdRxFreq, rx_rep->u.report.rssiInDBm,rx_rep->u.report.totalPkt);
-    }
-
-
-    ar->tcmdRxTotalPkt = rx_rep->u.report.totalPkt;
-    ar->tcmdRxRssi = rx_rep->u.report.rssiInDBm;
-    ar->tcmdRxcrcErrPkt = rx_rep->u.report.crcErrPkt;
-    ar->tcmdRxsecErrPkt = rx_rep->u.report.secErrPkt;
-    ar->tcmdRxReport = 1;
-    A_MEMZERO(ar->tcmdRateCnt,  sizeof(ar->tcmdRateCnt));
-    A_MEMZERO(ar->tcmdRateCntShortGuard,  sizeof(ar->tcmdRateCntShortGuard));
-    memcpy(ar->tcmdRateCnt, rx_rep->u.report.rateCnt, sizeof(ar->tcmdRateCnt));
-    memcpy(ar->tcmdRateCntShortGuard, rx_rep->u.report.rateCntShortGuard, sizeof(ar->tcmdRateCntShortGuard));
-
-    wake_up(&arEvent);
-}
-#endif /* CONFIG_HOST_TCMD_SUPPORT*/
-
-static int
-ar6000_ioctl_set_error_report_bitmask(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_TARGET_ERROR_REPORT_BITMASK cmd;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-        return -EFAULT;
-    }
-
-    ret = wmi_set_error_report_bitmask(ar->arWmi, cmd.bitmask);
-
-    return  (ret==0 ? ret : -EINVAL);
-}
-
-static int
-ar6000_clear_target_stats(struct net_device *dev)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    TARGET_STATS *pStats = &ar->arTargetStats;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-       return -EIO;
-    }
-    AR6000_SPIN_LOCK(&ar->arLock, 0);
-    A_MEMZERO(pStats, sizeof(TARGET_STATS));
-    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-    return ret;
-}
-
-static int
-ar6000_ioctl_get_target_stats(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    TARGET_STATS_CMD cmd;
-    TARGET_STATS *pStats = &ar->arTargetStats;
-    int ret = 0;
-
-    if (ar->bIsDestroyProgress) {
-        return -EBUSY;
-    }
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-        return -EFAULT;
-    }
-    if (down_interruptible(&ar->arSem)) {
-        return -ERESTARTSYS;
-    }
-    if (ar->bIsDestroyProgress) {
-        up(&ar->arSem);
-        return -EBUSY;
-    }
-
-    ar->statsUpdatePending = true;
-
-    if(wmi_get_stats_cmd(ar->arWmi) != 0) {
-        up(&ar->arSem);
-        return -EIO;
-    }
-
-    wait_event_interruptible_timeout(arEvent, ar->statsUpdatePending == false, wmitimeout * HZ);
-
-    if (signal_pending(current)) {
-        ret = -EINTR;
-    }
-
-    if (!ret && copy_to_user(rq->ifr_data, pStats, sizeof(*pStats))) {
-        ret = -EFAULT;
-    }
-
-    if (cmd.clearStats == 1) {
-        ret = ar6000_clear_target_stats(dev);
-    }
-
-    up(&ar->arSem);
-
-    return ret;
-}
-
-static int
-ar6000_ioctl_get_ap_stats(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    u32 action; /* Allocating only the desired space on the frame. Declaring is as a WMI_AP_MODE_STAT variable results in exceeding the compiler imposed limit on the maximum frame size */
-    WMI_AP_MODE_STAT *pStats = &ar->arAPStats;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-    if (copy_from_user(&action, (char *)((unsigned int*)rq->ifr_data + 1),
-                                sizeof(u32)))
-    {
-        return -EFAULT;
-    }
-    if (action == AP_CLEAR_STATS) {
-        u8 i;
-        AR6000_SPIN_LOCK(&ar->arLock, 0);
-        for(i = 0; i < AP_MAX_NUM_STA; i++) {
-            pStats->sta[i].tx_bytes = 0;
-            pStats->sta[i].tx_pkts = 0;
-            pStats->sta[i].tx_error = 0;
-            pStats->sta[i].tx_discard = 0;
-            pStats->sta[i].rx_bytes = 0;
-            pStats->sta[i].rx_pkts = 0;
-            pStats->sta[i].rx_error = 0;
-            pStats->sta[i].rx_discard = 0;
-        }
-        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-        return ret;
-    }
-
-    if (down_interruptible(&ar->arSem)) {
-        return -ERESTARTSYS;
-    }
-
-    ar->statsUpdatePending = true;
-
-    if(wmi_get_stats_cmd(ar->arWmi) != 0) {
-        up(&ar->arSem);
-        return -EIO;
-    }
-
-    wait_event_interruptible_timeout(arEvent, ar->statsUpdatePending == false, wmitimeout * HZ);
-
-    if (signal_pending(current)) {
-        ret = -EINTR;
-    }
-
-    if (!ret && copy_to_user(rq->ifr_data, pStats, sizeof(*pStats))) {
-        ret = -EFAULT;
-    }
-
-    up(&ar->arSem);
-
-    return ret;
-}
-
-static int
-ar6000_ioctl_set_access_params(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_SET_ACCESS_PARAMS_CMD cmd;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-        return -EFAULT;
-    }
-
-    if (wmi_set_access_params_cmd(ar->arWmi, cmd.ac, cmd.txop, cmd.eCWmin, cmd.eCWmax,
-                                  cmd.aifsn) == 0)
-    {
-        ret = 0;
-    } else {
-        ret = -EINVAL;
-    }
-
-    return (ret);
-}
-
-static int
-ar6000_ioctl_set_disconnect_timeout(struct net_device *dev, struct ifreq *rq)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_DISC_TIMEOUT_CMD cmd;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-        return -EFAULT;
-    }
-
-    if (wmi_disctimeout_cmd(ar->arWmi, cmd.disconnectTimeout) == 0)
-    {
-        ret = 0;
-    } else {
-        ret = -EINVAL;
-    }
-
-    return (ret);
-}
-
-static int
-ar6000_xioctl_set_voice_pkt_size(struct net_device *dev, char *userdata)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_SET_VOICE_PKT_SIZE_CMD cmd;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-        return -EFAULT;
-    }
-
-    if (wmi_set_voice_pkt_size_cmd(ar->arWmi, cmd.voicePktSize) == 0)
-    {
-        ret = 0;
-    } else {
-        ret = -EINVAL;
-    }
-
-
-    return (ret);
-}
-
-static int
-ar6000_xioctl_set_max_sp_len(struct net_device *dev, char *userdata)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_SET_MAX_SP_LEN_CMD cmd;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-        return -EFAULT;
-    }
-
-    if (wmi_set_max_sp_len_cmd(ar->arWmi, cmd.maxSPLen) == 0)
-    {
-        ret = 0;
-    } else {
-        ret = -EINVAL;
-    }
-
-    return (ret);
-}
-
-
-static int
-ar6000_xioctl_set_bt_status_cmd(struct net_device *dev, char *userdata)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_SET_BT_STATUS_CMD cmd;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-        return -EFAULT;
-    }
-
-    if (wmi_set_bt_status_cmd(ar->arWmi, cmd.streamType, cmd.status) == 0)
-    {
-        ret = 0;
-    } else {
-        ret = -EINVAL;
-    }
-
-    return (ret);
-}
-
-static int
-ar6000_xioctl_set_bt_params_cmd(struct net_device *dev, char *userdata)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_SET_BT_PARAMS_CMD cmd;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-        return -EFAULT;
-    }
-
-    if (wmi_set_bt_params_cmd(ar->arWmi, &cmd) == 0)
-    {
-        ret = 0;
-    } else {
-        ret = -EINVAL;
-    }
-
-    return (ret);
-}
-
-static int
-ar6000_xioctl_set_btcoex_fe_ant_cmd(struct net_device * dev, char *userdata)
-{
-	struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-	WMI_SET_BTCOEX_FE_ANT_CMD cmd;
-    int ret = 0;
-
-	if (ar->arWmiReady == false) {
-		return -EIO;
-	}
-	if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-		return -EFAULT;
-	}
-
-    if (wmi_set_btcoex_fe_ant_cmd(ar->arWmi, &cmd) == 0)
-    {
-        ret = 0;
-    } else {
-        ret = -EINVAL;
-    }
-
-	return(ret);
-}
-
-static int
-ar6000_xioctl_set_btcoex_colocated_bt_dev_cmd(struct net_device * dev, char *userdata)
-{
-	struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-	WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD cmd;
-    int ret = 0;
-
-	if (ar->arWmiReady == false) {
-		return -EIO;
-	}
-
-	if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-		return -EFAULT;
-	}
-
-    if (wmi_set_btcoex_colocated_bt_dev_cmd(ar->arWmi, &cmd) == 0)
-    {
-        ret = 0;
-    } else {
-        ret = -EINVAL;
-    }
-
-	return(ret);
-}
-
-static int
-ar6000_xioctl_set_btcoex_btinquiry_page_config_cmd(struct net_device * dev,  char *userdata)
-{
-	struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-	WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD cmd;
-    int ret = 0;
-
-	if (ar->arWmiReady == false) {
-		return -EIO;
-	}
-
-	if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-		return -EFAULT;
-	}
-
-    if (wmi_set_btcoex_btinquiry_page_config_cmd(ar->arWmi, &cmd) == 0)
-    {
-        ret = 0;
-    } else {
-        ret = -EINVAL;
-    }
-
-	return(ret);
-}
-
-static int
-ar6000_xioctl_set_btcoex_sco_config_cmd(struct net_device * dev, char *userdata)
-{
-	struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-	WMI_SET_BTCOEX_SCO_CONFIG_CMD cmd;
-    int ret = 0;
-
-	if (ar->arWmiReady == false) {
-		return -EIO;
-	}
-
-	if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-		return -EFAULT;
-	}
-
-    if (wmi_set_btcoex_sco_config_cmd(ar->arWmi, &cmd) == 0)
-    {
-        ret = 0;
-    } else {
-        ret = -EINVAL;
-    }
-
-	return(ret);
-}
-
-static int
-ar6000_xioctl_set_btcoex_a2dp_config_cmd(struct net_device * dev,
-														char *userdata)
-{
-	struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-	WMI_SET_BTCOEX_A2DP_CONFIG_CMD cmd;
-    int ret = 0;
-
-	if (ar->arWmiReady == false) {
-		return -EIO;
-	}
-
-	if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-		return -EFAULT;
-	}
-
-    if (wmi_set_btcoex_a2dp_config_cmd(ar->arWmi, &cmd) == 0)
-    {
-        ret = 0;
-    } else {
-        ret = -EINVAL;
-    }
-
-	return(ret);
-}
-
-static int
-ar6000_xioctl_set_btcoex_aclcoex_config_cmd(struct net_device * dev, char *userdata)
-{
-	struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-	WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD cmd;
-    int ret = 0;
-
-	if (ar->arWmiReady == false) {
-		return -EIO;
-	}
-
-	if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-		return -EFAULT;
-	}
-
-    if (wmi_set_btcoex_aclcoex_config_cmd(ar->arWmi, &cmd) == 0)
-    {
-        ret = 0;
-    } else {
-        ret = -EINVAL;
-    }
-
-	return(ret);
-}
-
-static int
-ar60000_xioctl_set_btcoex_debug_cmd(struct net_device * dev, char *userdata)
-{
-	struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-	WMI_SET_BTCOEX_DEBUG_CMD cmd;
-    int ret = 0;
-
-	if (ar->arWmiReady == false) {
-		return -EIO;
-	}
-
-	if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-		return -EFAULT;
-	}
-
-    if (wmi_set_btcoex_debug_cmd(ar->arWmi, &cmd) == 0)
-    {
-        ret = 0;
-    } else {
-        ret = -EINVAL;
-    }
-
-	return(ret);
-}
-
-static int
-ar6000_xioctl_set_btcoex_bt_operating_status_cmd(struct net_device * dev, char *userdata)
-{
-     struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-     WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMD cmd;
-     int ret = 0;
-
-    if (ar->arWmiReady == false) {
-	return -EIO;
-    }
-
-    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-	return -EFAULT;
-    }
-
-    if (wmi_set_btcoex_bt_operating_status_cmd(ar->arWmi, &cmd) == 0)
-    {
-        ret = 0;
-    } else {
-        ret = -EINVAL;
-    }
-    return(ret);
-}
-
-static int
-ar6000_xioctl_get_btcoex_config_cmd(struct net_device * dev, char *userdata,
-											struct ifreq *rq)
-{
-
-	struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    AR6000_BTCOEX_CONFIG btcoexConfig;
-    WMI_BTCOEX_CONFIG_EVENT *pbtcoexConfigEv = &ar->arBtcoexConfig;
-
-    int ret = 0;
-
-    if (ar->bIsDestroyProgress) {
-            return -EBUSY;
-    }
-    if (ar->arWmiReady == false) {
-            return -EIO;
-    }
-	if (copy_from_user(&btcoexConfig.configCmd, userdata, sizeof(AR6000_BTCOEX_CONFIG))) {
-		return -EFAULT;
-	}
-    if (down_interruptible(&ar->arSem)) {
-        return -ERESTARTSYS;
-    }
-
-    if (wmi_get_btcoex_config_cmd(ar->arWmi, (WMI_GET_BTCOEX_CONFIG_CMD *)&btcoexConfig.configCmd) != 0)
-    {
-    	up(&ar->arSem);
-    	return -EIO;
-    }
-
-    ar->statsUpdatePending = true;
-
-    wait_event_interruptible_timeout(arEvent, ar->statsUpdatePending == false, wmitimeout * HZ);
-
-    if (signal_pending(current)) {
-       ret = -EINTR;
-    }
-
-    if (!ret && copy_to_user(btcoexConfig.configEvent, pbtcoexConfigEv, sizeof(WMI_BTCOEX_CONFIG_EVENT))) {
-            ret = -EFAULT;
-    }
-    up(&ar->arSem);
-    return ret;
-}
-
-static int
-ar6000_xioctl_get_btcoex_stats_cmd(struct net_device * dev, char *userdata, struct ifreq *rq)
-{
-	struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    AR6000_BTCOEX_STATS btcoexStats;
-    WMI_BTCOEX_STATS_EVENT *pbtcoexStats = &ar->arBtcoexStats;
-    int ret = 0;
-
-    if (ar->bIsDestroyProgress) {
-            return -EBUSY;
-    }
-    if (ar->arWmiReady == false) {
-            return -EIO;
-    }
-
-    if (down_interruptible(&ar->arSem)) {
-        return -ERESTARTSYS;
-    }
-
-	if (copy_from_user(&btcoexStats.statsEvent, userdata, sizeof(AR6000_BTCOEX_CONFIG))) {
-		return -EFAULT;
-	}
-
-    if (wmi_get_btcoex_stats_cmd(ar->arWmi) != 0)
-    {
-    	up(&ar->arSem);
-    	return -EIO;
-    }
-
-    ar->statsUpdatePending = true;
-
-    wait_event_interruptible_timeout(arEvent, ar->statsUpdatePending == false, wmitimeout * HZ);
-
-    if (signal_pending(current)) {
-       ret = -EINTR;
-    }
-
-    if (!ret && copy_to_user(btcoexStats.statsEvent, pbtcoexStats, sizeof(WMI_BTCOEX_STATS_EVENT))) {
-            ret = -EFAULT;
-    }
-
-
-    up(&ar->arSem);
-
-	return(ret);
-}
-
-static int
-ar6000_xioctl_set_excess_tx_retry_thres_cmd(struct net_device * dev, char * userdata)
-{
-    struct ar6_softc     *ar     = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_SET_EXCESS_TX_RETRY_THRES_CMD cmd;
-    int ret = 0;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-        return -EFAULT;
-    }
-
-    if (wmi_set_excess_tx_retry_thres_cmd(ar->arWmi, &cmd) != 0)
-    {
-        ret = -EINVAL;
-    }
-    return(ret);
-}
-
-#ifdef CONFIG_HOST_GPIO_SUPPORT
-struct ar6000_gpio_intr_wait_cmd_s  gpio_intr_results;
-/* gpio_reg_results and gpio_data_available are protected by arSem */
-static struct ar6000_gpio_register_cmd_s gpio_reg_results;
-static bool gpio_data_available; /* Requested GPIO data available */
-static bool gpio_intr_available; /* GPIO interrupt info available */
-static bool gpio_ack_received;   /* GPIO ack was received */
-
-/* Host-side initialization for General Purpose I/O support */
-void ar6000_gpio_init(void)
-{
-    gpio_intr_available = false;
-    gpio_data_available = false;
-    gpio_ack_received   = false;
-}
-
-/*
- * Called when a GPIO interrupt is received from the Target.
- * intr_values shows which GPIO pins have interrupted.
- * input_values shows a recent value of GPIO pins.
- */
-void
-ar6000_gpio_intr_rx(u32 intr_mask, u32 input_values)
-{
-    gpio_intr_results.intr_mask = intr_mask;
-    gpio_intr_results.input_values = input_values;
-    *((volatile bool *)&gpio_intr_available) = true;
-    wake_up(&arEvent);
-}
-
-/*
- * This is called when a response is received from the Target
- * for a previous or ar6000_gpio_input_get or ar6000_gpio_register_get
- * call.
- */
-void
-ar6000_gpio_data_rx(u32 reg_id, u32 value)
-{
-    gpio_reg_results.gpioreg_id = reg_id;
-    gpio_reg_results.value = value;
-    *((volatile bool *)&gpio_data_available) = true;
-    wake_up(&arEvent);
-}
-
-/*
- * This is called when an acknowledgement is received from the Target
- * for a previous or ar6000_gpio_output_set or ar6000_gpio_register_set
- * call.
- */
-void
-ar6000_gpio_ack_rx(void)
-{
-    gpio_ack_received = true;
-    wake_up(&arEvent);
-}
-
-int
-ar6000_gpio_output_set(struct net_device *dev,
-                       u32 set_mask,
-                       u32 clear_mask,
-                       u32 enable_mask,
-                       u32 disable_mask)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    gpio_ack_received = false;
-    return wmi_gpio_output_set(ar->arWmi,
-                set_mask, clear_mask, enable_mask, disable_mask);
-}
-
-static int
-ar6000_gpio_input_get(struct net_device *dev)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    *((volatile bool *)&gpio_data_available) = false;
-    return wmi_gpio_input_get(ar->arWmi);
-}
-
-static int
-ar6000_gpio_register_set(struct net_device *dev,
-                         u32 gpioreg_id,
-                         u32 value)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    gpio_ack_received = false;
-    return wmi_gpio_register_set(ar->arWmi, gpioreg_id, value);
-}
-
-static int
-ar6000_gpio_register_get(struct net_device *dev,
-                         u32 gpioreg_id)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    *((volatile bool *)&gpio_data_available) = false;
-    return wmi_gpio_register_get(ar->arWmi, gpioreg_id);
-}
-
-static int
-ar6000_gpio_intr_ack(struct net_device *dev,
-                     u32 ack_mask)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    gpio_intr_available = false;
-    return wmi_gpio_intr_ack(ar->arWmi, ack_mask);
-}
-#endif /* CONFIG_HOST_GPIO_SUPPORT */
-
-#if defined(CONFIG_TARGET_PROFILE_SUPPORT)
-static struct prof_count_s prof_count_results;
-static bool prof_count_available; /* Requested GPIO data available */
-
-static int
-prof_count_get(struct net_device *dev)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    *((volatile bool *)&prof_count_available) = false;
-    return wmi_prof_count_get_cmd(ar->arWmi);
-}
-
-/*
- * This is called when a response is received from the Target
- * for a previous prof_count_get call.
- */
-void
-prof_count_rx(u32 addr, u32 count)
-{
-    prof_count_results.addr = addr;
-    prof_count_results.count = count;
-    *((volatile bool *)&prof_count_available) = true;
-    wake_up(&arEvent);
-}
-#endif /* CONFIG_TARGET_PROFILE_SUPPORT */
-
-
-static int
-ar6000_create_acl_data_osbuf(struct net_device *dev, u8 *userdata, void **p_osbuf)
-{
-    void *osbuf = NULL;
-    u8 tmp_space[8];
-    HCI_ACL_DATA_PKT *acl;
-    u8 hdr_size, *datap=NULL;
-    int ret = 0;
-
-    /* ACL is in data path. There is a need to create pool
-     * mechanism for allocating and freeing NETBUFs - ToDo later.
-     */
-
-    *p_osbuf = NULL;
-    acl = (HCI_ACL_DATA_PKT *)tmp_space;
-    hdr_size = sizeof(acl->hdl_and_flags) + sizeof(acl->data_len);
-
-    do {
-        if (a_copy_from_user(acl, userdata, hdr_size)) {
-            ret = A_EFAULT;
-            break;
-        }
-
-        osbuf = A_NETBUF_ALLOC(hdr_size + acl->data_len);
-        if (osbuf == NULL) {
-           ret = A_NO_MEMORY;
-           break;
-        }
-        A_NETBUF_PUT(osbuf, hdr_size + acl->data_len);
-        datap = (u8 *)A_NETBUF_DATA(osbuf);
-
-        /* Real copy to osbuf */
-        acl = (HCI_ACL_DATA_PKT *)(datap);
-        memcpy(acl, tmp_space, hdr_size);
-        if (a_copy_from_user(acl->data, userdata + hdr_size, acl->data_len)) {
-            ret = A_EFAULT;
-            break;
-        }
-    } while(false);
-
-    if (ret == 0) {
-        *p_osbuf = osbuf;
-    } else {
-        A_NETBUF_FREE(osbuf);
-    }
-    return ret;
-}
-
-
-
-int
-ar6000_ioctl_ap_setparam(struct ar6_softc *ar, int param, int value)
-{
-    int ret=0;
-
-    switch(param) {
-        case IEEE80211_PARAM_WPA:
-            switch (value) {
-                case WPA_MODE_WPA1:
-                    ar->arAuthMode = WPA_AUTH;
-                    break;
-                case WPA_MODE_WPA2:
-                    ar->arAuthMode = WPA2_AUTH;
-                    break;
-                case WPA_MODE_AUTO:
-                    ar->arAuthMode = WPA_AUTH | WPA2_AUTH;
-                    break;
-                case WPA_MODE_NONE:
-                    ar->arAuthMode = NONE_AUTH;
-                    break;
-            }
-            break;
-        case IEEE80211_PARAM_AUTHMODE:
-            if(value == IEEE80211_AUTH_WPA_PSK) {
-                if (WPA_AUTH == ar->arAuthMode) {
-                    ar->arAuthMode = WPA_PSK_AUTH;
-                } else if (WPA2_AUTH == ar->arAuthMode) {
-                    ar->arAuthMode = WPA2_PSK_AUTH;
-                } else if ((WPA_AUTH | WPA2_AUTH) == ar->arAuthMode) {
-                    ar->arAuthMode = WPA_PSK_AUTH | WPA2_PSK_AUTH;
-                } else {
-                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Error -  Setting PSK "\
-                        "mode when WPA param was set to %d\n",
-                        ar->arAuthMode));
-                    ret = -EIO;
-                }
-            }
-            break;
-        case IEEE80211_PARAM_UCASTCIPHER:
-            ar->arPairwiseCrypto = 0;
-            if(value & (1<<IEEE80211_CIPHER_AES_CCM)) {
-                ar->arPairwiseCrypto |= AES_CRYPT;
-            }
-            if(value & (1<<IEEE80211_CIPHER_TKIP)) {
-                ar->arPairwiseCrypto |= TKIP_CRYPT;
-            }
-            if(!ar->arPairwiseCrypto) {
-                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-                           ("Error - Invalid cipher in WPA \n"));
-                ret = -EIO;
-            }
-            break;
-        case IEEE80211_PARAM_PRIVACY:
-            if(value == 0) {
-                ar->arDot11AuthMode      = OPEN_AUTH;
-                ar->arAuthMode           = NONE_AUTH;
-                ar->arPairwiseCrypto     = NONE_CRYPT;
-                ar->arPairwiseCryptoLen  = 0;
-                ar->arGroupCrypto        = NONE_CRYPT;
-                ar->arGroupCryptoLen     = 0;
-            }
-            break;
-#ifdef WAPI_ENABLE
-        case IEEE80211_PARAM_WAPI:
-            A_PRINTF("WAPI Policy: %d\n", value);
-            ar->arDot11AuthMode      = OPEN_AUTH;
-            ar->arAuthMode           = NONE_AUTH;
-            if(value & 0x1) {
-                ar->arPairwiseCrypto     = WAPI_CRYPT;
-                ar->arGroupCrypto        = WAPI_CRYPT;
-            } else {
-                ar->arPairwiseCrypto     = NONE_CRYPT;
-                ar->arGroupCrypto        = NONE_CRYPT;
-            }
-            break;
-#endif
-    }
-    return ret;
-}
-
-int
-ar6000_ioctl_setparam(struct ar6_softc *ar, int param, int value)
-{
-    bool profChanged = false;
-    int ret=0;
-
-    if(ar->arNextMode == AP_NETWORK) {
-        ar->ap_profile_flag = 1; /* There is a change in profile */
-        switch (param) {
-            case IEEE80211_PARAM_WPA:
-            case IEEE80211_PARAM_AUTHMODE:
-            case IEEE80211_PARAM_UCASTCIPHER:
-            case IEEE80211_PARAM_PRIVACY:
-            case IEEE80211_PARAM_WAPI:
-                ret = ar6000_ioctl_ap_setparam(ar, param, value);
-                return ret;
-        }
-    }
-
-    switch (param) {
-        case IEEE80211_PARAM_WPA:
-            switch (value) {
-                case WPA_MODE_WPA1:
-                    ar->arAuthMode = WPA_AUTH;
-                    profChanged    = true;
-                    break;
-                case WPA_MODE_WPA2:
-                    ar->arAuthMode = WPA2_AUTH;
-                    profChanged    = true;
-                    break;
-                case WPA_MODE_NONE:
-                    ar->arAuthMode = NONE_AUTH;
-                    profChanged    = true;
-                    break;
-            }
-            break;
-        case IEEE80211_PARAM_AUTHMODE:
-            switch(value) {
-                case IEEE80211_AUTH_WPA_PSK:
-                    if (WPA_AUTH == ar->arAuthMode) {
-                        ar->arAuthMode = WPA_PSK_AUTH;
-                        profChanged    = true;
-                    } else if (WPA2_AUTH == ar->arAuthMode) {
-                        ar->arAuthMode = WPA2_PSK_AUTH;
-                        profChanged    = true;
-                    } else {
-                        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Error -  Setting PSK "\
-                            "mode when WPA param was set to %d\n",
-                            ar->arAuthMode));
-                        ret = -EIO;
-                    }
-                    break;
-                case IEEE80211_AUTH_WPA_CCKM:
-                    if (WPA2_AUTH == ar->arAuthMode) {
-                        ar->arAuthMode = WPA2_AUTH_CCKM;
-                    } else {
-                        ar->arAuthMode = WPA_AUTH_CCKM;
-                    }
-                    break;
-                default:
-                    break;
-            }
-            break;
-        case IEEE80211_PARAM_UCASTCIPHER:
-            switch (value) {
-                case IEEE80211_CIPHER_AES_CCM:
-                    ar->arPairwiseCrypto = AES_CRYPT;
-                    profChanged          = true;
-                    break;
-                case IEEE80211_CIPHER_TKIP:
-                    ar->arPairwiseCrypto = TKIP_CRYPT;
-                    profChanged          = true;
-                    break;
-                case IEEE80211_CIPHER_WEP:
-                    ar->arPairwiseCrypto = WEP_CRYPT;
-                    profChanged          = true;
-                    break;
-                case IEEE80211_CIPHER_NONE:
-                    ar->arPairwiseCrypto = NONE_CRYPT;
-                    profChanged          = true;
-                    break;
-            }
-            break;
-        case IEEE80211_PARAM_UCASTKEYLEN:
-            if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(value)) {
-                ret = -EIO;
-            } else {
-                ar->arPairwiseCryptoLen = value;
-            }
-            break;
-        case IEEE80211_PARAM_MCASTCIPHER:
-            switch (value) {
-                case IEEE80211_CIPHER_AES_CCM:
-                    ar->arGroupCrypto = AES_CRYPT;
-                    profChanged       = true;
-                    break;
-                case IEEE80211_CIPHER_TKIP:
-                    ar->arGroupCrypto = TKIP_CRYPT;
-                    profChanged       = true;
-                    break;
-                case IEEE80211_CIPHER_WEP:
-                    ar->arGroupCrypto = WEP_CRYPT;
-                    profChanged       = true;
-                    break;
-                case IEEE80211_CIPHER_NONE:
-                    ar->arGroupCrypto = NONE_CRYPT;
-                    profChanged       = true;
-                    break;
-            }
-            break;
-        case IEEE80211_PARAM_MCASTKEYLEN:
-            if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(value)) {
-                ret = -EIO;
-            } else {
-                ar->arGroupCryptoLen = value;
-            }
-            break;
-        case IEEE80211_PARAM_COUNTERMEASURES:
-            if (ar->arWmiReady == false) {
-                return -EIO;
-            }
-            wmi_set_tkip_countermeasures_cmd(ar->arWmi, value);
-            break;
-        default:
-            break;
-    }
-    if ((ar->arNextMode != AP_NETWORK) && (profChanged == true)) {
-        /*
-         * profile has changed.  Erase ssid to signal change
-         */
-        A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
-    }
-
-    return ret;
-}
-
-int
-ar6000_ioctl_setkey(struct ar6_softc *ar, struct ieee80211req_key *ik)
-{
-    KEY_USAGE keyUsage;
-    int status;
-    CRYPTO_TYPE keyType = NONE_CRYPT;
-
-#ifdef USER_KEYS
-    ar->user_saved_keys.keyOk = false;
-#endif
-    if ( (0 == memcmp(ik->ik_macaddr, null_mac, IEEE80211_ADDR_LEN)) ||
-         (0 == memcmp(ik->ik_macaddr, bcast_mac, IEEE80211_ADDR_LEN)) ) {
-        keyUsage = GROUP_USAGE;
-        if(ar->arNextMode == AP_NETWORK) {
-            memcpy(&ar->ap_mode_bkey, ik,
-                     sizeof(struct ieee80211req_key));
-#ifdef WAPI_ENABLE
-            if(ar->arPairwiseCrypto == WAPI_CRYPT) {
-                return ap_set_wapi_key(ar, ik);
-            }
-#endif
-        }
-#ifdef USER_KEYS
-        memcpy(&ar->user_saved_keys.bcast_ik, ik,
-                 sizeof(struct ieee80211req_key));
-#endif
-    } else {
-        keyUsage = PAIRWISE_USAGE;
-#ifdef USER_KEYS
-        memcpy(&ar->user_saved_keys.ucast_ik, ik,
-                 sizeof(struct ieee80211req_key));
-#endif
-#ifdef WAPI_ENABLE
-        if(ar->arNextMode == AP_NETWORK) {
-            if(ar->arPairwiseCrypto == WAPI_CRYPT) {
-                return ap_set_wapi_key(ar, ik);
-            }
-        }
-#endif
-    }
-
-    switch (ik->ik_type) {
-        case IEEE80211_CIPHER_WEP:
-            keyType = WEP_CRYPT;
-            break;
-        case IEEE80211_CIPHER_TKIP:
-            keyType = TKIP_CRYPT;
-            break;
-        case IEEE80211_CIPHER_AES_CCM:
-            keyType = AES_CRYPT;
-            break;
-        default:
-            break;
-    }
-#ifdef USER_KEYS
-    ar->user_saved_keys.keyType = keyType;
-#endif
-    if (IEEE80211_CIPHER_CCKM_KRK != ik->ik_type) {
-        if (NONE_CRYPT == keyType) {
-            return -EIO;
-        }
-
-        if ((WEP_CRYPT == keyType)&&(!ar->arConnected)) {
-             int index = ik->ik_keyix;
-
-            if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(ik->ik_keylen)) {
-                return -EIO;
-            }
-
-            A_MEMZERO(ar->arWepKeyList[index].arKey,
-                            sizeof(ar->arWepKeyList[index].arKey));
-            memcpy(ar->arWepKeyList[index].arKey, ik->ik_keydata, ik->ik_keylen);
-            ar->arWepKeyList[index].arKeyLen = ik->ik_keylen;
-
-            if(ik->ik_flags & IEEE80211_KEY_DEFAULT){
-                ar->arDefTxKeyIndex = index;
-            }
-
-            return 0;
-        }
-
-        if (((WPA_PSK_AUTH == ar->arAuthMode) || (WPA2_PSK_AUTH == ar->arAuthMode)) &&
-            (GROUP_USAGE & keyUsage))
-        {
-            A_UNTIMEOUT(&ar->disconnect_timer);
-        }
-
-        status = wmi_addKey_cmd(ar->arWmi, ik->ik_keyix, keyType, keyUsage,
-                                ik->ik_keylen, (u8 *)&ik->ik_keyrsc,
-                                ik->ik_keydata, KEY_OP_INIT_VAL, ik->ik_macaddr,
-                                SYNC_BOTH_WMIFLAG);
-
-        if (status) {
-            return -EIO;
-        }
-    } else {
-        status = wmi_add_krk_cmd(ar->arWmi, ik->ik_keydata);
-    }
-
-#ifdef USER_KEYS
-    ar->user_saved_keys.keyOk = true;
-#endif
-
-    return 0;
-}
-
-int ar6000_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    struct hif_device *hifDevice = ar->arHifDevice;
-    int ret = 0, param;
-    unsigned int address = 0;
-    unsigned int length = 0;
-    unsigned char *buffer;
-    char *userdata;
-    u32 connectCtrlFlags;
-
-
-    WMI_SET_AKMP_PARAMS_CMD  akmpParams;
-    WMI_SET_PMKID_LIST_CMD   pmkidInfo;
-
-    WMI_SET_HT_CAP_CMD htCap;
-    WMI_SET_HT_OP_CMD htOp;
-
-    /*
-     * ioctl operations may have to wait for the Target, so we cannot hold rtnl.
-     * Prevent the device from disappearing under us and release the lock during
-     * the ioctl operation.
-     */
-    dev_hold(dev);
-    rtnl_unlock();
-
-    if (cmd == AR6000_IOCTL_EXTENDED) {
-        /*
-         * This allows for many more wireless ioctls than would otherwise
-         * be available.  Applications embed the actual ioctl command in
-         * the first word of the parameter block, and use the command
-         * AR6000_IOCTL_EXTENDED_CMD on the ioctl call.
-         */
-	if (get_user(cmd, (int *)rq->ifr_data)) {
-	    ret = -EFAULT;
-	    goto ioctl_done;
-	}
-        userdata = (char *)(((unsigned int *)rq->ifr_data)+1);
-        if(is_xioctl_allowed(ar->arNextMode, cmd) != 0) {
-            A_PRINTF("xioctl: cmd=%d not allowed in this mode\n",cmd);
-            ret = -EOPNOTSUPP;
-            goto ioctl_done;
-    }
-    } else {
-        int ret = is_iwioctl_allowed(ar->arNextMode, cmd);
-        if(ret == A_ENOTSUP) {
-            A_PRINTF("iwioctl: cmd=0x%x not allowed in this mode\n", cmd);
-            ret = -EOPNOTSUPP;
-            goto ioctl_done;
-        } else if (ret == A_ERROR) {
-            /* It is not our ioctl (out of range ioctl) */
-            ret = -EOPNOTSUPP;
-            goto ioctl_done;
-        }
-        userdata = (char *)rq->ifr_data;
-    }
-
-    if ((ar->arWlanState == WLAN_DISABLED) &&
-        ((cmd != AR6000_XIOCTRL_WMI_SET_WLAN_STATE) &&
-         (cmd != AR6000_XIOCTL_GET_WLAN_SLEEP_STATE) &&
-         (cmd != AR6000_XIOCTL_DIAG_READ) &&
-         (cmd != AR6000_XIOCTL_DIAG_WRITE) &&
-         (cmd != AR6000_XIOCTL_SET_BT_HW_POWER_STATE) &&
-         (cmd != AR6000_XIOCTL_GET_BT_HW_POWER_STATE) &&
-         (cmd != AR6000_XIOCTL_ADD_AP_INTERFACE) &&
-         (cmd != AR6000_XIOCTL_REMOVE_AP_INTERFACE) &&
-         (cmd != AR6000_IOCTL_WMI_GETREV)))
-    {
-        ret = -EIO;
-        goto ioctl_done;
-    }
-
-    ret = 0;
-    switch(cmd)
-    {
-        case IEEE80211_IOCTL_SETPARAM:
-        {
-            int param, value;
-            int *ptr = (int *)rq->ifr_ifru.ifru_newname;
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else {
-                param = *ptr++;
-                value = *ptr;
-                ret = ar6000_ioctl_setparam(ar,param,value);
-            }
-            break;
-        }
-        case IEEE80211_IOCTL_SETKEY:
-        {
-            struct ieee80211req_key keydata;
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&keydata, userdata,
-                            sizeof(struct ieee80211req_key))) {
-                ret = -EFAULT;
-            } else {
-                ar6000_ioctl_setkey(ar, &keydata);
-            }
-            break;
-        }
-        case IEEE80211_IOCTL_DELKEY:
-        case IEEE80211_IOCTL_SETOPTIE:
-        {
-            //ret = -EIO;
-            break;
-        }
-        case IEEE80211_IOCTL_SETMLME:
-        {
-            struct ieee80211req_mlme mlme;
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&mlme, userdata,
-                            sizeof(struct ieee80211req_mlme))) {
-                ret = -EFAULT;
-            } else {
-                switch (mlme.im_op) {
-                    case IEEE80211_MLME_AUTHORIZE:
-                        A_PRINTF("setmlme AUTHORIZE %02X:%02X\n",
-                            mlme.im_macaddr[4], mlme.im_macaddr[5]);
-                        break;
-                    case IEEE80211_MLME_UNAUTHORIZE:
-                        A_PRINTF("setmlme UNAUTHORIZE %02X:%02X\n",
-                            mlme.im_macaddr[4], mlme.im_macaddr[5]);
-                        break;
-                    case IEEE80211_MLME_DEAUTH:
-                        A_PRINTF("setmlme DEAUTH %02X:%02X\n",
-                            mlme.im_macaddr[4], mlme.im_macaddr[5]);
-                        //remove_sta(ar, mlme.im_macaddr);
-                        break;
-                    case IEEE80211_MLME_DISASSOC:
-                        A_PRINTF("setmlme DISASSOC %02X:%02X\n",
-                            mlme.im_macaddr[4], mlme.im_macaddr[5]);
-                        //remove_sta(ar, mlme.im_macaddr);
-                        break;
-                    default:
-                        ret = 0;
-                        goto ioctl_done;
-                }
-
-                wmi_ap_set_mlme(ar->arWmi, mlme.im_op, mlme.im_macaddr,
-                                mlme.im_reason);
-            }
-            break;
-        }
-        case IEEE80211_IOCTL_ADDPMKID:
-        {
-            struct ieee80211req_addpmkid  req;
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&req, userdata, sizeof(struct ieee80211req_addpmkid))) {
-                ret = -EFAULT;
-            } else {
-                int status;
-
-                AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("Add pmkid for %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x en=%d\n",
-                    req.pi_bssid[0], req.pi_bssid[1], req.pi_bssid[2],
-                    req.pi_bssid[3], req.pi_bssid[4], req.pi_bssid[5],
-                    req.pi_enable));
-
-                status = wmi_setPmkid_cmd(ar->arWmi, req.pi_bssid, req.pi_pmkid,
-                              req.pi_enable);
-
-                if (status) {
-                    ret = -EIO;
-                    goto ioctl_done;
-                }
-            }
-            break;
-        }
-#ifdef CONFIG_HOST_TCMD_SUPPORT
-        case AR6000_XIOCTL_TCMD_CONT_TX:
-            {
-                TCMD_CONT_TX txCmd;
-
-                if ((ar->tcmdPm == TCMD_PM_SLEEP) ||
-                    (ar->tcmdPm == TCMD_PM_DEEPSLEEP))
-                {
-                    A_PRINTF("Can NOT send tx tcmd when target is asleep! \n");
-                    ret = -EFAULT;
-                    goto ioctl_done;
-                }
-
-                if(copy_from_user(&txCmd, userdata, sizeof(TCMD_CONT_TX))) {
-                    ret = -EFAULT;
-                    goto ioctl_done;
-                } else {
-                    wmi_test_cmd(ar->arWmi,(u8 *)&txCmd, sizeof(TCMD_CONT_TX));
-                }
-            }
-            break;
-        case AR6000_XIOCTL_TCMD_CONT_RX:
-            {
-                TCMD_CONT_RX rxCmd;
-
-                if ((ar->tcmdPm == TCMD_PM_SLEEP) ||
-                    (ar->tcmdPm == TCMD_PM_DEEPSLEEP))
-                {
-                    A_PRINTF("Can NOT send rx tcmd when target is asleep! \n");
-                    ret = -EFAULT;
-                    goto ioctl_done;
-                }
-                if(copy_from_user(&rxCmd, userdata, sizeof(TCMD_CONT_RX))) {
-                    ret = -EFAULT;
-                    goto ioctl_done;
-                }
-
-                switch(rxCmd.act)
-                {
-                    case TCMD_CONT_RX_PROMIS:
-                    case TCMD_CONT_RX_FILTER:
-                    case TCMD_CONT_RX_SETMAC:
-                    case TCMD_CONT_RX_SET_ANT_SWITCH_TABLE:
-                         wmi_test_cmd(ar->arWmi,(u8 *)&rxCmd,
-                                                sizeof(TCMD_CONT_RX));
-                         tcmdRxFreq = rxCmd.u.para.freq;
-                         break;
-                    case TCMD_CONT_RX_REPORT:
-                         ar6000_ioctl_tcmd_get_rx_report(dev, rq,
-                         (u8 *)&rxCmd, sizeof(TCMD_CONT_RX));
-                         break;
-                    default:
-                         A_PRINTF("Unknown Cont Rx mode: %d\n",rxCmd.act);
-                         ret = -EINVAL;
-                         goto ioctl_done;
-                }
-            }
-            break;
-        case AR6000_XIOCTL_TCMD_PM:
-            {
-                TCMD_PM pmCmd;
-
-                if(copy_from_user(&pmCmd, userdata, sizeof(TCMD_PM))) {
-                    ret = -EFAULT;
-                    goto ioctl_done;
-                }
-                ar->tcmdPm = pmCmd.mode;
-                wmi_test_cmd(ar->arWmi, (u8 *)&pmCmd, sizeof(TCMD_PM));
-            }
-            break;
-#endif /* CONFIG_HOST_TCMD_SUPPORT */
-
-        case AR6000_XIOCTL_BMI_DONE:
-            if(bmienable)
-            {
-                rtnl_lock(); /* ar6000_init expects to be called holding rtnl lock */
-                ret = ar6000_init(dev);
-                rtnl_unlock();
-            }
-            else
-            {
-                ret = BMIDone(hifDevice);
-            }
-            break;
-
-        case AR6000_XIOCTL_BMI_READ_MEMORY:
-	     if (get_user(address, (unsigned int *)userdata) ||
-		get_user(length, (unsigned int *)userdata + 1)) {
-		ret = -EFAULT;
-		break;
-	    }
-
-            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Read Memory (address: 0x%x, length: %d)\n",
-                             address, length));
-            if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
-                A_MEMZERO(buffer, length);
-                ret = BMIReadMemory(hifDevice, address, buffer, length);
-                if (copy_to_user(rq->ifr_data, buffer, length)) {
-                    ret = -EFAULT;
-                }
-                A_FREE(buffer);
-            } else {
-                ret = -ENOMEM;
-            }
-            break;
-
-        case AR6000_XIOCTL_BMI_WRITE_MEMORY:
-	     if (get_user(address, (unsigned int *)userdata) ||
-		get_user(length, (unsigned int *)userdata + 1)) {
-		ret = -EFAULT;
-		break;
-	    }
-            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Write Memory (address: 0x%x, length: %d)\n",
-                             address, length));
-            if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
-                A_MEMZERO(buffer, length);
-                if (copy_from_user(buffer, &userdata[sizeof(address) +
-                                   sizeof(length)], length))
-                {
-                    ret = -EFAULT;
-                } else {
-                    ret = BMIWriteMemory(hifDevice, address, buffer, length);
-                }
-                A_FREE(buffer);
-            } else {
-                ret = -ENOMEM;
-            }
-            break;
-
-        case AR6000_XIOCTL_BMI_TEST:
-           AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("No longer supported\n"));
-           ret = -EOPNOTSUPP;
-           break;
-
-        case AR6000_XIOCTL_BMI_EXECUTE:
-	     if (get_user(address, (unsigned int *)userdata) ||
-		get_user(param, (unsigned int *)userdata + 1)) {
-		ret = -EFAULT;
-		break;
-	    }
-            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Execute (address: 0x%x, param: %d)\n",
-                             address, param));
-            ret = BMIExecute(hifDevice, address, (u32 *)&param);
-	    /* return value */
-	    if (put_user(param, (unsigned int *)rq->ifr_data)) {
-		ret = -EFAULT;
-		break;
-	    }
-            break;
-
-        case AR6000_XIOCTL_BMI_SET_APP_START:
-	    if (get_user(address, (unsigned int *)userdata)) {
-		ret = -EFAULT;
-		break;
-	    }
-            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Set App Start (address: 0x%x)\n", address));
-            ret = BMISetAppStart(hifDevice, address);
-            break;
-
-        case AR6000_XIOCTL_BMI_READ_SOC_REGISTER:
-	    if (get_user(address, (unsigned int *)userdata)) {
-		ret = -EFAULT;
-		break;
-	    }
-            ret = BMIReadSOCRegister(hifDevice, address, (u32 *)&param);
-	    /* return value */
-	    if (put_user(param, (unsigned int *)rq->ifr_data)) {
-		ret = -EFAULT;
-		break;
-	    }
-            break;
-
-        case AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER:
-	    if (get_user(address, (unsigned int *)userdata) ||
-		get_user(param, (unsigned int *)userdata + 1)) {
-		ret = -EFAULT;
-		break;
-	    }
-            ret = BMIWriteSOCRegister(hifDevice, address, param);
-            break;
-
-#ifdef HTC_RAW_INTERFACE
-        case AR6000_XIOCTL_HTC_RAW_OPEN:
-            ret = 0;
-            if (!arRawIfEnabled(ar)) {
-                /* make sure block size is set in case the target was reset since last
-                  * BMI phase (i.e. flashup downloads) */
-                ret = ar6000_set_htc_params(ar->arHifDevice,
-                                            ar->arTargetType,
-                                            0,  /* use default yield */
-                                            0   /* use default number of HTC ctrl buffers */
-                                            );
-                if (ret) {
-                    break;
-                }
-                /* Terminate the BMI phase */
-                ret = BMIDone(hifDevice);
-                if (ret == 0) {
-                    ret = ar6000_htc_raw_open(ar);
-                }
-            }
-            break;
-
-        case AR6000_XIOCTL_HTC_RAW_CLOSE:
-            if (arRawIfEnabled(ar)) {
-                ret = ar6000_htc_raw_close(ar);
-                arRawIfEnabled(ar) = false;
-            } else {
-                ret = A_ERROR;
-            }
-            break;
-
-        case AR6000_XIOCTL_HTC_RAW_READ:
-            if (arRawIfEnabled(ar)) {
-                unsigned int streamID;
-		if (get_user(streamID, (unsigned int *)userdata) ||
-		    get_user(length, (unsigned int *)userdata + 1)) {
-		    ret = -EFAULT;
-		    break;
-		}
-                buffer = (unsigned char*)rq->ifr_data + sizeof(length);
-                ret = ar6000_htc_raw_read(ar, (HTC_RAW_STREAM_ID)streamID,
-                                          (char*)buffer, length);
-		if (put_user(ret, (unsigned int *)rq->ifr_data)) {
-		    ret = -EFAULT;
-		    break;
-		}
-            } else {
-                ret = A_ERROR;
-            }
-            break;
-
-        case AR6000_XIOCTL_HTC_RAW_WRITE:
-            if (arRawIfEnabled(ar)) {
-                unsigned int streamID;
-		if (get_user(streamID, (unsigned int *)userdata) ||
-		    get_user(length, (unsigned int *)userdata + 1)) {
-		    ret = -EFAULT;
-		    break;
-		}
-                buffer = (unsigned char*)userdata + sizeof(streamID) + sizeof(length);
-                ret = ar6000_htc_raw_write(ar, (HTC_RAW_STREAM_ID)streamID,
-                                           (char*)buffer, length);
-		if (put_user(ret, (unsigned int *)rq->ifr_data)) {
-		    ret = -EFAULT;
-		    break;
-		}
-            } else {
-                ret = A_ERROR;
-            }
-            break;
-#endif /* HTC_RAW_INTERFACE */
-
-        case AR6000_XIOCTL_BMI_LZ_STREAM_START:
-	    if (get_user(address, (unsigned int *)userdata)) {
-		ret = -EFAULT;
-		break;
-	    }
-            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Start Compressed Stream (address: 0x%x)\n", address));
-            ret = BMILZStreamStart(hifDevice, address);
-            break;
-
-        case AR6000_XIOCTL_BMI_LZ_DATA:
-	    if (get_user(length, (unsigned int *)userdata)) {
-		ret = -EFAULT;
-		break;
-	    }
-            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Send Compressed Data (length: %d)\n", length));
-            if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
-                A_MEMZERO(buffer, length);
-                if (copy_from_user(buffer, &userdata[sizeof(length)], length))
-                {
-                    ret = -EFAULT;
-                } else {
-                    ret = BMILZData(hifDevice, buffer, length);
-                }
-                A_FREE(buffer);
-            } else {
-                ret = -ENOMEM;
-            }
-            break;
-
-#if defined(CONFIG_TARGET_PROFILE_SUPPORT)
-        /*
-         * Optional support for Target-side profiling.
-         * Not needed in production.
-         */
-
-        /* Configure Target-side profiling */
-        case AR6000_XIOCTL_PROF_CFG:
-        {
-            u32 period;
-            u32 nbins;
-	    if (get_user(period, (unsigned int *)userdata) ||
-		get_user(nbins, (unsigned int *)userdata + 1)) {
-		ret = -EFAULT;
-		break;
-	    }
-
-            if (wmi_prof_cfg_cmd(ar->arWmi, period, nbins) != 0) {
-                ret = -EIO;
-            }
-
-            break;
-        }
-
-        /* Start a profiling bucket/bin at the specified address */
-        case AR6000_XIOCTL_PROF_ADDR_SET:
-        {
-            u32 addr;
-	    if (get_user(addr, (unsigned int *)userdata)) {
-		ret = -EFAULT;
-		break;
-	    }
-
-            if (wmi_prof_addr_set_cmd(ar->arWmi, addr) != 0) {
-                ret = -EIO;
-            }
-
-            break;
-        }
-
-        /* START Target-side profiling */
-        case AR6000_XIOCTL_PROF_START:
-            wmi_prof_start_cmd(ar->arWmi);
-            break;
-
-        /* STOP Target-side profiling */
-        case AR6000_XIOCTL_PROF_STOP:
-            wmi_prof_stop_cmd(ar->arWmi);
-            break;
-        case AR6000_XIOCTL_PROF_COUNT_GET:
-        {
-            if (ar->bIsDestroyProgress) {
-                ret = -EBUSY;
-                goto ioctl_done;
-            }
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-                goto ioctl_done;
-            }
-            if (down_interruptible(&ar->arSem)) {
-                ret = -ERESTARTSYS;
-                goto ioctl_done;
-            }
-            if (ar->bIsDestroyProgress) {
-                up(&ar->arSem);
-                ret = -EBUSY;
-                goto ioctl_done;
-            }
-
-            prof_count_available = false;
-            ret = prof_count_get(dev);
-            if (ret != 0) {
-                up(&ar->arSem);
-                ret = -EIO;
-                goto ioctl_done;
-            }
-
-            /* Wait for Target to respond. */
-            wait_event_interruptible(arEvent, prof_count_available);
-            if (signal_pending(current)) {
-                ret = -EINTR;
-            } else {
-                if (copy_to_user(userdata, &prof_count_results,
-                                 sizeof(prof_count_results)))
-                {
-                    ret = -EFAULT;
-                }
-            }
-            up(&ar->arSem);
-            break;
-        }
-#endif /* CONFIG_TARGET_PROFILE_SUPPORT */
-
-        case AR6000_IOCTL_WMI_GETREV:
-        {
-            if (copy_to_user(rq->ifr_data, &ar->arVersion,
-                             sizeof(ar->arVersion)))
-            {
-                ret = -EFAULT;
-            }
-            break;
-        }
-        case AR6000_IOCTL_WMI_SETPWR:
-        {
-            WMI_POWER_MODE_CMD pwrModeCmd;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&pwrModeCmd, userdata,
-                                   sizeof(pwrModeCmd)))
-            {
-                ret = -EFAULT;
-            } else {
-                if (wmi_powermode_cmd(ar->arWmi, pwrModeCmd.powerMode)
-                       != 0)
-                {
-                    ret = -EIO;
-                }
-            }
-            break;
-        }
-        case AR6000_IOCTL_WMI_SET_IBSS_PM_CAPS:
-        {
-            WMI_IBSS_PM_CAPS_CMD ibssPmCaps;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&ibssPmCaps, userdata,
-                                   sizeof(ibssPmCaps)))
-            {
-                ret = -EFAULT;
-            } else {
-                if (wmi_ibsspmcaps_cmd(ar->arWmi, ibssPmCaps.power_saving, ibssPmCaps.ttl,
-                    ibssPmCaps.atim_windows, ibssPmCaps.timeout_value) != 0)
-                {
-                    ret = -EIO;
-                }
-                AR6000_SPIN_LOCK(&ar->arLock, 0);
-                ar->arIbssPsEnable = ibssPmCaps.power_saving;
-                AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-            }
-            break;
-        }
-        case AR6000_XIOCTL_WMI_SET_AP_PS:
-        {
-            WMI_AP_PS_CMD apPsCmd;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&apPsCmd, userdata,
-                                   sizeof(apPsCmd)))
-            {
-                ret = -EFAULT;
-            } else {
-                if (wmi_apps_cmd(ar->arWmi, apPsCmd.psType, apPsCmd.idle_time,
-                    apPsCmd.ps_period, apPsCmd.sleep_period) != 0)
-                {
-                    ret = -EIO;
-                }
-            }
-            break;
-        }
-        case AR6000_IOCTL_WMI_SET_PMPARAMS:
-        {
-            WMI_POWER_PARAMS_CMD pmParams;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&pmParams, userdata,
-                                      sizeof(pmParams)))
-            {
-                ret = -EFAULT;
-            } else {
-                if (wmi_pmparams_cmd(ar->arWmi, pmParams.idle_period,
-                                     pmParams.pspoll_number,
-                                     pmParams.dtim_policy,
-                                     pmParams.tx_wakeup_policy,
-                                     pmParams.num_tx_to_wakeup,
-#if WLAN_CONFIG_IGNORE_POWER_SAVE_FAIL_EVENT_DURING_SCAN
-                                     IGNORE_POWER_SAVE_FAIL_EVENT_DURING_SCAN 
-#else
-                                     SEND_POWER_SAVE_FAIL_EVENT_ALWAYS
-#endif
-                                     ) != 0)
-                {
-                    ret = -EIO;
-                }
-            }
-            break;
-        }
-        case AR6000_IOCTL_WMI_SETSCAN:
-        {
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&ar->scParams, userdata,
-                                      sizeof(ar->scParams)))
-            {
-                ret = -EFAULT;
-            } else {
-                if (CAN_SCAN_IN_CONNECT(ar->scParams.scanCtrlFlags)) {
-                    ar->arSkipScan = false;
-                } else {
-                    ar->arSkipScan = true;
-                }
-
-                if (wmi_scanparams_cmd(ar->arWmi, ar->scParams.fg_start_period,
-                                       ar->scParams.fg_end_period,
-                                       ar->scParams.bg_period,
-                                       ar->scParams.minact_chdwell_time,
-                                       ar->scParams.maxact_chdwell_time,
-                                       ar->scParams.pas_chdwell_time,
-                                       ar->scParams.shortScanRatio,
-                                       ar->scParams.scanCtrlFlags,
-                                       ar->scParams.max_dfsch_act_time,
-                                       ar->scParams.maxact_scan_per_ssid) != 0)
-                {
-                    ret = -EIO;
-                }
-            }
-            break;
-        }
-        case AR6000_IOCTL_WMI_SETLISTENINT:
-        {
-            WMI_LISTEN_INT_CMD listenCmd;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&listenCmd, userdata,
-                                      sizeof(listenCmd)))
-            {
-                ret = -EFAULT;
-            } else {
-                    if (wmi_listeninterval_cmd(ar->arWmi, listenCmd.listenInterval, listenCmd.numBeacons) != 0) {
-                        ret = -EIO;
-                    } else {
-                        AR6000_SPIN_LOCK(&ar->arLock, 0);
-                        ar->arListenIntervalT = listenCmd.listenInterval;
-                        ar->arListenIntervalB = listenCmd.numBeacons;
-                        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-                    }
-
-                }
-            break;
-        }
-        case AR6000_IOCTL_WMI_SET_BMISS_TIME:
-        {
-            WMI_BMISS_TIME_CMD bmissCmd;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&bmissCmd, userdata,
-                                      sizeof(bmissCmd)))
-            {
-                ret = -EFAULT;
-            } else {
-                if (wmi_bmisstime_cmd(ar->arWmi, bmissCmd.bmissTime, bmissCmd.numBeacons) != 0) {
-                    ret = -EIO;
-                }
-            }
-            break;
-        }
-        case AR6000_IOCTL_WMI_SETBSSFILTER:
-        {
-            WMI_BSS_FILTER_CMD filt;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&filt, userdata,
-                                   sizeof(filt)))
-            {
-                ret = -EFAULT;
-            } else {
-                if (wmi_bssfilter_cmd(ar->arWmi, filt.bssFilter, filt.ieMask)
-                        != 0) {
-                    ret = -EIO;
-                } else {
-                    ar->arUserBssFilter = filt.bssFilter;
-                }
-            }
-            break;
-        }
-
-        case AR6000_IOCTL_WMI_SET_SNRTHRESHOLD:
-        {
-            ret = ar6000_ioctl_set_snr_threshold(dev, rq);
-            break;
-        }
-        case AR6000_XIOCTL_WMI_SET_RSSITHRESHOLD:
-        {
-            ret = ar6000_ioctl_set_rssi_threshold(dev, rq);
-            break;
-        }
-        case AR6000_XIOCTL_WMI_CLR_RSSISNR:
-        {
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            }
-            ret = wmi_clr_rssi_snr(ar->arWmi);
-            break;
-        }
-        case AR6000_XIOCTL_WMI_SET_LQTHRESHOLD:
-        {
-            ret = ar6000_ioctl_set_lq_threshold(dev, rq);
-            break;
-        }
-        case AR6000_XIOCTL_WMI_SET_LPREAMBLE:
-        {
-            WMI_SET_LPREAMBLE_CMD setLpreambleCmd;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&setLpreambleCmd, userdata,
-                                   sizeof(setLpreambleCmd)))
-            {
-                ret = -EFAULT;
-            } else {
-                if (wmi_set_lpreamble_cmd(ar->arWmi, setLpreambleCmd.status,
-#if WLAN_CONFIG_DONOT_IGNORE_BARKER_IN_ERP 
-                           WMI_DONOT_IGNORE_BARKER_IN_ERP
-#else
-                           WMI_IGNORE_BARKER_IN_ERP
-#endif
-                ) != 0)
-                {
-                    ret = -EIO;
-                }
-            }
-
-            break;
-        }
-        case AR6000_XIOCTL_WMI_SET_RTS:
-        {
-            WMI_SET_RTS_CMD rtsCmd;
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&rtsCmd, userdata,
-                                   sizeof(rtsCmd)))
-            {
-                ret = -EFAULT;
-            } else {
-                ar->arRTS = rtsCmd.threshold;
-                if (wmi_set_rts_cmd(ar->arWmi, rtsCmd.threshold)
-                       != 0)
-                {
-                    ret = -EIO;
-                }
-            }
-
-            break;
-        }
-        case AR6000_XIOCTL_WMI_SET_WMM:
-        {
-            ret = ar6000_ioctl_set_wmm(dev, rq);
-            break;
-        }
-       case AR6000_XIOCTL_WMI_SET_QOS_SUPP:
-        {
-            ret = ar6000_ioctl_set_qos_supp(dev, rq);
-            break;
-        }
-        case AR6000_XIOCTL_WMI_SET_TXOP:
-        {
-            ret = ar6000_ioctl_set_txop(dev, rq);
-            break;
-        }
-        case AR6000_XIOCTL_WMI_GET_RD:
-        {
-            ret = ar6000_ioctl_get_rd(dev, rq);
-            break;
-        }
-        case AR6000_IOCTL_WMI_SET_CHANNELPARAMS:
-        {
-            ret = ar6000_ioctl_set_channelParams(dev, rq);
-            break;
-        }
-        case AR6000_IOCTL_WMI_SET_PROBEDSSID:
-        {
-            ret = ar6000_ioctl_set_probedSsid(dev, rq);
-            break;
-        }
-        case AR6000_IOCTL_WMI_SET_BADAP:
-        {
-            ret = ar6000_ioctl_set_badAp(dev, rq);
-            break;
-        }
-        case AR6000_IOCTL_WMI_CREATE_QOS:
-        {
-            ret = ar6000_ioctl_create_qos(dev, rq);
-            break;
-        }
-        case AR6000_IOCTL_WMI_DELETE_QOS:
-        {
-            ret = ar6000_ioctl_delete_qos(dev, rq);
-            break;
-        }
-        case AR6000_IOCTL_WMI_GET_QOS_QUEUE:
-        {
-            ret = ar6000_ioctl_get_qos_queue(dev, rq);
-            break;
-        }
-        case AR6000_IOCTL_WMI_GET_TARGET_STATS:
-        {
-            ret = ar6000_ioctl_get_target_stats(dev, rq);
-            break;
-        }
-        case AR6000_IOCTL_WMI_SET_ERROR_REPORT_BITMASK:
-        {
-            ret = ar6000_ioctl_set_error_report_bitmask(dev, rq);
-            break;
-        }
-        case AR6000_IOCTL_WMI_SET_ASSOC_INFO:
-        {
-            WMI_SET_ASSOC_INFO_CMD cmd;
-            u8 assocInfo[WMI_MAX_ASSOC_INFO_LEN];
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-		break;
-	    }
-
-	    if (get_user(cmd.ieType, userdata)) {
-		ret = -EFAULT;
-		break;
-	    }
-	    if (cmd.ieType >= WMI_MAX_ASSOC_INFO_TYPE) {
-		ret = -EIO;
-		break;
-	    }
-
-	    if (get_user(cmd.bufferSize, userdata + 1) ||
-		(cmd.bufferSize > WMI_MAX_ASSOC_INFO_LEN) ||
-		copy_from_user(assocInfo, userdata + 2, cmd.bufferSize)) {
-		ret = -EFAULT;
-		break;
-	    }
-	    if (wmi_associnfo_cmd(ar->arWmi, cmd.ieType,
-				  cmd.bufferSize, assocInfo) != 0) {
-		ret = -EIO;
-		break;
-	    }
-            break;
-        }
-        case AR6000_IOCTL_WMI_SET_ACCESS_PARAMS:
-        {
-            ret = ar6000_ioctl_set_access_params(dev, rq);
-            break;
-        }
-        case AR6000_IOCTL_WMI_SET_DISC_TIMEOUT:
-        {
-            ret = ar6000_ioctl_set_disconnect_timeout(dev, rq);
-            break;
-        }
-        case AR6000_XIOCTL_FORCE_TARGET_RESET:
-        {
-            if (ar->arHtcTarget)
-            {
-//                HTCForceReset(htcTarget);
-            }
-            else
-            {
-                AR_DEBUG_PRINTF(ATH_DEBUG_WARN,("ar6000_ioctl cannot attempt reset.\n"));
-            }
-            break;
-        }
-        case AR6000_XIOCTL_TARGET_INFO:
-        case AR6000_XIOCTL_CHECK_TARGET_READY: /* backwards compatibility */
-        {
-            /* If we made it to here, then the Target exists and is ready. */
-
-            if (cmd == AR6000_XIOCTL_TARGET_INFO) {
-                if (copy_to_user((u32 *)rq->ifr_data, &ar->arVersion.target_ver,
-                                 sizeof(ar->arVersion.target_ver)))
-                {
-                    ret = -EFAULT;
-                }
-                if (copy_to_user(((u32 *)rq->ifr_data)+1, &ar->arTargetType,
-                                 sizeof(ar->arTargetType)))
-                {
-                    ret = -EFAULT;
-                }
-            }
-            break;
-        }
-        case AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS:
-        {
-            WMI_SET_HB_CHALLENGE_RESP_PARAMS_CMD hbparam;
-
-            if (copy_from_user(&hbparam, userdata, sizeof(hbparam)))
-            {
-                ret = -EFAULT;
-            } else {
-                AR6000_SPIN_LOCK(&ar->arLock, 0);
-                /* Start a cyclic timer with the parameters provided. */
-                if (hbparam.frequency) {
-                    ar->arHBChallengeResp.frequency = hbparam.frequency;
-                }
-                if (hbparam.threshold) {
-                    ar->arHBChallengeResp.missThres = hbparam.threshold;
-                }
-
-                /* Delete the pending timer and start a new one */
-                if (timer_pending(&ar->arHBChallengeResp.timer)) {
-                    A_UNTIMEOUT(&ar->arHBChallengeResp.timer);
-                }
-                A_TIMEOUT_MS(&ar->arHBChallengeResp.timer, ar->arHBChallengeResp.frequency * 1000, 0);
-                AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-            }
-            break;
-        }
-        case AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP:
-        {
-            u32 cookie;
-
-            if (copy_from_user(&cookie, userdata, sizeof(cookie))) {
-                ret = -EFAULT;
-                goto ioctl_done;
-            }
-
-            /* Send the challenge on the control channel */
-            if (wmi_get_challenge_resp_cmd(ar->arWmi, cookie, APP_HB_CHALLENGE) != 0) {
-                ret = -EIO;
-                goto ioctl_done;
-            }
-            break;
-        }
-#ifdef USER_KEYS
-        case AR6000_XIOCTL_USER_SETKEYS:
-        {
-
-            ar->user_savedkeys_stat = USER_SAVEDKEYS_STAT_RUN;
-
-            if (copy_from_user(&ar->user_key_ctrl, userdata,
-                               sizeof(ar->user_key_ctrl)))
-            {
-                ret = -EFAULT;
-                goto ioctl_done;
-            }
-
-            A_PRINTF("ar6000 USER set key %x\n", ar->user_key_ctrl);
-            break;
-        }
-#endif /* USER_KEYS */
-
-#ifdef CONFIG_HOST_GPIO_SUPPORT
-        case AR6000_XIOCTL_GPIO_OUTPUT_SET:
-        {
-            struct ar6000_gpio_output_set_cmd_s gpio_output_set_cmd;
-
-            if (ar->bIsDestroyProgress) {
-                ret = -EBUSY;
-                goto ioctl_done;
-            }
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-                goto ioctl_done;
-            }
-            if (down_interruptible(&ar->arSem)) {
-                ret = -ERESTARTSYS;
-                goto ioctl_done;
-            }
-            if (ar->bIsDestroyProgress) {
-                up(&ar->arSem);
-                ret = -EBUSY;
-                goto ioctl_done;
-            }
-
-            if (copy_from_user(&gpio_output_set_cmd, userdata,
-                                sizeof(gpio_output_set_cmd)))
-            {
-                ret = -EFAULT;
-            } else {
-                ret = ar6000_gpio_output_set(dev,
-                                             gpio_output_set_cmd.set_mask,
-                                             gpio_output_set_cmd.clear_mask,
-                                             gpio_output_set_cmd.enable_mask,
-                                             gpio_output_set_cmd.disable_mask);
-                if (ret != 0) {
-                    ret = -EIO;
-                }
-            }
-            up(&ar->arSem);
-            break;
-        }
-        case AR6000_XIOCTL_GPIO_INPUT_GET:
-        {
-            if (ar->bIsDestroyProgress) {
-                ret = -EBUSY;
-                goto ioctl_done;
-            }
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-                goto ioctl_done;
-            }
-            if (down_interruptible(&ar->arSem)) {
-                ret = -ERESTARTSYS;
-                goto ioctl_done;
-            }
-            if (ar->bIsDestroyProgress) {
-                up(&ar->arSem);
-                ret = -EBUSY;
-                goto ioctl_done;
-            }
-
-            ret = ar6000_gpio_input_get(dev);
-            if (ret != 0) {
-                up(&ar->arSem);
-                ret = -EIO;
-                goto ioctl_done;
-            }
-
-            /* Wait for Target to respond. */
-            wait_event_interruptible(arEvent, gpio_data_available);
-            if (signal_pending(current)) {
-                ret = -EINTR;
-            } else {
-                A_ASSERT(gpio_reg_results.gpioreg_id == GPIO_ID_NONE);
-
-                if (copy_to_user(userdata, &gpio_reg_results.value,
-                                 sizeof(gpio_reg_results.value)))
-                {
-                    ret = -EFAULT;
-                }
-            }
-            up(&ar->arSem);
-            break;
-        }
-        case AR6000_XIOCTL_GPIO_REGISTER_SET:
-        {
-            struct ar6000_gpio_register_cmd_s gpio_register_cmd;
-
-            if (ar->bIsDestroyProgress) {
-                ret = -EBUSY;
-                goto ioctl_done;
-            }
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-                goto ioctl_done;
-            }
-            if (down_interruptible(&ar->arSem)) {
-                ret = -ERESTARTSYS;
-                goto ioctl_done;
-            }
-            if (ar->bIsDestroyProgress) {
-                up(&ar->arSem);
-                ret = -EBUSY;
-                goto ioctl_done;
-            }
-
-            if (copy_from_user(&gpio_register_cmd, userdata,
-                                sizeof(gpio_register_cmd)))
-            {
-                ret = -EFAULT;
-            } else {
-                ret = ar6000_gpio_register_set(dev,
-                                               gpio_register_cmd.gpioreg_id,
-                                               gpio_register_cmd.value);
-                if (ret != 0) {
-                    ret = -EIO;
-                }
-
-                /* Wait for acknowledgement from Target */
-                wait_event_interruptible(arEvent, gpio_ack_received);
-                if (signal_pending(current)) {
-                    ret = -EINTR;
-                }
-            }
-            up(&ar->arSem);
-            break;
-        }
-        case AR6000_XIOCTL_GPIO_REGISTER_GET:
-        {
-            struct ar6000_gpio_register_cmd_s gpio_register_cmd;
-
-            if (ar->bIsDestroyProgress) {
-                ret = -EBUSY;
-                goto ioctl_done;
-            }
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-                goto ioctl_done;
-            }
-            if (down_interruptible(&ar->arSem)) {
-                ret = -ERESTARTSYS;
-                goto ioctl_done;
-            }
-            if (ar->bIsDestroyProgress) {
-                up(&ar->arSem);
-                ret = -EBUSY;
-                goto ioctl_done;
-            }
-
-            if (copy_from_user(&gpio_register_cmd, userdata,
-                                sizeof(gpio_register_cmd)))
-            {
-                ret = -EFAULT;
-            } else {
-                ret = ar6000_gpio_register_get(dev, gpio_register_cmd.gpioreg_id);
-                if (ret != 0) {
-                    up(&ar->arSem);
-                    ret = -EIO;
-                    goto ioctl_done;
-                }
-
-                /* Wait for Target to respond. */
-                wait_event_interruptible(arEvent, gpio_data_available);
-                if (signal_pending(current)) {
-                    ret = -EINTR;
-                } else {
-                    A_ASSERT(gpio_register_cmd.gpioreg_id == gpio_reg_results.gpioreg_id);
-                    if (copy_to_user(userdata, &gpio_reg_results,
-                                     sizeof(gpio_reg_results)))
-                    {
-                        ret = -EFAULT;
-                    }
-                }
-            }
-            up(&ar->arSem);
-            break;
-        }
-        case AR6000_XIOCTL_GPIO_INTR_ACK:
-        {
-            struct ar6000_gpio_intr_ack_cmd_s gpio_intr_ack_cmd;
-
-            if (ar->bIsDestroyProgress) {
-                ret = -EBUSY;
-                goto ioctl_done;
-            }
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-                goto ioctl_done;
-            }
-            if (down_interruptible(&ar->arSem)) {
-                ret = -ERESTARTSYS;
-                goto ioctl_done;
-            }
-            if (ar->bIsDestroyProgress) {
-                up(&ar->arSem);
-                ret = -EBUSY;
-                goto ioctl_done;
-            }
-
-            if (copy_from_user(&gpio_intr_ack_cmd, userdata,
-                                sizeof(gpio_intr_ack_cmd)))
-            {
-                ret = -EFAULT;
-            } else {
-                ret = ar6000_gpio_intr_ack(dev, gpio_intr_ack_cmd.ack_mask);
-                if (ret != 0) {
-                    ret = -EIO;
-                }
-            }
-            up(&ar->arSem);
-            break;
-        }
-        case AR6000_XIOCTL_GPIO_INTR_WAIT:
-        {
-            /* Wait for Target to report an interrupt. */
-            wait_event_interruptible(arEvent, gpio_intr_available);
-
-            if (signal_pending(current)) {
-                ret = -EINTR;
-            } else {
-                if (copy_to_user(userdata, &gpio_intr_results,
-                                 sizeof(gpio_intr_results)))
-                {
-                    ret = -EFAULT;
-                }
-            }
-            break;
-        }
-#endif /* CONFIG_HOST_GPIO_SUPPORT */
-
-        case AR6000_XIOCTL_DBGLOG_CFG_MODULE:
-        {
-            struct ar6000_dbglog_module_config_s config;
-
-            if (copy_from_user(&config, userdata, sizeof(config))) {
-                ret = -EFAULT;
-                goto ioctl_done;
-            }
-
-            /* Send the challenge on the control channel */
-            if (wmi_config_debug_module_cmd(ar->arWmi, config.mmask,
-                                            config.tsr, config.rep,
-                                            config.size, config.valid) != 0)
-            {
-                ret = -EIO;
-                goto ioctl_done;
-            }
-            break;
-        }
-
-        case AR6000_XIOCTL_DBGLOG_GET_DEBUG_LOGS:
-        {
-            /* Send the challenge on the control channel */
-            if (ar6000_dbglog_get_debug_logs(ar) != 0)
-            {
-                ret = -EIO;
-                goto ioctl_done;
-            }
-            break;
-        }
-
-        case AR6000_XIOCTL_SET_ADHOC_BSSID:
-        {
-            WMI_SET_ADHOC_BSSID_CMD adhocBssid;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&adhocBssid, userdata,
-                                      sizeof(adhocBssid)))
-            {
-                ret = -EFAULT;
-            } else if (memcmp(adhocBssid.bssid, bcast_mac,
-                                AR6000_ETH_ADDR_LEN) == 0)
-            {
-                ret = -EFAULT;
-            } else {
-
-                memcpy(ar->arReqBssid, adhocBssid.bssid, sizeof(ar->arReqBssid));
-        }
-            break;
-        }
-
-        case AR6000_XIOCTL_SET_OPT_MODE:
-        {
-        WMI_SET_OPT_MODE_CMD optModeCmd;
-            struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&optModeCmd, userdata,
-                                      sizeof(optModeCmd)))
-            {
-                ret = -EFAULT;
-            } else if (ar->arConnected && optModeCmd.optMode == SPECIAL_ON) {
-                ret = -EFAULT;
-
-            } else if (wmi_set_opt_mode_cmd(ar->arWmi, optModeCmd.optMode)
-                       != 0)
-            {
-                ret = -EIO;
-            }
-            break;
-        }
-
-        case AR6000_XIOCTL_OPT_SEND_FRAME:
-        {
-            WMI_OPT_TX_FRAME_CMD optTxFrmCmd;
-            u8 data[MAX_OPT_DATA_LEN];
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-                break;
-            }
-
-            if (copy_from_user(&optTxFrmCmd, userdata, sizeof(optTxFrmCmd))) {
-                ret = -EFAULT;
-                break;
-            }
-
-            if (optTxFrmCmd.optIEDataLen > MAX_OPT_DATA_LEN) {
-                ret = -EINVAL;
-                break;
-            }
-
-            if (copy_from_user(data, userdata+sizeof(WMI_OPT_TX_FRAME_CMD) - 1,
-                                   optTxFrmCmd.optIEDataLen)) {
-                ret = -EFAULT;
-                break;
-            }
-
-            ret = wmi_opt_tx_frame_cmd(ar->arWmi,
-                                           optTxFrmCmd.frmType,
-                                           optTxFrmCmd.dstAddr,
-                                           optTxFrmCmd.bssid,
-                                           optTxFrmCmd.optIEDataLen,
-                                           data);
-            break;
-        }
-        case AR6000_XIOCTL_WMI_SETRETRYLIMITS:
-        {
-            WMI_SET_RETRY_LIMITS_CMD setRetryParams;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&setRetryParams, userdata,
-                                      sizeof(setRetryParams)))
-            {
-                ret = -EFAULT;
-            } else {
-                if (wmi_set_retry_limits_cmd(ar->arWmi, setRetryParams.frameType,
-                                          setRetryParams.trafficClass,
-                                          setRetryParams.maxRetries,
-                                          setRetryParams.enableNotify) != 0)
-                {
-                    ret = -EIO;
-                }
-                AR6000_SPIN_LOCK(&ar->arLock, 0);
-                ar->arMaxRetries = setRetryParams.maxRetries;
-                AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-            }
-            break;
-        }
-
-        case AR6000_XIOCTL_SET_BEACON_INTVAL:
-        {
-            WMI_BEACON_INT_CMD bIntvlCmd;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&bIntvlCmd, userdata,
-                       sizeof(bIntvlCmd)))
-            {
-                ret = -EFAULT;
-            } else if (wmi_set_adhoc_bconIntvl_cmd(ar->arWmi, bIntvlCmd.beaconInterval)
-                        != 0)
-            {
-                ret = -EIO;
-            }
-            if(ret == 0) {
-                ar->ap_beacon_interval = bIntvlCmd.beaconInterval;
-                ar->ap_profile_flag = 1; /* There is a change in profile */
-            }
-            break;
-        }
-        case IEEE80211_IOCTL_SETAUTHALG:
-        {
-            struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-            struct ieee80211req_authalg req;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&req, userdata,
-                       sizeof(struct ieee80211req_authalg)))
-            {
-                ret = -EFAULT;
-            } else {
-                if (req.auth_alg & AUTH_ALG_OPEN_SYSTEM) {
-                    ar->arDot11AuthMode  |= OPEN_AUTH;
-                    ar->arPairwiseCrypto  = NONE_CRYPT;
-                    ar->arGroupCrypto     = NONE_CRYPT;
-                }
-                if (req.auth_alg & AUTH_ALG_SHARED_KEY) {
-                    ar->arDot11AuthMode  |= SHARED_AUTH;
-                    ar->arPairwiseCrypto  = WEP_CRYPT;
-                    ar->arGroupCrypto     = WEP_CRYPT;
-                    ar->arAuthMode        = NONE_AUTH;
-                }
-                if (req.auth_alg == AUTH_ALG_LEAP) {
-                    ar->arDot11AuthMode   = LEAP_AUTH;
-                }
-            }
-            break;
-        }
-
-        case AR6000_XIOCTL_SET_VOICE_PKT_SIZE:
-            ret = ar6000_xioctl_set_voice_pkt_size(dev, userdata);
-            break;
-
-        case AR6000_XIOCTL_SET_MAX_SP:
-            ret = ar6000_xioctl_set_max_sp_len(dev, userdata);
-            break;
-
-        case AR6000_XIOCTL_WMI_GET_ROAM_TBL:
-            ret = ar6000_ioctl_get_roam_tbl(dev, rq);
-            break;
-        case AR6000_XIOCTL_WMI_SET_ROAM_CTRL:
-            ret = ar6000_ioctl_set_roam_ctrl(dev, userdata);
-            break;
-        case AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS:
-            ret = ar6000_ioctl_set_powersave_timers(dev, userdata);
-            break;
-        case AR6000_XIOCTRL_WMI_GET_POWER_MODE:
-            ret = ar6000_ioctl_get_power_mode(dev, rq);
-            break;
-        case AR6000_XIOCTRL_WMI_SET_WLAN_STATE:
-        {
-            AR6000_WLAN_STATE state;
-	    if (get_user(state, (unsigned int *)userdata))
-		ret = -EFAULT;
-	    else if (ar6000_set_wlan_state(ar, state) != 0)
-                ret = -EIO;
-            break;
-        }
-        case AR6000_XIOCTL_WMI_GET_ROAM_DATA:
-            ret = ar6000_ioctl_get_roam_data(dev, rq);
-            break;
-
-        case AR6000_XIOCTL_WMI_SET_BT_STATUS:
-            ret = ar6000_xioctl_set_bt_status_cmd(dev, userdata);
-            break;
-
-        case AR6000_XIOCTL_WMI_SET_BT_PARAMS:
-            ret = ar6000_xioctl_set_bt_params_cmd(dev, userdata);
-            break;
-
-		case AR6000_XIOCTL_WMI_SET_BTCOEX_FE_ANT:
-			ret = ar6000_xioctl_set_btcoex_fe_ant_cmd(dev, userdata);
-			break;
-
-		case AR6000_XIOCTL_WMI_SET_BTCOEX_COLOCATED_BT_DEV:
-			ret = ar6000_xioctl_set_btcoex_colocated_bt_dev_cmd(dev, userdata);
-			break;
-
-		case AR6000_XIOCTL_WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG:
-			ret = ar6000_xioctl_set_btcoex_btinquiry_page_config_cmd(dev, userdata);
-			break;
-
-		case AR6000_XIOCTL_WMI_SET_BTCOEX_SCO_CONFIG:
-			ret = ar6000_xioctl_set_btcoex_sco_config_cmd( dev, userdata);
-			break;
-
-		case AR6000_XIOCTL_WMI_SET_BTCOEX_A2DP_CONFIG:
-			ret = ar6000_xioctl_set_btcoex_a2dp_config_cmd(dev, userdata);
-			break;
-
-		case AR6000_XIOCTL_WMI_SET_BTCOEX_ACLCOEX_CONFIG:
-			ret = ar6000_xioctl_set_btcoex_aclcoex_config_cmd(dev, userdata);
-			break;
-
-		case AR6000_XIOCTL_WMI_SET_BTCOEX_DEBUG:
-			ret = ar60000_xioctl_set_btcoex_debug_cmd(dev, userdata);
-			break;
-
-		case AR6000_XIOCTL_WMI_SET_BT_OPERATING_STATUS:
-			ret = ar6000_xioctl_set_btcoex_bt_operating_status_cmd(dev, userdata);
-			break;
-
-		case AR6000_XIOCTL_WMI_GET_BTCOEX_CONFIG:
-			ret = ar6000_xioctl_get_btcoex_config_cmd(dev, userdata, rq);
-			break;
-
-		case AR6000_XIOCTL_WMI_GET_BTCOEX_STATS:
-			ret = ar6000_xioctl_get_btcoex_stats_cmd(dev, userdata, rq);
-			break;
-
-        case AR6000_XIOCTL_WMI_STARTSCAN:
-        {
-            WMI_START_SCAN_CMD setStartScanCmd, *cmdp;
-
-            if (ar->arWmiReady == false) {
-                    ret = -EIO;
-                } else if (copy_from_user(&setStartScanCmd, userdata,
-                                          sizeof(setStartScanCmd)))
-                {
-                    ret = -EFAULT;
-                } else {
-                    if (setStartScanCmd.numChannels > 1) {
-                        cmdp = A_MALLOC(130);
-                        if (copy_from_user(cmdp, userdata,
-                                           sizeof (*cmdp) +
-                                           ((setStartScanCmd.numChannels - 1) *
-                                           sizeof(u16))))
-                        {
-                            kfree(cmdp);
-                            ret = -EFAULT;
-                            goto ioctl_done;
-                        }
-                    } else {
-                        cmdp = &setStartScanCmd;
-                    }
-
-                    if (wmi_startscan_cmd(ar->arWmi, cmdp->scanType,
-                                          cmdp->forceFgScan,
-                                          cmdp->isLegacy,
-                                          cmdp->homeDwellTime,
-                                          cmdp->forceScanInterval,
-                                          cmdp->numChannels,
-                                          cmdp->channelList) != 0)
-                    {
-                        ret = -EIO;
-                    }
-                }
-            break;
-        }
-        case AR6000_XIOCTL_WMI_SETFIXRATES:
-        {
-            WMI_FIX_RATES_CMD setFixRatesCmd;
-            int returnStatus;
-
-            if (ar->arWmiReady == false) {
-                    ret = -EIO;
-                } else if (copy_from_user(&setFixRatesCmd, userdata,
-                                          sizeof(setFixRatesCmd)))
-                {
-                    ret = -EFAULT;
-                } else {
-                    returnStatus = wmi_set_fixrates_cmd(ar->arWmi, setFixRatesCmd.fixRateMask);
-                    if (returnStatus == A_EINVAL) {
-                        ret = -EINVAL;
-                    } else if(returnStatus != 0) {
-                        ret = -EIO;
-                    } else {
-                        ar->ap_profile_flag = 1; /* There is a change in profile */
-                    }
-                }
-            break;
-        }
-
-        case AR6000_XIOCTL_WMI_GETFIXRATES:
-        {
-            WMI_FIX_RATES_CMD getFixRatesCmd;
-            struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-            int ret = 0;
-
-            if (ar->bIsDestroyProgress) {
-                ret = -EBUSY;
-                goto ioctl_done;
-            }
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-                goto ioctl_done;
-            }
-
-            if (down_interruptible(&ar->arSem)) {
-                ret = -ERESTARTSYS;
-                goto ioctl_done;
-            }
-            if (ar->bIsDestroyProgress) {
-                up(&ar->arSem);
-                ret = -EBUSY;
-                goto ioctl_done;
-            }
-            /* Used copy_from_user/copy_to_user to access user space data */
-            if (copy_from_user(&getFixRatesCmd, userdata, sizeof(getFixRatesCmd))) {
-                ret = -EFAULT;
-            } else {
-                ar->arRateMask = 0xFFFFFFFF;
-
-                if (wmi_get_ratemask_cmd(ar->arWmi) != 0) {
-                    up(&ar->arSem);
-                    ret = -EIO;
-                    goto ioctl_done;
-                }
-
-                wait_event_interruptible_timeout(arEvent, ar->arRateMask != 0xFFFFFFFF, wmitimeout * HZ);
-
-                if (signal_pending(current)) {
-                    ret = -EINTR;
-                }
-
-                if (!ret) {
-                    getFixRatesCmd.fixRateMask = ar->arRateMask;
-                }
-
-                if(copy_to_user(userdata, &getFixRatesCmd, sizeof(getFixRatesCmd))) {
-                   ret = -EFAULT;
-                }
-
-                up(&ar->arSem);
-            }
-            break;
-        }
-        case AR6000_XIOCTL_WMI_SET_AUTHMODE:
-        {
-            WMI_SET_AUTH_MODE_CMD setAuthMode;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&setAuthMode, userdata,
-                                      sizeof(setAuthMode)))
-            {
-                ret = -EFAULT;
-            } else {
-                if (wmi_set_authmode_cmd(ar->arWmi, setAuthMode.mode) != 0)
-                {
-                    ret = -EIO;
-                }
-            }
-            break;
-        }
-        case AR6000_XIOCTL_WMI_SET_REASSOCMODE:
-        {
-            WMI_SET_REASSOC_MODE_CMD setReassocMode;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&setReassocMode, userdata,
-                                      sizeof(setReassocMode)))
-            {
-                ret = -EFAULT;
-            } else {
-                if (wmi_set_reassocmode_cmd(ar->arWmi, setReassocMode.mode) != 0)
-                {
-                    ret = -EIO;
-                }
-            }
-            break;
-        }
-        case AR6000_XIOCTL_DIAG_READ:
-        {
-            u32 addr, data;
-	    if (get_user(addr, (unsigned int *)userdata)) {
-		ret = -EFAULT;
-		break;
-	    }
-            addr = TARG_VTOP(ar->arTargetType, addr);
-            if (ar6000_ReadRegDiag(ar->arHifDevice, &addr, &data) != 0) {
-                ret = -EIO;
-            }
-	    if (put_user(data, (unsigned int *)userdata + 1)) {
-		ret = -EFAULT;
-		break;
-	    }
-            break;
-        }
-        case AR6000_XIOCTL_DIAG_WRITE:
-        {
-            u32 addr, data;
-	    if (get_user(addr, (unsigned int *)userdata) ||
-		get_user(data, (unsigned int *)userdata + 1)) {
-		ret = -EFAULT;
-		break;
-	    }
-            addr = TARG_VTOP(ar->arTargetType, addr);
-            if (ar6000_WriteRegDiag(ar->arHifDevice, &addr, &data) != 0) {
-                ret = -EIO;
-            }
-            break;
-        }
-        case AR6000_XIOCTL_WMI_SET_KEEPALIVE:
-        {
-             WMI_SET_KEEPALIVE_CMD setKeepAlive;
-             if (ar->arWmiReady == false) {
-                 ret = -EIO;
-                 goto ioctl_done;
-             } else if (copy_from_user(&setKeepAlive, userdata,
-                        sizeof(setKeepAlive))){
-                 ret = -EFAULT;
-             } else {
-                 if (wmi_set_keepalive_cmd(ar->arWmi, setKeepAlive.keepaliveInterval) != 0) {
-                     ret = -EIO;
-               }
-             }
-             break;
-        }
-        case AR6000_XIOCTL_WMI_SET_PARAMS:
-        {
-             WMI_SET_PARAMS_CMD cmd;
-             if (ar->arWmiReady == false) {
-                 ret = -EIO;
-                 goto ioctl_done;
-             } else if (copy_from_user(&cmd, userdata,
-                        sizeof(cmd))){
-                 ret = -EFAULT;
-             } else if (copy_from_user(&cmd, userdata,
-                        sizeof(cmd) + cmd.length))
-            {
-                ret = -EFAULT;
-            } else {
-                 if (wmi_set_params_cmd(ar->arWmi, cmd.opcode, cmd.length, cmd.buffer) != 0) {
-                     ret = -EIO;
-               }
-             }
-             break;
-        }
-        case AR6000_XIOCTL_WMI_SET_MCAST_FILTER:
-        {
-             WMI_SET_MCAST_FILTER_CMD cmd;
-             if (ar->arWmiReady == false) {
-                 ret = -EIO;
-                 goto ioctl_done;
-             } else if (copy_from_user(&cmd, userdata,
-                        sizeof(cmd))){
-                 ret = -EFAULT;
-             } else {
-                 if (wmi_set_mcast_filter_cmd(ar->arWmi, cmd.multicast_mac[0],
-                                                                                     cmd.multicast_mac[1],
-                                                                                     cmd.multicast_mac[2],
-                                                                                     cmd.multicast_mac[3]) != 0) {
-                     ret = -EIO;
-               }
-             }
-             break;
-        }
-        case AR6000_XIOCTL_WMI_DEL_MCAST_FILTER:
-        {
-             WMI_SET_MCAST_FILTER_CMD cmd;
-             if (ar->arWmiReady == false) {
-                 ret = -EIO;
-                 goto ioctl_done;
-             } else if (copy_from_user(&cmd, userdata,
-                        sizeof(cmd))){
-                 ret = -EFAULT;
-             } else {
-                 if (wmi_del_mcast_filter_cmd(ar->arWmi, cmd.multicast_mac[0],
-                                                                                     cmd.multicast_mac[1],
-                                                                                     cmd.multicast_mac[2],
-                                                                                     cmd.multicast_mac[3]) != 0) {
-                     ret = -EIO;
-               }
-             }
-             break;
-        }
-        case AR6000_XIOCTL_WMI_MCAST_FILTER:
-        {
-             WMI_MCAST_FILTER_CMD cmd;
-             if (ar->arWmiReady == false) {
-                 ret = -EIO;
-                 goto ioctl_done;
-             } else if (copy_from_user(&cmd, userdata,
-                        sizeof(cmd))){
-                 ret = -EFAULT;
-             } else {
-                 if (wmi_mcast_filter_cmd(ar->arWmi, cmd.enable)  != 0) {
-                     ret = -EIO;
-               }
-             }
-             break;
-        }
-        case AR6000_XIOCTL_WMI_GET_KEEPALIVE:
-        {
-            struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-            WMI_GET_KEEPALIVE_CMD getKeepAlive;
-            int ret = 0;
-            if (ar->bIsDestroyProgress) {
-                ret =-EBUSY;
-                goto ioctl_done;
-            }
-            if (ar->arWmiReady == false) {
-               ret = -EIO;
-               goto ioctl_done;
-            }
-            if (down_interruptible(&ar->arSem)) {
-                ret = -ERESTARTSYS;
-                goto ioctl_done;
-            }
-            if (ar->bIsDestroyProgress) {
-                up(&ar->arSem);
-                ret = -EBUSY;
-                goto ioctl_done;
-            }
-            if (copy_from_user(&getKeepAlive, userdata,sizeof(getKeepAlive))) {
-               ret = -EFAULT;
-            } else {
-            getKeepAlive.keepaliveInterval = wmi_get_keepalive_cmd(ar->arWmi);
-            ar->arKeepaliveConfigured = 0xFF;
-            if (wmi_get_keepalive_configured(ar->arWmi) != 0){
-                up(&ar->arSem);
-                ret = -EIO;
-                goto ioctl_done;
-            }
-            wait_event_interruptible_timeout(arEvent, ar->arKeepaliveConfigured != 0xFF, wmitimeout * HZ);
-            if (signal_pending(current)) {
-                ret = -EINTR;
-            }
-
-            if (!ret) {
-                getKeepAlive.configured = ar->arKeepaliveConfigured;
-            }
-            if (copy_to_user(userdata, &getKeepAlive, sizeof(getKeepAlive))) {
-               ret = -EFAULT;
-            }
-            up(&ar->arSem);
-            }
-            break;
-        }
-        case AR6000_XIOCTL_WMI_SET_APPIE:
-        {
-            WMI_SET_APPIE_CMD appIEcmd;
-            u8 appIeInfo[IEEE80211_APPIE_FRAME_MAX_LEN];
-            u32 fType,ieLen;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-                goto ioctl_done;
-            }
-	    if (get_user(fType, (u32 *)userdata)) {
-		ret = -EFAULT;
-		break;
-	    }
-            appIEcmd.mgmtFrmType = fType;
-            if (appIEcmd.mgmtFrmType >= IEEE80211_APPIE_NUM_OF_FRAME) {
-                ret = -EIO;
-            } else {
-		if (get_user(ieLen, (u32 *)(userdata + 4))) {
-		    ret = -EFAULT;
-		    break;
-		}
-                appIEcmd.ieLen = ieLen;
-                A_PRINTF("WPSIE: Type-%d, Len-%d\n",appIEcmd.mgmtFrmType, appIEcmd.ieLen);
-                if (appIEcmd.ieLen > IEEE80211_APPIE_FRAME_MAX_LEN) {
-                    ret = -EIO;
-                    break;
-                }
-                if (copy_from_user(appIeInfo, userdata + 8, appIEcmd.ieLen)) {
-                    ret = -EFAULT;
-                } else {
-                    if (wmi_set_appie_cmd(ar->arWmi, appIEcmd.mgmtFrmType,
-                                          appIEcmd.ieLen,  appIeInfo) != 0)
-                    {
-                        ret = -EIO;
-                    }
-                }
-            }
-            break;
-        }
-        case AR6000_XIOCTL_WMI_SET_MGMT_FRM_RX_FILTER:
-        {
-            WMI_BSS_FILTER_CMD cmd;
-            u32 filterType;
-
-            if (copy_from_user(&filterType, userdata, sizeof(u32)))
-            {
-                ret = -EFAULT;
-                goto ioctl_done;
-            }
-            if (filterType & (IEEE80211_FILTER_TYPE_BEACON |
-                                    IEEE80211_FILTER_TYPE_PROBE_RESP))
-            {
-                cmd.bssFilter = ALL_BSS_FILTER;
-            } else {
-                cmd.bssFilter = NONE_BSS_FILTER;
-            }
-            if (wmi_bssfilter_cmd(ar->arWmi, cmd.bssFilter, 0) != 0) {
-                ret = -EIO;
-            } else {
-                ar->arUserBssFilter = cmd.bssFilter;
-            }
-
-            AR6000_SPIN_LOCK(&ar->arLock, 0);
-            ar->arMgmtFilter = filterType;
-            AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-            break;
-        }
-        case AR6000_XIOCTL_WMI_SET_WSC_STATUS:
-        {
-            u32 wsc_status;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-                goto ioctl_done;
-            } else if (copy_from_user(&wsc_status, userdata, sizeof(u32)))
-            {
-                ret = -EFAULT;
-                goto ioctl_done;
-            }
-            if (wmi_set_wsc_status_cmd(ar->arWmi, wsc_status) != 0) {
-                ret = -EIO;
-            }
-            break;
-        }
-        case AR6000_XIOCTL_BMI_ROMPATCH_INSTALL:
-        {
-            u32 ROM_addr;
-            u32 RAM_addr;
-            u32 nbytes;
-            u32 do_activate;
-            u32 rompatch_id;
-
-	    if (get_user(ROM_addr, (u32 *)userdata) ||
-		get_user(RAM_addr, (u32 *)userdata + 1) ||
-		get_user(nbytes, (u32 *)userdata + 2) ||
-		get_user(do_activate, (u32 *)userdata + 3)) {
-		ret = -EFAULT;
-		break;
-	    }
-            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Install rompatch from ROM: 0x%x to RAM: 0x%x  length: %d\n",
-                             ROM_addr, RAM_addr, nbytes));
-            ret = BMIrompatchInstall(hifDevice, ROM_addr, RAM_addr,
-                                        nbytes, do_activate, &rompatch_id);
-            if (ret == 0) {
-		/* return value */
-		if (put_user(rompatch_id, (unsigned int *)rq->ifr_data)) {
-		    ret = -EFAULT;
-		    break;
-		}
-            }
-            break;
-        }
-
-        case AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL:
-        {
-            u32 rompatch_id;
-
-	    if (get_user(rompatch_id, (u32 *)userdata)) {
-		ret = -EFAULT;
-		break;
-	    }
-            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("UNinstall rompatch_id %d\n", rompatch_id));
-            ret = BMIrompatchUninstall(hifDevice, rompatch_id);
-            break;
-        }
-
-        case AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE:
-        case AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE:
-        {
-            u32 rompatch_count;
-
-	    if (get_user(rompatch_count, (u32 *)userdata)) {
-		ret = -EFAULT;
-		break;
-	    }
-            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Change rompatch activation count=%d\n", rompatch_count));
-            length = sizeof(u32) * rompatch_count;
-            if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
-                A_MEMZERO(buffer, length);
-                if (copy_from_user(buffer, &userdata[sizeof(rompatch_count)], length))
-                {
-                    ret = -EFAULT;
-                } else {
-                    if (cmd == AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE) {
-                        ret = BMIrompatchActivate(hifDevice, rompatch_count, (u32 *)buffer);
-                    } else {
-                        ret = BMIrompatchDeactivate(hifDevice, rompatch_count, (u32 *)buffer);
-                    }
-                }
-                A_FREE(buffer);
-            } else {
-                ret = -ENOMEM;
-            }
-
-            break;
-        }
-        case AR6000_XIOCTL_SET_IP:
-        {
-            WMI_SET_IP_CMD setIP;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&setIP, userdata,
-                                      sizeof(setIP)))
-            {
-                ret = -EFAULT;
-            } else {
-                if (wmi_set_ip_cmd(ar->arWmi,
-                                &setIP) != 0)
-                {
-                    ret = -EIO;
-                }
-            }
-            break;
-        }
-
-        case AR6000_XIOCTL_WMI_SET_HOST_SLEEP_MODE:
-        {
-            WMI_SET_HOST_SLEEP_MODE_CMD setHostSleepMode;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&setHostSleepMode, userdata,
-                                      sizeof(setHostSleepMode)))
-            {
-                ret = -EFAULT;
-            } else {
-                if (wmi_set_host_sleep_mode_cmd(ar->arWmi,
-                                &setHostSleepMode) != 0)
-                {
-                    ret = -EIO;
-                }
-            }
-            break;
-        }
-        case AR6000_XIOCTL_WMI_SET_WOW_MODE:
-        {
-            WMI_SET_WOW_MODE_CMD setWowMode;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&setWowMode, userdata,
-                                      sizeof(setWowMode)))
-            {
-                ret = -EFAULT;
-            } else {
-                if (wmi_set_wow_mode_cmd(ar->arWmi,
-                                &setWowMode) != 0)
-                {
-                    ret = -EIO;
-                }
-            }
-            break;
-        }
-        case AR6000_XIOCTL_WMI_GET_WOW_LIST:
-        {
-            WMI_GET_WOW_LIST_CMD getWowList;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&getWowList, userdata,
-                                      sizeof(getWowList)))
-            {
-                ret = -EFAULT;
-            } else {
-                if (wmi_get_wow_list_cmd(ar->arWmi,
-                                &getWowList) != 0)
-                {
-                    ret = -EIO;
-                }
-            }
-            break;
-        }
-        case AR6000_XIOCTL_WMI_ADD_WOW_PATTERN:
-        {
-#define WOW_PATTERN_SIZE 64
-#define WOW_MASK_SIZE 64
-
-            WMI_ADD_WOW_PATTERN_CMD cmd;
-            u8 mask_data[WOW_PATTERN_SIZE]={0};
-            u8 pattern_data[WOW_PATTERN_SIZE]={0};
-
-            do {
-                if (ar->arWmiReady == false) {
-                    ret = -EIO;
-                    break;        
-                } 
-                if(copy_from_user(&cmd, userdata,
-                            sizeof(WMI_ADD_WOW_PATTERN_CMD))) 
-                {
-                    ret = -EFAULT;
-                    break;        
-                }
-                if (copy_from_user(pattern_data,
-                                      userdata + 3,
-                                      cmd.filter_size)) 
-                {
-                    ret = -EFAULT;
-                    break;        
-                }
-                if (copy_from_user(mask_data,
-                                  (userdata + 3 + cmd.filter_size),
-                                  cmd.filter_size))
-                {
-                    ret = -EFAULT;
-                    break;
-                }
-                if (wmi_add_wow_pattern_cmd(ar->arWmi,
-                            &cmd, pattern_data, mask_data, cmd.filter_size) != 0)
-                {
-                    ret = -EIO;
-                }
-            } while(false);
-#undef WOW_PATTERN_SIZE
-#undef WOW_MASK_SIZE
-            break;
-        }
-        case AR6000_XIOCTL_WMI_DEL_WOW_PATTERN:
-        {
-            WMI_DEL_WOW_PATTERN_CMD delWowPattern;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&delWowPattern, userdata,
-                                      sizeof(delWowPattern)))
-            {
-                ret = -EFAULT;
-            } else {
-                if (wmi_del_wow_pattern_cmd(ar->arWmi,
-                                &delWowPattern) != 0)
-                {
-                    ret = -EIO;
-                }
-            }
-            break;
-        }
-        case AR6000_XIOCTL_DUMP_HTC_CREDIT_STATE:
-            if (ar->arHtcTarget != NULL) {
-#ifdef ATH_DEBUG_MODULE
-                HTCDumpCreditStates(ar->arHtcTarget);
-#endif /* ATH_DEBUG_MODULE */
-#ifdef HTC_EP_STAT_PROFILING
-                {
-                    struct htc_endpoint_stats stats;
-                    int i;
-
-                    for (i = 0; i < 5; i++) {
-                        if (HTCGetEndpointStatistics(ar->arHtcTarget,
-                                                     i,
-                                                     HTC_EP_STAT_SAMPLE_AND_CLEAR,
-                                                     &stats)) {
-                            A_PRINTF(KERN_ALERT"------- Profiling Endpoint : %d \n", i);
-                            A_PRINTF(KERN_ALERT"TxCreditLowIndications : %d \n", stats.TxCreditLowIndications);
-                            A_PRINTF(KERN_ALERT"TxIssued : %d \n", stats.TxIssued);
-                            A_PRINTF(KERN_ALERT"TxDropped: %d \n", stats.TxDropped);
-                            A_PRINTF(KERN_ALERT"TxPacketsBundled : %d \n", stats.TxPacketsBundled);
-                            A_PRINTF(KERN_ALERT"TxBundles : %d \n", stats.TxBundles);
-                            A_PRINTF(KERN_ALERT"TxCreditRpts : %d \n", stats.TxCreditRpts);
-                            A_PRINTF(KERN_ALERT"TxCreditsRptsFromRx : %d \n", stats.TxCreditRptsFromRx);
-                            A_PRINTF(KERN_ALERT"TxCreditsRptsFromOther : %d \n", stats.TxCreditRptsFromOther);
-                            A_PRINTF(KERN_ALERT"TxCreditsRptsFromEp0 : %d \n", stats.TxCreditRptsFromEp0);
-                            A_PRINTF(KERN_ALERT"TxCreditsFromRx : %d \n", stats.TxCreditsFromRx);
-                            A_PRINTF(KERN_ALERT"TxCreditsFromOther : %d \n", stats.TxCreditsFromOther);
-                            A_PRINTF(KERN_ALERT"TxCreditsFromEp0 : %d \n", stats.TxCreditsFromEp0);
-                            A_PRINTF(KERN_ALERT"TxCreditsConsummed : %d \n", stats.TxCreditsConsummed);
-                            A_PRINTF(KERN_ALERT"TxCreditsReturned : %d \n", stats.TxCreditsReturned);
-                            A_PRINTF(KERN_ALERT"RxReceived : %d \n", stats.RxReceived);
-                            A_PRINTF(KERN_ALERT"RxPacketsBundled : %d \n", stats.RxPacketsBundled);
-                            A_PRINTF(KERN_ALERT"RxLookAheads : %d \n", stats.RxLookAheads);
-                            A_PRINTF(KERN_ALERT"RxBundleLookAheads : %d \n", stats.RxBundleLookAheads);
-                            A_PRINTF(KERN_ALERT"RxBundleIndFromHdr : %d \n", stats.RxBundleIndFromHdr);
-                            A_PRINTF(KERN_ALERT"RxAllocThreshHit : %d \n", stats.RxAllocThreshHit);
-                            A_PRINTF(KERN_ALERT"RxAllocThreshBytes : %d \n", stats.RxAllocThreshBytes);
-                            A_PRINTF(KERN_ALERT"---- \n");
-
-                        }
-            }
-                }
-#endif
-            }
-            break;
-        case AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE:
-            if (ar->arHtcTarget != NULL) {
-                struct ar6000_traffic_activity_change data;
-
-                if (copy_from_user(&data, userdata, sizeof(data)))
-                {
-                    ret = -EFAULT;
-                    goto ioctl_done;
-                }
-                    /* note, this is used for testing (mbox ping testing), indicate activity
-                     * change using the stream ID as the traffic class */
-                ar6000_indicate_tx_activity(ar,
-                                            (u8)data.StreamID,
-                                            data.Active ? true : false);
-            }
-            break;
-        case AR6000_XIOCTL_WMI_SET_CONNECT_CTRL_FLAGS:
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&connectCtrlFlags, userdata,
-                                      sizeof(connectCtrlFlags)))
-            {
-                ret = -EFAULT;
-            } else {
-                ar->arConnectCtrlFlags = connectCtrlFlags;
-            }
-            break;
-        case AR6000_XIOCTL_WMI_SET_AKMP_PARAMS:
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&akmpParams, userdata,
-                                      sizeof(WMI_SET_AKMP_PARAMS_CMD)))
-            {
-                ret = -EFAULT;
-            } else {
-                if (wmi_set_akmp_params_cmd(ar->arWmi, &akmpParams) != 0) {
-                    ret = -EIO;
-                }
-            }
-            break;
-        case AR6000_XIOCTL_WMI_SET_PMKID_LIST:
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else {
-                if (copy_from_user(&pmkidInfo.numPMKID, userdata,
-                                      sizeof(pmkidInfo.numPMKID)))
-                {
-                    ret = -EFAULT;
-                    break;
-                }
-                if (copy_from_user(&pmkidInfo.pmkidList,
-                                   userdata + sizeof(pmkidInfo.numPMKID),
-                                   pmkidInfo.numPMKID * sizeof(WMI_PMKID)))
-                {
-                    ret = -EFAULT;
-                    break;
-                }
-                if (wmi_set_pmkid_list_cmd(ar->arWmi, &pmkidInfo) != 0) {
-                    ret = -EIO;
-                }
-            }
-            break;
-        case AR6000_XIOCTL_WMI_GET_PMKID_LIST:
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else  {
-                if (wmi_get_pmkid_list_cmd(ar->arWmi) != 0) {
-                    ret = -EIO;
-                }
-            }
-            break;
-        case AR6000_XIOCTL_WMI_ABORT_SCAN:
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            }
-            ret = wmi_abort_scan_cmd(ar->arWmi);
-            break;
-        case AR6000_XIOCTL_AP_HIDDEN_SSID:
-        {
-            u8 hidden_ssid;
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&hidden_ssid, userdata, sizeof(hidden_ssid))) {
-                ret = -EFAULT;
-            } else {
-                wmi_ap_set_hidden_ssid(ar->arWmi, hidden_ssid);
-                ar->ap_hidden_ssid = hidden_ssid;
-                ar->ap_profile_flag = 1; /* There is a change in profile */
-            }
-            break;
-        }
-        case AR6000_XIOCTL_AP_GET_STA_LIST:
-        {
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else {
-                u8 i;
-                ap_get_sta_t temp;
-                A_MEMZERO(&temp, sizeof(temp));
-                for(i=0;i<AP_MAX_NUM_STA;i++) {
-                    memcpy(temp.sta[i].mac, ar->sta_list[i].mac, ATH_MAC_LEN);
-                    temp.sta[i].aid = ar->sta_list[i].aid;
-                    temp.sta[i].keymgmt = ar->sta_list[i].keymgmt;
-                    temp.sta[i].ucipher = ar->sta_list[i].ucipher;
-                    temp.sta[i].auth = ar->sta_list[i].auth;
-                }
-                if(copy_to_user((ap_get_sta_t *)rq->ifr_data, &temp,
-                                 sizeof(ar->sta_list))) {
-                    ret = -EFAULT;
-                }
-            }
-            break;
-        }
-        case AR6000_XIOCTL_AP_SET_NUM_STA:
-        {
-            u8 num_sta;
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&num_sta, userdata, sizeof(num_sta))) {
-                ret = -EFAULT;
-            } else if(num_sta > AP_MAX_NUM_STA) {
-                /* value out of range */
-                ret = -EINVAL;
-            } else {
-                wmi_ap_set_num_sta(ar->arWmi, num_sta);
-            }
-            break;
-        }
-        case AR6000_XIOCTL_AP_SET_ACL_POLICY:
-        {
-            u8 policy;
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&policy, userdata, sizeof(policy))) {
-                ret = -EFAULT;
-            } else if(policy == ar->g_acl.policy) {
-                /* No change in policy */
-            } else {
-                if(!(policy & AP_ACL_RETAIN_LIST_MASK)) {
-                    /* clear ACL list */
-                    memset(&ar->g_acl,0,sizeof(WMI_AP_ACL));
-                }
-                ar->g_acl.policy = policy;
-                wmi_ap_set_acl_policy(ar->arWmi, policy);
-            }
-            break;
-        }
-        case AR6000_XIOCTL_AP_SET_ACL_MAC:
-        {
-            WMI_AP_ACL_MAC_CMD    acl;
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&acl, userdata, sizeof(acl))) {
-                ret = -EFAULT;
-            } else {
-                if(acl_add_del_mac(&ar->g_acl, &acl)) {
-                    wmi_ap_acl_mac_list(ar->arWmi, &acl);
-                } else {
-                    A_PRINTF("ACL list error\n");
-                    ret = -EIO;
-                }
-            }
-            break;
-        }
-        case AR6000_XIOCTL_AP_GET_ACL_LIST:
-        {
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if(copy_to_user((WMI_AP_ACL *)rq->ifr_data, &ar->g_acl,
-                                 sizeof(WMI_AP_ACL))) {
-                    ret = -EFAULT;
-            }
-            break;
-        }
-        case AR6000_XIOCTL_AP_COMMIT_CONFIG:
-        {
-            ret = ar6000_ap_mode_profile_commit(ar);
-            break;
-        }
-        case IEEE80211_IOCTL_GETWPAIE:
-        {
-            struct ieee80211req_wpaie wpaie;
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&wpaie, userdata, sizeof(wpaie))) {
-                ret = -EFAULT;
-            } else if (ar6000_ap_mode_get_wpa_ie(ar, &wpaie)) {
-                ret = -EFAULT;
-            } else if(copy_to_user(userdata, &wpaie, sizeof(wpaie))) {
-                ret = -EFAULT;
-            }
-            break;
-        }
-        case AR6000_XIOCTL_AP_CONN_INACT_TIME:
-        {
-            u32 period;
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&period, userdata, sizeof(period))) {
-                ret = -EFAULT;
-            } else {
-                wmi_ap_conn_inact_time(ar->arWmi, period);
-            }
-            break;
-        }
-        case AR6000_XIOCTL_AP_PROT_SCAN_TIME:
-        {
-            WMI_AP_PROT_SCAN_TIME_CMD  bgscan;
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&bgscan, userdata, sizeof(bgscan))) {
-                ret = -EFAULT;
-            } else {
-                wmi_ap_bgscan_time(ar->arWmi, bgscan.period_min, bgscan.dwell_ms);
-            }
-            break;
-        }
-        case AR6000_XIOCTL_AP_SET_COUNTRY:
-        {
-            ret = ar6000_ioctl_set_country(dev, rq);
-            break;
-        }
-        case AR6000_XIOCTL_AP_SET_DTIM:
-        {
-            WMI_AP_SET_DTIM_CMD  d;
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&d, userdata, sizeof(d))) {
-                ret = -EFAULT;
-            } else {
-                if(d.dtim > 0 && d.dtim < 11) {
-                    ar->ap_dtim_period = d.dtim;
-                    wmi_ap_set_dtim(ar->arWmi, d.dtim);
-                    ar->ap_profile_flag = 1; /* There is a change in profile */
-                } else {
-                    A_PRINTF("DTIM out of range. Valid range is [1-10]\n");
-                    ret = -EIO;
-                }
-            }
-            break;
-        }
-        case AR6000_XIOCTL_WMI_TARGET_EVENT_REPORT:
-        {
-            WMI_SET_TARGET_EVENT_REPORT_CMD evtCfgCmd;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            }
-            if (copy_from_user(&evtCfgCmd, userdata,
-                               sizeof(evtCfgCmd))) {
-                ret = -EFAULT;
-                break;
-            }
-            ret = wmi_set_target_event_report_cmd(ar->arWmi, &evtCfgCmd);
-            break;
-        }
-        case AR6000_XIOCTL_AP_INTRA_BSS_COMM:
-        {
-            u8 intra=0;
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&intra, userdata, sizeof(intra))) {
-                ret = -EFAULT;
-            } else {
-                ar->intra_bss = (intra?1:0);
-            }
-            break;
-        }
-        case AR6000_XIOCTL_DUMP_MODULE_DEBUG_INFO:
-        {
-            struct drv_debug_module_s moduleinfo;
-
-            if (copy_from_user(&moduleinfo, userdata, sizeof(moduleinfo))) {
-                ret = -EFAULT;
-                break;
-            }
-
-            a_dump_module_debug_info_by_name(moduleinfo.modulename);
-            ret = 0;
-            break;
-        }
-        case AR6000_XIOCTL_MODULE_DEBUG_SET_MASK:
-        {
-            struct drv_debug_module_s moduleinfo;
-
-            if (copy_from_user(&moduleinfo, userdata, sizeof(moduleinfo))) {
-                ret = -EFAULT;
-                break;
-            }
-
-            if (a_set_module_mask(moduleinfo.modulename, moduleinfo.mask)) {
-                ret = -EFAULT;
-            }
-
-            break;
-        }
-        case AR6000_XIOCTL_MODULE_DEBUG_GET_MASK:
-        {
-            struct drv_debug_module_s moduleinfo;
-
-            if (copy_from_user(&moduleinfo, userdata, sizeof(moduleinfo))) {
-                ret = -EFAULT;
-                break;
-            }
-
-            if (a_get_module_mask(moduleinfo.modulename, &moduleinfo.mask)) {
-                ret = -EFAULT;
-                break;
-            }
-
-            if (copy_to_user(userdata, &moduleinfo, sizeof(moduleinfo))) {
-                ret = -EFAULT;
-                break;
-            }
-
-            break;
-        }
-#ifdef ATH_AR6K_11N_SUPPORT
-        case AR6000_XIOCTL_DUMP_RCV_AGGR_STATS:
-        {
-            PACKET_LOG *copy_of_pkt_log;
-
-            aggr_dump_stats(ar->aggr_cntxt, &copy_of_pkt_log);
-            if (copy_to_user(rq->ifr_data, copy_of_pkt_log, sizeof(PACKET_LOG))) {
-                ret = -EFAULT;
-            }
-            break;
-        }
-        case AR6000_XIOCTL_SETUP_AGGR:
-        {
-            WMI_ADDBA_REQ_CMD cmd;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-                ret = -EFAULT;
-            } else {
-                wmi_setup_aggr_cmd(ar->arWmi, cmd.tid);
-            }
-        }
-        break;
-
-        case AR6000_XIOCTL_DELE_AGGR:
-        {
-            WMI_DELBA_REQ_CMD cmd;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-                ret = -EFAULT;
-            } else {
-                wmi_delete_aggr_cmd(ar->arWmi, cmd.tid, cmd.is_sender_initiator);
-            }
-        }
-        break;
-
-        case AR6000_XIOCTL_ALLOW_AGGR:
-        {
-            WMI_ALLOW_AGGR_CMD cmd;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-                ret = -EFAULT;
-            } else {
-                wmi_allow_aggr_cmd(ar->arWmi, cmd.tx_allow_aggr, cmd.rx_allow_aggr);
-            }
-        }
-        break;
-
-        case AR6000_XIOCTL_SET_HT_CAP:
-        {
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&htCap, userdata,
-                                      sizeof(htCap)))
-            {
-                ret = -EFAULT;
-            } else {
-
-                if (wmi_set_ht_cap_cmd(ar->arWmi, &htCap) != 0)
-                {
-                    ret = -EIO;
-                }
-            }
-            break;
-        }
-        case AR6000_XIOCTL_SET_HT_OP:
-        {
-             if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&htOp, userdata,
-                                      sizeof(htOp)))
-            {
-                 ret = -EFAULT;
-             } else {
-
-                if (wmi_set_ht_op_cmd(ar->arWmi, htOp.sta_chan_width) != 0)
-                {
-                     ret = -EIO;
-               }
-             }
-             break;
-        }
-#endif
-        case AR6000_XIOCTL_ACL_DATA:
-        {
-            void *osbuf = NULL;
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (ar6000_create_acl_data_osbuf(dev, (u8 *)userdata, &osbuf) != 0) {
-                     ret = -EIO;
-            } else {
-                if (wmi_data_hdr_add(ar->arWmi, osbuf, DATA_MSGTYPE, 0, WMI_DATA_HDR_DATA_TYPE_ACL,0,NULL) != 0) {
-                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("XIOCTL_ACL_DATA - wmi_data_hdr_add failed\n"));
-                } else {
-                    /* Send data buffer over HTC */
-                    ar6000_acl_data_tx(osbuf, ar->arNetDev);
-                }
-            }
-            break;
-        }
-        case AR6000_XIOCTL_HCI_CMD:
-        {
-            char tmp_buf[512];
-            s8 i;
-            WMI_HCI_CMD *cmd = (WMI_HCI_CMD *)tmp_buf;
-            u8 size;
-
-            size = sizeof(cmd->cmd_buf_sz);
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(cmd, userdata, size)) {
-                 ret = -EFAULT;
-            } else if(copy_from_user(cmd->buf, userdata + size, cmd->cmd_buf_sz)) {
-                    ret = -EFAULT;
-            } else {
-                if (wmi_send_hci_cmd(ar->arWmi, cmd->buf, cmd->cmd_buf_sz) != 0) {
-                     ret = -EIO;
-                }else if(loghci) {
-                    A_PRINTF_LOG("HCI Command To PAL --> \n");
-                    for(i = 0; i < cmd->cmd_buf_sz; i++) {
-                        A_PRINTF_LOG("0x%02x ",cmd->buf[i]);
-                        if((i % 10) == 0) {
-                            A_PRINTF_LOG("\n");
-                        }
-                    }
-                    A_PRINTF_LOG("\n");
-                    A_PRINTF_LOG("==================================\n");
-                }
-            }
-            break;
-        }
-        case AR6000_XIOCTL_WLAN_CONN_PRECEDENCE:
-        {
-            WMI_SET_BT_WLAN_CONN_PRECEDENCE cmd;
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-                ret = -EFAULT;
-            } else {
-                if (cmd.precedence == BT_WLAN_CONN_PRECDENCE_WLAN ||
-                            cmd.precedence == BT_WLAN_CONN_PRECDENCE_PAL) {
-                    if ( wmi_set_wlan_conn_precedence_cmd(ar->arWmi, cmd.precedence) != 0) {
-                        ret = -EIO;
-                    }
-                } else {
-                    ret = -EINVAL;
-                }
-            }
-            break;
-        }
-        case AR6000_XIOCTL_AP_GET_STAT:
-        {
-            ret = ar6000_ioctl_get_ap_stats(dev, rq);
-            break;
-        }
-        case AR6000_XIOCTL_SET_TX_SELECT_RATES:
-        {
-            WMI_SET_TX_SELECT_RATES_CMD masks;
-
-             if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&masks, userdata,
-                                      sizeof(masks)))
-            {
-                 ret = -EFAULT;
-             } else {
-
-                if (wmi_set_tx_select_rates_cmd(ar->arWmi, masks.rateMasks) != 0)
-                {
-                     ret = -EIO;
-               }
-             }
-             break;
-        }
-        case AR6000_XIOCTL_AP_GET_HIDDEN_SSID:
-        {
-            WMI_AP_HIDDEN_SSID_CMD ssid;
-            ssid.hidden_ssid = ar->ap_hidden_ssid;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if(copy_to_user((WMI_AP_HIDDEN_SSID_CMD *)rq->ifr_data,
-                                    &ssid, sizeof(WMI_AP_HIDDEN_SSID_CMD))) {
-                    ret = -EFAULT;
-            }
-            break;
-        }
-        case AR6000_XIOCTL_AP_GET_COUNTRY:
-        {
-            WMI_AP_SET_COUNTRY_CMD cty;
-            memcpy(cty.countryCode, ar->ap_country_code, 3);
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if(copy_to_user((WMI_AP_SET_COUNTRY_CMD *)rq->ifr_data,
-                                    &cty, sizeof(WMI_AP_SET_COUNTRY_CMD))) {
-                    ret = -EFAULT;
-            }
-            break;
-        }
-        case AR6000_XIOCTL_AP_GET_WMODE:
-        {
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if(copy_to_user((u8 *)rq->ifr_data,
-                                    &ar->ap_wmode, sizeof(u8))) {
-                    ret = -EFAULT;
-            }
-            break;
-        }
-        case AR6000_XIOCTL_AP_GET_DTIM:
-        {
-            WMI_AP_SET_DTIM_CMD dtim;
-            dtim.dtim = ar->ap_dtim_period;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if(copy_to_user((WMI_AP_SET_DTIM_CMD *)rq->ifr_data,
-                                    &dtim, sizeof(WMI_AP_SET_DTIM_CMD))) {
-                    ret = -EFAULT;
-            }
-            break;
-        }
-        case AR6000_XIOCTL_AP_GET_BINTVL:
-        {
-            WMI_BEACON_INT_CMD bi;
-            bi.beaconInterval = ar->ap_beacon_interval;
-
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if(copy_to_user((WMI_BEACON_INT_CMD *)rq->ifr_data,
-                                    &bi, sizeof(WMI_BEACON_INT_CMD))) {
-                    ret = -EFAULT;
-            }
-            break;
-        }
-        case AR6000_XIOCTL_AP_GET_RTS:
-        {
-            WMI_SET_RTS_CMD rts;
-            rts.threshold = ar->arRTS;
-	     
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if(copy_to_user((WMI_SET_RTS_CMD *)rq->ifr_data,
-                                    &rts, sizeof(WMI_SET_RTS_CMD))) {
-                    ret = -EFAULT;
-            }
-            break;
-        }
-        case AR6000_XIOCTL_FETCH_TARGET_REGS:
-        {
-            u32 targregs[AR6003_FETCH_TARG_REGS_COUNT];
-
-            if (ar->arTargetType == TARGET_TYPE_AR6003) {
-                ar6k_FetchTargetRegs(hifDevice, targregs);
-                if (copy_to_user((u32 *)rq->ifr_data, &targregs, sizeof(targregs)))
-                {
-                    ret = -EFAULT;
-                }
-            } else {
-                ret = -EOPNOTSUPP;
-            }
-            break;
-        }
-        case AR6000_XIOCTL_AP_SET_11BG_RATESET:
-        {
-            WMI_AP_SET_11BG_RATESET_CMD  rate;
-            if (ar->arWmiReady == false) {
-                ret = -EIO;
-            } else if (copy_from_user(&rate, userdata, sizeof(rate))) {
-                ret = -EFAULT;
-            } else {
-                wmi_ap_set_rateset(ar->arWmi, rate.rateset);
-            }
-            break;
-        }
-        case AR6000_XIOCTL_GET_WLAN_SLEEP_STATE:
-        {
-            WMI_REPORT_SLEEP_STATE_EVENT  wmiSleepEvent ;
-
-            if (ar->arWlanState == WLAN_ENABLED) {
-                wmiSleepEvent.sleepState = WMI_REPORT_SLEEP_STATUS_IS_AWAKE;
-            } else {
-                wmiSleepEvent.sleepState = WMI_REPORT_SLEEP_STATUS_IS_DEEP_SLEEP;
-            }
-            rq->ifr_ifru.ifru_ivalue = ar->arWlanState; /* return value */
-
-            ar6000_send_event_to_app(ar, WMI_REPORT_SLEEP_STATE_EVENTID, (u8 *)&wmiSleepEvent,
-                                     sizeof(WMI_REPORT_SLEEP_STATE_EVENTID));
-            break;
-        }
-#ifdef CONFIG_PM
-        case AR6000_XIOCTL_SET_BT_HW_POWER_STATE:
-        {
-            unsigned int state;
-	    if (get_user(state, (unsigned int *)userdata)) {
-		ret = -EFAULT;
-		break;
-	    }
-            if (ar6000_set_bt_hw_state(ar, state)!= 0) {
-                ret = -EIO;
-            }       
-        }
-            break;
-        case AR6000_XIOCTL_GET_BT_HW_POWER_STATE:
-            rq->ifr_ifru.ifru_ivalue = !ar->arBTOff; /* return value */
-            break;
-#endif
-
-        case AR6000_XIOCTL_WMI_SET_TX_SGI_PARAM:
-        {
-             WMI_SET_TX_SGI_PARAM_CMD SGICmd;
-
-             if (ar->arWmiReady == false) {
-                 ret = -EIO;
-             } else if (copy_from_user(&SGICmd, userdata,
-                                       sizeof(SGICmd))){
-                 ret = -EFAULT;
-             } else{
-                     if (wmi_SGI_cmd(ar->arWmi, SGICmd.sgiMask, SGICmd.sgiPERThreshold) != 0) {
-                         ret = -EIO;
-                     }
-
-             }
-             break;
-        }
-
-        case AR6000_XIOCTL_ADD_AP_INTERFACE:
-#ifdef CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT
-        {
-            char ap_ifname[IFNAMSIZ] = {0,};
-            if (copy_from_user(ap_ifname, userdata, IFNAMSIZ)) {
-                ret = -EFAULT;
-            } else {
-                if (ar6000_add_ap_interface(ar, ap_ifname) != 0) {
-                    ret = -EIO;
-                } 
-            }
-        }
-#else
-            ret = -EOPNOTSUPP;
-#endif
-            break;
-        case AR6000_XIOCTL_REMOVE_AP_INTERFACE:
-#ifdef CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT
-            if (ar6000_remove_ap_interface(ar) != 0) {
-                ret = -EIO;
-            } 
-#else
-            ret = -EOPNOTSUPP;
-#endif
-            break;
-
-        case AR6000_XIOCTL_WMI_SET_EXCESS_TX_RETRY_THRES:
-        {
-            ret = ar6000_xioctl_set_excess_tx_retry_thres_cmd(dev, userdata);
-            break;
-        }
-
-        default:
-            ret = -EOPNOTSUPP;
-    }
-
-ioctl_done:
-    rtnl_lock(); /* restore rtnl state */
-    dev_put(dev);
-
-    return ret;
-}
-
-u8 mac_cmp_wild(u8 *mac, u8 *new_mac, u8 wild, u8 new_wild)
-{
-    u8 i;
-
-    for(i=0;i<ATH_MAC_LEN;i++) {
-        if((wild & 1<<i) && (new_wild & 1<<i)) continue;
-        if(mac[i] != new_mac[i]) return 1;
-    }
-    if((memcmp(new_mac, null_mac, 6)==0) && new_wild &&
-        (wild != new_wild)) {
-        return 1;
-    }
-
-    return 0;
-}
-
-u8 acl_add_del_mac(WMI_AP_ACL *a, WMI_AP_ACL_MAC_CMD *acl)
-{
-    s8 already_avail=-1, free_slot=-1, i;
-
-    /* To check whether this mac is already there in our list */
-    for(i=AP_ACL_SIZE-1;i>=0;i--)
-    {
-        if(mac_cmp_wild(a->acl_mac[i], acl->mac, a->wildcard[i],
-            acl->wildcard)==0)
-                already_avail = i;
-
-        if(!((1 << i) & a->index))
-            free_slot = i;
-    }
-
-    if(acl->action == ADD_MAC_ADDR)
-    {
-        /* Dont add mac if it is already available */
-        if((already_avail >= 0) || (free_slot == -1))
-            return 0;
-
-        memcpy(a->acl_mac[free_slot], acl->mac, ATH_MAC_LEN);
-        a->index = a->index | (1 << free_slot);
-        acl->index = free_slot;
-        a->wildcard[free_slot] = acl->wildcard;
-        return 1;
-    }
-    else if(acl->action == DEL_MAC_ADDR)
-    {
-        if(acl->index > AP_ACL_SIZE)
-            return 0;
-
-        if(!(a->index & (1 << acl->index)))
-            return 0;
-
-        A_MEMZERO(a->acl_mac[acl->index],ATH_MAC_LEN);
-        a->index = a->index & ~(1 << acl->index);
-        a->wildcard[acl->index] = 0;
-        return 1;
-    }
-
-    return 0;
-}
diff --git a/drivers/staging/ath6kl/os/linux/wireless_ext.c b/drivers/staging/ath6kl/os/linux/wireless_ext.c
deleted file mode 100644
index 4b77943..0000000
--- a/drivers/staging/ath6kl/os/linux/wireless_ext.c
+++ /dev/null
@@ -1,2723 +0,0 @@
-//------------------------------------------------------------------------------
-// Copyright (c) 2004-2010 Atheros Communications Inc.
-// All rights reserved.
-//
-// 
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-//
-//
-//
-// Author(s): ="Atheros"
-//------------------------------------------------------------------------------
-
-#include "ar6000_drv.h"
-
-#define IWE_STREAM_ADD_EVENT(p1, p2, p3, p4, p5) \
-    iwe_stream_add_event((p1), (p2), (p3), (p4), (p5))
-
-#define IWE_STREAM_ADD_POINT(p1, p2, p3, p4, p5) \
-    iwe_stream_add_point((p1), (p2), (p3), (p4), (p5))
-
-#define IWE_STREAM_ADD_VALUE(p1, p2, p3, p4, p5, p6) \
-    iwe_stream_add_value((p1), (p2), (p3), (p4), (p5), (p6))
-
-static void ar6000_set_quality(struct iw_quality *iq, s8 rssi);
-extern unsigned int wmitimeout;
-extern A_WAITQUEUE_HEAD arEvent;
-
-#if WIRELESS_EXT > 14
-/*
- * Encode a WPA or RSN information element as a custom
- * element using the hostap format.
- */
-static u_int
-encode_ie(void *buf, size_t bufsize,
-    const u_int8_t *ie, size_t ielen,
-    const char *leader, size_t leader_len)
-{
-    u_int8_t *p;
-    int i;
-
-    if (bufsize < leader_len)
-        return 0;
-    p = buf;
-    memcpy(p, leader, leader_len);
-    bufsize -= leader_len;
-    p += leader_len;
-    for (i = 0; i < ielen && bufsize > 2; i++)
-    {
-        p += sprintf((char*)p, "%02x", ie[i]);
-        bufsize -= 2;
-    }
-    return (i == ielen ? p - (u_int8_t *)buf : 0);
-}
-#endif /* WIRELESS_EXT > 14 */
-
-static u8 get_bss_phy_capability(bss_t *bss)
-{
-    u8 capability = 0;
-    struct ieee80211_common_ie *cie = &bss->ni_cie;
-#define CHAN_IS_11A(x)              (!((x >= 2412) && (x <= 2484)))
-    if (CHAN_IS_11A(cie->ie_chan)) {
-        if (cie->ie_htcap) {
-            capability = WMI_11NA_CAPABILITY;
-        } else {
-            capability = WMI_11A_CAPABILITY;
-        }
-    } else if ((cie->ie_erp) || (cie->ie_xrates)) {
-        if (cie->ie_htcap) {
-            capability = WMI_11NG_CAPABILITY;
-        } else {
-            capability = WMI_11G_CAPABILITY;
-        }
-    }
-    return capability;
-}
-
-void
-ar6000_scan_node(void *arg, bss_t *ni)
-{
-    struct iw_event iwe;
-#if WIRELESS_EXT > 14
-    char buf[256];
-#endif
-    struct ar_giwscan_param *param;
-    char *current_ev;
-    char *end_buf;
-    struct ieee80211_common_ie  *cie;
-    char *current_val;
-    s32 j;
-    u32 rate_len, data_len = 0;
-
-    param = (struct ar_giwscan_param *)arg;
-
-    current_ev = param->current_ev;
-    end_buf = param->end_buf;
-
-    cie = &ni->ni_cie;
-
-    if ((end_buf - current_ev) > IW_EV_ADDR_LEN)
-    {
-        A_MEMZERO(&iwe, sizeof(iwe));
-        iwe.cmd = SIOCGIWAP;
-        iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
-        memcpy(iwe.u.ap_addr.sa_data, ni->ni_macaddr, 6);
-        current_ev = IWE_STREAM_ADD_EVENT(param->info, current_ev, end_buf,
-                                          &iwe, IW_EV_ADDR_LEN);
-    }
-    param->bytes_needed += IW_EV_ADDR_LEN;
-
-    data_len = cie->ie_ssid[1] + IW_EV_POINT_LEN;
-    if ((end_buf - current_ev) > data_len)
-    {
-        A_MEMZERO(&iwe, sizeof(iwe));
-        iwe.cmd = SIOCGIWESSID;
-        iwe.u.data.flags = 1;
-        iwe.u.data.length = cie->ie_ssid[1];
-        current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev, end_buf,
-                                          &iwe, (char*)&cie->ie_ssid[2]);
-    }
-    param->bytes_needed += data_len;
-
-    if (cie->ie_capInfo & (IEEE80211_CAPINFO_ESS|IEEE80211_CAPINFO_IBSS)) {
-        if ((end_buf - current_ev) > IW_EV_UINT_LEN)
-        {
-            A_MEMZERO(&iwe, sizeof(iwe));
-            iwe.cmd = SIOCGIWMODE;
-            iwe.u.mode = cie->ie_capInfo & IEEE80211_CAPINFO_ESS ?
-                         IW_MODE_MASTER : IW_MODE_ADHOC;
-            current_ev = IWE_STREAM_ADD_EVENT(param->info, current_ev, end_buf,
-                                              &iwe, IW_EV_UINT_LEN);
-        }
-        param->bytes_needed += IW_EV_UINT_LEN;
-    }
-
-    if ((end_buf - current_ev) > IW_EV_FREQ_LEN)
-    {
-        A_MEMZERO(&iwe, sizeof(iwe));
-        iwe.cmd = SIOCGIWFREQ;
-        iwe.u.freq.m = cie->ie_chan * 100000;
-        iwe.u.freq.e = 1;
-        current_ev = IWE_STREAM_ADD_EVENT(param->info, current_ev, end_buf,
-                                          &iwe, IW_EV_FREQ_LEN);
-    }
-    param->bytes_needed += IW_EV_FREQ_LEN;
-
-    if ((end_buf - current_ev) > IW_EV_QUAL_LEN)
-    {
-        A_MEMZERO(&iwe, sizeof(iwe));
-        iwe.cmd = IWEVQUAL;
-        ar6000_set_quality(&iwe.u.qual, ni->ni_snr);
-        current_ev = IWE_STREAM_ADD_EVENT(param->info, current_ev, end_buf,
-                                          &iwe, IW_EV_QUAL_LEN);
-    }
-    param->bytes_needed += IW_EV_QUAL_LEN;
-
-    if ((end_buf - current_ev) > IW_EV_POINT_LEN)
-    {
-        A_MEMZERO(&iwe, sizeof(iwe));
-        iwe.cmd = SIOCGIWENCODE;
-        if (cie->ie_capInfo & IEEE80211_CAPINFO_PRIVACY) {
-            iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
-        } else {
-            iwe.u.data.flags = IW_ENCODE_DISABLED;
-        }
-        iwe.u.data.length = 0;
-        current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev, end_buf,
-                                          &iwe, "");
-    }
-    param->bytes_needed += IW_EV_POINT_LEN;
-
-    /* supported bit rate */
-    A_MEMZERO(&iwe, sizeof(iwe));
-    iwe.cmd = SIOCGIWRATE;
-    iwe.u.bitrate.fixed = 0;
-    iwe.u.bitrate.disabled = 0;
-    iwe.u.bitrate.value = 0;
-    current_val = current_ev + IW_EV_LCP_LEN;
-    param->bytes_needed += IW_EV_LCP_LEN;
-
-    if (cie->ie_rates != NULL) {
-        rate_len = cie->ie_rates[1];
-        data_len = (rate_len * (IW_EV_PARAM_LEN - IW_EV_LCP_LEN));
-        if ((end_buf - current_ev) > data_len)
-        {
-            for (j = 0; j < rate_len; j++) {
-                    unsigned char val;
-                    val = cie->ie_rates[2 + j];
-                    iwe.u.bitrate.value =
-                        (val >= 0x80)? ((val - 0x80) * 500000): (val * 500000);
-                    current_val = IWE_STREAM_ADD_VALUE(param->info, current_ev,
-                                                       current_val, end_buf,
-                                                       &iwe, IW_EV_PARAM_LEN);
-            }
-        }
-        param->bytes_needed += data_len;
-    }
-
-    if (cie->ie_xrates != NULL) {
-        rate_len = cie->ie_xrates[1];
-        data_len = (rate_len * (IW_EV_PARAM_LEN - IW_EV_LCP_LEN));
-        if ((end_buf - current_ev) > data_len)
-        {
-            for (j = 0; j < rate_len; j++) {
-                    unsigned char val;
-                    val = cie->ie_xrates[2 + j];
-                    iwe.u.bitrate.value =
-                        (val >= 0x80)? ((val - 0x80) * 500000): (val * 500000);
-                    current_val = IWE_STREAM_ADD_VALUE(param->info, current_ev,
-                                                       current_val, end_buf,
-                                                       &iwe, IW_EV_PARAM_LEN);
-            }
-        }
-        param->bytes_needed += data_len;
-    }
-    /* remove fixed header if no rates were added */
-    if ((current_val - current_ev) > IW_EV_LCP_LEN)
-        current_ev = current_val;
-
-#if WIRELESS_EXT >= 18
-    /* IE */
-    if (cie->ie_wpa != NULL) {
-        data_len = cie->ie_wpa[1] + 2 + IW_EV_POINT_LEN;
-        if ((end_buf - current_ev) > data_len)
-        {
-            A_MEMZERO(&iwe, sizeof(iwe));
-            iwe.cmd = IWEVGENIE;
-            iwe.u.data.length = cie->ie_wpa[1] + 2;
-            current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev, end_buf,
-                                              &iwe, (char*)cie->ie_wpa);
-        }
-        param->bytes_needed += data_len;
-    }
-
-    if (cie->ie_rsn != NULL && cie->ie_rsn[0] == IEEE80211_ELEMID_RSN) {
-        data_len = cie->ie_rsn[1] + 2 + IW_EV_POINT_LEN;
-        if ((end_buf - current_ev) > data_len)
-        {
-            A_MEMZERO(&iwe, sizeof(iwe));
-            iwe.cmd = IWEVGENIE;
-            iwe.u.data.length = cie->ie_rsn[1] + 2;
-            current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev, end_buf,
-                                              &iwe, (char*)cie->ie_rsn);
-        }
-        param->bytes_needed += data_len;
-    }
-
-#endif /* WIRELESS_EXT >= 18 */
-
-    if ((end_buf - current_ev) > IW_EV_CHAR_LEN)
-    {
-        /* protocol */
-        A_MEMZERO(&iwe, sizeof(iwe));
-        iwe.cmd = SIOCGIWNAME;
-        switch (get_bss_phy_capability(ni)) {
-        case WMI_11A_CAPABILITY:
-            snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11a");
-            break;
-        case WMI_11G_CAPABILITY:
-            snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11g");
-            break;
-        case WMI_11NA_CAPABILITY:
-            snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11na");
-            break;
-        case WMI_11NG_CAPABILITY:
-            snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11ng");
-            break;
-        default:
-            snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11b");
-            break;
-        }
-        current_ev = IWE_STREAM_ADD_EVENT(param->info, current_ev, end_buf,
-                                          &iwe, IW_EV_CHAR_LEN);
-    }
-    param->bytes_needed += IW_EV_CHAR_LEN;
-
-#if WIRELESS_EXT > 14
-    A_MEMZERO(&iwe, sizeof(iwe));
-    iwe.cmd = IWEVCUSTOM;
-    iwe.u.data.length = snprintf(buf, sizeof(buf), "bcn_int=%d", cie->ie_beaconInt);
-    data_len = iwe.u.data.length + IW_EV_POINT_LEN;
-    if ((end_buf - current_ev) > data_len)
-    {
-        current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev, end_buf,
-                                          &iwe, buf);
-    }
-    param->bytes_needed += data_len;
-
-#if WIRELESS_EXT < 18
-    if (cie->ie_wpa != NULL) {
-        static const char wpa_leader[] = "wpa_ie=";
-        data_len = (sizeof(wpa_leader) - 1) + ((cie->ie_wpa[1]+2) * 2) + IW_EV_POINT_LEN;
-        if ((end_buf - current_ev) > data_len)
-        {
-            A_MEMZERO(&iwe, sizeof(iwe));
-            iwe.cmd = IWEVCUSTOM;
-            iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_wpa,
-                                          cie->ie_wpa[1]+2,
-                                          wpa_leader, sizeof(wpa_leader)-1);
-
-            if (iwe.u.data.length != 0) {
-                current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev, 
-                                                  end_buf, &iwe, buf);
-            }
-        }
-        param->bytes_needed += data_len;
-    }
-
-    if (cie->ie_rsn != NULL && cie->ie_rsn[0] == IEEE80211_ELEMID_RSN) {
-        static const char rsn_leader[] = "rsn_ie=";
-        data_len = (sizeof(rsn_leader) - 1) + ((cie->ie_rsn[1]+2) * 2) + IW_EV_POINT_LEN;
-        if ((end_buf - current_ev) > data_len)
-        {
-            A_MEMZERO(&iwe, sizeof(iwe));
-            iwe.cmd = IWEVCUSTOM;
-            iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_rsn,
-                                          cie->ie_rsn[1]+2,
-                                          rsn_leader, sizeof(rsn_leader)-1);
-
-            if (iwe.u.data.length != 0) {
-                current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev, 
-                                                  end_buf, &iwe, buf);
-            }
-        }
-        param->bytes_needed += data_len;
-    }
-#endif /* WIRELESS_EXT < 18 */
-
-    if (cie->ie_wmm != NULL) {
-        static const char wmm_leader[] = "wmm_ie=";
-        data_len = (sizeof(wmm_leader) - 1) + ((cie->ie_wmm[1]+2) * 2) + IW_EV_POINT_LEN;
-        if ((end_buf - current_ev) > data_len)
-        {
-            A_MEMZERO(&iwe, sizeof(iwe));
-            iwe.cmd = IWEVCUSTOM;
-            iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_wmm,
-                                          cie->ie_wmm[1]+2,
-                                          wmm_leader, sizeof(wmm_leader)-1);
-            if (iwe.u.data.length != 0) {
-                current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev,
-                                                  end_buf, &iwe, buf);
-            }
-        }
-        param->bytes_needed += data_len;
-    }
-
-    if (cie->ie_ath != NULL) {
-        static const char ath_leader[] = "ath_ie=";
-        data_len = (sizeof(ath_leader) - 1) + ((cie->ie_ath[1]+2) * 2) + IW_EV_POINT_LEN;
-        if ((end_buf - current_ev) > data_len)
-        {
-            A_MEMZERO(&iwe, sizeof(iwe));
-            iwe.cmd = IWEVCUSTOM;
-            iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_ath,
-                                          cie->ie_ath[1]+2,
-                                          ath_leader, sizeof(ath_leader)-1);
-            if (iwe.u.data.length != 0) {
-                current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev,
-                                                  end_buf, &iwe, buf);
-            }
-        }
-        param->bytes_needed += data_len;
-    }
-
-#ifdef WAPI_ENABLE
-    if (cie->ie_wapi != NULL) {
-        static const char wapi_leader[] = "wapi_ie=";
-        data_len = (sizeof(wapi_leader) - 1) + ((cie->ie_wapi[1] + 2) * 2) + IW_EV_POINT_LEN;
-        if ((end_buf - current_ev) > data_len) {
-            A_MEMZERO(&iwe, sizeof(iwe));
-            iwe.cmd = IWEVCUSTOM;
-            iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_wapi,
-                                      cie->ie_wapi[1] + 2,
-                                      wapi_leader, sizeof(wapi_leader) - 1);
-            if (iwe.u.data.length != 0) {
-                current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev,
-                                                  end_buf, &iwe, buf);
-            }
-        }
-        param->bytes_needed += data_len;
-    }
-#endif /* WAPI_ENABLE */
-
-#endif /* WIRELESS_EXT > 14 */
-
-#if WIRELESS_EXT >= 18
-    if (cie->ie_wsc != NULL) {
-        data_len = (cie->ie_wsc[1] + 2) + IW_EV_POINT_LEN;
-        if ((end_buf - current_ev) > data_len)
-        {
-            A_MEMZERO(&iwe, sizeof(iwe));
-            iwe.cmd = IWEVGENIE;
-            iwe.u.data.length = cie->ie_wsc[1] + 2;
-            current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev, end_buf,
-                                              &iwe, (char*)cie->ie_wsc);
-        }
-        param->bytes_needed += data_len;
-    }
-#endif /* WIRELESS_EXT >= 18 */
-
-    param->current_ev = current_ev;
-}
-
-int
-ar6000_ioctl_giwscan(struct net_device *dev,
-            struct iw_request_info *info,
-            struct iw_point *data, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    struct ar_giwscan_param param;
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    param.current_ev = extra;
-    param.end_buf = extra + data->length;
-    param.bytes_needed = 0;
-    param.info = info;
-
-    /* Translate data to WE format */
-    wmi_iterate_nodes(ar->arWmi, ar6000_scan_node, &param);
-
-    /* check if bytes needed is greater than bytes consumed */
-    if (param.bytes_needed > (param.current_ev - extra))
-    {
-        /* Request one byte more than needed, because when "data->length" equals bytes_needed,
-        it is not possible to add the last event data as all iwe_stream_add_xxxxx() functions
-        checks whether (cur_ptr + ev_len) < end_ptr, due to this one more retry would happen*/
-        data->length = param.bytes_needed + 1;
-
-        return -E2BIG;
-    }
-
-    return 0;
-}
-
-extern int reconnect_flag;
-/* SIOCSIWESSID */
-static int
-ar6000_ioctl_siwessid(struct net_device *dev,
-                     struct iw_request_info *info,
-                     struct iw_point *data, char *ssid)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    int status;
-    u8 arNetworkType;
-    u8 prevMode = ar->arNetworkType;
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->bIsDestroyProgress) {
-        return -EBUSY;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-#if defined(WIRELESS_EXT)
-    if (WIRELESS_EXT >= 20) {
-        data->length += 1;
-    }
-#endif
-
-    /*
-     * iwconfig passes a null terminated string with length including this
-     * so we need to account for this
-     */
-    if (data->flags && (!data->length || (data->length == 1) ||
-        ((data->length - 1) > sizeof(ar->arSsid))))
-    {
-        /*
-         * ssid is invalid
-         */
-        return -EINVAL;
-    }
-
-    if (ar->arNextMode == AP_NETWORK) {
-        /* SSID change for AP network - Will take effect on commit */
-        if(memcmp(ar->arSsid,ssid,32) != 0) {
-             ar->arSsidLen = data->length - 1;
-            memcpy(ar->arSsid, ssid, ar->arSsidLen);
-            ar->ap_profile_flag = 1; /* There is a change in profile */
-        }
-        return 0;
-    } else if(ar->arNetworkType == AP_NETWORK) {
-        u8 ctr;
-        struct sk_buff *skb;
-
-        /* We are switching from AP to STA | IBSS mode, cleanup the AP state */
-        for (ctr=0; ctr < AP_MAX_NUM_STA; ctr++) {
-            remove_sta(ar, ar->sta_list[ctr].mac, 0);
-        }
-        A_MUTEX_LOCK(&ar->mcastpsqLock);
-        while (!A_NETBUF_QUEUE_EMPTY(&ar->mcastpsq)) {
-            skb = A_NETBUF_DEQUEUE(&ar->mcastpsq);
-            A_NETBUF_FREE(skb);
-        }
-        A_MUTEX_UNLOCK(&ar->mcastpsqLock);
-    }
-
-    /* Added for bug 25178, return an IOCTL error instead of target returning
-       Illegal parameter error when either the BSSID or channel is missing
-       and we cannot scan during connect.
-     */
-    if (data->flags) {
-        if (ar->arSkipScan == true &&
-            (ar->arChannelHint == 0 ||
-             (!ar->arReqBssid[0] && !ar->arReqBssid[1] && !ar->arReqBssid[2] &&
-              !ar->arReqBssid[3] && !ar->arReqBssid[4] && !ar->arReqBssid[5])))
-        {
-            return -EINVAL;
-        }
-    }
-
-    if (down_interruptible(&ar->arSem)) {
-        return -ERESTARTSYS;
-    }
-
-    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
-        up(&ar->arSem);
-        return -EBUSY;
-    }
-
-    if (ar->arTxPending[wmi_get_control_ep(ar->arWmi)]) {
-        /*
-         * sleep until the command queue drains
-         */
-        wait_event_interruptible_timeout(arEvent,
-            ar->arTxPending[wmi_get_control_ep(ar->arWmi)] == 0, wmitimeout * HZ);
-        if (signal_pending(current)) {
-            return -EINTR;
-        }
-    }
-
-    if (!data->flags) {
-        arNetworkType = ar->arNetworkType;
-#ifdef ATH6K_CONFIG_CFG80211
-        if (ar->arConnected) {
-#endif /* ATH6K_CONFIG_CFG80211 */
-            ar6000_init_profile_info(ar);
-#ifdef ATH6K_CONFIG_CFG80211
-        }
-#endif /* ATH6K_CONFIG_CFG80211 */
-        ar->arNetworkType = arNetworkType;
-    }
-
-    /* Update the arNetworkType */
-    ar->arNetworkType = ar->arNextMode;
-
-    if ((prevMode != AP_NETWORK) &&
-        ((ar->arSsidLen) || 
-        ((ar->arSsidLen == 0) && (ar->arConnected || ar->arConnectPending)) || 
-        (!data->flags)))
-    {
-        if ((!data->flags) ||
-            (memcmp(ar->arSsid, ssid, ar->arSsidLen) != 0) ||
-            (ar->arSsidLen != (data->length - 1)))
-        {
-            /*
-             * SSID set previously or essid off has been issued.
-             *
-             * Disconnect Command is issued in two cases after wmi is ready
-             * (1) ssid is different from the previous setting
-             * (2) essid off has been issued
-             *
-             */
-            if (ar->arWmiReady == true) {
-                reconnect_flag = 0;
-                status = wmi_setPmkid_cmd(ar->arWmi, ar->arBssid, NULL, 0);
-                ar6000_disconnect(ar);
-                A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
-                ar->arSsidLen = 0;
-                if (ar->arSkipScan == false) {
-                    A_MEMZERO(ar->arReqBssid, sizeof(ar->arReqBssid));
-                }
-                if (!data->flags) {
-                    up(&ar->arSem);
-                    return 0;
-                }
-            } else {
-                 up(&ar->arSem);
-            }
-        }
-        else
-        {
-            /*
-             * SSID is same, so we assume profile hasn't changed.
-             * If the interface is up and wmi is ready, we issue
-             * a reconnect cmd. Issue a reconnect only we are already
-             * connected.
-             */
-            if((ar->arConnected == true) && (ar->arWmiReady == true))
-            {
-                reconnect_flag = true;
-                status = wmi_reconnect_cmd(ar->arWmi,ar->arReqBssid,
-                                           ar->arChannelHint);
-                up(&ar->arSem);
-                if (status) {
-                    return -EIO;
-                }
-                return 0;
-            }
-            else{
-                /*
-                 * Dont return if connect is pending.
-                 */
-                if(!(ar->arConnectPending)) {
-                    up(&ar->arSem);
-                    return 0;
-                }
-            }
-        }
-    }
-
-    ar->arSsidLen = data->length - 1;
-    memcpy(ar->arSsid, ssid, ar->arSsidLen);
-
-    if (ar6000_connect_to_ap(ar)!= 0) {
-        up(&ar->arSem);
-        return -EIO;
-    }else{
-      up(&ar->arSem);
-    }
-    return 0;
-}
-
-/* SIOCGIWESSID */
-static int
-ar6000_ioctl_giwessid(struct net_device *dev,
-                     struct iw_request_info *info,
-                     struct iw_point *data, char *essid)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    if (!ar->arSsidLen) {
-        return -EINVAL;
-    }
-
-    data->flags = 1;
-    data->length = ar->arSsidLen;
-    memcpy(essid, ar->arSsid, ar->arSsidLen);
-
-    return 0;
-}
-
-
-void ar6000_install_static_wep_keys(struct ar6_softc *ar)
-{
-    u8 index;
-    u8 keyUsage;
-
-    for (index = WMI_MIN_KEY_INDEX; index <= WMI_MAX_KEY_INDEX; index++) {
-        if (ar->arWepKeyList[index].arKeyLen) {
-            keyUsage = GROUP_USAGE;
-            if (index == ar->arDefTxKeyIndex) {
-                keyUsage |= TX_USAGE;
-            }
-            wmi_addKey_cmd(ar->arWmi,
-                           index,
-                           WEP_CRYPT,
-                           keyUsage,
-                           ar->arWepKeyList[index].arKeyLen,
-                           NULL,
-                           ar->arWepKeyList[index].arKey, KEY_OP_INIT_VAL, NULL,
-                           NO_SYNC_WMIFLAG);
-        }
-    }
-}
-
-/*
- * SIOCSIWRATE
- */
-int
-ar6000_ioctl_siwrate(struct net_device *dev,
-            struct iw_request_info *info,
-            struct iw_param *rrq, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    u32 kbps;
-    s8 rate_idx;
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (rrq->fixed) {
-        kbps = rrq->value / 1000;           /* rrq->value is in bps */
-    } else {
-        kbps = -1;                          /* -1 indicates auto rate */
-    }
-    if(kbps != -1 && wmi_validate_bitrate(ar->arWmi, kbps, &rate_idx) != 0)
-    {
-        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BitRate is not Valid %d\n", kbps));
-        return -EINVAL;
-    }
-    ar->arBitRate = kbps;
-    if(ar->arWmiReady == true)
-    {
-        if (wmi_set_bitrate_cmd(ar->arWmi, kbps, -1, -1) != 0) {
-            return -EINVAL;
-        }
-    }
-    return 0;
-}
-
-/*
- * SIOCGIWRATE
- */
-int
-ar6000_ioctl_giwrate(struct net_device *dev,
-            struct iw_request_info *info,
-            struct iw_param *rrq, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    int ret = 0;
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->bIsDestroyProgress) {
-        return -EBUSY;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    if ((ar->arNextMode != AP_NETWORK && !ar->arConnected) || ar->arWmiReady == false) {
-        rrq->value = 1000 * 1000;       
-        return 0;
-    }
-
-    if (down_interruptible(&ar->arSem)) {
-        return -ERESTARTSYS;
-    }
-
-    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
-        up(&ar->arSem);
-        return -EBUSY;
-    }
-
-    ar->arBitRate = 0xFFFF;
-    if (wmi_get_bitrate_cmd(ar->arWmi) != 0) {
-        up(&ar->arSem);
-        return -EIO;
-    }
-    wait_event_interruptible_timeout(arEvent, ar->arBitRate != 0xFFFF, wmitimeout * HZ);
-    if (signal_pending(current)) {
-        ret = -EINTR;
-    }
-    /* If the interface is down or wmi is not ready or the target is not
-       connected - return the value stored in the device structure */
-    if (!ret) {
-        if (ar->arBitRate == -1) {
-            rrq->fixed = true;
-            rrq->value = 0;
-        } else {
-            rrq->value = ar->arBitRate * 1000;
-        }
-    }
-
-    up(&ar->arSem);
-
-    return ret;
-}
-
-/*
- * SIOCSIWTXPOW
- */
-static int
-ar6000_ioctl_siwtxpow(struct net_device *dev,
-             struct iw_request_info *info,
-             struct iw_param *rrq, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    u8 dbM;
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    if (rrq->disabled) {
-        return -EOPNOTSUPP;
-    }
-
-    if (rrq->fixed) {
-        if (rrq->flags != IW_TXPOW_DBM) {
-            return -EOPNOTSUPP;
-        }
-        ar->arTxPwr= dbM = rrq->value;
-        ar->arTxPwrSet = true;
-    } else {
-        ar->arTxPwr = dbM = 0;
-        ar->arTxPwrSet = false;
-    }
-    if(ar->arWmiReady == true)
-    {
-        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_TX,("Set tx pwr cmd %d dbM\n", dbM));
-        wmi_set_txPwr_cmd(ar->arWmi, dbM);
-    }
-    return 0;
-}
-
-/*
- * SIOCGIWTXPOW
- */
-int
-ar6000_ioctl_giwtxpow(struct net_device *dev,
-            struct iw_request_info *info,
-            struct iw_param *rrq, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    int ret = 0;
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->bIsDestroyProgress) {
-        return -EBUSY;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    if (down_interruptible(&ar->arSem)) {
-        return -ERESTARTSYS;
-    }
-
-    if (ar->bIsDestroyProgress) {
-        up(&ar->arSem);
-        return -EBUSY;
-    }
-
-    if((ar->arWmiReady == true) && (ar->arConnected == true))
-    {
-        ar->arTxPwr = 0;
-
-        if (wmi_get_txPwr_cmd(ar->arWmi) != 0) {
-            up(&ar->arSem);
-            return -EIO;
-        }
-
-        wait_event_interruptible_timeout(arEvent, ar->arTxPwr != 0, wmitimeout * HZ);
-
-        if (signal_pending(current)) {
-            ret = -EINTR;
-         }
-    }
-   /* If the interace is down or wmi is not ready or target is not connected
-      then return value stored in the device structure */
-
-    if (!ret) {
-         if (ar->arTxPwrSet == true) {
-            rrq->fixed = true;
-        }
-        rrq->value = ar->arTxPwr;
-        rrq->flags = IW_TXPOW_DBM;
-        //
-        // IWLIST need this flag to get TxPower
-        //
-        rrq->disabled = 0;
-    }
-
-    up(&ar->arSem);
-
-    return ret;
-}
-
-/*
- * SIOCSIWRETRY
- * since iwconfig only provides us with one max retry value, we use it
- * to apply to data frames of the BE traffic class.
- */
-static int
-ar6000_ioctl_siwretry(struct net_device *dev,
-             struct iw_request_info *info,
-             struct iw_param *rrq, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    if (rrq->disabled) {
-        return -EOPNOTSUPP;
-    }
-
-    if ((rrq->flags & IW_RETRY_TYPE) != IW_RETRY_LIMIT) {
-        return -EOPNOTSUPP;
-    }
-
-    if ( !(rrq->value >= WMI_MIN_RETRIES) || !(rrq->value <= WMI_MAX_RETRIES)) {
-            return - EINVAL;
-    }
-    if(ar->arWmiReady == true)
-    {
-        if (wmi_set_retry_limits_cmd(ar->arWmi, DATA_FRAMETYPE, WMM_AC_BE,
-                                     rrq->value, 0) != 0){
-            return -EINVAL;
-        }
-    }
-    ar->arMaxRetries = rrq->value;
-    return 0;
-}
-
-/*
- * SIOCGIWRETRY
- */
-static int
-ar6000_ioctl_giwretry(struct net_device *dev,
-             struct iw_request_info *info,
-             struct iw_param *rrq, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    rrq->disabled = 0;
-    switch (rrq->flags & IW_RETRY_TYPE) {
-    case IW_RETRY_LIFETIME:
-        return -EOPNOTSUPP;
-        break;
-    case IW_RETRY_LIMIT:
-        rrq->flags = IW_RETRY_LIMIT;
-        switch (rrq->flags & IW_RETRY_MODIFIER) {
-        case IW_RETRY_MIN:
-            rrq->flags |= IW_RETRY_MIN;
-            rrq->value = WMI_MIN_RETRIES;
-            break;
-        case IW_RETRY_MAX:
-            rrq->flags |= IW_RETRY_MAX;
-            rrq->value = ar->arMaxRetries;
-            break;
-        }
-        break;
-    }
-    return 0;
-}
-
-/*
- * SIOCSIWENCODE
- */
-static int
-ar6000_ioctl_siwencode(struct net_device *dev,
-              struct iw_request_info *info,
-              struct iw_point *erq, char *keybuf)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    int index;
-    s32 auth = 0;
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if(ar->arNextMode != AP_NETWORK) {
-    /*
-     *  Static WEP Keys should be configured before setting the SSID
-     */
-    if (ar->arSsid[0] && erq->length) {
-        return -EIO;
-    }
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    index = erq->flags & IW_ENCODE_INDEX;
-
-    if (index && (((index - 1) < WMI_MIN_KEY_INDEX) ||
-                  ((index - 1) > WMI_MAX_KEY_INDEX)))
-    {
-        return -EIO;
-    }
-
-    if (erq->flags & IW_ENCODE_DISABLED) {
-        /*
-         * Encryption disabled
-         */
-        if (index) {
-            /*
-             * If key index was specified then clear the specified key
-             */
-            index--;
-            A_MEMZERO(ar->arWepKeyList[index].arKey,
-                      sizeof(ar->arWepKeyList[index].arKey));
-            ar->arWepKeyList[index].arKeyLen = 0;
-        }
-        ar->arDot11AuthMode       = OPEN_AUTH;
-        ar->arPairwiseCrypto      = NONE_CRYPT;
-        ar->arGroupCrypto         = NONE_CRYPT;
-        ar->arAuthMode            = NONE_AUTH;
-    } else {
-        /*
-         * Enabling WEP encryption
-         */
-        if (index) {
-            index--;                /* keyindex is off base 1 in iwconfig */
-        }
-
-        if (erq->flags & IW_ENCODE_OPEN) {
-            auth |= OPEN_AUTH;
-            ar->arDefTxKeyIndex = index;
-        }
-        if (erq->flags & IW_ENCODE_RESTRICTED) {
-            auth |= SHARED_AUTH;
-        }
-
-        if (!auth) {
-            auth = OPEN_AUTH;
-        }
-
-        if (erq->length) {
-            if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(erq->length)) {
-                return -EIO;
-            }
-
-            A_MEMZERO(ar->arWepKeyList[index].arKey,
-                      sizeof(ar->arWepKeyList[index].arKey));
-            memcpy(ar->arWepKeyList[index].arKey, keybuf, erq->length);
-            ar->arWepKeyList[index].arKeyLen = erq->length;
-            ar->arDot11AuthMode       = auth;
-        } else {
-            if (ar->arWepKeyList[index].arKeyLen == 0) {
-                return -EIO;
-            }
-            ar->arDefTxKeyIndex = index;
-
-            if(ar->arSsidLen && ar->arWepKeyList[index].arKeyLen) {
-                wmi_addKey_cmd(ar->arWmi,
-                               index,
-                               WEP_CRYPT,
-                               GROUP_USAGE | TX_USAGE,
-                               ar->arWepKeyList[index].arKeyLen,
-                               NULL,
-                               ar->arWepKeyList[index].arKey, KEY_OP_INIT_VAL, NULL,
-                               NO_SYNC_WMIFLAG);
-            }
-        }
-
-        ar->arPairwiseCrypto      = WEP_CRYPT;
-        ar->arGroupCrypto         = WEP_CRYPT;
-        ar->arAuthMode            = NONE_AUTH;
-    }
-
-    if(ar->arNextMode != AP_NETWORK) {
-    /*
-     * profile has changed.  Erase ssid to signal change
-     */
-        A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
-        ar->arSsidLen = 0;
-    }
-    ar->ap_profile_flag = 1; /* There is a change in profile */
-    return 0;
-}
-
-static int
-ar6000_ioctl_giwencode(struct net_device *dev,
-              struct iw_request_info *info,
-              struct iw_point *erq, char *key)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    u8 keyIndex;
-    struct ar_wep_key *wk;
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    if (ar->arPairwiseCrypto == NONE_CRYPT) {
-        erq->length = 0;
-        erq->flags = IW_ENCODE_DISABLED;
-    } else {
-        if (ar->arPairwiseCrypto == WEP_CRYPT) {
-            /* get the keyIndex */
-            keyIndex = erq->flags & IW_ENCODE_INDEX;
-            if (0 == keyIndex) {
-                keyIndex = ar->arDefTxKeyIndex;
-            } else if ((keyIndex - 1 < WMI_MIN_KEY_INDEX) ||
-                       (keyIndex - 1 > WMI_MAX_KEY_INDEX))
-            {
-                keyIndex = WMI_MIN_KEY_INDEX;
-            } else {
-                keyIndex--;
-            }
-            erq->flags = keyIndex + 1;
-            erq->flags &= ~IW_ENCODE_DISABLED;
-            wk = &ar->arWepKeyList[keyIndex];
-            if (erq->length > wk->arKeyLen) {
-                erq->length = wk->arKeyLen;
-            }
-            if (wk->arKeyLen) {
-                memcpy(key, wk->arKey, erq->length);
-            }
-        } else {
-            erq->flags &= ~IW_ENCODE_DISABLED;
-            if (ar->user_saved_keys.keyOk) {
-                erq->length = ar->user_saved_keys.ucast_ik.ik_keylen;
-                if (erq->length) {
-                    memcpy(key, ar->user_saved_keys.ucast_ik.ik_keydata, erq->length);
-                }
-            } else {
-                erq->length = 1;    // not really printing any key but let iwconfig know enc is on
-            }
-        }
-
-        if (ar->arDot11AuthMode & OPEN_AUTH) {
-            erq->flags |= IW_ENCODE_OPEN;
-        }
-        if (ar->arDot11AuthMode & SHARED_AUTH) {
-            erq->flags |= IW_ENCODE_RESTRICTED;
-        }
-    }
-
-    return 0;
-}
-
-#if WIRELESS_EXT >= 18
-/*
- * SIOCSIWGENIE
- */
-static int
-ar6000_ioctl_siwgenie(struct net_device *dev,
-              struct iw_request_info *info,
-              struct iw_point *erq, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-#ifdef WAPI_ENABLE
-    u8 *ie = erq->pointer;
-    u8 ie_type = ie[0];
-    u16 ie_length = erq->length;
-    u8 wapi_ie[128];
-#endif
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-#ifdef WAPI_ENABLE
-    if (ie_type == IEEE80211_ELEMID_WAPI) {
-        if (ie_length > 0) {
-            if (copy_from_user(wapi_ie, ie, ie_length)) {
-                return -EIO;
-            }
-        }
-        wmi_set_appie_cmd(ar->arWmi, WMI_FRAME_ASSOC_REQ, ie_length, wapi_ie);
-    } else if (ie_length == 0) {
-        wmi_set_appie_cmd(ar->arWmi, WMI_FRAME_ASSOC_REQ, ie_length, wapi_ie);
-    }
-#endif
-    return 0;
-}
-
-
-/*
- * SIOCGIWGENIE
- */
-static int
-ar6000_ioctl_giwgenie(struct net_device *dev,
-              struct iw_request_info *info,
-              struct iw_point *erq, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-    erq->length = 0;
-    erq->flags = 0;
-
-    return 0;
-}
-
-/*
- * SIOCSIWAUTH
- */
-static int
-ar6000_ioctl_siwauth(struct net_device *dev,
-              struct iw_request_info *info,
-              struct iw_param *data, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    bool profChanged;
-    u16 param;
-    s32 ret;
-    s32 value;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    param = data->flags & IW_AUTH_INDEX;
-    value = data->value;
-    profChanged = true;
-    ret = 0;
-
-    switch (param) {
-        case IW_AUTH_WPA_VERSION:
-            if (value & IW_AUTH_WPA_VERSION_DISABLED) {
-                ar->arAuthMode = NONE_AUTH;
-            } else if (value & IW_AUTH_WPA_VERSION_WPA) {
-                    ar->arAuthMode = WPA_AUTH;
-            } else if (value & IW_AUTH_WPA_VERSION_WPA2) {
-                    ar->arAuthMode = WPA2_AUTH;
-            } else {
-                ret = -1;
-                profChanged    = false;
-            }
-            break;
-        case IW_AUTH_CIPHER_PAIRWISE:
-            if (value & IW_AUTH_CIPHER_NONE) {
-                ar->arPairwiseCrypto = NONE_CRYPT;
-                ar->arPairwiseCryptoLen = 0;
-            } else if (value & IW_AUTH_CIPHER_WEP40) {
-                ar->arPairwiseCrypto = WEP_CRYPT;
-                ar->arPairwiseCryptoLen = 5;
-            } else if (value & IW_AUTH_CIPHER_TKIP) {
-                ar->arPairwiseCrypto = TKIP_CRYPT;
-                ar->arPairwiseCryptoLen = 0;
-            } else if (value & IW_AUTH_CIPHER_CCMP) {
-                ar->arPairwiseCrypto = AES_CRYPT;
-                ar->arPairwiseCryptoLen = 0;
-            } else if (value & IW_AUTH_CIPHER_WEP104) {
-                ar->arPairwiseCrypto = WEP_CRYPT;
-                ar->arPairwiseCryptoLen = 13;
-            } else {
-                ret = -1;
-                profChanged    = false;
-            }
-            break;
-        case IW_AUTH_CIPHER_GROUP:
-            if (value & IW_AUTH_CIPHER_NONE) {
-                ar->arGroupCrypto = NONE_CRYPT;
-                ar->arGroupCryptoLen = 0;
-            } else if (value & IW_AUTH_CIPHER_WEP40) {
-                ar->arGroupCrypto = WEP_CRYPT;
-                ar->arGroupCryptoLen = 5;
-            } else if (value & IW_AUTH_CIPHER_TKIP) {
-                ar->arGroupCrypto = TKIP_CRYPT;
-                ar->arGroupCryptoLen = 0;
-            } else if (value & IW_AUTH_CIPHER_CCMP) {
-                ar->arGroupCrypto = AES_CRYPT;
-                ar->arGroupCryptoLen = 0;
-            } else if (value & IW_AUTH_CIPHER_WEP104) {
-                ar->arGroupCrypto = WEP_CRYPT;
-                ar->arGroupCryptoLen = 13;
-            } else {
-                ret = -1;
-                profChanged    = false;
-            }
-            break;
-        case IW_AUTH_KEY_MGMT:
-            if (value & IW_AUTH_KEY_MGMT_PSK) {
-                if (WPA_AUTH == ar->arAuthMode) {
-                    ar->arAuthMode = WPA_PSK_AUTH;
-                } else if (WPA2_AUTH == ar->arAuthMode) {
-                    ar->arAuthMode = WPA2_PSK_AUTH;
-                } else {
-                    ret = -1;
-                }
-            } else if (!(value & IW_AUTH_KEY_MGMT_802_1X)) {
-                ar->arAuthMode = NONE_AUTH;
-            }
-            break;
-        case IW_AUTH_TKIP_COUNTERMEASURES:
-            wmi_set_tkip_countermeasures_cmd(ar->arWmi, value);
-            profChanged    = false;
-            break;
-        case IW_AUTH_DROP_UNENCRYPTED:
-            profChanged    = false;
-            break;
-        case IW_AUTH_80211_AUTH_ALG:
-            ar->arDot11AuthMode = 0;
-            if (value & IW_AUTH_ALG_OPEN_SYSTEM) {
-                ar->arDot11AuthMode  |= OPEN_AUTH;
-            }
-            if (value & IW_AUTH_ALG_SHARED_KEY) {
-                ar->arDot11AuthMode  |= SHARED_AUTH;
-            }
-            if (value & IW_AUTH_ALG_LEAP) {
-                ar->arDot11AuthMode   = LEAP_AUTH;
-            }
-            if(ar->arDot11AuthMode == 0) {
-                ret = -1;
-                profChanged    = false;
-            }
-            break;
-        case IW_AUTH_WPA_ENABLED:
-            if (!value) {
-                ar->arAuthMode = NONE_AUTH;
-                /* when the supplicant is stopped, it calls this
-                 * handler with value=0. The followings need to be
-                 * reset if the STA were to connect again
-                 * without security
-                 */
-                ar->arDot11AuthMode = OPEN_AUTH;
-                ar->arPairwiseCrypto = NONE_CRYPT;
-                ar->arPairwiseCryptoLen = 0;
-                ar->arGroupCrypto = NONE_CRYPT;
-                ar->arGroupCryptoLen = 0;
-            }
-            break;
-        case IW_AUTH_RX_UNENCRYPTED_EAPOL:
-            profChanged    = false;
-            break;
-        case IW_AUTH_ROAMING_CONTROL:
-            profChanged    = false;
-            break;
-        case IW_AUTH_PRIVACY_INVOKED:
-            if (!value) {
-                ar->arPairwiseCrypto = NONE_CRYPT;
-                ar->arPairwiseCryptoLen = 0;
-                ar->arGroupCrypto = NONE_CRYPT;
-                ar->arGroupCryptoLen = 0;
-            }
-            break;
-#ifdef WAPI_ENABLE
-        case IW_AUTH_WAPI_ENABLED:
-            ar->arWapiEnable = value;
-            break;
-#endif
-        default:
-           ret = -1;
-           profChanged    = false;
-           break;
-    }
-
-    if (profChanged == true) {
-        /*
-         * profile has changed.  Erase ssid to signal change
-         */
-        A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
-        ar->arSsidLen = 0;
-    }
-
-    return ret;
-}
-
-
-/*
- * SIOCGIWAUTH
- */
-static int
-ar6000_ioctl_giwauth(struct net_device *dev,
-              struct iw_request_info *info,
-              struct iw_param *data, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    u16 param;
-    s32 ret;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    param = data->flags & IW_AUTH_INDEX;
-    ret = 0;
-    data->value = 0;
-
-
-    switch (param) {
-        case IW_AUTH_WPA_VERSION:
-            if (ar->arAuthMode == NONE_AUTH) {
-                data->value |= IW_AUTH_WPA_VERSION_DISABLED;
-            } else if (ar->arAuthMode == WPA_AUTH) {
-                data->value |= IW_AUTH_WPA_VERSION_WPA;
-            } else if (ar->arAuthMode == WPA2_AUTH) {
-                data->value |= IW_AUTH_WPA_VERSION_WPA2;
-            } else {
-                ret = -1;
-            }
-            break;
-        case IW_AUTH_CIPHER_PAIRWISE:
-            if (ar->arPairwiseCrypto == NONE_CRYPT) {
-                data->value |= IW_AUTH_CIPHER_NONE;
-            } else if (ar->arPairwiseCrypto == WEP_CRYPT) {
-                if (ar->arPairwiseCryptoLen == 13) {
-                    data->value |= IW_AUTH_CIPHER_WEP104;
-                } else {
-                    data->value |= IW_AUTH_CIPHER_WEP40;
-                }
-            } else if (ar->arPairwiseCrypto == TKIP_CRYPT) {
-                data->value |= IW_AUTH_CIPHER_TKIP;
-            } else if (ar->arPairwiseCrypto == AES_CRYPT) {
-                data->value |= IW_AUTH_CIPHER_CCMP;
-            } else {
-                ret = -1;
-            }
-            break;
-        case IW_AUTH_CIPHER_GROUP:
-            if (ar->arGroupCrypto == NONE_CRYPT) {
-                    data->value |= IW_AUTH_CIPHER_NONE;
-            } else if (ar->arGroupCrypto == WEP_CRYPT) {
-                if (ar->arGroupCryptoLen == 13) {
-                    data->value |= IW_AUTH_CIPHER_WEP104;
-                } else {
-                    data->value |= IW_AUTH_CIPHER_WEP40;
-                }
-            } else if (ar->arGroupCrypto == TKIP_CRYPT) {
-                data->value |= IW_AUTH_CIPHER_TKIP;
-            } else if (ar->arGroupCrypto == AES_CRYPT) {
-                data->value |= IW_AUTH_CIPHER_CCMP;
-            } else {
-                ret = -1;
-            }
-            break;
-        case IW_AUTH_KEY_MGMT:
-            if ((ar->arAuthMode == WPA_PSK_AUTH) ||
-                (ar->arAuthMode == WPA2_PSK_AUTH)) {
-                data->value |= IW_AUTH_KEY_MGMT_PSK;
-            } else if ((ar->arAuthMode == WPA_AUTH) ||
-                       (ar->arAuthMode == WPA2_AUTH)) {
-                data->value |= IW_AUTH_KEY_MGMT_802_1X;
-            }
-            break;
-        case IW_AUTH_TKIP_COUNTERMEASURES:
-            // TODO. Save countermeassure enable/disable
-            data->value = 0;
-            break;
-        case IW_AUTH_DROP_UNENCRYPTED:
-            break;
-        case IW_AUTH_80211_AUTH_ALG:
-            if (ar->arDot11AuthMode == OPEN_AUTH) {
-                data->value |= IW_AUTH_ALG_OPEN_SYSTEM;
-            } else if (ar->arDot11AuthMode == SHARED_AUTH) {
-                data->value |= IW_AUTH_ALG_SHARED_KEY;
-            } else if (ar->arDot11AuthMode == LEAP_AUTH) {
-                data->value |= IW_AUTH_ALG_LEAP;
-            } else {
-                ret = -1;
-            }
-            break;
-        case IW_AUTH_WPA_ENABLED:
-            if (ar->arAuthMode == NONE_AUTH) {
-                data->value = 0;
-            } else {
-                data->value = 1;
-            }
-            break;
-        case IW_AUTH_RX_UNENCRYPTED_EAPOL:
-            break;
-        case IW_AUTH_ROAMING_CONTROL:
-            break;
-        case IW_AUTH_PRIVACY_INVOKED:
-            if (ar->arPairwiseCrypto == NONE_CRYPT) {
-                data->value = 0;
-            } else {
-                data->value = 1;
-            }
-            break;
-#ifdef WAPI_ENABLE
-        case IW_AUTH_WAPI_ENABLED:
-            data->value = ar->arWapiEnable;
-            break;
-#endif
-        default:
-           ret = -1;
-           break;
-    }
-
-    return 0;
-}
-
-/*
- * SIOCSIWPMKSA
- */
-static int
-ar6000_ioctl_siwpmksa(struct net_device *dev,
-              struct iw_request_info *info,
-              struct iw_point *data, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    s32 ret;
-    int status;
-    struct iw_pmksa *pmksa;
-
-    pmksa = (struct iw_pmksa *)extra;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    ret = 0;
-    status = 0;
-
-    switch (pmksa->cmd) {
-        case IW_PMKSA_ADD:
-            status = wmi_setPmkid_cmd(ar->arWmi, (u8 *)pmksa->bssid.sa_data, pmksa->pmkid, true);
-            break;
-        case IW_PMKSA_REMOVE:
-            status = wmi_setPmkid_cmd(ar->arWmi, (u8 *)pmksa->bssid.sa_data, pmksa->pmkid, false);
-            break;
-        case IW_PMKSA_FLUSH:
-            if (ar->arConnected == true) {
-                status = wmi_setPmkid_cmd(ar->arWmi, ar->arBssid, NULL, 0);
-            }
-            break;
-        default:
-            ret=-1;
-            break;
-    }
-    if (status) {
-        ret = -1;
-    }
-
-    return ret;
-}
-
-#ifdef WAPI_ENABLE
-
-#define PN_INIT 0x5c365c36
-
-static int ar6000_set_wapi_key(struct net_device *dev,
-              struct iw_request_info *info,
-              struct iw_point *erq, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
-    KEY_USAGE   keyUsage = 0;
-    s32 keyLen;
-    u8 *keyData;
-    s32 index;
-    u32 *PN;
-    s32 i;
-    int    status;
-    u8 wapiKeyRsc[16];
-    CRYPTO_TYPE keyType = WAPI_CRYPT;
-    const u8 broadcastMac[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-
-    index = erq->flags & IW_ENCODE_INDEX;
-    if (index && (((index - 1) < WMI_MIN_KEY_INDEX) ||
-                ((index - 1) > WMI_MAX_KEY_INDEX))) {
-        return -EIO;
-    }
-
-    index--;
-    if (index < 0 || index > 4) {
-        return -EIO;
-    }
-    keyData = (u8 *)(ext + 1);
-    keyLen = erq->length - sizeof(struct iw_encode_ext);
-    memcpy(wapiKeyRsc, ext->tx_seq, sizeof(wapiKeyRsc));
-
-    if (memcmp(ext->addr.sa_data, broadcastMac, sizeof(broadcastMac)) == 0) {
-        keyUsage |= GROUP_USAGE;
-        PN = (u32 *)wapiKeyRsc;
-        for (i = 0; i < 4; i++) {
-            PN[i] = PN_INIT;
-        }
-    } else {
-        keyUsage |= PAIRWISE_USAGE;
-    }
-    status = wmi_addKey_cmd(ar->arWmi,
-                            index,
-                            keyType,
-                            keyUsage,
-                            keyLen,
-                            wapiKeyRsc,
-                            keyData,
-                            KEY_OP_INIT_WAPIPN,
-                            NULL,
-                            SYNC_BEFORE_WMIFLAG);
-    if (0 != status) {
-        return -EIO;
-    }
-    return 0;
-}
-
-#endif
-
-/*
- * SIOCSIWENCODEEXT
- */
-static int
-ar6000_ioctl_siwencodeext(struct net_device *dev,
-              struct iw_request_info *info,
-              struct iw_point *erq, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    s32 index;
-    struct iw_encode_ext *ext;
-    KEY_USAGE keyUsage;
-    s32 keyLen;
-    u8 *keyData;
-    u8 keyRsc[8];
-    int status;
-    CRYPTO_TYPE keyType;
-#ifdef USER_KEYS
-    struct ieee80211req_key ik;
-#endif /* USER_KEYS */
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-#ifdef USER_KEYS
-    ar->user_saved_keys.keyOk = false;
-#endif /* USER_KEYS */
-
-    index = erq->flags & IW_ENCODE_INDEX;
-
-    if (index && (((index - 1) < WMI_MIN_KEY_INDEX) ||
-                  ((index - 1) > WMI_MAX_KEY_INDEX)))
-    {
-        return -EIO;
-    }
-
-    ext = (struct iw_encode_ext *)extra;
-    if (erq->flags & IW_ENCODE_DISABLED) {
-        /*
-         * Encryption disabled
-         */
-        if (index) {
-            /*
-             * If key index was specified then clear the specified key
-             */
-            index--;
-            A_MEMZERO(ar->arWepKeyList[index].arKey,
-                      sizeof(ar->arWepKeyList[index].arKey));
-            ar->arWepKeyList[index].arKeyLen = 0;
-        }
-    } else {
-        /*
-         * Enabling WEP encryption
-         */
-        if (index) {
-            index--;                /* keyindex is off base 1 in iwconfig */
-        }
-
-        keyUsage = 0;
-        keyLen = erq->length - sizeof(struct iw_encode_ext);
-
-        if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
-            keyUsage = TX_USAGE;
-            ar->arDefTxKeyIndex = index;
-            // Just setting the key index
-            if (keyLen == 0) {
-                return 0;
-            }
-        }
-
-        if (keyLen <= 0) {
-            return -EIO;
-        }
-
-        /* key follows iw_encode_ext */
-        keyData = (u8 *)(ext + 1);
-
-        switch (ext->alg) {
-            case IW_ENCODE_ALG_WEP:
-                keyType = WEP_CRYPT;
-#ifdef USER_KEYS
-                ik.ik_type = IEEE80211_CIPHER_WEP;
-#endif /* USER_KEYS */
-                if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(keyLen)) {
-                    return -EIO;
-                }
-
-                /* Check whether it is static wep. */
-                if (!ar->arConnected) {
-                    A_MEMZERO(ar->arWepKeyList[index].arKey,
-                          sizeof(ar->arWepKeyList[index].arKey));
-                    memcpy(ar->arWepKeyList[index].arKey, keyData, keyLen);
-                    ar->arWepKeyList[index].arKeyLen = keyLen;
-
-                    return 0;
-                }
-                break;
-            case IW_ENCODE_ALG_TKIP:
-                keyType = TKIP_CRYPT;
-#ifdef USER_KEYS
-                ik.ik_type = IEEE80211_CIPHER_TKIP;
-#endif /* USER_KEYS */
-                break;
-            case IW_ENCODE_ALG_CCMP:
-                keyType = AES_CRYPT;
-#ifdef USER_KEYS
-                ik.ik_type = IEEE80211_CIPHER_AES_CCM;
-#endif /* USER_KEYS */
-                break;
-#ifdef WAPI_ENABLE
-            case IW_ENCODE_ALG_SM4:
-                if (ar->arWapiEnable) {
-                    return ar6000_set_wapi_key(dev, info, erq, extra);
-                } else {
-                    return -EIO;
-                }
-#endif
-            case IW_ENCODE_ALG_PMK:
-                ar->arConnectCtrlFlags |= CONNECT_DO_WPA_OFFLOAD;
-                return wmi_set_pmk_cmd(ar->arWmi, keyData);
-            default:
-                return -EIO;
-        }
-
-
-        if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY) {
-            keyUsage |= GROUP_USAGE;
-        } else {
-            keyUsage |= PAIRWISE_USAGE;
-        }
-
-        if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) {
-            memcpy(keyRsc, ext->rx_seq, sizeof(keyRsc));
-        } else {
-            A_MEMZERO(keyRsc, sizeof(keyRsc));
-        }
-
-        if (((WPA_PSK_AUTH == ar->arAuthMode) || (WPA2_PSK_AUTH == ar->arAuthMode)) &&
-            (GROUP_USAGE & keyUsage))
-        {
-            A_UNTIMEOUT(&ar->disconnect_timer);
-        }
-
-         status = wmi_addKey_cmd(ar->arWmi, index, keyType, keyUsage,
-                            keyLen, keyRsc,
-                            keyData, KEY_OP_INIT_VAL,
-                            (u8 *)ext->addr.sa_data,
-                            SYNC_BOTH_WMIFLAG);
-         if (status) {
-            return -EIO;
-         }
-
-#ifdef USER_KEYS
-        ik.ik_keyix = index;
-        ik.ik_keylen = keyLen;
-        memcpy(ik.ik_keydata, keyData, keyLen);
-        memcpy(&ik.ik_keyrsc, keyRsc, sizeof(keyRsc));
-        memcpy(ik.ik_macaddr, ext->addr.sa_data, ETH_ALEN);
-        if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY) {
-            memcpy(&ar->user_saved_keys.bcast_ik, &ik,
-                       sizeof(struct ieee80211req_key));
-        } else {
-            memcpy(&ar->user_saved_keys.ucast_ik, &ik,
-                      sizeof(struct ieee80211req_key));
-        }
-        ar->user_saved_keys.keyOk = true;
-#endif /* USER_KEYS */
-    }
-
-
-    return 0;
-}
-
-/*
- * SIOCGIWENCODEEXT
- */
-static int
-ar6000_ioctl_giwencodeext(struct net_device *dev,
-              struct iw_request_info *info,
-              struct iw_point *erq, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    if (ar->arPairwiseCrypto == NONE_CRYPT) {
-        erq->length = 0;
-        erq->flags = IW_ENCODE_DISABLED;
-    } else {
-        erq->length = 0;
-    }
-
-    return 0;
-}
-#endif // WIRELESS_EXT >= 18
-
-#if WIRELESS_EXT > 20
-static int ar6000_ioctl_siwpower(struct net_device *dev,
-                 struct iw_request_info *info,
-                 union iwreq_data *wrqu, char *extra)
-{
-#ifndef ATH6K_CONFIG_OTA_MODE
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_POWER_MODE power_mode;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    if (wrqu->power.disabled)
-        power_mode = MAX_PERF_POWER;
-    else
-        power_mode = REC_POWER;
-
-    if (wmi_powermode_cmd(ar->arWmi, power_mode) < 0)
-        return -EIO;
-#endif
-    return 0;
-}
-
-static int ar6000_ioctl_giwpower(struct net_device *dev,
-                 struct iw_request_info *info,
-                 union iwreq_data *wrqu, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    WMI_POWER_MODE power_mode;
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    power_mode = wmi_get_power_mode_cmd(ar->arWmi);
-
-    if (power_mode == MAX_PERF_POWER)
-        wrqu->power.disabled = 1;
-    else
-        wrqu->power.disabled = 0;
-
-    return 0;
-}
-#endif // WIRELESS_EXT > 20
-
-/*
- * SIOCGIWNAME
- */
-int
-ar6000_ioctl_giwname(struct net_device *dev,
-           struct iw_request_info *info,
-           char *name, char *extra)
-{
-    u8 capability;
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    capability = ar->arPhyCapability;
-    if(ar->arNetworkType == INFRA_NETWORK && ar->arConnected) {
-        bss_t *bss = wmi_find_node(ar->arWmi, ar->arBssid);
-        if (bss) {
-            capability = get_bss_phy_capability(bss);
-            wmi_node_return(ar->arWmi, bss);
-        }
-    }
-    switch (capability) {
-    case (WMI_11A_CAPABILITY):
-        strncpy(name, "AR6000 802.11a", IFNAMSIZ);
-        break;
-    case (WMI_11G_CAPABILITY):
-        strncpy(name, "AR6000 802.11g", IFNAMSIZ);
-        break;
-    case (WMI_11AG_CAPABILITY):
-        strncpy(name, "AR6000 802.11ag", IFNAMSIZ);
-        break;
-    case (WMI_11NA_CAPABILITY):
-        strncpy(name, "AR6000 802.11na", IFNAMSIZ);
-        break;
-    case (WMI_11NG_CAPABILITY):
-        strncpy(name, "AR6000 802.11ng", IFNAMSIZ);
-        break;
-    case (WMI_11NAG_CAPABILITY):
-        strncpy(name, "AR6000 802.11nag", IFNAMSIZ);
-        break;
-    default:
-        strncpy(name, "AR6000 802.11b", IFNAMSIZ);
-        break;
-    }
-
-    return 0;
-}
-
-/*
- * SIOCSIWFREQ
- */
-int
-ar6000_ioctl_siwfreq(struct net_device *dev,
-            struct iw_request_info *info,
-            struct iw_freq *freq, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    /*
-     * We support limiting the channels via wmiconfig.
-     *
-     * We use this command to configure the channel hint for the connect cmd
-     * so it is possible the target will end up connecting to a different
-     * channel.
-     */
-    if (freq->e > 1) {
-        return -EINVAL;
-    } else if (freq->e == 1) {
-        ar->arChannelHint = freq->m / 100000;
-    } else {
-        if(freq->m) {
-            ar->arChannelHint = wlan_ieee2freq(freq->m);
-        } else {
-            /* Auto Channel Selection */
-            ar->arChannelHint = 0;
-        }
-    }
-
-    ar->ap_profile_flag = 1; /* There is a change in profile */
-
-    A_PRINTF("channel hint set to %d\n", ar->arChannelHint);
-    return 0;
-}
-
-/*
- * SIOCGIWFREQ
- */
-int
-ar6000_ioctl_giwfreq(struct net_device *dev,
-                struct iw_request_info *info,
-                struct iw_freq *freq, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    if (ar->arNetworkType == AP_NETWORK) {
-        if(ar->arChannelHint) {
-            freq->m = ar->arChannelHint * 100000;
-        } else if(ar->arACS) {
-            freq->m = ar->arACS * 100000;
-        } else {
-            return -EINVAL;
-        }
-    } else {
-        if (ar->arConnected != true) {
-            return -EINVAL;
-        } else {
-            freq->m = ar->arBssChannel * 100000;
-        }
-    }
-
-    freq->e = 1;
-
-    return 0;
-}
-
-/*
- * SIOCSIWMODE
- */
-int
-ar6000_ioctl_siwmode(struct net_device *dev,
-            struct iw_request_info *info,
-            __u32 *mode, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    /*
-     * clear SSID during mode switch in connected state
-     */
-    if(!(ar->arNetworkType == (((*mode) == IW_MODE_INFRA) ? INFRA_NETWORK : ADHOC_NETWORK)) && (ar->arConnected == true) ){
-        A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
-        ar->arSsidLen = 0;
-    }
-
-    switch (*mode) {
-    case IW_MODE_INFRA:
-        ar->arNextMode = INFRA_NETWORK;
-        break;
-    case IW_MODE_ADHOC:
-        ar->arNextMode = ADHOC_NETWORK;
-        break;
-    case IW_MODE_MASTER:
-        ar->arNextMode = AP_NETWORK;
-        break;
-    default:
-        return -EINVAL;
-    }
-
-    /* clear all shared parameters between AP and STA|IBSS modes when we
-     * switch between them. Switch between STA & IBSS modes does'nt clear
-     * the shared profile. This is as per the original design for switching
-     * between STA & IBSS.
-     */
-    if (ar->arNetworkType == AP_NETWORK || ar->arNextMode == AP_NETWORK) {
-        ar->arDot11AuthMode      = OPEN_AUTH;
-        ar->arAuthMode           = NONE_AUTH;
-        ar->arPairwiseCrypto     = NONE_CRYPT;
-        ar->arPairwiseCryptoLen  = 0;
-        ar->arGroupCrypto        = NONE_CRYPT;
-        ar->arGroupCryptoLen     = 0;
-        ar->arChannelHint        = 0;
-        ar->arBssChannel         = 0;
-        A_MEMZERO(ar->arBssid, sizeof(ar->arBssid));
-        A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
-        ar->arSsidLen = 0;
-    }
-
-    /* SSID has to be cleared to trigger a profile change while switching
-     * between STA & IBSS modes having the same SSID
-     */
-    if (ar->arNetworkType != ar->arNextMode) {
-        A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
-        ar->arSsidLen = 0;
-    }
-
-    return 0;
-}
-
-/*
- * SIOCGIWMODE
- */
-int
-ar6000_ioctl_giwmode(struct net_device *dev,
-            struct iw_request_info *info,
-            __u32 *mode, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    switch (ar->arNetworkType) {
-    case INFRA_NETWORK:
-        *mode = IW_MODE_INFRA;
-        break;
-    case ADHOC_NETWORK:
-        *mode = IW_MODE_ADHOC;
-        break;
-    case AP_NETWORK:
-        *mode = IW_MODE_MASTER;
-        break;
-    default:
-        return -EIO;
-    }
-    return 0;
-}
-
-/*
- * SIOCSIWSENS
- */
-int
-ar6000_ioctl_siwsens(struct net_device *dev,
-            struct iw_request_info *info,
-            struct iw_param *sens, char *extra)
-{
-    return 0;
-}
-
-/*
- * SIOCGIWSENS
- */
-int
-ar6000_ioctl_giwsens(struct net_device *dev,
-            struct iw_request_info *info,
-            struct iw_param *sens, char *extra)
-{
-    sens->value = 0;
-    sens->fixed = 1;
-
-    return 0;
-}
-
-/*
- * SIOCGIWRANGE
- */
-int
-ar6000_ioctl_giwrange(struct net_device *dev,
-             struct iw_request_info *info,
-             struct iw_point *data, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    struct iw_range *range = (struct iw_range *) extra;
-    int i, ret = 0;
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->bIsDestroyProgress) {
-        return -EBUSY;
-    }
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (down_interruptible(&ar->arSem)) {
-        return -ERESTARTSYS;
-    }
-
-    if (ar->bIsDestroyProgress) {
-        up(&ar->arSem);
-        return -EBUSY;
-    }
-
-    ar->arNumChannels = -1;
-    A_MEMZERO(ar->arChannelList, sizeof (ar->arChannelList));
-
-    if (wmi_get_channelList_cmd(ar->arWmi) != 0) {
-        up(&ar->arSem);
-        return -EIO;
-    }
-
-    wait_event_interruptible_timeout(arEvent, ar->arNumChannels != -1, wmitimeout * HZ);
-
-    if (signal_pending(current)) {
-        up(&ar->arSem);
-        return -EINTR;
-    }
-
-    data->length = sizeof(struct iw_range);
-    A_MEMZERO(range, sizeof(struct iw_range));
-
-    range->txpower_capa = 0;
-
-    range->min_pmp = 1 * 1024;
-    range->max_pmp = 65535 * 1024;
-    range->min_pmt = 1 * 1024;
-    range->max_pmt = 1000 * 1024;
-    range->pmp_flags = IW_POWER_PERIOD;
-    range->pmt_flags = IW_POWER_TIMEOUT;
-    range->pm_capa = 0;
-
-    range->we_version_compiled = WIRELESS_EXT;
-    range->we_version_source = 13;
-
-    range->retry_capa = IW_RETRY_LIMIT;
-    range->retry_flags = IW_RETRY_LIMIT;
-    range->min_retry = 0;
-    range->max_retry = 255;
-
-    range->num_frequency = range->num_channels = ar->arNumChannels;
-    for (i = 0; i < ar->arNumChannels; i++) {
-        range->freq[i].i = wlan_freq2ieee(ar->arChannelList[i]);
-        range->freq[i].m = ar->arChannelList[i] * 100000;
-        range->freq[i].e = 1;
-         /*
-         * Linux supports max of 32 channels, bail out once you
-         * reach the max.
-         */
-        if (i == IW_MAX_FREQUENCIES) {
-            break;
-        }
-    }
-
-    /* Max quality is max field value minus noise floor */
-    range->max_qual.qual  = 0xff - 161;
-
-    /*
-     * In order to use dBm measurements, 'level' must be lower
-     * than any possible measurement (see iw_print_stats() in
-     * wireless tools).  It's unclear how this is meant to be
-     * done, but setting zero in these values forces dBm and
-     * the actual numbers are not used.
-     */
-    range->max_qual.level = 0;
-    range->max_qual.noise = 0;
-
-    range->sensitivity = 3;
-
-    range->max_encoding_tokens = 4;
-    /* XXX query driver to find out supported key sizes */
-    range->num_encoding_sizes = 3;
-    range->encoding_size[0] = 5;        /* 40-bit */
-    range->encoding_size[1] = 13;       /* 104-bit */
-    range->encoding_size[2] = 16;       /* 128-bit */
-
-    range->num_bitrates = 0;
-
-    /* estimated maximum TCP throughput values (bps) */
-    range->throughput = 22000000;
-
-    range->min_rts = 0;
-    range->max_rts = 2347;
-    range->min_frag = 256;
-    range->max_frag = 2346;
-
-    up(&ar->arSem);
-
-    return ret;
-}
-
-
-/*
- * SIOCSIWAP
- * This ioctl is used to set the desired bssid for the connect command.
- */
-int
-ar6000_ioctl_siwap(struct net_device *dev,
-              struct iw_request_info *info,
-              struct sockaddr *ap_addr, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    if (ap_addr->sa_family != ARPHRD_ETHER) {
-        return -EIO;
-    }
-
-    if (memcmp(&ap_addr->sa_data, bcast_mac, AR6000_ETH_ADDR_LEN) == 0) {
-        A_MEMZERO(ar->arReqBssid, sizeof(ar->arReqBssid));
-    } else {
-        memcpy(ar->arReqBssid, &ap_addr->sa_data,  sizeof(ar->arReqBssid));
-    }
-
-    return 0;
-}
-
-/*
- * SIOCGIWAP
- */
-int
-ar6000_ioctl_giwap(struct net_device *dev,
-              struct iw_request_info *info,
-              struct sockaddr *ap_addr, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    if (ar->arNetworkType == AP_NETWORK) {
-        memcpy(&ap_addr->sa_data, dev->dev_addr, ATH_MAC_LEN);
-        ap_addr->sa_family = ARPHRD_ETHER;
-        return 0;
-    }
-
-    if (ar->arConnected != true) {
-        return -EINVAL;
-    }
-
-    memcpy(&ap_addr->sa_data, ar->arBssid, sizeof(ar->arBssid));
-    ap_addr->sa_family = ARPHRD_ETHER;
-
-    return 0;
-}
-
-#if (WIRELESS_EXT >= 18)
-/*
- * SIOCSIWMLME
- */
-int
-ar6000_ioctl_siwmlme(struct net_device *dev,
-            struct iw_request_info *info,
-            struct iw_point *data, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->bIsDestroyProgress) {
-        return -EBUSY;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (down_interruptible(&ar->arSem)) {
-        return -ERESTARTSYS;
-    }
-
-    if (data->pointer && data->length == sizeof(struct iw_mlme)) {
-
-        u8 arNetworkType;
-        struct iw_mlme mlme;
-
-        if (copy_from_user(&mlme, data->pointer, sizeof(struct iw_mlme)))
-            return -EIO;
-
-        switch (mlme.cmd) {
-
-            case IW_MLME_DEAUTH:
-                /* fall through */
-            case IW_MLME_DISASSOC:
-                if ((ar->arConnected != true) ||
-                    (memcmp(ar->arBssid, mlme.addr.sa_data, 6) != 0)) {
-
-                    up(&ar->arSem);
-                    return -EINVAL;
-                }
-                wmi_setPmkid_cmd(ar->arWmi, ar->arBssid, NULL, 0);
-                arNetworkType = ar->arNetworkType;
-                ar6000_init_profile_info(ar);
-                ar->arNetworkType = arNetworkType;
-                reconnect_flag = 0;
-                ar6000_disconnect(ar);
-                A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
-                ar->arSsidLen = 0;
-                if (ar->arSkipScan == false) {
-                    A_MEMZERO(ar->arReqBssid, sizeof(ar->arReqBssid));
-                }
-                break;
-
-            case IW_MLME_AUTH:
-                /* fall through */
-            case IW_MLME_ASSOC:
-                /* fall through */
-            default:
-                up(&ar->arSem);
-                return -EOPNOTSUPP;
-        }
-    }
-
-    up(&ar->arSem);
-    return 0;
-}
-#endif /* WIRELESS_EXT >= 18 */
-
-/*
- * SIOCGIWAPLIST
- */
-int
-ar6000_ioctl_iwaplist(struct net_device *dev,
-            struct iw_request_info *info,
-            struct iw_point *data, char *extra)
-{
-    return -EIO;            /* for now */
-}
-
-/*
- * SIOCSIWSCAN
- */
-int
-ar6000_ioctl_siwscan(struct net_device *dev,
-                     struct iw_request_info *info,
-                     struct iw_point *data, char *extra)
-{
-#define ACT_DWELLTIME_DEFAULT   105
-#define HOME_TXDRAIN_TIME       100
-#define SCAN_INT                HOME_TXDRAIN_TIME + ACT_DWELLTIME_DEFAULT
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-    int ret = 0;
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    /* If scan is issued in the middle of ongoing scan or connect,
-       dont issue another one */
-    if ( ar->scan_triggered > 0 ) {
-        ++ar->scan_triggered;
-        if (ar->scan_triggered < 5) {
-            return 0;
-        } else {
-            AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_SCAN,("Scan request is triggered over 5 times. Not scan complete event\n"));
-        }
-    } 
-
-    if (!ar->arUserBssFilter) {
-        if (wmi_bssfilter_cmd(ar->arWmi, ALL_BSS_FILTER, 0) != 0) {
-            return -EIO;
-        }
-    }
-
-    if (ar->arConnected) {
-        if  (wmi_get_stats_cmd(ar->arWmi) != 0) {
-            return -EIO;
-        }
-    }
-
-#ifdef ANDROID_ENV
-#if WIRELESS_EXT >= 18
-    if (data->pointer && (data->length == sizeof(struct iw_scan_req)))
-    {
-        if ((data->flags & IW_SCAN_THIS_ESSID) == IW_SCAN_THIS_ESSID)
-        {
-            struct iw_scan_req req;
-            if (copy_from_user(&req, data->pointer, sizeof(struct iw_scan_req)))
-                return -EIO;
-            if (wmi_probedSsid_cmd(ar->arWmi, 1, SPECIFIC_SSID_FLAG, req.essid_len, req.essid) != 0)
-                return -EIO;
-            ar->scanSpecificSsid = true;
-        }
-        else
-        {
-            if (ar->scanSpecificSsid) {
-                if (wmi_probedSsid_cmd(ar->arWmi, 1, DISABLE_SSID_FLAG, 0, NULL) != 0)
-                    return -EIO;
-                 ar->scanSpecificSsid = false;
-            }
-        }
-    }
-    else
-    {
-        if (ar->scanSpecificSsid) {
-            if (wmi_probedSsid_cmd(ar->arWmi, 1, DISABLE_SSID_FLAG, 0, NULL) != 0)
-                return -EIO;
-             ar->scanSpecificSsid = false;
-        }
-    }
-#endif
-#endif /* ANDROID_ENV */
-
-    if (wmi_startscan_cmd(ar->arWmi, WMI_LONG_SCAN, false, false, \
-                          0, 0, 0, NULL) != 0) {
-        ret = -EIO;
-    }
-
-    if (ret == 0) {
-        ar->scan_triggered = 1;
-    }
-
-    return ret;
-#undef  ACT_DWELLTIME_DEFAULT
-#undef HOME_TXDRAIN_TIME
-#undef SCAN_INT
-}
-
-
-/*
- * Units are in db above the noise floor. That means the
- * rssi values reported in the tx/rx descriptors in the
- * driver are the SNR expressed in db.
- *
- * If you assume that the noise floor is -95, which is an
- * excellent assumption 99.5 % of the time, then you can
- * derive the absolute signal level (i.e. -95 + rssi).
- * There are some other slight factors to take into account
- * depending on whether the rssi measurement is from 11b,
- * 11g, or 11a.   These differences are at most 2db and
- * can be documented.
- *
- * NB: various calculations are based on the orinoco/wavelan
- *     drivers for compatibility
- */
-static void
-ar6000_set_quality(struct iw_quality *iq, s8 rssi)
-{
-    if (rssi < 0) {
-        iq->qual = 0;
-    } else {
-        iq->qual = rssi;
-    }
-
-    /* NB: max is 94 because noise is hardcoded to 161 */
-    if (iq->qual > 94)
-        iq->qual = 94;
-
-    iq->noise = 161;        /* -95dBm */
-    iq->level = iq->noise + iq->qual;
-    iq->updated = 7;
-}
-
-
-int
-ar6000_ioctl_siwcommit(struct net_device *dev,
-                     struct iw_request_info *info,
-                     struct iw_point *data, char *extra)
-{
-    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
-
-    if (is_iwioctl_allowed(ar->arNextMode, info->cmd) != 0) {
-        A_PRINTF("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd);
-        return -EOPNOTSUPP;
-    }
-
-    if (ar->arWmiReady == false) {
-        return -EIO;
-    }
-
-    if (ar->arWlanState == WLAN_DISABLED) {
-        return -EIO;
-    }
-
-    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("AP: SSID %s freq %d authmode %d dot11 auth %d"\
-                    " PW crypto %d GRP crypto %d\n",
-                    ar->arSsid, ar->arChannelHint,
-                    ar->arAuthMode, ar->arDot11AuthMode,
-                    ar->arPairwiseCrypto, ar->arGroupCrypto));
-
-    ar6000_ap_mode_profile_commit(ar);
-
-    /* if there is a profile switch from STA|IBSS mode to AP mode,
-     * update the host driver association state for the STA|IBSS mode.
-     */
-    if (ar->arNetworkType != AP_NETWORK && ar->arNextMode == AP_NETWORK) {
-        /* Stop getting pkts from upper stack */
-        netif_stop_queue(ar->arNetDev);
-        A_MEMZERO(ar->arBssid, sizeof(ar->arBssid));
-        ar->arBssChannel = 0;
-        ar->arBeaconInterval = 0;
-
-        /* Flush the Tx queues */
-        ar6000_TxDataCleanup(ar);
-
-        /* Start getting pkts from upper stack */
-        netif_wake_queue(ar->arNetDev);
-    }
-
-    return 0;
-}
-
-#define W_PROTO(_x) wait_ ## _x
-#define WAIT_HANDLER_IMPL(_x, type) \
-int wait_ ## _x (struct net_device *dev, struct iw_request_info *info, type wrqu, char *extra) {\
-    int ret; \
-    dev_hold(dev); \
-    rtnl_unlock(); \
-    ret = _x(dev, info, wrqu, extra); \
-    rtnl_lock(); \
-    dev_put(dev); \
-    return ret;\
-}
-
-WAIT_HANDLER_IMPL(ar6000_ioctl_siwessid, struct iw_point *)
-WAIT_HANDLER_IMPL(ar6000_ioctl_giwrate, struct iw_param *)
-WAIT_HANDLER_IMPL(ar6000_ioctl_giwtxpow, struct iw_param *)
-WAIT_HANDLER_IMPL(ar6000_ioctl_giwrange, struct iw_point*)
-
-/* Structures to export the Wireless Handlers */
-static const iw_handler ath_handlers[] = {
-    (iw_handler) ar6000_ioctl_siwcommit,        /* SIOCSIWCOMMIT */
-    (iw_handler) ar6000_ioctl_giwname,          /* SIOCGIWNAME */
-    (iw_handler) NULL,                          /* SIOCSIWNWID */
-    (iw_handler) NULL,                          /* SIOCGIWNWID */
-    (iw_handler) ar6000_ioctl_siwfreq,          /* SIOCSIWFREQ */
-    (iw_handler) ar6000_ioctl_giwfreq,          /* SIOCGIWFREQ */
-    (iw_handler) ar6000_ioctl_siwmode,          /* SIOCSIWMODE */
-    (iw_handler) ar6000_ioctl_giwmode,          /* SIOCGIWMODE */
-    (iw_handler) ar6000_ioctl_siwsens,          /* SIOCSIWSENS */
-    (iw_handler) ar6000_ioctl_giwsens,          /* SIOCGIWSENS */
-    (iw_handler) NULL /* not _used */,          /* SIOCSIWRANGE */
-    (iw_handler) W_PROTO(ar6000_ioctl_giwrange),/* SIOCGIWRANGE */
-    (iw_handler) NULL /* not used */,           /* SIOCSIWPRIV */
-    (iw_handler) NULL /* kernel code */,        /* SIOCGIWPRIV */
-    (iw_handler) NULL /* not used */,           /* SIOCSIWSTATS */
-    (iw_handler) NULL /* kernel code */,        /* SIOCGIWSTATS */
-    (iw_handler) NULL,                          /* SIOCSIWSPY */
-    (iw_handler) NULL,                          /* SIOCGIWSPY */
-    (iw_handler) NULL,                          /* SIOCSIWTHRSPY */
-    (iw_handler) NULL,                          /* SIOCGIWTHRSPY */
-    (iw_handler) ar6000_ioctl_siwap,            /* SIOCSIWAP */
-    (iw_handler) ar6000_ioctl_giwap,            /* SIOCGIWAP */
-#if (WIRELESS_EXT >= 18)
-    (iw_handler) ar6000_ioctl_siwmlme,          /* SIOCSIWMLME */
-#else
-    (iw_handler) NULL,                          /* -- hole -- */
-#endif  /* WIRELESS_EXT >= 18 */
-    (iw_handler) ar6000_ioctl_iwaplist,         /* SIOCGIWAPLIST */
-    (iw_handler) ar6000_ioctl_siwscan,          /* SIOCSIWSCAN */
-    (iw_handler) ar6000_ioctl_giwscan,          /* SIOCGIWSCAN */
-    (iw_handler) W_PROTO(ar6000_ioctl_siwessid),/* SIOCSIWESSID */
-    (iw_handler) ar6000_ioctl_giwessid,         /* SIOCGIWESSID */
-    (iw_handler) NULL,                          /* SIOCSIWNICKN */
-    (iw_handler) NULL,                          /* SIOCGIWNICKN */
-    (iw_handler) NULL,                          /* -- hole -- */
-    (iw_handler) NULL,                          /* -- hole -- */
-    (iw_handler) ar6000_ioctl_siwrate,          /* SIOCSIWRATE */
-    (iw_handler) W_PROTO(ar6000_ioctl_giwrate), /* SIOCGIWRATE */
-    (iw_handler) NULL,                          /* SIOCSIWRTS */
-    (iw_handler) NULL,                          /* SIOCGIWRTS */
-    (iw_handler) NULL,                          /* SIOCSIWFRAG */
-    (iw_handler) NULL,                          /* SIOCGIWFRAG */
-    (iw_handler) ar6000_ioctl_siwtxpow,         /* SIOCSIWTXPOW */
-    (iw_handler) W_PROTO(ar6000_ioctl_giwtxpow),/* SIOCGIWTXPOW */
-    (iw_handler) ar6000_ioctl_siwretry,         /* SIOCSIWRETRY */
-    (iw_handler) ar6000_ioctl_giwretry,         /* SIOCGIWRETRY */
-    (iw_handler) ar6000_ioctl_siwencode,        /* SIOCSIWENCODE */
-    (iw_handler) ar6000_ioctl_giwencode,        /* SIOCGIWENCODE */
-#if WIRELESS_EXT > 20
-    (iw_handler) ar6000_ioctl_siwpower,         /* SIOCSIWPOWER */
-    (iw_handler) ar6000_ioctl_giwpower,         /* SIOCGIWPOWER */
-#endif // WIRELESS_EXT > 20
-#if WIRELESS_EXT >= 18
-    (iw_handler) NULL,                          /* -- hole -- */
-    (iw_handler) NULL,                          /* -- hole -- */
-    (iw_handler) ar6000_ioctl_siwgenie,         /* SIOCSIWGENIE */
-    (iw_handler) ar6000_ioctl_giwgenie,         /* SIOCGIWGENIE */
-    (iw_handler) ar6000_ioctl_siwauth,          /* SIOCSIWAUTH */
-    (iw_handler) ar6000_ioctl_giwauth,          /* SIOCGIWAUTH */
-    (iw_handler) ar6000_ioctl_siwencodeext,     /* SIOCSIWENCODEEXT */
-    (iw_handler) ar6000_ioctl_giwencodeext,     /* SIOCGIWENCODEEXT */
-    (iw_handler) ar6000_ioctl_siwpmksa,         /* SIOCSIWPMKSA */
-#endif // WIRELESS_EXT >= 18
-};
-
-struct iw_handler_def ath_iw_handler_def = {
-    .standard         = (iw_handler *)ath_handlers,
-    .num_standard     = ARRAY_SIZE(ath_handlers),
-    .private          = NULL,
-    .num_private      = 0,
-};
diff --git a/drivers/staging/ath6kl/reorder/rcv_aggr.c b/drivers/staging/ath6kl/reorder/rcv_aggr.c
index 094b227..788d088 100644
--- a/drivers/staging/ath6kl/reorder/rcv_aggr.c
+++ b/drivers/staging/ath6kl/reorder/rcv_aggr.c
@@ -21,8 +21,6 @@
  *
  */
 
-#ifdef  ATH_AR6K_11N_SUPPORT
-
 #include <a_config.h>
 #include <athdefs.h>
 #include <a_types.h>
@@ -123,7 +121,7 @@
     rxtid->hold_q_sz = 0;
 
     if(rxtid->hold_q) {
-        A_FREE(rxtid->hold_q);
+        kfree(rxtid->hold_q);
         rxtid->hold_q = NULL;
     }
 
@@ -154,7 +152,7 @@
                         A_NETBUF_FREE(rxtid->hold_q[k].osbuf);
                     }
                 }
-                A_FREE(rxtid->hold_q);
+                kfree(rxtid->hold_q);
             }
             /* Free the dispatch q contents*/
             while(A_NETBUF_QUEUE_SIZE(&rxtid->q)) {
@@ -168,7 +166,7 @@
         while(A_NETBUF_QUEUE_SIZE(&p_aggr->freeQ)) {
             A_NETBUF_FREE(A_NETBUF_DEQUEUE(&p_aggr->freeQ));
         }
-        A_FREE(p_aggr);
+        kfree(p_aggr);
     }
     A_PRINTF("out aggr_module_destroy\n");
 }
@@ -662,5 +660,3 @@
     A_PRINTF("================================================\n\n");
 
 }
-
-#endif  /* ATH_AR6K_11N_SUPPORT */
diff --git a/drivers/staging/ath6kl/wlan/include/ieee80211.h b/drivers/staging/ath6kl/wlan/include/ieee80211.h
index 532ab0eb..cf47d06 100644
--- a/drivers/staging/ath6kl/wlan/include/ieee80211.h
+++ b/drivers/staging/ath6kl/wlan/include/ieee80211.h
@@ -23,8 +23,6 @@
 #ifndef _NET80211_IEEE80211_H_
 #define _NET80211_IEEE80211_H_
 
-#include "athstartpack.h"
-
 /*
  * 802.11 protocol definitions.
  */
@@ -396,6 +394,4 @@
 
 #define IEEE80211_PS_MAX_QUEUE    50 /*Maximum no of buffers that can be queues for PS*/
 
-#include "athendpack.h"
-
 #endif /* _NET80211_IEEE80211_H_ */
diff --git a/drivers/staging/ath6kl/wlan/src/wlan_node.c b/drivers/staging/ath6kl/wlan/src/wlan_node.c
index 1a3ac7d..b166dd4 100644
--- a/drivers/staging/ath6kl/wlan/src/wlan_node.c
+++ b/drivers/staging/ath6kl/wlan/src/wlan_node.c
@@ -72,7 +72,7 @@
         {
         ni->ni_buf = A_MALLOC_NOWAIT(wh_size);
         if (ni->ni_buf == NULL) {
-            A_FREE(ni);
+            kfree(ni);
             ni = NULL;
             return ni;
         }
@@ -104,9 +104,9 @@
 wlan_node_free(bss_t *ni)
 {
     if (ni->ni_buf != NULL) {
-        A_FREE(ni->ni_buf);
+        kfree(ni->ni_buf);
     }
-    A_FREE(ni);
+    kfree(ni);
 }
 
 void
diff --git a/drivers/staging/ath6kl/wmi/wmi.c b/drivers/staging/ath6kl/wmi/wmi.c
index a00bf0a..c3a1cc5 100644
--- a/drivers/staging/ath6kl/wmi/wmi.c
+++ b/drivers/staging/ath6kl/wmi/wmi.c
@@ -129,14 +129,6 @@
 static int
 wmi_set_params_event_rx(struct wmi_t *wmip, u8 *datap, u32 len);
 
-static int
-wmi_acm_reject_event_rx(struct wmi_t *wmip, u8 *datap, u32 len);
-
-#ifdef CONFIG_HOST_GPIO_SUPPORT
-static int wmi_gpio_intr_rx(struct wmi_t *wmip, u8 *datap, int len);
-static int wmi_gpio_data_rx(struct wmi_t *wmip, u8 *datap, int len);
-static int wmi_gpio_ack_rx(struct wmi_t *wmip, u8 *datap, int len);
-#endif /* CONFIG_HOST_GPIO_SUPPORT */
 
 #ifdef CONFIG_HOST_TCMD_SUPPORT
 static int
@@ -187,13 +179,11 @@
 
 static int wmi_peer_node_event_rx (struct wmi_t *wmip, u8 *datap,
                                         int len);
-#ifdef ATH_AR6K_11N_SUPPORT
 static int wmi_addba_req_event_rx(struct wmi_t *, u8 *, int);
 static int wmi_addba_resp_event_rx(struct wmi_t *, u8 *, int);
 static int wmi_delba_req_event_rx(struct wmi_t *, u8 *, int);
 static int wmi_btcoex_config_event_rx(struct wmi_t *wmip, u8 *datap, int len);
 static int wmi_btcoex_stats_event_rx(struct wmi_t *wmip, u8 *datap, int len);
-#endif
 static int wmi_hci_event_rx(struct wmi_t *, u8 *, int);
 
 #ifdef WAPI_ENABLE
@@ -273,8 +263,6 @@
                 WMM_AC_VO,
             };
 
-#include "athstartpack.h"
-
 /* This stuff is used when we want a simple layer-3 visibility */
 typedef PREPACK struct _iphdr {
     u8 ip_ver_hdrlen;          /* version and hdr length */
@@ -292,8 +280,6 @@
     u8 ip_dst[4];
 } POSTPACK iphdr;
 
-#include "athendpack.h"
-
 static s16 rssi_event_value = 0;
 static s16 snr_event_value = 0;
 
@@ -381,7 +367,7 @@
             A_MUTEX_DELETE(&wmip->wmi_lock);
 #endif
         }
-        A_FREE(wmip);
+        kfree(wmip);
     }
 }
 
@@ -475,7 +461,6 @@
         	*pVersion = WMI_META_VERSION_1;
 		return (0);
     		}
-#ifdef CONFIG_CHECKSUM_OFFLOAD
 	case WMI_META_VERSION_2:
 		{
      		WMI_TX_META_V2 *pV2 ;
@@ -487,7 +472,6 @@
          	memcpy(pV2,(WMI_TX_META_V2 *)pTxMetaS,sizeof(WMI_TX_META_V2));
 		return (0);
     		}
-#endif
 	default:
 		return (0);
     }
@@ -525,7 +509,8 @@
     }
 
     WMI_DATA_HDR_SET_META(dtHdr, metaVersion);
-    //dtHdr->rssi = 0;
+
+    dtHdr->info3 = 0;
 
     return (0);
 }
@@ -865,17 +850,6 @@
         status = wmi_dset_data_req_rx(wmip, datap, len);
         break;
 #endif /* CONFIG_HOST_DSET_SUPPORT */
-#ifdef CONFIG_HOST_GPIO_SUPPORT
-    case (WMIX_GPIO_INTR_EVENTID):
-        wmi_gpio_intr_rx(wmip, datap, len);
-        break;
-    case (WMIX_GPIO_DATA_EVENTID):
-        wmi_gpio_data_rx(wmip, datap, len);
-        break;
-    case (WMIX_GPIO_ACK_EVENTID):
-        wmi_gpio_ack_rx(wmip, datap, len);
-        break;
-#endif /* CONFIG_HOST_GPIO_SUPPORT */
     case (WMIX_HB_CHALLENGE_RESP_EVENTID):
         wmi_hbChallengeResp_rx(wmip, datap, len);
         break;
@@ -967,23 +941,19 @@
     case (WMI_READY_EVENTID):
         A_DPRINTF(DBG_WMI, (DBGFMT "WMI_READY_EVENTID\n", DBGARG));
         status = wmi_ready_event_rx(wmip, datap, len);
-        A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
         A_WMI_DBGLOG_INIT_DONE(wmip->wmi_devt);
         break;
     case (WMI_CONNECT_EVENTID):
         A_DPRINTF(DBG_WMI, (DBGFMT "WMI_CONNECT_EVENTID\n", DBGARG));
         status = wmi_connect_event_rx(wmip, datap, len);
-        A_WMI_SEND_GENERIC_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
         break;
     case (WMI_DISCONNECT_EVENTID):
         A_DPRINTF(DBG_WMI, (DBGFMT "WMI_DISCONNECT_EVENTID\n", DBGARG));
         status = wmi_disconnect_event_rx(wmip, datap, len);
-        A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
         break;
     case (WMI_PEER_NODE_EVENTID):
         A_DPRINTF (DBG_WMI, (DBGFMT "WMI_PEER_NODE_EVENTID\n", DBGARG));
         status = wmi_peer_node_event_rx(wmip, datap, len);
-        A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
         break;
     case (WMI_TKIP_MICERR_EVENTID):
         A_DPRINTF(DBG_WMI, (DBGFMT "WMI_TKIP_MICERR_EVENTID\n", DBGARG));
@@ -1014,7 +984,6 @@
             memcpy(bih->bssid, bih2.bssid, ATH_MAC_LEN);
 
             status = wmi_bssInfo_event_rx(wmip, datap, len);
-            A_WMI_SEND_GENERIC_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
         }
         break;
     case (WMI_REGDOMAIN_EVENTID):
@@ -1024,13 +993,6 @@
     case (WMI_PSTREAM_TIMEOUT_EVENTID):
         A_DPRINTF(DBG_WMI, (DBGFMT "WMI_PSTREAM_TIMEOUT_EVENTID\n", DBGARG));
         status = wmi_pstream_timeout_event_rx(wmip, datap, len);
-            /* pstreams are fatpipe abstractions that get implicitly created.
-             * User apps only deal with thinstreams. creation of a thinstream
-             * by the user or data traffic flow in an AC triggers implicit
-             * pstream creation. Do we need to send this event to App..?
-             * no harm in sending it.
-             */
-        A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
         break;
     case (WMI_NEIGHBOR_REPORT_EVENTID):
         A_DPRINTF(DBG_WMI, (DBGFMT "WMI_NEIGHBOR_REPORT_EVENTID\n", DBGARG));
@@ -1039,7 +1001,6 @@
     case (WMI_SCAN_COMPLETE_EVENTID):
         A_DPRINTF(DBG_WMI, (DBGFMT "WMI_SCAN_COMPLETE_EVENTID\n", DBGARG));
         status = wmi_scanComplete_rx(wmip, datap, len);
-        A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
         break;
     case (WMI_CMDERROR_EVENTID):
         A_DPRINTF(DBG_WMI, (DBGFMT "WMI_CMDERROR_EVENTID\n", DBGARG));
@@ -1056,7 +1017,6 @@
     case (WMI_ERROR_REPORT_EVENTID):
         A_DPRINTF(DBG_WMI, (DBGFMT "WMI_ERROR_REPORT_EVENTID\n", DBGARG));
         status = wmi_reportErrorEvent_rx(wmip, datap, len);
-        A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
         break;
     case (WMI_OPT_RX_FRAME_EVENTID):
         A_DPRINTF(DBG_WMI, (DBGFMT "WMI_OPT_RX_FRAME_EVENTID\n", DBGARG));
@@ -1095,7 +1055,6 @@
     case (WMI_TX_RETRY_ERR_EVENTID):
         A_DPRINTF(DBG_WMI, (DBGFMT "WMI_TX_RETRY_ERR_EVENTID\n", DBGARG));
         status = wmi_txRetryErrEvent_rx(wmip, datap, len);
-        A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
         break;
     case (WMI_SNR_THRESHOLD_EVENTID):
         A_DPRINTF(DBG_WMI, (DBGFMT "WMI_SNR_THRESHOLD_EVENTID\n", DBGARG));
@@ -1104,7 +1063,6 @@
     case (WMI_LQ_THRESHOLD_EVENTID):
         A_DPRINTF(DBG_WMI, (DBGFMT "WMI_LQ_THRESHOLD_EVENTID\n", DBGARG));
         status = wmi_lqThresholdEvent_rx(wmip, datap, len);
-        A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
         break;
     case (WMI_APLIST_EVENTID):
         AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Received APLIST Event\n"));
@@ -1133,11 +1091,6 @@
         A_DPRINTF(DBG_WMI, (DBGFMT "WMI_SET_PARAMS_REPLY Event\n", DBGARG));
         status = wmi_set_params_event_rx(wmip, datap, len);
         break;
-    case (WMI_ACM_REJECT_EVENTID):
-        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_SET_PARAMS_REPLY Event\n", DBGARG));
-        status = wmi_acm_reject_event_rx(wmip, datap, len);
-        break;		
-#ifdef ATH_AR6K_11N_SUPPORT
     case (WMI_ADDBA_REQ_EVENTID):
         status = wmi_addba_req_event_rx(wmip, datap, len);
         break;
@@ -1155,7 +1108,6 @@
 	    A_DPRINTF(DBG_WMI, (DBGFMT "WMI_BTCOEX_STATS_EVENTID", DBGARG));
     	status = wmi_btcoex_stats_event_rx(wmip, datap, len);
 	    break;
-#endif
     case (WMI_TX_COMPLETE_EVENTID):
         {
             int index;
@@ -1208,7 +1160,7 @@
 /* Send a "simple" extended wmi command -- one with no arguments.
    Enabling this command only if GPIO or profiling support is enabled.
    This is to suppress warnings on some platforms */
-#if defined(CONFIG_HOST_GPIO_SUPPORT) || defined(CONFIG_TARGET_PROFILE_SUPPORT)
+#if defined(CONFIG_TARGET_PROFILE_SUPPORT)
 static int
 wmi_simple_cmd_xtnd(struct wmi_t *wmip, WMIX_COMMAND_ID cmdid)
 {
@@ -2298,46 +2250,6 @@
     return 0;
 }
 
-#ifdef CONFIG_HOST_GPIO_SUPPORT
-static int
-wmi_gpio_intr_rx(struct wmi_t *wmip, u8 *datap, int len)
-{
-    WMIX_GPIO_INTR_EVENT *gpio_intr = (WMIX_GPIO_INTR_EVENT *)datap;
-
-    A_DPRINTF(DBG_WMI,
-        (DBGFMT "Enter - intrmask=0x%x input=0x%x.\n", DBGARG,
-        gpio_intr->intr_mask, gpio_intr->input_values));
-
-    A_WMI_GPIO_INTR_RX(gpio_intr->intr_mask, gpio_intr->input_values);
-
-    return 0;
-}
-
-static int
-wmi_gpio_data_rx(struct wmi_t *wmip, u8 *datap, int len)
-{
-    WMIX_GPIO_DATA_EVENT *gpio_data = (WMIX_GPIO_DATA_EVENT *)datap;
-
-    A_DPRINTF(DBG_WMI,
-        (DBGFMT "Enter - reg=%d value=0x%x\n", DBGARG,
-        gpio_data->reg_id, gpio_data->value));
-
-    A_WMI_GPIO_DATA_RX(gpio_data->reg_id, gpio_data->value);
-
-    return 0;
-}
-
-static int
-wmi_gpio_ack_rx(struct wmi_t *wmip, u8 *datap, int len)
-{
-    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-
-    A_WMI_GPIO_ACK_RX();
-
-    return 0;
-}
-#endif /* CONFIG_HOST_GPIO_SUPPORT */
-
 /*
  * Called to send a wmi command. Command specific data is already built
  * on osbuf and current osbuf->data points to it.
@@ -3075,6 +2987,7 @@
     dtHdr->info =
       (SYNC_MSGTYPE & WMI_DATA_HDR_MSG_TYPE_MASK) << WMI_DATA_HDR_MSG_TYPE_SHIFT;
 
+    dtHdr->info3 = 0;
     A_DPRINTF(DBG_WMI, (DBGFMT "Enter - eid %d\n", DBGARG, eid));
 
     return (A_WMI_CONTROL_TX(wmip->wmi_devt, osbuf, eid));
@@ -4282,132 +4195,6 @@
                          NO_SYNC_WMIFLAG));
 }
 
-#ifdef CONFIG_HOST_GPIO_SUPPORT
-/* Send a command to Target to change GPIO output pins. */
-int
-wmi_gpio_output_set(struct wmi_t *wmip,
-                    u32 set_mask,
-                    u32 clear_mask,
-                    u32 enable_mask,
-                    u32 disable_mask)
-{
-    void *osbuf;
-    WMIX_GPIO_OUTPUT_SET_CMD *output_set;
-    int size;
-
-    size = sizeof(*output_set);
-
-    A_DPRINTF(DBG_WMI,
-        (DBGFMT "Enter - set=0x%x clear=0x%x enb=0x%x dis=0x%x\n", DBGARG,
-        set_mask, clear_mask, enable_mask, disable_mask));
-
-    osbuf = A_NETBUF_ALLOC(size);
-    if (osbuf == NULL) {
-        return A_NO_MEMORY;
-    }
-    A_NETBUF_PUT(osbuf, size);
-    output_set = (WMIX_GPIO_OUTPUT_SET_CMD *)(A_NETBUF_DATA(osbuf));
-
-    output_set->set_mask                   = set_mask;
-    output_set->clear_mask                 = clear_mask;
-    output_set->enable_mask                = enable_mask;
-    output_set->disable_mask               = disable_mask;
-
-    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_OUTPUT_SET_CMDID,
-                             NO_SYNC_WMIFLAG));
-}
-
-/* Send a command to the Target requesting state of the GPIO input pins */
-int
-wmi_gpio_input_get(struct wmi_t *wmip)
-{
-    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-
-    return wmi_simple_cmd_xtnd(wmip, WMIX_GPIO_INPUT_GET_CMDID);
-}
-
-/* Send a command to the Target that changes the value of a GPIO register. */
-int
-wmi_gpio_register_set(struct wmi_t *wmip,
-                      u32 gpioreg_id,
-                      u32 value)
-{
-    void *osbuf;
-    WMIX_GPIO_REGISTER_SET_CMD *register_set;
-    int size;
-
-    size = sizeof(*register_set);
-
-    A_DPRINTF(DBG_WMI,
-        (DBGFMT "Enter - reg=%d value=0x%x\n", DBGARG, gpioreg_id, value));
-
-    osbuf = A_NETBUF_ALLOC(size);
-    if (osbuf == NULL) {
-        return A_NO_MEMORY;
-    }
-    A_NETBUF_PUT(osbuf, size);
-    register_set = (WMIX_GPIO_REGISTER_SET_CMD *)(A_NETBUF_DATA(osbuf));
-
-    register_set->gpioreg_id               = gpioreg_id;
-    register_set->value                    = value;
-
-    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_REGISTER_SET_CMDID,
-                             NO_SYNC_WMIFLAG));
-}
-
-/* Send a command to the Target to fetch the value of a GPIO register. */
-int
-wmi_gpio_register_get(struct wmi_t *wmip,
-                      u32 gpioreg_id)
-{
-    void *osbuf;
-    WMIX_GPIO_REGISTER_GET_CMD *register_get;
-    int size;
-
-    size = sizeof(*register_get);
-
-    A_DPRINTF(DBG_WMI, (DBGFMT "Enter - reg=%d\n", DBGARG, gpioreg_id));
-
-    osbuf = A_NETBUF_ALLOC(size);
-    if (osbuf == NULL) {
-        return A_NO_MEMORY;
-    }
-    A_NETBUF_PUT(osbuf, size);
-    register_get = (WMIX_GPIO_REGISTER_GET_CMD *)(A_NETBUF_DATA(osbuf));
-
-    register_get->gpioreg_id               = gpioreg_id;
-
-    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_REGISTER_GET_CMDID,
-                             NO_SYNC_WMIFLAG));
-}
-
-/* Send a command to the Target acknowledging some GPIO interrupts. */
-int
-wmi_gpio_intr_ack(struct wmi_t *wmip,
-                  u32 ack_mask)
-{
-    void *osbuf;
-    WMIX_GPIO_INTR_ACK_CMD *intr_ack;
-    int size;
-
-    size = sizeof(*intr_ack);
-
-    A_DPRINTF(DBG_WMI, (DBGFMT "Enter ack_mask=0x%x\n", DBGARG, ack_mask));
-
-    osbuf = A_NETBUF_ALLOC(size);
-    if (osbuf == NULL) {
-        return A_NO_MEMORY;
-    }
-    A_NETBUF_PUT(osbuf, size);
-    intr_ack = (WMIX_GPIO_INTR_ACK_CMD *)(A_NETBUF_DATA(osbuf));
-
-    intr_ack->ack_mask               = ack_mask;
-
-    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_INTR_ACK_CMDID,
-                             NO_SYNC_WMIFLAG));
-}
-#endif /* CONFIG_HOST_GPIO_SUPPORT */
-
 int
 wmi_set_access_params_cmd(struct wmi_t *wmip, u8 ac,  u16 txop, u8 eCWmin,
                           u8 eCWmax, u8 aifsn)
@@ -4683,8 +4470,6 @@
 
    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
 
-   A_WMI_TCMD_RX_REPORT_EVENT(wmip->wmi_devt, datap, len);
-
    return 0;
 }
 
@@ -5500,19 +5285,6 @@
 }
 
 
-
-static int
-wmi_acm_reject_event_rx(struct wmi_t *wmip, u8 *datap, u32 len)
-{
-    WMI_ACM_REJECT_EVENT *ev;
-
-    ev = (WMI_ACM_REJECT_EVENT *)datap;
-    wmip->wmi_traffic_class = ev->trafficClass;
-    printk("ACM REJECT %d\n",wmip->wmi_traffic_class);
-    return 0;
-}
-
-
 #ifdef CONFIG_HOST_DSET_SUPPORT
 int
 wmi_dset_data_reply(struct wmi_t *wmip,
@@ -5877,7 +5649,7 @@
 
     ar6000_scan_indication (wmip->wmi_devt, pAr6kScanIndEvent, size);
 
-    A_FREE(pAr6kScanIndEvent);
+    kfree(pAr6kScanIndEvent);
 }
 #endif
 
@@ -5995,7 +5767,6 @@
     return 0;
 }
 
-#ifdef ATH_AR6K_11N_SUPPORT
 static int
 wmi_addba_req_event_rx(struct wmi_t *wmip, u8 *datap, int len)
 {
@@ -6048,7 +5819,6 @@
      return 0;
 
 }
-#endif
 
 static int
 wmi_hci_event_rx(struct wmi_t *wmip, u8 *datap, int len)
@@ -6372,7 +6142,6 @@
     return (wmi_cmd_send(wmip, osbuf, WMI_AP_SET_11BG_RATESET_CMDID, NO_SYNC_WMIFLAG));
 }
 
-#ifdef ATH_AR6K_11N_SUPPORT
 int
 wmi_set_ht_cap_cmd(struct wmi_t *wmip, WMI_SET_HT_CAP_CMD *cmd)
 {
@@ -6418,7 +6187,6 @@
     return (wmi_cmd_send(wmip, osbuf, WMI_SET_HT_OP_CMDID,
                          NO_SYNC_WMIFLAG));
 }
-#endif
 
 int
 wmi_set_tx_select_rates_cmd(struct wmi_t *wmip, u32 *pMaskArray)
@@ -6460,7 +6228,6 @@
     return (wmi_cmd_send(wmip, osbuf, WMI_HCI_CMD_CMDID, NO_SYNC_WMIFLAG));
 }
 
-#ifdef ATH_AR6K_11N_SUPPORT
 int
 wmi_allow_aggr_cmd(struct wmi_t *wmip, u16 tx_tidmask, u16 rx_tidmask)
 {
@@ -6520,7 +6287,6 @@
     /* Delete the local aggr state, on host */
     return (wmi_cmd_send(wmip, osbuf, WMI_DELBA_REQ_CMDID, NO_SYNC_WMIFLAG));
 }
-#endif
 
 int
 wmi_set_rx_frame_format_cmd(struct wmi_t *wmip, u8 rxMetaVersion,
diff --git a/drivers/staging/brcm80211/Kconfig b/drivers/staging/brcm80211/Kconfig
index b6f8635..af74699 100644
--- a/drivers/staging/brcm80211/Kconfig
+++ b/drivers/staging/brcm80211/Kconfig
@@ -1,11 +1,8 @@
-menuconfig BRCM80211
-	tristate "Broadcom IEEE802.11n WLAN drivers"
-	depends on WLAN
-
 config BRCMSMAC
-	bool "Broadcom IEEE802.11n PCIe SoftMAC WLAN driver"
+	tristate "Broadcom IEEE802.11n PCIe SoftMAC WLAN driver"
+	default n
 	depends on PCI
-	depends on BRCM80211 && MAC80211
+	depends on WLAN && MAC80211
 	select FW_LOADER
 	---help---
 	  This module adds support for PCIe wireless adapters based on Broadcom
@@ -13,9 +10,10 @@
 	  be called brcmsmac.ko.
 
 config BRCMFMAC
-	bool "Broadcom IEEE802.11n embedded FullMAC WLAN driver"
+	tristate "Broadcom IEEE802.11n embedded FullMAC WLAN driver"
+	default n
 	depends on MMC
-	depends on BRCM80211 && CFG80211
+	depends on WLAN && CFG80211
 	select FW_LOADER
 	select WIRELESS_EXT
 	select WEXT_PRIV
@@ -28,6 +26,6 @@
 config BRCMDBG
 	bool "Broadcom driver debug functions"
 	default n
-	depends on BRCM80211
+	depends on BRCMSMAC || BRCMFMAC
 	---help---
 	  Selecting this enables additional code for debug purposes.
diff --git a/drivers/staging/brcm80211/README b/drivers/staging/brcm80211/README
index f8facb0..8ad5586 100644
--- a/drivers/staging/brcm80211/README
+++ b/drivers/staging/brcm80211/README
@@ -1,90 +1,64 @@
-Broadcom Mac80211 driver
+Broadcom brcmsmac (mac80211-based softmac PCIe) and brcmfmac (SDIO) drivers.
 
-This is a driver in progress.  It has features still to be implemented well as
-bugs in current code.
+Completely open source host drivers, no binary object files.
+
+Support for the following chips:
+===============================
+
+    brcmsmac (PCIe)
+    Name        Device ID
+    BCM4313     0x4727
+    BCM43224    0x4353
+    BCM43225    0x4357
+
+    brcmfmac (SDIO)
+    Name
+    BCM4329
+
+Both brcmsmac and brcmfmac drivers require firmware files that need to be
+separately downloaded.
+
+Firmware
+======================
+Firmware is available from the Linux firmware repository at:
+
+    git://git.kernel.org/pub/scm/linux/kernel/git/dwmw2/linux-firmware.git
+    http://git.kernel.org/?p=linux/kernel/git/dwmw2/linux-firmware.git
+    https://git.kernel.org/?p=linux/kernel/git/dwmw2/linux-firmware.git
 
 
-What's here and not here
-=======================
-- Completely open source host driver, no binary object files
-- Features Broadcom's OneDriver architecture (single source base for
-  supported chips and architectures)
-- On-chip firmware loaded using standard request_firmware()
-- Support for BCM43224, BCM43225, BCM4313 (PCIe NIC)
-- Framework for supporting new chips, including mac80211-aware embedded chips
-- Does not support older PCI/PCIe chips with SSB backplane
-- Driver includes BMAC interface for transparent dongle support
-- Uses minstrel_ht rate algorithm
-- HW based encryption not enabled yet
-
-
-What's done
-==========
-- Integration with mac80211 stack
-- A-MPDU single & dual stream rates
-- BCM43224:	Dualband, Dual stream, 20MHz channels
-	Throughput (in chamber): ~85-90 Mbits/sec (in both 2.4 & 5 GHz bands)
-- BCM43225:	2.4 GHz, Dual Stream, 20MHz channels
-	Throughput (in chamber): ~85-90 Mbits/sec
-- BCM4313:		2.4 GHz, Single Stream
-	Throughput (in chamber): ~40 Mbits/sec
-
-
-Things To Be Done
-=================
-See the TODO file
+===============================================================
+Broadcom brcmsmac driver
+===============================================================
+- Support for both 32 and 64 bit Linux kernels
 
 
 Firmware installation
 ======================
-Firmware is available from the Linux firmware repository at:
-
-	git://git.kernel.org/pub/scm/linux/kernel/git/dwmw2/linux-firmware.git
-	http://git.kernel.org/?p=linux/kernel/git/dwmw2/linux-firmware.git
-	https://git.kernel.org/?p=linux/kernel/git/dwmw2/linux-firmware.git
-
-For all chips, copy brcm/bcm43xx-0.fw and brcm/bcm43xx_hdr-0.fw to
-/lib/firmware/brcm (or wherever firmware is normally installed on your system).
-
-Currently supported chips
-==============
-PCI
-Name		Device ID
-BCM4313		0x4727
-BCM43224	0x4353
-BCM43225	0x4357
+Copy brcm/bcm43xx-0.fw and brcm/bcm43xx_hdr-0.fw to
+/lib/firmware/brcm (or wherever firmware is normally installed
+on your system).
 
 
-Bugs/Problems
-==============
-- Driver can get confused while scanning during high throughput, can cause
-  burping, hanging, and possible crashing.
-- Occasional hangs & burps with BCM43224 on 2.4 GHz with dual stream rates.
-- Occasional crashes with BCM43224 on multicore machines.
+===============================================================
+Broadcom brcmfmac driver
+===============================================================
+- Support for 32 bit Linux kernel, 64 bit untested
 
 
-Note on Regulatory Implementation
-================================
-This generation of chips contain additional regulatory support independent of
-the driver. The devices use a single worldwide regulatory domain, with channels
-12-14 (2.4 GHz band) and channels 52-64 and 100-140 (5 GHz band) restricted to
-passive operation. Transmission on those channels is suppressed until
-appropriate other traffic is observed on those channels.
-
-Within the driver, we use the fictitious country code "X2" to represent this
-worldwide regulatory domain. There is currently no interface to configure a
-different domain.
-
-The driver reads the SROM country code from the chip and hands it up to
-mac80211 as the regulatory hint, however this information is otherwise unused
-with the driver.
+Firmware installation
+======================
+Copy brcm/bcm4329-fullmac-4.bin and brcm/bcm4329-fullmac-4.txt
+to /lib/firmware/brcm (or wherever firmware is normally installed on your
+system).
 
 
 Contact Info:
 =============
 Brett Rudley		brudley@broadcom.com
 Henry Ptasinski		henryp@broadcom.com
-Dowan Kim			dowan@broadcom.com
+Dowan Kim		dowan@broadcom.com
 Roland Vossen		rvossen@broadcom.com
 Arend van Spriel	arend@broadcom.com
 
+For more info, refer to: http://linuxwireless.org/en/users/Drivers/brcm80211
diff --git a/drivers/staging/brcm80211/TODO b/drivers/staging/brcm80211/TODO
index 24ebadb..e9c1393 100644
--- a/drivers/staging/brcm80211/TODO
+++ b/drivers/staging/brcm80211/TODO
@@ -1,51 +1,15 @@
-To Do List for Broadcom Mac80211 driver
-
-Features to be added
-=====================
-- 40 MHz channels
-- Power Save
-- AP
-- IBSS
-- HW-based encryption
-- LED support
-- RFKILL
-- Debugfs and debugability
-
-Code cleanup
-============
-- Use proper kernel coding standards
-- Remove overlap with system header files. (ie much of include/proto/*.h should
-  be removed)
-- Purge unused variables/data structs/functions BUT keep code related to
-  features that are being added (ie AP mode, 40 Mhz channels, IBSS etc).
-- Replace proprietary utility functions with public kernel versions.
+To Do List for Broadcom Mac80211 driver before getting in mainline
 
 Bugs
 ====
-- Various occasional asserts/hangs
-- Scanning during data transfer sometimes causes major slowdowns.  Sometimes
-  revcovers when scan is done, other times not.
-- Mac80211 API not completely implemented (ie ops_bss_info_changed,
-  ops_get_stats, etc)
+- Oops on AMPDU traffic, to be solved by new ucode (currently under test)
 
-Other
-=====
-- wlc_mac80211.[ch], wl_mac80211.[ch] and linux_osl.c all need to be refactored
-    and combined.
-- Merge files that are partially duplicated between the softmac and fullmac
-  drivers
+brcmfmac and brcmsmac
+=====================
+- ASSERTS not allowed in mainline, replace by warning + error handling
+- Replace printk and WL_ERROR() with proper routines
+
+brcmfmac
+=====================
 - Replace driver's proprietary ssb interface with generic kernel ssb module
-  (only used when compiling for SDIO).
-- PCI and SDIO support are currently #ifdef'ed exclusive of each other, which
-  leads to a separate wl.ko for each.  This should be changed to runtime
-  handling of different interfaces so that a single binary driver can be built.
-- Add support for new chips (obviously an ongoing item).
-
-Contact
-=====
-Brett Rudley <brudley@broadcom.com>
-Henry Ptasinski <henryp@broadcom.com>
-Dowan Kim <dowan@broadcom.com>
-Roland Vossen <rvossen@broadcom.com>
-Arend van Spriel <arend@broadcom.com>
-
+- Build and test on 64 bit linux kernel
diff --git a/drivers/staging/brcm80211/brcmfmac/README b/drivers/staging/brcm80211/brcmfmac/README
index be29e42..139597f 100644
--- a/drivers/staging/brcm80211/brcmfmac/README
+++ b/drivers/staging/brcm80211/brcmfmac/README
@@ -1,37 +1,2 @@
-Broadcom fullmac driver
 
-This is production driver.
-
-What's here
-===========
-- Completely open source host driver, no binary object files
-- Features Broadcom's OneDriver architecture (single source base for
-  supported chips and architectures)
-- On-chip firmware loaded using standard request_firmware()
-- Support for BCM4329(SDIO)
-
-What's done
-==========
-- Integration with cfg80211 stack
-- Most of Mac functionality is performed in dongle
-- A-MPDU single stream rates
-- BCM4329:	Dualband, Single stream, 20MHz channels
-
-Firmware installation
-======================
-Firmware is available from the Linux firmware repository at:
-
-	git://git.kernel.org/pub/scm/linux/kernel/git/dwmw2/linux-firmware.git
-	http://git.kernel.org/?p=linux/kernel/git/dwmw2/linux-firmware.git
-	https://git.kernel.org/?p=linux/kernel/git/dwmw2/linux-firmware.git
-
-For 4329 chip, copy brcm/bcm4329-fullmac-4.bin and brcm/bcm4329-fullmac-4.txt
-to /lib/firmware/brcm (or wherever firmware is normally installed on your
-system).
-
-Contact Info:
-=============
-Brett Rudley	brudley@broadcom.com
-Henry Ptasinski henryp@broadcom.com
-Nohee Ko	noheek@broadcom.com
 
diff --git a/drivers/staging/brcm80211/brcmfmac/bcmchip.h b/drivers/staging/brcm80211/brcmfmac/bcmchip.h
new file mode 100644
index 0000000..29eeee2
--- /dev/null
+++ b/drivers/staging/brcm80211/brcmfmac/bcmchip.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2011 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _bcmchip_h_
+#define _bcmchip_h_
+
+/* Core reg address translation */
+#define CORE_CC_REG(base, field)	(base + offsetof(chipcregs_t, field))
+#define CORE_BUS_REG(base, field)	(base + offsetof(sdpcmd_regs_t, field))
+#define CORE_SB(base, field) \
+		(base + SBCONFIGOFF + offsetof(sbconfig_t, field))
+
+/* bcm4329 */
+/* SDIO device core, ID 0x829 */
+#define BCM4329_CORE_BUS_BASE		0x18011000
+/* internal memory core, ID 0x80e */
+#define BCM4329_CORE_SOCRAM_BASE	0x18003000
+/* ARM Cortex M3 core, ID 0x82a */
+#define BCM4329_CORE_ARM_BASE		0x18002000
+
+#endif				/* _bcmchip_h_ */
diff --git a/drivers/staging/brcm80211/brcmfmac/bcmsdh.c b/drivers/staging/brcm80211/brcmfmac/bcmsdh.c
index 473f57d..f15ee63 100644
--- a/drivers/staging/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/staging/brcm80211/brcmfmac/bcmsdh.c
@@ -17,6 +17,7 @@
 
 #include <linux/types.h>
 #include <linux/netdevice.h>
+#include <linux/pci_ids.h>
 #include <bcmdefs.h>
 #include <bcmdevs.h>
 #include <bcmutils.h>
@@ -580,7 +581,7 @@
 int bcmsdh_query_device(void *sdh)
 {
 	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *) sdh;
-	bcmsdh->vendevid = (VENDOR_BROADCOM << 16) | 0;
+	bcmsdh->vendevid = (PCI_VENDOR_ID_BROADCOM << 16) | 0;
 	return bcmsdh->vendevid;
 }
 
diff --git a/drivers/staging/brcm80211/brcmfmac/bcmsdh_linux.c b/drivers/staging/brcm80211/brcmfmac/bcmsdh_linux.c
index ac5bbc8..0188417 100644
--- a/drivers/staging/brcm80211/brcmfmac/bcmsdh_linux.c
+++ b/drivers/staging/brcm80211/brcmfmac/bcmsdh_linux.c
@@ -87,11 +87,11 @@
 		return true;
 
 	/* Check for BRCM 27XX Standard host controller */
-	if (device == BCM27XX_SDIOH_ID && vendor == VENDOR_BROADCOM)
+	if (device == BCM27XX_SDIOH_ID && vendor == PCI_VENDOR_ID_BROADCOM)
 		return true;
 
 	/* Check for BRCM Standard host controller */
-	if (device == SDIOH_FPGA_ID && vendor == VENDOR_BROADCOM)
+	if (device == SDIOH_FPGA_ID && vendor == PCI_VENDOR_ID_BROADCOM)
 		return true;
 
 	/* Check for TI PCIxx21 Standard host controller */
@@ -111,7 +111,7 @@
 #endif				/* BCMSDIOH_STD */
 #ifdef BCMSDIOH_SPI
 	/* This is the PciSpiHost. */
-	if (device == SPIH_FPGA_ID && vendor == VENDOR_BROADCOM) {
+	if (device == SPIH_FPGA_ID && vendor == PCI_VENDOR_ID_BROADCOM) {
 		WL_NONE("Found PCI SPI Host Controller\n");
 		return true;
 	}
diff --git a/drivers/staging/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/staging/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index 71c3571..d765462 100644
--- a/drivers/staging/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/staging/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -68,6 +68,13 @@
 int sdioh_sdmmc_card_regread(sdioh_info_t *sd, int func, u32 regaddr,
 			     int regsize, u32 *data);
 
+void sdioh_sdio_set_host_pm_flags(int flag)
+{
+	if (sdio_set_host_pm_flags(gInstance->func[1], flag))
+		printk(KERN_ERR "%s: Failed to set pm_flags 0x%08x\n",\
+			 __func__, (unsigned int)flag);
+}
+
 static int sdioh_sdmmc_card_enablefuncs(sdioh_info_t *sd)
 {
 	int err_ret;
diff --git a/drivers/staging/brcm80211/brcmfmac/bcmsdh_sdmmc_linux.c b/drivers/staging/brcm80211/brcmfmac/bcmsdh_sdmmc_linux.c
index d738d4d..bcacc38 100644
--- a/drivers/staging/brcm80211/brcmfmac/bcmsdh_sdmmc_linux.c
+++ b/drivers/staging/brcm80211/brcmfmac/bcmsdh_sdmmc_linux.c
@@ -155,7 +155,7 @@
 
 	sdos->sd = sd;
 	spin_lock_init(&sdos->lock);
-	return BCME_OK;
+	return 0;
 }
 
 void sdioh_sdmmc_osfree(sdioh_info_t *sd)
diff --git a/drivers/staging/brcm80211/brcmfmac/dhd_common.c b/drivers/staging/brcm80211/brcmfmac/dhd_common.c
index aa171f6..7d349b7 100644
--- a/drivers/staging/brcm80211/brcmfmac/dhd_common.c
+++ b/drivers/staging/brcm80211/brcmfmac/dhd_common.c
@@ -902,7 +902,7 @@
 	wl_show_host_event(event, event_data);
 #endif				/* SHOW_EVENTS */
 
-	return BCME_OK;
+	return 0;
 }
 
 /* Convert user's input in hex pattern to byte-size mask */
diff --git a/drivers/staging/brcm80211/brcmfmac/dhd_linux.c b/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
index dd03757..5d4b643 100644
--- a/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
@@ -2694,7 +2694,7 @@
 	ASSERT(dhd != NULL);
 
 	bcmerror = wl_host_event(dhd, ifidx, pktdata, event, data);
-	if (bcmerror != BCME_OK)
+	if (bcmerror != 0)
 		return bcmerror;
 
 #if defined(CONFIG_WIRELESS_EXT)
diff --git a/drivers/staging/brcm80211/brcmfmac/dhd_sdio.c b/drivers/staging/brcm80211/brcmfmac/dhd_sdio.c
index 464f52a..14f4703 100644
--- a/drivers/staging/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/staging/brcm80211/brcmfmac/dhd_sdio.c
@@ -15,6 +15,7 @@
  */
 
 #include <linux/types.h>
+#include <linux/pci_ids.h>
 #include <bcmdefs.h>
 #include <linux/netdevice.h>
 #include <bcmsdh.h>
@@ -52,6 +53,7 @@
 #include <dhdioctl.h>
 #include <sdiovar.h>
 #include <siutils_priv.h>
+#include <bcmchip.h>
 
 #ifndef DHDSDIO_MEM_DUMP_FNAME
 #define DHDSDIO_MEM_DUMP_FNAME         "mem_dump"
@@ -165,12 +167,28 @@
 } dhd_console_t;
 #endif				/* DHD_DEBUG */
 
+/* misc chip info needed by some of the routines */
+struct chip_info {
+	u32 chip;
+	u32 chiprev;
+	u32 cccorebase;
+	u32 ccrev;
+	u32 cccaps;
+	u32 buscorebase;
+	u32 buscorerev;
+	u32 buscoretype;
+	u32 ramcorebase;
+	u32 armcorebase;
+	u32 pmurev;
+};
+
 /* Private data for SDIO bus interaction */
 typedef struct dhd_bus {
 	dhd_pub_t *dhd;
 
 	bcmsdh_info_t *sdh;	/* Handle for BCMSDH calls */
 	si_t *sih;		/* Handle for SI calls */
+	struct chip_info *ci;	/* Chip info struct */
 	char *vars;		/* Variables (from CIS and/or other) */
 	uint varsz;		/* Size of variables buffer */
 	u32 sbaddr;		/* Current SB window pointer (-1, invalid) */
@@ -464,6 +482,7 @@
 #ifdef BCMEMBEDIMAGE
 static int dhdsdio_download_code_array(struct dhd_bus *bus);
 #endif
+static int dhdsdio_chip_attach(struct dhd_bus *bus, void *regs);
 
 static void dhd_dongle_setmemsize(struct dhd_bus *bus, int mem_size)
 {
@@ -557,7 +576,7 @@
 			DHD_INFO(("CLKCTL: set PENDING\n"));
 			bus->clkstate = CLK_PENDING;
 
-			return BCME_OK;
+			return 0;
 		} else if (bus->clkstate == CLK_PENDING) {
 			/* Cancel CA-only interrupt filter */
 			devctl =
@@ -633,7 +652,7 @@
 			return BCME_ERROR;
 		}
 	}
-	return BCME_OK;
+	return 0;
 }
 
 /* Change idle/active SD state */
@@ -720,7 +739,7 @@
 		bus->clkstate = CLK_NONE;
 	}
 
-	return BCME_OK;
+	return 0;
 }
 
 /* Transition SD and backplane clock readiness */
@@ -738,7 +757,7 @@
 			dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
 			bus->activity = true;
 		}
-		return BCME_OK;
+		return 0;
 	}
 
 	switch (target) {
@@ -777,7 +796,7 @@
 	DHD_INFO(("dhdsdio_clkctl: %d -> %d\n", oldstate, bus->clkstate));
 #endif				/* DHD_DEBUG */
 
-	return BCME_OK;
+	return 0;
 }
 
 int dhdsdio_bussleep(dhd_bus_t *bus, bool sleep)
@@ -792,7 +811,7 @@
 
 	/* Done if we're already in the requested state */
 	if (sleep == bus->sleeping)
-		return BCME_OK;
+		return 0;
 
 	/* Going to sleep: set the alarm and turn off the lights... */
 	if (sleep) {
@@ -864,7 +883,7 @@
 		}
 	}
 
-	return BCME_OK;
+	return 0;
 }
 
 #if defined(OOB_INTR_ONLY)
@@ -1114,7 +1133,7 @@
 			DHD_ERROR(("%s: out of bus->txq !!!\n", __func__));
 			ret = BCME_NORESOURCE;
 		} else {
-			ret = BCME_OK;
+			ret = 0;
 		}
 		dhd_os_sdunlock_txq(bus->dhd);
 
@@ -1804,7 +1823,7 @@
 		return BCME_ERROR;
 	}
 
-	return BCME_OK;
+	return 0;
 }
 
 static int dhdsdio_checkdied(dhd_bus_t *bus, u8 *data, uint size)
@@ -2019,7 +2038,7 @@
 	/* Skip reading the console buffer if the index pointer
 	 has not moved */
 	if (idx == c->last)
-		return BCME_OK;
+		return 0;
 
 	/* Read the console buffer */
 	addr = le32_to_cpu(c->log.buf);
@@ -2057,13 +2076,13 @@
 	}
 break2:
 
-	return BCME_OK;
+	return 0;
 }
 #endif				/* DHD_DEBUG */
 
 int dhdsdio_downloadvars(dhd_bus_t *bus, void *arg, int len)
 {
-	int bcmerror = BCME_OK;
+	int bcmerror = 0;
 
 	DHD_TRACE(("%s: Enter\n", __func__));
 
@@ -2739,7 +2758,7 @@
 		if (set && strcmp(name, "sd_divisor") == 0) {
 			if (bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
 					    &bus->sd_divisor, sizeof(s32),
-					    false) != BCME_OK) {
+					    false) != 0) {
 				bus->sd_divisor = -1;
 				DHD_ERROR(("%s: fail on %s get\n", __func__,
 					   name));
@@ -2752,7 +2771,7 @@
 		if (set && strcmp(name, "sd_mode") == 0) {
 			if (bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
 					    &bus->sd_mode, sizeof(s32),
-					    false) != BCME_OK) {
+					    false) != 0) {
 				bus->sd_mode = -1;
 				DHD_ERROR(("%s: fail on %s get\n", __func__,
 					   name));
@@ -2767,7 +2786,7 @@
 			if (bcmsdh_iovar_op
 			    (bus->sdh, "sd_blocksize", &fnum, sizeof(s32),
 			     &bus->blocksize, sizeof(s32),
-			     false) != BCME_OK) {
+			     false) != 0) {
 				bus->blocksize = 0;
 				DHD_ERROR(("%s: fail on %s get\n", __func__,
 					   "sd_blocksize"));
@@ -5089,7 +5108,7 @@
 	/* Check the Vendor ID */
 	switch (venid) {
 	case 0x0000:
-	case VENDOR_BROADCOM:
+	case PCI_VENDOR_ID_BROADCOM:
 		break;
 	default:
 		DHD_ERROR(("%s: unknown vendor: 0x%04x\n", __func__, venid));
@@ -5288,6 +5307,10 @@
 		DHD_ERROR(("%s: si_attach failed!\n", __func__));
 		goto fail;
 	}
+	if (dhdsdio_chip_attach(bus, regsva)) {
+		DHD_ERROR(("%s: dhdsdio_chip_attach failed!\n", __func__));
+		goto fail;
+	}
 
 	bcmsdh_chipinfo(sdh, bus->sih->chip, bus->sih->chiprev);
 
@@ -5425,7 +5448,7 @@
 	/* Query the SD clock speed */
 	if (bcmsdh_iovar_op(sdh, "sd_divisor", NULL, 0,
 			    &bus->sd_divisor, sizeof(s32),
-			    false) != BCME_OK) {
+			    false) != 0) {
 		DHD_ERROR(("%s: fail on %s get\n", __func__, "sd_divisor"));
 		bus->sd_divisor = -1;
 	} else {
@@ -5435,7 +5458,7 @@
 
 	/* Query the SD bus mode */
 	if (bcmsdh_iovar_op(sdh, "sd_mode", NULL, 0,
-			    &bus->sd_mode, sizeof(s32), false) != BCME_OK) {
+			    &bus->sd_mode, sizeof(s32), false) != 0) {
 		DHD_ERROR(("%s: fail on %s get\n", __func__, "sd_mode"));
 		bus->sd_mode = -1;
 	} else {
@@ -5446,7 +5469,7 @@
 	/* Query the F2 block size, set roundup accordingly */
 	fnum = 2;
 	if (bcmsdh_iovar_op(sdh, "sd_blocksize", &fnum, sizeof(s32),
-			    &bus->blocksize, sizeof(s32), false) != BCME_OK) {
+			    &bus->blocksize, sizeof(s32), false) != 0) {
 		bus->blocksize = 0;
 		DHD_ERROR(("%s: fail on %s get\n", __func__, "sd_blocksize"));
 	} else {
@@ -5459,7 +5482,7 @@
 		 default to use if supported */
 	if (bcmsdh_iovar_op(sdh, "sd_rxchain", NULL, 0,
 			    &bus->sd_rxchain, sizeof(s32),
-			    false) != BCME_OK) {
+			    false) != 0) {
 		bus->sd_rxchain = false;
 	} else {
 		DHD_INFO(("%s: bus module (through bcmsdh API) %s chaining\n",
@@ -6070,3 +6093,234 @@
 	}
 	return bcmerror;
 }
+
+static int
+dhdsdio_chip_recognition(bcmsdh_info_t *sdh, struct chip_info *ci, void *regs)
+{
+	u32 regdata;
+
+	/*
+	 * Get CC core rev
+	 * Chipid is assume to be at offset 0 from regs arg
+	 * For different chiptypes or old sdio hosts w/o chipcommon,
+	 * other ways of recognition should be added here.
+	 */
+	ci->cccorebase = (u32)regs;
+	regdata = bcmsdh_reg_read(sdh, CORE_CC_REG(ci->cccorebase, chipid), 4);
+	ci->chip = regdata & CID_ID_MASK;
+	ci->chiprev = (regdata & CID_REV_MASK) >> CID_REV_SHIFT;
+
+	DHD_INFO(("%s: chipid=0x%x chiprev=%d\n",
+		__func__, ci->chip, ci->chiprev));
+
+	/* Address of cores for new chips should be added here */
+	switch (ci->chip) {
+	case BCM4329_CHIP_ID:
+		ci->buscorebase = BCM4329_CORE_BUS_BASE;
+		ci->ramcorebase = BCM4329_CORE_SOCRAM_BASE;
+		ci->armcorebase	= BCM4329_CORE_ARM_BASE;
+		break;
+	default:
+		DHD_ERROR(("%s: chipid 0x%x is not supported\n",
+			__func__, ci->chip));
+		return -ENODEV;
+	}
+
+	regdata = bcmsdh_reg_read(sdh,
+		CORE_SB(ci->cccorebase, sbidhigh), 4);
+	ci->ccrev = SBCOREREV(regdata);
+
+	regdata = bcmsdh_reg_read(sdh,
+		CORE_CC_REG(ci->cccorebase, pmucapabilities), 4);
+	ci->pmurev = regdata & PCAP_REV_MASK;
+
+	regdata = bcmsdh_reg_read(sdh, CORE_SB(ci->buscorebase, sbidhigh), 4);
+	ci->buscorerev = SBCOREREV(regdata);
+	ci->buscoretype = (regdata & SBIDH_CC_MASK) >> SBIDH_CC_SHIFT;
+
+	DHD_INFO(("%s: ccrev=%d, pmurev=%d, buscore rev/type=%d/0x%x\n",
+		__func__, ci->ccrev, ci->pmurev,
+		ci->buscorerev, ci->buscoretype));
+
+	/* get chipcommon capabilites */
+	ci->cccaps = bcmsdh_reg_read(sdh,
+		CORE_CC_REG(ci->cccorebase, capabilities), 4);
+
+	return 0;
+}
+
+static void
+dhdsdio_chip_disablecore(bcmsdh_info_t *sdh, u32 corebase)
+{
+	u32 regdata;
+
+	regdata = bcmsdh_reg_read(sdh,
+		CORE_SB(corebase, sbtmstatelow), 4);
+	if (regdata & SBTML_RESET)
+		return;
+
+	regdata = bcmsdh_reg_read(sdh,
+		CORE_SB(corebase, sbtmstatelow), 4);
+	if ((regdata & (SICF_CLOCK_EN << SBTML_SICF_SHIFT)) != 0) {
+		/*
+		 * set target reject and spin until busy is clear
+		 * (preserve core-specific bits)
+		 */
+		regdata = bcmsdh_reg_read(sdh,
+			CORE_SB(corebase, sbtmstatelow), 4);
+		bcmsdh_reg_write(sdh, CORE_SB(corebase, sbtmstatelow), 4,
+			regdata | SBTML_REJ);
+
+		regdata = bcmsdh_reg_read(sdh,
+			CORE_SB(corebase, sbtmstatelow), 4);
+		udelay(1);
+		SPINWAIT((bcmsdh_reg_read(sdh,
+			CORE_SB(corebase, sbtmstatehigh), 4) &
+			SBTMH_BUSY), 100000);
+
+		regdata = bcmsdh_reg_read(sdh,
+			CORE_SB(corebase, sbtmstatehigh), 4);
+		if (regdata & SBTMH_BUSY)
+			DHD_ERROR(("%s: ARM core still busy\n", __func__));
+
+		regdata = bcmsdh_reg_read(sdh,
+			CORE_SB(corebase, sbidlow), 4);
+		if (regdata & SBIDL_INIT) {
+			regdata = bcmsdh_reg_read(sdh,
+				CORE_SB(corebase, sbimstate), 4) |
+				SBIM_RJ;
+			bcmsdh_reg_write(sdh,
+				CORE_SB(corebase, sbimstate), 4,
+				regdata);
+			regdata = bcmsdh_reg_read(sdh,
+				CORE_SB(corebase, sbimstate), 4);
+			udelay(1);
+			SPINWAIT((bcmsdh_reg_read(sdh,
+				CORE_SB(corebase, sbimstate), 4) &
+				SBIM_BY), 100000);
+		}
+
+		/* set reset and reject while enabling the clocks */
+		bcmsdh_reg_write(sdh,
+			CORE_SB(corebase, sbtmstatelow), 4,
+			(((SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
+			SBTML_REJ | SBTML_RESET));
+		regdata = bcmsdh_reg_read(sdh,
+			CORE_SB(corebase, sbtmstatelow), 4);
+		udelay(10);
+
+		/* clear the initiator reject bit */
+		regdata = bcmsdh_reg_read(sdh,
+			CORE_SB(corebase, sbidlow), 4);
+		if (regdata & SBIDL_INIT) {
+			regdata = bcmsdh_reg_read(sdh,
+				CORE_SB(corebase, sbimstate), 4) &
+				~SBIM_RJ;
+			bcmsdh_reg_write(sdh,
+				CORE_SB(corebase, sbimstate), 4,
+				regdata);
+		}
+	}
+
+	/* leave reset and reject asserted */
+	bcmsdh_reg_write(sdh, CORE_SB(corebase, sbtmstatelow), 4,
+		(SBTML_REJ | SBTML_RESET));
+	udelay(1);
+}
+
+static int
+dhdsdio_chip_attach(struct dhd_bus *bus, void *regs)
+{
+	struct chip_info *ci;
+	int err;
+	u8 clkval, clkset;
+
+	DHD_TRACE(("%s: Enter\n", __func__));
+
+	/* alloc chip_info_t */
+	ci = kmalloc(sizeof(struct chip_info), GFP_ATOMIC);
+	if (NULL == ci) {
+		DHD_ERROR(("%s: malloc failed!\n", __func__));
+		return -ENOMEM;
+	}
+
+	memset((unsigned char *)ci, 0, sizeof(struct chip_info));
+
+	/* bus/core/clk setup for register access */
+	/* Try forcing SDIO core to do ALPAvail request only */
+	clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
+	bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+			clkset, &err);
+	if (err) {
+		DHD_ERROR(("%s: error writing for HT off\n", __func__));
+		goto fail;
+	}
+
+	/* If register supported, wait for ALPAvail and then force ALP */
+	/* This may take up to 15 milliseconds */
+	clkval = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1,
+			SBSDIO_FUNC1_CHIPCLKCSR, NULL);
+	if ((clkval & ~SBSDIO_AVBITS) == clkset) {
+		SPINWAIT(((clkval =
+				bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1,
+						SBSDIO_FUNC1_CHIPCLKCSR,
+						NULL)),
+				!SBSDIO_ALPAV(clkval)),
+				PMU_MAX_TRANSITION_DLY);
+		if (!SBSDIO_ALPAV(clkval)) {
+			DHD_ERROR(("%s: timeout on ALPAV wait, clkval 0x%02x\n",
+				__func__, clkval));
+			err = -EBUSY;
+			goto fail;
+		}
+		clkset = SBSDIO_FORCE_HW_CLKREQ_OFF |
+				SBSDIO_FORCE_ALP;
+		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1,
+				SBSDIO_FUNC1_CHIPCLKCSR,
+				clkset, &err);
+		udelay(65);
+	} else {
+		DHD_ERROR(("%s: ChipClkCSR access: wrote 0x%02x read 0x%02x\n",
+			__func__, clkset, clkval));
+		err = -EACCES;
+		goto fail;
+	}
+
+	/* Also, disable the extra SDIO pull-ups */
+	bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SDIOPULLUP, 0,
+			 NULL);
+
+	err = dhdsdio_chip_recognition(bus->sdh, ci, regs);
+	if (err)
+		goto fail;
+
+	/*
+	 * Make sure any on-chip ARM is off (in case strapping is wrong),
+	 * or downloaded code was already running.
+	 */
+	dhdsdio_chip_disablecore(bus->sdh, ci->armcorebase);
+
+	bcmsdh_reg_write(bus->sdh,
+		CORE_CC_REG(ci->cccorebase, gpiopullup), 4, 0);
+	bcmsdh_reg_write(bus->sdh,
+		CORE_CC_REG(ci->cccorebase, gpiopulldown), 4, 0);
+
+	/* Disable F2 to clear any intermediate frame state on the dongle */
+	bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN,
+		SDIO_FUNC_ENABLE_1, NULL);
+
+	/* WAR: cmd52 backplane read so core HW will drop ALPReq */
+	clkval = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1,
+			0, NULL);
+
+	/* Done with backplane-dependent accesses, can drop clock... */
+	bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, 0,
+			 NULL);
+
+	bus->ci = ci;
+	return 0;
+fail:
+	bus->ci = NULL;
+	kfree(ci);
+	return err;
+}
diff --git a/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c
index 555b056b..b44daf9 100644
--- a/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c
@@ -39,6 +39,8 @@
 #include <linux/firmware.h>
 #include <wl_cfg80211.h>
 
+void sdioh_sdio_set_host_pm_flags(int flag);
+
 static struct sdio_func *cfg80211_sdio_func;
 static struct wl_dev *wl_cfg80211_dev;
 static const u8 ether_bcast[ETH_ALEN] = {255, 255, 255, 255, 255, 255};
@@ -1988,6 +1990,8 @@
 	clear_bit(WL_STATUS_SCANNING, &wl->status);
 	clear_bit(WL_STATUS_SCAN_ABORTING, &wl->status);
 
+	sdioh_sdio_set_host_pm_flags(MMC_PM_KEEP_POWER);
+
 	return err;
 }
 
diff --git a/drivers/staging/brcm80211/brcmfmac/wl_iw.c b/drivers/staging/brcm80211/brcmfmac/wl_iw.c
index b49957f..4e4cf36 100644
--- a/drivers/staging/brcm80211/brcmfmac/wl_iw.c
+++ b/drivers/staging/brcm80211/brcmfmac/wl_iw.c
@@ -3672,8 +3672,10 @@
 		return -ENOMEM;
 
 	iscan->iscan_ex_params_p = kmalloc(params_size, GFP_KERNEL);
-	if (!iscan->iscan_ex_params_p)
+	if (!iscan->iscan_ex_params_p) {
+		kfree(iscan);
 		return -ENOMEM;
+	}
 	iscan->iscan_ex_param_size = params_size;
 	iscan->sysioc_tsk = NULL;
 
diff --git a/drivers/staging/brcm80211/brcmsmac/Makefile b/drivers/staging/brcm80211/brcmsmac/Makefile
index c4aafe5..65a1a25 100644
--- a/drivers/staging/brcm80211/brcmsmac/Makefile
+++ b/drivers/staging/brcm80211/brcmsmac/Makefile
@@ -38,6 +38,7 @@
 	wlc_channel.o \
 	wlc_main.o \
 	wlc_phy_shim.o \
+	wlc_pmu.o \
 	wlc_rate.o \
 	wlc_stf.o \
 	phy/wlc_phy_cmn.o \
@@ -52,7 +53,6 @@
 	../util/bcmotp.o \
 	../util/bcmsrom.o \
 	../util/hnddma.o \
-	../util/hndpmu.o \
 	../util/nicpci.o \
 	../util/qmath.o \
 	../util/nvram/nvram_ro.o
diff --git a/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_cmn.c b/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_cmn.c
index 8f75af2..873d64c 100644
--- a/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_cmn.c
+++ b/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_cmn.c
@@ -155,8 +155,6 @@
 	char *s;
 	int len;
 
-	ASSERT(pi->vars != (char *)&pi->vars);
-
 	if (!name)
 		return NULL;
 
@@ -241,7 +239,7 @@
 		break;
 
 	default:
-		ASSERT(VALID_PHYTYPE(pi->pubpi.phy_type));
+		break;
 	}
 
 	if ((D11REV_GE(pi->sh->corerev, 24)) ||
@@ -579,9 +577,6 @@
 void wlc_phy_shared_detach(shared_phy_t *phy_sh)
 {
 	if (phy_sh) {
-		if (phy_sh->phy_head) {
-			ASSERT(!phy_sh->phy_head);
-		}
 		kfree(phy_sh);
 	}
 }
@@ -596,7 +591,7 @@
 	if (D11REV_IS(sh->corerev, 4))
 		sflags = SISF_2G_PHY | SISF_5G_PHY;
 	else
-		sflags = si_core_sflags(sh->sih, 0, 0);
+		sflags = ai_core_sflags(sh->sih, 0, 0);
 
 	if (BAND_5G(bandtype)) {
 		if ((sflags & (SISF_5G_PHY | SISF_DB_PHY)) == 0) {
@@ -781,8 +776,6 @@
 			pi->sh->phy_head = pi->next;
 		else if (pi->sh->phy_head->next == pi)
 			pi->sh->phy_head->next = NULL;
-		else
-			ASSERT(0);
 
 		if (pi->pi_fptr.detach)
 			(pi->pi_fptr.detach) (pi);
@@ -894,7 +887,6 @@
 			phy_bw_clkbits = SICF_BW40;
 			break;
 		default:
-			ASSERT(0);
 			break;
 		}
 	}
@@ -967,19 +959,16 @@
 		       "wlc_phy_init: Called with the MAC running!" == NULL);
 	}
 
-	ASSERT(pi != NULL);
-
 	if (!(pi->measure_hold & PHY_HOLD_FOR_SCAN)) {
 		pi->measure_hold |= PHY_HOLD_FOR_NOT_ASSOC;
 	}
 
 	if (D11REV_GE(pi->sh->corerev, 5))
-		ASSERT(si_core_sflags(pi->sh->sih, 0, 0) & SISF_FCLKA);
+		ASSERT(ai_core_sflags(pi->sh->sih, 0, 0) & SISF_FCLKA);
 
 	phy_init = pi->pi_fptr.init;
 
 	if (phy_init == NULL) {
-		ASSERT(phy_init != NULL);
 		return;
 	}
 
@@ -1029,8 +1018,6 @@
 	phy_info_t *pi = (phy_info_t *) pih;
 	int callbacks = 0;
 
-	ASSERT(pi->phytest_on == false);
-
 	if (pi->phycal_timer
 	    && !wlapi_del_timer(pi->sh->physhim, pi->phycal_timer))
 		callbacks++;
@@ -1070,8 +1057,6 @@
 
 void wlc_phy_table_data_write(phy_info_t *pi, uint width, u32 val)
 {
-	ASSERT((width == 8) || (width == 16) || (width == 32));
-
 	if ((pi->sh->chip == BCM43224_CHIP_ID ||
 	     pi->sh->chip == BCM43421_CHIP_ID) &&
 	    (pi->sh->chiprev == 1) &&
@@ -1105,8 +1090,6 @@
 	const u16 *ptbl_16b = (const u16 *)ptbl_info->tbl_ptr;
 	const u32 *ptbl_32b = (const u32 *)ptbl_info->tbl_ptr;
 
-	ASSERT((tbl_width == 8) || (tbl_width == 16) || (tbl_width == 32));
-
 	write_phy_reg(pi, tblAddr, (tbl_id << 10) | tbl_offset);
 
 	for (idx = 0; idx < ptbl_info->tbl_len; idx++) {
@@ -1148,8 +1131,6 @@
 	u16 *ptbl_16b = (u16 *)ptbl_info->tbl_ptr;
 	u32 *ptbl_32b = (u32 *)ptbl_info->tbl_ptr;
 
-	ASSERT((tbl_width == 8) || (tbl_width == 16) || (tbl_width == 32));
-
 	write_phy_reg(pi, tblAddr, (tbl_id << 10) | tbl_offset);
 
 	for (idx = 0; idx < ptbl_info->tbl_len; idx++) {
@@ -1258,7 +1239,6 @@
 
 	W_REG(&regs->txe_phyctl, (ofdm ? 1 : 0) | PHY_TXC_ANT_0);
 	if (ISNPHY(pi) || ISLCNPHY(pi)) {
-		ASSERT(ofdm);
 		W_REG(&regs->txe_phyctl1, 0x1A02);
 	}
 
@@ -1317,7 +1297,6 @@
 void wlc_phy_hold_upd(wlc_phy_t *pih, mbool id, bool set)
 {
 	phy_info_t *pi = (phy_info_t *) pih;
-	ASSERT(id);
 
 	if (set) {
 		mboolset(pi->measure_hold, id);
@@ -1439,8 +1418,6 @@
 	u16 m_cur_channel;
 	chansetfn_t chanspec_set = NULL;
 
-	ASSERT(!wf_chspec_malformed(chanspec));
-
 	m_cur_channel = CHSPEC_CHANNEL(chanspec);
 	if (CHSPEC_IS5G(chanspec))
 		m_cur_channel |= D11_CURCHANNEL_5G;
@@ -1480,8 +1457,7 @@
 		range = wlc_phy_get_chan_freq_range_nphy(pi, channel);
 	} else if (ISLCNPHY(pi)) {
 		range = wlc_phy_chanspec_freq2bandrange_lpssn(freq);
-	} else
-		ASSERT(0);
+	}
 
 	return range;
 }
@@ -1511,8 +1487,6 @@
 	uint i;
 	uint channel;
 
-	ASSERT((band == WLC_BAND_2G) || (band == WLC_BAND_5G));
-
 	memset(channels, 0, sizeof(chanvec_t));
 
 	for (i = 0; i < ARRAY_SIZE(chan_info_all); i++) {
@@ -1535,8 +1509,6 @@
 	uint channel;
 	chanspec_t chspec;
 
-	ASSERT((band == WLC_BAND_2G) || (band == WLC_BAND_5G));
-
 	for (i = 0; i < ARRAY_SIZE(chan_info_all); i++) {
 		channel = chan_info_all[i].chan;
 
@@ -1572,8 +1544,6 @@
 			return chspec;
 	}
 
-	ASSERT(0);
-
 	return (chanspec_t) INVCHANSPEC;
 }
 
@@ -1581,7 +1551,6 @@
 {
 	phy_info_t *pi = (phy_info_t *) ppi;
 
-	ASSERT(qdbm != NULL);
 	*qdbm = pi->tx_user_target[0];
 	if (override != NULL)
 		*override = pi->txpwroverride;
@@ -1703,7 +1672,6 @@
 				break;
 			}
 		}
-		ASSERT(i < ARRAY_SIZE(chan_info_all));
 
 		if (pi->hwtxpwr) {
 			*max_pwr = pi->hwtxpwr[i];
@@ -2134,7 +2102,6 @@
 {
 	int j;
 	if (ISNPHY(pi)) {
-		ASSERT(0);
 		return;
 	}
 
@@ -2466,8 +2433,6 @@
 			mod_phy_reg(pi, 0x410, (0x1 << 1), 0x00 << 1);
 			mod_phy_reg(pi, 0x410, (0x1 << 0), (u16) val << 0);
 		}
-	} else {
-		ASSERT(0);
 	}
 
 	if (!suspend)
@@ -2483,7 +2448,6 @@
 	u8 i;
 
 	memset((u8 *) cmplx_pwr_dbm, 0, sizeof(cmplx_pwr_dbm));
-	ASSERT(pi->pubpi.phy_corenum <= PHY_CORE_MAX);
 	wlc_phy_compute_dB(cmplx_pwr, cmplx_pwr_dbm, pi->pubpi.phy_corenum);
 
 	for (i = 0; i < pi->pubpi.phy_corenum; i++) {
@@ -2529,7 +2493,6 @@
 		break;
 
 	default:
-		ASSERT(0);
 		break;
 	}
 
@@ -2678,7 +2641,6 @@
 	s8 noise_dbm = PHY_NOISE_FIXED_VAL_NPHY;
 	u8 idx, core;
 
-	ASSERT(pi->pubpi.phy_corenum <= PHY_CORE_MAX);
 	memset((u8 *) cmplx_pwr, 0, sizeof(cmplx_pwr));
 	memset((u8 *) noise_dbm_ant, 0, sizeof(noise_dbm_ant));
 
@@ -2760,8 +2722,6 @@
 		channel = jssi_aux & D11_CURCHANNEL_MAX;
 
 		noise_dbm = wlc_phy_noise_read_shmem(pi);
-	} else {
-		ASSERT(0);
 	}
 
 	wlc_phy_noise_cb(pi, channel, noise_dbm);
@@ -2871,10 +2831,7 @@
 			rssi -= 256;
 	} else if (radioid == BCM2055_ID || radioid == BCM2056_ID
 		   || radioid == BCM2057_ID) {
-		ASSERT(ISNPHY(pi));
 		rssi = wlc_phy_rssi_compute_nphy(pi, wlc_rxhdr);
-	} else {
-		ASSERT((const char *)"Unknown radio" == NULL);
 	}
 
  end:
@@ -2900,9 +2857,6 @@
 		wlc_lcnphy_deaf_mode(pi, true);
 	else if (ISNPHY(pi))
 		wlc_nphy_deaf_mode(pi, true);
-	else {
-		ASSERT(0);
-	}
 }
 
 void wlc_phy_watchdog(wlc_phy_t *pih)
@@ -3163,13 +3117,9 @@
 			} else if (pi->nphy_perical == PHY_PERICAL_SPHASE)
 				wlc_phy_cal_perical_nphy_run(pi,
 							     PHY_PERICAL_AUTO);
-			else {
-				ASSERT(0);
-			}
 		}
 		break;
 	default:
-		ASSERT(0);
 		break;
 	}
 }
@@ -3311,12 +3261,12 @@
 				mod_phy_reg(pi, 0x44c, (0x1 << 2), (1) << 2);
 
 			}
-			si_corereg(pi->sh->sih, SI_CC_IDX,
+			ai_corereg(pi->sh->sih, SI_CC_IDX,
 				   offsetof(chipcregs_t, gpiocontrol), ~0x0,
 				   0x0);
-			si_corereg(pi->sh->sih, SI_CC_IDX,
+			ai_corereg(pi->sh->sih, SI_CC_IDX,
 				   offsetof(chipcregs_t, gpioout), 0x40, 0x40);
-			si_corereg(pi->sh->sih, SI_CC_IDX,
+			ai_corereg(pi->sh->sih, SI_CC_IDX,
 				   offsetof(chipcregs_t, gpioouten), 0x40,
 				   0x40);
 		} else {
@@ -3324,11 +3274,11 @@
 
 			mod_phy_reg(pi, 0x44d, (0x1 << 2), (0) << 2);
 
-			si_corereg(pi->sh->sih, SI_CC_IDX,
+			ai_corereg(pi->sh->sih, SI_CC_IDX,
 				   offsetof(chipcregs_t, gpioout), 0x40, 0x00);
-			si_corereg(pi->sh->sih, SI_CC_IDX,
+			ai_corereg(pi->sh->sih, SI_CC_IDX,
 				   offsetof(chipcregs_t, gpioouten), 0x40, 0x0);
-			si_corereg(pi->sh->sih, SI_CC_IDX,
+			ai_corereg(pi->sh->sih, SI_CC_IDX,
 				   offsetof(chipcregs_t, gpiocontrol), ~0x0,
 				   0x40);
 		}
@@ -3391,8 +3341,6 @@
 {
 	u32 quotient, remainder, roundup, rbit;
 
-	ASSERT(divisor);
-
 	quotient = dividend / divisor;
 	remainder = dividend % divisor;
 	rbit = divisor & 1;
diff --git a/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_lcn.c b/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_lcn.c
index a5a7bb8..9f5ee40 100644
--- a/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_lcn.c
+++ b/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_lcn.c
@@ -1081,8 +1081,6 @@
 {
 	u32 quotient, remainder, roundup, rbit;
 
-	ASSERT(divisor);
-
 	quotient = dividend / divisor;
 	remainder = dividend % divisor;
 	rbit = divisor & 1;
@@ -1780,11 +1778,6 @@
 	s8 index;
 	phy_info_lcnphy_t *pi_lcn = pi->u.pi_lcnphy;
 
-	ASSERT((LCNPHY_TX_PWR_CTRL_OFF == mode) ||
-	       (LCNPHY_TX_PWR_CTRL_SW == mode) ||
-	       (LCNPHY_TX_PWR_CTRL_HW == mode) ||
-	       (LCNPHY_TX_PWR_CTRL_TEMPBASED == mode));
-
 	mode = wlc_lcnphy_set_tx_pwr_ctrl_mode(pi, mode);
 	old_mode = wlc_lcnphy_set_tx_pwr_ctrl_mode(pi, old_mode);
 
@@ -1904,16 +1897,14 @@
 		break;
 
 	case LCNPHY_CAL_RECAL:
-		ASSERT(pi_lcn->lcnphy_cal_results.txiqlocal_bestcoeffs_valid);
-
 		start_coeffs = syst_coeffs;
-
 		cal_cmds = commands_recal;
 		n_cal_cmds = ARRAY_SIZE(commands_recal);
 		command_nums = command_nums_recal;
 		break;
+
 	default:
-		ASSERT(false);
+		break;
 	}
 
 	wlc_lcnphy_common_write_table(pi, LCNPHY_TBL_ID_IQLOCAL,
@@ -2460,8 +2451,6 @@
 	lcnphy_txgains_t gains;
 	phy_info_lcnphy_t *pi_lcn = pi->u.pi_lcnphy;
 
-	ASSERT(index <= LCNPHY_MAX_TX_POWER_INDEX);
-
 	pi_lcn->lcnphy_tx_power_idx_override = (s8) index;
 	pi_lcn->lcnphy_current_index = (u8) index;
 
@@ -2760,7 +2749,6 @@
 		do {
 			bw = phy_bw * 1000 * k;
 			num_samps = bw / ABS(f_kHz);
-			ASSERT(num_samps <= ARRAY_SIZE(data_buf));
 			k++;
 		} while ((num_samps * (u32) (ABS(f_kHz))) != bw);
 	} else
@@ -3298,8 +3286,6 @@
 		return false;
 	}
 	if (module == 2) {
-		ASSERT(iqcomp_sz);
-
 		while (iqcomp_sz--) {
 			if (iqcomp[iqcomp_sz].chan ==
 			    CHSPEC_CHANNEL(pi->radio_chanspec)) {
@@ -3313,7 +3299,6 @@
 				break;
 			}
 		}
-		ASSERT(result);
 		goto cal_done;
 	}
 
@@ -3584,9 +3569,6 @@
 		if (wlc_lcnphy_tempsense_based_pwr_ctrl_enabled(pi))
 			wlc_lcnphy_tx_power_adjustment((wlc_phy_t *) pi);
 		break;
-	default:
-		ASSERT(0);
-		break;
 	}
 }
 
@@ -5072,8 +5054,6 @@
 	}
 
 	pi->xtalfreq = si_alp_clock(pi->sh->sih);
-	ASSERT(0 == (pi->xtalfreq % 1000));
-
 	pi_lcn->lcnphy_papd_rxGnCtrl_init = 0;
 
 	pi->pi_fptr.init = wlc_phy_init_lcnphy;
@@ -5293,9 +5273,7 @@
 			}
 		}
 
-		if (filt_index == -1) {
-			ASSERT(false);
-		} else {
+		if (filt_index != -1) {
 			for (j = 0; j < LCNPHY_NUM_DIG_FILT_COEFFS; j++) {
 				write_phy_reg(pi, addr[j],
 					      LCNPHY_txdigfiltcoeffs_cck
@@ -5310,9 +5288,7 @@
 			}
 		}
 
-		if (filt_index == -1) {
-			ASSERT(false);
-		} else {
+		if (filt_index != -1) {
 			for (j = 0; j < LCNPHY_NUM_DIG_FILT_COEFFS; j++) {
 				write_phy_reg(pi, addr_ofdm[j],
 					      LCNPHY_txdigfiltcoeffs_ofdm
diff --git a/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_n.c b/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_n.c
index 7947c60..ccc79fd 100644
--- a/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_n.c
+++ b/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_n.c
@@ -14218,8 +14218,6 @@
 {
 	u16 addr, val;
 
-	ASSERT(ISNPHY(pi));
-
 	val = 0x1e1f;
 	for (addr = (NPHY_TO_BPHY_OFF + BPHY_RSSI_LUT);
 	     addr <= (NPHY_TO_BPHY_OFF + BPHY_RSSI_LUT_END); addr++) {
@@ -14367,8 +14365,6 @@
 			break;
 
 		default:
-
-			ASSERT(0);
 			break;
 		}
 
@@ -14401,8 +14397,6 @@
 								 [idx]);
 					break;
 				default:
-
-					ASSERT(0);
 					break;
 				}
 			} else {
@@ -14550,7 +14544,7 @@
 	     (pi->sh->chippkg == BCM4718_PKG_ID))) {
 		if ((pi->sh->boardflags & BFL_EXTLNA) &&
 		    (CHSPEC_IS2G(pi->radio_chanspec))) {
-			si_corereg(pi->sh->sih, SI_CC_IDX,
+			ai_corereg(pi->sh->sih, SI_CC_IDX,
 				   offsetof(chipcregs_t, chipcontrol), 0x40,
 				   0x40);
 		}
@@ -14566,8 +14560,6 @@
 
 		regs = (d11regs_t *) si_switch_core(pi->sh->sih, D11_CORE_ID,
 						    &origidx, &intr_val);
-		ASSERT(regs != NULL);
-
 		d11_clk_ctl_st = R_REG(&regs->clk_ctl_st);
 		AND_REG(&regs->clk_ctl_st,
 			~(CCS_FORCEHT | CCS_HTAREQ));
@@ -14783,10 +14775,7 @@
 						rfpwr_offset = (s16)
 						    nphy_papd_padgain_dlt_2g_2057rev7
 						    [pad_gn];
-					} else {
-						ASSERT(0);
 					}
-
 				} else {
 					if ((pi->pubpi.radiorev == 3) ||
 					    (pi->pubpi.radiorev == 4) ||
@@ -14800,8 +14789,6 @@
 						rfpwr_offset = (s16)
 						    nphy_papd_pgagain_dlt_5g_2057rev7
 						    [pga_gn];
-					} else {
-						ASSERT(0);
 					}
 				}
 				wlc_phy_table_write_nphy(pi,
@@ -14905,10 +14892,10 @@
 				}
 
 				if (wlc_phy_cal_txiqlo_nphy
-				    (pi, target_gain, true, false) == BCME_OK) {
+				    (pi, target_gain, true, false) == 0) {
 					if (wlc_phy_cal_rxiq_nphy
 					    (pi, target_gain, 2,
-					     false) == BCME_OK) {
+					     false) == 0) {
 						wlc_phy_savecal_nphy(pi);
 
 					}
@@ -16130,8 +16117,6 @@
 						 0x18, 16, bcm_adc_vmid);
 			wlc_phy_table_write_nphy(pi, NPHY_TBL_ID_AFECTRL, 4,
 						 0x1c, 16, bcm_adc_gain);
-		} else {
-			ASSERT(0);
 		}
 
 		write_radio_reg(pi,
@@ -17510,7 +17495,6 @@
 			break;
 
 		default:
-			ASSERT(0);
 			break;
 		}
 	}
@@ -17571,7 +17555,6 @@
 
 				regs_2057_ptr = regs_2057_rev5v1;
 			} else {
-				ASSERT(0);
 				break;
 			}
 
@@ -17586,11 +17569,8 @@
 			break;
 
 		default:
-			ASSERT(0);
 			break;
 		}
-	} else {
-		ASSERT(0);
 	}
 
 	wlc_phy_init_radio_regs_allbands(pi, regs_2057_ptr);
@@ -17708,7 +17688,6 @@
 		}
 
 		if (i >= tbl_len) {
-			ASSERT(i < tbl_len);
 			goto fail;
 		}
 		if (pi->pubpi.radiorev == 5) {
@@ -17765,7 +17744,6 @@
 		}
 
 		if (i >= tbl_len) {
-			ASSERT(i < tbl_len);
 			goto fail;
 		}
 		*t1 = &chan_info_tbl_p_1[i];
@@ -17777,7 +17755,6 @@
 				break;
 
 		if (i >= ARRAY_SIZE(chan_info_nphy_2055)) {
-			ASSERT(i < ARRAY_SIZE(chan_info_nphy_2055));
 			goto fail;
 		}
 		*t3 = &chan_info_nphy_2055[i];
@@ -19585,8 +19562,6 @@
 						 1, 0x08, 16, &v2);
 			wlc_phy_table_write_nphy(pi, NPHY_TBL_ID_ANTSWCTRLLUT,
 						 1, 0x0C, 16, &v3);
-		} else {
-			ASSERT(0);
 		}
 
 		if (pi->srom_fem5g.antswctrllut == 0) {
@@ -19598,8 +19573,6 @@
 						 1, 0x18, 16, &v2);
 			wlc_phy_table_write_nphy(pi, NPHY_TBL_ID_ANTSWCTRLLUT,
 						 1, 0x1C, 16, &v3);
-		} else {
-			ASSERT(0);
 		}
 	} else {
 
@@ -19718,8 +19691,6 @@
 		    3) ? NPHY_REV3_RFSEQ_CMD_END : NPHY_RFSEQ_CMD_END;
 	u8 end_dly = 1;
 
-	ASSERT(len <= 16);
-
 	if (pi->phyhang_avoid)
 		wlc_phy_stay_in_carriersearch_nphy(pi, true);
 
@@ -21503,8 +21474,6 @@
 		rxpwr = (rxpwr0 < rxpwr1) ? rxpwr0 : rxpwr1;
 	else if (pi->sh->rssi_mode == RSSI_ANT_MERGE_AVG)
 		rxpwr = (rxpwr0 + rxpwr1) >> 1;
-	else
-		ASSERT(0);
 
 	return rxpwr;
 }
@@ -22233,8 +22202,6 @@
 
 static void wlc_phy_restore_rssical_nphy(phy_info_t *pi)
 {
-	ASSERT(NREV_GE(pi->pubpi.phy_rev, 3));
-
 	if (CHSPEC_IS2G(pi->radio_chanspec)) {
 		if (pi->nphy_rssical_chanspec_2G == 0)
 			return;
@@ -22405,7 +22372,7 @@
 	wlc_phy_runsamples_nphy(pi, num_samps, loops, wait, iqmode,
 				dac_test_mode, modify_bbmult);
 
-	return BCME_OK;
+	return 0;
 }
 
 static void
@@ -22775,8 +22742,6 @@
 			}
 		}
 
-		ASSERT(idx != -1);
-
 		params->txgm = tbl_iqcal_gainparams_nphy[band_idx][k][1];
 		params->pga = tbl_iqcal_gainparams_nphy[band_idx][k][2];
 		params->pad = tbl_iqcal_gainparams_nphy[band_idx][k][3];
@@ -23855,8 +23820,6 @@
 	if (PHY_MUTED(pi))
 		return;
 
-	ASSERT(pi->nphy_perical != PHY_PERICAL_DISABLE);
-
 	if (caltype == PHY_PERICAL_AUTO)
 		fullcal = (pi->radio_chanspec != pi->nphy_txiqlocal_chanspec);
 	else if (caltype == PHY_PERICAL_PARTIAL)
@@ -23913,7 +23876,7 @@
 
 			target_gain = pi->nphy_cal_target_gain;
 		}
-		if (BCME_OK ==
+		if (0 ==
 		    wlc_phy_cal_txiqlo_nphy(pi, target_gain, fullcal, mphase)) {
 			if (PHY_IPA(pi))
 				wlc_phy_a4(pi, true);
@@ -23925,7 +23888,7 @@
 			wlapi_suspend_mac_and_wait(pi->sh->physhim);
 			wlc_phyreg_enter((wlc_phy_t *) pi);
 
-			if (BCME_OK == wlc_phy_cal_rxiq_nphy(pi, target_gain,
+			if (0 == wlc_phy_cal_rxiq_nphy(pi, target_gain,
 							     (pi->
 							      first_cal_after_assoc
 							      || (pi->
@@ -23955,8 +23918,6 @@
 			wlc_phy_radio205x_vcocal_nphy(pi);
 		}
 	} else {
-		ASSERT(pi->nphy_perical >= PHY_PERICAL_MPHASE);
-
 		switch (pi->mphase_cal_phase_id) {
 		case MPHASE_CAL_STATE_INIT:
 			pi->nphy_perical_last = pi->sh->now;
@@ -23980,7 +23941,7 @@
 
 			if (wlc_phy_cal_txiqlo_nphy
 			    (pi, pi->nphy_cal_target_gain, fullcal,
-			     true) != BCME_OK) {
+			     true) != 0) {
 
 				wlc_phy_cal_perical_mphase_reset(pi);
 				break;
@@ -24012,7 +23973,7 @@
 						  (pi->first_cal_after_assoc ||
 						   (pi->cal_type_override ==
 						    PHY_PERICAL_FULL)) ? 2 : 0,
-						  false) == BCME_OK) {
+						  false) == 0) {
 				wlc_phy_savecal_nphy(pi);
 			}
 
@@ -24052,7 +24013,6 @@
 			break;
 
 		default:
-			ASSERT(0);
 			wlc_phy_cal_perical_mphase_reset(pi);
 			break;
 		}
@@ -24116,7 +24076,7 @@
 	void *tbl_ptr;
 	bool ladder_updated[2];
 	u8 mphase_cal_lastphase = 0;
-	int bcmerror = BCME_OK;
+	int bcmerror = 0;
 	bool phyhang_avoid_state = false;
 
 	u16 tbl_tx_iqlo_cal_loft_ladder_20[] = {
@@ -24242,13 +24202,13 @@
 
 	if (pi->mphase_cal_phase_id > MPHASE_CAL_STATE_TXPHASE0) {
 		wlc_phy_runsamples_nphy(pi, phy_bw * 8, 0xffff, 0, 1, 0, false);
-		bcmerror = BCME_OK;
+		bcmerror = 0;
 	} else {
 		bcmerror =
 		    wlc_phy_tx_tone_nphy(pi, tone_freq, max_val, 1, 0, false);
 	}
 
-	if (bcmerror == BCME_OK) {
+	if (bcmerror == 0) {
 
 		if (pi->mphase_cal_phase_id > MPHASE_CAL_STATE_TXPHASE0) {
 			tbl_ptr = pi->mphase_txcal_bestcoeffs;
@@ -24468,8 +24428,6 @@
 {
 	u16 tbl_buf[7];
 
-	ASSERT(NREV_LT(pi->pubpi.phy_rev, 2));
-
 	if ((pi->nphy_txiqlocal_chanspec == pi->radio_chanspec) &&
 	    (pi->nphy_txiqlocal_coeffsvalid)) {
 		wlc_phy_table_read_nphy(pi, NPHY_TBL_ID_IQLOCAL,
@@ -24547,7 +24505,6 @@
 	ASSERT((read_phy_reg(pi, 0x129) & NPHY_IqestCmd_iqstart) == 0);
 
 	if ((read_phy_reg(pi, 0x129) & NPHY_IqestCmd_iqstart) == 0) {
-		ASSERT(pi->pubpi.phy_corenum <= PHY_CORE_MAX);
 		for (core = 0; core < pi->pubpi.phy_corenum; core++) {
 			est[core].i_pwr =
 			    (read_phy_reg(pi, NPHY_IqestipwrAccHi(core)) << 16)
@@ -24572,7 +24529,7 @@
 	u32 ii = 0, qq = 0;
 	s16 iq_nbits, qq_nbits, brsh, arsh;
 	s32 a, b, temp;
-	int bcmerror = BCME_OK;
+	int bcmerror = 0;
 	uint cal_retry = 0;
 
 	if (core_mask == 0x0)
@@ -24671,7 +24628,7 @@
 		}
 	}
 
-	if (bcmerror != BCME_OK) {
+	if (bcmerror != 0) {
 		printk("%s: Failed, cnt = %d\n", __func__, cal_retry);
 
 		if (cal_retry < CAL_RETRY_CNT) {
@@ -25451,7 +25408,7 @@
 			break;
 
 		default:
-			ASSERT(0);
+			break;
 		}
 
 		if ((curr_gaintbl_index < 0) ||
@@ -25916,7 +25873,7 @@
 
 	wlc_phy_stay_in_carriersearch_nphy(pi, false);
 
-	return BCME_OK;
+	return 0;
 }
 
 static int
@@ -25941,7 +25898,7 @@
 	u16 cal_gain[2];
 	nphy_iqcal_params_t cal_params[2];
 	u8 phy_bw;
-	int bcmerror = BCME_OK;
+	int bcmerror = 0;
 	bool first_playtone = true;
 
 	wlc_phy_stay_in_carriersearch_nphy(pi, true);
@@ -26091,7 +26048,7 @@
 							0, 0, 0, true);
 			}
 
-			if (bcmerror == BCME_OK) {
+			if (bcmerror == 0) {
 				if (gain_pass < 3) {
 
 					wlc_phy_rx_iq_est_nphy(pi, est,
@@ -26114,7 +26071,7 @@
 				wlc_phy_stopplayback_nphy(pi);
 			}
 
-			if (bcmerror != BCME_OK)
+			if (bcmerror != 0)
 				break;
 		}
 
@@ -26130,7 +26087,7 @@
 			      0xa7, orig_AfectrlCore);
 		write_phy_reg(pi, 0xa2, orig_RfseqCoreActv);
 
-		if (bcmerror != BCME_OK)
+		if (bcmerror != 0)
 			break;
 	}
 
@@ -26270,8 +26227,6 @@
 
 				tx_pwrctrl_tbl =
 				    nphy_tpc_txgain_ipa_2g_2057rev7;
-			} else {
-				ASSERT(0);
 			}
 
 		} else if (NREV_IS(pi->pubpi.phy_rev, 6)) {
@@ -26303,8 +26258,6 @@
 
 				tx_pwrctrl_tbl =
 				    nphy_tpc_txgain_ipa_5g_2057rev7;
-			} else {
-				ASSERT(0);
 			}
 
 		} else {
@@ -26347,8 +26300,6 @@
 				   || (pi->pubpi.radiorev == 6)) {
 
 				mixgain = 0x00;
-			} else {
-				ASSERT(0);
 			}
 
 		} else {
@@ -26361,8 +26312,6 @@
 				   || (pi->pubpi.radiorev == 8)) {
 
 				mixgain = 0x0;
-			} else {
-				ASSERT(0);
 			}
 		}
 
@@ -26464,8 +26413,6 @@
 				WRITE_RADIO_REG3(pi, RADIO_2057, TX, core,
 						 TXRXCOUPLE_2G_ATTEN, 0xf0);
 
-			} else {
-				ASSERT(0);
 			}
 
 			WRITE_RADIO_REG3(pi, RADIO_2057, TX, off_core,
@@ -26724,8 +26671,6 @@
 	u32 *buf, *src, *dst, sz;
 
 	sz = end - start + 1;
-	ASSERT(end > start);
-	ASSERT(end < NPHY_PAPD_EPS_TBL_SIZE);
 
 	buf = kmalloc(2 * sizeof(u32) * NPHY_PAPD_EPS_TBL_SIZE, GFP_ATOMIC);
 	if (NULL == buf) {
@@ -26787,8 +26732,6 @@
 
 	phy_a7 = (core == PHY_CORE_0) ? 1 : 0;
 
-	ASSERT((cal_mode == CAL_FULL) || (cal_mode == CAL_GCTRL)
-	       || (cal_mode == CAL_SOFT));
 	phy_a6 = ((cal_mode == CAL_GCTRL)
 		  || (cal_mode == CAL_SOFT)) ? true : false;
 
@@ -27333,8 +27276,6 @@
 							    nphy_papd_cal_gain_index
 							    [phy_b5], phy_b5);
 
-				} else {
-					ASSERT(0);
 				}
 
 				phy_b1[phy_b5].gains.pad[phy_b5] =
@@ -27417,8 +27358,6 @@
 					    -(nphy_papd_padgain_dlt_2g_2057rev7
 					      [phy_b8]
 					      + 1) / 2;
-				} else {
-					ASSERT(0);
 				}
 			} else {
 				phy_b7 = phy_b1[phy_b5].gains.pga[phy_b5];
@@ -27435,8 +27374,6 @@
 					    -(nphy_papd_pgagain_dlt_5g_2057rev7
 					      [phy_b7]
 					      + 1) / 2;
-				} else {
-					ASSERT(0);
 				}
 
 				phy_b10 = -9;
@@ -27536,8 +27473,6 @@
 	u8 txpi[2], chan_freq_range;
 	s32 rfpwr_offset;
 
-	ASSERT(pi->nphy_txpwrctrl == PHY_TPC_HW_OFF);
-
 	if (pi->phyhang_avoid)
 		wlc_phy_stay_in_carriersearch_nphy(pi, true);
 
@@ -29179,7 +29114,6 @@
 		*max_pwr = pi->tx_srom_max_rate_5g_hi[txp_rate_idx];
 		break;
 	default:
-		ASSERT(0);
 		*max_pwr = pi->tx_srom_max_rate_2g[txp_rate_idx];
 		break;
 	}
@@ -29207,8 +29141,6 @@
 		wlc_phy_resetcca_nphy(pi);
 
 	} else {
-		ASSERT(pi->nphy_deaf_count > 0);
-
 		pi->nphy_deaf_count--;
 
 		if (pi->nphy_deaf_count == 0) {
diff --git a/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c b/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c
index c1b07ae..61da97f 100644
--- a/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c
+++ b/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c
@@ -48,6 +48,8 @@
 #include "wl_ucode.h"
 #include "wl_mac80211.h"
 
+#define N_TX_QUEUES	4 /* #tx queues on mac80211<->driver interface */
+
 static void wl_timer(unsigned long data);
 static void _wl_timer(struct wl_timer *t);
 
@@ -552,7 +554,7 @@
 		 params->txop, params->cw_min, params->cw_max, params->aifs);
 
 	WL_LOCK(wl);
-	wlc_wme_setparams(wl->wlc, queue, (void *)params, true);
+	wlc_wme_setparams(wl->wlc, queue, params, true);
 	WL_UNLOCK(wl);
 
 	return 0;
@@ -1070,8 +1072,7 @@
 	    | IEEE80211_HW_AMPDU_AGGREGATION;
 
 	hw->extra_tx_headroom = wlc_get_header_len();
-	/* FIXME: should get this from wlc->machwcap */
-	hw->queues = 4;
+	hw->queues = N_TX_QUEUES;
 	/* FIXME: this doesn't seem to be used properly in minstrel_ht.
 	 * mac80211/status.c:ieee80211_tx_status() checks this value,
 	 * but mac80211/rc80211_minstrel_ht.c:minstrel_ht_get_rate()
diff --git a/drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c b/drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c
index f008659..07fbc3d 100644
--- a/drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c
+++ b/drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c
@@ -164,10 +164,6 @@
 	struct ampdu_info *ampdu;
 	int i;
 
-	/* some code depends on packed structures */
-	ASSERT(DOT11_MAXNUMFRAGS == NBITS(u16));
-	ASSERT(ISPOWEROF2(AMPDU_TX_BA_MAX_WSIZE));
-	ASSERT(ISPOWEROF2(AMPDU_RX_BA_MAX_WSIZE));
 	ASSERT(wlc->pub->tunables->ampdunummpdu <= AMPDU_MAX_MPDU);
 	ASSERT(wlc->pub->tunables->ampdunummpdu > 0);
 
@@ -406,7 +402,7 @@
 		/*
 		   compute a new dma xfer rate for max_mpdu @ max mcs.
 		   This is the minimum dma rate that
-		   can achieve no unferflow condition for the current mpdu size.
+		   can achieve no underflow condition for the current mpdu size.
 		 */
 		/* note : we divide/multiply by 100 to avoid integer overflows */
 		fifo->dmaxferrate =
@@ -687,7 +683,10 @@
 			WL_NONE("sendampdu: sgi %d, is40 %d, mcs %d\n",
 				sgi, is40, mcs);
 
-			maxlen = 64 * 1024;	/* XXX Fix me to honor real max_rxlen */
+			/* XXX Fix me to honor real max_rxlen */
+			/* can fix this as soon as ampdu_action() in mac80211.h
+			 * gets extra u8buf_size par */
+			maxlen = 64 * 1024;
 
 			if (is40)
 				mimo_ctlchbw =
@@ -1123,21 +1122,12 @@
 				ini->txretry[index] = 0;
 
 				/* ampdu_ack_len: number of acked aggregated frames */
-				/* ampdu_ack_map: block ack bit map for the aggregation */
 				/* ampdu_len: number of aggregated frames */
 				rate_status(wlc, tx_info, txs, mcs);
 				tx_info->flags |= IEEE80211_TX_STAT_ACK;
 				tx_info->flags |= IEEE80211_TX_STAT_AMPDU;
-
-				/* XXX TODO: Make these accurate. */
 				tx_info->status.ampdu_ack_len =
-				    (txs->
-				     status & TX_STATUS_FRM_RTX_MASK) >>
-				    TX_STATUS_FRM_RTX_SHIFT;
-				tx_info->status.ampdu_len =
-				    (txs->
-				     status & TX_STATUS_FRM_RTX_MASK) >>
-				    TX_STATUS_FRM_RTX_SHIFT;
+					tx_info->status.ampdu_len = 1;
 
 				skb_pull(p, D11_PHY_HDR_LEN);
 				skb_pull(p, D11_TXH_LEN);
@@ -1163,6 +1153,8 @@
 				/* Retry timeout */
 				ini->tx_in_transit--;
 				ieee80211_tx_info_clear_status(tx_info);
+				tx_info->status.ampdu_ack_len = 0;
+				tx_info->status.ampdu_len = 1;
 				tx_info->flags |=
 				    IEEE80211_TX_STAT_AMPDU_NO_BACK;
 				skb_pull(p, D11_PHY_HDR_LEN);
diff --git a/drivers/staging/brcm80211/brcmsmac/wlc_bmac.c b/drivers/staging/brcm80211/brcmsmac/wlc_bmac.c
index 4b6e181..f52b339 100644
--- a/drivers/staging/brcm80211/brcmsmac/wlc_bmac.c
+++ b/drivers/staging/brcm80211/brcmsmac/wlc_bmac.c
@@ -235,7 +235,7 @@
 	WL_TRACE("wl%d: wlc_setband_inact\n", wlc_hw->unit);
 
 	ASSERT(bandunit != wlc_hw->band->bandunit);
-	ASSERT(si_iscoreup(wlc_hw->sih));
+	ASSERT(ai_iscoreup(wlc_hw->sih));
 	ASSERT((R_REG(&wlc_hw->regs->maccontrol) & MCTL_EN_MAC) ==
 	       0);
 
@@ -547,8 +547,6 @@
 		 * TX: TX_AC_BK_FIFO (TX AC Background data packets)
 		 * RX: RX_FIFO (RX data packets)
 		 */
-		ASSERT(TX_AC_BK_FIFO == 0);
-		ASSERT(RX_FIFO == 0);
 		wlc_hw->di[0] = dma_attach(name, wlc_hw->sih,
 					   (wme ? DMAREG(wlc_hw, DMA_TX, 0) :
 					    NULL), DMAREG(wlc_hw, DMA_RX, 0),
@@ -563,8 +561,6 @@
 		 *   (legacy) TX_DATA_FIFO (TX data packets)
 		 * RX: UNUSED
 		 */
-		ASSERT(TX_AC_BE_FIFO == 1);
-		ASSERT(TX_DATA_FIFO == 1);
 		wlc_hw->di[1] = dma_attach(name, wlc_hw->sih,
 					   DMAREG(wlc_hw, DMA_TX, 1), NULL,
 					   tune->ntxd, 0, 0, -1, 0, 0,
@@ -576,7 +572,6 @@
 		 * TX: TX_AC_VI_FIFO (TX AC Video data packets)
 		 * RX: UNUSED
 		 */
-		ASSERT(TX_AC_VI_FIFO == 2);
 		wlc_hw->di[2] = dma_attach(name, wlc_hw->sih,
 					   DMAREG(wlc_hw, DMA_TX, 2), NULL,
 					   tune->ntxd, 0, 0, -1, 0, 0,
@@ -587,8 +582,6 @@
 		 * TX: TX_AC_VO_FIFO (TX AC Voice data packets)
 		 *   (legacy) TX_CTL_FIFO (TX control & mgmt packets)
 		 */
-		ASSERT(TX_AC_VO_FIFO == 3);
-		ASSERT(TX_CTL_FIFO == 3);
 		wlc_hw->di[3] = dma_attach(name, wlc_hw->sih,
 					   DMAREG(wlc_hw, DMA_TX, 3),
 					   NULL, tune->ntxd, 0, 0, -1,
@@ -648,7 +641,6 @@
 	WL_TRACE("wl%d: wlc_bmac_attach: vendor 0x%x device 0x%x\n",
 		 unit, vendor, device);
 
-	ASSERT(sizeof(wlc_d11rxhdr_t) <= WL_HWRXOFF);
 
 	wme = true;
 
@@ -715,7 +707,7 @@
 
 	/* set bar0 window to point at D11 core */
 	wlc_hw->regs = (d11regs_t *) si_setcore(wlc_hw->sih, D11_CORE_ID, 0);
-	wlc_hw->corerev = si_corerev(wlc_hw->sih);
+	wlc_hw->corerev = ai_corerev(wlc_hw->sih);
 
 	regs = wlc_hw->regs;
 
@@ -1230,7 +1222,7 @@
 	} else {
 
 		/* Reset and disable the core */
-		if (si_iscoreup(wlc_hw->sih)) {
+		if (ai_iscoreup(wlc_hw->sih)) {
 			if (R_REG(&wlc_hw->regs->maccontrol) &
 			    MCTL_EN_MAC)
 				wlc_suspend_mac_and_wait(wlc_hw->wlc);
@@ -1320,7 +1312,7 @@
 
 		/* check fast clock is available (if core is not in reset) */
 		if (wlc_hw->forcefastclk && wlc_hw->clk)
-			ASSERT(si_core_sflags(wlc_hw->sih, 0, 0) & SISF_FCLKA);
+			ASSERT(ai_core_sflags(wlc_hw->sih, 0, 0) & SISF_FCLKA);
 
 		/* keep the ucode wake bit on if forcefastclk is on
 		 * since we do not want ucode to put us back to slow clock
@@ -1384,7 +1376,6 @@
 
 	ASSERT((val & ~mask) == 0);
 	ASSERT(idx < MHFMAX);
-	ASSERT(ARRAY_SIZE(addr) == MHFMAX);
 
 	switch (bands) {
 		/* Current band only or all bands,
@@ -1460,8 +1451,6 @@
 		M_HOST_FLAGS5
 	};
 
-	ASSERT(ARRAY_SIZE(addr) == MHFMAX);
-
 	for (idx = 0; idx < MHFMAX; idx++) {
 		wlc_bmac_write_shm(wlc_hw, addr[idx], mhfs[idx]);
 	}
@@ -1843,17 +1832,17 @@
 
 	if (OFF == clk) {	/* clear gmode bit, put phy into reset */
 
-		si_core_cflags(wlc_hw->sih, (SICF_PRST | SICF_FGC | SICF_GMODE),
+		ai_core_cflags(wlc_hw->sih, (SICF_PRST | SICF_FGC | SICF_GMODE),
 			       (SICF_PRST | SICF_FGC));
 		udelay(1);
-		si_core_cflags(wlc_hw->sih, (SICF_PRST | SICF_FGC), SICF_PRST);
+		ai_core_cflags(wlc_hw->sih, (SICF_PRST | SICF_FGC), SICF_PRST);
 		udelay(1);
 
 	} else {		/* take phy out of reset */
 
-		si_core_cflags(wlc_hw->sih, (SICF_PRST | SICF_FGC), SICF_FGC);
+		ai_core_cflags(wlc_hw->sih, (SICF_PRST | SICF_FGC), SICF_FGC);
 		udelay(1);
-		si_core_cflags(wlc_hw->sih, (SICF_FGC), 0);
+		ai_core_cflags(wlc_hw->sih, (SICF_FGC), 0);
 		udelay(1);
 
 	}
@@ -1864,16 +1853,16 @@
 {
 	WL_TRACE("wl%d: wlc_bmac_core_phypll_reset\n", wlc_hw->unit);
 
-	si_corereg(wlc_hw->sih, SI_CC_IDX,
+	ai_corereg(wlc_hw->sih, SI_CC_IDX,
 		   offsetof(chipcregs_t, chipcontrol_addr), ~0, 0);
 	udelay(1);
-	si_corereg(wlc_hw->sih, SI_CC_IDX,
+	ai_corereg(wlc_hw->sih, SI_CC_IDX,
 		   offsetof(chipcregs_t, chipcontrol_data), 0x4, 0);
 	udelay(1);
-	si_corereg(wlc_hw->sih, SI_CC_IDX,
+	ai_corereg(wlc_hw->sih, SI_CC_IDX,
 		   offsetof(chipcregs_t, chipcontrol_data), 0x4, 4);
 	udelay(1);
-	si_corereg(wlc_hw->sih, SI_CC_IDX,
+	ai_corereg(wlc_hw->sih, SI_CC_IDX,
 		   offsetof(chipcregs_t, chipcontrol_data), 0x4, 0);
 	udelay(1);
 }
@@ -1888,18 +1877,18 @@
 		return;
 
 	if (ON == clk)
-		si_core_cflags(wlc_hw->sih, SICF_FGC, SICF_FGC);
+		ai_core_cflags(wlc_hw->sih, SICF_FGC, SICF_FGC);
 	else
-		si_core_cflags(wlc_hw->sih, SICF_FGC, 0);
+		ai_core_cflags(wlc_hw->sih, SICF_FGC, 0);
 
 }
 
 void wlc_bmac_macphyclk_set(struct wlc_hw_info *wlc_hw, bool clk)
 {
 	if (ON == clk)
-		si_core_cflags(wlc_hw->sih, SICF_MPCLKE, SICF_MPCLKE);
+		ai_core_cflags(wlc_hw->sih, SICF_MPCLKE, SICF_MPCLKE);
 	else
-		si_core_cflags(wlc_hw->sih, SICF_MPCLKE, 0);
+		ai_core_cflags(wlc_hw->sih, SICF_MPCLKE, 0);
 }
 
 void wlc_bmac_phy_reset(struct wlc_hw_info *wlc_hw)
@@ -1919,7 +1908,7 @@
 	if (WLCISNPHY(wlc_hw->band) && NREV_GE(wlc_hw->band->phyrev, 3) &&
 	    NREV_LE(wlc_hw->band->phyrev, 4)) {
 		/* Set the PHY bandwidth */
-		si_core_cflags(wlc_hw->sih, SICF_BWMASK, phy_bw_clkbits);
+		ai_core_cflags(wlc_hw->sih, SICF_BWMASK, phy_bw_clkbits);
 
 		udelay(1);
 
@@ -1927,12 +1916,12 @@
 		wlc_bmac_core_phypll_reset(wlc_hw);
 
 		/* reset the PHY */
-		si_core_cflags(wlc_hw->sih, (SICF_PRST | SICF_PCLKE),
+		ai_core_cflags(wlc_hw->sih, (SICF_PRST | SICF_PCLKE),
 			       (SICF_PRST | SICF_PCLKE));
 		phy_in_reset = true;
 	} else {
 
-		si_core_cflags(wlc_hw->sih,
+		ai_core_cflags(wlc_hw->sih,
 			       (SICF_PRST | SICF_PCLKE | SICF_BWMASK),
 			       (SICF_PRST | SICF_PCLKE | phy_bw_clkbits));
 	}
@@ -1955,9 +1944,9 @@
 	ASSERT(bandunit != wlc_hw->band->bandunit);
 
 	/* Enable the d11 core before accessing it */
-	if (!si_iscoreup(wlc_hw->sih)) {
-		si_core_reset(wlc_hw->sih, 0, 0);
-		ASSERT(si_iscoreup(wlc_hw->sih));
+	if (!ai_iscoreup(wlc_hw->sih)) {
+		ai_core_reset(wlc_hw->sih, 0, 0);
+		ASSERT(ai_iscoreup(wlc_hw->sih));
 		wlc_mctrl_reset(wlc_hw);
 	}
 
@@ -1999,7 +1988,7 @@
 
 	/* set gmode core flag */
 	if (wlc_hw->sbclk && !wlc_hw->noreset) {
-		si_core_cflags(wlc_hw->sih, SICF_GMODE,
+		ai_core_cflags(wlc_hw->sih, SICF_GMODE,
 			       ((bandunit == 0) ? SICF_GMODE : 0));
 	}
 }
@@ -2034,7 +2023,7 @@
 			goodboard = false;
 	}
 
-	if (wlc_hw->sih->boardvendor != VENDOR_BROADCOM)
+	if (wlc_hw->sih->boardvendor != PCI_VENDOR_ID_BROADCOM)
 		return goodboard;
 
 	return goodboard;
@@ -2096,7 +2085,7 @@
 			wlc_hw->regs =
 			    (d11regs_t *) si_setcore(wlc_hw->sih, D11_CORE_ID,
 						     0);
-		si_core_reset(wlc_hw->sih, flags, resetbits);
+		ai_core_reset(wlc_hw->sih, flags, resetbits);
 		wlc_mctrl_reset(wlc_hw);
 	}
 
@@ -2104,7 +2093,7 @@
 
 	/* put core back into reset */
 	if (!clk)
-		si_core_disable(wlc_hw->sih, 0);
+		ai_core_disable(wlc_hw->sih, 0);
 
 	if (!xtal)
 		wlc_bmac_xtal(wlc_hw, OFF);
@@ -2189,7 +2178,7 @@
 		wlc_clkctl_clk(wlc_hw, CLK_FAST);
 
 	/* reset the dma engines except first time thru */
-	if (si_iscoreup(wlc_hw->sih)) {
+	if (ai_iscoreup(wlc_hw->sih)) {
 		for (i = 0; i < NFIFO; i++)
 			if ((wlc_hw->di[i]) && (!dma_txreset(wlc_hw->di[i]))) {
 				WL_ERROR("wl%d: %s: dma_txreset[%d]: cannot stop dma\n",
@@ -2224,7 +2213,7 @@
 	 *  with other driver like mips/arm since they may touch chipcommon as well.
 	 */
 	wlc_hw->clk = false;
-	si_core_reset(wlc_hw->sih, flags, resetbits);
+	ai_core_reset(wlc_hw->sih, flags, resetbits);
 	wlc_hw->clk = true;
 	if (wlc_hw->band && wlc_hw->band->pi)
 		wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, true);
@@ -2343,7 +2332,7 @@
 
 	wlc_gpio_init(wlc);
 
-	sflags = si_core_sflags(wlc_hw->sih, 0, 0);
+	sflags = ai_core_sflags(wlc_hw->sih, 0, 0);
 
 	if (D11REV_IS(wlc_hw->corerev, 23)) {
 		if (WLCISNPHY(wlc_hw->band))
@@ -3480,7 +3469,7 @@
 		si_gpiocontrol(wlc_hw->sih, ~0, 0, GPIO_DRV_PRIORITY);
 
 	wlc_hw->clk = false;
-	si_core_disable(wlc_hw->sih, 0);
+	ai_core_disable(wlc_hw->sih, 0);
 	wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
 }
 
diff --git a/drivers/staging/brcm80211/brcmsmac/wlc_main.c b/drivers/staging/brcm80211/brcmsmac/wlc_main.c
index ab7ab85..fce9378 100644
--- a/drivers/staging/brcm80211/brcmsmac/wlc_main.c
+++ b/drivers/staging/brcm80211/brcmsmac/wlc_main.c
@@ -16,6 +16,7 @@
 #include <linux/kernel.h>
 #include <linux/ctype.h>
 #include <linux/etherdevice.h>
+#include <linux/pci_ids.h>
 #include <net/mac80211.h>
 
 #include <bcmdefs.h>
@@ -524,7 +525,7 @@
 	/* Enable EDCF mode (while the MAC is suspended) */
 	if (EDCF_ENAB(wlc->pub)) {
 		OR_REG(&regs->ifs_ctl, IFS_USEEDCF);
-		wlc_edcf_setparams(wlc->cfg, false);
+		wlc_edcf_setparams(wlc, false);
 	}
 
 	/* Init precedence maps for empty FIFOs */
@@ -1355,17 +1356,16 @@
 		  cpu_to_le16(EDCF_AC_VO_TXOP_STA)}
 		 }
 	};
-
-	ASSERT(sizeof(*pe) == WME_PARAM_IE_LEN);
 	memcpy(pe, &stadef, sizeof(*pe));
 }
 
-void wlc_wme_setparams(struct wlc_info *wlc, u16 aci, void *arg, bool suspend)
+void wlc_wme_setparams(struct wlc_info *wlc, u16 aci,
+		       const struct ieee80211_tx_queue_params *params,
+		       bool suspend)
 {
 	int i;
 	shm_acparams_t acp_shm;
 	u16 *shm_entry;
-	struct ieee80211_tx_queue_params *params = arg;
 
 	ASSERT(wlc);
 
@@ -1375,20 +1375,12 @@
 		return;
 	}
 
-	/*
-	 * AP uses AC params from wme_param_ie_ap.
-	 * AP advertises AC params from wme_param_ie.
-	 * STA uses AC params from wme_param_ie.
-	 */
-
 	wlc->wme_admctl = 0;
 
 	do {
 		memset((char *)&acp_shm, 0, sizeof(shm_acparams_t));
 		/* find out which ac this set of params applies to */
 		ASSERT(aci < AC_COUNT);
-		/* set the admission control policy for this AC */
-		/* wlc->wme_admctl |= 1 << aci; *//* should be set ??  seems like off by default */
 
 		/* fill in shm ac params struct */
 		acp_shm.txop = le16_to_cpu(params->txop);
@@ -1439,21 +1431,17 @@
 
 }
 
-void wlc_edcf_setparams(struct wlc_bsscfg *cfg, bool suspend)
+void wlc_edcf_setparams(struct wlc_info *wlc, bool suspend)
 {
-	struct wlc_info *wlc = cfg->wlc;
-	uint aci, i, j;
+	u16 aci;
+	int i_ac;
 	edcf_acparam_t *edcf_acp;
-	shm_acparams_t acp_shm;
-	u16 *shm_entry;
 
-	ASSERT(cfg);
+	struct ieee80211_tx_queue_params txq_pars;
+	struct ieee80211_tx_queue_params *params = &txq_pars;
+
 	ASSERT(wlc);
 
-	/* Only apply params if the core is out of reset and has clocks */
-	if (!wlc->clk)
-		return;
-
 	/*
 	 * AP uses AC params from wme_param_ie_ap.
 	 * AP advertises AC params from wme_param_ie.
@@ -1462,10 +1450,7 @@
 
 	edcf_acp = (edcf_acparam_t *) &wlc->wme_param_ie.acparam[0];
 
-	wlc->wme_admctl = 0;
-
-	for (i = 0; i < AC_COUNT; i++, edcf_acp++) {
-		memset((char *)&acp_shm, 0, sizeof(shm_acparams_t));
+	for (i_ac = 0; i_ac < AC_COUNT; i_ac++, edcf_acp++) {
 		/* find out which ac this set of params applies to */
 		aci = (edcf_acp->ACI & EDCF_ACI_MASK) >> EDCF_ACI_SHIFT;
 		ASSERT(aci < AC_COUNT);
@@ -1475,46 +1460,15 @@
 		}
 
 		/* fill in shm ac params struct */
-		acp_shm.txop = le16_to_cpu(edcf_acp->TXOP);
-		/* convert from units of 32us to us for ucode */
-		wlc->edcf_txop[aci] = acp_shm.txop =
-		    EDCF_TXOP2USEC(acp_shm.txop);
-		acp_shm.aifs = (edcf_acp->ACI & EDCF_AIFSN_MASK);
-
-		if (aci == AC_VI && acp_shm.txop == 0
-		    && acp_shm.aifs < EDCF_AIFSN_MAX)
-			acp_shm.aifs++;
-
-		if (acp_shm.aifs < EDCF_AIFSN_MIN
-		    || acp_shm.aifs > EDCF_AIFSN_MAX) {
-			WL_ERROR("wl%d: wlc_edcf_setparams: bad aifs %d\n",
-				 wlc->pub->unit, acp_shm.aifs);
-			continue;
-		}
+		params->txop = edcf_acp->TXOP;
+		params->aifs = edcf_acp->ACI;
 
 		/* CWmin = 2^(ECWmin) - 1 */
-		acp_shm.cwmin = EDCF_ECW2CW(edcf_acp->ECW & EDCF_ECWMIN_MASK);
+		params->cw_min = EDCF_ECW2CW(edcf_acp->ECW & EDCF_ECWMIN_MASK);
 		/* CWmax = 2^(ECWmax) - 1 */
-		acp_shm.cwmax = EDCF_ECW2CW((edcf_acp->ECW & EDCF_ECWMAX_MASK)
+		params->cw_max = EDCF_ECW2CW((edcf_acp->ECW & EDCF_ECWMAX_MASK)
 					    >> EDCF_ECWMAX_SHIFT);
-		acp_shm.cwcur = acp_shm.cwmin;
-		acp_shm.bslots =
-		    R_REG(&wlc->regs->tsf_random) & acp_shm.cwcur;
-		acp_shm.reggap = acp_shm.bslots + acp_shm.aifs;
-		/* Indicate the new params to the ucode */
-		acp_shm.status = wlc_read_shm(wlc, (M_EDCF_QINFO +
-						    wme_shmemacindex(aci) *
-						    M_EDCF_QLEN +
-						    M_EDCF_STATUS_OFF));
-		acp_shm.status |= WME_STATUS_NEWAC;
-
-		/* Fill in shm acparam table */
-		shm_entry = (u16 *) &acp_shm;
-		for (j = 0; j < (int)sizeof(shm_acparams_t); j += 2)
-			wlc_write_shm(wlc,
-				      M_EDCF_QINFO +
-				      wme_shmemacindex(aci) * M_EDCF_QLEN + j,
-				      *shm_entry++);
+		wlc_wme_setparams(wlc, aci, params, suspend);
 	}
 
 	if (suspend)
@@ -1733,39 +1687,6 @@
 	WL_NONE("wl%d: %s: vendor 0x%x device 0x%x\n",
 		unit, __func__, vendor, device);
 
-	ASSERT(WSEC_MAX_RCMTA_KEYS <= WSEC_MAX_KEYS);
-	ASSERT(WSEC_MAX_DEFAULT_KEYS == WLC_DEFAULT_KEYS);
-
-	/* some code depends on packed structures */
-	ASSERT(sizeof(struct ethhdr) == ETH_HLEN);
-	ASSERT(sizeof(d11regs_t) == SI_CORE_SIZE);
-	ASSERT(sizeof(ofdm_phy_hdr_t) == D11_PHY_HDR_LEN);
-	ASSERT(sizeof(cck_phy_hdr_t) == D11_PHY_HDR_LEN);
-	ASSERT(sizeof(d11txh_t) == D11_TXH_LEN);
-	ASSERT(sizeof(d11rxhdr_t) == RXHDR_LEN);
-	ASSERT(sizeof(struct ieee80211_hdr) == DOT11_A4_HDR_LEN);
-	ASSERT(sizeof(struct ieee80211_rts) == DOT11_RTS_LEN);
-	ASSERT(sizeof(tx_status_t) == TXSTATUS_LEN);
-	ASSERT(sizeof(struct ieee80211_ht_cap) == HT_CAP_IE_LEN);
-#ifdef BRCM_FULLMAC
-	ASSERT(offsetof(wl_scan_params_t, channel_list) ==
-	       WL_SCAN_PARAMS_FIXED_SIZE);
-#endif
-	ASSERT(IS_ALIGNED(offsetof(wsec_key_t, data), sizeof(u32)));
-	ASSERT(ISPOWEROF2(MA_WINDOW_SZ));
-
-	ASSERT(sizeof(wlc_d11rxhdr_t) <= WL_HWRXOFF);
-
-	/*
-	 * Number of replay counters value used in WPA IE must match # rxivs
-	 * supported in wsec_key_t struct. See 802.11i/D3.0 sect. 7.3.2.17
-	 * 'RSN Information Element' figure 8 for this mapping.
-	 */
-	ASSERT((WPA_CAP_16_REPLAY_CNTRS == WLC_REPLAY_CNTRS_VALUE
-		&& 16 == WLC_NUMRXIVS)
-	       || (WPA_CAP_4_REPLAY_CNTRS == WLC_REPLAY_CNTRS_VALUE
-		   && 4 == WLC_NUMRXIVS));
-
 	/* allocate struct wlc_info state and its substructures */
 	wlc = (struct wlc_info *) wlc_attach_malloc(unit, &err, device);
 	if (wlc == NULL)
@@ -4119,7 +4040,7 @@
 						    ~WSEC_PRIMARY_KEY;
 					key->flags |= WSEC_PRIMARY_KEY;
 					bsscfg->wsec_index = i;
-					bcmerror = BCME_OK;
+					bcmerror = 0;
 				}
 			}
 			break;
@@ -4551,7 +4472,7 @@
 
 			err = wlc_phy_txpower_get(wlc->band->pi, &qdbm,
 				&override);
-			if (err != BCME_OK)
+			if (err != 0)
 				return err;
 
 			/* Return qdbm units */
@@ -4871,7 +4792,7 @@
 
 bool wlc_chipmatch(u16 vendor, u16 device)
 {
-	if (vendor != VENDOR_BROADCOM) {
+	if (vendor != PCI_VENDOR_ID_BROADCOM) {
 		WL_ERROR("wlc_chipmatch: unknown vendor id %04x\n", vendor);
 		return false;
 	}
@@ -6948,11 +6869,6 @@
 #if defined(BCMDBG)
 	struct sk_buff *skb = p;
 #endif				/* BCMDBG */
-	/* Todo:
-	 * Cache plcp for first MPDU of AMPD and use chacched version for INTERMEDIATE.
-	 * Test for INTERMEDIATE  like so:
-	 * if (!(plcp[0] | plcp[1] | plcp[2]))
-	 */
 
 	memset(&rx_status, 0, sizeof(rx_status));
 	prep_mac80211_status(wlc, rxh, p, &rx_status);
@@ -7915,7 +7831,7 @@
 		rinfo->chippkg = wlc->pub->sih->chippkg;
 	}
 
-	return BCME_OK;
+	return 0;
 }
 
 void wlc_default_rateset(struct wlc_info *wlc, wlc_rateset_t *rs)
@@ -8111,7 +8027,7 @@
 	else
 		wlc->tx_duty_cycle_cck = (u16) duty_cycle;
 
-	return BCME_OK;
+	return 0;
 }
 
 /* Read a single u16 from shared memory.
diff --git a/drivers/staging/brcm80211/brcmsmac/wlc_main.h b/drivers/staging/brcm80211/brcmsmac/wlc_main.h
index 960f82c..f11161d 100644
--- a/drivers/staging/brcm80211/brcmsmac/wlc_main.h
+++ b/drivers/staging/brcm80211/brcmsmac/wlc_main.h
@@ -942,7 +942,7 @@
 
 extern void wlc_switch_shortslot(struct wlc_info *wlc, bool shortslot);
 extern void wlc_set_bssid(struct wlc_bsscfg *cfg);
-extern void wlc_edcf_setparams(struct wlc_bsscfg *cfg, bool suspend);
+extern void wlc_edcf_setparams(struct wlc_info *wlc, bool suspend);
 
 extern void wlc_set_ratetable(struct wlc_info *wlc);
 extern int wlc_set_mac(struct wlc_bsscfg *cfg);
diff --git a/drivers/staging/brcm80211/brcmsmac/wlc_pmu.c b/drivers/staging/brcm80211/brcmsmac/wlc_pmu.c
new file mode 100644
index 0000000..e26df70
--- /dev/null
+++ b/drivers/staging/brcm80211/brcmsmac/wlc_pmu.c
@@ -0,0 +1,1963 @@
+/*
+ * Copyright (c) 2011 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/delay.h>
+#include <asm/io.h>
+
+#include <bcmdevs.h>
+#include <sbchipc.h>
+#include <bcmutils.h>
+#include "wlc_pmu.h"
+
+/*
+ * d11 slow to fast clock transition time in slow clock cycles
+ */
+#define D11SCC_SLOW2FAST_TRANSITION	2
+
+/*
+ * external LPO crystal frequency
+ */
+#define EXT_ILP_HZ 32768
+
+/*
+ * Duration for ILP clock frequency measurment in milliseconds
+ *
+ * remark: 1000 must be an integer multiple of this duration
+ */
+#define ILP_CALC_DUR	10
+
+/*
+ * FVCO frequency
+ */
+#define FVCO_880	880000	/* 880MHz */
+#define FVCO_1760	1760000	/* 1760MHz */
+#define FVCO_1440	1440000	/* 1440MHz */
+#define FVCO_960	960000	/* 960MHz */
+
+/*
+ * PMU crystal table indices for 1440MHz fvco
+ */
+#define PMU1_XTALTAB0_1440_12000K	0
+#define PMU1_XTALTAB0_1440_13000K	1
+#define PMU1_XTALTAB0_1440_14400K	2
+#define PMU1_XTALTAB0_1440_15360K	3
+#define PMU1_XTALTAB0_1440_16200K	4
+#define PMU1_XTALTAB0_1440_16800K	5
+#define PMU1_XTALTAB0_1440_19200K	6
+#define PMU1_XTALTAB0_1440_19800K	7
+#define PMU1_XTALTAB0_1440_20000K	8
+#define PMU1_XTALTAB0_1440_25000K	9
+#define PMU1_XTALTAB0_1440_26000K	10
+#define PMU1_XTALTAB0_1440_30000K	11
+#define PMU1_XTALTAB0_1440_37400K	12
+#define PMU1_XTALTAB0_1440_38400K	13
+#define PMU1_XTALTAB0_1440_40000K	14
+#define PMU1_XTALTAB0_1440_48000K	15
+
+/*
+ * PMU crystal table indices for 960MHz fvco
+ */
+#define PMU1_XTALTAB0_960_12000K	0
+#define PMU1_XTALTAB0_960_13000K	1
+#define PMU1_XTALTAB0_960_14400K	2
+#define PMU1_XTALTAB0_960_15360K	3
+#define PMU1_XTALTAB0_960_16200K	4
+#define PMU1_XTALTAB0_960_16800K	5
+#define PMU1_XTALTAB0_960_19200K	6
+#define PMU1_XTALTAB0_960_19800K	7
+#define PMU1_XTALTAB0_960_20000K	8
+#define PMU1_XTALTAB0_960_25000K	9
+#define PMU1_XTALTAB0_960_26000K	10
+#define PMU1_XTALTAB0_960_30000K	11
+#define PMU1_XTALTAB0_960_37400K	12
+#define PMU1_XTALTAB0_960_38400K	13
+#define PMU1_XTALTAB0_960_40000K	14
+#define PMU1_XTALTAB0_960_48000K	15
+
+/*
+ * PMU crystal table indices for 880MHz fvco
+ */
+#define PMU1_XTALTAB0_880_12000K	0
+#define PMU1_XTALTAB0_880_13000K	1
+#define PMU1_XTALTAB0_880_14400K	2
+#define PMU1_XTALTAB0_880_15360K	3
+#define PMU1_XTALTAB0_880_16200K	4
+#define PMU1_XTALTAB0_880_16800K	5
+#define PMU1_XTALTAB0_880_19200K	6
+#define PMU1_XTALTAB0_880_19800K	7
+#define PMU1_XTALTAB0_880_20000K	8
+#define PMU1_XTALTAB0_880_24000K	9
+#define PMU1_XTALTAB0_880_25000K	10
+#define PMU1_XTALTAB0_880_26000K	11
+#define PMU1_XTALTAB0_880_30000K	12
+#define PMU1_XTALTAB0_880_37400K	13
+#define PMU1_XTALTAB0_880_38400K	14
+#define PMU1_XTALTAB0_880_40000K	15
+
+/*
+ * crystal frequency values
+ */
+#define XTAL_FREQ_24000MHZ		24000
+#define XTAL_FREQ_30000MHZ		30000
+#define XTAL_FREQ_37400MHZ		37400
+#define XTAL_FREQ_48000MHZ		48000
+
+/*
+ * Resource dependancies mask change action
+ *
+ * @RES_DEPEND_SET: Override the dependancies mask
+ * @RES_DEPEND_ADD: Add to the  dependancies mask
+ * @RES_DEPEND_REMOVE: Remove from the dependancies mask
+ */
+#define RES_DEPEND_SET		0
+#define RES_DEPEND_ADD		1
+#define RES_DEPEND_REMOVE	-1
+
+/* Setup resource up/down timers */
+typedef struct {
+	u8 resnum;
+	u16 updown;
+} pmu_res_updown_t;
+
+/* Change resource dependancies masks */
+typedef struct {
+	u32 res_mask;	/* resources (chip specific) */
+	s8 action;		/* action */
+	u32 depend_mask;	/* changes to the dependancies mask */
+	 bool(*filter) (si_t *sih);	/* action is taken when filter is NULL or return true */
+} pmu_res_depend_t;
+
+/* setup pll and query clock speed */
+typedef struct {
+	u16 fref;
+	u8 xf;
+	u8 p1div;
+	u8 p2div;
+	u8 ndiv_int;
+	u32 ndiv_frac;
+} pmu1_xtaltab0_t;
+
+/*
+ * prototypes used in resource tables
+ */
+static bool si_pmu_res_depfltr_bb(si_t *sih);
+static bool si_pmu_res_depfltr_ncb(si_t *sih);
+static bool si_pmu_res_depfltr_paldo(si_t *sih);
+static bool si_pmu_res_depfltr_npaldo(si_t *sih);
+
+static const pmu_res_updown_t bcm4328a0_res_updown[] = {
+	{
+	RES4328_EXT_SWITCHER_PWM, 0x0101}, {
+	RES4328_BB_SWITCHER_PWM, 0x1f01}, {
+	RES4328_BB_SWITCHER_BURST, 0x010f}, {
+	RES4328_BB_EXT_SWITCHER_BURST, 0x0101}, {
+	RES4328_ILP_REQUEST, 0x0202}, {
+	RES4328_RADIO_SWITCHER_PWM, 0x0f01}, {
+	RES4328_RADIO_SWITCHER_BURST, 0x0f01}, {
+	RES4328_ROM_SWITCH, 0x0101}, {
+	RES4328_PA_REF_LDO, 0x0f01}, {
+	RES4328_RADIO_LDO, 0x0f01}, {
+	RES4328_AFE_LDO, 0x0f01}, {
+	RES4328_PLL_LDO, 0x0f01}, {
+	RES4328_BG_FILTBYP, 0x0101}, {
+	RES4328_TX_FILTBYP, 0x0101}, {
+	RES4328_RX_FILTBYP, 0x0101}, {
+	RES4328_XTAL_PU, 0x0101}, {
+	RES4328_XTAL_EN, 0xa001}, {
+	RES4328_BB_PLL_FILTBYP, 0x0101}, {
+	RES4328_RF_PLL_FILTBYP, 0x0101}, {
+	RES4328_BB_PLL_PU, 0x0701}
+};
+
+static const pmu_res_depend_t bcm4328a0_res_depend[] = {
+	/* Adjust ILP request resource not to force ext/BB switchers into burst mode */
+	{
+	PMURES_BIT(RES4328_ILP_REQUEST),
+		    RES_DEPEND_SET,
+		    PMURES_BIT(RES4328_EXT_SWITCHER_PWM) |
+		    PMURES_BIT(RES4328_BB_SWITCHER_PWM), NULL}
+};
+
+static const pmu_res_updown_t bcm4325a0_res_updown_qt[] = {
+	{
+	RES4325_HT_AVAIL, 0x0300}, {
+	RES4325_BBPLL_PWRSW_PU, 0x0101}, {
+	RES4325_RFPLL_PWRSW_PU, 0x0101}, {
+	RES4325_ALP_AVAIL, 0x0100}, {
+	RES4325_XTAL_PU, 0x1000}, {
+	RES4325_LNLDO1_PU, 0x0800}, {
+	RES4325_CLDO_CBUCK_PWM, 0x0101}, {
+	RES4325_CBUCK_PWM, 0x0803}
+};
+
+static const pmu_res_updown_t bcm4325a0_res_updown[] = {
+	{
+	RES4325_XTAL_PU, 0x1501}
+};
+
+static const pmu_res_depend_t bcm4325a0_res_depend[] = {
+	/* Adjust OTP PU resource dependencies - remove BB BURST */
+	{
+	PMURES_BIT(RES4325_OTP_PU),
+		    RES_DEPEND_REMOVE,
+		    PMURES_BIT(RES4325_BUCK_BOOST_BURST), NULL},
+	    /* Adjust ALP/HT Avail resource dependencies - bring up BB along if it is used. */
+	{
+	PMURES_BIT(RES4325_ALP_AVAIL) | PMURES_BIT(RES4325_HT_AVAIL),
+		    RES_DEPEND_ADD,
+		    PMURES_BIT(RES4325_BUCK_BOOST_BURST) |
+		    PMURES_BIT(RES4325_BUCK_BOOST_PWM), si_pmu_res_depfltr_bb},
+	    /* Adjust HT Avail resource dependencies - bring up RF switches along with HT. */
+	{
+	PMURES_BIT(RES4325_HT_AVAIL),
+		    RES_DEPEND_ADD,
+		    PMURES_BIT(RES4325_RX_PWRSW_PU) |
+		    PMURES_BIT(RES4325_TX_PWRSW_PU) |
+		    PMURES_BIT(RES4325_LOGEN_PWRSW_PU) |
+		    PMURES_BIT(RES4325_AFE_PWRSW_PU), NULL},
+	    /* Adjust ALL resource dependencies - remove CBUCK dependancies if it is not used. */
+	{
+	PMURES_BIT(RES4325_ILP_REQUEST) |
+		    PMURES_BIT(RES4325_ABUCK_BURST) |
+		    PMURES_BIT(RES4325_ABUCK_PWM) |
+		    PMURES_BIT(RES4325_LNLDO1_PU) |
+		    PMURES_BIT(RES4325C1_LNLDO2_PU) |
+		    PMURES_BIT(RES4325_XTAL_PU) |
+		    PMURES_BIT(RES4325_ALP_AVAIL) |
+		    PMURES_BIT(RES4325_RX_PWRSW_PU) |
+		    PMURES_BIT(RES4325_TX_PWRSW_PU) |
+		    PMURES_BIT(RES4325_RFPLL_PWRSW_PU) |
+		    PMURES_BIT(RES4325_LOGEN_PWRSW_PU) |
+		    PMURES_BIT(RES4325_AFE_PWRSW_PU) |
+		    PMURES_BIT(RES4325_BBPLL_PWRSW_PU) |
+		    PMURES_BIT(RES4325_HT_AVAIL), RES_DEPEND_REMOVE,
+		    PMURES_BIT(RES4325B0_CBUCK_LPOM) |
+		    PMURES_BIT(RES4325B0_CBUCK_BURST) |
+		    PMURES_BIT(RES4325B0_CBUCK_PWM), si_pmu_res_depfltr_ncb}
+};
+
+static const pmu_res_updown_t bcm4315a0_res_updown_qt[] = {
+	{
+	RES4315_HT_AVAIL, 0x0101}, {
+	RES4315_XTAL_PU, 0x0100}, {
+	RES4315_LNLDO1_PU, 0x0100}, {
+	RES4315_PALDO_PU, 0x0100}, {
+	RES4315_CLDO_PU, 0x0100}, {
+	RES4315_CBUCK_PWM, 0x0100}, {
+	RES4315_CBUCK_BURST, 0x0100}, {
+	RES4315_CBUCK_LPOM, 0x0100}
+};
+
+static const pmu_res_updown_t bcm4315a0_res_updown[] = {
+	{
+	RES4315_XTAL_PU, 0x2501}
+};
+
+static const pmu_res_depend_t bcm4315a0_res_depend[] = {
+	/* Adjust OTP PU resource dependencies - not need PALDO unless write */
+	{
+	PMURES_BIT(RES4315_OTP_PU),
+		    RES_DEPEND_REMOVE,
+		    PMURES_BIT(RES4315_PALDO_PU), si_pmu_res_depfltr_npaldo},
+	    /* Adjust ALP/HT Avail resource dependencies - bring up PALDO along if it is used. */
+	{
+	PMURES_BIT(RES4315_ALP_AVAIL) | PMURES_BIT(RES4315_HT_AVAIL),
+		    RES_DEPEND_ADD,
+		    PMURES_BIT(RES4315_PALDO_PU), si_pmu_res_depfltr_paldo},
+	    /* Adjust HT Avail resource dependencies - bring up RF switches along with HT. */
+	{
+	PMURES_BIT(RES4315_HT_AVAIL),
+		    RES_DEPEND_ADD,
+		    PMURES_BIT(RES4315_RX_PWRSW_PU) |
+		    PMURES_BIT(RES4315_TX_PWRSW_PU) |
+		    PMURES_BIT(RES4315_LOGEN_PWRSW_PU) |
+		    PMURES_BIT(RES4315_AFE_PWRSW_PU), NULL},
+	    /* Adjust ALL resource dependencies - remove CBUCK dependancies if it is not used. */
+	{
+	PMURES_BIT(RES4315_CLDO_PU) | PMURES_BIT(RES4315_ILP_REQUEST) |
+		    PMURES_BIT(RES4315_LNLDO1_PU) |
+		    PMURES_BIT(RES4315_OTP_PU) |
+		    PMURES_BIT(RES4315_LNLDO2_PU) |
+		    PMURES_BIT(RES4315_XTAL_PU) |
+		    PMURES_BIT(RES4315_ALP_AVAIL) |
+		    PMURES_BIT(RES4315_RX_PWRSW_PU) |
+		    PMURES_BIT(RES4315_TX_PWRSW_PU) |
+		    PMURES_BIT(RES4315_RFPLL_PWRSW_PU) |
+		    PMURES_BIT(RES4315_LOGEN_PWRSW_PU) |
+		    PMURES_BIT(RES4315_AFE_PWRSW_PU) |
+		    PMURES_BIT(RES4315_BBPLL_PWRSW_PU) |
+		    PMURES_BIT(RES4315_HT_AVAIL), RES_DEPEND_REMOVE,
+		    PMURES_BIT(RES4315_CBUCK_LPOM) |
+		    PMURES_BIT(RES4315_CBUCK_BURST) |
+		    PMURES_BIT(RES4315_CBUCK_PWM), si_pmu_res_depfltr_ncb}
+};
+
+	/* 4329 specific. needs to come back this issue later */
+static const pmu_res_updown_t bcm4329_res_updown[] = {
+	{
+	RES4329_XTAL_PU, 0x1501}
+};
+
+static const pmu_res_depend_t bcm4329_res_depend[] = {
+	/* Adjust HT Avail resource dependencies */
+	{
+	PMURES_BIT(RES4329_HT_AVAIL),
+		    RES_DEPEND_ADD,
+		    PMURES_BIT(RES4329_CBUCK_LPOM) |
+		    PMURES_BIT(RES4329_CBUCK_BURST) |
+		    PMURES_BIT(RES4329_CBUCK_PWM) |
+		    PMURES_BIT(RES4329_CLDO_PU) |
+		    PMURES_BIT(RES4329_PALDO_PU) |
+		    PMURES_BIT(RES4329_LNLDO1_PU) |
+		    PMURES_BIT(RES4329_XTAL_PU) |
+		    PMURES_BIT(RES4329_ALP_AVAIL) |
+		    PMURES_BIT(RES4329_RX_PWRSW_PU) |
+		    PMURES_BIT(RES4329_TX_PWRSW_PU) |
+		    PMURES_BIT(RES4329_RFPLL_PWRSW_PU) |
+		    PMURES_BIT(RES4329_LOGEN_PWRSW_PU) |
+		    PMURES_BIT(RES4329_AFE_PWRSW_PU) |
+		    PMURES_BIT(RES4329_BBPLL_PWRSW_PU), NULL}
+};
+
+static const pmu_res_updown_t bcm4319a0_res_updown_qt[] = {
+	{
+	RES4319_HT_AVAIL, 0x0101}, {
+	RES4319_XTAL_PU, 0x0100}, {
+	RES4319_LNLDO1_PU, 0x0100}, {
+	RES4319_PALDO_PU, 0x0100}, {
+	RES4319_CLDO_PU, 0x0100}, {
+	RES4319_CBUCK_PWM, 0x0100}, {
+	RES4319_CBUCK_BURST, 0x0100}, {
+	RES4319_CBUCK_LPOM, 0x0100}
+};
+
+static const pmu_res_updown_t bcm4319a0_res_updown[] = {
+	{
+	RES4319_XTAL_PU, 0x3f01}
+};
+
+static const pmu_res_depend_t bcm4319a0_res_depend[] = {
+	/* Adjust OTP PU resource dependencies - not need PALDO unless write */
+	{
+	PMURES_BIT(RES4319_OTP_PU),
+		    RES_DEPEND_REMOVE,
+		    PMURES_BIT(RES4319_PALDO_PU), si_pmu_res_depfltr_npaldo},
+	    /* Adjust HT Avail resource dependencies - bring up PALDO along if it is used. */
+	{
+	PMURES_BIT(RES4319_HT_AVAIL),
+		    RES_DEPEND_ADD,
+		    PMURES_BIT(RES4319_PALDO_PU), si_pmu_res_depfltr_paldo},
+	    /* Adjust HT Avail resource dependencies - bring up RF switches along with HT. */
+	{
+	PMURES_BIT(RES4319_HT_AVAIL),
+		    RES_DEPEND_ADD,
+		    PMURES_BIT(RES4319_RX_PWRSW_PU) |
+		    PMURES_BIT(RES4319_TX_PWRSW_PU) |
+		    PMURES_BIT(RES4319_RFPLL_PWRSW_PU) |
+		    PMURES_BIT(RES4319_LOGEN_PWRSW_PU) |
+		    PMURES_BIT(RES4319_AFE_PWRSW_PU), NULL}
+};
+
+static const pmu_res_updown_t bcm4336a0_res_updown_qt[] = {
+	{
+	RES4336_HT_AVAIL, 0x0101}, {
+	RES4336_XTAL_PU, 0x0100}, {
+	RES4336_CLDO_PU, 0x0100}, {
+	RES4336_CBUCK_PWM, 0x0100}, {
+	RES4336_CBUCK_BURST, 0x0100}, {
+	RES4336_CBUCK_LPOM, 0x0100}
+};
+
+static const pmu_res_updown_t bcm4336a0_res_updown[] = {
+	{
+	RES4336_HT_AVAIL, 0x0D01}
+};
+
+static const pmu_res_depend_t bcm4336a0_res_depend[] = {
+	/* Just a dummy entry for now */
+	{
+	PMURES_BIT(RES4336_RSVD), RES_DEPEND_ADD, 0, NULL}
+};
+
+static const pmu_res_updown_t bcm4330a0_res_updown_qt[] = {
+	{
+	RES4330_HT_AVAIL, 0x0101}, {
+	RES4330_XTAL_PU, 0x0100}, {
+	RES4330_CLDO_PU, 0x0100}, {
+	RES4330_CBUCK_PWM, 0x0100}, {
+	RES4330_CBUCK_BURST, 0x0100}, {
+	RES4330_CBUCK_LPOM, 0x0100}
+};
+
+static const pmu_res_updown_t bcm4330a0_res_updown[] = {
+	{
+	RES4330_HT_AVAIL, 0x0e02}
+};
+
+static const pmu_res_depend_t bcm4330a0_res_depend[] = {
+	/* Just a dummy entry for now */
+	{
+	PMURES_BIT(RES4330_HT_AVAIL), RES_DEPEND_ADD, 0, NULL}
+};
+
+/* the following table is based on 1440Mhz fvco */
+static const pmu1_xtaltab0_t pmu1_xtaltab0_1440[] = {
+	{
+	12000, 1, 1, 1, 0x78, 0x0}, {
+	13000, 2, 1, 1, 0x6E, 0xC4EC4E}, {
+	14400, 3, 1, 1, 0x64, 0x0}, {
+	15360, 4, 1, 1, 0x5D, 0xC00000}, {
+	16200, 5, 1, 1, 0x58, 0xE38E38}, {
+	16800, 6, 1, 1, 0x55, 0xB6DB6D}, {
+	19200, 7, 1, 1, 0x4B, 0}, {
+	19800, 8, 1, 1, 0x48, 0xBA2E8B}, {
+	20000, 9, 1, 1, 0x48, 0x0}, {
+	25000, 10, 1, 1, 0x39, 0x999999}, {
+	26000, 11, 1, 1, 0x37, 0x627627}, {
+	30000, 12, 1, 1, 0x30, 0x0}, {
+	37400, 13, 2, 1, 0x4D, 0x15E76}, {
+	38400, 13, 2, 1, 0x4B, 0x0}, {
+	40000, 14, 2, 1, 0x48, 0x0}, {
+	48000, 15, 2, 1, 0x3c, 0x0}, {
+	0, 0, 0, 0, 0, 0}
+};
+
+static const pmu1_xtaltab0_t pmu1_xtaltab0_960[] = {
+	{
+	12000, 1, 1, 1, 0x50, 0x0}, {
+	13000, 2, 1, 1, 0x49, 0xD89D89}, {
+	14400, 3, 1, 1, 0x42, 0xAAAAAA}, {
+	15360, 4, 1, 1, 0x3E, 0x800000}, {
+	16200, 5, 1, 1, 0x39, 0x425ED0}, {
+	16800, 6, 1, 1, 0x39, 0x249249}, {
+	19200, 7, 1, 1, 0x32, 0x0}, {
+	19800, 8, 1, 1, 0x30, 0x7C1F07}, {
+	20000, 9, 1, 1, 0x30, 0x0}, {
+	25000, 10, 1, 1, 0x26, 0x666666}, {
+	26000, 11, 1, 1, 0x24, 0xEC4EC4}, {
+	30000, 12, 1, 1, 0x20, 0x0}, {
+	37400, 13, 2, 1, 0x33, 0x563EF9}, {
+	38400, 14, 2, 1, 0x32, 0x0}, {
+	40000, 15, 2, 1, 0x30, 0x0}, {
+	48000, 16, 2, 1, 0x28, 0x0}, {
+	0, 0, 0, 0, 0, 0}
+};
+
+static const pmu1_xtaltab0_t pmu1_xtaltab0_880_4329[] = {
+	{
+	12000, 1, 3, 22, 0x9, 0xFFFFEF}, {
+	13000, 2, 1, 6, 0xb, 0x483483}, {
+	14400, 3, 1, 10, 0xa, 0x1C71C7}, {
+	15360, 4, 1, 5, 0xb, 0x755555}, {
+	16200, 5, 1, 10, 0x5, 0x6E9E06}, {
+	16800, 6, 1, 10, 0x5, 0x3Cf3Cf}, {
+	19200, 7, 1, 4, 0xb, 0x755555}, {
+	19800, 8, 1, 11, 0x4, 0xA57EB}, {
+	20000, 9, 1, 11, 0x4, 0x0}, {
+	24000, 10, 3, 11, 0xa, 0x0}, {
+	25000, 11, 5, 16, 0xb, 0x0}, {
+	26000, 12, 1, 1, 0x21, 0xD89D89}, {
+	30000, 13, 3, 8, 0xb, 0x0}, {
+	37400, 14, 3, 1, 0x46, 0x969696}, {
+	38400, 15, 1, 1, 0x16, 0xEAAAAA}, {
+	40000, 16, 1, 2, 0xb, 0}, {
+	0, 0, 0, 0, 0, 0}
+};
+
+/* the following table is based on 880Mhz fvco */
+static const pmu1_xtaltab0_t pmu1_xtaltab0_880[] = {
+	{
+	12000, 1, 3, 22, 0x9, 0xFFFFEF}, {
+	13000, 2, 1, 6, 0xb, 0x483483}, {
+	14400, 3, 1, 10, 0xa, 0x1C71C7}, {
+	15360, 4, 1, 5, 0xb, 0x755555}, {
+	16200, 5, 1, 10, 0x5, 0x6E9E06}, {
+	16800, 6, 1, 10, 0x5, 0x3Cf3Cf}, {
+	19200, 7, 1, 4, 0xb, 0x755555}, {
+	19800, 8, 1, 11, 0x4, 0xA57EB}, {
+	20000, 9, 1, 11, 0x4, 0x0}, {
+	24000, 10, 3, 11, 0xa, 0x0}, {
+	25000, 11, 5, 16, 0xb, 0x0}, {
+	26000, 12, 1, 2, 0x10, 0xEC4EC4}, {
+	30000, 13, 3, 8, 0xb, 0x0}, {
+	33600, 14, 1, 2, 0xd, 0x186186}, {
+	38400, 15, 1, 2, 0xb, 0x755555}, {
+	40000, 16, 1, 2, 0xb, 0}, {
+	0, 0, 0, 0, 0, 0}
+};
+
+/* true if the power topology uses the buck boost to provide 3.3V to VDDIO_RF and WLAN PA */
+static bool si_pmu_res_depfltr_bb(si_t *sih)
+{
+	return (sih->boardflags & BFL_BUCKBOOST) != 0;
+}
+
+/* true if the power topology doesn't use the cbuck. Key on chiprev also if the chip is BCM4325. */
+static bool si_pmu_res_depfltr_ncb(si_t *sih)
+{
+
+	return (sih->boardflags & BFL_NOCBUCK) != 0;
+}
+
+/* true if the power topology uses the PALDO */
+static bool si_pmu_res_depfltr_paldo(si_t *sih)
+{
+	return (sih->boardflags & BFL_PALDO) != 0;
+}
+
+/* true if the power topology doesn't use the PALDO */
+static bool si_pmu_res_depfltr_npaldo(si_t *sih)
+{
+	return (sih->boardflags & BFL_PALDO) == 0;
+}
+
+/* Return dependancies (direct or all/indirect) for the given resources */
+static u32
+si_pmu_res_deps(si_t *sih, chipcregs_t *cc, u32 rsrcs,
+		bool all)
+{
+	u32 deps = 0;
+	u32 i;
+
+	for (i = 0; i <= PMURES_MAX_RESNUM; i++) {
+		if (!(rsrcs & PMURES_BIT(i)))
+			continue;
+		W_REG(&cc->res_table_sel, i);
+		deps |= R_REG(&cc->res_dep_mask);
+	}
+
+	return !all ? deps : (deps
+			      ? (deps |
+				 si_pmu_res_deps(sih, cc, deps,
+						 true)) : 0);
+}
+
+/* Determine min/max rsrc masks. Value 0 leaves hardware at default. */
+static void si_pmu_res_masks(si_t *sih, u32 * pmin, u32 * pmax)
+{
+	u32 min_mask = 0, max_mask = 0;
+	uint rsrcs;
+	char *val;
+
+	/* # resources */
+	rsrcs = (sih->pmucaps & PCAP_RC_MASK) >> PCAP_RC_SHIFT;
+
+	/* determine min/max rsrc masks */
+	switch (sih->chip) {
+	case BCM43224_CHIP_ID:
+	case BCM43225_CHIP_ID:
+	case BCM43421_CHIP_ID:
+	case BCM43235_CHIP_ID:
+	case BCM43236_CHIP_ID:
+	case BCM43238_CHIP_ID:
+	case BCM4331_CHIP_ID:
+	case BCM6362_CHIP_ID:
+		/* ??? */
+		break;
+
+	case BCM4329_CHIP_ID:
+		/* 4329 spedific issue. Needs to come back this issue later */
+		/* Down to save the power. */
+		min_mask =
+		    PMURES_BIT(RES4329_CBUCK_LPOM) |
+		    PMURES_BIT(RES4329_CLDO_PU);
+		/* Allow (but don't require) PLL to turn on */
+		max_mask = 0x3ff63e;
+		break;
+	case BCM4319_CHIP_ID:
+		/* We only need a few resources to be kept on all the time */
+		min_mask = PMURES_BIT(RES4319_CBUCK_LPOM) |
+		    PMURES_BIT(RES4319_CLDO_PU);
+
+		/* Allow everything else to be turned on upon requests */
+		max_mask = ~(~0 << rsrcs);
+		break;
+	case BCM4336_CHIP_ID:
+		/* Down to save the power. */
+		min_mask =
+		    PMURES_BIT(RES4336_CBUCK_LPOM) | PMURES_BIT(RES4336_CLDO_PU)
+		    | PMURES_BIT(RES4336_LDO3P3_PU) | PMURES_BIT(RES4336_OTP_PU)
+		    | PMURES_BIT(RES4336_DIS_INT_RESET_PD);
+		/* Allow (but don't require) PLL to turn on */
+		max_mask = 0x1ffffff;
+		break;
+
+	case BCM4330_CHIP_ID:
+		/* Down to save the power. */
+		min_mask =
+		    PMURES_BIT(RES4330_CBUCK_LPOM) | PMURES_BIT(RES4330_CLDO_PU)
+		    | PMURES_BIT(RES4330_DIS_INT_RESET_PD) |
+		    PMURES_BIT(RES4330_LDO3P3_PU) | PMURES_BIT(RES4330_OTP_PU);
+		/* Allow (but don't require) PLL to turn on */
+		max_mask = 0xfffffff;
+		break;
+
+	case BCM4313_CHIP_ID:
+		min_mask = PMURES_BIT(RES4313_BB_PU_RSRC) |
+		    PMURES_BIT(RES4313_XTAL_PU_RSRC) |
+		    PMURES_BIT(RES4313_ALP_AVAIL_RSRC) |
+		    PMURES_BIT(RES4313_BB_PLL_PWRSW_RSRC);
+		max_mask = 0xffff;
+		break;
+	default:
+		break;
+	}
+
+	/* Apply nvram override to min mask */
+	val = getvar(NULL, "rmin");
+	if (val != NULL) {
+		min_mask = (u32) simple_strtoul(val, NULL, 0);
+	}
+	/* Apply nvram override to max mask */
+	val = getvar(NULL, "rmax");
+	if (val != NULL) {
+		max_mask = (u32) simple_strtoul(val, NULL, 0);
+	}
+
+	*pmin = min_mask;
+	*pmax = max_mask;
+}
+
+/* Return up time in ILP cycles for the given resource. */
+static uint
+si_pmu_res_uptime(si_t *sih, chipcregs_t *cc, u8 rsrc) {
+	u32 deps;
+	uint up, i, dup, dmax;
+	u32 min_mask = 0, max_mask = 0;
+
+	/* uptime of resource 'rsrc' */
+	W_REG(&cc->res_table_sel, rsrc);
+	up = (R_REG(&cc->res_updn_timer) >> 8) & 0xff;
+
+	/* direct dependancies of resource 'rsrc' */
+	deps = si_pmu_res_deps(sih, cc, PMURES_BIT(rsrc), false);
+	for (i = 0; i <= PMURES_MAX_RESNUM; i++) {
+		if (!(deps & PMURES_BIT(i)))
+			continue;
+		deps &= ~si_pmu_res_deps(sih, cc, PMURES_BIT(i), true);
+	}
+	si_pmu_res_masks(sih, &min_mask, &max_mask);
+	deps &= ~min_mask;
+
+	/* max uptime of direct dependancies */
+	dmax = 0;
+	for (i = 0; i <= PMURES_MAX_RESNUM; i++) {
+		if (!(deps & PMURES_BIT(i)))
+			continue;
+		dup = si_pmu_res_uptime(sih, cc, (u8) i);
+		if (dmax < dup)
+			dmax = dup;
+	}
+
+	return up + dmax + PMURES_UP_TRANSITION;
+}
+
+static void
+si_pmu_spuravoid_pllupdate(si_t *sih, chipcregs_t *cc, u8 spuravoid)
+{
+	u32 tmp = 0;
+	u8 phypll_offset = 0;
+	u8 bcm5357_bcm43236_p1div[] = { 0x1, 0x5, 0x5 };
+	u8 bcm5357_bcm43236_ndiv[] = { 0x30, 0xf6, 0xfc };
+
+	switch (sih->chip) {
+	case BCM5357_CHIP_ID:
+	case BCM43235_CHIP_ID:
+	case BCM43236_CHIP_ID:
+	case BCM43238_CHIP_ID:
+
+		/* BCM5357 needs to touch PLL1_PLLCTL[02], so offset PLL0_PLLCTL[02] by 6 */
+		phypll_offset = (sih->chip == BCM5357_CHIP_ID) ? 6 : 0;
+
+		/* RMW only the P1 divider */
+		W_REG(&cc->pllcontrol_addr,
+		      PMU1_PLL0_PLLCTL0 + phypll_offset);
+		tmp = R_REG(&cc->pllcontrol_data);
+		tmp &= (~(PMU1_PLL0_PC0_P1DIV_MASK));
+		tmp |=
+		    (bcm5357_bcm43236_p1div[spuravoid] <<
+		     PMU1_PLL0_PC0_P1DIV_SHIFT);
+		W_REG(&cc->pllcontrol_data, tmp);
+
+		/* RMW only the int feedback divider */
+		W_REG(&cc->pllcontrol_addr,
+		      PMU1_PLL0_PLLCTL2 + phypll_offset);
+		tmp = R_REG(&cc->pllcontrol_data);
+		tmp &= ~(PMU1_PLL0_PC2_NDIV_INT_MASK);
+		tmp |=
+		    (bcm5357_bcm43236_ndiv[spuravoid]) <<
+		    PMU1_PLL0_PC2_NDIV_INT_SHIFT;
+		W_REG(&cc->pllcontrol_data, tmp);
+
+		tmp = 1 << 10;
+		break;
+
+	case BCM4331_CHIP_ID:
+		if (spuravoid == 2) {
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL0);
+			W_REG(&cc->pllcontrol_data, 0x11500014);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL2);
+			W_REG(&cc->pllcontrol_data, 0x0FC00a08);
+		} else if (spuravoid == 1) {
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL0);
+			W_REG(&cc->pllcontrol_data, 0x11500014);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL2);
+			W_REG(&cc->pllcontrol_data, 0x0F600a08);
+		} else {
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL0);
+			W_REG(&cc->pllcontrol_data, 0x11100014);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL2);
+			W_REG(&cc->pllcontrol_data, 0x03000a08);
+		}
+		tmp = 1 << 10;
+		break;
+
+	case BCM43224_CHIP_ID:
+	case BCM43225_CHIP_ID:
+	case BCM43421_CHIP_ID:
+	case BCM6362_CHIP_ID:
+		if (spuravoid == 1) {
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL0);
+			W_REG(&cc->pllcontrol_data, 0x11500010);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL1);
+			W_REG(&cc->pllcontrol_data, 0x000C0C06);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL2);
+			W_REG(&cc->pllcontrol_data, 0x0F600a08);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL3);
+			W_REG(&cc->pllcontrol_data, 0x00000000);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL4);
+			W_REG(&cc->pllcontrol_data, 0x2001E920);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL5);
+			W_REG(&cc->pllcontrol_data, 0x88888815);
+		} else {
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL0);
+			W_REG(&cc->pllcontrol_data, 0x11100010);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL1);
+			W_REG(&cc->pllcontrol_data, 0x000c0c06);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL2);
+			W_REG(&cc->pllcontrol_data, 0x03000a08);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL3);
+			W_REG(&cc->pllcontrol_data, 0x00000000);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL4);
+			W_REG(&cc->pllcontrol_data, 0x200005c0);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL5);
+			W_REG(&cc->pllcontrol_data, 0x88888815);
+		}
+		tmp = 1 << 10;
+		break;
+
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL0);
+		W_REG(&cc->pllcontrol_data, 0x11100008);
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL1);
+		W_REG(&cc->pllcontrol_data, 0x0c000c06);
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL2);
+		W_REG(&cc->pllcontrol_data, 0x03000a08);
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL3);
+		W_REG(&cc->pllcontrol_data, 0x00000000);
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL4);
+		W_REG(&cc->pllcontrol_data, 0x200005c0);
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL5);
+		W_REG(&cc->pllcontrol_data, 0x88888855);
+
+		tmp = 1 << 10;
+		break;
+
+	case BCM4716_CHIP_ID:
+	case BCM4748_CHIP_ID:
+	case BCM47162_CHIP_ID:
+		if (spuravoid == 1) {
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL0);
+			W_REG(&cc->pllcontrol_data, 0x11500060);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL1);
+			W_REG(&cc->pllcontrol_data, 0x080C0C06);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL2);
+			W_REG(&cc->pllcontrol_data, 0x0F600000);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL3);
+			W_REG(&cc->pllcontrol_data, 0x00000000);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL4);
+			W_REG(&cc->pllcontrol_data, 0x2001E924);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL5);
+			W_REG(&cc->pllcontrol_data, 0x88888815);
+		} else {
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL0);
+			W_REG(&cc->pllcontrol_data, 0x11100060);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL1);
+			W_REG(&cc->pllcontrol_data, 0x080c0c06);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL2);
+			W_REG(&cc->pllcontrol_data, 0x03000000);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL3);
+			W_REG(&cc->pllcontrol_data, 0x00000000);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL4);
+			W_REG(&cc->pllcontrol_data, 0x200005c0);
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL5);
+			W_REG(&cc->pllcontrol_data, 0x88888815);
+		}
+
+		tmp = 3 << 9;
+		break;
+
+	case BCM4319_CHIP_ID:
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL0);
+		W_REG(&cc->pllcontrol_data, 0x11100070);
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL1);
+		W_REG(&cc->pllcontrol_data, 0x1014140a);
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL5);
+		W_REG(&cc->pllcontrol_data, 0x88888854);
+
+		if (spuravoid == 1) {	/* spur_avoid ON, enable 41/82/164Mhz clock mode */
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL2);
+			W_REG(&cc->pllcontrol_data, 0x05201828);
+		} else {	/* enable 40/80/160Mhz clock mode */
+			W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL2);
+			W_REG(&cc->pllcontrol_data, 0x05001828);
+		}
+		break;
+	case BCM4336_CHIP_ID:
+		/* Looks like these are only for default xtal freq 26MHz */
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL0);
+		W_REG(&cc->pllcontrol_data, 0x02100020);
+
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL1);
+		W_REG(&cc->pllcontrol_data, 0x0C0C0C0C);
+
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL2);
+		W_REG(&cc->pllcontrol_data, 0x01240C0C);
+
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL4);
+		W_REG(&cc->pllcontrol_data, 0x202C2820);
+
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL5);
+		W_REG(&cc->pllcontrol_data, 0x88888825);
+
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL3);
+		if (spuravoid == 1) {
+			W_REG(&cc->pllcontrol_data, 0x00EC4EC4);
+		} else {
+			W_REG(&cc->pllcontrol_data, 0x00762762);
+		}
+
+		tmp = PCTL_PLL_PLLCTL_UPD;
+		break;
+
+	default:
+		/* bail out */
+		return;
+	}
+
+	tmp |= R_REG(&cc->pmucontrol);
+	W_REG(&cc->pmucontrol, tmp);
+}
+
+/* select default xtal frequency for each chip */
+static const pmu1_xtaltab0_t *si_pmu1_xtaldef0(si_t *sih)
+{
+	switch (sih->chip) {
+	case BCM4329_CHIP_ID:
+		/* Default to 38400Khz */
+		return &pmu1_xtaltab0_880_4329[PMU1_XTALTAB0_880_38400K];
+	case BCM4319_CHIP_ID:
+		/* Default to 30000Khz */
+		return &pmu1_xtaltab0_1440[PMU1_XTALTAB0_1440_30000K];
+	case BCM4336_CHIP_ID:
+		/* Default to 26000Khz */
+		return &pmu1_xtaltab0_960[PMU1_XTALTAB0_960_26000K];
+	case BCM4330_CHIP_ID:
+		/* Default to 37400Khz */
+		if (CST4330_CHIPMODE_SDIOD(sih->chipst))
+			return &pmu1_xtaltab0_960[PMU1_XTALTAB0_960_37400K];
+		else
+			return &pmu1_xtaltab0_1440[PMU1_XTALTAB0_1440_37400K];
+	default:
+		break;
+	}
+	ASSERT(0);
+	return NULL;
+}
+
+/* select xtal table for each chip */
+static const pmu1_xtaltab0_t *si_pmu1_xtaltab0(si_t *sih)
+{
+	switch (sih->chip) {
+	case BCM4329_CHIP_ID:
+		return pmu1_xtaltab0_880_4329;
+	case BCM4319_CHIP_ID:
+		return pmu1_xtaltab0_1440;
+	case BCM4336_CHIP_ID:
+		return pmu1_xtaltab0_960;
+	case BCM4330_CHIP_ID:
+		if (CST4330_CHIPMODE_SDIOD(sih->chipst))
+			return pmu1_xtaltab0_960;
+		else
+			return pmu1_xtaltab0_1440;
+	default:
+		break;
+	}
+	ASSERT(0);
+	return NULL;
+}
+
+/* query alp/xtal clock frequency */
+static u32
+si_pmu1_alpclk0(si_t *sih, chipcregs_t *cc)
+{
+	const pmu1_xtaltab0_t *xt;
+	u32 xf;
+
+	/* Find the frequency in the table */
+	xf = (R_REG(&cc->pmucontrol) & PCTL_XTALFREQ_MASK) >>
+	    PCTL_XTALFREQ_SHIFT;
+	for (xt = si_pmu1_xtaltab0(sih); xt != NULL && xt->fref != 0; xt++)
+		if (xt->xf == xf)
+			break;
+	/* Could not find it so assign a default value */
+	if (xt == NULL || xt->fref == 0)
+		xt = si_pmu1_xtaldef0(sih);
+	ASSERT(xt != NULL && xt->fref != 0);
+
+	return xt->fref * 1000;
+}
+
+/* select default pll fvco for each chip */
+static u32 si_pmu1_pllfvco0(si_t *sih)
+{
+	switch (sih->chip) {
+	case BCM4329_CHIP_ID:
+		return FVCO_880;
+	case BCM4319_CHIP_ID:
+		return FVCO_1440;
+	case BCM4336_CHIP_ID:
+		return FVCO_960;
+	case BCM4330_CHIP_ID:
+		if (CST4330_CHIPMODE_SDIOD(sih->chipst))
+			return FVCO_960;
+		else
+			return FVCO_1440;
+	default:
+		break;
+	}
+	ASSERT(0);
+	return 0;
+}
+
+static void si_pmu_set_4330_plldivs(si_t *sih)
+{
+	u32 FVCO = si_pmu1_pllfvco0(sih) / 1000;
+	u32 m1div, m2div, m3div, m4div, m5div, m6div;
+	u32 pllc1, pllc2;
+
+	m2div = m3div = m4div = m6div = FVCO / 80;
+	m5div = FVCO / 160;
+
+	if (CST4330_CHIPMODE_SDIOD(sih->chipst))
+		m1div = FVCO / 80;
+	else
+		m1div = FVCO / 90;
+	pllc1 =
+	    (m1div << PMU1_PLL0_PC1_M1DIV_SHIFT) | (m2div <<
+						    PMU1_PLL0_PC1_M2DIV_SHIFT) |
+	    (m3div << PMU1_PLL0_PC1_M3DIV_SHIFT) | (m4div <<
+						    PMU1_PLL0_PC1_M4DIV_SHIFT);
+	si_pmu_pllcontrol(sih, PMU1_PLL0_PLLCTL1, ~0, pllc1);
+
+	pllc2 = si_pmu_pllcontrol(sih, PMU1_PLL0_PLLCTL1, 0, 0);
+	pllc2 &= ~(PMU1_PLL0_PC2_M5DIV_MASK | PMU1_PLL0_PC2_M6DIV_MASK);
+	pllc2 |=
+	    ((m5div << PMU1_PLL0_PC2_M5DIV_SHIFT) |
+	     (m6div << PMU1_PLL0_PC2_M6DIV_SHIFT));
+	si_pmu_pllcontrol(sih, PMU1_PLL0_PLLCTL2, ~0, pllc2);
+}
+
+/* Set up PLL registers in the PMU as per the crystal speed.
+ * XtalFreq field in pmucontrol register being 0 indicates the PLL
+ * is not programmed and the h/w default is assumed to work, in which
+ * case the xtal frequency is unknown to the s/w so we need to call
+ * si_pmu1_xtaldef0() wherever it is needed to return a default value.
+ */
+static void si_pmu1_pllinit0(si_t *sih, chipcregs_t *cc, u32 xtal)
+{
+	const pmu1_xtaltab0_t *xt;
+	u32 tmp;
+	u32 buf_strength = 0;
+	u8 ndiv_mode = 1;
+
+	/* Use h/w default PLL config */
+	if (xtal == 0) {
+		return;
+	}
+
+	/* Find the frequency in the table */
+	for (xt = si_pmu1_xtaltab0(sih); xt != NULL && xt->fref != 0; xt++)
+		if (xt->fref == xtal)
+			break;
+
+	/* Check current PLL state, bail out if it has been programmed or
+	 * we don't know how to program it.
+	 */
+	if (xt == NULL || xt->fref == 0) {
+		return;
+	}
+	/* for 4319 bootloader already programs the PLL but bootloader does not
+	 * program the PLL4 and PLL5. So Skip this check for 4319
+	 */
+	if ((((R_REG(&cc->pmucontrol) & PCTL_XTALFREQ_MASK) >>
+	      PCTL_XTALFREQ_SHIFT) == xt->xf) &&
+	    !((sih->chip == BCM4319_CHIP_ID)
+	      || (sih->chip == BCM4330_CHIP_ID)))
+		return;
+
+	switch (sih->chip) {
+	case BCM4329_CHIP_ID:
+		/* Change the BBPLL drive strength to 8 for all channels */
+		buf_strength = 0x888888;
+		AND_REG(&cc->min_res_mask,
+			~(PMURES_BIT(RES4329_BBPLL_PWRSW_PU) |
+			  PMURES_BIT(RES4329_HT_AVAIL)));
+		AND_REG(&cc->max_res_mask,
+			~(PMURES_BIT(RES4329_BBPLL_PWRSW_PU) |
+			  PMURES_BIT(RES4329_HT_AVAIL)));
+		SPINWAIT(R_REG(&cc->clk_ctl_st) & CCS_HTAVAIL,
+			 PMU_MAX_TRANSITION_DLY);
+		ASSERT(!(R_REG(&cc->clk_ctl_st) & CCS_HTAVAIL));
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL4);
+		if (xt->fref == 38400)
+			tmp = 0x200024C0;
+		else if (xt->fref == 37400)
+			tmp = 0x20004500;
+		else if (xt->fref == 26000)
+			tmp = 0x200024C0;
+		else
+			tmp = 0x200005C0;	/* Chip Dflt Settings */
+		W_REG(&cc->pllcontrol_data, tmp);
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL5);
+		tmp =
+		    R_REG(&cc->pllcontrol_data) & PMU1_PLL0_PC5_CLK_DRV_MASK;
+		if ((xt->fref == 38400) || (xt->fref == 37400)
+		    || (xt->fref == 26000))
+			tmp |= 0x15;
+		else
+			tmp |= 0x25;	/* Chip Dflt Settings */
+		W_REG(&cc->pllcontrol_data, tmp);
+		break;
+
+	case BCM4319_CHIP_ID:
+		/* Change the BBPLL drive strength to 2 for all channels */
+		buf_strength = 0x222222;
+
+		/* Make sure the PLL is off */
+		/* WAR65104: Disable the HT_AVAIL resource first and then
+		 * after a delay (more than downtime for HT_AVAIL) remove the
+		 * BBPLL resource; backplane clock moves to ALP from HT.
+		 */
+		AND_REG(&cc->min_res_mask,
+			~(PMURES_BIT(RES4319_HT_AVAIL)));
+		AND_REG(&cc->max_res_mask,
+			~(PMURES_BIT(RES4319_HT_AVAIL)));
+
+		udelay(100);
+		AND_REG(&cc->min_res_mask,
+			~(PMURES_BIT(RES4319_BBPLL_PWRSW_PU)));
+		AND_REG(&cc->max_res_mask,
+			~(PMURES_BIT(RES4319_BBPLL_PWRSW_PU)));
+
+		udelay(100);
+		SPINWAIT(R_REG(&cc->clk_ctl_st) & CCS_HTAVAIL,
+			 PMU_MAX_TRANSITION_DLY);
+		ASSERT(!(R_REG(&cc->clk_ctl_st) & CCS_HTAVAIL));
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL4);
+		tmp = 0x200005c0;
+		W_REG(&cc->pllcontrol_data, tmp);
+		break;
+
+	case BCM4336_CHIP_ID:
+		AND_REG(&cc->min_res_mask,
+			~(PMURES_BIT(RES4336_HT_AVAIL) |
+			  PMURES_BIT(RES4336_MACPHY_CLKAVAIL)));
+		AND_REG(&cc->max_res_mask,
+			~(PMURES_BIT(RES4336_HT_AVAIL) |
+			  PMURES_BIT(RES4336_MACPHY_CLKAVAIL)));
+		udelay(100);
+		SPINWAIT(R_REG(&cc->clk_ctl_st) & CCS_HTAVAIL,
+			 PMU_MAX_TRANSITION_DLY);
+		ASSERT(!(R_REG(&cc->clk_ctl_st) & CCS_HTAVAIL));
+		break;
+
+	case BCM4330_CHIP_ID:
+		AND_REG(&cc->min_res_mask,
+			~(PMURES_BIT(RES4330_HT_AVAIL) |
+			  PMURES_BIT(RES4330_MACPHY_CLKAVAIL)));
+		AND_REG(&cc->max_res_mask,
+			~(PMURES_BIT(RES4330_HT_AVAIL) |
+			  PMURES_BIT(RES4330_MACPHY_CLKAVAIL)));
+		udelay(100);
+		SPINWAIT(R_REG(&cc->clk_ctl_st) & CCS_HTAVAIL,
+			 PMU_MAX_TRANSITION_DLY);
+		ASSERT(!(R_REG(&cc->clk_ctl_st) & CCS_HTAVAIL));
+		break;
+
+	default:
+		ASSERT(0);
+	}
+
+	/* Write p1div and p2div to pllcontrol[0] */
+	W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL0);
+	tmp = R_REG(&cc->pllcontrol_data) &
+	    ~(PMU1_PLL0_PC0_P1DIV_MASK | PMU1_PLL0_PC0_P2DIV_MASK);
+	tmp |=
+	    ((xt->
+	      p1div << PMU1_PLL0_PC0_P1DIV_SHIFT) & PMU1_PLL0_PC0_P1DIV_MASK) |
+	    ((xt->
+	      p2div << PMU1_PLL0_PC0_P2DIV_SHIFT) & PMU1_PLL0_PC0_P2DIV_MASK);
+	W_REG(&cc->pllcontrol_data, tmp);
+
+	if ((sih->chip == BCM4330_CHIP_ID))
+		si_pmu_set_4330_plldivs(sih);
+
+	if ((sih->chip == BCM4329_CHIP_ID)
+	    && (sih->chiprev == 0)) {
+
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL1);
+		tmp = R_REG(&cc->pllcontrol_data);
+		tmp = tmp & (~DOT11MAC_880MHZ_CLK_DIVISOR_MASK);
+		tmp = tmp | DOT11MAC_880MHZ_CLK_DIVISOR_VAL;
+		W_REG(&cc->pllcontrol_data, tmp);
+	}
+	if ((sih->chip == BCM4319_CHIP_ID) ||
+	    (sih->chip == BCM4336_CHIP_ID) ||
+	    (sih->chip == BCM4330_CHIP_ID))
+		ndiv_mode = PMU1_PLL0_PC2_NDIV_MODE_MFB;
+	else
+		ndiv_mode = PMU1_PLL0_PC2_NDIV_MODE_MASH;
+
+	/* Write ndiv_int and ndiv_mode to pllcontrol[2] */
+	W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL2);
+	tmp = R_REG(&cc->pllcontrol_data) &
+	    ~(PMU1_PLL0_PC2_NDIV_INT_MASK | PMU1_PLL0_PC2_NDIV_MODE_MASK);
+	tmp |=
+	    ((xt->
+	      ndiv_int << PMU1_PLL0_PC2_NDIV_INT_SHIFT) &
+	     PMU1_PLL0_PC2_NDIV_INT_MASK) | ((ndiv_mode <<
+					      PMU1_PLL0_PC2_NDIV_MODE_SHIFT) &
+					     PMU1_PLL0_PC2_NDIV_MODE_MASK);
+	W_REG(&cc->pllcontrol_data, tmp);
+
+	/* Write ndiv_frac to pllcontrol[3] */
+	W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL3);
+	tmp = R_REG(&cc->pllcontrol_data) & ~PMU1_PLL0_PC3_NDIV_FRAC_MASK;
+	tmp |= ((xt->ndiv_frac << PMU1_PLL0_PC3_NDIV_FRAC_SHIFT) &
+		PMU1_PLL0_PC3_NDIV_FRAC_MASK);
+	W_REG(&cc->pllcontrol_data, tmp);
+
+	/* Write clock driving strength to pllcontrol[5] */
+	if (buf_strength) {
+		W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL5);
+		tmp =
+		    R_REG(&cc->pllcontrol_data) & ~PMU1_PLL0_PC5_CLK_DRV_MASK;
+		tmp |= (buf_strength << PMU1_PLL0_PC5_CLK_DRV_SHIFT);
+		W_REG(&cc->pllcontrol_data, tmp);
+	}
+
+	/* to operate the 4319 usb in 24MHz/48MHz; chipcontrol[2][84:83] needs
+	 * to be updated.
+	 */
+	if ((sih->chip == BCM4319_CHIP_ID)
+	    && (xt->fref != XTAL_FREQ_30000MHZ)) {
+		W_REG(&cc->chipcontrol_addr, PMU1_PLL0_CHIPCTL2);
+		tmp =
+		    R_REG(&cc->chipcontrol_data) & ~CCTL_4319USB_XTAL_SEL_MASK;
+		if (xt->fref == XTAL_FREQ_24000MHZ) {
+			tmp |=
+			    (CCTL_4319USB_24MHZ_PLL_SEL <<
+			     CCTL_4319USB_XTAL_SEL_SHIFT);
+		} else if (xt->fref == XTAL_FREQ_48000MHZ) {
+			tmp |=
+			    (CCTL_4319USB_48MHZ_PLL_SEL <<
+			     CCTL_4319USB_XTAL_SEL_SHIFT);
+		}
+		W_REG(&cc->chipcontrol_data, tmp);
+	}
+
+	/* Flush deferred pll control registers writes */
+	if (sih->pmurev >= 2)
+		OR_REG(&cc->pmucontrol, PCTL_PLL_PLLCTL_UPD);
+
+	/* Write XtalFreq. Set the divisor also. */
+	tmp = R_REG(&cc->pmucontrol) &
+	    ~(PCTL_ILP_DIV_MASK | PCTL_XTALFREQ_MASK);
+	tmp |= (((((xt->fref + 127) / 128) - 1) << PCTL_ILP_DIV_SHIFT) &
+		PCTL_ILP_DIV_MASK) |
+	    ((xt->xf << PCTL_XTALFREQ_SHIFT) & PCTL_XTALFREQ_MASK);
+
+	if ((sih->chip == BCM4329_CHIP_ID)
+	    && sih->chiprev == 0) {
+		/* clear the htstretch before clearing HTReqEn */
+		AND_REG(&cc->clkstretch, ~CSTRETCH_HT);
+		tmp &= ~PCTL_HT_REQ_EN;
+	}
+
+	W_REG(&cc->pmucontrol, tmp);
+}
+
+u32 si_pmu_ilp_clock(si_t *sih)
+{
+	static u32 ilpcycles_per_sec = 0;
+
+	if (ISSIM_ENAB(sih))
+		return ILP_CLOCK;
+
+	if (ilpcycles_per_sec == 0) {
+		u32 start, end, delta;
+		u32 origidx = si_coreidx(sih);
+		chipcregs_t *cc = si_setcoreidx(sih, SI_CC_IDX);
+		ASSERT(cc != NULL);
+		start = R_REG(&cc->pmutimer);
+		mdelay(ILP_CALC_DUR);
+		end = R_REG(&cc->pmutimer);
+		delta = end - start;
+		ilpcycles_per_sec = delta * (1000 / ILP_CALC_DUR);
+		si_setcoreidx(sih, origidx);
+	}
+
+	return ilpcycles_per_sec;
+}
+
+void si_pmu_set_ldo_voltage(si_t *sih, u8 ldo, u8 voltage)
+{
+	u8 sr_cntl_shift = 0, rc_shift = 0, shift = 0, mask = 0;
+	u8 addr = 0;
+
+	ASSERT(sih->cccaps & CC_CAP_PMU);
+
+	switch (sih->chip) {
+	case BCM4336_CHIP_ID:
+		switch (ldo) {
+		case SET_LDO_VOLTAGE_CLDO_PWM:
+			addr = 4;
+			rc_shift = 1;
+			mask = 0xf;
+			break;
+		case SET_LDO_VOLTAGE_CLDO_BURST:
+			addr = 4;
+			rc_shift = 5;
+			mask = 0xf;
+			break;
+		case SET_LDO_VOLTAGE_LNLDO1:
+			addr = 4;
+			rc_shift = 17;
+			mask = 0xf;
+			break;
+		default:
+			ASSERT(false);
+			return;
+		}
+		break;
+	case BCM4330_CHIP_ID:
+		switch (ldo) {
+		case SET_LDO_VOLTAGE_CBUCK_PWM:
+			addr = 3;
+			rc_shift = 0;
+			mask = 0x1f;
+			break;
+		default:
+			ASSERT(false);
+			break;
+		}
+		break;
+	default:
+		ASSERT(false);
+		return;
+	}
+
+	shift = sr_cntl_shift + rc_shift;
+
+	si_corereg(sih, SI_CC_IDX, offsetof(chipcregs_t, regcontrol_addr),
+		   ~0, addr);
+	si_corereg(sih, SI_CC_IDX, offsetof(chipcregs_t, regcontrol_data),
+		   mask << shift, (voltage & mask) << shift);
+}
+
+u16 si_pmu_fast_pwrup_delay(si_t *sih)
+{
+	uint delay = PMU_MAX_TRANSITION_DLY;
+	chipcregs_t *cc;
+	uint origidx;
+#ifdef BCMDBG
+	char chn[8];
+	chn[0] = 0;		/* to suppress compile error */
+#endif
+
+	ASSERT(sih->cccaps & CC_CAP_PMU);
+
+	/* Remember original core before switch to chipc */
+	origidx = si_coreidx(sih);
+	cc = si_setcoreidx(sih, SI_CC_IDX);
+	ASSERT(cc != NULL);
+
+	switch (sih->chip) {
+	case BCM43224_CHIP_ID:
+	case BCM43225_CHIP_ID:
+	case BCM43421_CHIP_ID:
+	case BCM43235_CHIP_ID:
+	case BCM43236_CHIP_ID:
+	case BCM43238_CHIP_ID:
+	case BCM4331_CHIP_ID:
+	case BCM6362_CHIP_ID:
+	case BCM4313_CHIP_ID:
+		delay = ISSIM_ENAB(sih) ? 70 : 3700;
+		break;
+	case BCM4329_CHIP_ID:
+		if (ISSIM_ENAB(sih))
+			delay = 70;
+		else {
+			u32 ilp = si_ilp_clock(sih);
+			delay =
+			    (si_pmu_res_uptime(sih, cc, RES4329_HT_AVAIL) +
+			     D11SCC_SLOW2FAST_TRANSITION) * ((1000000 + ilp -
+							      1) / ilp);
+			delay = (11 * delay) / 10;
+		}
+		break;
+	case BCM4319_CHIP_ID:
+		delay = ISSIM_ENAB(sih) ? 70 : 3700;
+		break;
+	case BCM4336_CHIP_ID:
+		if (ISSIM_ENAB(sih))
+			delay = 70;
+		else {
+			u32 ilp = si_ilp_clock(sih);
+			delay =
+			    (si_pmu_res_uptime(sih, cc, RES4336_HT_AVAIL) +
+			     D11SCC_SLOW2FAST_TRANSITION) * ((1000000 + ilp -
+							      1) / ilp);
+			delay = (11 * delay) / 10;
+		}
+		break;
+	case BCM4330_CHIP_ID:
+		if (ISSIM_ENAB(sih))
+			delay = 70;
+		else {
+			u32 ilp = si_ilp_clock(sih);
+			delay =
+			    (si_pmu_res_uptime(sih, cc, RES4330_HT_AVAIL) +
+			     D11SCC_SLOW2FAST_TRANSITION) * ((1000000 + ilp -
+							      1) / ilp);
+			delay = (11 * delay) / 10;
+		}
+		break;
+	default:
+		break;
+	}
+	/* Return to original core */
+	si_setcoreidx(sih, origidx);
+
+	return (u16) delay;
+}
+
+void si_pmu_sprom_enable(si_t *sih, bool enable)
+{
+	chipcregs_t *cc;
+	uint origidx;
+
+	/* Remember original core before switch to chipc */
+	origidx = si_coreidx(sih);
+	cc = si_setcoreidx(sih, SI_CC_IDX);
+	ASSERT(cc != NULL);
+
+	/* Return to original core */
+	si_setcoreidx(sih, origidx);
+}
+
+/* Read/write a chipcontrol reg */
+u32 si_pmu_chipcontrol(si_t *sih, uint reg, u32 mask, u32 val)
+{
+	si_corereg(sih, SI_CC_IDX, offsetof(chipcregs_t, chipcontrol_addr), ~0,
+		   reg);
+	return si_corereg(sih, SI_CC_IDX,
+			  offsetof(chipcregs_t, chipcontrol_data), mask, val);
+}
+
+/* Read/write a regcontrol reg */
+u32 si_pmu_regcontrol(si_t *sih, uint reg, u32 mask, u32 val)
+{
+	si_corereg(sih, SI_CC_IDX, offsetof(chipcregs_t, regcontrol_addr), ~0,
+		   reg);
+	return si_corereg(sih, SI_CC_IDX,
+			  offsetof(chipcregs_t, regcontrol_data), mask, val);
+}
+
+/* Read/write a pllcontrol reg */
+u32 si_pmu_pllcontrol(si_t *sih, uint reg, u32 mask, u32 val)
+{
+	si_corereg(sih, SI_CC_IDX, offsetof(chipcregs_t, pllcontrol_addr), ~0,
+		   reg);
+	return si_corereg(sih, SI_CC_IDX,
+			  offsetof(chipcregs_t, pllcontrol_data), mask, val);
+}
+
+/* PMU PLL update */
+void si_pmu_pllupd(si_t *sih)
+{
+	si_corereg(sih, SI_CC_IDX, offsetof(chipcregs_t, pmucontrol),
+		   PCTL_PLL_PLLCTL_UPD, PCTL_PLL_PLLCTL_UPD);
+}
+
+/* query alp/xtal clock frequency */
+u32 si_pmu_alp_clock(si_t *sih)
+{
+	chipcregs_t *cc;
+	uint origidx;
+	u32 clock = ALP_CLOCK;
+
+	/* bail out with default */
+	if (!PMUCTL_ENAB(sih))
+		return clock;
+
+	ASSERT(sih->cccaps & CC_CAP_PMU);
+
+	/* Remember original core before switch to chipc */
+	origidx = si_coreidx(sih);
+	cc = si_setcoreidx(sih, SI_CC_IDX);
+	ASSERT(cc != NULL);
+
+	switch (sih->chip) {
+	case BCM43224_CHIP_ID:
+	case BCM43225_CHIP_ID:
+	case BCM43421_CHIP_ID:
+	case BCM43235_CHIP_ID:
+	case BCM43236_CHIP_ID:
+	case BCM43238_CHIP_ID:
+	case BCM4331_CHIP_ID:
+	case BCM6362_CHIP_ID:
+	case BCM4716_CHIP_ID:
+	case BCM4748_CHIP_ID:
+	case BCM47162_CHIP_ID:
+	case BCM4313_CHIP_ID:
+	case BCM5357_CHIP_ID:
+		/* always 20Mhz */
+		clock = 20000 * 1000;
+		break;
+	case BCM4329_CHIP_ID:
+	case BCM4319_CHIP_ID:
+	case BCM4336_CHIP_ID:
+	case BCM4330_CHIP_ID:
+
+		clock = si_pmu1_alpclk0(sih, cc);
+		break;
+	case BCM5356_CHIP_ID:
+		/* always 25Mhz */
+		clock = 25000 * 1000;
+		break;
+	default:
+		break;
+	}
+
+	/* Return to original core */
+	si_setcoreidx(sih, origidx);
+	return clock;
+}
+
+void si_pmu_spuravoid(si_t *sih, u8 spuravoid)
+{
+	chipcregs_t *cc;
+	uint origidx, intr_val;
+	u32 tmp = 0;
+
+	/* Remember original core before switch to chipc */
+	cc = (chipcregs_t *) si_switch_core(sih, CC_CORE_ID, &origidx,
+					    &intr_val);
+	ASSERT(cc != NULL);
+
+	/* force the HT off  */
+	if (sih->chip == BCM4336_CHIP_ID) {
+		tmp = R_REG(&cc->max_res_mask);
+		tmp &= ~RES4336_HT_AVAIL;
+		W_REG(&cc->max_res_mask, tmp);
+		/* wait for the ht to really go away */
+		SPINWAIT(((R_REG(&cc->clk_ctl_st) & CCS_HTAVAIL) == 0),
+			 10000);
+		ASSERT((R_REG(&cc->clk_ctl_st) & CCS_HTAVAIL) == 0);
+	}
+
+	/* update the pll changes */
+	si_pmu_spuravoid_pllupdate(sih, cc, spuravoid);
+
+	/* enable HT back on  */
+	if (sih->chip == BCM4336_CHIP_ID) {
+		tmp = R_REG(&cc->max_res_mask);
+		tmp |= RES4336_HT_AVAIL;
+		W_REG(&cc->max_res_mask, tmp);
+	}
+
+	/* Return to original core */
+	si_restore_core(sih, origidx, intr_val);
+}
+
+/* initialize PMU */
+void si_pmu_init(si_t *sih)
+{
+	chipcregs_t *cc;
+	uint origidx;
+
+	ASSERT(sih->cccaps & CC_CAP_PMU);
+
+	/* Remember original core before switch to chipc */
+	origidx = si_coreidx(sih);
+	cc = si_setcoreidx(sih, SI_CC_IDX);
+	ASSERT(cc != NULL);
+
+	if (sih->pmurev == 1)
+		AND_REG(&cc->pmucontrol, ~PCTL_NOILP_ON_WAIT);
+	else if (sih->pmurev >= 2)
+		OR_REG(&cc->pmucontrol, PCTL_NOILP_ON_WAIT);
+
+	if ((sih->chip == BCM4329_CHIP_ID) && (sih->chiprev == 2)) {
+		/* Fix for 4329b0 bad LPOM state. */
+		W_REG(&cc->regcontrol_addr, 2);
+		OR_REG(&cc->regcontrol_data, 0x100);
+
+		W_REG(&cc->regcontrol_addr, 3);
+		OR_REG(&cc->regcontrol_data, 0x4);
+	}
+
+	/* Return to original core */
+	si_setcoreidx(sih, origidx);
+}
+
+/* initialize PMU chip controls and other chip level stuff */
+void si_pmu_chip_init(si_t *sih)
+{
+	uint origidx;
+
+	ASSERT(sih->cccaps & CC_CAP_PMU);
+
+	/* Gate off SPROM clock and chip select signals */
+	si_pmu_sprom_enable(sih, false);
+
+	/* Remember original core */
+	origidx = si_coreidx(sih);
+
+	/* Return to original core */
+	si_setcoreidx(sih, origidx);
+}
+
+/* initialize PMU switch/regulators */
+void si_pmu_swreg_init(si_t *sih)
+{
+	ASSERT(sih->cccaps & CC_CAP_PMU);
+
+	switch (sih->chip) {
+	case BCM4336_CHIP_ID:
+		/* Reduce CLDO PWM output voltage to 1.2V */
+		si_pmu_set_ldo_voltage(sih, SET_LDO_VOLTAGE_CLDO_PWM, 0xe);
+		/* Reduce CLDO BURST output voltage to 1.2V */
+		si_pmu_set_ldo_voltage(sih, SET_LDO_VOLTAGE_CLDO_BURST,
+				       0xe);
+		/* Reduce LNLDO1 output voltage to 1.2V */
+		si_pmu_set_ldo_voltage(sih, SET_LDO_VOLTAGE_LNLDO1, 0xe);
+		if (sih->chiprev == 0)
+			si_pmu_regcontrol(sih, 2, 0x400000, 0x400000);
+		break;
+
+	case BCM4330_CHIP_ID:
+		/* CBUCK Voltage is 1.8 by default and set that to 1.5 */
+		si_pmu_set_ldo_voltage(sih, SET_LDO_VOLTAGE_CBUCK_PWM, 0);
+		break;
+	default:
+		break;
+	}
+}
+
+/* initialize PLL */
+void si_pmu_pll_init(si_t *sih, uint xtalfreq)
+{
+	chipcregs_t *cc;
+	uint origidx;
+
+	ASSERT(sih->cccaps & CC_CAP_PMU);
+
+	/* Remember original core before switch to chipc */
+	origidx = si_coreidx(sih);
+	cc = si_setcoreidx(sih, SI_CC_IDX);
+	ASSERT(cc != NULL);
+
+	switch (sih->chip) {
+	case BCM4329_CHIP_ID:
+		if (xtalfreq == 0)
+			xtalfreq = 38400;
+		si_pmu1_pllinit0(sih, cc, xtalfreq);
+		break;
+	case BCM4313_CHIP_ID:
+	case BCM43224_CHIP_ID:
+	case BCM43225_CHIP_ID:
+	case BCM43421_CHIP_ID:
+	case BCM43235_CHIP_ID:
+	case BCM43236_CHIP_ID:
+	case BCM43238_CHIP_ID:
+	case BCM4331_CHIP_ID:
+	case BCM6362_CHIP_ID:
+		/* ??? */
+		break;
+	case BCM4319_CHIP_ID:
+	case BCM4336_CHIP_ID:
+	case BCM4330_CHIP_ID:
+		si_pmu1_pllinit0(sih, cc, xtalfreq);
+		break;
+	default:
+		break;
+	}
+
+	/* Return to original core */
+	si_setcoreidx(sih, origidx);
+}
+
+/* initialize PMU resources */
+void si_pmu_res_init(si_t *sih)
+{
+	chipcregs_t *cc;
+	uint origidx;
+	const pmu_res_updown_t *pmu_res_updown_table = NULL;
+	uint pmu_res_updown_table_sz = 0;
+	const pmu_res_depend_t *pmu_res_depend_table = NULL;
+	uint pmu_res_depend_table_sz = 0;
+	u32 min_mask = 0, max_mask = 0;
+	char name[8], *val;
+	uint i, rsrcs;
+
+	ASSERT(sih->cccaps & CC_CAP_PMU);
+
+	/* Remember original core before switch to chipc */
+	origidx = si_coreidx(sih);
+	cc = si_setcoreidx(sih, SI_CC_IDX);
+	ASSERT(cc != NULL);
+
+	switch (sih->chip) {
+	case BCM4329_CHIP_ID:
+		/* Optimize resources up/down timers */
+		if (ISSIM_ENAB(sih)) {
+			pmu_res_updown_table = NULL;
+			pmu_res_updown_table_sz = 0;
+		} else {
+			pmu_res_updown_table = bcm4329_res_updown;
+			pmu_res_updown_table_sz = ARRAY_SIZE(bcm4329_res_updown);
+		}
+		/* Optimize resources dependencies */
+		pmu_res_depend_table = bcm4329_res_depend;
+		pmu_res_depend_table_sz = ARRAY_SIZE(bcm4329_res_depend);
+		break;
+
+	case BCM4319_CHIP_ID:
+		/* Optimize resources up/down timers */
+		if (ISSIM_ENAB(sih)) {
+			pmu_res_updown_table = bcm4319a0_res_updown_qt;
+			pmu_res_updown_table_sz =
+			    ARRAY_SIZE(bcm4319a0_res_updown_qt);
+		} else {
+			pmu_res_updown_table = bcm4319a0_res_updown;
+			pmu_res_updown_table_sz =
+			    ARRAY_SIZE(bcm4319a0_res_updown);
+		}
+		/* Optimize resources dependancies masks */
+		pmu_res_depend_table = bcm4319a0_res_depend;
+		pmu_res_depend_table_sz = ARRAY_SIZE(bcm4319a0_res_depend);
+		break;
+
+	case BCM4336_CHIP_ID:
+		/* Optimize resources up/down timers */
+		if (ISSIM_ENAB(sih)) {
+			pmu_res_updown_table = bcm4336a0_res_updown_qt;
+			pmu_res_updown_table_sz =
+			    ARRAY_SIZE(bcm4336a0_res_updown_qt);
+		} else {
+			pmu_res_updown_table = bcm4336a0_res_updown;
+			pmu_res_updown_table_sz =
+			    ARRAY_SIZE(bcm4336a0_res_updown);
+		}
+		/* Optimize resources dependancies masks */
+		pmu_res_depend_table = bcm4336a0_res_depend;
+		pmu_res_depend_table_sz = ARRAY_SIZE(bcm4336a0_res_depend);
+		break;
+
+	case BCM4330_CHIP_ID:
+		/* Optimize resources up/down timers */
+		if (ISSIM_ENAB(sih)) {
+			pmu_res_updown_table = bcm4330a0_res_updown_qt;
+			pmu_res_updown_table_sz =
+			    ARRAY_SIZE(bcm4330a0_res_updown_qt);
+		} else {
+			pmu_res_updown_table = bcm4330a0_res_updown;
+			pmu_res_updown_table_sz =
+			    ARRAY_SIZE(bcm4330a0_res_updown);
+		}
+		/* Optimize resources dependancies masks */
+		pmu_res_depend_table = bcm4330a0_res_depend;
+		pmu_res_depend_table_sz = ARRAY_SIZE(bcm4330a0_res_depend);
+		break;
+
+	default:
+		break;
+	}
+
+	/* # resources */
+	rsrcs = (sih->pmucaps & PCAP_RC_MASK) >> PCAP_RC_SHIFT;
+
+	/* Program up/down timers */
+	while (pmu_res_updown_table_sz--) {
+		ASSERT(pmu_res_updown_table != NULL);
+		W_REG(&cc->res_table_sel,
+		      pmu_res_updown_table[pmu_res_updown_table_sz].resnum);
+		W_REG(&cc->res_updn_timer,
+		      pmu_res_updown_table[pmu_res_updown_table_sz].updown);
+	}
+	/* Apply nvram overrides to up/down timers */
+	for (i = 0; i < rsrcs; i++) {
+		snprintf(name, sizeof(name), "r%dt", i);
+		val = getvar(NULL, name);
+		if (val == NULL)
+			continue;
+		W_REG(&cc->res_table_sel, (u32) i);
+		W_REG(&cc->res_updn_timer,
+		      (u32) simple_strtoul(val, NULL, 0));
+	}
+
+	/* Program resource dependencies table */
+	while (pmu_res_depend_table_sz--) {
+		ASSERT(pmu_res_depend_table != NULL);
+		if (pmu_res_depend_table[pmu_res_depend_table_sz].filter != NULL
+		    && !(pmu_res_depend_table[pmu_res_depend_table_sz].
+			 filter) (sih))
+			continue;
+		for (i = 0; i < rsrcs; i++) {
+			if ((pmu_res_depend_table[pmu_res_depend_table_sz].
+			     res_mask & PMURES_BIT(i)) == 0)
+				continue;
+			W_REG(&cc->res_table_sel, i);
+			switch (pmu_res_depend_table[pmu_res_depend_table_sz].
+				action) {
+			case RES_DEPEND_SET:
+				W_REG(&cc->res_dep_mask,
+				      pmu_res_depend_table
+				      [pmu_res_depend_table_sz].depend_mask);
+				break;
+			case RES_DEPEND_ADD:
+				OR_REG(&cc->res_dep_mask,
+				       pmu_res_depend_table
+				       [pmu_res_depend_table_sz].depend_mask);
+				break;
+			case RES_DEPEND_REMOVE:
+				AND_REG(&cc->res_dep_mask,
+					~pmu_res_depend_table
+					[pmu_res_depend_table_sz].depend_mask);
+				break;
+			default:
+				ASSERT(0);
+				break;
+			}
+		}
+	}
+	/* Apply nvram overrides to dependancies masks */
+	for (i = 0; i < rsrcs; i++) {
+		snprintf(name, sizeof(name), "r%dd", i);
+		val = getvar(NULL, name);
+		if (val == NULL)
+			continue;
+		W_REG(&cc->res_table_sel, (u32) i);
+		W_REG(&cc->res_dep_mask,
+		      (u32) simple_strtoul(val, NULL, 0));
+	}
+
+	/* Determine min/max rsrc masks */
+	si_pmu_res_masks(sih, &min_mask, &max_mask);
+
+	/* It is required to program max_mask first and then min_mask */
+
+	/* Program max resource mask */
+
+	if (max_mask) {
+		W_REG(&cc->max_res_mask, max_mask);
+	}
+
+	/* Program min resource mask */
+
+	if (min_mask) {
+		W_REG(&cc->min_res_mask, min_mask);
+	}
+
+	/* Add some delay; allow resources to come up and settle. */
+	mdelay(2);
+
+	/* Return to original core */
+	si_setcoreidx(sih, origidx);
+}
+
+u32 si_pmu_measure_alpclk(si_t *sih)
+{
+	chipcregs_t *cc;
+	uint origidx;
+	u32 alp_khz;
+
+	if (sih->pmurev < 10)
+		return 0;
+
+	ASSERT(sih->cccaps & CC_CAP_PMU);
+
+	/* Remember original core before switch to chipc */
+	origidx = si_coreidx(sih);
+	cc = si_setcoreidx(sih, SI_CC_IDX);
+	ASSERT(cc != NULL);
+
+	if (R_REG(&cc->pmustatus) & PST_EXTLPOAVAIL) {
+		u32 ilp_ctr, alp_hz;
+
+		/* Enable the reg to measure the freq, in case disabled before */
+		W_REG(&cc->pmu_xtalfreq,
+		      1U << PMU_XTALFREQ_REG_MEASURE_SHIFT);
+
+		/* Delay for well over 4 ILP clocks */
+		udelay(1000);
+
+		/* Read the latched number of ALP ticks per 4 ILP ticks */
+		ilp_ctr =
+		    R_REG(&cc->pmu_xtalfreq) & PMU_XTALFREQ_REG_ILPCTR_MASK;
+
+		/* Turn off the PMU_XTALFREQ_REG_MEASURE_SHIFT bit to save power */
+		W_REG(&cc->pmu_xtalfreq, 0);
+
+		/* Calculate ALP frequency */
+		alp_hz = (ilp_ctr * EXT_ILP_HZ) / 4;
+
+		/* Round to nearest 100KHz, and at the same time convert to KHz */
+		alp_khz = (alp_hz + 50000) / 100000 * 100;
+	} else
+		alp_khz = 0;
+
+	/* Return to original core */
+	si_setcoreidx(sih, origidx);
+
+	return alp_khz;
+}
+
+bool si_pmu_is_otp_powered(si_t *sih)
+{
+	uint idx;
+	chipcregs_t *cc;
+	bool st;
+
+	/* Remember original core before switch to chipc */
+	idx = si_coreidx(sih);
+	cc = si_setcoreidx(sih, SI_CC_IDX);
+	ASSERT(cc != NULL);
+
+	switch (sih->chip) {
+	case BCM4329_CHIP_ID:
+		st = (R_REG(&cc->res_state) & PMURES_BIT(RES4329_OTP_PU))
+		    != 0;
+		break;
+	case BCM4319_CHIP_ID:
+		st = (R_REG(&cc->res_state) & PMURES_BIT(RES4319_OTP_PU))
+		    != 0;
+		break;
+	case BCM4336_CHIP_ID:
+		st = (R_REG(&cc->res_state) & PMURES_BIT(RES4336_OTP_PU))
+		    != 0;
+		break;
+	case BCM4330_CHIP_ID:
+		st = (R_REG(&cc->res_state) & PMURES_BIT(RES4330_OTP_PU))
+		    != 0;
+		break;
+
+		/* These chip doesn't use PMU bit to power up/down OTP. OTP always on.
+		 * Use OTP_INIT command to reset/refresh state.
+		 */
+	case BCM43224_CHIP_ID:
+	case BCM43225_CHIP_ID:
+	case BCM43421_CHIP_ID:
+	case BCM43236_CHIP_ID:
+	case BCM43235_CHIP_ID:
+	case BCM43238_CHIP_ID:
+		st = true;
+		break;
+	default:
+		st = true;
+		break;
+	}
+
+	/* Return to original core */
+	si_setcoreidx(sih, idx);
+	return st;
+}
+
+/* power up/down OTP through PMU resources */
+void si_pmu_otp_power(si_t *sih, bool on)
+{
+	chipcregs_t *cc;
+	uint origidx;
+	u32 rsrcs = 0;	/* rsrcs to turn on/off OTP power */
+
+	ASSERT(sih->cccaps & CC_CAP_PMU);
+
+	/* Don't do anything if OTP is disabled */
+	if (si_is_otp_disabled(sih)) {
+		return;
+	}
+
+	/* Remember original core before switch to chipc */
+	origidx = si_coreidx(sih);
+	cc = si_setcoreidx(sih, SI_CC_IDX);
+	ASSERT(cc != NULL);
+
+	switch (sih->chip) {
+	case BCM4329_CHIP_ID:
+		rsrcs = PMURES_BIT(RES4329_OTP_PU);
+		break;
+	case BCM4319_CHIP_ID:
+		rsrcs = PMURES_BIT(RES4319_OTP_PU);
+		break;
+	case BCM4336_CHIP_ID:
+		rsrcs = PMURES_BIT(RES4336_OTP_PU);
+		break;
+	case BCM4330_CHIP_ID:
+		rsrcs = PMURES_BIT(RES4330_OTP_PU);
+		break;
+	default:
+		break;
+	}
+
+	if (rsrcs != 0) {
+		u32 otps;
+
+		/* Figure out the dependancies (exclude min_res_mask) */
+		u32 deps = si_pmu_res_deps(sih, cc, rsrcs, true);
+		u32 min_mask = 0, max_mask = 0;
+		si_pmu_res_masks(sih, &min_mask, &max_mask);
+		deps &= ~min_mask;
+		/* Turn on/off the power */
+		if (on) {
+			OR_REG(&cc->min_res_mask, (rsrcs | deps));
+			SPINWAIT(!(R_REG(&cc->res_state) & rsrcs),
+				 PMU_MAX_TRANSITION_DLY);
+			ASSERT(R_REG(&cc->res_state) & rsrcs);
+		} else {
+			AND_REG(&cc->min_res_mask, ~(rsrcs | deps));
+		}
+
+		SPINWAIT((((otps = R_REG(&cc->otpstatus)) & OTPS_READY) !=
+			  (on ? OTPS_READY : 0)), 100);
+		ASSERT((otps & OTPS_READY) == (on ? OTPS_READY : 0));
+	}
+
+	/* Return to original core */
+	si_setcoreidx(sih, origidx);
+}
diff --git a/drivers/staging/brcm80211/brcmsmac/wlc_pmu.h b/drivers/staging/brcm80211/brcmsmac/wlc_pmu.h
new file mode 100644
index 0000000..9fa48e4
--- /dev/null
+++ b/drivers/staging/brcm80211/brcmsmac/wlc_pmu.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2011 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+#ifndef WLC_PMU_H_
+#define WLC_PMU_H_
+
+#include <linux/types.h>
+
+#include <siutils.h>
+
+/*
+ * LDO selections used in si_pmu_set_ldo_voltage
+ */
+#define SET_LDO_VOLTAGE_LDO1	1
+#define SET_LDO_VOLTAGE_LDO2	2
+#define SET_LDO_VOLTAGE_LDO3	3
+#define SET_LDO_VOLTAGE_PAREF	4
+#define SET_LDO_VOLTAGE_CLDO_PWM	5
+#define SET_LDO_VOLTAGE_CLDO_BURST	6
+#define SET_LDO_VOLTAGE_CBUCK_PWM	7
+#define SET_LDO_VOLTAGE_CBUCK_BURST	8
+#define SET_LDO_VOLTAGE_LNLDO1	9
+#define SET_LDO_VOLTAGE_LNLDO2_SEL	10
+
+extern void si_pmu_set_ldo_voltage(si_t *sih, u8 ldo, u8 voltage);
+extern u16 si_pmu_fast_pwrup_delay(si_t *sih);
+extern void si_pmu_sprom_enable(si_t *sih, bool enable);
+extern u32 si_pmu_chipcontrol(si_t *sih, uint reg, u32 mask, u32 val);
+extern u32 si_pmu_regcontrol(si_t *sih, uint reg, u32 mask, u32 val);
+extern u32 si_pmu_ilp_clock(si_t *sih);
+extern u32 si_pmu_alp_clock(si_t *sih);
+extern void si_pmu_pllupd(si_t *sih);
+extern void si_pmu_spuravoid(si_t *sih, u8 spuravoid);
+extern u32 si_pmu_pllcontrol(si_t *sih, uint reg, u32 mask, u32 val);
+extern void si_pmu_init(si_t *sih);
+extern void si_pmu_chip_init(si_t *sih);
+extern void si_pmu_pll_init(si_t *sih, u32 xtalfreq);
+extern void si_pmu_res_init(si_t *sih);
+extern void si_pmu_swreg_init(si_t *sih);
+extern u32 si_pmu_measure_alpclk(si_t *sih);
+extern bool si_pmu_is_otp_powered(si_t *sih);
+extern void si_pmu_otp_power(si_t *sih, bool on);
+
+#endif /* WLC_PMU_H_ */
diff --git a/drivers/staging/brcm80211/brcmsmac/wlc_pub.h b/drivers/staging/brcm80211/brcmsmac/wlc_pub.h
index b956c23..273c508 100644
--- a/drivers/staging/brcm80211/brcmsmac/wlc_pub.h
+++ b/drivers/staging/brcm80211/brcmsmac/wlc_pub.h
@@ -92,6 +92,8 @@
 #define AIDMAPSZ	(roundup(MAXSCB, NBBY)/NBBY)	/* aid bitmap size in bytes */
 #endif				/* AIDMAPSZ */
 
+struct ieee80211_tx_queue_params;
+
 typedef struct wlc_tunables {
 	int ntxd;		/* size of tx descriptor table */
 	int nrxd;		/* size of rx descriptor table */
@@ -515,9 +517,9 @@
 extern void wlc_mac_bcn_promisc_change(struct wlc_info *wlc, bool promisc);
 extern void wlc_set_addrmatch(struct wlc_info *wlc, int match_reg_offset,
 			      const u8 *addr);
-extern void wlc_wme_setparams(struct wlc_info *wlc, u16 aci, void *arg,
+extern void wlc_wme_setparams(struct wlc_info *wlc, u16 aci,
+			      const struct ieee80211_tx_queue_params *arg,
 			      bool suspend);
-
 extern struct wlc_pub *wlc_pub(void *wlc);
 
 /* common functions for every port */
diff --git a/drivers/staging/brcm80211/brcmsmac/wlc_stf.c b/drivers/staging/brcm80211/brcmsmac/wlc_stf.c
index 098fd59..25bb2ca 100644
--- a/drivers/staging/brcm80211/brcmsmac/wlc_stf.c
+++ b/drivers/staging/brcm80211/brcmsmac/wlc_stf.c
@@ -225,7 +225,7 @@
 		}
 	}
 
-	return BCME_OK;
+	return 0;
 }
 
 static int wlc_stf_spatial_policy_set(struct wlc_info *wlc, int val)
@@ -241,7 +241,7 @@
 		    wlc->stf->txchain : txcore_default[i];
 		wlc_stf_txcore_set(wlc, (u8) i, core_mask);
 	}
-	return BCME_OK;
+	return 0;
 }
 
 int wlc_stf_txchain_set(struct wlc_info *wlc, s32 int_val, bool force)
@@ -251,7 +251,7 @@
 	uint i;
 
 	if (wlc->stf->txchain == txchain)
-		return BCME_OK;
+		return 0;
 
 	if ((txchain & ~wlc->stf->hw_txchain)
 	    || !(txchain & wlc->stf->hw_txchain))
@@ -303,7 +303,7 @@
 	for (i = 1; i <= MAX_STREAMS_SUPPORTED; i++)
 		wlc_stf_txcore_set(wlc, (u8) i, txcore_default[i]);
 
-	return BCME_OK;
+	return 0;
 }
 
 /* update wlc->stf->ss_opmode which represents the operational stf_ss mode we're using */
@@ -371,7 +371,7 @@
 
 int wlc_stf_ant_txant_validate(struct wlc_info *wlc, s8 val)
 {
-	int bcmerror = BCME_OK;
+	int bcmerror = 0;
 
 	/* when there is only 1 tx_streams, don't allow to change the txant */
 	if (WLCISNPHY(wlc->band) && (wlc->stf->txstreams == 1))
@@ -395,7 +395,7 @@
 		break;
 	}
 
-	if (bcmerror == BCME_OK)
+	if (bcmerror == 0)
 		wlc->stf->txant = (s8) val;
 
 	return bcmerror;
diff --git a/drivers/staging/brcm80211/include/bcmdevs.h b/drivers/staging/brcm80211/include/bcmdevs.h
index 075883a..26947ef 100644
--- a/drivers/staging/brcm80211/include/bcmdevs.h
+++ b/drivers/staging/brcm80211/include/bcmdevs.h
@@ -17,17 +17,10 @@
 #ifndef	_BCMDEVS_H
 #define	_BCMDEVS_H
 
-/* PCI vendor IDs */
-#define	VENDOR_BROADCOM		0x14e4
-
-/* DONGLE VID/PIDs */
-#define BCM_DNGL_VID		0x0a5c
-#define BCM_DNGL_BDC_PID	0x0bdc
-
 #define	BCM4325_D11DUAL_ID	0x431b
 #define	BCM4325_D11G_ID		0x431c
 #define	BCM4325_D11A_ID		0x431d
-#define BCM4329_D11N_ID		0x432e	/* 4329 802.11n dualband device */
+
 #define BCM4329_D11N2G_ID	0x432f	/* 4329 802.11n 2.4G device */
 #define BCM4329_D11N5G_ID	0x4330	/* 4329 802.11n 5G device */
 #define BCM4329_D11NDUAL_ID	0x432e
@@ -37,22 +30,13 @@
 #define BCM4319_D11N5G_ID	0x4339	/* 4319 802.11n 5G device */
 
 #define BCM43224_D11N_ID	0x4353	/* 43224 802.11n dualband device */
+
 #define BCM43225_D11N2G_ID	0x4357	/* 43225 802.11n 2.4GHz device */
 
 #define BCM43236_D11N_ID	0x4346	/* 43236 802.11n dualband device */
 #define BCM43236_D11N2G_ID	0x4347	/* 43236 802.11n 2.4GHz device */
-#define BCM43236_D11N5G_ID	0x4348	/* 43236 802.11n 5GHz device */
 
-#define BCM43421_D11N_ID	0xA99D	/* 43421 802.11n dualband device */
 #define BCM4313_D11N2G_ID	0x4727	/* 4313 802.11n 2.4G device */
-#define BCM4330_D11N_ID         0x4360	/* 4330 802.11n dualband device */
-#define BCM4330_D11N2G_ID       0x4361	/* 4330 802.11n 2.4G device */
-#define BCM4330_D11N5G_ID       0x4362	/* 4330 802.11n 5G device */
-#define BCM4336_D11N_ID		0x4343	/* 4336 802.11n 2.4GHz device */
-#define BCM6362_D11N_ID		0x435f	/* 6362 802.11n dualband device */
-#define BCM4331_D11N_ID		0x4331	/* 4331 802.11n dualband id */
-#define BCM4331_D11N2G_ID	0x4332	/* 4331 802.11n 2.4Ghz band id */
-#define BCM4331_D11N5G_ID	0x4333	/* 4331 802.11n 5Ghz band id */
 
 /* Chip IDs */
 #define BCM4313_CHIP_ID		0x4313	/* 4313 chip id */
@@ -60,7 +44,6 @@
 
 #define	BCM43224_CHIP_ID	43224	/* 43224 chipcommon chipid */
 #define	BCM43225_CHIP_ID	43225	/* 43225 chipcommon chipid */
-#define	BCM43228_CHIP_ID	43228	/* 43228 chipcommon chipid */
 #define	BCM43421_CHIP_ID	43421	/* 43421 chipcommon chipid */
 #define	BCM43235_CHIP_ID	43235	/* 43235 chipcommon chipid */
 #define	BCM43236_CHIP_ID	43236	/* 43236 chipcommon chipid */
@@ -82,57 +65,23 @@
 /* Package IDs */
 #define BCM4329_289PIN_PKG_ID	0	/* 4329 289-pin package id */
 #define BCM4329_182PIN_PKG_ID	1	/* 4329N 182-pin package id */
-#define	BCM4716_PKG_ID		8	/* 4716 package id */
 #define	BCM4717_PKG_ID		9	/* 4717 package id */
 #define	BCM4718_PKG_ID		10	/* 4718 package id */
-#define BCM5356_PKG_NONMODE	1	/* 5356 package without nmode suppport */
-#define BCM5358U_PKG_ID		8	/* 5358U package id */
-#define BCM5358_PKG_ID		9	/* 5358 package id */
-#define BCM47186_PKG_ID		10	/* 47186 package id */
-#define BCM5357_PKG_ID		11	/* 5357 package id */
-#define BCM5356U_PKG_ID		12	/* 5356U package id */
-#define HDLSIM5350_PKG_ID	1	/* HDL simulator package id for a 5350 */
 #define HDLSIM_PKG_ID		14	/* HDL simulator package id */
 #define HWSIM_PKG_ID		15	/* Hardware simulator package id */
-#define BCM43224_FAB_CSM	0x8	/* the chip is manufactured by CSM */
 #define BCM43224_FAB_SMIC	0xa	/* the chip is manufactured by SMIC */
-#define BCM4336_WLBGA_PKG_ID 0x8
 
 /* boardflags */
-#define	BFL_RESERVED1		0x00000001
 #define	BFL_PACTRL		0x00000002	/* Board has gpio 9 controlling the PA */
-#define	BFL_AIRLINEMODE		0x00000004	/* Board implements gpio 13 radio disable indication */
-#define	BFL_ADCDIV		0x00000008	/* Board has the rssi ADC divider */
-#define	BFL_ENETROBO		0x00000010	/* Board has robo switch or core */
 #define	BFL_NOPLLDOWN		0x00000020	/* Not ok to power down the chip pll and oscillator */
-#define	BFL_CCKHIPWR		0x00000040	/* Can do high-power CCK transmission */
-#define	BFL_ENETADM		0x00000080	/* Board has ADMtek switch */
-#define	BFL_ENETVLAN		0x00000100	/* Board has VLAN capability */
-#define BFL_NOPCI		0x00000400	/* Board leaves PCI floating */
 #define BFL_FEM			0x00000800	/* Board supports the Front End Module */
 #define BFL_EXTLNA		0x00001000	/* Board has an external LNA in 2.4GHz band */
-#define BFL_HGPA		0x00002000	/* Board has a high gain PA */
-#define	BFL_RESERVED2		0x00004000
-#define	BFL_ALTIQ		0x00008000	/* Alternate I/Q settings */
 #define BFL_NOPA		0x00010000	/* Board has no PA */
-#define BFL_RSSIINV		0x00020000	/* Board's RSSI uses positive slope(not TSSI) */
-#define BFL_PAREF		0x00040000	/* Board uses the PARef LDO */
-#define BFL_3TSWITCH		0x00080000	/* Board uses a triple throw switch shared with BT */
-#define BFL_PHASESHIFT		0x00100000	/* Board can support phase shifter */
 #define BFL_BUCKBOOST		0x00200000	/* Power topology uses BUCKBOOST */
 #define BFL_FEM_BT		0x00400000	/* Board has FEM and switch to share antenna w/ BT */
 #define BFL_NOCBUCK		0x00800000	/* Power topology doesn't use CBUCK */
-#define BFL_CCKFAVOREVM		0x01000000	/* Favor CCK EVM over spectral mask */
 #define BFL_PALDO		0x02000000	/* Power topology uses PALDO */
-#define BFL_LNLDO2_2P5		0x04000000	/* Select 2.5V as LNLDO2 output voltage */
-#define BFL_FASTPWR		0x08000000
-#define BFL_UCPWRCTL_MININDX	0x08000000	/* Enforce min power index to avoid FEM damage */
 #define BFL_EXTLNA_5GHz		0x10000000	/* Board has an external LNA in 5GHz band */
-#define BFL_TRSW_1by2		0x20000000	/* Board has 2 TRSW's in 1by2 designs */
-#define BFL_LO_TRSW_R_5GHz	0x40000000	/* In 5G do not throw TRSW to T for clipLO gain */
-#define BFL_ELNA_GAINDEF	0x80000000	/* Backoff InitGain based on elna_2g/5g field
-						 * when this flag is set
-						 */
 
 /* boardflags2 */
 #define BFL2_RXBB_INT_REG_DIS	0x00000001	/* Board has an external rxbb regulator */
@@ -141,16 +90,12 @@
 #define BFL2_2X4_DIV		0x00000008	/* Board supports the 2X4 diversity switch */
 #define BFL2_5G_PWRGAIN		0x00000010	/* Board supports 5G band power gain */
 #define BFL2_PCIEWAR_OVR	0x00000020	/* Board overrides ASPM and Clkreq settings */
-#define BFL2_CAESERS_BRD	0x00000040	/* Board is Caesers brd (unused by sw) */
 #define BFL2_LEGACY		0x00000080
 #define BFL2_SKWRKFEM_BRD	0x00000100	/* 4321mcm93 board uses Skyworks FEM */
 #define BFL2_SPUR_WAR		0x00000200	/* Board has a WAR for clock-harmonic spurs */
 #define BFL2_GPLL_WAR		0x00000400	/* Flag to narrow G-band PLL loop b/w */
-#define BFL2_TRISTATE_LED	0x00000800	/* Tri-state the LED */
 #define BFL2_SINGLEANT_CCK	0x00001000	/* Tx CCK pkts on Ant 0 only */
 #define BFL2_2G_SPUR_WAR	0x00002000	/* WAR to reduce and avoid clock-harmonic spurs in 2G */
-#define BFL2_BPHY_ALL_TXCORES	0x00004000	/* Transmit bphy frames using all tx cores */
-#define BFL2_FCC_BANDEDGE_WAR	0x00008000	/* using 40Mhz LPF for 20Mhz bandedge channels */
 #define BFL2_GPLL_WAR2	        0x00010000	/* Flag to widen G-band PLL loop b/w */
 #define BFL2_IPALVLSHIFT_3P3    0x00020000
 #define BFL2_INTERNDET_TXIQCAL  0x00040000	/* Use internal envelope detector for TX IQCAL */
@@ -160,32 +105,19 @@
 						 */
 
 /* board specific GPIO assignment, gpio 0-3 are also customer-configurable led */
-#define	BOARD_GPIO_RESERVED1	0x010
-#define	BOARD_GPIO_RESERVED2	0x020
-#define	BOARD_GPIO_RESERVED3	0x080
-#define	BOARD_GPIO_RESERVED4	0x100
 #define	BOARD_GPIO_PACTRL	0x200	/* bit 9 controls the PA on new 4306 boards */
 #define BOARD_GPIO_12		0x1000	/* gpio 12 */
 #define BOARD_GPIO_13		0x2000	/* gpio 13 */
-#define BOARD_GPIO_RESERVED5	0x0800
-#define BOARD_GPIO_RESERVED6	0x2000
-#define BOARD_GPIO_RESERVED7	0x4000
-#define BOARD_GPIO_RESERVED8	0x8000
 
 #define	PCI_CFG_GPIO_SCS	0x10	/* PCI config space bit 4 for 4306c0 slow clock source */
-#define PCI_CFG_GPIO_HWRAD	0x20	/* PCI config space GPIO 13 for hw radio disable */
 #define PCI_CFG_GPIO_XTAL	0x40	/* PCI config space GPIO 14 for Xtal power-up */
 #define PCI_CFG_GPIO_PLL	0x80	/* PCI config space GPIO 15 for PLL power-down */
 
 /* power control defines */
 #define PLL_DELAY		150	/* us pll on delay */
 #define FREF_DELAY		200	/* us fref change delay */
-#define MIN_SLOW_CLK		32	/* us Slow clock period */
 #define	XTAL_ON_DELAY		1000	/* us crystal power-on delay */
 
-/* # of GPIO pins */
-#define GPIO_NUMPINS		16
-
 /* Reference board types */
 #define	SPI_BOARD		0x0402
 
diff --git a/drivers/staging/brcm80211/include/bcmsrom_fmt.h b/drivers/staging/brcm80211/include/bcmsrom_fmt.h
index 4768968..4666afd 100644
--- a/drivers/staging/brcm80211/include/bcmsrom_fmt.h
+++ b/drivers/staging/brcm80211/include/bcmsrom_fmt.h
@@ -105,7 +105,7 @@
 
 /* SROM Rev 4: Reallocate the software part of the srom to accommodate
  * MIMO features. It assumes up to two PCIE functions and 440 bytes
- * of useable srom i.e. the useable storage in chips with OTP that
+ * of usable srom i.e. the usable storage in chips with OTP that
  * implements hardware redundancy.
  */
 
diff --git a/drivers/staging/brcm80211/include/bcmutils.h b/drivers/staging/brcm80211/include/bcmutils.h
index fc2a2a9..462bd89 100644
--- a/drivers/staging/brcm80211/include/bcmutils.h
+++ b/drivers/staging/brcm80211/include/bcmutils.h
@@ -251,16 +251,12 @@
  * update osl files with os specific errorcode map
 */
 
-#define BCME_OK				0	/* Success */
 #define BCME_ERROR			-1	/* Error generic */
 #define BCME_BADARG			-2	/* Bad Argument */
-#define BCME_BADOPTION			-3	/* Bad option */
 #define BCME_NOTUP			-4	/* Not up */
 #define BCME_NOTDOWN			-5	/* Not down */
-#define BCME_NOTAP			-6	/* Not AP */
-#define BCME_NOTSTA			-7	/* Not STA  */
 #define BCME_BADKEYIDX			-8	/* BAD Key Index */
-#define BCME_RADIOOFF 			-9	/* Radio Off */
+#define BCME_RADIOOFF			-9	/* Radio Off */
 #define BCME_NOTBANDLOCKED		-10	/* Not  band locked */
 #define BCME_NOCLK			-11	/* No Clock */
 #define BCME_BADRATESET			-12	/* BAD Rate valueset */
@@ -268,31 +264,19 @@
 #define BCME_BUFTOOSHORT		-14	/* Buffer too short */
 #define BCME_BUFTOOLONG			-15	/* Buffer too long */
 #define BCME_BUSY			-16	/* Busy */
-#define BCME_NOTASSOCIATED		-17	/* Not Associated */
-#define BCME_BADSSIDLEN			-18	/* Bad SSID len */
 #define BCME_OUTOFRANGECHAN		-19	/* Out of Range Channel */
 #define BCME_BADCHAN			-20	/* Bad Channel */
 #define BCME_BADADDR			-21	/* Bad Address */
 #define BCME_NORESOURCE			-22	/* Not Enough Resources */
 #define BCME_UNSUPPORTED		-23	/* Unsupported */
-#define BCME_BADLEN			-24	/* Bad length */
 #define BCME_NOTREADY			-25	/* Not Ready */
 #define BCME_EPERM			-26	/* Not Permitted */
 #define BCME_NOMEM			-27	/* No Memory */
 #define BCME_ASSOCIATED			-28	/* Associated */
 #define BCME_RANGE			-29	/* Not In Range */
 #define BCME_NOTFOUND			-30	/* Not Found */
-#define BCME_WME_NOT_ENABLED		-31	/* WME Not Enabled */
-#define BCME_TSPEC_NOTFOUND		-32	/* TSPEC Not Found */
-#define BCME_ACM_NOTSUPPORTED		-33	/* ACM Not Supported */
-#define BCME_NOT_WME_ASSOCIATION	-34	/* Not WME Association */
 #define BCME_SDIO_ERROR			-35	/* SDIO Bus Error */
 #define BCME_DONGLE_DOWN		-36	/* Dongle Not Accessible */
-#define BCME_VERSION			-37	/* Incorrect version */
-#define BCME_TXFAIL			-38	/* TX failure */
-#define BCME_RXFAIL			-39	/* RX failure */
-#define BCME_NODEVICE			-40	/* Device not present */
-#define BCME_NMODE_DISABLED		-41	/* NMODE disabled */
 #define BCME_NONRESIDENT		-42	/* access to nonresident overlay */
 #define BCME_LAST			BCME_NONRESIDENT
 
diff --git a/drivers/staging/brcm80211/include/hndpmu.h b/drivers/staging/brcm80211/include/hndpmu.h
index 3eea1f9..b2b2095 100644
--- a/drivers/staging/brcm80211/include/hndpmu.h
+++ b/drivers/staging/brcm80211/include/hndpmu.h
@@ -56,7 +56,6 @@
 extern u32 si_pmu_chipcontrol(si_t *sih, uint reg, u32 mask, u32 val);
 extern u32 si_pmu_regcontrol(si_t *sih, uint reg, u32 mask, u32 val);
 extern u32 si_pmu_pllcontrol(si_t *sih, uint reg, u32 mask, u32 val);
-extern void si_pmu_pllupd(si_t *sih);
 extern void si_pmu_sprom_enable(si_t *sih, bool enable);
 
 extern void si_pmu_radio_enable(si_t *sih, bool enable);
diff --git a/drivers/staging/brcm80211/include/pcicfg.h b/drivers/staging/brcm80211/include/pcicfg.h
index 675554a..d0c617a 100644
--- a/drivers/staging/brcm80211/include/pcicfg.h
+++ b/drivers/staging/brcm80211/include/pcicfg.h
@@ -17,508 +17,34 @@
 #ifndef	_h_pcicfg_
 #define	_h_pcicfg_
 
-/* The following inside ifndef's so we don't collide with NTDDK.H */
-#ifndef PCI_MAX_BUS
-#define PCI_MAX_BUS		0x100
-#endif
-#ifndef PCI_MAX_DEVICES
-#define PCI_MAX_DEVICES		0x20
-#endif
-#ifndef PCI_MAX_FUNCTION
-#define PCI_MAX_FUNCTION	0x8
-#endif
+#include <linux/pci_regs.h>
 
-#ifndef PCI_INVALID_VENDORID
-#define PCI_INVALID_VENDORID	0xffff
-#endif
-#ifndef PCI_INVALID_DEVICEID
-#define PCI_INVALID_DEVICEID	0xffff
-#endif
-
-/* Convert between bus-slot-function-register and config addresses */
-
-#define	PCICFG_BUS_SHIFT	16	/* Bus shift */
-#define	PCICFG_SLOT_SHIFT	11	/* Slot shift */
-#define	PCICFG_FUN_SHIFT	8	/* Function shift */
-#define	PCICFG_OFF_SHIFT	0	/* Register shift */
-
-#define	PCICFG_BUS_MASK		0xff	/* Bus mask */
-#define	PCICFG_SLOT_MASK	0x1f	/* Slot mask */
-#define	PCICFG_FUN_MASK		7	/* Function mask */
-#define	PCICFG_OFF_MASK		0xff	/* Bus mask */
-
-#define	PCI_CONFIG_ADDR(b, s, f, o)					\
-		((((b) & PCICFG_BUS_MASK) << PCICFG_BUS_SHIFT)		\
-		 | (((s) & PCICFG_SLOT_MASK) << PCICFG_SLOT_SHIFT)	\
-		 | (((f) & PCICFG_FUN_MASK) << PCICFG_FUN_SHIFT)	\
-		 | (((o) & PCICFG_OFF_MASK) << PCICFG_OFF_SHIFT))
-
-#define	PCI_CONFIG_BUS(a)	(((a) >> PCICFG_BUS_SHIFT) & PCICFG_BUS_MASK)
-#define	PCI_CONFIG_SLOT(a)	(((a) >> PCICFG_SLOT_SHIFT) & PCICFG_SLOT_MASK)
-#define	PCI_CONFIG_FUN(a)	(((a) >> PCICFG_FUN_SHIFT) & PCICFG_FUN_MASK)
-#define	PCI_CONFIG_OFF(a)	(((a) >> PCICFG_OFF_SHIFT) & PCICFG_OFF_MASK)
-
-/* PCIE Config space accessing MACROS */
-
-#define	PCIECFG_BUS_SHIFT	24	/* Bus shift */
-#define	PCIECFG_SLOT_SHIFT	19	/* Slot/Device shift */
-#define	PCIECFG_FUN_SHIFT	16	/* Function shift */
-#define	PCIECFG_OFF_SHIFT	0	/* Register shift */
-
-#define	PCIECFG_BUS_MASK	0xff	/* Bus mask */
-#define	PCIECFG_SLOT_MASK	0x1f	/* Slot/Device mask */
-#define	PCIECFG_FUN_MASK	7	/* Function mask */
-#define	PCIECFG_OFF_MASK	0xfff	/* Register mask */
-
-#define	PCIE_CONFIG_ADDR(b, s, f, o)					\
-		((((b) & PCIECFG_BUS_MASK) << PCIECFG_BUS_SHIFT)		\
-		 | (((s) & PCIECFG_SLOT_MASK) << PCIECFG_SLOT_SHIFT)	\
-		 | (((f) & PCIECFG_FUN_MASK) << PCIECFG_FUN_SHIFT)	\
-		 | (((o) & PCIECFG_OFF_MASK) << PCIECFG_OFF_SHIFT))
-
-#define	PCIE_CONFIG_BUS(a)	(((a) >> PCIECFG_BUS_SHIFT) & PCIECFG_BUS_MASK)
-#define	PCIE_CONFIG_SLOT(a)	(((a) >> PCIECFG_SLOT_SHIFT) & PCIECFG_SLOT_MASK)
-#define	PCIE_CONFIG_FUN(a)	(((a) >> PCIECFG_FUN_SHIFT) & PCIECFG_FUN_MASK)
-#define	PCIE_CONFIG_OFF(a)	(((a) >> PCIECFG_OFF_SHIFT) & PCIECFG_OFF_MASK)
-
-/* The actual config space */
-
-#define	PCI_BAR_MAX		6
-
-#define	PCI_ROM_BAR		8
-
-#define	PCR_RSVDA_MAX		2
-
-/* Bits in PCI bars' flags */
-
-#define	PCIBAR_FLAGS		0xf
-#define	PCIBAR_IO		0x1
-#define	PCIBAR_MEM1M		0x2
-#define	PCIBAR_MEM64		0x4
-#define	PCIBAR_PREFETCH		0x8
-#define	PCIBAR_MEM32_MASK	0xFFFFFF80
-
-/* pci config status reg has a bit to indicate that capability ptr is present */
-
-#define PCI_CAPPTR_PRESENT	0x0010
-
-typedef struct _pci_config_regs {
-	u16 vendor;
-	u16 device;
-	u16 command;
-	u16 status;
-	u8 rev_id;
-	u8 prog_if;
-	u8 sub_class;
-	u8 base_class;
-	u8 cache_line_size;
-	u8 latency_timer;
-	u8 header_type;
-	u8 bist;
-	u32 base[PCI_BAR_MAX];
-	u32 cardbus_cis;
-	u16 subsys_vendor;
-	u16 subsys_id;
-	u32 baserom;
-	u32 rsvd_a[PCR_RSVDA_MAX];
-	u8 int_line;
-	u8 int_pin;
-	u8 min_gnt;
-	u8 max_lat;
-	u8 dev_dep[192];
-} pci_config_regs;
-
-#define	SZPCR		(sizeof (pci_config_regs))
-#define	MINSZPCR	64	/* offsetof (dev_dep[0] */
-
-/* A structure for the config registers is nice, but in most
- * systems the config space is not memory mapped, so we need
- * field offsetts. :-(
- */
-#define	PCI_CFG_VID		0
-#define	PCI_CFG_DID		2
-#define	PCI_CFG_CMD		4
-#define	PCI_CFG_STAT		6
-#define	PCI_CFG_REV		8
-#define	PCI_CFG_PROGIF		9
-#define	PCI_CFG_SUBCL		0xa
-#define	PCI_CFG_BASECL		0xb
-#define	PCI_CFG_CLSZ		0xc
-#define	PCI_CFG_LATTIM		0xd
-#define	PCI_CFG_HDR		0xe
-#define	PCI_CFG_BIST		0xf
-#define	PCI_CFG_BAR0		0x10
-#define	PCI_CFG_BAR1		0x14
-#define	PCI_CFG_BAR2		0x18
-#define	PCI_CFG_BAR3		0x1c
-#define	PCI_CFG_BAR4		0x20
-#define	PCI_CFG_BAR5		0x24
-#define	PCI_CFG_CIS		0x28
-#define	PCI_CFG_SVID		0x2c
-#define	PCI_CFG_SSID		0x2e
-#define	PCI_CFG_ROMBAR		0x30
-#define PCI_CFG_CAPPTR		0x34
-#define	PCI_CFG_INT		0x3c
-#define	PCI_CFG_PIN		0x3d
-#define	PCI_CFG_MINGNT		0x3e
-#define	PCI_CFG_MAXLAT		0x3f
-
-/* Classes and subclasses */
-
-typedef enum {
-	PCI_CLASS_OLD = 0,
-	PCI_CLASS_DASDI,
-	PCI_CLASS_NET,
-	PCI_CLASS_DISPLAY,
-	PCI_CLASS_MMEDIA,
-	PCI_CLASS_MEMORY,
-	PCI_CLASS_BRIDGE,
-	PCI_CLASS_COMM,
-	PCI_CLASS_BASE,
-	PCI_CLASS_INPUT,
-	PCI_CLASS_DOCK,
-	PCI_CLASS_CPU,
-	PCI_CLASS_SERIAL,
-	PCI_CLASS_INTELLIGENT = 0xe,
-	PCI_CLASS_SATELLITE,
-	PCI_CLASS_CRYPT,
-	PCI_CLASS_DSP,
-	PCI_CLASS_XOR = 0xfe
-} pci_classes;
-
-typedef enum {
-	PCI_DASDI_SCSI,
-	PCI_DASDI_IDE,
-	PCI_DASDI_FLOPPY,
-	PCI_DASDI_IPI,
-	PCI_DASDI_RAID,
-	PCI_DASDI_OTHER = 0x80
-} pci_dasdi_subclasses;
-
-typedef enum {
-	PCI_NET_ETHER,
-	PCI_NET_TOKEN,
-	PCI_NET_FDDI,
-	PCI_NET_ATM,
-	PCI_NET_OTHER = 0x80
-} pci_net_subclasses;
-
-typedef enum {
-	PCI_DISPLAY_VGA,
-	PCI_DISPLAY_XGA,
-	PCI_DISPLAY_3D,
-	PCI_DISPLAY_OTHER = 0x80
-} pci_display_subclasses;
-
-typedef enum {
-	PCI_MMEDIA_VIDEO,
-	PCI_MMEDIA_AUDIO,
-	PCI_MMEDIA_PHONE,
-	PCI_MEDIA_OTHER = 0x80
-} pci_mmedia_subclasses;
-
-typedef enum {
-	PCI_MEMORY_RAM,
-	PCI_MEMORY_FLASH,
-	PCI_MEMORY_OTHER = 0x80
-} pci_memory_subclasses;
-
-typedef enum {
-	PCI_BRIDGE_HOST,
-	PCI_BRIDGE_ISA,
-	PCI_BRIDGE_EISA,
-	PCI_BRIDGE_MC,
-	PCI_BRIDGE_PCI,
-	PCI_BRIDGE_PCMCIA,
-	PCI_BRIDGE_NUBUS,
-	PCI_BRIDGE_CARDBUS,
-	PCI_BRIDGE_RACEWAY,
-	PCI_BRIDGE_OTHER = 0x80
-} pci_bridge_subclasses;
-
-typedef enum {
-	PCI_COMM_UART,
-	PCI_COMM_PARALLEL,
-	PCI_COMM_MULTIUART,
-	PCI_COMM_MODEM,
-	PCI_COMM_OTHER = 0x80
-} pci_comm_subclasses;
-
-typedef enum {
-	PCI_BASE_PIC,
-	PCI_BASE_DMA,
-	PCI_BASE_TIMER,
-	PCI_BASE_RTC,
-	PCI_BASE_PCI_HOTPLUG,
-	PCI_BASE_OTHER = 0x80
-} pci_base_subclasses;
-
-typedef enum {
-	PCI_INPUT_KBD,
-	PCI_INPUT_PEN,
-	PCI_INPUT_MOUSE,
-	PCI_INPUT_SCANNER,
-	PCI_INPUT_GAMEPORT,
-	PCI_INPUT_OTHER = 0x80
-} pci_input_subclasses;
-
-typedef enum {
-	PCI_DOCK_GENERIC,
-	PCI_DOCK_OTHER = 0x80
-} pci_dock_subclasses;
-
-typedef enum {
-	PCI_CPU_386,
-	PCI_CPU_486,
-	PCI_CPU_PENTIUM,
-	PCI_CPU_ALPHA = 0x10,
-	PCI_CPU_POWERPC = 0x20,
-	PCI_CPU_MIPS = 0x30,
-	PCI_CPU_COPROC = 0x40,
-	PCI_CPU_OTHER = 0x80
-} pci_cpu_subclasses;
-
-typedef enum {
-	PCI_SERIAL_IEEE1394,
-	PCI_SERIAL_ACCESS,
-	PCI_SERIAL_SSA,
-	PCI_SERIAL_USB,
-	PCI_SERIAL_FIBER,
-	PCI_SERIAL_SMBUS,
-	PCI_SERIAL_OTHER = 0x80
-} pci_serial_subclasses;
-
-typedef enum {
-	PCI_INTELLIGENT_I2O
-} pci_intelligent_subclasses;
-
-typedef enum {
-	PCI_SATELLITE_TV,
-	PCI_SATELLITE_AUDIO,
-	PCI_SATELLITE_VOICE,
-	PCI_SATELLITE_DATA,
-	PCI_SATELLITE_OTHER = 0x80
-} pci_satellite_subclasses;
-
-typedef enum {
-	PCI_CRYPT_NETWORK,
-	PCI_CRYPT_ENTERTAINMENT,
-	PCI_CRYPT_OTHER = 0x80
-} pci_crypt_subclasses;
-
-typedef enum {
-	PCI_DSP_DPIO,
-	PCI_DSP_OTHER = 0x80
-} pci_dsp_subclasses;
-
-typedef enum {
-	PCI_XOR_QDMA,
-	PCI_XOR_OTHER = 0x80
-} pci_xor_subclasses;
-
-/* Header types */
-#define	PCI_HEADER_MULTI	0x80
-#define	PCI_HEADER_MASK		0x7f
-typedef enum {
-	PCI_HEADER_NORMAL,
-	PCI_HEADER_BRIDGE,
-	PCI_HEADER_CARDBUS
-} pci_header_types;
-
-/* Overlay for a PCI-to-PCI bridge */
-
-#define	PPB_RSVDA_MAX		2
-#define	PPB_RSVDD_MAX		8
-
-typedef struct _ppb_config_regs {
-	u16 vendor;
-	u16 device;
-	u16 command;
-	u16 status;
-	u8 rev_id;
-	u8 prog_if;
-	u8 sub_class;
-	u8 base_class;
-	u8 cache_line_size;
-	u8 latency_timer;
-	u8 header_type;
-	u8 bist;
-	u32 rsvd_a[PPB_RSVDA_MAX];
-	u8 prim_bus;
-	u8 sec_bus;
-	u8 sub_bus;
-	u8 sec_lat;
-	u8 io_base;
-	u8 io_lim;
-	u16 sec_status;
-	u16 mem_base;
-	u16 mem_lim;
-	u16 pf_mem_base;
-	u16 pf_mem_lim;
-	u32 pf_mem_base_hi;
-	u32 pf_mem_lim_hi;
-	u16 io_base_hi;
-	u16 io_lim_hi;
-	u16 subsys_vendor;
-	u16 subsys_id;
-	u32 rsvd_b;
-	u8 rsvd_c;
-	u8 int_pin;
-	u16 bridge_ctrl;
-	u8 chip_ctrl;
-	u8 diag_ctrl;
-	u16 arb_ctrl;
-	u32 rsvd_d[PPB_RSVDD_MAX];
-	u8 dev_dep[192];
-} ppb_config_regs;
-
-/* PCI CAPABILITY DEFINES */
-#define PCI_CAP_POWERMGMTCAP_ID		0x01
-#define PCI_CAP_MSICAP_ID		0x05
-#define PCI_CAP_VENDSPEC_ID		0x09
-#define PCI_CAP_PCIECAP_ID		0x10
-
-/* Data structure to define the Message Signalled Interrupt facility
- * Valid for PCI and PCIE configurations
- */
-typedef struct _pciconfig_cap_msi {
-	u8 capID;
-	u8 nextptr;
-	u16 msgctrl;
-	u32 msgaddr;
-} pciconfig_cap_msi;
-
-/* Data structure to define the Power management facility
- * Valid for PCI and PCIE configurations
- */
-typedef struct _pciconfig_cap_pwrmgmt {
-	u8 capID;
-	u8 nextptr;
-	u16 pme_cap;
-	u16 pme_sts_ctrl;
-	u8 pme_bridge_ext;
-	u8 data;
-} pciconfig_cap_pwrmgmt;
-
-#define PME_CAP_PM_STATES (0x1f << 27)	/* Bits 31:27 states that can generate PME */
-#define PME_CSR_OFFSET	    0x4	/* 4-bytes offset */
-#define PME_CSR_PME_EN	  (1 << 8)	/* Bit 8 Enable generating of PME */
-#define PME_CSR_PME_STAT  (1 << 15)	/* Bit 15 PME got asserted */
-
-/* Data structure to define the PCIE capability */
-typedef struct _pciconfig_cap_pcie {
-	u8 capID;
-	u8 nextptr;
-	u16 pcie_cap;
-	u32 dev_cap;
-	u16 dev_ctrl;
-	u16 dev_status;
-	u32 link_cap;
-	u16 link_ctrl;
-	u16 link_status;
-	u32 slot_cap;
-	u16 slot_ctrl;
-	u16 slot_status;
-	u16 root_ctrl;
-	u16 root_cap;
-	u32 root_status;
-} pciconfig_cap_pcie;
-
-/* PCIE Enhanced CAPABILITY DEFINES */
-#define PCIE_EXTCFG_OFFSET	0x100
-#define PCIE_ADVERRREP_CAPID	0x0001
-#define PCIE_VC_CAPID		0x0002
-#define PCIE_DEVSNUM_CAPID	0x0003
-#define PCIE_PWRBUDGET_CAPID	0x0004
-
-/* PCIE Extended configuration */
-#define PCIE_ADV_CORR_ERR_MASK	0x114
-#define CORR_ERR_RE	(1 << 0)	/* Receiver  */
-#define CORR_ERR_BT 	(1 << 6)	/* Bad TLP  */
-#define CORR_ERR_BD	(1 << 7)	/* Bad DLLP */
-#define CORR_ERR_RR	(1 << 8)	/* REPLAY_NUM rollover */
-#define CORR_ERR_RT	(1 << 12)	/* Reply timer timeout */
-#define ALL_CORR_ERRORS (CORR_ERR_RE | CORR_ERR_BT | CORR_ERR_BD | \
-			 CORR_ERR_RR | CORR_ERR_RT)
-
-/* PCIE Root Control Register bits (Host mode only) */
-#define	PCIE_RC_CORR_SERR_EN		0x0001
-#define	PCIE_RC_NONFATAL_SERR_EN	0x0002
-#define	PCIE_RC_FATAL_SERR_EN		0x0004
-#define	PCIE_RC_PME_INT_EN		0x0008
-#define	PCIE_RC_CRS_EN			0x0010
-
-/* PCIE Root Capability Register bits (Host mode only) */
-#define	PCIE_RC_CRS_VISIBILITY		0x0001
-
-/* Header to define the PCIE specific capabilities in the extended config space */
-typedef struct _pcie_enhanced_caphdr {
-	u16 capID;
-	u16 cap_ver:4;
-	u16 next_ptr:12;
-} pcie_enhanced_caphdr;
+/* PCI configuration address space size */
+#define PCI_SZPCR		256
 
 /* Everything below is BRCM HND proprietary */
 
 /* Brcm PCI configuration registers */
-#define cap_list	rsvd_a[0]
-#define bar0_window	dev_dep[0x80 - 0x40]
-#define bar1_window	dev_dep[0x84 - 0x40]
-#define sprom_control	dev_dep[0x88 - 0x40]
-#define	PCI_BAR0_WIN		0x80	/* backplane address space accessed by BAR0 */
-#define	PCI_BAR1_WIN		0x84	/* backplane address space accessed by BAR1 */
-#define	PCI_SPROM_CONTROL	0x88	/* sprom property control */
-#define	PCI_BAR1_CONTROL	0x8c	/* BAR1 region burst control */
-#define	PCI_INT_STATUS		0x90	/* PCI and other cores interrupts */
-#define	PCI_INT_MASK		0x94	/* mask of PCI and other cores interrupts */
-#define PCI_TO_SB_MB		0x98	/* signal backplane interrupts */
-#define PCI_BACKPLANE_ADDR	0xa0	/* address an arbitrary location on the system backplane */
-#define PCI_BACKPLANE_DATA	0xa4	/* data at the location specified by above address */
-#define	PCI_CLK_CTL_ST		0xa8	/* pci config space clock control/status (>=rev14) */
-#define	PCI_BAR0_WIN2		0xac	/* backplane address space accessed by second 4KB of BAR0 */
-#define	PCI_GPIO_IN		0xb0	/* pci config space gpio input (>=rev3) */
-#define	PCI_GPIO_OUT		0xb4	/* pci config space gpio output (>=rev3) */
-#define	PCI_GPIO_OUTEN		0xb8	/* pci config space gpio output enable (>=rev3) */
+#define PCI_BAR0_WIN		0x80	/* backplane address space accessed by BAR0 */
+#define PCI_SPROM_CONTROL	0x88	/* sprom property control */
+#define PCI_INT_MASK		0x94	/* mask of PCI and other cores interrupts */
+#define  PCI_SBIM_SHIFT		8	/* backplane core interrupt mask bits offset */
+#define PCI_BAR0_WIN2		0xac	/* backplane address space accessed by second 4KB of BAR0 */
+#define PCI_GPIO_IN		0xb0	/* pci config space gpio input (>=rev3) */
+#define PCI_GPIO_OUT		0xb4	/* pci config space gpio output (>=rev3) */
+#define PCI_GPIO_OUTEN		0xb8	/* pci config space gpio output enable (>=rev3) */
 
-#define	PCI_BAR0_SHADOW_OFFSET	(2 * 1024)	/* bar0 + 2K accesses sprom shadow (in pci core) */
-#define	PCI_BAR0_SPROM_OFFSET	(4 * 1024)	/* bar0 + 4K accesses external sprom */
-#define	PCI_BAR0_PCIREGS_OFFSET	(6 * 1024)	/* bar0 + 6K accesses pci core registers */
-#define	PCI_BAR0_PCISBR_OFFSET	(4 * 1024)	/* pci core SB registers are at the end of the
+#define PCI_BAR0_SPROM_OFFSET	(4 * 1024)	/* bar0 + 4K accesses external sprom */
+#define PCI_BAR0_PCIREGS_OFFSET	(6 * 1024)	/* bar0 + 6K accesses pci core registers */
+#define PCI_BAR0_PCISBR_OFFSET	(4 * 1024)	/* pci core SB registers are at the end of the
 						 * 8KB window, so their address is the "regular"
 						 * address plus 4K
 						 */
 #define PCI_BAR0_WINSZ		(16 * 1024)	/* bar0 window size Match with corerev 13 */
 /* On pci corerev >= 13 and all pcie, the bar0 is now 16KB and it maps: */
-#define	PCI_16KB0_PCIREGS_OFFSET (8 * 1024)	/* bar0 + 8K accesses pci/pcie core registers */
-#define	PCI_16KB0_CCREGS_OFFSET	(12 * 1024)	/* bar0 + 12K accesses chipc core registers */
-#define PCI_16KBB0_WINSZ	(16 * 1024)	/* bar0 window size */
+#define PCI_16KB0_PCIREGS_OFFSET (8 * 1024)	/* bar0 + 8K accesses pci/pcie core registers */
+#define PCI_16KB0_CCREGS_OFFSET	(12 * 1024)	/* bar0 + 12K accesses chipc core registers */
 
-/* On AI chips we have a second window to map DMP regs are mapped: */
-#define	PCI_16KB0_WIN2_OFFSET	(4 * 1024)	/* bar0 + 4K is "Window 2" */
+#define PCI_SBIM_STATUS_SERR	0x4	/* backplane SBErr interrupt status */
 
-/* PCI_INT_STATUS */
-#define	PCI_SBIM_STATUS_SERR	0x4	/* backplane SBErr interrupt status */
-
-/* PCI_INT_MASK */
-#define	PCI_SBIM_SHIFT		8	/* backplane core interrupt mask bits offset */
-#define	PCI_SBIM_MASK		0xff00	/* backplane core interrupt mask */
-#define	PCI_SBIM_MASK_SERR	0x4	/* backplane SBErr interrupt mask */
-
-/* PCI_SPROM_CONTROL */
-#define SPROM_SZ_MSK		0x02	/* SPROM Size Mask */
-#define SPROM_LOCKED		0x08	/* SPROM Locked */
-#define	SPROM_BLANK		0x04	/* indicating a blank SPROM */
-#define SPROM_WRITEEN		0x10	/* SPROM write enable */
-#define SPROM_BOOTROM_WE	0x20	/* external bootrom write enable */
-#define SPROM_BACKPLANE_EN	0x40	/* Enable indirect backplane access */
-#define SPROM_OTPIN_USE		0x80	/* device OTP In use */
-
-/* Bits in PCI command and status regs */
-#define PCI_CMD_IO		0x00000001	/* I/O enable */
-#define PCI_CMD_MEMORY		0x00000002	/* Memory enable */
-#define PCI_CMD_MASTER		0x00000004	/* Master enable */
-#define PCI_CMD_SPECIAL		0x00000008	/* Special cycles enable */
-#define PCI_CMD_INVALIDATE	0x00000010	/* Invalidate? */
-#define PCI_CMD_VGA_PAL		0x00000040	/* VGA Palate */
-#define PCI_STAT_TA		0x08000000	/* target abort status */
 #endif				/* _h_pcicfg_ */
diff --git a/drivers/staging/brcm80211/util/bcmsrom.c b/drivers/staging/brcm80211/util/bcmsrom.c
index 850bfa6..2f8d7f7 100644
--- a/drivers/staging/brcm80211/util/bcmsrom.c
+++ b/drivers/staging/brcm80211/util/bcmsrom.c
@@ -28,24 +28,10 @@
 #include <siutils.h>
 #include <bcmsrom.h>
 #include <bcmsrom_tbl.h>
-#ifdef BCMSDIO
-#include <bcmsdh.h>
-#include <sdio.h>
-#endif
 
 #include <bcmnvram.h>
 #include <bcmotp.h>
 
-#if defined(BCMSDIO)
-#include <sbsdio.h>
-#include <sbhnddma.h>
-#include <sbsdpcmdev.h>
-#endif
-
-#include <linux/if_ether.h>
-
-#define	BS_ERROR(args)
-
 #define SROM_OFFSET(sih) ((sih->ccrev > 31) ? \
 	(((sih->cccaps & CC_CAP_SROM) == 0) ? NULL : \
 	 ((u8 *)curmap + PCI_16KB0_CCREGS_OFFSET + CC_SROM_OTP)) : \
@@ -64,17 +50,10 @@
 extern char *_vars;
 extern uint _varsz;
 
-#define SROM_CIS_SINGLE	1
-
 static int initvars_srom_si(si_t *sih, void *curmap, char **vars, uint *count);
 static void _initvars_srom_pci(u8 sromrev, u16 *srom, uint off, varbuf_t *b);
 static int initvars_srom_pci(si_t *sih, void *curmap, char **vars, uint *count);
 static int initvars_flash_si(si_t *sih, char **vars, uint *count);
-#ifdef BCMSDIO
-static int initvars_cis_sdio(char **vars, uint *count);
-static int sprom_cmd_sdio(u8 cmd);
-static int sprom_read_sdio(u16 addr, u16 *data);
-#endif				/* BCMSDIO */
 static int sprom_read_pci(si_t *sih, u16 *sprom,
 			  uint wordoff, u16 *buf, uint nwords, bool check_crc);
 #if defined(BCMNVRAMR)
@@ -179,1227 +158,12 @@
 
 		return initvars_srom_pci(sih, curmap, vars, count);
 
-#ifdef BCMSDIO
-	case SDIO_BUS:
-		return initvars_cis_sdio(vars, count);
-#endif				/* BCMSDIO */
-
 	default:
 		ASSERT(0);
 	}
 	return -1;
 }
 
-/* support only 16-bit word read from srom */
-int
-srom_read(si_t *sih, uint bustype, void *curmap,
-	  uint byteoff, uint nbytes, u16 *buf, bool check_crc)
-{
-	uint off, nw;
-#ifdef BCMSDIO
-	uint i;
-#endif				/* BCMSDIO */
-
-	ASSERT(bustype == bustype);
-
-	/* check input - 16-bit access only */
-	if (byteoff & 1 || nbytes & 1 || (byteoff + nbytes) > SROM_MAX)
-		return 1;
-
-	off = byteoff / 2;
-	nw = nbytes / 2;
-
-	if (bustype == PCI_BUS) {
-		if (!curmap)
-			return 1;
-
-		if (si_is_sprom_available(sih)) {
-			u16 *srom;
-
-			srom = (u16 *) SROM_OFFSET(sih);
-			if (srom == NULL)
-				return 1;
-
-			if (sprom_read_pci
-			    (sih, srom, off, buf, nw, check_crc))
-				return 1;
-		}
-#if defined(BCMNVRAMR)
-		else {
-			if (otp_read_pci(sih, buf, SROM_MAX))
-				return 1;
-		}
-#endif
-#ifdef BCMSDIO
-	} else if (bustype == SDIO_BUS) {
-		off = byteoff / 2;
-		nw = nbytes / 2;
-		for (i = 0; i < nw; i++) {
-			if (sprom_read_sdio
-			    ((u16) (off + i), (u16 *) (buf + i)))
-				return 1;
-		}
-#endif				/* BCMSDIO */
-	} else if (bustype == SI_BUS) {
-		return 1;
-	} else {
-		return 1;
-	}
-
-	return 0;
-}
-
-static const char vstr_manf[] = "manf=%s";
-static const char vstr_productname[] = "productname=%s";
-static const char vstr_manfid[] = "manfid=0x%x";
-static const char vstr_prodid[] = "prodid=0x%x";
-#ifdef BCMSDIO
-static const char vstr_sdmaxspeed[] = "sdmaxspeed=%d";
-static const char vstr_sdmaxblk[][13] = {
-"sdmaxblk0=%d", "sdmaxblk1=%d", "sdmaxblk2=%d"};
-#endif
-static const char vstr_regwindowsz[] = "regwindowsz=%d";
-static const char vstr_sromrev[] = "sromrev=%d";
-static const char vstr_chiprev[] = "chiprev=%d";
-static const char vstr_subvendid[] = "subvendid=0x%x";
-static const char vstr_subdevid[] = "subdevid=0x%x";
-static const char vstr_boardrev[] = "boardrev=0x%x";
-static const char vstr_aa2g[] = "aa2g=0x%x";
-static const char vstr_aa5g[] = "aa5g=0x%x";
-static const char vstr_ag[] = "ag%d=0x%x";
-static const char vstr_cc[] = "cc=%d";
-static const char vstr_opo[] = "opo=%d";
-static const char vstr_pa0b[][9] = {
-"pa0b0=%d", "pa0b1=%d", "pa0b2=%d"};
-
-static const char vstr_pa0itssit[] = "pa0itssit=%d";
-static const char vstr_pa0maxpwr[] = "pa0maxpwr=%d";
-static const char vstr_pa1b[][9] = {
-"pa1b0=%d", "pa1b1=%d", "pa1b2=%d"};
-
-static const char vstr_pa1lob[][11] = {
-"pa1lob0=%d", "pa1lob1=%d", "pa1lob2=%d"};
-
-static const char vstr_pa1hib[][11] = {
-"pa1hib0=%d", "pa1hib1=%d", "pa1hib2=%d"};
-
-static const char vstr_pa1itssit[] = "pa1itssit=%d";
-static const char vstr_pa1maxpwr[] = "pa1maxpwr=%d";
-static const char vstr_pa1lomaxpwr[] = "pa1lomaxpwr=%d";
-static const char vstr_pa1himaxpwr[] = "pa1himaxpwr=%d";
-static const char vstr_oem[] =
-    "oem=%02x%02x%02x%02x%02x%02x%02x%02x";
-static const char vstr_boardflags[] = "boardflags=0x%x";
-static const char vstr_boardflags2[] = "boardflags2=0x%x";
-static const char vstr_ledbh[] = "ledbh%d=0x%x";
-static const char vstr_noccode[] = "ccode=0x0";
-static const char vstr_ccode[] = "ccode=%c%c";
-static const char vstr_cctl[] = "cctl=0x%x";
-static const char vstr_cckpo[] = "cckpo=0x%x";
-static const char vstr_ofdmpo[] = "ofdmpo=0x%x";
-static const char vstr_rdlid[] = "rdlid=0x%x";
-static const char vstr_rdlrndis[] = "rdlrndis=%d";
-static const char vstr_rdlrwu[] = "rdlrwu=%d";
-static const char vstr_usbfs[] = "usbfs=%d";
-static const char vstr_wpsgpio[] = "wpsgpio=%d";
-static const char vstr_wpsled[] = "wpsled=%d";
-static const char vstr_rdlsn[] = "rdlsn=%d";
-static const char vstr_rssismf2g[] = "rssismf2g=%d";
-static const char vstr_rssismc2g[] = "rssismc2g=%d";
-static const char vstr_rssisav2g[] = "rssisav2g=%d";
-static const char vstr_bxa2g[] = "bxa2g=%d";
-static const char vstr_rssismf5g[] = "rssismf5g=%d";
-static const char vstr_rssismc5g[] = "rssismc5g=%d";
-static const char vstr_rssisav5g[] = "rssisav5g=%d";
-static const char vstr_bxa5g[] = "bxa5g=%d";
-static const char vstr_tri2g[] = "tri2g=%d";
-static const char vstr_tri5gl[] = "tri5gl=%d";
-static const char vstr_tri5g[] = "tri5g=%d";
-static const char vstr_tri5gh[] = "tri5gh=%d";
-static const char vstr_rxpo2g[] = "rxpo2g=%d";
-static const char vstr_rxpo5g[] = "rxpo5g=%d";
-static const char vstr_boardtype[] = "boardtype=0x%x";
-static const char vstr_leddc[] = "leddc=0x%04x";
-static const char vstr_vendid[] = "vendid=0x%x";
-static const char vstr_devid[] = "devid=0x%x";
-static const char vstr_xtalfreq[] = "xtalfreq=%d";
-static const char vstr_txchain[] = "txchain=0x%x";
-static const char vstr_rxchain[] = "rxchain=0x%x";
-static const char vstr_antswitch[] = "antswitch=0x%x";
-static const char vstr_regrev[] = "regrev=0x%x";
-static const char vstr_antswctl2g[] = "antswctl2g=0x%x";
-static const char vstr_triso2g[] = "triso2g=0x%x";
-static const char vstr_pdetrange2g[] = "pdetrange2g=0x%x";
-static const char vstr_extpagain2g[] = "extpagain2g=0x%x";
-static const char vstr_tssipos2g[] = "tssipos2g=0x%x";
-static const char vstr_antswctl5g[] = "antswctl5g=0x%x";
-static const char vstr_triso5g[] = "triso5g=0x%x";
-static const char vstr_pdetrange5g[] = "pdetrange5g=0x%x";
-static const char vstr_extpagain5g[] = "extpagain5g=0x%x";
-static const char vstr_tssipos5g[] = "tssipos5g=0x%x";
-static const char vstr_maxp2ga0[] = "maxp2ga0=0x%x";
-static const char vstr_itt2ga0[] = "itt2ga0=0x%x";
-static const char vstr_pa[] = "pa%dgw%da%d=0x%x";
-static const char vstr_pahl[] = "pa%dg%cw%da%d=0x%x";
-static const char vstr_maxp5ga0[] = "maxp5ga0=0x%x";
-static const char vstr_itt5ga0[] = "itt5ga0=0x%x";
-static const char vstr_maxp5gha0[] = "maxp5gha0=0x%x";
-static const char vstr_maxp5gla0[] = "maxp5gla0=0x%x";
-static const char vstr_maxp2ga1[] = "maxp2ga1=0x%x";
-static const char vstr_itt2ga1[] = "itt2ga1=0x%x";
-static const char vstr_maxp5ga1[] = "maxp5ga1=0x%x";
-static const char vstr_itt5ga1[] = "itt5ga1=0x%x";
-static const char vstr_maxp5gha1[] = "maxp5gha1=0x%x";
-static const char vstr_maxp5gla1[] = "maxp5gla1=0x%x";
-static const char vstr_cck2gpo[] = "cck2gpo=0x%x";
-static const char vstr_ofdm2gpo[] = "ofdm2gpo=0x%x";
-static const char vstr_ofdm5gpo[] = "ofdm5gpo=0x%x";
-static const char vstr_ofdm5glpo[] = "ofdm5glpo=0x%x";
-static const char vstr_ofdm5ghpo[] = "ofdm5ghpo=0x%x";
-static const char vstr_cddpo[] = "cddpo=0x%x";
-static const char vstr_stbcpo[] = "stbcpo=0x%x";
-static const char vstr_bw40po[] = "bw40po=0x%x";
-static const char vstr_bwduppo[] = "bwduppo=0x%x";
-static const char vstr_mcspo[] = "mcs%dgpo%d=0x%x";
-static const char vstr_mcspohl[] = "mcs%dg%cpo%d=0x%x";
-static const char vstr_custom[] = "customvar%d=0x%x";
-static const char vstr_cckdigfilttype[] = "cckdigfilttype=%d";
-static const char vstr_boardnum[] = "boardnum=%d";
-static const char vstr_macaddr[] = "macaddr=%s";
-static const char vstr_usbepnum[] = "usbepnum=0x%x";
-static const char vstr_end[] = "END\0";
-
-u8 patch_pair;
-
-/* For dongle HW, accept partial calibration parameters */
-#define BCMDONGLECASE(n)
-
-int srom_parsecis(u8 *pcis[], uint ciscnt, char **vars,
-		  uint *count)
-{
-	char eabuf[32];
-	char *base;
-	varbuf_t b;
-	u8 *cis, tup, tlen, sromrev = 1;
-	int i, j;
-	bool ag_init = false;
-	u32 w32;
-	uint funcid;
-	uint cisnum;
-	s32 boardnum;
-	int err;
-	bool standard_cis;
-
-	ASSERT(vars != NULL);
-	ASSERT(count != NULL);
-
-	boardnum = -1;
-
-	base = kmalloc(MAXSZ_NVRAM_VARS, GFP_ATOMIC);
-	ASSERT(base != NULL);
-	if (!base)
-		return -2;
-
-	varbuf_init(&b, base, MAXSZ_NVRAM_VARS);
-	memset(base, 0, MAXSZ_NVRAM_VARS);
-	eabuf[0] = '\0';
-	for (cisnum = 0; cisnum < ciscnt; cisnum++) {
-		cis = *pcis++;
-		i = 0;
-		funcid = 0;
-		standard_cis = true;
-		do {
-			if (standard_cis) {
-				tup = cis[i++];
-				if (tup == CISTPL_NULL || tup == CISTPL_END)
-					tlen = 0;
-				else
-					tlen = cis[i++];
-			} else {
-				if (cis[i] == CISTPL_NULL
-				    || cis[i] == CISTPL_END) {
-					tlen = 0;
-					tup = cis[i];
-				} else {
-					tlen = cis[i];
-					tup = CISTPL_BRCM_HNBU;
-				}
-				++i;
-			}
-			if ((i + tlen) >= CIS_SIZE)
-				break;
-
-			switch (tup) {
-			case CISTPL_VERS_1:
-				/* assume the strings are good if the version field checks out */
-				if (((cis[i + 1] << 8) + cis[i]) >= 0x0008) {
-					varbuf_append(&b, vstr_manf,
-						      &cis[i + 2]);
-					varbuf_append(&b, vstr_productname,
-						      &cis[i + 3 +
-							   strlen((char *)
-								  &cis[i +
-								       2])]);
-					break;
-				}
-
-			case CISTPL_MANFID:
-				varbuf_append(&b, vstr_manfid,
-					      (cis[i + 1] << 8) + cis[i]);
-				varbuf_append(&b, vstr_prodid,
-					      (cis[i + 3] << 8) + cis[i + 2]);
-				break;
-
-			case CISTPL_FUNCID:
-				funcid = cis[i];
-				break;
-
-			case CISTPL_FUNCE:
-				switch (funcid) {
-				case CISTPL_FID_SDIO:
-#ifdef BCMSDIO
-					if (cis[i] == 0) {
-						u8 spd = cis[i + 3];
-						static int base[] = {
-							-1, 10, 12, 13, 15, 20,
-							    25, 30,
-							35, 40, 45, 50, 55, 60,
-							    70, 80
-						};
-						static int mult[] = {
-							10, 100, 1000, 10000,
-							-1, -1, -1, -1
-						};
-						ASSERT((mult[spd & 0x7] != -1)
-						       &&
-						       (base
-							[(spd >> 3) & 0x0f]));
-						varbuf_append(&b,
-							      vstr_sdmaxblk[0],
-							      (cis[i + 2] << 8)
-							      + cis[i + 1]);
-						varbuf_append(&b,
-							      vstr_sdmaxspeed,
-							      (mult[spd & 0x7] *
-							       base[(spd >> 3) &
-								    0x0f]));
-					} else if (cis[i] == 1) {
-						varbuf_append(&b,
-							      vstr_sdmaxblk
-							      [cisnum],
-							      (cis[i + 13] << 8)
-							      | cis[i + 12]);
-					}
-#endif				/* BCMSDIO */
-					funcid = 0;
-					break;
-				default:
-					/* set macaddr if HNBU_MACADDR not seen yet */
-					if (eabuf[0] == '\0' &&
-					    cis[i] == LAN_NID &&
-					    !is_zero_ether_addr(&cis[i + 2]) &&
-					    !is_multicast_ether_addr(&cis[i + 2])) {
-						ASSERT(cis[i + 1] ==
-						       ETH_ALEN);
-						snprintf(eabuf, sizeof(eabuf),
-							"%pM", &cis[i + 2]);
-
-						/* set boardnum if HNBU_BOARDNUM not seen yet */
-						if (boardnum == -1)
-							boardnum =
-							    (cis[i + 6] << 8) +
-							    cis[i + 7];
-					}
-					break;
-				}
-				break;
-
-			case CISTPL_CFTABLE:
-				varbuf_append(&b, vstr_regwindowsz,
-					      (cis[i + 7] << 8) | cis[i + 6]);
-				break;
-
-			case CISTPL_BRCM_HNBU:
-				switch (cis[i]) {
-				case HNBU_SROMREV:
-					sromrev = cis[i + 1];
-					varbuf_append(&b, vstr_sromrev,
-						      sromrev);
-					break;
-
-				case HNBU_XTALFREQ:
-					varbuf_append(&b, vstr_xtalfreq,
-						      (cis[i + 4] << 24) |
-						      (cis[i + 3] << 16) |
-						      (cis[i + 2] << 8) |
-						      cis[i + 1]);
-					break;
-
-				case HNBU_CHIPID:
-					varbuf_append(&b, vstr_vendid,
-						      (cis[i + 2] << 8) +
-						      cis[i + 1]);
-					varbuf_append(&b, vstr_devid,
-						      (cis[i + 4] << 8) +
-						      cis[i + 3]);
-					if (tlen >= 7) {
-						varbuf_append(&b, vstr_chiprev,
-							      (cis[i + 6] << 8)
-							      + cis[i + 5]);
-					}
-					if (tlen >= 9) {
-						varbuf_append(&b,
-							      vstr_subvendid,
-							      (cis[i + 8] << 8)
-							      + cis[i + 7]);
-					}
-					if (tlen >= 11) {
-						varbuf_append(&b, vstr_subdevid,
-							      (cis[i + 10] << 8)
-							      + cis[i + 9]);
-						/* subdevid doubles for boardtype */
-						varbuf_append(&b,
-							      vstr_boardtype,
-							      (cis[i + 10] << 8)
-							      + cis[i + 9]);
-					}
-					break;
-
-				case HNBU_BOARDNUM:
-					boardnum =
-					    (cis[i + 2] << 8) + cis[i + 1];
-					break;
-
-				case HNBU_PATCH:
-					{
-						char vstr_paddr[16];
-						char vstr_pdata[16];
-
-						/* retrieve the patch pairs
-						 * from tlen/6; where 6 is
-						 * sizeof(patch addr(2)) +
-						 * sizeof(patch data(4)).
-						 */
-						patch_pair = tlen / 6;
-
-						for (j = 0; j < patch_pair; j++) {
-							snprintf(vstr_paddr,
-								 sizeof
-								 (vstr_paddr),
-								 "pa%d=0x%%x",
-								 j);
-							snprintf(vstr_pdata,
-								 sizeof
-								 (vstr_pdata),
-								 "pd%d=0x%%x",
-								 j);
-
-							varbuf_append(&b,
-								      vstr_paddr,
-								      (cis
-								       [i +
-									(j *
-									 6) +
-									2] << 8)
-								      | cis[i +
-									    (j *
-									     6)
-									    +
-									    1]);
-
-							varbuf_append(&b,
-								      vstr_pdata,
-								      (cis
-								       [i +
-									(j *
-									 6) +
-									6] <<
-								       24) |
-								      (cis
-								       [i +
-									(j *
-									 6) +
-									5] <<
-								       16) |
-								      (cis
-								       [i +
-									(j *
-									 6) +
-									4] << 8)
-								      | cis[i +
-									    (j *
-									     6)
-									    +
-									    3]);
-						}
-					}
-					break;
-
-				case HNBU_BOARDREV:
-					if (tlen == 2)
-						varbuf_append(&b, vstr_boardrev,
-							      cis[i + 1]);
-					else
-						varbuf_append(&b, vstr_boardrev,
-							      (cis[i + 2] << 8)
-							      + cis[i + 1]);
-					break;
-
-				case HNBU_BOARDFLAGS:
-					w32 = (cis[i + 2] << 8) + cis[i + 1];
-					if (tlen >= 5)
-						w32 |=
-						    ((cis[i + 4] << 24) +
-						     (cis[i + 3] << 16));
-					varbuf_append(&b, vstr_boardflags, w32);
-
-					if (tlen >= 7) {
-						w32 =
-						    (cis[i + 6] << 8) + cis[i +
-									    5];
-						if (tlen >= 9)
-							w32 |=
-							    ((cis[i + 8] << 24)
-							     +
-							     (cis[i + 7] <<
-							      16));
-						varbuf_append(&b,
-							      vstr_boardflags2,
-							      w32);
-					}
-					break;
-
-				case HNBU_USBFS:
-					varbuf_append(&b, vstr_usbfs,
-						      cis[i + 1]);
-					break;
-
-				case HNBU_BOARDTYPE:
-					varbuf_append(&b, vstr_boardtype,
-						      (cis[i + 2] << 8) +
-						      cis[i + 1]);
-					break;
-
-				case HNBU_HNBUCIS:
-					/*
-					 * what follows is a nonstandard HNBU CIS
-					 * that lacks CISTPL_BRCM_HNBU tags
-					 *
-					 * skip 0xff (end of standard CIS)
-					 * after this tuple
-					 */
-					tlen++;
-					standard_cis = false;
-					break;
-
-				case HNBU_USBEPNUM:
-					varbuf_append(&b, vstr_usbepnum,
-						      (cis[i + 2] << 8) | cis[i
-									      +
-									      1]);
-					break;
-
-				case HNBU_AA:
-					varbuf_append(&b, vstr_aa2g,
-						      cis[i + 1]);
-					if (tlen >= 3)
-						varbuf_append(&b, vstr_aa5g,
-							      cis[i + 2]);
-					break;
-
-				case HNBU_AG:
-					varbuf_append(&b, vstr_ag, 0,
-						      cis[i + 1]);
-					if (tlen >= 3)
-						varbuf_append(&b, vstr_ag, 1,
-							      cis[i + 2]);
-					if (tlen >= 4)
-						varbuf_append(&b, vstr_ag, 2,
-							      cis[i + 3]);
-					if (tlen >= 5)
-						varbuf_append(&b, vstr_ag, 3,
-							      cis[i + 4]);
-					ag_init = true;
-					break;
-
-				case HNBU_ANT5G:
-					varbuf_append(&b, vstr_aa5g,
-						      cis[i + 1]);
-					varbuf_append(&b, vstr_ag, 1,
-						      cis[i + 2]);
-					break;
-
-				case HNBU_CC:
-					ASSERT(sromrev == 1);
-					varbuf_append(&b, vstr_cc, cis[i + 1]);
-					break;
-
-				case HNBU_PAPARMS:
-					switch (tlen) {
-					case 2:
-						ASSERT(sromrev == 1);
-						varbuf_append(&b,
-							      vstr_pa0maxpwr,
-							      cis[i + 1]);
-						break;
-					case 10:
-						ASSERT(sromrev >= 2);
-						varbuf_append(&b, vstr_opo,
-							      cis[i + 9]);
-						/* FALLTHROUGH */
-					case 9:
-						varbuf_append(&b,
-							      vstr_pa0maxpwr,
-							      cis[i + 8]);
-						/* FALLTHROUGH */
-						BCMDONGLECASE(8)
-						    varbuf_append(&b,
-								  vstr_pa0itssit,
-								  cis[i + 7]);
-						/* FALLTHROUGH */
-						BCMDONGLECASE(7)
-						    for (j = 0; j < 3; j++) {
-							varbuf_append(&b,
-								      vstr_pa0b
-								      [j],
-								      (cis
-								       [i +
-									(j *
-									 2) +
-									2] << 8)
-								      + cis[i +
-									    (j *
-									     2)
-									    +
-									    1]);
-						}
-						break;
-					default:
-						ASSERT((tlen == 2)
-						       || (tlen == 9)
-						       || (tlen == 10));
-						break;
-					}
-					break;
-
-				case HNBU_PAPARMS5G:
-					ASSERT((sromrev == 2)
-					       || (sromrev == 3));
-					switch (tlen) {
-					case 23:
-						varbuf_append(&b,
-							      vstr_pa1himaxpwr,
-							      cis[i + 22]);
-						varbuf_append(&b,
-							      vstr_pa1lomaxpwr,
-							      cis[i + 21]);
-						varbuf_append(&b,
-							      vstr_pa1maxpwr,
-							      cis[i + 20]);
-						/* FALLTHROUGH */
-					case 20:
-						varbuf_append(&b,
-							      vstr_pa1itssit,
-							      cis[i + 19]);
-						/* FALLTHROUGH */
-					case 19:
-						for (j = 0; j < 3; j++) {
-							varbuf_append(&b,
-								      vstr_pa1b
-								      [j],
-								      (cis
-								       [i +
-									(j *
-									 2) +
-									2] << 8)
-								      + cis[i +
-									    (j *
-									     2)
-									    +
-									    1]);
-						}
-						for (j = 3; j < 6; j++) {
-							varbuf_append(&b,
-								      vstr_pa1lob
-								      [j - 3],
-								      (cis
-								       [i +
-									(j *
-									 2) +
-									2] << 8)
-								      + cis[i +
-									    (j *
-									     2)
-									    +
-									    1]);
-						}
-						for (j = 6; j < 9; j++) {
-							varbuf_append(&b,
-								      vstr_pa1hib
-								      [j - 6],
-								      (cis
-								       [i +
-									(j *
-									 2) +
-									2] << 8)
-								      + cis[i +
-									    (j *
-									     2)
-									    +
-									    1]);
-						}
-						break;
-					default:
-						ASSERT((tlen == 19) ||
-						       (tlen == 20)
-						       || (tlen == 23));
-						break;
-					}
-					break;
-
-				case HNBU_OEM:
-					ASSERT(sromrev == 1);
-					varbuf_append(&b, vstr_oem,
-						      cis[i + 1], cis[i + 2],
-						      cis[i + 3], cis[i + 4],
-						      cis[i + 5], cis[i + 6],
-						      cis[i + 7], cis[i + 8]);
-					break;
-
-				case HNBU_LEDS:
-					for (j = 1; j <= 4; j++) {
-						if (cis[i + j] != 0xff) {
-							varbuf_append(&b,
-								      vstr_ledbh,
-								      j - 1,
-								      cis[i +
-									  j]);
-						}
-					}
-					break;
-
-				case HNBU_CCODE:
-					ASSERT(sromrev > 1);
-					if ((cis[i + 1] == 0)
-					    || (cis[i + 2] == 0))
-						varbuf_append(&b, vstr_noccode);
-					else
-						varbuf_append(&b, vstr_ccode,
-							      cis[i + 1],
-							      cis[i + 2]);
-					varbuf_append(&b, vstr_cctl,
-						      cis[i + 3]);
-					break;
-
-				case HNBU_CCKPO:
-					ASSERT(sromrev > 2);
-					varbuf_append(&b, vstr_cckpo,
-						      (cis[i + 2] << 8) | cis[i
-									      +
-									      1]);
-					break;
-
-				case HNBU_OFDMPO:
-					ASSERT(sromrev > 2);
-					varbuf_append(&b, vstr_ofdmpo,
-						      (cis[i + 4] << 24) |
-						      (cis[i + 3] << 16) |
-						      (cis[i + 2] << 8) |
-						      cis[i + 1]);
-					break;
-
-				case HNBU_WPS:
-					varbuf_append(&b, vstr_wpsgpio,
-						      cis[i + 1]);
-					if (tlen >= 3)
-						varbuf_append(&b, vstr_wpsled,
-							      cis[i + 2]);
-					break;
-
-				case HNBU_RSSISMBXA2G:
-					ASSERT(sromrev == 3);
-					varbuf_append(&b, vstr_rssismf2g,
-						      cis[i + 1] & 0xf);
-					varbuf_append(&b, vstr_rssismc2g,
-						      (cis[i + 1] >> 4) & 0xf);
-					varbuf_append(&b, vstr_rssisav2g,
-						      cis[i + 2] & 0x7);
-					varbuf_append(&b, vstr_bxa2g,
-						      (cis[i + 2] >> 3) & 0x3);
-					break;
-
-				case HNBU_RSSISMBXA5G:
-					ASSERT(sromrev == 3);
-					varbuf_append(&b, vstr_rssismf5g,
-						      cis[i + 1] & 0xf);
-					varbuf_append(&b, vstr_rssismc5g,
-						      (cis[i + 1] >> 4) & 0xf);
-					varbuf_append(&b, vstr_rssisav5g,
-						      cis[i + 2] & 0x7);
-					varbuf_append(&b, vstr_bxa5g,
-						      (cis[i + 2] >> 3) & 0x3);
-					break;
-
-				case HNBU_TRI2G:
-					ASSERT(sromrev == 3);
-					varbuf_append(&b, vstr_tri2g,
-						      cis[i + 1]);
-					break;
-
-				case HNBU_TRI5G:
-					ASSERT(sromrev == 3);
-					varbuf_append(&b, vstr_tri5gl,
-						      cis[i + 1]);
-					varbuf_append(&b, vstr_tri5g,
-						      cis[i + 2]);
-					varbuf_append(&b, vstr_tri5gh,
-						      cis[i + 3]);
-					break;
-
-				case HNBU_RXPO2G:
-					ASSERT(sromrev == 3);
-					varbuf_append(&b, vstr_rxpo2g,
-						      cis[i + 1]);
-					break;
-
-				case HNBU_RXPO5G:
-					ASSERT(sromrev == 3);
-					varbuf_append(&b, vstr_rxpo5g,
-						      cis[i + 1]);
-					break;
-
-				case HNBU_MACADDR:
-					if (!is_zero_ether_addr(&cis[i + 1]) &&
-					    !is_multicast_ether_addr(&cis[i + 1])) {
-						snprintf(eabuf, sizeof(eabuf),
-							"%pM", &cis[i + 1]);
-
-						/* set boardnum if HNBU_BOARDNUM not seen yet */
-						if (boardnum == -1)
-							boardnum =
-							    (cis[i + 5] << 8) +
-							    cis[i + 6];
-					}
-					break;
-
-				case HNBU_LEDDC:
-					/* CIS leddc only has 16bits, convert it to 32bits */
-					w32 = ((cis[i + 2] << 24) |	/* oncount */
-					       (cis[i + 1] << 8));	/* offcount */
-					varbuf_append(&b, vstr_leddc, w32);
-					break;
-
-				case HNBU_CHAINSWITCH:
-					varbuf_append(&b, vstr_txchain,
-						      cis[i + 1]);
-					varbuf_append(&b, vstr_rxchain,
-						      cis[i + 2]);
-					varbuf_append(&b, vstr_antswitch,
-						      (cis[i + 4] << 8) +
-						      cis[i + 3]);
-					break;
-
-				case HNBU_REGREV:
-					varbuf_append(&b, vstr_regrev,
-						      cis[i + 1]);
-					break;
-
-				case HNBU_FEM:{
-						u16 fem =
-						    (cis[i + 2] << 8) + cis[i +
-									    1];
-						varbuf_append(&b,
-							      vstr_antswctl2g,
-							      (fem &
-							       SROM8_FEM_ANTSWLUT_MASK)
-							      >>
-							      SROM8_FEM_ANTSWLUT_SHIFT);
-						varbuf_append(&b, vstr_triso2g,
-							      (fem &
-							       SROM8_FEM_TR_ISO_MASK)
-							      >>
-							      SROM8_FEM_TR_ISO_SHIFT);
-						varbuf_append(&b,
-							      vstr_pdetrange2g,
-							      (fem &
-							       SROM8_FEM_PDET_RANGE_MASK)
-							      >>
-							      SROM8_FEM_PDET_RANGE_SHIFT);
-						varbuf_append(&b,
-							      vstr_extpagain2g,
-							      (fem &
-							       SROM8_FEM_EXTPA_GAIN_MASK)
-							      >>
-							      SROM8_FEM_EXTPA_GAIN_SHIFT);
-						varbuf_append(&b,
-							      vstr_tssipos2g,
-							      (fem &
-							       SROM8_FEM_TSSIPOS_MASK)
-							      >>
-							      SROM8_FEM_TSSIPOS_SHIFT);
-						if (tlen < 5)
-							break;
-
-						fem =
-						    (cis[i + 4] << 8) + cis[i +
-									    3];
-						varbuf_append(&b,
-							      vstr_antswctl5g,
-							      (fem &
-							       SROM8_FEM_ANTSWLUT_MASK)
-							      >>
-							      SROM8_FEM_ANTSWLUT_SHIFT);
-						varbuf_append(&b, vstr_triso5g,
-							      (fem &
-							       SROM8_FEM_TR_ISO_MASK)
-							      >>
-							      SROM8_FEM_TR_ISO_SHIFT);
-						varbuf_append(&b,
-							      vstr_pdetrange5g,
-							      (fem &
-							       SROM8_FEM_PDET_RANGE_MASK)
-							      >>
-							      SROM8_FEM_PDET_RANGE_SHIFT);
-						varbuf_append(&b,
-							      vstr_extpagain5g,
-							      (fem &
-							       SROM8_FEM_EXTPA_GAIN_MASK)
-							      >>
-							      SROM8_FEM_EXTPA_GAIN_SHIFT);
-						varbuf_append(&b,
-							      vstr_tssipos5g,
-							      (fem &
-							       SROM8_FEM_TSSIPOS_MASK)
-							      >>
-							      SROM8_FEM_TSSIPOS_SHIFT);
-						break;
-					}
-
-				case HNBU_PAPARMS_C0:
-					varbuf_append(&b, vstr_maxp2ga0,
-						      cis[i + 1]);
-					varbuf_append(&b, vstr_itt2ga0,
-						      cis[i + 2]);
-					varbuf_append(&b, vstr_pa, 2, 0, 0,
-						      (cis[i + 4] << 8) +
-						      cis[i + 3]);
-					varbuf_append(&b, vstr_pa, 2, 1, 0,
-						      (cis[i + 6] << 8) +
-						      cis[i + 5]);
-					varbuf_append(&b, vstr_pa, 2, 2, 0,
-						      (cis[i + 8] << 8) +
-						      cis[i + 7]);
-					if (tlen < 31)
-						break;
-
-					varbuf_append(&b, vstr_maxp5ga0,
-						      cis[i + 9]);
-					varbuf_append(&b, vstr_itt5ga0,
-						      cis[i + 10]);
-					varbuf_append(&b, vstr_maxp5gha0,
-						      cis[i + 11]);
-					varbuf_append(&b, vstr_maxp5gla0,
-						      cis[i + 12]);
-					varbuf_append(&b, vstr_pa, 5, 0, 0,
-						      (cis[i + 14] << 8) +
-						      cis[i + 13]);
-					varbuf_append(&b, vstr_pa, 5, 1, 0,
-						      (cis[i + 16] << 8) +
-						      cis[i + 15]);
-					varbuf_append(&b, vstr_pa, 5, 2, 0,
-						      (cis[i + 18] << 8) +
-						      cis[i + 17]);
-					varbuf_append(&b, vstr_pahl, 5, 'l', 0,
-						      0,
-						      (cis[i + 20] << 8) +
-						      cis[i + 19]);
-					varbuf_append(&b, vstr_pahl, 5, 'l', 1,
-						      0,
-						      (cis[i + 22] << 8) +
-						      cis[i + 21]);
-					varbuf_append(&b, vstr_pahl, 5, 'l', 2,
-						      0,
-						      (cis[i + 24] << 8) +
-						      cis[i + 23]);
-					varbuf_append(&b, vstr_pahl, 5, 'h', 0,
-						      0,
-						      (cis[i + 26] << 8) +
-						      cis[i + 25]);
-					varbuf_append(&b, vstr_pahl, 5, 'h', 1,
-						      0,
-						      (cis[i + 28] << 8) +
-						      cis[i + 27]);
-					varbuf_append(&b, vstr_pahl, 5, 'h', 2,
-						      0,
-						      (cis[i + 30] << 8) +
-						      cis[i + 29]);
-					break;
-
-				case HNBU_PAPARMS_C1:
-					varbuf_append(&b, vstr_maxp2ga1,
-						      cis[i + 1]);
-					varbuf_append(&b, vstr_itt2ga1,
-						      cis[i + 2]);
-					varbuf_append(&b, vstr_pa, 2, 0, 1,
-						      (cis[i + 4] << 8) +
-						      cis[i + 3]);
-					varbuf_append(&b, vstr_pa, 2, 1, 1,
-						      (cis[i + 6] << 8) +
-						      cis[i + 5]);
-					varbuf_append(&b, vstr_pa, 2, 2, 1,
-						      (cis[i + 8] << 8) +
-						      cis[i + 7]);
-					if (tlen < 31)
-						break;
-
-					varbuf_append(&b, vstr_maxp5ga1,
-						      cis[i + 9]);
-					varbuf_append(&b, vstr_itt5ga1,
-						      cis[i + 10]);
-					varbuf_append(&b, vstr_maxp5gha1,
-						      cis[i + 11]);
-					varbuf_append(&b, vstr_maxp5gla1,
-						      cis[i + 12]);
-					varbuf_append(&b, vstr_pa, 5, 0, 1,
-						      (cis[i + 14] << 8) +
-						      cis[i + 13]);
-					varbuf_append(&b, vstr_pa, 5, 1, 1,
-						      (cis[i + 16] << 8) +
-						      cis[i + 15]);
-					varbuf_append(&b, vstr_pa, 5, 2, 1,
-						      (cis[i + 18] << 8) +
-						      cis[i + 17]);
-					varbuf_append(&b, vstr_pahl, 5, 'l', 0,
-						      1,
-						      (cis[i + 20] << 8) +
-						      cis[i + 19]);
-					varbuf_append(&b, vstr_pahl, 5, 'l', 1,
-						      1,
-						      (cis[i + 22] << 8) +
-						      cis[i + 21]);
-					varbuf_append(&b, vstr_pahl, 5, 'l', 2,
-						      1,
-						      (cis[i + 24] << 8) +
-						      cis[i + 23]);
-					varbuf_append(&b, vstr_pahl, 5, 'h', 0,
-						      1,
-						      (cis[i + 26] << 8) +
-						      cis[i + 25]);
-					varbuf_append(&b, vstr_pahl, 5, 'h', 1,
-						      1,
-						      (cis[i + 28] << 8) +
-						      cis[i + 27]);
-					varbuf_append(&b, vstr_pahl, 5, 'h', 2,
-						      1,
-						      (cis[i + 30] << 8) +
-						      cis[i + 29]);
-					break;
-
-				case HNBU_PO_CCKOFDM:
-					varbuf_append(&b, vstr_cck2gpo,
-						      (cis[i + 2] << 8) +
-						      cis[i + 1]);
-					varbuf_append(&b, vstr_ofdm2gpo,
-						      (cis[i + 6] << 24) +
-						      (cis[i + 5] << 16) +
-						      (cis[i + 4] << 8) +
-						      cis[i + 3]);
-					if (tlen < 19)
-						break;
-
-					varbuf_append(&b, vstr_ofdm5gpo,
-						      (cis[i + 10] << 24) +
-						      (cis[i + 9] << 16) +
-						      (cis[i + 8] << 8) +
-						      cis[i + 7]);
-					varbuf_append(&b, vstr_ofdm5glpo,
-						      (cis[i + 14] << 24) +
-						      (cis[i + 13] << 16) +
-						      (cis[i + 12] << 8) +
-						      cis[i + 11]);
-					varbuf_append(&b, vstr_ofdm5ghpo,
-						      (cis[i + 18] << 24) +
-						      (cis[i + 17] << 16) +
-						      (cis[i + 16] << 8) +
-						      cis[i + 15]);
-					break;
-
-				case HNBU_PO_MCS2G:
-					for (j = 0; j <= (tlen / 2); j++) {
-						varbuf_append(&b, vstr_mcspo, 2,
-							      j,
-							      (cis
-							       [i + 2 +
-								2 * j] << 8) +
-							      cis[i + 1 +
-								  2 * j]);
-					}
-					break;
-
-				case HNBU_PO_MCS5GM:
-					for (j = 0; j <= (tlen / 2); j++) {
-						varbuf_append(&b, vstr_mcspo, 5,
-							      j,
-							      (cis
-							       [i + 2 +
-								2 * j] << 8) +
-							      cis[i + 1 +
-								  2 * j]);
-					}
-					break;
-
-				case HNBU_PO_MCS5GLH:
-					for (j = 0; j <= (tlen / 4); j++) {
-						varbuf_append(&b, vstr_mcspohl,
-							      5, 'l', j,
-							      (cis
-							       [i + 2 +
-								2 * j] << 8) +
-							      cis[i + 1 +
-								  2 * j]);
-					}
-
-					for (j = 0; j <= (tlen / 4); j++) {
-						varbuf_append(&b, vstr_mcspohl,
-							      5, 'h', j,
-							      (cis
-							       [i +
-								((tlen / 2) +
-								 2) +
-								2 * j] << 8) +
-							      cis[i +
-								  ((tlen / 2) +
-								   1) + 2 * j]);
-					}
-
-					break;
-
-				case HNBU_PO_CDD:
-					varbuf_append(&b, vstr_cddpo,
-						      (cis[i + 2] << 8) +
-						      cis[i + 1]);
-					break;
-
-				case HNBU_PO_STBC:
-					varbuf_append(&b, vstr_stbcpo,
-						      (cis[i + 2] << 8) +
-						      cis[i + 1]);
-					break;
-
-				case HNBU_PO_40M:
-					varbuf_append(&b, vstr_bw40po,
-						      (cis[i + 2] << 8) +
-						      cis[i + 1]);
-					break;
-
-				case HNBU_PO_40MDUP:
-					varbuf_append(&b, vstr_bwduppo,
-						      (cis[i + 2] << 8) +
-						      cis[i + 1]);
-					break;
-
-				case HNBU_OFDMPO5G:
-					varbuf_append(&b, vstr_ofdm5gpo,
-						      (cis[i + 4] << 24) +
-						      (cis[i + 3] << 16) +
-						      (cis[i + 2] << 8) +
-						      cis[i + 1]);
-					varbuf_append(&b, vstr_ofdm5glpo,
-						      (cis[i + 8] << 24) +
-						      (cis[i + 7] << 16) +
-						      (cis[i + 6] << 8) +
-						      cis[i + 5]);
-					varbuf_append(&b, vstr_ofdm5ghpo,
-						      (cis[i + 12] << 24) +
-						      (cis[i + 11] << 16) +
-						      (cis[i + 10] << 8) +
-						      cis[i + 9]);
-					break;
-
-				case HNBU_CUSTOM1:
-					varbuf_append(&b, vstr_custom, 1,
-						      ((cis[i + 4] << 24) +
-						       (cis[i + 3] << 16) +
-						       (cis[i + 2] << 8) +
-						       cis[i + 1]));
-					break;
-
-#if defined(BCMSDIO)
-				case HNBU_SROM3SWRGN:
-					if (tlen >= 73) {
-						u16 srom[35];
-						u8 srev = cis[i + 1 + 70];
-						ASSERT(srev == 3);
-						/* make tuple value 16-bit aligned and parse it */
-						memcpy(srom, &cis[i + 1],
-						       sizeof(srom));
-						_initvars_srom_pci(srev, srom,
-								   SROM3_SWRGN_OFF,
-								   &b);
-						/* 2.4G antenna gain is included in SROM */
-						ag_init = true;
-						/* Ethernet MAC address is included in SROM */
-						eabuf[0] = 0;
-						boardnum = -1;
-					}
-					/* create extra variables */
-					if (tlen >= 75)
-						varbuf_append(&b, vstr_vendid,
-							      (cis[i + 1 + 73]
-							       << 8) + cis[i +
-									   1 +
-									   72]);
-					if (tlen >= 77)
-						varbuf_append(&b, vstr_devid,
-							      (cis[i + 1 + 75]
-							       << 8) + cis[i +
-									   1 +
-									   74]);
-					if (tlen >= 79)
-						varbuf_append(&b, vstr_xtalfreq,
-							      (cis[i + 1 + 77]
-							       << 8) + cis[i +
-									   1 +
-									   76]);
-					break;
-#endif				/* defined(BCMSDIO) */
-
-				case HNBU_CCKFILTTYPE:
-					varbuf_append(&b, vstr_cckdigfilttype,
-						      (cis[i + 1]));
-					break;
-				}
-
-				break;
-			}
-			i += tlen;
-		} while (tup != CISTPL_END);
-	}
-
-	if (boardnum != -1) {
-		varbuf_append(&b, vstr_boardnum, boardnum);
-	}
-
-	if (eabuf[0]) {
-		varbuf_append(&b, vstr_macaddr, eabuf);
-	}
-
-	/* if there is no antenna gain field, set default */
-	if (getvar(NULL, "ag0") == NULL && ag_init == false) {
-		varbuf_append(&b, vstr_ag, 0, 0xff);
-	}
-
-	/* final nullbyte terminator */
-	ASSERT(b.size >= 1);
-	*b.buf++ = '\0';
-
-	ASSERT(b.buf - base <= MAXSZ_NVRAM_VARS);
-	err = initvars_table(base, b.buf, vars, count);
-
-	kfree(base);
-	return err;
-}
-
 /* In chips with chipcommon rev 32 and later, the srom is in chipcommon,
  * not in the bus cores.
  */
@@ -1424,7 +188,6 @@
 	}
 
 	if (!wait_cnt) {
-		BS_ERROR(("%s: Command 0x%x timed out\n", __func__, cmd));
 		return 0xffff;
 	}
 	if (cmd == SRC_OP_READ)
@@ -1490,8 +253,6 @@
 			 * is blank, regardless of the rest of the content, so declare
 			 * it bad.
 			 */
-			BS_ERROR(("%s: buf[0] = 0x%x, returning bad-crc\n",
-				  __func__, buf[0]));
 			return 1;
 		}
 
@@ -1500,7 +261,6 @@
 		if (hndcrc8((u8 *) buf, nwords * 2, CRC8_INIT_VALUE) !=
 		    CRC8_GOOD_VALUE) {
 			/* DBG only pci always read srom4 first, then srom8/9 */
-			/* BS_ERROR(("%s: bad crc\n", __func__)); */
 			err = 1;
 		}
 		/* now correct the endianness of the byte array */
@@ -1535,8 +295,6 @@
 		 * is blank, regardless of the rest of the content, so declare
 		 * it bad.
 		 */
-		BS_ERROR(("%s: buf[0] = 0x%x, returning bad-crc\n", __func__,
-			  buf[0]));
 		return 1;
 	}
 
@@ -1544,7 +302,6 @@
 	htol16_buf(buf, bufsz);
 	if (hndcrc8((u8 *) buf, SROM4_WORDS * 2, CRC8_INIT_VALUE) !=
 	    CRC8_GOOD_VALUE) {
-		BS_ERROR(("%s: bad crc\n", __func__));
 		err = 1;
 	}
 	/* now correct the endianness of the byte array */
@@ -1884,10 +641,6 @@
 			    sprom_read_pci(sih, sromwindow, 0, srom,
 					   SROM4_WORDS, true);
 			sromrev = srom[SROM4_CRCREV] & 0xff;
-			if (err)
-				BS_ERROR(("%s: srom %d, bad crc\n", __func__,
-					  sromrev));
-
 		} else if (err == 0) {
 			/* srom is good and is rev < 4 */
 			/* top word of sprom contains version and crc8 */
@@ -1921,7 +674,6 @@
 		u32 val;
 		val = 0;
 
-		BS_ERROR(("Neither SPROM nor OTP has valid image\n"));
 		value = si_getdevpathvar(sih, "sromrev");
 		if (value) {
 			sromrev = (u8) simple_strtoul(value, NULL, 0);
@@ -1929,8 +681,6 @@
 			goto varscont;
 		}
 
-		BS_ERROR(("%s, SROM CRC Error\n", __func__));
-
 		value = si_getnvramflvar(sih, "sromrev");
 		if (value) {
 			err = 0;
@@ -1994,92 +744,6 @@
 	return err;
 }
 
-#ifdef BCMSDIO
-/*
- * Read the SDIO cis and call parsecis to initialize the vars.
- * Return 0 on success, nonzero on error.
- */
-static int initvars_cis_sdio(char **vars, uint *count)
-{
-	u8 *cis[SBSDIO_NUM_FUNCTION + 1];
-	uint fn, numfn;
-	int rc = 0;
-
-	numfn = bcmsdh_query_iofnum(NULL);
-	ASSERT(numfn <= SDIOD_MAX_IOFUNCS);
-
-	for (fn = 0; fn <= numfn; fn++) {
-		cis[fn] = kzalloc(SBSDIO_CIS_SIZE_LIMIT, GFP_ATOMIC);
-		if (cis[fn] == NULL) {
-			rc = -1;
-			break;
-		}
-
-		if (bcmsdh_cis_read(NULL, fn, cis[fn], SBSDIO_CIS_SIZE_LIMIT) !=
-		    0) {
-			kfree(cis[fn]);
-			rc = -2;
-			break;
-		}
-	}
-
-	if (!rc)
-		rc = srom_parsecis(cis, fn, vars, count);
-
-	while (fn-- > 0)
-		kfree(cis[fn]);
-
-	return rc;
-}
-
-/* set SDIO sprom command register */
-static int sprom_cmd_sdio(u8 cmd)
-{
-	u8 status = 0;
-	uint wait_cnt = 1000;
-
-	/* write sprom command register */
-	bcmsdh_cfg_write(NULL, SDIO_FUNC_1, SBSDIO_SPROM_CS, cmd, NULL);
-
-	/* wait status */
-	while (wait_cnt--) {
-		status =
-		    bcmsdh_cfg_read(NULL, SDIO_FUNC_1, SBSDIO_SPROM_CS, NULL);
-		if (status & SBSDIO_SPROM_DONE)
-			return 0;
-	}
-
-	return 1;
-}
-
-/* read a word from the SDIO srom */
-static int sprom_read_sdio(u16 addr, u16 *data)
-{
-	u8 addr_l, addr_h, data_l, data_h;
-
-	addr_l = (u8) ((addr * 2) & 0xff);
-	addr_h = (u8) (((addr * 2) >> 8) & 0xff);
-
-	/* set address */
-	bcmsdh_cfg_write(NULL, SDIO_FUNC_1, SBSDIO_SPROM_ADDR_HIGH, addr_h,
-			 NULL);
-	bcmsdh_cfg_write(NULL, SDIO_FUNC_1, SBSDIO_SPROM_ADDR_LOW, addr_l,
-			 NULL);
-
-	/* do read */
-	if (sprom_cmd_sdio(SBSDIO_SPROM_READ))
-		return 1;
-
-	/* read data */
-	data_h =
-	    bcmsdh_cfg_read(NULL, SDIO_FUNC_1, SBSDIO_SPROM_DATA_HIGH, NULL);
-	data_l =
-	    bcmsdh_cfg_read(NULL, SDIO_FUNC_1, SBSDIO_SPROM_DATA_LOW, NULL);
-
-	*data = (data_h << 8) | data_l;
-	return 0;
-}
-#endif				/* BCMSDIO */
 
 static int initvars_srom_si(si_t *sih, void *curmap, char **vars, uint *varsz)
 {
diff --git a/drivers/staging/brcm80211/util/hnddma.c b/drivers/staging/brcm80211/util/hnddma.c
index be339fe..0684fb1 100644
--- a/drivers/staging/brcm80211/util/hnddma.c
+++ b/drivers/staging/brcm80211/util/hnddma.c
@@ -1451,9 +1451,6 @@
 
 		data = p->data;
 		len = p->len;
-#ifdef BCM_DMAPAD
-		len += PKTDMAPAD(di->osh, p);
-#endif				/* BCM_DMAPAD */
 		next = p->next;
 
 		/* return nonzero if out of tx descriptors */
diff --git a/drivers/staging/brcm80211/util/hndpmu.c b/drivers/staging/brcm80211/util/hndpmu.c
index 59e3ede..8426a27 100644
--- a/drivers/staging/brcm80211/util/hndpmu.c
+++ b/drivers/staging/brcm80211/util/hndpmu.c
@@ -34,7 +34,6 @@
 
 /* debug-only definitions */
 /* #define BCMDBG_FORCEHT */
-/* #define CHIPC_UART_ALWAYS_ON */
 #else
 #define	PMU_MSG(args)
 #endif				/* BCMDBG */
@@ -1449,10 +1448,6 @@
 si_pmu1_cpuclk0(si_t *sih, chipcregs_t *cc)
 {
 	u32 tmp, m1div;
-#ifdef BCMDBG
-	u32 ndiv_int, ndiv_frac, p2div, p1div, fvco;
-	u32 fref;
-#endif
 	u32 FVCO = si_pmu1_pllfvco0(sih);
 
 	/* Read m1div from pllcontrol[1] */
@@ -1460,41 +1455,6 @@
 	tmp = R_REG(&cc->pllcontrol_data);
 	m1div = (tmp & PMU1_PLL0_PC1_M1DIV_MASK) >> PMU1_PLL0_PC1_M1DIV_SHIFT;
 
-#ifdef BCMDBG
-	/* Read p2div/p1div from pllcontrol[0] */
-	W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL0);
-	tmp = R_REG(&cc->pllcontrol_data);
-	p2div = (tmp & PMU1_PLL0_PC0_P2DIV_MASK) >> PMU1_PLL0_PC0_P2DIV_SHIFT;
-	p1div = (tmp & PMU1_PLL0_PC0_P1DIV_MASK) >> PMU1_PLL0_PC0_P1DIV_SHIFT;
-
-	/* Calculate fvco based on xtal freq and ndiv and pdiv */
-	W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL2);
-	tmp = R_REG(&cc->pllcontrol_data);
-	ndiv_int =
-	    (tmp & PMU1_PLL0_PC2_NDIV_INT_MASK) >> PMU1_PLL0_PC2_NDIV_INT_SHIFT;
-
-	W_REG(&cc->pllcontrol_addr, PMU1_PLL0_PLLCTL3);
-	tmp = R_REG(&cc->pllcontrol_data);
-	ndiv_frac =
-	    (tmp & PMU1_PLL0_PC3_NDIV_FRAC_MASK) >>
-	    PMU1_PLL0_PC3_NDIV_FRAC_SHIFT;
-
-	fref = si_pmu1_alpclk0(sih, cc) / 1000;
-
-	fvco = (fref * ndiv_int) << 8;
-	fvco += (fref * (ndiv_frac >> 12)) >> 4;
-	fvco += (fref * (ndiv_frac & 0xfff)) >> 12;
-	fvco >>= 8;
-	fvco *= p2div;
-	fvco /= p1div;
-	fvco /= 1000;
-	fvco *= 1000;
-
-	PMU_MSG(("si_pmu1_cpuclk0: ndiv_int %u ndiv_frac %u p2div %u p1div %u fvco %u\n", ndiv_int, ndiv_frac, p2div, p1div, fvco));
-
-	FVCO = fvco;
-#endif				/* BCMDBG */
-
 	/* Return ARM/SB clock */
 	return FVCO / m1div * 1000;
 }
@@ -1544,10 +1504,6 @@
 		break;
 	}
 
-#ifdef BCMDBG_FORCEHT
-	OR_REG(&cc->clk_ctl_st, CCS_FORCEHT);
-#endif
-
 	/* Return to original core */
 	si_setcoreidx(sih, origidx);
 }
@@ -2511,11 +2467,6 @@
 
 	ASSERT(sih->cccaps & CC_CAP_PMU);
 
-#ifdef CHIPC_UART_ALWAYS_ON
-	si_corereg(sih, SI_CC_IDX, offsetof(chipcregs_t, clk_ctl_st),
-		   CCS_FORCEALP, CCS_FORCEALP);
-#endif				/* CHIPC_UART_ALWAYS_ON */
-
 	/* Gate off SPROM clock and chip select signals */
 	si_pmu_sprom_enable(sih, false);
 
diff --git a/drivers/staging/brcm80211/util/nicpci.c b/drivers/staging/brcm80211/util/nicpci.c
index a1fb2f0..6eabbed 100644
--- a/drivers/staging/brcm80211/util/nicpci.c
+++ b/drivers/staging/brcm80211/util/nicpci.c
@@ -98,9 +98,8 @@
 	if (sih->buscoretype == PCIE_CORE_ID) {
 		u8 cap_ptr;
 		pi->regs.pcieregs = (sbpcieregs_t *) regs;
-		cap_ptr =
-		    pcicore_find_pci_capability(pi->dev, PCI_CAP_PCIECAP_ID,
-						NULL, NULL);
+		cap_ptr = pcicore_find_pci_capability(pi->dev, PCI_CAP_ID_EXP,
+						      NULL, NULL);
 		ASSERT(cap_ptr);
 		pi->pciecap_lcreg_offset = cap_ptr + PCIE_CAP_LINKCTRL_OFFSET;
 	} else
@@ -130,16 +129,16 @@
 	u8 byte_val;
 
 	/* check for Header type 0 */
-	pci_read_config_byte(dev, PCI_CFG_HDR, &byte_val);
-	if ((byte_val & 0x7f) != PCI_HEADER_NORMAL)
+	pci_read_config_byte(dev, PCI_HEADER_TYPE, &byte_val);
+	if ((byte_val & 0x7f) != PCI_HEADER_TYPE_NORMAL)
 		goto end;
 
 	/* check if the capability pointer field exists */
-	pci_read_config_byte(dev, PCI_CFG_STAT, &byte_val);
-	if (!(byte_val & PCI_CAPPTR_PRESENT))
+	pci_read_config_byte(dev, PCI_STATUS, &byte_val);
+	if (!(byte_val & PCI_STATUS_CAP_LIST))
 		goto end;
 
-	pci_read_config_byte(dev, PCI_CFG_CAPPTR, &cap_ptr);
+	pci_read_config_byte(dev, PCI_CAPABILITY_LIST, &cap_ptr);
 	/* check if the capability pointer is 0x00 */
 	if (cap_ptr == 0x00)
 		goto end;
@@ -167,8 +166,8 @@
 		*buflen = 0;
 		/* copy the cpability data excluding cap ID and next ptr */
 		cap_data = cap_ptr + 2;
-		if ((bufsize + cap_data) > SZPCR)
-			bufsize = SZPCR - cap_data;
+		if ((bufsize + cap_data) > PCI_SZPCR)
+			bufsize = PCI_SZPCR - cap_data;
 		*buflen = bufsize;
 		while (bufsize--) {
 			pci_read_config_byte(dev, cap_data, buf);
@@ -693,16 +692,15 @@
 	u8 cap_ptr;
 	u32 pmecap;
 
-	cap_ptr =
-	    pcicore_find_pci_capability(pi->dev, PCI_CAP_POWERMGMTCAP_ID, NULL,
-					NULL);
+	cap_ptr = pcicore_find_pci_capability(pi->dev, PCI_CAP_ID_PM, NULL,
+					      NULL);
 
 	if (!cap_ptr)
 		return false;
 
 	pci_read_config_dword(pi->dev, cap_ptr, &pmecap);
 
-	return (pmecap & PME_CAP_PM_STATES) != 0;
+	return (pmecap & (PCI_PM_CAP_PME_MASK << 16)) != 0;
 }
 
 /* return true if PM capability exists in the pci config space
@@ -714,10 +712,9 @@
 	u32 pmecap;
 
 	if (!pi->pmecap_offset) {
-		cap_ptr =
-		    pcicore_find_pci_capability(pi->dev,
-						PCI_CAP_POWERMGMTCAP_ID, NULL,
-						NULL);
+		cap_ptr = pcicore_find_pci_capability(pi->dev,
+						      PCI_CAP_ID_PM,
+						      NULL, NULL);
 		if (!cap_ptr)
 			return false;
 
@@ -727,7 +724,7 @@
 					&pmecap);
 
 		/* At least one state can generate PME */
-		pi->pmecap = (pmecap & PME_CAP_PM_STATES) != 0;
+		pi->pmecap = (pmecap & (PCI_PM_CAP_PME_MASK << 16)) != 0;
 	}
 
 	return pi->pmecap;
@@ -743,11 +740,11 @@
 	if (!pcicore_pmecap(pi))
 		return;
 
-	pci_read_config_dword(pi->dev, pi->pmecap_offset + PME_CSR_OFFSET,
+	pci_read_config_dword(pi->dev, pi->pmecap_offset + PCI_PM_CTRL,
 				&w);
-	w |= (PME_CSR_PME_EN);
+	w |= (PCI_PM_CTRL_PME_ENABLE);
 	pci_write_config_dword(pi->dev,
-				pi->pmecap_offset + PME_CSR_OFFSET, w);
+				pi->pmecap_offset + PCI_PM_CTRL, w);
 }
 
 /*
@@ -761,10 +758,10 @@
 	if (!pcicore_pmecap(pi))
 		return false;
 
-	pci_read_config_dword(pi->dev, pi->pmecap_offset + PME_CSR_OFFSET,
+	pci_read_config_dword(pi->dev, pi->pmecap_offset + PCI_PM_CTRL,
 				&w);
 
-	return (w & PME_CSR_PME_STAT) == PME_CSR_PME_STAT;
+	return (w & PCI_PM_CTRL_PME_STATUS) == PCI_PM_CTRL_PME_STATUS;
 }
 
 /* Disable PME generation, clear the PME status bit if set
@@ -777,16 +774,16 @@
 	if (!pcicore_pmecap(pi))
 		return;
 
-	pci_read_config_dword(pi->dev, pi->pmecap_offset + PME_CSR_OFFSET,
+	pci_read_config_dword(pi->dev, pi->pmecap_offset + PCI_PM_CTRL,
 				&w);
 
 	PCI_ERROR(("pcicore_pci_pmeclr PMECSR : 0x%x\n", w));
 
 	/* PMESTAT is cleared by writing 1 to it */
-	w &= ~(PME_CSR_PME_EN);
+	w &= ~(PCI_PM_CTRL_PME_ENABLE);
 
 	pci_write_config_dword(pi->dev,
-				pi->pmecap_offset + PME_CSR_OFFSET, w);
+				pi->pmecap_offset + PCI_PM_CTRL, w);
 }
 
 u32 pcie_lcreg(void *pch, u32 mask, u32 val)
diff --git a/drivers/staging/brcm80211/util/nvram/nvram_ro.c b/drivers/staging/brcm80211/util/nvram/nvram_ro.c
index a697ff1..397eb8c 100644
--- a/drivers/staging/brcm80211/util/nvram/nvram_ro.c
+++ b/drivers/staging/brcm80211/util/nvram/nvram_ro.c
@@ -22,7 +22,6 @@
 #include <bcmnvram.h>
 #include <sbchipc.h>
 #include <bcmsrom.h>
-#include <bcmotp.h>
 #include <bcmdevs.h>
 #include <hndsoc.h>
 
@@ -98,7 +97,7 @@
 	new->next = vars;
 	vars = new;
 
-	return BCME_OK;
+	return 0;
 }
 
 void nvram_exit(void *si)
diff --git a/drivers/staging/brcm80211/util/siutils.c b/drivers/staging/brcm80211/util/siutils.c
index 6ebd7f5..9e181d6 100644
--- a/drivers/staging/brcm80211/util/siutils.c
+++ b/drivers/staging/brcm80211/util/siutils.c
@@ -312,7 +312,8 @@
 	switch (sii->pub.bustype) {
 	case PCI_BUS:
 		/* do a pci config read to get subsystem id and subvendor id */
-		pci_read_config_dword(sii->pbus, PCI_CFG_SVID, &w);
+		pci_read_config_dword(sii->pbus, PCI_SUBSYSTEM_VENDOR_ID,
+				      &w);
 		/* Let nvram variables override subsystem Vend/ID */
 		sii->pub.boardvendor = (u16)si_getdevpathintvar(&sii->pub,
 			"boardvendor");
@@ -337,14 +338,14 @@
 
 #ifdef BCMSDIO
 	case SPI_BUS:
-		sii->pub.boardvendor = VENDOR_BROADCOM;
+		sii->pub.boardvendor = PCI_VENDOR_ID_BROADCOM;
 		sii->pub.boardtype = SPI_BOARD;
 		break;
 #endif
 
 	case SI_BUS:
 	case JTAG_BUS:
-		sii->pub.boardvendor = VENDOR_BROADCOM;
+		sii->pub.boardvendor = PCI_VENDOR_ID_BROADCOM;
 		sii->pub.boardtype = getintvar(pvars, "prodid");
 		if (pvars == NULL || (sii->pub.boardtype == 0)) {
 			sii->pub.boardtype = getintvar(NULL, "boardtype");
@@ -364,7 +365,7 @@
 
 /* this is will make Sonics calls directly, since Sonics is no longer supported in the Si abstraction */
 /* this has been customized for the bcm 4329 ONLY */
-#ifdef BCMSDIO
+#ifdef BRCM_FULLMAC
 static si_info_t *si_doattach(si_info_t *sii, uint devid,
 			      void *regs, uint bustype, void *pbus,
 			      char **vars, uint *varsz)
@@ -372,7 +373,6 @@
 	struct si_pub *sih = &sii->pub;
 	u32 w, savewin;
 	chipcregs_t *cc;
-	char *pvars = NULL;
 	uint origidx;
 
 	ASSERT(GOODREGS(regs));
@@ -431,69 +431,17 @@
 		goto exit;
 	}
 
-#ifdef BRCM_FULLMAC
-	pvars = NULL;
-#else
-	/* Init nvram from flash if it exists */
-	nvram_init((void *)&(sii->pub));
-
-	/* Init nvram from sprom/otp if they exist */
-	if (srom_var_init
-	    (&sii->pub, bustype, regs, sii->osh, vars, varsz)) {
-		SI_ERROR(("si_doattach: srom_var_init failed: bad srom\n"));
-		goto exit;
-	}
-	pvars = vars ? *vars : NULL;
-	si_nvram_process(sii, pvars);
-#endif
-
-	/* === NVRAM, clock is ready === */
-
-#ifdef BRCM_FULLMAC
-	if (sii->pub.ccrev >= 20) {
-#endif
 	cc = (chipcregs_t *) si_setcore(sih, CC_CORE_ID, 0);
 	W_REG(&cc->gpiopullup, 0);
 	W_REG(&cc->gpiopulldown, 0);
 	sb_setcoreidx(sih, origidx);
-#ifdef BRCM_FULLMAC
-	}
-#endif
-
-#ifndef BRCM_FULLMAC
-	/* PMU specific initializations */
-	if (PMUCTL_ENAB(sih)) {
-		u32 xtalfreq;
-		si_pmu_init(sih);
-		si_pmu_chip_init(sih);
-		xtalfreq = getintvar(pvars, "xtalfreq");
-		/* If xtalfreq var not available, try to measure it */
-		if (xtalfreq == 0)
-			xtalfreq = si_pmu_measure_alpclk(sih);
-		si_pmu_pll_init(sih, xtalfreq);
-		si_pmu_res_init(sih);
-		si_pmu_swreg_init(sih);
-	}
-
-	/* setup the GPIO based LED powersave register */
-	w = getintvar(pvars, "leddc");
-	if (w == 0)
-		w = DEFAULT_GPIOTIMERVAL;
-	sb_corereg(sih, SI_CC_IDX, offsetof(chipcregs_t, gpiotimerval), ~0, w);
-
-#ifdef BCMDBG
-	/* clear any previous epidiag-induced target abort */
-	sb_taclear(sih, false);
-#endif				/* BCMDBG */
-#endif
 
 	return sii;
 
  exit:
 	return NULL;
 }
-
-#else				/* BCMSDIO */
+#else /* BRCM_FULLMAC */
 static si_info_t *si_doattach(si_info_t *sii, uint devid,
 			      void *regs, uint bustype, void *pbus,
 			      char **vars, uint *varsz)
@@ -685,7 +633,7 @@
 
 	return NULL;
 }
-#endif				/* BCMSDIO */
+#endif /* BRCM_FULLMAC */
 
 /* may be called with core in reset */
 void si_detach(si_t *sih)
@@ -1538,9 +1486,8 @@
 	if (sii->pub.bustype != PCI_BUS)
 		return false;
 
-	cap_ptr =
-	    pcicore_find_pci_capability(sii->pbus, PCI_CAP_PCIECAP_ID, NULL,
-					NULL);
+	cap_ptr = pcicore_find_pci_capability(sii->pbus, PCI_CAP_ID_EXP, NULL,
+					      NULL);
 	if (!cap_ptr)
 		return false;
 
@@ -1917,8 +1864,8 @@
 	switch (sih->bustype) {
 	case PCI_BUS:
 		ASSERT(sii->pbus != NULL);
-		pci_read_config_dword(sii->pbus, PCI_CFG_VID, &w);
-		if ((w & 0xFFFF) != VENDOR_BROADCOM)
+		pci_read_config_dword(sii->pbus, PCI_VENDOR_ID, &w);
+		if ((w & 0xFFFF) != PCI_VENDOR_ID_BROADCOM)
 			return true;
 		break;
 	}
diff --git a/drivers/staging/comedi/drivers/addi-data/APCI1710_Ssi.c b/drivers/staging/comedi/drivers/addi-data/APCI1710_Ssi.c
index 0c890a9..c13b0027 100644
--- a/drivers/staging/comedi/drivers/addi-data/APCI1710_Ssi.c
+++ b/drivers/staging/comedi/drivers/addi-data/APCI1710_Ssi.c
@@ -35,22 +35,8 @@
   | Project manager: Eric Stolz   | Date     :  02/12/2002                |
   +-----------------------------------------------------------------------+
   | Description :   APCI-1710 SSI counter module                          |
-  |                                                                       |
-  |                                                                       |
   +-----------------------------------------------------------------------+
-  |                             UPDATES                                   |
-  +-----------------------------------------------------------------------+
-  |   Date   |   Author  |          Description of updates                |
-  +----------+-----------+------------------------------------------------+
-  | 13/05/98 | S. Weber  | SSI digital input / output implementation      |
-  |----------|-----------|------------------------------------------------|
-  | 22/03/00 | C.Guinot  | 0100/0226 -> 0200/0227                         |
-  |          |           | Änderung in InitSSI Funktion                   |
-  |          |           | b_SSIProfile >= 2 anstatt b_SSIProfile > 2     |
-  |          |           |                                                |
-  +-----------------------------------------------------------------------+
-  | 08/05/00 | Guinot C  | - 0400/0228 All Function in RING 0             |
-  |          |           |   available                                    |
+  | several changes done by S. Weber in 1998 and C. Guinot in 2000        |
   +-----------------------------------------------------------------------+
 */
 
diff --git a/drivers/staging/crystalhd/bc_dts_types.h b/drivers/staging/crystalhd/bc_dts_types.h
index 6fd8089..d2131e7 100644
--- a/drivers/staging/crystalhd/bc_dts_types.h
+++ b/drivers/staging/crystalhd/bc_dts_types.h
@@ -65,7 +65,6 @@
 #else
 
 /* For Kernel usage.. */
-typedef bool	bc_bool_t;
 #endif
 
 #else
diff --git a/drivers/staging/cx25821/cx25821-video.c b/drivers/staging/cx25821/cx25821-video.c
index ab05392..04b18f4 100644
--- a/drivers/staging/cx25821/cx25821-video.c
+++ b/drivers/staging/cx25821/cx25821-video.c
@@ -832,6 +832,7 @@
 
        if (NULL == dev) {
 		mutex_unlock(&cx25821_devlist_mutex);
+		kfree(fh);
 		return -ENODEV;
        }
 
diff --git a/drivers/staging/easycap/easycap_main.c b/drivers/staging/easycap/easycap_main.c
index cee3252..74adfb0 100644
--- a/drivers/staging/easycap/easycap_main.c
+++ b/drivers/staging/easycap/easycap_main.c
@@ -201,9 +201,9 @@
 static int reset(struct easycap *peasycap)
 {
 	struct easycap_standard const *peasycap_standard;
-	int i, rc, input, rate;
+	int fmtidx, input, rate;
 	bool ntsc, other;
-	int fmtidx;
+	int rc;
 
 	if (!peasycap) {
 		SAY("ERROR: peasycap is NULL\n");
@@ -226,33 +226,27 @@
 	JOM(8, "peasycap->ntsc=%d\n", peasycap->ntsc);
 
 	rate = ready_saa(peasycap->pusb_device);
-	if (0 > rate) {
+	if (rate < 0) {
 		JOM(8, "not ready to capture after %i ms ...\n", PATIENCE);
-		if (peasycap->ntsc) {
-			JOM(8, "... trying PAL ...\n");  ntsc = false;
-		} else {
-			JOM(8, "... trying NTSC ...\n"); ntsc = true;
-	}
-	rc = setup_stk(peasycap->pusb_device, ntsc);
-	if (0 == rc)
-		JOM(4, "setup_stk() OK\n");
-	else {
-		SAM("ERROR: setup_stk() rc = %i\n", rc);
-		return -EFAULT;
-	}
-	rc = setup_saa(peasycap->pusb_device, ntsc);
-	if (0 == rc)
-		JOM(4, "setup_saa() OK\n");
-	else {
-		SAM("ERROR: setup_saa() rc = %i\n", rc);
-		return -EFAULT;
-	}
-	rate = ready_saa(peasycap->pusb_device);
-	if (0 > rate) {
-		JOM(8, "not ready to capture after %i ms ...\n", PATIENCE);
-		JOM(8, "... saa register 0x1F has 0x%02X\n",
+		ntsc = !peasycap->ntsc;
+		JOM(8, "... trying  %s ..\n", ntsc ? "NTSC" : "PAL");
+		rc = setup_stk(peasycap->pusb_device, ntsc);
+		if (rc) {
+			SAM("ERROR: setup_stk() rc = %i\n", rc);
+			return -EFAULT;
+		}
+		rc = setup_saa(peasycap->pusb_device, ntsc);
+		if (rc) {
+			SAM("ERROR: setup_saa() rc = %i\n", rc);
+			return -EFAULT;
+		}
+
+		rate = ready_saa(peasycap->pusb_device);
+		if (rate < 0) {
+			JOM(8, "not ready to capture after %i ms\n", PATIENCE);
+			JOM(8, "... saa register 0x1F has 0x%02X\n",
 					read_saa(peasycap->pusb_device, 0x1F));
-		ntsc = peasycap->ntsc;
+			ntsc = peasycap->ntsc;
 		} else {
 			JOM(8, "... success at second try:  %i=rate\n", rate);
 			ntsc = (0 < (rate/2)) ? true : false ;
@@ -266,22 +260,17 @@
 /*---------------------------------------------------------------------------*/
 
 	rc = setup_stk(peasycap->pusb_device, ntsc);
-	if (0 == rc)
-		JOM(4, "setup_stk() OK\n");
-	else {
+	if (rc) {
 		SAM("ERROR: setup_stk() rc = %i\n", rc);
 		return -EFAULT;
 	}
 	rc = setup_saa(peasycap->pusb_device, ntsc);
-	if (0 == rc)
-		JOM(4, "setup_saa() OK\n");
-	else {
+	if (rc) {
 		SAM("ERROR: setup_saa() rc = %i\n", rc);
 		return -EFAULT;
 	}
 
-	for (i = 0; i < 180; i++)
-		peasycap->merit[i] = 0;
+	memset(peasycap->merit, 0, sizeof(peasycap->merit));
 
 	peasycap->video_eof = 0;
 	peasycap->audio_eof = 0;
@@ -2986,25 +2975,19 @@
  *  TIMES, ONCE FOR EACH OF THE THREE INTERFACES.  BEWARE.
  */
 /*---------------------------------------------------------------------------*/
-static int easycap_usb_probe(struct usb_interface *pusb_interface,
-			    const struct usb_device_id *pusb_device_id)
+static int easycap_usb_probe(struct usb_interface *intf,
+			    const struct usb_device_id *id)
 {
-	struct usb_device *pusb_device;
-	struct usb_host_interface *pusb_host_interface;
-	struct usb_endpoint_descriptor *pepd;
-	struct usb_interface_descriptor *pusb_interface_descriptor;
+	struct usb_device *usbdev;
+	struct usb_host_interface *alt;
+	struct usb_endpoint_descriptor *ep;
+	struct usb_interface_descriptor *interface;
 	struct urb *purb;
 	struct easycap *peasycap;
 	int ndong;
 	struct data_urb *pdata_urb;
 	size_t wMaxPacketSize;
-	int ISOCwMaxPacketSize;
-	int BULKwMaxPacketSize;
-	int INTwMaxPacketSize;
-	int CTRLwMaxPacketSize;
 	u8 bEndpointAddress;
-	u8 ISOCbEndpointAddress;
-	u8 INTbEndpointAddress;
 	int isin, i, j, k, m, rc;
 	u8 bInterfaceNumber;
 	u8 bInterfaceClass;
@@ -3021,23 +3004,17 @@
 	struct inputset *inputset;
 	struct v4l2_device *pv4l2_device;
 
-/*---------------------------------------------------------------------------*/
-/*
- *  GET POINTER TO STRUCTURE usb_device
- */
-/*---------------------------------------------------------------------------*/
-	pusb_device = interface_to_usbdev(pusb_interface);
+	usbdev = interface_to_usbdev(intf);
 
-	JOT(4, "bNumConfigurations=%i\n", pusb_device->descriptor.bNumConfigurations);
 /*---------------------------------------------------------------------------*/
-	pusb_host_interface = pusb_interface->cur_altsetting;
-	if (!pusb_host_interface) {
-		SAY("ERROR: pusb_host_interface is NULL\n");
+	alt = usb_altnum_to_altsetting(intf, 0);
+	if (!alt) {
+		SAY("ERROR: usb_host_interface not found\n");
 		return -EFAULT;
 	}
-	pusb_interface_descriptor = &(pusb_host_interface->desc);
-	if (!pusb_interface_descriptor) {
-		SAY("ERROR: pusb_interface_descriptor is NULL\n");
+	interface = &alt->desc;
+	if (!interface) {
+		SAY("ERROR: intf_descriptor is NULL\n");
 		return -EFAULT;
 	}
 /*---------------------------------------------------------------------------*/
@@ -3045,16 +3022,15 @@
  *  GET PROPERTIES OF PROBED INTERFACE
  */
 /*---------------------------------------------------------------------------*/
-	bInterfaceNumber = pusb_interface_descriptor->bInterfaceNumber;
-	bInterfaceClass = pusb_interface_descriptor->bInterfaceClass;
-	bInterfaceSubClass = pusb_interface_descriptor->bInterfaceSubClass;
+	bInterfaceNumber = interface->bInterfaceNumber;
+	bInterfaceClass = interface->bInterfaceClass;
+	bInterfaceSubClass = interface->bInterfaceSubClass;
 
 	JOT(4, "intf[%i]: num_altsetting=%i\n",
-			bInterfaceNumber, pusb_interface->num_altsetting);
+			bInterfaceNumber, intf->num_altsetting);
 	JOT(4, "intf[%i]: cur_altsetting - altsetting=%li\n",
 		bInterfaceNumber,
-		(long int)(pusb_interface->cur_altsetting -
-				pusb_interface->altsetting));
+		(long int)(intf->cur_altsetting - intf->altsetting));
 	JOT(4, "intf[%i]: bInterfaceClass=0x%02X bInterfaceSubClass=0x%02X\n",
 			bInterfaceNumber, bInterfaceClass, bInterfaceSubClass);
 /*---------------------------------------------------------------------------*/
@@ -3140,8 +3116,8 @@
  *  ... AND FURTHER INITIALIZE THE STRUCTURE
 */
 /*---------------------------------------------------------------------------*/
-		peasycap->pusb_device = pusb_device;
-		peasycap->pusb_interface = pusb_interface;
+		peasycap->pusb_device = usbdev;
+		peasycap->pusb_interface = intf;
 
 		peasycap->ilk = 0;
 		peasycap->microphone = false;
@@ -3275,7 +3251,7 @@
  */
 /*---------------------------------------------------------------------------*/
 		for (ndong = 0; ndong < DONGLE_MANY; ndong++) {
-			if (pusb_device == easycapdc60_dongle[ndong].peasycap->
+			if (usbdev == easycapdc60_dongle[ndong].peasycap->
 									pusb_device) {
 				peasycap = easycapdc60_dongle[ndong].peasycap;
 				JOT(8, "intf[%i]: dongle[%i].peasycap\n",
@@ -3302,7 +3278,7 @@
 */
 /*---------------------------------------------------------------------------*/
 		if (memcmp(&peasycap->telltale[0], TELLTALE, strlen(TELLTALE))) {
-			pv4l2_device = usb_get_intfdata(pusb_interface);
+			pv4l2_device = usb_get_intfdata(intf);
 			if (!pv4l2_device) {
 				SAY("ERROR: pv4l2_device is NULL\n");
 				return -ENODEV;
@@ -3351,70 +3327,63 @@
 /*---------------------------------------------------------------------------*/
 	isokalt = 0;
 
-	for (i = 0; i < pusb_interface->num_altsetting; i++) {
-		pusb_host_interface = &(pusb_interface->altsetting[i]);
-		if (!pusb_host_interface) {
-			SAM("ERROR: pusb_host_interface is NULL\n");
+	for (i = 0; i < intf->num_altsetting; i++) {
+		alt = usb_altnum_to_altsetting(intf, i);
+		if (!alt) {
+			SAM("ERROR: alt is NULL\n");
 			return -EFAULT;
 		}
-		pusb_interface_descriptor = &(pusb_host_interface->desc);
-		if (!pusb_interface_descriptor) {
-			SAM("ERROR: pusb_interface_descriptor is NULL\n");
+		interface = &alt->desc;
+		if (!interface) {
+			SAM("ERROR: intf_descriptor is NULL\n");
 			return -EFAULT;
 		}
 
 		JOM(4, "intf[%i]alt[%i]: desc.bDescriptorType=0x%02X\n",
-		bInterfaceNumber, i, pusb_interface_descriptor->bDescriptorType);
+		bInterfaceNumber, i, interface->bDescriptorType);
 		JOM(4, "intf[%i]alt[%i]: desc.bInterfaceNumber=0x%02X\n",
-		bInterfaceNumber, i, pusb_interface_descriptor->bInterfaceNumber);
+		bInterfaceNumber, i, interface->bInterfaceNumber);
 		JOM(4, "intf[%i]alt[%i]: desc.bAlternateSetting=0x%02X\n",
-		bInterfaceNumber, i, pusb_interface_descriptor->bAlternateSetting);
+		bInterfaceNumber, i, interface->bAlternateSetting);
 		JOM(4, "intf[%i]alt[%i]: desc.bNumEndpoints=0x%02X\n",
-		bInterfaceNumber, i, pusb_interface_descriptor->bNumEndpoints);
+		bInterfaceNumber, i, interface->bNumEndpoints);
 		JOM(4, "intf[%i]alt[%i]: desc.bInterfaceClass=0x%02X\n",
-		bInterfaceNumber, i, pusb_interface_descriptor->bInterfaceClass);
+		bInterfaceNumber, i, interface->bInterfaceClass);
 		JOM(4, "intf[%i]alt[%i]: desc.bInterfaceSubClass=0x%02X\n",
-		bInterfaceNumber, i, pusb_interface_descriptor->bInterfaceSubClass);
+		bInterfaceNumber, i, interface->bInterfaceSubClass);
 		JOM(4, "intf[%i]alt[%i]: desc.bInterfaceProtocol=0x%02X\n",
-		bInterfaceNumber, i, pusb_interface_descriptor->bInterfaceProtocol);
+		bInterfaceNumber, i, interface->bInterfaceProtocol);
 		JOM(4, "intf[%i]alt[%i]: desc.iInterface=0x%02X\n",
-		bInterfaceNumber, i, pusb_interface_descriptor->iInterface);
+		bInterfaceNumber, i, interface->iInterface);
 
-		ISOCwMaxPacketSize = -1;
-		BULKwMaxPacketSize = -1;
-		INTwMaxPacketSize = -1;
-		CTRLwMaxPacketSize = -1;
-		ISOCbEndpointAddress = 0;
-		INTbEndpointAddress = 0;
-
-		if (0 == pusb_interface_descriptor->bNumEndpoints)
+		if (0 == interface->bNumEndpoints)
 			JOM(4, "intf[%i]alt[%i] has no endpoints\n",
 						bInterfaceNumber, i);
 /*---------------------------------------------------------------------------*/
-		for (j = 0; j < pusb_interface_descriptor->bNumEndpoints; j++) {
-			pepd = &(pusb_host_interface->endpoint[j].desc);
-			if (!pepd) {
-				SAM("ERROR:  pepd is NULL.\n");
+		for (j = 0; j < interface->bNumEndpoints; j++) {
+			ep = &alt->endpoint[j].desc;
+			if (!ep) {
+				SAM("ERROR:  ep is NULL.\n");
 				SAM("...... skipping\n");
 				continue;
 			}
-			wMaxPacketSize = le16_to_cpu(pepd->wMaxPacketSize);
-			bEndpointAddress = pepd->bEndpointAddress;
+			wMaxPacketSize = le16_to_cpu(ep->wMaxPacketSize);
+			bEndpointAddress = ep->bEndpointAddress;
 
 			JOM(4, "intf[%i]alt[%i]end[%i]: bEndpointAddress=0x%X\n",
 					bInterfaceNumber, i, j,
-					pepd->bEndpointAddress);
+					ep->bEndpointAddress);
 			JOM(4, "intf[%i]alt[%i]end[%i]: bmAttributes=0x%X\n",
 					bInterfaceNumber, i, j,
-					pepd->bmAttributes);
+					ep->bmAttributes);
 			JOM(4, "intf[%i]alt[%i]end[%i]: wMaxPacketSize=%i\n",
 					bInterfaceNumber, i, j,
-					pepd->wMaxPacketSize);
+					ep->wMaxPacketSize);
 			JOM(4, "intf[%i]alt[%i]end[%i]: bInterval=%i\n",
 					bInterfaceNumber, i, j,
-					pepd->bInterval);
+					ep->bInterval);
 
-			if (pepd->bEndpointAddress & USB_DIR_IN) {
+			if (ep->bEndpointAddress & USB_DIR_IN) {
 				JOM(4, "intf[%i]alt[%i]end[%i] is an  IN  endpoint\n",
 							bInterfaceNumber, i, j);
 				isin = 1;
@@ -3425,7 +3394,7 @@
 				SAM("...... continuing\n");
 				isin = 0;
 			}
-			if ((pepd->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
+			if ((ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
 						USB_ENDPOINT_XFER_ISOC) {
 				JOM(4, "intf[%i]alt[%i]end[%i] is an ISOC endpoint\n",
 							bInterfaceNumber, i, j);
@@ -3438,7 +3407,7 @@
 								"peasycap is NULL\n");
 							return -EFAULT;
 						}
-						if (pepd->wMaxPacketSize) {
+						if (ep->wMaxPacketSize) {
 							if (8 > isokalt) {
 								okalt[isokalt] = i;
 								JOM(4,
@@ -3446,7 +3415,7 @@
 								okalt[isokalt],
 								isokalt);
 								okepn[isokalt] =
-								pepd->
+								ep->
 								bEndpointAddress &
 								0x0F;
 								JOM(4,
@@ -3454,7 +3423,7 @@
 								okepn[isokalt],
 								isokalt);
 								okmps[isokalt] =
-								le16_to_cpu(pepd->
+								le16_to_cpu(ep->
 								wMaxPacketSize);
 								JOM(4,
 								"%i=okmps[%i]\n",
@@ -3496,7 +3465,7 @@
 							"peasycap is NULL\n");
 							return -EFAULT;
 						}
-						if (pepd->wMaxPacketSize) {
+						if (ep->wMaxPacketSize) {
 							if (8 > isokalt) {
 								okalt[isokalt] = i ;
 								JOM(4,
@@ -3504,7 +3473,7 @@
 								okalt[isokalt],
 								isokalt);
 								okepn[isokalt] =
-								pepd->
+								ep->
 								bEndpointAddress &
 								0x0F;
 								JOM(4,
@@ -3512,7 +3481,7 @@
 								okepn[isokalt],
 								isokalt);
 								okmps[isokalt] =
-								le16_to_cpu(pepd->
+								le16_to_cpu(ep->
 								wMaxPacketSize);
 								JOM(4,
 								"%i=okmps[%i]\n",
@@ -3550,12 +3519,12 @@
 						break;
 					}
 				}
-			} else if ((pepd->bmAttributes &
+			} else if ((ep->bmAttributes &
 							USB_ENDPOINT_XFERTYPE_MASK) ==
 							USB_ENDPOINT_XFER_BULK) {
 				JOM(4, "intf[%i]alt[%i]end[%i] is a  BULK endpoint\n",
 							bInterfaceNumber, i, j);
-			} else if ((pepd->bmAttributes &
+			} else if ((ep->bmAttributes &
 							USB_ENDPOINT_XFERTYPE_MASK) ==
 							USB_ENDPOINT_XFER_INT) {
 				JOM(4, "intf[%i]alt[%i]end[%i] is an  INT endpoint\n",
@@ -3564,7 +3533,7 @@
 				JOM(4, "intf[%i]alt[%i]end[%i] is a  CTRL endpoint\n",
 							bInterfaceNumber, i, j);
 			}
-			if (0 == pepd->wMaxPacketSize) {
+			if (0 == ep->wMaxPacketSize) {
 				JOM(4, "intf[%i]alt[%i]end[%i] "
 							"has zero packet size\n",
 							bInterfaceNumber, i, j);
@@ -3577,7 +3546,7 @@
  */
 /*---------------------------------------------------------------------------*/
 	JOM(4, "initialization begins for interface %i\n",
-		pusb_interface_descriptor->bInterfaceNumber);
+		interface->bInterfaceNumber);
 	switch (bInterfaceNumber) {
 /*---------------------------------------------------------------------------*/
 /*
@@ -3844,7 +3813,7 @@
  *  SAVE POINTER peasycap IN THIS INTERFACE.
  */
 /*--------------------------------------------------------------------------*/
-		usb_set_intfdata(pusb_interface, peasycap);
+		usb_set_intfdata(intf, peasycap);
 /*---------------------------------------------------------------------------*/
 /*
  *  IT IS ESSENTIAL TO INITIALIZE THE HARDWARE BEFORE, RATHER THAN AFTER,
@@ -3866,7 +3835,7 @@
  *  THE VIDEO DEVICE CAN BE REGISTERED NOW, AS IT IS READY.
  */
 /*--------------------------------------------------------------------------*/
-		if (0 != (v4l2_device_register(&(pusb_interface->dev),
+		if (0 != (v4l2_device_register(&(intf->dev),
 							&(peasycap->v4l2_device)))) {
 			SAM("v4l2_device_register() failed\n");
 			return -ENODEV;
@@ -3924,9 +3893,9 @@
  *  SAVE POINTER peasycap IN INTERFACE 1
  */
 /*--------------------------------------------------------------------------*/
-		usb_set_intfdata(pusb_interface, peasycap);
+		usb_set_intfdata(intf, peasycap);
 		JOM(4, "no initialization required for interface %i\n",
-					pusb_interface_descriptor->bInterfaceNumber);
+					interface->bInterfaceNumber);
 		break;
 	}
 /*--------------------------------------------------------------------------*/
@@ -4188,7 +4157,7 @@
  *  SAVE POINTER peasycap IN THIS INTERFACE.
  */
 /*---------------------------------------------------------------------------*/
-		usb_set_intfdata(pusb_interface, peasycap);
+		usb_set_intfdata(intf, peasycap);
 /*---------------------------------------------------------------------------*/
 /*
  *  THE AUDIO DEVICE CAN BE REGISTERED NOW, AS IT IS READY.
@@ -4201,28 +4170,22 @@
 		if (rc) {
 			err("easycap_alsa_probe() rc = %i\n", rc);
 			return -ENODEV;
-		} else {
-			JOM(8, "kref_get() with %i=kref.refcount.counter\n",
-					peasycap->kref.refcount.counter);
-			kref_get(&peasycap->kref);
-			peasycap->registered_audio++;
 		}
 
 #else /* CONFIG_EASYCAP_OSS */
-		rc = usb_register_dev(pusb_interface, &easyoss_class);
+		rc = usb_register_dev(intf, &easyoss_class);
 		if (rc) {
 			SAY("ERROR: usb_register_dev() failed\n");
-			usb_set_intfdata(pusb_interface, NULL);
+			usb_set_intfdata(intf, NULL);
 			return -ENODEV;
-		} else {
-			JOM(8, "kref_get() with %i=kref.refcount.counter\n",
-					peasycap->kref.refcount.counter);
-			kref_get(&peasycap->kref);
-			peasycap->registered_audio++;
 		}
-		SAM("easyoss attached to minor #%d\n", pusb_interface->minor);
+		SAM("easyoss attached to minor #%d\n", intf->minor);
 #endif /* CONFIG_EASYCAP_OSS */
 
+		JOM(8, "kref_get() with %i=kref.refcount.counter\n",
+				peasycap->kref.refcount.counter);
+		kref_get(&peasycap->kref);
+		peasycap->registered_audio++;
 		break;
 	}
 /*---------------------------------------------------------------------------*/
diff --git a/drivers/staging/ft1000/ft1000-usb/ft1000_hw.c b/drivers/staging/ft1000/ft1000-usb/ft1000_hw.c
index 684e69e..97a2926 100644
--- a/drivers/staging/ft1000/ft1000-usb/ft1000_hw.c
+++ b/drivers/staging/ft1000/ft1000-usb/ft1000_hw.c
@@ -6,8 +6,6 @@
 //
 // $Id:
 //====================================================
-// 20090926; aelias; removed compiler warnings & errors; ubuntu 9.04; 2.6.28-15-generic
-
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -38,8 +36,6 @@
 static struct net_device_stats *ft1000_netdev_stats(struct net_device *dev);
 static int ft1000_chkcard (struct ft1000_device *dev);
 
-//Jim
-
 static u8 tempbuffer[1600];
 
 #define MAX_RCV_LOOP   100
@@ -492,8 +488,6 @@
 	commandbuf = (unsigned char *)kmalloc(size + 2, GFP_KERNEL);
 	memcpy((void *)commandbuf + 2, (void *)ptempbuffer, size);
 
-	//DEBUG("card_send_command: Command Send\n");
-
 	ft1000_read_register(ft1000dev, &temp, FT1000_REG_DOORBELL);
 
 	if (temp & 0x0100)
@@ -506,16 +500,14 @@
 	if (size % 4)
 		size += 4 - (size % 4);
 
-	//DEBUG("card_send_command: write dpram ... size=%d\n", size);
 	ft1000_write_dpram32(ft1000dev, 0, commandbuf, size);
 	msleep(1);
-	//DEBUG("card_send_command: write into doorbell ...\n");
 	ft1000_write_register(ft1000dev, FT1000_DB_DPRAM_TX,
 			      FT1000_REG_DOORBELL);
 	msleep(1);
 
 	ft1000_read_register(ft1000dev, &temp, FT1000_REG_DOORBELL);
-	//DEBUG("card_send_command: read doorbell ...temp=%x\n", temp);
+
 	if ((temp & 0x0100) == 0) {
 		//DEBUG("card_send_command: Message sent\n");
 	}
@@ -683,8 +675,6 @@
 	return TRUE;
 }
 
-
-//mbelian
 #ifdef HAVE_NET_DEVICE_OPS
 static const struct net_device_ops ftnet_ops =
 {
@@ -904,14 +894,10 @@
 
 	struct ft1000_device *ft1000dev = urb->context;
 
-    //DEBUG("ft1000_usb_transmit_complete entered\n");
-
 	if (urb->status)
 		pr_err("%s: TX status %d\n", ft1000dev->net->name, urb->status);
 
 	netif_wake_queue(ft1000dev->net);
-
-    //DEBUG("Return from ft1000_usb_transmit_complete\n");
 }
 
 //---------------------------------------------------------------------------
@@ -943,8 +929,6 @@
 		return -ENODEV;
 	}
 
-	//DEBUG("ft1000_copy_down_pkt() entered, len = %d\n", len);
-
 	count = sizeof(struct pseudo_hdr) + len;
 	if (count > MAX_BUF_SIZE) {
 		DEBUG("Error:ft1000_copy_down_pkt:Message Size Overflow!\n");
@@ -973,8 +957,6 @@
 
 	netif_stop_queue(netdev);
 
-	//DEBUG ("ft1000_copy_down_pkt: count = %d\n", count);
-
 	usb_fill_bulk_urb(pFt1000Dev->tx_urb,
 			  pFt1000Dev->dev,
 			  usb_sndbulkpipe(pFt1000Dev->dev,
@@ -983,11 +965,6 @@
 			  ft1000_usb_transmit_complete, (void *)pFt1000Dev);
 
 	t = (u8 *) pFt1000Dev->tx_urb->transfer_buffer;
-	//DEBUG("transfer_length=%d\n", pFt1000Dev->tx_urb->transfer_buffer_length);
-	/*for (i=0; i<count; i++ )
-	   {
-	   DEBUG("%x    ", *t++ );
-	   } */
 
 	ret = usb_submit_urb(pFt1000Dev->tx_urb, GFP_ATOMIC);
 
@@ -999,8 +976,6 @@
 		pInfo->stats.tx_bytes += (len + 14);
 	}
 
-	//DEBUG("ft1000_copy_down_pkt() exit\n");
-
 	return 0;
 }
 
@@ -1026,8 +1001,6 @@
 	u8 *pdata;
 	int maxlen, pipe;
 
-	//DEBUG(" ft1000_start_xmit() entered\n");
-
 	if (skb == NULL) {
 		DEBUG("ft1000_hw: ft1000_start_xmit:skb == NULL!!!\n");
 		return NETDEV_TX_OK;
@@ -1037,17 +1010,12 @@
 		DEBUG("network driver is closed, return\n");
 		goto err;
 	}
-	//DEBUG("ft1000_start_xmit 1:length of packet = %d\n", skb->len);
+
 	pipe =
 	    usb_sndbulkpipe(pFt1000Dev->dev, pFt1000Dev->bulk_out_endpointAddr);
 	maxlen = usb_maxpacket(pFt1000Dev->dev, pipe, usb_pipeout(pipe));
-	//DEBUG("ft1000_start_xmit 2: pipe=%d dev->maxpacket  = %d\n", pipe, maxlen);
 
 	pdata = (u8 *) skb->data;
-	/*for (i=0; i<skb->len; i++)
-	   DEBUG("skb->data[%d]=%x    ", i, *(skb->data+i));
-
-	   DEBUG("\n"); */
 
 	if (pInfo->mediastate == 0) {
 		/* Drop packet is mediastate is down */
@@ -1060,13 +1028,12 @@
 		DEBUG("ft1000_hw:ft1000_start_xmit:invalid ethernet length\n");
 		goto err;
 	}
-//mbelian
+
 	ft1000_copy_down_pkt(dev, (pdata + ENET_HEADER_SIZE - 2),
 			     skb->len - ENET_HEADER_SIZE + 2);
 
 err:
 	dev_kfree_skb(skb);
-	//DEBUG(" ft1000_start_xmit() exit\n");
 
 	return NETDEV_TX_OK;
 }
@@ -1093,24 +1060,20 @@
 
 	u16 tempword;
 	u16 len;
-	u16 lena;		//mbelian
+	u16 lena;
 	struct sk_buff *skb;
 	u16 i;
 	u8 *pbuffer = NULL;
 	u8 *ptemp = NULL;
 	u16 *chksum;
 
-	//DEBUG("ft1000_copy_up_pkt entered\n");
-
 	if (ft1000dev->status & FT1000_STATUS_CLOSING) {
 		DEBUG("network driver is closed, return\n");
 		return STATUS_SUCCESS;
 	}
 	// Read length
 	len = urb->transfer_buffer_length;
-	lena = urb->actual_length;	//mbelian
-	//DEBUG("ft1000_copy_up_pkt: transfer_buffer_length=%d, actual_buffer_len=%d\n",
-	//       urb->transfer_buffer_length, urb->actual_length);
+	lena = urb->actual_length;
 
 	chksum = (u16 *) ft1000dev->rx_buf;
 
@@ -1124,8 +1087,6 @@
 		return STATUS_FAILURE;
 	}
 
-	//DEBUG("ft1000_copy_up_pkt: checksum is correct %x\n", *chksum);
-
 	skb = dev_alloc_skb(len + 12 + 2);
 
 	if (skb == NULL) {
@@ -1157,12 +1118,6 @@
 	memcpy(pbuffer, ft1000dev->rx_buf + sizeof(struct pseudo_hdr),
 	       len - sizeof(struct pseudo_hdr));
 
-	//DEBUG("ft1000_copy_up_pkt: Data passed to Protocol layer\n");
-	/*for (i=0; i<len+12; i++)
-	   {
-	   DEBUG("ft1000_copy_up_pkt: Protocol Data: 0x%x\n ", *ptemp++);
-	   } */
-
 	skb->dev = net;
 
 	skb->protocol = eth_type_trans(skb, net);
@@ -1171,10 +1126,10 @@
 
 	info->stats.rx_packets++;
 	/* Add on 12 bytes for MAC address which was removed */
-	info->stats.rx_bytes += (lena + 12);	//mbelian
+	info->stats.rx_bytes += (lena + 12);
 
 	ft1000_submit_rx_urb(info);
-	//DEBUG("ft1000_copy_up_pkt exited\n");
+
 	return SUCCESS;
 }
 
@@ -1197,10 +1152,8 @@
 	int result;
 	struct ft1000_device *pFt1000Dev = info->pFt1000Dev;
 
-	//DEBUG ("ft1000_submit_rx_urb entered: sizeof rx_urb is %d\n", sizeof(*pFt1000Dev->rx_urb));
 	if (pFt1000Dev->status & FT1000_STATUS_CLOSING) {
 		DEBUG("network driver is closed, return\n");
-		//usb_kill_urb(pFt1000Dev->rx_urb); //mbelian
 		return -ENODEV;
 	}
 
@@ -1218,7 +1171,6 @@
 		       result);
 		return result;
 	}
-	//DEBUG("ft1000_submit_rx_urb exit: result=%d\n", result);
 
 	return 0;
 }
@@ -1241,23 +1193,22 @@
 static int ft1000_open(struct net_device *dev)
 {
 	struct ft1000_info *pInfo = netdev_priv(dev);
-	struct timeval tv;	//mbelian
+	struct timeval tv;
 	int ret;
 
 	DEBUG("ft1000_open is called for card %d\n", pInfo->CardNumber);
-	//DEBUG("ft1000_open: dev->addr=%x, dev->addr_len=%d\n", dev->addr, dev->addr_len);
 
-	pInfo->stats.rx_bytes = 0;	//mbelian
-	pInfo->stats.tx_bytes = 0;	//mbelian
-	pInfo->stats.rx_packets = 0;	//mbelian
-	pInfo->stats.tx_packets = 0;	//mbelian
+	pInfo->stats.rx_bytes = 0;
+	pInfo->stats.tx_bytes = 0;
+	pInfo->stats.rx_packets = 0;
+	pInfo->stats.tx_packets = 0;
 	do_gettimeofday(&tv);
 	pInfo->ConTm = tv.tv_sec;
-	pInfo->ProgConStat = 0;	//mbelian
+	pInfo->ProgConStat = 0;
 
 	netif_start_queue(dev);
 
-	netif_carrier_on(dev);	//mbelian
+	netif_carrier_on(dev);
 
 	ret = ft1000_submit_rx_urb(pInfo);
 
@@ -1283,19 +1234,14 @@
 	struct ft1000_info *pInfo = netdev_priv(net);
 	struct ft1000_device *ft1000dev = pInfo->pFt1000Dev;
 
-	//DEBUG ("ft1000_close: netdev->refcnt=%d\n", net->refcnt);
-
 	ft1000dev->status |= FT1000_STATUS_CLOSING;
 
-	//DEBUG("ft1000_close: calling usb_kill_urb \n");
-
 	DEBUG("ft1000_close: pInfo=%p, ft1000dev=%p\n", pInfo, ft1000dev);
-	netif_carrier_off(net);	//mbelian
+	netif_carrier_off(net);
 	netif_stop_queue(net);
-	//DEBUG("ft1000_close: netif_stop_queue called\n");
 	ft1000dev->status &= ~FT1000_STATUS_CLOSING;
 
-	pInfo->ProgConStat = 0xff;	//mbelian
+	pInfo->ProgConStat = 0xff;
 
 	return 0;
 }
@@ -1304,15 +1250,10 @@
 {
 	struct ft1000_info *info = netdev_priv(dev);
 
-	return &(info->stats); //mbelian
+	return &(info->stats);
 }
 
 
-/*********************************************************************************
-Jim
-*/
-
-
 //---------------------------------------------------------------------------
 //
 // Function:   ft1000_chkcard
@@ -1340,7 +1281,6 @@
 	 * set to zero.
 	 */
 	status = ft1000_read_register(dev, &tempword, FT1000_REG_SUP_IMASK);
-	//DEBUG("ft1000_hw:ft1000_chkcard: read FT1000_REG_SUP_IMASK = %x\n", tempword);
 	if (tempword == 0) {
 		DEBUG
 		    ("ft1000_hw:ft1000_chkcard: IMASK = 0 Card not detected\n");
@@ -1350,9 +1290,8 @@
 	 * if the device is not present.
 	 */
 	status = ft1000_read_register(dev, &tempword, FT1000_REG_ASIC_ID);
-	//DEBUG("ft1000_hw:ft1000_chkcard: read FT1000_REG_ASIC_ID = %x\n", tempword);
 	if (tempword != 0x1b01) {
-		dev->status |= FT1000_STATUS_CLOSING;	//mbelian
+		dev->status |= FT1000_STATUS_CLOSING;
 		DEBUG
 		    ("ft1000_hw:ft1000_chkcard: Version = 0xffff Card not detected\n");
 		return FALSE;
@@ -1395,7 +1334,6 @@
 				      FT1000_REG_DPRAM_ADDR);
 		ret =
 		    ft1000_read_register(dev, pbuffer, FT1000_REG_MAG_DPDATAH);
-		//DEBUG("ft1000_hw:received data = 0x%x\n", *pbuffer);
 		pbuffer++;
 		ft1000_write_register(dev, FT1000_DPRAM_MAG_RX_BASE + 1,
 				      FT1000_REG_DPRAM_ADDR);
@@ -1412,11 +1350,11 @@
 		/* copy odd aligned word */
 		ret =
 		    ft1000_read_register(dev, pbuffer, FT1000_REG_MAG_DPDATAL);
-		//DEBUG("ft1000_hw:received data = 0x%x\n", *pbuffer);
+
 		pbuffer++;
 		ret =
 		    ft1000_read_register(dev, pbuffer, FT1000_REG_MAG_DPDATAH);
-		//DEBUG("ft1000_hw:received data = 0x%x\n", *pbuffer);
+
 		pbuffer++;
 		if (size & 0x0001) {
 			/* copy odd byte from fifo */
@@ -1495,10 +1433,8 @@
 			ppseudo_hdr->portsrc = 0;
 			/* Calculate new checksum */
 			ppseudo_hdr->checksum = *pmsg++;
-			//DEBUG("checksum = 0x%x\n", ppseudo_hdr->checksum);
 			for (i = 1; i < 7; i++) {
 				ppseudo_hdr->checksum ^= *pmsg++;
-				//DEBUG("checksum = 0x%x\n", ppseudo_hdr->checksum);
 			}
 
 			TempShortBuf[0] = 0;
@@ -1582,21 +1518,16 @@
 					DEBUG("Media is up\n");
 					if (info->mediastate == 0) {
 						if (info->NetDevRegDone) {
-							//netif_carrier_on(dev->net);//mbelian
 							netif_wake_queue(dev->
 									 net);
 						}
 						info->mediastate = 1;
-						/*do_gettimeofday(&tv);
-						   info->ConTm = tv.tv_sec; *///mbelian
 					}
 				} else {
 					DEBUG("Media is down\n");
 					if (info->mediastate == 1) {
 						info->mediastate = 0;
 						if (info->NetDevRegDone) {
-							//netif_carrier_off(dev->net); mbelian
-							//netif_stop_queue(dev->net);
 						}
 						info->ConTm = 0;
 					}
@@ -1605,10 +1536,6 @@
 				DEBUG("Media is down\n");
 				if (info->mediastate == 1) {
 					info->mediastate = 0;
-					if (info->NetDevRegDone) {
-						//netif_carrier_off(dev->net); //mbelian
-						//netif_stop_queue(dev->net);
-					}
 					info->ConTm = 0;
 				}
 			}
@@ -1860,31 +1787,26 @@
 	struct pseudo_hdr *ppseudo_hdr;
     unsigned long flags;
 
-    //DEBUG("Enter ft1000_poll...\n");
     if (ft1000_chkcard(dev) == FALSE) {
         DEBUG("ft1000_poll::ft1000_chkcard: failed\n");
         return STATUS_FAILURE;
     }
 
     status = ft1000_read_register (dev, &tempword, FT1000_REG_DOORBELL);
-   // DEBUG("ft1000_poll: read FT1000_REG_DOORBELL message 0x%x\n", tempword);
 
     if ( !status )
     {
 
         if (tempword & FT1000_DB_DPRAM_RX) {
-            //DEBUG("ft1000_poll: FT1000_REG_DOORBELL message type:  FT1000_DB_DPRAM_RX\n");
 
             status = ft1000_read_dpram16(dev, 0x200, (u8 *)&data, 0);
-            //DEBUG("ft1000_poll:FT1000_DB_DPRAM_RX:ft1000_read_dpram16:size = 0x%x\n", data);
-            size = ntohs(data) + 16 + 2; //wai
+            size = ntohs(data) + 16 + 2;
             if (size % 4) {
                 modulo = 4 - (size % 4);
                 size = size + modulo;
             }
             status = ft1000_read_dpram16(dev, 0x201, (u8 *)&portid, 1);
             portid &= 0xff;
-            //DEBUG("ft1000_poll: FT1000_REG_DOORBELL message type: FT1000_DB_DPRAM_RX : portid 0x%x\n", portid);
 
             if (size < MAX_CMD_SQSIZE) {
                 switch (portid)
@@ -1899,13 +1821,11 @@
                     case DSPBCMSGID:
                         // This is a dsp broadcast message
                         // Check which application has registered for dsp broadcast messages
-                        //DEBUG("ft1000_poll: FT1000_REG_DOORBELL message type: FT1000_DB_DPRAM_RX : portid DSPBCMSGID\n");
 
     	    	        for (i=0; i<MAX_NUM_APP; i++) {
         	           if ( (info->app_info[i].DspBCMsgFlag) && (info->app_info[i].fileobject) &&
                                          (info->app_info[i].NumOfMsg < MAX_MSG_LIMIT)  )
 			   {
-			       //DEBUG("Dsp broadcast message detected for app id %d\n", i);
 			       nxtph = FT1000_DPRAM_RX_BASE + 2;
 			       pdpram_blk = ft1000_get_buffer (&freercvpool);
 			       if (pdpram_blk != NULL) {
@@ -1929,15 +1849,13 @@
                                else {
                                    DEBUG("Out of memory in free receive command pool\n");
                                    info->app_info[i].nRxMsgMiss++;
-                               }//endof if (pdpram_blk != NULL)
-                           }//endof if
-    		           //else
-    		           //    DEBUG("app_info mismatch\n");
-	                }// endof for
+                               }
+                           }
+	                }
                         break;
                     default:
                         pdpram_blk = ft1000_get_buffer (&freercvpool);
-                        //DEBUG("Memory allocated = 0x%8x\n", (u32)pdpram_blk);
+
                         if (pdpram_blk != NULL) {
                            if ( ft1000_receive_cmd(dev, pdpram_blk->pbuffer, MAX_CMD_SQSIZE, &nxtph) ) {
 				ppseudo_hdr = (struct pseudo_hdr *)pdpram_blk->pbuffer;
@@ -1961,11 +1879,8 @@
                                    else {
                                        info->app_info[i].nRxMsg++;
                                        // Put message into the appropriate application block
-                                       //pxu spin_lock_irqsave(&free_buff_lock, flags);
                                        list_add_tail(&pdpram_blk->list, &info->app_info[i].app_sqlist);
             			       info->app_info[i].NumOfMsg++;
-                                       //pxu spin_unlock_irqrestore(&free_buff_lock, flags);
-                                       //pxu wake_up_interruptible(&info->app_info[i].wait_dpram_msg);
                                    }
                                }
                            }
@@ -1978,15 +1893,14 @@
                             DEBUG("Out of memory in free receive command pool\n");
                         }
                         break;
-                } //end of switch
-            } //endof if (size < MAX_CMD_SQSIZE)
+                }
+            }
             else {
                 DEBUG("FT1000:dpc:Invalid total length for SlowQ = %d\n", size);
             }
             status = ft1000_write_register (dev, FT1000_DB_DPRAM_RX, FT1000_REG_DOORBELL);
         }
         else if (tempword & FT1000_DSP_ASIC_RESET) {
-            //DEBUG("ft1000_poll: FT1000_REG_DOORBELL message type:  FT1000_DSP_ASIC_RESET\n");
 
             // Let's reset the ASIC from the Host side as well
             status = ft1000_write_register (dev, ASIC_RESET_BIT, FT1000_REG_RESET);
@@ -2025,10 +1939,8 @@
         }
         else if (tempword & FT1000_DB_COND_RESET) {
             DEBUG("ft1000_poll: FT1000_REG_DOORBELL message type:  FT1000_DB_COND_RESET\n");
-//By Jim
-// Reset ASIC and DSP
-//MAG
-            if (info->fAppMsgPend == 0) {
+
+	    if (info->fAppMsgPend == 0) {
                // Reset ASIC and DSP
 
                 status    = ft1000_read_dpram16(dev, FT1000_MAG_DSP_TIMER0, (u8 *)&(info->DSP_TIME[0]), FT1000_MAG_DSP_TIMER0_INDX);
@@ -2048,11 +1960,8 @@
             ft1000_write_register(dev, FT1000_DB_COND_RESET, FT1000_REG_DOORBELL);
         }
 
-    }//endof if ( !status )
+    }
 
-    //DEBUG("return from ft1000_poll.\n");
     return STATUS_SUCCESS;
 
 }
-
-/*end of Jim*/
diff --git a/drivers/staging/gma500/Kconfig b/drivers/staging/gma500/Kconfig
index 5501eb9..ce8beda 100644
--- a/drivers/staging/gma500/Kconfig
+++ b/drivers/staging/gma500/Kconfig
@@ -1,6 +1,6 @@
 config DRM_PSB
 	tristate "Intel GMA500 KMS Framebuffer"
-	depends on DRM && PCI
+	depends on DRM && PCI && X86
 	select FB_CFB_COPYAREA
         select FB_CFB_FILLRECT
         select FB_CFB_IMAGEBLIT
diff --git a/drivers/staging/gma500/Makefile b/drivers/staging/gma500/Makefile
index a52ba48..e00557e4 100644
--- a/drivers/staging/gma500/Makefile
+++ b/drivers/staging/gma500/Makefile
@@ -15,17 +15,12 @@
 	  psb_intel_lvds.o \
 	  psb_intel_modes.o \
 	  psb_intel_sdvo.o \
-	  psb_reset.o \
-	  psb_sgx.o \
+	  psb_lid.o \
 	  psb_pvr_glue.o \
-	  psb_buffer.o \
-	  psb_fence.o \
 	  psb_mmu.o \
-	  psb_ttm_glue.o \
-	  psb_ttm_fence.o \
-	  psb_ttm_fence_user.o \
-	  psb_ttm_placement_user.o \
 	  psb_powermgmt.o \
-	  psb_irq.o
+	  psb_irq.o \
+	  mrst_crtc.o \
+	  mrst_lvds.o
 
 obj-$(CONFIG_DRM_PSB) += psb_gfx.o
diff --git a/drivers/staging/gma500/mrst.h b/drivers/staging/gma500/mrst.h
new file mode 100644
index 0000000..5e4aaeb
--- /dev/null
+++ b/drivers/staging/gma500/mrst.h
@@ -0,0 +1,217 @@
+/**************************************************************************
+ * Copyright (c) 2007-2011, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ **************************************************************************/
+
+/* MID device specific descriptors */
+
+struct mrst_vbt {
+	s8 signature[4];	/*4 bytes,"$GCT" */
+	u8 revision;
+	u8 size;
+	u8 checksum;
+	void *mrst_gct;
+} __attribute__ ((packed));
+
+struct mrst_timing_info {
+	u16 pixel_clock;
+	u8 hactive_lo;
+	u8 hblank_lo;
+	u8 hblank_hi:4;
+	u8 hactive_hi:4;
+	u8 vactive_lo;
+	u8 vblank_lo;
+	u8 vblank_hi:4;
+	u8 vactive_hi:4;
+	u8 hsync_offset_lo;
+	u8 hsync_pulse_width_lo;
+	u8 vsync_pulse_width_lo:4;
+	u8 vsync_offset_lo:4;
+	u8 vsync_pulse_width_hi:2;
+	u8 vsync_offset_hi:2;
+	u8 hsync_pulse_width_hi:2;
+	u8 hsync_offset_hi:2;
+	u8 width_mm_lo;
+	u8 height_mm_lo;
+	u8 height_mm_hi:4;
+	u8 width_mm_hi:4;
+	u8 hborder;
+	u8 vborder;
+	u8 unknown0:1;
+	u8 hsync_positive:1;
+	u8 vsync_positive:1;
+	u8 separate_sync:2;
+	u8 stereo:1;
+	u8 unknown6:1;
+	u8 interlaced:1;
+} __attribute__((packed));
+
+struct gct_r10_timing_info {
+	u16 pixel_clock;
+	u32 hactive_lo:8;
+	u32 hactive_hi:4;
+	u32 hblank_lo:8;
+	u32 hblank_hi:4;
+	u32 hsync_offset_lo:8;
+	u16 hsync_offset_hi:2;
+	u16 hsync_pulse_width_lo:8;
+	u16 hsync_pulse_width_hi:2;
+	u16 hsync_positive:1;
+	u16 rsvd_1:3;
+	u8  vactive_lo:8;
+	u16 vactive_hi:4;
+	u16 vblank_lo:8;
+	u16 vblank_hi:4;
+	u16 vsync_offset_lo:4;
+	u16 vsync_offset_hi:2;
+	u16 vsync_pulse_width_lo:4;
+	u16 vsync_pulse_width_hi:2;
+	u16 vsync_positive:1;
+	u16 rsvd_2:3;
+} __attribute__((packed));
+
+struct mrst_panel_descriptor_v1 {
+	u32 Panel_Port_Control; /* 1 dword, Register 0x61180 if LVDS */
+				/* 0x61190 if MIPI */
+	u32 Panel_Power_On_Sequencing;/*1 dword,Register 0x61208,*/
+	u32 Panel_Power_Off_Sequencing;/*1 dword,Register 0x6120C,*/
+	u32 Panel_Power_Cycle_Delay_and_Reference_Divisor;/* 1 dword */
+						/* Register 0x61210 */
+	struct mrst_timing_info DTD;/*18 bytes, Standard definition */
+	u16 Panel_Backlight_Inverter_Descriptor;/* 16 bits, as follows */
+				/* Bit 0, Frequency, 15 bits,0 - 32767Hz */
+			/* Bit 15, Polarity, 1 bit, 0: Normal, 1: Inverted */
+	u16 Panel_MIPI_Display_Descriptor;
+			/*16 bits, Defined as follows: */
+			/* if MIPI, 0x0000 if LVDS */
+			/* Bit 0, Type, 2 bits, */
+			/* 0: Type-1, */
+			/* 1: Type-2, */
+			/* 2: Type-3, */
+			/* 3: Type-4 */
+			/* Bit 2, Pixel Format, 4 bits */
+			/* Bit0: 16bpp (not supported in LNC), */
+			/* Bit1: 18bpp loosely packed, */
+			/* Bit2: 18bpp packed, */
+			/* Bit3: 24bpp */
+			/* Bit 6, Reserved, 2 bits, 00b */
+			/* Bit 8, Minimum Supported Frame Rate, 6 bits, 0 - 63Hz */
+			/* Bit 14, Reserved, 2 bits, 00b */
+} __attribute__ ((packed));
+
+struct mrst_panel_descriptor_v2 {
+	u32 Panel_Port_Control; /* 1 dword, Register 0x61180 if LVDS */
+				/* 0x61190 if MIPI */
+	u32 Panel_Power_On_Sequencing;/*1 dword,Register 0x61208,*/
+	u32 Panel_Power_Off_Sequencing;/*1 dword,Register 0x6120C,*/
+	u8 Panel_Power_Cycle_Delay_and_Reference_Divisor;/* 1 byte */
+						/* Register 0x61210 */
+	struct mrst_timing_info DTD;/*18 bytes, Standard definition */
+	u16 Panel_Backlight_Inverter_Descriptor;/*16 bits, as follows*/
+				/*Bit 0, Frequency, 16 bits, 0 - 32767Hz*/
+	u8 Panel_Initial_Brightness;/* [7:0] 0 - 100% */
+			/*Bit 7, Polarity, 1 bit,0: Normal, 1: Inverted*/
+	u16 Panel_MIPI_Display_Descriptor;
+			/*16 bits, Defined as follows: */
+			/* if MIPI, 0x0000 if LVDS */
+			/* Bit 0, Type, 2 bits, */
+			/* 0: Type-1, */
+			/* 1: Type-2, */
+			/* 2: Type-3, */
+			/* 3: Type-4 */
+			/* Bit 2, Pixel Format, 4 bits */
+			/* Bit0: 16bpp (not supported in LNC), */
+			/* Bit1: 18bpp loosely packed, */
+			/* Bit2: 18bpp packed, */
+			/* Bit3: 24bpp */
+			/* Bit 6, Reserved, 2 bits, 00b */
+			/* Bit 8, Minimum Supported Frame Rate, 6 bits, 0 - 63Hz */
+			/* Bit 14, Reserved, 2 bits, 00b */
+} __attribute__ ((packed));
+
+union mrst_panel_rx {
+	struct{
+		u16 NumberOfLanes:2; /*Num of Lanes, 2 bits,0 = 1 lane,*/
+			/* 1 = 2 lanes, 2 = 3 lanes, 3 = 4 lanes. */
+		u16 MaxLaneFreq:3; /* 0: 100MHz, 1: 200MHz, 2: 300MHz, */
+		/*3: 400MHz, 4: 500MHz, 5: 600MHz, 6: 700MHz, 7: 800MHz.*/
+		u16 SupportedVideoTransferMode:2; /*0: Non-burst only */
+					/* 1: Burst and non-burst */
+					/* 2/3: Reserved */
+		u16 HSClkBehavior:1; /*0: Continuous, 1: Non-continuous*/
+		u16 DuoDisplaySupport:1; /*1 bit,0: No, 1: Yes*/
+		u16 ECC_ChecksumCapabilities:1;/*1 bit,0: No, 1: Yes*/
+		u16 BidirectionalCommunication:1;/*1 bit,0: No, 1: Yes */
+		u16 Rsvd:5;/*5 bits,00000b */
+	} panelrx;
+	u16 panel_receiver;
+} __attribute__ ((packed));
+
+struct mrst_gct_v1 {
+	union{ /*8 bits,Defined as follows: */
+		struct {
+			u8 PanelType:4; /*4 bits, Bit field for panels*/
+					/* 0 - 3: 0 = LVDS, 1 = MIPI*/
+					/*2 bits,Specifies which of the*/
+			u8 BootPanelIndex:2;
+					/* 4 panels to use by default*/
+			u8 BootMIPI_DSI_RxIndex:2;/*Specifies which of*/
+					/* the 4 MIPI DSI receivers to use*/
+		} PD;
+		u8 PanelDescriptor;
+	};
+	struct mrst_panel_descriptor_v1 panel[4];/*panel descrs,38 bytes each*/
+	union mrst_panel_rx panelrx[4]; /* panel receivers*/
+} __attribute__ ((packed));
+
+struct mrst_gct_v2 {
+	union{ /*8 bits,Defined as follows: */
+		struct {
+			u8 PanelType:4; /*4 bits, Bit field for panels*/
+					/* 0 - 3: 0 = LVDS, 1 = MIPI*/
+					/*2 bits,Specifies which of the*/
+			u8 BootPanelIndex:2;
+					/* 4 panels to use by default*/
+			u8 BootMIPI_DSI_RxIndex:2;/*Specifies which of*/
+					/* the 4 MIPI DSI receivers to use*/
+		} PD;
+		u8 PanelDescriptor;
+	};
+	struct mrst_panel_descriptor_v2 panel[4];/*panel descrs,38 bytes each*/
+	union mrst_panel_rx panelrx[4]; /* panel receivers*/
+} __attribute__ ((packed));
+
+struct mrst_gct_data {
+	u8 bpi; /* boot panel index, number of panel used during boot */
+	u8 pt; /* panel type, 4 bit field, 0=lvds, 1=mipi */
+	struct mrst_timing_info DTD; /* timing info for the selected panel */
+	u32 Panel_Port_Control;
+	u32 PP_On_Sequencing;/*1 dword,Register 0x61208,*/
+	u32 PP_Off_Sequencing;/*1 dword,Register 0x6120C,*/
+	u32 PP_Cycle_Delay;
+	u16 Panel_Backlight_Inverter_Descriptor;
+	u16 Panel_MIPI_Display_Descriptor;
+} __attribute__ ((packed));
+
+#define MODE_SETTING_IN_CRTC 	0x1
+#define MODE_SETTING_IN_ENCODER 0x2
+#define MODE_SETTING_ON_GOING 	0x3
+#define MODE_SETTING_IN_DSR 	0x4
+#define MODE_SETTING_ENCODER_DONE 0x8
+#define GCT_R10_HEADER_SIZE	16
+#define GCT_R10_DISPLAY_DESC_SIZE	28
+
diff --git a/drivers/staging/gma500/mrst_crtc.c b/drivers/staging/gma500/mrst_crtc.c
new file mode 100644
index 0000000..664d0e7
--- /dev/null
+++ b/drivers/staging/gma500/mrst_crtc.c
@@ -0,0 +1,620 @@
+/*
+ * Copyright © 2009 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include <linux/i2c.h>
+#include <linux/pm_runtime.h>
+
+#include <drm/drmP.h>
+#include "psb_fb.h"
+#include "psb_drv.h"
+#include "psb_intel_drv.h"
+#include "psb_intel_reg.h"
+#include "psb_intel_display.h"
+#include "psb_powermgmt.h"
+
+struct psb_intel_range_t {
+	int min, max;
+};
+
+struct mrst_limit_t {
+	struct psb_intel_range_t dot, m, p1;
+};
+
+struct mrst_clock_t {
+	/* derived values */
+	int dot;
+	int m;
+	int p1;
+};
+
+#define MRST_LIMIT_LVDS_100L	    0
+#define MRST_LIMIT_LVDS_83	    1
+#define MRST_LIMIT_LVDS_100	    2
+
+#define MRST_DOT_MIN		  19750
+#define MRST_DOT_MAX		  120000
+#define MRST_M_MIN_100L		    20
+#define MRST_M_MIN_100		    10
+#define MRST_M_MIN_83		    12
+#define MRST_M_MAX_100L		    34
+#define MRST_M_MAX_100		    17
+#define MRST_M_MAX_83		    20
+#define MRST_P1_MIN		    2
+#define MRST_P1_MAX_0		    7
+#define MRST_P1_MAX_1		    8
+
+static const struct mrst_limit_t mrst_limits[] = {
+	{			/* MRST_LIMIT_LVDS_100L */
+	 .dot = {.min = MRST_DOT_MIN, .max = MRST_DOT_MAX},
+	 .m = {.min = MRST_M_MIN_100L, .max = MRST_M_MAX_100L},
+	 .p1 = {.min = MRST_P1_MIN, .max = MRST_P1_MAX_1},
+	 },
+	{			/* MRST_LIMIT_LVDS_83L */
+	 .dot = {.min = MRST_DOT_MIN, .max = MRST_DOT_MAX},
+	 .m = {.min = MRST_M_MIN_83, .max = MRST_M_MAX_83},
+	 .p1 = {.min = MRST_P1_MIN, .max = MRST_P1_MAX_0},
+	 },
+	{			/* MRST_LIMIT_LVDS_100 */
+	 .dot = {.min = MRST_DOT_MIN, .max = MRST_DOT_MAX},
+	 .m = {.min = MRST_M_MIN_100, .max = MRST_M_MAX_100},
+	 .p1 = {.min = MRST_P1_MIN, .max = MRST_P1_MAX_1},
+	 },
+};
+
+#define MRST_M_MIN	    10
+static const u32 mrst_m_converts[] = {
+	0x2B, 0x15, 0x2A, 0x35, 0x1A, 0x0D, 0x26, 0x33, 0x19, 0x2C,
+	0x36, 0x3B, 0x1D, 0x2E, 0x37, 0x1B, 0x2D, 0x16, 0x0B, 0x25,
+	0x12, 0x09, 0x24, 0x32, 0x39, 0x1c,
+};
+
+static const struct mrst_limit_t *mrst_limit(struct drm_crtc *crtc)
+{
+	const struct mrst_limit_t *limit = NULL;
+	struct drm_device *dev = crtc->dev;
+	DRM_DRIVER_PRIVATE_T *dev_priv = dev->dev_private;
+
+	if (psb_intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)
+	    || psb_intel_pipe_has_type(crtc, INTEL_OUTPUT_MIPI)) {
+		switch (dev_priv->core_freq) {
+		case 100:
+			limit = &mrst_limits[MRST_LIMIT_LVDS_100L];
+			break;
+		case 166:
+			limit = &mrst_limits[MRST_LIMIT_LVDS_83];
+			break;
+		case 200:
+			limit = &mrst_limits[MRST_LIMIT_LVDS_100];
+			break;
+		}
+	} else {
+		limit = NULL;
+		PSB_DEBUG_ENTRY("mrst_limit Wrong display type.\n");
+	}
+
+	return limit;
+}
+
+/** Derive the pixel clock for the given refclk and divisors for 8xx chips. */
+static void mrst_clock(int refclk, struct mrst_clock_t *clock)
+{
+	clock->dot = (refclk * clock->m) / (14 * clock->p1);
+}
+
+void mrstPrintPll(char *prefix, struct mrst_clock_t *clock)
+{
+	PSB_DEBUG_ENTRY("%s: dotclock = %d,  m = %d, p1 = %d.\n",
+	     prefix, clock->dot, clock->m, clock->p1);
+}
+
+/**
+ * Returns a set of divisors for the desired target clock with the given refclk,
+ * or FALSE.  Divisor values are the actual divisors for
+ */
+static bool
+mrstFindBestPLL(struct drm_crtc *crtc, int target, int refclk,
+		struct mrst_clock_t *best_clock)
+{
+	struct mrst_clock_t clock;
+	const struct mrst_limit_t *limit = mrst_limit(crtc);
+	int err = target;
+
+	memset(best_clock, 0, sizeof(*best_clock));
+
+	for (clock.m = limit->m.min; clock.m <= limit->m.max; clock.m++) {
+		for (clock.p1 = limit->p1.min; clock.p1 <= limit->p1.max;
+		     clock.p1++) {
+			int this_err;
+
+			mrst_clock(refclk, &clock);
+
+			this_err = abs(clock.dot - target);
+			if (this_err < err) {
+				*best_clock = clock;
+				err = this_err;
+			}
+		}
+	}
+	DRM_DEBUG("mrstFindBestPLL err = %d.\n", err);
+
+	return err != target;
+}
+
+/**
+ * Sets the power management mode of the pipe and plane.
+ *
+ * This code should probably grow support for turning the cursor off and back
+ * on appropriately at the same time as we're turning the pipe off/on.
+ */
+static void mrst_crtc_dpms(struct drm_crtc *crtc, int mode)
+{
+	struct drm_device *dev = crtc->dev;
+	struct psb_intel_crtc *psb_intel_crtc = to_psb_intel_crtc(crtc);
+	int pipe = psb_intel_crtc->pipe;
+	int dpll_reg = (pipe == 0) ? MRST_DPLL_A : DPLL_B;
+	int dspcntr_reg = (pipe == 0) ? DSPACNTR : DSPBCNTR;
+	int dspbase_reg = (pipe == 0) ? MRST_DSPABASE : DSPBBASE;
+	int pipeconf_reg = (pipe == 0) ? PIPEACONF : PIPEBCONF;
+	u32 temp;
+	bool enabled;
+
+	PSB_DEBUG_ENTRY("mode = %d, pipe = %d\n", mode, pipe);
+
+	if (!gma_power_begin(dev, true))
+		return;
+
+	/* XXX: When our outputs are all unaware of DPMS modes other than off
+	 * and on, we should map those modes to DRM_MODE_DPMS_OFF in the CRTC.
+	 */
+	switch (mode) {
+	case DRM_MODE_DPMS_ON:
+	case DRM_MODE_DPMS_STANDBY:
+	case DRM_MODE_DPMS_SUSPEND:
+		/* Enable the DPLL */
+		temp = REG_READ(dpll_reg);
+		if ((temp & DPLL_VCO_ENABLE) == 0) {
+			REG_WRITE(dpll_reg, temp);
+			REG_READ(dpll_reg);
+			/* Wait for the clocks to stabilize. */
+			udelay(150);
+			REG_WRITE(dpll_reg, temp | DPLL_VCO_ENABLE);
+			REG_READ(dpll_reg);
+			/* Wait for the clocks to stabilize. */
+			udelay(150);
+			REG_WRITE(dpll_reg, temp | DPLL_VCO_ENABLE);
+			REG_READ(dpll_reg);
+			/* Wait for the clocks to stabilize. */
+			udelay(150);
+		}
+		/* Enable the pipe */
+		temp = REG_READ(pipeconf_reg);
+		if ((temp & PIPEACONF_ENABLE) == 0)
+			REG_WRITE(pipeconf_reg, temp | PIPEACONF_ENABLE);
+		/* Enable the plane */
+		temp = REG_READ(dspcntr_reg);
+		if ((temp & DISPLAY_PLANE_ENABLE) == 0) {
+			REG_WRITE(dspcntr_reg,
+				  temp | DISPLAY_PLANE_ENABLE);
+			/* Flush the plane changes */
+			REG_WRITE(dspbase_reg, REG_READ(dspbase_reg));
+		}
+
+		psb_intel_crtc_load_lut(crtc);
+
+		/* Give the overlay scaler a chance to enable
+		   if it's on this pipe */
+		/* psb_intel_crtc_dpms_video(crtc, true); TODO */
+		break;
+	case DRM_MODE_DPMS_OFF:
+		/* Give the overlay scaler a chance to disable
+		 * if it's on this pipe */
+		/* psb_intel_crtc_dpms_video(crtc, FALSE); TODO */
+
+		/* Disable the VGA plane that we never use */
+		REG_WRITE(VGACNTRL, VGA_DISP_DISABLE);
+		/* Disable display plane */
+		temp = REG_READ(dspcntr_reg);
+		if ((temp & DISPLAY_PLANE_ENABLE) != 0) {
+			REG_WRITE(dspcntr_reg,
+				  temp & ~DISPLAY_PLANE_ENABLE);
+			/* Flush the plane changes */
+			REG_WRITE(dspbase_reg, REG_READ(dspbase_reg));
+			REG_READ(dspbase_reg);
+		}
+
+		/* Next, disable display pipes */
+		temp = REG_READ(pipeconf_reg);
+		if ((temp & PIPEACONF_ENABLE) != 0) {
+			REG_WRITE(pipeconf_reg, temp & ~PIPEACONF_ENABLE);
+			REG_READ(pipeconf_reg);
+		}
+		/* Wait for for the pipe disable to take effect. */
+		psb_intel_wait_for_vblank(dev);
+
+		temp = REG_READ(dpll_reg);
+		if ((temp & DPLL_VCO_ENABLE) != 0) {
+			REG_WRITE(dpll_reg, temp & ~DPLL_VCO_ENABLE);
+			REG_READ(dpll_reg);
+		}
+
+		/* Wait for the clocks to turn off. */
+		udelay(150);
+		break;
+	}
+
+	enabled = crtc->enabled && mode != DRM_MODE_DPMS_OFF;
+
+	/*Set FIFO Watermarks*/
+	REG_WRITE(DSPARB, 0x3FFF);
+	REG_WRITE(DSPFW1, 0x3F88080A);
+	REG_WRITE(DSPFW2, 0x0b060808);
+	REG_WRITE(DSPFW3, 0x0);
+	REG_WRITE(DSPFW4, 0x08030404);
+	REG_WRITE(DSPFW5, 0x04040404);
+	REG_WRITE(DSPFW6, 0x78);
+	REG_WRITE(0x70400, REG_READ(0x70400) | 0x4000);
+	/* Must write Bit 14 of the Chicken Bit Register */
+
+	gma_power_end(dev);
+}
+
+/**
+ * Return the pipe currently connected to the panel fitter,
+ * or -1 if the panel fitter is not present or not in use
+ */
+static int mrst_panel_fitter_pipe(struct drm_device *dev)
+{
+	u32 pfit_control;
+
+	pfit_control = REG_READ(PFIT_CONTROL);
+
+	/* See if the panel fitter is in use */
+	if ((pfit_control & PFIT_ENABLE) == 0)
+		return -1;
+	return (pfit_control >> 29) & 3;
+}
+
+static int mrst_crtc_mode_set(struct drm_crtc *crtc,
+			      struct drm_display_mode *mode,
+			      struct drm_display_mode *adjusted_mode,
+			      int x, int y,
+			      struct drm_framebuffer *old_fb)
+{
+	struct drm_device *dev = crtc->dev;
+	struct psb_intel_crtc *psb_intel_crtc = to_psb_intel_crtc(crtc);
+	DRM_DRIVER_PRIVATE_T *dev_priv = dev->dev_private;
+	int pipe = psb_intel_crtc->pipe;
+	int fp_reg = (pipe == 0) ? MRST_FPA0 : FPB0;
+	int dpll_reg = (pipe == 0) ? MRST_DPLL_A : DPLL_B;
+	int dspcntr_reg = (pipe == 0) ? DSPACNTR : DSPBCNTR;
+	int pipeconf_reg = (pipe == 0) ? PIPEACONF : PIPEBCONF;
+	int htot_reg = (pipe == 0) ? HTOTAL_A : HTOTAL_B;
+	int hblank_reg = (pipe == 0) ? HBLANK_A : HBLANK_B;
+	int hsync_reg = (pipe == 0) ? HSYNC_A : HSYNC_B;
+	int vtot_reg = (pipe == 0) ? VTOTAL_A : VTOTAL_B;
+	int vblank_reg = (pipe == 0) ? VBLANK_A : VBLANK_B;
+	int vsync_reg = (pipe == 0) ? VSYNC_A : VSYNC_B;
+	int pipesrc_reg = (pipe == 0) ? PIPEASRC : PIPEBSRC;
+	int refclk = 0;
+	struct mrst_clock_t clock;
+	u32 dpll = 0, fp = 0, dspcntr, pipeconf;
+	bool ok, is_sdvo = false;
+	bool is_crt = false, is_lvds = false, is_tv = false;
+	bool is_mipi = false;
+	struct drm_mode_config *mode_config = &dev->mode_config;
+	struct psb_intel_output *psb_intel_output = NULL;
+	uint64_t scalingType = DRM_MODE_SCALE_FULLSCREEN;
+	struct drm_encoder *encoder;
+
+	PSB_DEBUG_ENTRY("pipe = 0x%x\n", pipe);
+
+	if (!gma_power_begin(dev, true))
+		return 0;
+
+	memcpy(&psb_intel_crtc->saved_mode,
+		mode,
+		sizeof(struct drm_display_mode));
+	memcpy(&psb_intel_crtc->saved_adjusted_mode,
+		adjusted_mode,
+		sizeof(struct drm_display_mode));
+
+	list_for_each_entry(encoder, &mode_config->encoder_list, head) {
+
+		if (encoder->crtc != crtc)
+			continue;
+
+		psb_intel_output = enc_to_psb_intel_output(encoder);
+		switch (psb_intel_output->type) {
+		case INTEL_OUTPUT_LVDS:
+			is_lvds = true;
+			break;
+		case INTEL_OUTPUT_SDVO:
+			is_sdvo = true;
+			break;
+		case INTEL_OUTPUT_TVOUT:
+			is_tv = true;
+			break;
+		case INTEL_OUTPUT_ANALOG:
+			is_crt = true;
+			break;
+		case INTEL_OUTPUT_MIPI:
+			is_mipi = true;
+			break;
+		}
+	}
+
+	/* Disable the VGA plane that we never use */
+	REG_WRITE(VGACNTRL, VGA_DISP_DISABLE);
+
+	/* Disable the panel fitter if it was on our pipe */
+	if (mrst_panel_fitter_pipe(dev) == pipe)
+		REG_WRITE(PFIT_CONTROL, 0);
+
+	REG_WRITE(pipesrc_reg,
+		  ((mode->crtc_hdisplay - 1) << 16) |
+		  (mode->crtc_vdisplay - 1));
+
+	if (psb_intel_output)
+		drm_connector_property_get_value(&psb_intel_output->base,
+			dev->mode_config.scaling_mode_property, &scalingType);
+
+	if (scalingType == DRM_MODE_SCALE_NO_SCALE) {
+		/* Moorestown doesn't have register support for centering so
+		 * we need to mess with the h/vblank and h/vsync start and
+		 * ends to get centering */
+		int offsetX = 0, offsetY = 0;
+
+		offsetX = (adjusted_mode->crtc_hdisplay -
+			   mode->crtc_hdisplay) / 2;
+		offsetY = (adjusted_mode->crtc_vdisplay -
+			   mode->crtc_vdisplay) / 2;
+
+		REG_WRITE(htot_reg, (mode->crtc_hdisplay - 1) |
+			((adjusted_mode->crtc_htotal - 1) << 16));
+		REG_WRITE(vtot_reg, (mode->crtc_vdisplay - 1) |
+			((adjusted_mode->crtc_vtotal - 1) << 16));
+		REG_WRITE(hblank_reg,
+			(adjusted_mode->crtc_hblank_start - offsetX - 1) |
+			((adjusted_mode->crtc_hblank_end - offsetX - 1) << 16));
+		REG_WRITE(hsync_reg,
+			(adjusted_mode->crtc_hsync_start - offsetX - 1) |
+			((adjusted_mode->crtc_hsync_end - offsetX - 1) << 16));
+		REG_WRITE(vblank_reg,
+			(adjusted_mode->crtc_vblank_start - offsetY - 1) |
+			((adjusted_mode->crtc_vblank_end - offsetY - 1) << 16));
+		REG_WRITE(vsync_reg,
+			(adjusted_mode->crtc_vsync_start - offsetY - 1) |
+			((adjusted_mode->crtc_vsync_end - offsetY - 1) << 16));
+	} else {
+		REG_WRITE(htot_reg, (adjusted_mode->crtc_hdisplay - 1) |
+			((adjusted_mode->crtc_htotal - 1) << 16));
+		REG_WRITE(vtot_reg, (adjusted_mode->crtc_vdisplay - 1) |
+			((adjusted_mode->crtc_vtotal - 1) << 16));
+		REG_WRITE(hblank_reg, (adjusted_mode->crtc_hblank_start - 1) |
+			((adjusted_mode->crtc_hblank_end - 1) << 16));
+		REG_WRITE(hsync_reg, (adjusted_mode->crtc_hsync_start - 1) |
+			((adjusted_mode->crtc_hsync_end - 1) << 16));
+		REG_WRITE(vblank_reg, (adjusted_mode->crtc_vblank_start - 1) |
+			((adjusted_mode->crtc_vblank_end - 1) << 16));
+		REG_WRITE(vsync_reg, (adjusted_mode->crtc_vsync_start - 1) |
+			((adjusted_mode->crtc_vsync_end - 1) << 16));
+	}
+
+	/* Flush the plane changes */
+	{
+		struct drm_crtc_helper_funcs *crtc_funcs =
+		    crtc->helper_private;
+		crtc_funcs->mode_set_base(crtc, x, y, old_fb);
+	}
+
+	/* setup pipeconf */
+	pipeconf = REG_READ(pipeconf_reg);
+
+	/* Set up the display plane register */
+	dspcntr = REG_READ(dspcntr_reg);
+	dspcntr |= DISPPLANE_GAMMA_ENABLE;
+
+	if (pipe == 0)
+		dspcntr |= DISPPLANE_SEL_PIPE_A;
+	else
+		dspcntr |= DISPPLANE_SEL_PIPE_B;
+
+	dev_priv->dspcntr = dspcntr |= DISPLAY_PLANE_ENABLE;
+	dev_priv->pipeconf = pipeconf |= PIPEACONF_ENABLE;
+
+	if (is_mipi)
+		goto mrst_crtc_mode_set_exit;
+
+	refclk = dev_priv->core_freq * 1000;
+
+	dpll = 0;		/*BIT16 = 0 for 100MHz reference */
+
+	ok = mrstFindBestPLL(crtc, adjusted_mode->clock, refclk, &clock);
+
+	if (!ok) {
+		PSB_DEBUG_ENTRY(
+			"mrstFindBestPLL fail in mrst_crtc_mode_set.\n");
+	} else {
+		PSB_DEBUG_ENTRY("mrst_crtc_mode_set pixel clock = %d,"
+			 "m = %x, p1 = %x.\n", clock.dot, clock.m,
+			 clock.p1);
+	}
+
+	fp = mrst_m_converts[(clock.m - MRST_M_MIN)] << 8;
+
+	dpll |= DPLL_VGA_MODE_DIS;
+
+
+	dpll |= DPLL_VCO_ENABLE;
+
+	if (is_lvds)
+		dpll |= DPLLA_MODE_LVDS;
+	else
+		dpll |= DPLLB_MODE_DAC_SERIAL;
+
+	if (is_sdvo) {
+		int sdvo_pixel_multiply =
+		    adjusted_mode->clock / mode->clock;
+
+		dpll |= DPLL_DVO_HIGH_SPEED;
+		dpll |=
+		    (sdvo_pixel_multiply -
+		     1) << SDVO_MULTIPLIER_SHIFT_HIRES;
+	}
+
+
+	/* compute bitmask from p1 value */
+	dpll |= (1 << (clock.p1 - 2)) << 17;
+
+	dpll |= DPLL_VCO_ENABLE;
+
+	mrstPrintPll("chosen", &clock);
+
+	if (dpll & DPLL_VCO_ENABLE) {
+		REG_WRITE(fp_reg, fp);
+		REG_WRITE(dpll_reg, dpll & ~DPLL_VCO_ENABLE);
+		REG_READ(dpll_reg);
+		/* Check the DPLLA lock bit PIPEACONF[29] */
+		udelay(150);
+	}
+
+	REG_WRITE(fp_reg, fp);
+	REG_WRITE(dpll_reg, dpll);
+	REG_READ(dpll_reg);
+	/* Wait for the clocks to stabilize. */
+	udelay(150);
+
+	/* write it again -- the BIOS does, after all */
+	REG_WRITE(dpll_reg, dpll);
+	REG_READ(dpll_reg);
+	/* Wait for the clocks to stabilize. */
+	udelay(150);
+
+	REG_WRITE(pipeconf_reg, pipeconf);
+	REG_READ(pipeconf_reg);
+	psb_intel_wait_for_vblank(dev);
+
+	REG_WRITE(dspcntr_reg, dspcntr);
+	psb_intel_wait_for_vblank(dev);
+
+mrst_crtc_mode_set_exit:
+	gma_power_end(dev);
+	return 0;
+}
+
+static bool mrst_crtc_mode_fixup(struct drm_crtc *crtc,
+				  struct drm_display_mode *mode,
+				  struct drm_display_mode *adjusted_mode)
+{
+	return true;
+}
+
+int mrst_pipe_set_base(struct drm_crtc *crtc,
+			    int x, int y, struct drm_framebuffer *old_fb)
+{
+	struct drm_device *dev = crtc->dev;
+	/* struct drm_i915_master_private *master_priv; */
+	struct psb_intel_crtc *psb_intel_crtc = to_psb_intel_crtc(crtc);
+	struct psb_framebuffer *psbfb = to_psb_fb(crtc->fb);
+	struct psb_intel_mode_device *mode_dev = psb_intel_crtc->mode_dev;
+	int pipe = psb_intel_crtc->pipe;
+	unsigned long Start, Offset;
+	/* FIXME: check if we need this surely MRST is pipe 0 only */
+	int dspbase = (pipe == 0 ? DSPALINOFF : DSPBBASE);
+	int dspsurf = (pipe == 0 ? DSPASURF : DSPBSURF);
+	int dspstride = (pipe == 0) ? DSPASTRIDE : DSPBSTRIDE;
+	int dspcntr_reg = (pipe == 0) ? DSPACNTR : DSPBCNTR;
+	u32 dspcntr;
+	int ret = 0;
+
+	PSB_DEBUG_ENTRY("\n");
+
+	/* no fb bound */
+	if (!crtc->fb) {
+		DRM_DEBUG("No FB bound\n");
+		return 0;
+	}
+
+	if (!gma_power_begin(dev, true))
+		return 0;
+
+	Start = mode_dev->bo_offset(dev, psbfb);
+	Offset = y * crtc->fb->pitch + x * (crtc->fb->bits_per_pixel / 8);
+
+	REG_WRITE(dspstride, crtc->fb->pitch);
+
+	dspcntr = REG_READ(dspcntr_reg);
+	dspcntr &= ~DISPPLANE_PIXFORMAT_MASK;
+
+	switch (crtc->fb->bits_per_pixel) {
+	case 8:
+		dspcntr |= DISPPLANE_8BPP;
+		break;
+	case 16:
+		if (crtc->fb->depth == 15)
+			dspcntr |= DISPPLANE_15_16BPP;
+		else
+			dspcntr |= DISPPLANE_16BPP;
+		break;
+	case 24:
+	case 32:
+		dspcntr |= DISPPLANE_32BPP_NO_ALPHA;
+		break;
+	default:
+		DRM_ERROR("Unknown color depth\n");
+		ret = -EINVAL;
+		goto pipe_set_base_exit;
+	}
+	REG_WRITE(dspcntr_reg, dspcntr);
+
+	DRM_DEBUG("Writing base %08lX %08lX %d %d\n", Start, Offset, x, y);
+	if (0 /* FIXMEAC - check what PSB needs */) {
+		REG_WRITE(dspbase, Offset);
+		REG_READ(dspbase);
+		REG_WRITE(dspsurf, Start);
+		REG_READ(dspsurf);
+	} else {
+		REG_WRITE(dspbase, Start + Offset);
+		REG_READ(dspbase);
+	}
+
+pipe_set_base_exit:
+	gma_power_end(dev);
+	return ret;
+}
+
+static void mrst_crtc_prepare(struct drm_crtc *crtc)
+{
+	struct drm_crtc_helper_funcs *crtc_funcs = crtc->helper_private;
+	crtc_funcs->dpms(crtc, DRM_MODE_DPMS_OFF);
+}
+
+static void mrst_crtc_commit(struct drm_crtc *crtc)
+{
+	struct drm_crtc_helper_funcs *crtc_funcs = crtc->helper_private;
+	crtc_funcs->dpms(crtc, DRM_MODE_DPMS_ON);
+}
+
+const struct drm_crtc_helper_funcs mrst_helper_funcs = {
+	.dpms = mrst_crtc_dpms,
+	.mode_fixup = mrst_crtc_mode_fixup,
+	.mode_set = mrst_crtc_mode_set,
+	.mode_set_base = mrst_pipe_set_base,
+	.prepare = mrst_crtc_prepare,
+	.commit = mrst_crtc_commit,
+};
+
diff --git a/drivers/staging/gma500/mrst_lvds.c b/drivers/staging/gma500/mrst_lvds.c
new file mode 100644
index 0000000..4a08b74
--- /dev/null
+++ b/drivers/staging/gma500/mrst_lvds.c
@@ -0,0 +1,371 @@
+/*
+ * Copyright © 2006-2009 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Authors:
+ *	Eric Anholt <eric@anholt.net>
+ *	Dave Airlie <airlied@linux.ie>
+ *	Jesse Barnes <jesse.barnes@intel.com>
+ */
+
+#include <linux/i2c.h>
+#include <drm/drmP.h>
+#include <asm/mrst.h>
+
+#include "psb_intel_bios.h"
+#include "psb_drv.h"
+#include "psb_intel_drv.h"
+#include "psb_intel_reg.h"
+#include "psb_powermgmt.h"
+#include <linux/pm_runtime.h>
+
+/* The max/min PWM frequency in BPCR[31:17] - */
+/* The smallest number is 1 (not 0) that can fit in the
+ * 15-bit field of the and then*/
+/* shifts to the left by one bit to get the actual 16-bit
+ * value that the 15-bits correspond to.*/
+#define MRST_BLC_MAX_PWM_REG_FREQ	    0xFFFF
+#define BRIGHTNESS_MAX_LEVEL 100
+
+/**
+ * Sets the power state for the panel.
+ */
+static void mrst_lvds_set_power(struct drm_device *dev,
+				struct psb_intel_output *output, bool on)
+{
+	u32 pp_status;
+	DRM_DRIVER_PRIVATE_T *dev_priv = dev->dev_private;
+	PSB_DEBUG_ENTRY("\n");
+
+	if (!gma_power_begin(dev, true))
+		return;
+
+	if (on) {
+		REG_WRITE(PP_CONTROL, REG_READ(PP_CONTROL) |
+			  POWER_TARGET_ON);
+		do {
+			pp_status = REG_READ(PP_STATUS);
+		} while ((pp_status & (PP_ON | PP_READY)) == PP_READY);
+		dev_priv->is_lvds_on = true;
+	} else {
+		REG_WRITE(PP_CONTROL, REG_READ(PP_CONTROL) &
+			  ~POWER_TARGET_ON);
+		do {
+			pp_status = REG_READ(PP_STATUS);
+		} while (pp_status & PP_ON);
+		dev_priv->is_lvds_on = false;
+		pm_request_idle(&dev->pdev->dev);
+	}
+
+	gma_power_end(dev);
+}
+
+static void mrst_lvds_dpms(struct drm_encoder *encoder, int mode)
+{
+	struct drm_device *dev = encoder->dev;
+	struct psb_intel_output *output = enc_to_psb_intel_output(encoder);
+
+	PSB_DEBUG_ENTRY("\n");
+
+	if (mode == DRM_MODE_DPMS_ON)
+		mrst_lvds_set_power(dev, output, true);
+	else
+		mrst_lvds_set_power(dev, output, false);
+
+	/* XXX: We never power down the LVDS pairs. */
+}
+
+static void mrst_lvds_mode_set(struct drm_encoder *encoder,
+			       struct drm_display_mode *mode,
+			       struct drm_display_mode *adjusted_mode)
+{
+	struct psb_intel_mode_device *mode_dev =
+				enc_to_psb_intel_output(encoder)->mode_dev;
+	struct drm_device *dev = encoder->dev;
+	u32 lvds_port;
+	uint64_t v = DRM_MODE_SCALE_FULLSCREEN;
+
+	PSB_DEBUG_ENTRY("\n");
+
+	if (!gma_power_begin(dev, true))
+		return;
+
+	/*
+	 * The LVDS pin pair will already have been turned on in the
+	 * psb_intel_crtc_mode_set since it has a large impact on the DPLL
+	 * settings.
+	 */
+	lvds_port = (REG_READ(LVDS) &
+		    (~LVDS_PIPEB_SELECT)) |
+		    LVDS_PORT_EN |
+		    LVDS_BORDER_EN;
+
+	if (mode_dev->panel_wants_dither)
+		lvds_port |= MRST_PANEL_8TO6_DITHER_ENABLE;
+
+	REG_WRITE(LVDS, lvds_port);
+
+	drm_connector_property_get_value(
+		&enc_to_psb_intel_output(encoder)->base,
+		dev->mode_config.scaling_mode_property,
+		&v);
+
+	if (v == DRM_MODE_SCALE_NO_SCALE)
+		REG_WRITE(PFIT_CONTROL, 0);
+	else if (v == DRM_MODE_SCALE_ASPECT) {
+		if ((mode->vdisplay != adjusted_mode->crtc_vdisplay) ||
+		    (mode->hdisplay != adjusted_mode->crtc_hdisplay)) {
+			if ((adjusted_mode->crtc_hdisplay * mode->vdisplay) ==
+			    (mode->hdisplay * adjusted_mode->crtc_vdisplay))
+				REG_WRITE(PFIT_CONTROL, PFIT_ENABLE);
+			else if ((adjusted_mode->crtc_hdisplay *
+				mode->vdisplay) > (mode->hdisplay *
+				adjusted_mode->crtc_vdisplay))
+				REG_WRITE(PFIT_CONTROL, PFIT_ENABLE |
+					  PFIT_SCALING_MODE_PILLARBOX);
+			else
+				REG_WRITE(PFIT_CONTROL, PFIT_ENABLE |
+					  PFIT_SCALING_MODE_LETTERBOX);
+		} else
+			REG_WRITE(PFIT_CONTROL, PFIT_ENABLE);
+	} else /*(v == DRM_MODE_SCALE_FULLSCREEN)*/
+		REG_WRITE(PFIT_CONTROL, PFIT_ENABLE);
+
+	gma_power_end(dev);
+}
+
+
+static const struct drm_encoder_helper_funcs mrst_lvds_helper_funcs = {
+	.dpms = mrst_lvds_dpms,
+	.mode_fixup = psb_intel_lvds_mode_fixup,
+	.prepare = psb_intel_lvds_prepare,
+	.mode_set = mrst_lvds_mode_set,
+	.commit = psb_intel_lvds_commit,
+};
+
+static struct drm_display_mode lvds_configuration_modes[] = {
+	/* hard coded fixed mode for TPO LTPS LPJ040K001A */
+	{ DRM_MODE("800x480",  DRM_MODE_TYPE_DRIVER, 33264, 800, 836,
+		   846, 1056, 0, 480, 489, 491, 525, 0, 0) },
+	/* hard coded fixed mode for LVDS 800x480 */
+	{ DRM_MODE("800x480",  DRM_MODE_TYPE_DRIVER, 30994, 800, 801,
+		   802, 1024, 0, 480, 481, 482, 525, 0, 0) },
+	/* hard coded fixed mode for Samsung 480wsvga LVDS 1024x600@75 */
+	{ DRM_MODE("1024x600", DRM_MODE_TYPE_DRIVER, 53990, 1024, 1072,
+		   1104, 1184, 0, 600, 603, 604, 608, 0, 0) },
+	/* hard coded fixed mode for Samsung 480wsvga LVDS 1024x600@75 */
+	{ DRM_MODE("1024x600", DRM_MODE_TYPE_DRIVER, 53990, 1024, 1104,
+		   1136, 1184, 0, 600, 603, 604, 608, 0, 0) },
+	/* hard coded fixed mode for Sharp wsvga LVDS 1024x600 */
+	{ DRM_MODE("1024x600", DRM_MODE_TYPE_DRIVER, 48885, 1024, 1124,
+		   1204, 1312, 0, 600, 607, 610, 621, 0, 0) },
+	/* hard coded fixed mode for LVDS 1024x768 */
+	{ DRM_MODE("1024x768", DRM_MODE_TYPE_DRIVER, 65000, 1024, 1048,
+		   1184, 1344, 0, 768, 771, 777, 806, 0, 0) },
+	/* hard coded fixed mode for LVDS 1366x768 */
+	{ DRM_MODE("1366x768", DRM_MODE_TYPE_DRIVER, 77500, 1366, 1430,
+		   1558, 1664, 0, 768, 769, 770, 776, 0, 0) },
+};
+
+/* Returns the panel fixed mode from configuration. */
+
+static struct drm_display_mode *
+mrst_lvds_get_configuration_mode(struct drm_device *dev)
+{
+	struct drm_display_mode *mode = NULL;
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	struct mrst_timing_info *ti = &dev_priv->gct_data.DTD;
+
+	if (dev_priv->vbt_data.size != 0x00) { /*if non-zero, then use vbt*/
+		mode = kzalloc(sizeof(*mode), GFP_KERNEL);
+		if (!mode)
+			return NULL;
+
+		mode->hdisplay = (ti->hactive_hi << 8) | ti->hactive_lo;
+		mode->vdisplay = (ti->vactive_hi << 8) | ti->vactive_lo;
+		mode->hsync_start = mode->hdisplay + \
+				((ti->hsync_offset_hi << 8) | \
+				ti->hsync_offset_lo);
+		mode->hsync_end = mode->hsync_start + \
+				((ti->hsync_pulse_width_hi << 8) | \
+				ti->hsync_pulse_width_lo);
+		mode->htotal = mode->hdisplay + ((ti->hblank_hi << 8) | \
+							ti->hblank_lo);
+		mode->vsync_start = \
+			mode->vdisplay + ((ti->vsync_offset_hi << 4) | \
+						ti->vsync_offset_lo);
+		mode->vsync_end = \
+			mode->vsync_start + ((ti->vsync_pulse_width_hi << 4) | \
+						ti->vsync_pulse_width_lo);
+		mode->vtotal = mode->vdisplay + \
+				((ti->vblank_hi << 8) | ti->vblank_lo);
+		mode->clock = ti->pixel_clock * 10;
+#if 0
+		printk(KERN_INFO "hdisplay is %d\n", mode->hdisplay);
+		printk(KERN_INFO "vdisplay is %d\n", mode->vdisplay);
+		printk(KERN_INFO "HSS is %d\n", mode->hsync_start);
+		printk(KERN_INFO "HSE is %d\n", mode->hsync_end);
+		printk(KERN_INFO "htotal is %d\n", mode->htotal);
+		printk(KERN_INFO "VSS is %d\n", mode->vsync_start);
+		printk(KERN_INFO "VSE is %d\n", mode->vsync_end);
+		printk(KERN_INFO "vtotal is %d\n", mode->vtotal);
+		printk(KERN_INFO "clock is %d\n", mode->clock);
+#endif
+	} else
+		mode = drm_mode_duplicate(dev, &lvds_configuration_modes[2]);
+
+	drm_mode_set_name(mode);
+	drm_mode_set_crtcinfo(mode, 0);
+
+	return mode;
+}
+
+/**
+ * mrst_lvds_init - setup LVDS connectors on this device
+ * @dev: drm device
+ *
+ * Create the connector, register the LVDS DDC bus, and try to figure out what
+ * modes we can display on the LVDS panel (if present).
+ */
+void mrst_lvds_init(struct drm_device *dev,
+		    struct psb_intel_mode_device *mode_dev)
+{
+	struct psb_intel_output *psb_intel_output;
+	struct drm_connector *connector;
+	struct drm_encoder *encoder;
+	struct drm_psb_private *dev_priv =
+				(struct drm_psb_private *) dev->dev_private;
+	struct edid *edid;
+	int ret = 0;
+	struct i2c_adapter *i2c_adap;
+	struct drm_display_mode *scan;	/* *modes, *bios_mode; */
+
+	PSB_DEBUG_ENTRY("\n");
+
+	psb_intel_output = kzalloc(sizeof(struct psb_intel_output), GFP_KERNEL);
+	if (!psb_intel_output)
+		return;
+
+	psb_intel_output->mode_dev = mode_dev;
+	connector = &psb_intel_output->base;
+	encoder = &psb_intel_output->enc;
+	dev_priv->is_lvds_on = true;
+	drm_connector_init(dev, &psb_intel_output->base,
+			   &psb_intel_lvds_connector_funcs,
+			   DRM_MODE_CONNECTOR_LVDS);
+
+	drm_encoder_init(dev, &psb_intel_output->enc, &psb_intel_lvds_enc_funcs,
+			 DRM_MODE_ENCODER_LVDS);
+
+	drm_mode_connector_attach_encoder(&psb_intel_output->base,
+					  &psb_intel_output->enc);
+	psb_intel_output->type = INTEL_OUTPUT_LVDS;
+
+	drm_encoder_helper_add(encoder, &mrst_lvds_helper_funcs);
+	drm_connector_helper_add(connector,
+				 &psb_intel_lvds_connector_helper_funcs);
+	connector->display_info.subpixel_order = SubPixelHorizontalRGB;
+	connector->interlace_allowed = false;
+	connector->doublescan_allowed = false;
+
+	drm_connector_attach_property(connector,
+					dev->mode_config.scaling_mode_property,
+					DRM_MODE_SCALE_FULLSCREEN);
+	drm_connector_attach_property(connector,
+					dev_priv->backlight_property,
+					BRIGHTNESS_MAX_LEVEL);
+
+	mode_dev->panel_wants_dither = false;
+	if (dev_priv->vbt_data.size != 0x00)
+		mode_dev->panel_wants_dither = (dev_priv->gct_data.
+			Panel_Port_Control & MRST_PANEL_8TO6_DITHER_ENABLE);
+
+	/*
+	 * LVDS discovery:
+	 * 1) check for EDID on DDC
+	 * 2) check for VBT data
+	 * 3) check to see if LVDS is already on
+	 *    if none of the above, no panel
+	 * 4) make sure lid is open
+	 *    if closed, act like it's not there for now
+	 */
+
+	 /* This ifdef can go once the cpu ident stuff is cleaned up in arch */
+#if defined(CONFIG_X86_MRST)
+	if (mrst_identify_cpu())
+        	i2c_adap = i2c_get_adapter(2);
+        else	/* Oaktrail uses I2C 1 */
+#endif        
+        	i2c_adap = i2c_get_adapter(1);
+
+	if (i2c_adap == NULL)
+		printk(KERN_ALERT "No ddc adapter available!\n");
+	/*
+	 * Attempt to get the fixed panel mode from DDC.  Assume that the
+	 * preferred mode is the right one.
+	 */
+	if (i2c_adap) {
+		edid = drm_get_edid(connector, i2c_adap);
+		if (edid) {
+			drm_mode_connector_update_edid_property(connector,
+									edid);
+			ret = drm_add_edid_modes(connector, edid);
+			kfree(edid);
+		}
+
+		list_for_each_entry(scan, &connector->probed_modes, head) {
+			if (scan->type & DRM_MODE_TYPE_PREFERRED) {
+				mode_dev->panel_fixed_mode =
+				    drm_mode_duplicate(dev, scan);
+				goto out;	/* FIXME: check for quirks */
+			}
+		}
+	}
+
+	/*
+	 * If we didn't get EDID, try geting panel timing
+	 * from configuration data
+	 */
+	mode_dev->panel_fixed_mode = mrst_lvds_get_configuration_mode(dev);
+
+	if (mode_dev->panel_fixed_mode) {
+		mode_dev->panel_fixed_mode->type |=
+		    DRM_MODE_TYPE_PREFERRED;
+		goto out;	/* FIXME: check for quirks */
+	}
+
+	/* If we still don't have a mode after all that, give up. */
+	if (!mode_dev->panel_fixed_mode) {
+		DRM_DEBUG
+		    ("Found no modes on the lvds, ignoring the LVDS\n");
+		goto failed_find;
+	}
+
+out:
+	drm_sysfs_connector_add(connector);
+	return;
+
+failed_find:
+	DRM_DEBUG("No LVDS modes found, disabling.\n");
+	if (psb_intel_output->ddc_bus)
+		psb_intel_i2c_destroy(psb_intel_output->ddc_bus);
+
+/* failed_ddc: */
+
+	drm_encoder_cleanup(encoder);
+	drm_connector_cleanup(connector);
+	kfree(connector);
+}
+
diff --git a/drivers/staging/gma500/psb_2d.c b/drivers/staging/gma500/psb_2d.c
index e4cae5d..29959de 100644
--- a/drivers/staging/gma500/psb_2d.c
+++ b/drivers/staging/gma500/psb_2d.c
@@ -40,7 +40,6 @@
 #include "psb_reg.h"
 #include "psb_drv.h"
 #include "psb_fb.h"
-#include "psb_sgx.h"
 
 void psb_spank(struct drm_psb_private *dev_priv)
 {
@@ -85,7 +84,7 @@
 /* FIXME: Remember if we expose the 2D engine to the DRM we need to serialize
    it with console use */
 
-static int psbfb_2d_submit(struct drm_psb_private *dev_priv, uint32_t *cmdbuf,
+int psbfb_2d_submit(struct drm_psb_private *dev_priv, uint32_t *cmdbuf,
 	 	  	   unsigned size)
 {
 	int ret = 0;
@@ -344,7 +343,7 @@
 	if (unlikely(info->state != FBINFO_STATE_RUNNING))
 		return;
 
-	if (1 || (info->flags & FBINFO_HWACCEL_DISABLED))
+	if (info->flags & FBINFO_HWACCEL_DISABLED)
 		return cfb_copyarea(info, region);
 
 	/* psb_check_power_state(dev, PSB_DEVICE_SGX); */
diff --git a/drivers/staging/gma500/psb_bl.c b/drivers/staging/gma500/psb_bl.c
index 70c17b3..57b9a5e 100644
--- a/drivers/staging/gma500/psb_bl.c
+++ b/drivers/staging/gma500/psb_bl.c
@@ -33,7 +33,6 @@
 #define BLC_PWM_FREQ_CALC_CONSTANT 32
 #define MHz 1000000
 #define BRIGHTNESS_MIN_LEVEL 1
-#define BRIGHTNESS_MAX_LEVEL 100
 #define BRIGHTNESS_MASK	0xFF
 #define BLC_POLARITY_NORMAL 0
 #define BLC_POLARITY_INVERSE 1
@@ -59,15 +58,57 @@
 
 	DRM_DEBUG_DRIVER("backlight level set to %d\n", level);
 
-	/* Perform value bounds checking */
-	if (level < BRIGHTNESS_MIN_LEVEL)
-		level = BRIGHTNESS_MIN_LEVEL;
+	/* Percentage 1-100% being valid */
+	if (level < 1)
+		level = 1;
 
 	psb_intel_lvds_set_brightness(dev, level);
 	psb_brightness = level;
 	return 0;
 }
 
+int mrst_set_brightness(struct backlight_device *bd)
+{
+	struct drm_device *dev = bl_get_data(psb_backlight_device);
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	int level = bd->props.brightness;
+	u32 blc_pwm_ctl;
+	u32 max_pwm_blc;
+
+	DRM_DEBUG_DRIVER("backlight level set to %d\n", level);
+
+	/* Percentage 1-100% being valid */
+	if (level < 1)
+		level = 1;
+
+	if (gma_power_begin(dev, 0)) {
+		/* Calculate and set the brightness value */
+		max_pwm_blc = REG_READ(BLC_PWM_CTL) >> 16;
+		blc_pwm_ctl = level * max_pwm_blc / 100;
+
+		/* Adjust the backlight level with the percent in
+		 * dev_priv->blc_adj1;
+		 */
+		blc_pwm_ctl = blc_pwm_ctl * dev_priv->blc_adj1;
+		blc_pwm_ctl = blc_pwm_ctl / 100;
+
+		/* Adjust the backlight level with the percent in
+		 * dev_priv->blc_adj2;
+		 */
+		blc_pwm_ctl = blc_pwm_ctl * dev_priv->blc_adj2;
+		blc_pwm_ctl = blc_pwm_ctl / 100;
+
+		if (blc_pol == BLC_POLARITY_INVERSE)
+			blc_pwm_ctl = max_pwm_blc - blc_pwm_ctl;
+		/* force PWM bit on */
+		REG_WRITE(BLC_PWM_CTL2, (0x80000000 | REG_READ(BLC_PWM_CTL2)));
+		REG_WRITE(BLC_PWM_CTL, (max_pwm_blc << 16) | blc_pwm_ctl);
+		gma_power_end(dev);
+	}
+	psb_brightness = level;
+	return 0;
+}
+
 int psb_get_brightness(struct backlight_device *bd)
 {
 	DRM_DEBUG_DRIVER("brightness = 0x%x\n", psb_brightness);
@@ -85,24 +126,33 @@
 
 static int device_backlight_init(struct drm_device *dev)
 {
+	struct drm_psb_private *dev_priv = dev->dev_private;
 	unsigned long core_clock;
 	/* u32 bl_max_freq; */
 	/* unsigned long value; */
 	u16 bl_max_freq;
 	uint32_t value;
 	uint32_t blc_pwm_precision_factor;
-	struct drm_psb_private *dev_priv = dev->dev_private;
 
-	/* get bl_max_freq and pol from dev_priv*/
-	if (!dev_priv->lvds_bl) {
-		DRM_ERROR("Has no valid LVDS backlight info\n");
-		return 1;
+	if (IS_MRST(dev)) {
+		dev_priv->blc_adj1 = BLC_ADJUSTMENT_MAX;
+		dev_priv->blc_adj2 = BLC_ADJUSTMENT_MAX;
+		bl_max_freq = 256;
+		/* this needs to be set elsewhere */
+		blc_pol = BLC_POLARITY_NORMAL;
+		blc_pwm_precision_factor = BLC_PWM_PRECISION_FACTOR;
+	} else {
+		/* get bl_max_freq and pol from dev_priv*/
+		if (!dev_priv->lvds_bl) {
+			DRM_ERROR("Has no valid LVDS backlight info\n");
+			return 1;
+		}
+		bl_max_freq = dev_priv->lvds_bl->freq;
+		blc_pol = dev_priv->lvds_bl->pol;
+		blc_pwm_precision_factor = PSB_BLC_PWM_PRECISION_FACTOR;
+		blc_brightnesscmd = dev_priv->lvds_bl->brightnesscmd;
+		blc_type = dev_priv->lvds_bl->type;
 	}
-	bl_max_freq = dev_priv->lvds_bl->freq;
-	blc_pol = dev_priv->lvds_bl->pol;
-	blc_pwm_precision_factor = PSB_BLC_PWM_PRECISION_FACTOR;
-	blc_brightnesscmd = dev_priv->lvds_bl->brightnesscmd;
-	blc_type = dev_priv->lvds_bl->type;
 
 	core_clock = dev_priv->core_freq;
 
@@ -111,20 +161,27 @@
 	value /= bl_max_freq;
 	value /= blc_pwm_precision_factor;
 
-	if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-						OSPM_UHB_ONLY_IF_ON)) {
-		/* Check: may be MFLD only */
-		if (
-		 value > (unsigned long long)PSB_BLC_MAX_PWM_REG_FREQ ||
-		 value < (unsigned long long)PSB_BLC_MIN_PWM_REG_FREQ)
-			return 2;
-		else {
-			value &= PSB_BACKLIGHT_PWM_POLARITY_BIT_CLEAR;
-			REG_WRITE(BLC_PWM_CTL,
-				(value << PSB_BACKLIGHT_PWM_CTL_SHIFT) |
-				(value));
+	if (gma_power_begin(dev, false)) {
+		if (IS_MRST(dev)) {
+			if (value > (unsigned long long)MRST_BLC_MAX_PWM_REG_FREQ)
+				return 2;
+			else {
+				REG_WRITE(BLC_PWM_CTL2,
+					(0x80000000 | REG_READ(BLC_PWM_CTL2)));
+				REG_WRITE(BLC_PWM_CTL, value | (value << 16));
+			}
+		} else {
+			if (value > (unsigned long long)PSB_BLC_MAX_PWM_REG_FREQ ||
+			 value < (unsigned long long)PSB_BLC_MIN_PWM_REG_FREQ)
+				return 2;
+			else {
+				value &= PSB_BACKLIGHT_PWM_POLARITY_BIT_CLEAR;
+				REG_WRITE(BLC_PWM_CTL,
+					(value << PSB_BACKLIGHT_PWM_CTL_SHIFT) |
+					(value));
+			}
 		}
-		ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+		gma_power_end(dev);
 	}
 	return 0;
 }
@@ -136,7 +193,7 @@
 
 	struct backlight_properties props;
 	memset(&props, 0, sizeof(struct backlight_properties));
-	props.max_brightness = BRIGHTNESS_MAX_LEVEL;
+	props.max_brightness = 100;
 
 	psb_backlight_device = backlight_device_register("psb-bl", NULL,
 						(void *)dev, &psb_ops, &props);
@@ -147,8 +204,8 @@
 	if (ret < 0)
 		return ret;
 
-	psb_backlight_device->props.brightness = BRIGHTNESS_MAX_LEVEL;
-	psb_backlight_device->props.max_brightness = BRIGHTNESS_MAX_LEVEL;
+	psb_backlight_device->props.brightness = 100;
+	psb_backlight_device->props.max_brightness = 100;
 	backlight_update_status(psb_backlight_device);
 #endif
 	return 0;
diff --git a/drivers/staging/gma500/psb_buffer.c b/drivers/staging/gma500/psb_buffer.c
deleted file mode 100644
index 3077f6a..0000000
--- a/drivers/staging/gma500/psb_buffer.c
+++ /dev/null
@@ -1,450 +0,0 @@
-/**************************************************************************
- * Copyright (c) 2007, Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- *
- **************************************************************************/
-/*
- * Authors: Thomas Hellstrom <thomas-at-tungstengraphics.com>
- */
-#include "ttm/ttm_placement.h"
-#include "ttm/ttm_execbuf_util.h"
-#include "psb_ttm_fence_api.h"
-#include <drm/drmP.h>
-#include "psb_drv.h"
-
-#define DRM_MEM_TTM       26
-
-struct drm_psb_ttm_backend {
-	struct ttm_backend base;
-	struct page **pages;
-	unsigned int desired_tile_stride;
-	unsigned int hw_tile_stride;
-	int mem_type;
-	unsigned long offset;
-	unsigned long num_pages;
-};
-
-/*
- * MSVDX/TOPAZ GPU virtual space looks like this
- * (We currently use only one MMU context).
- * PSB_MEM_MMU_START: from 0x00000000~0xe000000, for generic buffers
- * TTM_PL_CI: from 0xe0000000+half GTT space, for camear/video buffer sharing
- * TTM_PL_RAR: from TTM_PL_CI+CI size, for RAR/video buffer sharing
- * TTM_PL_TT: from TTM_PL_RAR+RAR size, for buffers need to mapping into GTT
- */
-static int psb_init_mem_type(struct ttm_bo_device *bdev, uint32_t type,
-			     struct ttm_mem_type_manager *man)
-{
-
-	struct drm_psb_private *dev_priv =
-	    container_of(bdev, struct drm_psb_private, bdev);
-	struct psb_gtt *pg = dev_priv->pg;
-
-	switch (type) {
-	case TTM_PL_SYSTEM:
-		man->flags = TTM_MEMTYPE_FLAG_MAPPABLE;
-		man->available_caching = TTM_PL_FLAG_CACHED |
-		    TTM_PL_FLAG_UNCACHED | TTM_PL_FLAG_WC;
-		man->default_caching = TTM_PL_FLAG_CACHED;
-		break;
-	case DRM_PSB_MEM_MMU:
-		man->func = &ttm_bo_manager_func;
-		man->flags = TTM_MEMTYPE_FLAG_MAPPABLE |
-		    TTM_MEMTYPE_FLAG_CMA;
-		man->gpu_offset = PSB_MEM_MMU_START;
-		man->available_caching = TTM_PL_FLAG_CACHED |
-		    TTM_PL_FLAG_UNCACHED | TTM_PL_FLAG_WC;
-		man->default_caching = TTM_PL_FLAG_WC;
-		break;
-	case TTM_PL_CI:
-		man->func = &ttm_bo_manager_func;
-		man->flags = TTM_MEMTYPE_FLAG_MAPPABLE |
-			TTM_MEMTYPE_FLAG_FIXED;
-		man->gpu_offset = pg->mmu_gatt_start + (pg->ci_start);
-		man->available_caching = TTM_PL_FLAG_UNCACHED;
-		man->default_caching = TTM_PL_FLAG_UNCACHED;
-		break;
-	case TTM_PL_RAR:	/* Unmappable RAR memory */
-		man->func = &ttm_bo_manager_func;
-		man->flags = TTM_MEMTYPE_FLAG_MAPPABLE |
-			TTM_MEMTYPE_FLAG_FIXED;
-		man->available_caching = TTM_PL_FLAG_UNCACHED;
-		man->default_caching = TTM_PL_FLAG_UNCACHED;
-		man->gpu_offset = pg->mmu_gatt_start + (pg->rar_start);
-		break;
-	case TTM_PL_TT:	/* Mappable GATT memory */
-		man->func = &ttm_bo_manager_func;
-#ifdef PSB_WORKING_HOST_MMU_ACCESS
-		man->flags = TTM_MEMTYPE_FLAG_MAPPABLE;
-#else
-		man->flags = TTM_MEMTYPE_FLAG_MAPPABLE |
-		    TTM_MEMTYPE_FLAG_CMA;
-#endif
-		man->available_caching = TTM_PL_FLAG_CACHED |
-		    TTM_PL_FLAG_UNCACHED | TTM_PL_FLAG_WC;
-		man->default_caching = TTM_PL_FLAG_WC;
-		man->gpu_offset = pg->mmu_gatt_start +
-				(pg->rar_start + dev_priv->rar_region_size);
-		break;
-	default:
-		DRM_ERROR("Unsupported memory type %u\n", (unsigned) type);
-		return -EINVAL;
-	}
-	return 0;
-}
-
-
-static void psb_evict_mask(struct ttm_buffer_object *bo,
-					struct ttm_placement *placement)
-{
-	static uint32_t cur_placement;
-
-	cur_placement = bo->mem.placement & ~TTM_PL_MASK_MEM;
-	cur_placement |= TTM_PL_FLAG_SYSTEM;
-
-	placement->fpfn = 0;
-	placement->lpfn = 0;
-	placement->num_placement = 1;
-	placement->placement = &cur_placement;
-	placement->num_busy_placement = 0;
-	placement->busy_placement = NULL;
-
-	/* all buffers evicted to system memory */
-	/* return cur_placement | TTM_PL_FLAG_SYSTEM; */
-}
-
-static int psb_invalidate_caches(struct ttm_bo_device *bdev,
-				 uint32_t placement)
-{
-	return 0;
-}
-
-static int psb_move_blit(struct ttm_buffer_object *bo,
-			 bool evict, bool no_wait,
-			 struct ttm_mem_reg *new_mem)
-{
-	BUG();
-	return 0;
-}
-
-/*
- * Flip destination ttm into GATT,
- * then blit and subsequently move out again.
- */
-
-static int psb_move_flip(struct ttm_buffer_object *bo,
-			 bool evict, bool interruptible, bool no_wait,
-			 struct ttm_mem_reg *new_mem)
-{
-	/*struct ttm_bo_device *bdev = bo->bdev;*/
-	struct ttm_mem_reg tmp_mem;
-	int ret;
-	struct ttm_placement placement;
-	uint32_t flags = TTM_PL_FLAG_TT;
-
-	tmp_mem = *new_mem;
-	tmp_mem.mm_node = NULL;
-
-	placement.fpfn = 0;
-	placement.lpfn = 0;
-	placement.num_placement = 1;
-	placement.placement = &flags;
-	placement.num_busy_placement = 0; /* FIXME */
-	placement.busy_placement = NULL;
-
-	ret = ttm_bo_mem_space(bo, &placement, &tmp_mem, interruptible,
-							false, no_wait);
-	if (ret)
-		return ret;
-	ret = ttm_tt_bind(bo->ttm, &tmp_mem);
-	if (ret)
-		goto out_cleanup;
-	ret = psb_move_blit(bo, true, no_wait, &tmp_mem);
-	if (ret)
-		goto out_cleanup;
-
-	ret = ttm_bo_move_ttm(bo, evict, false, no_wait, new_mem);
-out_cleanup:
-	if (tmp_mem.mm_node) {
-		drm_mm_put_block(tmp_mem.mm_node);
-		tmp_mem.mm_node = NULL;
-	}
-	return ret;
-}
-
-static int psb_move(struct ttm_buffer_object *bo,
-		    bool evict, bool interruptible, bool no_wait_reserve,
-		    bool no_wait, struct ttm_mem_reg *new_mem)
-{
-	struct ttm_mem_reg *old_mem = &bo->mem;
-
-	if ((old_mem->mem_type == TTM_PL_RAR) ||
-	    (new_mem->mem_type == TTM_PL_RAR)) {
-		if (old_mem->mm_node) {
-			spin_lock(&bo->glob->lru_lock);
-			drm_mm_put_block(old_mem->mm_node);
-			spin_unlock(&bo->glob->lru_lock);
-		}
-		old_mem->mm_node = NULL;
-		*old_mem = *new_mem;
-	} else if (old_mem->mem_type == TTM_PL_SYSTEM) {
-		return ttm_bo_move_memcpy(bo, evict, false, no_wait, new_mem);
-	} else if (new_mem->mem_type == TTM_PL_SYSTEM) {
-		int ret = psb_move_flip(bo, evict, interruptible,
-					no_wait, new_mem);
-		if (unlikely(ret != 0)) {
-			if (ret == -ERESTART)
-				return ret;
-			else
-				return ttm_bo_move_memcpy(bo, evict, false,
-						no_wait, new_mem);
-		}
-	} else {
-		if (psb_move_blit(bo, evict, no_wait, new_mem))
-			return ttm_bo_move_memcpy(bo, evict, false, no_wait,
-						  new_mem);
-	}
-	return 0;
-}
-
-static int drm_psb_tbe_populate(struct ttm_backend *backend,
-				unsigned long num_pages,
-				struct page **pages,
-				struct page *dummy_read_page,
-				dma_addr_t *dma_addrs)
-{
-	struct drm_psb_ttm_backend *psb_be =
-	    container_of(backend, struct drm_psb_ttm_backend, base);
-
-	psb_be->pages = pages;
-	return 0;
-}
-
-static int drm_psb_tbe_unbind(struct ttm_backend *backend)
-{
-	struct ttm_bo_device *bdev = backend->bdev;
-	struct drm_psb_private *dev_priv =
-	    container_of(bdev, struct drm_psb_private, bdev);
-	struct drm_psb_ttm_backend *psb_be =
-	    container_of(backend, struct drm_psb_ttm_backend, base);
-	struct psb_mmu_pd *pd = psb_mmu_get_default_pd(dev_priv->mmu);
-	/* struct ttm_mem_type_manager *man = &bdev->man[psb_be->mem_type]; */
-
-	if (psb_be->mem_type == TTM_PL_TT) {
-		uint32_t gatt_p_offset =
-			(psb_be->offset - dev_priv->pg->mmu_gatt_start)
-								>> PAGE_SHIFT;
-
-		(void) psb_gtt_remove_pages(dev_priv->pg, gatt_p_offset,
-					    psb_be->num_pages,
-					    psb_be->desired_tile_stride,
-					    psb_be->hw_tile_stride, 0);
-	}
-
-	psb_mmu_remove_pages(pd, psb_be->offset,
-			     psb_be->num_pages,
-			     psb_be->desired_tile_stride,
-			     psb_be->hw_tile_stride);
-
-	return 0;
-}
-
-static int drm_psb_tbe_bind(struct ttm_backend *backend,
-			    struct ttm_mem_reg *bo_mem)
-{
-	struct ttm_bo_device *bdev = backend->bdev;
-	struct drm_psb_private *dev_priv =
-	    container_of(bdev, struct drm_psb_private, bdev);
-	struct drm_psb_ttm_backend *psb_be =
-	    container_of(backend, struct drm_psb_ttm_backend, base);
-	struct psb_mmu_pd *pd = psb_mmu_get_default_pd(dev_priv->mmu);
-	struct ttm_mem_type_manager *man = &bdev->man[bo_mem->mem_type];
-	struct drm_mm_node *mm_node = bo_mem->mm_node;
-	int type;
-	int ret = 0;
-
-	psb_be->mem_type = bo_mem->mem_type;
-	psb_be->num_pages = bo_mem->num_pages;
-	psb_be->desired_tile_stride = 0;
-	psb_be->hw_tile_stride = 0;
-	psb_be->offset = (mm_node->start << PAGE_SHIFT) +
-	    man->gpu_offset;
-
-	type =
-	    (bo_mem->
-	     placement & TTM_PL_FLAG_CACHED) ? PSB_MMU_CACHED_MEMORY : 0;
-
-	if (psb_be->mem_type == TTM_PL_TT) {
-		uint32_t gatt_p_offset =
-				(psb_be->offset - dev_priv->pg->mmu_gatt_start)
-								>> PAGE_SHIFT;
-
-		ret = psb_gtt_insert_pages(dev_priv->pg, psb_be->pages,
-					   gatt_p_offset,
-					   psb_be->num_pages,
-					   psb_be->desired_tile_stride,
-					   psb_be->hw_tile_stride, type);
-	}
-
-	ret = psb_mmu_insert_pages(pd, psb_be->pages,
-				   psb_be->offset, psb_be->num_pages,
-				   psb_be->desired_tile_stride,
-				   psb_be->hw_tile_stride, type);
-	if (ret)
-		goto out_err;
-
-	return 0;
-out_err:
-	drm_psb_tbe_unbind(backend);
-	return ret;
-
-}
-
-static void drm_psb_tbe_clear(struct ttm_backend *backend)
-{
-	struct drm_psb_ttm_backend *psb_be =
-	    container_of(backend, struct drm_psb_ttm_backend, base);
-
-	psb_be->pages = NULL;
-	return;
-}
-
-static void drm_psb_tbe_destroy(struct ttm_backend *backend)
-{
-	struct drm_psb_ttm_backend *psb_be =
-	    container_of(backend, struct drm_psb_ttm_backend, base);
-
-	if (backend)
-		kfree(psb_be);
-}
-
-static struct ttm_backend_func psb_ttm_backend = {
-	.populate = drm_psb_tbe_populate,
-	.clear = drm_psb_tbe_clear,
-	.bind = drm_psb_tbe_bind,
-	.unbind = drm_psb_tbe_unbind,
-	.destroy = drm_psb_tbe_destroy,
-};
-
-static struct ttm_backend *drm_psb_tbe_init(struct ttm_bo_device *bdev)
-{
-	struct drm_psb_ttm_backend *psb_be;
-
-	psb_be = kzalloc(sizeof(*psb_be), GFP_KERNEL);
-	if (!psb_be)
-		return NULL;
-	psb_be->pages = NULL;
-	psb_be->base.func = &psb_ttm_backend;
-	psb_be->base.bdev = bdev;
-	return &psb_be->base;
-}
-
-static int psb_ttm_io_mem_reserve(struct ttm_bo_device *bdev,
-						struct ttm_mem_reg *mem)
-{
-	struct ttm_mem_type_manager *man = &bdev->man[mem->mem_type];
-	struct drm_psb_private *dev_priv =
-	    container_of(bdev, struct drm_psb_private, bdev);
-	struct psb_gtt *pg = dev_priv->pg;
-	struct drm_mm_node *mm_node = mem->mm_node;
-
-	mem->bus.addr = NULL;
-	mem->bus.offset = 0;
-	mem->bus.size = mem->num_pages << PAGE_SHIFT;
-	mem->bus.base = 0;
-	mem->bus.is_iomem = false;
-	if (!(man->flags & TTM_MEMTYPE_FLAG_MAPPABLE))
-		return -EINVAL;
-	switch (mem->mem_type) {
-	case TTM_PL_SYSTEM:
-		/* system memory */
-		return 0;
-	case TTM_PL_TT:
-		mem->bus.offset = mm_node->start << PAGE_SHIFT;
-		mem->bus.base = pg->gatt_start;
-		mem->bus.is_iomem = false;
-		/* Don't know whether it is IO_MEM, this flag
-						used in vm_fault handle */
-		break;
-	case DRM_PSB_MEM_MMU:
-		mem->bus.offset = mm_node->start << PAGE_SHIFT;
-		mem->bus.base = 0x00000000;
-		break;
-	case TTM_PL_CI:
-		mem->bus.offset = mm_node->start << PAGE_SHIFT;
-		mem->bus.base = dev_priv->ci_region_start;;
-		mem->bus.is_iomem = true;
-		break;
-	case TTM_PL_RAR:
-		mem->bus.offset = mm_node->start << PAGE_SHIFT;
-		mem->bus.base = dev_priv->rar_region_start;;
-		mem->bus.is_iomem = true;
-		break;
-	default:
-		return -EINVAL;
-	}
-	return 0;
-}
-
-static void psb_ttm_io_mem_free(struct ttm_bo_device *bdev,
-						struct ttm_mem_reg *mem)
-{
-}
-
-/*
- * Use this memory type priority if no eviction is needed.
- */
-/*
-static uint32_t psb_mem_prios[] = {
-	TTM_PL_CI,
-	TTM_PL_RAR,
-	TTM_PL_TT,
-	DRM_PSB_MEM_MMU,
-	TTM_PL_SYSTEM
-};
-*/
-/*
- * Use this memory type priority if need to evict.
- */
-/*
-static uint32_t psb_busy_prios[] = {
-	TTM_PL_TT,
-	TTM_PL_CI,
-	TTM_PL_RAR,
-	DRM_PSB_MEM_MMU,
-	TTM_PL_SYSTEM
-};
-*/
-struct ttm_bo_driver psb_ttm_bo_driver = {
-/*
-	.mem_type_prio = psb_mem_prios,
-	.mem_busy_prio = psb_busy_prios,
-	.num_mem_type_prio = ARRAY_SIZE(psb_mem_prios),
-	.num_mem_busy_prio = ARRAY_SIZE(psb_busy_prios),
-*/
-	.create_ttm_backend_entry = &drm_psb_tbe_init,
-	.invalidate_caches = &psb_invalidate_caches,
-	.init_mem_type = &psb_init_mem_type,
-	.evict_flags = &psb_evict_mask,
-	.move = &psb_move,
-	.verify_access = &psb_verify_access,
-	.sync_obj_signaled = &ttm_fence_sync_obj_signaled,
-	.sync_obj_wait = &ttm_fence_sync_obj_wait,
-	.sync_obj_flush = &ttm_fence_sync_obj_flush,
-	.sync_obj_unref = &ttm_fence_sync_obj_unref,
-	.sync_obj_ref = &ttm_fence_sync_obj_ref,
-	.io_mem_reserve = &psb_ttm_io_mem_reserve,
-	.io_mem_free = &psb_ttm_io_mem_free
-};
diff --git a/drivers/staging/gma500/psb_drm.h b/drivers/staging/gma500/psb_drm.h
index a339406..28862c7 100644
--- a/drivers/staging/gma500/psb_drm.h
+++ b/drivers/staging/gma500/psb_drm.h
@@ -28,9 +28,6 @@
 #include "drm_mode.h"
 #endif
 
-#include "psb_ttm_fence_user.h"
-#include "psb_ttm_placement_user.h"
-
 #define DRM_PSB_SAREA_MAJOR 0
 #define DRM_PSB_SAREA_MINOR 2
 #define PSB_FIXED_SHIFT 16
@@ -41,15 +38,6 @@
  * Public memory types.
  */
 
-#define DRM_PSB_MEM_MMU 	TTM_PL_PRIV1
-#define DRM_PSB_FLAG_MEM_MMU	TTM_PL_FLAG_PRIV1
-
-#define TTM_PL_CI               TTM_PL_PRIV0
-#define TTM_PL_FLAG_CI          TTM_PL_FLAG_PRIV0
-
-#define TTM_PL_RAR              TTM_PL_PRIV2
-#define TTM_PL_FLAG_RAR         TTM_PL_FLAG_PRIV2
-
 typedef s32 psb_fixed;
 typedef u32 psb_ufixed;
 
@@ -112,111 +100,12 @@
 	u32 num_active_scanouts;
 };
 
-#define PSB_RELOC_MAGIC         0x67676767
-#define PSB_RELOC_SHIFT_MASK    0x0000FFFF
-#define PSB_RELOC_SHIFT_SHIFT   0
-#define PSB_RELOC_ALSHIFT_MASK  0xFFFF0000
-#define PSB_RELOC_ALSHIFT_SHIFT 16
-
-#define PSB_RELOC_OP_OFFSET     0	/* Offset of the indicated
-					 * buffer
-					 */
-
-struct drm_psb_reloc {
-	u32 reloc_op;
-	u32 where;		/* offset in destination buffer */
-	u32 buffer;	/* Buffer reloc applies to */
-	u32 mask;		/* Destination format: */
-	u32 shift;		/* Destination format: */
-	u32 pre_add;	/* Destination format: */
-	u32 background;	/* Destination add */
-	u32 dst_buffer;	/* Destination buffer. Index into buffer_list */
-	u32 arg0;		/* Reloc-op dependent */
-	u32 arg1;
-};
-
-
 #define PSB_GPU_ACCESS_READ         (1ULL << 32)
 #define PSB_GPU_ACCESS_WRITE        (1ULL << 33)
 #define PSB_GPU_ACCESS_MASK         (PSB_GPU_ACCESS_READ | PSB_GPU_ACCESS_WRITE)
 
 #define PSB_BO_FLAG_COMMAND         (1ULL << 52)
 
-#define PSB_ENGINE_2D 0
-#define PSB_ENGINE_VIDEO 1
-#define LNC_ENGINE_ENCODE 5
-
-/*
- * For this fence class we have a couple of
- * fence types.
- */
-
-#define _PSB_FENCE_EXE_SHIFT           0
-#define _PSB_FENCE_FEEDBACK_SHIFT      4
-
-#define _PSB_FENCE_TYPE_EXE         (1 << _PSB_FENCE_EXE_SHIFT)
-#define _PSB_FENCE_TYPE_FEEDBACK    (1 << _PSB_FENCE_FEEDBACK_SHIFT)
-
-#define PSB_NUM_ENGINES 6
-
-
-#define PSB_FEEDBACK_OP_VISTEST (1 << 0)
-
-struct drm_psb_extension_rep {
-	s32 exists;
-	u32 driver_ioctl_offset;
-	u32 sarea_offset;
-	u32 major;
-	u32 minor;
-	u32 pl;
-};
-
-#define DRM_PSB_EXT_NAME_LEN 128
-
-union drm_psb_extension_arg {
-	char extension[DRM_PSB_EXT_NAME_LEN];
-	struct drm_psb_extension_rep rep;
-};
-
-struct psb_validate_req {
-	u64 set_flags;
-	u64 clear_flags;
-	u64 next;
-	u64 presumed_gpu_offset;
-	u32 buffer_handle;
-	u32 presumed_flags;
-	u32 group;
-	u32 pad64;
-};
-
-struct psb_validate_rep {
-	u64 gpu_offset;
-	u32 placement;
-	u32 fence_type_mask;
-};
-
-#define PSB_USE_PRESUMED     (1 << 0)
-
-struct psb_validate_arg {
-	int handled;
-	int ret;
-	union {
-		struct psb_validate_req req;
-		struct psb_validate_rep rep;
-	} d;
-};
-
-
-#define DRM_PSB_FENCE_NO_USER        (1 << 0)
-
-struct psb_ttm_fence_rep {
-	u32 handle;
-	u32 fence_class;
-	u32 fence_type;
-	u32 signaled_types;
-	u32 error;
-};
-
 /*
  * Feedback components:
  */
diff --git a/drivers/staging/gma500/psb_drv.c b/drivers/staging/gma500/psb_drv.c
index d01d45e..711e5a9 100644
--- a/drivers/staging/gma500/psb_drv.c
+++ b/drivers/staging/gma500/psb_drv.c
@@ -38,30 +38,29 @@
 int drm_psb_debug;
 static int drm_psb_trap_pagefaults;
 
-int drm_psb_disable_vsync = 1;
 int drm_psb_no_fb;
-int gfxrtdelay = 2 * 1000;
 
 static int psb_probe(struct pci_dev *pdev, const struct pci_device_id *ent);
 
 MODULE_PARM_DESC(debug, "Enable debug output");
 MODULE_PARM_DESC(no_fb, "Disable FBdev");
 MODULE_PARM_DESC(trap_pagefaults, "Error and reset on MMU pagefaults");
-MODULE_PARM_DESC(disable_vsync, "Disable vsync interrupts");
-MODULE_PARM_DESC(force_pipeb, "Forces PIPEB to become primary fb");
-MODULE_PARM_DESC(ta_mem_size, "TA memory size in kiB");
-MODULE_PARM_DESC(ospm, "switch for ospm support");
-MODULE_PARM_DESC(rtpm, "Specifies Runtime PM delay for GFX");
-MODULE_PARM_DESC(hdmi_edid, "EDID info for HDMI monitor");
 module_param_named(debug, drm_psb_debug, int, 0600);
 module_param_named(no_fb, drm_psb_no_fb, int, 0600);
 module_param_named(trap_pagefaults, drm_psb_trap_pagefaults, int, 0600);
-module_param_named(rtpm, gfxrtdelay, int, 0600);
 
 
 static struct pci_device_id pciidlist[] = {
 	{ 0x8086, 0x8108, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PSB_8108 },
 	{ 0x8086, 0x8109, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PSB_8109 },
+	{ 0x8086, 0x4100, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MRST_4100},
+	{ 0x8086, 0x4101, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MRST_4100},
+	{ 0x8086, 0x4102, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MRST_4100},
+	{ 0x8086, 0x4103, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MRST_4100},
+	{ 0x8086, 0x4104, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MRST_4100},
+	{ 0x8086, 0x4105, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MRST_4100},
+	{ 0x8086, 0x4106, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MRST_4100},
+	{ 0x8086, 0x4107, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MRST_4100},
 	{ 0, 0, 0}
 };
 MODULE_DEVICE_TABLE(pci, pciidlist);
@@ -103,9 +102,6 @@
 #define DRM_IOCTL_PSB_GTT_UNMAP	\
 		DRM_IOW(DRM_PSB_GTT_UNMAP + DRM_COMMAND_BASE, \
 			struct psb_gtt_mapping_arg)
-#define DRM_IOCTL_PSB_GETPAGEADDRS	\
-		DRM_IOWR(DRM_COMMAND_BASE + DRM_PSB_GETPAGEADDRS,\
-			 struct drm_psb_getpageaddrs_arg)
 #define DRM_IOCTL_PSB_UPDATE_GUARD	\
 		DRM_IOWR(DRM_PSB_UPDATE_GUARD + DRM_COMMAND_BASE, \
 			 uint32_t)
@@ -122,69 +118,8 @@
 		DRM_IOWR(DRM_PSB_GET_PIPE_FROM_CRTC_ID + DRM_COMMAND_BASE, \
 			 struct drm_psb_get_pipe_from_crtc_id_arg)
 
-/*
- * TTM execbuf extension.
- */
-
-#define DRM_PSB_CMDBUF		  0x23
-#define DRM_PSB_SCENE_UNREF	  0x24
 #define DRM_IOCTL_PSB_KMS_OFF	  DRM_IO(DRM_PSB_KMS_OFF + DRM_COMMAND_BASE)
 #define DRM_IOCTL_PSB_KMS_ON	  DRM_IO(DRM_PSB_KMS_ON + DRM_COMMAND_BASE)
-/*
- * TTM placement user extension.
- */
-
-#define DRM_PSB_PLACEMENT_OFFSET   (DRM_PSB_SCENE_UNREF + 1)
-
-#define DRM_PSB_TTM_PL_CREATE	 (TTM_PL_CREATE + DRM_PSB_PLACEMENT_OFFSET)
-#define DRM_PSB_TTM_PL_REFERENCE (TTM_PL_REFERENCE + DRM_PSB_PLACEMENT_OFFSET)
-#define DRM_PSB_TTM_PL_UNREF	 (TTM_PL_UNREF + DRM_PSB_PLACEMENT_OFFSET)
-#define DRM_PSB_TTM_PL_SYNCCPU	 (TTM_PL_SYNCCPU + DRM_PSB_PLACEMENT_OFFSET)
-#define DRM_PSB_TTM_PL_WAITIDLE  (TTM_PL_WAITIDLE + DRM_PSB_PLACEMENT_OFFSET)
-#define DRM_PSB_TTM_PL_SETSTATUS (TTM_PL_SETSTATUS + DRM_PSB_PLACEMENT_OFFSET)
-#define DRM_PSB_TTM_PL_CREATE_UB (TTM_PL_CREATE_UB + DRM_PSB_PLACEMENT_OFFSET)
-
-/*
- * TTM fence extension.
- */
-
-#define DRM_PSB_FENCE_OFFSET	   (DRM_PSB_TTM_PL_CREATE_UB + 1)
-#define DRM_PSB_TTM_FENCE_SIGNALED (TTM_FENCE_SIGNALED + DRM_PSB_FENCE_OFFSET)
-#define DRM_PSB_TTM_FENCE_FINISH   (TTM_FENCE_FINISH + DRM_PSB_FENCE_OFFSET)
-#define DRM_PSB_TTM_FENCE_UNREF    (TTM_FENCE_UNREF + DRM_PSB_FENCE_OFFSET)
-
-#define DRM_PSB_FLIP	   (DRM_PSB_TTM_FENCE_UNREF + 1)	/*20*/
-
-#define DRM_IOCTL_PSB_TTM_PL_CREATE    \
-	DRM_IOWR(DRM_COMMAND_BASE + DRM_PSB_TTM_PL_CREATE,\
-		 union ttm_pl_create_arg)
-#define DRM_IOCTL_PSB_TTM_PL_REFERENCE \
-	DRM_IOWR(DRM_COMMAND_BASE + DRM_PSB_TTM_PL_REFERENCE,\
-		 union ttm_pl_reference_arg)
-#define DRM_IOCTL_PSB_TTM_PL_UNREF    \
-	DRM_IOW(DRM_COMMAND_BASE + DRM_PSB_TTM_PL_UNREF,\
-		struct ttm_pl_reference_req)
-#define DRM_IOCTL_PSB_TTM_PL_SYNCCPU	\
-	DRM_IOW(DRM_COMMAND_BASE + DRM_PSB_TTM_PL_SYNCCPU,\
-		struct ttm_pl_synccpu_arg)
-#define DRM_IOCTL_PSB_TTM_PL_WAITIDLE	 \
-	DRM_IOW(DRM_COMMAND_BASE + DRM_PSB_TTM_PL_WAITIDLE,\
-		struct ttm_pl_waitidle_arg)
-#define DRM_IOCTL_PSB_TTM_PL_SETSTATUS \
-	DRM_IOWR(DRM_COMMAND_BASE + DRM_PSB_TTM_PL_SETSTATUS,\
-		 union ttm_pl_setstatus_arg)
-#define DRM_IOCTL_PSB_TTM_PL_CREATE_UB    \
-	DRM_IOWR(DRM_COMMAND_BASE + DRM_PSB_TTM_PL_CREATE_UB,\
-		 union ttm_pl_create_ub_arg)
-#define DRM_IOCTL_PSB_TTM_FENCE_SIGNALED \
-	DRM_IOWR(DRM_COMMAND_BASE + DRM_PSB_TTM_FENCE_SIGNALED,	\
-		  union ttm_fence_signaled_arg)
-#define DRM_IOCTL_PSB_TTM_FENCE_FINISH \
-	DRM_IOWR(DRM_COMMAND_BASE + DRM_PSB_TTM_FENCE_FINISH,	\
-		 union ttm_fence_finish_arg)
-#define DRM_IOCTL_PSB_TTM_FENCE_UNREF \
-	DRM_IOW(DRM_COMMAND_BASE + DRM_PSB_TTM_FENCE_UNREF,	\
-		 struct ttm_fence_unref_arg)
 
 static int psb_vt_leave_ioctl(struct drm_device *dev, void *data,
 			      struct drm_file *file_priv);
@@ -238,86 +173,226 @@
 	PSB_IOCTL_DEF(DRM_IOCTL_PSB_GTT_UNMAP,
 			psb_gtt_unmap_meminfo_ioctl,
 			DRM_AUTH),
-	PSB_IOCTL_DEF(DRM_IOCTL_PSB_GETPAGEADDRS,
-			psb_getpageaddrs_ioctl,
-			DRM_AUTH),
 	PSB_IOCTL_DEF(DRM_IOCTL_PSB_DPST, psb_dpst_ioctl, DRM_AUTH),
 	PSB_IOCTL_DEF(DRM_IOCTL_PSB_GAMMA, psb_gamma_ioctl, DRM_AUTH),
 	PSB_IOCTL_DEF(DRM_IOCTL_PSB_DPST_BL, psb_dpst_bl_ioctl, DRM_AUTH),
 	PSB_IOCTL_DEF(DRM_IOCTL_PSB_GET_PIPE_FROM_CRTC_ID,
 					psb_intel_get_pipe_from_crtc_id, 0),
 
-	PSB_IOCTL_DEF(DRM_IOCTL_PSB_TTM_PL_CREATE, psb_pl_create_ioctl,
-		      DRM_AUTH),
-	PSB_IOCTL_DEF(DRM_IOCTL_PSB_TTM_PL_REFERENCE, psb_pl_reference_ioctl,
-		      DRM_AUTH),
-	PSB_IOCTL_DEF(DRM_IOCTL_PSB_TTM_PL_UNREF, psb_pl_unref_ioctl,
-		      DRM_AUTH),
-	PSB_IOCTL_DEF(DRM_IOCTL_PSB_TTM_PL_SYNCCPU, psb_pl_synccpu_ioctl,
-		      DRM_AUTH),
-	PSB_IOCTL_DEF(DRM_IOCTL_PSB_TTM_PL_WAITIDLE, psb_pl_waitidle_ioctl,
-		      DRM_AUTH),
-	PSB_IOCTL_DEF(DRM_IOCTL_PSB_TTM_PL_SETSTATUS, psb_pl_setstatus_ioctl,
-		      DRM_AUTH),
-	PSB_IOCTL_DEF(DRM_IOCTL_PSB_TTM_PL_CREATE_UB, psb_pl_ub_create_ioctl,
-		      DRM_AUTH),
-	PSB_IOCTL_DEF(DRM_IOCTL_PSB_TTM_FENCE_SIGNALED,
-		      psb_fence_signaled_ioctl, DRM_AUTH),
-	PSB_IOCTL_DEF(DRM_IOCTL_PSB_TTM_FENCE_FINISH, psb_fence_finish_ioctl,
-		      DRM_AUTH),
-	PSB_IOCTL_DEF(DRM_IOCTL_PSB_TTM_FENCE_UNREF, psb_fence_unref_ioctl,
-		      DRM_AUTH),
 };
 
-static void psb_set_uopt(struct drm_psb_uopt *uopt)
-{
-	return;
-}
-
 static void psb_lastclose(struct drm_device *dev)
 {
-	struct drm_psb_private *dev_priv =
-	    (struct drm_psb_private *) dev->dev_private;
-
 	return;
-
-	if (!dev->dev_private)
-		return;
-
-	mutex_lock(&dev_priv->cmdbuf_mutex);
-	if (dev_priv->context.buffers) {
-		vfree(dev_priv->context.buffers);
-		dev_priv->context.buffers = NULL;
-	}
-	mutex_unlock(&dev_priv->cmdbuf_mutex);
 }
 
 static void psb_do_takedown(struct drm_device *dev)
 {
-	struct drm_psb_private *dev_priv =
-	    (struct drm_psb_private *) dev->dev_private;
-	struct ttm_bo_device *bdev = &dev_priv->bdev;
+	/* FIXME: do we need to clean up the gtt here ? */
+}
 
+void mrst_get_fuse_settings(struct drm_device *dev)
+{
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	struct pci_dev *pci_root = pci_get_bus_and_slot(0, 0);
+	uint32_t fuse_value = 0;
+	uint32_t fuse_value_tmp = 0;
 
-	if (dev_priv->have_mem_mmu) {
-		ttm_bo_clean_mm(bdev, DRM_PSB_MEM_MMU);
-		dev_priv->have_mem_mmu = 0;
+#define FB_REG06 0xD0810600
+#define FB_MIPI_DISABLE  (1 << 11)
+#define FB_REG09 0xD0810900
+#define FB_REG09 0xD0810900
+#define FB_SKU_MASK  0x7000
+#define FB_SKU_SHIFT 12
+#define FB_SKU_100 0
+#define FB_SKU_100L 1
+#define FB_SKU_83 2
+	pci_write_config_dword(pci_root, 0xD0, FB_REG06);
+	pci_read_config_dword(pci_root, 0xD4, &fuse_value);
+
+	dev_priv->iLVDS_enable = fuse_value & FB_MIPI_DISABLE;
+
+	DRM_INFO("internal display is %s\n",
+		 dev_priv->iLVDS_enable ? "LVDS display" : "MIPI display");
+
+	 /*prevent Runtime suspend at start*/
+	 if (dev_priv->iLVDS_enable) {
+		dev_priv->is_lvds_on = true;
+		dev_priv->is_mipi_on = false;
+	}
+	else {
+		dev_priv->is_mipi_on = true;
+		dev_priv->is_lvds_on = false;
 	}
 
-	if (dev_priv->have_tt) {
-		ttm_bo_clean_mm(bdev, TTM_PL_TT);
-		dev_priv->have_tt = 0;
+	dev_priv->video_device_fuse = fuse_value;
+
+	pci_write_config_dword(pci_root, 0xD0, FB_REG09);
+	pci_read_config_dword(pci_root, 0xD4, &fuse_value);
+
+	DRM_INFO("SKU values is 0x%x. \n", fuse_value);
+	fuse_value_tmp = (fuse_value & FB_SKU_MASK) >> FB_SKU_SHIFT;
+
+	dev_priv->fuse_reg_value = fuse_value;
+
+	switch (fuse_value_tmp) {
+	case FB_SKU_100:
+		dev_priv->core_freq = 200;
+		break;
+	case FB_SKU_100L:
+		dev_priv->core_freq = 100;
+		break;
+	case FB_SKU_83:
+		dev_priv->core_freq = 166;
+		break;
+	default:
+		DRM_ERROR("Invalid SKU values, SKU value = 0x%08x\n", fuse_value_tmp);
+		dev_priv->core_freq = 0;
+	}
+	DRM_INFO("LNC core clk is %dMHz.\n", dev_priv->core_freq);
+	pci_dev_put(pci_root);
+}
+
+void mid_get_pci_revID (struct drm_psb_private *dev_priv)
+{
+	uint32_t platform_rev_id = 0;
+	struct pci_dev *pci_gfx_root = pci_get_bus_and_slot(0, PCI_DEVFN(2, 0));
+
+	/*get the revison ID, B0:D2:F0;0x08 */
+	pci_read_config_dword(pci_gfx_root, 0x08, &platform_rev_id);
+	dev_priv->platform_rev_id = (uint8_t) platform_rev_id;
+	pci_dev_put(pci_gfx_root);
+	PSB_DEBUG_ENTRY("platform_rev_id is %x\n",	dev_priv->platform_rev_id);
+}
+
+void mrst_get_vbt_data(struct drm_psb_private *dev_priv)
+{
+	struct mrst_vbt *vbt = &dev_priv->vbt_data;
+	u32 platform_config_address;
+	u16 new_size;
+	u8 *vbt_virtual;
+	u8 bpi;
+	u8 number_desc = 0;
+	struct mrst_timing_info *dp_ti = &dev_priv->gct_data.DTD;
+	struct gct_r10_timing_info ti;
+	void *pGCT;
+	struct pci_dev *pci_gfx_root = pci_get_bus_and_slot(0, PCI_DEVFN(2, 0));
+
+	/*get the address of the platform config vbt, B0:D2:F0;0xFC */
+	pci_read_config_dword(pci_gfx_root, 0xFC, &platform_config_address);
+	pci_dev_put(pci_gfx_root);
+	DRM_INFO("drm platform config address is %x\n",
+			platform_config_address);
+
+	/* check for platform config address == 0. */
+	/* this means fw doesn't support vbt */
+
+	if (platform_config_address == 0) {
+		vbt->size = 0;
+		return;
 	}
 
-	if (dev_priv->have_camera) {
-		ttm_bo_clean_mm(bdev, TTM_PL_CI);
-		dev_priv->have_camera = 0;
-	}
-	if (dev_priv->have_rar) {
-		ttm_bo_clean_mm(bdev, TTM_PL_RAR);
-		dev_priv->have_rar = 0;
-	}
+	/* get the virtual address of the vbt */
+	vbt_virtual = ioremap(platform_config_address, sizeof(*vbt));
 
+	memcpy(vbt, vbt_virtual, sizeof(*vbt));
+	iounmap(vbt_virtual); /* Free virtual address space */
+
+	printk(KERN_ALERT "GCT revision is %x\n", vbt->revision);
+
+	switch (vbt->revision) {
+	case 0:
+		vbt->mrst_gct = NULL;
+		vbt->mrst_gct = \
+			ioremap(platform_config_address + sizeof(*vbt) - 4,
+					vbt->size - sizeof(*vbt) + 4);
+		pGCT = vbt->mrst_gct;
+		bpi = ((struct mrst_gct_v1 *)pGCT)->PD.BootPanelIndex;
+		dev_priv->gct_data.bpi = bpi;
+		dev_priv->gct_data.pt =
+			((struct mrst_gct_v1 *)pGCT)->PD.PanelType;
+		memcpy(&dev_priv->gct_data.DTD,
+			&((struct mrst_gct_v1 *)pGCT)->panel[bpi].DTD,
+				sizeof(struct mrst_timing_info));
+		dev_priv->gct_data.Panel_Port_Control =
+		  ((struct mrst_gct_v1 *)pGCT)->panel[bpi].Panel_Port_Control;
+		dev_priv->gct_data.Panel_MIPI_Display_Descriptor =
+		  ((struct mrst_gct_v1 *)pGCT)->panel[bpi].Panel_MIPI_Display_Descriptor;
+		break;
+	case 1:
+		vbt->mrst_gct = NULL;
+		vbt->mrst_gct = \
+			ioremap(platform_config_address + sizeof(*vbt) - 4,
+					vbt->size - sizeof(*vbt) + 4);
+		pGCT = vbt->mrst_gct;
+		bpi = ((struct mrst_gct_v2 *)pGCT)->PD.BootPanelIndex;
+		dev_priv->gct_data.bpi = bpi;
+		dev_priv->gct_data.pt =
+			((struct mrst_gct_v2 *)pGCT)->PD.PanelType;
+		memcpy(&dev_priv->gct_data.DTD,
+			&((struct mrst_gct_v2 *)pGCT)->panel[bpi].DTD,
+				sizeof(struct mrst_timing_info));
+		dev_priv->gct_data.Panel_Port_Control =
+		  ((struct mrst_gct_v2 *)pGCT)->panel[bpi].Panel_Port_Control;
+		dev_priv->gct_data.Panel_MIPI_Display_Descriptor =
+		  ((struct mrst_gct_v2 *)pGCT)->panel[bpi].Panel_MIPI_Display_Descriptor;
+		break;
+	case 0x10:
+		/*header definition changed from rev 01 (v2) to rev 10h. */
+		/*so, some values have changed location*/
+		new_size = vbt->checksum; /*checksum contains lo size byte*/
+		/*LSB of mrst_gct contains hi size byte*/
+		new_size |= ((0xff & (unsigned int)vbt->mrst_gct)) << 8;
+
+		vbt->checksum = vbt->size; /*size contains the checksum*/
+		if (new_size > 0xff)
+			vbt->size = 0xff; /*restrict size to 255*/
+		else
+			vbt->size = new_size;
+
+		/* number of descriptors defined in the GCT */
+		number_desc = ((0xff00 & (unsigned int)vbt->mrst_gct)) >> 8;
+		bpi = ((0xff0000 & (unsigned int)vbt->mrst_gct)) >> 16;
+		vbt->mrst_gct = NULL;
+		vbt->mrst_gct = \
+			ioremap(platform_config_address + GCT_R10_HEADER_SIZE,
+				GCT_R10_DISPLAY_DESC_SIZE * number_desc);
+		pGCT = vbt->mrst_gct;
+		pGCT = (u8 *)pGCT + (bpi*GCT_R10_DISPLAY_DESC_SIZE);
+		dev_priv->gct_data.bpi = bpi; /*save boot panel id*/
+
+		/*copy the GCT display timings into a temp structure*/
+		memcpy(&ti, pGCT, sizeof(struct gct_r10_timing_info));
+
+		/*now copy the temp struct into the dev_priv->gct_data*/
+		dp_ti->pixel_clock = ti.pixel_clock;
+		dp_ti->hactive_hi = ti.hactive_hi;
+		dp_ti->hactive_lo = ti.hactive_lo;
+		dp_ti->hblank_hi = ti.hblank_hi;
+		dp_ti->hblank_lo = ti.hblank_lo;
+		dp_ti->hsync_offset_hi = ti.hsync_offset_hi;
+		dp_ti->hsync_offset_lo = ti.hsync_offset_lo;
+		dp_ti->hsync_pulse_width_hi = ti.hsync_pulse_width_hi;
+		dp_ti->hsync_pulse_width_lo = ti.hsync_pulse_width_lo;
+		dp_ti->vactive_hi = ti.vactive_hi;
+		dp_ti->vactive_lo = ti.vactive_lo;
+		dp_ti->vblank_hi = ti.vblank_hi;
+		dp_ti->vblank_lo = ti.vblank_lo;
+		dp_ti->vsync_offset_hi = ti.vsync_offset_hi;
+		dp_ti->vsync_offset_lo = ti.vsync_offset_lo;
+		dp_ti->vsync_pulse_width_hi = ti.vsync_pulse_width_hi;
+		dp_ti->vsync_pulse_width_lo = ti.vsync_pulse_width_lo;
+
+		/*mov the MIPI_Display_Descriptor data from GCT to dev priv*/
+		dev_priv->gct_data.Panel_MIPI_Display_Descriptor =
+							*((u8 *)pGCT + 0x0d);
+		dev_priv->gct_data.Panel_MIPI_Display_Descriptor |=
+						(*((u8 *)pGCT + 0x0e)) << 8;
+		break;
+	default:
+		printk(KERN_ERR "Unknown revision of GCT!\n");
+		vbt->size = 0;
+	}
 }
 
 static void psb_get_core_freq(struct drm_device *dev)
@@ -358,36 +433,10 @@
 	}
 }
 
-#define FB_REG06 0xD0810600
-#define FB_TOPAZ_DISABLE BIT0
-#define FB_MIPI_DISABLE  BIT11
-#define FB_REG09 0xD0810900
-#define FB_SKU_MASK  (BIT12|BIT13|BIT14)
-#define FB_SKU_SHIFT 12
-#define FB_SKU_100 0
-#define FB_SKU_100L 1
-#define FB_SKU_83 2
-
-bool mid_get_pci_revID(struct drm_psb_private *dev_priv)
-{
-	uint32_t platform_rev_id = 0;
-	struct pci_dev *pci_gfx_root = pci_get_bus_and_slot(0, PCI_DEVFN(2, 0));
-
-	/*get the revison ID, B0:D2:F0;0x08 */
-	pci_read_config_dword(pci_gfx_root, 0x08, &platform_rev_id);
-	dev_priv->platform_rev_id = (uint8_t) platform_rev_id;
-	pci_dev_put(pci_gfx_root);
-	PSB_DEBUG_ENTRY("platform_rev_id is %x\n",
-					dev_priv->platform_rev_id);
-
-	return true;
-}
-
 static int psb_do_init(struct drm_device *dev)
 {
 	struct drm_psb_private *dev_priv =
 	    (struct drm_psb_private *) dev->dev_private;
-	struct ttm_bo_device *bdev = &dev_priv->bdev;
 	struct psb_gtt *pg = dev_priv->pg;
 
 	uint32_t stolen_gtt;
@@ -396,16 +445,6 @@
 
 	int ret = -ENOMEM;
 
-
-	/*
-	 * Initialize sequence numbers for the different command
-	 * submission mechanisms.
-	 */
-
-	dev_priv->sequence[PSB_ENGINE_2D] = 0;
-	dev_priv->sequence[PSB_ENGINE_VIDEO] = 0;
-	dev_priv->sequence[LNC_ENGINE_ENCODE] = 0;
-
 	if (pg->mmu_gatt_start & 0x0FFFFFFF) {
 		DRM_ERROR("Gatt must be 256M aligned. This is a bug.\n");
 		ret = -EINVAL;
@@ -445,6 +484,7 @@
 	    pg->gatt_pages : PSB_TT_PRIV0_PLIMIT;
 	tt_start = dev_priv->gatt_free_offset - pg->mmu_gatt_start;
 	tt_pages -= tt_start >> PAGE_SHIFT;
+	/* FIXME: can we kill ta_mem_size ? */
 	dev_priv->sizes.ta_mem_size = 0;
 
 	PSB_WSGX32(0x00000000, PSB_CR_BIF_BANK0);
@@ -453,30 +493,11 @@
         PSB_WSGX32(PSB_RSGX32(PSB_CR_BIF_CTRL) | _PSB_MMU_ER_MASK,
 							PSB_CR_BIF_CTRL);
 	psb_spank(dev_priv);
-       
-      	PSB_WSGX32(pg->mmu_gatt_start, PSB_CR_BIF_TWOD_REQ_BASE);
 
-	/* TT region managed by TTM. */
-	if (!ttm_bo_init_mm(bdev, TTM_PL_TT,
-			pg->gatt_pages -
-			(pg->ci_start >> PAGE_SHIFT) -
-			((dev_priv->ci_region_size + dev_priv->rar_region_size)
-			 >> PAGE_SHIFT))) {
+	/* mmu_gatt ?? */
+	printk(KERN_INFO "TWOD base %08lX\n", (u32) pg->gatt_start);
+      	PSB_WSGX32(pg->gatt_start, PSB_CR_BIF_TWOD_REQ_BASE);
 
-		dev_priv->have_tt = 1;
-		dev_priv->sizes.tt_size =
-			(tt_pages << PAGE_SHIFT) / (1024 * 1024) / 2;
-	}
-
-	if (!ttm_bo_init_mm(bdev,
-			DRM_PSB_MEM_MMU,
-			PSB_MEM_TT_START >> PAGE_SHIFT)) {
-		dev_priv->have_mem_mmu = 1;
-		dev_priv->sizes.mmu_size =
-			PSB_MEM_TT_START / (1024*1024);
-	}
-
-	PSB_DEBUG_INIT("Init MSVDX\n");
 	return 0;
 out_err:
 	psb_do_takedown(dev);
@@ -514,18 +535,6 @@
 					(dev_priv->mmu),
 					pg->mmu_gatt_start,
 					pg->vram_stolen_size >> PAGE_SHIFT);
-			if (pg->ci_stolen_size != 0)
-				psb_mmu_remove_pfn_sequence(
-					psb_mmu_get_default_pd
-					(dev_priv->mmu),
-					pg->ci_start,
-					pg->ci_stolen_size >> PAGE_SHIFT);
-			if (pg->rar_stolen_size != 0)
-				psb_mmu_remove_pfn_sequence(
-					psb_mmu_get_default_pd
-					(dev_priv->mmu),
-					pg->rar_start,
-					pg->rar_stolen_size >> PAGE_SHIFT);
 			up_read(&pg->sem);
 			psb_mmu_driver_takedown(dev_priv->mmu);
 			dev_priv->mmu = NULL;
@@ -535,14 +544,6 @@
 			__free_page(dev_priv->scratch_page);
 			dev_priv->scratch_page = NULL;
 		}
-		if (dev_priv->has_bo_device) {
-			ttm_bo_device_release(&dev_priv->bdev);
-			dev_priv->has_bo_device = 0;
-		}
-		if (dev_priv->has_fence_device) {
-			ttm_fence_device_release(&dev_priv->fdev);
-			dev_priv->has_fence_device = 0;
-		}
 		if (dev_priv->vdc_reg) {
 			iounmap(dev_priv->vdc_reg);
 			dev_priv->vdc_reg = NULL;
@@ -552,12 +553,6 @@
 			dev_priv->sgx_reg = NULL;
 		}
 
-		if (dev_priv->tdev)
-			ttm_object_device_release(&dev_priv->tdev);
-
-		if (dev_priv->has_global)
-			psb_ttm_global_release(dev_priv);
-
 		kfree(dev_priv);
 		dev->dev_private = NULL;
 
@@ -565,7 +560,7 @@
 		psb_intel_destroy_bios(dev);
 	}
 
-	ospm_power_uninit();
+	gma_power_uninit(dev);
 
 	return 0;
 }
@@ -574,7 +569,6 @@
 static int psb_driver_load(struct drm_device *dev, unsigned long chipset)
 {
 	struct drm_psb_private *dev_priv;
-	struct ttm_bo_device *bdev;
 	unsigned long resource_start;
 	struct psb_gtt *pg;
 	unsigned long irqflags;
@@ -584,39 +578,16 @@
 	dev_priv = kzalloc(sizeof(*dev_priv), GFP_KERNEL);
 	if (dev_priv == NULL)
 		return -ENOMEM;
-	INIT_LIST_HEAD(&dev_priv->video_ctx);
 
-	dev_priv->num_pipe = 2;
-
+	if (IS_MRST(dev))
+		dev_priv->num_pipe = 1;
+	else
+		dev_priv->num_pipe = 2;
 
 	dev_priv->dev = dev;
-	bdev = &dev_priv->bdev;
-
-	ret = psb_ttm_global_init(dev_priv);
-	if (unlikely(ret != 0))
-		goto out_err;
-	dev_priv->has_global = 1;
-
-	dev_priv->tdev = ttm_object_device_init
-		(dev_priv->mem_global_ref.object, PSB_OBJECT_HASH_ORDER);
-	if (unlikely(dev_priv->tdev == NULL))
-		goto out_err;
-
-	mutex_init(&dev_priv->temp_mem);
-	mutex_init(&dev_priv->cmdbuf_mutex);
-	mutex_init(&dev_priv->reset_mutex);
-	INIT_LIST_HEAD(&dev_priv->context.validate_list);
-	INIT_LIST_HEAD(&dev_priv->context.kern_validate_list);
-
-/*	mutex_init(&dev_priv->dsr_mutex); */
-
-	spin_lock_init(&dev_priv->reloc_lock);
-
-	DRM_INIT_WAITQUEUE(&dev_priv->rel_mapped_queue);
 
 	dev->dev_private = (void *) dev_priv;
 	dev_priv->chipset = chipset;
-	psb_set_uopt(&dev_priv->uopt);
 
 	PSB_DEBUG_INIT("Mapping MMIO\n");
 	resource_start = pci_resource_start(dev->pdev, PSB_MMIO_RESOURCE);
@@ -632,28 +603,18 @@
 	if (!dev_priv->sgx_reg)
 		goto out_err;
 
-	psb_get_core_freq(dev);
-	psb_intel_opregion_init(dev);
-	psb_intel_init_bios(dev);
-
-	PSB_DEBUG_INIT("Init TTM fence and BO driver\n");
+	if (IS_MRST(dev)) {
+		mrst_get_fuse_settings(dev);
+		mrst_get_vbt_data(dev_priv);
+		mid_get_pci_revID(dev_priv);
+	} else {
+		psb_get_core_freq(dev);
+		psb_intel_opregion_init(dev);
+		psb_intel_init_bios(dev);
+	}
 
 	/* Init OSPM support */
-	ospm_power_init(dev);
-
-	ret = psb_ttm_fence_device_init(&dev_priv->fdev);
-	if (unlikely(ret != 0))
-		goto out_err;
-
-	dev_priv->has_fence_device = 1;
-	ret = ttm_bo_device_init(bdev,
-				 dev_priv->bo_global_ref.ref.object,
-				 &psb_ttm_bo_driver,
-				 DRM_PSB_FILE_PAGE_OFFSET, false);
-	if (unlikely(ret != 0))
-		goto out_err;
-	dev_priv->has_bo_device = 1;
-	ttm_lock_init(&dev_priv->ttm_lock);
+	gma_power_init(dev);
 
 	ret = -ENOMEM;
 
@@ -686,40 +647,6 @@
 	tt_pages = (pg->gatt_pages < PSB_TT_PRIV0_PLIMIT) ?
 		(pg->gatt_pages) : PSB_TT_PRIV0_PLIMIT;
 
-	/* CI/RAR use the lower half of TT. */
-	pg->ci_start = (tt_pages / 2) << PAGE_SHIFT;
-	pg->rar_start = pg->ci_start + pg->ci_stolen_size;
-
-
-	/*
-	 * Make MSVDX/TOPAZ MMU aware of the CI stolen memory area.
-	 */
-	if (dev_priv->pg->ci_stolen_size != 0) {
-		down_read(&pg->sem);
-		ret = psb_mmu_insert_pfn_sequence(psb_mmu_get_default_pd
-				(dev_priv->mmu),
-				dev_priv->ci_region_start >> PAGE_SHIFT,
-				pg->mmu_gatt_start + pg->ci_start,
-				pg->ci_stolen_size >> PAGE_SHIFT, 0);
-		up_read(&pg->sem);
-		if (ret)
-			goto out_err;
-	}
-
-	/*
-	 * Make MSVDX/TOPAZ MMU aware of the rar stolen memory area.
-	 */
-	if (dev_priv->pg->rar_stolen_size != 0) {
-		down_read(&pg->sem);
-		ret = psb_mmu_insert_pfn_sequence(
-				psb_mmu_get_default_pd(dev_priv->mmu),
-				dev_priv->rar_region_start >> PAGE_SHIFT,
-				pg->mmu_gatt_start + pg->rar_start,
-				pg->rar_stolen_size >> PAGE_SHIFT, 0);
-		up_read(&pg->sem);
-		if (ret)
-			goto out_err;
-	}
 
 	dev_priv->pf_pd = psb_mmu_alloc_pd(dev_priv->mmu, 1, 0);
 	if (!dev_priv->pf_pd)
@@ -728,14 +655,13 @@
 	psb_mmu_set_pd_context(psb_mmu_get_default_pd(dev_priv->mmu), 0);
 	psb_mmu_set_pd_context(dev_priv->pf_pd, 1);
 
-	spin_lock_init(&dev_priv->sequence_lock);
-
-	PSB_DEBUG_INIT("Begin to init MSVDX/Topaz\n");
-
 	ret = psb_do_init(dev);
 	if (ret)
 		return ret;
 
+	PSB_WSGX32(0x20000000, PSB_CR_PDS_EXEC_BASE);
+	PSB_WSGX32(0x30000000, PSB_CR_BIF_3D_REQ_BASE);
+
 /*	igd_opregion_init(&dev_priv->opregion_dev); */
 	acpi_video_register();
 	if (dev_priv->lid_state)
@@ -783,11 +709,6 @@
 #endif
 	/*Intel drm driver load is done, continue doing pvr load*/
 	DRM_DEBUG("Pvr driver load\n");
-
-/*	if (PVRCore_Init() < 0)
-		goto out_err; */
-/*	if (MRSTLFBInit(dev) < 0)
-		goto out_err;*/
 	return 0;
 out_err:
 	psb_driver_unload(dev);
@@ -803,40 +724,13 @@
 static int psb_vt_leave_ioctl(struct drm_device *dev, void *data,
 			      struct drm_file *file_priv)
 {
-	struct drm_psb_private *dev_priv = psb_priv(dev);
-	struct ttm_bo_device *bdev = &dev_priv->bdev;
-	struct ttm_mem_type_manager *man;
-	int ret;
-
-	ret = ttm_vt_lock(&dev_priv->ttm_lock, 1,
-			     psb_fpriv(file_priv)->tfile);
-	if (unlikely(ret != 0))
-		return ret;
-
-	ret = ttm_bo_evict_mm(&dev_priv->bdev, TTM_PL_TT);
-	if (unlikely(ret != 0))
-		goto out_unlock;
-
-	man = &bdev->man[TTM_PL_TT];
-
-#if 0		/* What to do with this ? */
-	if (unlikely(!drm_mm_clean(&man->manager)))
-		DRM_INFO("Warning: GATT was not clean after VT switch.\n");
-#endif
-
-	ttm_bo_swapout_all(&dev_priv->bdev);
-
 	return 0;
-out_unlock:
-	(void) ttm_vt_unlock(&dev_priv->ttm_lock);
-	return ret;
 }
 
 static int psb_vt_enter_ioctl(struct drm_device *dev, void *data,
 			      struct drm_file *file_priv)
 {
-	struct drm_psb_private *dev_priv = psb_priv(dev);
-	return ttm_vt_unlock(&dev_priv->ttm_lock);
+	return 0;
 }
 
 static int psb_sizes_ioctl(struct drm_device *dev, void *data,
@@ -945,13 +839,12 @@
 	uint32_t y;
 	uint32_t reg;
 
-	if (!ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-							OSPM_UHB_ONLY_IF_ON))
+	if (!gma_power_begin(dev, 0))
 		return 0;
 
 	reg = PSB_RVDC32(PIPEASRC);
 
-	ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+	gma_power_end(dev);
 
 	/* horizontal is the left 16 bits */
 	x = reg >> 16;
@@ -1028,11 +921,10 @@
 		drm_fb = obj_to_fb(obj);
 		psb_fb = to_psb_fb(drm_fb);
 
-		if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-					      OSPM_UHB_ONLY_IF_ON)) {
+		if (gma_power_begin(dev, 0)) {
 			REG_WRITE(DSPASURF, psb_fb->offset);
 			REG_READ(DSPASURF);
-			ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+			gma_power_end(dev);
 		} else {
 			dev_priv->saveDSPASURF = psb_fb->offset;
 		}
@@ -1118,11 +1010,10 @@
 {
 	struct drm_psb_private *dev_priv = psb_priv(dev);
 	struct drm_psb_register_rw_arg *arg = data;
-	UHBUsage usage =
-	  arg->b_force_hw_on ? OSPM_UHB_FORCE_POWER_ON : OSPM_UHB_ONLY_IF_ON;
+	bool usage = arg->b_force_hw_on ? true : false;
 
 	if (arg->display_write_mask != 0) {
-		if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND, usage)) {
+		if (gma_power_begin(dev, usage)) {
 			if (arg->display_write_mask & REGRWBITS_PFIT_CONTROLS)
 				PSB_WVDC32(arg->display.pfit_controls,
 					   PFIT_CONTROL);
@@ -1147,7 +1038,7 @@
 			if (arg->display_write_mask & REGRWBITS_VTOTAL_B)
 				PSB_WVDC32(arg->display.vtotal_b,
 					   VTOTAL_B);
-			ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+			gma_power_end(dev);
 		} else {
 			if (arg->display_write_mask & REGRWBITS_PFIT_CONTROLS)
 				dev_priv->savePFIT_CONTROL =
@@ -1172,7 +1063,7 @@
 	}
 
 	if (arg->display_read_mask != 0) {
-		if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND, usage)) {
+		if (gma_power_begin(dev, usage)) {
 			if (arg->display_read_mask &
 			    REGRWBITS_PFIT_CONTROLS)
 				arg->display.pfit_controls =
@@ -1193,7 +1084,7 @@
 				arg->display.vtotal_a = PSB_RVDC32(VTOTAL_A);
 			if (arg->display_read_mask & REGRWBITS_VTOTAL_B)
 				arg->display.vtotal_b = PSB_RVDC32(VTOTAL_B);
-			ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+			gma_power_end(dev);
 		} else {
 			if (arg->display_read_mask &
 			    REGRWBITS_PFIT_CONTROLS)
@@ -1219,7 +1110,7 @@
 	}
 
 	if (arg->overlay_write_mask != 0) {
-		if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND, usage)) {
+		if (gma_power_begin(dev, usage)) {
 			if (arg->overlay_write_mask & OV_REGRWBITS_OGAM_ALL) {
 				PSB_WVDC32(arg->overlay.OGAMC5, OV_OGAMC5);
 				PSB_WVDC32(arg->overlay.OGAMC4, OV_OGAMC4);
@@ -1270,7 +1161,7 @@
 					}
 				}
 			}
-			ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+			gma_power_end(dev);
 		} else {
 			if (arg->overlay_write_mask & OV_REGRWBITS_OGAM_ALL) {
 				dev_priv->saveOV_OGAMC5 = arg->overlay.OGAMC5;
@@ -1296,7 +1187,7 @@
 	}
 
 	if (arg->overlay_read_mask != 0) {
-		if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND, usage)) {
+		if (gma_power_begin(dev, usage)) {
 			if (arg->overlay_read_mask & OV_REGRWBITS_OGAM_ALL) {
 				arg->overlay.OGAMC5 = PSB_RVDC32(OV_OGAMC5);
 				arg->overlay.OGAMC4 = PSB_RVDC32(OV_OGAMC4);
@@ -1317,7 +1208,7 @@
 				arg->overlay.OVADD = PSB_RVDC32(OV_OVADD);
 			if (arg->overlay_read_mask & OVC_REGRWBITS_OVADD)
 				arg->overlay.OVADD = PSB_RVDC32(OVC_OVADD);
-			ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+			gma_power_end(dev);
 		} else {
 			if (arg->overlay_read_mask & OV_REGRWBITS_OGAM_ALL) {
 				arg->overlay.OGAMC5 = dev_priv->saveOV_OGAMC5;
@@ -1343,7 +1234,7 @@
 	}
 
 	if (arg->sprite_enable_mask != 0) {
-		if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND, usage)) {
+		if (gma_power_begin(dev, usage)) {
 			PSB_WVDC32(0x1F3E, DSPARB);
 			PSB_WVDC32(arg->sprite.dspa_control
 					| PSB_RVDC32(DSPACNTR), DSPACNTR);
@@ -1358,22 +1249,22 @@
 			PSB_WVDC32(arg->sprite.dspc_size, DSPCSIZE);
 			PSB_WVDC32(arg->sprite.dspc_surface, DSPCSURF);
 			PSB_RVDC32(DSPCSURF);
-			ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+			gma_power_end(dev);
 		}
 	}
 
 	if (arg->sprite_disable_mask != 0) {
-		if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND, usage)) {
+		if (gma_power_begin(dev, usage)) {
 			PSB_WVDC32(0x3F3E, DSPARB);
 			PSB_WVDC32(0x0, DSPCCNTR);
 			PSB_WVDC32(arg->sprite.dspc_surface, DSPCSURF);
 			PSB_RVDC32(DSPCSURF);
-			ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+			gma_power_end(dev);
 		}
 	}
 
 	if (arg->subpicture_enable_mask != 0) {
-		if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND, usage)) {
+		if (gma_power_begin(dev, usage)) {
 			uint32_t temp;
 			if (arg->subpicture_enable_mask & REGRWBITS_DSPACNTR) {
 				temp =  PSB_RVDC32(DSPACNTR);
@@ -1417,12 +1308,12 @@
 				PSB_WVDC32(temp, DSPCSURF);
 				PSB_RVDC32(DSPCSURF);
 			}
-			ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+			gma_power_end(dev);
 		}
 	}
 
 	if (arg->subpicture_disable_mask != 0) {
-		if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND, usage)) {
+		if (gma_power_begin(dev, usage)) {
 			uint32_t temp;
 			if (arg->subpicture_disable_mask & REGRWBITS_DSPACNTR) {
 				temp =  PSB_RVDC32(DSPACNTR);
@@ -1463,7 +1354,7 @@
 				PSB_WVDC32(temp, DSPCSURF);
 				PSB_RVDC32(DSPCSURF);
 			}
-			ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+			gma_power_end(dev);
 		}
 	}
 
@@ -1518,8 +1409,7 @@
 		dev_priv->rpm_enabled = 1;
 	}
 	/*
-	 * The driver private ioctls and TTM ioctls should be
-	 * thread-safe.
+	 * The driver private ioctls should be thread-safe.
 	 */
 
 	if ((nr >= DRM_COMMAND_BASE) && (nr < DRM_COMMAND_END)
@@ -1557,6 +1447,16 @@
 	drm_put_dev(dev);
 }
 
+static int psb_open(struct inode *inode, struct file *filp)
+{
+	return 0;
+}
+
+static int psb_release(struct inode *inode, struct file *filp)
+{
+	return 0;
+}
+
 
 static const struct dev_pm_ops psb_pm_ops = {
 	.runtime_suspend = psb_runtime_suspend,
@@ -1596,7 +1496,7 @@
 		 .open = psb_open,
 		 .release = psb_release,
 		 .unlocked_ioctl = psb_unlocked_ioctl,
-		 .mmap = psb_mmap,
+		/* .mmap = psb_mmap, */
 		 .poll = psb_poll,
 		 .fasync = drm_fasync,
 		 .read = drm_read,
@@ -1612,8 +1512,8 @@
 static struct pci_driver psb_pci_driver = {
 	.name = DRIVER_NAME,
 	.id_table = pciidlist,
-	.resume = ospm_power_resume,
-	.suspend = ospm_power_suspend,
+	.resume = gma_power_resume,
+	.suspend = gma_power_suspend,
 	.probe = psb_probe,
 	.remove = psb_remove,
 #ifdef CONFIG_PM
diff --git a/drivers/staging/gma500/psb_drv.h b/drivers/staging/gma500/psb_drv.h
index 29a3605..c3609e0 100644
--- a/drivers/staging/gma500/psb_drv.h
+++ b/drivers/staging/gma500/psb_drv.h
@@ -29,11 +29,7 @@
 #include "psb_intel_drv.h"
 #include "psb_gtt.h"
 #include "psb_powermgmt.h"
-#include "ttm/ttm_object.h"
-#include "psb_ttm_fence_driver.h"
-#include "psb_ttm_userobj_api.h"
-#include "ttm/ttm_bo_driver.h"
-#include "ttm/ttm_lock.h"
+#include "mrst.h"
 
 /*Append new drm mode definition here, align with libdrm definition*/
 #define DRM_MODE_SCALE_NO_SCALE   2
@@ -43,8 +39,11 @@
 enum {
 	CHIP_PSB_8108 = 0,
 	CHIP_PSB_8109 = 1,
+	CHIP_MRST_4100 = 2,
 };
 
+#define IS_MRST(dev) (((dev)->pci_device & 0xfffc) == 0x4100)
+
 /*
  *Hardware bugfixes
  */
@@ -52,10 +51,6 @@
 #define DRIVER_NAME "pvrsrvkm"
 #define DRIVER_DESC "drm driver for the Intel GMA500"
 #define DRIVER_AUTHOR "Intel Corporation"
-#define OSPM_PROC_ENTRY "ospm"
-#define RTPM_PROC_ENTRY "rtpm"
-#define BLC_PROC_ENTRY "mrst_blc"
-#define DISPLAY_PROC_ENTRY "display_status"
 
 #define PSB_DRM_DRIVER_DATE "2009-03-10"
 #define PSB_DRM_DRIVER_MAJOR 8
@@ -92,26 +87,10 @@
 #define PSB_TT_PRIV0_PLIMIT	 (PSB_TT_PRIV0_LIMIT >> PAGE_SHIFT)
 #define PSB_NUM_VALIDATE_BUFFERS 2048
 
-#define PSB_MEM_MMU_START       0x00000000
-#define PSB_MEM_TT_START        0xE0000000
-
-#define PSB_GL3_CACHE_CTL	0x2100
-#define PSB_GL3_CACHE_STAT	0x2108
-
 /*
  *Flags for external memory type field.
  */
 
-#define MRST_MSVDX_OFFSET	0x90000	/*MSVDX Base offset */
-#define PSB_MSVDX_OFFSET	0x50000	/*MSVDX Base offset */
-/* MSVDX MMIO region is 0x50000 - 0x57fff ==> 32KB */
-#define PSB_MSVDX_SIZE		0x10000
-
-#define LNC_TOPAZ_OFFSET	0xA0000
-#define PNW_TOPAZ_OFFSET	0xC0000
-#define PNW_GL3_OFFSET		0xB0000
-#define LNC_TOPAZ_SIZE		0x10000
-#define PNW_TOPAZ_SIZE		0x30000 /* PNW VXE285 has two cores */
 #define PSB_MMU_CACHED_MEMORY	  0x0001	/* Bind to MMU only */
 #define PSB_MMU_RO_MEMORY	  0x0002	/* MMU RO memory */
 #define PSB_MMU_WO_MEMORY	  0x0004	/* MMU WO memory */
@@ -223,20 +202,6 @@
 #define MDFLD_PNW_B0 0x04
 #define MDFLD_PNW_C0 0x08
 
-#define MDFLD_DSR_2D_3D_0 BIT0
-#define MDFLD_DSR_2D_3D_2 BIT1
-#define MDFLD_DSR_CURSOR_0 BIT2
-#define MDFLD_DSR_CURSOR_2 BIT3
-#define MDFLD_DSR_OVERLAY_0 BIT4
-#define MDFLD_DSR_OVERLAY_2 BIT5
-#define MDFLD_DSR_MIPI_CONTROL	BIT6
-#define MDFLD_DSR_2D_3D 	(MDFLD_DSR_2D_3D_0 | MDFLD_DSR_2D_3D_2)
-
-#define MDFLD_DSR_RR 45
-#define MDFLD_DPU_ENABLE BIT31
-#define MDFLD_DSR_FULLSCREEN BIT30
-#define MDFLD_DSR_DELAY (DRM_HZ / MDFLD_DSR_RR)
-
 #define PSB_PWR_STATE_ON		1
 #define PSB_PWR_STATE_OFF		2
 
@@ -250,9 +215,6 @@
 #define PSB_PCIx_MSI_ADDR_LOC		0x94
 #define PSB_PCIx_MSI_DATA_LOC		0x98
 
-#define MDFLD_PLANE_MAX_WIDTH		2048
-#define MDFLD_PLANE_MAX_HEIGHT		2048
-
 struct opregion_header;
 struct opregion_acpi;
 struct opregion_swsci;
@@ -266,119 +228,16 @@
 	int enabled;
 };
 
-/*
- *User options.
- */
-
-struct drm_psb_uopt {
-	int pad; /*keep it here in case we use it in future*/
-};
-
-/**
- *struct psb_context
- *
- *@buffers:	 array of pre-allocated validate buffers.
- *@used_buffers: number of buffers in @buffers array currently in use.
- *@validate_buffer: buffers validated from user-space.
- *@kern_validate_buffers : buffers validated from kernel-space.
- *@fence_flags : Fence flags to be used for fence creation.
- *
- *This structure is used during execbuf validation.
- */
-
-struct psb_context {
-	struct psb_validate_buffer *buffers;
-	uint32_t used_buffers;
-	struct list_head validate_list;
-	struct list_head kern_validate_list;
-	uint32_t fence_types;
-	uint32_t val_seq;
-};
-
-struct psb_validate_buffer;
-
-/* Currently defined profiles */
-enum VAProfile {
-	VAProfileMPEG2Simple		= 0,
-	VAProfileMPEG2Main		= 1,
-	VAProfileMPEG4Simple		= 2,
-	VAProfileMPEG4AdvancedSimple	= 3,
-	VAProfileMPEG4Main		= 4,
-	VAProfileH264Baseline		= 5,
-	VAProfileH264Main		= 6,
-	VAProfileH264High		= 7,
-	VAProfileVC1Simple		= 8,
-	VAProfileVC1Main		= 9,
-	VAProfileVC1Advanced		= 10,
-	VAProfileH263Baseline		= 11,
-	VAProfileJPEGBaseline           = 12,
-	VAProfileH264ConstrainedBaseline = 13
-};
-
-/* Currently defined entrypoints */
-enum VAEntrypoint {
-	VAEntrypointVLD		= 1,
-	VAEntrypointIZZ		= 2,
-	VAEntrypointIDCT	= 3,
-	VAEntrypointMoComp	= 4,
-	VAEntrypointDeblocking	= 5,
-	VAEntrypointEncSlice	= 6,	/* slice level encode */
-	VAEntrypointEncPicture 	= 7	/* pictuer encode, JPEG, etc */
-};
-
-
-struct psb_video_ctx {
-	struct list_head head;
-	struct file *filp; /* DRM device file pointer */
-	int ctx_type; /* profile<<8|entrypoint */
-	/* todo: more context specific data for multi-context support */
-};
-
-#define MODE_SETTING_IN_CRTC 	0x1
-#define MODE_SETTING_IN_ENCODER 0x2
-#define MODE_SETTING_ON_GOING 	0x3
-#define MODE_SETTING_IN_DSR 	0x4
-#define MODE_SETTING_ENCODER_DONE 0x8
-#define GCT_R10_HEADER_SIZE	16
-#define GCT_R10_DISPLAY_DESC_SIZE	28
-
 struct drm_psb_private {
-	/*
-	 * DSI info.
-	 */
-	void * dbi_dsr_info;
-	void * dsi_configs[2];
-
-	/*
-	 *TTM Glue.
-	 */
-
-	struct drm_global_reference mem_global_ref;
-	struct ttm_bo_global_ref bo_global_ref;
-	int has_global;
-
 	struct drm_device *dev;
-	struct ttm_object_device *tdev;
-	struct ttm_fence_device fdev;
-	struct ttm_bo_device bdev;
-	struct ttm_lock ttm_lock;
-	struct vm_operations_struct *ttm_vm_ops;
-	int has_fence_device;
-	int has_bo_device;
 
 	unsigned long chipset;
 
-	struct drm_psb_uopt uopt;
-
 	struct psb_gtt *pg;
 
 	/*GTT Memory manager*/
 	struct psb_gtt_mm *gtt_mm;
-
 	struct page *scratch_page;
-	uint32_t sequence[PSB_NUM_ENGINES];
-	uint32_t last_sequence[PSB_NUM_ENGINES];
-	uint32_t last_submitted_seq[PSB_NUM_ENGINES];
 
 	struct psb_mmu_driver *mmu;
 	struct psb_mmu_pd *pf_pd;
@@ -387,21 +246,22 @@
 	uint8_t *vdc_reg;
 	uint32_t gatt_free_offset;
 
-	/* IMG video context */
-	struct list_head video_ctx;
-
-
-
 	/*
 	 *Fencing / irq.
 	 */
 
 	uint32_t vdc_irq_mask;
 	uint32_t pipestat[PSB_NUM_PIPE];
-	bool vblanksEnabledForFlips;
 
 	spinlock_t irqmask_lock;
-	spinlock_t sequence_lock;
+
+	/*
+	 * Power
+         */
+
+	bool suspended;
+	bool display_power;
+	int display_count;
 
 	/*
 	 *Modesetting
@@ -413,40 +273,9 @@
 	uint32_t num_pipe;
 
 	/*
-	 * CI share buffer
-	 */
-	unsigned int ci_region_start;
-	unsigned int ci_region_size;
-
-	/*
-	 * RAR share buffer;
-	 */
-	unsigned int rar_region_start;
-	unsigned int rar_region_size;
-
-	/*
 	 *Memory managers
 	 */
 
-	int have_camera;
-	int have_rar;
-	int have_tt;
-	int have_mem_mmu;
-	struct mutex temp_mem;
-
-	/*
-	 *Relocation buffer mapping.
-	 */
-
-	spinlock_t reloc_lock;
-	unsigned int rel_mapped_pages;
-	wait_queue_head_t rel_mapped_queue;
-
-	/*
-	 *SAREA
-	 */
-	struct drm_psb_sarea *sarea_priv;
-
 	/*
 	*OSPM info
 	*/
@@ -458,7 +287,8 @@
 
 	struct drm_psb_sizes_arg sizes;
 
-	uint32_t fuse_reg_value;
+	u32 fuse_reg_value;
+	u32 video_device_fuse;
 
 	/* pci revision id for B0:D2:F0 */
 	uint8_t platform_rev_id;
@@ -483,6 +313,7 @@
 	unsigned int lvds_use_ssc:1;
 	int lvds_ssc_freq;
 	bool is_lvds_on;
+	bool is_mipi_on;
 
 	unsigned int core_freq;
 	uint32_t iLVDS_enable;
@@ -490,6 +321,20 @@
 	/*runtime PM state*/
 	int rpm_enabled;
 
+	/* Moorestown specific */
+	struct mrst_vbt vbt_data;
+	struct mrst_gct_data gct_data;
+
+	/* Moorestown pipe config register value cache */
+	uint32_t pipeconf;
+	uint32_t pipeconf1;
+	uint32_t pipeconf2;
+
+	/* Moorestown plane control register value cache */
+	uint32_t dspcntr;
+	uint32_t dspcntr1;
+	uint32_t dspcntr2;
+
 	/*
 	 *Register state
 	 */
@@ -595,98 +440,11 @@
 	uint32_t saveOVC_OGAMC4;
 	uint32_t saveOVC_OGAMC5;
 
-	/*
-	 * extra MDFLD Register state
-	 */
-	uint32_t saveHDMIPHYMISCCTL;
-	uint32_t saveHDMIB_CONTROL;
-	uint32_t saveDSPCCNTR;
-	uint32_t savePIPECCONF;
-	uint32_t savePIPECSRC;
-	uint32_t saveHTOTAL_C;
-	uint32_t saveHBLANK_C;
-	uint32_t saveHSYNC_C;
-	uint32_t saveVTOTAL_C;
-	uint32_t saveVBLANK_C;
-	uint32_t saveVSYNC_C;
-	uint32_t saveDSPCSTRIDE;
-	uint32_t saveDSPCSIZE;
-	uint32_t saveDSPCPOS;
-	uint32_t saveDSPCSURF;
-	uint32_t saveDSPCLINOFF;
-	uint32_t saveDSPCTILEOFF;
-	uint32_t saveDSPCCURSOR_CTRL;
-	uint32_t saveDSPCCURSOR_BASE;
-	uint32_t saveDSPCCURSOR_POS;
-	uint32_t save_palette_c[256];
-	uint32_t saveOV_OVADD_C;
-	uint32_t saveOV_OGAMC0_C;
-	uint32_t saveOV_OGAMC1_C;
-	uint32_t saveOV_OGAMC2_C;
-	uint32_t saveOV_OGAMC3_C;
-	uint32_t saveOV_OGAMC4_C;
-	uint32_t saveOV_OGAMC5_C;
-
-	/* DSI reg save */
-	uint32_t saveDEVICE_READY_REG;
-	uint32_t saveINTR_EN_REG;
-	uint32_t saveDSI_FUNC_PRG_REG;
-	uint32_t saveHS_TX_TIMEOUT_REG;
-	uint32_t saveLP_RX_TIMEOUT_REG;
-	uint32_t saveTURN_AROUND_TIMEOUT_REG;
-	uint32_t saveDEVICE_RESET_REG;
-	uint32_t saveDPI_RESOLUTION_REG;
-	uint32_t saveHORIZ_SYNC_PAD_COUNT_REG;
-	uint32_t saveHORIZ_BACK_PORCH_COUNT_REG;
-	uint32_t saveHORIZ_FRONT_PORCH_COUNT_REG;
-	uint32_t saveHORIZ_ACTIVE_AREA_COUNT_REG;
-	uint32_t saveVERT_SYNC_PAD_COUNT_REG;
-	uint32_t saveVERT_BACK_PORCH_COUNT_REG;
-	uint32_t saveVERT_FRONT_PORCH_COUNT_REG;
-	uint32_t saveHIGH_LOW_SWITCH_COUNT_REG;
-	uint32_t saveINIT_COUNT_REG;
-	uint32_t saveMAX_RET_PAK_REG;
-	uint32_t saveVIDEO_FMT_REG;
-	uint32_t saveEOT_DISABLE_REG;
-	uint32_t saveLP_BYTECLK_REG;
-	uint32_t saveHS_LS_DBI_ENABLE_REG;
-	uint32_t saveTXCLKESC_REG;
-	uint32_t saveDPHY_PARAM_REG;
-	uint32_t saveMIPI_CONTROL_REG;
-	uint32_t saveMIPI;
-	uint32_t saveMIPI_C;
-	void (*init_drvIC)(struct drm_device *dev);
-	void (*dsi_prePowerState)(struct drm_device *dev);
-	void (*dsi_postPowerState)(struct drm_device *dev);
-
-	/* DPST Register Save */
-	uint32_t saveHISTOGRAM_INT_CONTROL_REG;
-	uint32_t saveHISTOGRAM_LOGIC_CONTROL_REG;
-	uint32_t savePWM_CONTROL_LOGIC;
-
 	/* MSI reg save */
-
 	uint32_t msi_addr;
 	uint32_t msi_data;
 
 	/*
-	 *Scheduling.
-	 */
-
-	struct mutex reset_mutex;
-	struct mutex cmdbuf_mutex;
-	/*uint32_t ta_mem_pages;
-	struct psb_ta_mem *ta_mem;
-	int force_ta_mem_load;*/
-	atomic_t val_seq;
-
-	/*
-	 *TODO: change this to be per drm-context.
-	 */
-
-	struct psb_context context;
-
-	/*
 	 * LID-Switch
 	 */
 	spinlock_t lid_lock;
@@ -699,8 +457,6 @@
 	 *Watchdog
 	 */
 
-	int timer_available;
-
 	uint32_t apm_reg;
 	uint16_t apm_base;
 
@@ -716,73 +472,17 @@
 };
 
 
-struct psb_file_data {	/* TODO: Audit this, remove the indirection and set
-			   it up properly in open/postclose  ACFIXME */
-	void *priv;
-};
-
-struct psb_fpriv {
-	struct ttm_object_file *tfile;
-};
-
 struct psb_mmu_driver;
 
 extern int drm_crtc_probe_output_modes(struct drm_device *dev, int, int);
 extern int drm_pick_crtcs(struct drm_device *dev);
 
-static inline struct psb_fpriv *psb_fpriv(struct drm_file *file_priv)
-{
-	struct psb_file_data *pvr_file_priv
-			= (struct psb_file_data *)file_priv->driver_priv;
-	return (struct psb_fpriv *) pvr_file_priv->priv;
-}
-
 static inline struct drm_psb_private *psb_priv(struct drm_device *dev)
 {
 	return (struct drm_psb_private *) dev->dev_private;
 }
 
 /*
- *TTM glue. psb_ttm_glue.c
- */
-
-extern int psb_open(struct inode *inode, struct file *filp);
-extern int psb_release(struct inode *inode, struct file *filp);
-extern int psb_mmap(struct file *filp, struct vm_area_struct *vma);
-
-extern int psb_fence_signaled_ioctl(struct drm_device *dev, void *data,
-				    struct drm_file *file_priv);
-extern int psb_verify_access(struct ttm_buffer_object *bo,
-			     struct file *filp);
-extern ssize_t psb_ttm_read(struct file *filp, char __user *buf,
-			    size_t count, loff_t *f_pos);
-extern ssize_t psb_ttm_write(struct file *filp, const char __user *buf,
-			    size_t count, loff_t *f_pos);
-extern int psb_fence_finish_ioctl(struct drm_device *dev, void *data,
-				  struct drm_file *file_priv);
-extern int psb_fence_unref_ioctl(struct drm_device *dev, void *data,
-				 struct drm_file *file_priv);
-extern int psb_pl_waitidle_ioctl(struct drm_device *dev, void *data,
-				 struct drm_file *file_priv);
-extern int psb_pl_setstatus_ioctl(struct drm_device *dev, void *data,
-				  struct drm_file *file_priv);
-extern int psb_pl_synccpu_ioctl(struct drm_device *dev, void *data,
-				struct drm_file *file_priv);
-extern int psb_pl_unref_ioctl(struct drm_device *dev, void *data,
-			      struct drm_file *file_priv);
-extern int psb_pl_reference_ioctl(struct drm_device *dev, void *data,
-				  struct drm_file *file_priv);
-extern int psb_pl_create_ioctl(struct drm_device *dev, void *data,
-			       struct drm_file *file_priv);
-extern int psb_pl_ub_create_ioctl(struct drm_device *dev, void *data,
-			       struct drm_file *file_priv);
-extern int psb_extension_ioctl(struct drm_device *dev, void *data,
-			       struct drm_file *file_priv);
-extern int psb_ttm_global_init(struct drm_psb_private *dev_priv);
-extern void psb_ttm_global_release(struct drm_psb_private *dev_priv);
-extern int psb_getpageaddrs_ioctl(struct drm_device *dev, void *data,
-				struct drm_file *file_priv);
-/*
  *MMU stuff.
  */
 
@@ -825,31 +525,6 @@
 				 uint32_t desired_tile_stride,
 				 uint32_t hw_tile_stride);
 /*
- *psb_sgx.c
- */
-
-
-
-extern int psb_cmdbuf_ioctl(struct drm_device *dev, void *data,
-			    struct drm_file *file_priv);
-extern int psb_reg_submit(struct drm_psb_private *dev_priv,
-			  uint32_t *regs, unsigned int cmds);
-
-
-extern void psb_fence_or_sync(struct drm_file *file_priv,
-			      uint32_t engine,
-			      uint32_t fence_types,
-			      uint32_t fence_flags,
-			      struct list_head *list,
-			      struct psb_ttm_fence_rep *fence_arg,
-			      struct ttm_fence_object **fence_p);
-extern int psb_validate_kernel_buffer(struct psb_context *context,
-				      struct ttm_buffer_object *bo,
-				      uint32_t fence_class,
-				      uint64_t set_flags,
-				      uint64_t clr_flags);
-
-/*
  *psb_irq.c
  */
 
@@ -859,8 +534,6 @@
 extern void psb_irq_preinstall(struct drm_device *dev);
 extern int psb_irq_postinstall(struct drm_device *dev);
 extern void psb_irq_uninstall(struct drm_device *dev);
-extern void psb_irq_preinstall_islands(struct drm_device *dev, int hw_islands);
-extern int psb_irq_postinstall_islands(struct drm_device *dev, int hw_islands);
 extern void psb_irq_turn_on_dpst(struct drm_device *dev);
 extern void psb_irq_turn_off_dpst(struct drm_device *dev);
 
@@ -878,29 +551,6 @@
 extern u32 psb_get_vblank_counter(struct drm_device *dev, int crtc);
 
 /*
- *psb_fence.c
- */
-
-extern void psb_fence_handler(struct drm_device *dev, uint32_t class);
-
-extern int psb_fence_emit_sequence(struct ttm_fence_device *fdev,
-				   uint32_t fence_class,
-				   uint32_t flags, uint32_t *sequence,
-				   unsigned long *timeout_jiffies);
-extern void psb_fence_error(struct drm_device *dev,
-			    uint32_t class,
-			    uint32_t sequence, uint32_t type, int error);
-extern int psb_ttm_fence_device_init(struct ttm_fence_device *fdev);
-
-/* MSVDX/Topaz stuff */
-extern int psb_remove_videoctx(struct drm_psb_private *dev_priv, struct file *filp);
-
-extern int lnc_video_frameskip(struct drm_device *dev,
-			       uint64_t user_pointer);
-extern int lnc_video_getparam(struct drm_device *dev, void *data,
-			      struct drm_file *file_priv);
-
-/*
  * psb_opregion.c
  */
 extern int psb_intel_opregion_init(struct drm_device *dev);
@@ -930,6 +580,9 @@
 
 extern void psb_spank(struct drm_psb_private *dev_priv);
 
+extern int psbfb_2d_submit(struct drm_psb_private *dev_priv, uint32_t *cmdbuf,
+	 	  	   unsigned size);
+
 /*
  *psb_reset.c
  */
@@ -950,6 +603,21 @@
 int psb_get_brightness(struct backlight_device *bd);
 struct backlight_device * psb_get_backlight_device(void);
 
+/* mrst_crtc.c */
+extern const struct drm_crtc_helper_funcs mrst_helper_funcs;
+
+/* mrst_lvds.c */
+extern void mrst_lvds_init(struct drm_device *dev,
+		    struct psb_intel_mode_device *mode_dev);
+
+/* psb_intel_lvds.c */
+extern void psb_intel_lvds_prepare(struct drm_encoder *encoder);
+extern void psb_intel_lvds_commit(struct drm_encoder *encoder);
+extern const struct drm_connector_helper_funcs
+					psb_intel_lvds_connector_helper_funcs;
+extern const struct drm_connector_funcs psb_intel_lvds_connector_funcs;
+
+
 /*
  *Debug print bits setting
  */
@@ -975,7 +643,6 @@
 
 extern int drm_psb_debug;
 extern int drm_psb_no_fb;
-extern int drm_psb_disable_vsync;
 extern int drm_idle_check_interval;
 
 #define PSB_DEBUG_GENERAL(_fmt, _arg...) \
diff --git a/drivers/staging/gma500/psb_fb.c b/drivers/staging/gma500/psb_fb.c
index f67f53b..665096f 100644
--- a/drivers/staging/gma500/psb_fb.c
+++ b/drivers/staging/gma500/psb_fb.c
@@ -36,9 +36,7 @@
 #include "psb_drv.h"
 #include "psb_intel_reg.h"
 #include "psb_intel_drv.h"
-#include "psb_ttm_userobj_api.h"
 #include "psb_fb.h"
-#include "psb_sgx.h"
 #include "psb_pvr_glue.h"
 
 static void psb_user_framebuffer_destroy(struct drm_framebuffer *fb);
@@ -194,7 +192,7 @@
 	struct drm_device *dev = psbfb->base.dev;
 	struct drm_psb_private *dev_priv = dev->dev_private;
 	struct psb_gtt *pg = dev_priv->pg;
-	unsigned long phys_addr = (unsigned long)pg->stolen_base;;
+	unsigned long phys_addr = (unsigned long)pg->stolen_base;
 
 	page_num = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
 
@@ -272,6 +270,31 @@
 	return 0;
 }
 
+static int psbfb_ioctl(struct fb_info *info, unsigned int cmd, unsigned long arg)
+{
+	struct psb_fbdev *fbdev = info->par;
+	struct psb_framebuffer *psbfb = fbdev->pfb;
+	struct drm_device *dev = psbfb->base.dev;
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	u32 __user *p = (u32 __user *)arg;
+	u32 l;
+	u32 buf[32];
+	switch (cmd) {
+	case 0x12345678:
+		if (!capable(CAP_SYS_RAWIO))
+			return -EPERM;
+		if (get_user(l, p))
+			return -EFAULT;
+		if (l > 32)
+			return -EMSGSIZE;
+		if (copy_from_user(buf, p + 1, l * sizeof(u32)))
+			return -EFAULT;
+		psbfb_2d_submit(dev_priv, buf, l);
+		return 0;
+	default:
+		return -ENOTTY;
+	}
+}
 
 static struct fb_ops psbfb_ops = {
 	.owner = THIS_MODULE,
@@ -284,6 +307,7 @@
 	.fb_imageblit = psbfb_imageblit,
 	.fb_mmap = psbfb_mmap,
 	.fb_sync = psbfb_sync,
+	.fb_ioctl = psbfb_ioctl,
 };
 
 static struct drm_framebuffer *psb_framebuffer_create
@@ -317,6 +341,8 @@
 			(struct drm_device *dev, struct drm_file *filp,
 			 struct drm_mode_fb_cmd *r)
 {
+        return NULL;
+#if 0
 	struct ttm_buffer_object *bo = NULL;
 	uint64_t size;
 
@@ -332,7 +358,6 @@
 	/* JB: TODO not drop, refcount buffer */
 	return psb_framebuffer_create(dev, r, bo);
 
-#if 0
 	struct psb_framebuffer *psbfb;
 	struct drm_framebuffer *fb;
 	struct fb_info *info;
@@ -698,8 +723,15 @@
 
 	psb_create_backlight_property(dev);
 
-	psb_intel_lvds_init(dev, &dev_priv->mode_dev);
-	/* psb_intel_sdvo_init(dev, SDVOB); */
+	if (IS_MRST(dev)) {
+		if (dev_priv->iLVDS_enable)
+			mrst_lvds_init(dev, &dev_priv->mode_dev);
+		else
+			DRM_ERROR("DSI is not supported\n");
+	} else {
+		psb_intel_lvds_init(dev, &dev_priv->mode_dev);
+		psb_intel_sdvo_init(dev, SDVOB);
+	}
 
 	list_for_each_entry(connector, &dev->mode_config.connector_list,
 			    head) {
@@ -716,7 +748,10 @@
 			break;
 		case INTEL_OUTPUT_LVDS:
 			PSB_DEBUG_ENTRY("LVDS.\n");
-			crtc_mask = (1 << 1);
+			if (IS_MRST(dev))
+				crtc_mask = (1 << 0);
+			else
+				crtc_mask = (1 << 1);
 			clone_mask = (1 << INTEL_OUTPUT_LVDS);
 			break;
 		case INTEL_OUTPUT_MIPI:
diff --git a/drivers/staging/gma500/psb_fence.c b/drivers/staging/gma500/psb_fence.c
deleted file mode 100644
index a70aa64..0000000
--- a/drivers/staging/gma500/psb_fence.c
+++ /dev/null
@@ -1,122 +0,0 @@
-/*
- * Copyright (c) 2007, Intel Corporation.
- * All Rights Reserved.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- *
- *
- * Authors: Thomas Hellstrom <thomas-at-tungstengraphics-dot-com>
- */
-
-#include <drm/drmP.h>
-#include "psb_drv.h"
-
-
-static void psb_fence_poll(struct ttm_fence_device *fdev,
-			   uint32_t fence_class, uint32_t waiting_types)
-{
-	struct drm_psb_private *dev_priv =
-	    container_of(fdev, struct drm_psb_private, fdev);
-
-
-	if (unlikely(!dev_priv))
-		return;
-
-	if (waiting_types == 0)
-		return;
-
-	/* DRM_ERROR("Polling fence sequence, got 0x%08x\n", sequence); */
-	ttm_fence_handler(fdev, fence_class, 0 /* Sequence */,
-			_PSB_FENCE_TYPE_EXE, 0);
-}
-
-void psb_fence_error(struct drm_device *dev,
-		     uint32_t fence_class,
-		     uint32_t sequence, uint32_t type, int error)
-{
-	struct drm_psb_private *dev_priv = psb_priv(dev);
-	struct ttm_fence_device *fdev = &dev_priv->fdev;
-	unsigned long irq_flags;
-	struct ttm_fence_class_manager *fc =
-	    &fdev->fence_class[fence_class];
-
-	BUG_ON(fence_class >= PSB_NUM_ENGINES);
-	write_lock_irqsave(&fc->lock, irq_flags);
-	ttm_fence_handler(fdev, fence_class, sequence, type, error);
-	write_unlock_irqrestore(&fc->lock, irq_flags);
-}
-
-int psb_fence_emit_sequence(struct ttm_fence_device *fdev,
-			    uint32_t fence_class,
-			    uint32_t flags, uint32_t *sequence,
-			    unsigned long *timeout_jiffies)
-{
-	struct drm_psb_private *dev_priv =
-	    container_of(fdev, struct drm_psb_private, fdev);
-
-	if (!dev_priv)
-		return -EINVAL;
-
-	if (fence_class >= PSB_NUM_ENGINES)
-		return -EINVAL;
-
-	DRM_ERROR("Unexpected fence class\n");
-	return -EINVAL;
-}
-
-static void psb_fence_lockup(struct ttm_fence_object *fence,
-			     uint32_t fence_types)
-{
-	DRM_ERROR("Unsupported fence class\n");
-}
-
-void psb_fence_handler(struct drm_device *dev, uint32_t fence_class)
-{
-	struct drm_psb_private *dev_priv = psb_priv(dev);
-	struct ttm_fence_device *fdev = &dev_priv->fdev;
-	struct ttm_fence_class_manager *fc =
-	    &fdev->fence_class[fence_class];
-	unsigned long irq_flags;
-
-	write_lock_irqsave(&fc->lock, irq_flags);
-	psb_fence_poll(fdev, fence_class, fc->waiting_types);
-	write_unlock_irqrestore(&fc->lock, irq_flags);
-}
-
-
-static struct ttm_fence_driver psb_ttm_fence_driver = {
-	.has_irq = NULL,
-	.emit = psb_fence_emit_sequence,
-	.flush = NULL,
-	.poll = psb_fence_poll,
-	.needed_flush = NULL,
-	.wait = NULL,
-	.signaled = NULL,
-	.lockup = psb_fence_lockup,
-};
-
-int psb_ttm_fence_device_init(struct ttm_fence_device *fdev)
-{
-	struct drm_psb_private *dev_priv =
-		container_of(fdev, struct drm_psb_private, fdev);
-	struct ttm_fence_class_init fci = {.wrap_diff = (1 << 30),
-		.flush_diff = (1 << 29),
-		.sequence_mask = 0xFFFFFFFF
-	};
-
-	return ttm_fence_device_init(PSB_NUM_ENGINES,
-				     dev_priv->mem_global_ref.object,
-				     fdev, &fci, 1,
-				     &psb_ttm_fence_driver);
-}
diff --git a/drivers/staging/gma500/psb_gtt.c b/drivers/staging/gma500/psb_gtt.c
index 53c1e1e..093d7dfee 100644
--- a/drivers/staging/gma500/psb_gtt.c
+++ b/drivers/staging/gma500/psb_gtt.c
@@ -75,11 +75,10 @@
 	struct drm_device *dev = pg->dev;
 	struct drm_psb_private *dev_priv = dev->dev_private;
 	unsigned gtt_pages;
-	unsigned long stolen_size, vram_stolen_size, ci_stolen_size;
-	unsigned long rar_stolen_size;
+	unsigned long stolen_size, vram_stolen_size;
 	unsigned i, num_pages;
 	unsigned pfn_base;
-	uint32_t ci_pages, vram_pages;
+	uint32_t vram_pages;
 	uint32_t tt_pages;
 	uint32_t *ttm_gtt_map;
 	uint32_t dvmt_mode = 0;
@@ -102,7 +101,7 @@
 	pg->gatt_start = pci_resource_start(dev->pdev, PSB_GATT_RESOURCE);
 	/* fix me: video mmu has hw bug to access 0x0D0000000,
 	 * then make gatt start at 0x0e000,0000 */
-	pg->mmu_gatt_start = PSB_MEM_TT_START;
+	pg->mmu_gatt_start = 0xE0000000;
 	pg->gtt_start = pci_resource_start(dev->pdev, PSB_GTT_RESOURCE);
 	gtt_pages =
 	    pci_resource_len(dev->pdev, PSB_GTT_RESOURCE) >> PAGE_SHIFT;
@@ -112,35 +111,20 @@
 	pci_read_config_dword(dev->pdev, PSB_BSM, &pg->stolen_base);
 	vram_stolen_size = pg->gtt_phys_start - pg->stolen_base - PAGE_SIZE;
 
-	/* CI is not included in the stolen size since the TOPAZ MMU bug */
-	ci_stolen_size = dev_priv->ci_region_size;
-	/* Don't add CI & RAR share buffer space
-	 * managed by TTM to stolen_size */
 	stolen_size = vram_stolen_size;
 
-	rar_stolen_size = dev_priv->rar_region_size;
-
 	printk(KERN_INFO"GMMADR(region 0) start: 0x%08x (%dM).\n",
 		pg->gatt_start, pg->gatt_pages/256);
 	printk(KERN_INFO"GTTADR(region 3) start: 0x%08x (can map %dM RAM), and actual RAM base 0x%08x.\n",
 		pg->gtt_start, gtt_pages * 4, pg->gtt_phys_start);
-	printk(KERN_INFO "Stole memory information\n");
-	printk(KERN_INFO "      base in RAM: 0x%x\n", pg->stolen_base);
-	printk(KERN_INFO "      size: %luK, calculated by (GTT RAM base) - (Stolen base), seems wrong\n",
+	printk(KERN_INFO "Stolen memory information\n");
+	printk(KERN_INFO "       base in RAM: 0x%x\n", pg->stolen_base);
+	printk(KERN_INFO "       size: %luK, calculated by (GTT RAM base) - (Stolen base), seems wrong\n",
 		vram_stolen_size/1024);
 	dvmt_mode = (pg->gmch_ctrl >> 4) & 0x7;
 	printk(KERN_INFO "      the correct size should be: %dM(dvmt mode=%d)\n",
 		(dvmt_mode == 1) ? 1 : (2 << (dvmt_mode - 1)), dvmt_mode);
 
-	if (ci_stolen_size > 0)
-		printk(KERN_INFO"CI Stole memory: RAM base = 0x%08x, size = %lu M\n",
-				dev_priv->ci_region_start,
-				ci_stolen_size / 1024 / 1024);
-	if (rar_stolen_size > 0)
-		printk(KERN_INFO "RAR Stole memory: RAM base = 0x%08x, size = %lu M\n",
-			dev_priv->rar_region_start,
-			rar_stolen_size / 1024 / 1024);
-
 	if (resume && (gtt_pages != pg->gtt_pages) &&
 	    (stolen_size != pg->stolen_size)) {
 		DRM_ERROR("GTT resume error.\n");
@@ -151,8 +135,6 @@
 	pg->gtt_pages = gtt_pages;
 	pg->stolen_size = stolen_size;
 	pg->vram_stolen_size = vram_stolen_size;
-	pg->ci_stolen_size = ci_stolen_size;
-	pg->rar_stolen_size = rar_stolen_size;
 	pg->gtt_map =
 	    ioremap_nocache(pg->gtt_phys_start, gtt_pages << PAGE_SHIFT);
 	if (!pg->gtt_map) {
@@ -197,33 +179,6 @@
 		iowrite32(pte, pg->gtt_map + i);
 
 	/*
-	 * insert CI stolen pages
-	 */
-
-	pfn_base = dev_priv->ci_region_start >> PAGE_SHIFT;
-	ci_pages = num_pages = ci_stolen_size >> PAGE_SHIFT;
-	printk(KERN_INFO"Set up %d CI stolen pages starting at 0x%08x, GTT offset %dK\n",
-	       num_pages, pfn_base, (ttm_gtt_map - pg->gtt_map) * 4);
-	for (i = 0; i < num_pages; ++i) {
-		pte = psb_gtt_mask_pte(pfn_base + i, 0);
-		iowrite32(pte, ttm_gtt_map + i);
-	}
-
-	/*
-	 * insert RAR stolen pages
-	 */
-	if (rar_stolen_size != 0) {
-		pfn_base = dev_priv->rar_region_start >> PAGE_SHIFT;
-		num_pages = rar_stolen_size >> PAGE_SHIFT;
-		printk(KERN_INFO"Set up %d RAR stolen pages starting at 0x%08x, GTT offset %dK\n",
-			num_pages, pfn_base,
-			(ttm_gtt_map - pg->gtt_map + i) * 4);
-		for (; i < num_pages + ci_pages; ++i) {
-			pte = psb_gtt_mask_pte(pfn_base + i - ci_pages, 0);
-			iowrite32(pte, ttm_gtt_map + i);
-		}
-	}
-	/*
 	 * Init rest of gtt managed by TTM.
 	 */
 
diff --git a/drivers/staging/gma500/psb_gtt.h b/drivers/staging/gma500/psb_gtt.h
index 0272f83..8a0ef77 100644
--- a/drivers/staging/gma500/psb_gtt.h
+++ b/drivers/staging/gma500/psb_gtt.h
@@ -29,8 +29,6 @@
 	int initialized;
 	uint32_t gatt_start;
 	uint32_t mmu_gatt_start;
-	uint32_t ci_start;
-	uint32_t rar_start;
 	uint32_t gtt_start;
 	uint32_t gtt_phys_start;
 	unsigned gtt_pages;
@@ -41,8 +39,6 @@
 	u16 gmch_ctrl;
 	unsigned long stolen_size;
 	unsigned long vram_stolen_size;
-	unsigned long ci_stolen_size;
-	unsigned long rar_stolen_size;
 	uint32_t *gtt_map;
 	struct rw_semaphore sem;
 };
diff --git a/drivers/staging/gma500/psb_intel_display.c b/drivers/staging/gma500/psb_intel_display.c
index 80b37f4..b462f32 100644
--- a/drivers/staging/gma500/psb_intel_display.c
+++ b/drivers/staging/gma500/psb_intel_display.c
@@ -359,8 +359,7 @@
 		return 0;
 	}
 
-	if (!ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-				       OSPM_UHB_FORCE_POWER_ON))
+	if (!gma_power_begin(dev, true))
 		return 0;
 
 	Start = mode_dev->bo_offset(dev, psbfb);
@@ -405,7 +404,7 @@
 
 psb_intel_pipe_set_base_exit:
 
-	ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+	gma_power_end(dev);
 
 	return ret;
 }
@@ -816,8 +815,7 @@
 		return;
 	}
 
-	if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-				      OSPM_UHB_ONLY_IF_ON)) {
+	if (gma_power_begin(dev, false)) {
 		for (i = 0; i < 256; i++) {
 			REG_WRITE(palreg + 4 * i,
 				  ((psb_intel_crtc->lut_r[i] +
@@ -827,7 +825,7 @@
 				  (psb_intel_crtc->lut_b[i] +
 				  psb_intel_crtc->lut_adj[i]));
 		}
-		ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+		gma_power_end(dev);
 	} else {
 		for (i = 0; i < 256; i++) {
 			dev_priv->save_palette_a[i] =
@@ -1046,11 +1044,10 @@
 		temp = 0;
 		temp |= CURSOR_MODE_DISABLE;
 
-		if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-					      OSPM_UHB_ONLY_IF_ON)) {
+        	if (gma_power_begin(dev, false)) {
 			REG_WRITE(control, temp);
 			REG_WRITE(base, 0);
-			ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+			gma_power_end(dev);
 		}
 
 		/* unpin the old bo */
@@ -1104,11 +1101,10 @@
 	temp |= (pipe << 28);
 	temp |= CURSOR_MODE_64_ARGB_AX | MCURSOR_GAMMA_ENABLE;
 
-	if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-				      OSPM_UHB_ONLY_IF_ON)) {
+       	if (gma_power_begin(dev, false)) {
 		REG_WRITE(control, temp);
 		REG_WRITE(base, addr);
-		ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+		gma_power_end(dev);
 	}
 
 	/* unpin the old bo */
@@ -1143,11 +1139,10 @@
 
 	adder = psb_intel_crtc->cursor_addr;
 
-	if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-				      OSPM_UHB_ONLY_IF_ON)) {
+       	if (gma_power_begin(dev, false)) {
 		REG_WRITE((pipe == 0) ? CURAPOS : CURBPOS, temp);
 		REG_WRITE((pipe == 0) ? CURABASE : CURBBASE, adder);
-		ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+		gma_power_end(dev);
 	}
 	return 0;
 }
@@ -1197,15 +1192,14 @@
 	bool is_lvds;
 	struct drm_psb_private *dev_priv = dev->dev_private;
 
-	if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-				      OSPM_UHB_ONLY_IF_ON)) {
+       	if (gma_power_begin(dev, false)) {
 		dpll = REG_READ((pipe == 0) ? DPLL_A : DPLL_B);
 		if ((dpll & DISPLAY_RATE_SELECT_FPA1) == 0)
 			fp = REG_READ((pipe == 0) ? FPA0 : FPB0);
 		else
 			fp = REG_READ((pipe == 0) ? FPA1 : FPB1);
 		is_lvds = (pipe == 1) && (REG_READ(LVDS) & LVDS_PORT_EN);
-		ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+		gma_power_end(dev);
 	} else {
 		dpll = (pipe == 0) ?
 			dev_priv->saveDPLL_A : dev_priv->saveDPLL_B;
@@ -1277,13 +1271,12 @@
 	int vsync;
 	struct drm_psb_private *dev_priv = dev->dev_private;
 
-	if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-				      OSPM_UHB_ONLY_IF_ON)) {
+       	if (gma_power_begin(dev, false)) {
 		htot = REG_READ((pipe == 0) ? HTOTAL_A : HTOTAL_B);
 		hsync = REG_READ((pipe == 0) ? HSYNC_A : HSYNC_B);
 		vtot = REG_READ((pipe == 0) ? VTOTAL_A : VTOTAL_B);
 		vsync = REG_READ((pipe == 0) ? VSYNC_A : VSYNC_B);
-		ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+		gma_power_end(dev);
 	} else {
 		htot = (pipe == 0) ?
 			dev_priv->saveHTOTAL_A : dev_priv->saveHTOTAL_B;
@@ -1333,10 +1326,6 @@
 	.commit = psb_intel_crtc_commit,
 };
 
-static const struct drm_crtc_helper_funcs mrst_helper_funcs;
-static const struct drm_crtc_helper_funcs mdfld_helper_funcs;
-const struct drm_crtc_funcs mdfld_intel_crtc_funcs;
-
 const struct drm_crtc_funcs psb_intel_crtc_funcs = {
 	.save = psb_intel_crtc_save,
 	.restore = psb_intel_crtc_restore,
@@ -1397,7 +1386,11 @@
 	psb_intel_crtc->mode_dev = mode_dev;
 	psb_intel_crtc->cursor_addr = 0;
 
-	drm_crtc_helper_add(&psb_intel_crtc->base,
+	if (IS_MRST(dev))
+        	drm_crtc_helper_add(&psb_intel_crtc->base,
+				    &mrst_helper_funcs);
+	else
+        	drm_crtc_helper_add(&psb_intel_crtc->base,
 				    &psb_intel_helper_funcs);
 
 	/* Setup the array of drm_connector pointer array */
diff --git a/drivers/staging/gma500/psb_intel_lvds.c b/drivers/staging/gma500/psb_intel_lvds.c
index d3d210a..28e04a3e 100644
--- a/drivers/staging/gma500/psb_intel_lvds.c
+++ b/drivers/staging/gma500/psb_intel_lvds.c
@@ -83,13 +83,12 @@
 	struct drm_psb_private *dev_priv = dev->dev_private;
 	u32 retVal;
 
-	if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-					OSPM_UHB_ONLY_IF_ON)) {
+	if (gma_power_begin(dev, false)) {
 		retVal = ((REG_READ(BLC_PWM_CTL) &
 			  BACKLIGHT_MODULATION_FREQ_MASK) >>
 			  BACKLIGHT_MODULATION_FREQ_SHIFT) * 2;
 
-		ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+		gma_power_end(dev);
 	} else
 		retVal = ((dev_priv->saveBLC_PWM_CTL &
 			  BACKLIGHT_MODULATION_FREQ_MASK) >>
@@ -200,14 +199,13 @@
 	struct drm_psb_private *dev_priv = dev->dev_private;
 	u32 blc_pwm_ctl;
 
-	if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-					OSPM_UHB_ONLY_IF_ON)) {
+	if (gma_power_begin(dev, false)) {
 		blc_pwm_ctl =
 			REG_READ(BLC_PWM_CTL) & ~BACKLIGHT_DUTY_CYCLE_MASK;
 		REG_WRITE(BLC_PWM_CTL,
 				(blc_pwm_ctl |
 				(level << BACKLIGHT_DUTY_CYCLE_SHIFT)));
-		ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+		gma_power_end(dev);
 	} else {
 		blc_pwm_ctl = dev_priv->saveBLC_PWM_CTL &
 				~BACKLIGHT_DUTY_CYCLE_MASK;
@@ -224,8 +222,7 @@
 {
 	u32 pp_status;
 
-	if (!ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-					OSPM_UHB_FORCE_POWER_ON))
+	if (!gma_power_begin(dev, true))
 		return;
 
 	if (on) {
@@ -248,7 +245,7 @@
 		} while (pp_status & PP_ON);
 	}
 
-	ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+	gma_power_end(dev);
 }
 
 static void psb_intel_lvds_encoder_dpms(struct drm_encoder *encoder, int mode)
@@ -400,11 +397,15 @@
 	if (psb_intel_output->type == INTEL_OUTPUT_MIPI2)
 		panel_fixed_mode = mode_dev->panel_fixed_mode2;
 
-	/* PSB doesn't appear to be GEN4 */
-	if (psb_intel_crtc->pipe == 0) {
+	/* PSB requires the LVDS is on pipe B, MRST has only one pipe anyway */
+	if (!IS_MRST(dev) && psb_intel_crtc->pipe == 0) {
 		printk(KERN_ERR "Can't support LVDS on pipe A\n");
 		return false;
 	}
+	if (IS_MRST(dev) && psb_intel_crtc->pipe != 0) {
+		printk(KERN_ERR "Must use PIPE A\n");
+		return false;
+	}
 	/* Should never happen!! */
 	list_for_each_entry(tmp_encoder, &dev->mode_config.encoder_list,
 			    head) {
@@ -445,7 +446,7 @@
 	return true;
 }
 
-static void psb_intel_lvds_prepare(struct drm_encoder *encoder)
+void psb_intel_lvds_prepare(struct drm_encoder *encoder)
 {
 	struct drm_device *dev = encoder->dev;
 	struct psb_intel_output *output = enc_to_psb_intel_output(encoder);
@@ -453,8 +454,7 @@
 
 	PSB_DEBUG_ENTRY("\n");
 
-	if (!ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-					OSPM_UHB_FORCE_POWER_ON))
+	if (!gma_power_begin(dev, true))
 		return;
 
 	mode_dev->saveBLC_PWM_CTL = REG_READ(BLC_PWM_CTL);
@@ -463,10 +463,10 @@
 
 	psb_intel_lvds_set_power(dev, output, false);
 
-	ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+	gma_power_end(dev);
 }
 
-static void psb_intel_lvds_commit(struct drm_encoder *encoder)
+void psb_intel_lvds_commit(struct drm_encoder *encoder)
 {
 	struct drm_device *dev = encoder->dev;
 	struct psb_intel_output *output = enc_to_psb_intel_output(encoder);
@@ -669,14 +669,14 @@
 	.commit = psb_intel_lvds_commit,
 };
 
-static const struct drm_connector_helper_funcs
+const struct drm_connector_helper_funcs
 				psb_intel_lvds_connector_helper_funcs = {
 	.get_modes = psb_intel_lvds_get_modes,
 	.mode_valid = psb_intel_lvds_mode_valid,
 	.best_encoder = psb_intel_best_encoder,
 };
 
-static const struct drm_connector_funcs psb_intel_lvds_connector_funcs = {
+const struct drm_connector_funcs psb_intel_lvds_connector_funcs = {
 	.dpms = drm_helper_connector_dpms,
 	.save = psb_intel_lvds_save,
 	.restore = psb_intel_lvds_restore,
diff --git a/drivers/staging/gma500/psb_intel_sdvo.c b/drivers/staging/gma500/psb_intel_sdvo.c
index 1d2bb02..df1c006 100644
--- a/drivers/staging/gma500/psb_intel_sdvo.c
+++ b/drivers/staging/gma500/psb_intel_sdvo.c
@@ -204,7 +204,7 @@
 	struct psb_intel_sdvo_priv *sdvo_priv = psb_intel_output->dev_priv;
 	int i;
 
-	if (1) {
+	if (0) {
 		DRM_DEBUG("%s: W: %02X ", SDVO_NAME(sdvo_priv), cmd);
 		for (i = 0; i < args_len; i++)
 			printk(KERN_INFO"%02X ", ((u8 *) args)[i]);
@@ -266,7 +266,7 @@
 					 SDVO_I2C_CMD_STATUS,
 					 &status);
 
-		if (1) {
+		if (0) {
 			DRM_DEBUG("%s: R: ", SDVO_NAME(sdvo_priv));
 			for (i = 0; i < response_len; i++)
 				printk(KERN_INFO"%02X ", ((u8 *) response)[i]);
diff --git a/drivers/staging/gma500/psb_irq.c b/drivers/staging/gma500/psb_irq.c
index 4597c88..9ea37e5 100644
--- a/drivers/staging/gma500/psb_irq.c
+++ b/drivers/staging/gma500/psb_irq.c
@@ -88,13 +88,12 @@
 		u32 reg = psb_pipestat(pipe);
 		dev_priv->pipestat[pipe] |= mask;
 		/* Enable the interrupt, clear any pending status */
-		if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-							OSPM_UHB_ONLY_IF_ON)) {
+		if (gma_power_begin(dev_priv->dev, false)) {
 			u32 writeVal = PSB_RVDC32(reg);
 			writeVal |= (mask | (mask >> 16));
 			PSB_WVDC32(writeVal, reg);
 			(void) PSB_RVDC32(reg);
-			ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+			gma_power_end(dev_priv->dev);
 		}
 	}
 }
@@ -105,39 +104,36 @@
 	if ((dev_priv->pipestat[pipe] & mask) != 0) {
 		u32 reg = psb_pipestat(pipe);
 		dev_priv->pipestat[pipe] &= ~mask;
-		if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-							OSPM_UHB_ONLY_IF_ON)) {
+		if (gma_power_begin(dev_priv->dev, false)) {
 			u32 writeVal = PSB_RVDC32(reg);
 			writeVal &= ~mask;
 			PSB_WVDC32(writeVal, reg);
 			(void) PSB_RVDC32(reg);
-			ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+			gma_power_end(dev_priv->dev);
 		}
 	}
 }
 
 void mid_enable_pipe_event(struct drm_psb_private *dev_priv, int pipe)
 {
-	if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-							OSPM_UHB_ONLY_IF_ON)) {
+	if (gma_power_begin(dev_priv->dev, false)) {
 		u32 pipe_event = mid_pipe_event(pipe);
 		dev_priv->vdc_irq_mask |= pipe_event;
 		PSB_WVDC32(~dev_priv->vdc_irq_mask, PSB_INT_MASK_R);
 		PSB_WVDC32(dev_priv->vdc_irq_mask, PSB_INT_ENABLE_R);
-		ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+		gma_power_end(dev_priv->dev);
 	}
 }
 
 void mid_disable_pipe_event(struct drm_psb_private *dev_priv, int pipe)
 {
 	if (dev_priv->pipestat[pipe] == 0) {
-		if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-							OSPM_UHB_ONLY_IF_ON)) {
+		if (gma_power_begin(dev_priv->dev, false)) {
 			u32 pipe_event = mid_pipe_event(pipe);
 			dev_priv->vdc_irq_mask &= ~pipe_event;
 			PSB_WVDC32(~dev_priv->vdc_irq_mask, PSB_INT_MASK_R);
 			PSB_WVDC32(dev_priv->vdc_irq_mask, PSB_INT_ENABLE_R);
-			ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+			gma_power_end(dev_priv->dev);
 		}
 	}
 }
@@ -242,7 +238,7 @@
 	vdc_stat &= dev_priv->vdc_irq_mask;
 	spin_unlock(&dev_priv->irqmask_lock);
 
-	if (dsp_int && ospm_power_is_hw_on(OSPM_DISPLAY_ISLAND)) {
+	if (dsp_int && gma_power_is_on(dev)) {
 		psb_vdc_interrupt(dev, vdc_stat);
 		handled = 1;
 	}
@@ -271,54 +267,28 @@
 
 void psb_irq_preinstall(struct drm_device *dev)
 {
-	psb_irq_preinstall_islands(dev, OSPM_ALL_ISLANDS);
-}
-
-/**
- * FIXME: should I remove display irq enable here??
- */
-void psb_irq_preinstall_islands(struct drm_device *dev, int hw_islands)
-{
 	struct drm_psb_private *dev_priv =
 	    (struct drm_psb_private *) dev->dev_private;
 	unsigned long irqflags;
 
-	PSB_DEBUG_ENTRY("\n");
-
 	spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags);
 
-	if (hw_islands & OSPM_DISPLAY_ISLAND) {
-		if (ospm_power_is_hw_on(OSPM_DISPLAY_ISLAND)) {
-			PSB_WVDC32(0xFFFFFFFF, PSB_HWSTAM);
-			if (dev->vblank_enabled[0])
-				dev_priv->vdc_irq_mask |=
-						_PSB_PIPEA_EVENT_FLAG;
-			if (dev->vblank_enabled[1])
-				dev_priv->vdc_irq_mask |=
-						_MDFLD_PIPEB_EVENT_FLAG;
-			if (dev->vblank_enabled[2])
-				dev_priv->vdc_irq_mask |=
-						_MDFLD_PIPEC_EVENT_FLAG;
-		}
-	}
-/* NO I DONT WANT ANY IRQS GRRR FIXMEAC */
-	if (hw_islands & OSPM_GRAPHICS_ISLAND)
-		dev_priv->vdc_irq_mask |= _PSB_IRQ_SGX_FLAG;
-/* */
+	if (gma_power_is_on(dev))
+		PSB_WVDC32(0xFFFFFFFF, PSB_HWSTAM);
+	if (dev->vblank_enabled[0])
+		dev_priv->vdc_irq_mask |= _PSB_PIPEA_EVENT_FLAG;
+	if (dev->vblank_enabled[1])
+		dev_priv->vdc_irq_mask |= _MDFLD_PIPEB_EVENT_FLAG;
+	if (dev->vblank_enabled[2])
+		dev_priv->vdc_irq_mask |= _MDFLD_PIPEC_EVENT_FLAG;
+
 	/*This register is safe even if display island is off*/
 	PSB_WVDC32(~dev_priv->vdc_irq_mask, PSB_INT_MASK_R);
-
 	spin_unlock_irqrestore(&dev_priv->irqmask_lock, irqflags);
 }
 
 int psb_irq_postinstall(struct drm_device *dev)
 {
-	return psb_irq_postinstall_islands(dev, OSPM_ALL_ISLANDS);
-}
-
-int psb_irq_postinstall_islands(struct drm_device *dev, int hw_islands)
-{
-
 	struct drm_psb_private *dev_priv =
 	    (struct drm_psb_private *) dev->dev_private;
 	unsigned long irqflags;
@@ -327,48 +297,31 @@
 
 	spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags);
 
-	/*This register is safe even if display island is off*/
+	/* This register is safe even if display island is off */
 	PSB_WVDC32(dev_priv->vdc_irq_mask, PSB_INT_ENABLE_R);
+	PSB_WVDC32(0xFFFFFFFF, PSB_HWSTAM);
 
-	if (hw_islands & OSPM_DISPLAY_ISLAND) {
-		if (true/*powermgmt_is_hw_on(dev->pdev, PSB_DISPLAY_ISLAND)*/) {
-			PSB_WVDC32(0xFFFFFFFF, PSB_HWSTAM);
+	if (dev->vblank_enabled[0])
+		psb_enable_pipestat(dev_priv, 0, PIPE_VBLANK_INTERRUPT_ENABLE);
+	else
+		psb_disable_pipestat(dev_priv, 0, PIPE_VBLANK_INTERRUPT_ENABLE);
 
-			if (dev->vblank_enabled[0])
-				psb_enable_pipestat(dev_priv, 0,
-				    PIPE_VBLANK_INTERRUPT_ENABLE);
-			else
-				psb_disable_pipestat(dev_priv, 0,
-				    PIPE_VBLANK_INTERRUPT_ENABLE);
+	if (dev->vblank_enabled[1])
+		psb_enable_pipestat(dev_priv, 1, PIPE_VBLANK_INTERRUPT_ENABLE);
+	else
+		psb_disable_pipestat(dev_priv, 1, PIPE_VBLANK_INTERRUPT_ENABLE);
 
-			if (dev->vblank_enabled[1])
-					psb_enable_pipestat(dev_priv, 1,
-					    PIPE_VBLANK_INTERRUPT_ENABLE);
-			else
-				psb_disable_pipestat(dev_priv, 1,
-				    PIPE_VBLANK_INTERRUPT_ENABLE);
-
-			if (dev->vblank_enabled[2])
-				psb_enable_pipestat(dev_priv, 2,
-				    PIPE_VBLANK_INTERRUPT_ENABLE);
-			else
-				psb_disable_pipestat(dev_priv, 2,
-				    PIPE_VBLANK_INTERRUPT_ENABLE);
-		}
-	}
+	if (dev->vblank_enabled[2])
+		psb_enable_pipestat(dev_priv, 2, PIPE_VBLANK_INTERRUPT_ENABLE);
+	else
+		psb_disable_pipestat(dev_priv, 2, PIPE_VBLANK_INTERRUPT_ENABLE);
 
 	spin_unlock_irqrestore(&dev_priv->irqmask_lock, irqflags);
-
 	return 0;
 }
 
 void psb_irq_uninstall(struct drm_device *dev)
 {
-	psb_irq_uninstall_islands(dev, OSPM_ALL_ISLANDS);
-}
-
-void psb_irq_uninstall_islands(struct drm_device *dev, int hw_islands)
-{
 	struct drm_psb_private *dev_priv =
 	    (struct drm_psb_private *) dev->dev_private;
 	unsigned long irqflags;
@@ -377,39 +330,29 @@
 
 	spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags);
 
-	if (hw_islands & OSPM_DISPLAY_ISLAND) {
-		if (true/*powermgmt_is_hw_on(dev->pdev, PSB_DISPLAY_ISLAND)*/) {
-			PSB_WVDC32(0xFFFFFFFF, PSB_HWSTAM);
+	PSB_WVDC32(0xFFFFFFFF, PSB_HWSTAM);
 
-			if (dev->vblank_enabled[0])
-				psb_disable_pipestat(dev_priv, 0,
-				    PIPE_VBLANK_INTERRUPT_ENABLE);
+	if (dev->vblank_enabled[0])
+		psb_disable_pipestat(dev_priv, 0, PIPE_VBLANK_INTERRUPT_ENABLE);
 
-			if (dev->vblank_enabled[1])
-				psb_disable_pipestat(dev_priv, 1,
-				    PIPE_VBLANK_INTERRUPT_ENABLE);
+	if (dev->vblank_enabled[1])
+		psb_disable_pipestat(dev_priv, 1, PIPE_VBLANK_INTERRUPT_ENABLE);
 
-			if (dev->vblank_enabled[2])
-				psb_disable_pipestat(dev_priv, 2,
-				    PIPE_VBLANK_INTERRUPT_ENABLE);
-		}
-		dev_priv->vdc_irq_mask &= _PSB_IRQ_SGX_FLAG |
-					  _PSB_IRQ_MSVDX_FLAG |
-					  _LNC_IRQ_TOPAZ_FLAG;
-	}
-	/*TODO: remove following code*/
-	if (hw_islands & OSPM_GRAPHICS_ISLAND)
-		dev_priv->vdc_irq_mask &= ~_PSB_IRQ_SGX_FLAG;
+	if (dev->vblank_enabled[2])
+		psb_disable_pipestat(dev_priv, 2, PIPE_VBLANK_INTERRUPT_ENABLE);
 
-	/*These two registers are safe even if display island is off*/
+	dev_priv->vdc_irq_mask &= _PSB_IRQ_SGX_FLAG |
+				  _PSB_IRQ_MSVDX_FLAG |
+				  _LNC_IRQ_TOPAZ_FLAG;
+
+	/* These two registers are safe even if display island is off */
 	PSB_WVDC32(~dev_priv->vdc_irq_mask, PSB_INT_MASK_R);
 	PSB_WVDC32(dev_priv->vdc_irq_mask, PSB_INT_ENABLE_R);
 
 	wmb();
 
-	/*This register is safe even if display island is off*/
+	/* This register is safe even if display island is off */
 	PSB_WVDC32(PSB_RVDC32(PSB_INT_IDENTITY_R), PSB_INT_IDENTITY_R);
-
 	spin_unlock_irqrestore(&dev_priv->irqmask_lock, irqflags);
 }
 
@@ -420,8 +363,7 @@
 	u32 hist_reg;
 	u32 pwm_reg;
 
-	if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-							OSPM_UHB_ONLY_IF_ON)) {
+	if (gma_power_begin(dev, false)) {
 		PSB_WVDC32(1 << 31, HISTOGRAM_LOGIC_CONTROL);
 		hist_reg = PSB_RVDC32(HISTOGRAM_LOGIC_CONTROL);
 		PSB_WVDC32(1 << 31, HISTOGRAM_INT_CONTROL);
@@ -443,7 +385,7 @@
 		PSB_WVDC32(pwm_reg | 0x80010100 | PWM_PHASEIN_ENABLE,
 							PWM_CONTROL_LOGIC);
 
-		ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+		gma_power_end(dev);
 	}
 }
 
@@ -472,8 +414,7 @@
 	u32 hist_reg;
 	u32 pwm_reg;
 
-	if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-							OSPM_UHB_ONLY_IF_ON)) {
+	if (gma_power_begin(dev, false)) {
 		PSB_WVDC32(0x00000000, HISTOGRAM_INT_CONTROL);
 		hist_reg = PSB_RVDC32(HISTOGRAM_INT_CONTROL);
 
@@ -484,7 +425,7 @@
 							PWM_CONTROL_LOGIC);
 		pwm_reg = PSB_RVDC32(PWM_CONTROL_LOGIC);
 
-		ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+		gma_power_end(dev);
 	}
 }
 
@@ -526,18 +467,16 @@
  */
 int psb_enable_vblank(struct drm_device *dev, int pipe)
 {
-	struct drm_psb_private *dev_priv =
-	    (struct drm_psb_private *) dev->dev_private;
+	struct drm_psb_private *dev_priv = dev->dev_private;
 	unsigned long irqflags;
 	uint32_t reg_val = 0;
 	uint32_t pipeconf_reg = mid_pipeconf(pipe);
 
 	PSB_DEBUG_ENTRY("\n");
 
-	if (ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND,
-							OSPM_UHB_ONLY_IF_ON)) {
+	if (gma_power_begin(dev, false)) {
 		reg_val = REG_READ(pipeconf_reg);
-		ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+		gma_power_end(dev);
 	}
 
 	if (!(reg_val & PIPEACONF_ENABLE))
@@ -545,7 +484,6 @@
 
 	spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags);
 
-	drm_psb_disable_vsync = 0;
 	mid_enable_pipe_event(dev_priv, pipe);
 	psb_enable_pipestat(dev_priv, pipe, PIPE_VBLANK_INTERRUPT_ENABLE);
 
@@ -559,15 +497,13 @@
  */
 void psb_disable_vblank(struct drm_device *dev, int pipe)
 {
-	struct drm_psb_private *dev_priv =
-	    (struct drm_psb_private *) dev->dev_private;
+	struct drm_psb_private *dev_priv = dev->dev_private;
 	unsigned long irqflags;
 
 	PSB_DEBUG_ENTRY("\n");
 
 	spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags);
 
-	drm_psb_disable_vsync = 1;
 	mid_disable_pipe_event(dev_priv, pipe);
 	psb_disable_pipestat(dev_priv, pipe, PIPE_VBLANK_INTERRUPT_ENABLE);
 
@@ -603,7 +539,7 @@
 		return 0;
 	}
 
-	if (!ospm_power_using_hw_begin(OSPM_DISPLAY_ISLAND, false))
+	if (!gma_power_begin(dev, false))
 		return 0;
 
 	reg_val = REG_READ(pipeconf_reg);
@@ -632,7 +568,7 @@
 
 psb_get_vblank_counter_exit:
 
-	ospm_power_using_hw_end(OSPM_DISPLAY_ISLAND);
+	gma_power_end(dev);
 
 	return count;
 }
diff --git a/drivers/staging/gma500/psb_reset.c b/drivers/staging/gma500/psb_lid.c
similarity index 100%
rename from drivers/staging/gma500/psb_reset.c
rename to drivers/staging/gma500/psb_lid.c
diff --git a/drivers/staging/gma500/psb_mmu.c b/drivers/staging/gma500/psb_mmu.c
index edd0d49..c904d73 100644
--- a/drivers/staging/gma500/psb_mmu.c
+++ b/drivers/staging/gma500/psb_mmu.c
@@ -444,67 +444,6 @@
 	pt->v[psb_mmu_pt_index(addr)] = pt->pd->invalid_pte;
 }
 
-#if 0
-static uint32_t psb_mmu_check_pte_locked(struct psb_mmu_pd *pd,
-					 uint32_t mmu_offset)
-{
-	uint32_t *v;
-	uint32_t pfn;
-
-	v = kmap_atomic(pd->p, KM_USER0);
-	if (!v) {
-		printk(KERN_INFO "Could not kmap pde page.\n");
-		return 0;
-	}
-	pfn = v[psb_mmu_pd_index(mmu_offset)];
-	/*      printk(KERN_INFO "pde is 0x%08x\n",pfn); */
-	kunmap_atomic(v, KM_USER0);
-	if (((pfn & 0x0F) != PSB_PTE_VALID)) {
-		printk(KERN_INFO "Strange pde at 0x%08x: 0x%08x.\n",
-		       mmu_offset, pfn);
-	}
-	v = ioremap(pfn & 0xFFFFF000, 4096);
-	if (!v) {
-		printk(KERN_INFO "Could not kmap pte page.\n");
-		return 0;
-	}
-	pfn = v[psb_mmu_pt_index(mmu_offset)];
-	/* printk(KERN_INFO "pte is 0x%08x\n",pfn); */
-	iounmap(v);
-	if (((pfn & 0x0F) != PSB_PTE_VALID)) {
-		printk(KERN_INFO "Strange pte at 0x%08x: 0x%08x.\n",
-		       mmu_offset, pfn);
-	}
-	return pfn >> PAGE_SHIFT;
-}
-
-static void psb_mmu_check_mirrored_gtt(struct psb_mmu_pd *pd,
-				       uint32_t mmu_offset,
-				       uint32_t gtt_pages)
-{
-	uint32_t start;
-	uint32_t next;
-
-	printk(KERN_INFO "Checking mirrored gtt 0x%08x %d\n",
-	       mmu_offset, gtt_pages);
-	down_read(&pd->driver->sem);
-	start = psb_mmu_check_pte_locked(pd, mmu_offset);
-	mmu_offset += PAGE_SIZE;
-	gtt_pages -= 1;
-	while (gtt_pages--) {
-		next = psb_mmu_check_pte_locked(pd, mmu_offset);
-		if (next != start + 1) {
-			printk(KERN_INFO
-			       "Ptes out of order: 0x%08x, 0x%08x.\n",
-			       start, next);
-		}
-		start = next;
-		mmu_offset += PAGE_SIZE;
-	}
-	up_read(&pd->driver->sem);
-}
-
-#endif
 
 void psb_mmu_mirror_gtt(struct psb_mmu_pd *pd,
 			uint32_t mmu_offset, uint32_t gtt_start,
diff --git a/drivers/staging/gma500/psb_powermgmt.c b/drivers/staging/gma500/psb_powermgmt.c
index 7deb1ba..fc0ed7a 100644
--- a/drivers/staging/gma500/psb_powermgmt.c
+++ b/drivers/staging/gma500/psb_powermgmt.c
@@ -24,83 +24,73 @@
  * Authors:
  *    Benjamin Defnet <benjamin.r.defnet@intel.com>
  *    Rajesh Poornachandran <rajesh.poornachandran@intel.com>
- *
+ * Massively reworked
+ *    Alan Cox <alan@linux.intel.com>
  */
 #include "psb_powermgmt.h"
 #include "psb_drv.h"
+#include "psb_reg.h"
 #include "psb_intel_reg.h"
 #include <linux/mutex.h>
 #include <linux/pm_runtime.h>
 
-#undef OSPM_GFX_DPK
-
-extern u32 gui32SGXDeviceID;
-extern u32 gui32MRSTDisplayDeviceID;
-extern u32 gui32MRSTMSVDXDeviceID;
-extern u32 gui32MRSTTOPAZDeviceID;
-
-struct drm_device *gpDrmDevice = NULL;
 static struct mutex power_mutex;
-static bool gbSuspendInProgress = false;
-static bool gbResumeInProgress = false;
-static int g_hw_power_status_mask;
-static atomic_t g_display_access_count;
-static atomic_t g_graphics_access_count;
-static atomic_t g_videoenc_access_count;
-static atomic_t g_videodec_access_count;
-int allow_runtime_pm = 0;
 
-void ospm_power_island_up(int hw_islands);
-void ospm_power_island_down(int hw_islands);
-static bool gbSuspended = false;
-bool gbgfxsuspended = false;
-
-/*
- * ospm_power_init
+/**
+ *	gma_power_init		-	initialise power manager
+ *	@dev: our device
  *
- * Description: Initialize this ospm power management module
+ *	Set up for power management tracking of our hardware.
  */
-void ospm_power_init(struct drm_device *dev)
+void gma_power_init(struct drm_device *dev)
 {
-	struct drm_psb_private *dev_priv = (struct drm_psb_private *)dev->dev_private;
-
-	gpDrmDevice = dev;
+	struct drm_psb_private *dev_priv = dev->dev_private;
 
 	dev_priv->apm_base = dev_priv->apm_reg & 0xffff;
 	dev_priv->ospm_base &= 0xffff;
 
+	dev_priv->display_power = true;	/* We start active */
+	dev_priv->display_count = 0;	/* Currently no users */
+	dev_priv->suspended = false;	/* And not suspended */
 	mutex_init(&power_mutex);
-	g_hw_power_status_mask = OSPM_ALL_ISLANDS;
-	atomic_set(&g_display_access_count, 0);
-	atomic_set(&g_graphics_access_count, 0);
-	atomic_set(&g_videoenc_access_count, 0);
-	atomic_set(&g_videodec_access_count, 0);
+
+	if (!IS_MRST(dev)) {
+		/* FIXME: wants further review */
+		u32 gating = PSB_RSGX32(PSB_CR_CLKGATECTL);
+		/* Disable 2D clock gating */
+		gating &= ~3;
+		gating |= 1;
+		PSB_WSGX32(gating, PSB_CR_CLKGATECTL);
+		PSB_RSGX32(PSB_CR_CLKGATECTL);
+	}
 }
 
-/*
- * ospm_power_uninit
+/**
+ *	gma_power_uninit	-	end power manager
+ *	@dev: device to end for
  *
- * Description: Uninitialize this ospm power management module
+ *	Undo the effects of gma_power_init
  */
-void ospm_power_uninit(void)
+void gma_power_uninit(struct drm_device *dev)
 {
 	mutex_destroy(&power_mutex);
-    	pm_runtime_disable(&gpDrmDevice->pdev->dev);
-	pm_runtime_set_suspended(&gpDrmDevice->pdev->dev);
+	pm_runtime_disable(&dev->pdev->dev);
+	pm_runtime_set_suspended(&dev->pdev->dev);
 }
 
 
-/*
- * save_display_registers
+/**
+ *	save_display_registers	-	save registers lost on suspend
+ *	@dev: our DRM device
  *
- * Description: We are going to suspend so save current display
- * register state.
+ *	Save the state we need in order to be able to restore the interface
+ *	upon resume from suspend
  */
 static int save_display_registers(struct drm_device *dev)
 {
 	struct drm_psb_private *dev_priv = dev->dev_private;
-	struct drm_crtc * crtc;
-	struct drm_connector * connector;
+	struct drm_crtc *crtc;
+	struct drm_connector *connector;
 
 	/* Display arbitration control + watermarks */
 	dev_priv->saveDSPARB = PSB_RVDC32(DSPARB);
@@ -112,37 +102,31 @@
 	dev_priv->saveDSPFW6 = PSB_RVDC32(DSPFW6);
 	dev_priv->saveCHICKENBIT = PSB_RVDC32(DSPCHICKENBIT);
 
-	/*save crtc and output state*/
+	/* Save crtc and output state */
 	mutex_lock(&dev->mode_config.mutex);
 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-		if(drm_helper_crtc_in_use(crtc)) {
+		if (drm_helper_crtc_in_use(crtc))
 			crtc->funcs->save(crtc);
-		}
 	}
 
-	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
 		connector->funcs->save(connector);
-	}
+
 	mutex_unlock(&dev->mode_config.mutex);
-
-	/* Interrupt state */
-	/*
-	 * Handled in psb_irq.c
-	 */
-
 	return 0;
 }
 
-/*
- * restore_display_registers
+/**
+ *	restore_display_registers	-	restore lost register state
+ *	@dev: our DRM device
  *
- * Description: We are going to resume so restore display register state.
+ *	Restore register state that was lost during suspend and resume.
  */
 static int restore_display_registers(struct drm_device *dev)
 {
 	struct drm_psb_private *dev_priv = dev->dev_private;
-	struct drm_crtc * crtc;
-	struct drm_connector * connector;
+	struct drm_crtc *crtc;
+	struct drm_connector *connector;
 
 	/* Display arbitration + watermarks */
 	PSB_WVDC32(dev_priv->saveDSPARB, DSPARB);
@@ -158,39 +142,57 @@
 	PSB_WVDC32(0x80000000, VGACNTRL);
 
 	mutex_lock(&dev->mode_config.mutex);
-	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-		if(drm_helper_crtc_in_use(crtc))
+	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
+		if (drm_helper_crtc_in_use(crtc))
 			crtc->funcs->restore(crtc);
-	}
-	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+
+	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
 		connector->funcs->restore(connector);
-	}
+
 	mutex_unlock(&dev->mode_config.mutex);
-
-	/*Interrupt state*/
-	/*
-	 * Handled in psb_irq.c
-	 */
-
 	return 0;
 }
-/*
- * powermgmt_suspend_display
+
+/**
+ *	power_down	-	power down the display island
+ *	@dev: our DRM device
  *
- * Description: Suspend the display hardware saving state and disabling
- * as necessary.
+ *	Power down the display interface of our device
  */
-void ospm_suspend_display(struct drm_device *dev)
+static void power_down(struct drm_device *dev)
 {
 	struct drm_psb_private *dev_priv = dev->dev_private;
-	int pp_stat, ret=0;
+	u32 pwr_mask ;
+	u32 pwr_sts;
 
-	printk(KERN_ALERT "%s \n", __func__);
+	if (IS_MRST(dev)) {
+		pwr_mask = PSB_PWRGT_DISPLAY_MASK;
+		outl(pwr_mask, dev_priv->ospm_base + PSB_PM_SSC);
 
-#ifdef OSPM_GFX_DPK
-	printk(KERN_ALERT "%s \n", __func__);
-#endif
-	if (!(g_hw_power_status_mask & OSPM_DISPLAY_ISLAND))
+		while (true) {
+			pwr_sts = inl(dev_priv->ospm_base + PSB_PM_SSS);
+			if ((pwr_sts & pwr_mask) == pwr_mask)
+				break;
+			else
+				udelay(10);
+		}
+		dev_priv->display_power = false;
+	}
+}
+
+
+/**
+ *	gma_suspend_display	-	suspend the display logic
+ *	@dev: our DRM device
+ *
+ *	Suspend the display logic of the graphics interface
+ */
+static void gma_suspend_display(struct drm_device *dev)
+{
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	int pp_stat;
+
+	if (dev_priv->suspended)
 		return;
 
 	save_display_registers(dev);
@@ -225,33 +227,55 @@
 			!= DPI_FIFO_EMPTY);
 		PSB_WVDC32(0, DEVICE_READY_REG);
 			/* turn off panel power */
-		ret = 0;
 	}
-	ospm_power_island_down(OSPM_DISPLAY_ISLAND);
+	power_down(dev);
 }
 
 /*
- * ospm_resume_display
+ * power_up
  *
- * Description: Resume the display hardware restoring state and enabling
- * as necessary.
+ * Description: Restore power to the specified island(s) (powergating)
  */
-void ospm_resume_display(struct pci_dev *pdev)
+static void power_up(struct drm_device *dev)
+{
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	u32 pwr_mask = PSB_PWRGT_DISPLAY_MASK;
+	u32 pwr_sts, pwr_cnt;
+
+	if (IS_MRST(dev)) {
+		pwr_cnt = inl(dev_priv->ospm_base + PSB_PM_SSC);
+		pwr_cnt &= ~pwr_mask;
+		outl(pwr_cnt, (dev_priv->ospm_base + PSB_PM_SSC));
+
+		while (true) {
+			pwr_sts = inl(dev_priv->ospm_base + PSB_PM_SSS);
+			if ((pwr_sts & pwr_mask) == 0)
+				break;
+			else
+				udelay(10);
+		}
+	}
+	dev_priv->suspended = false;
+	dev_priv->display_power = true;
+}
+
+/**
+ *	gma_resume_display	-	resume display side logic
+ *
+ *	Resume the display hardware restoring state and enabling
+ *	as necessary.
+ */
+static void gma_resume_display(struct pci_dev *pdev)
 {
 	struct drm_device *dev = pci_get_drvdata(pdev);
 	struct drm_psb_private *dev_priv = dev->dev_private;
 	struct psb_gtt *pg = dev_priv->pg;
 
-	printk(KERN_ALERT "%s \n", __func__);
-
-#ifdef OSPM_GFX_DPK
-	printk(KERN_ALERT "%s \n", __func__);
-#endif
-	if (g_hw_power_status_mask & OSPM_DISPLAY_ISLAND)
+	if (dev_priv->suspended == false)
 		return;
 
 	/* turn on the display power island */
-	ospm_power_island_up(OSPM_DISPLAY_ISLAND);
+	power_up(dev);
 
 	PSB_WVDC32(pg->pge_ctl | _PSB_PGETBL_ENABLED, PSB_PGETBL_CTL);
 	pci_write_config_word(pdev, PSB_GMCH_CTRL,
@@ -267,26 +291,21 @@
 	restore_display_registers(dev);
 }
 
-#if 1
-/*
- * ospm_suspend_pci
+/**
+ *	gma_suspend_pci		-	suspend PCI side
+ *	@pdev: PCI device
  *
- * Description: Suspend the pci device saving state and disabling
- * as necessary.
+ *	Perform the suspend processing on our PCI device state
  */
-static void ospm_suspend_pci(struct pci_dev *pdev)
+static void gma_suspend_pci(struct pci_dev *pdev)
 {
 	struct drm_device *dev = pci_get_drvdata(pdev);
 	struct drm_psb_private *dev_priv = dev->dev_private;
 	int bsm, vbt;
 
-	if (gbSuspended)
+	if (dev_priv->suspended)
 		return;
 
-#ifdef OSPM_GFX_DPK
-	printk(KERN_ALERT "ospm_suspend_pci\n");
-#endif
-
 	pci_save_state(pdev);
 	pci_read_config_dword(pdev, 0x5C, &bsm);
 	dev_priv->saveBSM = bsm;
@@ -298,29 +317,25 @@
 	pci_disable_device(pdev);
 	pci_set_power_state(pdev, PCI_D3hot);
 
-	gbSuspended = true;
-	gbgfxsuspended = true;
+	dev_priv->suspended = true;
 }
 
-/*
- * ospm_resume_pci
+/**
+ *	gma_resume_pci		-	resume helper
+ *	@dev: our PCI device
  *
- * Description: Resume the pci device restoring state and enabling
- * as necessary.
+ *	Perform the resume processing on our PCI device state - rewrite
+ *	register state and re-enable the PCI device
  */
-static bool ospm_resume_pci(struct pci_dev *pdev)
+static bool gma_resume_pci(struct pci_dev *pdev)
 {
 	struct drm_device *dev = pci_get_drvdata(pdev);
 	struct drm_psb_private *dev_priv = dev->dev_private;
-	int ret = 0;
+	int ret;
 
-	if (!gbSuspended)
+	if (!dev_priv->suspended)
 		return true;
 
-#ifdef OSPM_GFX_DPK
-	printk(KERN_ALERT "ospm_resume_pci\n");
-#endif
-
 	pci_set_power_state(pdev, PCI_D0);
 	pci_restore_state(pdev);
 	pci_write_config_dword(pdev, 0x5c, dev_priv->saveBSM);
@@ -331,448 +346,131 @@
 	ret = pci_enable_device(pdev);
 
 	if (ret != 0)
-		printk(KERN_ALERT "ospm_resume_pci: pci_enable_device failed: %d\n", ret);
+		dev_err(&pdev->dev, "pci_enable failed: %d\n", ret);
 	else
-		gbSuspended = false;
-
-	return !gbSuspended;
-}
-#endif
-/*
- * ospm_power_suspend
- *
- * Description: OSPM is telling our driver to suspend so save state
- * and power down all hardware.
- */
-int ospm_power_suspend(struct pci_dev *pdev, pm_message_t state)
-{
-        int ret = 0;
-        int graphics_access_count;
-        int videoenc_access_count;
-        int videodec_access_count;
-        int display_access_count;
-    	bool suspend_pci = true;
-
-	if(gbSuspendInProgress || gbResumeInProgress)
-        {
-#ifdef OSPM_GFX_DPK
-                printk(KERN_ALERT "OSPM_GFX_DPK: %s system BUSY \n", __func__);
-#endif
-                return  -EBUSY;
-        }
-
-        mutex_lock(&power_mutex);
-
-        if (!gbSuspended) {
-                graphics_access_count = atomic_read(&g_graphics_access_count);
-                videoenc_access_count = atomic_read(&g_videoenc_access_count);
-                videodec_access_count = atomic_read(&g_videodec_access_count);
-                display_access_count = atomic_read(&g_display_access_count);
-
-                if (graphics_access_count ||
-			videoenc_access_count ||
-			videodec_access_count ||
-			display_access_count)
-                        ret = -EBUSY;
-
-                if (!ret) {
-                        gbSuspendInProgress = true;
-
-                        psb_irq_uninstall_islands(gpDrmDevice, OSPM_DISPLAY_ISLAND);
-                        ospm_suspend_display(gpDrmDevice);
-                        if (suspend_pci == true) {
-				ospm_suspend_pci(pdev);
-                        }
-                        gbSuspendInProgress = false;
-                } else {
-                        printk(KERN_ALERT "ospm_power_suspend: device busy: graphics %d videoenc %d videodec %d display %d\n", graphics_access_count, videoenc_access_count, videodec_access_count, display_access_count);
-                }
-        }
-
-
-        mutex_unlock(&power_mutex);
-        return ret;
+		dev_priv->suspended = false;
+	return !dev_priv->suspended;
 }
 
-/*
- * ospm_power_island_up
+/**
+ *	gma_power_suspend		-	bus callback for suspend
+ *	@pdev: our PCI device
+ *	@state: suspend type
  *
- * Description: Restore power to the specified island(s) (powergating)
+ *	Called back by the PCI layer during a suspend of the system. We
+ *	perform the necessary shut down steps and save enough state that
+ *	we can undo this when resume is called.
  */
-void ospm_power_island_up(int hw_islands)
+int gma_power_suspend(struct pci_dev *pdev, pm_message_t state)
 {
-	u32 pwr_cnt = 0;
-	u32 pwr_sts = 0;
-	u32 pwr_mask = 0;
+	struct drm_device *dev = pci_get_drvdata(pdev);
+	struct drm_psb_private *dev_priv = dev->dev_private;
 
-	struct drm_psb_private *dev_priv =
-		(struct drm_psb_private *) gpDrmDevice->dev_private;
-
-
-	if (hw_islands & OSPM_DISPLAY_ISLAND) {
-		pwr_mask = PSB_PWRGT_DISPLAY_MASK;
-
-		pwr_cnt = inl(dev_priv->ospm_base + PSB_PM_SSC);
-		pwr_cnt &= ~pwr_mask;
-		outl(pwr_cnt, (dev_priv->ospm_base + PSB_PM_SSC));
-
-		while (true) {
-			pwr_sts = inl(dev_priv->ospm_base + PSB_PM_SSS);
-			if ((pwr_sts & pwr_mask) == 0)
-				break;
-			else
-				udelay(10);
+	mutex_lock(&power_mutex);
+	if (!dev_priv->suspended) {
+		if (dev_priv->display_count) {
+			mutex_unlock(&power_mutex);
+			return -EBUSY;
 		}
+		psb_irq_uninstall(dev);
+		gma_suspend_display(dev);
+		gma_suspend_pci(pdev);
 	}
-
-	g_hw_power_status_mask |= hw_islands;
-}
-
-/*
- * ospm_power_resume
- */
-int ospm_power_resume(struct pci_dev *pdev)
-{
-	if(gbSuspendInProgress || gbResumeInProgress)
-        {
-#ifdef OSPM_GFX_DPK
-                printk(KERN_ALERT "OSPM_GFX_DPK: %s hw_island: Suspend || gbResumeInProgress!!!! \n", __func__);
-#endif
-                return 0;
-        }
-
-        mutex_lock(&power_mutex);
-
-#ifdef OSPM_GFX_DPK
-	printk(KERN_ALERT "OSPM_GFX_DPK: ospm_power_resume \n");
-#endif
-
-  	gbResumeInProgress = true;
-
-        ospm_resume_pci(pdev);
-
-	ospm_resume_display(gpDrmDevice->pdev);
-        psb_irq_preinstall_islands(gpDrmDevice, OSPM_DISPLAY_ISLAND);
-        psb_irq_postinstall_islands(gpDrmDevice, OSPM_DISPLAY_ISLAND);
-
-	gbResumeInProgress = false;
-
-        mutex_unlock(&power_mutex);
-
+	mutex_unlock(&power_mutex);
 	return 0;
 }
 
 
-/*
- * ospm_power_island_down
+/**
+ *	gma_power_resume		-	resume power
+ *	@pdev: PCI device
  *
- * Description: Cut power to the specified island(s) (powergating)
+ *	Resume the PCI side of the graphics and then the displays
  */
-void ospm_power_island_down(int islands)
+int gma_power_resume(struct pci_dev *pdev)
 {
-#if 0
-	u32 pwr_cnt = 0;
-	u32 pwr_mask = 0;
-	u32 pwr_sts = 0;
+	struct drm_device *dev = pci_get_drvdata(pdev);
 
-	struct drm_psb_private *dev_priv =
-		(struct drm_psb_private *) gpDrmDevice->dev_private;
-
-	g_hw_power_status_mask &= ~islands;
-
-	if (islands & OSPM_GRAPHICS_ISLAND) {
-		pwr_cnt |= PSB_PWRGT_GFX_MASK;
-		pwr_mask |= PSB_PWRGT_GFX_MASK;
-		if (dev_priv->graphics_state == PSB_PWR_STATE_ON) {
-			dev_priv->gfx_on_time += (jiffies - dev_priv->gfx_last_mode_change) * 1000 / HZ;
-			dev_priv->gfx_last_mode_change = jiffies;
-			dev_priv->graphics_state = PSB_PWR_STATE_OFF;
-			dev_priv->gfx_off_cnt++;
-		}
-	}
-	if (islands & OSPM_VIDEO_ENC_ISLAND) {
-		pwr_cnt |= PSB_PWRGT_VID_ENC_MASK;
-		pwr_mask |= PSB_PWRGT_VID_ENC_MASK;
-	}
-	if (islands & OSPM_VIDEO_DEC_ISLAND) {
-		pwr_cnt |= PSB_PWRGT_VID_DEC_MASK;
-		pwr_mask |= PSB_PWRGT_VID_DEC_MASK;
-	}
-	if (pwr_cnt) {
-		pwr_cnt |= inl(dev_priv->apm_base);
-		outl(pwr_cnt, dev_priv->apm_base  + PSB_APM_CMD);
-		while (true) {
-			pwr_sts = inl(dev_priv->apm_base + PSB_APM_STS);
-
-			if ((pwr_sts & pwr_mask) == pwr_mask)
-				break;
-			else
-				udelay(10);
-		}
-	}
-
-	if (islands & OSPM_DISPLAY_ISLAND) {
-		pwr_mask = PSB_PWRGT_DISPLAY_MASK;
-
-		outl(pwr_mask, (dev_priv->ospm_base + PSB_PM_SSC));
-
-		while (true) {
-			pwr_sts = inl(dev_priv->ospm_base + PSB_PM_SSS);
-			if ((pwr_sts & pwr_mask) == pwr_mask)
-				break;
-			else
-				udelay(10);
-		}
-	}
-#endif
-}
-
-
-/*
- * ospm_power_is_hw_on
- *
- * Description: do an instantaneous check for if the specified islands
- * are on.  Only use this in cases where you know the g_state_change_mutex
- * is already held such as in irq install/uninstall.  Otherwise, use
- * ospm_power_using_hw_begin().
- */
-bool ospm_power_is_hw_on(int hw_islands)
-{
-	return ((g_hw_power_status_mask & hw_islands) == hw_islands) ? true:false;
-}
-
-/*
- * ospm_power_using_hw_begin
- *
- * Description: Notify PowerMgmt module that you will be accessing the
- * specified island's hw so don't power it off.  If force_on is true,
- * this will power on the specified island if it is off.
- * Otherwise, this will return false and the caller is expected to not
- * access the hw.
- *
- * NOTE *** If this is called from and interrupt handler or other atomic
- * context, then it will return false if we are in the middle of a
- * power state transition and the caller will be expected to handle that
- * even if force_on is set to true.
- */
-bool ospm_power_using_hw_begin(int hw_island, UHBUsage usage)
-{
-        return 1;	/*FIXMEAC */
-#if 0
-	bool ret = true;
-	bool island_is_off = false;
-	bool b_atomic = (in_interrupt() || in_atomic());
-	bool locked = true;
-	struct pci_dev *pdev = gpDrmDevice->pdev;
-	u32 deviceID = 0;
-	bool force_on = usage ? true: false;
-	/*quick path, not 100% race safe, but should be enough comapre to current other code in this file */
-	if (!force_on) {
-		if (hw_island & (OSPM_ALL_ISLANDS & ~g_hw_power_status_mask))
-			return false;
-		else {
-			locked = false;
-#ifdef CONFIG_PM_RUNTIME
-			/* increment pm_runtime_refcount */
-			pm_runtime_get(&pdev->dev);
-#endif
-			goto increase_count;
-		}
-	}
-
-
-	if (!b_atomic)
-		mutex_lock(&power_mutex);
-
-	island_is_off = hw_island & (OSPM_ALL_ISLANDS & ~g_hw_power_status_mask);
-
-	if (b_atomic && (gbSuspendInProgress || gbResumeInProgress || gbSuspended) && force_on && island_is_off)
-		ret = false;
-
-	if (ret && island_is_off && !force_on)
-		ret = false;
-
-	if (ret && island_is_off && force_on) {
-		gbResumeInProgress = true;
-
-		ret = ospm_resume_pci(pdev);
-
-		if (ret) {
-			switch(hw_island)
-			{
-			case OSPM_DISPLAY_ISLAND:
-				deviceID = gui32MRSTDisplayDeviceID;
-				ospm_resume_display(pdev);
-				psb_irq_preinstall_islands(gpDrmDevice, OSPM_DISPLAY_ISLAND);
-				psb_irq_postinstall_islands(gpDrmDevice, OSPM_DISPLAY_ISLAND);
-				break;
-			case OSPM_GRAPHICS_ISLAND:
-				deviceID = gui32SGXDeviceID;
-				ospm_power_island_up(OSPM_GRAPHICS_ISLAND);
-				psb_irq_preinstall_islands(gpDrmDevice, OSPM_GRAPHICS_ISLAND);
-				psb_irq_postinstall_islands(gpDrmDevice, OSPM_GRAPHICS_ISLAND);
-				break;
-#if 1
-			case OSPM_VIDEO_DEC_ISLAND:
-				if(!ospm_power_is_hw_on(OSPM_DISPLAY_ISLAND)) {
-					//printk(KERN_ALERT "%s power on display for video decode use\n", __func__);
-					deviceID = gui32MRSTDisplayDeviceID;
-					ospm_resume_display(pdev);
-					psb_irq_preinstall_islands(gpDrmDevice, OSPM_DISPLAY_ISLAND);
-					psb_irq_postinstall_islands(gpDrmDevice, OSPM_DISPLAY_ISLAND);
-				}
-				else{
-					//printk(KERN_ALERT "%s display is already on for video decode use\n", __func__);
-				}
-
-				if(!ospm_power_is_hw_on(OSPM_VIDEO_DEC_ISLAND)) {
-					//printk(KERN_ALERT "%s power on video decode\n", __func__);
-					deviceID = gui32MRSTMSVDXDeviceID;
-					ospm_power_island_up(OSPM_VIDEO_DEC_ISLAND);
-					psb_irq_preinstall_islands(gpDrmDevice, OSPM_VIDEO_DEC_ISLAND);
-					psb_irq_postinstall_islands(gpDrmDevice, OSPM_VIDEO_DEC_ISLAND);
-				}
-				else{
-					//printk(KERN_ALERT "%s video decode is already on\n", __func__);
-				}
-
-				break;
-			case OSPM_VIDEO_ENC_ISLAND:
-				if(!ospm_power_is_hw_on(OSPM_DISPLAY_ISLAND)) {
-					//printk(KERN_ALERT "%s power on display for video encode\n", __func__);
-					deviceID = gui32MRSTDisplayDeviceID;
-					ospm_resume_display(pdev);
-					psb_irq_preinstall_islands(gpDrmDevice, OSPM_DISPLAY_ISLAND);
-					psb_irq_postinstall_islands(gpDrmDevice, OSPM_DISPLAY_ISLAND);
-				}
-				else{
-					//printk(KERN_ALERT "%s display is already on for video encode use\n", __func__);
-				}
-
-				if(!ospm_power_is_hw_on(OSPM_VIDEO_ENC_ISLAND)) {
-					//printk(KERN_ALERT "%s power on video encode\n", __func__);
-					deviceID = gui32MRSTTOPAZDeviceID;
-					ospm_power_island_up(OSPM_VIDEO_ENC_ISLAND);
-					psb_irq_preinstall_islands(gpDrmDevice, OSPM_VIDEO_ENC_ISLAND);
-					psb_irq_postinstall_islands(gpDrmDevice, OSPM_VIDEO_ENC_ISLAND);
-				}
-				else{
-					//printk(KERN_ALERT "%s video decode is already on\n", __func__);
-				}
-#endif
-				break;
-
-			default:
-				printk(KERN_ALERT "%s unknown island !!!! \n", __func__);
-				break;
-			}
-
-		}
-
-		if (!ret)
-			printk(KERN_ALERT "ospm_power_using_hw_begin: forcing on %d failed\n", hw_island);
-
-		gbResumeInProgress = false;
-	}
-increase_count:
-	if (ret) {
-		switch(hw_island)
-		{
-		case OSPM_GRAPHICS_ISLAND:
-			atomic_inc(&g_graphics_access_count);
-			break;
-		case OSPM_VIDEO_ENC_ISLAND:
-			atomic_inc(&g_videoenc_access_count);
-			break;
-		case OSPM_VIDEO_DEC_ISLAND:
-			atomic_inc(&g_videodec_access_count);
-			break;
-		case OSPM_DISPLAY_ISLAND:
-			atomic_inc(&g_display_access_count);
-			break;
-		}
-	}
-
-	if (!b_atomic && locked)
-		mutex_unlock(&power_mutex);
-
-	return ret;
-#endif
-}
-
-
-/*
- * ospm_power_using_hw_end
- *
- * Description: Notify PowerMgmt module that you are done accessing the
- * specified island's hw so feel free to power it off.  Note that this
- * function doesn't actually power off the islands.
- */
-void ospm_power_using_hw_end(int hw_island)
-{
-#if 0 /* FIXMEAC */
-	switch(hw_island)
-	{
-	case OSPM_GRAPHICS_ISLAND:
-		atomic_dec(&g_graphics_access_count);
-		break;
-	case OSPM_VIDEO_ENC_ISLAND:
-		atomic_dec(&g_videoenc_access_count);
-		break;
-	case OSPM_VIDEO_DEC_ISLAND:
-		atomic_dec(&g_videodec_access_count);
-		break;
-	case OSPM_DISPLAY_ISLAND:
-		atomic_dec(&g_display_access_count);
-		break;
-	}
-
-	//decrement runtime pm ref count
-	pm_runtime_put(&gpDrmDevice->pdev->dev);
-
-	WARN_ON(atomic_read(&g_graphics_access_count) < 0);
-	WARN_ON(atomic_read(&g_videoenc_access_count) < 0);
-	WARN_ON(atomic_read(&g_videodec_access_count) < 0);
-	WARN_ON(atomic_read(&g_display_access_count) < 0);
-#endif
-}
-
-int ospm_runtime_pm_allow(struct drm_device * dev)
-{
+	mutex_lock(&power_mutex);
+	gma_resume_pci(pdev);
+	gma_resume_display(pdev);
+	psb_irq_preinstall(dev);
+	psb_irq_postinstall(dev);
+	mutex_unlock(&power_mutex);
 	return 0;
 }
 
-void ospm_runtime_pm_forbid(struct drm_device * dev)
+
+
+/**
+ *	gma_power_is_on		-	returne true if power is on
+ *	@dev: our DRM device
+ *
+ *	Returns true if the display island power is on at this moment
+ */
+bool gma_power_is_on(struct drm_device *dev)
 {
-	struct drm_psb_private * dev_priv = dev->dev_private;
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	return dev_priv->display_power;
+}
 
-	DRM_INFO("%s\n", __FUNCTION__);
 
-	pm_runtime_forbid(&dev->pdev->dev);
-	dev_priv->rpm_enabled = 0;
+/**
+ *	gma_power_begin		-	begin requiring power
+ *	@dev: our DRM device
+ *	@force_on: true to force power on
+ *
+ *	Begin an action that requires the display power island is enabled.
+ *	We refcount the islands.
+ *
+ *	FIXME: locking
+ */
+bool gma_power_begin(struct drm_device *dev, bool force_on)
+{
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	int ret;
+
+	/* Power already on ? */
+	if (dev_priv->display_power) {
+		dev_priv->display_count++;
+		pm_runtime_get(&dev->pdev->dev);
+		return true;
+	}
+	if (force_on == false)
+		return false;
+
+	/* Ok power up needed */
+	ret = gma_resume_pci(dev->pdev);
+	if (ret == 0) {
+		psb_irq_preinstall(dev);
+		psb_irq_postinstall(dev);
+		pm_runtime_get(&dev->pdev->dev);
+		dev_priv->display_count++;
+		return true;
+	}
+	return false;
+}
+
+
+/**
+ *	gma_power_end		-	end use of power
+ *	@dev: Our DRM device
+ *
+ *	Indicate that one of our gma_power_begin() requested periods when
+ *	the diplay island power is needed has completed.
+ */
+void gma_power_end(struct drm_device *dev)
+{
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	dev_priv->display_count--;
+	WARN_ON(dev_priv->display_count < 0);
+	pm_runtime_put(&dev->pdev->dev);
 }
 
 int psb_runtime_suspend(struct device *dev)
 {
-	pm_message_t state;
-	int ret = 0;
-	state.event = 0;
-
-#ifdef OSPM_GFX_DPK
-	printk(KERN_ALERT "OSPM_GFX_DPK: %s \n", __func__);
-#endif
-        if (atomic_read(&g_graphics_access_count) || atomic_read(&g_videoenc_access_count)
-		|| atomic_read(&g_videodec_access_count) || atomic_read(&g_display_access_count)){
-#ifdef OSPM_GFX_DPK
-                printk(KERN_ALERT "OSPM_GFX_DPK: GFX: %d VEC: %d VED: %d DC: %d DSR: %d \n", atomic_read(&g_graphics_access_count),
-			atomic_read(&g_videoenc_access_count), atomic_read(&g_videodec_access_count), atomic_read(&g_display_access_count));
-#endif
-                return -EBUSY;
-        }
-        else
-		ret = ospm_power_suspend(gpDrmDevice->pdev, state);
-
-	return ret;
+	static pm_message_t dummy;
+	return gma_power_suspend(to_pci_dev(dev), dummy);
 }
 
 int psb_runtime_resume(struct device *dev)
@@ -782,11 +480,11 @@
 
 int psb_runtime_idle(struct device *dev)
 {
-	/*printk (KERN_ALERT "lvds:%d,mipi:%d\n", dev_priv->is_lvds_on, dev_priv->is_mipi_on);*/
-	if (atomic_read(&g_graphics_access_count) || atomic_read(&g_videoenc_access_count)
-		|| atomic_read(&g_videodec_access_count) || atomic_read(&g_display_access_count))
-		return 1;
-	else
+	struct drm_device *drmdev = pci_get_drvdata(to_pci_dev(dev));
+	struct drm_psb_private *dev_priv = drmdev->dev_private;
+	if (dev_priv->display_count)
 		return 0;
+	else
+		return 1;
 }
 
diff --git a/drivers/staging/gma500/psb_powermgmt.h b/drivers/staging/gma500/psb_powermgmt.h
index bf6f27a..e005229 100644
--- a/drivers/staging/gma500/psb_powermgmt.h
+++ b/drivers/staging/gma500/psb_powermgmt.h
@@ -24,7 +24,8 @@
  * Authors:
  *    Benjamin Defnet <benjamin.r.defnet@intel.com>
  *    Rajesh Poornachandran <rajesh.poornachandran@intel.com>
- *
+ * Massively reworked
+ *    Alan Cox <alan@linux.intel.com>
  */
 #ifndef _PSB_POWERMGMT_H_
 #define _PSB_POWERMGMT_H_
@@ -32,65 +33,35 @@
 #include <linux/pci.h>
 #include <drm/drmP.h>
 
-#define OSPM_GRAPHICS_ISLAND	0x1
-#define OSPM_VIDEO_ENC_ISLAND	0x2
-#define OSPM_VIDEO_DEC_ISLAND	0x4
-#define OSPM_DISPLAY_ISLAND	0x8
-#define OSPM_GL3_CACHE_ISLAND	0x10
-#define OSPM_ALL_ISLANDS	0x1f
-
-/* IPC message and command defines used to enable/disable mipi panel voltages */
-#define IPC_MSG_PANEL_ON_OFF    0xE9
-#define IPC_CMD_PANEL_ON        1
-#define IPC_CMD_PANEL_OFF       0
-
-typedef enum _UHBUsage
-{
-    OSPM_UHB_ONLY_IF_ON = 0,
-    OSPM_UHB_FORCE_POWER_ON,
-} UHBUsage;
-
-/* Use these functions to power down video HW for D0i3 purpose  */
-
-void ospm_power_init(struct drm_device *dev);
-void ospm_power_uninit(void);
-
+void gma_power_init(struct drm_device *dev);
+void gma_power_uninit(struct drm_device *dev);
 
 /*
- * OSPM will call these functions
+ * The kernel bus power management  will call these functions
  */
-int ospm_power_suspend(struct pci_dev *pdev, pm_message_t state);
-int ospm_power_resume(struct pci_dev *pdev);
+int gma_power_suspend(struct pci_dev *pdev, pm_message_t state);
+int gma_power_resume(struct pci_dev *pdev);
 
 /*
  * These are the functions the driver should use to wrap all hw access
  * (i.e. register reads and writes)
  */
-bool ospm_power_using_hw_begin(int hw_island, UHBUsage usage);
-void ospm_power_using_hw_end(int hw_island);
+bool gma_power_begin(struct drm_device *dev, bool force);
+void gma_power_end(struct drm_device *dev);
 
 /*
  * Use this function to do an instantaneous check for if the hw is on.
- * Only use this in cases where you know the g_state_change_mutex
- * is already held such as in irq install/uninstall and you need to
- * prevent a deadlock situation.  Otherwise use ospm_power_using_hw_begin().
+ * Only use this in cases where you know the mutex is already held such
+ * as in irq install/uninstall and you need to
+ * prevent a deadlock situation.  Otherwise use gma_power_begin().
  */
-bool ospm_power_is_hw_on(int hw_islands);
+bool gma_power_is_on(struct drm_device *dev);
 
 /*
- * Power up/down different hw component rails/islands
- */
-void ospm_power_island_down(int hw_islands);
-void ospm_power_island_up(int hw_islands);
-void ospm_suspend_graphics(void);
-/*
  * GFX-Runtime PM callbacks
  */
 int psb_runtime_suspend(struct device *dev);
 int psb_runtime_resume(struct device *dev);
 int psb_runtime_idle(struct device *dev);
-int ospm_runtime_pm_allow(struct drm_device * dev);
-void ospm_runtime_pm_forbid(struct drm_device * dev);
-
 
 #endif /*_PSB_POWERMGMT_H_*/
diff --git a/drivers/staging/gma500/psb_sgx.c b/drivers/staging/gma500/psb_sgx.c
deleted file mode 100644
index 973134b..0000000
--- a/drivers/staging/gma500/psb_sgx.c
+++ /dev/null
@@ -1,238 +0,0 @@
-/**************************************************************************
- * Copyright (c) 2007, Intel Corporation.
- * All Rights Reserved.
- * Copyright (c) 2008, Tungsten Graphics, Inc. Cedar Park, TX. USA.
- * All Rights Reserved.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- *
- **************************************************************************/
-
-#include <drm/drmP.h>
-#include "psb_drv.h"
-#include "psb_drm.h"
-#include "psb_reg.h"
-#include "ttm/ttm_bo_api.h"
-#include "ttm/ttm_execbuf_util.h"
-#include "psb_ttm_userobj_api.h"
-#include "ttm/ttm_placement.h"
-#include "psb_sgx.h"
-#include "psb_intel_reg.h"
-#include "psb_powermgmt.h"
-
-
-static inline int psb_same_page(unsigned long offset,
-				unsigned long offset2)
-{
-	return (offset & PAGE_MASK) == (offset2 & PAGE_MASK);
-}
-
-static inline unsigned long psb_offset_end(unsigned long offset,
-					      unsigned long end)
-{
-	offset = (offset + PAGE_SIZE) & PAGE_MASK;
-	return (end < offset) ? end : offset;
-}
-
-struct psb_dstbuf_cache {
-	unsigned int dst;
-	struct ttm_buffer_object *dst_buf;
-	unsigned long dst_offset;
-	uint32_t *dst_page;
-	unsigned int dst_page_offset;
-	struct ttm_bo_kmap_obj dst_kmap;
-	bool dst_is_iomem;
-};
-
-struct psb_validate_buffer {
-	struct ttm_validate_buffer base;
-	struct psb_validate_req req;
-	int ret;
-	struct psb_validate_arg __user *user_val_arg;
-	uint32_t flags;
-	uint32_t offset;
-	int po_correct;
-};
-static int
-psb_placement_fence_type(struct ttm_buffer_object *bo,
-			 uint64_t set_val_flags,
-			 uint64_t clr_val_flags,
-			 uint32_t new_fence_class,
-			 uint32_t *new_fence_type)
-{
-	int ret;
-	uint32_t n_fence_type;
-	/*
-	uint32_t set_flags = set_val_flags & 0xFFFFFFFF;
-	uint32_t clr_flags = clr_val_flags & 0xFFFFFFFF;
-	*/
-	struct ttm_fence_object *old_fence;
-	uint32_t old_fence_type;
-	struct ttm_placement placement;
-
-	if (unlikely
-	    (!(set_val_flags &
-	       (PSB_GPU_ACCESS_READ | PSB_GPU_ACCESS_WRITE)))) {
-		DRM_ERROR
-		    ("GPU access type (read / write) is not indicated.\n");
-		return -EINVAL;
-	}
-
-	/* User space driver doesn't set any TTM placement flags in
-					set_val_flags or clr_val_flags */
-	placement.num_placement = 0;/* FIXME  */
-	placement.num_busy_placement = 0;
-	placement.fpfn = 0;
-	placement.lpfn = 0;
-	ret = psb_ttm_bo_check_placement(bo, &placement);
-	if (unlikely(ret != 0))
-		return ret;
-
-	switch (new_fence_class) {
-	default:
-		n_fence_type = _PSB_FENCE_TYPE_EXE;
-	}
-
-	*new_fence_type = n_fence_type;
-	old_fence = (struct ttm_fence_object *) bo->sync_obj;
-	old_fence_type = (uint32_t) (unsigned long) bo->sync_obj_arg;
-
-	if (old_fence && ((new_fence_class != old_fence->fence_class) ||
-			  ((n_fence_type ^ old_fence_type) &
-			   old_fence_type))) {
-		ret = ttm_bo_wait(bo, 0, 1, 0);
-		if (unlikely(ret != 0))
-			return ret;
-	}
-	/*
-	bo->proposed_flags = (bo->proposed_flags | set_flags)
-		& ~clr_flags & TTM_PL_MASK_MEMTYPE;
-	*/
-	return 0;
-}
-
-int psb_validate_kernel_buffer(struct psb_context *context,
-			       struct ttm_buffer_object *bo,
-			       uint32_t fence_class,
-			       uint64_t set_flags, uint64_t clr_flags)
-{
-	struct psb_validate_buffer *item;
-	uint32_t cur_fence_type;
-	int ret;
-
-	if (unlikely(context->used_buffers >= PSB_NUM_VALIDATE_BUFFERS)) {
-		DRM_ERROR("Out of free validation buffer entries for "
-			  "kernel buffer validation.\n");
-		return -ENOMEM;
-	}
-
-	item = &context->buffers[context->used_buffers];
-	item->user_val_arg = NULL;
-	item->base.reserved = 0;
-
-	ret = ttm_bo_reserve(bo, 1, 0, 1, context->val_seq);
-	if (unlikely(ret != 0))
-	        return ret;
-
-	ret = psb_placement_fence_type(bo, set_flags, clr_flags, fence_class,
-				       &cur_fence_type);
-	if (unlikely(ret != 0)) {
-		ttm_bo_unreserve(bo);
-		return ret;
-	}
-
-	item->base.bo = ttm_bo_reference(bo);
-	item->base.new_sync_obj_arg = (void *) (unsigned long) cur_fence_type;
-	item->base.reserved = 1;
-
-	/* Internal locking ??? FIXMEAC */
-	list_add_tail(&item->base.head, &context->kern_validate_list);
-	context->used_buffers++;
-	/*
-	ret = ttm_bo_validate(bo, 1, 0, 0);
-	if (unlikely(ret != 0))
-		goto out_unlock;
-	*/
-	item->offset = bo->offset;
-	item->flags = bo->mem.placement;
-	context->fence_types |= cur_fence_type;
-
-	return ret;
-}
-
-void psb_fence_or_sync(struct drm_file *file_priv,
-		       uint32_t engine,
-		       uint32_t fence_types,
-		       uint32_t fence_flags,
-		       struct list_head *list,
-		       struct psb_ttm_fence_rep *fence_arg,
-		       struct ttm_fence_object **fence_p)
-{
-	struct drm_device *dev = file_priv->minor->dev;
-	struct drm_psb_private *dev_priv = psb_priv(dev);
-	struct ttm_fence_device *fdev = &dev_priv->fdev;
-	int ret;
-	struct ttm_fence_object *fence;
-	struct ttm_object_file *tfile = psb_fpriv(file_priv)->tfile;
-	uint32_t handle;
-
-	ret = ttm_fence_user_create(fdev, tfile,
-				    engine, fence_types,
-				    TTM_FENCE_FLAG_EMIT, &fence, &handle);
-	if (ret) {
-
-		/*
-		 * Fence creation failed.
-		 * Fall back to synchronous operation and idle the engine.
-		 */
-
-		if (!(fence_flags & DRM_PSB_FENCE_NO_USER)) {
-
-			/*
-			 * Communicate to user-space that
-			 * fence creation has failed and that
-			 * the engine is idle.
-			 */
-
-			fence_arg->handle = ~0;
-			fence_arg->error = ret;
-		}
-
-		ttm_eu_backoff_reservation(list);
-		if (fence_p)
-			*fence_p = NULL;
-		return;
-	}
-
-	ttm_eu_fence_buffer_objects(list, fence);
-	if (!(fence_flags & DRM_PSB_FENCE_NO_USER)) {
-		struct ttm_fence_info info = ttm_fence_get_info(fence);
-		fence_arg->handle = handle;
-		fence_arg->fence_class = ttm_fence_class(fence);
-		fence_arg->fence_type = ttm_fence_types(fence);
-		fence_arg->signaled_types = info.signaled_types;
-		fence_arg->error = 0;
-	} else {
-		ret =
-		    ttm_ref_object_base_unref(tfile, handle,
-					      ttm_fence_type);
-		BUG_ON(ret);
-	}
-
-	if (fence_p)
-		*fence_p = fence;
-	else if (fence)
-		ttm_fence_object_unref(&fence);
-}
-
diff --git a/drivers/staging/gma500/psb_sgx.h b/drivers/staging/gma500/psb_sgx.h
deleted file mode 100644
index 9300e2d..0000000
--- a/drivers/staging/gma500/psb_sgx.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright (c) 2008, Intel Corporation
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- *
- * Authors:
- *    Eric Anholt <eric@anholt.net>
- *
- **/
-#ifndef _PSB_SGX_H_
-#define _PSB_SGX_H_
-
-extern int psb_submit_video_cmdbuf(struct drm_device *dev,
-			       struct ttm_buffer_object *cmd_buffer,
-			       unsigned long cmd_offset,
-			       unsigned long cmd_size,
-			       struct ttm_fence_object *fence);
-
-extern int drm_idle_check_interval;
-
-#endif
diff --git a/drivers/staging/gma500/psb_ttm_fence.c b/drivers/staging/gma500/psb_ttm_fence.c
deleted file mode 100644
index d1c3590..0000000
--- a/drivers/staging/gma500/psb_ttm_fence.c
+++ /dev/null
@@ -1,605 +0,0 @@
-/**************************************************************************
- *
- * Copyright (c) 2006-2008 Tungsten Graphics, Inc., Cedar Park, TX., USA
- * All Rights Reserved.
- * Copyright (c) 2009 VMware, Inc., Palo Alto, CA., USA
- * All Rights Reserved.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- *
- **************************************************************************/
-/*
- * Authors: Thomas Hellstrom <thomas-at-tungstengraphics-dot-com>
- */
-
-#include "psb_ttm_fence_api.h"
-#include "psb_ttm_fence_driver.h"
-#include <linux/wait.h>
-#include <linux/sched.h>
-
-#include <drm/drmP.h>
-
-/*
- * Simple implementation for now.
- */
-
-static void ttm_fence_lockup(struct ttm_fence_object *fence, uint32_t mask)
-{
-	struct ttm_fence_class_manager *fc = ttm_fence_fc(fence);
-
-	printk(KERN_ERR "GPU lockup dectected on engine %u "
-	       "fence type 0x%08x\n",
-	       (unsigned int)fence->fence_class, (unsigned int)mask);
-	/*
-	 * Give engines some time to idle?
-	 */
-
-	write_lock(&fc->lock);
-	ttm_fence_handler(fence->fdev, fence->fence_class,
-			  fence->sequence, mask, -EBUSY);
-	write_unlock(&fc->lock);
-}
-
-/*
- * Convenience function to be called by fence::wait methods that
- * need polling.
- */
-
-int ttm_fence_wait_polling(struct ttm_fence_object *fence, bool lazy,
-			   bool interruptible, uint32_t mask)
-{
-	struct ttm_fence_class_manager *fc = ttm_fence_fc(fence);
-	const struct ttm_fence_driver *driver = ttm_fence_driver(fence);
-	uint32_t count = 0;
-	int ret;
-	unsigned long end_jiffies = fence->timeout_jiffies;
-
-	DECLARE_WAITQUEUE(entry, current);
-	add_wait_queue(&fc->fence_queue, &entry);
-
-	ret = 0;
-
-	for (;;) {
-		__set_current_state((interruptible) ?
-				    TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
-		if (ttm_fence_object_signaled(fence, mask))
-			break;
-		if (time_after_eq(jiffies, end_jiffies)) {
-			if (driver->lockup)
-				driver->lockup(fence, mask);
-			else
-				ttm_fence_lockup(fence, mask);
-			continue;
-		}
-		if (lazy)
-			schedule_timeout(1);
-		else if ((++count & 0x0F) == 0) {
-			__set_current_state(TASK_RUNNING);
-			schedule();
-			__set_current_state((interruptible) ?
-					    TASK_INTERRUPTIBLE :
-					    TASK_UNINTERRUPTIBLE);
-		}
-		if (interruptible && signal_pending(current)) {
-			ret = -ERESTART;
-			break;
-		}
-	}
-	__set_current_state(TASK_RUNNING);
-	remove_wait_queue(&fc->fence_queue, &entry);
-	return ret;
-}
-
-/*
- * Typically called by the IRQ handler.
- */
-
-void ttm_fence_handler(struct ttm_fence_device *fdev, uint32_t fence_class,
-		       uint32_t sequence, uint32_t type, uint32_t error)
-{
-	int wake = 0;
-	uint32_t diff;
-	uint32_t relevant_type;
-	uint32_t new_type;
-	struct ttm_fence_class_manager *fc = &fdev->fence_class[fence_class];
-	const struct ttm_fence_driver *driver = ttm_fence_driver_from_dev(fdev);
-	struct list_head *head;
-	struct ttm_fence_object *fence, *next;
-	bool found = false;
-
-	if (list_empty(&fc->ring))
-		return;
-
-	list_for_each_entry(fence, &fc->ring, ring) {
-		diff = (sequence - fence->sequence) & fc->sequence_mask;
-		if (diff > fc->wrap_diff) {
-			found = true;
-			break;
-		}
-	}
-
-	fc->waiting_types &= ~type;
-	head = (found) ? &fence->ring : &fc->ring;
-
-	list_for_each_entry_safe_reverse(fence, next, head, ring) {
-		if (&fence->ring == &fc->ring)
-			break;
-
-		DRM_DEBUG("Fence 0x%08lx, sequence 0x%08x, type 0x%08x\n",
-			  (unsigned long)fence, fence->sequence,
-			  fence->fence_type);
-
-		if (error) {
-			fence->info.error = error;
-			fence->info.signaled_types = fence->fence_type;
-			list_del_init(&fence->ring);
-			wake = 1;
-			break;
-		}
-
-		relevant_type = type & fence->fence_type;
-		new_type = (fence->info.signaled_types | relevant_type) ^
-		    fence->info.signaled_types;
-
-		if (new_type) {
-			fence->info.signaled_types |= new_type;
-			DRM_DEBUG("Fence 0x%08lx signaled 0x%08x\n",
-				  (unsigned long)fence,
-				  fence->info.signaled_types);
-
-			if (unlikely(driver->signaled))
-				driver->signaled(fence);
-
-			if (driver->needed_flush)
-				fc->pending_flush |=
-				    driver->needed_flush(fence);
-
-			if (new_type & fence->waiting_types)
-				wake = 1;
-		}
-
-		fc->waiting_types |=
-		    fence->waiting_types & ~fence->info.signaled_types;
-
-		if (!(fence->fence_type & ~fence->info.signaled_types)) {
-			DRM_DEBUG("Fence completely signaled 0x%08lx\n",
-				  (unsigned long)fence);
-			list_del_init(&fence->ring);
-		}
-	}
-
-	/*
-	 * Reinstate lost waiting types.
-	 */
-
-	if ((fc->waiting_types & type) != type) {
-		head = head->prev;
-		list_for_each_entry(fence, head, ring) {
-			if (&fence->ring == &fc->ring)
-				break;
-			diff =
-			    (fc->highest_waiting_sequence -
-			     fence->sequence) & fc->sequence_mask;
-			if (diff > fc->wrap_diff)
-				break;
-
-			fc->waiting_types |=
-			    fence->waiting_types & ~fence->info.signaled_types;
-		}
-	}
-
-	if (wake)
-		wake_up_all(&fc->fence_queue);
-}
-
-static void ttm_fence_unring(struct ttm_fence_object *fence)
-{
-	struct ttm_fence_class_manager *fc = ttm_fence_fc(fence);
-	unsigned long irq_flags;
-
-	write_lock_irqsave(&fc->lock, irq_flags);
-	list_del_init(&fence->ring);
-	write_unlock_irqrestore(&fc->lock, irq_flags);
-}
-
-bool ttm_fence_object_signaled(struct ttm_fence_object *fence, uint32_t mask)
-{
-	unsigned long flags;
-	bool signaled;
-	const struct ttm_fence_driver *driver = ttm_fence_driver(fence);
-	struct ttm_fence_class_manager *fc = ttm_fence_fc(fence);
-
-	mask &= fence->fence_type;
-	read_lock_irqsave(&fc->lock, flags);
-	signaled = (mask & fence->info.signaled_types) == mask;
-	read_unlock_irqrestore(&fc->lock, flags);
-	if (!signaled && driver->poll) {
-		write_lock_irqsave(&fc->lock, flags);
-		driver->poll(fence->fdev, fence->fence_class, mask);
-		signaled = (mask & fence->info.signaled_types) == mask;
-		write_unlock_irqrestore(&fc->lock, flags);
-	}
-	return signaled;
-}
-
-int ttm_fence_object_flush(struct ttm_fence_object *fence, uint32_t type)
-{
-	const struct ttm_fence_driver *driver = ttm_fence_driver(fence);
-	struct ttm_fence_class_manager *fc = ttm_fence_fc(fence);
-	unsigned long irq_flags;
-	uint32_t saved_pending_flush;
-	uint32_t diff;
-	bool call_flush;
-
-	if (type & ~fence->fence_type) {
-		DRM_ERROR("Flush trying to extend fence type, "
-			  "0x%x, 0x%x\n", type, fence->fence_type);
-		return -EINVAL;
-	}
-
-	write_lock_irqsave(&fc->lock, irq_flags);
-	fence->waiting_types |= type;
-	fc->waiting_types |= fence->waiting_types;
-	diff = (fence->sequence - fc->highest_waiting_sequence) &
-	    fc->sequence_mask;
-
-	if (diff < fc->wrap_diff)
-		fc->highest_waiting_sequence = fence->sequence;
-
-	/*
-	 * fence->waiting_types has changed. Determine whether
-	 * we need to initiate some kind of flush as a result of this.
-	 */
-
-	saved_pending_flush = fc->pending_flush;
-	if (driver->needed_flush)
-		fc->pending_flush |= driver->needed_flush(fence);
-
-	if (driver->poll)
-		driver->poll(fence->fdev, fence->fence_class,
-			     fence->waiting_types);
-
-	call_flush = (fc->pending_flush != 0);
-	write_unlock_irqrestore(&fc->lock, irq_flags);
-
-	if (call_flush && driver->flush)
-		driver->flush(fence->fdev, fence->fence_class);
-
-	return 0;
-}
-
-/*
- * Make sure old fence objects are signaled before their fence sequences are
- * wrapped around and reused.
- */
-
-void ttm_fence_flush_old(struct ttm_fence_device *fdev,
-			 uint32_t fence_class, uint32_t sequence)
-{
-	struct ttm_fence_class_manager *fc = &fdev->fence_class[fence_class];
-	struct ttm_fence_object *fence;
-	unsigned long irq_flags;
-	const struct ttm_fence_driver *driver = fdev->driver;
-	bool call_flush;
-
-	uint32_t diff;
-
-	write_lock_irqsave(&fc->lock, irq_flags);
-
-	list_for_each_entry_reverse(fence, &fc->ring, ring) {
-		diff = (sequence - fence->sequence) & fc->sequence_mask;
-		if (diff <= fc->flush_diff)
-			break;
-
-		fence->waiting_types = fence->fence_type;
-		fc->waiting_types |= fence->fence_type;
-
-		if (driver->needed_flush)
-			fc->pending_flush |= driver->needed_flush(fence);
-	}
-
-	if (driver->poll)
-		driver->poll(fdev, fence_class, fc->waiting_types);
-
-	call_flush = (fc->pending_flush != 0);
-	write_unlock_irqrestore(&fc->lock, irq_flags);
-
-	if (call_flush && driver->flush)
-		driver->flush(fdev, fence->fence_class);
-
-	/*
-	 * FIXME: Shold we implement a wait here for really old fences?
-	 */
-
-}
-
-int ttm_fence_object_wait(struct ttm_fence_object *fence,
-			  bool lazy, bool interruptible, uint32_t mask)
-{
-	const struct ttm_fence_driver *driver = ttm_fence_driver(fence);
-	struct ttm_fence_class_manager *fc = ttm_fence_fc(fence);
-	int ret = 0;
-	unsigned long timeout;
-	unsigned long cur_jiffies;
-	unsigned long to_jiffies;
-
-	if (mask & ~fence->fence_type) {
-		DRM_ERROR("Wait trying to extend fence type"
-			  " 0x%08x 0x%08x\n", mask, fence->fence_type);
-		BUG();
-		return -EINVAL;
-	}
-
-	if (driver->wait)
-		return driver->wait(fence, lazy, interruptible, mask);
-
-	ttm_fence_object_flush(fence, mask);
-retry:
-	if (!driver->has_irq ||
-	    driver->has_irq(fence->fdev, fence->fence_class, mask)) {
-
-		cur_jiffies = jiffies;
-		to_jiffies = fence->timeout_jiffies;
-
-		timeout = (time_after(to_jiffies, cur_jiffies)) ?
-		    to_jiffies - cur_jiffies : 1;
-
-		if (interruptible)
-			ret = wait_event_interruptible_timeout
-			    (fc->fence_queue,
-			     ttm_fence_object_signaled(fence, mask), timeout);
-		else
-			ret = wait_event_timeout
-			    (fc->fence_queue,
-			     ttm_fence_object_signaled(fence, mask), timeout);
-
-		if (unlikely(ret == -ERESTARTSYS))
-			return -ERESTART;
-
-		if (unlikely(ret == 0)) {
-			if (driver->lockup)
-				driver->lockup(fence, mask);
-			else
-				ttm_fence_lockup(fence, mask);
-			goto retry;
-		}
-
-		return 0;
-	}
-
-	return ttm_fence_wait_polling(fence, lazy, interruptible, mask);
-}
-
-int ttm_fence_object_emit(struct ttm_fence_object *fence, uint32_t fence_flags,
-			  uint32_t fence_class, uint32_t type)
-{
-	const struct ttm_fence_driver *driver = ttm_fence_driver(fence);
-	struct ttm_fence_class_manager *fc = ttm_fence_fc(fence);
-	unsigned long flags;
-	uint32_t sequence;
-	unsigned long timeout;
-	int ret;
-
-	ttm_fence_unring(fence);
-	ret = driver->emit(fence->fdev,
-			   fence_class, fence_flags, &sequence, &timeout);
-	if (ret)
-		return ret;
-
-	write_lock_irqsave(&fc->lock, flags);
-	fence->fence_class = fence_class;
-	fence->fence_type = type;
-	fence->waiting_types = 0;
-	fence->info.signaled_types = 0;
-	fence->info.error = 0;
-	fence->sequence = sequence;
-	fence->timeout_jiffies = timeout;
-	if (list_empty(&fc->ring))
-		fc->highest_waiting_sequence = sequence - 1;
-	list_add_tail(&fence->ring, &fc->ring);
-	fc->latest_queued_sequence = sequence;
-	write_unlock_irqrestore(&fc->lock, flags);
-	return 0;
-}
-
-int ttm_fence_object_init(struct ttm_fence_device *fdev,
-			  uint32_t fence_class,
-			  uint32_t type,
-			  uint32_t create_flags,
-			  void (*destroy) (struct ttm_fence_object *),
-			  struct ttm_fence_object *fence)
-{
-	int ret = 0;
-
-	kref_init(&fence->kref);
-	fence->fence_class = fence_class;
-	fence->fence_type = type;
-	fence->info.signaled_types = 0;
-	fence->waiting_types = 0;
-	fence->sequence = 0;
-	fence->info.error = 0;
-	fence->fdev = fdev;
-	fence->destroy = destroy;
-	INIT_LIST_HEAD(&fence->ring);
-	atomic_inc(&fdev->count);
-
-	if (create_flags & TTM_FENCE_FLAG_EMIT) {
-		ret = ttm_fence_object_emit(fence, create_flags,
-					    fence->fence_class, type);
-	}
-
-	return ret;
-}
-
-int ttm_fence_object_create(struct ttm_fence_device *fdev,
-			    uint32_t fence_class,
-			    uint32_t type,
-			    uint32_t create_flags,
-			    struct ttm_fence_object **c_fence)
-{
-	struct ttm_fence_object *fence;
-	int ret;
-
-	ret = ttm_mem_global_alloc(fdev->mem_glob,
-				   sizeof(*fence),
-				   false,
-				   false);
-	if (unlikely(ret != 0)) {
-		printk(KERN_ERR "Out of memory creating fence object\n");
-		return ret;
-	}
-
-	fence = kmalloc(sizeof(*fence), GFP_KERNEL);
-	if (!fence) {
-		printk(KERN_ERR "Out of memory creating fence object\n");
-		ttm_mem_global_free(fdev->mem_glob, sizeof(*fence));
-		return -ENOMEM;
-	}
-
-	ret = ttm_fence_object_init(fdev, fence_class, type,
-				    create_flags, NULL, fence);
-	if (ret) {
-		ttm_fence_object_unref(&fence);
-		return ret;
-	}
-	*c_fence = fence;
-
-	return 0;
-}
-
-static void ttm_fence_object_destroy(struct kref *kref)
-{
-	struct ttm_fence_object *fence =
-	    container_of(kref, struct ttm_fence_object, kref);
-	struct ttm_fence_class_manager *fc = ttm_fence_fc(fence);
-	unsigned long irq_flags;
-
-	write_lock_irqsave(&fc->lock, irq_flags);
-	list_del_init(&fence->ring);
-	write_unlock_irqrestore(&fc->lock, irq_flags);
-
-	atomic_dec(&fence->fdev->count);
-	if (fence->destroy)
-		fence->destroy(fence);
-	else {
-		ttm_mem_global_free(fence->fdev->mem_glob,
-				    sizeof(*fence));
-		kfree(fence);
-	}
-}
-
-void ttm_fence_device_release(struct ttm_fence_device *fdev)
-{
-	kfree(fdev->fence_class);
-}
-
-int
-ttm_fence_device_init(int num_classes,
-		      struct ttm_mem_global *mem_glob,
-		      struct ttm_fence_device *fdev,
-		      const struct ttm_fence_class_init *init,
-		      bool replicate_init,
-		      const struct ttm_fence_driver *driver)
-{
-	struct ttm_fence_class_manager *fc;
-	const struct ttm_fence_class_init *fci;
-	int i;
-
-	fdev->mem_glob = mem_glob;
-	fdev->fence_class = kzalloc(num_classes *
-				    sizeof(*fdev->fence_class), GFP_KERNEL);
-
-	if (unlikely(!fdev->fence_class))
-		return -ENOMEM;
-
-	fdev->num_classes = num_classes;
-	atomic_set(&fdev->count, 0);
-	fdev->driver = driver;
-
-	for (i = 0; i < fdev->num_classes; ++i) {
-		fc = &fdev->fence_class[i];
-		fci = &init[(replicate_init) ? 0 : i];
-
-		fc->wrap_diff = fci->wrap_diff;
-		fc->flush_diff = fci->flush_diff;
-		fc->sequence_mask = fci->sequence_mask;
-
-		rwlock_init(&fc->lock);
-		INIT_LIST_HEAD(&fc->ring);
-		init_waitqueue_head(&fc->fence_queue);
-	}
-
-	return 0;
-}
-
-struct ttm_fence_info ttm_fence_get_info(struct ttm_fence_object *fence)
-{
-	struct ttm_fence_class_manager *fc = ttm_fence_fc(fence);
-	struct ttm_fence_info tmp;
-	unsigned long irq_flags;
-
-	read_lock_irqsave(&fc->lock, irq_flags);
-	tmp = fence->info;
-	read_unlock_irqrestore(&fc->lock, irq_flags);
-
-	return tmp;
-}
-
-void ttm_fence_object_unref(struct ttm_fence_object **p_fence)
-{
-	struct ttm_fence_object *fence = *p_fence;
-
-	*p_fence = NULL;
-	(void)kref_put(&fence->kref, &ttm_fence_object_destroy);
-}
-
-/*
- * Placement / BO sync object glue.
- */
-
-bool ttm_fence_sync_obj_signaled(void *sync_obj, void *sync_arg)
-{
-	struct ttm_fence_object *fence = (struct ttm_fence_object *)sync_obj;
-	uint32_t fence_types = (uint32_t) (unsigned long)sync_arg;
-
-	return ttm_fence_object_signaled(fence, fence_types);
-}
-
-int ttm_fence_sync_obj_wait(void *sync_obj, void *sync_arg,
-			    bool lazy, bool interruptible)
-{
-	struct ttm_fence_object *fence = (struct ttm_fence_object *)sync_obj;
-	uint32_t fence_types = (uint32_t) (unsigned long)sync_arg;
-
-	return ttm_fence_object_wait(fence, lazy, interruptible, fence_types);
-}
-
-int ttm_fence_sync_obj_flush(void *sync_obj, void *sync_arg)
-{
-	struct ttm_fence_object *fence = (struct ttm_fence_object *)sync_obj;
-	uint32_t fence_types = (uint32_t) (unsigned long)sync_arg;
-
-	return ttm_fence_object_flush(fence, fence_types);
-}
-
-void ttm_fence_sync_obj_unref(void **sync_obj)
-{
-	ttm_fence_object_unref((struct ttm_fence_object **)sync_obj);
-}
-
-void *ttm_fence_sync_obj_ref(void *sync_obj)
-{
-	return (void *)
-	    ttm_fence_object_ref((struct ttm_fence_object *)sync_obj);
-}
diff --git a/drivers/staging/gma500/psb_ttm_fence_api.h b/drivers/staging/gma500/psb_ttm_fence_api.h
deleted file mode 100644
index b14a427..0000000
--- a/drivers/staging/gma500/psb_ttm_fence_api.h
+++ /dev/null
@@ -1,272 +0,0 @@
-/**************************************************************************
- *
- * Copyright (c) 2006-2008 Tungsten Graphics, Inc., Cedar Park, TX., USA
- * All Rights Reserved.
- * Copyright (c) 2009 VMware, Inc., Palo Alto, CA., USA
- * All Rights Reserved.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- *
- **************************************************************************/
-/*
- * Authors: Thomas Hellstrom <thomas-at-tungstengraphics-dot-com>
- */
-#ifndef _TTM_FENCE_API_H_
-#define _TTM_FENCE_API_H_
-
-#include <linux/list.h>
-#include <linux/kref.h>
-
-#define TTM_FENCE_FLAG_EMIT (1 << 0)
-#define TTM_FENCE_TYPE_EXE  (1 << 0)
-
-struct ttm_fence_device;
-
-/**
- * struct ttm_fence_info
- *
- * @fence_class:    The fence class.
- * @fence_type:     Bitfield indicating types for this fence.
- * @signaled_types: Bitfield indicating which types are signaled.
- * @error:          Last error reported from the device.
- *
- * Used as output from the ttm_fence_get_info
- */
-
-struct ttm_fence_info {
-	uint32_t signaled_types;
-	uint32_t error;
-};
-
-/**
- * struct ttm_fence_object
- *
- * @fdev:            Pointer to the fence device struct.
- * @kref:            Holds the reference count of this fence object.
- * @ring:            List head used for the circular list of not-completely
- *                   signaled fences.
- * @info:            Data for fast retrieval using the ttm_fence_get_info()
- * function.
- * @timeout_jiffies: Absolute jiffies value indicating when this fence
- *                   object times out and, if waited on, calls ttm_fence_lockup
- *                   to check for and resolve a GPU lockup.
- * @sequence:        Fence sequence number.
- * @waiting_types:   Types currently waited on.
- * @destroy:         Called to free the fence object, when its refcount has
- *                   reached zero. If NULL, kfree is used.
- *
- * This struct is provided in the driver interface so that drivers can
- * derive from it and create their own fence implementation. All members
- * are private to the fence implementation and the fence driver callbacks.
- * Otherwise a driver may access the derived object using container_of().
- */
-
-struct ttm_fence_object {
-	struct ttm_fence_device *fdev;
-	struct kref kref;
-	uint32_t fence_class;
-	uint32_t fence_type;
-
-	/*
-	 * The below fields are protected by the fence class
-	 * manager spinlock.
-	 */
-
-	struct list_head ring;
-	struct ttm_fence_info info;
-	unsigned long timeout_jiffies;
-	uint32_t sequence;
-	uint32_t waiting_types;
-	void (*destroy) (struct ttm_fence_object *);
-};
-
-/**
- * ttm_fence_object_init
- *
- * @fdev: Pointer to a struct ttm_fence_device.
- * @fence_class: Fence class for this fence.
- * @type: Fence type for this fence.
- * @create_flags: Flags indicating varios actions at init time. At this point
- * there's only TTM_FENCE_FLAG_EMIT, which triggers a sequence emission to
- * the command stream.
- * @destroy: Destroy function. If NULL, kfree() is used.
- * @fence: The struct ttm_fence_object to initialize.
- *
- * Initialize a pre-allocated fence object. This function, together with the
- * destroy function makes it possible to derive driver-specific fence objects.
- */
-
-extern int
-ttm_fence_object_init(struct ttm_fence_device *fdev,
-		      uint32_t fence_class,
-		      uint32_t type,
-		      uint32_t create_flags,
-		      void (*destroy) (struct ttm_fence_object *fence),
-		      struct ttm_fence_object *fence);
-
-/**
- * ttm_fence_object_create
- *
- * @fdev: Pointer to a struct ttm_fence_device.
- * @fence_class: Fence class for this fence.
- * @type: Fence type for this fence.
- * @create_flags: Flags indicating varios actions at init time. At this point
- * there's only TTM_FENCE_FLAG_EMIT, which triggers a sequence emission to
- * the command stream.
- * @c_fence: On successful termination, *(@c_fence) will point to the created
- * fence object.
- *
- * Create and initialize a struct ttm_fence_object. The destroy function will
- * be set to kfree().
- */
-
-extern int
-ttm_fence_object_create(struct ttm_fence_device *fdev,
-			uint32_t fence_class,
-			uint32_t type,
-			uint32_t create_flags,
-			struct ttm_fence_object **c_fence);
-
-/**
- * ttm_fence_object_wait
- *
- * @fence: The fence object to wait on.
- * @lazy: Allow sleeps to reduce the cpu-usage if polling.
- * @interruptible: Sleep interruptible when waiting.
- * @type_mask: Wait for the given type_mask to signal.
- *
- * Wait for a fence to signal the given type_mask. The function will
- * perform a fence_flush using type_mask. (See ttm_fence_object_flush).
- *
- * Returns
- * -ERESTART if interrupted by a signal.
- * May return driver-specific error codes if timed-out.
- */
-
-extern int
-ttm_fence_object_wait(struct ttm_fence_object *fence,
-		      bool lazy, bool interruptible, uint32_t type_mask);
-
-/**
- * ttm_fence_object_flush
- *
- * @fence: The fence object to flush.
- * @flush_mask: Fence types to flush.
- *
- * Make sure that the given fence eventually signals the
- * types indicated by @flush_mask. Note that this may or may not
- * map to a CPU or GPU flush.
- */
-
-extern int
-ttm_fence_object_flush(struct ttm_fence_object *fence, uint32_t flush_mask);
-
-/**
- * ttm_fence_get_info
- *
- * @fence: The fence object.
- *
- * Copy the info block from the fence while holding relevant locks.
- */
-
-struct ttm_fence_info ttm_fence_get_info(struct ttm_fence_object *fence);
-
-/**
- * ttm_fence_object_ref
- *
- * @fence: The fence object.
- *
- * Return a ref-counted pointer to the fence object indicated by @fence.
- */
-
-static inline struct ttm_fence_object *ttm_fence_object_ref(struct
-							    ttm_fence_object
-							    *fence)
-{
-	kref_get(&fence->kref);
-	return fence;
-}
-
-/**
- * ttm_fence_object_unref
- *
- * @p_fence: Pointer to a ref-counted pinter to a struct ttm_fence_object.
- *
- * Unreference the fence object pointed to by *(@p_fence), clearing
- * *(p_fence).
- */
-
-extern void ttm_fence_object_unref(struct ttm_fence_object **p_fence);
-
-/**
- * ttm_fence_object_signaled
- *
- * @fence: Pointer to the struct ttm_fence_object.
- * @mask: Type mask to check whether signaled.
- *
- * This function checks (without waiting) whether the fence object
- * pointed to by @fence has signaled the types indicated by @mask,
- * and returns 1 if true, 0 if false. This function does NOT perform
- * an implicit fence flush.
- */
-
-extern bool
-ttm_fence_object_signaled(struct ttm_fence_object *fence, uint32_t mask);
-
-/**
- * ttm_fence_class
- *
- * @fence: Pointer to the struct ttm_fence_object.
- *
- * Convenience function that returns the fence class of a
- * struct ttm_fence_object.
- */
-
-static inline uint32_t ttm_fence_class(const struct ttm_fence_object *fence)
-{
-	return fence->fence_class;
-}
-
-/**
- * ttm_fence_types
- *
- * @fence: Pointer to the struct ttm_fence_object.
- *
- * Convenience function that returns the fence types of a
- * struct ttm_fence_object.
- */
-
-static inline uint32_t ttm_fence_types(const struct ttm_fence_object *fence)
-{
-	return fence->fence_type;
-}
-
-/*
- * The functions below are wrappers to the above functions, with
- * similar names but with sync_obj omitted. These wrappers are intended
- * to be plugged directly into the buffer object driver's sync object
- * API, if the driver chooses to use ttm_fence_objects as buffer object
- * sync objects. In the prototypes below, a sync_obj is cast to a
- * struct ttm_fence_object, whereas a sync_arg is cast to an
- * uint32_t representing a fence_type argument.
- */
-
-extern bool ttm_fence_sync_obj_signaled(void *sync_obj, void *sync_arg);
-extern int ttm_fence_sync_obj_wait(void *sync_obj, void *sync_arg,
-				   bool lazy, bool interruptible);
-extern int ttm_fence_sync_obj_flush(void *sync_obj, void *sync_arg);
-extern void ttm_fence_sync_obj_unref(void **sync_obj);
-extern void *ttm_fence_sync_obj_ref(void *sync_obj);
-
-#endif
diff --git a/drivers/staging/gma500/psb_ttm_fence_driver.h b/drivers/staging/gma500/psb_ttm_fence_driver.h
deleted file mode 100644
index c35c569..0000000
--- a/drivers/staging/gma500/psb_ttm_fence_driver.h
+++ /dev/null
@@ -1,302 +0,0 @@
-/**************************************************************************
- *
- * Copyright (c) 2006-2008 Tungsten Graphics, Inc., Cedar Park, TX., USA
- * All Rights Reserved.
- * Copyright (c) 2009 VMware, Inc., Palo Alto, CA., USA
- * All Rights Reserved.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- *
- **************************************************************************/
-/*
- * Authors: Thomas Hellstrom <thomas-at-tungstengraphics-dot-com>
- */
-#ifndef _TTM_FENCE_DRIVER_H_
-#define _TTM_FENCE_DRIVER_H_
-
-#include <linux/kref.h>
-#include <linux/spinlock.h>
-#include <linux/wait.h>
-#include "psb_ttm_fence_api.h"
-#include "ttm/ttm_memory.h"
-
-/** @file ttm_fence_driver.h
- *
- * Definitions needed for a driver implementing the
- * ttm_fence subsystem.
- */
-
-/**
- * struct ttm_fence_class_manager:
- *
- * @wrap_diff: Sequence difference to catch 32-bit wrapping.
- * if (seqa - seqb) > @wrap_diff, then seqa < seqb.
- * @flush_diff: Sequence difference to trigger fence flush.
- * if (cur_seq - seqa) > @flush_diff, then consider fence object with
- * seqa as old an needing a flush.
- * @sequence_mask: Mask of valid bits in a fence sequence.
- * @lock: Lock protecting this struct as well as fence objects
- * associated with this struct.
- * @ring: Circular sequence-ordered list of fence objects.
- * @pending_flush: Fence types currently needing a flush.
- * @waiting_types: Fence types that are currently waited for.
- * @fence_queue: Queue of waiters on fences belonging to this fence class.
- * @highest_waiting_sequence: Sequence number of the fence with highest
- * sequence number and that is waited for.
- * @latest_queued_sequence: Sequence number of the fence latest queued
- * on the ring.
- */
-
-struct ttm_fence_class_manager {
-
-	/*
-	 * Unprotected constant members.
-	 */
-
-	uint32_t wrap_diff;
-	uint32_t flush_diff;
-	uint32_t sequence_mask;
-
-	/*
-	 * The rwlock protects this structure as well as
-	 * the data in all fence objects belonging to this
-	 * class. This should be OK as most fence objects are
-	 * only read from once they're created.
-	 */
-
-	rwlock_t lock;
-	struct list_head ring;
-	uint32_t pending_flush;
-	uint32_t waiting_types;
-	wait_queue_head_t fence_queue;
-	uint32_t highest_waiting_sequence;
-	uint32_t latest_queued_sequence;
-};
-
-/**
- * struct ttm_fence_device
- *
- * @fence_class:  Array of fence class managers.
- * @num_classes:  Array dimension of @fence_class.
- * @count:        Current number of fence objects for statistics.
- * @driver:       Driver struct.
- *
- * Provided in the driver interface so that the driver can derive
- * from this struct for its driver_private, and accordingly
- * access the driver_private from the fence driver callbacks.
- *
- * All members except "count" are initialized at creation and
- * never touched after that. No protection needed.
- *
- * This struct is private to the fence implementation and to the fence
- * driver callbacks, and may otherwise be used by drivers only to
- * obtain the derived device_private object using container_of().
- */
-
-struct ttm_fence_device {
-	struct ttm_mem_global *mem_glob;
-	struct ttm_fence_class_manager *fence_class;
-	uint32_t num_classes;
-	atomic_t count;
-	const struct ttm_fence_driver *driver;
-};
-
-/**
- * struct ttm_fence_class_init
- *
- * @wrap_diff:    Fence sequence number wrap indicator. If
- * (sequence1 - sequence2) > @wrap_diff, then sequence1 is
- * considered to be older than sequence2.
- * @flush_diff:   Fence sequence number flush indicator.
- * If a non-completely-signaled fence has a fence sequence number
- * sequence1 and (sequence1 - current_emit_sequence) > @flush_diff,
- * the fence is considered too old and it will be flushed upon the
- * next call of ttm_fence_flush_old(), to make sure no fences with
- * stale sequence numbers remains unsignaled. @flush_diff should
- * be sufficiently less than @wrap_diff.
- * @sequence_mask: Mask with valid bits of the fence sequence
- * number set to 1.
- *
- * This struct is used as input to ttm_fence_device_init.
- */
-
-struct ttm_fence_class_init {
-	uint32_t wrap_diff;
-	uint32_t flush_diff;
-	uint32_t sequence_mask;
-};
-
-/**
- * struct ttm_fence_driver
- *
- * @has_irq: Called by a potential waiter. Should return 1 if a
- * fence object with indicated parameters is expected to signal
- * automatically, and 0 if the fence implementation needs to
- * repeatedly call @poll to make it signal.
- * @emit:    Make sure a fence with the given parameters is
- * present in the indicated command stream. Return its sequence number
- * in "breadcrumb".
- * @poll:    Check and report sequences of the given "fence_class"
- *           that have signaled "types"
- * @flush:   Make sure that the types indicated by the bitfield
- *           ttm_fence_class_manager::pending_flush will eventually
- *           signal. These bits have been put together using the
- *           result from the needed_flush function described below.
- * @needed_flush: Given the fence_class and fence_types indicated by
- *           "fence", and the last received fence sequence of this
- *           fence class, indicate what types need a fence flush to
- *           signal. Return as a bitfield.
- * @wait:    Set to non-NULL if the driver wants to override the fence
- *           wait implementation. Return 0 on success, -EBUSY on failure,
- *           and -ERESTART if interruptible and a signal is pending.
- * @signaled:  Driver callback that is called whenever a
- *           ttm_fence_object::signaled_types has changed status.
- *           This function is called from atomic context,
- *           with the ttm_fence_class_manager::lock held in write mode.
- * @lockup:  Driver callback that is called whenever a wait has exceeded
- *           the lifetime of a fence object.
- *           If there is a GPU lockup,
- *           this function should, if possible, reset the GPU,
- *           call the ttm_fence_handler with an error status, and
- *           return. If no lockup was detected, simply extend the
- *           fence timeout_jiffies and return. The driver might
- *           want to protect the lockup check with a mutex and cache a
- *           non-locked-up status for a while to avoid an excessive
- *           amount of lockup checks from every waiting thread.
- */
-
-struct ttm_fence_driver {
-	bool (*has_irq) (struct ttm_fence_device *fdev,
-			uint32_t fence_class, uint32_t flags);
-	int (*emit) (struct ttm_fence_device *fdev,
-		     uint32_t fence_class,
-		     uint32_t flags,
-		     uint32_t *breadcrumb, unsigned long *timeout_jiffies);
-	void (*flush) (struct ttm_fence_device *fdev, uint32_t fence_class);
-	void (*poll) (struct ttm_fence_device *fdev,
-		      uint32_t fence_class, uint32_t types);
-	 uint32_t(*needed_flush)
-	 (struct ttm_fence_object *fence);
-	int (*wait) (struct ttm_fence_object *fence, bool lazy,
-		     bool interruptible, uint32_t mask);
-	void (*signaled) (struct ttm_fence_object *fence);
-	void (*lockup) (struct ttm_fence_object *fence, uint32_t fence_types);
-};
-
-/**
- * function ttm_fence_device_init
- *
- * @num_classes:      Number of fence classes for this fence implementation.
- * @mem_global:       Pointer to the global memory accounting info.
- * @fdev:             Pointer to an uninitialised struct ttm_fence_device.
- * @init:             Array of initialization info for each fence class.
- * @replicate_init:   Use the first @init initialization info for all classes.
- * @driver:           Driver callbacks.
- *
- * Initialize a struct ttm_fence_driver structure. Returns -ENOMEM if
- * out-of-memory. Otherwise returns 0.
- */
-extern int
-ttm_fence_device_init(int num_classes,
-		      struct ttm_mem_global *mem_glob,
-		      struct ttm_fence_device *fdev,
-		      const struct ttm_fence_class_init *init,
-		      bool replicate_init,
-		      const struct ttm_fence_driver *driver);
-
-/**
- * function ttm_fence_device_release
- *
- * @fdev:             Pointer to the fence device.
- *
- * Release all resources held by a fence device. Note that before
- * this function is called, the caller must have made sure all fence
- * objects belonging to this fence device are completely signaled.
- */
-
-extern void ttm_fence_device_release(struct ttm_fence_device *fdev);
-
-/**
- * ttm_fence_handler - the fence handler.
- *
- * @fdev:        Pointer to the fence device.
- * @fence_class: Fence class that signals.
- * @sequence:    Signaled sequence.
- * @type:        Types that signal.
- * @error:       Error from the engine.
- *
- * This function signals all fences with a sequence previous to the
- * @sequence argument, and belonging to @fence_class. The signaled fence
- * types are provided in @type. If error is non-zero, the error member
- * of the fence with sequence = @sequence is set to @error. This value
- * may be reported back to user-space, indicating, for example an illegal
- * 3D command or illegal mpeg data.
- *
- * This function is typically called from the driver::poll method when the
- * command sequence preceding the fence marker has executed. It should be
- * called with the ttm_fence_class_manager::lock held in write mode and
- * may be called from interrupt context.
- */
-
-extern void
-ttm_fence_handler(struct ttm_fence_device *fdev,
-		  uint32_t fence_class,
-		  uint32_t sequence, uint32_t type, uint32_t error);
-
-/**
- * ttm_fence_driver_from_dev
- *
- * @fdev:        The ttm fence device.
- *
- * Returns a pointer to the fence driver struct.
- */
-
-static inline const struct ttm_fence_driver *ttm_fence_driver_from_dev(
-						struct ttm_fence_device *fdev)
-{
-	return fdev->driver;
-}
-
-/**
- * ttm_fence_driver
- *
- * @fence:        Pointer to a ttm fence object.
- *
- * Returns a pointer to the fence driver struct.
- */
-
-static inline const struct ttm_fence_driver *ttm_fence_driver(struct
-							      ttm_fence_object
-							      *fence)
-{
-	return ttm_fence_driver_from_dev(fence->fdev);
-}
-
-/**
- * ttm_fence_fc
- *
- * @fence:        Pointer to a ttm fence object.
- *
- * Returns a pointer to the struct ttm_fence_class_manager for the
- * fence class of @fence.
- */
-
-static inline struct ttm_fence_class_manager *ttm_fence_fc(struct
-							   ttm_fence_object
-							   *fence)
-{
-	return &fence->fdev->fence_class[fence->fence_class];
-}
-
-#endif
diff --git a/drivers/staging/gma500/psb_ttm_fence_user.c b/drivers/staging/gma500/psb_ttm_fence_user.c
deleted file mode 100644
index 36f974f..0000000
--- a/drivers/staging/gma500/psb_ttm_fence_user.c
+++ /dev/null
@@ -1,237 +0,0 @@
-/**************************************************************************
- *
- * Copyright (c) 2006-2008 Tungsten Graphics, Inc., Cedar Park, TX., USA
- * All Rights Reserved.
- * Copyright (c) 2009 VMware, Inc., Palo Alto, CA., USA
- * All Rights Reserved.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- *
- **************************************************************************/
-/*
- * Authors: Thomas Hellstrom <thomas-at-tungstengraphics-dot-com>
- */
-
-#include <drm/drmP.h>
-#include "psb_ttm_fence_user.h"
-#include "ttm/ttm_object.h"
-#include "psb_ttm_fence_driver.h"
-#include "psb_ttm_userobj_api.h"
-
-/**
- * struct ttm_fence_user_object
- *
- * @base:    The base object used for user-space visibility and refcounting.
- *
- * @fence:   The fence object itself.
- *
- */
-
-struct ttm_fence_user_object {
-	struct ttm_base_object base;
-	struct ttm_fence_object fence;
-};
-
-static struct ttm_fence_user_object *ttm_fence_user_object_lookup(
-					struct ttm_object_file *tfile,
-					uint32_t handle)
-{
-	struct ttm_base_object *base;
-
-	base = ttm_base_object_lookup(tfile, handle);
-	if (unlikely(base == NULL)) {
-		printk(KERN_ERR "Invalid fence handle 0x%08lx\n",
-		       (unsigned long)handle);
-		return NULL;
-	}
-
-	if (unlikely(base->object_type != ttm_fence_type)) {
-		ttm_base_object_unref(&base);
-		printk(KERN_ERR "Invalid fence handle 0x%08lx\n",
-		       (unsigned long)handle);
-		return NULL;
-	}
-
-	return container_of(base, struct ttm_fence_user_object, base);
-}
-
-/*
- * The fence object destructor.
- */
-
-static void ttm_fence_user_destroy(struct ttm_fence_object *fence)
-{
-	struct ttm_fence_user_object *ufence =
-	    container_of(fence, struct ttm_fence_user_object, fence);
-
-	ttm_mem_global_free(fence->fdev->mem_glob, sizeof(*ufence));
-	kfree(ufence);
-}
-
-/*
- * The base object destructor. We basically unly unreference the
- * attached fence object.
- */
-
-static void ttm_fence_user_release(struct ttm_base_object **p_base)
-{
-	struct ttm_fence_user_object *ufence;
-	struct ttm_base_object *base = *p_base;
-	struct ttm_fence_object *fence;
-
-	*p_base = NULL;
-
-	if (unlikely(base == NULL))
-		return;
-
-	ufence = container_of(base, struct ttm_fence_user_object, base);
-	fence = &ufence->fence;
-	ttm_fence_object_unref(&fence);
-}
-
-int
-ttm_fence_user_create(struct ttm_fence_device *fdev,
-		      struct ttm_object_file *tfile,
-		      uint32_t fence_class,
-		      uint32_t fence_types,
-		      uint32_t create_flags,
-		      struct ttm_fence_object **fence,
-		      uint32_t *user_handle)
-{
-	int ret;
-	struct ttm_fence_object *tmp;
-	struct ttm_fence_user_object *ufence;
-
-	ret = ttm_mem_global_alloc(fdev->mem_glob,
-				   sizeof(*ufence),
-				   false,
-				   false);
-	if (unlikely(ret != 0))
-		return -ENOMEM;
-
-	ufence = kmalloc(sizeof(*ufence), GFP_KERNEL);
-	if (unlikely(ufence == NULL)) {
-		ttm_mem_global_free(fdev->mem_glob, sizeof(*ufence));
-		return -ENOMEM;
-	}
-
-	ret = ttm_fence_object_init(fdev,
-				    fence_class,
-				    fence_types, create_flags,
-				    &ttm_fence_user_destroy, &ufence->fence);
-
-	if (unlikely(ret != 0))
-		goto out_err0;
-
-	/*
-	 * One fence ref is held by the fence ptr we return.
-	 * The other one by the base object. Need to up the
-	 * fence refcount before we publish this object to
-	 * user-space.
-	 */
-
-	tmp = ttm_fence_object_ref(&ufence->fence);
-	ret = ttm_base_object_init(tfile, &ufence->base,
-				   false, ttm_fence_type,
-				   &ttm_fence_user_release, NULL);
-
-	if (unlikely(ret != 0))
-		goto out_err1;
-
-	*fence = &ufence->fence;
-	*user_handle = ufence->base.hash.key;
-
-	return 0;
-out_err1:
-	ttm_fence_object_unref(&tmp);
-	tmp = &ufence->fence;
-	ttm_fence_object_unref(&tmp);
-	return ret;
-out_err0:
-	ttm_mem_global_free(fdev->mem_glob, sizeof(*ufence));
-	kfree(ufence);
-	return ret;
-}
-
-int ttm_fence_signaled_ioctl(struct ttm_object_file *tfile, void *data)
-{
-	int ret;
-	union ttm_fence_signaled_arg *arg = data;
-	struct ttm_fence_object *fence;
-	struct ttm_fence_info info;
-	struct ttm_fence_user_object *ufence;
-	struct ttm_base_object *base;
-	ret = 0;
-
-	ufence = ttm_fence_user_object_lookup(tfile, arg->req.handle);
-	if (unlikely(ufence == NULL))
-		return -EINVAL;
-
-	fence = &ufence->fence;
-
-	if (arg->req.flush) {
-		ret = ttm_fence_object_flush(fence, arg->req.fence_type);
-		if (unlikely(ret != 0))
-			goto out;
-	}
-
-	info = ttm_fence_get_info(fence);
-	arg->rep.signaled_types = info.signaled_types;
-	arg->rep.fence_error = info.error;
-
-out:
-	base = &ufence->base;
-	ttm_base_object_unref(&base);
-	return ret;
-}
-
-int ttm_fence_finish_ioctl(struct ttm_object_file *tfile, void *data)
-{
-	int ret;
-	union ttm_fence_finish_arg *arg = data;
-	struct ttm_fence_user_object *ufence;
-	struct ttm_base_object *base;
-	struct ttm_fence_object *fence;
-	ret = 0;
-
-	ufence = ttm_fence_user_object_lookup(tfile, arg->req.handle);
-	if (unlikely(ufence == NULL))
-		return -EINVAL;
-
-	fence = &ufence->fence;
-
-	ret = ttm_fence_object_wait(fence,
-				    arg->req.mode & TTM_FENCE_FINISH_MODE_LAZY,
-				    true, arg->req.fence_type);
-	if (likely(ret == 0)) {
-		struct ttm_fence_info info = ttm_fence_get_info(fence);
-
-		arg->rep.signaled_types = info.signaled_types;
-		arg->rep.fence_error = info.error;
-	}
-
-	base = &ufence->base;
-	ttm_base_object_unref(&base);
-
-	return ret;
-}
-
-int ttm_fence_unref_ioctl(struct ttm_object_file *tfile, void *data)
-{
-	struct ttm_fence_unref_arg *arg = data;
-	int ret = 0;
-
-	ret = ttm_ref_object_base_unref(tfile, arg->handle, ttm_fence_type);
-	return ret;
-}
diff --git a/drivers/staging/gma500/psb_ttm_fence_user.h b/drivers/staging/gma500/psb_ttm_fence_user.h
deleted file mode 100644
index 762a057..0000000
--- a/drivers/staging/gma500/psb_ttm_fence_user.h
+++ /dev/null
@@ -1,140 +0,0 @@
-/**************************************************************************
- *
- * Copyright 2006-2008 Tungsten Graphics, Inc., Cedar Park, TX., USA
- * All Rights Reserved.
- * Copyright (c) 2009 VMware, Inc., Palo Alto, CA., USA
- * All Rights Reserved.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- *
- **************************************************************************/
-/*
- * Authors
- * Thomas Hellström <thomas-at-tungstengraphics-dot-com>
- */
-
-#ifndef TTM_FENCE_USER_H
-#define TTM_FENCE_USER_H
-
-#if !defined(__KERNEL__) && !defined(_KERNEL)
-#include <stdint.h>
-#endif
-
-#define TTM_FENCE_MAJOR 0
-#define TTM_FENCE_MINOR 1
-#define TTM_FENCE_PL    0
-#define TTM_FENCE_DATE  "080819"
-
-/**
- * struct ttm_fence_signaled_req
- *
- * @handle: Handle to the fence object. Input.
- *
- * @fence_type: Fence types we want to flush. Input.
- *
- * @flush: Boolean. Flush the indicated fence_types. Input.
- *
- * Argument to the TTM_FENCE_SIGNALED ioctl.
- */
-
-struct ttm_fence_signaled_req {
-	uint32_t handle;
-	uint32_t fence_type;
-	int32_t flush;
-	uint32_t pad64;
-};
-
-/**
- * struct ttm_fence_rep
- *
- * @signaled_types: Fence type that has signaled.
- *
- * @fence_error: Command execution error.
- * Hardware errors that are consequences of the execution
- * of the command stream preceding the fence are reported
- * here.
- *
- * Output argument to the TTM_FENCE_SIGNALED and
- * TTM_FENCE_FINISH ioctls.
- */
-
-struct ttm_fence_rep {
-	uint32_t signaled_types;
-	uint32_t fence_error;
-};
-
-union ttm_fence_signaled_arg {
-	struct ttm_fence_signaled_req req;
-	struct ttm_fence_rep rep;
-};
-
-/*
- * Waiting mode flags for the TTM_FENCE_FINISH ioctl.
- *
- * TTM_FENCE_FINISH_MODE_LAZY: Allow for sleeps during polling
- * wait.
- *
- * TTM_FENCE_FINISH_MODE_NO_BLOCK: Don't block waiting for GPU,
- * but return -EBUSY if the buffer is busy.
- */
-
-#define TTM_FENCE_FINISH_MODE_LAZY     (1 << 0)
-#define TTM_FENCE_FINISH_MODE_NO_BLOCK (1 << 1)
-
-/**
- * struct ttm_fence_finish_req
- *
- * @handle: Handle to the fence object. Input.
- *
- * @fence_type: Fence types we want to finish.
- *
- * @mode: Wait mode.
- *
- * Input to the TTM_FENCE_FINISH ioctl.
- */
-
-struct ttm_fence_finish_req {
-	uint32_t handle;
-	uint32_t fence_type;
-	uint32_t mode;
-	uint32_t pad64;
-};
-
-union ttm_fence_finish_arg {
-	struct ttm_fence_finish_req req;
-	struct ttm_fence_rep rep;
-};
-
-/**
- * struct ttm_fence_unref_arg
- *
- * @handle: Handle to the fence object.
- *
- * Argument to the TTM_FENCE_UNREF ioctl.
- */
-
-struct ttm_fence_unref_arg {
-	uint32_t handle;
-	uint32_t pad64;
-};
-
-/*
- * Ioctl offsets from extenstion start.
- */
-
-#define TTM_FENCE_SIGNALED 0x01
-#define TTM_FENCE_FINISH   0x02
-#define TTM_FENCE_UNREF    0x03
-
-#endif
diff --git a/drivers/staging/gma500/psb_ttm_glue.c b/drivers/staging/gma500/psb_ttm_glue.c
deleted file mode 100644
index d1d965e..0000000
--- a/drivers/staging/gma500/psb_ttm_glue.c
+++ /dev/null
@@ -1,349 +0,0 @@
-/**************************************************************************
- * Copyright (c) 2008, Intel Corporation.
- * All Rights Reserved.
- * Copyright (c) 2008, Tungsten Graphics Inc.  Cedar Park, TX., USA.
- * All Rights Reserved.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- *
- **************************************************************************/
-
-
-#include <drm/drmP.h>
-#include "psb_drv.h"
-#include "psb_ttm_userobj_api.h"
-#include <linux/io.h>
-
-
-static struct vm_operations_struct psb_ttm_vm_ops;
-
-/**
- * NOTE: driver_private of drm_file is now a struct psb_file_data struct
- * pPriv in struct psb_file_data contains the original psb_fpriv;
- */
-int psb_open(struct inode *inode, struct file *filp)
-{
-	struct drm_file *file_priv;
-	struct drm_psb_private *dev_priv;
-	struct psb_fpriv *psb_fp;
-	struct psb_file_data *pvr_file_priv;
-	int ret;
-
-	DRM_DEBUG("\n");
-
-	ret = drm_open(inode, filp);
-	if (unlikely(ret))
-		return ret;
-
-	psb_fp = kzalloc(sizeof(*psb_fp), GFP_KERNEL);
-
-	if (unlikely(psb_fp == NULL))
-		goto out_err0;
-
-	file_priv = (struct drm_file *) filp->private_data;
-	dev_priv = psb_priv(file_priv->minor->dev);
-
-	DRM_DEBUG("is_master %d\n", file_priv->is_master ? 1 : 0);
-
-	psb_fp->tfile = ttm_object_file_init(dev_priv->tdev,
-					     PSB_FILE_OBJECT_HASH_ORDER);
-	if (unlikely(psb_fp->tfile == NULL))
-		goto out_err1;
-
-	pvr_file_priv = (struct psb_file_data *)file_priv->driver_priv;
-	if (!pvr_file_priv) {
-		DRM_ERROR("drm file private is NULL\n");
-		goto out_err1;
-	}
-
-	pvr_file_priv->priv = psb_fp;
-	if (unlikely(dev_priv->bdev.dev_mapping == NULL))
-		dev_priv->bdev.dev_mapping = dev_priv->dev->dev_mapping;
-
-	return 0;
-
-out_err1:
-	kfree(psb_fp);
-out_err0:
-	(void) drm_release(inode, filp);
-	return ret;
-}
-
-int psb_release(struct inode *inode, struct file *filp)
-{
-	struct drm_file *file_priv;
-	struct psb_fpriv *psb_fp;
-	struct drm_psb_private *dev_priv;
-	int ret;
-	file_priv = (struct drm_file *) filp->private_data;
-	psb_fp = psb_fpriv(file_priv);
-	dev_priv = psb_priv(file_priv->minor->dev);
-
-	ttm_object_file_release(&psb_fp->tfile);
-	kfree(psb_fp);
-
-	ret = drm_release(inode, filp);
-
-	return ret;
-}
-
-int psb_fence_signaled_ioctl(struct drm_device *dev, void *data,
-			     struct drm_file *file_priv)
-{
-
-	return ttm_fence_signaled_ioctl(psb_fpriv(file_priv)->tfile, data);
-}
-
-int psb_fence_finish_ioctl(struct drm_device *dev, void *data,
-			   struct drm_file *file_priv)
-{
-	return ttm_fence_finish_ioctl(psb_fpriv(file_priv)->tfile, data);
-}
-
-int psb_fence_unref_ioctl(struct drm_device *dev, void *data,
-			  struct drm_file *file_priv)
-{
-	return ttm_fence_unref_ioctl(psb_fpriv(file_priv)->tfile, data);
-}
-
-int psb_pl_waitidle_ioctl(struct drm_device *dev, void *data,
-			  struct drm_file *file_priv)
-{
-	return ttm_pl_waitidle_ioctl(psb_fpriv(file_priv)->tfile, data);
-}
-
-int psb_pl_setstatus_ioctl(struct drm_device *dev, void *data,
-			   struct drm_file *file_priv)
-{
-	return ttm_pl_setstatus_ioctl(psb_fpriv(file_priv)->tfile,
-				      &psb_priv(dev)->ttm_lock, data);
-
-}
-
-int psb_pl_synccpu_ioctl(struct drm_device *dev, void *data,
-			 struct drm_file *file_priv)
-{
-	return ttm_pl_synccpu_ioctl(psb_fpriv(file_priv)->tfile, data);
-}
-
-int psb_pl_unref_ioctl(struct drm_device *dev, void *data,
-		       struct drm_file *file_priv)
-{
-	return ttm_pl_unref_ioctl(psb_fpriv(file_priv)->tfile, data);
-
-}
-
-int psb_pl_reference_ioctl(struct drm_device *dev, void *data,
-			   struct drm_file *file_priv)
-{
-	return  ttm_pl_reference_ioctl(psb_fpriv(file_priv)->tfile, data);
-
-}
-
-int psb_pl_create_ioctl(struct drm_device *dev, void *data,
-			struct drm_file *file_priv)
-{
-	struct drm_psb_private *dev_priv = psb_priv(dev);
-
-	return ttm_pl_create_ioctl(psb_fpriv(file_priv)->tfile,
-				   &dev_priv->bdev, &dev_priv->ttm_lock, data);
-
-}
-
-int psb_pl_ub_create_ioctl(struct drm_device *dev, void *data,
-			struct drm_file *file_priv)
-{
-	struct drm_psb_private *dev_priv = psb_priv(dev);
-
-	return ttm_pl_ub_create_ioctl(psb_fpriv(file_priv)->tfile,
-				   &dev_priv->bdev, &dev_priv->ttm_lock, data);
-
-}
-/**
- * psb_ttm_fault - Wrapper around the ttm fault method.
- *
- * @vma: The struct vm_area_struct as in the vm fault() method.
- * @vmf: The struct vm_fault as in the vm fault() method.
- *
- * Since ttm_fault() will reserve buffers while faulting,
- * we need to take the ttm read lock around it, as this driver
- * relies on the ttm_lock in write mode to exclude all threads from
- * reserving and thus validating buffers in aperture- and memory shortage
- * situations.
- */
-
-static int psb_ttm_fault(struct vm_area_struct *vma,
-			 struct vm_fault *vmf)
-{
-	struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
-		vma->vm_private_data;
-	struct drm_psb_private *dev_priv =
-		container_of(bo->bdev, struct drm_psb_private, bdev);
-	int ret;
-
-	ret = ttm_read_lock(&dev_priv->ttm_lock, true);
-	if (unlikely(ret != 0))
-		return VM_FAULT_NOPAGE;
-
-	ret = dev_priv->ttm_vm_ops->fault(vma, vmf);
-
-	ttm_read_unlock(&dev_priv->ttm_lock);
-	return ret;
-}
-
-/**
- * if vm_pgoff < DRM_PSB_FILE_PAGE_OFFSET call directly to
- * PVRMMap
- */
-int psb_mmap(struct file *filp, struct vm_area_struct *vma)
-{
-	struct drm_file *file_priv;
-	struct drm_psb_private *dev_priv;
-	int ret;
-
-	if (vma->vm_pgoff < DRM_PSB_FILE_PAGE_OFFSET ||
-	    vma->vm_pgoff > 2 * DRM_PSB_FILE_PAGE_OFFSET)
-#if 0		/* FIXMEAC */
-		return PVRMMap(filp, vma);
-#else
-		return -EINVAL;
-#endif
-
-	file_priv = (struct drm_file *) filp->private_data;
-	dev_priv = psb_priv(file_priv->minor->dev);
-
-	ret = ttm_bo_mmap(filp, vma, &dev_priv->bdev);
-	if (unlikely(ret != 0))
-		return ret;
-
-	if (unlikely(dev_priv->ttm_vm_ops == NULL)) {
-		dev_priv->ttm_vm_ops = (struct vm_operations_struct *)
-								vma->vm_ops;
-		psb_ttm_vm_ops = *vma->vm_ops;
-		psb_ttm_vm_ops.fault = &psb_ttm_fault;
-	}
-
-	vma->vm_ops = &psb_ttm_vm_ops;
-
-	return 0;
-}
-/*
-ssize_t psb_ttm_write(struct file *filp, const char __user *buf,
-		      size_t count, loff_t *f_pos)
-{
-	struct drm_file *file_priv = (struct drm_file *)filp->private_data;
-	struct drm_psb_private *dev_priv = psb_priv(file_priv->minor->dev);
-
-	return ttm_bo_io(&dev_priv->bdev, filp, buf, NULL, count, f_pos, 1);
-}
-
-ssize_t psb_ttm_read(struct file *filp, char __user *buf,
-		     size_t count, loff_t *f_pos)
-{
-	struct drm_file *file_priv = (struct drm_file *)filp->private_data;
-	struct drm_psb_private *dev_priv = psb_priv(file_priv->minor->dev);
-
-	return ttm_bo_io(&dev_priv->bdev, filp, NULL, buf, count, f_pos, 1);
-}
-*/
-int psb_verify_access(struct ttm_buffer_object *bo,
-		      struct file *filp)
-{
-	struct drm_file *file_priv = (struct drm_file *)filp->private_data;
-
-	if (capable(CAP_SYS_ADMIN))
-		return 0;
-
-	if (unlikely(!file_priv->authenticated))
-		return -EPERM;
-
-	return ttm_pl_verify_access(bo, psb_fpriv(file_priv)->tfile);
-}
-
-static int psb_ttm_mem_global_init(struct drm_global_reference *ref)
-{
-	return ttm_mem_global_init(ref->object);
-}
-
-static void psb_ttm_mem_global_release(struct drm_global_reference *ref)
-{
-	ttm_mem_global_release(ref->object);
-}
-
-int psb_ttm_global_init(struct drm_psb_private *dev_priv)
-{
-	struct drm_global_reference *global_ref;
-	int ret;
-
-	global_ref = &dev_priv->mem_global_ref;
-	global_ref->global_type = DRM_GLOBAL_TTM_MEM;
-	global_ref->size = sizeof(struct ttm_mem_global);
-	global_ref->init = &psb_ttm_mem_global_init;
-	global_ref->release = &psb_ttm_mem_global_release;
-
-	ret = drm_global_item_ref(global_ref);
-	if (unlikely(ret != 0)) {
-		DRM_ERROR("Failed referencing a global TTM memory object.\n");
-		return ret;
-	}
-
-	dev_priv->bo_global_ref.mem_glob = dev_priv->mem_global_ref.object;
-	global_ref = &dev_priv->bo_global_ref.ref;
-	global_ref->global_type = DRM_GLOBAL_TTM_BO;
-	global_ref->size = sizeof(struct ttm_bo_global);
-	global_ref->init = &ttm_bo_global_init;
-	global_ref->release = &ttm_bo_global_release;
-	ret = drm_global_item_ref(global_ref);
-	if (ret != 0) {
-		DRM_ERROR("Failed setting up TTM BO subsystem.\n");
-		drm_global_item_unref(global_ref);
-		return ret;
-	}
-	return 0;
-}
-
-void psb_ttm_global_release(struct drm_psb_private *dev_priv)
-{
-	drm_global_item_unref(&dev_priv->mem_global_ref);
-}
-
-int psb_getpageaddrs_ioctl(struct drm_device *dev, void *data,
-		struct drm_file *file_priv)
-{
-	struct drm_psb_getpageaddrs_arg *arg = data;
-	struct ttm_buffer_object *bo;
-	struct ttm_tt *ttm;
-	struct page **tt_pages;
-	unsigned long i, num_pages;
-	unsigned long *p = arg->page_addrs;
-	int ret = 0;
-
-	bo = ttm_buffer_object_lookup(psb_fpriv(file_priv)->tfile,
-					arg->handle);
-	if (unlikely(bo == NULL)) {
-		printk(KERN_ERR
-			"Could not find buffer object for getpageaddrs.\n");
-		return -EINVAL;
-	}
-
-	arg->gtt_offset = bo->offset;
-	ttm = bo->ttm;
-	num_pages = ttm->num_pages;
-	tt_pages = ttm->pages;
-
-	for (i = 0; i < num_pages; i++)
-		p[i] = (unsigned long)page_to_phys(tt_pages[i]);
-
-	return ret;
-}
diff --git a/drivers/staging/gma500/psb_ttm_placement_user.c b/drivers/staging/gma500/psb_ttm_placement_user.c
deleted file mode 100644
index 272b397..0000000
--- a/drivers/staging/gma500/psb_ttm_placement_user.c
+++ /dev/null
@@ -1,628 +0,0 @@
-/**************************************************************************
- *
- * Copyright (c) 2006-2008 Tungsten Graphics, Inc., Cedar Park, TX., USA
- * All Rights Reserved.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- *
- **************************************************************************/
-/*
- * Authors: Thomas Hellstrom <thomas-at-tungstengraphics-dot-com>
- */
-
-#include "psb_ttm_placement_user.h"
-#include "ttm/ttm_bo_driver.h"
-#include "ttm/ttm_object.h"
-#include "psb_ttm_userobj_api.h"
-#include "ttm/ttm_lock.h"
-#include <linux/slab.h>
-#include <linux/sched.h>
-
-struct ttm_bo_user_object {
-	struct ttm_base_object base;
-	struct ttm_buffer_object bo;
-};
-
-static size_t pl_bo_size;
-
-static uint32_t psb_busy_prios[] = {
-	TTM_PL_TT,
-	TTM_PL_PRIV0, /* CI */
-	TTM_PL_PRIV2, /* RAR */
-	TTM_PL_PRIV1, /* DRM_PSB_MEM_MMU */
-	TTM_PL_SYSTEM
-};
-
-static const struct ttm_placement default_placement = {
-				0, 0, 0, NULL, 5, psb_busy_prios
-};
-
-static size_t ttm_pl_size(struct ttm_bo_device *bdev, unsigned long num_pages)
-{
-	size_t page_array_size =
-	    (num_pages * sizeof(void *) + PAGE_SIZE - 1) & PAGE_MASK;
-
-	if (unlikely(pl_bo_size == 0)) {
-		pl_bo_size = bdev->glob->ttm_bo_extra_size +
-		    ttm_round_pot(sizeof(struct ttm_bo_user_object));
-	}
-
-	return bdev->glob->ttm_bo_size + 2 * page_array_size;
-}
-
-static struct ttm_bo_user_object *ttm_bo_user_lookup(struct ttm_object_file
-						     *tfile, uint32_t handle)
-{
-	struct ttm_base_object *base;
-
-	base = ttm_base_object_lookup(tfile, handle);
-	if (unlikely(base == NULL)) {
-		printk(KERN_ERR "Invalid buffer object handle 0x%08lx.\n",
-		       (unsigned long)handle);
-		return NULL;
-	}
-
-	if (unlikely(base->object_type != ttm_buffer_type)) {
-		ttm_base_object_unref(&base);
-		printk(KERN_ERR "Invalid buffer object handle 0x%08lx.\n",
-		       (unsigned long)handle);
-		return NULL;
-	}
-
-	return container_of(base, struct ttm_bo_user_object, base);
-}
-
-struct ttm_buffer_object *ttm_buffer_object_lookup(struct ttm_object_file
-						   *tfile, uint32_t handle)
-{
-	struct ttm_bo_user_object *user_bo;
-	struct ttm_base_object *base;
-
-	user_bo = ttm_bo_user_lookup(tfile, handle);
-	if (unlikely(user_bo == NULL))
-		return NULL;
-
-	(void)ttm_bo_reference(&user_bo->bo);
-	base = &user_bo->base;
-	ttm_base_object_unref(&base);
-	return &user_bo->bo;
-}
-
-static void ttm_bo_user_destroy(struct ttm_buffer_object *bo)
-{
-	struct ttm_bo_user_object *user_bo =
-	    container_of(bo, struct ttm_bo_user_object, bo);
-
-	ttm_mem_global_free(bo->glob->mem_glob, bo->acc_size);
-	kfree(user_bo);
-}
-
-static void ttm_bo_user_release(struct ttm_base_object **p_base)
-{
-	struct ttm_bo_user_object *user_bo;
-	struct ttm_base_object *base = *p_base;
-	struct ttm_buffer_object *bo;
-
-	*p_base = NULL;
-
-	if (unlikely(base == NULL))
-		return;
-
-	user_bo = container_of(base, struct ttm_bo_user_object, base);
-	bo = &user_bo->bo;
-	ttm_bo_unref(&bo);
-}
-
-static void ttm_bo_user_ref_release(struct ttm_base_object *base,
-				    enum ttm_ref_type ref_type)
-{
-	struct ttm_bo_user_object *user_bo =
-	    container_of(base, struct ttm_bo_user_object, base);
-	struct ttm_buffer_object *bo = &user_bo->bo;
-
-	switch (ref_type) {
-	case TTM_REF_SYNCCPU_WRITE:
-		ttm_bo_synccpu_write_release(bo);
-		break;
-	default:
-		BUG();
-	}
-}
-
-static void ttm_pl_fill_rep(struct ttm_buffer_object *bo,
-			    struct ttm_pl_rep *rep)
-{
-	struct ttm_bo_user_object *user_bo =
-	    container_of(bo, struct ttm_bo_user_object, bo);
-
-	rep->gpu_offset = bo->offset;
-	rep->bo_size = bo->num_pages << PAGE_SHIFT;
-	rep->map_handle = bo->addr_space_offset;
-	rep->placement = bo->mem.placement;
-	rep->handle = user_bo->base.hash.key;
-	rep->sync_object_arg = (uint32_t) (unsigned long)bo->sync_obj_arg;
-}
-
-/* FIXME Copy from upstream TTM */
-static inline size_t ttm_bo_size(struct ttm_bo_global *glob,
-				 unsigned long num_pages)
-{
-	size_t page_array_size = (num_pages * sizeof(void *) + PAGE_SIZE - 1) &
-	    PAGE_MASK;
-
-	return glob->ttm_bo_size + 2 * page_array_size;
-}
-
-/* FIXME Copy from upstream TTM "ttm_bo_create", upstream TTM does not
-   export this, so copy it here */
-static int ttm_bo_create_private(struct ttm_bo_device *bdev,
-			unsigned long size,
-			enum ttm_bo_type type,
-			struct ttm_placement *placement,
-			uint32_t page_alignment,
-			unsigned long buffer_start,
-			bool interruptible,
-			struct file *persistant_swap_storage,
-			struct ttm_buffer_object **p_bo)
-{
-	struct ttm_buffer_object *bo;
-	struct ttm_mem_global *mem_glob = bdev->glob->mem_glob;
-	int ret;
-
-	size_t acc_size =
-	    ttm_bo_size(bdev->glob, (size + PAGE_SIZE - 1) >> PAGE_SHIFT);
-	ret = ttm_mem_global_alloc(mem_glob, acc_size, false, false);
-	if (unlikely(ret != 0))
-		return ret;
-
-	bo = kzalloc(sizeof(*bo), GFP_KERNEL);
-
-	if (unlikely(bo == NULL)) {
-		ttm_mem_global_free(mem_glob, acc_size);
-		return -ENOMEM;
-	}
-
-	ret = ttm_bo_init(bdev, bo, size, type, placement, page_alignment,
-				buffer_start, interruptible,
-				persistant_swap_storage, acc_size, NULL);
-	if (likely(ret == 0))
-		*p_bo = bo;
-
-	return ret;
-}
-
-int psb_ttm_bo_check_placement(struct ttm_buffer_object *bo,
-				struct ttm_placement *placement)
-{
-	int i;
-
-	for (i = 0; i < placement->num_placement; i++) {
-		if (!capable(CAP_SYS_ADMIN)) {
-			if (placement->placement[i] & TTM_PL_FLAG_NO_EVICT) {
-				printk(KERN_ERR TTM_PFX "Need to be root to "
-					"modify NO_EVICT status.\n");
-				return -EINVAL;
-			}
-		}
-	}
-	for (i = 0; i < placement->num_busy_placement; i++) {
-		if (!capable(CAP_SYS_ADMIN)) {
-			if (placement->busy_placement[i]
-						& TTM_PL_FLAG_NO_EVICT) {
-				printk(KERN_ERR TTM_PFX "Need to be root to modify NO_EVICT status.\n");
-				return -EINVAL;
-			}
-		}
-	}
-	return 0;
-}
-
-int ttm_buffer_object_create(struct ttm_bo_device *bdev,
-			unsigned long size,
-			enum ttm_bo_type type,
-			uint32_t flags,
-			uint32_t page_alignment,
-			unsigned long buffer_start,
-			bool interruptible,
-			struct file *persistant_swap_storage,
-			struct ttm_buffer_object **p_bo)
-{
-	struct ttm_placement placement = default_placement;
-	int ret;
-
-	if ((flags & TTM_PL_MASK_CACHING) == 0)
-		flags |= TTM_PL_FLAG_WC | TTM_PL_FLAG_UNCACHED;
-
-	placement.num_placement = 1;
-	placement.placement = &flags;
-
-	ret = ttm_bo_create_private(bdev,
-			size,
-			type,
-			&placement,
-			page_alignment,
-			buffer_start,
-			interruptible,
-			persistant_swap_storage,
-			p_bo);
-
-	return ret;
-}
-
-
-int ttm_pl_create_ioctl(struct ttm_object_file *tfile,
-			struct ttm_bo_device *bdev,
-			struct ttm_lock *lock, void *data)
-{
-	union ttm_pl_create_arg *arg = data;
-	struct ttm_pl_create_req *req = &arg->req;
-	struct ttm_pl_rep *rep = &arg->rep;
-	struct ttm_buffer_object *bo;
-	struct ttm_buffer_object *tmp;
-	struct ttm_bo_user_object *user_bo;
-	uint32_t flags;
-	int ret = 0;
-	struct ttm_mem_global *mem_glob = bdev->glob->mem_glob;
-	struct ttm_placement placement = default_placement;
-	size_t acc_size =
-	    ttm_pl_size(bdev, (req->size + PAGE_SIZE - 1) >> PAGE_SHIFT);
-	ret = ttm_mem_global_alloc(mem_glob, acc_size, false, false);
-	if (unlikely(ret != 0))
-		return ret;
-
-	flags = req->placement;
-	user_bo = kzalloc(sizeof(*user_bo), GFP_KERNEL);
-	if (unlikely(user_bo == NULL)) {
-		ttm_mem_global_free(mem_glob, acc_size);
-		return -ENOMEM;
-	}
-
-	bo = &user_bo->bo;
-	ret = ttm_read_lock(lock, true);
-	if (unlikely(ret != 0)) {
-		ttm_mem_global_free(mem_glob, acc_size);
-		kfree(user_bo);
-		return ret;
-	}
-
-	placement.num_placement = 1;
-	placement.placement = &flags;
-
-	if ((flags & TTM_PL_MASK_CACHING) == 0)
-		flags |=  TTM_PL_FLAG_WC | TTM_PL_FLAG_UNCACHED;
-
-	ret = ttm_bo_init(bdev, bo, req->size,
-				     ttm_bo_type_device, &placement,
-				     req->page_alignment, 0, true,
-				     NULL, acc_size, &ttm_bo_user_destroy);
-	ttm_read_unlock(lock);
-
-	/*
-	 * Note that the ttm_buffer_object_init function
-	 * would've called the destroy function on failure!!
-	 */
-
-	if (unlikely(ret != 0))
-		goto out;
-
-	tmp = ttm_bo_reference(bo);
-	ret = ttm_base_object_init(tfile, &user_bo->base,
-				   flags & TTM_PL_FLAG_SHARED,
-				   ttm_buffer_type,
-				   &ttm_bo_user_release,
-				   &ttm_bo_user_ref_release);
-	if (unlikely(ret != 0))
-		goto out_err;
-
-	ttm_pl_fill_rep(bo, rep);
-	ttm_bo_unref(&bo);
-out:
-	return 0;
-out_err:
-	ttm_bo_unref(&tmp);
-	ttm_bo_unref(&bo);
-	return ret;
-}
-
-int ttm_pl_ub_create_ioctl(struct ttm_object_file *tfile,
-			   struct ttm_bo_device *bdev,
-			   struct ttm_lock *lock, void *data)
-{
-	union ttm_pl_create_ub_arg *arg = data;
-	struct ttm_pl_create_ub_req *req = &arg->req;
-	struct ttm_pl_rep *rep = &arg->rep;
-	struct ttm_buffer_object *bo;
-	struct ttm_buffer_object *tmp;
-	struct ttm_bo_user_object *user_bo;
-	uint32_t flags;
-	int ret = 0;
-	struct ttm_mem_global *mem_glob = bdev->glob->mem_glob;
-	struct ttm_placement placement = default_placement;
-	size_t acc_size =
-	    ttm_pl_size(bdev, (req->size + PAGE_SIZE - 1) >> PAGE_SHIFT);
-	ret = ttm_mem_global_alloc(mem_glob, acc_size, false, false);
-	if (unlikely(ret != 0))
-		return ret;
-
-	flags = req->placement;
-	user_bo = kzalloc(sizeof(*user_bo), GFP_KERNEL);
-	if (unlikely(user_bo == NULL)) {
-		ttm_mem_global_free(mem_glob, acc_size);
-		return -ENOMEM;
-	}
-	ret = ttm_read_lock(lock, true);
-	if (unlikely(ret != 0)) {
-		ttm_mem_global_free(mem_glob, acc_size);
-		kfree(user_bo);
-		return ret;
-	}
-	bo = &user_bo->bo;
-
-	placement.num_placement = 1;
-	placement.placement = &flags;
-
-	ret = ttm_bo_init(bdev,
-					bo,
-					req->size,
-					ttm_bo_type_user,
-					&placement,
-					req->page_alignment,
-					req->user_address,
-					true,
-					NULL,
-					acc_size,
-					&ttm_bo_user_destroy);
-
-	/*
-	 * Note that the ttm_buffer_object_init function
-	 * would've called the destroy function on failure!!
-	 */
-	ttm_read_unlock(lock);
-	if (unlikely(ret != 0))
-		goto out;
-
-	tmp = ttm_bo_reference(bo);
-	ret = ttm_base_object_init(tfile, &user_bo->base,
-				   flags & TTM_PL_FLAG_SHARED,
-				   ttm_buffer_type,
-				   &ttm_bo_user_release,
-				   &ttm_bo_user_ref_release);
-	if (unlikely(ret != 0))
-		goto out_err;
-
-	ttm_pl_fill_rep(bo, rep);
-	ttm_bo_unref(&bo);
-out:
-	return 0;
-out_err:
-	ttm_bo_unref(&tmp);
-	ttm_bo_unref(&bo);
-	return ret;
-}
-
-int ttm_pl_reference_ioctl(struct ttm_object_file *tfile, void *data)
-{
-	union ttm_pl_reference_arg *arg = data;
-	struct ttm_pl_rep *rep = &arg->rep;
-	struct ttm_bo_user_object *user_bo;
-	struct ttm_buffer_object *bo;
-	struct ttm_base_object *base;
-	int ret;
-
-	user_bo = ttm_bo_user_lookup(tfile, arg->req.handle);
-	if (unlikely(user_bo == NULL)) {
-		printk(KERN_ERR "Could not reference buffer object.\n");
-		return -EINVAL;
-	}
-
-	bo = &user_bo->bo;
-	ret = ttm_ref_object_add(tfile, &user_bo->base, TTM_REF_USAGE, NULL);
-	if (unlikely(ret != 0)) {
-		printk(KERN_ERR
-		       "Could not add a reference to buffer object.\n");
-		goto out;
-	}
-
-	ttm_pl_fill_rep(bo, rep);
-
-out:
-	base = &user_bo->base;
-	ttm_base_object_unref(&base);
-	return ret;
-}
-
-int ttm_pl_unref_ioctl(struct ttm_object_file *tfile, void *data)
-{
-	struct ttm_pl_reference_req *arg = data;
-
-	return ttm_ref_object_base_unref(tfile, arg->handle, TTM_REF_USAGE);
-}
-
-int ttm_pl_synccpu_ioctl(struct ttm_object_file *tfile, void *data)
-{
-	struct ttm_pl_synccpu_arg *arg = data;
-	struct ttm_bo_user_object *user_bo;
-	struct ttm_buffer_object *bo;
-	struct ttm_base_object *base;
-	bool existed;
-	int ret;
-
-	switch (arg->op) {
-	case TTM_PL_SYNCCPU_OP_GRAB:
-		user_bo = ttm_bo_user_lookup(tfile, arg->handle);
-		if (unlikely(user_bo == NULL)) {
-			printk(KERN_ERR
-			       "Could not find buffer object for synccpu.\n");
-			return -EINVAL;
-		}
-		bo = &user_bo->bo;
-		base = &user_bo->base;
-		ret = ttm_bo_synccpu_write_grab(bo,
-						arg->access_mode &
-						TTM_PL_SYNCCPU_MODE_NO_BLOCK);
-		if (unlikely(ret != 0)) {
-			ttm_base_object_unref(&base);
-			goto out;
-		}
-		ret = ttm_ref_object_add(tfile, &user_bo->base,
-					 TTM_REF_SYNCCPU_WRITE, &existed);
-		if (existed || ret != 0)
-			ttm_bo_synccpu_write_release(bo);
-		ttm_base_object_unref(&base);
-		break;
-	case TTM_PL_SYNCCPU_OP_RELEASE:
-		ret = ttm_ref_object_base_unref(tfile, arg->handle,
-						TTM_REF_SYNCCPU_WRITE);
-		break;
-	default:
-		ret = -EINVAL;
-		break;
-	}
-out:
-	return ret;
-}
-
-int ttm_pl_setstatus_ioctl(struct ttm_object_file *tfile,
-			   struct ttm_lock *lock, void *data)
-{
-	union ttm_pl_setstatus_arg *arg = data;
-	struct ttm_pl_setstatus_req *req = &arg->req;
-	struct ttm_pl_rep *rep = &arg->rep;
-	struct ttm_buffer_object *bo;
-	struct ttm_bo_device *bdev;
-	struct ttm_placement placement = default_placement;
-	uint32_t flags[2];
-	int ret;
-
-	bo = ttm_buffer_object_lookup(tfile, req->handle);
-	if (unlikely(bo == NULL)) {
-		printk(KERN_ERR
-		       "Could not find buffer object for setstatus.\n");
-		return -EINVAL;
-	}
-
-	bdev = bo->bdev;
-
-	ret = ttm_read_lock(lock, true);
-	if (unlikely(ret != 0))
-		goto out_err0;
-
-	ret = ttm_bo_reserve(bo, true, false, false, 0);
-	if (unlikely(ret != 0))
-		goto out_err1;
-
-	ret = ttm_bo_wait_cpu(bo, false);
-	if (unlikely(ret != 0))
-		goto out_err2;
-
-	flags[0] = req->set_placement;
-	flags[1] = req->clr_placement;
-
-	placement.num_placement = 2;
-	placement.placement = flags;
-
-	/* Review internal locking ? FIXMEAC */
-	ret = psb_ttm_bo_check_placement(bo, &placement);
-	if (unlikely(ret != 0))
-		goto out_err2;
-
-	placement.num_placement = 1;
-	flags[0] = (req->set_placement | bo->mem.placement)
-						& ~req->clr_placement;
-
-	ret = ttm_bo_validate(bo, &placement, true, false, false);
-	if (unlikely(ret != 0))
-		goto out_err2;
-
-	ttm_pl_fill_rep(bo, rep);
-out_err2:
-	ttm_bo_unreserve(bo);
-out_err1:
-	ttm_read_unlock(lock);
-out_err0:
-	ttm_bo_unref(&bo);
-	return ret;
-}
-
-static int psb_ttm_bo_block_reservation(struct ttm_buffer_object *bo,
-				bool interruptible, bool no_wait)
-{
-	int ret;
-
-	while (unlikely(atomic_cmpxchg(&bo->reserved, 0, 1) != 0)) {
-		if (no_wait)
-			return -EBUSY;
-		else if (interruptible) {
-			ret = wait_event_interruptible(bo->event_queue,
-					atomic_read(&bo->reserved) == 0);
-			if (unlikely(ret != 0))
-				return -ERESTART;
-		} else {
-			wait_event(bo->event_queue,
-				atomic_read(&bo->reserved) == 0);
-		}
-	}
-	return 0;
-}
-
-static void psb_ttm_bo_unblock_reservation(struct ttm_buffer_object *bo)
-{
-	atomic_set(&bo->reserved, 0);
-	wake_up_all(&bo->event_queue);
-}
-
-int ttm_pl_waitidle_ioctl(struct ttm_object_file *tfile, void *data)
-{
-	struct ttm_pl_waitidle_arg *arg = data;
-	struct ttm_buffer_object *bo;
-	int ret;
-
-	bo = ttm_buffer_object_lookup(tfile, arg->handle);
-	if (unlikely(bo == NULL)) {
-		printk(KERN_ERR "Could not find buffer object for waitidle.\n");
-		return -EINVAL;
-	}
-
-	ret =
-	    psb_ttm_bo_block_reservation(bo, true,
-				     arg->mode & TTM_PL_WAITIDLE_MODE_NO_BLOCK);
-	if (unlikely(ret != 0))
-		goto out;
-	ret = ttm_bo_wait(bo,
-			  arg->mode & TTM_PL_WAITIDLE_MODE_LAZY,
-			  true, arg->mode & TTM_PL_WAITIDLE_MODE_NO_BLOCK);
-	psb_ttm_bo_unblock_reservation(bo);
-out:
-	ttm_bo_unref(&bo);
-	return ret;
-}
-
-int ttm_pl_verify_access(struct ttm_buffer_object *bo,
-			 struct ttm_object_file *tfile)
-{
-	struct ttm_bo_user_object *ubo;
-
-	/*
-	 * Check bo subclass.
-	 */
-
-	if (unlikely(bo->destroy != &ttm_bo_user_destroy))
-		return -EPERM;
-
-	ubo = container_of(bo, struct ttm_bo_user_object, bo);
-	if (likely(ubo->base.shareable || ubo->base.tfile == tfile))
-		return 0;
-
-	return -EPERM;
-}
diff --git a/drivers/staging/gma500/psb_ttm_placement_user.h b/drivers/staging/gma500/psb_ttm_placement_user.h
deleted file mode 100644
index 8b7068b..0000000
--- a/drivers/staging/gma500/psb_ttm_placement_user.h
+++ /dev/null
@@ -1,252 +0,0 @@
-/**************************************************************************
- *
- * Copyright 2006-2008 Tungsten Graphics, Inc., Cedar Park, TX., USA
- * All Rights Reserved.
- * Copyright (c) 2009 VMware, Inc., Palo Alto, CA., USA
- * All Rights Reserved.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- *
- **************************************************************************/
-/*
- * Authors
- * Thomas Hellström <thomas-at-tungstengraphics-dot-com>
- */
-
-#ifndef _TTM_PLACEMENT_USER_H_
-#define _TTM_PLACEMENT_USER_H_
-
-#if !defined(__KERNEL__) && !defined(_KERNEL)
-#include <stdint.h>
-#else
-#include <linux/kernel.h>
-#endif
-
-#include "ttm/ttm_placement.h"
-
-#define TTM_PLACEMENT_MAJOR 0
-#define TTM_PLACEMENT_MINOR 1
-#define TTM_PLACEMENT_PL    0
-#define TTM_PLACEMENT_DATE  "080819"
-
-/**
- * struct ttm_pl_create_req
- *
- * @size: The buffer object size.
- * @placement: Flags that indicate initial acceptable
- *  placement.
- * @page_alignment: Required alignment in pages.
- *
- * Input to the TTM_BO_CREATE ioctl.
- */
-
-struct ttm_pl_create_req {
-	uint64_t size;
-	uint32_t placement;
-	uint32_t page_alignment;
-};
-
-/**
- * struct ttm_pl_create_ub_req
- *
- * @size: The buffer object size.
- * @user_address: User-space address of the memory area that
- * should be used to back the buffer object cast to 64-bit.
- * @placement: Flags that indicate initial acceptable
- *  placement.
- * @page_alignment: Required alignment in pages.
- *
- * Input to the TTM_BO_CREATE_UB ioctl.
- */
-
-struct ttm_pl_create_ub_req {
-	uint64_t size;
-	uint64_t user_address;
-	uint32_t placement;
-	uint32_t page_alignment;
-};
-
-/**
- * struct ttm_pl_rep
- *
- * @gpu_offset: The current offset into the memory region used.
- * This can be used directly by the GPU if there are no
- * additional GPU mapping procedures used by the driver.
- *
- * @bo_size: Actual buffer object size.
- *
- * @map_handle: Offset into the device address space.
- * Used for map, seek, read, write. This will never change
- * during the lifetime of an object.
- *
- * @placement: Flag indicating the placement status of
- * the buffer object using the TTM_PL flags above.
- *
- * @sync_object_arg: Used for user-space synchronization and
- * depends on the synchronization model used. If fences are
- * used, this is the buffer_object::fence_type_mask
- *
- * Output from the TTM_PL_CREATE and TTM_PL_REFERENCE, and
- * TTM_PL_SETSTATUS ioctls.
- */
-
-struct ttm_pl_rep {
-	uint64_t gpu_offset;
-	uint64_t bo_size;
-	uint64_t map_handle;
-	uint32_t placement;
-	uint32_t handle;
-	uint32_t sync_object_arg;
-	uint32_t pad64;
-};
-
-/**
- * struct ttm_pl_setstatus_req
- *
- * @set_placement: Placement flags to set.
- *
- * @clr_placement: Placement flags to clear.
- *
- * @handle: The object handle
- *
- * Input to the TTM_PL_SETSTATUS ioctl.
- */
-
-struct ttm_pl_setstatus_req {
-	uint32_t set_placement;
-	uint32_t clr_placement;
-	uint32_t handle;
-	uint32_t pad64;
-};
-
-/**
- * struct ttm_pl_reference_req
- *
- * @handle: The object to put a reference on.
- *
- * Input to the TTM_PL_REFERENCE and the TTM_PL_UNREFERENCE ioctls.
- */
-
-struct ttm_pl_reference_req {
-	uint32_t handle;
-	uint32_t pad64;
-};
-
-/*
- * ACCESS mode flags for SYNCCPU.
- *
- * TTM_SYNCCPU_MODE_READ will guarantee that the GPU is not
- * writing to the buffer.
- *
- * TTM_SYNCCPU_MODE_WRITE will guarantee that the GPU is not
- * accessing the buffer.
- *
- * TTM_SYNCCPU_MODE_NO_BLOCK makes sure the call does not wait
- * for GPU accesses to finish but return -EBUSY.
- *
- * TTM_SYNCCPU_MODE_TRYCACHED Try to place the buffer in cacheable
- * memory while synchronized for CPU.
- */
-
-#define TTM_PL_SYNCCPU_MODE_READ      TTM_ACCESS_READ
-#define TTM_PL_SYNCCPU_MODE_WRITE     TTM_ACCESS_WRITE
-#define TTM_PL_SYNCCPU_MODE_NO_BLOCK  (1 << 2)
-#define TTM_PL_SYNCCPU_MODE_TRYCACHED (1 << 3)
-
-/**
- * struct ttm_pl_synccpu_arg
- *
- * @handle: The object to synchronize.
- *
- * @access_mode: access mode indicated by the
- * TTM_SYNCCPU_MODE flags.
- *
- * @op: indicates whether to grab or release the
- * buffer for cpu usage.
- *
- * Input to the TTM_PL_SYNCCPU ioctl.
- */
-
-struct ttm_pl_synccpu_arg {
-	uint32_t handle;
-	uint32_t access_mode;
-	enum {
-		TTM_PL_SYNCCPU_OP_GRAB,
-		TTM_PL_SYNCCPU_OP_RELEASE
-	} op;
-	uint32_t pad64;
-};
-
-/*
- * Waiting mode flags for the TTM_BO_WAITIDLE ioctl.
- *
- * TTM_WAITIDLE_MODE_LAZY: Allow for sleeps during polling
- * wait.
- *
- * TTM_WAITIDLE_MODE_NO_BLOCK: Don't block waiting for GPU,
- * but return -EBUSY if the buffer is busy.
- */
-
-#define TTM_PL_WAITIDLE_MODE_LAZY     (1 << 0)
-#define TTM_PL_WAITIDLE_MODE_NO_BLOCK (1 << 1)
-
-/**
- * struct ttm_waitidle_arg
- *
- * @handle: The object to synchronize.
- *
- * @mode: wait mode indicated by the
- * TTM_SYNCCPU_MODE flags.
- *
- * Argument to the TTM_BO_WAITIDLE ioctl.
- */
-
-struct ttm_pl_waitidle_arg {
-	uint32_t handle;
-	uint32_t mode;
-};
-
-union ttm_pl_create_arg {
-	struct ttm_pl_create_req req;
-	struct ttm_pl_rep rep;
-};
-
-union ttm_pl_reference_arg {
-	struct ttm_pl_reference_req req;
-	struct ttm_pl_rep rep;
-};
-
-union ttm_pl_setstatus_arg {
-	struct ttm_pl_setstatus_req req;
-	struct ttm_pl_rep rep;
-};
-
-union ttm_pl_create_ub_arg {
-	struct ttm_pl_create_ub_req req;
-	struct ttm_pl_rep rep;
-};
-
-/*
- * Ioctl offsets.
- */
-
-#define TTM_PL_CREATE      0x00
-#define TTM_PL_REFERENCE   0x01
-#define TTM_PL_UNREF       0x02
-#define TTM_PL_SYNCCPU     0x03
-#define TTM_PL_WAITIDLE    0x04
-#define TTM_PL_SETSTATUS   0x05
-#define TTM_PL_CREATE_UB   0x06
-
-#endif
diff --git a/drivers/staging/gma500/psb_ttm_userobj_api.h b/drivers/staging/gma500/psb_ttm_userobj_api.h
deleted file mode 100644
index 6a8f7c4..0000000
--- a/drivers/staging/gma500/psb_ttm_userobj_api.h
+++ /dev/null
@@ -1,85 +0,0 @@
-/**************************************************************************
- *
- * Copyright (c) 2006-2008 Tungsten Graphics, Inc., Cedar Park, TX., USA
- * All Rights Reserved.
- * Copyright (c) 2009 VMware, Inc., Palo Alto, CA., USA
- * All Rights Reserved.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- *
- **************************************************************************/
-/*
- * Authors: Thomas Hellstrom <thomas-at-tungstengraphics-dot-com>
- */
-
-#ifndef _TTM_USEROBJ_API_H_
-#define _TTM_USEROBJ_API_H_
-
-#include "psb_ttm_placement_user.h"
-#include "psb_ttm_fence_user.h"
-#include "ttm/ttm_object.h"
-#include "psb_ttm_fence_api.h"
-#include "ttm/ttm_bo_api.h"
-
-struct ttm_lock;
-
-/*
- * User ioctls.
- */
-
-extern int ttm_pl_create_ioctl(struct ttm_object_file *tfile,
-			       struct ttm_bo_device *bdev,
-			       struct ttm_lock *lock, void *data);
-extern int ttm_pl_ub_create_ioctl(struct ttm_object_file *tfile,
-				  struct ttm_bo_device *bdev,
-				  struct ttm_lock *lock, void *data);
-extern int ttm_pl_reference_ioctl(struct ttm_object_file *tfile, void *data);
-extern int ttm_pl_unref_ioctl(struct ttm_object_file *tfile, void *data);
-extern int ttm_pl_synccpu_ioctl(struct ttm_object_file *tfile, void *data);
-extern int ttm_pl_setstatus_ioctl(struct ttm_object_file *tfile,
-				  struct ttm_lock *lock, void *data);
-extern int ttm_pl_waitidle_ioctl(struct ttm_object_file *tfile, void *data);
-extern int ttm_fence_signaled_ioctl(struct ttm_object_file *tfile, void *data);
-extern int ttm_fence_finish_ioctl(struct ttm_object_file *tfile, void *data);
-extern int ttm_fence_unref_ioctl(struct ttm_object_file *tfile, void *data);
-
-extern int
-ttm_fence_user_create(struct ttm_fence_device *fdev,
-		      struct ttm_object_file *tfile,
-		      uint32_t fence_class,
-		      uint32_t fence_types,
-		      uint32_t create_flags,
-		      struct ttm_fence_object **fence, uint32_t * user_handle);
-
-extern struct ttm_buffer_object *ttm_buffer_object_lookup(struct ttm_object_file
-							  *tfile,
-							  uint32_t handle);
-
-extern int
-ttm_pl_verify_access(struct ttm_buffer_object *bo,
-		     struct ttm_object_file *tfile);
-
-extern int ttm_buffer_object_create(struct ttm_bo_device *bdev,
-			unsigned long size,
-			enum ttm_bo_type type,
-			uint32_t flags,
-			uint32_t page_alignment,
-			unsigned long buffer_start,
-			bool interruptible,
-			struct file *persistant_swap_storage,
-			struct ttm_buffer_object **p_bo);
-
-extern int psb_ttm_bo_check_placement(struct ttm_buffer_object *bo,
-				struct ttm_placement *placement);
-#endif
diff --git a/drivers/staging/hv/Makefile b/drivers/staging/hv/Makefile
index abeb2f7..3004674 100644
--- a/drivers/staging/hv/Makefile
+++ b/drivers/staging/hv/Makefile
@@ -9,6 +9,6 @@
 		 hv.o connection.o channel.o \
 		 channel_mgmt.o ring_buffer.o
 hv_storvsc-y := storvsc_drv.o storvsc.o
-hv_blkvsc-y := blkvsc_drv.o blkvsc.o
+hv_blkvsc-y := blkvsc_drv.o  storvsc.o
 hv_netvsc-y := netvsc_drv.o netvsc.o rndis_filter.o
 hv_utils-y := hv_util.o hv_kvp.o
diff --git a/drivers/staging/hv/blkvsc.c b/drivers/staging/hv/blkvsc.c
deleted file mode 100644
index 7c8729b..0000000
--- a/drivers/staging/hv/blkvsc.c
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- *
- * Copyright (c) 2009, Microsoft Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
- * Place - Suite 330, Boston, MA 02111-1307 USA.
- *
- * Authors:
- *   Haiyang Zhang <haiyangz@microsoft.com>
- *   Hank Janssen  <hjanssen@microsoft.com>
- *
- */
-#include <linux/kernel.h>
-#include <linux/mm.h>
-#include "hv_api.h"
-#include "storvsc.c"
-
-static const char *g_blk_driver_name = "blkvsc";
-
-/* {32412632-86cb-44a2-9b5c-50d1417354f5} */
-static const struct hv_guid g_blk_device_type = {
-	.data = {
-		0x32, 0x26, 0x41, 0x32, 0xcb, 0x86, 0xa2, 0x44,
-		0x9b, 0x5c, 0x50, 0xd1, 0x41, 0x73, 0x54, 0xf5
-	}
-};
-
-static int blk_vsc_on_device_add(struct hv_device *device, void *additional_info)
-{
-	struct storvsc_device_info *device_info;
-	int ret = 0;
-
-	device_info = (struct storvsc_device_info *)additional_info;
-
-	ret = stor_vsc_on_device_add(device, additional_info);
-	if (ret != 0)
-		return ret;
-
-	/*
-	 * We need to use the device instance guid to set the path and target
-	 * id. For IDE devices, the device instance id is formatted as
-	 * <bus id> * - <device id> - 8899 - 000000000000.
-	 */
-	device_info->path_id = device->dev_instance.data[3] << 24 |
-			     device->dev_instance.data[2] << 16 |
-			     device->dev_instance.data[1] << 8  |
-			     device->dev_instance.data[0];
-
-	device_info->target_id = device->dev_instance.data[5] << 8 |
-			       device->dev_instance.data[4];
-
-	return ret;
-}
-
-int blk_vsc_initialize(struct hv_driver *driver)
-{
-	struct storvsc_driver_object *stor_driver;
-	int ret = 0;
-
-	stor_driver = (struct storvsc_driver_object *)driver;
-
-	/* Make sure we are at least 2 pages since 1 page is used for control */
-	/* ASSERT(stor_driver->RingBufferSize >= (PAGE_SIZE << 1)); */
-
-	driver->name = g_blk_driver_name;
-	memcpy(&driver->dev_type, &g_blk_device_type, sizeof(struct hv_guid));
-
-	stor_driver->request_ext_size = sizeof(struct storvsc_request_extension);
-
-	/*
-	 * Divide the ring buffer data size (which is 1 page less than the ring
-	 * buffer size since that page is reserved for the ring buffer indices)
-	 * by the max request size (which is
-	 * vmbus_channel_packet_multipage_buffer + struct vstor_packet + u64)
-	 */
-	stor_driver->max_outstanding_req_per_channel =
-		((stor_driver->ring_buffer_size - PAGE_SIZE) /
-		  ALIGN(MAX_MULTIPAGE_BUFFER_PACKET +
-			   sizeof(struct vstor_packet) + sizeof(u64),
-			   sizeof(u64)));
-
-	DPRINT_INFO(BLKVSC, "max io outstd %u",
-		    stor_driver->max_outstanding_req_per_channel);
-
-	/* Setup the dispatch table */
-	stor_driver->base.dev_add = blk_vsc_on_device_add;
-	stor_driver->base.dev_rm = stor_vsc_on_device_remove;
-	stor_driver->base.cleanup = stor_vsc_on_cleanup;
-	stor_driver->on_io_request = stor_vsc_on_io_request;
-
-	return ret;
-}
diff --git a/drivers/staging/hv/blkvsc_drv.c b/drivers/staging/hv/blkvsc_drv.c
index 68ad17d..acc5435 100644
--- a/drivers/staging/hv/blkvsc_drv.c
+++ b/drivers/staging/hv/blkvsc_drv.c
@@ -17,6 +17,8 @@
  * Authors:
  *   Haiyang Zhang <haiyangz@microsoft.com>
  *   Hank Janssen  <hjanssen@microsoft.com>
+ *
+ * 4/3/2011: K. Y. Srinivasan - Significant restructuring and cleanup.
  */
 #include <linux/init.h>
 #include <linux/module.h>
@@ -46,6 +48,12 @@
 	DVD_TYPE,
 };
 
+enum blkvsc_op_type {
+	DO_INQUIRY,
+	DO_CAPACITY,
+	DO_FLUSH,
+};
+
 /*
  * This request ties the struct request and struct
  * blkvsc_request/hv_storvsc_request together A struct request may be
@@ -72,9 +80,6 @@
 	/* The group this request is part of. Maybe null */
 	struct blkvsc_request_group *group;
 
-	wait_queue_head_t wevent;
-	int cond;
-
 	int write;
 	sector_t sector_start;
 	unsigned long sector_count;
@@ -84,12 +89,6 @@
 	unsigned char cmnd[MAX_COMMAND_SIZE];
 
 	struct hv_storvsc_request request;
-	/*
-	 * !!!DO NOT ADD ANYTHING BELOW HERE!!! Otherwise, memory can overlap,
-	 * because - The extension buffer falls right here and is pointed to by
-	 * request.Extension;
-	 * Which sounds like a horrible idea, who designed this?
-	 */
 };
 
 /* Per device structure */
@@ -106,7 +105,6 @@
 	unsigned int device_id_len;
 	int num_outstanding_reqs;
 	int shutting_down;
-	int media_not_present;
 	unsigned int sector_size;
 	sector_t capacity;
 	unsigned int port;
@@ -115,40 +113,752 @@
 	int users;
 };
 
-
-/* Static decl */
 static DEFINE_MUTEX(blkvsc_mutex);
-static int blkvsc_probe(struct device *dev);
-static int blkvsc_remove(struct device *device);
-static void blkvsc_shutdown(struct device *device);
 
-static int blkvsc_open(struct block_device *bdev,  fmode_t mode);
-static int blkvsc_release(struct gendisk *disk, fmode_t mode);
-static unsigned int blkvsc_check_events(struct gendisk *gd,
-					unsigned int clearing);
-static int blkvsc_revalidate_disk(struct gendisk *gd);
-static int blkvsc_getgeo(struct block_device *bd, struct hd_geometry *hg);
-static int blkvsc_ioctl(struct block_device *bd, fmode_t mode,
-			unsigned cmd, unsigned long argument);
-static void blkvsc_request(struct request_queue *queue);
+static const char *g_blk_driver_name = "blkvsc";
+
+/* {32412632-86cb-44a2-9b5c-50d1417354f5} */
+static const struct hv_guid g_blk_device_type = {
+	.data = {
+		0x32, 0x26, 0x41, 0x32, 0xcb, 0x86, 0xa2, 0x44,
+		0x9b, 0x5c, 0x50, 0xd1, 0x41, 0x73, 0x54, 0xf5
+	}
+};
+
+/*
+ * There is a circular dependency involving blkvsc_request_completion()
+ * and blkvsc_do_request().
+ */
 static void blkvsc_request_completion(struct hv_storvsc_request *request);
-static int blkvsc_do_request(struct block_device_context *blkdev,
-			     struct request *req);
-static int blkvsc_submit_request(struct blkvsc_request *blkvsc_req,
-		void (*request_completion)(struct hv_storvsc_request *));
-static void blkvsc_init_rw(struct blkvsc_request *blkvsc_req);
-static void blkvsc_cmd_completion(struct hv_storvsc_request *request);
-static int blkvsc_do_inquiry(struct block_device_context *blkdev);
-static int blkvsc_do_read_capacity(struct block_device_context *blkdev);
-static int blkvsc_do_read_capacity16(struct block_device_context *blkdev);
-static int blkvsc_do_flush(struct block_device_context *blkdev);
-static int blkvsc_cancel_pending_reqs(struct block_device_context *blkdev);
-static int blkvsc_do_pending_reqs(struct block_device_context *blkdev);
 
 static int blkvsc_ringbuffer_size = BLKVSC_RING_BUFFER_SIZE;
+
 module_param(blkvsc_ringbuffer_size, int, S_IRUGO);
 MODULE_PARM_DESC(ring_size, "Ring buffer size (in bytes)");
 
+/*
+ * There is a circular dependency involving blkvsc_probe()
+ * and block_ops.
+ */
+static int blkvsc_probe(struct device *dev);
+
+static int blk_vsc_on_device_add(struct hv_device *device,
+				void *additional_info)
+{
+	struct storvsc_device_info *device_info;
+	int ret = 0;
+
+	device_info = (struct storvsc_device_info *)additional_info;
+
+	ret = stor_vsc_on_device_add(device, additional_info);
+	if (ret != 0)
+		return ret;
+
+	/*
+	 * We need to use the device instance guid to set the path and target
+	 * id. For IDE devices, the device instance id is formatted as
+	 * <bus id> * - <device id> - 8899 - 000000000000.
+	 */
+	device_info->path_id = device->dev_instance.data[3] << 24 |
+			     device->dev_instance.data[2] << 16 |
+			     device->dev_instance.data[1] << 8  |
+			     device->dev_instance.data[0];
+
+	device_info->target_id = device->dev_instance.data[5] << 8 |
+			       device->dev_instance.data[4];
+
+	return ret;
+}
+
+
+static int blk_vsc_initialize(struct hv_driver *driver)
+{
+	struct storvsc_driver_object *stor_driver;
+	int ret = 0;
+
+	stor_driver = hvdr_to_stordr(driver);
+
+	/* Make sure we are at least 2 pages since 1 page is used for control */
+
+	driver->name = g_blk_driver_name;
+	memcpy(&driver->dev_type, &g_blk_device_type, sizeof(struct hv_guid));
+
+
+	/*
+	 * Divide the ring buffer data size (which is 1 page less than the ring
+	 * buffer size since that page is reserved for the ring buffer indices)
+	 * by the max request size (which is
+	 * vmbus_channel_packet_multipage_buffer + struct vstor_packet + u64)
+	 */
+	stor_driver->max_outstanding_req_per_channel =
+		((stor_driver->ring_buffer_size - PAGE_SIZE) /
+		  ALIGN(MAX_MULTIPAGE_BUFFER_PACKET +
+			   sizeof(struct vstor_packet) + sizeof(u64),
+			   sizeof(u64)));
+
+	DPRINT_INFO(BLKVSC, "max io outstd %u",
+		    stor_driver->max_outstanding_req_per_channel);
+
+	/* Setup the dispatch table */
+	stor_driver->base.dev_add = blk_vsc_on_device_add;
+	stor_driver->base.dev_rm = stor_vsc_on_device_remove;
+	stor_driver->base.cleanup = stor_vsc_on_cleanup;
+	stor_driver->on_io_request = stor_vsc_on_io_request;
+
+	return ret;
+}
+
+
+static int blkvsc_submit_request(struct blkvsc_request *blkvsc_req,
+			void (*request_completion)(struct hv_storvsc_request *))
+{
+	struct block_device_context *blkdev = blkvsc_req->dev;
+	struct hv_device *device_ctx = blkdev->device_ctx;
+	struct hv_driver *drv =
+			drv_to_hv_drv(device_ctx->device.driver);
+	struct storvsc_driver_object *storvsc_drv_obj =
+			drv->priv;
+	struct hv_storvsc_request *storvsc_req;
+	struct vmscsi_request *vm_srb;
+	int ret;
+
+
+	storvsc_req = &blkvsc_req->request;
+	vm_srb = &storvsc_req->vstor_packet.vm_srb;
+
+	vm_srb->data_in = blkvsc_req->write ? WRITE_TYPE : READ_TYPE;
+
+	storvsc_req->on_io_completion = request_completion;
+	storvsc_req->context = blkvsc_req;
+
+	vm_srb->port_number = blkdev->port;
+	vm_srb->path_id = blkdev->path;
+	vm_srb->target_id = blkdev->target;
+	vm_srb->lun = 0;	 /* this is not really used at all */
+
+	vm_srb->cdb_length = blkvsc_req->cmd_len;
+
+	memcpy(vm_srb->cdb, blkvsc_req->cmnd, vm_srb->cdb_length);
+
+	storvsc_req->sense_buffer = blkvsc_req->sense_buffer;
+
+	ret = storvsc_drv_obj->on_io_request(blkdev->device_ctx,
+					   &blkvsc_req->request);
+	if (ret == 0)
+		blkdev->num_outstanding_reqs++;
+
+	return ret;
+}
+
+
+static int blkvsc_open(struct block_device *bdev, fmode_t mode)
+{
+	struct block_device_context *blkdev = bdev->bd_disk->private_data;
+
+	spin_lock(&blkdev->lock);
+
+	blkdev->users++;
+
+	spin_unlock(&blkdev->lock);
+
+	return 0;
+}
+
+
+static int blkvsc_getgeo(struct block_device *bd, struct hd_geometry *hg)
+{
+	sector_t nsect = get_capacity(bd->bd_disk);
+	sector_t cylinders = nsect;
+
+	/*
+	 * We are making up these values; let us keep it simple.
+	 */
+	hg->heads = 0xff;
+	hg->sectors = 0x3f;
+	sector_div(cylinders, hg->heads * hg->sectors);
+	hg->cylinders = cylinders;
+	if ((sector_t)(hg->cylinders + 1) * hg->heads * hg->sectors < nsect)
+		hg->cylinders = 0xffff;
+	return 0;
+
+}
+
+
+static void blkvsc_init_rw(struct blkvsc_request *blkvsc_req)
+{
+
+	blkvsc_req->cmd_len = 16;
+
+	if (rq_data_dir(blkvsc_req->req)) {
+		blkvsc_req->write = 1;
+		blkvsc_req->cmnd[0] = WRITE_16;
+	} else {
+		blkvsc_req->write = 0;
+		blkvsc_req->cmnd[0] = READ_16;
+	}
+
+	blkvsc_req->cmnd[1] |=
+	(blkvsc_req->req->cmd_flags & REQ_FUA) ? 0x8 : 0;
+
+	*(unsigned long long *)&blkvsc_req->cmnd[2] =
+	cpu_to_be64(blkvsc_req->sector_start);
+	*(unsigned int *)&blkvsc_req->cmnd[10] =
+	cpu_to_be32(blkvsc_req->sector_count);
+}
+
+
+static int blkvsc_ioctl(struct block_device *bd, fmode_t mode,
+			unsigned cmd, unsigned long arg)
+{
+	struct block_device_context *blkdev = bd->bd_disk->private_data;
+	int ret = 0;
+
+	switch (cmd) {
+	case HDIO_GET_IDENTITY:
+		if (copy_to_user((void __user *)arg, blkdev->device_id,
+				 blkdev->device_id_len))
+			ret = -EFAULT;
+		break;
+	default:
+		ret = -EINVAL;
+		break;
+	}
+
+	return ret;
+}
+
+static void blkvsc_cmd_completion(struct hv_storvsc_request *request)
+{
+	struct blkvsc_request *blkvsc_req =
+			(struct blkvsc_request *)request->context;
+	struct block_device_context *blkdev =
+			(struct block_device_context *)blkvsc_req->dev;
+	struct scsi_sense_hdr sense_hdr;
+	struct vmscsi_request *vm_srb;
+
+
+	vm_srb = &blkvsc_req->request.vstor_packet.vm_srb;
+	blkdev->num_outstanding_reqs--;
+
+	if (vm_srb->scsi_status)
+		if (scsi_normalize_sense(blkvsc_req->sense_buffer,
+					 SCSI_SENSE_BUFFERSIZE, &sense_hdr))
+			scsi_print_sense_hdr("blkvsc", &sense_hdr);
+
+	complete(&blkvsc_req->request.wait_event);
+}
+
+
+static int blkvsc_do_operation(struct block_device_context *blkdev,
+				enum blkvsc_op_type op)
+{
+	struct blkvsc_request *blkvsc_req;
+	struct page *page_buf;
+	unsigned char *buf;
+	unsigned char device_type;
+	struct scsi_sense_hdr sense_hdr;
+	struct vmscsi_request *vm_srb;
+
+	int ret = 0;
+
+	blkvsc_req = kmem_cache_zalloc(blkdev->request_pool, GFP_KERNEL);
+	if (!blkvsc_req)
+		return -ENOMEM;
+
+	page_buf = alloc_page(GFP_KERNEL);
+	if (!page_buf) {
+		kmem_cache_free(blkvsc_req->dev->request_pool, blkvsc_req);
+		return -ENOMEM;
+	}
+
+	vm_srb = &blkvsc_req->request.vstor_packet.vm_srb;
+	init_completion(&blkvsc_req->request.wait_event);
+	blkvsc_req->dev = blkdev;
+	blkvsc_req->req = NULL;
+	blkvsc_req->write = 0;
+
+	blkvsc_req->request.data_buffer.pfn_array[0] =
+	page_to_pfn(page_buf);
+	blkvsc_req->request.data_buffer.offset = 0;
+
+	switch (op) {
+	case DO_INQUIRY:
+		blkvsc_req->cmnd[0] = INQUIRY;
+		blkvsc_req->cmnd[1] = 0x1;		/* Get product data */
+		blkvsc_req->cmnd[2] = 0x83;		/* mode page 83 */
+		blkvsc_req->cmnd[4] = 64;
+		blkvsc_req->cmd_len = 6;
+		blkvsc_req->request.data_buffer.len = 64;
+		break;
+
+	case DO_CAPACITY:
+		blkdev->sector_size = 0;
+		blkdev->capacity = 0;
+
+		blkvsc_req->cmnd[0] = READ_CAPACITY;
+		blkvsc_req->cmd_len = 16;
+		blkvsc_req->request.data_buffer.len = 8;
+		break;
+
+	case DO_FLUSH:
+		blkvsc_req->cmnd[0] = SYNCHRONIZE_CACHE;
+		blkvsc_req->cmd_len = 10;
+		blkvsc_req->request.data_buffer.pfn_array[0] = 0;
+		blkvsc_req->request.data_buffer.len = 0;
+		break;
+	default:
+		ret = -EINVAL;
+		goto cleanup;
+	}
+
+	blkvsc_submit_request(blkvsc_req, blkvsc_cmd_completion);
+
+	wait_for_completion_interruptible(&blkvsc_req->request.wait_event);
+
+	/* check error */
+	if (vm_srb->scsi_status) {
+		scsi_normalize_sense(blkvsc_req->sense_buffer,
+				     SCSI_SENSE_BUFFERSIZE, &sense_hdr);
+
+		return 0;
+	}
+
+	buf = kmap(page_buf);
+
+	switch (op) {
+	case DO_INQUIRY:
+		device_type = buf[0] & 0x1F;
+
+		if (device_type == 0x0)
+			blkdev->device_type = HARDDISK_TYPE;
+		 else
+			blkdev->device_type = UNKNOWN_DEV_TYPE;
+
+		blkdev->device_id_len = buf[7];
+		if (blkdev->device_id_len > 64)
+			blkdev->device_id_len = 64;
+
+		memcpy(blkdev->device_id, &buf[8], blkdev->device_id_len);
+		break;
+
+	case DO_CAPACITY:
+		/* be to le */
+		blkdev->capacity =
+		((buf[0] << 24) | (buf[1] << 16) |
+		(buf[2] << 8) | buf[3]) + 1;
+
+		blkdev->sector_size =
+		(buf[4] << 24) | (buf[5] << 16) |
+		(buf[6] << 8) | buf[7];
+		break;
+	default:
+		break;
+
+	}
+
+cleanup:
+
+	kunmap(page_buf);
+
+	__free_page(page_buf);
+
+	kmem_cache_free(blkvsc_req->dev->request_pool, blkvsc_req);
+
+	return ret;
+}
+
+
+static int blkvsc_cancel_pending_reqs(struct block_device_context *blkdev)
+{
+	struct blkvsc_request *pend_req, *tmp;
+	struct blkvsc_request *comp_req, *tmp2;
+	struct vmscsi_request *vm_srb;
+
+	int ret = 0;
+
+
+	/* Flush the pending list first */
+	list_for_each_entry_safe(pend_req, tmp, &blkdev->pending_list,
+				 pend_entry) {
+		/*
+		 * The pend_req could be part of a partially completed
+		 * request. If so, complete those req first until we
+		 * hit the pend_req
+		 */
+		list_for_each_entry_safe(comp_req, tmp2,
+					 &pend_req->group->blkvsc_req_list,
+					 req_entry) {
+
+			if (comp_req == pend_req)
+				break;
+
+			list_del(&comp_req->req_entry);
+
+			if (comp_req->req) {
+				vm_srb =
+				&comp_req->request.vstor_packet.
+				vm_srb;
+				ret = __blk_end_request(comp_req->req,
+					(!vm_srb->scsi_status ? 0 : -EIO),
+					comp_req->sector_count *
+					blkdev->sector_size);
+
+				/* FIXME: shouldn't this do more than return? */
+				if (ret)
+					goto out;
+			}
+
+			kmem_cache_free(blkdev->request_pool, comp_req);
+		}
+
+		list_del(&pend_req->pend_entry);
+
+		list_del(&pend_req->req_entry);
+
+		if (comp_req->req) {
+			if (!__blk_end_request(pend_req->req, -EIO,
+					       pend_req->sector_count *
+					       blkdev->sector_size)) {
+				/*
+				 * All the sectors have been xferred ie the
+				 * request is done
+				 */
+				kmem_cache_free(blkdev->request_pool,
+						pend_req->group);
+			}
+		}
+
+		kmem_cache_free(blkdev->request_pool, pend_req);
+	}
+
+out:
+	return ret;
+}
+
+
+/*
+ * blkvsc_remove() - Callback when our device is removed
+ */
+static int blkvsc_remove(struct device *device)
+{
+	struct hv_driver *drv =
+				drv_to_hv_drv(device->driver);
+	struct storvsc_driver_object *storvsc_drv_obj =
+				drv->priv;
+	struct hv_device *device_obj = device_to_hv_device(device);
+	struct block_device_context *blkdev = dev_get_drvdata(device);
+	unsigned long flags;
+
+	/*
+	 * Call to the vsc driver to let it know that the device is being
+	 * removed
+	 */
+	storvsc_drv_obj->base.dev_rm(device_obj);
+
+	/* Get to a known state */
+	spin_lock_irqsave(&blkdev->lock, flags);
+
+	blkdev->shutting_down = 1;
+
+	blk_stop_queue(blkdev->gd->queue);
+
+	spin_unlock_irqrestore(&blkdev->lock, flags);
+
+	while (blkdev->num_outstanding_reqs) {
+		DPRINT_INFO(STORVSC, "waiting for %d requests to complete...",
+			    blkdev->num_outstanding_reqs);
+		udelay(100);
+	}
+
+	blkvsc_do_operation(blkdev, DO_FLUSH);
+
+	spin_lock_irqsave(&blkdev->lock, flags);
+
+	blkvsc_cancel_pending_reqs(blkdev);
+
+	spin_unlock_irqrestore(&blkdev->lock, flags);
+
+	blk_cleanup_queue(blkdev->gd->queue);
+
+	del_gendisk(blkdev->gd);
+
+	kmem_cache_destroy(blkdev->request_pool);
+
+	kfree(blkdev);
+
+	return 0;
+
+}
+
+static void blkvsc_shutdown(struct device *device)
+{
+	struct block_device_context *blkdev = dev_get_drvdata(device);
+	unsigned long flags;
+
+	if (!blkdev)
+		return;
+
+	spin_lock_irqsave(&blkdev->lock, flags);
+
+	blkdev->shutting_down = 1;
+
+	blk_stop_queue(blkdev->gd->queue);
+
+	spin_unlock_irqrestore(&blkdev->lock, flags);
+
+	while (blkdev->num_outstanding_reqs) {
+		DPRINT_INFO(STORVSC, "waiting for %d requests to complete...",
+			    blkdev->num_outstanding_reqs);
+		udelay(100);
+	}
+
+	blkvsc_do_operation(blkdev, DO_FLUSH);
+
+	spin_lock_irqsave(&blkdev->lock, flags);
+
+	blkvsc_cancel_pending_reqs(blkdev);
+
+	spin_unlock_irqrestore(&blkdev->lock, flags);
+}
+
+static int blkvsc_release(struct gendisk *disk, fmode_t mode)
+{
+	struct block_device_context *blkdev = disk->private_data;
+
+	mutex_lock(&blkvsc_mutex);
+	spin_lock(&blkdev->lock);
+	if (blkdev->users == 1) {
+		spin_unlock(&blkdev->lock);
+		blkvsc_do_operation(blkdev, DO_FLUSH);
+		spin_lock(&blkdev->lock);
+	}
+
+	blkdev->users--;
+
+	spin_unlock(&blkdev->lock);
+	mutex_unlock(&blkvsc_mutex);
+	return 0;
+}
+
+
+/*
+ * We break the request into 1 or more blkvsc_requests and submit
+ * them.  If we cant submit them all, we put them on the
+ * pending_list. The blkvsc_request() will work on the pending_list.
+ */
+static int blkvsc_do_request(struct block_device_context *blkdev,
+			     struct request *req)
+{
+	struct bio *bio = NULL;
+	struct bio_vec *bvec = NULL;
+	struct bio_vec *prev_bvec = NULL;
+	struct blkvsc_request *blkvsc_req = NULL;
+	struct blkvsc_request *tmp;
+	int databuf_idx = 0;
+	int seg_idx = 0;
+	sector_t start_sector;
+	unsigned long num_sectors = 0;
+	int ret = 0;
+	int pending = 0;
+	struct blkvsc_request_group *group = NULL;
+
+	/* Create a group to tie req to list of blkvsc_reqs */
+	group = kmem_cache_zalloc(blkdev->request_pool, GFP_ATOMIC);
+	if (!group)
+		return -ENOMEM;
+
+	INIT_LIST_HEAD(&group->blkvsc_req_list);
+	group->outstanding = group->status = 0;
+
+	start_sector = blk_rq_pos(req);
+
+	/* foreach bio in the request */
+	if (req->bio) {
+		for (bio = req->bio; bio; bio = bio->bi_next) {
+			/*
+			 * Map this bio into an existing or new storvsc request
+			 */
+			bio_for_each_segment(bvec, bio, seg_idx) {
+				/* Get a new storvsc request */
+				/* 1st-time */
+				if ((!blkvsc_req) ||
+				    (databuf_idx >= MAX_MULTIPAGE_BUFFER_COUNT)
+				    /* hole at the begin of page */
+				    || (bvec->bv_offset != 0) ||
+				    /* hold at the end of page */
+				    (prev_bvec &&
+				     (prev_bvec->bv_len != PAGE_SIZE))) {
+					/* submit the prev one */
+					if (blkvsc_req) {
+						blkvsc_req->sector_start =
+						start_sector;
+						sector_div(
+						blkvsc_req->sector_start,
+						(blkdev->sector_size >> 9));
+
+						blkvsc_req->sector_count =
+						num_sectors /
+						(blkdev->sector_size >> 9);
+						blkvsc_init_rw(blkvsc_req);
+					}
+
+					/*
+					 * Create new blkvsc_req to represent
+					 * the current bvec
+					 */
+					blkvsc_req =
+					kmem_cache_zalloc(
+					blkdev->request_pool, GFP_ATOMIC);
+					if (!blkvsc_req) {
+						/* free up everything */
+						list_for_each_entry_safe(
+							blkvsc_req, tmp,
+							&group->blkvsc_req_list,
+							req_entry) {
+							list_del(
+							&blkvsc_req->req_entry);
+							kmem_cache_free(
+							blkdev->request_pool,
+							blkvsc_req);
+						}
+
+						kmem_cache_free(
+						blkdev->request_pool, group);
+						return -ENOMEM;
+					}
+
+					memset(blkvsc_req, 0,
+					       sizeof(struct blkvsc_request));
+
+					blkvsc_req->dev = blkdev;
+					blkvsc_req->req = req;
+					blkvsc_req->request.
+					data_buffer.offset
+					= bvec->bv_offset;
+					blkvsc_req->request.
+					data_buffer.len = 0;
+
+					/* Add to the group */
+					blkvsc_req->group = group;
+					blkvsc_req->group->outstanding++;
+					list_add_tail(&blkvsc_req->req_entry,
+					&blkvsc_req->group->blkvsc_req_list);
+
+					start_sector += num_sectors;
+					num_sectors = 0;
+					databuf_idx = 0;
+				}
+
+				/*
+				 * Add the curr bvec/segment to the curr
+				 * blkvsc_req
+				 */
+				blkvsc_req->request.data_buffer.
+					pfn_array[databuf_idx]
+						= page_to_pfn(bvec->bv_page);
+				blkvsc_req->request.data_buffer.len
+					+= bvec->bv_len;
+
+				prev_bvec = bvec;
+
+				databuf_idx++;
+				num_sectors += bvec->bv_len >> 9;
+
+			} /* bio_for_each_segment */
+
+		} /* rq_for_each_bio */
+	}
+
+	/* Handle the last one */
+	if (blkvsc_req) {
+		blkvsc_req->sector_start = start_sector;
+		sector_div(blkvsc_req->sector_start,
+			   (blkdev->sector_size >> 9));
+
+		blkvsc_req->sector_count = num_sectors /
+					   (blkdev->sector_size >> 9);
+
+		blkvsc_init_rw(blkvsc_req);
+	}
+
+	list_for_each_entry(blkvsc_req, &group->blkvsc_req_list, req_entry) {
+		if (pending) {
+
+			list_add_tail(&blkvsc_req->pend_entry,
+				      &blkdev->pending_list);
+		} else {
+			ret = blkvsc_submit_request(blkvsc_req,
+						    blkvsc_request_completion);
+			if (ret == -1) {
+				pending = 1;
+				list_add_tail(&blkvsc_req->pend_entry,
+					      &blkdev->pending_list);
+			}
+
+		}
+	}
+
+	return pending;
+}
+
+static int blkvsc_do_pending_reqs(struct block_device_context *blkdev)
+{
+	struct blkvsc_request *pend_req, *tmp;
+	int ret = 0;
+
+	/* Flush the pending list first */
+	list_for_each_entry_safe(pend_req, tmp, &blkdev->pending_list,
+				 pend_entry) {
+
+		ret = blkvsc_submit_request(pend_req,
+					    blkvsc_request_completion);
+		if (ret != 0)
+			break;
+		else
+			list_del(&pend_req->pend_entry);
+	}
+
+	return ret;
+}
+
+
+static void blkvsc_request(struct request_queue *queue)
+{
+	struct block_device_context *blkdev = NULL;
+	struct request *req;
+	int ret = 0;
+
+	while ((req = blk_peek_request(queue)) != NULL) {
+
+		blkdev = req->rq_disk->private_data;
+		if (blkdev->shutting_down || req->cmd_type != REQ_TYPE_FS) {
+			__blk_end_request_cur(req, 0);
+			continue;
+		}
+
+		ret = blkvsc_do_pending_reqs(blkdev);
+
+		if (ret != 0) {
+			blk_stop_queue(queue);
+			break;
+		}
+
+		blk_start_request(req);
+
+		ret = blkvsc_do_request(blkdev, req);
+		if (ret > 0) {
+			blk_stop_queue(queue);
+			break;
+		} else if (ret < 0) {
+			blk_requeue_request(queue, req);
+			blk_stop_queue(queue);
+			break;
+		}
+	}
+}
+
+
+
 /* The one and only one */
 static  struct storvsc_driver_object g_blkvsc_drv;
 
@@ -156,8 +866,6 @@
 	.owner = THIS_MODULE,
 	.open = blkvsc_open,
 	.release = blkvsc_release,
-	.check_events = blkvsc_check_events,
-	.revalidate_disk = blkvsc_revalidate_disk,
 	.getgeo = blkvsc_getgeo,
 	.ioctl  = blkvsc_ioctl,
 };
@@ -165,7 +873,7 @@
 /*
  * blkvsc_drv_init -  BlkVsc driver initialization.
  */
-static int blkvsc_drv_init(int (*drv_init)(struct hv_driver *drv))
+static int blkvsc_drv_init(void)
 {
 	struct storvsc_driver_object *storvsc_drv_obj = &g_blkvsc_drv;
 	struct hv_driver *drv = &g_blkvsc_drv.base;
@@ -176,7 +884,7 @@
 	drv->priv = storvsc_drv_obj;
 
 	/* Callback to client driver to complete the initialization */
-	drv_init(&storvsc_drv_obj->base);
+	blk_vsc_initialize(&storvsc_drv_obj->base);
 
 	drv->driver.name = storvsc_drv_obj->base.name;
 
@@ -245,24 +953,14 @@
 
 	struct block_device_context *blkdev = NULL;
 	struct storvsc_device_info device_info;
-	int major = 0;
-	int devnum = 0;
+	struct storvsc_major_info major_info;
 	int ret = 0;
-	static int ide0_registered;
-	static int ide1_registered;
 
-	DPRINT_DBG(BLKVSC_DRV, "blkvsc_probe - enter");
-
-	if (!storvsc_drv_obj->base.dev_add) {
-		DPRINT_ERR(BLKVSC_DRV, "OnDeviceAdd() not set");
-		ret = -1;
-		goto Cleanup;
-	}
 
 	blkdev = kzalloc(sizeof(struct block_device_context), GFP_KERNEL);
 	if (!blkdev) {
 		ret = -ENOMEM;
-		goto Cleanup;
+		goto cleanup;
 	}
 
 	INIT_LIST_HEAD(&blkdev->pending_list);
@@ -270,25 +968,20 @@
 	/* Initialize what we can here */
 	spin_lock_init(&blkdev->lock);
 
-	/* ASSERT(sizeof(struct blkvsc_request_group) <= */
-	/* 	sizeof(struct blkvsc_request)); */
 
 	blkdev->request_pool = kmem_cache_create(dev_name(&device_obj->device),
-					sizeof(struct blkvsc_request) +
-					storvsc_drv_obj->request_ext_size, 0,
+					sizeof(struct blkvsc_request), 0,
 					SLAB_HWCACHE_ALIGN, NULL);
 	if (!blkdev->request_pool) {
 		ret = -ENOMEM;
-		goto Cleanup;
+		goto cleanup;
 	}
 
 
 	/* Call to the vsc driver to add the device */
 	ret = storvsc_drv_obj->base.dev_add(device_obj, &device_info);
-	if (ret != 0) {
-		DPRINT_ERR(BLKVSC_DRV, "unable to add blkvsc device");
-		goto Cleanup;
-	}
+	if (ret != 0)
+		goto cleanup;
 
 	blkdev->device_ctx = device_obj;
 	/* this identified the device 0 or 1 */
@@ -298,50 +991,28 @@
 
 	dev_set_drvdata(device, blkdev);
 
-	/* Calculate the major and device num */
-	if (blkdev->path == 0) {
-		major = IDE0_MAJOR;
-		devnum = blkdev->path + blkdev->target;		/* 0 or 1 */
+	ret = stor_vsc_get_major_info(&device_info, &major_info);
 
-		if (!ide0_registered) {
-			ret = register_blkdev(major, "ide");
-			if (ret != 0) {
-				DPRINT_ERR(BLKVSC_DRV,
-					   "register_blkdev() failed! ret %d",
-					   ret);
-				goto Remove;
-			}
+	if (ret)
+		goto cleanup;
 
-			ide0_registered = 1;
+	if (major_info.do_register) {
+		ret = register_blkdev(major_info.major, major_info.devname);
+
+		if (ret != 0) {
+			DPRINT_ERR(BLKVSC_DRV,
+				   "register_blkdev() failed! ret %d", ret);
+			goto remove;
 		}
-	} else if (blkdev->path == 1) {
-		major = IDE1_MAJOR;
-		devnum = blkdev->path + blkdev->target + 1; /* 2 or 3 */
-
-		if (!ide1_registered) {
-			ret = register_blkdev(major, "ide");
-			if (ret != 0) {
-				DPRINT_ERR(BLKVSC_DRV,
-					   "register_blkdev() failed! ret %d",
-					   ret);
-				goto Remove;
-			}
-
-			ide1_registered = 1;
-		}
-	} else {
-		DPRINT_ERR(BLKVSC_DRV, "invalid pathid");
-		ret = -1;
-		goto Cleanup;
 	}
 
-	DPRINT_INFO(BLKVSC_DRV, "blkvsc registered for major %d!!", major);
+	DPRINT_INFO(BLKVSC_DRV, "blkvsc registered for major %d!!",
+			major_info.major);
 
 	blkdev->gd = alloc_disk(BLKVSC_MINORS);
 	if (!blkdev->gd) {
-		DPRINT_ERR(BLKVSC_DRV, "register_blkdev() failed! ret %d", ret);
 		ret = -1;
-		goto Cleanup;
+		goto cleanup;
 	}
 
 	blkdev->gd->queue = blk_init_queue(blkvsc_request, &blkdev->lock);
@@ -352,8 +1023,8 @@
 	blk_queue_bounce_limit(blkdev->gd->queue, BLK_BOUNCE_ANY);
 	blk_queue_dma_alignment(blkdev->gd->queue, 511);
 
-	blkdev->gd->major = major;
-	if (devnum == 1 || devnum == 3)
+	blkdev->gd->major = major_info.major;
+	if (major_info.index == 1 || major_info.index == 3)
 		blkdev->gd->first_minor = BLKVSC_MINORS;
 	else
 		blkdev->gd->first_minor = 0;
@@ -361,16 +1032,10 @@
 	blkdev->gd->events = DISK_EVENT_MEDIA_CHANGE;
 	blkdev->gd->private_data = blkdev;
 	blkdev->gd->driverfs_dev = &(blkdev->device_ctx->device);
-	sprintf(blkdev->gd->disk_name, "hd%c", 'a' + devnum);
+	sprintf(blkdev->gd->disk_name, "hd%c", 'a' + major_info.index);
 
-	blkvsc_do_inquiry(blkdev);
-	if (blkdev->device_type == DVD_TYPE) {
-		set_disk_ro(blkdev->gd, 1);
-		blkdev->gd->flags |= GENHD_FL_REMOVABLE;
-		blkvsc_do_read_capacity(blkdev);
-	} else {
-		blkvsc_do_read_capacity16(blkdev);
-	}
+	blkvsc_do_operation(blkdev, DO_INQUIRY);
+	blkvsc_do_operation(blkdev, DO_CAPACITY);
 
 	set_capacity(blkdev->gd, blkdev->capacity * (blkdev->sector_size/512));
 	blk_queue_logical_block_size(blkdev->gd->queue, blkdev->sector_size);
@@ -383,10 +1048,10 @@
 
 	return ret;
 
-Remove:
+remove:
 	storvsc_drv_obj->base.dev_rm(device_obj);
 
-Cleanup:
+cleanup:
 	if (blkdev) {
 		if (blkdev->request_pool) {
 			kmem_cache_destroy(blkdev->request_pool);
@@ -399,692 +1064,6 @@
 	return ret;
 }
 
-static void blkvsc_shutdown(struct device *device)
-{
-	struct block_device_context *blkdev = dev_get_drvdata(device);
-	unsigned long flags;
-
-	if (!blkdev)
-		return;
-
-	DPRINT_DBG(BLKVSC_DRV, "blkvsc_shutdown - users %d disk %s\n",
-		   blkdev->users, blkdev->gd->disk_name);
-
-	spin_lock_irqsave(&blkdev->lock, flags);
-
-	blkdev->shutting_down = 1;
-
-	blk_stop_queue(blkdev->gd->queue);
-
-	spin_unlock_irqrestore(&blkdev->lock, flags);
-
-	while (blkdev->num_outstanding_reqs) {
-		DPRINT_INFO(STORVSC, "waiting for %d requests to complete...",
-			    blkdev->num_outstanding_reqs);
-		udelay(100);
-	}
-
-	blkvsc_do_flush(blkdev);
-
-	spin_lock_irqsave(&blkdev->lock, flags);
-
-	blkvsc_cancel_pending_reqs(blkdev);
-
-	spin_unlock_irqrestore(&blkdev->lock, flags);
-}
-
-static int blkvsc_do_flush(struct block_device_context *blkdev)
-{
-	struct blkvsc_request *blkvsc_req;
-
-	DPRINT_DBG(BLKVSC_DRV, "blkvsc_do_flush()\n");
-
-	if (blkdev->device_type != HARDDISK_TYPE)
-		return 0;
-
-	blkvsc_req = kmem_cache_alloc(blkdev->request_pool, GFP_KERNEL);
-	if (!blkvsc_req)
-		return -ENOMEM;
-
-	memset(blkvsc_req, 0, sizeof(struct blkvsc_request));
-	init_waitqueue_head(&blkvsc_req->wevent);
-	blkvsc_req->dev = blkdev;
-	blkvsc_req->req = NULL;
-	blkvsc_req->write = 0;
-
-	blkvsc_req->request.data_buffer.pfn_array[0] = 0;
-	blkvsc_req->request.data_buffer.offset = 0;
-	blkvsc_req->request.data_buffer.len = 0;
-
-	blkvsc_req->cmnd[0] = SYNCHRONIZE_CACHE;
-	blkvsc_req->cmd_len = 10;
-
-	/*
-	 * Set this here since the completion routine may be invoked and
-	 * completed before we return
-	 */
-	blkvsc_req->cond = 0;
-	blkvsc_submit_request(blkvsc_req, blkvsc_cmd_completion);
-
-	wait_event_interruptible(blkvsc_req->wevent, blkvsc_req->cond);
-
-	kmem_cache_free(blkvsc_req->dev->request_pool, blkvsc_req);
-
-	return 0;
-}
-
-/* Do a scsi INQUIRY cmd here to get the device type (ie disk or dvd) */
-static int blkvsc_do_inquiry(struct block_device_context *blkdev)
-{
-	struct blkvsc_request *blkvsc_req;
-	struct page *page_buf;
-	unsigned char *buf;
-	unsigned char device_type;
-
-	DPRINT_DBG(BLKVSC_DRV, "blkvsc_do_inquiry()\n");
-
-	blkvsc_req = kmem_cache_alloc(blkdev->request_pool, GFP_KERNEL);
-	if (!blkvsc_req)
-		return -ENOMEM;
-
-	memset(blkvsc_req, 0, sizeof(struct blkvsc_request));
-	page_buf = alloc_page(GFP_KERNEL);
-	if (!page_buf) {
-		kmem_cache_free(blkvsc_req->dev->request_pool, blkvsc_req);
-		return -ENOMEM;
-	}
-
-	init_waitqueue_head(&blkvsc_req->wevent);
-	blkvsc_req->dev = blkdev;
-	blkvsc_req->req = NULL;
-	blkvsc_req->write = 0;
-
-	blkvsc_req->request.data_buffer.pfn_array[0] = page_to_pfn(page_buf);
-	blkvsc_req->request.data_buffer.offset = 0;
-	blkvsc_req->request.data_buffer.len = 64;
-
-	blkvsc_req->cmnd[0] = INQUIRY;
-	blkvsc_req->cmnd[1] = 0x1;		/* Get product data */
-	blkvsc_req->cmnd[2] = 0x83;		/* mode page 83 */
-	blkvsc_req->cmnd[4] = 64;
-	blkvsc_req->cmd_len = 6;
-
-	/*
-	 * Set this here since the completion routine may be invoked and
-	 * completed before we return
-	 */
-	blkvsc_req->cond = 0;
-
-	blkvsc_submit_request(blkvsc_req, blkvsc_cmd_completion);
-
-	DPRINT_DBG(BLKVSC_DRV, "waiting %p to complete - cond %d\n",
-		   blkvsc_req, blkvsc_req->cond);
-
-	wait_event_interruptible(blkvsc_req->wevent, blkvsc_req->cond);
-
-	buf = kmap(page_buf);
-
-	/* print_hex_dump_bytes("", DUMP_PREFIX_NONE, buf, 64); */
-	/* be to le */
-	device_type = buf[0] & 0x1F;
-
-	if (device_type == 0x0) {
-		blkdev->device_type = HARDDISK_TYPE;
-	} else if (device_type == 0x5) {
-		blkdev->device_type = DVD_TYPE;
-	} else {
-		/* TODO: this is currently unsupported device type */
-		blkdev->device_type = UNKNOWN_DEV_TYPE;
-	}
-
-	DPRINT_DBG(BLKVSC_DRV, "device type %d\n", device_type);
-
-	blkdev->device_id_len = buf[7];
-	if (blkdev->device_id_len > 64)
-		blkdev->device_id_len = 64;
-
-	memcpy(blkdev->device_id, &buf[8], blkdev->device_id_len);
-	/* printk_hex_dump_bytes("", DUMP_PREFIX_NONE, blkdev->device_id,
-	 * blkdev->device_id_len); */
-
-	kunmap(page_buf);
-
-	__free_page(page_buf);
-
-	kmem_cache_free(blkvsc_req->dev->request_pool, blkvsc_req);
-
-	return 0;
-}
-
-/* Do a scsi READ_CAPACITY cmd here to get the size of the disk */
-static int blkvsc_do_read_capacity(struct block_device_context *blkdev)
-{
-	struct blkvsc_request *blkvsc_req;
-	struct page *page_buf;
-	unsigned char *buf;
-	struct scsi_sense_hdr sense_hdr;
-
-	DPRINT_DBG(BLKVSC_DRV, "blkvsc_do_read_capacity()\n");
-
-	blkdev->sector_size = 0;
-	blkdev->capacity = 0;
-	blkdev->media_not_present = 0; /* assume a disk is present */
-
-	blkvsc_req = kmem_cache_alloc(blkdev->request_pool, GFP_KERNEL);
-	if (!blkvsc_req)
-		return -ENOMEM;
-
-	memset(blkvsc_req, 0, sizeof(struct blkvsc_request));
-	page_buf = alloc_page(GFP_KERNEL);
-	if (!page_buf) {
-		kmem_cache_free(blkvsc_req->dev->request_pool, blkvsc_req);
-		return -ENOMEM;
-	}
-
-	init_waitqueue_head(&blkvsc_req->wevent);
-	blkvsc_req->dev = blkdev;
-	blkvsc_req->req = NULL;
-	blkvsc_req->write = 0;
-
-	blkvsc_req->request.data_buffer.pfn_array[0] = page_to_pfn(page_buf);
-	blkvsc_req->request.data_buffer.offset = 0;
-	blkvsc_req->request.data_buffer.len = 8;
-
-	blkvsc_req->cmnd[0] = READ_CAPACITY;
-	blkvsc_req->cmd_len = 16;
-
-	/*
-	 * Set this here since the completion routine may be invoked
-	 * and completed before we return
-	 */
-	blkvsc_req->cond = 0;
-
-	blkvsc_submit_request(blkvsc_req, blkvsc_cmd_completion);
-
-	DPRINT_DBG(BLKVSC_DRV, "waiting %p to complete - cond %d\n",
-		   blkvsc_req, blkvsc_req->cond);
-
-	wait_event_interruptible(blkvsc_req->wevent, blkvsc_req->cond);
-
-	/* check error */
-	if (blkvsc_req->request.status) {
-		scsi_normalize_sense(blkvsc_req->sense_buffer,
-				     SCSI_SENSE_BUFFERSIZE, &sense_hdr);
-
-		if (sense_hdr.asc == 0x3A) {
-			/* Medium not present */
-			blkdev->media_not_present = 1;
-		}
-		return 0;
-	}
-	buf = kmap(page_buf);
-
-	/* be to le */
-	blkdev->capacity = ((buf[0] << 24) | (buf[1] << 16) |
-			    (buf[2] << 8) | buf[3]) + 1;
-	blkdev->sector_size = (buf[4] << 24) | (buf[5] << 16) |
-			      (buf[6] << 8) | buf[7];
-
-	kunmap(page_buf);
-
-	__free_page(page_buf);
-
-	kmem_cache_free(blkvsc_req->dev->request_pool, blkvsc_req);
-
-	return 0;
-}
-
-static int blkvsc_do_read_capacity16(struct block_device_context *blkdev)
-{
-	struct blkvsc_request *blkvsc_req;
-	struct page *page_buf;
-	unsigned char *buf;
-	struct scsi_sense_hdr sense_hdr;
-
-	DPRINT_DBG(BLKVSC_DRV, "blkvsc_do_read_capacity16()\n");
-
-	blkdev->sector_size = 0;
-	blkdev->capacity = 0;
-	blkdev->media_not_present = 0; /* assume a disk is present */
-
-	blkvsc_req = kmem_cache_alloc(blkdev->request_pool, GFP_KERNEL);
-	if (!blkvsc_req)
-		return -ENOMEM;
-
-	memset(blkvsc_req, 0, sizeof(struct blkvsc_request));
-	page_buf = alloc_page(GFP_KERNEL);
-	if (!page_buf) {
-		kmem_cache_free(blkvsc_req->dev->request_pool, blkvsc_req);
-		return -ENOMEM;
-	}
-
-	init_waitqueue_head(&blkvsc_req->wevent);
-	blkvsc_req->dev = blkdev;
-	blkvsc_req->req = NULL;
-	blkvsc_req->write = 0;
-
-	blkvsc_req->request.data_buffer.pfn_array[0] = page_to_pfn(page_buf);
-	blkvsc_req->request.data_buffer.offset = 0;
-	blkvsc_req->request.data_buffer.len = 12;
-
-	blkvsc_req->cmnd[0] = 0x9E; /* READ_CAPACITY16; */
-	blkvsc_req->cmd_len = 16;
-
-	/*
-	 * Set this here since the completion routine may be invoked
-	 * and completed before we return
-	 */
-	blkvsc_req->cond = 0;
-
-	blkvsc_submit_request(blkvsc_req, blkvsc_cmd_completion);
-
-	DPRINT_DBG(BLKVSC_DRV, "waiting %p to complete - cond %d\n",
-		   blkvsc_req, blkvsc_req->cond);
-
-	wait_event_interruptible(blkvsc_req->wevent, blkvsc_req->cond);
-
-	/* check error */
-	if (blkvsc_req->request.status) {
-		scsi_normalize_sense(blkvsc_req->sense_buffer,
-				     SCSI_SENSE_BUFFERSIZE, &sense_hdr);
-		if (sense_hdr.asc == 0x3A) {
-			/* Medium not present */
-			blkdev->media_not_present = 1;
-		}
-		return 0;
-	}
-	buf = kmap(page_buf);
-
-	/* be to le */
-	blkdev->capacity = be64_to_cpu(*(unsigned long long *) &buf[0]) + 1;
-	blkdev->sector_size = be32_to_cpu(*(unsigned int *)&buf[8]);
-
-#if 0
-	blkdev->capacity = ((buf[0] << 24) | (buf[1] << 16) |
-			    (buf[2] << 8) | buf[3]) + 1;
-	blkdev->sector_size = (buf[4] << 24) | (buf[5] << 16) |
-			      (buf[6] << 8) | buf[7];
-#endif
-
-	kunmap(page_buf);
-
-	__free_page(page_buf);
-
-	kmem_cache_free(blkvsc_req->dev->request_pool, blkvsc_req);
-
-	return 0;
-}
-
-/*
- * blkvsc_remove() - Callback when our device is removed
- */
-static int blkvsc_remove(struct device *device)
-{
-	struct hv_driver *drv =
-				drv_to_hv_drv(device->driver);
-	struct storvsc_driver_object *storvsc_drv_obj =
-				drv->priv;
-	struct hv_device *device_obj = device_to_hv_device(device);
-	struct block_device_context *blkdev = dev_get_drvdata(device);
-	unsigned long flags;
-	int ret;
-
-	DPRINT_DBG(BLKVSC_DRV, "blkvsc_remove()\n");
-
-	if (!storvsc_drv_obj->base.dev_rm)
-		return -1;
-
-	/*
-	 * Call to the vsc driver to let it know that the device is being
-	 * removed
-	 */
-	ret = storvsc_drv_obj->base.dev_rm(device_obj);
-	if (ret != 0) {
-		/* TODO: */
-		DPRINT_ERR(BLKVSC_DRV,
-			   "unable to remove blkvsc device (ret %d)", ret);
-	}
-
-	/* Get to a known state */
-	spin_lock_irqsave(&blkdev->lock, flags);
-
-	blkdev->shutting_down = 1;
-
-	blk_stop_queue(blkdev->gd->queue);
-
-	spin_unlock_irqrestore(&blkdev->lock, flags);
-
-	while (blkdev->num_outstanding_reqs) {
-		DPRINT_INFO(STORVSC, "waiting for %d requests to complete...",
-			    blkdev->num_outstanding_reqs);
-		udelay(100);
-	}
-
-	blkvsc_do_flush(blkdev);
-
-	spin_lock_irqsave(&blkdev->lock, flags);
-
-	blkvsc_cancel_pending_reqs(blkdev);
-
-	spin_unlock_irqrestore(&blkdev->lock, flags);
-
-	blk_cleanup_queue(blkdev->gd->queue);
-
-	del_gendisk(blkdev->gd);
-
-	kmem_cache_destroy(blkdev->request_pool);
-
-	kfree(blkdev);
-
-	return ret;
-}
-
-static void blkvsc_init_rw(struct blkvsc_request *blkvsc_req)
-{
-	/* ASSERT(blkvsc_req->req); */
-	/* ASSERT(blkvsc_req->sector_count <= (MAX_MULTIPAGE_BUFFER_COUNT*8)); */
-
-	blkvsc_req->cmd_len = 16;
-
-	if (blkvsc_req->sector_start > 0xffffffff) {
-		if (rq_data_dir(blkvsc_req->req)) {
-			blkvsc_req->write = 1;
-			blkvsc_req->cmnd[0] = WRITE_16;
-		} else {
-			blkvsc_req->write = 0;
-			blkvsc_req->cmnd[0] = READ_16;
-		}
-
-		blkvsc_req->cmnd[1] |=
-			(blkvsc_req->req->cmd_flags & REQ_FUA) ? 0x8 : 0;
-
-		*(unsigned long long *)&blkvsc_req->cmnd[2] =
-				cpu_to_be64(blkvsc_req->sector_start);
-		*(unsigned int *)&blkvsc_req->cmnd[10] =
-				cpu_to_be32(blkvsc_req->sector_count);
-	} else if ((blkvsc_req->sector_count > 0xff) ||
-		   (blkvsc_req->sector_start > 0x1fffff)) {
-		if (rq_data_dir(blkvsc_req->req)) {
-			blkvsc_req->write = 1;
-			blkvsc_req->cmnd[0] = WRITE_10;
-		} else {
-			blkvsc_req->write = 0;
-			blkvsc_req->cmnd[0] = READ_10;
-		}
-
-		blkvsc_req->cmnd[1] |=
-			(blkvsc_req->req->cmd_flags & REQ_FUA) ? 0x8 : 0;
-
-		*(unsigned int *)&blkvsc_req->cmnd[2] =
-				cpu_to_be32(blkvsc_req->sector_start);
-		*(unsigned short *)&blkvsc_req->cmnd[7] =
-				cpu_to_be16(blkvsc_req->sector_count);
-	} else {
-		if (rq_data_dir(blkvsc_req->req)) {
-			blkvsc_req->write = 1;
-			blkvsc_req->cmnd[0] = WRITE_6;
-		} else {
-			blkvsc_req->write = 0;
-			blkvsc_req->cmnd[0] = READ_6;
-		}
-
-		*(unsigned int *)&blkvsc_req->cmnd[1] =
-				cpu_to_be32(blkvsc_req->sector_start) >> 8;
-		blkvsc_req->cmnd[1] &= 0x1f;
-		blkvsc_req->cmnd[4] = (unsigned char)blkvsc_req->sector_count;
-	}
-}
-
-static int blkvsc_submit_request(struct blkvsc_request *blkvsc_req,
-			void (*request_completion)(struct hv_storvsc_request *))
-{
-	struct block_device_context *blkdev = blkvsc_req->dev;
-	struct hv_device *device_ctx = blkdev->device_ctx;
-	struct hv_driver *drv =
-			drv_to_hv_drv(device_ctx->device.driver);
-	struct storvsc_driver_object *storvsc_drv_obj =
-			drv->priv;
-	struct hv_storvsc_request *storvsc_req;
-	int ret;
-
-	DPRINT_DBG(BLKVSC_DRV, "blkvsc_submit_request() - "
-		   "req %p type %s start_sector %lu count %ld offset %d "
-		   "len %d\n", blkvsc_req,
-		   (blkvsc_req->write) ? "WRITE" : "READ",
-		   (unsigned long) blkvsc_req->sector_start,
-		   blkvsc_req->sector_count,
-		   blkvsc_req->request.data_buffer.offset,
-		   blkvsc_req->request.data_buffer.len);
-#if 0
-	for (i = 0; i < (blkvsc_req->request.data_buffer.len >> 12); i++) {
-		DPRINT_DBG(BLKVSC_DRV, "blkvsc_submit_request() - "
-			   "req %p pfn[%d] %llx\n",
-			   blkvsc_req, i,
-			   blkvsc_req->request.data_buffer.pfn_array[i]);
-	}
-#endif
-
-	storvsc_req = &blkvsc_req->request;
-	storvsc_req->extension = (void *)((unsigned long)blkvsc_req +
-					  sizeof(struct blkvsc_request));
-
-	storvsc_req->type = blkvsc_req->write ? WRITE_TYPE : READ_TYPE;
-
-	storvsc_req->on_io_completion = request_completion;
-	storvsc_req->context = blkvsc_req;
-
-	storvsc_req->host = blkdev->port;
-	storvsc_req->bus = blkdev->path;
-	storvsc_req->target_id = blkdev->target;
-	storvsc_req->lun_id = 0;	 /* this is not really used at all */
-
-	storvsc_req->cdb_len = blkvsc_req->cmd_len;
-	storvsc_req->cdb = blkvsc_req->cmnd;
-
-	storvsc_req->sense_buffer = blkvsc_req->sense_buffer;
-	storvsc_req->sense_buffer_size = SCSI_SENSE_BUFFERSIZE;
-
-	ret = storvsc_drv_obj->on_io_request(blkdev->device_ctx,
-					   &blkvsc_req->request);
-	if (ret == 0)
-		blkdev->num_outstanding_reqs++;
-
-	return ret;
-}
-
-/*
- * We break the request into 1 or more blkvsc_requests and submit
- * them.  If we can't submit them all, we put them on the
- * pending_list. The blkvsc_request() will work on the pending_list.
- */
-static int blkvsc_do_request(struct block_device_context *blkdev,
-			     struct request *req)
-{
-	struct bio *bio = NULL;
-	struct bio_vec *bvec = NULL;
-	struct bio_vec *prev_bvec = NULL;
-	struct blkvsc_request *blkvsc_req = NULL;
-	struct blkvsc_request *tmp;
-	int databuf_idx = 0;
-	int seg_idx = 0;
-	sector_t start_sector;
-	unsigned long num_sectors = 0;
-	int ret = 0;
-	int pending = 0;
-	struct blkvsc_request_group *group = NULL;
-
-	DPRINT_DBG(BLKVSC_DRV, "blkdev %p req %p sect %lu\n", blkdev, req,
-		  (unsigned long)blk_rq_pos(req));
-
-	/* Create a group to tie req to list of blkvsc_reqs */
-	group = kmem_cache_alloc(blkdev->request_pool, GFP_ATOMIC);
-	if (!group)
-		return -ENOMEM;
-
-	INIT_LIST_HEAD(&group->blkvsc_req_list);
-	group->outstanding = group->status = 0;
-
-	start_sector = blk_rq_pos(req);
-
-	/* foreach bio in the request */
-	if (req->bio) {
-		for (bio = req->bio; bio; bio = bio->bi_next) {
-			/*
-			 * Map this bio into an existing or new storvsc request
-			 */
-			bio_for_each_segment(bvec, bio, seg_idx) {
-				DPRINT_DBG(BLKVSC_DRV, "bio_for_each_segment() "
-					   "- req %p bio %p bvec %p seg_idx %d "
-					   "databuf_idx %d\n", req, bio, bvec,
-					   seg_idx, databuf_idx);
-
-				/* Get a new storvsc request */
-				/* 1st-time */
-				if ((!blkvsc_req) ||
-				    (databuf_idx >= MAX_MULTIPAGE_BUFFER_COUNT)
-				    /* hole at the begin of page */
-				    || (bvec->bv_offset != 0) ||
-				    /* hold at the end of page */
-				    (prev_bvec &&
-				     (prev_bvec->bv_len != PAGE_SIZE))) {
-					/* submit the prev one */
-					if (blkvsc_req) {
-						blkvsc_req->sector_start = start_sector;
-						sector_div(blkvsc_req->sector_start, (blkdev->sector_size >> 9));
-
-						blkvsc_req->sector_count = num_sectors / (blkdev->sector_size >> 9);
-						blkvsc_init_rw(blkvsc_req);
-					}
-
-					/*
-					 * Create new blkvsc_req to represent
-					 * the current bvec
-					 */
-					blkvsc_req = kmem_cache_alloc(blkdev->request_pool, GFP_ATOMIC);
-					if (!blkvsc_req) {
-						/* free up everything */
-						list_for_each_entry_safe(
-							blkvsc_req, tmp,
-							&group->blkvsc_req_list,
-							req_entry) {
-							list_del(&blkvsc_req->req_entry);
-							kmem_cache_free(blkdev->request_pool, blkvsc_req);
-						}
-
-						kmem_cache_free(blkdev->request_pool, group);
-						return -ENOMEM;
-					}
-
-					memset(blkvsc_req, 0,
-					       sizeof(struct blkvsc_request));
-
-					blkvsc_req->dev = blkdev;
-					blkvsc_req->req = req;
-					blkvsc_req->request.data_buffer.offset
-						= bvec->bv_offset;
-					blkvsc_req->request.data_buffer.len
-						= 0;
-
-					/* Add to the group */
-					blkvsc_req->group = group;
-					blkvsc_req->group->outstanding++;
-					list_add_tail(&blkvsc_req->req_entry,
-						&blkvsc_req->group->blkvsc_req_list);
-
-					start_sector += num_sectors;
-					num_sectors = 0;
-					databuf_idx = 0;
-				}
-
-				/* Add the curr bvec/segment to the curr blkvsc_req */
-				blkvsc_req->request.data_buffer.
-					pfn_array[databuf_idx]
-						= page_to_pfn(bvec->bv_page);
-				blkvsc_req->request.data_buffer.len
-					+= bvec->bv_len;
-
-				prev_bvec = bvec;
-
-				databuf_idx++;
-				num_sectors += bvec->bv_len >> 9;
-
-			} /* bio_for_each_segment */
-
-		} /* rq_for_each_bio */
-	}
-
-	/* Handle the last one */
-	if (blkvsc_req) {
-		DPRINT_DBG(BLKVSC_DRV, "blkdev %p req %p group %p count %d\n",
-			   blkdev, req, blkvsc_req->group,
-			   blkvsc_req->group->outstanding);
-
-		blkvsc_req->sector_start = start_sector;
-		sector_div(blkvsc_req->sector_start,
-			   (blkdev->sector_size >> 9));
-
-		blkvsc_req->sector_count = num_sectors /
-					   (blkdev->sector_size >> 9);
-
-		blkvsc_init_rw(blkvsc_req);
-	}
-
-	list_for_each_entry(blkvsc_req, &group->blkvsc_req_list, req_entry) {
-		if (pending) {
-			DPRINT_DBG(BLKVSC_DRV, "adding blkvsc_req to "
-				   "pending_list - blkvsc_req %p start_sect %lu"
-				   " sect_count %ld (%lu %ld)\n", blkvsc_req,
-				   (unsigned long)blkvsc_req->sector_start,
-				   blkvsc_req->sector_count,
-				   (unsigned long)start_sector,
-				   (unsigned long)num_sectors);
-
-			list_add_tail(&blkvsc_req->pend_entry,
-				      &blkdev->pending_list);
-		} else {
-			ret = blkvsc_submit_request(blkvsc_req,
-						    blkvsc_request_completion);
-			if (ret == -1) {
-				pending = 1;
-				list_add_tail(&blkvsc_req->pend_entry,
-					      &blkdev->pending_list);
-			}
-
-			DPRINT_DBG(BLKVSC_DRV, "submitted blkvsc_req %p "
-				   "start_sect %lu sect_count %ld (%lu %ld) "
-				   "ret %d\n", blkvsc_req,
-				   (unsigned long)blkvsc_req->sector_start,
-				   blkvsc_req->sector_count,
-				   (unsigned long)start_sector,
-				   num_sectors, ret);
-		}
-	}
-
-	return pending;
-}
-
-static void blkvsc_cmd_completion(struct hv_storvsc_request *request)
-{
-	struct blkvsc_request *blkvsc_req =
-			(struct blkvsc_request *)request->context;
-	struct block_device_context *blkdev =
-			(struct block_device_context *)blkvsc_req->dev;
-	struct scsi_sense_hdr sense_hdr;
-
-	DPRINT_DBG(BLKVSC_DRV, "blkvsc_cmd_completion() - req %p\n",
-		   blkvsc_req);
-
-	blkdev->num_outstanding_reqs--;
-
-	if (blkvsc_req->request.status)
-		if (scsi_normalize_sense(blkvsc_req->sense_buffer,
-					 SCSI_SENSE_BUFFERSIZE, &sense_hdr))
-			scsi_print_sense_hdr("blkvsc", &sense_hdr);
-
-	blkvsc_req->cond = 1;
-	wake_up_interruptible(&blkvsc_req->wevent);
-}
-
 static void blkvsc_request_completion(struct hv_storvsc_request *request)
 {
 	struct blkvsc_request *blkvsc_req =
@@ -1093,19 +1072,8 @@
 			(struct block_device_context *)blkvsc_req->dev;
 	unsigned long flags;
 	struct blkvsc_request *comp_req, *tmp;
+	struct vmscsi_request *vm_srb;
 
-	/* ASSERT(blkvsc_req->group); */
-
-	DPRINT_DBG(BLKVSC_DRV, "blkdev %p blkvsc_req %p group %p type %s "
-		   "sect_start %lu sect_count %ld len %d group outstd %d "
-		   "total outstd %d\n",
-		   blkdev, blkvsc_req, blkvsc_req->group,
-		   (blkvsc_req->write) ? "WRITE" : "READ",
-		   (unsigned long)blkvsc_req->sector_start,
-		   blkvsc_req->sector_count,
-		   blkvsc_req->request.data_buffer.len,
-		   blkvsc_req->group->outstanding,
-		   blkdev->num_outstanding_reqs);
 
 	spin_lock_irqsave(&blkdev->lock, flags);
 
@@ -1121,23 +1089,18 @@
 		list_for_each_entry_safe(comp_req, tmp,
 					 &blkvsc_req->group->blkvsc_req_list,
 					 req_entry) {
-			DPRINT_DBG(BLKVSC_DRV, "completing blkvsc_req %p "
-				   "sect_start %lu sect_count %ld\n",
-				   comp_req,
-				   (unsigned long)comp_req->sector_start,
-				   comp_req->sector_count);
 
 			list_del(&comp_req->req_entry);
 
+			vm_srb =
+			&comp_req->request.vstor_packet.vm_srb;
 			if (!__blk_end_request(comp_req->req,
-				(!comp_req->request.status ? 0 : -EIO),
+				(!vm_srb->scsi_status ? 0 : -EIO),
 				comp_req->sector_count * blkdev->sector_size)) {
 				/*
 				 * All the sectors have been xferred ie the
 				 * request is done
 				 */
-				DPRINT_DBG(BLKVSC_DRV, "req %p COMPLETED\n",
-					   comp_req->req);
 				kmem_cache_free(blkdev->request_pool,
 						comp_req->group);
 			}
@@ -1155,328 +1118,13 @@
 	spin_unlock_irqrestore(&blkdev->lock, flags);
 }
 
-static int blkvsc_cancel_pending_reqs(struct block_device_context *blkdev)
-{
-	struct blkvsc_request *pend_req, *tmp;
-	struct blkvsc_request *comp_req, *tmp2;
-
-	int ret = 0;
-
-	DPRINT_DBG(BLKVSC_DRV, "blkvsc_cancel_pending_reqs()");
-
-	/* Flush the pending list first */
-	list_for_each_entry_safe(pend_req, tmp, &blkdev->pending_list,
-				 pend_entry) {
-		/*
-		 * The pend_req could be part of a partially completed
-		 * request. If so, complete those req first until we
-		 * hit the pend_req
-		 */
-		list_for_each_entry_safe(comp_req, tmp2,
-					 &pend_req->group->blkvsc_req_list,
-					 req_entry) {
-			DPRINT_DBG(BLKVSC_DRV, "completing blkvsc_req %p "
-				   "sect_start %lu sect_count %ld\n",
-				   comp_req,
-				   (unsigned long) comp_req->sector_start,
-				   comp_req->sector_count);
-
-			if (comp_req == pend_req)
-				break;
-
-			list_del(&comp_req->req_entry);
-
-			if (comp_req->req) {
-				ret = __blk_end_request(comp_req->req,
-					(!comp_req->request.status ? 0 : -EIO),
-					comp_req->sector_count *
-					blkdev->sector_size);
-
-				/* FIXME: shouldn't this do more than return? */
-				if (ret)
-					goto out;
-			}
-
-			kmem_cache_free(blkdev->request_pool, comp_req);
-		}
-
-		DPRINT_DBG(BLKVSC_DRV, "cancelling pending request - %p\n",
-			   pend_req);
-
-		list_del(&pend_req->pend_entry);
-
-		list_del(&pend_req->req_entry);
-
-		if (comp_req->req) {
-			if (!__blk_end_request(pend_req->req, -EIO,
-					       pend_req->sector_count *
-					       blkdev->sector_size)) {
-				/*
-				 * All the sectors have been xferred ie the
-				 * request is done
-				 */
-				DPRINT_DBG(BLKVSC_DRV,
-					   "blkvsc_cancel_pending_reqs() - "
-					   "req %p COMPLETED\n", pend_req->req);
-				kmem_cache_free(blkdev->request_pool,
-						pend_req->group);
-			}
-		}
-
-		kmem_cache_free(blkdev->request_pool, pend_req);
-	}
-
-out:
-	return ret;
-}
-
-static int blkvsc_do_pending_reqs(struct block_device_context *blkdev)
-{
-	struct blkvsc_request *pend_req, *tmp;
-	int ret = 0;
-
-	/* Flush the pending list first */
-	list_for_each_entry_safe(pend_req, tmp, &blkdev->pending_list,
-				 pend_entry) {
-		DPRINT_DBG(BLKVSC_DRV, "working off pending_list - %p\n",
-			   pend_req);
-
-		ret = blkvsc_submit_request(pend_req,
-					    blkvsc_request_completion);
-		if (ret != 0)
-			break;
-		else
-			list_del(&pend_req->pend_entry);
-	}
-
-	return ret;
-}
-
-static void blkvsc_request(struct request_queue *queue)
-{
-	struct block_device_context *blkdev = NULL;
-	struct request *req;
-	int ret = 0;
-
-	DPRINT_DBG(BLKVSC_DRV, "- enter\n");
-	while ((req = blk_peek_request(queue)) != NULL) {
-		DPRINT_DBG(BLKVSC_DRV, "- req %p\n", req);
-
-		blkdev = req->rq_disk->private_data;
-		if (blkdev->shutting_down || req->cmd_type != REQ_TYPE_FS ||
-		    blkdev->media_not_present) {
-			__blk_end_request_cur(req, 0);
-			continue;
-		}
-
-		ret = blkvsc_do_pending_reqs(blkdev);
-
-		if (ret != 0) {
-			DPRINT_DBG(BLKVSC_DRV,
-				   "- stop queue - pending_list not empty\n");
-			blk_stop_queue(queue);
-			break;
-		}
-
-		blk_start_request(req);
-
-		ret = blkvsc_do_request(blkdev, req);
-		if (ret > 0) {
-			DPRINT_DBG(BLKVSC_DRV, "- stop queue - no room\n");
-			blk_stop_queue(queue);
-			break;
-		} else if (ret < 0) {
-			DPRINT_DBG(BLKVSC_DRV, "- stop queue - no mem\n");
-			blk_requeue_request(queue, req);
-			blk_stop_queue(queue);
-			break;
-		}
-	}
-}
-
-static int blkvsc_open(struct block_device *bdev, fmode_t mode)
-{
-	struct block_device_context *blkdev = bdev->bd_disk->private_data;
-
-	DPRINT_DBG(BLKVSC_DRV, "- users %d disk %s\n", blkdev->users,
-		   blkdev->gd->disk_name);
-
-	mutex_lock(&blkvsc_mutex);
-	spin_lock(&blkdev->lock);
-
-	if (!blkdev->users && blkdev->device_type == DVD_TYPE) {
-		spin_unlock(&blkdev->lock);
-		check_disk_change(bdev);
-		spin_lock(&blkdev->lock);
-	}
-
-	blkdev->users++;
-
-	spin_unlock(&blkdev->lock);
-	mutex_unlock(&blkvsc_mutex);
-	return 0;
-}
-
-static int blkvsc_release(struct gendisk *disk, fmode_t mode)
-{
-	struct block_device_context *blkdev = disk->private_data;
-
-	DPRINT_DBG(BLKVSC_DRV, "- users %d disk %s\n", blkdev->users,
-		   blkdev->gd->disk_name);
-
-	mutex_lock(&blkvsc_mutex);
-	spin_lock(&blkdev->lock);
-	if (blkdev->users == 1) {
-		spin_unlock(&blkdev->lock);
-		blkvsc_do_flush(blkdev);
-		spin_lock(&blkdev->lock);
-	}
-
-	blkdev->users--;
-
-	spin_unlock(&blkdev->lock);
-	mutex_unlock(&blkvsc_mutex);
-	return 0;
-}
-
-static unsigned int blkvsc_check_events(struct gendisk *gd,
-					unsigned int clearing)
-{
-	DPRINT_DBG(BLKVSC_DRV, "- enter\n");
-	return DISK_EVENT_MEDIA_CHANGE;
-}
-
-static int blkvsc_revalidate_disk(struct gendisk *gd)
-{
-	struct block_device_context *blkdev = gd->private_data;
-
-	DPRINT_DBG(BLKVSC_DRV, "- enter\n");
-
-	if (blkdev->device_type == DVD_TYPE) {
-		blkvsc_do_read_capacity(blkdev);
-		set_capacity(blkdev->gd, blkdev->capacity *
-			    (blkdev->sector_size/512));
-		blk_queue_logical_block_size(gd->queue, blkdev->sector_size);
-	}
-	return 0;
-}
-
-static int blkvsc_getgeo(struct block_device *bd, struct hd_geometry *hg)
-{
-	sector_t total_sectors = get_capacity(bd->bd_disk);
-	sector_t cylinder_times_heads = 0;
-	sector_t temp = 0;
-
-	int sectors_per_track = 0;
-	int heads = 0;
-	int cylinders = 0;
-	int rem = 0;
-
-	if (total_sectors > (65535 * 16 * 255))
-		total_sectors = (65535 * 16 * 255);
-
-	if (total_sectors >= (65535 * 16 * 63)) {
-		sectors_per_track = 255;
-		heads = 16;
-
-		cylinder_times_heads = total_sectors;
-		/* sector_div stores the quotient in cylinder_times_heads */
-		rem = sector_div(cylinder_times_heads, sectors_per_track);
-	} else {
-		sectors_per_track = 17;
-
-		cylinder_times_heads = total_sectors;
-		/* sector_div stores the quotient in cylinder_times_heads */
-		rem = sector_div(cylinder_times_heads, sectors_per_track);
-
-		temp = cylinder_times_heads + 1023;
-		/* sector_div stores the quotient in temp */
-		rem = sector_div(temp, 1024);
-
-		heads = temp;
-
-		if (heads < 4)
-			heads = 4;
-
-
-		if (cylinder_times_heads >= (heads * 1024) || (heads > 16)) {
-			sectors_per_track = 31;
-			heads = 16;
-
-			cylinder_times_heads = total_sectors;
-			/*
-			 * sector_div stores the quotient in
-			 * cylinder_times_heads
-			 */
-			rem = sector_div(cylinder_times_heads,
-					 sectors_per_track);
-		}
-
-		if (cylinder_times_heads >= (heads * 1024)) {
-			sectors_per_track = 63;
-			heads = 16;
-
-			cylinder_times_heads = total_sectors;
-			/*
-			 * sector_div stores the quotient in
-			 * cylinder_times_heads
-			 */
-			rem = sector_div(cylinder_times_heads,
-					 sectors_per_track);
-		}
-	}
-
-	temp = cylinder_times_heads;
-	/* sector_div stores the quotient in temp */
-	rem = sector_div(temp, heads);
-	cylinders = temp;
-
-	hg->heads = heads;
-	hg->sectors = sectors_per_track;
-	hg->cylinders = cylinders;
-
-	DPRINT_INFO(BLKVSC_DRV, "CHS (%d, %d, %d)", cylinders, heads,
-		    sectors_per_track);
-
-    return 0;
-}
-
-static int blkvsc_ioctl(struct block_device *bd, fmode_t mode,
-			unsigned cmd, unsigned long argument)
-{
-/*	struct block_device_context *blkdev = bd->bd_disk->private_data; */
-	int ret;
-
-	switch (cmd) {
-	/*
-	 * TODO: I think there is certain format for HDIO_GET_IDENTITY rather
-	 * than just a GUID. Commented it out for now.
-	 */
-#if 0
-	case HDIO_GET_IDENTITY:
-		DPRINT_INFO(BLKVSC_DRV, "HDIO_GET_IDENTITY\n");
-		if (copy_to_user((void __user *)arg, blkdev->device_id,
-				 blkdev->device_id_len))
-			ret = -EFAULT;
-		break;
-#endif
-	default:
-		ret = -EINVAL;
-		break;
-	}
-
-	return ret;
-}
-
 static int __init blkvsc_init(void)
 {
 	int ret;
 
 	BUILD_BUG_ON(sizeof(sector_t) != 8);
 
-	DPRINT_INFO(BLKVSC_DRV, "Blkvsc initializing....");
-
-	ret = blkvsc_drv_init(blk_vsc_initialize);
+	ret = blkvsc_drv_init();
 
 	return ret;
 }
diff --git a/drivers/staging/hv/channel.c b/drivers/staging/hv/channel.c
index f7ce7d2..b53be58 100644
--- a/drivers/staging/hv/channel.c
+++ b/drivers/staging/hv/channel.c
@@ -18,6 +18,8 @@
  *   Haiyang Zhang <haiyangz@microsoft.com>
  *   Hank Janssen  <hjanssen@microsoft.com>
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/wait.h>
@@ -213,9 +215,6 @@
 
 
 	/* Establish the gpadl for the ring buffer */
-	DPRINT_DBG(VMBUS, "Establishing ring buffer's gpadl for channel %p...",
-		   newchannel);
-
 	newchannel->ringbuffer_gpadlhandle = 0;
 
 	ret = vmbus_establish_gpadl(newchannel,
@@ -229,16 +228,6 @@
 		goto errorout;
 	}
 
-	DPRINT_DBG(VMBUS, "channel %p <relid %d gpadl 0x%x send ring %p "
-		   "size %d recv ring %p size %d, downstreamoffset %d>",
-		   newchannel, newchannel->offermsg.child_relid,
-		   newchannel->ringbuffer_gpadlhandle,
-		   newchannel->outbound.ring_buffer,
-		   newchannel->outbound.ring_size,
-		   newchannel->inbound.ring_buffer,
-		   newchannel->inbound.ring_size,
-		   send_ringbuffer_size);
-
 	/* Create and init the channel open message */
 	openInfo = kmalloc(sizeof(*openInfo) +
 			   sizeof(struct vmbus_channel_open_channel),
@@ -272,14 +261,11 @@
 		      &vmbus_connection.chn_msg_list);
 	spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
 
-	DPRINT_DBG(VMBUS, "Sending channel open msg...");
-
 	ret = vmbus_post_msg(openMsg,
 			       sizeof(struct vmbus_channel_open_channel));
-	if (ret != 0) {
-		DPRINT_ERR(VMBUS, "unable to open channel - %d", ret);
+
+	if (ret != 0)
 		goto Cleanup;
-	}
 
 	openInfo->wait_condition = 0;
 	wait_event_timeout(openInfo->waitevent,
@@ -291,11 +277,8 @@
 	}
 
 
-	if (openInfo->response.open_result.status == 0)
-		DPRINT_INFO(VMBUS, "channel <%p> open success!!", newchannel);
-	else
-		DPRINT_INFO(VMBUS, "channel <%p> open failed - %d!!",
-			    newchannel, openInfo->response.open_result.status);
+	if (openInfo->response.open_result.status)
+		err = openInfo->response.open_result.status;
 
 Cleanup:
 	spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
@@ -303,7 +286,7 @@
 	spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
 
 	kfree(openInfo);
-	return 0;
+	return err;
 
 errorout:
 	ringbuffer_cleanup(&newchannel->outbound);
@@ -326,6 +309,7 @@
 
 	pfncount = (len - sizeof(struct vmbus_channel_gpadl_body)) /
 		   sizeof(u64);
+
 	DPRINT_DBG(VMBUS, "gpadl body - len %d pfn count %d", len, pfncount);
 
 	for (i = 0; i < pfncount; i++)
@@ -530,19 +514,12 @@
 		      &vmbus_connection.chn_msg_list);
 
 	spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
-	DPRINT_DBG(VMBUS, "buffer %p, size %d msg cnt %d",
-		   kbuffer, size, msgcount);
-
-	DPRINT_DBG(VMBUS, "Sending GPADL Header - len %zd",
-		   msginfo->msgsize - sizeof(*msginfo));
 
 	msginfo->wait_condition = 0;
 	ret = vmbus_post_msg(gpadlmsg, msginfo->msgsize -
 			       sizeof(*msginfo));
-	if (ret != 0) {
-		DPRINT_ERR(VMBUS, "Unable to open channel - %d", ret);
+	if (ret != 0)
 		goto Cleanup;
-	}
 
 	if (msgcount > 1) {
 		list_for_each(curr, &msginfo->submsglist) {
@@ -556,10 +533,6 @@
 				CHANNELMSG_GPADL_BODY;
 			gpadl_body->gpadl = next_gpadl_handle;
 
-			DPRINT_DBG(VMBUS, "Sending GPADL Body - len %zd",
-				   submsginfo->msgsize -
-				   sizeof(*submsginfo));
-
 			dump_gpadl_body(gpadl_body, submsginfo->msgsize -
 				      sizeof(*submsginfo));
 			ret = vmbus_post_msg(gpadl_body,
@@ -577,12 +550,6 @@
 
 
 	/* At this point, we received the gpadl created msg */
-	DPRINT_DBG(VMBUS, "Received GPADL created "
-		   "(relid %d, status %d handle %x)",
-		   channel->offermsg.child_relid,
-		   msginfo->response.gpadl_created.creation_status,
-		   gpadlmsg->gpadl);
-
 	*gpadl_handle = gpadlmsg->gpadl;
 
 Cleanup:
@@ -730,9 +697,6 @@
 	u64 aligned_data = 0;
 	int ret;
 
-	DPRINT_DBG(VMBUS, "channel %p buffer %p len %d",
-		   channel, buffer, bufferlen);
-
 	dump_vmbus_channel(channel);
 
 	/* ASSERT((packetLenAligned - packetLen) < sizeof(u64)); */
@@ -846,10 +810,6 @@
 
 	dump_vmbus_channel(channel);
 
-	DPRINT_DBG(VMBUS, "data buffer - offset %u len %u pfn count %u",
-		multi_pagebuffer->offset,
-		multi_pagebuffer->len, pfncount);
-
 	if ((pfncount < 0) || (pfncount > MAX_MULTIPAGE_BUFFER_COUNT))
 		return -EINVAL;
 
@@ -926,8 +886,6 @@
 			     sizeof(struct vmpacket_descriptor));
 	if (ret != 0) {
 		spin_unlock_irqrestore(&channel->inbound_lock, flags);
-
-		/* DPRINT_DBG(VMBUS, "nothing to read!!"); */
 		return 0;
 	}
 
@@ -937,17 +895,12 @@
 	userlen = packetlen - (desc.offset8 << 3);
 	/* ASSERT(userLen > 0); */
 
-	DPRINT_DBG(VMBUS, "packet received on channel %p relid %d <type %d "
-		   "flag %d tid %llx pktlen %d datalen %d> ",
-		   channel, channel->offermsg.child_relid, desc.type,
-		   desc.flags, desc.trans_id, packetlen, userlen);
-
 	*buffer_actual_len = userlen;
 
 	if (userlen > bufferlen) {
 		spin_unlock_irqrestore(&channel->inbound_lock, flags);
 
-		DPRINT_ERR(VMBUS, "buffer too small - got %d needs %d",
+		pr_err("Buffer too small - got %d needs %d\n",
 			   bufferlen, userlen);
 		return -1;
 	}
@@ -986,8 +939,6 @@
 			     sizeof(struct vmpacket_descriptor));
 	if (ret != 0) {
 		spin_unlock_irqrestore(&channel->inbound_lock, flags);
-
-		/* DPRINT_DBG(VMBUS, "nothing to read!!"); */
 		return 0;
 	}
 
@@ -996,18 +947,14 @@
 	packetlen = desc.len8 << 3;
 	userlen = packetlen - (desc.offset8 << 3);
 
-	DPRINT_DBG(VMBUS, "packet received on channel %p relid %d <type %d "
-		   "flag %d tid %llx pktlen %d datalen %d> ",
-		   channel, channel->offermsg.child_relid, desc.type,
-		   desc.flags, desc.trans_id, packetlen, userlen);
-
 	*buffer_actual_len = packetlen;
 
 	if (packetlen > bufferlen) {
 		spin_unlock_irqrestore(&channel->inbound_lock, flags);
 
-		DPRINT_ERR(VMBUS, "buffer too small - needed %d bytes but "
-			   "got space for only %d bytes", packetlen, bufferlen);
+		pr_err("Buffer too small - needed %d bytes but "
+			"got space for only %d bytes\n",
+			packetlen, bufferlen);
 		return -2;
 	}
 
diff --git a/drivers/staging/hv/channel_mgmt.c b/drivers/staging/hv/channel_mgmt.c
index 06b5732..fe32f7e 100644
--- a/drivers/staging/hv/channel_mgmt.c
+++ b/drivers/staging/hv/channel_mgmt.c
@@ -18,6 +18,8 @@
  *   Haiyang Zhang <haiyangz@microsoft.com>
  *   Hank Janssen  <hjanssen@microsoft.com>
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/wait.h>
@@ -290,9 +292,7 @@
 						     struct vmbus_channel,
 						     work);
 
-	DPRINT_DBG(VMBUS, "releasing channel (%p)", channel);
 	destroy_workqueue(channel->controlwq);
-	DPRINT_DBG(VMBUS, "channel released (%p)", channel);
 
 	kfree(channel);
 }
@@ -384,8 +384,6 @@
 	spin_unlock_irqrestore(&vmbus_connection.channel_lock, flags);
 
 	if (!fnew) {
-		DPRINT_DBG(VMBUS, "Ignoring duplicate offer for relid (%d)",
-			   newchannel->offermsg.child_relid);
 		free_channel(newchannel);
 		return;
 	}
@@ -400,9 +398,6 @@
 		&newchannel->offermsg.offer.if_instance,
 		newchannel);
 
-	DPRINT_DBG(VMBUS, "child device object allocated - %p",
-		   newchannel->device_obj);
-
 	/*
 	 * Add the new device to the bus. This will kick off device-driver
 	 * binding which eventually invokes the device driver's AddDevice()
@@ -410,8 +405,7 @@
 	 */
 	ret = vmbus_child_device_register(newchannel->device_obj);
 	if (ret != 0) {
-		DPRINT_ERR(VMBUS,
-			   "unable to add child device object (relid %d)",
+		pr_err("unable to add child device object (relid %d)\n",
 			   newchannel->offermsg.child_relid);
 
 		spin_lock_irqsave(&vmbus_connection.channel_lock, flags);
@@ -437,8 +431,9 @@
 						 hv_cb_utils[cnt].callback,
 						 newchannel) == 0) {
 				hv_cb_utils[cnt].channel = newchannel;
-				DPRINT_INFO(VMBUS, "%s",
-						hv_cb_utils[cnt].log_msg);
+
+				pr_info("%s\n", hv_cb_utils[cnt].log_msg);
+
 				count_hv_channel();
 			}
 		}
@@ -470,49 +465,19 @@
 		}
 	}
 
-	if (!fsupported) {
-		DPRINT_DBG(VMBUS, "Ignoring channel offer notification for "
-			   "child relid %d", offer->child_relid);
+	if (!fsupported)
 		return;
-	}
 
 	guidtype = &offer->offer.if_type;
 	guidinstance = &offer->offer.if_instance;
 
-	DPRINT_INFO(VMBUS, "Channel offer notification - "
-		    "child relid %d monitor id %d allocated %d, "
-		    "type {%02x%02x%02x%02x-%02x%02x-%02x%02x-"
-		    "%02x%02x%02x%02x%02x%02x%02x%02x} "
-		    "instance {%02x%02x%02x%02x-%02x%02x-%02x%02x-"
-		    "%02x%02x%02x%02x%02x%02x%02x%02x}",
-		    offer->child_relid, offer->monitorid,
-		    offer->monitor_allocated,
-		    guidtype->data[3], guidtype->data[2],
-		    guidtype->data[1], guidtype->data[0],
-		    guidtype->data[5], guidtype->data[4],
-		    guidtype->data[7], guidtype->data[6],
-		    guidtype->data[8], guidtype->data[9],
-		    guidtype->data[10], guidtype->data[11],
-		    guidtype->data[12], guidtype->data[13],
-		    guidtype->data[14], guidtype->data[15],
-		    guidinstance->data[3], guidinstance->data[2],
-		    guidinstance->data[1], guidinstance->data[0],
-		    guidinstance->data[5], guidinstance->data[4],
-		    guidinstance->data[7], guidinstance->data[6],
-		    guidinstance->data[8], guidinstance->data[9],
-		    guidinstance->data[10], guidinstance->data[11],
-		    guidinstance->data[12], guidinstance->data[13],
-		    guidinstance->data[14], guidinstance->data[15]);
-
 	/* Allocate the channel object and save this offer. */
 	newchannel = alloc_channel();
 	if (!newchannel) {
-		DPRINT_ERR(VMBUS, "unable to allocate channel object");
+		pr_err("Unable to allocate channel object\n");
 		return;
 	}
 
-	DPRINT_DBG(VMBUS, "channel object allocated - %p", newchannel);
-
 	memcpy(&newchannel->offermsg, offer,
 	       sizeof(struct vmbus_channel_offer_channel));
 	newchannel->monitor_grp = (u8)offer->monitorid / 32;
@@ -535,11 +500,10 @@
 
 	rescind = (struct vmbus_channel_rescind_offer *)hdr;
 	channel = relid2channel(rescind->child_relid);
-	if (channel == NULL) {
-		DPRINT_DBG(VMBUS, "channel not found for relId %d",
-			   rescind->child_relid);
+
+	if (channel == NULL)
+		/* Just return here, no channel found */
 		return;
-	}
 
 	/* work is initialized for vmbus_process_rescind_offer() from
 	 * vmbus_process_offer() where the channel got created */
@@ -573,7 +537,6 @@
 	unsigned long flags;
 
 	result = (struct vmbus_channel_open_result *)hdr;
-	DPRINT_DBG(VMBUS, "vmbus open result - %d", result->status);
 
 	/*
 	 * Find the open msg, copy the result and signal/unblock the wait event
@@ -618,8 +581,6 @@
 	unsigned long flags;
 
 	gpadlcreated = (struct vmbus_channel_gpadl_created *)hdr;
-	DPRINT_DBG(VMBUS, "vmbus gpadl created result - %d",
-		   gpadlcreated->creation_status);
 
 	/*
 	 * Find the establish msg, copy the result and signal/unblock the wait
@@ -770,11 +731,8 @@
 	hdr = (struct vmbus_channel_message_header *)msg->u.payload;
 	size = msg->header.payload_size;
 
-	DPRINT_DBG(VMBUS, "message type %d size %d", hdr->msgtype, size);
-
 	if (hdr->msgtype >= CHANNELMSG_COUNT) {
-		DPRINT_ERR(VMBUS,
-			   "Received invalid channel message type %d size %d",
+		pr_err("Received invalid channel message type %d size %d\n",
 			   hdr->msgtype, size);
 		print_hex_dump_bytes("", DUMP_PREFIX_NONE,
 				     (unsigned char *)msg->u.payload, size);
@@ -784,8 +742,7 @@
 	if (gChannelMessageTable[hdr->msgtype].messageHandler)
 		gChannelMessageTable[hdr->msgtype].messageHandler(hdr);
 	else
-		DPRINT_ERR(VMBUS, "Unhandled channel message type %d",
-			   hdr->msgtype);
+		pr_err("Unhandled channel message type %d\n", hdr->msgtype);
 }
 
 /*
@@ -813,7 +770,7 @@
 	ret = vmbus_post_msg(msg,
 			       sizeof(struct vmbus_channel_message_header));
 	if (ret != 0) {
-		DPRINT_ERR(VMBUS, "Unable to request offers - %d", ret);
+		pr_err("Unable to request offers - %d\n", ret);
 
 		goto cleanup;
 	}
@@ -853,9 +810,8 @@
 
 		if (!channel->device_obj->drv) {
 			list_del(&channel->listentry);
-			DPRINT_INFO(VMBUS,
-				    "Releasing unattached device object %p",
-				    channel->device_obj);
+
+			pr_err("Releasing unattached device object\n");
 
 			vmbus_child_device_unregister(channel->device_obj);
 			free_channel(channel);
diff --git a/drivers/staging/hv/connection.c b/drivers/staging/hv/connection.c
index afc8116..4f411a9 100644
--- a/drivers/staging/hv/connection.c
+++ b/drivers/staging/hv/connection.c
@@ -20,6 +20,8 @@
  *   Hank Janssen  <hjanssen@microsoft.com>
  *
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/wait.h>
@@ -121,11 +123,6 @@
 
 	spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
 
-	DPRINT_DBG(VMBUS, "Vmbus connection - interrupt pfn %llx, "
-		   "monitor1 pfn %llx,, monitor2 pfn %llx",
-		   msg->interrupt_page, msg->monitor_page1, msg->monitor_page2);
-
-	DPRINT_DBG(VMBUS, "Sending channel initiate msg...");
 	ret = vmbus_post_msg(msg,
 			       sizeof(struct vmbus_channel_initiate_contact));
 	if (ret != 0) {
@@ -156,13 +153,11 @@
 
 	/* Check if successful */
 	if (msginfo->response.version_response.version_supported) {
-		DPRINT_INFO(VMBUS, "Vmbus connected!!");
 		vmbus_connection.conn_state = CONNECTED;
-
 	} else {
-		DPRINT_ERR(VMBUS, "Vmbus connection failed!!..."
-			   "current version (%d) not supported",
-			   VMBUS_REVISION_NUMBER);
+		pr_err("Unable to connect, "
+			"Version %d not supported by Hyper-V\n",
+			VMBUS_REVISION_NUMBER);
 		ret = -1;
 		goto Cleanup;
 	}
@@ -223,7 +218,7 @@
 
 	vmbus_connection.conn_state = DISCONNECTED;
 
-	DPRINT_INFO(VMBUS, "Vmbus disconnected!!");
+	pr_info("hv_vmbus disconnected\n");
 
 Cleanup:
 	kfree(msg);
@@ -255,10 +250,9 @@
 /*
  * process_chn_event - Process a channel event notification
  */
-static void process_chn_event(void *context)
+static void process_chn_event(u32 relid)
 {
 	struct vmbus_channel *channel;
-	u32 relid = (u32)(unsigned long)context;
 
 	/* ASSERT(relId > 0); */
 
@@ -276,7 +270,7 @@
 		 *			  (void*)channel);
 		 */
 	} else {
-		DPRINT_ERR(VMBUS, "channel not found for relid - %d.", relid);
+		pr_err("channel not found for relid - %u\n", relid);
 	}
 }
 
@@ -285,39 +279,30 @@
  */
 void vmbus_on_event(unsigned long data)
 {
-	int dword;
-	int maxdword = MAX_NUM_CHANNELS_SUPPORTED >> 5;
+	u32 dword;
+	u32 maxdword = MAX_NUM_CHANNELS_SUPPORTED >> 5;
 	int bit;
-	int relid;
+	u32 relid;
 	u32 *recv_int_page = vmbus_connection.recv_int_page;
 
 	/* Check events */
-	if (recv_int_page) {
-		for (dword = 0; dword < maxdword; dword++) {
-			if (recv_int_page[dword]) {
-				for (bit = 0; bit < 32; bit++) {
-					if (sync_test_and_clear_bit(bit,
-						(unsigned long *)
-						&recv_int_page[dword])) {
-						relid = (dword << 5) + bit;
-						DPRINT_DBG(VMBUS, "event detected for relid - %d", relid);
+	if (!recv_int_page)
+		return;
+	for (dword = 0; dword < maxdword; dword++) {
+		if (!recv_int_page[dword])
+			continue;
+		for (bit = 0; bit < 32; bit++) {
+			if (sync_test_and_clear_bit(bit, (unsigned long *)&recv_int_page[dword])) {
+				relid = (dword << 5) + bit;
 
-						if (relid == 0) {
-							/* special case - vmbus channel protocol msg */
-							DPRINT_DBG(VMBUS, "invalid relid - %d", relid);
-							continue;
-						} else {
-							/* QueueWorkItem(VmbusProcessEvent, (void*)relid); */
-							/* ret = WorkQueueQueueWorkItem(gVmbusConnection.workQueue, VmbusProcessChannelEvent, (void*)relid); */
-						process_chn_event((void *)
-						(unsigned long)relid);
-						}
-					}
+				if (relid == 0) {
+					/* special case - vmbus channel protocol msg */
+					continue;
 				}
+				process_chn_event(relid);
 			}
-		 }
+		}
 	}
-	return;
 }
 
 /*
diff --git a/drivers/staging/hv/hv.c b/drivers/staging/hv/hv.c
index 0b06f4f..e6312bd4 100644
--- a/drivers/staging/hv/hv.c
+++ b/drivers/staging/hv/hv.c
@@ -19,6 +19,8 @@
  *   Hank Janssen  <hjanssen@microsoft.com>
  *
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/slab.h>
@@ -80,7 +82,7 @@
 	op = HVCPUID_VENDOR_MAXFUNCTION;
 	cpuid(op, &eax, &ebx, &ecx, &edx);
 
-	DPRINT_INFO(VMBUS, "Vendor ID: %c%c%c%c%c%c%c%c%c%c%c%c",
+/*	DPRINT_INFO(VMBUS, "Vendor ID: %c%c%c%c%c%c%c%c%c%c%c%c",
 		    (ebx & 0xFF),
 		    ((ebx >> 8) & 0xFF),
 		    ((ebx >> 16) & 0xFF),
@@ -93,9 +95,9 @@
 		    ((edx >> 8) & 0xFF),
 		    ((edx >> 16) & 0xFF),
 		    ((edx >> 24) & 0xFF));
-
+*/
 	max_leaf = eax;
-	eax = 0;
+/*	eax = 0;
 	ebx = 0;
 	ecx = 0;
 	edx = 0;
@@ -107,6 +109,7 @@
 		    ((eax >> 8) & 0xFF),
 		    ((eax >> 16) & 0xFF),
 		    ((eax >> 24) & 0xFF));
+*/
 
 	if (max_leaf >= HVCPUID_VERSION) {
 		eax = 0;
@@ -115,7 +118,7 @@
 		edx = 0;
 		op = HVCPUID_VERSION;
 		cpuid(op, &eax, &ebx, &ecx, &edx);
-		DPRINT_INFO(VMBUS, "OS Build:%d-%d.%d-%d-%d.%d",\
+		pr_info("Hyper-V Host OS Build:%d-%d.%d-%d-%d.%d\n",
 			    eax,
 			    ebx >> 16,
 			    ebx & 0xFFFF,
@@ -137,18 +140,11 @@
 	u64 output_address = (output) ? virt_to_phys(output) : 0;
 	volatile void *hypercall_page = hv_context.hypercall_page;
 
-	DPRINT_DBG(VMBUS, "Hypercall <control %llx input phys %llx virt %p "
-		   "output phys %llx virt %p hypercall %p>",
-		   control, input_address, input,
-		   output_address, output, hypercall_page);
-
 	__asm__ __volatile__("mov %0, %%r8" : : "r" (output_address) : "r8");
 	__asm__ __volatile__("call *%3" : "=a" (hv_status) :
 			     "c" (control), "d" (input_address),
 			     "m" (hypercall_page));
 
-	DPRINT_DBG(VMBUS, "Hypercall <return %llx>",  hv_status);
-
 	return hv_status;
 
 #else
@@ -165,18 +161,12 @@
 	u32 output_address_lo = output_address & 0xFFFFFFFF;
 	volatile void *hypercall_page = hv_context.hypercall_page;
 
-	DPRINT_DBG(VMBUS, "Hypercall <control %llx input %p output %p>",
-		   control, input, output);
-
 	__asm__ __volatile__ ("call *%8" : "=d"(hv_status_hi),
 			      "=a"(hv_status_lo) : "d" (control_hi),
 			      "a" (control_lo), "b" (input_address_hi),
 			      "c" (input_address_lo), "D"(output_address_hi),
 			      "S"(output_address_lo), "m" (hypercall_page));
 
-	DPRINT_DBG(VMBUS, "Hypercall <return %llx>",
-		   hv_status_lo | ((u64)hv_status_hi << 32));
-
 	return hv_status_lo | ((u64)hv_status_hi << 32);
 #endif /* !x86_64 */
 }
@@ -197,13 +187,8 @@
 	memset(hv_context.synic_message_page, 0,
 	       sizeof(void *) * MAX_NUM_CPUS);
 
-	if (!query_hypervisor_presence()) {
-		DPRINT_ERR(VMBUS, "No Windows hypervisor detected!!");
+	if (!query_hypervisor_presence())
 		goto Cleanup;
-	}
-
-	DPRINT_INFO(VMBUS,
-		    "Windows hypervisor detected! Retrieving more info...");
 
 	max_leaf = query_hypervisor_info();
 	/* HvQueryHypervisorFeatures(maxLeaf); */
@@ -213,11 +198,8 @@
 	 */
 	rdmsrl(HV_X64_MSR_GUEST_OS_ID, hv_context.guestid);
 
-	if (hv_context.guestid != 0) {
-		DPRINT_ERR(VMBUS, "Unknown guest id (0x%llx)!!",
-				hv_context.guestid);
+	if (hv_context.guestid != 0)
 		goto Cleanup;
-	}
 
 	/* Write our OS info */
 	wrmsrl(HV_X64_MSR_GUEST_OS_ID, HV_LINUX_GUEST_ID);
@@ -232,11 +214,8 @@
 	*/
 	virtaddr = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL_EXEC);
 
-	if (!virtaddr) {
-		DPRINT_ERR(VMBUS,
-			   "unable to allocate hypercall page!!");
+	if (!virtaddr)
 		goto Cleanup;
-	}
 
 	hypercall_msr.enable = 1;
 
@@ -247,17 +226,11 @@
 	hypercall_msr.as_uint64 = 0;
 	rdmsrl(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64);
 
-	if (!hypercall_msr.enable) {
-		DPRINT_ERR(VMBUS, "unable to set hypercall page!!");
+	if (!hypercall_msr.enable)
 		goto Cleanup;
-	}
 
 	hv_context.hypercall_page = virtaddr;
 
-	DPRINT_INFO(VMBUS, "Hypercall page VA=%p, PA=0x%0llx",
-		    hv_context.hypercall_page,
-		    (u64)hypercall_msr.guest_physical_address << PAGE_SHIFT);
-
 	/* Setup the global signal event param for the signal event hypercall */
 	hv_context.signal_event_buffer =
 			kmalloc(sizeof(struct hv_input_signal_event_buffer),
@@ -394,14 +367,11 @@
 	/* Check the version */
 	rdmsrl(HV_X64_MSR_SVERSION, version);
 
-	DPRINT_INFO(VMBUS, "SynIC version: %llx", version);
-
 	hv_context.synic_message_page[cpu] =
 		(void *)get_zeroed_page(GFP_ATOMIC);
 
 	if (hv_context.synic_message_page[cpu] == NULL) {
-		DPRINT_ERR(VMBUS,
-			   "unable to allocate SYNIC message page!!");
+		pr_err("Unable to allocate SYNIC message page\n");
 		goto Cleanup;
 	}
 
@@ -409,8 +379,7 @@
 		(void *)get_zeroed_page(GFP_ATOMIC);
 
 	if (hv_context.synic_event_page[cpu] == NULL) {
-		DPRINT_ERR(VMBUS,
-			   "unable to allocate SYNIC event page!!");
+		pr_err("Unable to allocate SYNIC event page\n");
 		goto Cleanup;
 	}
 
@@ -420,8 +389,6 @@
 	simp.base_simp_gpa = virt_to_phys(hv_context.synic_message_page[cpu])
 		>> PAGE_SHIFT;
 
-	DPRINT_DBG(VMBUS, "HV_X64_MSR_SIMP msr set to: %llx", simp.as_uint64);
-
 	wrmsrl(HV_X64_MSR_SIMP, simp.as_uint64);
 
 	/* Setup the Synic's event page */
@@ -430,8 +397,6 @@
 	siefp.base_siefp_gpa = virt_to_phys(hv_context.synic_event_page[cpu])
 		>> PAGE_SHIFT;
 
-	DPRINT_DBG(VMBUS, "HV_X64_MSR_SIEFP msr set to: %llx", siefp.as_uint64);
-
 	wrmsrl(HV_X64_MSR_SIEFP, siefp.as_uint64);
 
 	/* Setup the interception SINT. */
@@ -446,9 +411,6 @@
 	shared_sint.masked = false;
 	shared_sint.auto_eoi = true;
 
-	DPRINT_DBG(VMBUS, "HV_X64_MSR_SINT1 msr set to: %llx",
-		   shared_sint.as_uint64);
-
 	wrmsrl(HV_X64_MSR_SINT0 + VMBUS_MESSAGE_SINT, shared_sint.as_uint64);
 
 	/* Enable the global synic bit */
diff --git a/drivers/staging/hv/hv_kvp.c b/drivers/staging/hv/hv_kvp.c
index faf692e..c71a148 100644
--- a/drivers/staging/hv/hv_kvp.c
+++ b/drivers/staging/hv/hv_kvp.c
@@ -20,7 +20,7 @@
  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  *
  */
-
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/net.h>
 #include <linux/nls.h>
@@ -114,7 +114,7 @@
 
 	message = (struct hv_ku_msg *)msg->data;
 	if (msg->seq == KVP_REGISTER) {
-		printk(KERN_INFO "KVP: user-mode registering done.\n");
+		pr_info("KVP: user-mode registering done.\n");
 		kvp_register();
 	}
 
@@ -174,7 +174,7 @@
 		/*
 		 * This is a spurious call!
 		 */
-		printk(KERN_WARNING "KVP: Transaction not active\n");
+		pr_warn("KVP: Transaction not active\n");
 		return;
 	}
 	/*
@@ -259,9 +259,6 @@
 	vmbus_recvpacket(channel, recv_buffer, PAGE_SIZE, &recvlen, &requestid);
 
 	if (recvlen > 0) {
-		DPRINT_DBG(VMBUS, "KVP packet: len=%d, requestid=%lld",
-			   recvlen, requestid);
-
 		icmsghdrp = (struct icmsg_hdr *)&recv_buffer[
 			sizeof(struct vmbuspipe_hdr)];
 
diff --git a/drivers/staging/hv/hv_mouse.c b/drivers/staging/hv/hv_mouse.c
index 118c7be225..bd93548 100644
--- a/drivers/staging/hv/hv_mouse.c
+++ b/drivers/staging/hv/hv_mouse.c
@@ -48,7 +48,7 @@
 /* Represents the input vsc driver */
 /* FIXME - can be removed entirely */
 struct mousevsc_drv_obj {
-	struct hv_driver Base;
+	struct hv_driver base;
 };
 
 
@@ -169,23 +169,23 @@
  * Represents an mousevsc device
  */
 struct mousevsc_dev {
-	struct hv_device	*Device;
+	struct hv_device	*device;
 	/* 0 indicates the device is being destroyed */
-	atomic_t		RefCount;
-	int			NumOutstandingRequests;
-	unsigned char		bInitializeComplete;
-	struct mousevsc_prt_msg	ProtocolReq;
-	struct mousevsc_prt_msg	ProtocolResp;
+	atomic_t		ref_count;
+	int			num_outstanding_req;
+	unsigned char		init_complete;
+	struct mousevsc_prt_msg	protocol_req;
+	struct mousevsc_prt_msg	protocol_resp;
 	/* Synchronize the request/response if needed */
-	wait_queue_head_t	ProtocolWaitEvent;
-	wait_queue_head_t	DeviceInfoWaitEvent;
+	wait_queue_head_t	protocol_wait_event;
+	wait_queue_head_t	dev_info_wait_event;
 	int			protocol_wait_condition;
 	int			device_wait_condition;
-	int			DeviceInfoStatus;
+	int			dev_info_status;
 
-	struct hid_descriptor	*HidDesc;
-	unsigned char		*ReportDesc;
-	u32			ReportDescSize;
+	struct hid_descriptor	*hid_desc;
+	unsigned char		*report_desc;
+	u32			report_desc_size;
 	struct hv_input_dev_info hid_dev_info;
 };
 
@@ -202,41 +202,41 @@
 static void inputreport_callback(struct hv_device *dev, void *packet, u32 len);
 static void reportdesc_callback(struct hv_device *dev, void *packet, u32 len);
 
-static struct mousevsc_dev *AllocInputDevice(struct hv_device *Device)
+static struct mousevsc_dev *alloc_input_device(struct hv_device *device)
 {
-	struct mousevsc_dev *inputDevice;
+	struct mousevsc_dev *input_dev;
 
-	inputDevice = kzalloc(sizeof(struct mousevsc_dev), GFP_KERNEL);
+	input_dev = kzalloc(sizeof(struct mousevsc_dev), GFP_KERNEL);
 
-	if (!inputDevice)
+	if (!input_dev)
 		return NULL;
 
 	/*
 	 * Set to 2 to allow both inbound and outbound traffics
-	 * (ie GetInputDevice() and MustGetInputDevice()) to proceed.
+	 * (ie get_input_device() and must_get_input_device()) to proceed.
 	 */
-	atomic_cmpxchg(&inputDevice->RefCount, 0, 2);
+	atomic_cmpxchg(&input_dev->ref_count, 0, 2);
 
-	inputDevice->Device = Device;
-	Device->ext = inputDevice;
+	input_dev->device = device;
+	device->ext = input_dev;
 
-	return inputDevice;
+	return input_dev;
 }
 
-static void FreeInputDevice(struct mousevsc_dev *Device)
+static void free_input_device(struct mousevsc_dev *device)
 {
-	WARN_ON(atomic_read(&Device->RefCount) == 0);
-	kfree(Device);
+	WARN_ON(atomic_read(&device->ref_count) == 0);
+	kfree(device);
 }
 
 /*
  * Get the inputdevice object if exists and its refcount > 1
  */
-static struct mousevsc_dev *GetInputDevice(struct hv_device *Device)
+static struct mousevsc_dev *get_input_device(struct hv_device *device)
 {
-	struct mousevsc_dev *inputDevice;
+	struct mousevsc_dev *input_dev;
 
-	inputDevice = (struct mousevsc_dev *)Device->ext;
+	input_dev = (struct mousevsc_dev *)device->ext;
 
 /*
  *	FIXME
@@ -244,134 +244,137 @@
  *	what the intention is...
  *
  *	printk(KERN_ERR "-------------------------> REFCOUNT = %d",
- *	       inputDevice->RefCount);
+ *	       input_dev->ref_count);
  */
 
-	if (inputDevice && atomic_read(&inputDevice->RefCount) > 1)
-		atomic_inc(&inputDevice->RefCount);
+	if (input_dev && atomic_read(&input_dev->ref_count) > 1)
+		atomic_inc(&input_dev->ref_count);
 	else
-		inputDevice = NULL;
+		input_dev = NULL;
 
-	return inputDevice;
+	return input_dev;
 }
 
 /*
  * Get the inputdevice object iff exists and its refcount > 0
  */
-static struct mousevsc_dev *MustGetInputDevice(struct hv_device *Device)
+static struct mousevsc_dev *must_get_input_device(struct hv_device *device)
 {
-	struct mousevsc_dev *inputDevice;
+	struct mousevsc_dev *input_dev;
 
-	inputDevice = (struct mousevsc_dev *)Device->ext;
+	input_dev = (struct mousevsc_dev *)device->ext;
 
-	if (inputDevice && atomic_read(&inputDevice->RefCount))
-		atomic_inc(&inputDevice->RefCount);
+	if (input_dev && atomic_read(&input_dev->ref_count))
+		atomic_inc(&input_dev->ref_count);
 	else
-		inputDevice = NULL;
+		input_dev = NULL;
 
-	return inputDevice;
+	return input_dev;
 }
 
-static void PutInputDevice(struct hv_device *Device)
+static void put_input_device(struct hv_device *device)
 {
-	struct mousevsc_dev *inputDevice;
+	struct mousevsc_dev *input_dev;
 
-	inputDevice = (struct mousevsc_dev *)Device->ext;
+	input_dev = (struct mousevsc_dev *)device->ext;
 
-	atomic_dec(&inputDevice->RefCount);
+	atomic_dec(&input_dev->ref_count);
 }
 
 /*
- * Drop ref count to 1 to effectively disable GetInputDevice()
+ * Drop ref count to 1 to effectively disable get_input_device()
  */
-static struct mousevsc_dev *ReleaseInputDevice(struct hv_device *Device)
+static struct mousevsc_dev *release_input_device(struct hv_device *device)
 {
-	struct mousevsc_dev *inputDevice;
+	struct mousevsc_dev *input_dev;
 
-	inputDevice = (struct mousevsc_dev *)Device->ext;
+	input_dev = (struct mousevsc_dev *)device->ext;
 
 	/* Busy wait until the ref drop to 2, then set it to 1  */
-	while (atomic_cmpxchg(&inputDevice->RefCount, 2, 1) != 2)
+	while (atomic_cmpxchg(&input_dev->ref_count, 2, 1) != 2)
 		udelay(100);
 
-	return inputDevice;
+	return input_dev;
 }
 
 /*
- * Drop ref count to 0. No one can use InputDevice object.
+ * Drop ref count to 0. No one can use input_device object.
  */
-static struct mousevsc_dev *FinalReleaseInputDevice(struct hv_device *Device)
+static struct mousevsc_dev *final_release_input_device(struct hv_device *device)
 {
-	struct mousevsc_dev *inputDevice;
+	struct mousevsc_dev *input_dev;
 
-	inputDevice = (struct mousevsc_dev *)Device->ext;
+	input_dev = (struct mousevsc_dev *)device->ext;
 
 	/* Busy wait until the ref drop to 1, then set it to 0  */
-	while (atomic_cmpxchg(&inputDevice->RefCount, 1, 0) != 1)
+	while (atomic_cmpxchg(&input_dev->ref_count, 1, 0) != 1)
 		udelay(100);
 
-	Device->ext = NULL;
-	return inputDevice;
+	device->ext = NULL;
+	return input_dev;
 }
 
-static void MousevscOnSendCompletion(struct hv_device *Device, struct vmpacket_descriptor *Packet)
+static void mousevsc_on_send_completion(struct hv_device *device,
+					struct vmpacket_descriptor *packet)
 {
-	struct mousevsc_dev *inputDevice;
+	struct mousevsc_dev *input_dev;
 	void *request;
 
-	inputDevice = MustGetInputDevice(Device);
-	if (!inputDevice) {
+	input_dev = must_get_input_device(device);
+	if (!input_dev) {
 		pr_err("unable to get input device...device being destroyed?");
 		return;
 	}
 
-	request = (void *)(unsigned long)Packet->trans_id;
+	request = (void *)(unsigned long)packet->trans_id;
 
-	if (request == &inputDevice->ProtocolReq) {
+	if (request == &input_dev->protocol_req) {
 		/* FIXME */
 		/* Shouldn't we be doing something here? */
 	}
 
-	PutInputDevice(Device);
+	put_input_device(device);
 }
 
-static void MousevscOnReceiveDeviceInfo(struct mousevsc_dev *InputDevice, struct synthhid_device_info *DeviceInfo)
+static void mousevsc_on_receive_device_info(struct mousevsc_dev *input_device,
+				struct synthhid_device_info *device_info)
 {
 	int ret = 0;
 	struct hid_descriptor *desc;
 	struct mousevsc_prt_msg ack;
 
 	/* Assume success for now */
-	InputDevice->DeviceInfoStatus = 0;
+	input_device->dev_info_status = 0;
 
 	/* Save the device attr */
-	memcpy(&InputDevice->hid_dev_info, &DeviceInfo->hid_dev_info, sizeof(struct hv_input_dev_info));
+	memcpy(&input_device->hid_dev_info, &device_info->hid_dev_info,
+		sizeof(struct hv_input_dev_info));
 
 	/* Save the hid desc */
-	desc = &DeviceInfo->hid_descriptor;
+	desc = &device_info->hid_descriptor;
 	WARN_ON(desc->bLength > 0);
 
-	InputDevice->HidDesc = kzalloc(desc->bLength, GFP_KERNEL);
+	input_device->hid_desc = kzalloc(desc->bLength, GFP_KERNEL);
 
-	if (!InputDevice->HidDesc) {
+	if (!input_device->hid_desc) {
 		pr_err("unable to allocate hid descriptor - size %d", desc->bLength);
 		goto Cleanup;
 	}
 
-	memcpy(InputDevice->HidDesc, desc, desc->bLength);
+	memcpy(input_device->hid_desc, desc, desc->bLength);
 
 	/* Save the report desc */
-	InputDevice->ReportDescSize = desc->desc[0].wDescriptorLength;
-	InputDevice->ReportDesc = kzalloc(InputDevice->ReportDescSize,
+	input_device->report_desc_size = desc->desc[0].wDescriptorLength;
+	input_device->report_desc = kzalloc(input_device->report_desc_size,
 					  GFP_KERNEL);
 
-	if (!InputDevice->ReportDesc) {
+	if (!input_device->report_desc) {
 		pr_err("unable to allocate report descriptor - size %d",
-			   InputDevice->ReportDescSize);
+			   input_device->report_desc_size);
 		goto Cleanup;
 	}
 
-	memcpy(InputDevice->ReportDesc,
+	memcpy(input_device->report_desc,
 	       ((unsigned char *)desc) + desc->bLength,
 	       desc->desc[0].wDescriptorLength);
 
@@ -385,7 +388,7 @@
 	ack.ack.header.size = 1;
 	ack.ack.reserved = 0;
 
-	ret = vmbus_sendpacket(InputDevice->Device->channel,
+	ret = vmbus_sendpacket(input_device->device->channel,
 			&ack,
 			sizeof(struct pipe_prt_msg) - sizeof(unsigned char) +
 			sizeof(struct synthhid_device_info_ack),
@@ -398,138 +401,143 @@
 		goto Cleanup;
 	}
 
-	InputDevice->device_wait_condition = 1;
-	wake_up(&InputDevice->DeviceInfoWaitEvent);
+	input_device->device_wait_condition = 1;
+	wake_up(&input_device->dev_info_wait_event);
 
 	return;
 
 Cleanup:
-	kfree(InputDevice->HidDesc);
-	InputDevice->HidDesc = NULL;
+	kfree(input_device->hid_desc);
+	input_device->hid_desc = NULL;
 
-	kfree(InputDevice->ReportDesc);
-	InputDevice->ReportDesc = NULL;
+	kfree(input_device->report_desc);
+	input_device->report_desc = NULL;
 
-	InputDevice->DeviceInfoStatus = -1;
-	InputDevice->device_wait_condition = 1;
-	wake_up(&InputDevice->DeviceInfoWaitEvent);
+	input_device->dev_info_status = -1;
+	input_device->device_wait_condition = 1;
+	wake_up(&input_device->dev_info_wait_event);
 }
 
-static void MousevscOnReceiveInputReport(struct mousevsc_dev *InputDevice, struct synthhid_input_report *InputReport)
+static void mousevsc_on_receive_input_report(struct mousevsc_dev *input_device,
+				struct synthhid_input_report *input_report)
 {
-	struct mousevsc_drv_obj *inputDriver;
+	struct mousevsc_drv_obj *input_drv;
 
-	if (!InputDevice->bInitializeComplete) {
-		pr_info("Initialization incomplete...ignoring InputReport msg");
+	if (!input_device->init_complete) {
+		pr_info("Initialization incomplete...ignoring input_report msg");
 		return;
 	}
 
-	inputDriver = (struct mousevsc_drv_obj *)InputDevice->Device->drv;
+	input_drv = (struct mousevsc_drv_obj *)input_device->device->drv;
 
-	inputreport_callback(InputDevice->Device,
-			     InputReport->buffer,
-			     InputReport->header.size);
+	inputreport_callback(input_device->device,
+			     input_report->buffer,
+			     input_report->header.size);
 }
 
-static void MousevscOnReceive(struct hv_device *Device, struct vmpacket_descriptor *Packet)
+static void mousevsc_on_receive(struct hv_device *device,
+				struct vmpacket_descriptor *packet)
 {
-	struct pipe_prt_msg *pipeMsg;
-	struct synthhid_msg *hidMsg;
-	struct mousevsc_dev *inputDevice;
+	struct pipe_prt_msg *pipe_msg;
+	struct synthhid_msg *hid_msg;
+	struct mousevsc_dev *input_dev;
 
-	inputDevice = MustGetInputDevice(Device);
-	if (!inputDevice) {
+	input_dev = must_get_input_device(device);
+	if (!input_dev) {
 		pr_err("unable to get input device...device being destroyed?");
 		return;
 	}
 
-	pipeMsg = (struct pipe_prt_msg *)((unsigned long)Packet + (Packet->offset8 << 3));
+	pipe_msg = (struct pipe_prt_msg *)((unsigned long)packet +
+						(packet->offset8 << 3));
 
-	if (pipeMsg->type != PipeMessageData) {
+	if (pipe_msg->type != PipeMessageData) {
 		pr_err("unknown pipe msg type - type %d len %d",
-			   pipeMsg->type, pipeMsg->size);
-		PutInputDevice(Device);
+			   pipe_msg->type, pipe_msg->size);
+		put_input_device(device);
 		return ;
 	}
 
-	hidMsg = (struct synthhid_msg *)&pipeMsg->data[0];
+	hid_msg = (struct synthhid_msg *)&pipe_msg->data[0];
 
-	switch (hidMsg->header.type) {
+	switch (hid_msg->header.type) {
 	case SynthHidProtocolResponse:
-		memcpy(&inputDevice->ProtocolResp, pipeMsg,
-		       pipeMsg->size + sizeof(struct pipe_prt_msg) -
+		memcpy(&input_dev->protocol_resp, pipe_msg,
+		       pipe_msg->size + sizeof(struct pipe_prt_msg) -
 		       sizeof(unsigned char));
-		inputDevice->protocol_wait_condition = 1;
-		wake_up(&inputDevice->ProtocolWaitEvent);
+		input_dev->protocol_wait_condition = 1;
+		wake_up(&input_dev->protocol_wait_event);
 		break;
 
 	case SynthHidInitialDeviceInfo:
-		WARN_ON(pipeMsg->size >= sizeof(struct hv_input_dev_info));
+		WARN_ON(pipe_msg->size >= sizeof(struct hv_input_dev_info));
 
 		/*
 		 * Parse out the device info into device attr,
 		 * hid desc and report desc
 		 */
-		MousevscOnReceiveDeviceInfo(inputDevice,
-					    (struct synthhid_device_info *)&pipeMsg->data[0]);
+		mousevsc_on_receive_device_info(input_dev,
+			(struct synthhid_device_info *)&pipe_msg->data[0]);
 		break;
 	case SynthHidInputReport:
-		MousevscOnReceiveInputReport(inputDevice,
-					     (struct synthhid_input_report *)&pipeMsg->data[0]);
+		mousevsc_on_receive_input_report(input_dev,
+			(struct synthhid_input_report *)&pipe_msg->data[0]);
 
 		break;
 	default:
 		pr_err("unsupported hid msg type - type %d len %d",
-		       hidMsg->header.type, hidMsg->header.size);
+		       hid_msg->header.type, hid_msg->header.size);
 		break;
 	}
 
-	PutInputDevice(Device);
+	put_input_device(device);
 }
 
-static void MousevscOnChannelCallback(void *Context)
+static void mousevsc_on_channel_callback(void *context)
 {
 	const int packetSize = 0x100;
 	int ret = 0;
-	struct hv_device *device = (struct hv_device *)Context;
-	struct mousevsc_dev *inputDevice;
+	struct hv_device *device = (struct hv_device *)context;
+	struct mousevsc_dev *input_dev;
 
-	u32 bytesRecvd;
-	u64 requestId;
+	u32 bytes_recvd;
+	u64 req_id;
 	unsigned char packet[packetSize];
 	struct vmpacket_descriptor *desc;
 	unsigned char	*buffer = packet;
 	int	bufferlen = packetSize;
 
-	inputDevice = MustGetInputDevice(device);
+	input_dev = must_get_input_device(device);
 
-	if (!inputDevice) {
+	if (!input_dev) {
 		pr_err("unable to get input device...device being destroyed?");
 		return;
 	}
 
 	do {
-		ret = vmbus_recvpacket_raw(device->channel, buffer, bufferlen, &bytesRecvd, &requestId);
+		ret = vmbus_recvpacket_raw(device->channel, buffer,
+					bufferlen, &bytes_recvd, &req_id);
 
 		if (ret == 0) {
-			if (bytesRecvd > 0) {
+			if (bytes_recvd > 0) {
 				desc = (struct vmpacket_descriptor *)buffer;
 
 				switch (desc->type) {
 					case VM_PKT_COMP:
-						MousevscOnSendCompletion(device,
-									 desc);
+						mousevsc_on_send_completion(
+							device, desc);
 						break;
 
 					case VM_PKT_DATA_INBAND:
-						MousevscOnReceive(device, desc);
+						mousevsc_on_receive(
+							device, desc);
 						break;
 
 					default:
 						pr_err("unhandled packet type %d, tid %llx len %d\n",
 							   desc->type,
-							   requestId,
-							   bytesRecvd);
+							   req_id,
+							   bytes_recvd);
 						break;
 				}
 
@@ -555,8 +563,8 @@
 			}
 		} else if (ret == -2) {
 			/* Handle large packet */
-			bufferlen = bytesRecvd;
-			buffer = kzalloc(bytesRecvd, GFP_KERNEL);
+			bufferlen = bytes_recvd;
+			buffer = kzalloc(bytes_recvd, GFP_KERNEL);
 
 			if (buffer == NULL) {
 				buffer = packet;
@@ -564,35 +572,35 @@
 
 				/* Try again next time around */
 				pr_err("unable to allocate buffer of size %d!",
-				       bytesRecvd);
+				       bytes_recvd);
 				break;
 			}
 		}
 	} while (1);
 
-	PutInputDevice(device);
+	put_input_device(device);
 
 	return;
 }
 
-static int MousevscConnectToVsp(struct hv_device *Device)
+static int mousevsc_connect_to_vsp(struct hv_device *device)
 {
 	int ret = 0;
-	struct mousevsc_dev *inputDevice;
+	struct mousevsc_dev *input_dev;
 	struct mousevsc_prt_msg *request;
 	struct mousevsc_prt_msg *response;
 
-	inputDevice = GetInputDevice(Device);
+	input_dev = get_input_device(device);
 
-	if (!inputDevice) {
+	if (!input_dev) {
 		pr_err("unable to get input device...device being destroyed?");
 		return -1;
 	}
 
-	init_waitqueue_head(&inputDevice->ProtocolWaitEvent);
-	init_waitqueue_head(&inputDevice->DeviceInfoWaitEvent);
+	init_waitqueue_head(&input_dev->protocol_wait_event);
+	init_waitqueue_head(&input_dev->dev_info_wait_event);
 
-	request = &inputDevice->ProtocolReq;
+	request = &input_dev->protocol_req;
 
 	/*
 	 * Now, initiate the vsc/vsp initialization protocol on the open channel
@@ -608,7 +616,7 @@
 
 	pr_info("synthhid protocol request...");
 
-	ret = vmbus_sendpacket(Device->channel, request,
+	ret = vmbus_sendpacket(device->channel, request,
 					sizeof(struct pipe_prt_msg) -
 					sizeof(unsigned char) +
 					sizeof(struct synthhid_protocol_request),
@@ -620,14 +628,15 @@
 		goto Cleanup;
 	}
 
-	inputDevice->protocol_wait_condition = 0;
-	wait_event_timeout(inputDevice->ProtocolWaitEvent, inputDevice->protocol_wait_condition, msecs_to_jiffies(1000));
-	if (inputDevice->protocol_wait_condition == 0) {
+	input_dev->protocol_wait_condition = 0;
+	wait_event_timeout(input_dev->protocol_wait_event,
+		input_dev->protocol_wait_condition, msecs_to_jiffies(1000));
+	if (input_dev->protocol_wait_condition == 0) {
 		ret = -ETIMEDOUT;
 		goto Cleanup;
 	}
 
-	response = &inputDevice->ProtocolResp;
+	response = &input_dev->protocol_resp;
 
 	if (!response->response.approved) {
 		pr_err("synthhid protocol request failed (version %d)",
@@ -636,9 +645,10 @@
 		goto Cleanup;
 	}
 
-	inputDevice->device_wait_condition = 0;
-	wait_event_timeout(inputDevice->DeviceInfoWaitEvent, inputDevice->device_wait_condition, msecs_to_jiffies(1000));
-	if (inputDevice->device_wait_condition == 0) {
+	input_dev->device_wait_condition = 0;
+	wait_event_timeout(input_dev->dev_info_wait_event,
+		input_dev->device_wait_condition, msecs_to_jiffies(1000));
+	if (input_dev->device_wait_condition == 0) {
 		ret = -ETIMEDOUT;
 		goto Cleanup;
 	}
@@ -647,94 +657,95 @@
 	 * We should have gotten the device attr, hid desc and report
 	 * desc at this point
 	 */
-	if (!inputDevice->DeviceInfoStatus)
+	if (!input_dev->dev_info_status)
 		pr_info("**** input channel up and running!! ****");
 	else
 		ret = -1;
 
 Cleanup:
-	PutInputDevice(Device);
+	put_input_device(device);
 
 	return ret;
 }
 
-static int MousevscOnDeviceAdd(struct hv_device *Device, void *AdditionalInfo)
+static int mousevsc_on_device_add(struct hv_device *device,
+					void *additional_info)
 {
 	int ret = 0;
-	struct mousevsc_dev *inputDevice;
-	struct mousevsc_drv_obj *inputDriver;
+	struct mousevsc_dev *input_dev;
+	struct mousevsc_drv_obj *input_drv;
 	struct hv_input_dev_info dev_info;
 
-	inputDevice = AllocInputDevice(Device);
+	input_dev = alloc_input_device(device);
 
-	if (!inputDevice) {
+	if (!input_dev) {
 		ret = -1;
 		goto Cleanup;
 	}
 
-	inputDevice->bInitializeComplete = false;
+	input_dev->init_complete = false;
 
 	/* Open the channel */
-	ret = vmbus_open(Device->channel,
+	ret = vmbus_open(device->channel,
 		INPUTVSC_SEND_RING_BUFFER_SIZE,
 		INPUTVSC_RECV_RING_BUFFER_SIZE,
 		NULL,
 		0,
-		MousevscOnChannelCallback,
-		Device
+		mousevsc_on_channel_callback,
+		device
 		);
 
 	if (ret != 0) {
 		pr_err("unable to open channel: %d", ret);
-		FreeInputDevice(inputDevice);
+		free_input_device(input_dev);
 		return -1;
 	}
 
 	pr_info("InputVsc channel open: %d", ret);
 
-	ret = MousevscConnectToVsp(Device);
+	ret = mousevsc_connect_to_vsp(device);
 
 	if (ret != 0) {
 		pr_err("unable to connect channel: %d", ret);
 
-		vmbus_close(Device->channel);
-		FreeInputDevice(inputDevice);
+		vmbus_close(device->channel);
+		free_input_device(input_dev);
 		return ret;
 	}
 
-	inputDriver = (struct mousevsc_drv_obj *)inputDevice->Device->drv;
+	input_drv = (struct mousevsc_drv_obj *)input_dev->device->drv;
 
-	dev_info.vendor = inputDevice->hid_dev_info.vendor;
-	dev_info.product = inputDevice->hid_dev_info.product;
-	dev_info.version = inputDevice->hid_dev_info.version;
+	dev_info.vendor = input_dev->hid_dev_info.vendor;
+	dev_info.product = input_dev->hid_dev_info.product;
+	dev_info.version = input_dev->hid_dev_info.version;
 	strcpy(dev_info.name, "Microsoft Vmbus HID-compliant Mouse");
 
 	/* Send the device info back up */
-	deviceinfo_callback(Device, &dev_info);
+	deviceinfo_callback(device, &dev_info);
 
 	/* Send the report desc back up */
 	/* workaround SA-167 */
-	if (inputDevice->ReportDesc[14] == 0x25)
-		inputDevice->ReportDesc[14] = 0x29;
+	if (input_dev->report_desc[14] == 0x25)
+		input_dev->report_desc[14] = 0x29;
 
-	reportdesc_callback(Device, inputDevice->ReportDesc,
-			    inputDevice->ReportDescSize);
+	reportdesc_callback(device, input_dev->report_desc,
+			    input_dev->report_desc_size);
 
-	inputDevice->bInitializeComplete = true;
+	input_dev->init_complete = true;
 
 Cleanup:
 	return ret;
 }
 
-static int MousevscOnDeviceRemove(struct hv_device *Device)
+static int mousevsc_on_device_remove(struct hv_device *device)
 {
-	struct mousevsc_dev *inputDevice;
+	struct mousevsc_dev *input_dev;
 	int ret = 0;
 
 	pr_info("disabling input device (%p)...",
-		    Device->ext);
+		    device->ext);
 
-	inputDevice = ReleaseInputDevice(Device);
+	input_dev = release_input_device(device);
 
 
 	/*
@@ -743,27 +754,28 @@
 	 *
 	 * so that outstanding requests can be completed.
 	 */
-	while (inputDevice->NumOutstandingRequests) {
-		pr_info("waiting for %d requests to complete...", inputDevice->NumOutstandingRequests);
+	while (input_dev->num_outstanding_req) {
+		pr_info("waiting for %d requests to complete...",
+			input_dev->num_outstanding_req);
 
 		udelay(100);
 	}
 
-	pr_info("removing input device (%p)...", Device->ext);
+	pr_info("removing input device (%p)...", device->ext);
 
-	inputDevice = FinalReleaseInputDevice(Device);
+	input_dev = final_release_input_device(device);
 
-	pr_info("input device (%p) safe to remove", inputDevice);
+	pr_info("input device (%p) safe to remove", input_dev);
 
 	/* Close the channel */
-	vmbus_close(Device->channel);
+	vmbus_close(device->channel);
 
-	FreeInputDevice(inputDevice);
+	free_input_device(input_dev);
 
 	return ret;
 }
 
-static void MousevscOnCleanup(struct hv_driver *drv)
+static void mousevsc_on_cleanup(struct hv_driver *drv)
 {
 }
 
@@ -830,7 +842,7 @@
 	dev_set_drvdata(device, input_dev_ctx);
 
 	/* Call to the vsc driver to add the device */
-	ret = mousevsc_drv_obj->Base.dev_add(device_obj, NULL);
+	ret = mousevsc_drv_obj->base.dev_add(device_obj, NULL);
 
 	if (ret != 0) {
 		DPRINT_ERR(INPUTVSC_DRV, "unable to add input vsc device");
@@ -862,14 +874,14 @@
 		input_dev_ctx->connected = 0;
 	}
 
-	if (!mousevsc_drv_obj->Base.dev_rm)
+	if (!mousevsc_drv_obj->base.dev_rm)
 		return -1;
 
 	/*
 	 * Call to the vsc driver to let it know that the device
 	 * is being removed
 	 */
-	ret = mousevsc_drv_obj->Base.dev_rm(device_obj);
+	ret = mousevsc_drv_obj->base.dev_rm(device_obj);
 
 	if (ret != 0) {
 		DPRINT_ERR(INPUTVSC_DRV,
@@ -945,7 +957,7 @@
 static void mousevsc_drv_exit(void)
 {
 	struct mousevsc_drv_obj *mousevsc_drv_obj = &g_mousevsc_drv;
-	struct hv_driver *drv = &g_mousevsc_drv.Base;
+	struct hv_driver *drv = &g_mousevsc_drv.base;
 	int ret;
 
 	struct device *current_dev = NULL;
@@ -967,28 +979,28 @@
 		device_unregister(current_dev);
 	}
 
-	if (mousevsc_drv_obj->Base.cleanup)
-		mousevsc_drv_obj->Base.cleanup(&mousevsc_drv_obj->Base);
+	if (mousevsc_drv_obj->base.cleanup)
+		mousevsc_drv_obj->base.cleanup(&mousevsc_drv_obj->base);
 
 	vmbus_child_driver_unregister(&drv->driver);
 
 	return;
 }
 
-static int mouse_vsc_initialize(struct hv_driver *Driver)
+static int mouse_vsc_initialize(struct hv_driver *driver)
 {
-	struct mousevsc_drv_obj *inputDriver =
-		(struct mousevsc_drv_obj *)Driver;
+	struct mousevsc_drv_obj *input_drv =
+		(struct mousevsc_drv_obj *)driver;
 	int ret = 0;
 
-	Driver->name = driver_name;
-	memcpy(&Driver->dev_type, &mouse_guid,
+	driver->name = driver_name;
+	memcpy(&driver->dev_type, &mouse_guid,
 	       sizeof(struct hv_guid));
 
 	/* Setup the dispatch table */
-	inputDriver->Base.dev_add = MousevscOnDeviceAdd;
-	inputDriver->Base.dev_rm = MousevscOnDeviceRemove;
-	inputDriver->Base.cleanup = MousevscOnCleanup;
+	input_drv->base.dev_add = mousevsc_on_device_add;
+	input_drv->base.dev_rm = mousevsc_on_device_remove;
+	input_drv->base.cleanup = mousevsc_on_cleanup;
 
 	return ret;
 }
@@ -997,14 +1009,14 @@
 static int __init mousevsc_init(void)
 {
 	struct mousevsc_drv_obj *input_drv_obj = &g_mousevsc_drv;
-	struct hv_driver *drv = &g_mousevsc_drv.Base;
+	struct hv_driver *drv = &g_mousevsc_drv.base;
 
 	DPRINT_INFO(INPUTVSC_DRV, "Hyper-V Mouse driver initializing.");
 
 	/* Callback to client driver to complete the initialization */
-	mouse_vsc_initialize(&input_drv_obj->Base);
+	mouse_vsc_initialize(&input_drv_obj->base);
 
-	drv->driver.name = input_drv_obj->Base.name;
+	drv->driver.name = input_drv_obj->base.name;
 	drv->priv = input_drv_obj;
 
 	drv->driver.probe = mousevsc_probe;
diff --git a/drivers/staging/hv/hv_timesource.c b/drivers/staging/hv/hv_timesource.c
index a7ee5333..0efb049 100644
--- a/drivers/staging/hv/hv_timesource.c
+++ b/drivers/staging/hv/hv_timesource.c
@@ -20,6 +20,7 @@
  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  *
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/version.h>
 #include <linux/clocksource.h>
@@ -91,7 +92,7 @@
 	if (!dmi_check_system(hv_timesource_dmi_table))
 		return -ENODEV;
 
-	printk(KERN_INFO "Registering HyperV clock source\n");
+	pr_info("Registering HyperV clock source\n");
 	return clocksource_register(&hyperv_cs);
 }
 
diff --git a/drivers/staging/hv/hv_util.c b/drivers/staging/hv/hv_util.c
index 2df1568..8038589 100644
--- a/drivers/staging/hv/hv_util.c
+++ b/drivers/staging/hv/hv_util.c
@@ -18,6 +18,8 @@
  *   Haiyang Zhang <haiyangz@microsoft.com>
  *   Hank Janssen  <hjanssen@microsoft.com>
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/module.h>
@@ -59,9 +61,6 @@
 			 PAGE_SIZE, &recvlen, &requestid);
 
 	if (recvlen > 0) {
-		DPRINT_DBG(VMBUS, "shutdown packet: len=%d, requestid=%lld",
-			   recvlen, requestid);
-
 		icmsghdrp = (struct icmsg_hdr *)&shut_txf_buf[
 			sizeof(struct vmbuspipe_hdr)];
 
@@ -79,15 +78,15 @@
 				icmsghdrp->status = HV_S_OK;
 				execute_shutdown = true;
 
-				DPRINT_INFO(VMBUS, "Shutdown request received -"
-					    " graceful shutdown initiated");
+				pr_info("Shutdown request received -"
+					    " graceful shutdown initiated\n");
 				break;
 			default:
 				icmsghdrp->status = HV_E_FAIL;
 				execute_shutdown = false;
 
-				DPRINT_INFO(VMBUS, "Shutdown request received -"
-					    " Invalid request");
+				pr_info("Shutdown request received -"
+					    " Invalid request\n");
 				break;
 			};
 		}
@@ -159,9 +158,6 @@
 			 PAGE_SIZE, &recvlen, &requestid);
 
 	if (recvlen > 0) {
-		DPRINT_DBG(VMBUS, "timesync packet: recvlen=%d, requestid=%lld",
-			recvlen, requestid);
-
 		icmsghdrp = (struct icmsg_hdr *)&time_txf_buf[
 				sizeof(struct vmbuspipe_hdr)];
 
@@ -200,9 +196,6 @@
 			 PAGE_SIZE, &recvlen, &requestid);
 
 	if (recvlen > 0) {
-		DPRINT_DBG(VMBUS, "heartbeat packet: len=%d, requestid=%lld",
-			   recvlen, requestid);
-
 		icmsghdrp = (struct icmsg_hdr *)&hbeat_txf_buf[
 				sizeof(struct vmbuspipe_hdr)];
 
@@ -214,9 +207,6 @@
 					sizeof(struct vmbuspipe_hdr) +
 					sizeof(struct icmsg_hdr)];
 
-			DPRINT_DBG(VMBUS, "heartbeat seq = %lld",
-				   heartbeat_msg->seq_num);
-
 			heartbeat_msg->seq_num += 1;
 		}
 
@@ -254,7 +244,7 @@
 
 static int __init init_hyperv_utils(void)
 {
-	printk(KERN_INFO "Registering HyperV Utility Driver\n");
+	pr_info("Registering HyperV Utility Driver\n");
 
 	if (hv_kvp_init())
 		return -ENODEV;
@@ -268,8 +258,7 @@
 	hbeat_txf_buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
 
 	if (!shut_txf_buf || !time_txf_buf || !hbeat_txf_buf) {
-		printk(KERN_INFO
-		       "Unable to allocate memory for receive buffer\n");
+		pr_info("Unable to allocate memory for receive buffer\n");
 		kfree(shut_txf_buf);
 		kfree(time_txf_buf);
 		kfree(hbeat_txf_buf);
@@ -298,7 +287,7 @@
 
 static void exit_hyperv_utils(void)
 {
-	printk(KERN_INFO "De-Registered HyperV Utility Driver\n");
+	pr_info("De-Registered HyperV Utility Driver\n");
 
 	hv_cb_utils[HV_SHUTDOWN_MSG].channel->onchannel_callback =
 		&chn_cb_negotiate;
diff --git a/drivers/staging/hv/netvsc.c b/drivers/staging/hv/netvsc.c
index 20b15977..b3e64978 100644
--- a/drivers/staging/hv/netvsc.c
+++ b/drivers/staging/hv/netvsc.c
@@ -18,6 +18,8 @@
  *   Haiyang Zhang <haiyangz@microsoft.com>
  *   Hank Janssen  <hjanssen@microsoft.com>
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/wait.h>
@@ -43,38 +45,6 @@
 	}
 };
 
-static int netvsc_device_add(struct hv_device *device, void *additional_info);
-
-static int netvsc_device_remove(struct hv_device *device);
-
-static void netvsc_cleanup(struct hv_driver *driver);
-
-static void netvsc_channel_cb(void *context);
-
-static int netvsc_init_send_buf(struct hv_device *device);
-
-static int netvsc_init_recv_buf(struct hv_device *device);
-
-static int netvsc_destroy_send_buf(struct netvsc_device *net_device);
-
-static int netvsc_destroy_recv_buf(struct netvsc_device *net_device);
-
-static int netvsc_connect_vsp(struct hv_device *device);
-
-static void netvsc_send_completion(struct hv_device *device,
-				   struct vmpacket_descriptor *packet);
-
-static int netvsc_send(struct hv_device *device,
-			struct hv_netvsc_packet *packet);
-
-static void netvsc_receive(struct hv_device *device,
-			    struct vmpacket_descriptor *packet);
-
-static void netvsc_receive_completion(void *context);
-
-static void netvsc_send_recv_completion(struct hv_device *device,
-					u64 transaction_id);
-
 
 static struct netvsc_device *alloc_net_device(struct hv_device *device)
 {
@@ -171,32 +141,73 @@
 	return net_device;
 }
 
-/*
- * netvsc_initialize - Main entry point
- */
-int netvsc_initialize(struct hv_driver *drv)
+static int netvsc_destroy_recv_buf(struct netvsc_device *net_device)
 {
-	struct netvsc_driver *driver = (struct netvsc_driver *)drv;
+	struct nvsp_message *revoke_packet;
+	int ret = 0;
 
-	DPRINT_DBG(NETVSC, "sizeof(struct hv_netvsc_packet)=%zd, "
-		   "sizeof(struct nvsp_message)=%zd, "
-		   "sizeof(struct vmtransfer_page_packet_header)=%zd",
-		   sizeof(struct hv_netvsc_packet),
-		   sizeof(struct nvsp_message),
-		   sizeof(struct vmtransfer_page_packet_header));
+	/*
+	 * If we got a section count, it means we received a
+	 * SendReceiveBufferComplete msg (ie sent
+	 * NvspMessage1TypeSendReceiveBuffer msg) therefore, we need
+	 * to send a revoke msg here
+	 */
+	if (net_device->recv_section_cnt) {
+		/* Send the revoke receive buffer */
+		revoke_packet = &net_device->revoke_packet;
+		memset(revoke_packet, 0, sizeof(struct nvsp_message));
 
-	drv->name = driver_name;
-	memcpy(&drv->dev_type, &netvsc_device_type, sizeof(struct hv_guid));
+		revoke_packet->hdr.msg_type =
+			NVSP_MSG1_TYPE_REVOKE_RECV_BUF;
+		revoke_packet->msg.v1_msg.
+		revoke_recv_buf.id = NETVSC_RECEIVE_BUFFER_ID;
 
-	/* Setup the dispatch table */
-	driver->base.dev_add	= netvsc_device_add;
-	driver->base.dev_rm	= netvsc_device_remove;
-	driver->base.cleanup		= netvsc_cleanup;
+		ret = vmbus_sendpacket(net_device->dev->channel,
+				       revoke_packet,
+				       sizeof(struct nvsp_message),
+				       (unsigned long)revoke_packet,
+				       VM_PKT_DATA_INBAND, 0);
+		/*
+		 * If we failed here, we might as well return and
+		 * have a leak rather than continue and a bugchk
+		 */
+		if (ret != 0) {
+			dev_err(&net_device->dev->device, "unable to send "
+				"revoke receive buffer to netvsp");
+			return -1;
+		}
+	}
 
-	driver->send			= netvsc_send;
+	/* Teardown the gpadl on the vsp end */
+	if (net_device->recv_buf_gpadl_handle) {
+		ret = vmbus_teardown_gpadl(net_device->dev->channel,
+			   net_device->recv_buf_gpadl_handle);
 
-	rndis_filter_init(driver);
-	return 0;
+		/* If we failed here, we might as well return and have a leak
+		 * rather than continue and a bugchk
+		 */
+		if (ret != 0) {
+			dev_err(&net_device->dev->device,
+				   "unable to teardown receive buffer's gpadl");
+			return -1;
+		}
+		net_device->recv_buf_gpadl_handle = 0;
+	}
+
+	if (net_device->recv_buf) {
+		/* Free up the receive buffer */
+		free_pages((unsigned long)net_device->recv_buf,
+			get_order(net_device->recv_buf_size));
+		net_device->recv_buf = NULL;
+	}
+
+	if (net_device->recv_section) {
+		net_device->recv_section_cnt = 0;
+		kfree(net_device->recv_section);
+		net_device->recv_section = NULL;
+	}
+
+	return ret;
 }
 
 static int netvsc_init_recv_buf(struct hv_device *device)
@@ -207,7 +218,7 @@
 
 	net_device = get_outbound_net_device(device);
 	if (!net_device) {
-		DPRINT_ERR(NETVSC, "unable to get net device..."
+		dev_err(&device->device, "unable to get net device..."
 			   "device being destroyed?");
 		return -1;
 	}
@@ -216,15 +227,12 @@
 		(void *)__get_free_pages(GFP_KERNEL|__GFP_ZERO,
 				get_order(net_device->recv_buf_size));
 	if (!net_device->recv_buf) {
-		DPRINT_ERR(NETVSC,
-			   "unable to allocate receive buffer of size %d",
-			   net_device->recv_buf_size);
+		dev_err(&device->device, "unable to allocate receive "
+			"buffer of size %d", net_device->recv_buf_size);
 		ret = -1;
 		goto cleanup;
 	}
 
-	DPRINT_INFO(NETVSC, "Establishing receive buffer's GPADL...");
-
 	/*
 	 * Establish the gpadl handle for this buffer on this
 	 * channel.  Note: This call uses the vmbus connection rather
@@ -234,15 +242,13 @@
 				    net_device->recv_buf_size,
 				    &net_device->recv_buf_gpadl_handle);
 	if (ret != 0) {
-		DPRINT_ERR(NETVSC,
-			   "unable to establish receive buffer's gpadl");
+		dev_err(&device->device,
+			"unable to establish receive buffer's gpadl");
 		goto cleanup;
 	}
 
 
 	/* Notify the NetVsp of the gpadl handle */
-	DPRINT_INFO(NETVSC, "Sending NvspMessage1TypeSendReceiveBuffer...");
-
 	init_packet = &net_device->channel_init_pkt;
 
 	memset(init_packet, 0, sizeof(struct nvsp_message));
@@ -261,8 +267,8 @@
 			       VM_PKT_DATA_INBAND,
 			       VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);
 	if (ret != 0) {
-		DPRINT_ERR(NETVSC,
-			   "unable to send receive buffer's gpadl to netvsp");
+		dev_err(&device->device,
+			"unable to send receive buffer's gpadl to netvsp");
 		goto cleanup;
 	}
 
@@ -275,7 +281,7 @@
 	/* Check the response */
 	if (init_packet->msg.v1_msg.
 	    send_recv_buf_complete.status != NVSP_STAT_SUCCESS) {
-		DPRINT_ERR(NETVSC, "Unable to complete receive buffer "
+		dev_err(&device->device, "Unable to complete receive buffer "
 			   "initialzation with NetVsp - status %d",
 			   init_packet->msg.v1_msg.
 			   send_recv_buf_complete.status);
@@ -301,14 +307,6 @@
 		net_device->recv_section_cnt *
 	       sizeof(struct nvsp_1_receive_buffer_section));
 
-	DPRINT_INFO(NETVSC, "Receive sections info (count %d, offset %d, "
-		    "endoffset %d, suballoc size %d, num suballocs %d)",
-		    net_device->recv_section_cnt,
-		    net_device->recv_section[0].offset,
-		    net_device->recv_section[0].end_offset,
-		    net_device->recv_section[0].sub_alloc_size,
-		    net_device->recv_section[0].num_sub_allocs);
-
 	/*
 	 * For 1st release, there should only be 1 section that represents the
 	 * entire receive buffer
@@ -329,6 +327,70 @@
 	return ret;
 }
 
+static int netvsc_destroy_send_buf(struct netvsc_device *net_device)
+{
+	struct nvsp_message *revoke_packet;
+	int ret = 0;
+
+	/*
+	 * If we got a section count, it means we received a
+	 *  SendReceiveBufferComplete msg (ie sent
+	 *  NvspMessage1TypeSendReceiveBuffer msg) therefore, we need
+	 *  to send a revoke msg here
+	 */
+	if (net_device->send_section_size) {
+		/* Send the revoke send buffer */
+		revoke_packet = &net_device->revoke_packet;
+		memset(revoke_packet, 0, sizeof(struct nvsp_message));
+
+		revoke_packet->hdr.msg_type =
+			NVSP_MSG1_TYPE_REVOKE_SEND_BUF;
+		revoke_packet->msg.v1_msg.
+			revoke_send_buf.id = NETVSC_SEND_BUFFER_ID;
+
+		ret = vmbus_sendpacket(net_device->dev->channel,
+				       revoke_packet,
+				       sizeof(struct nvsp_message),
+				       (unsigned long)revoke_packet,
+				       VM_PKT_DATA_INBAND, 0);
+		/*
+		 * If we failed here, we might as well return and have a leak
+		 * rather than continue and a bugchk
+		 */
+		if (ret != 0) {
+			dev_err(&net_device->dev->device, "unable to send "
+				"revoke send buffer to netvsp");
+			return -1;
+		}
+	}
+
+	/* Teardown the gpadl on the vsp end */
+	if (net_device->send_buf_gpadl_handle) {
+		ret = vmbus_teardown_gpadl(net_device->dev->channel,
+					   net_device->send_buf_gpadl_handle);
+
+		/*
+		 * If we failed here, we might as well return and have a leak
+		 * rather than continue and a bugchk
+		 */
+		if (ret != 0) {
+			dev_err(&net_device->dev->device,
+				"unable to teardown send buffer's gpadl");
+			return -1;
+		}
+		net_device->send_buf_gpadl_handle = 0;
+	}
+
+	if (net_device->send_buf) {
+		/* Free up the receive buffer */
+		free_pages((unsigned long)net_device->send_buf,
+				get_order(net_device->send_buf_size));
+		net_device->send_buf = NULL;
+	}
+
+	return ret;
+}
+
 static int netvsc_init_send_buf(struct hv_device *device)
 {
 	int ret = 0;
@@ -337,7 +399,7 @@
 
 	net_device = get_outbound_net_device(device);
 	if (!net_device) {
-		DPRINT_ERR(NETVSC, "unable to get net device..."
+		dev_err(&device->device, "unable to get net device..."
 			   "device being destroyed?");
 		return -1;
 	}
@@ -350,14 +412,12 @@
 		(void *)__get_free_pages(GFP_KERNEL|__GFP_ZERO,
 				get_order(net_device->send_buf_size));
 	if (!net_device->send_buf) {
-		DPRINT_ERR(NETVSC, "unable to allocate send buffer of size %d",
-			   net_device->send_buf_size);
+		dev_err(&device->device, "unable to allocate send "
+			"buffer of size %d", net_device->send_buf_size);
 		ret = -1;
 		goto cleanup;
 	}
 
-	DPRINT_INFO(NETVSC, "Establishing send buffer's GPADL...");
-
 	/*
 	 * Establish the gpadl handle for this buffer on this
 	 * channel.  Note: This call uses the vmbus connection rather
@@ -367,13 +427,11 @@
 				    net_device->send_buf_size,
 				    &net_device->send_buf_gpadl_handle);
 	if (ret != 0) {
-		DPRINT_ERR(NETVSC, "unable to establish send buffer's gpadl");
+		dev_err(&device->device, "unable to establish send buffer's gpadl");
 		goto cleanup;
 	}
 
 	/* Notify the NetVsp of the gpadl handle */
-	DPRINT_INFO(NETVSC, "Sending NvspMessage1TypeSendSendBuffer...");
-
 	init_packet = &net_device->channel_init_pkt;
 
 	memset(init_packet, 0, sizeof(struct nvsp_message));
@@ -392,7 +450,7 @@
 			       VM_PKT_DATA_INBAND,
 			       VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);
 	if (ret != 0) {
-		DPRINT_ERR(NETVSC,
+		dev_err(&device->device,
 			   "unable to send receive buffer's gpadl to netvsp");
 		goto cleanup;
 	}
@@ -405,7 +463,7 @@
 	/* Check the response */
 	if (init_packet->msg.v1_msg.
 	    send_send_buf_complete.status != NVSP_STAT_SUCCESS) {
-		DPRINT_ERR(NETVSC, "Unable to complete send buffer "
+		dev_err(&device->device, "Unable to complete send buffer "
 			   "initialzation with NetVsp - status %d",
 			   init_packet->msg.v1_msg.
 			   send_send_buf_complete.status);
@@ -426,150 +484,6 @@
 	return ret;
 }
 
-static int netvsc_destroy_recv_buf(struct netvsc_device *net_device)
-{
-	struct nvsp_message *revoke_packet;
-	int ret = 0;
-
-	/*
-	 * If we got a section count, it means we received a
-	 * SendReceiveBufferComplete msg (ie sent
-	 * NvspMessage1TypeSendReceiveBuffer msg) therefore, we need
-	 * to send a revoke msg here
-	 */
-	if (net_device->recv_section_cnt) {
-		DPRINT_INFO(NETVSC,
-			    "Sending NvspMessage1TypeRevokeReceiveBuffer...");
-
-		/* Send the revoke receive buffer */
-		revoke_packet = &net_device->revoke_packet;
-		memset(revoke_packet, 0, sizeof(struct nvsp_message));
-
-		revoke_packet->hdr.msg_type =
-			NVSP_MSG1_TYPE_REVOKE_RECV_BUF;
-		revoke_packet->msg.v1_msg.
-		revoke_recv_buf.id = NETVSC_RECEIVE_BUFFER_ID;
-
-		ret = vmbus_sendpacket(net_device->dev->channel,
-				       revoke_packet,
-				       sizeof(struct nvsp_message),
-				       (unsigned long)revoke_packet,
-				       VM_PKT_DATA_INBAND, 0);
-		/*
-		 * If we failed here, we might as well return and
-		 * have a leak rather than continue and a bugchk
-		 */
-		if (ret != 0) {
-			DPRINT_ERR(NETVSC, "unable to send revoke receive "
-				   "buffer to netvsp");
-			return -1;
-		}
-	}
-
-	/* Teardown the gpadl on the vsp end */
-	if (net_device->recv_buf_gpadl_handle) {
-		DPRINT_INFO(NETVSC, "Tearing down receive buffer's GPADL...");
-
-		ret = vmbus_teardown_gpadl(net_device->dev->channel,
-			   net_device->recv_buf_gpadl_handle);
-
-		/* If we failed here, we might as well return and have a leak rather than continue and a bugchk */
-		if (ret != 0) {
-			DPRINT_ERR(NETVSC,
-				   "unable to teardown receive buffer's gpadl");
-			return -1;
-		}
-		net_device->recv_buf_gpadl_handle = 0;
-	}
-
-	if (net_device->recv_buf) {
-		DPRINT_INFO(NETVSC, "Freeing up receive buffer...");
-
-		/* Free up the receive buffer */
-		free_pages((unsigned long)net_device->recv_buf,
-			get_order(net_device->recv_buf_size));
-		net_device->recv_buf = NULL;
-	}
-
-	if (net_device->recv_section) {
-		net_device->recv_section_cnt = 0;
-		kfree(net_device->recv_section);
-		net_device->recv_section = NULL;
-	}
-
-	return ret;
-}
-
-static int netvsc_destroy_send_buf(struct netvsc_device *net_device)
-{
-	struct nvsp_message *revoke_packet;
-	int ret = 0;
-
-	/*
-	 * If we got a section count, it means we received a
-	 *  SendReceiveBufferComplete msg (ie sent
-	 *  NvspMessage1TypeSendReceiveBuffer msg) therefore, we need
-	 *  to send a revoke msg here
-	 */
-	if (net_device->send_section_size) {
-		DPRINT_INFO(NETVSC,
-			    "Sending NvspMessage1TypeRevokeSendBuffer...");
-
-		/* Send the revoke send buffer */
-		revoke_packet = &net_device->revoke_packet;
-		memset(revoke_packet, 0, sizeof(struct nvsp_message));
-
-		revoke_packet->hdr.msg_type =
-			NVSP_MSG1_TYPE_REVOKE_SEND_BUF;
-		revoke_packet->msg.v1_msg.
-			revoke_send_buf.id = NETVSC_SEND_BUFFER_ID;
-
-		ret = vmbus_sendpacket(net_device->dev->channel,
-				       revoke_packet,
-				       sizeof(struct nvsp_message),
-				       (unsigned long)revoke_packet,
-				       VM_PKT_DATA_INBAND, 0);
-		/*
-		 * If we failed here, we might as well return and have a leak
-		 * rather than continue and a bugchk
-		 */
-		if (ret != 0) {
-			DPRINT_ERR(NETVSC, "unable to send revoke send buffer "
-				   "to netvsp");
-			return -1;
-		}
-	}
-
-	/* Teardown the gpadl on the vsp end */
-	if (net_device->send_buf_gpadl_handle) {
-		DPRINT_INFO(NETVSC, "Tearing down send buffer's GPADL...");
-		ret = vmbus_teardown_gpadl(net_device->dev->channel,
-					   net_device->send_buf_gpadl_handle);
-
-		/*
-		 * If we failed here, we might as well return and have a leak
-		 * rather than continue and a bugchk
-		 */
-		if (ret != 0) {
-			DPRINT_ERR(NETVSC, "unable to teardown send buffer's "
-				   "gpadl");
-			return -1;
-		}
-		net_device->send_buf_gpadl_handle = 0;
-	}
-
-	if (net_device->send_buf) {
-		DPRINT_INFO(NETVSC, "Freeing up send buffer...");
-
-		/* Free up the receive buffer */
-		free_pages((unsigned long)net_device->send_buf,
-				get_order(net_device->send_buf_size));
-		net_device->send_buf = NULL;
-	}
-
-	return ret;
-}
-
 
 static int netvsc_connect_vsp(struct hv_device *device)
 {
@@ -580,7 +494,7 @@
 
 	net_device = get_outbound_net_device(device);
 	if (!net_device) {
-		DPRINT_ERR(NETVSC, "unable to get net device..."
+		dev_err(&device->device, "unable to get net device..."
 			   "device being destroyed?");
 		return -1;
 	}
@@ -594,8 +508,6 @@
 	init_packet->msg.init_msg.init.max_protocol_ver =
 		NVSP_MAX_PROTOCOL_VERSION;
 
-	DPRINT_INFO(NETVSC, "Sending NvspMessageTypeInit...");
-
 	/* Send the init request */
 	net_device->wait_condition = 0;
 	ret = vmbus_sendpacket(device->channel, init_packet,
@@ -604,10 +516,8 @@
 			       VM_PKT_DATA_INBAND,
 			       VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);
 
-	if (ret != 0) {
-		DPRINT_ERR(NETVSC, "unable to send NvspMessageTypeInit");
+	if (ret != 0)
 		goto cleanup;
-	}
 
 	wait_event_timeout(net_device->channel_init_wait,
 			net_device->wait_condition,
@@ -617,31 +527,17 @@
 		goto cleanup;
 	}
 
-	DPRINT_INFO(NETVSC, "NvspMessageTypeInit status(%d) max mdl chain (%d)",
-		init_packet->msg.init_msg.init_complete.status,
-		init_packet->msg.init_msg.
-		    init_complete.max_mdl_chain_len);
-
 	if (init_packet->msg.init_msg.init_complete.status !=
 	    NVSP_STAT_SUCCESS) {
-		DPRINT_ERR(NETVSC,
-			"unable to initialize with netvsp (status 0x%x)",
-			init_packet->msg.init_msg.init_complete.status);
 		ret = -1;
 		goto cleanup;
 	}
 
 	if (init_packet->msg.init_msg.init_complete.
 	    negotiated_protocol_ver != NVSP_PROTOCOL_VERSION_1) {
-		DPRINT_ERR(NETVSC, "unable to initialize with netvsp "
-			   "(version expected 1 got %d)",
-			   init_packet->msg.init_msg.
-			   init_complete.negotiated_protocol_ver);
 		ret = -1;
 		goto cleanup;
 	}
-	DPRINT_INFO(NETVSC, "Sending NvspMessage1TypeSendNdisVersion...");
-
 	/* Send the ndis version */
 	memset(init_packet, 0, sizeof(struct nvsp_message));
 
@@ -661,8 +557,6 @@
 				(unsigned long)init_packet,
 				VM_PKT_DATA_INBAND, 0);
 	if (ret != 0) {
-		DPRINT_ERR(NETVSC,
-			   "unable to send NvspMessage1TypeSendNdisVersion");
 		ret = -1;
 		goto cleanup;
 	}
@@ -677,107 +571,13 @@
 	return ret;
 }
 
-static void NetVscDisconnectFromVsp(struct netvsc_device *net_device)
+static void netvsc_disconnect_vsp(struct netvsc_device *net_device)
 {
 	netvsc_destroy_recv_buf(net_device);
 	netvsc_destroy_send_buf(net_device);
 }
 
 /*
- * netvsc_device_add - Callback when the device belonging to this
- * driver is added
- */
-static int netvsc_device_add(struct hv_device *device, void *additional_info)
-{
-	int ret = 0;
-	int i;
-	struct netvsc_device *net_device;
-	struct hv_netvsc_packet *packet, *pos;
-	struct netvsc_driver *net_driver =
-				(struct netvsc_driver *)device->drv;
-
-	net_device = alloc_net_device(device);
-	if (!net_device) {
-		ret = -1;
-		goto cleanup;
-	}
-
-	DPRINT_DBG(NETVSC, "netvsc channel object allocated - %p", net_device);
-
-	/* Initialize the NetVSC channel extension */
-	net_device->recv_buf_size = NETVSC_RECEIVE_BUFFER_SIZE;
-	spin_lock_init(&net_device->recv_pkt_list_lock);
-
-	net_device->send_buf_size = NETVSC_SEND_BUFFER_SIZE;
-
-	INIT_LIST_HEAD(&net_device->recv_pkt_list);
-
-	for (i = 0; i < NETVSC_RECEIVE_PACKETLIST_COUNT; i++) {
-		packet = kzalloc(sizeof(struct hv_netvsc_packet) +
-				 (NETVSC_RECEIVE_SG_COUNT *
-				  sizeof(struct hv_page_buffer)), GFP_KERNEL);
-		if (!packet) {
-			DPRINT_DBG(NETVSC, "unable to allocate netvsc pkts "
-				   "for receive pool (wanted %d got %d)",
-				   NETVSC_RECEIVE_PACKETLIST_COUNT, i);
-			break;
-		}
-		list_add_tail(&packet->list_ent,
-			      &net_device->recv_pkt_list);
-	}
-	init_waitqueue_head(&net_device->channel_init_wait);
-
-	/* Open the channel */
-	ret = vmbus_open(device->channel, net_driver->ring_buf_size,
-			 net_driver->ring_buf_size, NULL, 0,
-			 netvsc_channel_cb, device);
-
-	if (ret != 0) {
-		DPRINT_ERR(NETVSC, "unable to open channel: %d", ret);
-		ret = -1;
-		goto cleanup;
-	}
-
-	/* Channel is opened */
-	DPRINT_INFO(NETVSC, "*** NetVSC channel opened successfully! ***");
-
-	/* Connect with the NetVsp */
-	ret = netvsc_connect_vsp(device);
-	if (ret != 0) {
-		DPRINT_ERR(NETVSC, "unable to connect to NetVSP - %d", ret);
-		ret = -1;
-		goto close;
-	}
-
-	DPRINT_INFO(NETVSC, "*** NetVSC channel handshake result - %d ***",
-		    ret);
-
-	return ret;
-
-close:
-	/* Now, we can close the channel safely */
-	vmbus_close(device->channel);
-
-cleanup:
-
-	if (net_device) {
-		list_for_each_entry_safe(packet, pos,
-					 &net_device->recv_pkt_list,
-					 list_ent) {
-			list_del(&packet->list_ent);
-			kfree(packet);
-		}
-
-		release_outbound_net_device(device);
-		release_inbound_net_device(device);
-
-		free_net_device(net_device);
-	}
-
-	return ret;
-}
-
-/*
  * netvsc_device_remove - Callback when the root bus device is removed
  */
 static int netvsc_device_remove(struct hv_device *device)
@@ -785,35 +585,28 @@
 	struct netvsc_device *net_device;
 	struct hv_netvsc_packet *netvsc_packet, *pos;
 
-	DPRINT_INFO(NETVSC, "Disabling outbound traffic on net device (%p)...",
-		    device->ext);
-
 	/* Stop outbound traffic ie sends and receives completions */
 	net_device = release_outbound_net_device(device);
 	if (!net_device) {
-		DPRINT_ERR(NETVSC, "No net device present!!");
+		dev_err(&device->device, "No net device present!!");
 		return -1;
 	}
 
 	/* Wait for all send completions */
 	while (atomic_read(&net_device->num_outstanding_sends)) {
-		DPRINT_INFO(NETVSC, "waiting for %d requests to complete...",
-			    atomic_read(&net_device->num_outstanding_sends));
+		dev_err(&device->device,
+			"waiting for %d requests to complete...",
+			atomic_read(&net_device->num_outstanding_sends));
 		udelay(100);
 	}
 
-	DPRINT_INFO(NETVSC, "Disconnecting from netvsp...");
-
-	NetVscDisconnectFromVsp(net_device);
-
-	DPRINT_INFO(NETVSC, "Disabling inbound traffic on net device (%p)...",
-		    device->ext);
+	netvsc_disconnect_vsp(net_device);
 
 	/* Stop inbound traffic ie receives and sends completions */
 	net_device = release_inbound_net_device(device);
 
 	/* At this point, no one should be accessing netDevice except in here */
-	DPRINT_INFO(NETVSC, "net device (%p) safe to remove", net_device);
+	dev_notice(&device->device, "net device safe to remove");
 
 	/* Now, we can close the channel safely */
 	vmbus_close(device->channel);
@@ -845,7 +638,7 @@
 
 	net_device = get_inbound_net_device(device);
 	if (!net_device) {
-		DPRINT_ERR(NETVSC, "unable to get net device..."
+		dev_err(&device->device, "unable to get net device..."
 			   "device being destroyed?");
 		return;
 	}
@@ -853,9 +646,6 @@
 	nvsp_packet = (struct nvsp_message *)((unsigned long)packet +
 			(packet->offset8 << 3));
 
-	DPRINT_DBG(NETVSC, "send completion packet - type %d",
-		   nvsp_packet->hdr.msg_type);
-
 	if ((nvsp_packet->hdr.msg_type == NVSP_MSG_TYPE_INIT_COMPLETE) ||
 	    (nvsp_packet->hdr.msg_type ==
 	     NVSP_MSG1_TYPE_SEND_RECV_BUF_COMPLETE) ||
@@ -878,7 +668,7 @@
 
 		atomic_dec(&net_device->num_outstanding_sends);
 	} else {
-		DPRINT_ERR(NETVSC, "Unknown send completion packet type - "
+		dev_err(&device->device, "Unknown send completion packet type- "
 			   "%d received!!", nvsp_packet->hdr.msg_type);
 	}
 
@@ -895,7 +685,7 @@
 
 	net_device = get_outbound_net_device(device);
 	if (!net_device) {
-		DPRINT_ERR(NETVSC, "net device (%p) shutting down..."
+		dev_err(&device->device, "net device (%p) shutting down..."
 			   "ignoring outbound packets", net_device);
 		return -2;
 	}
@@ -931,7 +721,7 @@
 	}
 
 	if (ret != 0)
-		DPRINT_ERR(NETVSC, "Unable to send packet %p ret %d",
+		dev_err(&device->device, "Unable to send packet %p ret %d",
 			   packet, ret);
 
 	atomic_inc(&net_device->num_outstanding_sends);
@@ -939,6 +729,98 @@
 	return ret;
 }
 
+static void netvsc_send_recv_completion(struct hv_device *device,
+					u64 transaction_id)
+{
+	struct nvsp_message recvcompMessage;
+	int retries = 0;
+	int ret;
+
+	recvcompMessage.hdr.msg_type =
+				NVSP_MSG1_TYPE_SEND_RNDIS_PKT_COMPLETE;
+
+	/* FIXME: Pass in the status */
+	recvcompMessage.msg.v1_msg.send_rndis_pkt_complete.status =
+		NVSP_STAT_SUCCESS;
+
+retry_send_cmplt:
+	/* Send the completion */
+	ret = vmbus_sendpacket(device->channel, &recvcompMessage,
+			       sizeof(struct nvsp_message), transaction_id,
+			       VM_PKT_COMP, 0);
+	if (ret == 0) {
+		/* success */
+		/* no-op */
+	} else if (ret == -1) {
+		/* no more room...wait a bit and attempt to retry 3 times */
+		retries++;
+		dev_err(&device->device, "unable to send receive completion pkt"
+			" (tid %llx)...retrying %d", transaction_id, retries);
+
+		if (retries < 4) {
+			udelay(100);
+			goto retry_send_cmplt;
+		} else {
+			dev_err(&device->device, "unable to send receive "
+				"completion pkt (tid %llx)...give up retrying",
+				transaction_id);
+		}
+	} else {
+		dev_err(&device->device, "unable to send receive "
+			"completion pkt - %llx", transaction_id);
+	}
+}
+
+/* Send a receive completion packet to RNDIS device (ie NetVsp) */
+static void netvsc_receive_completion(void *context)
+{
+	struct hv_netvsc_packet *packet = context;
+	struct hv_device *device = (struct hv_device *)packet->device;
+	struct netvsc_device *net_device;
+	u64 transaction_id = 0;
+	bool fsend_receive_comp = false;
+	unsigned long flags;
+
+	/*
+	 * Even though it seems logical to do a GetOutboundNetDevice() here to
+	 * send out receive completion, we are using GetInboundNetDevice()
+	 * since we may have disable outbound traffic already.
+	 */
+	net_device = get_inbound_net_device(device);
+	if (!net_device) {
+		dev_err(&device->device, "unable to get net device..."
+			   "device being destroyed?");
+		return;
+	}
+
+	/* Overloading use of the lock. */
+	spin_lock_irqsave(&net_device->recv_pkt_list_lock, flags);
+
+	packet->xfer_page_pkt->count--;
+
+	/*
+	 * Last one in the line that represent 1 xfer page packet.
+	 * Return the xfer page packet itself to the freelist
+	 */
+	if (packet->xfer_page_pkt->count == 0) {
+		fsend_receive_comp = true;
+		transaction_id = packet->completion.recv.recv_completion_tid;
+		list_add_tail(&packet->xfer_page_pkt->list_ent,
+			      &net_device->recv_pkt_list);
+
+	}
+
+	/* Put the packet back */
+	list_add_tail(&packet->list_ent, &net_device->recv_pkt_list);
+	spin_unlock_irqrestore(&net_device->recv_pkt_list_lock, flags);
+
+	/* Send a receive completion for the xfer page packet */
+	if (fsend_receive_comp)
+		netvsc_send_recv_completion(device, transaction_id);
+
+	put_net_device(device);
+}
+
 static void netvsc_receive(struct hv_device *device,
 			    struct vmpacket_descriptor *packet)
 {
@@ -957,7 +839,7 @@
 
 	net_device = get_inbound_net_device(device);
 	if (!net_device) {
-		DPRINT_ERR(NETVSC, "unable to get net device..."
+		dev_err(&device->device, "unable to get net device..."
 			   "device being destroyed?");
 		return;
 	}
@@ -967,7 +849,7 @@
 	 * packet
 	 */
 	if (packet->type != VM_PKT_DATA_USING_XFER_PAGES) {
-		DPRINT_ERR(NETVSC, "Unknown packet type received - %d",
+		dev_err(&device->device, "Unknown packet type received - %d",
 			   packet->type);
 		put_net_device(device);
 		return;
@@ -979,28 +861,22 @@
 	/* Make sure this is a valid nvsp packet */
 	if (nvsp_packet->hdr.msg_type !=
 	    NVSP_MSG1_TYPE_SEND_RNDIS_PKT) {
-		DPRINT_ERR(NETVSC, "Unknown nvsp packet type received - %d",
-			   nvsp_packet->hdr.msg_type);
+		dev_err(&device->device, "Unknown nvsp packet type received-"
+			" %d", nvsp_packet->hdr.msg_type);
 		put_net_device(device);
 		return;
 	}
 
-	DPRINT_DBG(NETVSC, "NVSP packet received - type %d",
-		   nvsp_packet->hdr.msg_type);
-
 	vmxferpage_packet = (struct vmtransfer_page_packet_header *)packet;
 
 	if (vmxferpage_packet->xfer_pageset_id != NETVSC_RECEIVE_BUFFER_ID) {
-		DPRINT_ERR(NETVSC, "Invalid xfer page set id - "
+		dev_err(&device->device, "Invalid xfer page set id - "
 			   "expecting %x got %x", NETVSC_RECEIVE_BUFFER_ID,
 			   vmxferpage_packet->xfer_pageset_id);
 		put_net_device(device);
 		return;
 	}
 
-	DPRINT_DBG(NETVSC, "xfer page - range count %d",
-		   vmxferpage_packet->range_cnt);
-
 	/*
 	 * Grab free packets (range count + 1) to represent this xfer
 	 * page packet. +1 to represent the xfer page packet itself.
@@ -1021,9 +897,9 @@
 	 * some of the xfer page packet ranges...
 	 */
 	if (count < 2) {
-		DPRINT_ERR(NETVSC, "Got only %d netvsc pkt...needed %d pkts. "
-			   "Dropping this xfer page packet completely!",
-			   count, vmxferpage_packet->range_cnt + 1);
+		dev_err(&device->device, "Got only %d netvsc pkt...needed "
+			"%d pkts. Dropping this xfer page packet completely!",
+			count, vmxferpage_packet->range_cnt + 1);
 
 		/* Return it to the freelist */
 		spin_lock_irqsave(&net_device->recv_pkt_list_lock, flags);
@@ -1049,9 +925,9 @@
 	xferpage_packet->count = count - 1;
 
 	if (xferpage_packet->count != vmxferpage_packet->range_cnt) {
-		DPRINT_INFO(NETVSC, "Needed %d netvsc pkts to satisy this xfer "
-			    "page...got %d", vmxferpage_packet->range_cnt,
-			    xferpage_packet->count);
+		dev_err(&device->device, "Needed %d netvsc pkts to satisy "
+			"this xfer page...got %d",
+			vmxferpage_packet->range_cnt, xferpage_packet->count);
 	}
 
 	/* Each range represents 1 RNDIS pkt that contains 1 ethernet frame */
@@ -1117,13 +993,6 @@
 					break;
 			}
 		}
-		DPRINT_DBG(NETVSC, "[%d] - (abs offset %u len %u) => "
-			   "(pfn %llx, offset %u, len %u)", i,
-			   vmxferpage_packet->ranges[i].byte_offset,
-			   vmxferpage_packet->ranges[i].byte_count,
-			   netvsc_packet->page_buf[0].pfn,
-			   netvsc_packet->page_buf[0].offset,
-			   netvsc_packet->page_buf[0].len);
 
 		/* Pass it to the upper layer */
 		((struct netvsc_driver *)device->drv)->
@@ -1136,101 +1005,6 @@
 	put_net_device(device);
 }
 
-static void netvsc_send_recv_completion(struct hv_device *device,
-					u64 transaction_id)
-{
-	struct nvsp_message recvcompMessage;
-	int retries = 0;
-	int ret;
-
-	DPRINT_DBG(NETVSC, "Sending receive completion pkt - %llx",
-		   transaction_id);
-
-	recvcompMessage.hdr.msg_type =
-				NVSP_MSG1_TYPE_SEND_RNDIS_PKT_COMPLETE;
-
-	/* FIXME: Pass in the status */
-	recvcompMessage.msg.v1_msg.send_rndis_pkt_complete.status =
-		NVSP_STAT_SUCCESS;
-
-retry_send_cmplt:
-	/* Send the completion */
-	ret = vmbus_sendpacket(device->channel, &recvcompMessage,
-			       sizeof(struct nvsp_message), transaction_id,
-			       VM_PKT_COMP, 0);
-	if (ret == 0) {
-		/* success */
-		/* no-op */
-	} else if (ret == -1) {
-		/* no more room...wait a bit and attempt to retry 3 times */
-		retries++;
-		DPRINT_ERR(NETVSC, "unable to send receive completion pkt "
-			   "(tid %llx)...retrying %d", transaction_id, retries);
-
-		if (retries < 4) {
-			udelay(100);
-			goto retry_send_cmplt;
-		} else {
-			DPRINT_ERR(NETVSC, "unable to send receive completion "
-				  "pkt (tid %llx)...give up retrying",
-				  transaction_id);
-		}
-	} else {
-		DPRINT_ERR(NETVSC, "unable to send receive completion pkt - "
-			   "%llx", transaction_id);
-	}
-}
-
-/* Send a receive completion packet to RNDIS device (ie NetVsp) */
-static void netvsc_receive_completion(void *context)
-{
-	struct hv_netvsc_packet *packet = context;
-	struct hv_device *device = (struct hv_device *)packet->device;
-	struct netvsc_device *net_device;
-	u64 transaction_id = 0;
-	bool fsend_receive_comp = false;
-	unsigned long flags;
-
-	/*
-	 * Even though it seems logical to do a GetOutboundNetDevice() here to
-	 * send out receive completion, we are using GetInboundNetDevice()
-	 * since we may have disable outbound traffic already.
-	 */
-	net_device = get_inbound_net_device(device);
-	if (!net_device) {
-		DPRINT_ERR(NETVSC, "unable to get net device..."
-			   "device being destroyed?");
-		return;
-	}
-
-	/* Overloading use of the lock. */
-	spin_lock_irqsave(&net_device->recv_pkt_list_lock, flags);
-
-	packet->xfer_page_pkt->count--;
-
-	/*
-	 * Last one in the line that represent 1 xfer page packet.
-	 * Return the xfer page packet itself to the freelist
-	 */
-	if (packet->xfer_page_pkt->count == 0) {
-		fsend_receive_comp = true;
-		transaction_id = packet->completion.recv.recv_completion_tid;
-		list_add_tail(&packet->xfer_page_pkt->list_ent,
-			      &net_device->recv_pkt_list);
-
-	}
-
-	/* Put the packet back */
-	list_add_tail(&packet->list_ent, &net_device->recv_pkt_list);
-	spin_unlock_irqrestore(&net_device->recv_pkt_list_lock, flags);
-
-	/* Send a receive completion for the xfer page packet */
-	if (fsend_receive_comp)
-		netvsc_send_recv_completion(device, transaction_id);
-
-	put_net_device(device);
-}
-
 static void netvsc_channel_cb(void *context)
 {
 	int ret;
@@ -1251,7 +1025,7 @@
 
 	net_device = get_inbound_net_device(device);
 	if (!net_device) {
-		DPRINT_ERR(NETVSC, "net device (%p) shutting down..."
+		dev_err(&device->device, "net device (%p) shutting down..."
 			   "ignoring inbound packets", net_device);
 		goto out;
 	}
@@ -1261,9 +1035,6 @@
 					   &bytes_recvd, &request_id);
 		if (ret == 0) {
 			if (bytes_recvd > 0) {
-				DPRINT_DBG(NETVSC, "receive %d bytes, tid %llx",
-					   bytes_recvd, request_id);
-
 				desc = (struct vmpacket_descriptor *)buffer;
 				switch (desc->type) {
 				case VM_PKT_COMP:
@@ -1275,7 +1046,7 @@
 					break;
 
 				default:
-					DPRINT_ERR(NETVSC,
+					dev_err(&device->device,
 						   "unhandled packet type %d, "
 						   "tid %llx len %d\n",
 						   desc->type, request_id,
@@ -1304,7 +1075,7 @@
 			buffer = kmalloc(bytes_recvd, GFP_ATOMIC);
 			if (buffer == NULL) {
 				/* Try again next time around */
-				DPRINT_ERR(NETVSC,
+				dev_err(&device->device,
 					   "unable to allocate buffer of size "
 					   "(%d)!!", bytes_recvd);
 				break;
@@ -1319,3 +1090,111 @@
 	kfree(buffer);
 	return;
 }
+
+/*
+ * netvsc_device_add - Callback when the device belonging to this
+ * driver is added
+ */
+static int netvsc_device_add(struct hv_device *device, void *additional_info)
+{
+	int ret = 0;
+	int i;
+	struct netvsc_device *net_device;
+	struct hv_netvsc_packet *packet, *pos;
+	struct netvsc_driver *net_driver =
+				(struct netvsc_driver *)device->drv;
+
+	net_device = alloc_net_device(device);
+	if (!net_device) {
+		ret = -1;
+		goto cleanup;
+	}
+
+	/* Initialize the NetVSC channel extension */
+	net_device->recv_buf_size = NETVSC_RECEIVE_BUFFER_SIZE;
+	spin_lock_init(&net_device->recv_pkt_list_lock);
+
+	net_device->send_buf_size = NETVSC_SEND_BUFFER_SIZE;
+
+	INIT_LIST_HEAD(&net_device->recv_pkt_list);
+
+	for (i = 0; i < NETVSC_RECEIVE_PACKETLIST_COUNT; i++) {
+		packet = kzalloc(sizeof(struct hv_netvsc_packet) +
+				 (NETVSC_RECEIVE_SG_COUNT *
+				  sizeof(struct hv_page_buffer)), GFP_KERNEL);
+		if (!packet)
+			break;
+
+		list_add_tail(&packet->list_ent,
+			      &net_device->recv_pkt_list);
+	}
+	init_waitqueue_head(&net_device->channel_init_wait);
+
+	/* Open the channel */
+	ret = vmbus_open(device->channel, net_driver->ring_buf_size,
+			 net_driver->ring_buf_size, NULL, 0,
+			 netvsc_channel_cb, device);
+
+	if (ret != 0) {
+		dev_err(&device->device, "unable to open channel: %d", ret);
+		ret = -1;
+		goto cleanup;
+	}
+
+	/* Channel is opened */
+	pr_info("hv_netvsc channel opened successfully");
+
+	/* Connect with the NetVsp */
+	ret = netvsc_connect_vsp(device);
+	if (ret != 0) {
+		dev_err(&device->device,
+			"unable to connect to NetVSP - %d", ret);
+		ret = -1;
+		goto close;
+	}
+
+	return ret;
+
+close:
+	/* Now, we can close the channel safely */
+	vmbus_close(device->channel);
+
+cleanup:
+
+	if (net_device) {
+		list_for_each_entry_safe(packet, pos,
+					 &net_device->recv_pkt_list,
+					 list_ent) {
+			list_del(&packet->list_ent);
+			kfree(packet);
+		}
+
+		release_outbound_net_device(device);
+		release_inbound_net_device(device);
+
+		free_net_device(net_device);
+	}
+
+	return ret;
+}
+
+/*
+ * netvsc_initialize - Main entry point
+ */
+int netvsc_initialize(struct hv_driver *drv)
+{
+	struct netvsc_driver *driver = (struct netvsc_driver *)drv;
+
+	drv->name = driver_name;
+	memcpy(&drv->dev_type, &netvsc_device_type, sizeof(struct hv_guid));
+
+	/* Setup the dispatch table */
+	driver->base.dev_add	= netvsc_device_add;
+	driver->base.dev_rm	= netvsc_device_remove;
+	driver->base.cleanup		= netvsc_cleanup;
+
+	driver->send			= netvsc_send;
+
+	rndis_filter_init(driver);
+	return 0;
+}
diff --git a/drivers/staging/hv/netvsc_drv.c b/drivers/staging/hv/netvsc_drv.c
index 3397356..096a732 100644
--- a/drivers/staging/hv/netvsc_drv.c
+++ b/drivers/staging/hv/netvsc_drv.c
@@ -18,6 +18,8 @@
  *   Haiyang Zhang <haiyangz@microsoft.com>
  *   Hank Janssen  <hjanssen@microsoft.com>
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/highmem.h>
@@ -78,14 +80,14 @@
 		/* Open up the device */
 		ret = rndis_filter_open(device_obj);
 		if (ret != 0) {
-			DPRINT_ERR(NETVSC_DRV,
-				   "unable to open device (ret %d).", ret);
+			netdev_err(net, "unable to open device (ret %d).\n",
+				   ret);
 			return ret;
 		}
 
 		netif_start_queue(net);
 	} else {
-		DPRINT_ERR(NETVSC_DRV, "unable to open device...link is down.");
+		netdev_err(net, "unable to open device...link is down.\n");
 	}
 
 	return ret;
@@ -101,7 +103,7 @@
 
 	ret = rndis_filter_close(device_obj);
 	if (ret != 0)
-		DPRINT_ERR(NETVSC_DRV, "unable to close device (ret %d).", ret);
+		netdev_err(net, "unable to close device (ret %d).\n", ret);
 
 	return ret;
 }
@@ -137,9 +139,6 @@
 	int ret;
 	unsigned int i, num_pages;
 
-	DPRINT_DBG(NETVSC_DRV, "xmit packet - len %d data_len %d",
-		   skb->len, skb->data_len);
-
 	/* Add 1 for skb->data and additional one for RNDIS */
 	num_pages = skb_shinfo(skb)->nr_frags + 1 + 1;
 	if (num_pages > net_device_ctx->avail)
@@ -151,7 +150,7 @@
 			 net_drv_obj->req_ext_size, GFP_ATOMIC);
 	if (!packet) {
 		/* out of memory, silently drop packet */
-		DPRINT_ERR(NETVSC_DRV, "unable to allocate hv_netvsc_packet");
+		netdev_err(net, "unable to allocate hv_netvsc_packet\n");
 
 		dev_kfree_skb(skb);
 		net->stats.tx_dropped++;
@@ -197,10 +196,6 @@
 		net->stats.tx_bytes += skb->len;
 		net->stats.tx_packets++;
 
-		DPRINT_DBG(NETVSC_DRV, "# of xmits %lu total size %lu",
-			   net->stats.tx_packets,
-			   net->stats.tx_bytes);
-
 		net_device_ctx->avail -= num_pages;
 		if (net_device_ctx->avail < PACKET_PAGES_LOWATER)
 			netif_stop_queue(net);
@@ -223,8 +218,8 @@
 	struct net_device_context *ndev_ctx;
 
 	if (!net) {
-		DPRINT_ERR(NETVSC_DRV, "got link status but net device "
-				"not initialized yet");
+		netdev_err(net, "got link status but net device "
+				"not initialized yet\n");
 		return;
 	}
 
@@ -254,8 +249,8 @@
 	unsigned long flags;
 
 	if (!net) {
-		DPRINT_ERR(NETVSC_DRV, "got receive callback but net device "
-				"not initialized yet");
+		netdev_err(net, "got receive callback but net device"
+			" not initialized yet\n");
 		return 0;
 	}
 
@@ -301,9 +296,6 @@
 	 */
 	netif_rx(skb);
 
-	DPRINT_DBG(NETVSC_DRV, "# of recvs %lu total size %lu",
-		   net->stats.rx_packets, net->stats.rx_bytes);
-
 	return 0;
 }
 
@@ -317,8 +309,6 @@
 
 static const struct ethtool_ops ethtool_ops = {
 	.get_drvinfo	= netvsc_get_drvinfo,
-	.get_sg		= ethtool_op_get_sg,
-	.set_sg		= ethtool_op_set_sg,
 	.get_link	= ethtool_op_get_link,
 };
 
@@ -384,8 +374,7 @@
 		free_netdev(net);
 		dev_set_drvdata(device, NULL);
 
-		DPRINT_ERR(NETVSC_DRV, "unable to add netvsc device (ret %d)",
-			   ret);
+		netdev_err(net, "unable to add netvsc device (ret %d)\n", ret);
 		return ret;
 	}
 
@@ -406,6 +395,7 @@
 	net->netdev_ops = &device_ops;
 
 	/* TODO: Add GSO and Checksum offload */
+	net->hw_features = NETIF_F_SG;
 	net->features = NETIF_F_SG;
 
 	SET_ETHTOOL_OPS(net, &ethtool_ops);
@@ -431,7 +421,7 @@
 	int ret;
 
 	if (net == NULL) {
-		DPRINT_INFO(NETVSC, "no net device to remove");
+		dev_err(device, "No net device to remove\n");
 		return 0;
 	}
 
@@ -451,7 +441,7 @@
 	ret = net_drv_obj->base.dev_rm(device_obj);
 	if (ret != 0) {
 		/* TODO: */
-		DPRINT_ERR(NETVSC, "unable to remove vsc device (ret %d)", ret);
+		netdev_err(net, "unable to remove vsc device (ret %d)\n", ret);
 	}
 
 	free_netdev(net);
@@ -480,16 +470,13 @@
 		/* Get the device */
 		ret = driver_for_each_device(&drv->driver, NULL,
 					     &current_dev, netvsc_drv_exit_cb);
-		if (ret)
-			DPRINT_WARN(NETVSC_DRV,
-				    "driver_for_each_device returned %d", ret);
 
 		if (current_dev == NULL)
 			break;
 
 		/* Initiate removal from the top-down */
-		DPRINT_INFO(NETVSC_DRV, "unregistering device (%p)...",
-			    current_dev);
+		dev_err(current_dev, "unregistering device (%s)...\n",
+			dev_name(current_dev));
 
 		device_unregister(current_dev);
 	}
@@ -543,7 +530,7 @@
 
 static int __init netvsc_init(void)
 {
-	DPRINT_INFO(NETVSC_DRV, "Netvsc initializing....");
+	pr_info("initializing....");
 
 	if (!dmi_check_system(hv_netvsc_dmi_table))
 		return -ENODEV;
diff --git a/drivers/staging/hv/ring_buffer.c b/drivers/staging/hv/ring_buffer.c
index 66688fb..66e1b3f 100644
--- a/drivers/staging/hv/ring_buffer.c
+++ b/drivers/staging/hv/ring_buffer.c
@@ -20,6 +20,7 @@
  *   Hank Janssen  <hjanssen@microsoft.com>
  *
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/kernel.h>
 #include <linux/mm.h>
@@ -372,20 +373,12 @@
 				&bytes_avail_toread,
 				&bytes_avail_towrite);
 
-	DPRINT_DBG(VMBUS, "Writing %u bytes...", totalbytes_towrite);
-
 	/* Dumpring_info(Outring_info, "BEFORE "); */
 
 	/* If there is only room for the packet, assume it is full. */
 	/* Otherwise, the next time around, we think the ring buffer */
 	/* is empty since the read index == write index */
 	if (bytes_avail_towrite <= totalbytes_towrite) {
-		DPRINT_DBG(VMBUS,
-			"No more space left on outbound ring buffer "
-			"(needed %u, avail %u)",
-			totalbytes_towrite,
-			bytes_avail_towrite);
-
 		spin_unlock_irqrestore(&outring_info->ring_lock, flags);
 		return -1;
 	}
@@ -499,18 +492,10 @@
 				&bytes_avail_toread,
 				&bytes_avail_towrite);
 
-	DPRINT_DBG(VMBUS, "Reading %u bytes...", buflen);
-
 	/* Dumpring_info(Inring_info, "BEFORE "); */
 
 	/* Make sure there is something to read */
 	if (bytes_avail_toread < buflen) {
-		DPRINT_DBG(VMBUS,
-			"got callback but not enough to read "
-			"<avail to read %d read size %d>!!",
-			bytes_avail_toread,
-			buflen);
-
 		spin_unlock_irqrestore(&inring_info->ring_lock, flags);
 
 		return -1;
@@ -568,8 +553,6 @@
 
 	/* wrap-around detected! */
 	if (srclen > ring_buffer_size - start_write_offset) {
-		DPRINT_DBG(VMBUS, "wrap-around detected!");
-
 		frag_len = ring_buffer_size - start_write_offset;
 		memcpy(ring_buffer + start_write_offset, src, frag_len);
 		memcpy(ring_buffer, src + frag_len, srclen - frag_len);
@@ -607,8 +590,6 @@
 
 	/* wrap-around detected at the src */
 	if (destlen > ring_buffer_size - start_read_offset) {
-		DPRINT_DBG(VMBUS, "src wrap-around detected!");
-
 		frag_len = ring_buffer_size - start_read_offset;
 
 		memcpy(dest, ring_buffer + start_read_offset, frag_len);
diff --git a/drivers/staging/hv/rndis_filter.c b/drivers/staging/hv/rndis_filter.c
index 048376b..6305050 100644
--- a/drivers/staging/hv/rndis_filter.c
+++ b/drivers/staging/hv/rndis_filter.c
@@ -25,7 +25,7 @@
 #include <linux/slab.h>
 #include <linux/io.h>
 #include <linux/if_ether.h>
-
+#include <linux/netdevice.h>
 #include "logging.h"
 #include "hv_api.h"
 #include "netvsc_api.h"
@@ -283,14 +283,6 @@
 		 */
 		if (request->request_msg.msg.init_req.req_id
 		    == resp->msg.init_complete.req_id) {
-			DPRINT_DBG(NETVSC, "found rndis request for "
-				"this response (id 0x%x req type 0x%x res "
-				"type 0x%x)",
-				request->request_msg.msg.
-				   init_req.req_id,
-				request->request_msg.ndis_msg_type,
-				resp->ndis_msg_type);
-
 			found = true;
 			break;
 		}
@@ -302,10 +294,11 @@
 			memcpy(&request->response_msg, resp,
 			       resp->msg_len);
 		} else {
-			DPRINT_ERR(NETVSC, "rndis response buffer overflow "
-				  "detected (size %u max %zu)",
-				  resp->msg_len,
-				  sizeof(struct rndis_filter_packet));
+			dev_err(&dev->net_dev->dev->device,
+				"rndis response buffer overflow "
+				"detected (size %u max %zu)\n",
+				resp->msg_len,
+				sizeof(struct rndis_filter_packet));
 
 			if (resp->ndis_msg_type ==
 			    REMOTE_NDIS_RESET_CMPLT) {
@@ -322,10 +315,11 @@
 		request->wait_condition = 1;
 		wake_up(&request->wait_event);
 	} else {
-		DPRINT_ERR(NETVSC, "no rndis request found for this response "
-			   "(id 0x%x res type 0x%x)",
-			   resp->msg.init_complete.req_id,
-			   resp->ndis_msg_type);
+		dev_err(&dev->net_dev->dev->device,
+			"no rndis request found for this response "
+			"(id 0x%x res type 0x%x)\n",
+			resp->msg.init_complete.req_id,
+			resp->ndis_msg_type);
 	}
 }
 
@@ -388,15 +382,15 @@
 
 	/* Make sure the rndis device state is initialized */
 	if (!net_dev->extension) {
-		DPRINT_ERR(NETVSC, "got rndis message but no rndis device..."
-			  "dropping this message!");
+		dev_err(&dev->device, "got rndis message but no rndis device - "
+			  "dropping this message!\n");
 		return -1;
 	}
 
 	rndis_dev = (struct rndis_device *)net_dev->extension;
 	if (rndis_dev->state == RNDIS_DEV_UNINITIALIZED) {
-		DPRINT_ERR(NETVSC, "got rndis message but rndis device "
-			   "uninitialized...dropping this message!");
+		dev_err(&dev->device, "got rndis message but rndis device "
+			   "uninitialized...dropping this message!\n");
 		return -1;
 	}
 
@@ -417,8 +411,8 @@
 		kunmap_atomic(rndis_hdr - pkt->page_buf[0].offset,
 			      KM_IRQ0);
 
-		DPRINT_ERR(NETVSC, "invalid rndis message? (expected %u "
-			   "bytes got %u)...dropping this message!",
+		dev_err(&dev->device, "invalid rndis message? (expected %u "
+			   "bytes got %u)...dropping this message!\n",
 			   rndis_hdr->msg_len,
 			   pkt->total_data_buflen);
 		return -1;
@@ -427,8 +421,8 @@
 
 	if ((rndis_hdr->ndis_msg_type != REMOTE_NDIS_PACKET_MSG) &&
 	    (rndis_hdr->msg_len > sizeof(struct rndis_message))) {
-		DPRINT_ERR(NETVSC, "incoming rndis message buffer overflow "
-			   "detected (got %u, max %zu)...marking it an error!",
+		dev_err(&dev->device, "incoming rndis message buffer overflow "
+			   "detected (got %u, max %zu)..marking it an error!\n",
 			   rndis_hdr->msg_len,
 			   sizeof(struct rndis_message));
 	}
@@ -460,7 +454,8 @@
 		rndis_filter_receive_indicate_status(rndis_dev, &rndis_msg);
 		break;
 	default:
-		DPRINT_ERR(NETVSC, "unhandled rndis message (type %u len %u)",
+		dev_err(&dev->device,
+			"unhandled rndis message (type %u len %u)\n",
 			   rndis_msg.ndis_msg_type,
 			   rndis_msg.msg_len);
 		break;
@@ -583,7 +578,8 @@
 		msecs_to_jiffies(2000));
 	if (request->wait_condition == 0) {
 		ret = -1;
-		DPRINT_ERR(NETVSC, "timeout before we got a set response...");
+		dev_err(&dev->net_dev->dev->device,
+			"timeout before we got a set response...\n");
 		/*
 		 * We can't deallocate the request since we may still receive a
 		 * send completion for it.
@@ -605,9 +601,6 @@
 
 int rndis_filter_init(struct netvsc_driver *drv)
 {
-	DPRINT_DBG(NETVSC, "sizeof(struct rndis_filter_packet) == %zd",
-		   sizeof(struct rndis_filter_packet));
-
 	drv->req_ext_size = sizeof(struct rndis_filter_packet);
 
 	/* Driver->Context = rndisDriver; */
@@ -765,8 +758,6 @@
 	if (!rndisDevice)
 		return -1;
 
-	DPRINT_DBG(NETVSC, "rndis device object allocated - %p", rndisDevice);
-
 	/*
 	 * Let the inner driver handle this first to create the netvsc channel
 	 * NOTE! Once the channel is created, we may get a receive callback
@@ -802,16 +793,15 @@
 		 */
 	}
 
-	DPRINT_INFO(NETVSC, "Device 0x%p mac addr %pM",
-		    rndisDevice, rndisDevice->hw_mac_adr);
-
 	memcpy(deviceInfo->mac_adr, rndisDevice->hw_mac_adr, ETH_ALEN);
 
 	rndis_filter_query_device_link_status(rndisDevice);
 
 	deviceInfo->link_state = rndisDevice->link_stat;
-	DPRINT_INFO(NETVSC, "Device 0x%p link state %s", rndisDevice,
-		    ((deviceInfo->link_state) ? ("down") : ("up")));
+
+	dev_info(&dev->device, "Device MAC %pM link state %s",
+		 rndisDevice->hw_mac_adr,
+		 ((deviceInfo->link_state) ? ("down\n") : ("up\n")));
 
 	return ret;
 }
diff --git a/drivers/staging/hv/storvsc.c b/drivers/staging/hv/storvsc.c
index e2ad729..85bae5a 100644
--- a/drivers/staging/hv/storvsc.c
+++ b/drivers/staging/hv/storvsc.c
@@ -17,10 +17,12 @@
  * Authors:
  *   Haiyang Zhang <haiyangz@microsoft.com>
  *   Hank Janssen  <hjanssen@microsoft.com>
+ *
+ * 4/3/2011: K. Y. Srinivasan - Significant restructuring and cleanup.
  */
 #include <linux/kernel.h>
 #include <linux/sched.h>
-#include <linux/wait.h>
+#include <linux/completion.h>
 #include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/mm.h>
@@ -33,57 +35,6 @@
 #include "channel.h"
 
 
-struct storvsc_request_extension {
-	/* LIST_ENTRY ListEntry; */
-
-	struct hv_storvsc_request *request;
-	struct hv_device *device;
-
-	/* Synchronize the request/response if needed */
-	int wait_condition;
-	wait_queue_head_t wait_event;
-
-	struct vstor_packet vstor_packet;
-};
-
-/* A storvsc device is a device object that contains a vmbus channel */
-struct storvsc_device {
-	struct hv_device *device;
-
-	/* 0 indicates the device is being destroyed */
-	atomic_t ref_count;
-
-	atomic_t num_outstanding_req;
-
-	/*
-	 * Each unique Port/Path/Target represents 1 channel ie scsi
-	 * controller. In reality, the pathid, targetid is always 0
-	 * and the port is set by us
-	 */
-	unsigned int port_number;
-	unsigned char path_id;
-	unsigned char target_id;
-
-	/* LIST_ENTRY OutstandingRequestList; */
-	/* HANDLE OutstandingRequestLock; */
-
-	/* Used for vsc/vsp channel reset process */
-	struct storvsc_request_extension init_request;
-	struct storvsc_request_extension reset_request;
-};
-
-
-static const char *g_driver_name = "storvsc";
-
-/* {ba6163d9-04a1-4d29-b605-72e2ffb1dc7f} */
-static const struct hv_guid gStorVscDeviceType = {
-	.data = {
-		0xd9, 0x63, 0x61, 0xba, 0xa1, 0x04, 0x29, 0x4d,
-		0xb6, 0x05, 0x72, 0xe2, 0xff, 0xb1, 0xdc, 0x7f
-	}
-};
-
-
 static inline struct storvsc_device *alloc_stor_device(struct hv_device *device)
 {
 	struct storvsc_device *stor_device;
@@ -104,24 +55,9 @@
 
 static inline void free_stor_device(struct storvsc_device *device)
 {
-	/* ASSERT(atomic_read(&device->ref_count) == 0); */
 	kfree(device);
 }
 
-/* Get the stordevice object iff exists and its refcount > 1 */
-static inline struct storvsc_device *get_stor_device(struct hv_device *device)
-{
-	struct storvsc_device *stor_device;
-
-	stor_device = (struct storvsc_device *)device->ext;
-	if (stor_device && atomic_read(&stor_device->ref_count) > 1)
-		atomic_inc(&stor_device->ref_count);
-	else
-		stor_device = NULL;
-
-	return stor_device;
-}
-
 /* Get the stordevice object iff exists and its refcount > 0 */
 static inline struct storvsc_device *must_get_stor_device(
 					struct hv_device *device)
@@ -137,17 +73,6 @@
 	return stor_device;
 }
 
-static inline void put_stor_device(struct hv_device *device)
-{
-	struct storvsc_device *stor_device;
-
-	stor_device = (struct storvsc_device *)device->ext;
-	/* ASSERT(stor_device); */
-
-	atomic_dec(&stor_device->ref_count);
-	/* ASSERT(atomic_read(&stor_device->ref_count)); */
-}
-
 /* Drop ref count to 1 to effectively disable get_stor_device() */
 static inline struct storvsc_device *release_stor_device(
 					struct hv_device *device)
@@ -155,7 +80,6 @@
 	struct storvsc_device *stor_device;
 
 	stor_device = (struct storvsc_device *)device->ext;
-	/* ASSERT(stor_device); */
 
 	/* Busy wait until the ref drop to 2, then set it to 1 */
 	while (atomic_cmpxchg(&stor_device->ref_count, 2, 1) != 2)
@@ -171,7 +95,6 @@
 	struct storvsc_device *stor_device;
 
 	stor_device = (struct storvsc_device *)device->ext;
-	/* ASSERT(stor_device); */
 
 	/* Busy wait until the ref drop to 1, then set it to 0 */
 	while (atomic_cmpxchg(&stor_device->ref_count, 1, 0) != 1)
@@ -184,9 +107,9 @@
 static int stor_vsc_channel_init(struct hv_device *device)
 {
 	struct storvsc_device *stor_device;
-	struct storvsc_request_extension *request;
+	struct hv_storvsc_request *request;
 	struct vstor_packet *vstor_packet;
-	int ret;
+	int ret, t;
 
 	stor_device = get_stor_device(device);
 	if (!stor_device) {
@@ -202,14 +125,13 @@
 	 * Now, initiate the vsc/vsp initialization protocol on the open
 	 * channel
 	 */
-	memset(request, 0, sizeof(struct storvsc_request_extension));
-	init_waitqueue_head(&request->wait_event);
+	memset(request, 0, sizeof(struct hv_storvsc_request));
+	init_completion(&request->wait_event);
 	vstor_packet->operation = VSTOR_OPERATION_BEGIN_INITIALIZATION;
 	vstor_packet->flags = REQUEST_COMPLETION_FLAG;
 
 	DPRINT_INFO(STORVSC, "BEGIN_INITIALIZATION_OPERATION...");
 
-	request->wait_condition = 0;
 	ret = vmbus_sendpacket(device->channel, vstor_packet,
 			       sizeof(struct vstor_packet),
 			       (unsigned long)request,
@@ -221,14 +143,12 @@
 		goto cleanup;
 	}
 
-	wait_event_timeout(request->wait_event, request->wait_condition,
-			msecs_to_jiffies(1000));
-	if (request->wait_condition == 0) {
+	t = wait_for_completion_timeout(&request->wait_event, HZ);
+	if (t == 0) {
 		ret = -ETIMEDOUT;
 		goto cleanup;
 	}
 
-
 	if (vstor_packet->operation != VSTOR_OPERATION_COMPLETE_IO ||
 	    vstor_packet->status != 0) {
 		DPRINT_ERR(STORVSC, "BEGIN_INITIALIZATION_OPERATION failed "
@@ -247,7 +167,6 @@
 	vstor_packet->version.major_minor = VMSTOR_PROTOCOL_VERSION_CURRENT;
 	FILL_VMSTOR_REVISION(vstor_packet->version.revision);
 
-	request->wait_condition = 0;
 	ret = vmbus_sendpacket(device->channel, vstor_packet,
 			       sizeof(struct vstor_packet),
 			       (unsigned long)request,
@@ -259,9 +178,8 @@
 		goto cleanup;
 	}
 
-	wait_event_timeout(request->wait_event, request->wait_condition,
-			msecs_to_jiffies(1000));
-	if (request->wait_condition == 0) {
+	t = wait_for_completion_timeout(&request->wait_event, HZ);
+	if (t == 0) {
 		ret = -ETIMEDOUT;
 		goto cleanup;
 	}
@@ -284,7 +202,6 @@
 	vstor_packet->storage_channel_properties.port_number =
 					stor_device->port_number;
 
-	request->wait_condition = 0;
 	ret = vmbus_sendpacket(device->channel, vstor_packet,
 			       sizeof(struct vstor_packet),
 			       (unsigned long)request,
@@ -297,9 +214,8 @@
 		goto cleanup;
 	}
 
-	wait_event_timeout(request->wait_event, request->wait_condition,
-			msecs_to_jiffies(1000));
-	if (request->wait_condition == 0) {
+	t = wait_for_completion_timeout(&request->wait_event, HZ);
+	if (t == 0) {
 		ret = -ETIMEDOUT;
 		goto cleanup;
 	}
@@ -327,7 +243,6 @@
 	vstor_packet->operation = VSTOR_OPERATION_END_INITIALIZATION;
 	vstor_packet->flags = REQUEST_COMPLETION_FLAG;
 
-	request->wait_condition = 0;
 	ret = vmbus_sendpacket(device->channel, vstor_packet,
 			       sizeof(struct vstor_packet),
 			       (unsigned long)request,
@@ -340,9 +255,8 @@
 		goto cleanup;
 	}
 
-	wait_event_timeout(request->wait_event, request->wait_condition,
-			msecs_to_jiffies(1000));
-	if (request->wait_condition == 0) {
+	t = wait_for_completion_timeout(&request->wait_event, HZ);
+	if (t == 0) {
 		ret = -ETIMEDOUT;
 		goto cleanup;
 	}
@@ -364,10 +278,10 @@
 
 static void stor_vsc_on_io_completion(struct hv_device *device,
 				  struct vstor_packet *vstor_packet,
-				  struct storvsc_request_extension *request_ext)
+				  struct hv_storvsc_request *request)
 {
-	struct hv_storvsc_request *request;
 	struct storvsc_device *stor_device;
+	struct vstor_packet *stor_pkt;
 
 	stor_device = must_get_stor_device(device);
 	if (!stor_device) {
@@ -376,48 +290,45 @@
 		return;
 	}
 
-	DPRINT_DBG(STORVSC, "IO_COMPLETE_OPERATION - request extension %p "
-		   "completed bytes xfer %u", request_ext,
+	DPRINT_DBG(STORVSC, "IO_COMPLETE_OPERATION - request %p "
+		   "completed bytes xfer %u", request,
 		   vstor_packet->vm_srb.data_transfer_length);
 
-	/* ASSERT(request_ext != NULL); */
-	/* ASSERT(request_ext->request != NULL); */
+	stor_pkt = &request->vstor_packet;
 
-	request = request_ext->request;
-
-	/* ASSERT(request->OnIOCompletion != NULL); */
 
 	/* Copy over the status...etc */
-	request->status = vstor_packet->vm_srb.scsi_status;
+	stor_pkt->vm_srb.scsi_status = vstor_packet->vm_srb.scsi_status;
+	stor_pkt->vm_srb.srb_status = vstor_packet->vm_srb.srb_status;
+	stor_pkt->vm_srb.sense_info_length =
+	vstor_packet->vm_srb.sense_info_length;
 
-	if (request->status != 0 || vstor_packet->vm_srb.srb_status != 1) {
+	if (vstor_packet->vm_srb.scsi_status != 0 ||
+		vstor_packet->vm_srb.srb_status != 1) {
 		DPRINT_WARN(STORVSC,
 			    "cmd 0x%x scsi status 0x%x srb status 0x%x\n",
-			    request->cdb[0], vstor_packet->vm_srb.scsi_status,
+			    stor_pkt->vm_srb.cdb[0],
+			    vstor_packet->vm_srb.scsi_status,
 			    vstor_packet->vm_srb.srb_status);
 	}
 
-	if ((request->status & 0xFF) == 0x02) {
+	if ((vstor_packet->vm_srb.scsi_status & 0xFF) == 0x02) {
 		/* CHECK_CONDITION */
 		if (vstor_packet->vm_srb.srb_status & 0x80) {
 			/* autosense data available */
 			DPRINT_WARN(STORVSC, "storvsc pkt %p autosense data "
-				    "valid - len %d\n", request_ext,
+				    "valid - len %d\n", request,
 				    vstor_packet->vm_srb.sense_info_length);
 
-			/* ASSERT(vstor_packet->vm_srb.sense_info_length <= */
-			/* 	request->SenseBufferSize); */
 			memcpy(request->sense_buffer,
 			       vstor_packet->vm_srb.sense_data,
 			       vstor_packet->vm_srb.sense_info_length);
 
-			request->sense_buffer_size =
-					vstor_packet->vm_srb.sense_info_length;
 		}
 	}
 
-	/* TODO: */
-	request->bytes_xfer = vstor_packet->vm_srb.data_transfer_length;
+	stor_pkt->vm_srb.data_transfer_length =
+	vstor_packet->vm_srb.data_transfer_length;
 
 	request->on_io_completion(request);
 
@@ -428,12 +339,12 @@
 
 static void stor_vsc_on_receive(struct hv_device *device,
 			     struct vstor_packet *vstor_packet,
-			     struct storvsc_request_extension *request_ext)
+			     struct hv_storvsc_request *request)
 {
 	switch (vstor_packet->operation) {
 	case VSTOR_OPERATION_COMPLETE_IO:
 		DPRINT_DBG(STORVSC, "IO_COMPLETE_OPERATION");
-		stor_vsc_on_io_completion(device, vstor_packet, request_ext);
+		stor_vsc_on_io_completion(device, vstor_packet, request);
 		break;
 	case VSTOR_OPERATION_REMOVE_DEVICE:
 		DPRINT_INFO(STORVSC, "REMOVE_DEVICE_OPERATION");
@@ -454,10 +365,9 @@
 	u32 bytes_recvd;
 	u64 request_id;
 	unsigned char packet[ALIGN(sizeof(struct vstor_packet), 8)];
-	struct storvsc_request_extension *request;
+	struct hv_storvsc_request *request;
 	int ret;
 
-	/* ASSERT(device); */
 
 	stor_device = must_get_stor_device(device);
 	if (!stor_device) {
@@ -474,33 +384,22 @@
 			DPRINT_DBG(STORVSC, "receive %d bytes - tid %llx",
 				   bytes_recvd, request_id);
 
-			/* ASSERT(bytes_recvd ==
-					sizeof(struct vstor_packet)); */
 
-			request = (struct storvsc_request_extension *)
+			request = (struct hv_storvsc_request *)
 					(unsigned long)request_id;
-			/* ASSERT(request);c */
 
-			/* if (vstor_packet.Flags & SYNTHETIC_FLAG) */
 			if ((request == &stor_device->init_request) ||
 			    (request == &stor_device->reset_request)) {
-				/* DPRINT_INFO(STORVSC,
-				 *             "reset completion - operation "
-				 *             "%u status %u",
-				 *             vstor_packet.Operation,
-				 *             vstor_packet.Status); */
 
 				memcpy(&request->vstor_packet, packet,
 				       sizeof(struct vstor_packet));
-				request->wait_condition = 1;
-				wake_up(&request->wait_event);
+				complete(&request->wait_event);
 			} else {
 				stor_vsc_on_receive(device,
 						(struct vstor_packet *)packet,
 						request);
 			}
 		} else {
-			/* DPRINT_DBG(STORVSC, "nothing else to read..."); */
 			break;
 		}
 	} while (1);
@@ -543,11 +442,10 @@
  * stor_vsc_on_device_add - Callback when the device belonging to this driver
  * is added
  */
-static int stor_vsc_on_device_add(struct hv_device *device,
+int stor_vsc_on_device_add(struct hv_device *device,
 					void *additional_info)
 {
 	struct storvsc_device *stor_device;
-	/* struct vmstorage_channel_properties *props; */
 	struct storvsc_device_info *device_info;
 	int ret = 0;
 
@@ -559,8 +457,6 @@
 	}
 
 	/* Save the channel properties to our storvsc channel */
-	/* props = (struct vmstorage_channel_properties *)
-	 *		channel->offerMsg.Offer.u.Standard.UserDefined; */
 
 	/* FIXME: */
 	/*
@@ -569,15 +465,10 @@
 	 * scsi channel prior to the bus scan
 	 */
 
-	/* storChannel->PortNumber = 0;
-	storChannel->PathId = props->PathId;
-	storChannel->TargetId = props->TargetId; */
-
 	stor_device->port_number = device_info->port_number;
 	/* Send it back up */
 	ret = stor_vsc_connect_to_vsp(device);
 
-	/* device_info->PortNumber = stor_device->PortNumber; */
 	device_info->path_id = stor_device->path_id;
 	device_info->target_id = stor_device->target_id;
 
@@ -592,7 +483,7 @@
 /*
  * stor_vsc_on_device_remove - Callback when the our device is being removed
  */
-static int stor_vsc_on_device_remove(struct hv_device *device)
+int stor_vsc_on_device_remove(struct hv_device *device)
 {
 	struct storvsc_device *stor_device;
 
@@ -626,85 +517,24 @@
 	return 0;
 }
 
-int stor_vsc_on_host_reset(struct hv_device *device)
-{
-	struct storvsc_device *stor_device;
-	struct storvsc_request_extension *request;
-	struct vstor_packet *vstor_packet;
-	int ret;
-
-	DPRINT_INFO(STORVSC, "resetting host adapter...");
-
-	stor_device = get_stor_device(device);
-	if (!stor_device) {
-		DPRINT_ERR(STORVSC, "unable to get stor device..."
-			   "device being destroyed?");
-		return -1;
-	}
-
-	request = &stor_device->reset_request;
-	vstor_packet = &request->vstor_packet;
-
-	init_waitqueue_head(&request->wait_event);
-
-	vstor_packet->operation = VSTOR_OPERATION_RESET_BUS;
-	vstor_packet->flags = REQUEST_COMPLETION_FLAG;
-	vstor_packet->vm_srb.path_id = stor_device->path_id;
-
-	request->wait_condition = 0;
-	ret = vmbus_sendpacket(device->channel, vstor_packet,
-			       sizeof(struct vstor_packet),
-			       (unsigned long)&stor_device->reset_request,
-			       VM_PKT_DATA_INBAND,
-			       VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);
-	if (ret != 0) {
-		DPRINT_ERR(STORVSC, "Unable to send reset packet %p ret %d",
-			   vstor_packet, ret);
-		goto cleanup;
-	}
-
-	wait_event_timeout(request->wait_event, request->wait_condition,
-			msecs_to_jiffies(1000));
-	if (request->wait_condition == 0) {
-		ret = -ETIMEDOUT;
-		goto cleanup;
-	}
-
-	DPRINT_INFO(STORVSC, "host adapter reset completed");
-
-	/*
-	 * At this point, all outstanding requests in the adapter
-	 * should have been flushed out and return to us
-	 */
-
-cleanup:
-	put_stor_device(device);
-	return ret;
-}
-
 /*
  * stor_vsc_on_io_request - Callback to initiate an I/O request
  */
-static int stor_vsc_on_io_request(struct hv_device *device,
+int stor_vsc_on_io_request(struct hv_device *device,
 			      struct hv_storvsc_request *request)
 {
 	struct storvsc_device *stor_device;
-	struct storvsc_request_extension *request_extension;
 	struct vstor_packet *vstor_packet;
 	int ret = 0;
 
-	request_extension =
-		(struct storvsc_request_extension *)request->extension;
-	vstor_packet = &request_extension->vstor_packet;
+	vstor_packet = &request->vstor_packet;
 	stor_device = get_stor_device(device);
 
 	DPRINT_DBG(STORVSC, "enter - Device %p, DeviceExt %p, Request %p, "
-		   "Extension %p", device, stor_device, request,
-		   request_extension);
+		   , device, stor_device, request);
 
-	DPRINT_DBG(STORVSC, "req %p len %d bus %d, target %d, lun %d cdblen %d",
-		   request, request->data_buffer.len, request->bus,
-		   request->target_id, request->lun_id, request->cdb_len);
+	DPRINT_DBG(STORVSC, "req %p len %d",
+		   request, request->data_buffer.len);
 
 	if (!stor_device) {
 		DPRINT_ERR(STORVSC, "unable to get stor device..."
@@ -712,31 +542,20 @@
 		return -2;
 	}
 
-	/* print_hex_dump_bytes("", DUMP_PREFIX_NONE, request->Cdb,
-	 *			request->CdbLen); */
 
-	request_extension->request = request;
-	request_extension->device  = device;
+	request->device  = device;
 
-	memset(vstor_packet, 0 , sizeof(struct vstor_packet));
 
 	vstor_packet->flags |= REQUEST_COMPLETION_FLAG;
 
 	vstor_packet->vm_srb.length = sizeof(struct vmscsi_request);
 
-	vstor_packet->vm_srb.port_number = request->host;
-	vstor_packet->vm_srb.path_id = request->bus;
-	vstor_packet->vm_srb.target_id = request->target_id;
-	vstor_packet->vm_srb.lun = request->lun_id;
 
 	vstor_packet->vm_srb.sense_info_length = SENSE_BUFFER_SIZE;
 
-	/* Copy over the scsi command descriptor block */
-	vstor_packet->vm_srb.cdb_length = request->cdb_len;
-	memcpy(&vstor_packet->vm_srb.cdb, request->cdb, request->cdb_len);
 
-	vstor_packet->vm_srb.data_in = request->type;
-	vstor_packet->vm_srb.data_transfer_length = request->data_buffer.len;
+	vstor_packet->vm_srb.data_transfer_length =
+	request->data_buffer.len;
 
 	vstor_packet->operation = VSTOR_OPERATION_EXECUTE_SRB;
 
@@ -750,16 +569,16 @@
 		   vstor_packet->vm_srb.sense_info_length,
 		   vstor_packet->vm_srb.cdb_length);
 
-	if (request_extension->request->data_buffer.len) {
+	if (request->data_buffer.len) {
 		ret = vmbus_sendpacket_multipagebuffer(device->channel,
-				&request_extension->request->data_buffer,
+				&request->data_buffer,
 				vstor_packet,
 				sizeof(struct vstor_packet),
-				(unsigned long)request_extension);
+				(unsigned long)request);
 	} else {
 		ret = vmbus_sendpacket(device->channel, vstor_packet,
 				       sizeof(struct vstor_packet),
-				       (unsigned long)request_extension,
+				       (unsigned long)request,
 				       VM_PKT_DATA_INBAND,
 				       VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);
 	}
@@ -776,62 +595,75 @@
 }
 
 /*
- * stor_vsc_on_cleanup - Perform any cleanup when the driver is removed
+ * The channel properties uniquely specify how the device is to be
+ * presented to the guest. Map this information for use by the block
+ * driver. For Linux guests on Hyper-V, we emulate a scsi HBA in the guest
+ * (storvsc_drv) and so scsi devices in the guest  are handled by
+ * native upper level Linux drivers. Consequently, Hyper-V
+ * block driver, while being a generic block driver, presently does not
+ * deal with anything other than devices that would need to be presented
+ * to the guest as an IDE disk.
+ *
+ * This function maps the channel properties as embedded in the input
+ * parameter device_info onto information necessary to register the
+ * corresponding block device.
+ *
+ * Currently, there is no way to stop the emulation of the block device
+ * on the host side. And so, to prevent the native IDE drivers in Linux
+ * from taking over these devices (to be managedby Hyper-V block
+ * driver), we will take over if need be the major of the IDE controllers.
+ *
  */
-static void stor_vsc_on_cleanup(struct hv_driver *driver)
+
+int stor_vsc_get_major_info(struct storvsc_device_info *device_info,
+			    struct storvsc_major_info *major_info)
 {
+	static bool ide0_registered;
+	static bool ide1_registered;
+
+	/*
+	 * For now we only support IDE disks.
+	 */
+	major_info->devname = "ide";
+	major_info->diskname = "hd";
+
+	if (device_info->path_id) {
+		major_info->major = 22;
+		if (!ide1_registered) {
+			major_info->do_register = true;
+			ide1_registered = true;
+		} else
+			major_info->do_register = false;
+
+		if (device_info->target_id)
+			major_info->index = 3;
+		else
+			major_info->index = 2;
+
+		return 0;
+	} else {
+		major_info->major = 3;
+		if (!ide0_registered) {
+			major_info->do_register = true;
+			ide0_registered = true;
+		} else
+			major_info->do_register = false;
+
+		if (device_info->target_id)
+			major_info->index = 1;
+		else
+			major_info->index = 0;
+
+		return 0;
+	}
+
+	return -ENODEV;
 }
 
 /*
- * stor_vsc_initialize - Main entry point
+ * stor_vsc_on_cleanup - Perform any cleanup when the driver is removed
  */
-int stor_vsc_initialize(struct hv_driver *driver)
+void stor_vsc_on_cleanup(struct hv_driver *driver)
 {
-	struct storvsc_driver_object *stor_driver;
-
-	stor_driver = (struct storvsc_driver_object *)driver;
-
-	DPRINT_DBG(STORVSC, "sizeof(STORVSC_REQUEST)=%zd "
-		   "sizeof(struct storvsc_request_extension)=%zd "
-		   "sizeof(struct vstor_packet)=%zd, "
-		   "sizeof(struct vmscsi_request)=%zd",
-		   sizeof(struct hv_storvsc_request),
-		   sizeof(struct storvsc_request_extension),
-		   sizeof(struct vstor_packet),
-		   sizeof(struct vmscsi_request));
-
-	/* Make sure we are at least 2 pages since 1 page is used for control */
-	/* ASSERT(stor_driver->RingBufferSize >= (PAGE_SIZE << 1)); */
-
-	driver->name = g_driver_name;
-	memcpy(&driver->dev_type, &gStorVscDeviceType,
-	       sizeof(struct hv_guid));
-
-	stor_driver->request_ext_size =
-			sizeof(struct storvsc_request_extension);
-
-	/*
-	 * Divide the ring buffer data size (which is 1 page less
-	 * than the ring buffer size since that page is reserved for
-	 * the ring buffer indices) by the max request size (which is
-	 * vmbus_channel_packet_multipage_buffer + struct vstor_packet + u64)
-	 */
-	stor_driver->max_outstanding_req_per_channel =
-		((stor_driver->ring_buffer_size - PAGE_SIZE) /
-		  ALIGN(MAX_MULTIPAGE_BUFFER_PACKET +
-			   sizeof(struct vstor_packet) + sizeof(u64),
-			   sizeof(u64)));
-
-	DPRINT_INFO(STORVSC, "max io %u, currently %u\n",
-		    stor_driver->max_outstanding_req_per_channel,
-		    STORVSC_MAX_IO_REQUESTS);
-
-	/* Setup the dispatch table */
-	stor_driver->base.dev_add	= stor_vsc_on_device_add;
-	stor_driver->base.dev_rm	= stor_vsc_on_device_remove;
-	stor_driver->base.cleanup	= stor_vsc_on_cleanup;
-
-	stor_driver->on_io_request	= stor_vsc_on_io_request;
-
-	return 0;
 }
+
diff --git a/drivers/staging/hv/storvsc_api.h b/drivers/staging/hv/storvsc_api.h
index fbf5755..c98139c 100644
--- a/drivers/staging/hv/storvsc_api.h
+++ b/drivers/staging/hv/storvsc_api.h
@@ -25,6 +25,8 @@
 #ifndef _STORVSC_API_H_
 #define _STORVSC_API_H_
 
+#include <linux/kernel.h>
+#include "vstorage.h"
 #include "vmbus_api.h"
 
 /* Defines */
@@ -52,42 +54,30 @@
 	UNKNOWN_TYPE,
 };
 
+
 struct hv_storvsc_request {
-	enum storvsc_request_type type;
-	u32 host;
-	u32 bus;
-	u32 target_id;
-	u32 lun_id;
-	u8 *cdb;
-	u32 cdb_len;
-	u32 status;
-	u32 bytes_xfer;
+	struct hv_storvsc_request *request;
+	struct hv_device *device;
+
+	/* Synchronize the request/response if needed */
+	struct completion wait_event;
 
 	unsigned char *sense_buffer;
-	u32 sense_buffer_size;
-
 	void *context;
-
 	void (*on_io_completion)(struct hv_storvsc_request *request);
-
-	/* This points to the memory after DataBuffer */
-	void *extension;
-
 	struct hv_multipage_buffer data_buffer;
+
+	struct vstor_packet vstor_packet;
 };
 
+
 /* Represents the block vsc driver */
 struct storvsc_driver_object {
-	/* Must be the first field */
-	/* Which is a bug FIXME! */
 	struct hv_driver base;
 
 	/* Set by caller (in bytes) */
 	u32 ring_buffer_size;
 
-	/* Allocate this much private extension for each I/O request */
-	u32 request_ext_size;
-
 	/* Maximum # of requests in flight per channel/device */
 	u32 max_outstanding_req_per_channel;
 
@@ -102,9 +92,78 @@
 	unsigned char target_id;
 };
 
+struct storvsc_major_info {
+	int major;
+	int index;
+	bool do_register;
+	char *devname;
+	char *diskname;
+};
+
+/* A storvsc device is a device object that contains a vmbus channel */
+struct storvsc_device {
+	struct hv_device *device;
+
+	/* 0 indicates the device is being destroyed */
+	atomic_t ref_count;
+
+	atomic_t num_outstanding_req;
+
+	/*
+	 * Each unique Port/Path/Target represents 1 channel ie scsi
+	 * controller. In reality, the pathid, targetid is always 0
+	 * and the port is set by us
+	 */
+	unsigned int port_number;
+	unsigned char path_id;
+	unsigned char target_id;
+
+	/* Used for vsc/vsp channel reset process */
+	struct hv_storvsc_request init_request;
+	struct hv_storvsc_request reset_request;
+};
+
+
+/* Get the stordevice object iff exists and its refcount > 1 */
+static inline struct storvsc_device *get_stor_device(struct hv_device *device)
+{
+	struct storvsc_device *stor_device;
+
+	stor_device = (struct storvsc_device *)device->ext;
+	if (stor_device && atomic_read(&stor_device->ref_count) > 1)
+		atomic_inc(&stor_device->ref_count);
+	else
+		stor_device = NULL;
+
+	return stor_device;
+}
+
+
+static inline void put_stor_device(struct hv_device *device)
+{
+	struct storvsc_device *stor_device;
+
+	stor_device = (struct storvsc_device *)device->ext;
+
+	atomic_dec(&stor_device->ref_count);
+}
+
+static inline struct storvsc_driver_object *hvdr_to_stordr(struct hv_driver *d)
+{
+	return container_of(d, struct storvsc_driver_object, base);
+}
+
 /* Interface */
-int stor_vsc_initialize(struct hv_driver *driver);
-int stor_vsc_on_host_reset(struct hv_device *device);
-int blk_vsc_initialize(struct hv_driver *driver);
+
+int stor_vsc_on_device_add(struct hv_device *device,
+				void *additional_info);
+int stor_vsc_on_device_remove(struct hv_device *device);
+
+int stor_vsc_on_io_request(struct hv_device *device,
+				struct hv_storvsc_request *request);
+void stor_vsc_on_cleanup(struct hv_driver *driver);
+
+int stor_vsc_get_major_info(struct storvsc_device_info *device_info,
+				struct storvsc_major_info *major_info);
 
 #endif /* _STORVSC_API_H_ */
diff --git a/drivers/staging/hv/storvsc_drv.c b/drivers/staging/hv/storvsc_drv.c
index e6462a2..f819c6a 100644
--- a/drivers/staging/hv/storvsc_drv.c
+++ b/drivers/staging/hv/storvsc_drv.c
@@ -36,8 +36,20 @@
 #include "version_info.h"
 #include "vmbus.h"
 #include "storvsc_api.h"
+#include "vstorage.h"
+#include "channel.h"
 
 
+static const char *g_driver_name = "storvsc";
+
+/* {ba6163d9-04a1-4d29-b605-72e2ffb1dc7f} */
+static const struct hv_guid gStorVscDeviceType = {
+	.data = {
+		0xd9, 0x63, 0x61, 0xba, 0xa1, 0x04, 0x29, 0x4d,
+		0xb6, 0x05, 0x72, 0xe2, 0xff, 0xb1, 0xdc, 0x7f
+	}
+};
+
 struct host_device_context {
 	/* must be 1st field
 	 * FIXME this is a bug */
@@ -57,13 +69,59 @@
 	struct scatterlist *bounce_sgl;
 
 	struct hv_storvsc_request request;
-	/* !!!DO NOT ADD ANYTHING BELOW HERE!!! */
-	/* The extension buffer falls right here and is pointed to by
-	 * request.Extension;
-	 * Which sounds like a very bad design... */
 };
 
 
+/*
+ * stor_vsc_initialize - Main entry point
+ */
+static int stor_vsc_initialize(struct hv_driver *driver)
+{
+	struct storvsc_driver_object *stor_driver;
+
+	stor_driver = hvdr_to_stordr(driver);
+
+	DPRINT_DBG(STORVSC,
+		   "sizeof(struct hv_storvsc_request)=%zd "
+		   "sizeof(struct vstor_packet)=%zd, "
+		   "sizeof(struct vmscsi_request)=%zd",
+		   sizeof(struct hv_storvsc_request),
+		   sizeof(struct vstor_packet),
+		   sizeof(struct vmscsi_request));
+
+	/* Make sure we are at least 2 pages since 1 page is used for control */
+
+	driver->name = g_driver_name;
+	memcpy(&driver->dev_type, &gStorVscDeviceType,
+	       sizeof(struct hv_guid));
+
+
+	/*
+	 * Divide the ring buffer data size (which is 1 page less
+	 * than the ring buffer size since that page is reserved for
+	 * the ring buffer indices) by the max request size (which is
+	 * vmbus_channel_packet_multipage_buffer + struct vstor_packet + u64)
+	 */
+	stor_driver->max_outstanding_req_per_channel =
+		((stor_driver->ring_buffer_size - PAGE_SIZE) /
+		  ALIGN(MAX_MULTIPAGE_BUFFER_PACKET +
+			   sizeof(struct vstor_packet) + sizeof(u64),
+			   sizeof(u64)));
+
+	DPRINT_INFO(STORVSC, "max io %u, currently %u\n",
+		    stor_driver->max_outstanding_req_per_channel,
+		    STORVSC_MAX_IO_REQUESTS);
+
+	/* Setup the dispatch table */
+	stor_driver->base.dev_add	= stor_vsc_on_device_add;
+	stor_driver->base.dev_rm	= stor_vsc_on_device_remove;
+	stor_driver->base.cleanup	= stor_vsc_on_cleanup;
+
+	stor_driver->on_io_request	= stor_vsc_on_io_request;
+
+	return 0;
+}
+
 /* Static decl */
 static int storvsc_probe(struct device *dev);
 static int storvsc_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd);
@@ -128,7 +186,7 @@
 /*
  * storvsc_drv_init - StorVsc driver initialization.
  */
-static int storvsc_drv_init(int (*drv_init)(struct hv_driver *drv))
+static int storvsc_drv_init(void)
 {
 	int ret;
 	struct storvsc_driver_object *storvsc_drv_obj = &g_storvsc_drv;
@@ -137,13 +195,12 @@
 	storvsc_drv_obj->ring_buffer_size = storvsc_ringbuffer_size;
 
 	/* Callback to client driver to complete the initialization */
-	drv_init(&storvsc_drv_obj->base);
+	stor_vsc_initialize(&storvsc_drv_obj->base);
 
 	drv->priv = storvsc_drv_obj;
 
 	DPRINT_INFO(STORVSC_DRV,
-		    "request extension size %u, max outstanding reqs %u",
-		    storvsc_drv_obj->request_ext_size,
+		    "max outstanding reqs %u",
 		    storvsc_drv_obj->max_outstanding_req_per_channel);
 
 	if (storvsc_drv_obj->max_outstanding_req_per_channel <
@@ -167,6 +224,61 @@
 	return ret;
 }
 
+
+static int stor_vsc_on_host_reset(struct hv_device *device)
+{
+	struct storvsc_device *stor_device;
+	struct hv_storvsc_request *request;
+	struct vstor_packet *vstor_packet;
+	int ret, t;
+
+	DPRINT_INFO(STORVSC, "resetting host adapter...");
+
+	stor_device = get_stor_device(device);
+	if (!stor_device) {
+		DPRINT_ERR(STORVSC, "unable to get stor device..."
+			   "device being destroyed?");
+		return -1;
+	}
+
+	request = &stor_device->reset_request;
+	vstor_packet = &request->vstor_packet;
+
+	init_completion(&request->wait_event);
+
+	vstor_packet->operation = VSTOR_OPERATION_RESET_BUS;
+	vstor_packet->flags = REQUEST_COMPLETION_FLAG;
+	vstor_packet->vm_srb.path_id = stor_device->path_id;
+
+	ret = vmbus_sendpacket(device->channel, vstor_packet,
+			       sizeof(struct vstor_packet),
+			       (unsigned long)&stor_device->reset_request,
+			       VM_PKT_DATA_INBAND,
+			       VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);
+	if (ret != 0) {
+		DPRINT_ERR(STORVSC, "Unable to send reset packet %p ret %d",
+			   vstor_packet, ret);
+		goto cleanup;
+	}
+
+	t = wait_for_completion_timeout(&request->wait_event, HZ);
+	if (t == 0) {
+		ret = -ETIMEDOUT;
+		goto cleanup;
+	}
+
+	DPRINT_INFO(STORVSC, "host adapter reset completed");
+
+	/*
+	 * At this point, all outstanding requests in the adapter
+	 * should have been flushed out and return to us
+	 */
+
+cleanup:
+	put_stor_device(device);
+	return ret;
+}
+
 static int storvsc_drv_exit_cb(struct device *dev, void *data)
 {
 	struct device **curr = (struct device **)data;
@@ -241,8 +353,7 @@
 
 	host_device_ctx->request_pool =
 				kmem_cache_create(dev_name(&device_obj->device),
-					sizeof(struct storvsc_cmd_request) +
-					storvsc_drv_obj->request_ext_size, 0,
+					sizeof(struct storvsc_cmd_request), 0,
 					SLAB_HWCACHE_ALIGN, NULL);
 
 	if (!host_device_ctx->request_pool) {
@@ -293,7 +404,6 @@
  */
 static int storvsc_remove(struct device *device)
 {
-	int ret;
 	struct hv_driver *drv =
 			drv_to_hv_drv(device->driver);
 	struct storvsc_driver_object *storvsc_drv_obj = drv->priv;
@@ -302,20 +412,11 @@
 	struct host_device_context *host_device_ctx =
 			(struct host_device_context *)host->hostdata;
 
-
-	if (!storvsc_drv_obj->base.dev_rm)
-		return -1;
-
 	/*
 	 * Call to the vsc driver to let it know that the device is being
 	 * removed
 	 */
-	ret = storvsc_drv_obj->base.dev_rm(device_obj);
-	if (ret != 0) {
-		/* TODO: */
-		DPRINT_ERR(STORVSC, "unable to remove vsc device (ret %d)",
-			   ret);
-	}
+	storvsc_drv_obj->base.dev_rm(device_obj);
 
 	if (host_device_ctx->request_pool) {
 		kmem_cache_destroy(host_device_ctx->request_pool);
@@ -327,7 +428,7 @@
 
 	DPRINT_INFO(STORVSC, "releasing host adapter (%p)...", host);
 	scsi_host_put(host);
-	return ret;
+	return 0;
 }
 
 /*
@@ -342,6 +443,7 @@
 		(struct host_device_context *)scmnd->device->host->hostdata;
 	void (*scsi_done_fn)(struct scsi_cmnd *);
 	struct scsi_sense_hdr sense_hdr;
+	struct vmscsi_request *vm_srb;
 
 	/* ASSERT(request == &cmd_request->request); */
 	/* ASSERT(scmnd); */
@@ -361,17 +463,19 @@
 				      cmd_request->bounce_sgl_count);
 	}
 
-	scmnd->result = request->status;
+	vm_srb = &request->vstor_packet.vm_srb;
+	scmnd->result = vm_srb->scsi_status;
 
 	if (scmnd->result) {
 		if (scsi_normalize_sense(scmnd->sense_buffer,
-				request->sense_buffer_size, &sense_hdr))
+				SCSI_SENSE_BUFFERSIZE, &sense_hdr))
 			scsi_print_sense_hdr("storvsc", &sense_hdr);
 	}
 
 	/* ASSERT(request->BytesXfer <= request->data_buffer.Length); */
 	scsi_set_resid(scmnd,
-		request->data_buffer.len - request->bytes_xfer);
+		request->data_buffer.len -
+		vm_srb->data_transfer_length);
 
 	scsi_done_fn = scmnd->scsi_done;
 
@@ -597,6 +701,7 @@
 	int i;
 	struct scatterlist *sgl;
 	unsigned int sg_count = 0;
+	struct vmscsi_request *vm_srb;
 
 	DPRINT_DBG(STORVSC_DRV, "scmnd %p dir %d, use_sg %d buf %p len %d "
 		   "queue depth %d tagged %d", scmnd, scmnd->sc_data_direction,
@@ -623,7 +728,7 @@
 
 	request_size = sizeof(struct storvsc_cmd_request);
 
-	cmd_request = kmem_cache_alloc(host_device_ctx->request_pool,
+	cmd_request = kmem_cache_zalloc(host_device_ctx->request_pool,
 				       GFP_ATOMIC);
 	if (!cmd_request) {
 		DPRINT_ERR(STORVSC_DRV, "scmnd (%p) - unable to allocate "
@@ -640,22 +745,20 @@
 	scmnd->host_scribble = (unsigned char *)cmd_request;
 
 	request = &cmd_request->request;
+	vm_srb = &request->vstor_packet.vm_srb;
 
-	request->extension =
-		(void *)((unsigned long)cmd_request + request_size);
-	DPRINT_DBG(STORVSC_DRV, "req %p size %d ext %d", request, request_size,
-		   storvsc_drv_obj->request_ext_size);
+	DPRINT_DBG(STORVSC_DRV, "req %p size %d", request, request_size);
 
 	/* Build the SRB */
 	switch (scmnd->sc_data_direction) {
 	case DMA_TO_DEVICE:
-		request->type = WRITE_TYPE;
+		vm_srb->data_in = WRITE_TYPE;
 		break;
 	case DMA_FROM_DEVICE:
-		request->type = READ_TYPE;
+		vm_srb->data_in = READ_TYPE;
 		break;
 	default:
-		request->type = UNKNOWN_TYPE;
+		vm_srb->data_in = UNKNOWN_TYPE;
 		break;
 	}
 
@@ -663,17 +766,17 @@
 	request->context = cmd_request;/* scmnd; */
 
 	/* request->PortId = scmnd->device->channel; */
-	request->host = host_device_ctx->port;
-	request->bus = scmnd->device->channel;
-	request->target_id = scmnd->device->id;
-	request->lun_id = scmnd->device->lun;
+	vm_srb->port_number = host_device_ctx->port;
+	vm_srb->path_id = scmnd->device->channel;
+	vm_srb->target_id = scmnd->device->id;
+	vm_srb->lun = scmnd->device->lun;
 
 	/* ASSERT(scmnd->cmd_len <= 16); */
-	request->cdb_len = scmnd->cmd_len;
-	request->cdb = scmnd->cmnd;
+	vm_srb->cdb_length = scmnd->cmd_len;
+
+	memcpy(vm_srb->cdb, scmnd->cmnd, vm_srb->cdb_length);
 
 	request->sense_buffer = scmnd->sense_buffer;
-	request->sense_buffer_size = SCSI_SENSE_BUFFERSIZE;
 
 
 	request->data_buffer.len = scsi_bufflen(scmnd);
@@ -923,7 +1026,7 @@
 	int ret;
 
 	DPRINT_INFO(STORVSC_DRV, "Storvsc initializing....");
-	ret = storvsc_drv_init(stor_vsc_initialize);
+	ret = storvsc_drv_init();
 	return ret;
 }
 
diff --git a/drivers/staging/hv/vmbus_drv.c b/drivers/staging/hv/vmbus_drv.c
index 79089f8..c85d796 100644
--- a/drivers/staging/hv/vmbus_drv.c
+++ b/drivers/staging/hv/vmbus_drv.c
@@ -17,7 +17,11 @@
  * Authors:
  *   Haiyang Zhang <haiyangz@microsoft.com>
  *   Hank Janssen  <hjanssen@microsoft.com>
+ *
+ * 3/9/2011: K. Y. Srinivasan	- Significant restructuring and cleanup
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/device.h>
@@ -36,231 +40,20 @@
 #include "vmbus_private.h"
 
 
-/* FIXME! We need to do this dynamically for PIC and APIC system */
-#define VMBUS_IRQ		0x5
-#define VMBUS_IRQ_VECTOR	IRQ5_VECTOR
+struct pci_dev *hv_pci_dev;
 
 /* Main vmbus driver data structure */
-struct vmbus_driver_context {
-
+struct hv_bus {
 	struct bus_type bus;
 	struct tasklet_struct msg_dpc;
 	struct tasklet_struct event_dpc;
-
-	/* The bus root device */
-	struct hv_device device_ctx;
 };
 
-static int vmbus_match(struct device *device, struct device_driver *driver);
-static int vmbus_probe(struct device *device);
-static int vmbus_remove(struct device *device);
-static void vmbus_shutdown(struct device *device);
-static int vmbus_uevent(struct device *device, struct kobj_uevent_env *env);
-
-static irqreturn_t vmbus_isr(int irq, void *dev_id);
-
-static void vmbus_device_release(struct device *device);
-static void vmbus_bus_release(struct device *device);
-
-static ssize_t vmbus_show_device_attr(struct device *dev,
-				      struct device_attribute *dev_attr,
-				      char *buf);
-
-
 unsigned int vmbus_loglevel = (ALL_MODULES << 16 | INFO_LVL);
 EXPORT_SYMBOL(vmbus_loglevel);
 	/* (ALL_MODULES << 16 | DEBUG_LVL_ENTEREXIT); */
 	/* (((VMBUS | VMBUS_DRV)<<16) | DEBUG_LVL_ENTEREXIT); */
 
-static int vmbus_irq = VMBUS_IRQ;
-
-/* Set up per device attributes in /sys/bus/vmbus/devices/<bus device> */
-static struct device_attribute vmbus_device_attrs[] = {
-	__ATTR(id, S_IRUGO, vmbus_show_device_attr, NULL),
-	__ATTR(state, S_IRUGO, vmbus_show_device_attr, NULL),
-	__ATTR(class_id, S_IRUGO, vmbus_show_device_attr, NULL),
-	__ATTR(device_id, S_IRUGO, vmbus_show_device_attr, NULL),
-	__ATTR(monitor_id, S_IRUGO, vmbus_show_device_attr, NULL),
-
-	__ATTR(server_monitor_pending, S_IRUGO, vmbus_show_device_attr, NULL),
-	__ATTR(server_monitor_latency, S_IRUGO, vmbus_show_device_attr, NULL),
-	__ATTR(server_monitor_conn_id, S_IRUGO, vmbus_show_device_attr, NULL),
-
-	__ATTR(client_monitor_pending, S_IRUGO, vmbus_show_device_attr, NULL),
-	__ATTR(client_monitor_latency, S_IRUGO, vmbus_show_device_attr, NULL),
-	__ATTR(client_monitor_conn_id, S_IRUGO, vmbus_show_device_attr, NULL),
-
-	__ATTR(out_intr_mask, S_IRUGO, vmbus_show_device_attr, NULL),
-	__ATTR(out_read_index, S_IRUGO, vmbus_show_device_attr, NULL),
-	__ATTR(out_write_index, S_IRUGO, vmbus_show_device_attr, NULL),
-	__ATTR(out_read_bytes_avail, S_IRUGO, vmbus_show_device_attr, NULL),
-	__ATTR(out_write_bytes_avail, S_IRUGO, vmbus_show_device_attr, NULL),
-
-	__ATTR(in_intr_mask, S_IRUGO, vmbus_show_device_attr, NULL),
-	__ATTR(in_read_index, S_IRUGO, vmbus_show_device_attr, NULL),
-	__ATTR(in_write_index, S_IRUGO, vmbus_show_device_attr, NULL),
-	__ATTR(in_read_bytes_avail, S_IRUGO, vmbus_show_device_attr, NULL),
-	__ATTR(in_write_bytes_avail, S_IRUGO, vmbus_show_device_attr, NULL),
-	__ATTR_NULL
-};
-
-/* The one and only one */
-static struct vmbus_driver_context vmbus_drv = {
-	.bus.name =		"vmbus",
-	.bus.match =		vmbus_match,
-	.bus.shutdown =		vmbus_shutdown,
-	.bus.remove =		vmbus_remove,
-	.bus.probe =		vmbus_probe,
-	.bus.uevent =		vmbus_uevent,
-	.bus.dev_attrs =	vmbus_device_attrs,
-};
-
-static const char *driver_name = "hyperv";
-
-/*
- * Windows vmbus does not defined this.
- * We defined this to be consistent with other devices
- */
-/* {c5295816-f63a-4d5f-8d1a-4daf999ca185} */
-static const struct hv_guid device_type = {
-	.data = {
-		0x16, 0x58, 0x29, 0xc5, 0x3a, 0xf6, 0x5f, 0x4d,
-		0x8d, 0x1a, 0x4d, 0xaf, 0x99, 0x9c, 0xa1, 0x85
-	}
-};
-
-/* {ac3760fc-9adf-40aa-9427-a70ed6de95c5} */
-static const struct hv_guid device_id = {
-	.data = {
-		0xfc, 0x60, 0x37, 0xac, 0xdf, 0x9a, 0xaa, 0x40,
-		0x94, 0x27, 0xa7, 0x0e, 0xd6, 0xde, 0x95, 0xc5
-	}
-};
-
-static struct hv_device *vmbus_device; /* vmbus root device */
-
-
-/*
- * vmbus_dev_add - Callback when the root bus device is added
- */
-static int vmbus_dev_add(struct hv_device *dev, void *info)
-{
-	u32 *irqvector = info;
-	int ret;
-
-	vmbus_device = dev;
-
-	memcpy(&vmbus_device->dev_type, &device_type, sizeof(struct hv_guid));
-	memcpy(&vmbus_device->dev_instance, &device_id,
-	       sizeof(struct hv_guid));
-
-	/* strcpy(dev->name, "vmbus"); */
-	/* SynIC setup... */
-	on_each_cpu(hv_synic_init, (void *)irqvector, 1);
-
-	/* Connect to VMBus in the root partition */
-	ret = vmbus_connect();
-
-	/* VmbusSendEvent(device->localPortId+1); */
-	return ret;
-}
-
-
-struct onmessage_work_context {
-	struct work_struct work;
-	struct hv_message msg;
-};
-
-static void vmbus_onmessage_work(struct work_struct *work)
-{
-	struct onmessage_work_context *ctx;
-
-	ctx = container_of(work, struct onmessage_work_context,
-			   work);
-	vmbus_onmessage(&ctx->msg);
-	kfree(ctx);
-}
-
-/*
- * vmbus_on_msg_dpc - DPC routine to handle messages from the hypervisior
- */
-static void vmbus_on_msg_dpc(unsigned long data)
-{
-	int cpu = smp_processor_id();
-	void *page_addr = hv_context.synic_message_page[cpu];
-	struct hv_message *msg = (struct hv_message *)page_addr +
-				  VMBUS_MESSAGE_SINT;
-	struct onmessage_work_context *ctx;
-
-	while (1) {
-		if (msg->header.message_type == HVMSG_NONE) {
-			/* no msg */
-			break;
-		} else {
-			ctx = kmalloc(sizeof(*ctx), GFP_ATOMIC);
-			if (ctx == NULL)
-				continue;
-			INIT_WORK(&ctx->work, vmbus_onmessage_work);
-			memcpy(&ctx->msg, msg, sizeof(*msg));
-			queue_work(vmbus_connection.work_queue, &ctx->work);
-		}
-
-		msg->header.message_type = HVMSG_NONE;
-
-		/*
-		 * Make sure the write to MessageType (ie set to
-		 * HVMSG_NONE) happens before we read the
-		 * MessagePending and EOMing. Otherwise, the EOMing
-		 * will not deliver any more messages since there is
-		 * no empty slot
-		 */
-		mb();
-
-		if (msg->header.message_flags.msg_pending) {
-			/*
-			 * This will cause message queue rescan to
-			 * possibly deliver another msg from the
-			 * hypervisor
-			 */
-			wrmsrl(HV_X64_MSR_EOM, 0);
-		}
-	}
-}
-
-/*
- * vmbus_on_isr - ISR routine
- */
-static int vmbus_on_isr(void)
-{
-	int ret = 0;
-	int cpu = smp_processor_id();
-	void *page_addr;
-	struct hv_message *msg;
-	union hv_synic_event_flags *event;
-
-	page_addr = hv_context.synic_message_page[cpu];
-	msg = (struct hv_message *)page_addr + VMBUS_MESSAGE_SINT;
-
-	/* Check if there are actual msgs to be process */
-	if (msg->header.message_type != HVMSG_NONE) {
-		DPRINT_DBG(VMBUS, "received msg type %d size %d",
-				msg->header.message_type,
-				msg->header.payload_size);
-		ret |= 0x1;
-	}
-
-	/* TODO: Check if there are events to be process */
-	page_addr = hv_context.synic_event_page[cpu];
-	event = (union hv_synic_event_flags *)page_addr + VMBUS_MESSAGE_SINT;
-
-	/* Since we are a child, we only need to check bit 0 */
-	if (sync_test_and_clear_bit(0, (unsigned long *) &event->flags32[0])) {
-		DPRINT_DBG(VMBUS, "received event %d", event->flags32[0]);
-		ret |= 0x2;
-	}
-
-	return ret;
-}
 
 static void get_channel_info(struct hv_device *device,
 			     struct hv_device_info *info)
@@ -411,308 +204,36 @@
 	}
 }
 
-/*
- * vmbus_bus_init -Main vmbus driver initialization routine.
- *
- * Here, we
- *	- initialize the vmbus driver context
- *	- setup various driver entry points
- *	- invoke the vmbus hv main init routine
- *	- get the irq resource
- *	- invoke the vmbus to add the vmbus root device
- *	- setup the vmbus root device
- *	- retrieve the channel offers
- */
-static int vmbus_bus_init(void)
-{
-	struct vmbus_driver_context *vmbus_drv_ctx = &vmbus_drv;
-	struct hv_device *dev_ctx = &vmbus_drv.device_ctx;
-	int ret;
-	unsigned int vector;
+/* Set up per device attributes in /sys/bus/vmbus/devices/<bus device> */
+static struct device_attribute vmbus_device_attrs[] = {
+	__ATTR(id, S_IRUGO, vmbus_show_device_attr, NULL),
+	__ATTR(state, S_IRUGO, vmbus_show_device_attr, NULL),
+	__ATTR(class_id, S_IRUGO, vmbus_show_device_attr, NULL),
+	__ATTR(device_id, S_IRUGO, vmbus_show_device_attr, NULL),
+	__ATTR(monitor_id, S_IRUGO, vmbus_show_device_attr, NULL),
 
-	DPRINT_INFO(VMBUS, "+++++++ HV Driver version = %s +++++++",
-		    HV_DRV_VERSION);
-	DPRINT_INFO(VMBUS, "+++++++ Vmbus supported version = %d +++++++",
-			VMBUS_REVISION_NUMBER);
-	DPRINT_INFO(VMBUS, "+++++++ Vmbus using SINT %d +++++++",
-			VMBUS_MESSAGE_SINT);
-	DPRINT_DBG(VMBUS, "sizeof(vmbus_channel_packet_page_buffer)=%zd, "
-			"sizeof(VMBUS_CHANNEL_PACKET_MULITPAGE_BUFFER)=%zd",
-			sizeof(struct vmbus_channel_packet_page_buffer),
-			sizeof(struct vmbus_channel_packet_multipage_buffer));
+	__ATTR(server_monitor_pending, S_IRUGO, vmbus_show_device_attr, NULL),
+	__ATTR(server_monitor_latency, S_IRUGO, vmbus_show_device_attr, NULL),
+	__ATTR(server_monitor_conn_id, S_IRUGO, vmbus_show_device_attr, NULL),
 
+	__ATTR(client_monitor_pending, S_IRUGO, vmbus_show_device_attr, NULL),
+	__ATTR(client_monitor_latency, S_IRUGO, vmbus_show_device_attr, NULL),
+	__ATTR(client_monitor_conn_id, S_IRUGO, vmbus_show_device_attr, NULL),
 
-	/* Hypervisor initialization...setup hypercall page..etc */
-	ret = hv_init();
-	if (ret != 0) {
-		DPRINT_ERR(VMBUS, "Unable to initialize the hypervisor - 0x%x",
-				ret);
-		goto cleanup;
-	}
+	__ATTR(out_intr_mask, S_IRUGO, vmbus_show_device_attr, NULL),
+	__ATTR(out_read_index, S_IRUGO, vmbus_show_device_attr, NULL),
+	__ATTR(out_write_index, S_IRUGO, vmbus_show_device_attr, NULL),
+	__ATTR(out_read_bytes_avail, S_IRUGO, vmbus_show_device_attr, NULL),
+	__ATTR(out_write_bytes_avail, S_IRUGO, vmbus_show_device_attr, NULL),
 
+	__ATTR(in_intr_mask, S_IRUGO, vmbus_show_device_attr, NULL),
+	__ATTR(in_read_index, S_IRUGO, vmbus_show_device_attr, NULL),
+	__ATTR(in_write_index, S_IRUGO, vmbus_show_device_attr, NULL),
+	__ATTR(in_read_bytes_avail, S_IRUGO, vmbus_show_device_attr, NULL),
+	__ATTR(in_write_bytes_avail, S_IRUGO, vmbus_show_device_attr, NULL),
+	__ATTR_NULL
+};
 
-	vmbus_drv_ctx->bus.name = driver_name;
-
-	/* Initialize the bus context */
-	tasklet_init(&vmbus_drv_ctx->msg_dpc, vmbus_on_msg_dpc,
-		     (unsigned long)NULL);
-	tasklet_init(&vmbus_drv_ctx->event_dpc, vmbus_on_event,
-		     (unsigned long)NULL);
-
-	/* Now, register the bus  with LDM */
-	ret = bus_register(&vmbus_drv_ctx->bus);
-	if (ret) {
-		ret = -1;
-		goto cleanup;
-	}
-
-	/* Get the interrupt resource */
-	ret = request_irq(vmbus_irq, vmbus_isr, IRQF_SAMPLE_RANDOM,
-			  driver_name, NULL);
-
-	if (ret != 0) {
-		DPRINT_ERR(VMBUS_DRV, "ERROR - Unable to request IRQ %d",
-			   vmbus_irq);
-
-		bus_unregister(&vmbus_drv_ctx->bus);
-
-		ret = -1;
-		goto cleanup;
-	}
-	vector = VMBUS_IRQ_VECTOR;
-
-	DPRINT_INFO(VMBUS_DRV, "irq 0x%x vector 0x%x", vmbus_irq, vector);
-
-	/* Add the root device */
-	memset(dev_ctx, 0, sizeof(struct hv_device));
-
-	ret = vmbus_dev_add(dev_ctx, &vector);
-	if (ret != 0) {
-		DPRINT_ERR(VMBUS_DRV,
-			   "ERROR - Unable to add vmbus root device");
-
-		free_irq(vmbus_irq, NULL);
-
-		bus_unregister(&vmbus_drv_ctx->bus);
-
-		ret = -1;
-		goto cleanup;
-	}
-	/* strcpy(dev_ctx->device.bus_id, dev_ctx->device_obj.name); */
-	dev_set_name(&dev_ctx->device, "vmbus_0_0");
-
-	/* No need to bind a driver to the root device. */
-	dev_ctx->device.parent = NULL;
-	/* NULL; vmbus_remove() does not get invoked */
-	dev_ctx->device.bus = &vmbus_drv_ctx->bus;
-
-	/* Setup the device dispatch table */
-	dev_ctx->device.release = vmbus_bus_release;
-
-	/* register the  root device */
-	ret = device_register(&dev_ctx->device);
-	if (ret) {
-		DPRINT_ERR(VMBUS_DRV,
-			   "ERROR - Unable to register vmbus root device");
-
-		free_irq(vmbus_irq, NULL);
-		bus_unregister(&vmbus_drv_ctx->bus);
-
-		ret = -1;
-		goto cleanup;
-	}
-
-	vmbus_request_offers();
-	wait_for_completion(&hv_channel_ready);
-
-cleanup:
-	return ret;
-}
-
-/*
- * vmbus_bus_exit - Terminate the vmbus driver.
- *
- * This routine is opposite of vmbus_bus_init()
- */
-static void vmbus_bus_exit(void)
-{
-	struct vmbus_driver_context *vmbus_drv_ctx = &vmbus_drv;
-
-	struct hv_device *dev_ctx = &vmbus_drv.device_ctx;
-
-	vmbus_release_unattached_channels();
-	vmbus_disconnect();
-	on_each_cpu(hv_synic_cleanup, NULL, 1);
-
-	hv_cleanup();
-
-	/* Unregister the root bus device */
-	device_unregister(&dev_ctx->device);
-
-	bus_unregister(&vmbus_drv_ctx->bus);
-
-	free_irq(vmbus_irq, NULL);
-
-	tasklet_kill(&vmbus_drv_ctx->msg_dpc);
-	tasklet_kill(&vmbus_drv_ctx->event_dpc);
-}
-
-
-/**
- * vmbus_child_driver_register() - Register a vmbus's child driver
- * @drv:        Pointer to driver structure you want to register
- *
- *
- * Registers the given driver with Linux through the 'driver_register()' call
- * And sets up the hyper-v vmbus handling for this driver.
- * It will return the state of the 'driver_register()' call.
- *
- * Mainly used by Hyper-V drivers.
- */
-int vmbus_child_driver_register(struct device_driver *drv)
-{
-	int ret;
-
-	DPRINT_INFO(VMBUS_DRV, "child driver (%p) registering - name %s",
-		    drv, drv->name);
-
-	/* The child driver on this vmbus */
-	drv->bus = &vmbus_drv.bus;
-
-	ret = driver_register(drv);
-
-	vmbus_request_offers();
-
-	return ret;
-}
-EXPORT_SYMBOL(vmbus_child_driver_register);
-
-/**
- * vmbus_child_driver_unregister() - Unregister a vmbus's child driver
- * @drv:        Pointer to driver structure you want to un-register
- *
- *
- * Un-register the given driver with Linux through the 'driver_unregister()'
- * call. And ungegisters the driver from the Hyper-V vmbus handler.
- *
- * Mainly used by Hyper-V drivers.
- */
-void vmbus_child_driver_unregister(struct device_driver *drv)
-{
-	DPRINT_INFO(VMBUS_DRV, "child driver (%p) unregistering - name %s",
-		    drv, drv->name);
-
-	driver_unregister(drv);
-
-	drv->bus = NULL;
-}
-EXPORT_SYMBOL(vmbus_child_driver_unregister);
-
-/*
- * vmbus_child_device_create - Creates and registers a new child device
- * on the vmbus.
- */
-struct hv_device *vmbus_child_device_create(struct hv_guid *type,
-					    struct hv_guid *instance,
-					    struct vmbus_channel *channel)
-{
-	struct hv_device *child_device_obj;
-
-	/* Allocate the new child device */
-	child_device_obj = kzalloc(sizeof(struct hv_device), GFP_KERNEL);
-	if (!child_device_obj) {
-		DPRINT_ERR(VMBUS_DRV,
-			"unable to allocate device_context for child device");
-		return NULL;
-	}
-
-	DPRINT_DBG(VMBUS_DRV, "child device (%p) allocated - "
-		"type {%02x%02x%02x%02x-%02x%02x-%02x%02x-"
-		"%02x%02x%02x%02x%02x%02x%02x%02x},"
-		"id {%02x%02x%02x%02x-%02x%02x-%02x%02x-"
-		"%02x%02x%02x%02x%02x%02x%02x%02x}",
-		&child_device_obj->device,
-		type->data[3], type->data[2], type->data[1], type->data[0],
-		type->data[5], type->data[4], type->data[7], type->data[6],
-		type->data[8], type->data[9], type->data[10], type->data[11],
-		type->data[12], type->data[13], type->data[14], type->data[15],
-		instance->data[3], instance->data[2],
-		instance->data[1], instance->data[0],
-		instance->data[5], instance->data[4],
-		instance->data[7], instance->data[6],
-		instance->data[8], instance->data[9],
-		instance->data[10], instance->data[11],
-		instance->data[12], instance->data[13],
-		instance->data[14], instance->data[15]);
-
-	child_device_obj->channel = channel;
-	memcpy(&child_device_obj->dev_type, type, sizeof(struct hv_guid));
-	memcpy(&child_device_obj->dev_instance, instance,
-	       sizeof(struct hv_guid));
-
-
-	return child_device_obj;
-}
-
-/*
- * vmbus_child_device_register - Register the child device
- */
-int vmbus_child_device_register(struct hv_device *child_device_obj)
-{
-	int ret = 0;
-
-	static atomic_t device_num = ATOMIC_INIT(0);
-
-	DPRINT_DBG(VMBUS_DRV, "child device (%p) registering",
-		   child_device_obj);
-
-	/* Set the device name. Otherwise, device_register() will fail. */
-	dev_set_name(&child_device_obj->device, "vmbus_0_%d",
-		     atomic_inc_return(&device_num));
-
-	/* The new device belongs to this bus */
-	child_device_obj->device.bus = &vmbus_drv.bus; /* device->dev.bus; */
-	child_device_obj->device.parent = &vmbus_device->device;
-	child_device_obj->device.release = vmbus_device_release;
-
-	/*
-	 * Register with the LDM. This will kick off the driver/device
-	 * binding...which will eventually call vmbus_match() and vmbus_probe()
-	 */
-	ret = device_register(&child_device_obj->device);
-
-	/* vmbus_probe() error does not get propergate to device_register(). */
-	ret = child_device_obj->probe_error;
-
-	if (ret)
-		DPRINT_ERR(VMBUS_DRV, "unable to register child device (%p)",
-			   &child_device_obj->device);
-	else
-		DPRINT_INFO(VMBUS_DRV, "child device (%p) registered",
-			    &child_device_obj->device);
-
-	return ret;
-}
-
-/*
- * vmbus_child_device_unregister - Remove the specified child device
- * from the vmbus.
- */
-void vmbus_child_device_unregister(struct hv_device *device_obj)
-{
-
-	DPRINT_INFO(VMBUS_DRV, "unregistering child device (%p)",
-		    &device_obj->device);
-
-	/*
-	 * Kick off the process of unregistering the device.
-	 * This will call vmbus_remove() and eventually vmbus_device_release()
-	 */
-	device_unregister(&device_obj->device);
-
-	DPRINT_INFO(VMBUS_DRV, "child device (%p) unregistered",
-		    &device_obj->device);
-}
 
 /*
  * vmbus_uevent - add uevent for our device
@@ -726,21 +247,6 @@
 	struct hv_device *dev = device_to_hv_device(device);
 	int ret;
 
-	DPRINT_INFO(VMBUS_DRV, "generating uevent - VMBUS_DEVICE_CLASS_GUID={"
-		    "%02x%02x%02x%02x-%02x%02x-%02x%02x-"
-		    "%02x%02x%02x%02x%02x%02x%02x%02x}",
-		    dev->dev_type.data[3], dev->dev_type.data[2],
-		    dev->dev_type.data[1], dev->dev_type.data[0],
-		    dev->dev_type.data[5], dev->dev_type.data[4],
-		    dev->dev_type.data[7], dev->dev_type.data[6],
-		    dev->dev_type.data[8], dev->dev_type.data[9],
-		    dev->dev_type.data[10],
-		    dev->dev_type.data[11],
-		    dev->dev_type.data[12],
-		    dev->dev_type.data[13],
-		    dev->dev_type.data[14],
-		    dev->dev_type.data[15]);
-
 	ret = add_uevent_var(env, "VMBUS_DEVICE_CLASS_GUID={"
 			     "%02x%02x%02x%02x-%02x%02x-%02x%02x-"
 			     "%02x%02x%02x%02x%02x%02x%02x%02x}",
@@ -789,6 +295,7 @@
 	return 0;
 }
 
+
 /*
  * vmbus_match - Attempt to match the specified device to the specified driver
  */
@@ -803,16 +310,13 @@
 		   sizeof(struct hv_guid)) == 0) {
 
 		device_ctx->drv = drv->priv;
-		DPRINT_INFO(VMBUS_DRV,
-			    "device object (%p) set to driver object (%p)",
-			    &device_ctx,
-			    device_ctx->drv);
 
 		match = 1;
 	}
 	return match;
 }
 
+
 /*
  * vmbus_probe_failed_cb - Callback when a driver probe failed in vmbus_probe()
  *
@@ -848,18 +352,16 @@
 		ret = dev->probe_error =
 		drv->driver.probe(child_device);
 		if (ret != 0) {
-			DPRINT_ERR(VMBUS_DRV, "probe() failed for device %s "
-				   "(%p) on driver %s (%d)...",
-				   dev_name(child_device), child_device,
-				   child_device->driver->name, ret);
+			pr_err("probe failed for device %s (%d)\n",
+			       dev_name(child_device), ret);
 
 			INIT_WORK(&dev->probe_failed_work_item,
 				  vmbus_probe_failed_cb);
 			schedule_work(&dev->probe_failed_work_item);
 		}
 	} else {
-		DPRINT_ERR(VMBUS_DRV, "probe() method not set for driver - %s",
-			   child_device->driver->name);
+		pr_err("probe not set for driver %s\n",
+		       dev_name(child_device));
 		ret = -1;
 	}
 	return ret;
@@ -873,14 +375,6 @@
 	int ret;
 	struct hv_driver *drv;
 
-	/* Special case root bus device */
-	if (child_device->parent == NULL) {
-		/*
-		 * No-op since it is statically defined and handle in
-		 * vmbus_bus_exit()
-		 */
-		return 0;
-	}
 
 	if (child_device->driver) {
 		drv = drv_to_hv_drv(child_device->driver);
@@ -892,9 +386,8 @@
 		if (drv->driver.remove) {
 			ret = drv->driver.remove(child_device);
 		} else {
-			DPRINT_ERR(VMBUS_DRV,
-				   "remove() method not set for driver - %s",
-				   child_device->driver->name);
+			pr_err("remove not set for driver %s\n",
+				dev_name(child_device));
 			ret = -1;
 		}
 	}
@@ -902,6 +395,7 @@
 	return 0;
 }
 
+
 /*
  * vmbus_shutdown - Shutdown a vmbus device
  */
@@ -909,14 +403,6 @@
 {
 	struct hv_driver *drv;
 
-	/* Special case root bus device */
-	if (child_device->parent == NULL) {
-		/*
-		 * No-op since it is statically defined and handle in
-		 * vmbus_bus_exit()
-		 */
-		return;
-	}
 
 	/* The device may not be attached yet */
 	if (!child_device->driver)
@@ -931,17 +417,6 @@
 	return;
 }
 
-/*
- * vmbus_bus_release - Final callback release of the vmbus root device
- */
-static void vmbus_bus_release(struct device *device)
-{
-	/* FIXME */
-	/* Empty release functions are a bug, or a major sign
-	 * of a problem design, this MUST BE FIXED! */
-	dev_err(device, "%s needs to be fixed!\n", __func__);
-	WARN_ON(1);
-}
 
 /*
  * vmbus_device_release - Final callback release of the vmbus child device
@@ -952,9 +427,111 @@
 
 	kfree(device_ctx);
 
-	/* !!DO NOT REFERENCE device_ctx anymore at this point!! */
 }
 
+/* The one and only one */
+static struct hv_bus  hv_bus = {
+	.bus.name =		"vmbus",
+	.bus.match =		vmbus_match,
+	.bus.shutdown =		vmbus_shutdown,
+	.bus.remove =		vmbus_remove,
+	.bus.probe =		vmbus_probe,
+	.bus.uevent =		vmbus_uevent,
+	.bus.dev_attrs =	vmbus_device_attrs,
+};
+
+static const char *driver_name = "hyperv";
+
+
+struct onmessage_work_context {
+	struct work_struct work;
+	struct hv_message msg;
+};
+
+static void vmbus_onmessage_work(struct work_struct *work)
+{
+	struct onmessage_work_context *ctx;
+
+	ctx = container_of(work, struct onmessage_work_context,
+			   work);
+	vmbus_onmessage(&ctx->msg);
+	kfree(ctx);
+}
+
+/*
+ * vmbus_on_msg_dpc - DPC routine to handle messages from the hypervisior
+ */
+static void vmbus_on_msg_dpc(unsigned long data)
+{
+	int cpu = smp_processor_id();
+	void *page_addr = hv_context.synic_message_page[cpu];
+	struct hv_message *msg = (struct hv_message *)page_addr +
+				  VMBUS_MESSAGE_SINT;
+	struct onmessage_work_context *ctx;
+
+	while (1) {
+		if (msg->header.message_type == HVMSG_NONE) {
+			/* no msg */
+			break;
+		} else {
+			ctx = kmalloc(sizeof(*ctx), GFP_ATOMIC);
+			if (ctx == NULL)
+				continue;
+			INIT_WORK(&ctx->work, vmbus_onmessage_work);
+			memcpy(&ctx->msg, msg, sizeof(*msg));
+			queue_work(vmbus_connection.work_queue, &ctx->work);
+		}
+
+		msg->header.message_type = HVMSG_NONE;
+
+		/*
+		 * Make sure the write to MessageType (ie set to
+		 * HVMSG_NONE) happens before we read the
+		 * MessagePending and EOMing. Otherwise, the EOMing
+		 * will not deliver any more messages since there is
+		 * no empty slot
+		 */
+		mb();
+
+		if (msg->header.message_flags.msg_pending) {
+			/*
+			 * This will cause message queue rescan to
+			 * possibly deliver another msg from the
+			 * hypervisor
+			 */
+			wrmsrl(HV_X64_MSR_EOM, 0);
+		}
+	}
+}
+
+/*
+ * vmbus_on_isr - ISR routine
+ */
+static int vmbus_on_isr(void)
+{
+	int ret = 0;
+	int cpu = smp_processor_id();
+	void *page_addr;
+	struct hv_message *msg;
+	union hv_synic_event_flags *event;
+
+	page_addr = hv_context.synic_message_page[cpu];
+	msg = (struct hv_message *)page_addr + VMBUS_MESSAGE_SINT;
+
+	/* Check if there are actual msgs to be process */
+	if (msg->header.message_type != HVMSG_NONE)
+		ret |= 0x1;
+
+	/* TODO: Check if there are events to be process */
+	page_addr = hv_context.synic_event_page[cpu];
+	event = (union hv_synic_event_flags *)page_addr + VMBUS_MESSAGE_SINT;
+
+	/* Since we are a child, we only need to check bit 0 */
+	if (sync_test_and_clear_bit(0, (unsigned long *) &event->flags32[0]))
+		ret |= 0x2;
+
+	return ret;
+}
 
 
 static irqreturn_t vmbus_isr(int irq, void *dev_id)
@@ -966,10 +543,10 @@
 	/* Schedules a dpc if necessary */
 	if (ret > 0) {
 		if (test_bit(0, (unsigned long *)&ret))
-			tasklet_schedule(&vmbus_drv.msg_dpc);
+			tasklet_schedule(&hv_bus.msg_dpc);
 
 		if (test_bit(1, (unsigned long *)&ret))
-			tasklet_schedule(&vmbus_drv.event_dpc);
+			tasklet_schedule(&hv_bus.event_dpc);
 
 		return IRQ_HANDLED;
 	} else {
@@ -977,36 +554,244 @@
 	}
 }
 
-static struct dmi_system_id __initdata microsoft_hv_dmi_table[] = {
-	{
-		.ident = "Hyper-V",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
-			DMI_MATCH(DMI_PRODUCT_NAME, "Virtual Machine"),
-			DMI_MATCH(DMI_BOARD_NAME, "Virtual Machine"),
-		},
-	},
-	{ },
-};
-MODULE_DEVICE_TABLE(dmi, microsoft_hv_dmi_table);
-
-static int __init vmbus_init(void)
+/*
+ * vmbus_bus_init -Main vmbus driver initialization routine.
+ *
+ * Here, we
+ *	- initialize the vmbus driver context
+ *	- invoke the vmbus hv main init routine
+ *	- get the irq resource
+ *	- retrieve the channel offers
+ */
+static int vmbus_bus_init(struct pci_dev *pdev)
 {
-	DPRINT_INFO(VMBUS_DRV,
-		"Vmbus initializing.... current log level 0x%x (%x,%x)",
-		vmbus_loglevel, HIWORD(vmbus_loglevel), LOWORD(vmbus_loglevel));
-	/* Todo: it is used for loglevel, to be ported to new kernel. */
+	int ret;
+	unsigned int vector;
 
-	if (!dmi_check_system(microsoft_hv_dmi_table))
-		return -ENODEV;
+	/* Hypervisor initialization...setup hypercall page..etc */
+	ret = hv_init();
+	if (ret != 0) {
+		pr_err("Unable to initialize the hypervisor - 0x%x\n", ret);
+		goto cleanup;
+	}
 
-	return vmbus_bus_init();
+	hv_bus.bus.name = driver_name;
+
+	/* Initialize the bus context */
+	tasklet_init(&hv_bus.msg_dpc, vmbus_on_msg_dpc, 0);
+	tasklet_init(&hv_bus.event_dpc, vmbus_on_event, 0);
+
+	/* Now, register the bus  with LDM */
+	ret = bus_register(&hv_bus.bus);
+	if (ret) {
+		ret = -1;
+		goto cleanup;
+	}
+
+	/* Get the interrupt resource */
+	ret = request_irq(pdev->irq, vmbus_isr,
+			  IRQF_SHARED | IRQF_SAMPLE_RANDOM,
+			  driver_name, pdev);
+
+	if (ret != 0) {
+		pr_err("Unable to request IRQ %d\n",
+			   pdev->irq);
+
+		bus_unregister(&hv_bus.bus);
+
+		ret = -1;
+		goto cleanup;
+	}
+
+	vector = IRQ0_VECTOR + pdev->irq;
+
+	/*
+	 * Notify the hypervisor of our irq and
+	 * connect to the host.
+	 */
+	on_each_cpu(hv_synic_init, (void *)&vector, 1);
+	ret = vmbus_connect();
+	if (ret) {
+		free_irq(pdev->irq, pdev);
+		bus_unregister(&hv_bus.bus);
+		goto cleanup;
+	}
+
+
+	vmbus_request_offers();
+	wait_for_completion(&hv_channel_ready);
+
+cleanup:
+	return ret;
 }
 
-static void __exit vmbus_exit(void)
+/*
+ * vmbus_bus_exit - Terminate the vmbus driver.
+ *
+ * This routine is opposite of vmbus_bus_init()
+ */
+static void vmbus_bus_exit(void)
 {
-	vmbus_bus_exit();
-	/* Todo: it is used for loglevel, to be ported to new kernel. */
+
+
+	vmbus_release_unattached_channels();
+	vmbus_disconnect();
+	on_each_cpu(hv_synic_cleanup, NULL, 1);
+
+	hv_cleanup();
+
+	bus_unregister(&hv_bus.bus);
+
+	free_irq(hv_pci_dev->irq, hv_pci_dev);
+
+	tasklet_kill(&hv_bus.msg_dpc);
+	tasklet_kill(&hv_bus.event_dpc);
+}
+
+
+/**
+ * vmbus_child_driver_register() - Register a vmbus's child driver
+ * @drv:        Pointer to driver structure you want to register
+ *
+ *
+ * Registers the given driver with Linux through the 'driver_register()' call
+ * And sets up the hyper-v vmbus handling for this driver.
+ * It will return the state of the 'driver_register()' call.
+ *
+ * Mainly used by Hyper-V drivers.
+ */
+int vmbus_child_driver_register(struct device_driver *drv)
+{
+	int ret;
+
+	pr_info("child driver registering - name %s\n", drv->name);
+
+	/* The child driver on this vmbus */
+	drv->bus = &hv_bus.bus;
+
+	ret = driver_register(drv);
+
+	vmbus_request_offers();
+
+	return ret;
+}
+EXPORT_SYMBOL(vmbus_child_driver_register);
+
+/**
+ * vmbus_child_driver_unregister() - Unregister a vmbus's child driver
+ * @drv:        Pointer to driver structure you want to un-register
+ *
+ *
+ * Un-register the given driver with Linux through the 'driver_unregister()'
+ * call. And ungegisters the driver from the Hyper-V vmbus handler.
+ *
+ * Mainly used by Hyper-V drivers.
+ */
+void vmbus_child_driver_unregister(struct device_driver *drv)
+{
+	pr_info("child driver unregistering - name %s\n", drv->name);
+
+	driver_unregister(drv);
+
+	drv->bus = NULL;
+}
+EXPORT_SYMBOL(vmbus_child_driver_unregister);
+
+/*
+ * vmbus_child_device_create - Creates and registers a new child device
+ * on the vmbus.
+ */
+struct hv_device *vmbus_child_device_create(struct hv_guid *type,
+					    struct hv_guid *instance,
+					    struct vmbus_channel *channel)
+{
+	struct hv_device *child_device_obj;
+
+	/* Allocate the new child device */
+	child_device_obj = kzalloc(sizeof(struct hv_device), GFP_KERNEL);
+	if (!child_device_obj) {
+		pr_err("Unable to allocate device object for child device\n");
+		return NULL;
+	}
+
+	child_device_obj->channel = channel;
+	memcpy(&child_device_obj->dev_type, type, sizeof(struct hv_guid));
+	memcpy(&child_device_obj->dev_instance, instance,
+	       sizeof(struct hv_guid));
+
+
+	return child_device_obj;
+}
+
+/*
+ * vmbus_child_device_register - Register the child device
+ */
+int vmbus_child_device_register(struct hv_device *child_device_obj)
+{
+	int ret = 0;
+
+	static atomic_t device_num = ATOMIC_INIT(0);
+
+	/* Set the device name. Otherwise, device_register() will fail. */
+	dev_set_name(&child_device_obj->device, "vmbus_0_%d",
+		     atomic_inc_return(&device_num));
+
+	/* The new device belongs to this bus */
+	child_device_obj->device.bus = &hv_bus.bus; /* device->dev.bus; */
+	child_device_obj->device.parent = &hv_pci_dev->dev;
+	child_device_obj->device.release = vmbus_device_release;
+
+	/*
+	 * Register with the LDM. This will kick off the driver/device
+	 * binding...which will eventually call vmbus_match() and vmbus_probe()
+	 */
+	ret = device_register(&child_device_obj->device);
+
+	/* vmbus_probe() error does not get propergate to device_register(). */
+	ret = child_device_obj->probe_error;
+
+	if (ret)
+		pr_err("Unable to register child device\n");
+	else
+		pr_info("child device %s registered\n",
+			dev_name(&child_device_obj->device));
+
+	return ret;
+}
+
+/*
+ * vmbus_child_device_unregister - Remove the specified child device
+ * from the vmbus.
+ */
+void vmbus_child_device_unregister(struct hv_device *device_obj)
+{
+	/*
+	 * Kick off the process of unregistering the device.
+	 * This will call vmbus_remove() and eventually vmbus_device_release()
+	 */
+	device_unregister(&device_obj->device);
+
+	pr_info("child device %s unregistered\n",
+		dev_name(&device_obj->device));
+}
+
+
+static int __devinit hv_pci_probe(struct pci_dev *pdev,
+				const struct pci_device_id *ent)
+{
+	int err;
+
+	hv_pci_dev = pdev;
+
+	err = pci_enable_device(pdev);
+	if (err)
+		return err;
+
+	err = vmbus_bus_init(pdev);
+	if (err)
+		pci_disable_device(pdev);
+
+	return err;
 }
 
 /*
@@ -1021,10 +806,28 @@
 };
 MODULE_DEVICE_TABLE(pci, microsoft_hv_pci_table);
 
+static struct pci_driver hv_bus_driver = {
+	.name =           "hv_bus",
+	.probe =          hv_pci_probe,
+	.id_table =       microsoft_hv_pci_table,
+};
+
+static int __init hv_pci_init(void)
+{
+	return pci_register_driver(&hv_bus_driver);
+}
+
+static void __exit hv_pci_exit(void)
+{
+	vmbus_bus_exit();
+	pci_unregister_driver(&hv_bus_driver);
+}
+
+
+
 MODULE_LICENSE("GPL");
 MODULE_VERSION(HV_DRV_VERSION);
-module_param(vmbus_irq, int, S_IRUGO);
-module_param(vmbus_loglevel, int, S_IRUGO);
+module_param(vmbus_loglevel, int, S_IRUGO|S_IWUSR);
 
-module_init(vmbus_init);
-module_exit(vmbus_exit);
+module_init(hv_pci_init);
+module_exit(hv_pci_exit);
diff --git a/drivers/staging/hv/vstorage.h b/drivers/staging/hv/vstorage.h
index ebb4d67..83060cd 100644
--- a/drivers/staging/hv/vstorage.h
+++ b/drivers/staging/hv/vstorage.h
@@ -25,6 +25,9 @@
 /* to alert the user that structure sizes may be mismatched even though the */
 /* protocol versions match. */
 
+#ifndef _VSTORAGE_H_
+#define _VSTORAGE_H_
+
 #define REVISION_STRING(REVISION_) #REVISION_
 #define FILL_VMSTOR_REVISION(RESULT_LVALUE_)				\
 	do {								\
@@ -190,3 +193,5 @@
 
 /*  This is the set of flags that the vsc can set in any packets it sends */
 #define VSC_LEGAL_FLAGS		(REQUEST_COMPLETION_FLAG)
+
+#endif /* _VSTORAGE_H_ */
diff --git a/drivers/staging/iio/Documentation/sysfs-bus-iio b/drivers/staging/iio/Documentation/sysfs-bus-iio
index 4915aee..49047ad 100644
--- a/drivers/staging/iio/Documentation/sysfs-bus-iio
+++ b/drivers/staging/iio/Documentation/sysfs-bus-iio
@@ -698,3 +698,10 @@
 		with all _en attributes to establish which channels are present,
 		and the relevant _type attributes to establish the data storage
 		format.
+
+What:		/sys/bus/iio/devices/deviceX/gyro_z_quadrature_correction_raw
+KernelVersion:	2.6.38
+Contact:	linux-iio@xxxxxxxxxxxxxxx
+Description:
+		This attribute is used to read the amount of quadrature error
+		present in the device at a given time.
diff --git a/drivers/staging/iio/adc/Kconfig b/drivers/staging/iio/adc/Kconfig
index 6692a3d..4159389 100644
--- a/drivers/staging/iio/adc/Kconfig
+++ b/drivers/staging/iio/adc/Kconfig
@@ -142,6 +142,17 @@
 	  To compile this driver as a module, choose M here: the
 	  module will be called ad7887.
 
+config AD7780
+	tristate "Analog Devices AD7780 AD7781 ADC driver"
+	depends on SPI
+	help
+	  Say yes here to build support for Analog Devices
+	  AD7780 and AD7781 SPI analog to digital convertors (ADC).
+	  If unsure, say N (but it's safe to say "Y").
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called ad7780.
+
 config AD7745
 	tristate "Analog Devices AD7745, AD7746 AD7747 capacitive sensor driver"
 	depends on I2C
diff --git a/drivers/staging/iio/adc/Makefile b/drivers/staging/iio/adc/Makefile
index 31067de..1d9b3f5 100644
--- a/drivers/staging/iio/adc/Makefile
+++ b/drivers/staging/iio/adc/Makefile
@@ -34,6 +34,7 @@
 obj-$(CONFIG_AD7291) += ad7291.o
 obj-$(CONFIG_AD7314) += ad7314.o
 obj-$(CONFIG_AD7745) += ad7745.o
+obj-$(CONFIG_AD7780) += ad7780.o
 obj-$(CONFIG_AD7816) += ad7816.o
 obj-$(CONFIG_ADT75) += adt75.o
 obj-$(CONFIG_ADT7310) += adt7310.o
diff --git a/drivers/staging/iio/adc/ad7780.c b/drivers/staging/iio/adc/ad7780.c
new file mode 100644
index 0000000..0fd994f
--- /dev/null
+++ b/drivers/staging/iio/adc/ad7780.c
@@ -0,0 +1,329 @@
+/*
+ * AD7780/AD7781 SPI ADC driver
+ *
+ * Copyright 2011 Analog Devices Inc.
+ *
+ * Licensed under the GPL-2.
+ */
+
+#include <linux/interrupt.h>
+#include <linux/workqueue.h>
+#include <linux/device.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/sysfs.h>
+#include <linux/list.h>
+#include <linux/spi/spi.h>
+#include <linux/regulator/consumer.h>
+#include <linux/err.h>
+#include <linux/sched.h>
+#include <linux/gpio.h>
+
+#include "../iio.h"
+#include "../sysfs.h"
+#include "../ring_generic.h"
+#include "adc.h"
+
+#include "ad7780.h"
+
+#define AD7780_RDY	(1 << 7)
+#define AD7780_FILTER	(1 << 6)
+#define AD7780_ERR	(1 << 5)
+#define AD7780_ID1	(1 << 4)
+#define AD7780_ID0	(1 << 3)
+#define AD7780_GAIN	(1 << 2)
+#define AD7780_PAT1	(1 << 1)
+#define AD7780_PAT0	(1 << 0)
+
+struct ad7780_chip_info {
+	u8				bits;
+	u8				storagebits;
+	u8				res_shift;
+};
+
+struct ad7780_state {
+	struct iio_dev			*indio_dev;
+	struct spi_device		*spi;
+	const struct ad7780_chip_info	*chip_info;
+	struct regulator		*reg;
+	struct ad7780_platform_data	*pdata;
+	wait_queue_head_t		wq_data_avail;
+	bool				done;
+	u16				int_vref_mv;
+	struct spi_transfer		xfer;
+	struct spi_message		msg;
+	/*
+	 * DMA (thus cache coherency maintenance) requires the
+	 * transfer buffers to live in their own cache lines.
+	 */
+	unsigned int			data ____cacheline_aligned;
+};
+
+enum ad7780_supported_device_ids {
+	ID_AD7780,
+	ID_AD7781,
+};
+
+static int ad7780_read(struct ad7780_state *st, int *val)
+{
+	int ret;
+
+	spi_bus_lock(st->spi->master);
+
+	enable_irq(st->spi->irq);
+	st->done = false;
+	gpio_set_value(st->pdata->gpio_pdrst, 1);
+
+	ret = wait_event_interruptible(st->wq_data_avail, st->done);
+	disable_irq_nosync(st->spi->irq);
+	if (ret)
+		goto out;
+
+	ret = spi_sync_locked(st->spi, &st->msg);
+	*val = be32_to_cpu(st->data);
+out:
+	gpio_set_value(st->pdata->gpio_pdrst, 0);
+	spi_bus_unlock(st->spi->master);
+
+	return ret;
+}
+
+static ssize_t ad7780_scan(struct device *dev,
+			    struct device_attribute *attr,
+			    char *buf)
+{
+	struct iio_dev *dev_info = dev_get_drvdata(dev);
+	struct ad7780_state *st = dev_info->dev_data;
+	int ret, val, smpl;
+
+	mutex_lock(&dev_info->mlock);
+	ret = ad7780_read(st, &smpl);
+	mutex_unlock(&dev_info->mlock);
+
+	if (ret < 0)
+		return ret;
+
+	if ((smpl & AD7780_ERR) ||
+		!((smpl & AD7780_PAT0) && !(smpl & AD7780_PAT1)))
+		return -EIO;
+
+	val = (smpl >> st->chip_info->res_shift) &
+		((1 << (st->chip_info->bits)) - 1);
+	val -= (1 << (st->chip_info->bits - 1));
+
+	if (!(smpl & AD7780_GAIN))
+		val *= 128;
+
+	return sprintf(buf, "%d\n", val);
+}
+static IIO_DEV_ATTR_IN_RAW(0, ad7780_scan, 0);
+
+static ssize_t ad7780_show_scale(struct device *dev,
+				struct device_attribute *attr,
+				char *buf)
+{
+	struct iio_dev *dev_info = dev_get_drvdata(dev);
+	struct ad7780_state *st = iio_dev_get_devdata(dev_info);
+	/* Corresponds to Vref / 2^(bits-1) */
+	unsigned int scale = (st->int_vref_mv * 100000) >>
+		(st->chip_info->bits - 1);
+
+	return sprintf(buf, "%d.%05d\n", scale / 100000, scale % 100000);
+}
+static IIO_DEVICE_ATTR(in_scale, S_IRUGO, ad7780_show_scale, NULL, 0);
+
+static ssize_t ad7780_show_name(struct device *dev,
+				 struct device_attribute *attr,
+				 char *buf)
+{
+	struct iio_dev *dev_info = dev_get_drvdata(dev);
+	struct ad7780_state *st = iio_dev_get_devdata(dev_info);
+
+	return sprintf(buf, "%s\n", spi_get_device_id(st->spi)->name);
+}
+static IIO_DEVICE_ATTR(name, S_IRUGO, ad7780_show_name, NULL, 0);
+
+static struct attribute *ad7780_attributes[] = {
+	&iio_dev_attr_in0_raw.dev_attr.attr,
+	&iio_dev_attr_in_scale.dev_attr.attr,
+	&iio_dev_attr_name.dev_attr.attr,
+	NULL,
+};
+
+static const struct attribute_group ad7780_attribute_group = {
+	.attrs = ad7780_attributes,
+};
+
+static const struct ad7780_chip_info ad7780_chip_info_tbl[] = {
+	[ID_AD7780] = {
+		.bits = 24,
+		.storagebits = 32,
+		.res_shift = 8,
+	},
+	[ID_AD7781] = {
+		.bits = 20,
+		.storagebits = 32,
+		.res_shift = 12,
+	},
+};
+
+/**
+ *  Interrupt handler
+ */
+static irqreturn_t ad7780_interrupt(int irq, void *dev_id)
+{
+	struct ad7780_state *st = dev_id;
+
+	st->done = true;
+	wake_up_interruptible(&st->wq_data_avail);
+
+	return IRQ_HANDLED;
+};
+
+static int __devinit ad7780_probe(struct spi_device *spi)
+{
+	struct ad7780_platform_data *pdata = spi->dev.platform_data;
+	struct ad7780_state *st;
+	int ret, voltage_uv = 0;
+
+	if (!pdata) {
+		dev_dbg(&spi->dev, "no platform data?\n");
+		return -ENODEV;
+	}
+
+	st = kzalloc(sizeof(*st), GFP_KERNEL);
+	if (st == NULL) {
+		ret = -ENOMEM;
+		goto error_ret;
+	}
+
+	st->reg = regulator_get(&spi->dev, "vcc");
+	if (!IS_ERR(st->reg)) {
+		ret = regulator_enable(st->reg);
+		if (ret)
+			goto error_put_reg;
+
+		voltage_uv = regulator_get_voltage(st->reg);
+	}
+
+	st->chip_info =
+		&ad7780_chip_info_tbl[spi_get_device_id(spi)->driver_data];
+
+	st->pdata = pdata;
+
+	if (pdata && pdata->vref_mv)
+		st->int_vref_mv = pdata->vref_mv;
+	else if (voltage_uv)
+		st->int_vref_mv = voltage_uv / 1000;
+	else
+		dev_warn(&spi->dev, "reference voltage unspecified\n");
+
+	spi_set_drvdata(spi, st);
+	st->spi = spi;
+
+	st->indio_dev = iio_allocate_device();
+	if (st->indio_dev == NULL) {
+		ret = -ENOMEM;
+		goto error_disable_reg;
+	}
+
+	/* Establish that the iio_dev is a child of the spi device */
+	st->indio_dev->dev.parent = &spi->dev;
+	st->indio_dev->attrs = &ad7780_attribute_group;
+	st->indio_dev->dev_data = (void *)(st);
+	st->indio_dev->driver_module = THIS_MODULE;
+	st->indio_dev->modes = INDIO_DIRECT_MODE;
+
+	init_waitqueue_head(&st->wq_data_avail);
+
+	/* Setup default message */
+
+	st->xfer.rx_buf = &st->data;
+	st->xfer.len = st->chip_info->storagebits / 8;
+
+	spi_message_init(&st->msg);
+	spi_message_add_tail(&st->xfer, &st->msg);
+
+	ret = gpio_request_one(st->pdata->gpio_pdrst, GPIOF_OUT_INIT_LOW,
+			       "AD7877 /PDRST");
+	if (ret) {
+		dev_err(&spi->dev, "failed to request GPIO PDRST\n");
+		goto error_free_device;
+	}
+
+	ret = request_irq(spi->irq, ad7780_interrupt,
+		IRQF_TRIGGER_FALLING, spi_get_device_id(spi)->name, st);
+	if (ret)
+		goto error_free_device;
+
+	disable_irq(spi->irq);
+
+	ret = iio_device_register(st->indio_dev);
+	if (ret)
+		goto error_free_irq;
+
+	return 0;
+
+error_free_irq:
+	free_irq(spi->irq, st);
+
+error_free_device:
+	iio_free_device(st->indio_dev);
+error_disable_reg:
+	if (!IS_ERR(st->reg))
+		regulator_disable(st->reg);
+error_put_reg:
+	if (!IS_ERR(st->reg))
+		regulator_put(st->reg);
+	kfree(st);
+error_ret:
+	return ret;
+}
+
+static int ad7780_remove(struct spi_device *spi)
+{
+	struct ad7780_state *st = spi_get_drvdata(spi);
+	struct iio_dev *indio_dev = st->indio_dev;
+	free_irq(spi->irq, st);
+	gpio_free(st->pdata->gpio_pdrst);
+	iio_device_unregister(indio_dev);
+	if (!IS_ERR(st->reg)) {
+		regulator_disable(st->reg);
+		regulator_put(st->reg);
+	}
+	kfree(st);
+	return 0;
+}
+
+static const struct spi_device_id ad7780_id[] = {
+	{"ad7780", ID_AD7780},
+	{"ad7781", ID_AD7781},
+	{}
+};
+
+static struct spi_driver ad7780_driver = {
+	.driver = {
+		.name	= "ad7780",
+		.bus	= &spi_bus_type,
+		.owner	= THIS_MODULE,
+	},
+	.probe		= ad7780_probe,
+	.remove		= __devexit_p(ad7780_remove),
+	.id_table	= ad7780_id,
+};
+
+static int __init ad7780_init(void)
+{
+	return spi_register_driver(&ad7780_driver);
+}
+module_init(ad7780_init);
+
+static void __exit ad7780_exit(void)
+{
+	spi_unregister_driver(&ad7780_driver);
+}
+module_exit(ad7780_exit);
+
+MODULE_AUTHOR("Michael Hennerich <hennerich@blackfin.uclinux.org>");
+MODULE_DESCRIPTION("Analog Devices AD7780/1 ADC");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/staging/iio/adc/ad7780.h b/drivers/staging/iio/adc/ad7780.h
new file mode 100644
index 0000000..67e511c
--- /dev/null
+++ b/drivers/staging/iio/adc/ad7780.h
@@ -0,0 +1,30 @@
+/*
+ * AD7780/AD7781 SPI ADC driver
+ *
+ * Copyright 2011 Analog Devices Inc.
+ *
+ * Licensed under the GPL-2.
+ */
+#ifndef IIO_ADC_AD7780_H_
+#define IIO_ADC_AD7780_H_
+
+/*
+ * TODO: struct ad7780_platform_data needs to go into include/linux/iio
+ */
+
+/* NOTE:
+ * The AD7780 doesn't feature a dedicated SPI chip select, in addition it
+ * features a dual use data out ready DOUT/RDY output.
+ * In order to avoid contentions on the SPI bus, it's therefore necessary
+ * to use spi bus locking combined with a dedicated GPIO to control the
+ * power down reset signal of the AD7780.
+ *
+ * The DOUT/RDY output must also be wired to an interrupt capable GPIO.
+ */
+
+struct ad7780_platform_data {
+	u16				vref_mv;
+	int				gpio_pdrst;
+};
+
+#endif /* IIO_ADC_AD7780_H_ */
diff --git a/drivers/staging/iio/dac/Kconfig b/drivers/staging/iio/dac/Kconfig
index 67defcb..1b0188a 100644
--- a/drivers/staging/iio/dac/Kconfig
+++ b/drivers/staging/iio/dac/Kconfig
@@ -21,6 +21,16 @@
 	  To compile this driver as a module, choose M here: the
 	  module will be called ad5446.
 
+config AD5504
+	tristate "Analog Devices AD5504/AD5501 DAC SPI driver"
+	depends on SPI
+	help
+	  Say yes here to build support for Analog Devices AD5504, AD5501,
+	  High Voltage Digital to Analog Converter.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called ad5504.
+
 config MAX517
 	tristate "Maxim MAX517/518/519 DAC driver"
 	depends on I2C && EXPERIMENTAL
diff --git a/drivers/staging/iio/dac/Makefile b/drivers/staging/iio/dac/Makefile
index 1197aef..020df4a 100644
--- a/drivers/staging/iio/dac/Makefile
+++ b/drivers/staging/iio/dac/Makefile
@@ -3,5 +3,6 @@
 #
 
 obj-$(CONFIG_AD5624R_SPI) += ad5624r_spi.o
+obj-$(CONFIG_AD5504) += ad5504.o
 obj-$(CONFIG_AD5446) += ad5446.o
 obj-$(CONFIG_MAX517) += max517.o
diff --git a/drivers/staging/iio/dac/ad5504.c b/drivers/staging/iio/dac/ad5504.c
new file mode 100644
index 0000000..153c36e
--- /dev/null
+++ b/drivers/staging/iio/dac/ad5504.c
@@ -0,0 +1,426 @@
+/*
+ * AD5504, AD5501 High Voltage Digital to Analog Converter
+ *
+ * Copyright 2011 Analog Devices Inc.
+ *
+ * Licensed under the GPL-2.
+ */
+
+#include <linux/interrupt.h>
+#include <linux/gpio.h>
+#include <linux/fs.h>
+#include <linux/device.h>
+#include <linux/kernel.h>
+#include <linux/spi/spi.h>
+#include <linux/slab.h>
+#include <linux/sysfs.h>
+#include <linux/regulator/consumer.h>
+
+#include "../iio.h"
+#include "../sysfs.h"
+#include "dac.h"
+#include "ad5504.h"
+
+static int ad5504_spi_write(struct spi_device *spi, u8 addr, u16 val)
+{
+	u16 tmp = cpu_to_be16(AD5504_CMD_WRITE |
+			      AD5504_ADDR(addr) |
+			      (val & AD5504_RES_MASK));
+
+	return spi_write(spi, (u8 *)&tmp, 2);
+}
+
+static int ad5504_spi_read(struct spi_device *spi, u8 addr, u16 *val)
+{
+	u16 tmp = cpu_to_be16(AD5504_CMD_READ | AD5504_ADDR(addr));
+	int ret;
+	struct spi_transfer	t = {
+			.tx_buf		= &tmp,
+			.rx_buf		= val,
+			.len		= 2,
+		};
+	struct spi_message	m;
+
+	spi_message_init(&m);
+	spi_message_add_tail(&t, &m);
+	ret = spi_sync(spi, &m);
+
+	*val = be16_to_cpu(*val) & AD5504_RES_MASK;
+
+	return ret;
+}
+
+static ssize_t ad5504_write_dac(struct device *dev,
+				 struct device_attribute *attr,
+				 const char *buf, size_t len)
+{
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct ad5504_state *st = iio_dev_get_devdata(indio_dev);
+	struct iio_dev_attr *this_attr = to_iio_dev_attr(attr);
+	long readin;
+	int ret;
+
+	ret = strict_strtol(buf, 10, &readin);
+	if (ret)
+		return ret;
+
+	ret = ad5504_spi_write(st->spi, this_attr->address, readin);
+	return ret ? ret : len;
+}
+
+static ssize_t ad5504_read_dac(struct device *dev,
+					   struct device_attribute *attr,
+					   char *buf)
+{
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct ad5504_state *st = iio_dev_get_devdata(indio_dev);
+	struct iio_dev_attr *this_attr = to_iio_dev_attr(attr);
+	int ret;
+	u16 val;
+
+	ret = ad5504_spi_read(st->spi, this_attr->address, &val);
+	if (ret)
+		return ret;
+
+	return sprintf(buf, "%d\n", val);
+}
+
+static ssize_t ad5504_read_powerdown_mode(struct device *dev,
+				      struct device_attribute *attr, char *buf)
+{
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct ad5504_state *st = iio_dev_get_devdata(indio_dev);
+
+	const char mode[][14] = {"20kohm_to_gnd", "three_state"};
+
+	return sprintf(buf, "%s\n", mode[st->pwr_down_mode]);
+}
+
+static ssize_t ad5504_write_powerdown_mode(struct device *dev,
+				       struct device_attribute *attr,
+				       const char *buf, size_t len)
+{
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct ad5504_state *st = iio_dev_get_devdata(indio_dev);
+	int ret;
+
+	if (sysfs_streq(buf, "20kohm_to_gnd"))
+		st->pwr_down_mode = AD5504_DAC_PWRDN_20K;
+	else if (sysfs_streq(buf, "three_state"))
+		st->pwr_down_mode = AD5504_DAC_PWRDN_3STATE;
+	else
+		ret = -EINVAL;
+
+	return ret ? ret : len;
+}
+
+static ssize_t ad5504_read_dac_powerdown(struct device *dev,
+					   struct device_attribute *attr,
+					   char *buf)
+{
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct ad5504_state *st = iio_dev_get_devdata(indio_dev);
+	struct iio_dev_attr *this_attr = to_iio_dev_attr(attr);
+
+	return sprintf(buf, "%d\n",
+			!(st->pwr_down_mask & (1 << this_attr->address)));
+}
+
+static ssize_t ad5504_write_dac_powerdown(struct device *dev,
+					    struct device_attribute *attr,
+					    const char *buf, size_t len)
+{
+	long readin;
+	int ret;
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct ad5504_state *st = iio_dev_get_devdata(indio_dev);
+	struct iio_dev_attr *this_attr = to_iio_dev_attr(attr);
+
+	ret = strict_strtol(buf, 10, &readin);
+	if (ret)
+		return ret;
+
+	if (readin == 0)
+		st->pwr_down_mask |= (1 << this_attr->address);
+	else if (readin == 1)
+		st->pwr_down_mask &= ~(1 << this_attr->address);
+	else
+		ret = -EINVAL;
+
+	ret = ad5504_spi_write(st->spi, AD5504_ADDR_CTRL,
+				AD5504_DAC_PWRDWN_MODE(st->pwr_down_mode) |
+				AD5504_DAC_PWR(st->pwr_down_mask));
+
+	/* writes to the CTRL register must be followed by a NOOP */
+	ad5504_spi_write(st->spi, AD5504_ADDR_NOOP, 0);
+
+	return ret ? ret : len;
+}
+
+static ssize_t ad5504_show_scale(struct device *dev,
+				struct device_attribute *attr,
+				char *buf)
+{
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct ad5504_state *st = iio_dev_get_devdata(indio_dev);
+	/* Corresponds to Vref / 2^(bits) */
+	unsigned int scale_uv = (st->vref_mv * 1000) >> AD5505_BITS;
+
+	return sprintf(buf, "%d.%03d\n", scale_uv / 1000, scale_uv % 1000);
+}
+static IIO_DEVICE_ATTR(out_scale, S_IRUGO, ad5504_show_scale, NULL, 0);
+
+static ssize_t ad5504_show_name(struct device *dev,
+				 struct device_attribute *attr,
+				 char *buf)
+{
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct ad5504_state *st = iio_dev_get_devdata(indio_dev);
+
+	return sprintf(buf, "%s\n", spi_get_device_id(st->spi)->name);
+}
+static IIO_DEVICE_ATTR(name, S_IRUGO, ad5504_show_name, NULL, 0);
+
+#define IIO_DEV_ATTR_OUT_RW_RAW(_num, _show, _store, _addr)		\
+	IIO_DEVICE_ATTR(out##_num##_raw,				\
+			S_IRUGO | S_IWUSR, _show, _store, _addr)
+
+static IIO_DEV_ATTR_OUT_RW_RAW(0, ad5504_read_dac,
+	ad5504_write_dac, AD5504_ADDR_DAC0);
+static IIO_DEV_ATTR_OUT_RW_RAW(1, ad5504_read_dac,
+	ad5504_write_dac, AD5504_ADDR_DAC1);
+static IIO_DEV_ATTR_OUT_RW_RAW(2, ad5504_read_dac,
+	ad5504_write_dac, AD5504_ADDR_DAC2);
+static IIO_DEV_ATTR_OUT_RW_RAW(3, ad5504_read_dac,
+	ad5504_write_dac, AD5504_ADDR_DAC3);
+
+static IIO_DEVICE_ATTR(out_powerdown_mode, S_IRUGO |
+			S_IWUSR, ad5504_read_powerdown_mode,
+			ad5504_write_powerdown_mode, 0);
+
+static IIO_CONST_ATTR(out_powerdown_mode_available,
+			"20kohm_to_gnd three_state");
+
+#define IIO_DEV_ATTR_DAC_POWERDOWN(_num, _show, _store, _addr)		\
+	IIO_DEVICE_ATTR(out##_num##_powerdown,				\
+			S_IRUGO | S_IWUSR, _show, _store, _addr)
+
+static IIO_DEV_ATTR_DAC_POWERDOWN(0, ad5504_read_dac_powerdown,
+				   ad5504_write_dac_powerdown, 0);
+static IIO_DEV_ATTR_DAC_POWERDOWN(1, ad5504_read_dac_powerdown,
+				   ad5504_write_dac_powerdown, 1);
+static IIO_DEV_ATTR_DAC_POWERDOWN(2, ad5504_read_dac_powerdown,
+				   ad5504_write_dac_powerdown, 2);
+static IIO_DEV_ATTR_DAC_POWERDOWN(3, ad5504_read_dac_powerdown,
+				   ad5504_write_dac_powerdown, 3);
+
+static struct attribute *ad5504_attributes[] = {
+	&iio_dev_attr_out0_raw.dev_attr.attr,
+	&iio_dev_attr_out1_raw.dev_attr.attr,
+	&iio_dev_attr_out2_raw.dev_attr.attr,
+	&iio_dev_attr_out3_raw.dev_attr.attr,
+	&iio_dev_attr_out0_powerdown.dev_attr.attr,
+	&iio_dev_attr_out1_powerdown.dev_attr.attr,
+	&iio_dev_attr_out2_powerdown.dev_attr.attr,
+	&iio_dev_attr_out3_powerdown.dev_attr.attr,
+	&iio_dev_attr_out_powerdown_mode.dev_attr.attr,
+	&iio_const_attr_out_powerdown_mode_available.dev_attr.attr,
+	&iio_dev_attr_out_scale.dev_attr.attr,
+	&iio_dev_attr_name.dev_attr.attr,
+	NULL,
+};
+
+static const struct attribute_group ad5504_attribute_group = {
+	.attrs = ad5504_attributes,
+};
+
+static struct attribute *ad5501_attributes[] = {
+	&iio_dev_attr_out0_raw.dev_attr.attr,
+	&iio_dev_attr_out0_powerdown.dev_attr.attr,
+	&iio_dev_attr_out_powerdown_mode.dev_attr.attr,
+	&iio_const_attr_out_powerdown_mode_available.dev_attr.attr,
+	&iio_dev_attr_out_scale.dev_attr.attr,
+	&iio_dev_attr_name.dev_attr.attr,
+	NULL,
+};
+
+static const struct attribute_group ad5501_attribute_group = {
+	.attrs = ad5501_attributes,
+};
+
+static IIO_CONST_ATTR(temp0_thresh_rising_value, "110000");
+static IIO_CONST_ATTR(temp0_thresh_rising_en, "1");
+
+static struct attribute *ad5504_ev_attributes[] = {
+	&iio_const_attr_temp0_thresh_rising_value.dev_attr.attr,
+	&iio_const_attr_temp0_thresh_rising_en.dev_attr.attr,
+	NULL,
+};
+
+static struct attribute_group ad5504_ev_attribute_group = {
+	.attrs = ad5504_ev_attributes,
+};
+
+static void ad5504_interrupt_bh(struct work_struct *work_s)
+{
+	struct ad5504_state *st = container_of(work_s,
+		struct ad5504_state, work_alarm);
+
+	iio_push_event(st->indio_dev, 0,
+			IIO_UNMOD_EVENT_CODE(IIO_EV_CLASS_TEMP,
+			0,
+			IIO_EV_TYPE_THRESH,
+			IIO_EV_DIR_RISING),
+			st->last_timestamp);
+
+	enable_irq(st->spi->irq);
+}
+
+static int ad5504_interrupt(struct iio_dev *dev_info,
+		int index,
+		s64 timestamp,
+		int no_test)
+{
+	struct ad5504_state *st = dev_info->dev_data;
+
+	st->last_timestamp = timestamp;
+	schedule_work(&st->work_alarm);
+	return 0;
+}
+
+IIO_EVENT_SH(ad5504, &ad5504_interrupt);
+
+static int __devinit ad5504_probe(struct spi_device *spi)
+{
+	struct ad5504_platform_data *pdata = spi->dev.platform_data;
+	struct ad5504_state *st;
+	int ret, voltage_uv = 0;
+
+	st = kzalloc(sizeof(*st), GFP_KERNEL);
+	if (st == NULL) {
+		ret = -ENOMEM;
+		goto error_ret;
+	}
+
+	spi_set_drvdata(spi, st);
+
+	st->reg = regulator_get(&spi->dev, "vcc");
+	if (!IS_ERR(st->reg)) {
+		ret = regulator_enable(st->reg);
+		if (ret)
+			goto error_put_reg;
+
+		voltage_uv = regulator_get_voltage(st->reg);
+	}
+
+	if (voltage_uv)
+		st->vref_mv = voltage_uv / 1000;
+	else if (pdata)
+		st->vref_mv = pdata->vref_mv;
+	else
+		dev_warn(&spi->dev, "reference voltage unspecified\n");
+
+	st->spi = spi;
+	st->indio_dev = iio_allocate_device();
+	if (st->indio_dev == NULL) {
+		ret = -ENOMEM;
+		goto error_disable_reg;
+	}
+	st->indio_dev->dev.parent = &spi->dev;
+
+	st->indio_dev->attrs = spi_get_device_id(st->spi)->driver_data
+		== ID_AD5501 ? &ad5501_attribute_group :
+		&ad5504_attribute_group;
+	st->indio_dev->dev_data = (void *)(st);
+	st->indio_dev->driver_module = THIS_MODULE;
+	st->indio_dev->modes = INDIO_DIRECT_MODE;
+	st->indio_dev->num_interrupt_lines = 1;
+	st->indio_dev->event_attrs = &ad5504_ev_attribute_group,
+
+	ret = iio_device_register(st->indio_dev);
+	if (ret)
+		goto error_free_dev;
+
+	if (spi->irq) {
+		INIT_WORK(&st->work_alarm, ad5504_interrupt_bh);
+
+		ret = iio_register_interrupt_line(spi->irq,
+				st->indio_dev,
+				0,
+				IRQF_TRIGGER_FALLING,
+				spi_get_device_id(st->spi)->name);
+		if (ret)
+			goto error_unreg_iio_device;
+
+		iio_add_event_to_list(&iio_event_ad5504,
+				&st->indio_dev->interrupts[0]->ev_list);
+	}
+
+	return 0;
+
+error_unreg_iio_device:
+	iio_device_unregister(st->indio_dev);
+error_free_dev:
+	iio_free_device(st->indio_dev);
+error_disable_reg:
+	if (!IS_ERR(st->reg))
+		regulator_disable(st->reg);
+error_put_reg:
+	if (!IS_ERR(st->reg))
+		regulator_put(st->reg);
+
+	kfree(st);
+error_ret:
+	return ret;
+}
+
+static int __devexit ad5504_remove(struct spi_device *spi)
+{
+	struct ad5504_state *st = spi_get_drvdata(spi);
+
+	if (spi->irq)
+		iio_unregister_interrupt_line(st->indio_dev, 0);
+
+	iio_device_unregister(st->indio_dev);
+
+	if (!IS_ERR(st->reg)) {
+		regulator_disable(st->reg);
+		regulator_put(st->reg);
+	}
+
+	kfree(st);
+
+	return 0;
+}
+
+static const struct spi_device_id ad5504_id[] = {
+	{"ad5504", ID_AD5504},
+	{"ad5501", ID_AD5501},
+	{}
+};
+
+static struct spi_driver ad5504_driver = {
+	.driver = {
+		   .name = "ad5504",
+		   .owner = THIS_MODULE,
+		   },
+	.probe = ad5504_probe,
+	.remove = __devexit_p(ad5504_remove),
+	.id_table = ad5504_id,
+};
+
+static __init int ad5504_spi_init(void)
+{
+	return spi_register_driver(&ad5504_driver);
+}
+module_init(ad5504_spi_init);
+
+static __exit void ad5504_spi_exit(void)
+{
+	spi_unregister_driver(&ad5504_driver);
+}
+module_exit(ad5504_spi_exit);
+
+MODULE_AUTHOR("Michael Hennerich <hennerich@blackfin.uclinux.org>");
+MODULE_DESCRIPTION("Analog Devices AD5501/AD5501 DAC");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/staging/iio/dac/ad5504.h b/drivers/staging/iio/dac/ad5504.h
new file mode 100644
index 0000000..d2fac63
--- /dev/null
+++ b/drivers/staging/iio/dac/ad5504.h
@@ -0,0 +1,74 @@
+/*
+ * AD5504 SPI DAC driver
+ *
+ * Copyright 2011 Analog Devices Inc.
+ *
+ * Licensed under the GPL-2.
+ */
+
+#ifndef SPI_AD5504_H_
+#define SPI_AD5504_H_
+
+#define AD5505_BITS			12
+#define AD5504_RES_MASK			((1 << (AD5505_BITS)) - 1)
+
+#define AD5504_CMD_READ			(1 << 15)
+#define AD5504_CMD_WRITE		(0 << 15)
+#define AD5504_ADDR(addr)		((addr) << 12)
+
+/* Registers */
+#define AD5504_ADDR_NOOP		0
+#define AD5504_ADDR_DAC0		1
+#define AD5504_ADDR_DAC1		2
+#define AD5504_ADDR_DAC2		3
+#define AD5504_ADDR_DAC3		4
+#define AD5504_ADDR_ALL_DAC		5
+#define AD5504_ADDR_CTRL		7
+
+/* Control Register */
+#define AD5504_DAC_PWR(ch)		((ch) << 2)
+#define AD5504_DAC_PWRDWN_MODE(mode)	((mode) << 6)
+#define AD5504_DAC_PWRDN_20K		0
+#define AD5504_DAC_PWRDN_3STATE		1
+
+/*
+ * TODO: struct ad5504_platform_data needs to go into include/linux/iio
+ */
+
+struct ad5504_platform_data {
+	u16				vref_mv;
+};
+
+/**
+ * struct ad5446_state - driver instance specific data
+ * @indio_dev:		the industrial I/O device
+ * @us:			spi_device
+ * @reg:		supply regulator
+ * @vref_mv:		actual reference voltage used
+ * @work_alarm:		bh work structure for event handling
+ * @last_timestamp:	timestamp of last event interrupt
+ * @pwr_down_mask	power down mask
+ * @pwr_down_mode	current power down mode
+ */
+
+struct ad5504_state {
+	struct iio_dev			*indio_dev;
+	struct spi_device		*spi;
+	struct regulator		*reg;
+	unsigned short			vref_mv;
+	struct work_struct		work_alarm;
+	s64				last_timestamp;
+	unsigned			pwr_down_mask;
+	unsigned			pwr_down_mode;
+};
+
+/**
+ * ad5504_supported_device_ids:
+ */
+
+enum ad5504_supported_device_ids {
+	ID_AD5504,
+	ID_AD5501,
+};
+
+#endif /* SPI_AD5504_H_ */
diff --git a/drivers/staging/iio/gyro/Kconfig b/drivers/staging/iio/gyro/Kconfig
index 8b78fa0..ae2e7d3 100644
--- a/drivers/staging/iio/gyro/Kconfig
+++ b/drivers/staging/iio/gyro/Kconfig
@@ -35,3 +35,13 @@
 
 	  This driver can also be built as a module.  If so, the module
 	  will be called adis16260.
+
+config ADXRS450
+	tristate "Analog Devices ADXRS450 Digital Output Gyroscope SPI driver"
+	depends on SPI
+	help
+	  Say yes here to build support for Analog Devices ADXRS450 programmable
+	  digital output gyroscope.
+
+	  This driver can also be built as a module.  If so, the module
+	  will be called adxrs450.
diff --git a/drivers/staging/iio/gyro/Makefile b/drivers/staging/iio/gyro/Makefile
index 2764c15..2212240 100644
--- a/drivers/staging/iio/gyro/Makefile
+++ b/drivers/staging/iio/gyro/Makefile
@@ -17,3 +17,6 @@
 
 adis16251-y             := adis16251_core.o
 obj-$(CONFIG_ADIS16251) += adis16251.o
+
+adxrs450-y             := adxrs450_core.o
+obj-$(CONFIG_ADXRS450) += adxrs450.o
diff --git a/drivers/staging/iio/gyro/adxrs450.h b/drivers/staging/iio/gyro/adxrs450.h
new file mode 100644
index 0000000..c92f694
--- /dev/null
+++ b/drivers/staging/iio/gyro/adxrs450.h
@@ -0,0 +1,58 @@
+#ifndef SPI_ADXRS450_H_
+#define SPI_ADXRS450_H_
+
+#define ADXRS450_STARTUP_DELAY	50 /* ms */
+
+/* The MSB for the spi commands */
+#define ADXRS450_SENSOR_DATA    0x20
+#define ADXRS450_WRITE_DATA	0x40
+#define ADXRS450_READ_DATA	0x80
+
+#define ADXRS450_RATE1	0x00	/* Rate Registers */
+#define ADXRS450_TEMP1	0x02	/* Temperature Registers */
+#define ADXRS450_LOCST1	0x04	/* Low CST Memory Registers */
+#define ADXRS450_HICST1	0x06	/* High CST Memory Registers */
+#define ADXRS450_QUAD1	0x08	/* Quad Memory Registers */
+#define ADXRS450_FAULT1	0x0A	/* Fault Registers */
+#define ADXRS450_PID1	0x0C	/* Part ID Register 1 */
+#define ADXRS450_SNH	0x0E	/* Serial Number Registers, 4 bytes */
+#define ADXRS450_SNL	0x10
+#define ADXRS450_DNC1	0x12	/* Dynamic Null Correction Registers */
+/* Check bits */
+#define ADXRS450_P	0x01
+#define ADXRS450_CHK	0x02
+#define ADXRS450_CST	0x04
+#define ADXRS450_PWR	0x08
+#define ADXRS450_POR	0x10
+#define ADXRS450_NVM	0x20
+#define ADXRS450_Q	0x40
+#define ADXRS450_PLL	0x80
+#define ADXRS450_UV	0x100
+#define ADXRS450_OV	0x200
+#define ADXRS450_AMP	0x400
+#define ADXRS450_FAIL	0x800
+
+#define ADXRS450_WRERR_MASK	(0x7 << 29)
+
+#define ADXRS450_MAX_RX 4
+#define ADXRS450_MAX_TX 4
+
+#define ADXRS450_GET_ST(a)	((a >> 26) & 0x3)
+
+/**
+ * struct adxrs450_state - device instance specific data
+ * @us:			actual spi_device
+ * @indio_dev:		industrial I/O device structure
+ * @tx:			transmit buffer
+ * @rx:			recieve buffer
+ * @buf_lock:		mutex to protect tx and rx
+ **/
+struct adxrs450_state {
+	struct spi_device		*us;
+	struct iio_dev			*indio_dev;
+	u8				*tx;
+	u8				*rx;
+	struct mutex			buf_lock;
+};
+
+#endif /* SPI_ADXRS450_H_ */
diff --git a/drivers/staging/iio/gyro/adxrs450_core.c b/drivers/staging/iio/gyro/adxrs450_core.c
new file mode 100644
index 0000000..d70bf68
--- /dev/null
+++ b/drivers/staging/iio/gyro/adxrs450_core.c
@@ -0,0 +1,446 @@
+/*
+ * ADXRS450 Digital Output Gyroscope Driver
+ *
+ * Copyright 2011 Analog Devices Inc.
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/gpio.h>
+#include <linux/delay.h>
+#include <linux/mutex.h>
+#include <linux/device.h>
+#include <linux/kernel.h>
+#include <linux/spi/spi.h>
+#include <linux/slab.h>
+#include <linux/sysfs.h>
+#include <linux/list.h>
+
+#include "../iio.h"
+#include "../sysfs.h"
+#include "gyro.h"
+#include "../adc/adc.h"
+
+#include "adxrs450.h"
+
+/**
+ * adxrs450_spi_read_reg_16() - read 2 bytes from a register pair
+ * @dev: device associated with child of actual iio_dev
+ * @reg_address: the address of the lower of the two registers,which should be an even address,
+ * Second register's address is reg_address + 1.
+ * @val: somewhere to pass back the value read
+ **/
+static int adxrs450_spi_read_reg_16(struct device *dev,
+		u8 reg_address,
+		u16 *val)
+{
+	struct spi_message msg;
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct adxrs450_state *st = iio_dev_get_devdata(indio_dev);
+	int ret;
+	struct spi_transfer xfers = {
+		.tx_buf = st->tx,
+		.rx_buf = st->rx,
+		.bits_per_word = 8,
+		.len = 4,
+	};
+	/* Needs to send the command twice to get the wanted value */
+	mutex_lock(&st->buf_lock);
+	st->tx[0] = ADXRS450_READ_DATA | reg_address >> 7;
+	st->tx[1] = reg_address << 1;
+	st->tx[2] = 0;
+	st->tx[3] = 0;
+	spi_message_init(&msg);
+	spi_message_add_tail(&xfers, &msg);
+	ret = spi_sync(st->us, &msg);
+	if (ret) {
+		dev_err(&st->us->dev, "problem while reading 16 bit register 0x%02x\n",
+				reg_address);
+		goto error_ret;
+	}
+
+	spi_message_init(&msg);
+	spi_message_add_tail(&xfers, &msg);
+	ret = spi_sync(st->us, &msg);
+	if (ret) {
+		dev_err(&st->us->dev, "problem while reading 16 bit register 0x%02x\n",
+				reg_address);
+		goto error_ret;
+	}
+
+	*val = (st->rx[1] & 0x1f) << 11 | st->rx[2] << 3 | (st->rx[3] & 0xe0) >> 5;
+
+error_ret:
+	mutex_unlock(&st->buf_lock);
+	return ret;
+}
+
+/**
+ * adxrs450_spi_write_reg_16() - write 2 bytes data to a register pair
+ * @dev: device associated with child of actual actual iio_dev
+ * @reg_address: the address of the lower of the two registers,which should be an even address,
+ * Second register's address is reg_address + 1.
+ * @val: value to be written.
+ **/
+static int adxrs450_spi_write_reg_16(struct device *dev,
+		u8 reg_address,
+		u16 val)
+{
+	struct spi_message msg;
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct adxrs450_state *st = iio_dev_get_devdata(indio_dev);
+	int ret;
+	struct spi_transfer xfers = {
+		.tx_buf = st->tx,
+		.rx_buf = st->rx,
+		.bits_per_word = 8,
+		.len = 4,
+	};
+
+	mutex_lock(&st->buf_lock);
+	st->tx[0] = ADXRS450_WRITE_DATA | reg_address >> 7;
+	st->tx[1] = reg_address << 1 | val >> 15;
+	st->tx[2] = val >> 7;
+	st->tx[3] = val << 1;
+	spi_message_init(&msg);
+	spi_message_add_tail(&xfers, &msg);
+	ret = spi_sync(st->us, &msg);
+	if (ret)
+		dev_err(&st->us->dev, "problem while writing 16 bit register 0x%02x\n",
+				reg_address);
+	mutex_unlock(&st->buf_lock);
+	return ret;
+}
+
+/**
+ * adxrs450_spi_sensor_data() - read 2 bytes sensor data
+ * @dev: device associated with child of actual iio_dev
+ * @val: somewhere to pass back the value read
+ **/
+static int adxrs450_spi_sensor_data(struct device *dev, u16 *val)
+{
+	struct spi_message msg;
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct adxrs450_state *st = iio_dev_get_devdata(indio_dev);
+	int ret;
+	struct spi_transfer xfers = {
+		.tx_buf = st->tx,
+		.rx_buf = st->rx,
+		.bits_per_word = 8,
+		.len = 4,
+	};
+
+	mutex_lock(&st->buf_lock);
+	st->tx[0] = ADXRS450_SENSOR_DATA;
+	st->tx[1] = 0;
+	st->tx[2] = 0;
+	st->tx[3] = 0;
+
+	spi_message_init(&msg);
+	spi_message_add_tail(&xfers, &msg);
+	ret = spi_sync(st->us, &msg);
+	if (ret) {
+		dev_err(&st->us->dev, "Problem while reading sensor data\n");
+		goto error_ret;
+	}
+
+	spi_message_init(&msg);
+	spi_message_add_tail(&xfers, &msg);
+	ret = spi_sync(st->us, &msg);
+	if (ret) {
+		dev_err(&st->us->dev, "Problem while reading sensor data\n");
+		goto error_ret;
+	}
+
+	*val = (st->rx[0] & 0x03) << 14 | st->rx[1] << 6 | (st->rx[2] & 0xfc) >> 2;
+error_ret:
+	mutex_unlock(&st->buf_lock);
+	return ret;
+}
+
+/**
+ * adxrs450_spi_initial() - use for initializing procedure.
+ * @st: device instance specific data
+ * @val: somewhere to pass back the value read
+ **/
+static int adxrs450_spi_initial(struct adxrs450_state *st,
+		u32 *val, char chk)
+{
+	struct spi_message msg;
+	int ret;
+	struct spi_transfer xfers = {
+		.tx_buf = st->tx,
+		.rx_buf = st->rx,
+		.bits_per_word = 8,
+		.len = 4,
+	};
+
+	mutex_lock(&st->buf_lock);
+	st->tx[0] = ADXRS450_SENSOR_DATA;
+	st->tx[1] = 0;
+	st->tx[2] = 0;
+	st->tx[3] = 0;
+	if (chk)
+		st->tx[3] |= (ADXRS450_CHK | ADXRS450_P);
+	spi_message_init(&msg);
+	spi_message_add_tail(&xfers, &msg);
+	ret = spi_sync(st->us, &msg);
+	if (ret) {
+		dev_err(&st->us->dev, "Problem while reading initializing data\n");
+		goto error_ret;
+	}
+
+	*val = be32_to_cpu(*(u32 *)st->rx);
+
+error_ret:
+	mutex_unlock(&st->buf_lock);
+	return ret;
+}
+
+static ssize_t adxrs450_read_temp(struct device *dev,
+		struct device_attribute *attr,
+		char *buf)
+{
+	int ret;
+	u16 t;
+	ret = adxrs450_spi_read_reg_16(dev,
+			ADXRS450_TEMP1,
+			&t);
+	if (ret)
+		return ret;
+	return sprintf(buf, "%d\n", t);
+}
+
+static ssize_t adxrs450_read_quad(struct device *dev,
+		struct device_attribute *attr,
+		char *buf)
+{
+	int ret;
+	u16 t;
+	ret = adxrs450_spi_read_reg_16(dev,
+			ADXRS450_QUAD1,
+			&t);
+	if (ret)
+		return ret;
+	return sprintf(buf, "%d\n", t);
+}
+
+static ssize_t adxrs450_write_dnc(struct device *dev,
+		struct device_attribute *attr,
+		const char *buf,
+		size_t len)
+{
+	int ret;
+	long val;
+
+	ret = strict_strtol(buf, 10, &val);
+	if (ret)
+		goto error_ret;
+	ret = adxrs450_spi_write_reg_16(dev,
+			ADXRS450_DNC1,
+			val);
+error_ret:
+	return ret ? ret : len;
+}
+
+static ssize_t adxrs450_read_sensor_data(struct device *dev,
+		struct device_attribute *attr,
+		char *buf)
+{
+	int ret;
+	u16 t;
+
+	ret = adxrs450_spi_sensor_data(dev, &t);
+	if (ret)
+		return ret;
+
+	return sprintf(buf, "%d\n", t);
+}
+
+/* Recommended Startup Sequence by spec */
+static int adxrs450_initial_setup(struct adxrs450_state *st)
+{
+	u32 t;
+	u16 data;
+	int ret;
+	struct device *dev = &st->indio_dev->dev;
+
+	msleep(ADXRS450_STARTUP_DELAY*2);
+	ret = adxrs450_spi_initial(st, &t, 1);
+	if (ret)
+		return ret;
+	if (t != 0x01) {
+		dev_err(&st->us->dev, "The initial response is not correct!\n");
+		return -ENODEV;
+
+	}
+
+	msleep(ADXRS450_STARTUP_DELAY);
+	ret = adxrs450_spi_initial(st, &t, 0);
+	if (ret)
+		return ret;
+
+	msleep(ADXRS450_STARTUP_DELAY);
+	ret = adxrs450_spi_initial(st, &t, 0);
+	if (ret)
+		return ret;
+	if (((t & 0xff) | 0x01) != 0xff || ADXRS450_GET_ST(t) != 2) {
+		dev_err(&st->us->dev, "The second response is not correct!\n");
+		return -EIO;
+
+	}
+	ret = adxrs450_spi_initial(st, &t, 0);
+	if (ret)
+		return ret;
+	if (((t & 0xff) | 0x01) != 0xff || ADXRS450_GET_ST(t) != 2) {
+		dev_err(&st->us->dev, "The third response is not correct!\n");
+		return -EIO;
+
+	}
+	ret = adxrs450_spi_read_reg_16(dev, ADXRS450_FAULT1, &data);
+	if (ret)
+		return ret;
+	if (data & 0x0fff) {
+		dev_err(&st->us->dev, "The device is not in normal status!\n");
+		return -EINVAL;
+	}
+	ret = adxrs450_spi_read_reg_16(dev, ADXRS450_PID1, &data);
+	if (ret)
+		return ret;
+	dev_info(&st->us->dev, "The Part ID is 0x%x\n", data);
+
+	ret = adxrs450_spi_read_reg_16(dev, ADXRS450_SNL, &data);
+	if (ret)
+		return ret;
+	t = data;
+	ret = adxrs450_spi_read_reg_16(dev, ADXRS450_SNH, &data);
+	if (ret)
+		return ret;
+	t |= data << 16;
+	dev_info(&st->us->dev, "The Serial Number is 0x%x\n", t);
+
+	return 0;
+}
+
+static IIO_DEV_ATTR_GYRO_Z(adxrs450_read_sensor_data, 0);
+static IIO_DEV_ATTR_TEMP_RAW(adxrs450_read_temp);
+static IIO_DEV_ATTR_GYRO_Z_QUADRATURE_CORRECTION(adxrs450_read_quad, 0);
+static IIO_DEV_ATTR_GYRO_Z_CALIBBIAS(S_IWUSR,
+		NULL, adxrs450_write_dnc, 0);
+static IIO_CONST_ATTR(name, "adxrs450");
+
+static struct attribute *adxrs450_attributes[] = {
+	&iio_dev_attr_gyro_z_raw.dev_attr.attr,
+	&iio_dev_attr_temp_raw.dev_attr.attr,
+	&iio_dev_attr_gyro_z_quadrature_correction_raw.dev_attr.attr,
+	&iio_dev_attr_gyro_z_calibbias.dev_attr.attr,
+	&iio_const_attr_name.dev_attr.attr,
+	NULL
+};
+
+static const struct attribute_group adxrs450_attribute_group = {
+	.attrs = adxrs450_attributes,
+};
+
+static int __devinit adxrs450_probe(struct spi_device *spi)
+{
+	int ret, regdone = 0;
+	struct adxrs450_state *st = kzalloc(sizeof *st, GFP_KERNEL);
+	if (!st) {
+		ret =  -ENOMEM;
+		goto error_ret;
+	}
+	/* This is only used for removal purposes */
+	spi_set_drvdata(spi, st);
+
+	/* Allocate the comms buffers */
+	st->rx = kzalloc(sizeof(*st->rx)*ADXRS450_MAX_RX, GFP_KERNEL);
+	if (st->rx == NULL) {
+		ret = -ENOMEM;
+		goto error_free_st;
+	}
+	st->tx = kzalloc(sizeof(*st->tx)*ADXRS450_MAX_TX, GFP_KERNEL);
+	if (st->tx == NULL) {
+		ret = -ENOMEM;
+		goto error_free_rx;
+	}
+	st->us = spi;
+	mutex_init(&st->buf_lock);
+	/* setup the industrialio driver allocated elements */
+	st->indio_dev = iio_allocate_device();
+	if (st->indio_dev == NULL) {
+		ret = -ENOMEM;
+		goto error_free_tx;
+	}
+
+	st->indio_dev->dev.parent = &spi->dev;
+	st->indio_dev->attrs = &adxrs450_attribute_group;
+	st->indio_dev->dev_data = (void *)(st);
+	st->indio_dev->driver_module = THIS_MODULE;
+	st->indio_dev->modes = INDIO_DIRECT_MODE;
+
+	ret = iio_device_register(st->indio_dev);
+	if (ret)
+		goto error_free_dev;
+	regdone = 1;
+
+	/* Get the device into a sane initial state */
+	ret = adxrs450_initial_setup(st);
+	if (ret)
+		goto error_initial;
+	return 0;
+
+error_initial:
+error_free_dev:
+	if (regdone)
+		iio_device_unregister(st->indio_dev);
+	else
+		iio_free_device(st->indio_dev);
+error_free_tx:
+	kfree(st->tx);
+error_free_rx:
+	kfree(st->rx);
+error_free_st:
+	kfree(st);
+error_ret:
+	return ret;
+}
+
+static int adxrs450_remove(struct spi_device *spi)
+{
+	struct adxrs450_state *st = spi_get_drvdata(spi);
+
+	iio_device_unregister(st->indio_dev);
+	kfree(st->tx);
+	kfree(st->rx);
+	kfree(st);
+
+	return 0;
+}
+
+static struct spi_driver adxrs450_driver = {
+	.driver = {
+		.name = "adxrs450",
+		.owner = THIS_MODULE,
+	},
+	.probe = adxrs450_probe,
+	.remove = __devexit_p(adxrs450_remove),
+};
+
+static __init int adxrs450_init(void)
+{
+	return spi_register_driver(&adxrs450_driver);
+}
+module_init(adxrs450_init);
+
+static __exit void adxrs450_exit(void)
+{
+	spi_unregister_driver(&adxrs450_driver);
+}
+module_exit(adxrs450_exit);
+
+MODULE_AUTHOR("Cliff Cai <cliff.cai@xxxxxxxxxx>");
+MODULE_DESCRIPTION("Analog Devices ADXRS450 Gyroscope SPI driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/staging/iio/gyro/gyro.h b/drivers/staging/iio/gyro/gyro.h
index b4ea5bf..b5495613 100644
--- a/drivers/staging/iio/gyro/gyro.h
+++ b/drivers/staging/iio/gyro/gyro.h
@@ -57,6 +57,9 @@
 #define IIO_DEV_ATTR_GYRO_Z_CALIBSCALE(_mode, _show, _store, _addr)		\
 	IIO_DEVICE_ATTR(gyro_z_calibscale, _mode, _show, _store, _addr)
 
+#define IIO_DEV_ATTR_GYRO_Z_QUADRATURE_CORRECTION(_show, _addr)		\
+	IIO_DEVICE_ATTR(gyro_z_quadrature_correction_raw, S_IRUGO, _show, NULL, _addr)
+
 #define IIO_DEV_ATTR_GYRO(_show, _addr)			\
 	IIO_DEVICE_ATTR(gyro_raw, S_IRUGO, _show, NULL, _addr)
 
diff --git a/drivers/staging/iio/magnetometer/ak8975.c b/drivers/staging/iio/magnetometer/ak8975.c
index 420f206..d71904a 100644
--- a/drivers/staging/iio/magnetometer/ak8975.c
+++ b/drivers/staging/iio/magnetometer/ak8975.c
@@ -206,7 +206,7 @@
 	}
 
 	/* Precalculate scale factor for each axis and
-           store in the device data. */
+	   store in the device data. */
 	data->raw_to_gauss[0] = ((data->asa[0] + 128) * 30) >> 8;
 	data->raw_to_gauss[1] = ((data->asa[1] + 128) * 30) >> 8;
 	data->raw_to_gauss[2] = ((data->asa[2] + 128) * 30) >> 8;
@@ -316,6 +316,59 @@
 	return sprintf(buf, "%ld\n", data->raw_to_gauss[this_attr->address]);
 }
 
+static int wait_conversion_complete_gpio(struct ak8975_data *data)
+{
+	struct i2c_client *client = data->client;
+	u8 read_status;
+	u32 timeout_ms = AK8975_MAX_CONVERSION_TIMEOUT;
+	int ret;
+
+	/* Wait for the conversion to complete. */
+	while (timeout_ms) {
+		msleep(AK8975_CONVERSION_DONE_POLL_TIME);
+		if (gpio_get_value(data->eoc_gpio))
+			break;
+		timeout_ms -= AK8975_CONVERSION_DONE_POLL_TIME;
+	}
+	if (!timeout_ms) {
+		dev_err(&client->dev, "Conversion timeout happened\n");
+		return -EINVAL;
+	}
+
+	ret = ak8975_read_data(client, AK8975_REG_ST1, 1, &read_status);
+	if (ret < 0) {
+		dev_err(&client->dev, "Error in reading ST1\n");
+		return ret;
+	}
+	return read_status;
+}
+
+static int wait_conversion_complete_polled(struct ak8975_data *data)
+{
+	struct i2c_client *client = data->client;
+	u8 read_status;
+	u32 timeout_ms = AK8975_MAX_CONVERSION_TIMEOUT;
+	int ret;
+
+	/* Wait for the conversion to complete. */
+	while (timeout_ms) {
+		msleep(AK8975_CONVERSION_DONE_POLL_TIME);
+		ret = ak8975_read_data(client, AK8975_REG_ST1, 1, &read_status);
+		if (ret < 0) {
+			dev_err(&client->dev, "Error in reading ST1\n");
+			return ret;
+		}
+		if (read_status)
+			break;
+		timeout_ms -= AK8975_CONVERSION_DONE_POLL_TIME;
+	}
+	if (!timeout_ms) {
+		dev_err(&client->dev, "Conversion timeout happened\n");
+		return -EINVAL;
+	}
+	return read_status;
+}
+
 /*
  * Emits the raw flux value for the x, y, or z axis.
  */
@@ -326,7 +379,6 @@
 	struct ak8975_data *data = indio_dev->dev_data;
 	struct i2c_client *client = data->client;
 	struct iio_dev_attr *this_attr = to_iio_dev_attr(devattr);
-	u32 timeout_ms = AK8975_MAX_CONVERSION_TIMEOUT;
 	u16 meas_reg;
 	s16 raw;
 	u8 read_status;
@@ -352,23 +404,14 @@
 	}
 
 	/* Wait for the conversion to complete. */
-	while (timeout_ms) {
-		msleep(AK8975_CONVERSION_DONE_POLL_TIME);
-		if (gpio_get_value(data->eoc_gpio))
-			break;
-		timeout_ms -= AK8975_CONVERSION_DONE_POLL_TIME;
-	}
-	if (!timeout_ms) {
-		dev_err(&client->dev, "Conversion timeout happened\n");
-		ret = -EINVAL;
+	if (data->eoc_gpio)
+		ret = wait_conversion_complete_gpio(data);
+	else
+		ret = wait_conversion_complete_polled(data);
+	if (ret < 0)
 		goto exit;
-	}
 
-	ret = ak8975_read_data(client, AK8975_REG_ST1, 1, &read_status);
-	if (ret < 0) {
-		dev_err(&client->dev, "Error in reading ST1\n");
-		goto exit;
-	}
+	read_status = ret;
 
 	if (read_status & AK8975_REG_ST1_DRDY_MASK) {
 		ret = ak8975_read_data(client, AK8975_REG_ST2, 1, &read_status);
@@ -454,25 +497,26 @@
 	data->eoc_irq = client->irq;
 	data->eoc_gpio = irq_to_gpio(client->irq);
 
-	if (!data->eoc_gpio) {
-		dev_err(&client->dev, "failed, no valid GPIO\n");
-		err = -EINVAL;
-		goto exit_free;
-	}
+	/* We may not have a GPIO based IRQ to scan, that is fine, we will
+	   poll if so */
+	if (data->eoc_gpio > 0) {
+		err = gpio_request(data->eoc_gpio, "ak_8975");
+		if (err < 0) {
+			dev_err(&client->dev,
+				"failed to request GPIO %d, error %d\n",
+							data->eoc_gpio, err);
+			goto exit_free;
+		}
 
-	err = gpio_request(data->eoc_gpio, "ak_8975");
-	if (err < 0) {
-		dev_err(&client->dev, "failed to request GPIO %d, error %d\n",
-			data->eoc_gpio, err);
-		goto exit_free;
-	}
-
-	err = gpio_direction_input(data->eoc_gpio);
-	if (err < 0) {
-		dev_err(&client->dev, "Failed to configure input direction for"
-			" GPIO %d, error %d\n", data->eoc_gpio, err);
-		goto exit_gpio;
-	}
+		err = gpio_direction_input(data->eoc_gpio);
+		if (err < 0) {
+			dev_err(&client->dev,
+				"Failed to configure input direction for GPIO %d, error %d\n",
+						data->eoc_gpio, err);
+			goto exit_gpio;
+		}
+	} else
+		data->eoc_gpio = 0;	/* No GPIO available */
 
 	/* Perform some basic start-of-day setup of the device. */
 	err = ak8975_setup(client);
@@ -503,7 +547,8 @@
 exit_free_iio:
 	iio_free_device(data->indio_dev);
 exit_gpio:
-	gpio_free(data->eoc_gpio);
+	if (data->eoc_gpio)
+		gpio_free(data->eoc_gpio);
 exit_free:
 	kfree(data);
 exit:
@@ -517,7 +562,8 @@
 	iio_device_unregister(data->indio_dev);
 	iio_free_device(data->indio_dev);
 
-	gpio_free(data->eoc_gpio);
+	if (data->eoc_gpio)
+		gpio_free(data->eoc_gpio);
 
 	kfree(data);
 
diff --git a/drivers/staging/iio/sysfs.h b/drivers/staging/iio/sysfs.h
index 24b74dd..8f4d547 100644
--- a/drivers/staging/iio/sysfs.h
+++ b/drivers/staging/iio/sysfs.h
@@ -266,6 +266,7 @@
 #define IIO_EV_CLASS_MAGN		4
 #define IIO_EV_CLASS_LIGHT		5
 #define IIO_EV_CLASS_PROXIMITY		6
+#define IIO_EV_CLASS_TEMP		7
 
 #define IIO_EV_MOD_X			0
 #define IIO_EV_MOD_Y			1
diff --git a/drivers/staging/intel_sst/intel_sst_app_interface.c b/drivers/staging/intel_sst/intel_sst_app_interface.c
index 1d06212..d7454e2 100644
--- a/drivers/staging/intel_sst/intel_sst_app_interface.c
+++ b/drivers/staging/intel_sst/intel_sst_app_interface.c
@@ -418,10 +418,6 @@
 	static int sent_offset;
 	static unsigned long sent_index;
 
-	stream_bufs = kzalloc(sizeof(*stream_bufs), GFP_KERNEL);
-	if (!stream_bufs)
-		return -ENOMEM;
-	stream_bufs->addr = sst_drv_ctx->mmap_mem;
 #ifdef CONFIG_MRST_RAR_HANDLER
 	if (stream->ops == STREAM_OPS_PLAYBACK_DRM) {
 		for (index = stream->sg_index; index < nr_segs; index++) {
@@ -448,6 +444,10 @@
 		return retval;
 	}
 #endif
+	stream_bufs = kzalloc(sizeof(*stream_bufs), GFP_KERNEL);
+	if (!stream_bufs)
+		return -ENOMEM;
+	stream_bufs->addr = sst_drv_ctx->mmap_mem;
 	mmap_len = sst_drv_ctx->mmap_len;
 	stream_bufs->addr = sst_drv_ctx->mmap_mem;
 	bufp = stream->cur_ptr;
diff --git a/drivers/staging/keucr/msscsi.c b/drivers/staging/keucr/msscsi.c
index cb92d25..d1a919b 100644
--- a/drivers/staging/keucr/msscsi.c
+++ b/drivers/staging/keucr/msscsi.c
@@ -1,3 +1,5 @@
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
@@ -44,7 +46,7 @@
 //----- MS_SCSI_Test_Unit_Ready() --------------------------------------------------
 int MS_SCSI_Test_Unit_Ready(struct us_data *us, struct scsi_cmnd *srb)
 {
-	//printk("MS_SCSI_Test_Unit_Ready\n");
+	/* pr_info("MS_SCSI_Test_Unit_Ready\n"); */
 	if (us->MS_Status.Insert && us->MS_Status.Ready)
 		return USB_STOR_TRANSPORT_GOOD;
 	else
@@ -59,7 +61,7 @@
 //----- MS_SCSI_Inquiry() --------------------------------------------------
 int MS_SCSI_Inquiry(struct us_data *us, struct scsi_cmnd *srb)
 {
-	//printk("MS_SCSI_Inquiry\n");
+	/* pr_info("MS_SCSI_Inquiry\n"); */
 	BYTE data_ptr[36] = {0x00, 0x80, 0x02, 0x00, 0x1F, 0x00, 0x00, 0x00, 0x55, 0x53, 0x42, 0x32, 0x2E, 0x30, 0x20, 0x20, 0x43, 0x61, 0x72, 0x64, 0x52, 0x65, 0x61, 0x64, 0x65, 0x72, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x30, 0x31, 0x30, 0x30};
 
 	usb_stor_set_xfer_buf(us, data_ptr, 36, srb, TO_XFER_BUF);
@@ -91,7 +93,7 @@
 	WORD    bl_len;
 	BYTE    buf[8];
 
-	printk("MS_SCSI_Read_Capacity\n");
+	pr_info("MS_SCSI_Read_Capacity\n");
 
 	bl_len = 0x200;
 	if ( us->MS_Status.IsMSPro )
@@ -100,8 +102,8 @@
 		bl_num = us->MS_Lib.NumberOfLogBlock * us->MS_Lib.blockSize * 2 - 1;
 
 	us->bl_num = bl_num;
-	printk("bl_len = %x\n", bl_len);
-	printk("bl_num = %x\n", bl_num);
+	pr_info("bl_len = %x\n", bl_len);
+	pr_info("bl_num = %x\n", bl_num);
 
 	//srb->request_bufflen = 8;
 	buf[0] = (bl_num>>24) & 0xff;
@@ -130,7 +132,8 @@
 	WORD  blen = ((Cdb[7]<< 8) & 0xff00)     | ((Cdb[8]<< 0) & 0x00ff);
 	DWORD	blenByte = blen * 0x200;
 
-	//printk("SCSIOP_READ --- bn = %X, blen = %X, srb->use_sg = %X\n", bn, blen, srb->use_sg);
+	/* pr_info("SCSIOP_READ --- bn = %X, blen = %X, srb->use_sg = %X\n",
+						bn, blen, srb->use_sg); */
 	
 	if (bn > us->bl_num)
 		return USB_STOR_TRANSPORT_ERROR;
@@ -140,7 +143,7 @@
 		result = ENE_LoadBinCode(us, MSP_RW_PATTERN);
 		if (result != USB_STOR_XFER_GOOD)
 		{
-			printk("Load MSP RW pattern Fail !!\n");
+			pr_info("Load MSP RW pattern Fail !!\n");
 			return USB_STOR_TRANSPORT_ERROR;
 		}
 
@@ -174,7 +177,7 @@
 		result = ENE_LoadBinCode(us, MS_RW_PATTERN);
 		if (result != USB_STOR_XFER_GOOD)
 		{
-			printk("Load MS RW pattern Fail !!\n");
+			pr_info("Load MS RW pattern Fail !!\n");
 			result = USB_STOR_TRANSPORT_ERROR;
 			goto exit;
 		}
@@ -207,7 +210,8 @@
 			result = ENE_SendScsiCmd(us, FDIR_READ, buf+offset, 0);
 			if (result != USB_STOR_XFER_GOOD)
 			{
-				printk("MS_SCSI_Read --- result = %x\n", result);
+				pr_info("MS_SCSI_Read --- result = %x\n",
+								result);
 				result =  USB_STOR_TRANSPORT_ERROR;
 				goto exit;
 			}
@@ -245,7 +249,7 @@
 		result = ENE_LoadBinCode(us, MSP_RW_PATTERN);
 		if (result != USB_STOR_XFER_GOOD)
 		{
-			printk("Load MSP RW pattern Fail !!\n");
+			pr_info("Load MSP RW pattern Fail !!\n");
 			return USB_STOR_TRANSPORT_ERROR;
 		}
 
@@ -280,7 +284,7 @@
 		result = ENE_LoadBinCode(us, MS_RW_PATTERN);
 		if (result != USB_STOR_XFER_GOOD)
 		{
-			printk("Load MS RW pattern Fail !!\n");
+			pr_info("Load MS RW pattern Fail !!\n");
 			result = USB_STOR_TRANSPORT_ERROR;
 			goto exit;
 		}
@@ -301,7 +305,8 @@
 			result = MS_ReaderCopyBlock(us, oldphy, newphy, PhyBlockAddr, PageNum, buf+offset, len);
 			if (result != USB_STOR_XFER_GOOD)
 			{
-				printk("MS_SCSI_Write --- result = %x\n", result);
+				pr_info("MS_SCSI_Write --- result = %x\n",
+								result);
 				result =  USB_STOR_TRANSPORT_ERROR;
 				goto exit;
 			}
diff --git a/drivers/staging/keucr/scsiglue.c b/drivers/staging/keucr/scsiglue.c
index da4f42a..5e35d94c 100644
--- a/drivers/staging/keucr/scsiglue.c
+++ b/drivers/staging/keucr/scsiglue.c
@@ -1,3 +1,5 @@
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
@@ -16,7 +18,7 @@
 //----- host_info() ---------------------
 static const char* host_info(struct Scsi_Host *host)
 {
-	//printk("scsiglue --- host_info\n");
+	/* pr_info("scsiglue --- host_info\n"); */
 	return "SCSI emulation for USB Mass Storage devices";
 }
 
@@ -25,7 +27,7 @@
 {
 	struct us_data *us = host_to_us(sdev->host);
 
-	//printk("scsiglue --- slave_alloc\n");
+	/* pr_info("scsiglue --- slave_alloc\n"); */
 	sdev->inquiry_len = 36;
 
 	blk_queue_update_dma_alignment(sdev->request_queue, (512 - 1));
@@ -41,7 +43,7 @@
 {
 	struct us_data *us = host_to_us(sdev->host);
 
-	//printk("scsiglue --- slave_configure\n");
+	/* pr_info("scsiglue --- slave_configure\n"); */
 	if (us->fflags & (US_FL_MAX_SECTORS_64 | US_FL_MAX_SECTORS_MIN))
 	{
 		unsigned int max_sectors = 64;
@@ -91,19 +93,20 @@
 {
 	struct us_data *us = host_to_us(srb->device->host);
 
-	//printk("scsiglue --- queuecommand\n");
+	/* pr_info("scsiglue --- queuecommand\n"); */
 
 	/* check for state-transition errors */
 	if (us->srb != NULL)
 	{
-		printk("Error in %s: us->srb = %p\n", __FUNCTION__, us->srb);
+		/* pr_info("Error in %s: us->srb = %p\n"
+				 __FUNCTION__, us->srb); */
 		return SCSI_MLQUEUE_HOST_BUSY;
 	}
 
 	/* fail the command if we are disconnecting */
 	if (test_bit(US_FLIDX_DISCONNECTING, &us->dflags))
 	{
-		printk("Fail command during disconnect\n");
+		pr_info("Fail command during disconnect\n");
 		srb->result = DID_NO_CONNECT << 16;
 		done(srb);
 		return 0;
@@ -129,7 +132,7 @@
 {
 	struct us_data *us = host_to_us(srb->device->host);
 
-	//printk("scsiglue --- command_abort\n");
+	/* pr_info("scsiglue --- command_abort\n"); */
 
 	scsi_lock(us_to_host(us));
 	if (us->srb != srb)
@@ -159,7 +162,7 @@
 	struct us_data *us = host_to_us(srb->device->host);
 	int result;
 
-	//printk("scsiglue --- device_reset\n");
+	/* pr_info("scsiglue --- device_reset\n"); */
 
 	/* lock the device pointers and do the reset */
 	mutex_lock(&(us->dev_mutex));
@@ -175,7 +178,7 @@
 	struct us_data *us = host_to_us(srb->device->host);
 	int result;
 
-	//printk("scsiglue --- bus_reset\n");
+	/* pr_info("scsiglue --- bus_reset\n"); */
 	result = usb_stor_port_reset(us);
 	return result < 0 ? FAILED : SUCCESS;
 }
@@ -186,7 +189,7 @@
 	int i;
 	struct Scsi_Host *host = us_to_host(us);
 
-	//printk("scsiglue --- usb_stor_report_device_reset\n");
+	/* pr_info("scsiglue --- usb_stor_report_device_reset\n"); */
 	scsi_report_device_reset(host, 0, 0);
 	if (us->fflags & US_FL_SCM_MULT_TARG)
 	{
@@ -200,7 +203,7 @@
 {
 	struct Scsi_Host *host = us_to_host(us);
 
-	//printk("scsiglue --- usb_stor_report_bus_reset\n");
+	/* pr_info("scsiglue --- usb_stor_report_bus_reset\n"); */
 	scsi_lock(host);
 	scsi_report_bus_reset(host, 0);
 	scsi_unlock(host);
@@ -222,7 +225,7 @@
 	char *pos = buffer;
 	const char *string;
 
-	//printk("scsiglue --- proc_info\n");
+	/* pr_info("scsiglue --- proc_info\n"); */
 	if (inout)
 		return length;
 
@@ -288,7 +291,7 @@
 {
 	struct scsi_device *sdev = to_scsi_device(dev);
 
-	//printk("scsiglue --- ssize_t show_max_sectors\n");
+	/* pr_info("scsiglue --- ssize_t show_max_sectors\n"); */
 	return sprintf(buf, "%u\n", queue_max_sectors(sdev->request_queue));
 }
 
@@ -299,7 +302,7 @@
 	struct scsi_device *sdev = to_scsi_device(dev);
 	unsigned short ms;
 
-	//printk("scsiglue --- ssize_t store_max_sectors\n");
+	/* pr_info("scsiglue --- ssize_t store_max_sectors\n"); */
 	if (sscanf(buf, "%hu", &ms) > 0 && ms <= SCSI_DEFAULT_MAX_SECTORS)
 	{
 		blk_queue_max_hw_sectors(sdev->request_queue, ms);
@@ -383,7 +386,7 @@
 {
 	unsigned int cnt;
 
-	//printk("transport --- usb_stor_access_xfer_buf\n");
+	/* pr_info("transport --- usb_stor_access_xfer_buf\n"); */
 	struct scatterlist *sg = *sgptr;
 
 	if (!sg)
@@ -441,7 +444,7 @@
 	unsigned int offset = 0;
 	struct scatterlist *sg = NULL;
 
-	//printk("transport --- usb_stor_set_xfer_buf\n");
+	/* pr_info("transport --- usb_stor_set_xfer_buf\n"); */
 	// TO_XFER_BUF = 0, FROM_XFER_BUF = 1
 	buflen = min(buflen, scsi_bufflen(srb));
 	buflen = usb_stor_access_xfer_buf(us, buffer, buflen, srb, &sg, &offset, dir);
diff --git a/drivers/staging/keucr/smilmain.c b/drivers/staging/keucr/smilmain.c
index 95c688a..566dac0 100644
--- a/drivers/staging/keucr/smilmain.c
+++ b/drivers/staging/keucr/smilmain.c
@@ -102,12 +102,12 @@
 {
 	int	i;
 
-	printk("SM_FreeMem start\n");
+	pr_info("SM_FreeMem start\n");
 	for (i=0; i<MAX_ZONENUM; i++)
 	{
 		if (Log2Phy[i]!=NULL)
 		{
-			printk("Free Zone = %x, Addr = %p\n", i, Log2Phy[i]);
+			pr_info("Free Zone = %x, Addr = %p\n", i, Log2Phy[i]);
 			kfree(Log2Phy[i]);
 			Log2Phy[i] = NULL;
 		}
@@ -198,7 +198,7 @@
 	//SSFDCTYPE_T aa = (SSFDCTYPE_T ) &Ssfdc;
 	//ADDRESS_T   bb = (ADDRESS_T) &Media;
 
-	//printk("Media_D_CopySector !!!\n");
+	/* pr_info("Media_D_CopySector !!!\n"); */
 	if (Conv_D_MediaAddr(us, start))
 		return(ErrCode);
 
@@ -657,7 +657,7 @@
 //----- Check_D_MediaFmt() ---------------------------------------------
 int Check_D_MediaFmt(struct us_data *us)
 {
-	printk("Check_D_MediaFmt\n");
+	pr_info("Check_D_MediaFmt\n");
 	//ULONG i,j, result=FALSE, zone,block;
 
 	//usleep(56*1024);
@@ -1334,7 +1334,7 @@
 	//SSFDCTYPE_T aa = (SSFDCTYPE_T ) &Ssfdc;
 	//ADDRESS_T   bb = (ADDRESS_T) &Media;
 
-	//printk("Copy_D_PhyOneSect --- Secotr = %x\n", Media.Sector);
+	/* pr_info("Copy_D_PhyOneSect --- Secotr = %x\n", Media.Sector); */
 	if (ReadBlock!=NO_ASSIGN)
 	{
 		Media.PhyBlock=ReadBlock;
@@ -1620,7 +1620,8 @@
 	if (Log2Phy[Media.Zone]==NULL)
 	{
 		Log2Phy[Media.Zone] = kmalloc(MAX_LOGBLOCK*sizeof(WORD), GFP_KERNEL);
-		//printk("ExAllocatePool Zone = %x, Addr = %x\n", Media.Zone, Log2Phy[Media.Zone]);
+		/* pr_info("ExAllocatePool Zone = %x, Addr = %x\n",
+				Media.Zone, Log2Phy[Media.Zone]); */
 		if (Log2Phy[Media.Zone]==NULL)
 			return(ERROR);
 	}
@@ -1630,7 +1631,8 @@
 	//for(Media.Zone=0; Media.Zone<MAX_ZONENUM; Media.Zone++)
 	//for(Media.Zone=0; Media.Zone<Ssfdc.MaxZones; Media.Zone++)
 	{
-		//printk("Make_D_LogTable --- MediaZone = 0x%x\n", Media.Zone);
+		/* pr_info("Make_D_LogTable --- MediaZone = 0x%x\n",
+							Media.Zone); */
 		for(Media.LogBlock=0; Media.LogBlock<Ssfdc.MaxLogBlocks; Media.LogBlock++)
 			Log2Phy[Media.Zone][Media.LogBlock]=NO_ASSIGN;
 
diff --git a/drivers/staging/keucr/transport.c b/drivers/staging/keucr/transport.c
index a53402f..0114276 100644
--- a/drivers/staging/keucr/transport.c
+++ b/drivers/staging/keucr/transport.c
@@ -1,3 +1,5 @@
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
@@ -18,7 +20,7 @@
 {
 	struct completion *urb_done_ptr = urb->context;
 
-	//printk("transport --- usb_stor_blocking_completion\n");
+	/* pr_info("transport --- usb_stor_blocking_completion\n"); */
 	complete(urb_done_ptr);
 }
 
@@ -29,7 +31,7 @@
 	long timeleft;
 	int status;
 
-	//printk("transport --- usb_stor_msg_common\n");
+	/* pr_info("transport --- usb_stor_msg_common\n"); */
 	if (test_bit(US_FLIDX_ABORTING, &us->dflags))
 		return -EIO;
 
@@ -56,7 +58,7 @@
 	{
 		if (test_and_clear_bit(US_FLIDX_URB_ACTIVE, &us->dflags))
 		{
-			//printk("-- cancelling URB\n");
+			/* pr_info("-- cancelling URB\n"); */
 			usb_unlink_urb(us->current_urb);
 		}
 	}
@@ -66,7 +68,8 @@
 
 	if (timeleft <= 0)
 	{
-		//printk("%s -- cancelling URB\n", timeleft == 0 ? "Timeout" : "Signal");
+		/* pr_info("%s -- cancelling URB\n",
+			timeleft == 0 ? "Timeout" : "Signal"); */
 		usb_kill_urb(us->current_urb);
 	}
 
@@ -80,7 +83,7 @@
 {
 	int status;
 
-	//printk("transport --- usb_stor_control_msg\n");
+	/* pr_info("transport --- usb_stor_control_msg\n"); */
 
 	/* fill in the devrequest structure */
 	us->cr->bRequestType = requesttype;
@@ -107,7 +110,7 @@
 	int result;
 	int endp = usb_pipeendpoint(pipe);
 
-	//printk("transport --- usb_stor_clear_halt\n");
+	/* pr_info("transport --- usb_stor_clear_halt\n"); */
 	if (usb_pipein (pipe))
 		endp |= USB_DIR_IN;
 
@@ -128,41 +131,41 @@
 static int interpret_urb_result(struct us_data *us, unsigned int pipe,
 		unsigned int length, int result, unsigned int partial)
 {
-	//printk("transport --- interpret_urb_result\n");
+	/* pr_info("transport --- interpret_urb_result\n"); */
 	switch (result) {
 	/* no error code; did we send all the data? */
 	case 0:
 		if (partial != length)
 		{
-			//printk("-- short transfer\n");
+			/* pr_info("-- short transfer\n"); */
 			return USB_STOR_XFER_SHORT;
 		}
-		//printk("-- transfer complete\n");
+		/* pr_info("-- transfer complete\n"); */
 		return USB_STOR_XFER_GOOD;
 	case -EPIPE:
 		if (usb_pipecontrol(pipe))
 		{
-			//printk("-- stall on control pipe\n");
+			/* pr_info("-- stall on control pipe\n"); */
 			return USB_STOR_XFER_STALLED;
 		}
-		//printk("clearing endpoint halt for pipe 0x%x\n", pipe);
+		/* pr_info("clearing endpoint halt for pipe 0x%x\n", pipe); */
 		if (usb_stor_clear_halt(us, pipe) < 0)
 			return USB_STOR_XFER_ERROR;
 		return USB_STOR_XFER_STALLED;
 	case -EOVERFLOW:
-		//printk("-- babble\n");
+		/* pr_info("-- babble\n"); */
 		return USB_STOR_XFER_LONG;
 	case -ECONNRESET:
-		//printk("-- transfer cancelled\n");
+		/* pr_info("-- transfer cancelled\n"); */
 		return USB_STOR_XFER_ERROR;
 	case -EREMOTEIO:
-		//printk("-- short read transfer\n");
+		/* pr_info("-- short read transfer\n"); */
 		return USB_STOR_XFER_SHORT;
 	case -EIO:
-		//printk("-- abort or disconnect in progress\n");
+		/* pr_info("-- abort or disconnect in progress\n"); */
 		return USB_STOR_XFER_ERROR;
 	default:
-		//printk("-- unknown error\n");
+		/* pr_info("-- unknown error\n"); */
 		return USB_STOR_XFER_ERROR;
 	}
 }
@@ -173,7 +176,7 @@
 {
 	int result;
 
-	//printk("transport --- usb_stor_bulk_transfer_buf\n");
+	/* pr_info("transport --- usb_stor_bulk_transfer_buf\n"); */
 
 	/* fill and submit the URB */
 	usb_fill_bulk_urb(us->current_urb, us->pusb_dev, pipe, buf, length, usb_stor_blocking_completion, NULL);
@@ -193,7 +196,7 @@
 {
 	int result;
 
-	//printk("transport --- usb_stor_bulk_transfer_sglist\n");
+	/* pr_info("transport --- usb_stor_bulk_transfer_sglist\n"); */
 	if (test_bit(US_FLIDX_ABORTING, &us->dflags))
 		return USB_STOR_XFER_ERROR;
 
@@ -201,7 +204,7 @@
 	result = usb_sg_init(&us->current_sg, us->pusb_dev, pipe, 0, sg, num_sg, length, GFP_NOIO);
 	if (result)
 	{
-		//printk("usb_sg_init returned %d\n", result);
+		/* pr_info("usb_sg_init returned %d\n", result); */
 		return USB_STOR_XFER_ERROR;
 	}
 
@@ -214,7 +217,7 @@
 		/* cancel the request, if it hasn't been cancelled already */
 		if (test_and_clear_bit(US_FLIDX_SG_ACTIVE, &us->dflags))
 		{
-			//printk("-- cancelling sg request\n");
+			/* pr_info("-- cancelling sg request\n"); */
 			usb_sg_cancel(&us->current_sg);
 		}
 	}
@@ -249,7 +252,7 @@
 	int result;
 	unsigned int partial;
 
-	//printk("transport --- usb_stor_bulk_transfer_sg\n");
+	/* pr_info("transport --- usb_stor_bulk_transfer_sg\n"); */
 	/* are we scatter-gathering? */
 	if (use_sg)
 	{
@@ -281,7 +284,7 @@
 	int need_auto_sense;
 	int result;
 
-	//printk("transport --- usb_stor_invoke_transport\n");
+	/* pr_info("transport --- usb_stor_invoke_transport\n"); */
 	usb_stor_print_cmd(srb);
 	/* send the command to the transport layer */
 	scsi_set_resid(srb, 0);
@@ -290,7 +293,7 @@
 	/* if the command gets aborted by the higher layers, we need to short-circuit all other processing */
 	if (test_bit(US_FLIDX_TIMED_OUT, &us->dflags))
 	{
-		//printk("-- command was aborted\n");
+		/* pr_info("-- command was aborted\n"); */
 		srb->result = DID_ABORT << 16;
 		goto Handle_Errors;
 	}
@@ -298,7 +301,7 @@
 	/* if there is a transport error, reset and don't auto-sense */
 	if (result == USB_STOR_TRANSPORT_ERROR)
 	{
-		//printk("-- transport indicates error, resetting\n");
+		/* pr_info("-- transport indicates error, resetting\n"); */
 		srb->result = DID_ERROR << 16;
 		goto Handle_Errors;
 	}
@@ -317,13 +320,13 @@
 
 	if ((us->protocol == USB_PR_CB || us->protocol == USB_PR_DPCM_USB) && srb->sc_data_direction != DMA_FROM_DEVICE)
 	{
-		//printk("-- CB transport device requiring auto-sense\n");
+		/* pr_info("-- CB transport device requiring auto-sense\n"); */
 		need_auto_sense = 1;
 	}
 
 	if (result == USB_STOR_TRANSPORT_FAILED)
 	{
-		//printk("-- transport indicates command failure\n");
+		/* pr_info("-- transport indicates command failure\n"); */
 		need_auto_sense = 1;
 	}
 
@@ -333,7 +336,7 @@
 		int temp_result;
 		struct scsi_eh_save ses;
 
-		printk("Issuing auto-REQUEST_SENSE\n");
+		pr_info("Issuing auto-REQUEST_SENSE\n");
 
 		scsi_eh_prep_cmnd(srb, &ses, NULL, 0, US_SENSE_SIZE);
 
@@ -352,13 +355,13 @@
 
 		if (test_bit(US_FLIDX_TIMED_OUT, &us->dflags))
 		{
-			//printk("-- auto-sense aborted\n");
+			/* pr_info("-- auto-sense aborted\n"); */
 			srb->result = DID_ABORT << 16;
 			goto Handle_Errors;
 		}
 		if (temp_result != USB_STOR_TRANSPORT_GOOD)
 		{
-			//printk("-- auto-sense failure\n");
+			/* pr_info("-- auto-sense failure\n"); */
 			srb->result = DID_ERROR << 16;
 			if (!(us->fflags & US_FL_SCM_MULT_TARG))
 				goto Handle_Errors;
@@ -409,7 +412,7 @@
 {
 	int result=0;
 
-	//printk("transport --- ENE_stor_invoke_transport\n");
+	/* pr_info("transport --- ENE_stor_invoke_transport\n"); */
 	usb_stor_print_cmd(srb);
 	/* send the command to the transport layer */
 	scsi_set_resid(srb, 0);
@@ -427,7 +430,7 @@
 	/* if the command gets aborted by the higher layers, we need to short-circuit all other processing */
 	if (test_bit(US_FLIDX_TIMED_OUT, &us->dflags))
 	{
-		//printk("-- command was aborted\n");
+		/* pr_info("-- command was aborted\n"); */
 		srb->result = DID_ABORT << 16;
 		goto Handle_Errors;
 	}
@@ -435,7 +438,7 @@
 	/* if there is a transport error, reset and don't auto-sense */
 	if (result == USB_STOR_TRANSPORT_ERROR)
 	{
-		//printk("-- transport indicates error, resetting\n");
+		/* pr_info("-- transport indicates error, resetting\n"); */
 		srb->result = DID_ERROR << 16;
 		goto Handle_Errors;
 	}
@@ -450,7 +453,7 @@
 	srb->result = SAM_STAT_GOOD;
 	if (result == USB_STOR_TRANSPORT_FAILED)
 	{
-		//printk("-- transport indicates command failure\n");
+		/* pr_info("-- transport indicates command failure\n"); */
 		//need_auto_sense = 1;
 		BuildSenseBuffer(srb, us->SrbStatus);
 		srb->result = SAM_STAT_CHECK_CONDITION;
@@ -488,7 +491,7 @@
     BYTE    *buf = srb->sense_buffer;
     BYTE    asc;
 
-    printk("transport --- BuildSenseBuffer\n");
+	pr_info("transport --- BuildSenseBuffer\n");
     switch (SrbStatus)
     {
         case SS_NOT_READY:        asc = 0x3a;    break;  // sense key = 0x02
@@ -507,17 +510,17 @@
 //----- usb_stor_stop_transport() ---------------------
 void usb_stor_stop_transport(struct us_data *us)
 {
-	//printk("transport --- usb_stor_stop_transport\n");
+	/* pr_info("transport --- usb_stor_stop_transport\n"); */
 
 	if (test_and_clear_bit(US_FLIDX_URB_ACTIVE, &us->dflags))
 	{
-		//printk("-- cancelling URB\n");
+		/* pr_info("-- cancelling URB\n"); */
 		usb_unlink_urb(us->current_urb);
 	}
 
 	if (test_and_clear_bit(US_FLIDX_SG_ACTIVE, &us->dflags))
 	{
-		//printk("-- cancelling sg request\n");
+		/* pr_info("-- cancelling sg request\n"); */
 		usb_sg_cancel(&us->current_sg);
 	}
 }
@@ -527,7 +530,7 @@
 {
 	int result;
 
-	//printk("transport --- usb_stor_Bulk_max_lun\n");
+	/* pr_info("transport --- usb_stor_Bulk_max_lun\n"); */
 	/* issue the command */
 	us->iobuf[0] = 0;
 	result = usb_stor_control_msg(us, us->recv_ctrl_pipe,
@@ -536,7 +539,8 @@
 				 USB_RECIP_INTERFACE,
 				 0, us->ifnum, us->iobuf, 1, HZ);
 
-	//printk("GetMaxLUN command result is %d, data is %d\n", result, us->iobuf[0]);
+	/* pr_info("GetMaxLUN command result is %d, data is %d\n",
+						result, us->iobuf[0]); */
 
 	/* if we have a successful request, return the result */
 	if (result > 0)
@@ -557,7 +561,7 @@
 	unsigned int cswlen;
 	unsigned int cbwlen = US_BULK_CB_WRAP_LEN;
 
-	//printk("transport --- usb_stor_Bulk_transport\n");
+	/* pr_info("transport --- usb_stor_Bulk_transport\n"); */
 	/* Take care of BULK32 devices; set extra byte to 0 */
 	if (unlikely(us->fflags & US_FL_BULK32))
 	{
@@ -581,13 +585,13 @@
 
 	// send command
 	/* send it to out endpoint */
-	/*printk("Bulk Command S 0x%x T 0x%x L %d F %d Trg %d LUN %d CL %d\n",
+	/* pr_info("Bulk Command S 0x%x T 0x%x L %d F %d Trg %d LUN %d CL %d\n",
 			le32_to_cpu(bcb->Signature), bcb->Tag,
 			le32_to_cpu(bcb->DataTransferLength), bcb->Flags,
 			(bcb->Lun >> 4), (bcb->Lun & 0x0F),
-			bcb->Length);*/
+			bcb->Length); */
 	result = usb_stor_bulk_transfer_buf(us, us->send_bulk_pipe, bcb, cbwlen, NULL);
-	//printk("Bulk command transfer result=%d\n", result);
+	/* pr_info("Bulk command transfer result=%d\n", result); */
 	if (result != USB_STOR_XFER_GOOD)
 		return USB_STOR_TRANSPORT_ERROR;
 
@@ -599,7 +603,7 @@
 	{
 		unsigned int pipe = srb->sc_data_direction == DMA_FROM_DEVICE ? us->recv_bulk_pipe : us->send_bulk_pipe;
 		result = usb_stor_bulk_srb(us, pipe, srb);
-		//printk("Bulk data transfer result 0x%x\n", result);
+		/* pr_info("Bulk data transfer result 0x%x\n", result); */
 		if (result == USB_STOR_XFER_ERROR)
 			return USB_STOR_TRANSPORT_ERROR;
 
@@ -608,12 +612,12 @@
 	}
 
 	/* get CSW for device status */
-	//printk("Attempting to get CSW...\n");
+	/* pr_info("Attempting to get CSW...\n"); */
 	result = usb_stor_bulk_transfer_buf(us, us->recv_bulk_pipe, bcs, US_BULK_CS_WRAP_LEN, &cswlen);
 
 	if (result == USB_STOR_XFER_SHORT && cswlen == 0)
 	{
-		//printk("Received 0-length CSW; retrying...\n");
+		/* pr_info("Received 0-length CSW; retrying...\n"); */
 		result = usb_stor_bulk_transfer_buf(us, us->recv_bulk_pipe, bcs, US_BULK_CS_WRAP_LEN, &cswlen);
 	}
 
@@ -621,21 +625,23 @@
 	if (result == USB_STOR_XFER_STALLED)
 	{
 		/* get the status again */
-		//printk("Attempting to get CSW (2nd try)...\n");
+		/* pr_info("Attempting to get CSW (2nd try)...\n"); */
 		result = usb_stor_bulk_transfer_buf(us, us->recv_bulk_pipe, bcs, US_BULK_CS_WRAP_LEN, NULL);
 	}
 
 	/* if we still have a failure at this point, we're in trouble */
-	//printk("Bulk status result = %d\n", result);
+	/* pr_info("Bulk status result = %d\n", result); */
 	if (result != USB_STOR_XFER_GOOD)
 		return USB_STOR_TRANSPORT_ERROR;
 
 	/* check bulk status */
 	residue = le32_to_cpu(bcs->Residue);
-	//printk("Bulk Status S 0x%x T 0x%x R %u Stat 0x%x\n", le32_to_cpu(bcs->Signature), bcs->Tag, residue, bcs->Status);
+	/* pr_info("Bulk Status S 0x%x T 0x%x R %u Stat 0x%x\n",
+				le32_to_cpu(bcs->Signature),
+				bcs->Tag, residue, bcs->Status); */
 	if (!(bcs->Tag == us->tag || (us->fflags & US_FL_BULK_IGNORE_TAG)) || bcs->Status > US_BULK_STAT_PHASE)
 	{
-		//printk("Bulk logical error\n");
+		/* pr_info("Bulk logical error\n"); */
 		return USB_STOR_TRANSPORT_ERROR;
 	}
 
@@ -643,13 +649,14 @@
 	{
 		us->bcs_signature = bcs->Signature;
 		//if (us->bcs_signature != cpu_to_le32(US_BULK_CS_SIGN))
-		//	printk("Learnt BCS signature 0x%08X\n", le32_to_cpu(us->bcs_signature));
+		/* pr_info("Learnt BCS signature 0x%08X\n",
+				le32_to_cpu(us->bcs_signature)); */
 	}
 	else if (bcs->Signature != us->bcs_signature)
 	{
-		/*printk("Signature mismatch: got %08X, expecting %08X\n",
+		/* pr_info("Signature mismatch: got %08X, expecting %08X\n",
 			  le32_to_cpu(bcs->Signature),
-			  le32_to_cpu(us->bcs_signature));*/
+			  le32_to_cpu(us->bcs_signature)); */
 		return USB_STOR_TRANSPORT_ERROR;
 	}
 
@@ -710,47 +717,47 @@
 	int result;
 	int result2;
 
-	//printk("transport --- usb_stor_reset_common\n");
+	/* pr_info("transport --- usb_stor_reset_common\n"); */
 	if (test_bit(US_FLIDX_DISCONNECTING, &us->dflags))
 	{
-		//printk("No reset during disconnect\n");
+		/* pr_info("No reset during disconnect\n"); */
 		return -EIO;
 	}
 
 	result = usb_stor_control_msg(us, us->send_ctrl_pipe, request, requesttype, value, index, data, size,	5*HZ);
 	if (result < 0)
 	{
-		//printk("Soft reset failed: %d\n", result);
+		/* pr_info("Soft reset failed: %d\n", result); */
 		return result;
 	}
 
 	wait_event_interruptible_timeout(us->delay_wait, test_bit(US_FLIDX_DISCONNECTING, &us->dflags),	HZ*6);
 	if (test_bit(US_FLIDX_DISCONNECTING, &us->dflags))
 	{
-		//printk("Reset interrupted by disconnect\n");
+		/* pr_info("Reset interrupted by disconnect\n"); */
 		return -EIO;
 	}
 
-	//printk("Soft reset: clearing bulk-in endpoint halt\n");
+	/* pr_info("Soft reset: clearing bulk-in endpoint halt\n"); */
 	result = usb_stor_clear_halt(us, us->recv_bulk_pipe);
 
-	//printk("Soft reset: clearing bulk-out endpoint halt\n");
+	/* pr_info("Soft reset: clearing bulk-out endpoint halt\n"); */
 	result2 = usb_stor_clear_halt(us, us->send_bulk_pipe);
 
 	/* return a result code based on the result of the clear-halts */
 	if (result >= 0)
 		result = result2;
 	//if (result < 0)
-	//	printk("Soft reset failed\n");
+		/* pr_info("Soft reset failed\n"); */
 	//else
-	//	printk("Soft reset done\n");
+		/* pr_info("Soft reset done\n"); */
 	return result;
 }
 
 //----- usb_stor_Bulk_reset() ---------------------
 int usb_stor_Bulk_reset(struct us_data *us)
 {
-	//printk("transport --- usb_stor_Bulk_reset\n");
+	/* pr_info("transport --- usb_stor_Bulk_reset\n"); */
 	return usb_stor_reset_common(us, US_BULK_RESET_REQUEST,
 				 USB_TYPE_CLASS | USB_RECIP_INTERFACE,
 				 0, us->ifnum, NULL, 0);
@@ -761,18 +768,19 @@
 {
 	int result;
 
-	//printk("transport --- usb_stor_port_reset\n");
+	/* pr_info("transport --- usb_stor_port_reset\n"); */
 	result = usb_lock_device_for_reset(us->pusb_dev, us->pusb_intf);
 	if (result < 0)
-		printk("unable to lock device for reset: %d\n", result);
+		pr_info("unable to lock device for reset: %d\n", result);
 	else {
 		/* Were we disconnected while waiting for the lock? */
 		if (test_bit(US_FLIDX_DISCONNECTING, &us->dflags)) {
 			result = -EIO;
-			//printk("No reset during disconnect\n");
+			/* pr_info("No reset during disconnect\n"); */
 		} else {
 			result = usb_reset_device(us->pusb_dev);
-			//printk("usb_reset_composite_device returns %d\n", result);
+			/* pr_info("usb_reset_composite_device returns %d\n",
+								result); */
 		}
 		usb_unlock_device(us->pusb_dev);
 	}
diff --git a/drivers/staging/keucr/usb.c b/drivers/staging/keucr/usb.c
index 8c2332e..b0d1670 100644
--- a/drivers/staging/keucr/usb.c
+++ b/drivers/staging/keucr/usb.c
@@ -37,7 +37,7 @@
 int eucr_suspend(struct usb_interface *iface, pm_message_t message)
 {
 	struct us_data *us = usb_get_intfdata(iface);
-	printk("--- eucr_suspend ---\n");
+	pr_info("--- eucr_suspend ---\n");
 	/* Wait until no command is running */
 	mutex_lock(&us->dev_mutex);
 
@@ -60,7 +60,7 @@
 	BYTE    tmp = 0;
 
 	struct us_data *us = usb_get_intfdata(iface);
-	printk("--- eucr_resume---\n");
+	pr_info("--- eucr_resume---\n");
 	mutex_lock(&us->dev_mutex);
 
 	//US_DEBUGP("%s\n", __func__);
@@ -85,7 +85,7 @@
 	BYTE    tmp = 0;
 	struct us_data *us = usb_get_intfdata(iface);
 
-	printk("--- eucr_reset_resume---\n");
+	pr_info("--- eucr_reset_resume---\n");
 	//US_DEBUGP("%s\n", __func__);
 
 	/* Report the reset to the SCSI core */
@@ -116,7 +116,7 @@
 {
 	struct us_data *us = usb_get_intfdata(iface);
 
-      printk("usb --- eucr_pre_reset\n");
+	pr_info("usb --- eucr_pre_reset\n");
 
 	/* Make sure no command runs during the reset */
 	mutex_lock(&us->dev_mutex);
@@ -128,7 +128,7 @@
 {
 	struct us_data *us = usb_get_intfdata(iface);
 
-      printk("usb --- eucr_post_reset\n");
+	pr_info("usb --- eucr_post_reset\n");
 
 	/* Report the reset to the SCSI core */
 	usb_stor_report_bus_reset(us);
@@ -140,7 +140,7 @@
 //----- fill_inquiry_response() ---------------------
 void fill_inquiry_response(struct us_data *us, unsigned char *data, unsigned int data_len)
 {
-      printk("usb --- fill_inquiry_response\n");
+	pr_info("usb --- fill_inquiry_response\n");
 	if (data_len<36) // You lose.
 		return;
 
@@ -171,7 +171,7 @@
 	struct us_data *us = (struct us_data *)__us;
 	struct Scsi_Host *host = us_to_host(us);
 
-      printk("usb --- usb_stor_control_thread\n");
+	pr_info("usb --- usb_stor_control_thread\n");
 	for(;;)
 	{
 		if (wait_for_completion_interruptible(&us->cmnd_ready))
@@ -242,7 +242,7 @@
 		else
 		{
 SkipForAbort:
-			printk("scsi command aborted\n");
+			pr_info("scsi command aborted\n");
 		}
 
 		if (test_bit(US_FLIDX_TIMED_OUT, &us->dflags))
@@ -277,7 +277,7 @@
 //----- associate_dev() ---------------------
 static int associate_dev(struct us_data *us, struct usb_interface *intf)
 {
-      printk("usb --- associate_dev\n");
+	pr_info("usb --- associate_dev\n");
 
 	/* Fill in the device-related fields */
 	us->pusb_dev = interface_to_usbdev(intf);
@@ -291,21 +291,21 @@
 	us->cr = usb_alloc_coherent(us->pusb_dev, sizeof(*us->cr), GFP_KERNEL, &us->cr_dma);
 	if (!us->cr)
 	{
-		printk("usb_ctrlrequest allocation failed\n");
+		pr_info("usb_ctrlrequest allocation failed\n");
 		return -ENOMEM;
 	}
 
 	us->iobuf = usb_alloc_coherent(us->pusb_dev, US_IOBUF_SIZE, GFP_KERNEL, &us->iobuf_dma);
 	if (!us->iobuf)
 	{
-		printk("I/O buffer allocation failed\n");
+		pr_info("I/O buffer allocation failed\n");
 		return -ENOMEM;
 	}
 
 	us->sensebuf = kmalloc(US_SENSE_SIZE, GFP_KERNEL);
 	if (!us->sensebuf)
 	{
-		printk("Sense buffer allocation failed\n");
+		pr_info("Sense buffer allocation failed\n");
 		return -ENOMEM;
 	}
 	return 0;
@@ -317,7 +317,7 @@
 	struct usb_device *dev = us->pusb_dev;
 	struct usb_interface_descriptor *idesc = &us->pusb_intf->cur_altsetting->desc;
 
-      printk("usb --- get_device_info\n");
+	pr_info("usb --- get_device_info\n");
 
 	us->subclass = idesc->bInterfaceSubClass;
 	us->protocol = idesc->bInterfaceProtocol;
@@ -326,7 +326,7 @@
 
 	if (us->fflags & US_FL_IGNORE_DEVICE)
 	{
-		printk("device ignored\n");
+		pr_info("device ignored\n");
 		return -ENODEV;
 	}
 
@@ -339,7 +339,7 @@
 //----- get_transport() ---------------------
 static int get_transport(struct us_data *us)
 {
-      printk("usb --- get_transport\n");
+	pr_info("usb --- get_transport\n");
 	switch (us->protocol) {
 	case USB_PR_BULK:
 		us->transport_name = "Bulk";
@@ -350,7 +350,7 @@
 	default:
 		return -EIO;
 	}
-	//printk("Transport: %s\n", us->transport_name);
+	/* pr_info("Transport: %s\n", us->transport_name); */
 
 	/* fix for single-lun devices */
 	if (us->fflags & US_FL_SINGLE_LUN)
@@ -361,9 +361,11 @@
 //----- get_protocol() ---------------------
 static int get_protocol(struct us_data *us)
 {
-      printk("usb --- get_protocol\n");
-	printk("us->pusb_dev->descriptor.idVendor = %x\n", us->pusb_dev->descriptor.idVendor);
-	printk("us->pusb_dev->descriptor.idProduct = %x\n", us->pusb_dev->descriptor.idProduct);
+	pr_info("usb --- get_protocol\n");
+	pr_info("us->pusb_dev->descriptor.idVendor = %x\n",
+			us->pusb_dev->descriptor.idVendor);
+	pr_info("us->pusb_dev->descriptor.idProduct = %x\n",
+			us->pusb_dev->descriptor.idProduct);
 	switch (us->subclass) {
 	case USB_SC_SCSI:
 		us->protocol_name = "Transparent SCSI";
@@ -376,7 +378,7 @@
 	default:
 		return -EIO;
 	}
-	//printk("Protocol: %s\n", us->protocol_name);
+	/* pr_info("Protocol: %s\n", us->protocol_name); */
 	return 0;
 }
 
@@ -390,7 +392,7 @@
 	struct usb_endpoint_descriptor *ep_out = NULL;
 	struct usb_endpoint_descriptor *ep_int = NULL;
 
-      printk("usb --- get_pipes\n");
+	pr_info("usb --- get_pipes\n");
 
 	for (i = 0; i < altsetting->desc.bNumEndpoints; i++)
 	{
@@ -418,7 +420,7 @@
 
 	if (!ep_in || !ep_out || (us->protocol == USB_PR_CBI && !ep_int))
 	{
-		printk("Endpoint sanity check failed! Rejecting dev.\n");
+		pr_info("Endpoint sanity check failed! Rejecting dev.\n");
 		return -EIO;
 	}
 
@@ -440,11 +442,11 @@
 {
 	struct task_struct *th;
 
-      printk("usb --- usb_stor_acquire_resources\n");
+	pr_info("usb --- usb_stor_acquire_resources\n");
 	us->current_urb = usb_alloc_urb(0, GFP_KERNEL);
 	if (!us->current_urb)
 	{
-		printk("URB allocation failed\n");
+		pr_info("URB allocation failed\n");
 		return -ENOMEM;
 	}
 
@@ -452,7 +454,7 @@
 	th = kthread_run(usb_stor_control_thread, us, "eucr-storage");
 	if (IS_ERR(th))
 	{
-		printk("Unable to start control thread\n");
+		pr_info("Unable to start control thread\n");
 		return PTR_ERR(th);
 	}
 	us->ctl_thread = th;
@@ -463,7 +465,7 @@
 //----- usb_stor_release_resources() ---------------------
 static void usb_stor_release_resources(struct us_data *us)
 {
-	printk("usb --- usb_stor_release_resources\n");
+	pr_info("usb --- usb_stor_release_resources\n");
 
 	SM_FreeMem();
 
@@ -474,7 +476,7 @@
 	/* Call the destructor routine, if it exists */
 	if (us->extra_destructor)
 	{
-		printk("-- calling extra_destructor()\n");
+		pr_info("-- calling extra_destructor()\n");
 		us->extra_destructor(us->extra);
 	}
 
@@ -486,7 +488,7 @@
 //----- dissociate_dev() ---------------------
 static void dissociate_dev(struct us_data *us)
 {
-      printk("usb --- dissociate_dev\n");
+	pr_info("usb --- dissociate_dev\n");
 
 	kfree(us->sensebuf);
 
@@ -505,7 +507,7 @@
 {
 	struct Scsi_Host *host = us_to_host(us);
 
-      printk("usb --- quiesce_and_remove_host\n");
+	pr_info("usb --- quiesce_and_remove_host\n");
 
 	/* If the device is really gone, cut short reset delays */
 	if (us->pusb_dev->state == USB_STATE_NOTATTACHED)
@@ -535,7 +537,7 @@
 //----- release_everything() ---------------------
 static void release_everything(struct us_data *us)
 {
-      printk("usb --- release_everything\n");
+	pr_info("usb --- release_everything\n");
 
 	usb_stor_release_resources(us);
 	dissociate_dev(us);
@@ -547,8 +549,8 @@
 {
 	struct us_data *us = (struct us_data *)__us;
 
-      printk("usb --- usb_stor_scan_thread\n");
-	printk("EUCR : device found at %d\n", us->pusb_dev->devnum);
+	pr_info("usb --- usb_stor_scan_thread\n");
+	pr_info("EUCR : device found at %d\n", us->pusb_dev->devnum);
 
 	set_freezable();
 	/* Wait for the timeout to expire or for a disconnect */
@@ -569,7 +571,7 @@
 			mutex_unlock(&us->dev_mutex);
 		}
 		scsi_scan_host(us_to_host(us));
-		printk("EUCR : device scan complete\n");
+		pr_info("EUCR : device scan complete\n");
 	}
 	complete_and_exit(&us->scanning_done, 0);
 }
@@ -583,12 +585,12 @@
 	BYTE	MiscReg03 = 0;
 	struct task_struct *th;
 
-      printk("usb --- eucr_probe\n");
+	pr_info("usb --- eucr_probe\n");
 
       host = scsi_host_alloc(&usb_stor_host_template, sizeof(*us));
 	if (!host)
 	{
-		printk("Unable to allocate the scsi host\n");
+		pr_info("Unable to allocate the scsi host\n");
 		return -ENOMEM;
 	}
 
@@ -631,7 +633,7 @@
 	result = scsi_add_host(host, &intf->dev);
 	if (result)
 	{
-		printk("Unable to add the scsi host\n");
+		pr_info("Unable to add the scsi host\n");
 		goto BadDevice;
 	}
 
@@ -639,7 +641,7 @@
 	th = kthread_create(usb_stor_scan_thread, us, "eucr-stor-scan");
 	if (IS_ERR(th))
 	{
-		printk("Unable to start the device-scanning thread\n");
+		pr_info("Unable to start the device-scanning thread\n");
 		complete(&us->scanning_done);
 		quiesce_and_remove_host(us);
 		result = PTR_ERR(th);
@@ -658,7 +660,7 @@
 	if (!(MiscReg03 & 0x02)) {
 		result = -ENODEV;
 		quiesce_and_remove_host(us);
-		printk(KERN_NOTICE "keucr: The driver only supports SM/MS card.\
+		pr_info("keucr: The driver only supports SM/MS card.\
 			To use SD card, \
 			please build driver/usb/storage/ums-eneub6250.ko\n");
 		goto BadDevice;
@@ -668,7 +670,7 @@
 
 	/* We come here if there are any problems */
 BadDevice:
-      printk("usb --- eucr_probe failed\n");
+	pr_info("usb --- eucr_probe failed\n");
 	release_everything(us);
 	return result;
 }
@@ -678,7 +680,7 @@
 {
 	struct us_data *us = usb_get_intfdata(intf);
 
-      printk("usb --- eucr_disconnect\n");
+	pr_info("usb --- eucr_disconnect\n");
 	quiesce_and_remove_host(us);
 	release_everything(us);
 }
@@ -705,11 +707,11 @@
 static int __init usb_stor_init(void)
 {
 	int retval;
-      printk("usb --- usb_stor_init start\n");
+	pr_info("usb --- usb_stor_init start\n");
 
 	retval = usb_register(&usb_storage_driver);
 	if (retval == 0)
-            printk("ENE USB Mass Storage support registered.\n");
+		pr_info("ENE USB Mass Storage support registered.\n");
 
 	return retval;
 }
@@ -717,7 +719,7 @@
 //----- usb_stor_exit() ---------------------
 static void __exit usb_stor_exit(void)
 {
-      printk("usb --- usb_stor_exit\n");
+	pr_info("usb --- usb_stor_exit\n");
 
 	usb_deregister(&usb_storage_driver) ;
 }
diff --git a/drivers/staging/rtl8712/ieee80211.h b/drivers/staging/rtl8712/ieee80211.h
index 432cf8a..1f4d147 100644
--- a/drivers/staging/rtl8712/ieee80211.h
+++ b/drivers/staging/rtl8712/ieee80211.h
@@ -76,7 +76,7 @@
 			u8 reserved[32];
 			u8 data[0];
 		} wpa_ie;
-		struct{
+		struct {
 			int command;
 			int reason_code;
 		} mlme;
@@ -149,11 +149,11 @@
 struct  ieee80211_hdr_3addr_qos {
 	u16 frame_ctl;
 	u16 duration_id;
-	u8 addr1[ETH_ALEN];
-	u8 addr2[ETH_ALEN];
-	u8 addr3[ETH_ALEN];
+	u8  addr1[ETH_ALEN];
+	u8  addr2[ETH_ALEN];
+	u8  addr3[ETH_ALEN];
 	u16 seq_ctl;
-       u16     qc;
+	u16 qc;
 }  __attribute__ ((packed));
 
 struct eapol {
@@ -461,7 +461,7 @@
 	uint rx_message_in_bad_msg_fragments;
 };
 
-struct ieee80211_softmac_stats{
+struct ieee80211_softmac_stats {
 	uint rx_ass_ok;
 	uint rx_ass_err;
 	uint rx_probe_rq;
@@ -754,15 +754,17 @@
 u8 *r8712_set_ie(u8 *pbuf, sint index, uint len, u8 *source, uint *frlen);
 u8 *r8712_get_ie(u8*pbuf, sint index, sint *len, sint limit);
 unsigned char *r8712_get_wpa_ie(unsigned char *pie, int *rsn_ie_len, int limit);
-unsigned char *r8712_get_wpa2_ie(unsigned char *pie, int *rsn_ie_len, int limit);
+unsigned char *r8712_get_wpa2_ie(unsigned char *pie, int *rsn_ie_len,
+				 int limit);
 int r8712_parse_wpa_ie(u8 *wpa_ie, int wpa_ie_len, int *group_cipher,
-		       int *pairwise_cipher);
+			int *pairwise_cipher);
 int r8712_parse_wpa2_ie(u8 *wpa_ie, int wpa_ie_len, int *group_cipher,
-		        int *pairwise_cipher);
-int r8712_get_sec_ie(u8 *in_ie, uint in_len, u8 *rsn_ie, u16 *rsn_len, u8 *wpa_ie,
-	       u16 *wpa_len);
+			int *pairwise_cipher);
+int r8712_get_sec_ie(u8 *in_ie, uint in_len, u8 *rsn_ie, u16 *rsn_len,
+		     u8 *wpa_ie, u16 *wpa_len);
 int r8712_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen);
-int r8712_generate_ie(struct registry_priv *pregistrypriv, struct _adapter *padapter);
+int r8712_generate_ie(struct registry_priv *pregistrypriv,
+		      struct _adapter *padapter);
 uint r8712_is_cckrates_included(u8 *rate);
 uint r8712_is_cckratesonly_included(u8 *rate);
 
diff --git a/drivers/staging/rtl8712/if_ether.h b/drivers/staging/rtl8712/if_ether.h
index 36a2ba5..0e9753b 100644
--- a/drivers/staging/rtl8712/if_ether.h
+++ b/drivers/staging/rtl8712/if_ether.h
@@ -99,8 +99,8 @@
 };
 
 struct _vlan {
-   unsigned short       h_vlan_TCI;	/* Encapsulates priority and VLAN ID*/
-   unsigned short       h_vlan_encapsulated_proto;
+	unsigned short  h_vlan_TCI;	/* Encapsulates priority and VLAN ID*/
+	unsigned short  h_vlan_encapsulated_proto;
 };
 
 
diff --git a/drivers/staging/rtl8712/ip.h b/drivers/staging/rtl8712/ip.h
index 4785a59..f37b0f8 100644
--- a/drivers/staging/rtl8712/ip.h
+++ b/drivers/staging/rtl8712/ip.h
@@ -90,23 +90,23 @@
 #define	IPOPT_TS_PRESPEC	3		/* specified modules only */
 
 struct ip_options {
-  __u32		faddr;				/* Saved first hop address */
-  unsigned char	optlen;
-  unsigned char srr;
-  unsigned char rr;
-  unsigned char ts;
-  unsigned char is_setbyuser:1,	/* Set by setsockopt?			*/
-		is_data:1,	/* Options in __data, rather than skb	*/
-		is_strictroute:1, /* Strict source route		*/
-		srr_is_hit:1,	/* Packet destination addr was our one	*/
-		is_changed:1,	/* IP checksum more not valid		*/
-		rr_needaddr:1,	/* Need to record addr of outgoing dev	*/
-		ts_needtime:1,	/* Need to record timestamp		*/
-		ts_needaddr:1;	/* Need to record addr of outgoing dev  */
-  unsigned char router_alert;
-  unsigned char __pad1;
-  unsigned char __pad2;
-  unsigned char __data[0];
+	__u32		faddr;			/* Saved first hop address */
+	unsigned char	optlen;
+	unsigned char srr;
+	unsigned char rr;
+	unsigned char ts;
+	unsigned char is_setbyuser:1,	/* Set by setsockopt?		      */
+		      is_data:1,	/* Options in __data, rather than skb */
+		      is_strictroute:1, /* Strict source route		      */
+		      srr_is_hit:1,	/* Packet destination addr was our one*/
+		      is_changed:1,	/* IP checksum more not valid	      */
+		      rr_needaddr:1,	/* Need to record addr of outgoing dev*/
+		      ts_needtime:1,	/* Need to record timestamp	      */
+		      ts_needaddr:1;	/* Need to record addr of outgoing dev*/
+	unsigned char router_alert;
+	unsigned char __pad1;
+	unsigned char __pad2;
+	unsigned char __data[0];
 };
 
 #define optlength(opt) (sizeof(struct ip_options) + opt->optlen)
diff --git a/drivers/staging/rtl8712/mlme_osdep.h b/drivers/staging/rtl8712/mlme_osdep.h
index 7013a49..968e787 100644
--- a/drivers/staging/rtl8712/mlme_osdep.h
+++ b/drivers/staging/rtl8712/mlme_osdep.h
@@ -9,8 +9,8 @@
 void r8712_os_indicate_connect(struct _adapter *adapter);
 void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie);
 int r8712_recv_indicatepkts_in_order(struct _adapter *adapter,
-				     struct recv_reorder_ctrl *precvreorder_ctrl,
-				     int bforced);
+				struct recv_reorder_ctrl *precvreorder_ctrl,
+				int bforced);
 void r8712_indicate_wx_assoc_event(struct _adapter *padapter);
 void r8712_indicate_wx_disassoc_event(struct _adapter *padapter);
 
diff --git a/drivers/staging/rtl8712/osdep_service.h b/drivers/staging/rtl8712/osdep_service.h
index 36eeb5a..3d3f73c 100644
--- a/drivers/staging/rtl8712/osdep_service.h
+++ b/drivers/staging/rtl8712/osdep_service.h
@@ -145,7 +145,8 @@
 		return false;
 }
 
-static inline void list_insert_tail(struct list_head *plist, struct list_head *phead)
+static inline void list_insert_tail(struct list_head *plist,
+				    struct list_head *phead)
 {
 	list_add_tail(plist, phead);
 }
diff --git a/drivers/staging/rtl8712/recv_osdep.h b/drivers/staging/rtl8712/recv_osdep.h
index b23dd6b..60a54dd 100644
--- a/drivers/staging/rtl8712/recv_osdep.h
+++ b/drivers/staging/rtl8712/recv_osdep.h
@@ -12,7 +12,8 @@
 void r8712_recv_indicatepkt(struct _adapter *adapter,
 			    union recv_frame *precv_frame);
 void r8712_handle_tkip_mic_err(struct _adapter *padapter, u8 bgroup);
-int r8712_init_recv_priv(struct recv_priv *precvpriv, struct _adapter *padapter);
+int r8712_init_recv_priv(struct recv_priv *precvpriv,
+			 struct _adapter *padapter);
 void r8712_free_recv_priv(struct recv_priv *precvpriv);
 int r8712_os_recv_resource_alloc(struct _adapter *padapter,
 				 union recv_frame *precvframe);
@@ -24,4 +25,3 @@
 void r8712_init_recv_timer(struct recv_reorder_ctrl *preorder_ctrl);
 
 #endif
-
diff --git a/drivers/staging/rtl8712/rtl8712_event.h b/drivers/staging/rtl8712/rtl8712_event.h
index 48408f7..2731693 100644
--- a/drivers/staging/rtl8712/rtl8712_event.h
+++ b/drivers/staging/rtl8712/rtl8712_event.h
@@ -5,33 +5,33 @@
 void r8712_got_addbareq_event_callback(struct _adapter *adapter , u8 *pbuf);
 
 enum rtl8712_c2h_event {
-	GEN_EVT_CODE(_Read_MACREG) = 0, /*0*/
+	GEN_EVT_CODE(_Read_MACREG) = 0,		/*0*/
 	GEN_EVT_CODE(_Read_BBREG),
 	GEN_EVT_CODE(_Read_RFREG),
 	GEN_EVT_CODE(_Read_EEPROM),
 	GEN_EVT_CODE(_Read_EFUSE),
-	GEN_EVT_CODE(_Read_CAM),			/*5*/
+	GEN_EVT_CODE(_Read_CAM),		/*5*/
 	GEN_EVT_CODE(_Get_BasicRate),
 	GEN_EVT_CODE(_Get_DataRate),
-	GEN_EVT_CODE(_Survey),	 /*8*/
-	GEN_EVT_CODE(_SurveyDone),	 /*9*/
+	GEN_EVT_CODE(_Survey),			/*8*/
+	GEN_EVT_CODE(_SurveyDone),		/*9*/
 
-	GEN_EVT_CODE(_JoinBss) , /*10*/
+	GEN_EVT_CODE(_JoinBss),			/*10*/
 	GEN_EVT_CODE(_AddSTA),
 	GEN_EVT_CODE(_DelSTA),
-	GEN_EVT_CODE(_AtimDone) ,
+	GEN_EVT_CODE(_AtimDone),
 	GEN_EVT_CODE(_TX_Report),
-	GEN_EVT_CODE(_CCX_Report),			/*15*/
+	GEN_EVT_CODE(_CCX_Report),		/*15*/
 	GEN_EVT_CODE(_DTM_Report),
 	GEN_EVT_CODE(_TX_Rate_Statistics),
 	GEN_EVT_CODE(_C2HLBK),
 	GEN_EVT_CODE(_FWDBG),
-	GEN_EVT_CODE(_C2HFEEDBACK),               /*20*/
+	GEN_EVT_CODE(_C2HFEEDBACK),		/*20*/
 	GEN_EVT_CODE(_ADDBA),
 	GEN_EVT_CODE(_C2HBCN),
 	GEN_EVT_CODE(_ReportPwrState),		/*filen: only for PCIE, USB*/
 	GEN_EVT_CODE(_WPS_PBC),			/*24*/
-	GEN_EVT_CODE(_ADDBAReq_Report),	/*25*/
+	GEN_EVT_CODE(_ADDBAReq_Report),		/*25*/
 	MAX_C2HEVT
 };
 
@@ -48,7 +48,8 @@
 	{0, NULL},
 	{0, NULL},
 	{0, &r8712_survey_event_callback},		/*8*/
-	{sizeof(struct surveydone_event), &r8712_surveydone_event_callback},/*9*/
+	{sizeof(struct surveydone_event),
+		&r8712_surveydone_event_callback},	/*9*/
 
 	{0, &r8712_joinbss_event_callback},		/*10*/
 	{sizeof(struct stassoc_event), &r8712_stassoc_event_callback},
@@ -59,8 +60,8 @@
 	{0, NULL},
 	{0, NULL},
 	{0, NULL},
-	{0, NULL}, /*fwdbg_event_callback},*/
-	{0, NULL},	 /*20*/
+	{0, NULL},	/*fwdbg_event_callback},*/
+	{0, NULL},	/*20*/
 	{0, NULL},
 	{0, NULL},
 	{0, &r8712_cpwm_event_callback},
diff --git a/drivers/staging/rtl8712/rtl8712_hal.h b/drivers/staging/rtl8712/rtl8712_hal.h
index 13df200..66baa87c 100644
--- a/drivers/staging/rtl8712/rtl8712_hal.h
+++ b/drivers/staging/rtl8712/rtl8712_hal.h
@@ -21,13 +21,13 @@
 	RTL8712_USB,
 };
 
-enum RTL8712_RF_CONFIG{
+enum RTL8712_RF_CONFIG {
 	RTL8712_RF_1T1R,
 	RTL8712_RF_1T2R,
 	RTL8712_RF_2T2R
 };
 
-enum _RTL8712_HCI_TYPE_{
+enum _RTL8712_HCI_TYPE_ {
 	RTL8712_HCI_TYPE_PCIE = 0x01,
 	RTL8712_HCI_TYPE_AP_PCIE = 0x81,
 	RTL8712_HCI_TYPE_USB = 0x02,
@@ -40,62 +40,62 @@
 
 struct fw_priv {   /*8-bytes alignment required*/
 	/*--- long word 0 ----*/
- unsigned char  signature_0;  /*0x12: CE product, 0x92: IT product*/
- unsigned char  signature_1;  /*0x87: CE product, 0x81: IT product*/
- unsigned char  hci_sel;   /*0x81: PCI-AP, 01:PCIe, 02: 92S-U, 0x82: USB-AP,
+	unsigned char signature_0;  /*0x12: CE product, 0x92: IT product*/
+	unsigned char signature_1;  /*0x87: CE product, 0x81: IT product*/
+	unsigned char hci_sel; /*0x81: PCI-AP, 01:PCIe, 02: 92S-U, 0x82: USB-AP,
 			    * 0x12: 72S-U, 03:SDIO*/
- unsigned char  chip_version; /*the same value as register value*/
- unsigned char  customer_ID_0; /*customer  ID low byte*/
- unsigned char  customer_ID_1; /*customer  ID high byte*/
- unsigned char  rf_config;  /*0x11:  1T1R, 0x12: 1T2R, 0x92: 1T2R turbo,
+	unsigned char chip_version; /*the same value as register value*/
+	unsigned char customer_ID_0; /*customer  ID low byte*/
+	unsigned char customer_ID_1; /*customer  ID high byte*/
+	unsigned char rf_config;  /*0x11:  1T1R, 0x12: 1T2R, 0x92: 1T2R turbo,
 			     * 0x22: 2T2R*/
- unsigned char  usb_ep_num;  /* 4: 4EP, 6: 6EP, 11: 11EP*/
+	unsigned char usb_ep_num;  /* 4: 4EP, 6: 6EP, 11: 11EP*/
 	/*--- long word 1 ----*/
- unsigned char  regulatory_class_0; /*regulatory class bit map 0*/
- unsigned char  regulatory_class_1; /*regulatory class bit map 1*/
- unsigned char  regulatory_class_2; /*regulatory class bit map 2*/
- unsigned char  regulatory_class_3; /*regulatory class bit map 3*/
- unsigned char  rfintfs;    /* 0:SWSI, 1:HWSI, 2:HWPI*/
- unsigned char  def_nettype;
- unsigned char  turboMode;
- unsigned char  lowPowerMode;/* 0: noral mode, 1: low power mode*/
+	unsigned char regulatory_class_0; /*regulatory class bit map 0*/
+	unsigned char regulatory_class_1; /*regulatory class bit map 1*/
+	unsigned char regulatory_class_2; /*regulatory class bit map 2*/
+	unsigned char regulatory_class_3; /*regulatory class bit map 3*/
+	unsigned char rfintfs;    /* 0:SWSI, 1:HWSI, 2:HWPI*/
+	unsigned char def_nettype;
+	unsigned char turboMode;
+	unsigned char lowPowerMode;/* 0: noral mode, 1: low power mode*/
 	/*--- long word 2 ----*/
- unsigned char  lbk_mode; /*0x00: normal, 0x03: MACLBK, 0x01: PHYLBK*/
- unsigned char  mp_mode; /* 1: for MP use, 0: for normal driver */
- unsigned char  vcsType; /* 0:off 1:on 2:auto */
- unsigned char  vcsMode; /* 1:RTS/CTS 2:CTS to self */
- unsigned char  rsvd022;
- unsigned char  rsvd023;
- unsigned char  rsvd024;
- unsigned char  rsvd025;
+	unsigned char lbk_mode; /*0x00: normal, 0x03: MACLBK, 0x01: PHYLBK*/
+	unsigned char mp_mode; /* 1: for MP use, 0: for normal driver */
+	unsigned char vcsType; /* 0:off 1:on 2:auto */
+	unsigned char vcsMode; /* 1:RTS/CTS 2:CTS to self */
+	unsigned char rsvd022;
+	unsigned char rsvd023;
+	unsigned char rsvd024;
+	unsigned char rsvd025;
 	/*--- long word 3 ----*/
- unsigned char  qos_en;    /*1: QoS enable*/
- unsigned char  bw_40MHz_en;   /*1: 40MHz BW enable*/
- unsigned char  AMSDU2AMPDU_en;   /*1: 4181 convert AMSDU to AMPDU,
+	unsigned char qos_en;    /*1: QoS enable*/
+	unsigned char bw_40MHz_en;   /*1: 40MHz BW enable*/
+	unsigned char AMSDU2AMPDU_en;   /*1: 4181 convert AMSDU to AMPDU,
 				   * 0: disable*/
- unsigned char  AMPDU_en;   /*1: 11n AMPDU enable*/
- unsigned char  rate_control_offload;  /*1: FW offloads, 0: driver handles*/
- unsigned char  aggregation_offload;  /*1: FW offloads, 0: driver handles*/
- unsigned char  rsvd030;
- unsigned char  rsvd031;
+	unsigned char AMPDU_en;   /*1: 11n AMPDU enable*/
+	unsigned char rate_control_offload; /*1: FW offloads,0: driver handles*/
+	unsigned char aggregation_offload;  /*1: FW offloads,0: driver handles*/
+	unsigned char rsvd030;
+	unsigned char rsvd031;
 	/*--- long word 4 ----*/
- unsigned char  beacon_offload;   /* 1. FW offloads, 0: driver handles*/
- unsigned char  MLME_offload;   /* 2. FW offloads, 0: driver handles*/
- unsigned char  hwpc_offload;   /* 3. FW offloads, 0: driver handles*/
- unsigned char  tcp_checksum_offload; /* 4. FW offloads, 0: driver handles*/
- unsigned char  tcp_offload;    /* 5. FW offloads, 0: driver handles*/
- unsigned char  ps_control_offload;  /* 6. FW offloads, 0: driver handles*/
- unsigned char  WWLAN_offload;   /* 7. FW offloads, 0: driver handles*/
- unsigned char  rsvd040;
+	unsigned char beacon_offload;   /* 1. FW offloads, 0: driver handles*/
+	unsigned char MLME_offload;   /* 2. FW offloads, 0: driver handles*/
+	unsigned char hwpc_offload;   /* 3. FW offloads, 0: driver handles*/
+	unsigned char tcp_checksum_offload; /*4. FW offloads,0: driver handles*/
+	unsigned char tcp_offload;    /* 5. FW offloads, 0: driver handles*/
+	unsigned char ps_control_offload; /* 6. FW offloads, 0: driver handles*/
+	unsigned char WWLAN_offload;   /* 7. FW offloads, 0: driver handles*/
+	unsigned char rsvd040;
 	/*--- long word 5 ----*/
- unsigned char  tcp_tx_frame_len_L;  /*tcp tx packet length low byte*/
- unsigned char  tcp_tx_frame_len_H;  /*tcp tx packet length high byte*/
- unsigned char  tcp_rx_frame_len_L;  /*tcp rx packet length low byte*/
- unsigned char  tcp_rx_frame_len_H;  /*tcp rx packet length high byte*/
- unsigned char  rsvd050;
- unsigned char  rsvd051;
- unsigned char  rsvd052;
- unsigned char  rsvd053;
+	unsigned char tcp_tx_frame_len_L;  /*tcp tx packet length low byte*/
+	unsigned char tcp_tx_frame_len_H;  /*tcp tx packet length high byte*/
+	unsigned char tcp_rx_frame_len_L;  /*tcp rx packet length low byte*/
+	unsigned char tcp_rx_frame_len_H;  /*tcp rx packet length high byte*/
+	unsigned char rsvd050;
+	unsigned char rsvd051;
+	unsigned char rsvd052;
+	unsigned char rsvd053;
 };
 
 struct fw_hdr {/*8-byte alinment required*/
diff --git a/drivers/staging/rtl8712/rtl8712_led.c b/drivers/staging/rtl8712/rtl8712_led.c
index 5024ee4..cb1751e 100644
--- a/drivers/staging/rtl8712/rtl8712_led.c
+++ b/drivers/staging/rtl8712/rtl8712_led.c
@@ -49,7 +49,7 @@
  * LED object.
  *===========================================================================
  */
-enum _LED_STATE_871x{
+enum _LED_STATE_871x {
 	LED_UNKNOWN = 0,
 	LED_ON = 1,
 	LED_OFF = 2,
diff --git a/drivers/staging/rtl8712/rtl8712_recv.h b/drivers/staging/rtl8712/rtl8712_recv.h
index 4ba52b9..c48757f 100644
--- a/drivers/staging/rtl8712/rtl8712_recv.h
+++ b/drivers/staging/rtl8712/rtl8712_recv.h
@@ -93,7 +93,7 @@
 	end   ----->
 	len = (unsigned int )(tail - data);
 */
-struct recv_frame_hdr{
+struct recv_frame_hdr {
 	struct list_head list;
 	_pkt	*pkt;
 	_pkt *pkt_newalloc;
diff --git a/drivers/staging/rtl8712/rtl8712_xmit.h b/drivers/staging/rtl8712/rtl8712_xmit.h
index 5d77c51..12a080f 100644
--- a/drivers/staging/rtl8712/rtl8712_xmit.h
+++ b/drivers/staging/rtl8712/rtl8712_xmit.h
@@ -59,25 +59,16 @@
 /*OFFSET 20*/
 #define DISFB BIT(15)
 
-struct tx_desc{
-
+struct tx_desc {
 	/*DWORD 0*/
 	unsigned int txdw0;
-
 	unsigned int txdw1;
-
 	unsigned int txdw2;
-
 	unsigned int txdw3;
-
 	unsigned int txdw4;
-
 	unsigned int txdw5;
-
 	unsigned int txdw6;
-
 	unsigned int txdw7;
-
 };
 
 
diff --git a/drivers/staging/rtl8712/rtl871x_cmd.c b/drivers/staging/rtl8712/rtl871x_cmd.c
index fbb2e4e..ba92762db 100644
--- a/drivers/staging/rtl8712/rtl871x_cmd.c
+++ b/drivers/staging/rtl8712/rtl871x_cmd.c
@@ -431,8 +431,7 @@
 	}
 	psecnetwork = (struct ndis_wlan_bssid_ex *)&psecuritypriv->sec_bss;
 	if (psecnetwork == NULL) {
-		if (pcmd != NULL)
-			kfree((unsigned char *)pcmd);
+		kfree(pcmd);
 		return _FAIL;
 	}
 	memset(psecnetwork, 0, t_len);
@@ -478,8 +477,8 @@
 		 * to avoid some IOT issues, especially for Realtek 8192u
 		 * SoftAP.
 		 */
-		if ((padapter->securitypriv.PrivacyAlgrthm != _WEP40_ ) &&
-		    (padapter->securitypriv.PrivacyAlgrthm != _WEP104_ )) {
+		if ((padapter->securitypriv.PrivacyAlgrthm != _WEP40_) &&
+		    (padapter->securitypriv.PrivacyAlgrthm != _WEP104_)) {
 			/* restructure_ht_ie */
 			r8712_restructure_ht_ie(padapter,
 						&pnetwork->network.IEs[0],
diff --git a/drivers/staging/rtl8712/rtl871x_cmd.h b/drivers/staging/rtl8712/rtl871x_cmd.h
index 2dc7847..dcf256d 100644
--- a/drivers/staging/rtl8712/rtl871x_cmd.h
+++ b/drivers/staging/rtl8712/rtl871x_cmd.h
@@ -562,54 +562,54 @@
 };
 
 /*to get TX,RX retry count*/
-struct gettxretrycnt_parm{
+struct gettxretrycnt_parm {
 	unsigned int rsvd;
 };
 
-struct gettxretrycnt_rsp{
+struct gettxretrycnt_rsp {
 	unsigned long tx_retrycnt;
 };
 
-struct getrxretrycnt_parm{
+struct getrxretrycnt_parm {
 	unsigned int rsvd;
 };
 
-struct getrxretrycnt_rsp{
+struct getrxretrycnt_rsp {
 	unsigned long rx_retrycnt;
 };
 
 /*to get BCNOK,BCNERR count*/
-struct getbcnokcnt_parm{
+struct getbcnokcnt_parm {
 	unsigned int rsvd;
 };
 
-struct getbcnokcnt_rsp{
-	unsigned long  bcnokcnt;
+struct getbcnokcnt_rsp {
+	unsigned long bcnokcnt;
 };
 
-struct getbcnerrcnt_parm{
+struct getbcnerrcnt_parm {
 	unsigned int rsvd;
 };
-struct getbcnerrcnt_rsp{
+struct getbcnerrcnt_rsp {
 	unsigned long bcnerrcnt;
 };
 
 /* to get current TX power level*/
-struct getcurtxpwrlevel_parm{
+struct getcurtxpwrlevel_parm {
 	unsigned int rsvd;
 };
 
-struct getcurtxpwrlevel_rsp{
+struct getcurtxpwrlevel_rsp {
 	unsigned short tx_power;
 };
 
 /*dynamic on/off DIG*/
-struct setdig_parm{
+struct setdig_parm {
 	unsigned char dig_on;	/* 1:on , 0:off */
 };
 
 /*dynamic on/off RA*/
-struct setra_parm{
+struct setra_parm {
 	unsigned char ra_on;	/* 1:on , 0:off */
 };
 
diff --git a/drivers/staging/rtl8712/rtl871x_event.h b/drivers/staging/rtl8712/rtl871x_event.h
index d452293..6ce0676 100644
--- a/drivers/staging/rtl8712/rtl871x_event.h
+++ b/drivers/staging/rtl8712/rtl871x_event.h
@@ -45,8 +45,8 @@
 };
 
 struct stadel_event {
- unsigned char macaddr[6];
- unsigned char rsvd[2];
+	unsigned char macaddr[6];
+	unsigned char rsvd[2];
 };
 
 struct addba_event {
@@ -61,7 +61,7 @@
 };
 
 #define C2HEVENT_SZ			32
-struct event_node{
+struct event_node {
 	unsigned char *node;
 	unsigned char evt_code;
 	unsigned short evt_sz;
@@ -85,9 +85,9 @@
 };
 
 struct ADDBA_Req_Report_parm {
- unsigned char MacAddress[ETH_ALEN];
- unsigned short StartSeqNum;
- unsigned char tid;
+	unsigned char MacAddress[ETH_ALEN];
+	unsigned short StartSeqNum;
+	unsigned char tid;
 };
 #include "rtl8712_event.h"
 
diff --git a/drivers/staging/rtl8712/rtl871x_io.c b/drivers/staging/rtl8712/rtl871x_io.c
index e6e3c37..ca84ee0 100644
--- a/drivers/staging/rtl8712/rtl871x_io.c
+++ b/drivers/staging/rtl8712/rtl871x_io.c
@@ -73,8 +73,7 @@
 		goto _init_intf_hdl_fail;
 	return _SUCCESS;
 _init_intf_hdl_fail:
-	if (pintf_priv)
-		kfree((u8 *)pintf_priv);
+	kfree(pintf_priv);
 	return _FAIL;
 }
 
@@ -84,8 +83,7 @@
 
 	unload_intf_priv = &r8712_usb_unload_intf_priv;
 	unload_intf_priv(pintfpriv);
-	if (pintfpriv)
-		kfree((u8 *)pintfpriv);
+	kfree(pintfpriv);
 }
 
 static uint register_intf_hdl(u8 *dev, struct intf_hdl *pintfhdl)
diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
index bd315c7..40e6b5c 100644
--- a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
+++ b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
@@ -291,7 +291,8 @@
 			memset(buf, 0, MAX_WPA_IE_LEN);
 			n = sprintf(buf, "wpa_ie=");
 			for (i = 0; i < wpa_len; i++) {
-				n += snprintf(buf + n, MAX_WPA_IE_LEN - n, "%02x", wpa_ie[i]);
+				n += snprintf(buf + n, MAX_WPA_IE_LEN - n,
+							"%02x", wpa_ie[i]);
 				if (n >= MAX_WPA_IE_LEN)
 					break;
 			}
@@ -310,7 +311,8 @@
 			memset(buf, 0, MAX_WPA_IE_LEN);
 			n = sprintf(buf, "rsn_ie=");
 			for (i = 0; i < rsn_len; i++) {
-				n += snprintf(buf + n, MAX_WPA_IE_LEN - n, "%02x", rsn_ie[i]);
+				n += snprintf(buf + n, MAX_WPA_IE_LEN - n,
+							"%02x", rsn_ie[i]);
 				if (n >= MAX_WPA_IE_LEN)
 					break;
 			}
@@ -1732,8 +1734,7 @@
 		memcpy(param + 1, pext + 1, pext->key_len);
 	}
 	ret = wpa_set_encryption(dev, param, param_len);
-	if (param)
-		kfree((u8 *)param);
+	kfree(param);
 	return ret;
 }
 
diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_rtl.c b/drivers/staging/rtl8712/rtl871x_ioctl_rtl.c
index 7adbe82..9a33eae 100644
--- a/drivers/staging/rtl8712/rtl871x_ioctl_rtl.c
+++ b/drivers/staging/rtl8712/rtl871x_ioctl_rtl.c
@@ -493,7 +493,7 @@
 	return status;
 }
 
-enum _CONNECT_STATE_{
+enum _CONNECT_STATE_ {
 	CHECKINGSTATUS,
 	ASSOCIATED,
 	ADHOCMODE,
diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_set.h b/drivers/staging/rtl8712/rtl871x_ioctl_set.h
index 283afbf..8dff2b1 100644
--- a/drivers/staging/rtl8712/rtl871x_ioctl_set.h
+++ b/drivers/staging/rtl8712/rtl871x_ioctl_set.h
@@ -6,19 +6,27 @@
 typedef u8 NDIS_802_11_PMKID_VALUE[16];
 
 struct BSSIDInfo {
-	unsigned char  BSSID[6];
-	NDIS_802_11_PMKID_VALUE  PMKID;
+	unsigned char BSSID[6];
+	NDIS_802_11_PMKID_VALUE PMKID;
 };
 
 u8 r8712_set_802_11_authentication_mode(struct _adapter *pdapter,
 			enum NDIS_802_11_AUTHENTICATION_MODE authmode);
+
 u8 r8712_set_802_11_bssid(struct _adapter *padapter, u8 *bssid);
-u8 r8712_set_802_11_add_wep(struct _adapter *padapter, struct NDIS_802_11_WEP *wep);
+
+u8 r8712_set_802_11_add_wep(struct _adapter *padapter,
+			    struct NDIS_802_11_WEP *wep);
+
 u8 r8712_set_802_11_disassociate(struct _adapter *padapter);
+
 u8 r8712_set_802_11_bssid_list_scan(struct _adapter *padapter);
+
 u8 r8712_set_802_11_infrastructure_mode(struct _adapter *padapter,
 			enum NDIS_802_11_NETWORK_INFRASTRUCTURE networktype);
-void r8712_set_802_11_ssid(struct _adapter *padapter, struct ndis_802_11_ssid *ssid);
+
+void r8712_set_802_11_ssid(struct _adapter *padapter,
+			   struct ndis_802_11_ssid *ssid);
 
 #endif
 
diff --git a/drivers/staging/rtl8712/rtl871x_mp.c b/drivers/staging/rtl8712/rtl871x_mp.c
index 427467c..41e00a2 100644
--- a/drivers/staging/rtl8712/rtl871x_mp.c
+++ b/drivers/staging/rtl8712/rtl871x_mp.c
@@ -217,7 +217,10 @@
 	return new_value;
 }
 
-static u8 set_bb_reg(struct _adapter *pAdapter, u16 offset, u32 bitmask, u32 value)
+static u8 set_bb_reg(struct _adapter *pAdapter,
+		     u16 offset,
+		     u32 bitmask,
+		     u32 value)
 {
 	u32 org_value, bit_shift, new_value;
 
@@ -274,8 +277,7 @@
 	pparm = (struct SetChannel_parm *)_malloc(sizeof(struct
 					 SetChannel_parm));
 	if (pparm == NULL) {
-		if (pcmd != NULL)
-			kfree((u8 *)pcmd);
+		kfree(pcmd);
 		return;
 	}
 	pparm->curr_ch = pAdapter->mppriv.curr_ch;
diff --git a/drivers/staging/rtl8712/rtl871x_mp_ioctl.h b/drivers/staging/rtl8712/rtl871x_mp_ioctl.h
index fdd2278..67759c3 100644
--- a/drivers/staging/rtl8712/rtl871x_mp_ioctl.h
+++ b/drivers/staging/rtl8712/rtl871x_mp_ioctl.h
@@ -281,23 +281,23 @@
 	MP_ERR_MODE
 };
 
-struct rwreg_param{
+struct rwreg_param {
 	unsigned int offset;
 	unsigned int width;
 	unsigned int value;
 };
 
-struct bbreg_param{
+struct bbreg_param {
 	unsigned int offset;
 	unsigned int phymask;
 	unsigned int value;
 };
 
-struct txpower_param{
+struct txpower_param {
 	unsigned int pwr_index;
 };
 
-struct datarate_param{
+struct datarate_param {
 	unsigned int rate_index;
 };
 
@@ -321,7 +321,7 @@
 	unsigned int oid;
 };
 
-struct mp_ioctl_param{
+struct mp_ioctl_param {
 	unsigned int subcode;
 	unsigned int len;
 	unsigned char data[0];
diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c
index a3165e6..aec83dd 100644
--- a/drivers/staging/rtl8712/rtl871x_recv.c
+++ b/drivers/staging/rtl8712/rtl871x_recv.c
@@ -307,9 +307,9 @@
 	return _SUCCESS;
 }
 
-static sint sta2sta_data_frame(struct _adapter *adapter, union recv_frame *precv_frame,
-			struct sta_info **psta
-)
+static sint sta2sta_data_frame(struct _adapter *adapter,
+			       union recv_frame *precv_frame,
+			       struct sta_info **psta)
 {
 	u8 *ptr = precv_frame->u.hdr.rx_data;
 	sint ret = _SUCCESS;
@@ -373,8 +373,9 @@
 	return ret;
 }
 
-static sint ap2sta_data_frame(struct _adapter *adapter, union recv_frame *precv_frame,
-		       struct sta_info **psta)
+static sint ap2sta_data_frame(struct _adapter *adapter,
+			      union recv_frame *precv_frame,
+			      struct sta_info **psta)
 {
 	u8 *ptr = precv_frame->u.hdr.rx_data;
 	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
@@ -431,8 +432,9 @@
 	return _SUCCESS;
 }
 
-static sint sta2ap_data_frame(struct _adapter *adapter, union recv_frame *precv_frame,
-		       struct sta_info **psta)
+static sint sta2ap_data_frame(struct _adapter *adapter,
+			      union recv_frame *precv_frame,
+			      struct sta_info **psta)
 {
 	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
 	struct	sta_priv *pstapriv = &adapter->stapriv;
diff --git a/drivers/staging/rtl8712/rtl871x_recv.h b/drivers/staging/rtl8712/rtl871x_recv.h
index bf8115d..cc7a72f 100644
--- a/drivers/staging/rtl8712/rtl871x_recv.h
+++ b/drivers/staging/rtl8712/rtl871x_recv.h
@@ -19,9 +19,9 @@
 /* for Rx reordering buffer control */
 struct recv_reorder_ctrl {
 	struct _adapter	*padapter;
-	u16 indicate_seq;/* =wstart_b, init_value=0xffff */
+	u16 indicate_seq; /* =wstart_b, init_value=0xffff */
 	u16 wend_b;
-       u8 wsize_b;
+	u8 wsize_b;
 	struct  __queue pending_recvframe_queue;
 	struct timer_list reordering_ctrl_timer;
 };
diff --git a/drivers/staging/rtl8712/rtl871x_rf.h b/drivers/staging/rtl8712/rtl871x_rf.h
index c709d8c..6c54966 100644
--- a/drivers/staging/rtl8712/rtl871x_rf.h
+++ b/drivers/staging/rtl8712/rtl871x_rf.h
@@ -22,7 +22,7 @@
 	u8	modem;
 };
 
-enum	_REG_PREAMBLE_MODE{
+enum	_REG_PREAMBLE_MODE {
 	PREAMBLE_LONG	= 1,
 	PREAMBLE_AUTO	= 2,
 	PREAMBLE_SHORT	= 3,
diff --git a/drivers/staging/rtl8712/rtl871x_security.h b/drivers/staging/rtl8712/rtl871x_security.h
index 782b70a..bff71d2 100644
--- a/drivers/staging/rtl8712/rtl871x_security.h
+++ b/drivers/staging/rtl8712/rtl871x_security.h
@@ -21,30 +21,31 @@
 #ifndef Ndis802_11AuthModeWPA2PSK
 #define Ndis802_11AuthModeWPA2PSK (Ndis802_11AuthModeWPANone + 2)
 #endif
+
 union pn48 {
 	u64 val;
 #if defined(__BIG_ENDIAN)
-struct {
-  u8 TSC7;
-  u8 TSC6;
-  u8 TSC5;
-  u8 TSC4;
-  u8 TSC3;
-  u8 TSC2;
-  u8 TSC1;
-  u8 TSC0;
-} _byte_;
+	struct {
+		u8 TSC7;
+		u8 TSC6;
+		u8 TSC5;
+		u8 TSC4;
+		u8 TSC3;
+		u8 TSC2;
+		u8 TSC1;
+		u8 TSC0;
+	} _byte_;
 #else
-struct {
-  u8 TSC0;
-  u8 TSC1;
-  u8 TSC2;
-  u8 TSC3;
-  u8 TSC4;
-  u8 TSC5;
-  u8 TSC6;
-  u8 TSC7;
-} _byte_;
+	struct {
+		u8 TSC0;
+		u8 TSC1;
+		u8 TSC2;
+		u8 TSC3;
+		u8 TSC4;
+		u8 TSC5;
+		u8 TSC6;
+		u8 TSC7;
+	} _byte_;
 #endif
 };
 
@@ -174,11 +175,11 @@
 };
 
 void seccalctkipmic(
-	u8 *key,
-	u8 *header,
-	u8 *data,
-	u32 data_len,
-	u8 *Miccode,
+	u8  *key,
+	u8  *header,
+	u8  *data,
+	u32  data_len,
+	u8  *Miccode,
 	u8   priority);
 
 void r8712_secmicsetkey(struct mic_data *pmicdata, u8 * key);
diff --git a/drivers/staging/rtl8712/rtl871x_xmit.c b/drivers/staging/rtl8712/rtl871x_xmit.c
index 75f1a6bb..ccf0891 100644
--- a/drivers/staging/rtl8712/rtl871x_xmit.c
+++ b/drivers/staging/rtl8712/rtl871x_xmit.c
@@ -996,8 +996,7 @@
 {
 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
 
-	if (pxmitpriv->hwxmits)
-		kfree((u8 *)pxmitpriv->hwxmits);
+	kfree(pxmitpriv->hwxmits);
 }
 
 static void init_hwxmits(struct hw_xmit *phwxmit, sint entry)
diff --git a/drivers/staging/rtl8712/rtl871x_xmit.h b/drivers/staging/rtl8712/rtl871x_xmit.h
index d518ce8..df13e67 100644
--- a/drivers/staging/rtl8712/rtl871x_xmit.h
+++ b/drivers/staging/rtl8712/rtl871x_xmit.h
@@ -244,7 +244,8 @@
 			 struct pkt_attrib *pattrib);
 int r8712_txframes_sta_ac_pending(struct _adapter *padapter,
 				  struct pkt_attrib *pattrib);
-sint _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv, struct _adapter *padapter);
+sint _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv,
+			   struct _adapter *padapter);
 void _free_xmit_priv(struct xmit_priv *pxmitpriv);
 void r8712_free_xmitframe_ex(struct xmit_priv *pxmitpriv,
 			     struct xmit_frame *pxmitframe);
diff --git a/drivers/staging/rtl8712/wifi.h b/drivers/staging/rtl8712/wifi.h
index 86d4b98..6032cdc 100644
--- a/drivers/staging/rtl8712/wifi.h
+++ b/drivers/staging/rtl8712/wifi.h
@@ -39,38 +39,35 @@
 };
 
 enum WIFI_FRAME_SUBTYPE {
-
-    /* below is for mgt frame */
-    WIFI_ASSOCREQ       = (0 | WIFI_MGT_TYPE),
-    WIFI_ASSOCRSP       = (BIT(4) | WIFI_MGT_TYPE),
-    WIFI_REASSOCREQ     = (BIT(5) | WIFI_MGT_TYPE),
-    WIFI_REASSOCRSP     = (BIT(5) | BIT(4) | WIFI_MGT_TYPE),
-    WIFI_PROBEREQ       = (BIT(6) | WIFI_MGT_TYPE),
-    WIFI_PROBERSP       = (BIT(6) | BIT(4) | WIFI_MGT_TYPE),
-    WIFI_BEACON         = (BIT(7) | WIFI_MGT_TYPE),
-    WIFI_ATIM           = (BIT(7) | BIT(4) | WIFI_MGT_TYPE),
-    WIFI_DISASSOC       = (BIT(7) | BIT(5) | WIFI_MGT_TYPE),
-    WIFI_AUTH           = (BIT(7) | BIT(5) | BIT(4) | WIFI_MGT_TYPE),
-    WIFI_DEAUTH         = (BIT(7) | BIT(6) | WIFI_MGT_TYPE),
-    WIFI_ACTION         = (BIT(7) | BIT(6) | BIT(4) | WIFI_MGT_TYPE),
-
-    /* below is for control frame */
-    WIFI_PSPOLL         = (BIT(7) | BIT(5) | WIFI_CTRL_TYPE),
-    WIFI_RTS            = (BIT(7) | BIT(5) | BIT(4) | WIFI_CTRL_TYPE),
-    WIFI_CTS            = (BIT(7) | BIT(6) | WIFI_CTRL_TYPE),
-    WIFI_ACK            = (BIT(7) | BIT(6) | BIT(4) | WIFI_CTRL_TYPE),
-    WIFI_CFEND          = (BIT(7) | BIT(6) | BIT(5) | WIFI_CTRL_TYPE),
-    WIFI_CFEND_CFACK    = (BIT(7) | BIT(6) | BIT(5) | BIT(4) | WIFI_CTRL_TYPE),
-
-    /* below is for data frame */
-    WIFI_DATA           = (0 | WIFI_DATA_TYPE),
-    WIFI_DATA_CFACK     = (BIT(4) | WIFI_DATA_TYPE),
-    WIFI_DATA_CFPOLL    = (BIT(5) | WIFI_DATA_TYPE),
-    WIFI_DATA_CFACKPOLL = (BIT(5) | BIT(4) | WIFI_DATA_TYPE),
-    WIFI_DATA_NULL      = (BIT(6) | WIFI_DATA_TYPE),
-    WIFI_CF_ACK         = (BIT(6) | BIT(4) | WIFI_DATA_TYPE),
-    WIFI_CF_POLL        = (BIT(6) | BIT(5) | WIFI_DATA_TYPE),
-    WIFI_CF_ACKPOLL     = (BIT(6) | BIT(5) | BIT(4) | WIFI_DATA_TYPE),
+	/* below is for mgt frame */
+	WIFI_ASSOCREQ       = (0 | WIFI_MGT_TYPE),
+	WIFI_ASSOCRSP       = (BIT(4) | WIFI_MGT_TYPE),
+	WIFI_REASSOCREQ     = (BIT(5) | WIFI_MGT_TYPE),
+	WIFI_REASSOCRSP     = (BIT(5) | BIT(4) | WIFI_MGT_TYPE),
+	WIFI_PROBEREQ       = (BIT(6) | WIFI_MGT_TYPE),
+	WIFI_PROBERSP       = (BIT(6) | BIT(4) | WIFI_MGT_TYPE),
+	WIFI_BEACON         = (BIT(7) | WIFI_MGT_TYPE),
+	WIFI_ATIM           = (BIT(7) | BIT(4) | WIFI_MGT_TYPE),
+	WIFI_DISASSOC       = (BIT(7) | BIT(5) | WIFI_MGT_TYPE),
+	WIFI_AUTH           = (BIT(7) | BIT(5) | BIT(4) | WIFI_MGT_TYPE),
+	WIFI_DEAUTH         = (BIT(7) | BIT(6) | WIFI_MGT_TYPE),
+	WIFI_ACTION         = (BIT(7) | BIT(6) | BIT(4) | WIFI_MGT_TYPE),
+	/* below is for control frame */
+	WIFI_PSPOLL         = (BIT(7) | BIT(5) | WIFI_CTRL_TYPE),
+	WIFI_RTS            = (BIT(7) | BIT(5) | BIT(4) | WIFI_CTRL_TYPE),
+	WIFI_CTS            = (BIT(7) | BIT(6) | WIFI_CTRL_TYPE),
+	WIFI_ACK            = (BIT(7) | BIT(6) | BIT(4) | WIFI_CTRL_TYPE),
+	WIFI_CFEND          = (BIT(7) | BIT(6) | BIT(5) | WIFI_CTRL_TYPE),
+	WIFI_CFEND_CFACK = (BIT(7) | BIT(6) | BIT(5) | BIT(4) | WIFI_CTRL_TYPE),
+	/* below is for data frame */
+	WIFI_DATA           = (0 | WIFI_DATA_TYPE),
+	WIFI_DATA_CFACK     = (BIT(4) | WIFI_DATA_TYPE),
+	WIFI_DATA_CFPOLL    = (BIT(5) | WIFI_DATA_TYPE),
+	WIFI_DATA_CFACKPOLL = (BIT(5) | BIT(4) | WIFI_DATA_TYPE),
+	WIFI_DATA_NULL      = (BIT(6) | WIFI_DATA_TYPE),
+	WIFI_CF_ACK         = (BIT(6) | BIT(4) | WIFI_DATA_TYPE),
+	WIFI_CF_POLL        = (BIT(6) | BIT(5) | WIFI_DATA_TYPE),
+	WIFI_CF_ACKPOLL     = (BIT(6) | BIT(5) | BIT(4) | WIFI_DATA_TYPE),
 };
 
 enum WIFI_REASON_CODE	{
@@ -84,7 +81,6 @@
 	_RSON_CLS3_			= 7,
 	_RSON_DISAOC_STA_LEAVING_	= 8,
 	_RSON_ASOC_NOT_AUTH_		= 9,
-
 	/* WPA reason */
 	_RSON_INVALID_IE_		= 13,
 	_RSON_MIC_FAILURE_		= 14,
@@ -97,7 +93,6 @@
 	_RSON_UNSUPPORT_RSNE_VER_	= 21,
 	_RSON_INVALID_RSNE_CAP_		= 22,
 	_RSON_IEEE_802DOT1X_AUTH_FAIL_	= 23,
-
 	/* below are Realtek definitions */
 	_RSON_PMK_NOT_AVAILABLE_	= 24,
 };
diff --git a/drivers/staging/rtl8712/wlan_bssdef.h b/drivers/staging/rtl8712/wlan_bssdef.h
index 6d92952..0d90e1f 100644
--- a/drivers/staging/rtl8712/wlan_bssdef.h
+++ b/drivers/staging/rtl8712/wlan_bssdef.h
@@ -13,23 +13,23 @@
 typedef unsigned char   NDIS_802_11_RATES_EX[NDIS_802_11_LENGTH_RATES_EX];
 
 struct ndis_802_11_ssid {
-  u32  SsidLength;
-  u8  Ssid[32];
+	u32 SsidLength;
+	u8  Ssid[32];
 };
 
 enum NDIS_802_11_NETWORK_TYPE {
-    Ndis802_11FH,
-    Ndis802_11DS,
-    Ndis802_11OFDM5,
-    Ndis802_11OFDM24,
-    Ndis802_11NetworkTypeMax    /* not a real type, defined as an upper bound */
+	Ndis802_11FH,
+	Ndis802_11DS,
+	Ndis802_11OFDM5,
+	Ndis802_11OFDM24,
+	Ndis802_11NetworkTypeMax /* not a real type, defined as an upper bound*/
 };
 
 struct NDIS_802_11_CONFIGURATION_FH {
-    u32           Length;             /* Length of structure */
-    u32           HopPattern;         /* As defined by 802.11, MSB set */
-    u32           HopSet;             /* to one if non-802.11 */
-    u32           DwellTime;          /* units are Kusec */
+	u32 Length;             /* Length of structure */
+	u32 HopPattern;         /* As defined by 802.11, MSB set */
+	u32 HopSet;             /* to one if non-802.11 */
+	u32 DwellTime;          /* units are Kusec */
 };
 
 /*
@@ -37,25 +37,25 @@
 	ODI Handler will convert the channel number to freq. number.
 */
 struct NDIS_802_11_CONFIGURATION {
-    u32           Length;             /* Length of structure */
-    u32           BeaconPeriod;       /* units are Kusec */
-    u32           ATIMWindow;         /* units are Kusec */
-    u32           DSConfig;           /* Frequency, units are kHz */
-    struct NDIS_802_11_CONFIGURATION_FH    FHConfig;
+	u32 Length;             /* Length of structure */
+	u32 BeaconPeriod;       /* units are Kusec */
+	u32 ATIMWindow;         /* units are Kusec */
+	u32 DSConfig;           /* Frequency, units are kHz */
+	struct NDIS_802_11_CONFIGURATION_FH FHConfig;
 };
 
 enum NDIS_802_11_NETWORK_INFRASTRUCTURE {
-    Ndis802_11IBSS,
-    Ndis802_11Infrastructure,
-    Ndis802_11AutoUnknown,
-    Ndis802_11InfrastructureMax, /* Not a real value, defined as upper bound */
-    Ndis802_11APMode
+	Ndis802_11IBSS,
+	Ndis802_11Infrastructure,
+	Ndis802_11AutoUnknown,
+	Ndis802_11InfrastructureMax, /*Not a real value,defined as upper bound*/
+	Ndis802_11APMode
 };
 
 struct NDIS_802_11_FIXED_IEs {
-  u8  Timestamp[8];
-  u16  BeaconInterval;
-  u16  Capabilities;
+	u8  Timestamp[8];
+	u16 BeaconInterval;
+	u16 Capabilities;
 };
 
 /*
@@ -70,44 +70,44 @@
  */
 
 struct ndis_wlan_bssid_ex {
-  u32  Length;
-  unsigned char  MacAddress[6];
-  u8  Reserved[2];
-  struct ndis_802_11_ssid  Ssid;
-  u32  Privacy;
-  s32  Rssi;
-  enum NDIS_802_11_NETWORK_TYPE  NetworkTypeInUse;
-  struct NDIS_802_11_CONFIGURATION  Configuration;
-  enum NDIS_802_11_NETWORK_INFRASTRUCTURE  InfrastructureMode;
-  NDIS_802_11_RATES_EX  SupportedRates;
-  u32  IELength;
-/*(timestamp, beacon interval, and capability information) */
-  u8  IEs[MAX_IE_SZ];
+	u32 Length;
+	unsigned char  MacAddress[6];
+	u8  Reserved[2];
+	struct ndis_802_11_ssid  Ssid;
+	u32 Privacy;
+	s32 Rssi;
+	enum NDIS_802_11_NETWORK_TYPE  NetworkTypeInUse;
+	struct NDIS_802_11_CONFIGURATION  Configuration;
+	enum NDIS_802_11_NETWORK_INFRASTRUCTURE  InfrastructureMode;
+	NDIS_802_11_RATES_EX  SupportedRates;
+	u32 IELength;
+	/*(timestamp, beacon interval, and capability information) */
+	u8 IEs[MAX_IE_SZ];
 };
 
 enum NDIS_802_11_AUTHENTICATION_MODE {
-    Ndis802_11AuthModeOpen,
-    Ndis802_11AuthModeShared,
-    Ndis802_11AuthModeAutoSwitch,
-    Ndis802_11AuthModeWPA,
-    Ndis802_11AuthModeWPAPSK,
-    Ndis802_11AuthModeWPANone,
-    Ndis802_11AuthModeMax     /* Not a real mode, defined as upper bound */
+	Ndis802_11AuthModeOpen,
+	Ndis802_11AuthModeShared,
+	Ndis802_11AuthModeAutoSwitch,
+	Ndis802_11AuthModeWPA,
+	Ndis802_11AuthModeWPAPSK,
+	Ndis802_11AuthModeWPANone,
+	Ndis802_11AuthModeMax      /* Not a real mode, defined as upper bound */
 };
 
 enum {
-    Ndis802_11WEPEnabled,
-    Ndis802_11Encryption1Enabled = Ndis802_11WEPEnabled,
-    Ndis802_11WEPDisabled,
-    Ndis802_11EncryptionDisabled = Ndis802_11WEPDisabled,
-    Ndis802_11WEPKeyAbsent,
-    Ndis802_11Encryption1KeyAbsent = Ndis802_11WEPKeyAbsent,
-    Ndis802_11WEPNotSupported,
-    Ndis802_11EncryptionNotSupported = Ndis802_11WEPNotSupported,
-    Ndis802_11Encryption2Enabled,
-    Ndis802_11Encryption2KeyAbsent,
-    Ndis802_11Encryption3Enabled,
-    Ndis802_11Encryption3KeyAbsent
+	Ndis802_11WEPEnabled,
+	Ndis802_11Encryption1Enabled = Ndis802_11WEPEnabled,
+	Ndis802_11WEPDisabled,
+	Ndis802_11EncryptionDisabled = Ndis802_11WEPDisabled,
+	Ndis802_11WEPKeyAbsent,
+	Ndis802_11Encryption1KeyAbsent = Ndis802_11WEPKeyAbsent,
+	Ndis802_11WEPNotSupported,
+	Ndis802_11EncryptionNotSupported = Ndis802_11WEPNotSupported,
+	Ndis802_11Encryption2Enabled,
+	Ndis802_11Encryption2KeyAbsent,
+	Ndis802_11Encryption3Enabled,
+	Ndis802_11Encryption3KeyAbsent
 };
 
 #define NDIS_802_11_AI_REQFI_CAPABILITIES      1
@@ -119,51 +119,51 @@
 #define NDIS_802_11_AI_RESFI_ASSOCIATIONID     4
 
 struct NDIS_802_11_AI_REQFI {
-    u16 Capabilities;
-    u16 ListenInterval;
-    unsigned char CurrentAPAddress[6];
+	u16 Capabilities;
+	u16 ListenInterval;
+	unsigned char CurrentAPAddress[6];
 };
 
 struct NDIS_802_11_AI_RESFI {
-    u16 Capabilities;
-    u16 StatusCode;
-    u16 AssociationId;
+	u16 Capabilities;
+	u16 StatusCode;
+	u16 AssociationId;
 };
 
 struct NDIS_802_11_ASSOCIATION_INFORMATION {
-    u32                   Length;
-    u16                  AvailableRequestFixedIEs;
-    struct NDIS_802_11_AI_REQFI    RequestFixedIEs;
-    u32                   RequestIELength;
-    u32                   OffsetRequestIEs;
-    u16                  AvailableResponseFixedIEs;
-    struct NDIS_802_11_AI_RESFI    ResponseFixedIEs;
-    u32                   ResponseIELength;
-    u32                   OffsetResponseIEs;
+	u32 Length;
+	u16 AvailableRequestFixedIEs;
+	struct NDIS_802_11_AI_REQFI RequestFixedIEs;
+	u32 RequestIELength;
+	u32 OffsetRequestIEs;
+	u16 AvailableResponseFixedIEs;
+	struct NDIS_802_11_AI_RESFI ResponseFixedIEs;
+	u32 ResponseIELength;
+	u32 OffsetResponseIEs;
 };
 
 /* Key mapping keys require a BSSID*/
 struct NDIS_802_11_KEY {
-    u32           Length;             /* Length of this structure */
-    u32           KeyIndex;
-    u32           KeyLength;          /* length of key in bytes */
-    unsigned char BSSID[6];
-    unsigned long long KeyRSC;
-    u8           KeyMaterial[32];     /* variable length */
+	u32 Length;			/* Length of this structure */
+	u32 KeyIndex;
+	u32 KeyLength;			/* length of key in bytes */
+	unsigned char BSSID[6];
+	unsigned long long KeyRSC;
+	u8  KeyMaterial[32];		/* variable length */
 };
 
 struct NDIS_802_11_REMOVE_KEY {
-    u32                   Length;        /* Length of this structure */
-    u32                   KeyIndex;
-    unsigned char BSSID[6];
+	u32 Length;			/* Length of this structure */
+	u32 KeyIndex;
+	unsigned char BSSID[6];
 };
 
 struct NDIS_802_11_WEP {
-    u32     Length;        /* Length of this structure */
-    u32     KeyIndex;      /* 0 is the per-client key,
-			      * 1-N are the global keys */
-    u32     KeyLength;     /* length of key in bytes */
-    u8     KeyMaterial[16];/* variable length depending on above field */
+	u32 Length;		  /* Length of this structure */
+	u32 KeyIndex;		  /* 0 is the per-client key,
+				   * 1-N are the global keys */
+	u32 KeyLength;		  /* length of key in bytes */
+	u8  KeyMaterial[16];      /* variable length depending on above field */
 };
 
 /* mask for authentication/integrity fields */
@@ -192,15 +192,15 @@
 };
 
 enum VRTL_CARRIER_SENSE {
-    DISABLE_VCS,
-    ENABLE_VCS,
-    AUTO_VCS
+	DISABLE_VCS,
+	ENABLE_VCS,
+	AUTO_VCS
 };
 
 enum VCS_TYPE {
-    NONE_VCS,
-    RTS_CTS,
-    CTS_TO_SELF
+	NONE_VCS,
+	RTS_CTS,
+	CTS_TO_SELF
 };
 
 #define PWR_CAM 0
@@ -211,9 +211,9 @@
 
 enum UAPSD_MAX_SP {
 	NO_LIMIT,
-       TWO_MSDU,
-       FOUR_MSDU,
-       SIX_MSDU
+	TWO_MSDU,
+	FOUR_MSDU,
+	SIX_MSDU
 };
 
 #define NUM_PRE_AUTH_KEY 16
@@ -223,18 +223,18 @@
  *	WPA2
  */
 struct wlan_bssid_ex {
-  u32  Length;
-  unsigned char  MacAddress[6];
-  u8  Reserved[2];
-  struct ndis_802_11_ssid  Ssid;
-  u32  Privacy;
-  s32  Rssi;
-  enum NDIS_802_11_NETWORK_TYPE  NetworkTypeInUse;
-  struct NDIS_802_11_CONFIGURATION  Configuration;
-  enum NDIS_802_11_NETWORK_INFRASTRUCTURE  InfrastructureMode;
-  NDIS_802_11_RATES_EX  SupportedRates;
-  u32  IELength;
-  u8  IEs[MAX_IE_SZ];	/* (timestamp, beacon interval, and capability
+	u32 Length;
+	unsigned char  MacAddress[6];
+	u8  Reserved[2];
+	struct ndis_802_11_ssid  Ssid;
+	u32 Privacy;
+	s32 Rssi;
+	enum NDIS_802_11_NETWORK_TYPE  NetworkTypeInUse;
+	struct NDIS_802_11_CONFIGURATION  Configuration;
+	enum NDIS_802_11_NETWORK_INFRASTRUCTURE  InfrastructureMode;
+	NDIS_802_11_RATES_EX  SupportedRates;
+	u32 IELength;
+	u8  IEs[MAX_IE_SZ];	/* (timestamp, beacon interval, and capability
 				 * information) */
 };
 
diff --git a/drivers/staging/rts_pstor/ms.c b/drivers/staging/rts_pstor/ms.c
index 810e170..2fd2932 100644
--- a/drivers/staging/rts_pstor/ms.c
+++ b/drivers/staging/rts_pstor/ms.c
@@ -863,7 +863,7 @@
 		TRACE_RET(chip, STATUS_FAIL);
 	}
 
-	buf = (u8 *)rtsx_alloc_dma_buf(chip, 64 * 512, GFP_KERNEL);
+	buf = kmalloc(64 * 512, GFP_KERNEL);
 	if (buf == NULL) {
 		TRACE_RET(chip, STATUS_ERROR);
 	}
@@ -875,11 +875,11 @@
 		}
 		retval = rtsx_read_register(chip, MS_TRANS_CFG, &val);
 		if (retval != STATUS_SUCCESS) {
-			rtsx_free_dma_buf(chip, buf);
+			kfree(buf);
 			TRACE_RET(chip, STATUS_FAIL);
 		}
 		if (!(val & MS_INT_BREQ)) {
-			rtsx_free_dma_buf(chip, buf);
+			kfree(buf);
 			TRACE_RET(chip, STATUS_FAIL);
 		}
 		retval = ms_transfer_data(chip, MS_TM_AUTO_READ, PRO_READ_LONG_DATA,
@@ -891,7 +891,7 @@
 		}
 	}
 	if (retval != STATUS_SUCCESS) {
-		rtsx_free_dma_buf(chip, buf);
+		kfree(buf);
 		TRACE_RET(chip, STATUS_FAIL);
 	}
 
@@ -899,7 +899,7 @@
 	do {
 		retval = rtsx_read_register(chip, MS_TRANS_CFG, &val);
 		if (retval != STATUS_SUCCESS) {
-			rtsx_free_dma_buf(chip, buf);
+			kfree(buf);
 			TRACE_RET(chip, STATUS_FAIL);
 		}
 
@@ -908,7 +908,7 @@
 
 		retval = ms_transfer_tpc(chip, MS_TM_NORMAL_READ, PRO_READ_LONG_DATA, 0, WAIT_INT);
 		if (retval != STATUS_SUCCESS) {
-			rtsx_free_dma_buf(chip, buf);
+			kfree(buf);
 			TRACE_RET(chip, STATUS_FAIL);
 		}
 
@@ -916,18 +916,18 @@
 	} while (i < 1024);
 
 	if (retval != STATUS_SUCCESS) {
-		rtsx_free_dma_buf(chip, buf);
+		kfree(buf);
 		TRACE_RET(chip, STATUS_FAIL);
 	}
 
 	if ((buf[0] != 0xa5) && (buf[1] != 0xc3)) {
 		/* Signature code is wrong */
-		rtsx_free_dma_buf(chip, buf);
+		kfree(buf);
 		TRACE_RET(chip, STATUS_FAIL);
 	}
 
 	if ((buf[4] < 1) || (buf[4] > 12)) {
-		rtsx_free_dma_buf(chip, buf);
+		kfree(buf);
 		TRACE_RET(chip, STATUS_FAIL);
 	}
 
@@ -949,15 +949,15 @@
 			RTSX_DEBUGP("sys_info_addr = 0x%x, sys_info_size = 0x%x\n",
 					sys_info_addr, sys_info_size);
 			if (sys_info_size != 96)  {
-				rtsx_free_dma_buf(chip, buf);
+				kfree(buf);
 				TRACE_RET(chip, STATUS_FAIL);
 			}
 			if (sys_info_addr < 0x1A0) {
-				rtsx_free_dma_buf(chip, buf);
+				kfree(buf);
 				TRACE_RET(chip, STATUS_FAIL);
 			}
 			if ((sys_info_size + sys_info_addr) > 0x8000) {
-				rtsx_free_dma_buf(chip, buf);
+				kfree(buf);
 				TRACE_RET(chip, STATUS_FAIL);
 			}
 
@@ -983,15 +983,15 @@
 			RTSX_DEBUGP("model_name_addr = 0x%x, model_name_size = 0x%x\n",
 					model_name_addr, model_name_size);
 			if (model_name_size != 48)  {
-				rtsx_free_dma_buf(chip, buf);
+				kfree(buf);
 				TRACE_RET(chip, STATUS_FAIL);
 			}
 			if (model_name_addr < 0x1A0) {
-				rtsx_free_dma_buf(chip, buf);
+				kfree(buf);
 				TRACE_RET(chip, STATUS_FAIL);
 			}
 			if ((model_name_size + model_name_addr) > 0x8000) {
-				rtsx_free_dma_buf(chip, buf);
+				kfree(buf);
 				TRACE_RET(chip, STATUS_FAIL);
 			}
 
@@ -1004,7 +1004,7 @@
 	}
 
 	if (i == buf[4]) {
-		rtsx_free_dma_buf(chip, buf);
+		kfree(buf);
 		TRACE_RET(chip, STATUS_FAIL);
 	}
 
@@ -1041,7 +1041,7 @@
 	memcpy(ms_card->raw_model_name, buf + model_name_addr, 48);
 #endif
 
-	rtsx_free_dma_buf(chip, buf);
+	kfree(buf);
 
 #ifdef SUPPORT_MSXC
 	if (CHK_MSXC(ms_card)) {
@@ -3783,7 +3783,7 @@
 		TRACE_RET(chip, STATUS_FAIL);
 	}
 
-	buf = (u8 *)rtsx_alloc_dma_buf(chip, 1540, GFP_KERNEL);
+	buf = kmalloc(1540, GFP_KERNEL);
 	if (!buf) {
 		TRACE_RET(chip, STATUS_ERROR);
 	}
@@ -3816,9 +3816,7 @@
 	rtsx_stor_set_xfer_buf(buf, bufflen, srb);
 
 GetEKBFinish:
-	if (buf) {
-		rtsx_free_dma_buf(chip, buf);
-	}
+	kfree(buf);
 	return retval;
 }
 
@@ -4021,7 +4019,7 @@
 		TRACE_RET(chip, STATUS_FAIL);
 	}
 
-	buf = (u8 *)rtsx_alloc_dma_buf(chip, 1028, GFP_KERNEL);
+	buf = kmalloc(1028, GFP_KERNEL);
 	if (!buf) {
 		TRACE_RET(chip, STATUS_ERROR);
 	}
@@ -4054,9 +4052,7 @@
 	rtsx_stor_set_xfer_buf(buf, bufflen, srb);
 
 GetICVFinish:
-	if (buf) {
-		rtsx_free_dma_buf(chip, buf);
-	}
+	kfree(buf);
 	return retval;
 }
 
@@ -4080,7 +4076,7 @@
 		TRACE_RET(chip, STATUS_FAIL);
 	}
 
-	buf = (u8 *)rtsx_alloc_dma_buf(chip, 1028, GFP_KERNEL);
+	buf = kmalloc(1028, GFP_KERNEL);
 	if (!buf) {
 		TRACE_RET(chip, STATUS_ERROR);
 	}
@@ -4155,9 +4151,7 @@
 #endif
 
 SetICVFinish:
-	if (buf) {
-		rtsx_free_dma_buf(chip, buf);
-	}
+	kfree(buf);
 	return retval;
 }
 
diff --git a/drivers/staging/rts_pstor/rtsx.h b/drivers/staging/rts_pstor/rtsx.h
index 4d5ddf6..6afb635 100644
--- a/drivers/staging/rts_pstor/rtsx.h
+++ b/drivers/staging/rts_pstor/rtsx.h
@@ -98,9 +98,6 @@
 
 #define SCSI_LUN(srb)		((srb)->device->lun)
 
-#define rtsx_alloc_dma_buf(chip, size, flag)	kmalloc((size), (flag))
-#define rtsx_free_dma_buf(chip, ptr)		kfree((ptr))
-
 typedef unsigned long DELAY_PARA_T;
 
 struct rtsx_chip;
diff --git a/drivers/staging/rts_pstor/spi.c b/drivers/staging/rts_pstor/spi.c
index 8a8689b..c803ba6 100644
--- a/drivers/staging/rts_pstor/spi.c
+++ b/drivers/staging/rts_pstor/spi.c
@@ -505,7 +505,7 @@
 		TRACE_RET(chip, STATUS_FAIL);
 	}
 
-	buf = (u8 *)rtsx_alloc_dma_buf(chip, SF_PAGE_LEN, GFP_KERNEL);
+	buf = kmalloc(SF_PAGE_LEN, GFP_KERNEL);
 	if (buf == NULL)
 		TRACE_RET(chip, STATUS_ERROR);
 
@@ -543,7 +543,7 @@
 
 		retval = rtsx_transfer_data(chip, 0, buf, pagelen, 0, DMA_FROM_DEVICE, 10000);
 		if (retval < 0) {
-			rtsx_free_dma_buf(chip, buf);
+			kfree(buf);
 			rtsx_clear_spi_error(chip);
 			spi_set_err_code(chip, SPI_HW_ERR);
 			TRACE_RET(chip, STATUS_FAIL);
@@ -556,7 +556,7 @@
 	}
 
 	scsi_set_resid(srb, 0);
-	rtsx_free_dma_buf(chip, buf);
+	kfree(buf);
 
 	return STATUS_SUCCESS;
 }
@@ -584,14 +584,14 @@
 	}
 
 	if (program_mode == BYTE_PROGRAM) {
-		buf = rtsx_alloc_dma_buf(chip, 4, GFP_KERNEL);
+		buf = kmalloc(4, GFP_KERNEL);
 		if (!buf)
 			TRACE_RET(chip, STATUS_ERROR);
 
 		while (len) {
 			retval = sf_enable_write(chip, SPI_WREN);
 			if (retval != STATUS_SUCCESS) {
-				rtsx_free_dma_buf(chip, buf);
+				kfree(buf);
 				TRACE_RET(chip, STATUS_FAIL);
 			}
 
@@ -605,7 +605,7 @@
 
 			retval = rtsx_send_cmd(chip, 0, 100);
 			if (retval < 0) {
-				rtsx_free_dma_buf(chip, buf);
+				kfree(buf);
 				rtsx_clear_spi_error(chip);
 				spi_set_err_code(chip, SPI_HW_ERR);
 				TRACE_RET(chip, STATUS_FAIL);
@@ -613,7 +613,7 @@
 
 			retval = sf_polling_status(chip, 100);
 			if (retval != STATUS_SUCCESS) {
-				rtsx_free_dma_buf(chip, buf);
+				kfree(buf);
 				TRACE_RET(chip, STATUS_FAIL);
 			}
 
@@ -621,7 +621,7 @@
 			len--;
 		}
 
-		rtsx_free_dma_buf(chip, buf);
+		kfree(buf);
 
 	} else if (program_mode == AAI_PROGRAM) {
 		int first_byte = 1;
@@ -630,7 +630,7 @@
 		if (retval != STATUS_SUCCESS)
 			TRACE_RET(chip, STATUS_FAIL);
 
-		buf = rtsx_alloc_dma_buf(chip, 4, GFP_KERNEL);
+		buf = kmalloc(4, GFP_KERNEL);
 		if (!buf)
 			TRACE_RET(chip, STATUS_ERROR);
 
@@ -650,7 +650,7 @@
 
 			retval = rtsx_send_cmd(chip, 0, 100);
 			if (retval < 0) {
-				rtsx_free_dma_buf(chip, buf);
+				kfree(buf);
 				rtsx_clear_spi_error(chip);
 				spi_set_err_code(chip, SPI_HW_ERR);
 				TRACE_RET(chip, STATUS_FAIL);
@@ -658,14 +658,14 @@
 
 			retval = sf_polling_status(chip, 100);
 			if (retval != STATUS_SUCCESS) {
-				rtsx_free_dma_buf(chip, buf);
+				kfree(buf);
 				TRACE_RET(chip, STATUS_FAIL);
 			}
 
 			len--;
 		}
 
-		rtsx_free_dma_buf(chip, buf);
+		kfree(buf);
 
 		retval = sf_disable_write(chip, SPI_WRDI);
 		if (retval != STATUS_SUCCESS)
@@ -675,7 +675,7 @@
 		if (retval != STATUS_SUCCESS)
 			TRACE_RET(chip, STATUS_FAIL);
 	} else if (program_mode == PAGE_PROGRAM) {
-		buf = rtsx_alloc_dma_buf(chip, SF_PAGE_LEN, GFP_KERNEL);
+		buf = kmalloc(SF_PAGE_LEN, GFP_KERNEL);
 		if (!buf)
 			TRACE_RET(chip, STATUS_NOMEM);
 
@@ -687,7 +687,7 @@
 
 			retval = sf_enable_write(chip, SPI_WREN);
 			if (retval != STATUS_SUCCESS) {
-				rtsx_free_dma_buf(chip, buf);
+				kfree(buf);
 				TRACE_RET(chip, STATUS_FAIL);
 			}
 
@@ -702,7 +702,7 @@
 
 			retval = rtsx_transfer_data(chip, 0, buf, pagelen, 0, DMA_TO_DEVICE, 100);
 			if (retval < 0) {
-				rtsx_free_dma_buf(chip, buf);
+				kfree(buf);
 				rtsx_clear_spi_error(chip);
 				spi_set_err_code(chip, SPI_HW_ERR);
 				TRACE_RET(chip, STATUS_FAIL);
@@ -710,7 +710,7 @@
 
 			retval = sf_polling_status(chip, 100);
 			if (retval != STATUS_SUCCESS) {
-				rtsx_free_dma_buf(chip, buf);
+				kfree(buf);
 				TRACE_RET(chip, STATUS_FAIL);
 			}
 
@@ -718,7 +718,7 @@
 			len -= pagelen;
 		}
 
-		rtsx_free_dma_buf(chip, buf);
+		kfree(buf);
 	} else {
 		spi_set_err_code(chip, SPI_INVALID_COMMAND);
 		TRACE_RET(chip, STATUS_FAIL);
diff --git a/drivers/staging/rts_pstor/xd.c b/drivers/staging/rts_pstor/xd.c
index 7bcd468..a58a689 100644
--- a/drivers/staging/rts_pstor/xd.c
+++ b/drivers/staging/rts_pstor/xd.c
@@ -379,7 +379,7 @@
 
 		RTSX_DEBUGP("xD ECC error, dummy write!\n");
 
-		buf = (u8 *)rtsx_alloc_dma_buf(chip, 512, GFP_KERNEL);
+		buf = kmalloc(512, GFP_KERNEL);
 		if (!buf)
 			return;
 
@@ -426,7 +426,7 @@
 			rtsx_write_register(chip, CARD_STOP, SD_STOP | SD_CLR_ERR, SD_STOP | SD_CLR_ERR);
 		}
 
-		rtsx_free_dma_buf(chip, buf);
+		kfree(buf);
 
 		if (chip->asic_code) {
 			rtsx_write_register(chip, CARD_PULL_CTL2, 0xFF, 0x55);
diff --git a/drivers/staging/samsung-laptop/Kconfig b/drivers/staging/samsung-laptop/Kconfig
deleted file mode 100644
index f27c608..0000000
--- a/drivers/staging/samsung-laptop/Kconfig
+++ /dev/null
@@ -1,10 +0,0 @@
-config SAMSUNG_LAPTOP
-	tristate "Samsung Laptop driver"
-	default n
-	depends on RFKILL && BACKLIGHT_CLASS_DEVICE && X86
-	help
-	  This module implements a driver for the N128 Samsung Laptop
-	  providing control over the Wireless LED and the LCD backlight
-
-	  To compile this driver as a module, choose
-	  M here: the module will be called samsung-laptop.
diff --git a/drivers/staging/samsung-laptop/Makefile b/drivers/staging/samsung-laptop/Makefile
deleted file mode 100644
index 3c6f420..0000000
--- a/drivers/staging/samsung-laptop/Makefile
+++ /dev/null
@@ -1 +0,0 @@
-obj-$(CONFIG_SAMSUNG_LAPTOP)	+= samsung-laptop.o
diff --git a/drivers/staging/samsung-laptop/TODO b/drivers/staging/samsung-laptop/TODO
deleted file mode 100644
index f7a6d58..0000000
--- a/drivers/staging/samsung-laptop/TODO
+++ /dev/null
@@ -1,5 +0,0 @@
-TODO:
-	- review from other developers
-	- figure out ACPI video issues
-
-Please send patches to Greg Kroah-Hartman <gregkh@suse.de>
diff --git a/drivers/staging/samsung-laptop/samsung-laptop.c b/drivers/staging/samsung-laptop/samsung-laptop.c
deleted file mode 100644
index 2529446..0000000
--- a/drivers/staging/samsung-laptop/samsung-laptop.c
+++ /dev/null
@@ -1,843 +0,0 @@
-/*
- * Samsung Laptop driver
- *
- * Copyright (C) 2009,2011 Greg Kroah-Hartman (gregkh@suse.de)
- * Copyright (C) 2009,2011 Novell Inc.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 as published by
- * the Free Software Foundation.
- *
- */
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/delay.h>
-#include <linux/pci.h>
-#include <linux/backlight.h>
-#include <linux/fb.h>
-#include <linux/dmi.h>
-#include <linux/platform_device.h>
-#include <linux/rfkill.h>
-
-/*
- * This driver is needed because a number of Samsung laptops do not hook
- * their control settings through ACPI.  So we have to poke around in the
- * BIOS to do things like brightness values, and "special" key controls.
- */
-
-/*
- * We have 0 - 8 as valid brightness levels.  The specs say that level 0 should
- * be reserved by the BIOS (which really doesn't make much sense), we tell
- * userspace that the value is 0 - 7 and then just tell the hardware 1 - 8
- */
-#define MAX_BRIGHT	0x07
-
-
-#define SABI_IFACE_MAIN			0x00
-#define SABI_IFACE_SUB			0x02
-#define SABI_IFACE_COMPLETE		0x04
-#define SABI_IFACE_DATA			0x05
-
-/* Structure to get data back to the calling function */
-struct sabi_retval {
-	u8 retval[20];
-};
-
-struct sabi_header_offsets {
-	u8 port;
-	u8 re_mem;
-	u8 iface_func;
-	u8 en_mem;
-	u8 data_offset;
-	u8 data_segment;
-};
-
-struct sabi_commands {
-	/*
-	 * Brightness is 0 - 8, as described above.
-	 * Value 0 is for the BIOS to use
-	 */
-	u8 get_brightness;
-	u8 set_brightness;
-
-	/*
-	 * first byte:
-	 * 0x00 - wireless is off
-	 * 0x01 - wireless is on
-	 * second byte:
-	 * 0x02 - 3G is off
-	 * 0x03 - 3G is on
-	 * TODO, verify 3G is correct, that doesn't seem right...
-	 */
-	u8 get_wireless_button;
-	u8 set_wireless_button;
-
-	/* 0 is off, 1 is on */
-	u8 get_backlight;
-	u8 set_backlight;
-
-	/*
-	 * 0x80 or 0x00 - no action
-	 * 0x81 - recovery key pressed
-	 */
-	u8 get_recovery_mode;
-	u8 set_recovery_mode;
-
-	/*
-	 * on seclinux: 0 is low, 1 is high,
-	 * on swsmi: 0 is normal, 1 is silent, 2 is turbo
-	 */
-	u8 get_performance_level;
-	u8 set_performance_level;
-
-	/*
-	 * Tell the BIOS that Linux is running on this machine.
-	 * 81 is on, 80 is off
-	 */
-	u8 set_linux;
-};
-
-struct sabi_performance_level {
-	const char *name;
-	u8 value;
-};
-
-struct sabi_config {
-	const char *test_string;
-	u16 main_function;
-	const struct sabi_header_offsets header_offsets;
-	const struct sabi_commands commands;
-	const struct sabi_performance_level performance_levels[4];
-	u8 min_brightness;
-	u8 max_brightness;
-};
-
-static const struct sabi_config sabi_configs[] = {
-	{
-		.test_string = "SECLINUX",
-
-		.main_function = 0x4c49,
-
-		.header_offsets = {
-			.port = 0x00,
-			.re_mem = 0x02,
-			.iface_func = 0x03,
-			.en_mem = 0x04,
-			.data_offset = 0x05,
-			.data_segment = 0x07,
-		},
-
-		.commands = {
-			.get_brightness = 0x00,
-			.set_brightness = 0x01,
-
-			.get_wireless_button = 0x02,
-			.set_wireless_button = 0x03,
-
-			.get_backlight = 0x04,
-			.set_backlight = 0x05,
-
-			.get_recovery_mode = 0x06,
-			.set_recovery_mode = 0x07,
-
-			.get_performance_level = 0x08,
-			.set_performance_level = 0x09,
-
-			.set_linux = 0x0a,
-		},
-
-		.performance_levels = {
-			{
-				.name = "silent",
-				.value = 0,
-			},
-			{
-				.name = "normal",
-				.value = 1,
-			},
-			{ },
-		},
-		.min_brightness = 1,
-		.max_brightness = 8,
-	},
-	{
-		.test_string = "SwSmi@",
-
-		.main_function = 0x5843,
-
-		.header_offsets = {
-			.port = 0x00,
-			.re_mem = 0x04,
-			.iface_func = 0x02,
-			.en_mem = 0x03,
-			.data_offset = 0x05,
-			.data_segment = 0x07,
-		},
-
-		.commands = {
-			.get_brightness = 0x10,
-			.set_brightness = 0x11,
-
-			.get_wireless_button = 0x12,
-			.set_wireless_button = 0x13,
-
-			.get_backlight = 0x2d,
-			.set_backlight = 0x2e,
-
-			.get_recovery_mode = 0xff,
-			.set_recovery_mode = 0xff,
-
-			.get_performance_level = 0x31,
-			.set_performance_level = 0x32,
-
-			.set_linux = 0xff,
-		},
-
-		.performance_levels = {
-			{
-				.name = "normal",
-				.value = 0,
-			},
-			{
-				.name = "silent",
-				.value = 1,
-			},
-			{
-				.name = "overclock",
-				.value = 2,
-			},
-			{ },
-		},
-		.min_brightness = 0,
-		.max_brightness = 8,
-	},
-	{ },
-};
-
-static const struct sabi_config *sabi_config;
-
-static void __iomem *sabi;
-static void __iomem *sabi_iface;
-static void __iomem *f0000_segment;
-static struct backlight_device *backlight_device;
-static struct mutex sabi_mutex;
-static struct platform_device *sdev;
-static struct rfkill *rfk;
-
-static int force;
-module_param(force, bool, 0);
-MODULE_PARM_DESC(force,
-		"Disable the DMI check and forces the driver to be loaded");
-
-static int debug;
-module_param(debug, bool, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(debug, "Debug enabled or not");
-
-static int sabi_get_command(u8 command, struct sabi_retval *sretval)
-{
-	int retval = 0;
-	u16 port = readw(sabi + sabi_config->header_offsets.port);
-	u8 complete, iface_data;
-
-	mutex_lock(&sabi_mutex);
-
-	/* enable memory to be able to write to it */
-	outb(readb(sabi + sabi_config->header_offsets.en_mem), port);
-
-	/* write out the command */
-	writew(sabi_config->main_function, sabi_iface + SABI_IFACE_MAIN);
-	writew(command, sabi_iface + SABI_IFACE_SUB);
-	writeb(0, sabi_iface + SABI_IFACE_COMPLETE);
-	outb(readb(sabi + sabi_config->header_offsets.iface_func), port);
-
-	/* write protect memory to make it safe */
-	outb(readb(sabi + sabi_config->header_offsets.re_mem), port);
-
-	/* see if the command actually succeeded */
-	complete = readb(sabi_iface + SABI_IFACE_COMPLETE);
-	iface_data = readb(sabi_iface + SABI_IFACE_DATA);
-	if (complete != 0xaa || iface_data == 0xff) {
-		pr_warn("SABI get command 0x%02x failed with completion flag 0x%02x and data 0x%02x\n",
-		        command, complete, iface_data);
-		retval = -EINVAL;
-		goto exit;
-	}
-	/*
-	 * Save off the data into a structure so the caller use it.
-	 * Right now we only want the first 4 bytes,
-	 * There are commands that need more, but not for the ones we
-	 * currently care about.
-	 */
-	sretval->retval[0] = readb(sabi_iface + SABI_IFACE_DATA);
-	sretval->retval[1] = readb(sabi_iface + SABI_IFACE_DATA + 1);
-	sretval->retval[2] = readb(sabi_iface + SABI_IFACE_DATA + 2);
-	sretval->retval[3] = readb(sabi_iface + SABI_IFACE_DATA + 3);
-
-exit:
-	mutex_unlock(&sabi_mutex);
-	return retval;
-
-}
-
-static int sabi_set_command(u8 command, u8 data)
-{
-	int retval = 0;
-	u16 port = readw(sabi + sabi_config->header_offsets.port);
-	u8 complete, iface_data;
-
-	mutex_lock(&sabi_mutex);
-
-	/* enable memory to be able to write to it */
-	outb(readb(sabi + sabi_config->header_offsets.en_mem), port);
-
-	/* write out the command */
-	writew(sabi_config->main_function, sabi_iface + SABI_IFACE_MAIN);
-	writew(command, sabi_iface + SABI_IFACE_SUB);
-	writeb(0, sabi_iface + SABI_IFACE_COMPLETE);
-	writeb(data, sabi_iface + SABI_IFACE_DATA);
-	outb(readb(sabi + sabi_config->header_offsets.iface_func), port);
-
-	/* write protect memory to make it safe */
-	outb(readb(sabi + sabi_config->header_offsets.re_mem), port);
-
-	/* see if the command actually succeeded */
-	complete = readb(sabi_iface + SABI_IFACE_COMPLETE);
-	iface_data = readb(sabi_iface + SABI_IFACE_DATA);
-	if (complete != 0xaa || iface_data == 0xff) {
-		pr_warn("SABI set command 0x%02x failed with completion flag 0x%02x and data 0x%02x\n",
-		       command, complete, iface_data);
-		retval = -EINVAL;
-	}
-
-	mutex_unlock(&sabi_mutex);
-	return retval;
-}
-
-static void test_backlight(void)
-{
-	struct sabi_retval sretval;
-
-	sabi_get_command(sabi_config->commands.get_backlight, &sretval);
-	printk(KERN_DEBUG "backlight = 0x%02x\n", sretval.retval[0]);
-
-	sabi_set_command(sabi_config->commands.set_backlight, 0);
-	printk(KERN_DEBUG "backlight should be off\n");
-
-	sabi_get_command(sabi_config->commands.get_backlight, &sretval);
-	printk(KERN_DEBUG "backlight = 0x%02x\n", sretval.retval[0]);
-
-	msleep(1000);
-
-	sabi_set_command(sabi_config->commands.set_backlight, 1);
-	printk(KERN_DEBUG "backlight should be on\n");
-
-	sabi_get_command(sabi_config->commands.get_backlight, &sretval);
-	printk(KERN_DEBUG "backlight = 0x%02x\n", sretval.retval[0]);
-}
-
-static void test_wireless(void)
-{
-	struct sabi_retval sretval;
-
-	sabi_get_command(sabi_config->commands.get_wireless_button, &sretval);
-	printk(KERN_DEBUG "wireless led = 0x%02x\n", sretval.retval[0]);
-
-	sabi_set_command(sabi_config->commands.set_wireless_button, 0);
-	printk(KERN_DEBUG "wireless led should be off\n");
-
-	sabi_get_command(sabi_config->commands.get_wireless_button, &sretval);
-	printk(KERN_DEBUG "wireless led = 0x%02x\n", sretval.retval[0]);
-
-	msleep(1000);
-
-	sabi_set_command(sabi_config->commands.set_wireless_button, 1);
-	printk(KERN_DEBUG "wireless led should be on\n");
-
-	sabi_get_command(sabi_config->commands.get_wireless_button, &sretval);
-	printk(KERN_DEBUG "wireless led = 0x%02x\n", sretval.retval[0]);
-}
-
-static u8 read_brightness(void)
-{
-	struct sabi_retval sretval;
-	int user_brightness = 0;
-	int retval;
-
-	retval = sabi_get_command(sabi_config->commands.get_brightness,
-				  &sretval);
-	if (!retval) {
-		user_brightness = sretval.retval[0];
-		if (user_brightness != 0)
-			user_brightness -= sabi_config->min_brightness;
-	}
-	return user_brightness;
-}
-
-static void set_brightness(u8 user_brightness)
-{
-	u8 user_level = user_brightness - sabi_config->min_brightness;
-
-	sabi_set_command(sabi_config->commands.set_brightness, user_level);
-}
-
-static int get_brightness(struct backlight_device *bd)
-{
-	return (int)read_brightness();
-}
-
-static int update_status(struct backlight_device *bd)
-{
-	set_brightness(bd->props.brightness);
-
-	if (bd->props.power == FB_BLANK_UNBLANK)
-		sabi_set_command(sabi_config->commands.set_backlight, 1);
-	else
-		sabi_set_command(sabi_config->commands.set_backlight, 0);
-	return 0;
-}
-
-static const struct backlight_ops backlight_ops = {
-	.get_brightness	= get_brightness,
-	.update_status	= update_status,
-};
-
-static int rfkill_set(void *data, bool blocked)
-{
-	/* Do something with blocked...*/
-	/*
-	 * blocked == false is on
-	 * blocked == true is off
-	 */
-	if (blocked)
-		sabi_set_command(sabi_config->commands.set_wireless_button, 0);
-	else
-		sabi_set_command(sabi_config->commands.set_wireless_button, 1);
-
-	return 0;
-}
-
-static struct rfkill_ops rfkill_ops = {
-	.set_block = rfkill_set,
-};
-
-static int init_wireless(struct platform_device *sdev)
-{
-	int retval;
-
-	rfk = rfkill_alloc("samsung-wifi", &sdev->dev, RFKILL_TYPE_WLAN,
-			   &rfkill_ops, NULL);
-	if (!rfk)
-		return -ENOMEM;
-
-	retval = rfkill_register(rfk);
-	if (retval) {
-		rfkill_destroy(rfk);
-		return -ENODEV;
-	}
-
-	return 0;
-}
-
-static void destroy_wireless(void)
-{
-	rfkill_unregister(rfk);
-	rfkill_destroy(rfk);
-}
-
-static ssize_t get_performance_level(struct device *dev,
-				     struct device_attribute *attr, char *buf)
-{
-	struct sabi_retval sretval;
-	int retval;
-	int i;
-
-	/* Read the state */
-	retval = sabi_get_command(sabi_config->commands.get_performance_level,
-				  &sretval);
-	if (retval)
-		return retval;
-
-	/* The logic is backwards, yeah, lots of fun... */
-	for (i = 0; sabi_config->performance_levels[i].name; ++i) {
-		if (sretval.retval[0] == sabi_config->performance_levels[i].value)
-			return sprintf(buf, "%s\n", sabi_config->performance_levels[i].name);
-	}
-	return sprintf(buf, "%s\n", "unknown");
-}
-
-static ssize_t set_performance_level(struct device *dev,
-				struct device_attribute *attr, const char *buf,
-				size_t count)
-{
-	if (count >= 1) {
-		int i;
-		for (i = 0; sabi_config->performance_levels[i].name; ++i) {
-			const struct sabi_performance_level *level =
-				&sabi_config->performance_levels[i];
-			if (!strncasecmp(level->name, buf, strlen(level->name))) {
-				sabi_set_command(sabi_config->commands.set_performance_level,
-						 level->value);
-				break;
-			}
-		}
-		if (!sabi_config->performance_levels[i].name)
-			return -EINVAL;
-	}
-	return count;
-}
-static DEVICE_ATTR(performance_level, S_IWUSR | S_IRUGO,
-		   get_performance_level, set_performance_level);
-
-
-static int __init dmi_check_cb(const struct dmi_system_id *id)
-{
-	pr_info("found laptop model '%s'\n",
-		id->ident);
-	return 0;
-}
-
-static struct dmi_system_id __initdata samsung_dmi_table[] = {
-	{
-		.ident = "N128",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR,
-					"SAMSUNG ELECTRONICS CO., LTD."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "N128"),
-			DMI_MATCH(DMI_BOARD_NAME, "N128"),
-		},
-		.callback = dmi_check_cb,
-	},
-	{
-		.ident = "N130",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR,
-					"SAMSUNG ELECTRONICS CO., LTD."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "N130"),
-			DMI_MATCH(DMI_BOARD_NAME, "N130"),
-		},
-		.callback = dmi_check_cb,
-	},
-	{
-		.ident = "X125",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR,
-					"SAMSUNG ELECTRONICS CO., LTD."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "X125"),
-			DMI_MATCH(DMI_BOARD_NAME, "X125"),
-		},
-		.callback = dmi_check_cb,
-	},
-	{
-		.ident = "X120/X170",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR,
-					"SAMSUNG ELECTRONICS CO., LTD."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "X120/X170"),
-			DMI_MATCH(DMI_BOARD_NAME, "X120/X170"),
-		},
-		.callback = dmi_check_cb,
-	},
-	{
-		.ident = "NC10",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR,
-					"SAMSUNG ELECTRONICS CO., LTD."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "NC10"),
-			DMI_MATCH(DMI_BOARD_NAME, "NC10"),
-		},
-		.callback = dmi_check_cb,
-	},
-		{
-		.ident = "NP-Q45",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR,
-					"SAMSUNG ELECTRONICS CO., LTD."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "SQ45S70S"),
-			DMI_MATCH(DMI_BOARD_NAME, "SQ45S70S"),
-		},
-		.callback = dmi_check_cb,
-		},
-	{
-		.ident = "X360",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR,
-					"SAMSUNG ELECTRONICS CO., LTD."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "X360"),
-			DMI_MATCH(DMI_BOARD_NAME, "X360"),
-		},
-		.callback = dmi_check_cb,
-	},
-	{
-		.ident = "R410 Plus",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR,
-					"SAMSUNG ELECTRONICS CO., LTD."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "R410P"),
-			DMI_MATCH(DMI_BOARD_NAME, "R460"),
-		},
-		.callback = dmi_check_cb,
-	},
-	{
-		.ident = "R518",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR,
-					"SAMSUNG ELECTRONICS CO., LTD."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "R518"),
-			DMI_MATCH(DMI_BOARD_NAME, "R518"),
-		},
-		.callback = dmi_check_cb,
-	},
-	{
-		.ident = "R519/R719",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR,
-					"SAMSUNG ELECTRONICS CO., LTD."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "R519/R719"),
-			DMI_MATCH(DMI_BOARD_NAME, "R519/R719"),
-		},
-		.callback = dmi_check_cb,
-	},
-	{
-		.ident = "N150/N210/N220/N230",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR,
-					"SAMSUNG ELECTRONICS CO., LTD."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "N150/N210/N220/N230"),
-			DMI_MATCH(DMI_BOARD_NAME, "N150/N210/N220/N230"),
-		},
-		.callback = dmi_check_cb,
-	},
-	{
-		.ident = "N150P/N210P/N220P",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR,
-					"SAMSUNG ELECTRONICS CO., LTD."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "N150P/N210P/N220P"),
-			DMI_MATCH(DMI_BOARD_NAME, "N150P/N210P/N220P"),
-		},
-		.callback = dmi_check_cb,
-	},
-	{
-		.ident = "R530/R730",
-		.matches = {
-		      DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
-		      DMI_MATCH(DMI_PRODUCT_NAME, "R530/R730"),
-		      DMI_MATCH(DMI_BOARD_NAME, "R530/R730"),
-		},
-		.callback = dmi_check_cb,
-	},
-	{
-		.ident = "NF110/NF210/NF310",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "NF110/NF210/NF310"),
-			DMI_MATCH(DMI_BOARD_NAME, "NF110/NF210/NF310"),
-		},
-		.callback = dmi_check_cb,
-	},
-	{
-		.ident = "N145P/N250P/N260P",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "N145P/N250P/N260P"),
-			DMI_MATCH(DMI_BOARD_NAME, "N145P/N250P/N260P"),
-		},
-		.callback = dmi_check_cb,
-	},
-	{
-		.ident = "R70/R71",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR,
-					"SAMSUNG ELECTRONICS CO., LTD."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "R70/R71"),
-			DMI_MATCH(DMI_BOARD_NAME, "R70/R71"),
-		},
-		.callback = dmi_check_cb,
-	},
-	{
-		.ident = "P460",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "P460"),
-			DMI_MATCH(DMI_BOARD_NAME, "P460"),
-		},
-		.callback = dmi_check_cb,
-	},
-	{ },
-};
-MODULE_DEVICE_TABLE(dmi, samsung_dmi_table);
-
-static int find_signature(void __iomem *memcheck, const char *testStr)
-{
-	int i = 0;
-	int loca;
-
-	for (loca = 0; loca < 0xffff; loca++) {
-		char temp = readb(memcheck + loca);
-
-		if (temp == testStr[i]) {
-			if (i == strlen(testStr)-1)
-				break;
-			++i;
-		} else {
-			i = 0;
-		}
-	}
-	return loca;
-}
-
-static int __init samsung_init(void)
-{
-	struct backlight_properties props;
-	struct sabi_retval sretval;
-	unsigned int ifaceP;
-	int i;
-	int loca;
-	int retval;
-
-	mutex_init(&sabi_mutex);
-
-	if (!force && !dmi_check_system(samsung_dmi_table))
-		return -ENODEV;
-
-	f0000_segment = ioremap_nocache(0xf0000, 0xffff);
-	if (!f0000_segment) {
-		pr_err("Can't map the segment at 0xf0000\n");
-		return -EINVAL;
-	}
-
-	/* Try to find one of the signatures in memory to find the header */
-	for (i = 0; sabi_configs[i].test_string != 0; ++i) {
-		sabi_config = &sabi_configs[i];
-		loca = find_signature(f0000_segment, sabi_config->test_string);
-		if (loca != 0xffff)
-			break;
-	}
-
-	if (loca == 0xffff) {
-		pr_err("This computer does not support SABI\n");
-		goto error_no_signature;
-	}
-
-	/* point to the SMI port Number */
-	loca += 1;
-	sabi = (f0000_segment + loca);
-
-	if (debug) {
-		printk(KERN_DEBUG "This computer supports SABI==%x\n",
-			loca + 0xf0000 - 6);
-		printk(KERN_DEBUG "SABI header:\n");
-		printk(KERN_DEBUG " SMI Port Number = 0x%04x\n",
-			readw(sabi + sabi_config->header_offsets.port));
-		printk(KERN_DEBUG " SMI Interface Function = 0x%02x\n",
-			readb(sabi + sabi_config->header_offsets.iface_func));
-		printk(KERN_DEBUG " SMI enable memory buffer = 0x%02x\n",
-			readb(sabi + sabi_config->header_offsets.en_mem));
-		printk(KERN_DEBUG " SMI restore memory buffer = 0x%02x\n",
-			readb(sabi + sabi_config->header_offsets.re_mem));
-		printk(KERN_DEBUG " SABI data offset = 0x%04x\n",
-			readw(sabi + sabi_config->header_offsets.data_offset));
-		printk(KERN_DEBUG " SABI data segment = 0x%04x\n",
-			readw(sabi + sabi_config->header_offsets.data_segment));
-	}
-
-	/* Get a pointer to the SABI Interface */
-	ifaceP = (readw(sabi + sabi_config->header_offsets.data_segment) & 0x0ffff) << 4;
-	ifaceP += readw(sabi + sabi_config->header_offsets.data_offset) & 0x0ffff;
-	sabi_iface = ioremap_nocache(ifaceP, 16);
-	if (!sabi_iface) {
-		pr_err("Can't remap %x\n", ifaceP);
-		goto exit;
-	}
-	if (debug) {
-		printk(KERN_DEBUG "ifaceP = 0x%08x\n", ifaceP);
-		printk(KERN_DEBUG "sabi_iface = %p\n", sabi_iface);
-
-		test_backlight();
-		test_wireless();
-
-		retval = sabi_get_command(sabi_config->commands.get_brightness,
-					  &sretval);
-		printk(KERN_DEBUG "brightness = 0x%02x\n", sretval.retval[0]);
-	}
-
-	/* Turn on "Linux" mode in the BIOS */
-	if (sabi_config->commands.set_linux != 0xff) {
-		retval = sabi_set_command(sabi_config->commands.set_linux,
-					  0x81);
-		if (retval) {
-			pr_warn("Linux mode was not set!\n");
-			goto error_no_platform;
-		}
-	}
-
-	/* knock up a platform device to hang stuff off of */
-	sdev = platform_device_register_simple("samsung", -1, NULL, 0);
-	if (IS_ERR(sdev))
-		goto error_no_platform;
-
-	/* create a backlight device to talk to this one */
-	memset(&props, 0, sizeof(struct backlight_properties));
-	props.type = BACKLIGHT_PLATFORM;
-	props.max_brightness = sabi_config->max_brightness;
-	backlight_device = backlight_device_register("samsung", &sdev->dev,
-						     NULL, &backlight_ops,
-						     &props);
-	if (IS_ERR(backlight_device))
-		goto error_no_backlight;
-
-	backlight_device->props.brightness = read_brightness();
-	backlight_device->props.power = FB_BLANK_UNBLANK;
-	backlight_update_status(backlight_device);
-
-	retval = init_wireless(sdev);
-	if (retval)
-		goto error_no_rfk;
-
-	retval = device_create_file(&sdev->dev, &dev_attr_performance_level);
-	if (retval)
-		goto error_file_create;
-
-exit:
-	return 0;
-
-error_file_create:
-	destroy_wireless();
-
-error_no_rfk:
-	backlight_device_unregister(backlight_device);
-
-error_no_backlight:
-	platform_device_unregister(sdev);
-
-error_no_platform:
-	iounmap(sabi_iface);
-
-error_no_signature:
-	iounmap(f0000_segment);
-	return -EINVAL;
-}
-
-static void __exit samsung_exit(void)
-{
-	/* Turn off "Linux" mode in the BIOS */
-	if (sabi_config->commands.set_linux != 0xff)
-		sabi_set_command(sabi_config->commands.set_linux, 0x80);
-
-	device_remove_file(&sdev->dev, &dev_attr_performance_level);
-	backlight_device_unregister(backlight_device);
-	destroy_wireless();
-	iounmap(sabi_iface);
-	iounmap(f0000_segment);
-	platform_device_unregister(sdev);
-}
-
-module_init(samsung_init);
-module_exit(samsung_exit);
-
-MODULE_AUTHOR("Greg Kroah-Hartman <gregkh@suse.de>");
-MODULE_DESCRIPTION("Samsung Backlight driver");
-MODULE_LICENSE("GPL");
diff --git a/drivers/staging/sbe-2t3e3/dc.c b/drivers/staging/sbe-2t3e3/dc.c
index 126a972..9dc4ec2 100644
--- a/drivers/staging/sbe-2t3e3/dc.c
+++ b/drivers/staging/sbe-2t3e3/dc.c
@@ -341,10 +341,6 @@
 		sc->ether.tx_ring = kzalloc(SBE_2T3E3_TX_DESC_RING_SIZE *
 					    sizeof(t3e3_tx_desc_t), GFP_KERNEL);
 	if (sc->ether.tx_ring == NULL) {
-#ifdef T3E3_USE_CONTIGMALLOC
-		t3e3_contigmemory_size = SBE_2T3E3_RX_DESC_RING_SIZE *
-			sizeof(t3e3_rx_desc_t);
-#endif
 		kfree(sc->ether.rx_ring);
 		sc->ether.rx_ring = NULL;
 		dev_err(&sc->pdev->dev, "SBE 2T3E3: no buffer space for RX ring\n");
@@ -366,16 +362,8 @@
 					dev_kfree_skb_any(sc->ether.rx_data[j]);
 					sc->ether.rx_data[j] = NULL;
 				}
-#ifdef T3E3_USE_CONTIGMALLOC
-				t3e3_contigmemory_size = SBE_2T3E3_RX_DESC_RING_SIZE *
-					sizeof(t3e3_rx_desc_t);
-#endif
 				kfree(sc->ether.rx_ring);
 				sc->ether.rx_ring = NULL;
-#ifdef T3E3_USE_CONTIGMALLOC
-				t3e3_contigmemory_size = SBE_2T3E3_TX_DESC_RING_SIZE *
-					sizeof(t3e3_tx_desc_t);
-#endif
 				kfree(sc->ether.tx_ring);
 				sc->ether.tx_ring = NULL;
 				dev_err(&sc->pdev->dev, "SBE 2T3E3: token_alloc err:"
@@ -454,23 +442,10 @@
 		}
 	}
 
-	if (sc->ether.rx_ring != NULL) {
-#ifdef T3E3_USE_CONTIGMALLOC
-		t3e3_contigmemory_size = SBE_2T3E3_RX_DESC_RING_SIZE *
-			sizeof(t3e3_rx_desc_t);
-#endif
-		kfree(sc->ether.rx_ring);
-		sc->ether.rx_ring = NULL;
-	}
-
-	if (sc->ether.tx_ring != NULL) {
-#ifdef T3E3_USE_CONTIGMALLOC
-		t3e3_contigmemory_size = SBE_2T3E3_TX_DESC_RING_SIZE *
-			sizeof(t3e3_tx_desc_t);
-#endif
-		kfree(sc->ether.tx_ring);
-		sc->ether.tx_ring = NULL;
-	}
+	kfree(sc->ether.rx_ring);
+	sc->ether.rx_ring = NULL;
+	kfree(sc->ether.tx_ring);
+	sc->ether.tx_ring = NULL;
 }
 
 
diff --git a/drivers/staging/tty/istallion.c b/drivers/staging/tty/istallion.c
index 0b26627..ca18cbf 100644
--- a/drivers/staging/tty/istallion.c
+++ b/drivers/staging/tty/istallion.c
@@ -186,7 +186,6 @@
  *	re-used for each stats call.
  */
 static comstats_t	stli_comstats;
-static combrd_t		stli_brdstats;
 static struct asystats	stli_cdkstats;
 
 /*****************************************************************************/
@@ -4005,6 +4004,7 @@
 {
 	struct stlibrd *brdp;
 	unsigned int i;
+	combrd_t stli_brdstats;
 
 	if (copy_from_user(&stli_brdstats, bp, sizeof(combrd_t)))
 		return -EFAULT;
diff --git a/drivers/staging/winbond/mto.c b/drivers/staging/winbond/mto.c
index c03e501..5250217 100644
--- a/drivers/staging/winbond/mto.c
+++ b/drivers/staging/winbond/mto.c
@@ -40,14 +40,9 @@
 	2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108
 };
 
-static int TotalTxPkt;
-static int TotalTxPktRetry;
 /* this record the retry rate at different data rate */
 static int retryrate_rec[MTO_MAX_DATA_RATE_LEVELS];
 
-static int PeriodTotalTxPkt;
-static int PeriodTotalTxPktRetry;
-
 static u8 boSparseTxTraffic;
 
 void MTO_Init(struct wbsoft_priv *adapter);
@@ -174,9 +169,4 @@
 		MTO_HAL()->dto_tx_retry_count += index;
 		MTO_HAL()->dto_tx_frag_count += (index + 1);
 	}
-	TotalTxPkt++;
-	TotalTxPktRetry += (index + 1);
-
-	PeriodTotalTxPkt++;
-	PeriodTotalTxPktRetry += (index + 1);
 }
diff --git a/drivers/staging/winbond/phy_calibration.c b/drivers/staging/winbond/phy_calibration.c
index 09844db..79e53e4 100644
--- a/drivers/staging/winbond/phy_calibration.c
+++ b/drivers/staging/winbond/phy_calibration.c
@@ -27,10 +27,10 @@
 #define DEG2RAD(X)      0.017453 * (X)
 
 static const s32 Angles[] = {
-    FIXED(DEG2RAD(45.0)),     FIXED(DEG2RAD(26.565)),   FIXED(DEG2RAD(14.0362)),
-    FIXED(DEG2RAD(7.12502)),  FIXED(DEG2RAD(3.57633)),  FIXED(DEG2RAD(1.78991)),
-    FIXED(DEG2RAD(0.895174)), FIXED(DEG2RAD(0.447614)), FIXED(DEG2RAD(0.223811)),
-    FIXED(DEG2RAD(0.111906)), FIXED(DEG2RAD(0.055953)), FIXED(DEG2RAD(0.027977))
+	FIXED(DEG2RAD(45.0)),     FIXED(DEG2RAD(26.565)),   FIXED(DEG2RAD(14.0362)),
+	FIXED(DEG2RAD(7.12502)),  FIXED(DEG2RAD(3.57633)),  FIXED(DEG2RAD(1.78991)),
+	FIXED(DEG2RAD(0.895174)), FIXED(DEG2RAD(0.447614)), FIXED(DEG2RAD(0.223811)),
+	FIXED(DEG2RAD(0.111906)), FIXED(DEG2RAD(0.055953)), FIXED(DEG2RAD(0.027977))
 };
 
 /****************** LOCAL FUNCTION DECLARATION SECTION **********************/
diff --git a/drivers/staging/winbond/wb35tx.c b/drivers/staging/winbond/wb35tx.c
index 44fc3fe..5df39d4 100644
--- a/drivers/staging/winbond/wb35tx.c
+++ b/drivers/staging/winbond/wb35tx.c
@@ -291,7 +291,6 @@
 	if (atomic_inc_return(&pWb35Tx->TxResultCount) == 1) {
 		pWb35Tx->EP2vm_state = VM_RUNNING;
 		Wb35Tx_EP2VM(adapter);
-	}
-	else
+	} else
 		atomic_dec(&pWb35Tx->TxResultCount);
 }
diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
index 41b6e51..006489d 100644
--- a/drivers/usb/Kconfig
+++ b/drivers/usb/Kconfig
@@ -66,6 +66,7 @@
 	default y if ARCH_VT8500
 	default y if PLAT_SPEAR
 	default y if ARCH_MSM
+	default y if MICROBLAZE
 	default PCI
 
 # ARM SA1111 chips have a non-PCI based "OHCI-compatible" USB host interface.
diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
index a3d2e23..96fdfb8 100644
--- a/drivers/usb/core/devices.c
+++ b/drivers/usb/core/devices.c
@@ -221,7 +221,7 @@
 		break;
 	case USB_ENDPOINT_XFER_INT:
 		type = "Int.";
-		if (speed == USB_SPEED_HIGH)
+		if (speed == USB_SPEED_HIGH || speed == USB_SPEED_SUPER)
 			interval = 1 << (desc->bInterval - 1);
 		else
 			interval = desc->bInterval;
@@ -229,7 +229,8 @@
 	default:	/* "can't happen" */
 		return start;
 	}
-	interval *= (speed == USB_SPEED_HIGH) ? 125 : 1000;
+	interval *= (speed == USB_SPEED_HIGH ||
+		     speed == USB_SPEED_SUPER) ? 125 : 1000;
 	if (interval % 1000)
 		unit = 'u';
 	else {
@@ -542,8 +543,9 @@
 	if (level == 0) {
 		int	max;
 
-		/* high speed reserves 80%, full/low reserves 90% */
-		if (usbdev->speed == USB_SPEED_HIGH)
+		/* super/high speed reserves 80%, full/low reserves 90% */
+		if (usbdev->speed == USB_SPEED_HIGH ||
+		    usbdev->speed == USB_SPEED_SUPER)
 			max = 800;
 		else
 			max = FRAME_TIME_MAX_USECS_ALLOC;
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 8eed05d2..77a7fae 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1908,7 +1908,7 @@
 
 	/* Streams only apply to bulk endpoints. */
 	for (i = 0; i < num_eps; i++)
-		if (!usb_endpoint_xfer_bulk(&eps[i]->desc))
+		if (!eps[i] || !usb_endpoint_xfer_bulk(&eps[i]->desc))
 			return;
 
 	hcd->driver->free_streams(hcd, dev, eps, num_eps, mem_flags);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 8fb7549..93720bdc 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2285,7 +2285,17 @@
 	}
 
 	/* see 7.1.7.6 */
-	status = set_port_feature(hub->hdev, port1, USB_PORT_FEAT_SUSPEND);
+	/* Clear PORT_POWER if it's a USB3.0 device connected to USB 3.0
+	 * external hub.
+	 * FIXME: this is a temporary workaround to make the system able
+	 * to suspend/resume.
+	 */
+	if ((hub->hdev->parent != NULL) && hub_is_superspeed(hub->hdev))
+		status = clear_port_feature(hub->hdev, port1,
+						USB_PORT_FEAT_POWER);
+	else
+		status = set_port_feature(hub->hdev, port1,
+						USB_PORT_FEAT_SUSPEND);
 	if (status) {
 		dev_dbg(hub->intfdev, "can't suspend port %d, status %d\n",
 				port1, status);
diff --git a/drivers/usb/gadget/f_audio.c b/drivers/usb/gadget/f_audio.c
index 9abecfd..0111f8a 100644
--- a/drivers/usb/gadget/f_audio.c
+++ b/drivers/usb/gadget/f_audio.c
@@ -706,6 +706,7 @@
 	struct f_audio		*audio = func_to_audio(f);
 
 	usb_free_descriptors(f->descriptors);
+	usb_free_descriptors(f->hs_descriptors);
 	kfree(audio);
 }
 
diff --git a/drivers/usb/gadget/f_eem.c b/drivers/usb/gadget/f_eem.c
index 95dd4662..b3c3042 100644
--- a/drivers/usb/gadget/f_eem.c
+++ b/drivers/usb/gadget/f_eem.c
@@ -314,6 +314,9 @@
 
 static void eem_cmd_complete(struct usb_ep *ep, struct usb_request *req)
 {
+	struct sk_buff *skb = (struct sk_buff *)req->context;
+
+	dev_kfree_skb_any(skb);
 }
 
 /*
@@ -428,10 +431,11 @@
 				skb_trim(skb2, len);
 				put_unaligned_le16(BIT(15) | BIT(11) | len,
 							skb_push(skb2, 2));
-				skb_copy_bits(skb, 0, req->buf, skb->len);
-				req->length = skb->len;
+				skb_copy_bits(skb2, 0, req->buf, skb2->len);
+				req->length = skb2->len;
 				req->complete = eem_cmd_complete;
 				req->zero = 1;
+				req->context = skb2;
 				if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC))
 					DBG(cdev, "echo response queue fail\n");
 				break;
diff --git a/drivers/usb/gadget/fsl_qe_udc.c b/drivers/usb/gadget/fsl_qe_udc.c
index aee7e3c..36613b3 100644
--- a/drivers/usb/gadget/fsl_qe_udc.c
+++ b/drivers/usb/gadget/fsl_qe_udc.c
@@ -1148,6 +1148,12 @@
 static int txcomplete(struct qe_ep *ep, unsigned char restart)
 {
 	if (ep->tx_req != NULL) {
+		struct qe_req *req = ep->tx_req;
+		unsigned zlp = 0, last_len = 0;
+
+		last_len = min_t(unsigned, req->req.length - ep->sent,
+				ep->ep.maxpacket);
+
 		if (!restart) {
 			int asent = ep->last;
 			ep->sent += asent;
@@ -1156,9 +1162,18 @@
 			ep->last = 0;
 		}
 
+		/* zlp needed when req->re.zero is set */
+		if (req->req.zero) {
+			if (last_len == 0 ||
+				(req->req.length % ep->ep.maxpacket) != 0)
+				zlp = 0;
+			else
+				zlp = 1;
+		} else
+			zlp = 0;
+
 		/* a request already were transmitted completely */
-		if ((ep->tx_req->req.length - ep->sent) <= 0) {
-			ep->tx_req->req.actual = (unsigned int)ep->sent;
+		if (((ep->tx_req->req.length - ep->sent) <= 0) && !zlp) {
 			done(ep, ep->tx_req, 0);
 			ep->tx_req = NULL;
 			ep->last = 0;
@@ -1191,6 +1206,7 @@
 	buf = (u8 *)ep->tx_req->req.buf + ep->sent;
 	if (buf && size) {
 		ep->last = size;
+		ep->tx_req->req.actual += size;
 		frame_set_data(frame, buf);
 		frame_set_length(frame, size);
 		frame_set_status(frame, FRAME_OK);
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index 3ed73f4..a01383f 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -386,8 +386,10 @@
 
 	/* halt any endpoint by doing a "wrong direction" i/o call */
 	if (usb_endpoint_dir_in(&data->desc)) {
-		if (usb_endpoint_xfer_isoc(&data->desc))
+		if (usb_endpoint_xfer_isoc(&data->desc)) {
+			mutex_unlock(&data->lock);
 			return -EINVAL;
+		}
 		DBG (data->dev, "%s halt\n", data->name);
 		spin_lock_irq (&data->dev->lock);
 		if (likely (data->ep != NULL))
diff --git a/drivers/usb/gadget/pch_udc.c b/drivers/usb/gadget/pch_udc.c
index 3e4b35e..68dbcc3 100644
--- a/drivers/usb/gadget/pch_udc.c
+++ b/drivers/usb/gadget/pch_udc.c
@@ -1608,7 +1608,7 @@
 		return -EINVAL;
 	if (!dev->driver || (dev->gadget.speed == USB_SPEED_UNKNOWN))
 		return -ESHUTDOWN;
-	spin_lock_irqsave(&ep->dev->lock, iflags);
+	spin_lock_irqsave(&dev->lock, iflags);
 	/* map the buffer for dma */
 	if (usbreq->length &&
 	    ((usbreq->dma == DMA_ADDR_INVALID) || !usbreq->dma)) {
@@ -1625,8 +1625,10 @@
 							     DMA_FROM_DEVICE);
 		} else {
 			req->buf = kzalloc(usbreq->length, GFP_ATOMIC);
-			if (!req->buf)
-				return -ENOMEM;
+			if (!req->buf) {
+				retval = -ENOMEM;
+				goto probe_end;
+			}
 			if (ep->in) {
 				memcpy(req->buf, usbreq->buf, usbreq->length);
 				req->dma = dma_map_single(&dev->pdev->dev,
diff --git a/drivers/usb/gadget/r8a66597-udc.c b/drivers/usb/gadget/r8a66597-udc.c
index 0151185..6dcc1f6 100644
--- a/drivers/usb/gadget/r8a66597-udc.c
+++ b/drivers/usb/gadget/r8a66597-udc.c
@@ -1083,7 +1083,9 @@
 
 	if (dvsq == DS_DFLT) {
 		/* bus reset */
+		spin_unlock(&r8a66597->lock);
 		r8a66597->driver->disconnect(&r8a66597->gadget);
+		spin_lock(&r8a66597->lock);
 		r8a66597_update_usb_speed(r8a66597);
 	}
 	if (r8a66597->old_dvsq == DS_CNFG && dvsq != DS_CNFG)
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 98ded66..42abd0f 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -1247,24 +1247,27 @@
 
 static void scan_async (struct ehci_hcd *ehci)
 {
+	bool			stopped;
 	struct ehci_qh		*qh;
 	enum ehci_timer_action	action = TIMER_IO_WATCHDOG;
 
 	ehci->stamp = ehci_readl(ehci, &ehci->regs->frame_index);
 	timer_action_done (ehci, TIMER_ASYNC_SHRINK);
 rescan:
+	stopped = !HC_IS_RUNNING(ehci_to_hcd(ehci)->state);
 	qh = ehci->async->qh_next.qh;
 	if (likely (qh != NULL)) {
 		do {
 			/* clean any finished work for this qh */
-			if (!list_empty (&qh->qtd_list)
-					&& qh->stamp != ehci->stamp) {
+			if (!list_empty(&qh->qtd_list) && (stopped ||
+					qh->stamp != ehci->stamp)) {
 				int temp;
 
 				/* unlinks could happen here; completion
 				 * reporting drops the lock.  rescan using
 				 * the latest schedule, but don't rescan
-				 * qhs we already finished (no looping).
+				 * qhs we already finished (no looping)
+				 * unless the controller is stopped.
 				 */
 				qh = qh_get (qh);
 				qh->stamp = ehci->stamp;
@@ -1285,9 +1288,9 @@
 			 */
 			if (list_empty(&qh->qtd_list)
 					&& qh->qh_state == QH_STATE_LINKED) {
-				if (!ehci->reclaim
-					&& ((ehci->stamp - qh->stamp) & 0x1fff)
-						>= (EHCI_SHRINK_FRAMES * 8))
+				if (!ehci->reclaim && (stopped ||
+					((ehci->stamp - qh->stamp) & 0x1fff)
+						>= EHCI_SHRINK_FRAMES * 8))
 					start_unlink_async(ehci, qh);
 				else
 					action = TIMER_ASYNC_SHRINK;
diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c
index f50e84a..795345a 100644
--- a/drivers/usb/host/isp1760-hcd.c
+++ b/drivers/usb/host/isp1760-hcd.c
@@ -295,7 +295,7 @@
 	}
 
 	dev_err(hcd->self.controller,
-				"%s: Can not allocate %lu bytes of memory\n"
+				"%s: Cannot allocate %zu bytes of memory\n"
 				"Current memory map:\n",
 				__func__, qtd->length);
 	for (i = 0; i < BLOCKS; i++) {
diff --git a/drivers/usb/host/ohci-au1xxx.c b/drivers/usb/host/ohci-au1xxx.c
index 17a6043..958d985f 100644
--- a/drivers/usb/host/ohci-au1xxx.c
+++ b/drivers/usb/host/ohci-au1xxx.c
@@ -33,7 +33,7 @@
 
 #ifdef __LITTLE_ENDIAN
 #define USBH_ENABLE_INIT (USBH_ENABLE_CE | USBH_ENABLE_E | USBH_ENABLE_C)
-#elif __BIG_ENDIAN
+#elif defined(__BIG_ENDIAN)
 #define USBH_ENABLE_INIT (USBH_ENABLE_CE | USBH_ENABLE_E | USBH_ENABLE_C | \
 			  USBH_ENABLE_BE)
 #else
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 1d586d4..9b166d7 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -84,65 +84,92 @@
 {
 	u8 rev = 0;
 	unsigned long flags;
+	struct amd_chipset_info info;
+	int ret;
 
 	spin_lock_irqsave(&amd_lock, flags);
 
-	amd_chipset.probe_count++;
 	/* probe only once */
-	if (amd_chipset.probe_count > 1) {
+	if (amd_chipset.probe_count > 0) {
+		amd_chipset.probe_count++;
 		spin_unlock_irqrestore(&amd_lock, flags);
 		return amd_chipset.probe_result;
 	}
+	memset(&info, 0, sizeof(info));
+	spin_unlock_irqrestore(&amd_lock, flags);
 
-	amd_chipset.smbus_dev = pci_get_device(PCI_VENDOR_ID_ATI, 0x4385, NULL);
-	if (amd_chipset.smbus_dev) {
-		rev = amd_chipset.smbus_dev->revision;
+	info.smbus_dev = pci_get_device(PCI_VENDOR_ID_ATI, 0x4385, NULL);
+	if (info.smbus_dev) {
+		rev = info.smbus_dev->revision;
 		if (rev >= 0x40)
-			amd_chipset.sb_type = 1;
+			info.sb_type = 1;
 		else if (rev >= 0x30 && rev <= 0x3b)
-			amd_chipset.sb_type = 3;
+			info.sb_type = 3;
 	} else {
-		amd_chipset.smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
-							0x780b, NULL);
-		if (!amd_chipset.smbus_dev) {
-			spin_unlock_irqrestore(&amd_lock, flags);
-			return 0;
+		info.smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
+						0x780b, NULL);
+		if (!info.smbus_dev) {
+			ret = 0;
+			goto commit;
 		}
-		rev = amd_chipset.smbus_dev->revision;
+
+		rev = info.smbus_dev->revision;
 		if (rev >= 0x11 && rev <= 0x18)
-			amd_chipset.sb_type = 2;
+			info.sb_type = 2;
 	}
 
-	if (amd_chipset.sb_type == 0) {
-		if (amd_chipset.smbus_dev) {
-			pci_dev_put(amd_chipset.smbus_dev);
-			amd_chipset.smbus_dev = NULL;
+	if (info.sb_type == 0) {
+		if (info.smbus_dev) {
+			pci_dev_put(info.smbus_dev);
+			info.smbus_dev = NULL;
 		}
-		spin_unlock_irqrestore(&amd_lock, flags);
-		return 0;
+		ret = 0;
+		goto commit;
 	}
 
-	amd_chipset.nb_dev = pci_get_device(PCI_VENDOR_ID_AMD, 0x9601, NULL);
-	if (amd_chipset.nb_dev) {
-		amd_chipset.nb_type = 1;
+	info.nb_dev = pci_get_device(PCI_VENDOR_ID_AMD, 0x9601, NULL);
+	if (info.nb_dev) {
+		info.nb_type = 1;
 	} else {
-		amd_chipset.nb_dev = pci_get_device(PCI_VENDOR_ID_AMD,
-							0x1510, NULL);
-		if (amd_chipset.nb_dev) {
-			amd_chipset.nb_type = 2;
-		} else  {
-			amd_chipset.nb_dev = pci_get_device(PCI_VENDOR_ID_AMD,
-								0x9600, NULL);
-			if (amd_chipset.nb_dev)
-				amd_chipset.nb_type = 3;
+		info.nb_dev = pci_get_device(PCI_VENDOR_ID_AMD, 0x1510, NULL);
+		if (info.nb_dev) {
+			info.nb_type = 2;
+		} else {
+			info.nb_dev = pci_get_device(PCI_VENDOR_ID_AMD,
+						     0x9600, NULL);
+			if (info.nb_dev)
+				info.nb_type = 3;
 		}
 	}
 
-	amd_chipset.probe_result = 1;
+	ret = info.probe_result = 1;
 	printk(KERN_DEBUG "QUIRK: Enable AMD PLL fix\n");
 
-	spin_unlock_irqrestore(&amd_lock, flags);
-	return amd_chipset.probe_result;
+commit:
+
+	spin_lock_irqsave(&amd_lock, flags);
+	if (amd_chipset.probe_count > 0) {
+		/* race - someone else was faster - drop devices */
+
+		/* Mark that we where here */
+		amd_chipset.probe_count++;
+		ret = amd_chipset.probe_result;
+
+		spin_unlock_irqrestore(&amd_lock, flags);
+
+		if (info.nb_dev)
+			pci_dev_put(info.nb_dev);
+		if (info.smbus_dev)
+			pci_dev_put(info.smbus_dev);
+
+	} else {
+		/* no race - commit the result */
+		info.probe_count++;
+		amd_chipset = info;
+		spin_unlock_irqrestore(&amd_lock, flags);
+	}
+
+	return ret;
 }
 EXPORT_SYMBOL_GPL(usb_amd_find_chipset_info);
 
@@ -284,6 +311,7 @@
 
 void usb_amd_dev_put(void)
 {
+	struct pci_dev *nb, *smbus;
 	unsigned long flags;
 
 	spin_lock_irqsave(&amd_lock, flags);
@@ -294,20 +322,23 @@
 		return;
 	}
 
-	if (amd_chipset.nb_dev) {
-		pci_dev_put(amd_chipset.nb_dev);
-		amd_chipset.nb_dev = NULL;
-	}
-	if (amd_chipset.smbus_dev) {
-		pci_dev_put(amd_chipset.smbus_dev);
-		amd_chipset.smbus_dev = NULL;
-	}
+	/* save them to pci_dev_put outside of spinlock */
+	nb    = amd_chipset.nb_dev;
+	smbus = amd_chipset.smbus_dev;
+
+	amd_chipset.nb_dev = NULL;
+	amd_chipset.smbus_dev = NULL;
 	amd_chipset.nb_type = 0;
 	amd_chipset.sb_type = 0;
 	amd_chipset.isoc_reqs = 0;
 	amd_chipset.probe_result = 0;
 
 	spin_unlock_irqrestore(&amd_lock, flags);
+
+	if (nb)
+		pci_dev_put(nb);
+	if (smbus)
+		pci_dev_put(smbus);
 }
 EXPORT_SYMBOL_GPL(usb_amd_dev_put);
 
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index a003e79..627f343 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -846,7 +846,7 @@
 		 * Skip ports that don't have known speeds, or have duplicate
 		 * Extended Capabilities port speed entries.
 		 */
-		if (port_speed == 0 || port_speed == -1)
+		if (port_speed == 0 || port_speed == DUPLICATE_ENTRY)
 			continue;
 
 		/*
@@ -974,6 +974,47 @@
 	return 0;
 }
 
+/*
+ * Convert interval expressed as 2^(bInterval - 1) == interval into
+ * straight exponent value 2^n == interval.
+ *
+ */
+static unsigned int xhci_parse_exponent_interval(struct usb_device *udev,
+		struct usb_host_endpoint *ep)
+{
+	unsigned int interval;
+
+	interval = clamp_val(ep->desc.bInterval, 1, 16) - 1;
+	if (interval != ep->desc.bInterval - 1)
+		dev_warn(&udev->dev,
+			 "ep %#x - rounding interval to %d microframes\n",
+			 ep->desc.bEndpointAddress,
+			 1 << interval);
+
+	return interval;
+}
+
+/*
+ * Convert bInterval expressed in frames (in 1-255 range) to exponent of
+ * microframes, rounded down to nearest power of 2.
+ */
+static unsigned int xhci_parse_frame_interval(struct usb_device *udev,
+		struct usb_host_endpoint *ep)
+{
+	unsigned int interval;
+
+	interval = fls(8 * ep->desc.bInterval) - 1;
+	interval = clamp_val(interval, 3, 10);
+	if ((1 << interval) != 8 * ep->desc.bInterval)
+		dev_warn(&udev->dev,
+			 "ep %#x - rounding interval to %d microframes, ep desc says %d microframes\n",
+			 ep->desc.bEndpointAddress,
+			 1 << interval,
+			 8 * ep->desc.bInterval);
+
+	return interval;
+}
+
 /* Return the polling or NAK interval.
  *
  * The polling interval is expressed in "microframes".  If xHCI's Interval field
@@ -982,7 +1023,7 @@
  * The NAK interval is one NAK per 1 to 255 microframes, or no NAKs if interval
  * is set to 0.
  */
-static inline unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
+static unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
 		struct usb_host_endpoint *ep)
 {
 	unsigned int interval = 0;
@@ -991,45 +1032,38 @@
 	case USB_SPEED_HIGH:
 		/* Max NAK rate */
 		if (usb_endpoint_xfer_control(&ep->desc) ||
-				usb_endpoint_xfer_bulk(&ep->desc))
+		    usb_endpoint_xfer_bulk(&ep->desc)) {
 			interval = ep->desc.bInterval;
+			break;
+		}
 		/* Fall through - SS and HS isoc/int have same decoding */
+
 	case USB_SPEED_SUPER:
 		if (usb_endpoint_xfer_int(&ep->desc) ||
-				usb_endpoint_xfer_isoc(&ep->desc)) {
-			if (ep->desc.bInterval == 0)
-				interval = 0;
-			else
-				interval = ep->desc.bInterval - 1;
-			if (interval > 15)
-				interval = 15;
-			if (interval != ep->desc.bInterval + 1)
-				dev_warn(&udev->dev, "ep %#x - rounding interval to %d microframes\n",
-						ep->desc.bEndpointAddress, 1 << interval);
+		    usb_endpoint_xfer_isoc(&ep->desc)) {
+			interval = xhci_parse_exponent_interval(udev, ep);
 		}
 		break;
-	/* Convert bInterval (in 1-255 frames) to microframes and round down to
-	 * nearest power of 2.
-	 */
+
 	case USB_SPEED_FULL:
+		if (usb_endpoint_xfer_int(&ep->desc)) {
+			interval = xhci_parse_exponent_interval(udev, ep);
+			break;
+		}
+		/*
+		 * Fall through for isochronous endpoint interval decoding
+		 * since it uses the same rules as low speed interrupt
+		 * endpoints.
+		 */
+
 	case USB_SPEED_LOW:
 		if (usb_endpoint_xfer_int(&ep->desc) ||
-				usb_endpoint_xfer_isoc(&ep->desc)) {
-			interval = fls(8*ep->desc.bInterval) - 1;
-			if (interval > 10)
-				interval = 10;
-			if (interval < 3)
-				interval = 3;
-			if ((1 << interval) != 8*ep->desc.bInterval)
-				dev_warn(&udev->dev,
-						"ep %#x - rounding interval"
-						" to %d microframes, "
-						"ep desc says %d microframes\n",
-						ep->desc.bEndpointAddress,
-						1 << interval,
-						8*ep->desc.bInterval);
+		    usb_endpoint_xfer_isoc(&ep->desc)) {
+
+			interval = xhci_parse_frame_interval(udev, ep);
 		}
 		break;
+
 	default:
 		BUG();
 	}
@@ -1041,7 +1075,7 @@
  * transaction opportunities per microframe", but that goes in the Max Burst
  * endpoint context field.
  */
-static inline u32 xhci_get_endpoint_mult(struct usb_device *udev,
+static u32 xhci_get_endpoint_mult(struct usb_device *udev,
 		struct usb_host_endpoint *ep)
 {
 	if (udev->speed != USB_SPEED_SUPER ||
@@ -1050,7 +1084,7 @@
 	return ep->ss_ep_comp.bmAttributes;
 }
 
-static inline u32 xhci_get_endpoint_type(struct usb_device *udev,
+static u32 xhci_get_endpoint_type(struct usb_device *udev,
 		struct usb_host_endpoint *ep)
 {
 	int in;
@@ -1084,7 +1118,7 @@
  * Basically, this is the maxpacket size, multiplied by the burst size
  * and mult size.
  */
-static inline u32 xhci_get_max_esit_payload(struct xhci_hcd *xhci,
+static u32 xhci_get_max_esit_payload(struct xhci_hcd *xhci,
 		struct usb_device *udev,
 		struct usb_host_endpoint *ep)
 {
@@ -1727,12 +1761,12 @@
 			 * found a similar duplicate.
 			 */
 			if (xhci->port_array[i] != major_revision &&
-				xhci->port_array[i] != (u8) -1) {
+				xhci->port_array[i] != DUPLICATE_ENTRY) {
 				if (xhci->port_array[i] == 0x03)
 					xhci->num_usb3_ports--;
 				else
 					xhci->num_usb2_ports--;
-				xhci->port_array[i] = (u8) -1;
+				xhci->port_array[i] = DUPLICATE_ENTRY;
 			}
 			/* FIXME: Should we disable the port? */
 			continue;
@@ -1831,7 +1865,7 @@
 		for (i = 0; i < num_ports; i++) {
 			if (xhci->port_array[i] == 0x03 ||
 					xhci->port_array[i] == 0 ||
-					xhci->port_array[i] == -1)
+					xhci->port_array[i] == DUPLICATE_ENTRY)
 				continue;
 
 			xhci->usb2_ports[port_index] =
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index ceea9f3..a10494c 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -114,6 +114,10 @@
 	if (pdev->vendor == PCI_VENDOR_ID_NEC)
 		xhci->quirks |= XHCI_NEC_HOST;
 
+	/* AMD PLL quirk */
+	if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_find_chipset_info())
+		xhci->quirks |= XHCI_AMD_PLL_FIX;
+
 	/* Make sure the HC is halted. */
 	retval = xhci_halt(xhci);
 	if (retval)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index cfc1ad9..7437386 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -93,7 +93,7 @@
 /* Does this link TRB point to the first segment in a ring,
  * or was the previous TRB the last TRB on the last segment in the ERST?
  */
-static inline bool last_trb_on_last_seg(struct xhci_hcd *xhci, struct xhci_ring *ring,
+static bool last_trb_on_last_seg(struct xhci_hcd *xhci, struct xhci_ring *ring,
 		struct xhci_segment *seg, union xhci_trb *trb)
 {
 	if (ring == xhci->event_ring)
@@ -107,7 +107,7 @@
  * segment?  I.e. would the updated event TRB pointer step off the end of the
  * event seg?
  */
-static inline int last_trb(struct xhci_hcd *xhci, struct xhci_ring *ring,
+static int last_trb(struct xhci_hcd *xhci, struct xhci_ring *ring,
 		struct xhci_segment *seg, union xhci_trb *trb)
 {
 	if (ring == xhci->event_ring)
@@ -116,7 +116,7 @@
 		return (trb->link.control & TRB_TYPE_BITMASK) == TRB_TYPE(TRB_LINK);
 }
 
-static inline int enqueue_is_link_trb(struct xhci_ring *ring)
+static int enqueue_is_link_trb(struct xhci_ring *ring)
 {
 	struct xhci_link_trb *link = &ring->enqueue->link;
 	return ((link->control & TRB_TYPE_BITMASK) == TRB_TYPE(TRB_LINK));
@@ -592,7 +592,7 @@
 	ep->ep_state |= SET_DEQ_PENDING;
 }
 
-static inline void xhci_stop_watchdog_timer_in_irq(struct xhci_hcd *xhci,
+static void xhci_stop_watchdog_timer_in_irq(struct xhci_hcd *xhci,
 		struct xhci_virt_ep *ep)
 {
 	ep->ep_state &= ~EP_HALT_PENDING;
@@ -619,6 +619,13 @@
 
 	/* Only giveback urb when this is the last td in urb */
 	if (urb_priv->td_cnt == urb_priv->length) {
+		if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+			xhci_to_hcd(xhci)->self.bandwidth_isoc_reqs--;
+			if (xhci_to_hcd(xhci)->self.bandwidth_isoc_reqs	== 0) {
+				if (xhci->quirks & XHCI_AMD_PLL_FIX)
+					usb_amd_quirk_pll_enable();
+			}
+		}
 		usb_hcd_unlink_urb_from_ep(hcd, urb);
 		xhci_dbg(xhci, "Giveback %s URB %p\n", adjective, urb);
 
@@ -1209,7 +1216,7 @@
 		 * Skip ports that don't have known speeds, or have duplicate
 		 * Extended Capabilities port speed entries.
 		 */
-		if (port_speed == 0 || port_speed == -1)
+		if (port_speed == 0 || port_speed == DUPLICATE_ENTRY)
 			continue;
 
 		/*
@@ -1235,6 +1242,7 @@
 	u8 major_revision;
 	struct xhci_bus_state *bus_state;
 	u32 __iomem **port_array;
+	bool bogus_port_status = false;
 
 	/* Port status change events always have a successful completion code */
 	if (GET_COMP_CODE(event->generic.field[2]) != COMP_SUCCESS) {
@@ -1247,6 +1255,7 @@
 	max_ports = HCS_MAX_PORTS(xhci->hcs_params1);
 	if ((port_id <= 0) || (port_id > max_ports)) {
 		xhci_warn(xhci, "Invalid port id %d\n", port_id);
+		bogus_port_status = true;
 		goto cleanup;
 	}
 
@@ -1258,12 +1267,14 @@
 		xhci_warn(xhci, "Event for port %u not in "
 				"Extended Capabilities, ignoring.\n",
 				port_id);
+		bogus_port_status = true;
 		goto cleanup;
 	}
-	if (major_revision == (u8) -1) {
+	if (major_revision == DUPLICATE_ENTRY) {
 		xhci_warn(xhci, "Event for port %u duplicated in"
 				"Extended Capabilities, ignoring.\n",
 				port_id);
+		bogus_port_status = true;
 		goto cleanup;
 	}
 
@@ -1335,6 +1346,13 @@
 	/* Update event ring dequeue pointer before dropping the lock */
 	inc_deq(xhci, xhci->event_ring, true);
 
+	/* Don't make the USB core poll the roothub if we got a bad port status
+	 * change event.  Besides, at that point we can't tell which roothub
+	 * (USB 2.0 or USB 3.0) to kick.
+	 */
+	if (bogus_port_status)
+		return;
+
 	spin_unlock(&xhci->lock);
 	/* Pass this up to the core */
 	usb_hcd_poll_rh_status(hcd);
@@ -1554,8 +1572,17 @@
 
 		urb_priv->td_cnt++;
 		/* Giveback the urb when all the tds are completed */
-		if (urb_priv->td_cnt == urb_priv->length)
+		if (urb_priv->td_cnt == urb_priv->length) {
 			ret = 1;
+			if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+				xhci_to_hcd(xhci)->self.bandwidth_isoc_reqs--;
+				if (xhci_to_hcd(xhci)->self.bandwidth_isoc_reqs
+					== 0) {
+					if (xhci->quirks & XHCI_AMD_PLL_FIX)
+						usb_amd_quirk_pll_enable();
+				}
+			}
+		}
 	}
 
 	return ret;
@@ -1675,71 +1702,52 @@
 	struct urb_priv *urb_priv;
 	int idx;
 	int len = 0;
-	int skip_td = 0;
 	union xhci_trb *cur_trb;
 	struct xhci_segment *cur_seg;
+	struct usb_iso_packet_descriptor *frame;
 	u32 trb_comp_code;
+	bool skip_td = false;
 
 	ep_ring = xhci_dma_to_transfer_ring(ep, event->buffer);
 	trb_comp_code = GET_COMP_CODE(event->transfer_len);
 	urb_priv = td->urb->hcpriv;
 	idx = urb_priv->td_cnt;
+	frame = &td->urb->iso_frame_desc[idx];
 
-	if (ep->skip) {
-		/* The transfer is partly done */
-		*status = -EXDEV;
-		td->urb->iso_frame_desc[idx].status = -EXDEV;
-	} else {
-		/* handle completion code */
-		switch (trb_comp_code) {
-		case COMP_SUCCESS:
-			td->urb->iso_frame_desc[idx].status = 0;
-			xhci_dbg(xhci, "Successful isoc transfer!\n");
-			break;
-		case COMP_SHORT_TX:
-			if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
-				td->urb->iso_frame_desc[idx].status =
-					 -EREMOTEIO;
-			else
-				td->urb->iso_frame_desc[idx].status = 0;
-			break;
-		case COMP_BW_OVER:
-			td->urb->iso_frame_desc[idx].status = -ECOMM;
-			skip_td = 1;
-			break;
-		case COMP_BUFF_OVER:
-		case COMP_BABBLE:
-			td->urb->iso_frame_desc[idx].status = -EOVERFLOW;
-			skip_td = 1;
-			break;
-		case COMP_STALL:
-			td->urb->iso_frame_desc[idx].status = -EPROTO;
-			skip_td = 1;
-			break;
-		case COMP_STOP:
-		case COMP_STOP_INVAL:
-			break;
-		default:
-			td->urb->iso_frame_desc[idx].status = -1;
-			break;
-		}
+	/* handle completion code */
+	switch (trb_comp_code) {
+	case COMP_SUCCESS:
+		frame->status = 0;
+		xhci_dbg(xhci, "Successful isoc transfer!\n");
+		break;
+	case COMP_SHORT_TX:
+		frame->status = td->urb->transfer_flags & URB_SHORT_NOT_OK ?
+				-EREMOTEIO : 0;
+		break;
+	case COMP_BW_OVER:
+		frame->status = -ECOMM;
+		skip_td = true;
+		break;
+	case COMP_BUFF_OVER:
+	case COMP_BABBLE:
+		frame->status = -EOVERFLOW;
+		skip_td = true;
+		break;
+	case COMP_STALL:
+		frame->status = -EPROTO;
+		skip_td = true;
+		break;
+	case COMP_STOP:
+	case COMP_STOP_INVAL:
+		break;
+	default:
+		frame->status = -1;
+		break;
 	}
 
-	/* calc actual length */
-	if (ep->skip) {
-		td->urb->iso_frame_desc[idx].actual_length = 0;
-		/* Update ring dequeue pointer */
-		while (ep_ring->dequeue != td->last_trb)
-			inc_deq(xhci, ep_ring, false);
-		inc_deq(xhci, ep_ring, false);
-		return finish_td(xhci, td, event_trb, event, ep, status, true);
-	}
-
-	if (trb_comp_code == COMP_SUCCESS || skip_td == 1) {
-		td->urb->iso_frame_desc[idx].actual_length =
-			td->urb->iso_frame_desc[idx].length;
-		td->urb->actual_length +=
-			td->urb->iso_frame_desc[idx].length;
+	if (trb_comp_code == COMP_SUCCESS || skip_td) {
+		frame->actual_length = frame->length;
+		td->urb->actual_length += frame->length;
 	} else {
 		for (cur_trb = ep_ring->dequeue,
 		     cur_seg = ep_ring->deq_seg; cur_trb != event_trb;
@@ -1755,7 +1763,7 @@
 			TRB_LEN(event->transfer_len);
 
 		if (trb_comp_code != COMP_STOP_INVAL) {
-			td->urb->iso_frame_desc[idx].actual_length = len;
+			frame->actual_length = len;
 			td->urb->actual_length += len;
 		}
 	}
@@ -1766,6 +1774,35 @@
 	return finish_td(xhci, td, event_trb, event, ep, status, false);
 }
 
+static int skip_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+			struct xhci_transfer_event *event,
+			struct xhci_virt_ep *ep, int *status)
+{
+	struct xhci_ring *ep_ring;
+	struct urb_priv *urb_priv;
+	struct usb_iso_packet_descriptor *frame;
+	int idx;
+
+	ep_ring = xhci_dma_to_transfer_ring(ep, event->buffer);
+	urb_priv = td->urb->hcpriv;
+	idx = urb_priv->td_cnt;
+	frame = &td->urb->iso_frame_desc[idx];
+
+	/* The transfer is partly done */
+	*status = -EXDEV;
+	frame->status = -EXDEV;
+
+	/* calc actual length */
+	frame->actual_length = 0;
+
+	/* Update ring dequeue pointer */
+	while (ep_ring->dequeue != td->last_trb)
+		inc_deq(xhci, ep_ring, false);
+	inc_deq(xhci, ep_ring, false);
+
+	return finish_td(xhci, td, NULL, event, ep, status, true);
+}
+
 /*
  * Process bulk and interrupt tds, update urb status and actual_length.
  */
@@ -2024,36 +2061,42 @@
 		}
 
 		td = list_entry(ep_ring->td_list.next, struct xhci_td, td_list);
+
 		/* Is this a TRB in the currently executing TD? */
 		event_seg = trb_in_td(ep_ring->deq_seg, ep_ring->dequeue,
 				td->last_trb, event_dma);
-		if (event_seg && ep->skip) {
+		if (!event_seg) {
+			if (!ep->skip ||
+			    !usb_endpoint_xfer_isoc(&td->urb->ep->desc)) {
+				/* HC is busted, give up! */
+				xhci_err(xhci,
+					"ERROR Transfer event TRB DMA ptr not "
+					"part of current TD\n");
+				return -ESHUTDOWN;
+			}
+
+			ret = skip_isoc_td(xhci, td, event, ep, &status);
+			goto cleanup;
+		}
+
+		if (ep->skip) {
 			xhci_dbg(xhci, "Found td. Clear skip flag.\n");
 			ep->skip = false;
 		}
-		if (!event_seg &&
-		   (!ep->skip || !usb_endpoint_xfer_isoc(&td->urb->ep->desc))) {
-			/* HC is busted, give up! */
-			xhci_err(xhci, "ERROR Transfer event TRB DMA ptr not "
-					"part of current TD\n");
-			return -ESHUTDOWN;
-		}
 
-		if (event_seg) {
-			event_trb = &event_seg->trbs[(event_dma -
-					 event_seg->dma) / sizeof(*event_trb)];
-			/*
-			 * No-op TRB should not trigger interrupts.
-			 * If event_trb is a no-op TRB, it means the
-			 * corresponding TD has been cancelled. Just ignore
-			 * the TD.
-			 */
-			if ((event_trb->generic.field[3] & TRB_TYPE_BITMASK)
-					 == TRB_TYPE(TRB_TR_NOOP)) {
-				xhci_dbg(xhci, "event_trb is a no-op TRB. "
-						"Skip it\n");
-				goto cleanup;
-			}
+		event_trb = &event_seg->trbs[(event_dma - event_seg->dma) /
+						sizeof(*event_trb)];
+		/*
+		 * No-op TRB should not trigger interrupts.
+		 * If event_trb is a no-op TRB, it means the
+		 * corresponding TD has been cancelled. Just ignore
+		 * the TD.
+		 */
+		if ((event_trb->generic.field[3] & TRB_TYPE_BITMASK)
+				 == TRB_TYPE(TRB_TR_NOOP)) {
+			xhci_dbg(xhci,
+				 "event_trb is a no-op TRB. Skip it\n");
+			goto cleanup;
 		}
 
 		/* Now update the urb's actual_length and give back to
@@ -3126,6 +3169,12 @@
 		}
 	}
 
+	if (xhci_to_hcd(xhci)->self.bandwidth_isoc_reqs == 0) {
+		if (xhci->quirks & XHCI_AMD_PLL_FIX)
+			usb_amd_quirk_pll_disable();
+	}
+	xhci_to_hcd(xhci)->self.bandwidth_isoc_reqs++;
+
 	giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
 			start_cycle, start_trb);
 	return 0;
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 196e018..81b976e 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -550,6 +550,9 @@
 	del_timer_sync(&xhci->event_ring_timer);
 #endif
 
+	if (xhci->quirks & XHCI_AMD_PLL_FIX)
+		usb_amd_dev_put();
+
 	xhci_dbg(xhci, "// Disabling event ring interrupts\n");
 	temp = xhci_readl(xhci, &xhci->op_regs->status);
 	xhci_writel(xhci, temp & ~STS_EINT, &xhci->op_regs->status);
@@ -771,7 +774,9 @@
 
 	/* If restore operation fails, re-initialize the HC during resume */
 	if ((temp & STS_SRE) || hibernated) {
-		usb_root_hub_lost_power(hcd->self.root_hub);
+		/* Let the USB core know _both_ roothubs lost power. */
+		usb_root_hub_lost_power(xhci->main_hcd->self.root_hub);
+		usb_root_hub_lost_power(xhci->shared_hcd->self.root_hub);
 
 		xhci_dbg(xhci, "Stop HCD\n");
 		xhci_halt(xhci);
@@ -2386,10 +2391,18 @@
 	/* Everything but endpoint 0 is disabled, so free or cache the rings. */
 	last_freed_endpoint = 1;
 	for (i = 1; i < 31; ++i) {
-		if (!virt_dev->eps[i].ring)
-			continue;
-		xhci_free_or_cache_endpoint_ring(xhci, virt_dev, i);
-		last_freed_endpoint = i;
+		struct xhci_virt_ep *ep = &virt_dev->eps[i];
+
+		if (ep->ep_state & EP_HAS_STREAMS) {
+			xhci_free_stream_info(xhci, ep->stream_info);
+			ep->stream_info = NULL;
+			ep->ep_state &= ~EP_HAS_STREAMS;
+		}
+
+		if (ep->ring) {
+			xhci_free_or_cache_endpoint_ring(xhci, virt_dev, i);
+			last_freed_endpoint = i;
+		}
 	}
 	xhci_dbg(xhci, "Output context after successful reset device cmd:\n");
 	xhci_dbg_ctx(xhci, virt_dev->out_ctx, last_freed_endpoint);
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 07e2630..ba1be6b 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -30,6 +30,7 @@
 
 /* Code sharing between pci-quirks and xhci hcd */
 #include	"xhci-ext-caps.h"
+#include "pci-quirks.h"
 
 /* xHCI PCI Configuration Registers */
 #define XHCI_SBRN_OFFSET	(0x60)
@@ -232,7 +233,7 @@
  * notification type that matches a bit set in this bit field.
  */
 #define	DEV_NOTE_MASK		(0xffff)
-#define ENABLE_DEV_NOTE(x)	(1 << x)
+#define ENABLE_DEV_NOTE(x)	(1 << (x))
 /* Most of the device notification types should only be used for debug.
  * SW does need to pay attention to function wake notifications.
  */
@@ -348,6 +349,9 @@
 /* Initiate a warm port reset - complete when PORT_WRC is '1' */
 #define PORT_WR		(1 << 31)
 
+/* We mark duplicate entries with -1 */
+#define DUPLICATE_ENTRY ((u8)(-1))
+
 /* Port Power Management Status and Control - port_power_base bitmasks */
 /* Inactivity timer value for transitions into U1, in microseconds.
  * Timeout can be up to 127us.  0xFF means an infinite timeout.
@@ -601,11 +605,11 @@
 #define EP_STATE_STOPPED	3
 #define EP_STATE_ERROR		4
 /* Mult - Max number of burtst within an interval, in EP companion desc. */
-#define EP_MULT(p)		((p & 0x3) << 8)
+#define EP_MULT(p)		(((p) & 0x3) << 8)
 /* bits 10:14 are Max Primary Streams */
 /* bit 15 is Linear Stream Array */
 /* Interval - period between requests to an endpoint - 125u increments. */
-#define EP_INTERVAL(p)		((p & 0xff) << 16)
+#define EP_INTERVAL(p)		(((p) & 0xff) << 16)
 #define EP_INTERVAL_TO_UFRAMES(p)		(1 << (((p) >> 16) & 0xff))
 #define EP_MAXPSTREAMS_MASK	(0x1f << 10)
 #define EP_MAXPSTREAMS(p)	(((p) << 10) & EP_MAXPSTREAMS_MASK)
@@ -1276,6 +1280,7 @@
 #define	XHCI_LINK_TRB_QUIRK	(1 << 0)
 #define XHCI_RESET_EP_QUIRK	(1 << 1)
 #define XHCI_NEC_HOST		(1 << 2)
+#define XHCI_AMD_PLL_FIX	(1 << 3)
 	/* There are two roothubs to keep track of bus suspend info for */
 	struct xhci_bus_state   bus_state[2];
 	/* Is each xHCI roothub port a USB 3.0, USB 2.0, or USB 1.1 port? */
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 4cbb7e4..74073b3 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -14,7 +14,7 @@
 	select TWL4030_USB if MACH_OMAP_3430SDP
 	select TWL6030_USB if MACH_OMAP_4430SDP || MACH_OMAP4_PANDA
 	select USB_OTG_UTILS
-	tristate 'Inventra Highspeed Dual Role Controller (TI, ADI, ...)'
+	bool 'Inventra Highspeed Dual Role Controller (TI, ADI, ...)'
 	help
 	  Say Y here if your system has a dual role high speed USB
 	  controller based on the Mentor Graphics silicon IP.  Then
@@ -30,8 +30,8 @@
 
 	  If you do not know what this is, please say N.
 
-	  To compile this driver as a module, choose M here; the
-	  module will be called "musb-hdrc".
+#	  To compile this driver as a module, choose M here; the
+#	  module will be called "musb-hdrc".
 
 choice
 	prompt "Platform Glue Layer"
diff --git a/drivers/usb/musb/blackfin.c b/drivers/usb/musb/blackfin.c
index 52312e8..8e2a1ff 100644
--- a/drivers/usb/musb/blackfin.c
+++ b/drivers/usb/musb/blackfin.c
@@ -21,6 +21,7 @@
 #include <asm/cacheflush.h>
 
 #include "musb_core.h"
+#include "musbhsdma.h"
 #include "blackfin.h"
 
 struct bfin_glue {
@@ -332,6 +333,27 @@
 	return -EIO;
 }
 
+static int bfin_musb_adjust_channel_params(struct dma_channel *channel,
+				u16 packet_sz, u8 *mode,
+				dma_addr_t *dma_addr, u32 *len)
+{
+	struct musb_dma_channel *musb_channel = channel->private_data;
+
+	/*
+	 * Anomaly 05000450 might cause data corruption when using DMA
+	 * MODE 1 transmits with short packet.  So to work around this,
+	 * we truncate all MODE 1 transfers down to a multiple of the
+	 * max packet size, and then do the last short packet transfer
+	 * (if there is any) using MODE 0.
+	 */
+	if (ANOMALY_05000450) {
+		if (musb_channel->transmit && *mode == 1)
+			*len = *len - (*len % packet_sz);
+	}
+
+	return 0;
+}
+
 static void bfin_musb_reg_init(struct musb *musb)
 {
 	if (ANOMALY_05000346) {
@@ -430,6 +452,8 @@
 
 	.vbus_status	= bfin_musb_vbus_status,
 	.set_vbus	= bfin_musb_set_vbus,
+
+	.adjust_channel_params = bfin_musb_adjust_channel_params,
 };
 
 static u64 bfin_dmamask = DMA_BIT_MASK(32);
diff --git a/drivers/usb/musb/cppi_dma.c b/drivers/usb/musb/cppi_dma.c
index de55a3c..ab434fb 100644
--- a/drivers/usb/musb/cppi_dma.c
+++ b/drivers/usb/musb/cppi_dma.c
@@ -597,12 +597,12 @@
 		length = min(n_bds * maxpacket, length);
 	}
 
-	DBG(4, "TX DMA%d, pktSz %d %s bds %d dma 0x%x len %u\n",
+	DBG(4, "TX DMA%d, pktSz %d %s bds %d dma 0x%llx len %u\n",
 			tx->index,
 			maxpacket,
 			rndis ? "rndis" : "transparent",
 			n_bds,
-			addr, length);
+			(unsigned long long)addr, length);
 
 	cppi_rndis_update(tx, 0, musb->ctrl_base, rndis);
 
@@ -820,7 +820,7 @@
 	length = min(n_bds * maxpacket, length);
 
 	DBG(4, "RX DMA%d seg, maxp %d %s bds %d (cnt %d) "
-			"dma 0x%x len %u %u/%u\n",
+			"dma 0x%llx len %u %u/%u\n",
 			rx->index, maxpacket,
 			onepacket
 				? (is_rndis ? "rndis" : "onepacket")
@@ -829,7 +829,8 @@
 			musb_readl(tibase,
 				DAVINCI_RXCPPI_BUFCNT0_REG + (rx->index * 4))
 					& 0xffff,
-			addr, length, rx->channel.actual_len, rx->buf_len);
+			(unsigned long long)addr, length,
+			rx->channel.actual_len, rx->buf_len);
 
 	/* only queue one segment at a time, since the hardware prevents
 	 * correct queue shutdown after unexpected short packets
@@ -1039,9 +1040,9 @@
 		if (!completed && (bd->hw_options & CPPI_OWN_SET))
 			break;
 
-		DBG(5, "C/RXBD %08x: nxt %08x buf %08x "
+		DBG(5, "C/RXBD %llx: nxt %08x buf %08x "
 			"off.len %08x opt.len %08x (%d)\n",
-			bd->dma, bd->hw_next, bd->hw_bufp,
+			(unsigned long long)bd->dma, bd->hw_next, bd->hw_bufp,
 			bd->hw_off_len, bd->hw_options,
 			rx->channel.actual_len);
 
@@ -1111,11 +1112,12 @@
 		musb_ep_select(cppi->mregs, rx->index + 1);
 		csr = musb_readw(regs, MUSB_RXCSR);
 		if (csr & MUSB_RXCSR_DMAENAB) {
-			DBG(4, "list%d %p/%p, last %08x%s, csr %04x\n",
+			DBG(4, "list%d %p/%p, last %llx%s, csr %04x\n",
 				rx->index,
 				rx->head, rx->tail,
 				rx->last_processed
-					? rx->last_processed->dma
+					? (unsigned long long)
+						rx->last_processed->dma
 					: 0,
 				completed ? ", completed" : "",
 				csr);
@@ -1167,8 +1169,11 @@
 	tx = musb_readl(tibase, DAVINCI_TXCPPI_MASKED_REG);
 	rx = musb_readl(tibase, DAVINCI_RXCPPI_MASKED_REG);
 
-	if (!tx && !rx)
+	if (!tx && !rx) {
+		if (cppi->irq)
+			spin_unlock_irqrestore(&musb->lock, flags);
 		return IRQ_NONE;
+	}
 
 	DBG(4, "CPPI IRQ Tx%x Rx%x\n", tx, rx);
 
@@ -1199,7 +1204,7 @@
 		 */
 		if (NULL == bd) {
 			DBG(1, "null BD\n");
-			tx_ram->tx_complete = 0;
+			musb_writel(&tx_ram->tx_complete, 0, 0);
 			continue;
 		}
 
@@ -1452,7 +1457,7 @@
 		 *    compare mode by writing 1 to the tx_complete register.
 		 */
 		cppi_reset_tx(tx_ram, 1);
-		cppi_ch->head = 0;
+		cppi_ch->head = NULL;
 		musb_writel(&tx_ram->tx_complete, 0, 1);
 		cppi_dump_tx(5, cppi_ch, " (done teardown)");
 
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 630ae7f..f10ff00 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1030,6 +1030,7 @@
 	struct musb	*musb = dev_to_musb(&pdev->dev);
 	unsigned long	flags;
 
+	pm_runtime_get_sync(musb->controller);
 	spin_lock_irqsave(&musb->lock, flags);
 	musb_platform_disable(musb);
 	musb_generic_disable(musb);
@@ -1040,6 +1041,7 @@
 	musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
 	musb_platform_exit(musb);
 
+	pm_runtime_put(musb->controller);
 	/* FIXME power down */
 }
 
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index 4bd9e21..0e053b5 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -261,6 +261,7 @@
  * @try_ilde:	tries to idle the IP
  * @vbus_status: returns vbus status if possible
  * @set_vbus:	forces vbus status
+ * @channel_program: pre check for standard dma channel_program func
  */
 struct musb_platform_ops {
 	int	(*init)(struct musb *musb);
@@ -274,6 +275,10 @@
 
 	int	(*vbus_status)(struct musb *musb);
 	void	(*set_vbus)(struct musb *musb, int on);
+
+	int	(*adjust_channel_params)(struct dma_channel *channel,
+				u16 packet_sz, u8 *mode,
+				dma_addr_t *dma_addr, u32 *len);
 };
 
 /*
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 98519c5..6dfbf9f 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -535,7 +535,7 @@
 			is_dma = 1;
 			csr |= MUSB_TXCSR_P_WZC_BITS;
 			csr &= ~(MUSB_TXCSR_DMAENAB | MUSB_TXCSR_P_UNDERRUN |
-				 MUSB_TXCSR_TXPKTRDY);
+				 MUSB_TXCSR_TXPKTRDY | MUSB_TXCSR_AUTOSET);
 			musb_writew(epio, MUSB_TXCSR, csr);
 			/* Ensure writebuffer is empty. */
 			csr = musb_readw(epio, MUSB_TXCSR);
@@ -1296,7 +1296,7 @@
 	}
 
 	/* if the hardware doesn't have the request, easy ... */
-	if (musb_ep->req_list.next != &request->list || musb_ep->busy)
+	if (musb_ep->req_list.next != &req->list || musb_ep->busy)
 		musb_g_giveback(musb_ep, request, -ECONNRESET);
 
 	/* ... else abort the dma transfer ... */
diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c
index 0144a2d..d281792 100644
--- a/drivers/usb/musb/musbhsdma.c
+++ b/drivers/usb/musb/musbhsdma.c
@@ -169,6 +169,14 @@
 	BUG_ON(channel->status == MUSB_DMA_STATUS_UNKNOWN ||
 		channel->status == MUSB_DMA_STATUS_BUSY);
 
+	/* Let targets check/tweak the arguments */
+	if (musb->ops->adjust_channel_params) {
+		int ret = musb->ops->adjust_channel_params(channel,
+			packet_sz, &mode, &dma_addr, &len);
+		if (ret)
+			return ret;
+	}
+
 	/*
 	 * The DMA engine in RTL1.8 and above cannot handle
 	 * DMA addresses that are not aligned to a 4 byte boundary.
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 25cb8b0..57a27fa 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -259,9 +259,10 @@
 	case USB_EVENT_VBUS:
 		DBG(4, "VBUS Connect\n");
 
+#ifdef CONFIG_USB_GADGET_MUSB_HDRC
 		if (musb->gadget_driver)
 			pm_runtime_get_sync(musb->controller);
-
+#endif
 		otg_init(musb->xceiv);
 		break;
 
diff --git a/drivers/usb/musb/ux500.c b/drivers/usb/musb/ux500.c
index d6384e4..f7e04bf 100644
--- a/drivers/usb/musb/ux500.c
+++ b/drivers/usb/musb/ux500.c
@@ -93,6 +93,8 @@
 	}
 
 	musb->dev.parent		= &pdev->dev;
+	musb->dev.dma_mask		= pdev->dev.dma_mask;
+	musb->dev.coherent_dma_mask	= pdev->dev.coherent_dma_mask;
 
 	glue->dev			= &pdev->dev;
 	glue->musb			= musb;
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index a973c7a..4de6ef0 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -151,6 +151,8 @@
  * /sys/bus/usb/ftdi_sio/new_id, then send patch/report!
  */
 static struct usb_device_id id_table_combined [] = {
+	{ USB_DEVICE(FTDI_VID, FTDI_CTI_MINI_PID) },
+	{ USB_DEVICE(FTDI_VID, FTDI_CTI_NANO_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) },
@@ -525,6 +527,7 @@
 	{ USB_DEVICE(SEALEVEL_VID, SEALEVEL_2803_8_PID) },
 	{ USB_DEVICE(IDTECH_VID, IDTECH_IDT1221U_PID) },
 	{ USB_DEVICE(OCT_VID, OCT_US101_PID) },
+	{ USB_DEVICE(OCT_VID, OCT_DK201_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_HE_TIRA1_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_HE_TIRA1_quirk },
 	{ USB_DEVICE(FTDI_VID, FTDI_USB_UIRT_PID),
@@ -787,6 +790,8 @@
 	{ USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
 	{ USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) },
+	{ USB_DEVICE(FTDI_VID, HAMEG_HO720_PID) },
+	{ USB_DEVICE(FTDI_VID, HAMEG_HO730_PID) },
 	{ USB_DEVICE(FTDI_VID, HAMEG_HO870_PID) },
 	{ USB_DEVICE(FTDI_VID, MJSG_GENERIC_PID) },
 	{ USB_DEVICE(FTDI_VID, MJSG_SR_RADIO_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index c543e55..efffc237 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -300,6 +300,8 @@
  * Hameg HO820 and HO870 interface (using VID 0x0403)
  */
 #define HAMEG_HO820_PID			0xed74
+#define HAMEG_HO730_PID			0xed73
+#define HAMEG_HO720_PID			0xed72
 #define HAMEG_HO870_PID			0xed71
 
 /*
@@ -572,6 +574,7 @@
 /* Note: OCT US101 is also rebadged as Dick Smith Electronics (NZ) XH6381 */
 /* Also rebadged as Dick Smith Electronics (Aus) XH6451 */
 /* Also rebadged as SIIG Inc. model US2308 hardware version 1 */
+#define OCT_DK201_PID		0x0103	/* OCT DK201 USB docking station */
 #define OCT_US101_PID		0x0421	/* OCT US101 USB to RS-232 */
 
 /*
@@ -1141,3 +1144,12 @@
 #define QIHARDWARE_VID			0x20B7
 #define MILKYMISTONE_JTAGSERIAL_PID	0x0713
 
+/*
+ * CTI GmbH RS485 Converter http://www.cti-lean.com/
+ */
+/* USB-485-Mini*/
+#define FTDI_CTI_MINI_PID	0xF608
+/* USB-Nano-485*/
+#define FTDI_CTI_NANO_PID	0xF60B
+
+
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 75c7f45..d77ff04 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -407,6 +407,10 @@
 /* ONDA MT825UP HSDPA 14.2 modem */
 #define ONDA_MT825UP         0x000b
 
+/* Samsung products */
+#define SAMSUNG_VENDOR_ID                       0x04e8
+#define SAMSUNG_PRODUCT_GT_B3730                0x6889
+
 /* some devices interfaces need special handling due to a number of reasons */
 enum option_blacklist_reason {
 		OPTION_BLACKLIST_NONE = 0,
@@ -968,6 +972,7 @@
 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
 	{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
 	{ USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
+	{ USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730/GT-B3710 LTE USB modem.*/
 	{ } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 8858201..54a9dab 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -111,7 +111,7 @@
 	ifnum = intf->desc.bInterfaceNumber;
 	dbg("This Interface = %d", ifnum);
 
-	data = serial->private = kzalloc(sizeof(struct usb_wwan_intf_private),
+	data = kzalloc(sizeof(struct usb_wwan_intf_private),
 					 GFP_KERNEL);
 	if (!data)
 		return -ENOMEM;
@@ -134,8 +134,10 @@
 		    usb_endpoint_is_bulk_out(&intf->endpoint[1].desc)) {
 			dbg("QDL port found");
 
-			if (serial->interface->num_altsetting == 1)
-				return 0;
+			if (serial->interface->num_altsetting == 1) {
+				retval = 0; /* Success */
+				break;
+			}
 
 			retval = usb_set_interface(serial->dev, ifnum, 1);
 			if (retval < 0) {
@@ -145,7 +147,6 @@
 				retval = -ENODEV;
 				kfree(data);
 			}
-			return retval;
 		}
 		break;
 
@@ -166,6 +167,7 @@
 					"Could not set interface, error %d\n",
 					retval);
 				retval = -ENODEV;
+				kfree(data);
 			}
 		} else if (ifnum == 2) {
 			dbg("Modem port found");
@@ -177,7 +179,6 @@
 				retval = -ENODEV;
 				kfree(data);
 			}
-			return retval;
 		} else if (ifnum==3) {
 			/*
 			 * NMEA (serial line 9600 8N1)
@@ -191,6 +192,7 @@
 					"Could not set interface, error %d\n",
 					retval);
 				retval = -ENODEV;
+				kfree(data);
 			}
 		}
 		break;
@@ -199,12 +201,27 @@
 		dev_err(&serial->dev->dev,
 			"unknown number of interfaces: %d\n", nintf);
 		kfree(data);
-		return -ENODEV;
+		retval = -ENODEV;
 	}
 
+	/* Set serial->private if not returning -ENODEV */
+	if (retval != -ENODEV)
+		usb_set_serial_data(serial, data);
 	return retval;
 }
 
+static void qc_release(struct usb_serial *serial)
+{
+	struct usb_wwan_intf_private *priv = usb_get_serial_data(serial);
+
+	dbg("%s", __func__);
+
+	/* Call usb_wwan release & free the private data allocated in qcprobe */
+	usb_wwan_release(serial);
+	usb_set_serial_data(serial, NULL);
+	kfree(priv);
+}
+
 static struct usb_serial_driver qcdevice = {
 	.driver = {
 		.owner     = THIS_MODULE,
@@ -222,7 +239,7 @@
 	.chars_in_buffer     = usb_wwan_chars_in_buffer,
 	.attach		     = usb_wwan_startup,
 	.disconnect	     = usb_wwan_disconnect,
-	.release	     = usb_wwan_release,
+	.release	     = qc_release,
 #ifdef CONFIG_PM
 	.suspend	     = usb_wwan_suspend,
 	.resume		     = usb_wwan_resume,
diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c
index a2e5b51..0f4e8c9 100644
--- a/drivers/video/pxafb.c
+++ b/drivers/video/pxafb.c
@@ -1648,7 +1648,9 @@
 
 	switch (val) {
 	case CPUFREQ_PRECHANGE:
-		if (!fbi->overlay[0].usage && !fbi->overlay[1].usage)
+#ifdef CONFIG_FB_PXA_OVERLAY
+		if (!(fbi->overlay[0].usage || fbi->overlay[1].usage))
+#endif
 			set_ctrlr_state(fbi, C_DISABLE_CLKCHANGE);
 		break;
 
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 42d6c93..33167b4 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -912,8 +912,7 @@
 			      unsigned long irqflags,
 			      const char *devname, void *dev_id)
 {
-	unsigned int irq;
-	int retval;
+	int irq, retval;
 
 	irq = bind_evtchn_to_irq(evtchn);
 	if (irq < 0)
@@ -955,8 +954,7 @@
 			    irq_handler_t handler,
 			    unsigned long irqflags, const char *devname, void *dev_id)
 {
-	unsigned int irq;
-	int retval;
+	int irq, retval;
 
 	irq = bind_virq_to_irq(virq, cpu);
 	if (irq < 0)
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index 95143dd..1ac9412 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -61,7 +61,7 @@
 	xen_mm_unpin_all();
 }
 
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
 static int xen_suspend(void *data)
 {
 	struct suspend_info *si = data;
@@ -173,7 +173,7 @@
 #endif
 	shutting_down = SHUTDOWN_INVALID;
 }
-#endif	/* CONFIG_HIBERNATION */
+#endif	/* CONFIG_HIBERNATE_CALLBACKS */
 
 struct shutdown_handler {
 	const char *command;
@@ -202,7 +202,7 @@
 		{ "poweroff",	do_poweroff },
 		{ "halt",	do_poweroff },
 		{ "reboot",	do_reboot   },
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
 		{ "suspend",	do_suspend  },
 #endif
 		{NULL, NULL},
diff --git a/fs/9p/fid.c b/fs/9p/fid.c
index 0ee5945..85b67ffa 100644
--- a/fs/9p/fid.c
+++ b/fs/9p/fid.c
@@ -286,11 +286,9 @@
 
 struct p9_fid *v9fs_writeback_fid(struct dentry *dentry)
 {
-	int err, flags;
+	int err;
 	struct p9_fid *fid;
-	struct v9fs_session_info *v9ses;
 
-	v9ses = v9fs_dentry2v9ses(dentry);
 	fid = v9fs_fid_clone_with_uid(dentry, 0);
 	if (IS_ERR(fid))
 		goto error_out;
@@ -299,17 +297,8 @@
 	 * dirty pages. We always request for the open fid in read-write
 	 * mode so that a partial page write which result in page
 	 * read can work.
-	 *
-	 * we don't have a tsyncfs operation for older version
-	 * of protocol. So make sure the write back fid is
-	 * opened in O_SYNC mode.
 	 */
-	if (!v9fs_proto_dotl(v9ses))
-		flags = O_RDWR | O_SYNC;
-	else
-		flags = O_RDWR;
-
-	err = p9_client_open(fid, flags);
+	err = p9_client_open(fid, O_RDWR);
 	if (err < 0) {
 		p9_client_clunk(fid);
 		fid = ERR_PTR(err);
diff --git a/fs/9p/v9fs.h b/fs/9p/v9fs.h
index 9665c2b..e5ebedf 100644
--- a/fs/9p/v9fs.h
+++ b/fs/9p/v9fs.h
@@ -116,7 +116,6 @@
 	struct list_head slist; /* list of sessions registered with v9fs */
 	struct backing_dev_info bdi;
 	struct rw_semaphore rename_sem;
-	struct p9_fid *root_fid; /* Used for file system sync */
 };
 
 /* cache_validity flags */
diff --git a/fs/9p/vfs_dentry.c b/fs/9p/vfs_dentry.c
index b6a3b9f..e022890 100644
--- a/fs/9p/vfs_dentry.c
+++ b/fs/9p/vfs_dentry.c
@@ -126,7 +126,9 @@
 			retval = v9fs_refresh_inode_dotl(fid, inode);
 		else
 			retval = v9fs_refresh_inode(fid, inode);
-		if (retval <= 0)
+		if (retval == -ENOENT)
+			return 0;
+		if (retval < 0)
 			return retval;
 	}
 out_valid:
diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
index ffbb113..82a7c38 100644
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -811,7 +811,7 @@
 	fid = v9fs_fid_lookup(dentry);
 	if (IS_ERR(fid)) {
 		__putname(link);
-		link = ERR_PTR(PTR_ERR(fid));
+		link = ERR_CAST(fid);
 		goto ndset;
 	}
 	retval = p9_client_readlink(fid, &target);
diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c
index f3eed33..feef6cd 100644
--- a/fs/9p/vfs_super.c
+++ b/fs/9p/vfs_super.c
@@ -154,6 +154,7 @@
 		retval = PTR_ERR(inode);
 		goto release_sb;
 	}
+
 	root = d_alloc_root(inode);
 	if (!root) {
 		iput(inode);
@@ -185,21 +186,10 @@
 		p9stat_free(st);
 		kfree(st);
 	}
-	v9fs_fid_add(root, fid);
 	retval = v9fs_get_acl(inode, fid);
 	if (retval)
 		goto release_sb;
-	/*
-	 * Add the root fid to session info. This is used
-	 * for file system sync. We want a cloned fid here
-	 * so that we can do a sync_filesystem after a
-	 * shrink_dcache_for_umount
-	 */
-	v9ses->root_fid = v9fs_fid_clone(root);
-	if (IS_ERR(v9ses->root_fid)) {
-		retval = PTR_ERR(v9ses->root_fid);
-		goto release_sb;
-	}
+	v9fs_fid_add(root, fid);
 
 	P9_DPRINTK(P9_DEBUG_VFS, " simple set mount, return 0\n");
 	return dget(sb->s_root);
@@ -210,11 +200,15 @@
 	v9fs_session_close(v9ses);
 	kfree(v9ses);
 	return ERR_PTR(retval);
+
 release_sb:
 	/*
-	 * we will do the session_close and root dentry
-	 * release in the below call.
+	 * we will do the session_close and root dentry release
+	 * in the below call. But we need to clunk fid, because we haven't
+	 * attached the fid to dentry so it won't get clunked
+	 * automatically.
 	 */
+	p9_client_clunk(fid);
 	deactivate_locked_super(sb);
 	return ERR_PTR(retval);
 }
@@ -232,7 +226,7 @@
 	P9_DPRINTK(P9_DEBUG_VFS, " %p\n", s);
 
 	kill_anon_super(s);
-	p9_client_clunk(v9ses->root_fid);
+
 	v9fs_session_cancel(v9ses);
 	v9fs_session_close(v9ses);
 	kfree(v9ses);
@@ -285,14 +279,6 @@
 	return res;
 }
 
-static int v9fs_sync_fs(struct super_block *sb, int wait)
-{
-	struct v9fs_session_info *v9ses = sb->s_fs_info;
-
-	P9_DPRINTK(P9_DEBUG_VFS, "v9fs_sync_fs: super_block %p\n", sb);
-	return p9_client_sync_fs(v9ses->root_fid);
-}
-
 static int v9fs_drop_inode(struct inode *inode)
 {
 	struct v9fs_session_info *v9ses;
@@ -307,6 +293,51 @@
 	return 1;
 }
 
+static int v9fs_write_inode(struct inode *inode,
+			    struct writeback_control *wbc)
+{
+	int ret;
+	struct p9_wstat wstat;
+	struct v9fs_inode *v9inode;
+	/*
+	 * send an fsync request to server irrespective of
+	 * wbc->sync_mode.
+	 */
+	P9_DPRINTK(P9_DEBUG_VFS, "%s: inode %p\n", __func__, inode);
+	v9inode = V9FS_I(inode);
+	if (!v9inode->writeback_fid)
+		return 0;
+	v9fs_blank_wstat(&wstat);
+
+	ret = p9_client_wstat(v9inode->writeback_fid, &wstat);
+	if (ret < 0) {
+		__mark_inode_dirty(inode, I_DIRTY_DATASYNC);
+		return ret;
+	}
+	return 0;
+}
+
+static int v9fs_write_inode_dotl(struct inode *inode,
+				 struct writeback_control *wbc)
+{
+	int ret;
+	struct v9fs_inode *v9inode;
+	/*
+	 * send an fsync request to server irrespective of
+	 * wbc->sync_mode.
+	 */
+	P9_DPRINTK(P9_DEBUG_VFS, "%s: inode %p\n", __func__, inode);
+	v9inode = V9FS_I(inode);
+	if (!v9inode->writeback_fid)
+		return 0;
+	ret = p9_client_fsync(v9inode->writeback_fid, 0);
+	if (ret < 0) {
+		__mark_inode_dirty(inode, I_DIRTY_DATASYNC);
+		return ret;
+	}
+	return 0;
+}
+
 static const struct super_operations v9fs_super_ops = {
 	.alloc_inode = v9fs_alloc_inode,
 	.destroy_inode = v9fs_destroy_inode,
@@ -314,17 +345,18 @@
 	.evict_inode = v9fs_evict_inode,
 	.show_options = generic_show_options,
 	.umount_begin = v9fs_umount_begin,
+	.write_inode = v9fs_write_inode,
 };
 
 static const struct super_operations v9fs_super_ops_dotl = {
 	.alloc_inode = v9fs_alloc_inode,
 	.destroy_inode = v9fs_destroy_inode,
-	.sync_fs = v9fs_sync_fs,
 	.statfs = v9fs_statfs,
 	.drop_inode = v9fs_drop_inode,
 	.evict_inode = v9fs_evict_inode,
 	.show_options = generic_show_options,
 	.umount_begin = v9fs_umount_begin,
+	.write_inode = v9fs_write_inode_dotl,
 };
 
 struct file_system_type v9fs_fs_type = {
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index f34078d..303983f 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -941,9 +941,13 @@
 	current->mm->start_stack = bprm->p;
 
 #ifdef arch_randomize_brk
-	if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1))
+	if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
 		current->mm->brk = current->mm->start_brk =
 			arch_randomize_brk(current->mm);
+#ifdef CONFIG_COMPAT_BRK
+		current->brk_randomized = 1;
+#endif
+	}
 #endif
 
 	if (current->personality & MMAP_PAGE_ZERO) {
diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c
index de34bfa..5d505aa 100644
--- a/fs/btrfs/acl.c
+++ b/fs/btrfs/acl.c
@@ -178,16 +178,17 @@
 
 	if (value) {
 		acl = posix_acl_from_xattr(value, size);
-		if (acl == NULL) {
-			value = NULL;
-			size = 0;
+		if (acl) {
+			ret = posix_acl_valid(acl);
+			if (ret)
+				goto out;
 		} else if (IS_ERR(acl)) {
 			return PTR_ERR(acl);
 		}
 	}
 
 	ret = btrfs_set_acl(NULL, dentry->d_inode, acl, type);
-
+out:
 	posix_acl_release(acl);
 
 	return ret;
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 3458b57..2e61fe1 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -740,8 +740,10 @@
 	 */
 	unsigned long reservation_progress;
 
-	int full;		/* indicates that we cannot allocate any more
+	int full:1;		/* indicates that we cannot allocate any more
 				   chunks for this space */
+	int chunk_alloc:1;	/* set if we are allocating a chunk */
+
 	int force_alloc;	/* set if we need to force a chunk alloc for
 				   this space */
 
@@ -2576,6 +2578,11 @@
 int btrfs_mark_extent_written(struct btrfs_trans_handle *trans,
 			      struct inode *inode, u64 start, u64 end);
 int btrfs_release_file(struct inode *inode, struct file *file);
+void btrfs_drop_pages(struct page **pages, size_t num_pages);
+int btrfs_dirty_pages(struct btrfs_root *root, struct inode *inode,
+		      struct page **pages, size_t num_pages,
+		      loff_t pos, size_t write_bytes,
+		      struct extent_state **cached);
 
 /* tree-defrag.c */
 int btrfs_defrag_leaves(struct btrfs_trans_handle *trans,
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 8f1d44b..68c84c8 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3057,7 +3057,7 @@
 		btrfs_destroy_pinned_extent(root,
 					    root->fs_info->pinned_extents);
 
-		t->use_count = 0;
+		atomic_set(&t->use_count, 0);
 		list_del_init(&t->list);
 		memset(t, 0, sizeof(*t));
 		kmem_cache_free(btrfs_transaction_cachep, t);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index f619c3c..31f33ba 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -33,6 +33,25 @@
 #include "locking.h"
 #include "free-space-cache.h"
 
+/* control flags for do_chunk_alloc's force field
+ * CHUNK_ALLOC_NO_FORCE means to only allocate a chunk
+ * if we really need one.
+ *
+ * CHUNK_ALLOC_FORCE means it must try to allocate one
+ *
+ * CHUNK_ALLOC_LIMITED means to only try and allocate one
+ * if we have very few chunks already allocated.  This is
+ * used as part of the clustering code to help make sure
+ * we have a good pool of storage to cluster in, without
+ * filling the FS with empty chunks
+ *
+ */
+enum {
+	CHUNK_ALLOC_NO_FORCE = 0,
+	CHUNK_ALLOC_FORCE = 1,
+	CHUNK_ALLOC_LIMITED = 2,
+};
+
 static int update_block_group(struct btrfs_trans_handle *trans,
 			      struct btrfs_root *root,
 			      u64 bytenr, u64 num_bytes, int alloc);
@@ -3019,7 +3038,8 @@
 	found->bytes_readonly = 0;
 	found->bytes_may_use = 0;
 	found->full = 0;
-	found->force_alloc = 0;
+	found->force_alloc = CHUNK_ALLOC_NO_FORCE;
+	found->chunk_alloc = 0;
 	*space_info = found;
 	list_add_rcu(&found->list, &info->space_info);
 	atomic_set(&found->caching_threads, 0);
@@ -3150,7 +3170,7 @@
 		if (!data_sinfo->full && alloc_chunk) {
 			u64 alloc_target;
 
-			data_sinfo->force_alloc = 1;
+			data_sinfo->force_alloc = CHUNK_ALLOC_FORCE;
 			spin_unlock(&data_sinfo->lock);
 alloc:
 			alloc_target = btrfs_get_alloc_profile(root, 1);
@@ -3160,7 +3180,8 @@
 
 			ret = do_chunk_alloc(trans, root->fs_info->extent_root,
 					     bytes + 2 * 1024 * 1024,
-					     alloc_target, 0);
+					     alloc_target,
+					     CHUNK_ALLOC_NO_FORCE);
 			btrfs_end_transaction(trans, root);
 			if (ret < 0) {
 				if (ret != -ENOSPC)
@@ -3239,31 +3260,56 @@
 	rcu_read_lock();
 	list_for_each_entry_rcu(found, head, list) {
 		if (found->flags & BTRFS_BLOCK_GROUP_METADATA)
-			found->force_alloc = 1;
+			found->force_alloc = CHUNK_ALLOC_FORCE;
 	}
 	rcu_read_unlock();
 }
 
 static int should_alloc_chunk(struct btrfs_root *root,
-			      struct btrfs_space_info *sinfo, u64 alloc_bytes)
+			      struct btrfs_space_info *sinfo, u64 alloc_bytes,
+			      int force)
 {
 	u64 num_bytes = sinfo->total_bytes - sinfo->bytes_readonly;
+	u64 num_allocated = sinfo->bytes_used + sinfo->bytes_reserved;
 	u64 thresh;
 
-	if (sinfo->bytes_used + sinfo->bytes_reserved +
-	    alloc_bytes + 256 * 1024 * 1024 < num_bytes)
+	if (force == CHUNK_ALLOC_FORCE)
+		return 1;
+
+	/*
+	 * in limited mode, we want to have some free space up to
+	 * about 1% of the FS size.
+	 */
+	if (force == CHUNK_ALLOC_LIMITED) {
+		thresh = btrfs_super_total_bytes(&root->fs_info->super_copy);
+		thresh = max_t(u64, 64 * 1024 * 1024,
+			       div_factor_fine(thresh, 1));
+
+		if (num_bytes - num_allocated < thresh)
+			return 1;
+	}
+
+	/*
+	 * we have two similar checks here, one based on percentage
+	 * and once based on a hard number of 256MB.  The idea
+	 * is that if we have a good amount of free
+	 * room, don't allocate a chunk.  A good mount is
+	 * less than 80% utilized of the chunks we have allocated,
+	 * or more than 256MB free
+	 */
+	if (num_allocated + alloc_bytes + 256 * 1024 * 1024 < num_bytes)
 		return 0;
 
-	if (sinfo->bytes_used + sinfo->bytes_reserved +
-	    alloc_bytes < div_factor(num_bytes, 8))
+	if (num_allocated + alloc_bytes < div_factor(num_bytes, 8))
 		return 0;
 
 	thresh = btrfs_super_total_bytes(&root->fs_info->super_copy);
+
+	/* 256MB or 5% of the FS */
 	thresh = max_t(u64, 256 * 1024 * 1024, div_factor_fine(thresh, 5));
 
 	if (num_bytes > thresh && sinfo->bytes_used < div_factor(num_bytes, 3))
 		return 0;
-
 	return 1;
 }
 
@@ -3273,10 +3319,9 @@
 {
 	struct btrfs_space_info *space_info;
 	struct btrfs_fs_info *fs_info = extent_root->fs_info;
+	int wait_for_alloc = 0;
 	int ret = 0;
 
-	mutex_lock(&fs_info->chunk_mutex);
-
 	flags = btrfs_reduce_alloc_profile(extent_root, flags);
 
 	space_info = __find_space_info(extent_root->fs_info, flags);
@@ -3287,21 +3332,40 @@
 	}
 	BUG_ON(!space_info);
 
+again:
 	spin_lock(&space_info->lock);
 	if (space_info->force_alloc)
-		force = 1;
+		force = space_info->force_alloc;
 	if (space_info->full) {
 		spin_unlock(&space_info->lock);
-		goto out;
+		return 0;
 	}
 
-	if (!force && !should_alloc_chunk(extent_root, space_info,
-					  alloc_bytes)) {
+	if (!should_alloc_chunk(extent_root, space_info, alloc_bytes, force)) {
 		spin_unlock(&space_info->lock);
-		goto out;
+		return 0;
+	} else if (space_info->chunk_alloc) {
+		wait_for_alloc = 1;
+	} else {
+		space_info->chunk_alloc = 1;
 	}
+
 	spin_unlock(&space_info->lock);
 
+	mutex_lock(&fs_info->chunk_mutex);
+
+	/*
+	 * The chunk_mutex is held throughout the entirety of a chunk
+	 * allocation, so once we've acquired the chunk_mutex we know that the
+	 * other guy is done and we need to recheck and see if we should
+	 * allocate.
+	 */
+	if (wait_for_alloc) {
+		mutex_unlock(&fs_info->chunk_mutex);
+		wait_for_alloc = 0;
+		goto again;
+	}
+
 	/*
 	 * If we have mixed data/metadata chunks we want to make sure we keep
 	 * allocating mixed chunks instead of individual chunks.
@@ -3327,9 +3391,10 @@
 		space_info->full = 1;
 	else
 		ret = 1;
-	space_info->force_alloc = 0;
+
+	space_info->force_alloc = CHUNK_ALLOC_NO_FORCE;
+	space_info->chunk_alloc = 0;
 	spin_unlock(&space_info->lock);
-out:
 	mutex_unlock(&extent_root->fs_info->chunk_mutex);
 	return ret;
 }
@@ -5303,11 +5368,13 @@
 
 		if (allowed_chunk_alloc) {
 			ret = do_chunk_alloc(trans, root, num_bytes +
-					     2 * 1024 * 1024, data, 1);
+					     2 * 1024 * 1024, data,
+					     CHUNK_ALLOC_LIMITED);
 			allowed_chunk_alloc = 0;
 			done_chunk_alloc = 1;
-		} else if (!done_chunk_alloc) {
-			space_info->force_alloc = 1;
+		} else if (!done_chunk_alloc &&
+			   space_info->force_alloc == CHUNK_ALLOC_NO_FORCE) {
+			space_info->force_alloc = CHUNK_ALLOC_LIMITED;
 		}
 
 		if (loop < LOOP_NO_EMPTY_SIZE) {
@@ -5393,7 +5460,8 @@
 	 */
 	if (empty_size || root->ref_cows)
 		ret = do_chunk_alloc(trans, root->fs_info->extent_root,
-				     num_bytes + 2 * 1024 * 1024, data, 0);
+				     num_bytes + 2 * 1024 * 1024, data,
+				     CHUNK_ALLOC_NO_FORCE);
 
 	WARN_ON(num_bytes < root->sectorsize);
 	ret = find_free_extent(trans, root, num_bytes, empty_size,
@@ -5405,7 +5473,7 @@
 		num_bytes = num_bytes & ~(root->sectorsize - 1);
 		num_bytes = max(num_bytes, min_alloc_size);
 		do_chunk_alloc(trans, root->fs_info->extent_root,
-			       num_bytes, data, 1);
+			       num_bytes, data, CHUNK_ALLOC_FORCE);
 		goto again;
 	}
 	if (ret == -ENOSPC && btrfs_test_opt(root, ENOSPC_DEBUG)) {
@@ -8109,13 +8177,15 @@
 
 	alloc_flags = update_block_group_flags(root, cache->flags);
 	if (alloc_flags != cache->flags)
-		do_chunk_alloc(trans, root, 2 * 1024 * 1024, alloc_flags, 1);
+		do_chunk_alloc(trans, root, 2 * 1024 * 1024, alloc_flags,
+			       CHUNK_ALLOC_FORCE);
 
 	ret = set_block_group_ro(cache);
 	if (!ret)
 		goto out;
 	alloc_flags = get_alloc_profile(root, cache->space_info->flags);
-	ret = do_chunk_alloc(trans, root, 2 * 1024 * 1024, alloc_flags, 1);
+	ret = do_chunk_alloc(trans, root, 2 * 1024 * 1024, alloc_flags,
+			     CHUNK_ALLOC_FORCE);
 	if (ret < 0)
 		goto out;
 	ret = set_block_group_ro(cache);
@@ -8128,7 +8198,8 @@
 			    struct btrfs_root *root, u64 type)
 {
 	u64 alloc_flags = get_alloc_profile(root, type);
-	return do_chunk_alloc(trans, root, 2 * 1024 * 1024, alloc_flags, 1);
+	return do_chunk_alloc(trans, root, 2 * 1024 * 1024, alloc_flags,
+			      CHUNK_ALLOC_FORCE);
 }
 
 /*
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 20ddb28..3151386 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -690,6 +690,15 @@
 	}
 }
 
+static void uncache_state(struct extent_state **cached_ptr)
+{
+	if (cached_ptr && (*cached_ptr)) {
+		struct extent_state *state = *cached_ptr;
+		*cached_ptr = NULL;
+		free_extent_state(state);
+	}
+}
+
 /*
  * set some bits on a range in the tree.  This may require allocations or
  * sleeping, so the gfp mask is used to indicate what is allowed.
@@ -940,10 +949,10 @@
 }
 
 int set_extent_uptodate(struct extent_io_tree *tree, u64 start, u64 end,
-			gfp_t mask)
+			struct extent_state **cached_state, gfp_t mask)
 {
-	return set_extent_bit(tree, start, end, EXTENT_UPTODATE, 0, NULL,
-			      NULL, mask);
+	return set_extent_bit(tree, start, end, EXTENT_UPTODATE, 0,
+			      NULL, cached_state, mask);
 }
 
 static int clear_extent_uptodate(struct extent_io_tree *tree, u64 start,
@@ -1012,8 +1021,7 @@
 				mask);
 }
 
-int unlock_extent(struct extent_io_tree *tree, u64 start, u64 end,
-		  gfp_t mask)
+int unlock_extent(struct extent_io_tree *tree, u64 start, u64 end, gfp_t mask)
 {
 	return clear_extent_bit(tree, start, end, EXTENT_LOCKED, 1, 0, NULL,
 				mask);
@@ -1735,6 +1743,9 @@
 
 	do {
 		struct page *page = bvec->bv_page;
+		struct extent_state *cached = NULL;
+		struct extent_state *state;
+
 		tree = &BTRFS_I(page->mapping->host)->io_tree;
 
 		start = ((u64)page->index << PAGE_CACHE_SHIFT) +
@@ -1749,9 +1760,20 @@
 		if (++bvec <= bvec_end)
 			prefetchw(&bvec->bv_page->flags);
 
+		spin_lock(&tree->lock);
+		state = find_first_extent_bit_state(tree, start, EXTENT_LOCKED);
+		if (state && state->start == start) {
+			/*
+			 * take a reference on the state, unlock will drop
+			 * the ref
+			 */
+			cache_state(state, &cached);
+		}
+		spin_unlock(&tree->lock);
+
 		if (uptodate && tree->ops && tree->ops->readpage_end_io_hook) {
 			ret = tree->ops->readpage_end_io_hook(page, start, end,
-							      NULL);
+							      state);
 			if (ret)
 				uptodate = 0;
 		}
@@ -1764,15 +1786,16 @@
 					test_bit(BIO_UPTODATE, &bio->bi_flags);
 				if (err)
 					uptodate = 0;
+				uncache_state(&cached);
 				continue;
 			}
 		}
 
 		if (uptodate) {
-			set_extent_uptodate(tree, start, end,
+			set_extent_uptodate(tree, start, end, &cached,
 					    GFP_ATOMIC);
 		}
-		unlock_extent(tree, start, end, GFP_ATOMIC);
+		unlock_extent_cached(tree, start, end, &cached, GFP_ATOMIC);
 
 		if (whole_page) {
 			if (uptodate) {
@@ -1811,6 +1834,7 @@
 
 	do {
 		struct page *page = bvec->bv_page;
+		struct extent_state *cached = NULL;
 		tree = &BTRFS_I(page->mapping->host)->io_tree;
 
 		start = ((u64)page->index << PAGE_CACHE_SHIFT) +
@@ -1821,13 +1845,14 @@
 			prefetchw(&bvec->bv_page->flags);
 
 		if (uptodate) {
-			set_extent_uptodate(tree, start, end, GFP_ATOMIC);
+			set_extent_uptodate(tree, start, end, &cached,
+					    GFP_ATOMIC);
 		} else {
 			ClearPageUptodate(page);
 			SetPageError(page);
 		}
 
-		unlock_extent(tree, start, end, GFP_ATOMIC);
+		unlock_extent_cached(tree, start, end, &cached, GFP_ATOMIC);
 
 	} while (bvec >= bio->bi_io_vec);
 
@@ -2016,14 +2041,17 @@
 	while (cur <= end) {
 		if (cur >= last_byte) {
 			char *userpage;
+			struct extent_state *cached = NULL;
+
 			iosize = PAGE_CACHE_SIZE - page_offset;
 			userpage = kmap_atomic(page, KM_USER0);
 			memset(userpage + page_offset, 0, iosize);
 			flush_dcache_page(page);
 			kunmap_atomic(userpage, KM_USER0);
 			set_extent_uptodate(tree, cur, cur + iosize - 1,
-					    GFP_NOFS);
-			unlock_extent(tree, cur, cur + iosize - 1, GFP_NOFS);
+					    &cached, GFP_NOFS);
+			unlock_extent_cached(tree, cur, cur + iosize - 1,
+					     &cached, GFP_NOFS);
 			break;
 		}
 		em = get_extent(inode, page, page_offset, cur,
@@ -2063,14 +2091,17 @@
 		/* we've found a hole, just zero and go on */
 		if (block_start == EXTENT_MAP_HOLE) {
 			char *userpage;
+			struct extent_state *cached = NULL;
+
 			userpage = kmap_atomic(page, KM_USER0);
 			memset(userpage + page_offset, 0, iosize);
 			flush_dcache_page(page);
 			kunmap_atomic(userpage, KM_USER0);
 
 			set_extent_uptodate(tree, cur, cur + iosize - 1,
-					    GFP_NOFS);
-			unlock_extent(tree, cur, cur + iosize - 1, GFP_NOFS);
+					    &cached, GFP_NOFS);
+			unlock_extent_cached(tree, cur, cur + iosize - 1,
+			                     &cached, GFP_NOFS);
 			cur = cur + iosize;
 			page_offset += iosize;
 			continue;
@@ -2789,9 +2820,12 @@
 			iocount++;
 			block_start = block_start + iosize;
 		} else {
-			set_extent_uptodate(tree, block_start, cur_end,
+			struct extent_state *cached = NULL;
+
+			set_extent_uptodate(tree, block_start, cur_end, &cached,
 					    GFP_NOFS);
-			unlock_extent(tree, block_start, cur_end, GFP_NOFS);
+			unlock_extent_cached(tree, block_start, cur_end,
+					     &cached, GFP_NOFS);
 			block_start = cur_end + 1;
 		}
 		page_offset = block_start & (PAGE_CACHE_SIZE - 1);
@@ -3457,7 +3491,7 @@
 	num_pages = num_extent_pages(eb->start, eb->len);
 
 	set_extent_uptodate(tree, eb->start, eb->start + eb->len - 1,
-			    GFP_NOFS);
+			    NULL, GFP_NOFS);
 	for (i = 0; i < num_pages; i++) {
 		page = extent_buffer_page(eb, i);
 		if ((i == 0 && (eb->start & (PAGE_CACHE_SIZE - 1))) ||
@@ -3885,6 +3919,12 @@
 	kunmap_atomic(dst_kaddr, KM_USER0);
 }
 
+static inline bool areas_overlap(unsigned long src, unsigned long dst, unsigned long len)
+{
+	unsigned long distance = (src > dst) ? src - dst : dst - src;
+	return distance < len;
+}
+
 static void copy_pages(struct page *dst_page, struct page *src_page,
 		       unsigned long dst_off, unsigned long src_off,
 		       unsigned long len)
@@ -3892,10 +3932,12 @@
 	char *dst_kaddr = kmap_atomic(dst_page, KM_USER0);
 	char *src_kaddr;
 
-	if (dst_page != src_page)
+	if (dst_page != src_page) {
 		src_kaddr = kmap_atomic(src_page, KM_USER1);
-	else
+	} else {
 		src_kaddr = dst_kaddr;
+		BUG_ON(areas_overlap(src_off, dst_off, len));
+	}
 
 	memcpy(dst_kaddr + dst_off, src_kaddr + src_off, len);
 	kunmap_atomic(dst_kaddr, KM_USER0);
@@ -3970,7 +4012,7 @@
 		       "len %lu len %lu\n", dst_offset, len, dst->len);
 		BUG_ON(1);
 	}
-	if (dst_offset < src_offset) {
+	if (!areas_overlap(src_offset, dst_offset, len)) {
 		memcpy_extent_buffer(dst, dst_offset, src_offset, len);
 		return;
 	}
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index f62c5442..af2d717 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -208,7 +208,7 @@
 		   int bits, int exclusive_bits, u64 *failed_start,
 		   struct extent_state **cached_state, gfp_t mask);
 int set_extent_uptodate(struct extent_io_tree *tree, u64 start, u64 end,
-			gfp_t mask);
+			struct extent_state **cached_state, gfp_t mask);
 int set_extent_new(struct extent_io_tree *tree, u64 start, u64 end,
 		   gfp_t mask);
 int set_extent_dirty(struct extent_io_tree *tree, u64 start, u64 end,
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index e621ea5..75899a0 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -104,7 +104,7 @@
 /*
  * unlocks pages after btrfs_file_write is done with them
  */
-static noinline void btrfs_drop_pages(struct page **pages, size_t num_pages)
+void btrfs_drop_pages(struct page **pages, size_t num_pages)
 {
 	size_t i;
 	for (i = 0; i < num_pages; i++) {
@@ -127,16 +127,13 @@
  * this also makes the decision about creating an inline extent vs
  * doing real data extents, marking pages dirty and delalloc as required.
  */
-static noinline int dirty_and_release_pages(struct btrfs_root *root,
-					    struct file *file,
-					    struct page **pages,
-					    size_t num_pages,
-					    loff_t pos,
-					    size_t write_bytes)
+int btrfs_dirty_pages(struct btrfs_root *root, struct inode *inode,
+		      struct page **pages, size_t num_pages,
+		      loff_t pos, size_t write_bytes,
+		      struct extent_state **cached)
 {
 	int err = 0;
 	int i;
-	struct inode *inode = fdentry(file)->d_inode;
 	u64 num_bytes;
 	u64 start_pos;
 	u64 end_of_last_block;
@@ -149,7 +146,7 @@
 
 	end_of_last_block = start_pos + num_bytes - 1;
 	err = btrfs_set_extent_delalloc(inode, start_pos, end_of_last_block,
-					NULL);
+					cached);
 	if (err)
 		return err;
 
@@ -992,9 +989,9 @@
 		}
 
 		if (copied > 0) {
-			ret = dirty_and_release_pages(root, file, pages,
-						      dirty_pages, pos,
-						      copied);
+			ret = btrfs_dirty_pages(root, inode, pages,
+						dirty_pages, pos, copied,
+						NULL);
 			if (ret) {
 				btrfs_delalloc_release_space(inode,
 					dirty_pages << PAGE_CACHE_SHIFT);
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index f561c95..11d2e9ce 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -508,6 +508,7 @@
 	struct inode *inode;
 	struct rb_node *node;
 	struct list_head *pos, *n;
+	struct page **pages;
 	struct page *page;
 	struct extent_state *cached_state = NULL;
 	struct btrfs_free_cluster *cluster = NULL;
@@ -517,13 +518,13 @@
 	u64 start, end, len;
 	u64 bytes = 0;
 	u32 *crc, *checksums;
-	pgoff_t index = 0, last_index = 0;
 	unsigned long first_page_offset;
-	int num_checksums;
+	int index = 0, num_pages = 0;
 	int entries = 0;
 	int bitmaps = 0;
 	int ret = 0;
 	bool next_page = false;
+	bool out_of_space = false;
 
 	root = root->fs_info->tree_root;
 
@@ -551,24 +552,31 @@
 		return 0;
 	}
 
-	last_index = (i_size_read(inode) - 1) >> PAGE_CACHE_SHIFT;
+	num_pages = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >>
+		PAGE_CACHE_SHIFT;
 	filemap_write_and_wait(inode->i_mapping);
 	btrfs_wait_ordered_range(inode, inode->i_size &
 				 ~(root->sectorsize - 1), (u64)-1);
 
 	/* We need a checksum per page. */
-	num_checksums = i_size_read(inode) / PAGE_CACHE_SIZE;
-	crc = checksums  = kzalloc(sizeof(u32) * num_checksums, GFP_NOFS);
+	crc = checksums = kzalloc(sizeof(u32) * num_pages, GFP_NOFS);
 	if (!crc) {
 		iput(inode);
 		return 0;
 	}
 
+	pages = kzalloc(sizeof(struct page *) * num_pages, GFP_NOFS);
+	if (!pages) {
+		kfree(crc);
+		iput(inode);
+		return 0;
+	}
+
 	/* Since the first page has all of our checksums and our generation we
 	 * need to calculate the offset into the page that we can start writing
 	 * our entries.
 	 */
-	first_page_offset = (sizeof(u32) * num_checksums) + sizeof(u64);
+	first_page_offset = (sizeof(u32) * num_pages) + sizeof(u64);
 
 	/* Get the cluster for this block_group if it exists */
 	if (!list_empty(&block_group->cluster_list))
@@ -590,20 +598,18 @@
 	 * after find_get_page at this point.  Just putting this here so people
 	 * know and don't freak out.
 	 */
-	while (index <= last_index) {
+	while (index < num_pages) {
 		page = grab_cache_page(inode->i_mapping, index);
 		if (!page) {
-			pgoff_t i = 0;
+			int i;
 
-			while (i < index) {
-				page = find_get_page(inode->i_mapping, i);
-				unlock_page(page);
-				page_cache_release(page);
-				page_cache_release(page);
-				i++;
+			for (i = 0; i < num_pages; i++) {
+				unlock_page(pages[i]);
+				page_cache_release(pages[i]);
 			}
 			goto out_free;
 		}
+		pages[index] = page;
 		index++;
 	}
 
@@ -631,7 +637,12 @@
 			offset = start_offset;
 		}
 
-		page = find_get_page(inode->i_mapping, index);
+		if (index >= num_pages) {
+			out_of_space = true;
+			break;
+		}
+
+		page = pages[index];
 
 		addr = kmap(page);
 		entry = addr + start_offset;
@@ -708,23 +719,6 @@
 
 		bytes += PAGE_CACHE_SIZE;
 
-		ClearPageChecked(page);
-		set_page_extent_mapped(page);
-		SetPageUptodate(page);
-		set_page_dirty(page);
-
-		/*
-		 * We need to release our reference we got for grab_cache_page,
-		 * except for the first page which will hold our checksums, we
-		 * do that below.
-		 */
-		if (index != 0) {
-			unlock_page(page);
-			page_cache_release(page);
-		}
-
-		page_cache_release(page);
-
 		index++;
 	} while (node || next_page);
 
@@ -734,7 +728,11 @@
 		struct btrfs_free_space *entry =
 			list_entry(pos, struct btrfs_free_space, list);
 
-		page = find_get_page(inode->i_mapping, index);
+		if (index >= num_pages) {
+			out_of_space = true;
+			break;
+		}
+		page = pages[index];
 
 		addr = kmap(page);
 		memcpy(addr, entry->bitmap, PAGE_CACHE_SIZE);
@@ -745,64 +743,58 @@
 		crc++;
 		bytes += PAGE_CACHE_SIZE;
 
-		ClearPageChecked(page);
-		set_page_extent_mapped(page);
-		SetPageUptodate(page);
-		set_page_dirty(page);
-		unlock_page(page);
-		page_cache_release(page);
-		page_cache_release(page);
 		list_del_init(&entry->list);
 		index++;
 	}
 
+	if (out_of_space) {
+		btrfs_drop_pages(pages, num_pages);
+		unlock_extent_cached(&BTRFS_I(inode)->io_tree, 0,
+				     i_size_read(inode) - 1, &cached_state,
+				     GFP_NOFS);
+		ret = 0;
+		goto out_free;
+	}
+
 	/* Zero out the rest of the pages just to make sure */
-	while (index <= last_index) {
+	while (index < num_pages) {
 		void *addr;
 
-		page = find_get_page(inode->i_mapping, index);
-
+		page = pages[index];
 		addr = kmap(page);
 		memset(addr, 0, PAGE_CACHE_SIZE);
 		kunmap(page);
-		ClearPageChecked(page);
-		set_page_extent_mapped(page);
-		SetPageUptodate(page);
-		set_page_dirty(page);
-		unlock_page(page);
-		page_cache_release(page);
-		page_cache_release(page);
 		bytes += PAGE_CACHE_SIZE;
 		index++;
 	}
 
-	btrfs_set_extent_delalloc(inode, 0, bytes - 1, &cached_state);
-
 	/* Write the checksums and trans id to the first page */
 	{
 		void *addr;
 		u64 *gen;
 
-		page = find_get_page(inode->i_mapping, 0);
+		page = pages[0];
 
 		addr = kmap(page);
-		memcpy(addr, checksums, sizeof(u32) * num_checksums);
-		gen = addr + (sizeof(u32) * num_checksums);
+		memcpy(addr, checksums, sizeof(u32) * num_pages);
+		gen = addr + (sizeof(u32) * num_pages);
 		*gen = trans->transid;
 		kunmap(page);
-		ClearPageChecked(page);
-		set_page_extent_mapped(page);
-		SetPageUptodate(page);
-		set_page_dirty(page);
-		unlock_page(page);
-		page_cache_release(page);
-		page_cache_release(page);
 	}
-	BTRFS_I(inode)->generation = trans->transid;
 
+	ret = btrfs_dirty_pages(root, inode, pages, num_pages, 0,
+					    bytes, &cached_state);
+	btrfs_drop_pages(pages, num_pages);
 	unlock_extent_cached(&BTRFS_I(inode)->io_tree, 0,
 			     i_size_read(inode) - 1, &cached_state, GFP_NOFS);
 
+	if (ret) {
+		ret = 0;
+		goto out_free;
+	}
+
+	BTRFS_I(inode)->generation = trans->transid;
+
 	filemap_write_and_wait(inode->i_mapping);
 
 	key.objectid = BTRFS_FREE_SPACE_OBJECTID;
@@ -853,6 +845,7 @@
 		BTRFS_I(inode)->generation = 0;
 	}
 	kfree(checksums);
+	kfree(pages);
 	btrfs_update_inode(trans, root, inode);
 	iput(inode);
 	return ret;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 5cc64ab9c..fcd66b6 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1770,9 +1770,12 @@
 	add_pending_csums(trans, inode, ordered_extent->file_offset,
 			  &ordered_extent->list);
 
-	btrfs_ordered_update_i_size(inode, 0, ordered_extent);
-	ret = btrfs_update_inode(trans, root, inode);
-	BUG_ON(ret);
+	ret = btrfs_ordered_update_i_size(inode, 0, ordered_extent);
+	if (!ret) {
+		ret = btrfs_update_inode(trans, root, inode);
+		BUG_ON(ret);
+	}
+	ret = 0;
 out:
 	if (nolock) {
 		if (trans)
@@ -2590,6 +2593,13 @@
 			    struct btrfs_inode_item *item,
 			    struct inode *inode)
 {
+	if (!leaf->map_token)
+		map_private_extent_buffer(leaf, (unsigned long)item,
+					  sizeof(struct btrfs_inode_item),
+					  &leaf->map_token, &leaf->kaddr,
+					  &leaf->map_start, &leaf->map_len,
+					  KM_USER1);
+
 	btrfs_set_inode_uid(leaf, item, inode->i_uid);
 	btrfs_set_inode_gid(leaf, item, inode->i_gid);
 	btrfs_set_inode_size(leaf, item, BTRFS_I(inode)->disk_i_size);
@@ -2618,6 +2628,11 @@
 	btrfs_set_inode_rdev(leaf, item, inode->i_rdev);
 	btrfs_set_inode_flags(leaf, item, BTRFS_I(inode)->flags);
 	btrfs_set_inode_block_group(leaf, item, BTRFS_I(inode)->block_group);
+
+	if (leaf->map_token) {
+		unmap_extent_buffer(leaf, leaf->map_token, KM_USER1);
+		leaf->map_token = NULL;
+	}
 }
 
 /*
@@ -4207,10 +4222,8 @@
 	struct btrfs_key found_key;
 	struct btrfs_path *path;
 	int ret;
-	u32 nritems;
 	struct extent_buffer *leaf;
 	int slot;
-	int advance;
 	unsigned char d_type;
 	int over = 0;
 	u32 di_cur;
@@ -4253,27 +4266,19 @@
 	ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
 	if (ret < 0)
 		goto err;
-	advance = 0;
 
 	while (1) {
 		leaf = path->nodes[0];
-		nritems = btrfs_header_nritems(leaf);
 		slot = path->slots[0];
-		if (advance || slot >= nritems) {
-			if (slot >= nritems - 1) {
-				ret = btrfs_next_leaf(root, path);
-				if (ret)
-					break;
-				leaf = path->nodes[0];
-				nritems = btrfs_header_nritems(leaf);
-				slot = path->slots[0];
-			} else {
-				slot++;
-				path->slots[0]++;
-			}
+		if (slot >= btrfs_header_nritems(leaf)) {
+			ret = btrfs_next_leaf(root, path);
+			if (ret < 0)
+				goto err;
+			else if (ret > 0)
+				break;
+			continue;
 		}
 
-		advance = 1;
 		item = btrfs_item_nr(leaf, slot);
 		btrfs_item_key_to_cpu(leaf, &found_key, slot);
 
@@ -4282,7 +4287,7 @@
 		if (btrfs_key_type(&found_key) != key_type)
 			break;
 		if (found_key.offset < filp->f_pos)
-			continue;
+			goto next;
 
 		filp->f_pos = found_key.offset;
 
@@ -4335,6 +4340,8 @@
 			di_cur += di_len;
 			di = (struct btrfs_dir_item *)((char *)di + di_len);
 		}
+next:
+		path->slots[0]++;
 	}
 
 	/* Reached end of directory/root. Bump pos past the last item. */
@@ -4527,14 +4534,17 @@
 	BUG_ON(!path);
 
 	inode = new_inode(root->fs_info->sb);
-	if (!inode)
+	if (!inode) {
+		btrfs_free_path(path);
 		return ERR_PTR(-ENOMEM);
+	}
 
 	if (dir) {
 		trace_btrfs_inode_request(dir);
 
 		ret = btrfs_set_inode_index(dir, index);
 		if (ret) {
+			btrfs_free_path(path);
 			iput(inode);
 			return ERR_PTR(ret);
 		}
@@ -4834,9 +4844,6 @@
 	if (inode->i_nlink == ~0U)
 		return -EMLINK;
 
-	btrfs_inc_nlink(inode);
-	inode->i_ctime = CURRENT_TIME;
-
 	err = btrfs_set_inode_index(dir, &index);
 	if (err)
 		goto fail;
@@ -4852,6 +4859,9 @@
 		goto fail;
 	}
 
+	btrfs_inc_nlink(inode);
+	inode->i_ctime = CURRENT_TIME;
+
 	btrfs_set_trans_block_group(trans, dir);
 	ihold(inode);
 
@@ -5221,7 +5231,7 @@
 			btrfs_mark_buffer_dirty(leaf);
 		}
 		set_extent_uptodate(io_tree, em->start,
-				    extent_map_end(em) - 1, GFP_NOFS);
+				    extent_map_end(em) - 1, NULL, GFP_NOFS);
 		goto insert;
 	} else {
 		printk(KERN_ERR "btrfs unknown found_type %d\n", found_type);
@@ -5428,17 +5438,30 @@
 }
 
 static struct extent_map *btrfs_new_extent_direct(struct inode *inode,
+						  struct extent_map *em,
 						  u64 start, u64 len)
 {
 	struct btrfs_root *root = BTRFS_I(inode)->root;
 	struct btrfs_trans_handle *trans;
-	struct extent_map *em;
 	struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree;
 	struct btrfs_key ins;
 	u64 alloc_hint;
 	int ret;
+	bool insert = false;
 
-	btrfs_drop_extent_cache(inode, start, start + len - 1, 0);
+	/*
+	 * Ok if the extent map we looked up is a hole and is for the exact
+	 * range we want, there is no reason to allocate a new one, however if
+	 * it is not right then we need to free this one and drop the cache for
+	 * our range.
+	 */
+	if (em->block_start != EXTENT_MAP_HOLE || em->start != start ||
+	    em->len != len) {
+		free_extent_map(em);
+		em = NULL;
+		insert = true;
+		btrfs_drop_extent_cache(inode, start, start + len - 1, 0);
+	}
 
 	trans = btrfs_join_transaction(root, 0);
 	if (IS_ERR(trans))
@@ -5454,10 +5477,12 @@
 		goto out;
 	}
 
-	em = alloc_extent_map(GFP_NOFS);
 	if (!em) {
-		em = ERR_PTR(-ENOMEM);
-		goto out;
+		em = alloc_extent_map(GFP_NOFS);
+		if (!em) {
+			em = ERR_PTR(-ENOMEM);
+			goto out;
+		}
 	}
 
 	em->start = start;
@@ -5467,9 +5492,15 @@
 	em->block_start = ins.objectid;
 	em->block_len = ins.offset;
 	em->bdev = root->fs_info->fs_devices->latest_bdev;
+
+	/*
+	 * We need to do this because if we're using the original em we searched
+	 * for, we could have EXTENT_FLAG_VACANCY set, and we don't want that.
+	 */
+	em->flags = 0;
 	set_bit(EXTENT_FLAG_PINNED, &em->flags);
 
-	while (1) {
+	while (insert) {
 		write_lock(&em_tree->lock);
 		ret = add_extent_mapping(em_tree, em);
 		write_unlock(&em_tree->lock);
@@ -5687,8 +5718,7 @@
 	 * it above
 	 */
 	len = bh_result->b_size;
-	free_extent_map(em);
-	em = btrfs_new_extent_direct(inode, start, len);
+	em = btrfs_new_extent_direct(inode, em, start, len);
 	if (IS_ERR(em))
 		return PTR_ERR(em);
 	len = min(len, em->len - (start - em->start));
@@ -5851,8 +5881,10 @@
 	}
 
 	add_pending_csums(trans, inode, ordered->file_offset, &ordered->list);
-	btrfs_ordered_update_i_size(inode, 0, ordered);
-	btrfs_update_inode(trans, root, inode);
+	ret = btrfs_ordered_update_i_size(inode, 0, ordered);
+	if (!ret)
+		btrfs_update_inode(trans, root, inode);
+	ret = 0;
 out_unlock:
 	unlock_extent_cached(&BTRFS_I(inode)->io_tree, ordered->file_offset,
 			     ordered->file_offset + ordered->len - 1,
@@ -5938,7 +5970,7 @@
 
 static inline int __btrfs_submit_dio_bio(struct bio *bio, struct inode *inode,
 					 int rw, u64 file_offset, int skip_sum,
-					 u32 *csums)
+					 u32 *csums, int async_submit)
 {
 	int write = rw & REQ_WRITE;
 	struct btrfs_root *root = BTRFS_I(inode)->root;
@@ -5949,13 +5981,24 @@
 	if (ret)
 		goto err;
 
-	if (write && !skip_sum) {
+	if (skip_sum)
+		goto map;
+
+	if (write && async_submit) {
 		ret = btrfs_wq_submit_bio(root->fs_info,
 				   inode, rw, bio, 0, 0,
 				   file_offset,
 				   __btrfs_submit_bio_start_direct_io,
 				   __btrfs_submit_bio_done);
 		goto err;
+	} else if (write) {
+		/*
+		 * If we aren't doing async submit, calculate the csum of the
+		 * bio now.
+		 */
+		ret = btrfs_csum_one_bio(root, inode, bio, file_offset, 1);
+		if (ret)
+			goto err;
 	} else if (!skip_sum) {
 		ret = btrfs_lookup_bio_sums_dio(root, inode, bio,
 					  file_offset, csums);
@@ -5963,7 +6006,8 @@
 			goto err;
 	}
 
-	ret = btrfs_map_bio(root, rw, bio, 0, 1);
+map:
+	ret = btrfs_map_bio(root, rw, bio, 0, async_submit);
 err:
 	bio_put(bio);
 	return ret;
@@ -5985,15 +6029,9 @@
 	int nr_pages = 0;
 	u32 *csums = dip->csums;
 	int ret = 0;
+	int async_submit = 0;
 	int write = rw & REQ_WRITE;
 
-	bio = btrfs_dio_bio_alloc(orig_bio->bi_bdev, start_sector, GFP_NOFS);
-	if (!bio)
-		return -ENOMEM;
-	bio->bi_private = dip;
-	bio->bi_end_io = btrfs_end_dio_bio;
-	atomic_inc(&dip->pending_bios);
-
 	map_length = orig_bio->bi_size;
 	ret = btrfs_map_block(map_tree, READ, start_sector << 9,
 			      &map_length, NULL, 0);
@@ -6002,6 +6040,19 @@
 		return -EIO;
 	}
 
+	if (map_length >= orig_bio->bi_size) {
+		bio = orig_bio;
+		goto submit;
+	}
+
+	async_submit = 1;
+	bio = btrfs_dio_bio_alloc(orig_bio->bi_bdev, start_sector, GFP_NOFS);
+	if (!bio)
+		return -ENOMEM;
+	bio->bi_private = dip;
+	bio->bi_end_io = btrfs_end_dio_bio;
+	atomic_inc(&dip->pending_bios);
+
 	while (bvec <= (orig_bio->bi_io_vec + orig_bio->bi_vcnt - 1)) {
 		if (unlikely(map_length < submit_len + bvec->bv_len ||
 		    bio_add_page(bio, bvec->bv_page, bvec->bv_len,
@@ -6015,7 +6066,7 @@
 			atomic_inc(&dip->pending_bios);
 			ret = __btrfs_submit_dio_bio(bio, inode, rw,
 						     file_offset, skip_sum,
-						     csums);
+						     csums, async_submit);
 			if (ret) {
 				bio_put(bio);
 				atomic_dec(&dip->pending_bios);
@@ -6052,8 +6103,9 @@
 		}
 	}
 
+submit:
 	ret = __btrfs_submit_dio_bio(bio, inode, rw, file_offset, skip_sum,
-				     csums);
+				     csums, async_submit);
 	if (!ret)
 		return 0;
 
@@ -6148,6 +6200,7 @@
 			unsigned long nr_segs)
 {
 	int seg;
+	int i;
 	size_t size;
 	unsigned long addr;
 	unsigned blocksize_mask = root->sectorsize - 1;
@@ -6162,8 +6215,22 @@
 		addr = (unsigned long)iov[seg].iov_base;
 		size = iov[seg].iov_len;
 		end += size;
-		if ((addr & blocksize_mask) || (size & blocksize_mask)) 
+		if ((addr & blocksize_mask) || (size & blocksize_mask))
 			goto out;
+
+		/* If this is a write we don't need to check anymore */
+		if (rw & WRITE)
+			continue;
+
+		/*
+		 * Check to make sure we don't have duplicate iov_base's in this
+		 * iovec, if so return EINVAL, otherwise we'll get csum errors
+		 * when reading back.
+		 */
+		for (i = seg + 1; i < nr_segs; i++) {
+			if (iov[seg].iov_base == iov[i].iov_base)
+				goto out;
+		}
 	}
 	retval = 0;
 out:
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index cfc264f..ffb48d6c 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2287,7 +2287,7 @@
 	struct btrfs_ioctl_space_info space;
 	struct btrfs_ioctl_space_info *dest;
 	struct btrfs_ioctl_space_info *dest_orig;
-	struct btrfs_ioctl_space_info *user_dest;
+	struct btrfs_ioctl_space_info __user *user_dest;
 	struct btrfs_space_info *info;
 	u64 types[] = {BTRFS_BLOCK_GROUP_DATA,
 		       BTRFS_BLOCK_GROUP_SYSTEM,
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 58e7de9..0ac712e 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -159,7 +159,7 @@
 	Opt_compress_type, Opt_compress_force, Opt_compress_force_type,
 	Opt_notreelog, Opt_ratio, Opt_flushoncommit, Opt_discard,
 	Opt_space_cache, Opt_clear_cache, Opt_user_subvol_rm_allowed,
-	Opt_enospc_debug, Opt_err,
+	Opt_enospc_debug, Opt_subvolrootid, Opt_err,
 };
 
 static match_table_t tokens = {
@@ -189,6 +189,7 @@
 	{Opt_clear_cache, "clear_cache"},
 	{Opt_user_subvol_rm_allowed, "user_subvol_rm_allowed"},
 	{Opt_enospc_debug, "enospc_debug"},
+	{Opt_subvolrootid, "subvolrootid=%d"},
 	{Opt_err, NULL},
 };
 
@@ -232,6 +233,7 @@
 			break;
 		case Opt_subvol:
 		case Opt_subvolid:
+		case Opt_subvolrootid:
 		case Opt_device:
 			/*
 			 * These are parsed by btrfs_parse_early_options
@@ -388,7 +390,7 @@
  */
 static int btrfs_parse_early_options(const char *options, fmode_t flags,
 		void *holder, char **subvol_name, u64 *subvol_objectid,
-		struct btrfs_fs_devices **fs_devices)
+		u64 *subvol_rootid, struct btrfs_fs_devices **fs_devices)
 {
 	substring_t args[MAX_OPT_ARGS];
 	char *opts, *orig, *p;
@@ -429,6 +431,18 @@
 					*subvol_objectid = intarg;
 			}
 			break;
+		case Opt_subvolrootid:
+			intarg = 0;
+			error = match_int(&args[0], &intarg);
+			if (!error) {
+				/* we want the original fs_tree */
+				if (!intarg)
+					*subvol_rootid =
+						BTRFS_FS_TREE_OBJECTID;
+				else
+					*subvol_rootid = intarg;
+			}
+			break;
 		case Opt_device:
 			error = btrfs_scan_one_device(match_strdup(&args[0]),
 					flags, holder, fs_devices);
@@ -736,6 +750,7 @@
 	fmode_t mode = FMODE_READ;
 	char *subvol_name = NULL;
 	u64 subvol_objectid = 0;
+	u64 subvol_rootid = 0;
 	int error = 0;
 
 	if (!(flags & MS_RDONLY))
@@ -743,7 +758,7 @@
 
 	error = btrfs_parse_early_options(data, mode, fs_type,
 					  &subvol_name, &subvol_objectid,
-					  &fs_devices);
+					  &subvol_rootid, &fs_devices);
 	if (error)
 		return ERR_PTR(error);
 
@@ -807,15 +822,17 @@
 		s->s_flags |= MS_ACTIVE;
 	}
 
-	root = get_default_root(s, subvol_objectid);
-	if (IS_ERR(root)) {
-		error = PTR_ERR(root);
-		deactivate_locked_super(s);
-		goto error_free_subvol_name;
-	}
 	/* if they gave us a subvolume name bind mount into that */
 	if (strcmp(subvol_name, ".")) {
 		struct dentry *new_root;
+
+		root = get_default_root(s, subvol_rootid);
+		if (IS_ERR(root)) {
+			error = PTR_ERR(root);
+			deactivate_locked_super(s);
+			goto error_free_subvol_name;
+		}
+
 		mutex_lock(&root->d_inode->i_mutex);
 		new_root = lookup_one_len(subvol_name, root,
 				      strlen(subvol_name));
@@ -836,6 +853,13 @@
 		}
 		dput(root);
 		root = new_root;
+	} else {
+		root = get_default_root(s, subvol_objectid);
+		if (IS_ERR(root)) {
+			error = PTR_ERR(root);
+			deactivate_locked_super(s);
+			goto error_free_subvol_name;
+		}
 	}
 
 	kfree(subvol_name);
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 5b158da..c571734 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -32,10 +32,8 @@
 
 static noinline void put_transaction(struct btrfs_transaction *transaction)
 {
-	WARN_ON(transaction->use_count == 0);
-	transaction->use_count--;
-	if (transaction->use_count == 0) {
-		list_del_init(&transaction->list);
+	WARN_ON(atomic_read(&transaction->use_count) == 0);
+	if (atomic_dec_and_test(&transaction->use_count)) {
 		memset(transaction, 0, sizeof(*transaction));
 		kmem_cache_free(btrfs_transaction_cachep, transaction);
 	}
@@ -60,14 +58,14 @@
 		if (!cur_trans)
 			return -ENOMEM;
 		root->fs_info->generation++;
-		cur_trans->num_writers = 1;
+		atomic_set(&cur_trans->num_writers, 1);
 		cur_trans->num_joined = 0;
 		cur_trans->transid = root->fs_info->generation;
 		init_waitqueue_head(&cur_trans->writer_wait);
 		init_waitqueue_head(&cur_trans->commit_wait);
 		cur_trans->in_commit = 0;
 		cur_trans->blocked = 0;
-		cur_trans->use_count = 1;
+		atomic_set(&cur_trans->use_count, 1);
 		cur_trans->commit_done = 0;
 		cur_trans->start_time = get_seconds();
 
@@ -88,7 +86,7 @@
 		root->fs_info->running_transaction = cur_trans;
 		spin_unlock(&root->fs_info->new_trans_lock);
 	} else {
-		cur_trans->num_writers++;
+		atomic_inc(&cur_trans->num_writers);
 		cur_trans->num_joined++;
 	}
 
@@ -145,7 +143,7 @@
 	cur_trans = root->fs_info->running_transaction;
 	if (cur_trans && cur_trans->blocked) {
 		DEFINE_WAIT(wait);
-		cur_trans->use_count++;
+		atomic_inc(&cur_trans->use_count);
 		while (1) {
 			prepare_to_wait(&root->fs_info->transaction_wait, &wait,
 					TASK_UNINTERRUPTIBLE);
@@ -181,6 +179,7 @@
 {
 	struct btrfs_trans_handle *h;
 	struct btrfs_transaction *cur_trans;
+	int retries = 0;
 	int ret;
 
 	if (root->fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR)
@@ -204,7 +203,7 @@
 	}
 
 	cur_trans = root->fs_info->running_transaction;
-	cur_trans->use_count++;
+	atomic_inc(&cur_trans->use_count);
 	if (type != TRANS_JOIN_NOLOCK)
 		mutex_unlock(&root->fs_info->trans_mutex);
 
@@ -224,10 +223,18 @@
 
 	if (num_items > 0) {
 		ret = btrfs_trans_reserve_metadata(h, root, num_items);
-		if (ret == -EAGAIN) {
+		if (ret == -EAGAIN && !retries) {
+			retries++;
 			btrfs_commit_transaction(h, root);
 			goto again;
+		} else if (ret == -EAGAIN) {
+			/*
+			 * We have already retried and got EAGAIN, so really we
+			 * don't have space, so set ret to -ENOSPC.
+			 */
+			ret = -ENOSPC;
 		}
+
 		if (ret < 0) {
 			btrfs_end_transaction(h, root);
 			return ERR_PTR(ret);
@@ -327,7 +334,7 @@
 			goto out_unlock;  /* nothing committing|committed */
 	}
 
-	cur_trans->use_count++;
+	atomic_inc(&cur_trans->use_count);
 	mutex_unlock(&root->fs_info->trans_mutex);
 
 	wait_for_commit(root, cur_trans);
@@ -457,18 +464,14 @@
 			wake_up_process(info->transaction_kthread);
 	}
 
-	if (lock)
-		mutex_lock(&info->trans_mutex);
 	WARN_ON(cur_trans != info->running_transaction);
-	WARN_ON(cur_trans->num_writers < 1);
-	cur_trans->num_writers--;
+	WARN_ON(atomic_read(&cur_trans->num_writers) < 1);
+	atomic_dec(&cur_trans->num_writers);
 
 	smp_mb();
 	if (waitqueue_active(&cur_trans->writer_wait))
 		wake_up(&cur_trans->writer_wait);
 	put_transaction(cur_trans);
-	if (lock)
-		mutex_unlock(&info->trans_mutex);
 
 	if (current->journal_info == trans)
 		current->journal_info = NULL;
@@ -1178,7 +1181,7 @@
 	/* take transaction reference */
 	mutex_lock(&root->fs_info->trans_mutex);
 	cur_trans = trans->transaction;
-	cur_trans->use_count++;
+	atomic_inc(&cur_trans->use_count);
 	mutex_unlock(&root->fs_info->trans_mutex);
 
 	btrfs_end_transaction(trans, root);
@@ -1237,7 +1240,7 @@
 
 	mutex_lock(&root->fs_info->trans_mutex);
 	if (cur_trans->in_commit) {
-		cur_trans->use_count++;
+		atomic_inc(&cur_trans->use_count);
 		mutex_unlock(&root->fs_info->trans_mutex);
 		btrfs_end_transaction(trans, root);
 
@@ -1259,7 +1262,7 @@
 		prev_trans = list_entry(cur_trans->list.prev,
 					struct btrfs_transaction, list);
 		if (!prev_trans->commit_done) {
-			prev_trans->use_count++;
+			atomic_inc(&prev_trans->use_count);
 			mutex_unlock(&root->fs_info->trans_mutex);
 
 			wait_for_commit(root, prev_trans);
@@ -1300,14 +1303,14 @@
 				TASK_UNINTERRUPTIBLE);
 
 		smp_mb();
-		if (cur_trans->num_writers > 1)
+		if (atomic_read(&cur_trans->num_writers) > 1)
 			schedule_timeout(MAX_SCHEDULE_TIMEOUT);
 		else if (should_grow)
 			schedule_timeout(1);
 
 		mutex_lock(&root->fs_info->trans_mutex);
 		finish_wait(&cur_trans->writer_wait, &wait);
-	} while (cur_trans->num_writers > 1 ||
+	} while (atomic_read(&cur_trans->num_writers) > 1 ||
 		 (should_grow && cur_trans->num_joined != joined));
 
 	ret = create_pending_snapshots(trans, root->fs_info);
@@ -1394,6 +1397,7 @@
 
 	wake_up(&cur_trans->commit_wait);
 
+	list_del_init(&cur_trans->list);
 	put_transaction(cur_trans);
 	put_transaction(cur_trans);
 
diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h
index 229a594..e441acc 100644
--- a/fs/btrfs/transaction.h
+++ b/fs/btrfs/transaction.h
@@ -27,11 +27,11 @@
 	 * total writers in this transaction, it must be zero before the
 	 * transaction can end
 	 */
-	unsigned long num_writers;
+	atomic_t num_writers;
 
 	unsigned long num_joined;
 	int in_commit;
-	int use_count;
+	atomic_t use_count;
 	int commit_done;
 	int blocked;
 	struct list_head list;
diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
index a5303b8..cfd6605 100644
--- a/fs/btrfs/xattr.c
+++ b/fs/btrfs/xattr.c
@@ -180,11 +180,10 @@
 	struct btrfs_path *path;
 	struct extent_buffer *leaf;
 	struct btrfs_dir_item *di;
-	int ret = 0, slot, advance;
+	int ret = 0, slot;
 	size_t total_size = 0, size_left = size;
 	unsigned long name_ptr;
 	size_t name_len;
-	u32 nritems;
 
 	/*
 	 * ok we want all objects associated with this id.
@@ -204,34 +203,24 @@
 	ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
 	if (ret < 0)
 		goto err;
-	advance = 0;
+
 	while (1) {
 		leaf = path->nodes[0];
-		nritems = btrfs_header_nritems(leaf);
 		slot = path->slots[0];
 
 		/* this is where we start walking through the path */
-		if (advance || slot >= nritems) {
+		if (slot >= btrfs_header_nritems(leaf)) {
 			/*
 			 * if we've reached the last slot in this leaf we need
 			 * to go to the next leaf and reset everything
 			 */
-			if (slot >= nritems-1) {
-				ret = btrfs_next_leaf(root, path);
-				if (ret)
-					break;
-				leaf = path->nodes[0];
-				nritems = btrfs_header_nritems(leaf);
-				slot = path->slots[0];
-			} else {
-				/*
-				 * just walking through the slots on this leaf
-				 */
-				slot++;
-				path->slots[0]++;
-			}
+			ret = btrfs_next_leaf(root, path);
+			if (ret < 0)
+				goto err;
+			else if (ret > 0)
+				break;
+			continue;
 		}
-		advance = 1;
 
 		btrfs_item_key_to_cpu(leaf, &found_key, slot);
 
@@ -250,7 +239,7 @@
 
 		/* we are just looking for how big our buffer needs to be */
 		if (!size)
-			continue;
+			goto next;
 
 		if (!buffer || (name_len + 1) > size_left) {
 			ret = -ERANGE;
@@ -263,6 +252,8 @@
 
 		size_left -= name_len + 1;
 		buffer += name_len + 1;
+next:
+		path->slots[0]++;
 	}
 	ret = total_size;
 
diff --git a/fs/cifs/README b/fs/cifs/README
index fe16835..74ab165f 100644
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -685,22 +685,6 @@
 			support and want to map the uid and gid fields 
 			to values supplied at mount (rather than the 
 			actual values, then set this to zero. (default 1)
-Experimental            When set to 1 used to enable certain experimental
-			features (currently enables multipage writes
-			when signing is enabled, the multipage write
-			performance enhancement was disabled when
-			signing turned on in case buffer was modified
-			just before it was sent, also this flag will
-			be used to use the new experimental directory change 
-			notification code).  When set to 2 enables
-			an additional experimental feature, "raw ntlmssp"
-			session establishment support (which allows
-			specifying "sec=ntlmssp" on mount). The Linux cifs
-			module will use ntlmv2 authentication encapsulated
-			in "raw ntlmssp" (not using SPNEGO) when
-			"sec=ntlmssp" is specified on mount.
-			This support also requires building cifs with
-			the CONFIG_CIFS_EXPERIMENTAL configuration flag.
 
 These experimental features and tracing can be enabled by changing flags in 
 /proc/fs/cifs (after the cifs module has been installed or built into the 
diff --git a/fs/cifs/cache.c b/fs/cifs/cache.c
index e654dfd0..53d57a3 100644
--- a/fs/cifs/cache.c
+++ b/fs/cifs/cache.c
@@ -50,7 +50,7 @@
  */
 struct cifs_server_key {
 	uint16_t	family;		/* address family */
-	uint16_t	port;		/* IP port */
+	__be16		port;		/* IP port */
 	union {
 		struct in_addr	ipv4_addr;
 		struct in6_addr	ipv6_addr;
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 65829d3..30d01bc 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -423,7 +423,6 @@
 static const struct file_operations traceSMB_proc_fops;
 static const struct file_operations cifs_multiuser_mount_proc_fops;
 static const struct file_operations cifs_security_flags_proc_fops;
-static const struct file_operations cifs_experimental_proc_fops;
 static const struct file_operations cifs_linux_ext_proc_fops;
 
 void
@@ -441,8 +440,6 @@
 	proc_create("cifsFYI", 0, proc_fs_cifs, &cifsFYI_proc_fops);
 	proc_create("traceSMB", 0, proc_fs_cifs, &traceSMB_proc_fops);
 	proc_create("OplockEnabled", 0, proc_fs_cifs, &cifs_oplock_proc_fops);
-	proc_create("Experimental", 0, proc_fs_cifs,
-		    &cifs_experimental_proc_fops);
 	proc_create("LinuxExtensionsEnabled", 0, proc_fs_cifs,
 		    &cifs_linux_ext_proc_fops);
 	proc_create("MultiuserMount", 0, proc_fs_cifs,
@@ -469,7 +466,6 @@
 	remove_proc_entry("OplockEnabled", proc_fs_cifs);
 	remove_proc_entry("SecurityFlags", proc_fs_cifs);
 	remove_proc_entry("LinuxExtensionsEnabled", proc_fs_cifs);
-	remove_proc_entry("Experimental", proc_fs_cifs);
 	remove_proc_entry("LookupCacheEnabled", proc_fs_cifs);
 	remove_proc_entry("fs/cifs", NULL);
 }
@@ -550,45 +546,6 @@
 	.write		= cifs_oplock_proc_write,
 };
 
-static int cifs_experimental_proc_show(struct seq_file *m, void *v)
-{
-	seq_printf(m, "%d\n", experimEnabled);
-	return 0;
-}
-
-static int cifs_experimental_proc_open(struct inode *inode, struct file *file)
-{
-	return single_open(file, cifs_experimental_proc_show, NULL);
-}
-
-static ssize_t cifs_experimental_proc_write(struct file *file,
-		const char __user *buffer, size_t count, loff_t *ppos)
-{
-	char c;
-	int rc;
-
-	rc = get_user(c, buffer);
-	if (rc)
-		return rc;
-	if (c == '0' || c == 'n' || c == 'N')
-		experimEnabled = 0;
-	else if (c == '1' || c == 'y' || c == 'Y')
-		experimEnabled = 1;
-	else if (c == '2')
-		experimEnabled = 2;
-
-	return count;
-}
-
-static const struct file_operations cifs_experimental_proc_fops = {
-	.owner		= THIS_MODULE,
-	.open		= cifs_experimental_proc_open,
-	.read		= seq_read,
-	.llseek		= seq_lseek,
-	.release	= single_release,
-	.write		= cifs_experimental_proc_write,
-};
-
 static int cifs_linux_ext_proc_show(struct seq_file *m, void *v)
 {
 	seq_printf(m, "%d\n", linuxExtEnabled);
diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
index 4dfba82..33d2213 100644
--- a/fs/cifs/cifs_spnego.c
+++ b/fs/cifs/cifs_spnego.c
@@ -113,7 +113,7 @@
 		   MAX_MECH_STR_LEN +
 		   UID_KEY_LEN + (sizeof(uid_t) * 2) +
 		   CREDUID_KEY_LEN + (sizeof(uid_t) * 2) +
-		   USER_KEY_LEN + strlen(sesInfo->userName) +
+		   USER_KEY_LEN + strlen(sesInfo->user_name) +
 		   PID_KEY_LEN + (sizeof(pid_t) * 2) + 1;
 
 	spnego_key = ERR_PTR(-ENOMEM);
@@ -153,7 +153,7 @@
 	sprintf(dp, ";creduid=0x%x", sesInfo->cred_uid);
 
 	dp = description + strlen(description);
-	sprintf(dp, ";user=%s", sesInfo->userName);
+	sprintf(dp, ";user=%s", sesInfo->user_name);
 
 	dp = description + strlen(description);
 	sprintf(dp, ";pid=0x%x", current->pid);
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index fc0fd4f..23d43cd 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -90,7 +90,7 @@
 	case UNI_COLON:
 		*target = ':';
 		break;
-	case UNI_ASTERIK:
+	case UNI_ASTERISK:
 		*target = '*';
 		break;
 	case UNI_QUESTION:
@@ -264,40 +264,40 @@
  * names are little endian 16 bit Unicode on the wire
  */
 int
-cifsConvertToUCS(__le16 *target, const char *source, int maxlen,
+cifsConvertToUCS(__le16 *target, const char *source, int srclen,
 		 const struct nls_table *cp, int mapChars)
 {
 	int i, j, charlen;
-	int len_remaining = maxlen;
 	char src_char;
-	__u16 temp;
+	__le16 dst_char;
+	wchar_t tmp;
 
 	if (!mapChars)
 		return cifs_strtoUCS(target, source, PATH_MAX, cp);
 
-	for (i = 0, j = 0; i < maxlen; j++) {
+	for (i = 0, j = 0; i < srclen; j++) {
 		src_char = source[i];
 		switch (src_char) {
 		case 0:
-			put_unaligned_le16(0, &target[j]);
+			put_unaligned(0, &target[j]);
 			goto ctoUCS_out;
 		case ':':
-			temp = UNI_COLON;
+			dst_char = cpu_to_le16(UNI_COLON);
 			break;
 		case '*':
-			temp = UNI_ASTERIK;
+			dst_char = cpu_to_le16(UNI_ASTERISK);
 			break;
 		case '?':
-			temp = UNI_QUESTION;
+			dst_char = cpu_to_le16(UNI_QUESTION);
 			break;
 		case '<':
-			temp = UNI_LESSTHAN;
+			dst_char = cpu_to_le16(UNI_LESSTHAN);
 			break;
 		case '>':
-			temp = UNI_GRTRTHAN;
+			dst_char = cpu_to_le16(UNI_GRTRTHAN);
 			break;
 		case '|':
-			temp = UNI_PIPE;
+			dst_char = cpu_to_le16(UNI_PIPE);
 			break;
 		/*
 		 * FIXME: We can not handle remapping backslash (UNI_SLASH)
@@ -305,17 +305,17 @@
 		 * as they use backslash as separator.
 		 */
 		default:
-			charlen = cp->char2uni(source+i, len_remaining,
-						&temp);
+			charlen = cp->char2uni(source + i, srclen - i, &tmp);
+			dst_char = cpu_to_le16(tmp);
+
 			/*
 			 * if no match, use question mark, which at least in
 			 * some cases serves as wild card
 			 */
 			if (charlen < 1) {
-				temp = 0x003f;
+				dst_char = cpu_to_le16(0x003f);
 				charlen = 1;
 			}
-			len_remaining -= charlen;
 			/*
 			 * character may take more than one byte in the source
 			 * string, but will take exactly two bytes in the
@@ -324,9 +324,8 @@
 			i += charlen;
 			continue;
 		}
-		put_unaligned_le16(temp, &target[j]);
+		put_unaligned(dst_char, &target[j]);
 		i++; /* move to next char in source string */
-		len_remaining--;
 	}
 
 ctoUCS_out:
diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h
index 7fe6b52..644dd882 100644
--- a/fs/cifs/cifs_unicode.h
+++ b/fs/cifs/cifs_unicode.h
@@ -44,7 +44,7 @@
  * reserved symbols (along with \ and /), otherwise illegal to store
  * in filenames in NTFS
  */
-#define UNI_ASTERIK     (__u16) ('*' + 0xF000)
+#define UNI_ASTERISK    (__u16) ('*' + 0xF000)
 #define UNI_QUESTION    (__u16) ('?' + 0xF000)
 #define UNI_COLON       (__u16) (':' + 0xF000)
 #define UNI_GRTRTHAN    (__u16) ('>' + 0xF000)
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index a51585f..d1a016b 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -30,12 +30,13 @@
 #include <linux/ctype.h>
 #include <linux/random.h>
 
-/* Calculate and return the CIFS signature based on the mac key and SMB PDU */
-/* the 16 byte signature must be allocated by the caller  */
-/* Note we only use the 1st eight bytes */
-/* Note that the smb header signature field on input contains the
-	sequence number before this function is called */
-
+/*
+ * Calculate and return the CIFS signature based on the mac key and SMB PDU.
+ * The 16 byte signature must be allocated by the caller. Note we only use the
+ * 1st eight bytes and that the smb header signature field on input contains
+ * the sequence number before this function is called. Also, this function
+ * should be called with the server->srv_mutex held.
+ */
 static int cifs_calculate_signature(const struct smb_hdr *cifs_pdu,
 				struct TCP_Server_Info *server, char *signature)
 {
@@ -209,8 +210,10 @@
 					cpu_to_le32(expected_sequence_number);
 	cifs_pdu->Signature.Sequence.Reserved = 0;
 
+	mutex_lock(&server->srv_mutex);
 	rc = cifs_calculate_signature(cifs_pdu, server,
 		what_we_think_sig_should_be);
+	mutex_unlock(&server->srv_mutex);
 
 	if (rc)
 		return rc;
@@ -469,15 +472,15 @@
 		return rc;
 	}
 
-	/* convert ses->userName to unicode and uppercase */
-	len = strlen(ses->userName);
+	/* convert ses->user_name to unicode and uppercase */
+	len = strlen(ses->user_name);
 	user = kmalloc(2 + (len * 2), GFP_KERNEL);
 	if (user == NULL) {
 		cERROR(1, "calc_ntlmv2_hash: user mem alloc failure\n");
 		rc = -ENOMEM;
 		goto calc_exit_2;
 	}
-	len = cifs_strtoUCS((__le16 *)user, ses->userName, len, nls_cp);
+	len = cifs_strtoUCS((__le16 *)user, ses->user_name, len, nls_cp);
 	UniStrupr(user);
 
 	crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash,
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index f297013..5c412b3 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -53,7 +53,6 @@
 int cifsERROR = 1;
 int traceSMB = 0;
 unsigned int oplockEnabled = 1;
-unsigned int experimEnabled = 0;
 unsigned int linuxExtEnabled = 1;
 unsigned int lookupCacheEnabled = 1;
 unsigned int multiuser_mount = 0;
@@ -127,6 +126,7 @@
 		kfree(cifs_sb);
 		return rc;
 	}
+	cifs_sb->bdi.ra_pages = default_backing_dev_info.ra_pages;
 
 #ifdef CONFIG_CIFS_DFS_UPCALL
 	/* copy mount params to sb for use in submounts */
@@ -409,8 +409,8 @@
 
 	if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER)
 		seq_printf(s, ",multiuser");
-	else if (tcon->ses->userName)
-		seq_printf(s, ",username=%s", tcon->ses->userName);
+	else if (tcon->ses->user_name)
+		seq_printf(s, ",username=%s", tcon->ses->user_name);
 
 	if (tcon->ses->domainName)
 		seq_printf(s, ",domain=%s", tcon->ses->domainName);
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 17afb0f..a5d1106 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -37,10 +37,9 @@
 
 #define MAX_TREE_SIZE (2 + MAX_SERVER_SIZE + 1 + MAX_SHARE_SIZE + 1)
 #define MAX_SERVER_SIZE 15
-#define MAX_SHARE_SIZE  64	/* used to be 20, this should still be enough */
-#define MAX_USERNAME_SIZE 32	/* 32 is to allow for 15 char names + null
-				   termination then *2 for unicode versions */
-#define MAX_PASSWORD_SIZE 512  /* max for windows seems to be 256 wide chars */
+#define MAX_SHARE_SIZE 80
+#define MAX_USERNAME_SIZE 256	/* reasonable maximum for current servers */
+#define MAX_PASSWORD_SIZE 512	/* max for windows seems to be 256 wide chars */
 
 #define CIFS_MIN_RCV_POOL 4
 
@@ -92,7 +91,8 @@
 	CifsNew = 0,
 	CifsGood,
 	CifsExiting,
-	CifsNeedReconnect
+	CifsNeedReconnect,
+	CifsNeedNegotiate
 };
 
 enum securityEnum {
@@ -274,7 +274,7 @@
 	int capabilities;
 	char serverName[SERVER_NAME_LEN_WITH_NULL * 2];	/* BB make bigger for
 				TCP names - will ipv6 and sctp addresses fit? */
-	char userName[MAX_USERNAME_SIZE + 1];
+	char *user_name;
 	char *domainName;
 	char *password;
 	struct session_key auth_key;
@@ -817,7 +817,6 @@
 				have the uid/password or Kerberos credential
 				or equivalent for current user */
 GLOBAL_EXTERN unsigned int oplockEnabled;
-GLOBAL_EXTERN unsigned int experimEnabled;
 GLOBAL_EXTERN unsigned int lookupCacheEnabled;
 GLOBAL_EXTERN unsigned int global_secflags;	/* if on, session setup sent
 				with more secure ntlmssp2 challenge/resp */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 2644a5d..df959ba 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -142,9 +142,9 @@
 	 */
 	while (server->tcpStatus == CifsNeedReconnect) {
 		wait_event_interruptible_timeout(server->response_q,
-			(server->tcpStatus == CifsGood), 10 * HZ);
+			(server->tcpStatus != CifsNeedReconnect), 10 * HZ);
 
-		/* is TCP session is reestablished now ?*/
+		/* are we still trying to reconnect? */
 		if (server->tcpStatus != CifsNeedReconnect)
 			break;
 
@@ -729,7 +729,7 @@
 		return rc;
 
 	/* set up echo request */
-	smb->hdr.Tid = cpu_to_le16(0xffff);
+	smb->hdr.Tid = 0xffff;
 	smb->hdr.WordCount = 1;
 	put_unaligned_le16(1, &smb->EchoCount);
 	put_bcc_le(1, &smb->hdr);
@@ -1884,10 +1884,10 @@
 					__constant_cpu_to_le16(CIFS_WRLCK))
 				pLockData->fl_type = F_WRLCK;
 
-			pLockData->fl_start = parm_data->start;
-			pLockData->fl_end = parm_data->start +
-						parm_data->length - 1;
-			pLockData->fl_pid = parm_data->pid;
+			pLockData->fl_start = le64_to_cpu(parm_data->start);
+			pLockData->fl_end = pLockData->fl_start +
+					le64_to_cpu(parm_data->length) - 1;
+			pLockData->fl_pid = le32_to_cpu(parm_data->pid);
 		}
 	}
 
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 6e2b2ad..db9d55b 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -199,8 +199,7 @@
 	}
 	spin_unlock(&GlobalMid_Lock);
 
-	while ((server->tcpStatus != CifsExiting) &&
-	       (server->tcpStatus != CifsGood)) {
+	while (server->tcpStatus == CifsNeedReconnect) {
 		try_to_freeze();
 
 		/* we should try only the port we connected to before */
@@ -212,7 +211,7 @@
 			atomic_inc(&tcpSesReconnectCount);
 			spin_lock(&GlobalMid_Lock);
 			if (server->tcpStatus != CifsExiting)
-				server->tcpStatus = CifsGood;
+				server->tcpStatus = CifsNeedNegotiate;
 			spin_unlock(&GlobalMid_Lock);
 		}
 	}
@@ -248,24 +247,24 @@
 	total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 	data_in_this_rsp = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 
-	remaining = total_data_size - data_in_this_rsp;
-
-	if (remaining == 0)
+	if (total_data_size == data_in_this_rsp)
 		return 0;
-	else if (remaining < 0) {
+	else if (total_data_size < data_in_this_rsp) {
 		cFYI(1, "total data %d smaller than data in frame %d",
 			total_data_size, data_in_this_rsp);
 		return -EINVAL;
-	} else {
-		cFYI(1, "missing %d bytes from transact2, check next response",
-			remaining);
-		if (total_data_size > maxBufSize) {
-			cERROR(1, "TotalDataSize %d is over maximum buffer %d",
-				total_data_size, maxBufSize);
-			return -EINVAL;
-		}
-		return remaining;
 	}
+
+	remaining = total_data_size - data_in_this_rsp;
+
+	cFYI(1, "missing %d bytes from transact2, check next response",
+		remaining);
+	if (total_data_size > maxBufSize) {
+		cERROR(1, "TotalDataSize %d is over maximum buffer %d",
+			total_data_size, maxBufSize);
+		return -EINVAL;
+	}
+	return remaining;
 }
 
 static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
@@ -421,7 +420,7 @@
 		pdu_length = 4; /* enough to get RFC1001 header */
 
 incomplete_rcv:
-		if (echo_retries > 0 &&
+		if (echo_retries > 0 && server->tcpStatus == CifsGood &&
 		    time_after(jiffies, server->lstrp +
 					(echo_retries * SMB_ECHO_INTERVAL))) {
 			cERROR(1, "Server %s has not responded in %d seconds. "
@@ -881,7 +880,8 @@
 				/* null user, ie anonymous, authentication */
 				vol->nullauth = 1;
 			}
-			if (strnlen(value, 200) < 200) {
+			if (strnlen(value, MAX_USERNAME_SIZE) <
+						MAX_USERNAME_SIZE) {
 				vol->username = value;
 			} else {
 				printk(KERN_WARNING "CIFS: username too long\n");
@@ -1472,7 +1472,7 @@
 static bool
 match_port(struct TCP_Server_Info *server, struct sockaddr *addr)
 {
-	unsigned short int port, *sport;
+	__be16 port, *sport;
 
 	switch (addr->sa_family) {
 	case AF_INET:
@@ -1765,6 +1765,7 @@
 		module_put(THIS_MODULE);
 		goto out_err_crypto_release;
 	}
+	tcp_ses->tcpStatus = CifsNeedNegotiate;
 
 	/* thread spawned, put it on the list */
 	spin_lock(&cifs_tcp_ses_lock);
@@ -1808,7 +1809,9 @@
 			break;
 		default:
 			/* anything else takes username/password */
-			if (strncmp(ses->userName, vol->username,
+			if (ses->user_name == NULL)
+				continue;
+			if (strncmp(ses->user_name, vol->username,
 				    MAX_USERNAME_SIZE))
 				continue;
 			if (strlen(vol->username) != 0 &&
@@ -1851,6 +1854,8 @@
 	cifs_put_tcp_session(server);
 }
 
+static bool warned_on_ntlm;  /* globals init to false automatically */
+
 static struct cifsSesInfo *
 cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
 {
@@ -1906,9 +1911,11 @@
 	else
 		sprintf(ses->serverName, "%pI4", &addr->sin_addr);
 
-	if (volume_info->username)
-		strncpy(ses->userName, volume_info->username,
-			MAX_USERNAME_SIZE);
+	if (volume_info->username) {
+		ses->user_name = kstrdup(volume_info->username, GFP_KERNEL);
+		if (!ses->user_name)
+			goto get_ses_fail;
+	}
 
 	/* volume_info->password freed at unmount */
 	if (volume_info->password) {
@@ -1923,6 +1930,15 @@
 	}
 	ses->cred_uid = volume_info->cred_uid;
 	ses->linux_uid = volume_info->linux_uid;
+
+	/* ntlmv2 is much stronger than ntlm security, and has been broadly
+	supported for many years, time to update default security mechanism */
+	if ((volume_info->secFlg == 0) && warned_on_ntlm == false) {
+		warned_on_ntlm = true;
+		cERROR(1, "default security mechanism requested.  The default "
+			"security mechanism will be upgraded from ntlm to "
+			"ntlmv2 in kernel release 2.6.41");
+	}
 	ses->overrideSecFlg = volume_info->secFlg;
 
 	mutex_lock(&ses->session_mutex);
@@ -2276,7 +2292,7 @@
 generic_ip_connect(struct TCP_Server_Info *server)
 {
 	int rc = 0;
-	unsigned short int sport;
+	__be16 sport;
 	int slen, sfamily;
 	struct socket *socket = server->ssocket;
 	struct sockaddr *saddr;
@@ -2361,7 +2377,7 @@
 static int
 ip_connect(struct TCP_Server_Info *server)
 {
-	unsigned short int *sport;
+	__be16 *sport;
 	struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
 	struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
 
@@ -2826,7 +2842,7 @@
 
 remote_path_check:
 	/* check if a whole path (including prepath) is not remote */
-	if (!rc && cifs_sb->prepathlen && tcon) {
+	if (!rc && tcon) {
 		/* build_path_to_root works only when we have a valid tcon */
 		full_path = cifs_build_path_to_root(cifs_sb, tcon);
 		if (full_path == NULL) {
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index c27d2367..faf5952 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -575,8 +575,10 @@
 
 int cifs_close(struct inode *inode, struct file *file)
 {
-	cifsFileInfo_put(file->private_data);
-	file->private_data = NULL;
+	if (file->private_data != NULL) {
+		cifsFileInfo_put(file->private_data);
+		file->private_data = NULL;
+	}
 
 	/* return code from the ->release op is always ignored */
 	return 0;
@@ -970,6 +972,9 @@
 	     total_written += bytes_written) {
 		rc = -EAGAIN;
 		while (rc == -EAGAIN) {
+			struct kvec iov[2];
+			unsigned int len;
+
 			if (open_file->invalidHandle) {
 				/* we could deadlock if we called
 				   filemap_fdatawait from here so tell
@@ -979,31 +984,14 @@
 				if (rc != 0)
 					break;
 			}
-			if (experimEnabled || (pTcon->ses->server &&
-				((pTcon->ses->server->secMode &
-				(SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
-				== 0))) {
-				struct kvec iov[2];
-				unsigned int len;
 
-				len = min((size_t)cifs_sb->wsize,
-					  write_size - total_written);
-				/* iov[0] is reserved for smb header */
-				iov[1].iov_base = (char *)write_data +
-						  total_written;
-				iov[1].iov_len = len;
-				rc = CIFSSMBWrite2(xid, pTcon,
-						open_file->netfid, len,
-						*poffset, &bytes_written,
-						iov, 1, 0);
-			} else
-				rc = CIFSSMBWrite(xid, pTcon,
-					 open_file->netfid,
-					 min_t(const int, cifs_sb->wsize,
-					       write_size - total_written),
-					 *poffset, &bytes_written,
-					 write_data + total_written,
-					 NULL, 0);
+			len = min((size_t)cifs_sb->wsize,
+				  write_size - total_written);
+			/* iov[0] is reserved for smb header */
+			iov[1].iov_base = (char *)write_data + total_written;
+			iov[1].iov_len = len;
+			rc = CIFSSMBWrite2(xid, pTcon, open_file->netfid, len,
+					   *poffset, &bytes_written, iov, 1, 0);
 		}
 		if (rc || (bytes_written == 0)) {
 			if (total_written)
@@ -1240,12 +1228,6 @@
 	}
 
 	tcon = tlink_tcon(open_file->tlink);
-	if (!experimEnabled && tcon->ses->server->secMode &
-			(SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) {
-		cifsFileInfo_put(open_file);
-		kfree(iov);
-		return generic_writepages(mapping, wbc);
-	}
 	cifsFileInfo_put(open_file);
 
 	xid = GetXid();
@@ -1980,6 +1962,24 @@
 	return total_read;
 }
 
+/*
+ * If the page is mmap'ed into a process' page tables, then we need to make
+ * sure that it doesn't change while being written back.
+ */
+static int
+cifs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
+{
+	struct page *page = vmf->page;
+
+	lock_page(page);
+	return VM_FAULT_LOCKED;
+}
+
+static struct vm_operations_struct cifs_file_vm_ops = {
+	.fault = filemap_fault,
+	.page_mkwrite = cifs_page_mkwrite,
+};
+
 int cifs_file_strict_mmap(struct file *file, struct vm_area_struct *vma)
 {
 	int rc, xid;
@@ -1991,6 +1991,8 @@
 		cifs_invalidate_mapping(inode);
 
 	rc = generic_file_mmap(file, vma);
+	if (rc == 0)
+		vma->vm_ops = &cifs_file_vm_ops;
 	FreeXid(xid);
 	return rc;
 }
@@ -2007,6 +2009,8 @@
 		return rc;
 	}
 	rc = generic_file_mmap(file, vma);
+	if (rc == 0)
+		vma->vm_ops = &cifs_file_vm_ops;
 	FreeXid(xid);
 	return rc;
 }
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index e8804d3..ce417a9 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -239,7 +239,7 @@
 	if (rc != 0)
 		return rc;
 
-	if (file_info.EndOfFile != CIFS_MF_SYMLINK_FILE_SIZE) {
+	if (file_info.EndOfFile != cpu_to_le64(CIFS_MF_SYMLINK_FILE_SIZE)) {
 		CIFSSMBClose(xid, tcon, netfid);
 		/* it's not a symlink */
 		return -EINVAL;
@@ -316,7 +316,7 @@
 	if (rc != 0)
 		goto out;
 
-	if (file_info.EndOfFile != CIFS_MF_SYMLINK_FILE_SIZE) {
+	if (file_info.EndOfFile != cpu_to_le64(CIFS_MF_SYMLINK_FILE_SIZE)) {
 		CIFSSMBClose(xid, pTcon, netfid);
 		/* it's not a symlink */
 		goto out;
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 2a930a7..0c684ae 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -100,6 +100,7 @@
 		memset(buf_to_free->password, 0, strlen(buf_to_free->password));
 		kfree(buf_to_free->password);
 	}
+	kfree(buf_to_free->user_name);
 	kfree(buf_to_free->domainName);
 	kfree(buf_to_free);
 }
@@ -520,7 +521,7 @@
 			(struct smb_com_transaction_change_notify_rsp *)buf;
 		struct file_notify_information *pnotify;
 		__u32 data_offset = 0;
-		if (pSMBr->ByteCount > sizeof(struct file_notify_information)) {
+		if (get_bcc_le(buf) > sizeof(struct file_notify_information)) {
 			data_offset = le32_to_cpu(pSMBr->DataOffset);
 
 			pnotify = (struct file_notify_information *)
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 1676570..f6728eb 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -219,12 +219,12 @@
 		bcc_ptr++;
 	} */
 	/* copy user */
-	if (ses->userName == NULL) {
+	if (ses->user_name == NULL) {
 		/* null user mount */
 		*bcc_ptr = 0;
 		*(bcc_ptr+1) = 0;
 	} else {
-		bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->userName,
+		bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->user_name,
 					  MAX_USERNAME_SIZE, nls_cp);
 	}
 	bcc_ptr += 2 * bytes_ret;
@@ -244,12 +244,11 @@
 	/* copy user */
 	/* BB what about null user mounts - check that we do this BB */
 	/* copy user */
-	if (ses->userName == NULL) {
-		/* BB what about null user mounts - check that we do this BB */
-	} else {
-		strncpy(bcc_ptr, ses->userName, MAX_USERNAME_SIZE);
-	}
-	bcc_ptr += strnlen(ses->userName, MAX_USERNAME_SIZE);
+	if (ses->user_name != NULL)
+		strncpy(bcc_ptr, ses->user_name, MAX_USERNAME_SIZE);
+	/* else null user mount */
+
+	bcc_ptr += strnlen(ses->user_name, MAX_USERNAME_SIZE);
 	*bcc_ptr = 0;
 	bcc_ptr++; /* account for null termination */
 
@@ -405,8 +404,8 @@
 	/* BB spec says that if AvId field of MsvAvTimestamp is populated then
 		we must set the MIC field of the AUTHENTICATE_MESSAGE */
 	ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags);
-	tioffset = cpu_to_le16(pblob->TargetInfoArray.BufferOffset);
-	tilen = cpu_to_le16(pblob->TargetInfoArray.Length);
+	tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
+	tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
 	if (tilen) {
 		ses->auth_key.response = kmalloc(tilen, GFP_KERNEL);
 		if (!ses->auth_key.response) {
@@ -523,14 +522,14 @@
 		tmp += len;
 	}
 
-	if (ses->userName == NULL) {
+	if (ses->user_name == NULL) {
 		sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer);
 		sec_blob->UserName.Length = 0;
 		sec_blob->UserName.MaximumLength = 0;
 		tmp += 2;
 	} else {
 		int len;
-		len = cifs_strtoUCS((__le16 *)tmp, ses->userName,
+		len = cifs_strtoUCS((__le16 *)tmp, ses->user_name,
 				    MAX_USERNAME_SIZE, nls_cp);
 		len *= 2; /* unicode is 2 bytes each */
 		sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer);
diff --git a/fs/dcache.c b/fs/dcache.c
index ad25c4c..129a357 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2131,7 +2131,7 @@
  */
 void dentry_update_name_case(struct dentry *dentry, struct qstr *name)
 {
-	BUG_ON(!mutex_is_locked(&dentry->d_inode->i_mutex));
+	BUG_ON(!mutex_is_locked(&dentry->d_parent->d_inode->i_mutex));
 	BUG_ON(dentry->d_name.len != name->len); /* d_lookup gives this */
 
 	spin_lock(&dentry->d_lock);
diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
index e25e99b..d0f5353 100644
--- a/fs/ext4/ext4_jbd2.h
+++ b/fs/ext4/ext4_jbd2.h
@@ -86,8 +86,8 @@
 
 #ifdef CONFIG_QUOTA
 /* Amount of blocks needed for quota update - we know that the structure was
- * allocated so we need to update only inode+data */
-#define EXT4_QUOTA_TRANS_BLOCKS(sb) (test_opt(sb, QUOTA) ? 2 : 0)
+ * allocated so we need to update only data block */
+#define EXT4_QUOTA_TRANS_BLOCKS(sb) (test_opt(sb, QUOTA) ? 1 : 0)
 /* Amount of blocks needed for quota insert/delete - we do some block writes
  * but inode, sb and group updates are done only once */
 #define EXT4_QUOTA_INIT_BLOCKS(sb) (test_opt(sb, QUOTA) ? (DQUOT_INIT_ALLOC*\
diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
index 4673bc0..e9473cb 100644
--- a/fs/ext4/fsync.c
+++ b/fs/ext4/fsync.c
@@ -125,9 +125,11 @@
  * the parent directory's parent as well, and so on recursively, if
  * they are also freshly created.
  */
-static void ext4_sync_parent(struct inode *inode)
+static int ext4_sync_parent(struct inode *inode)
 {
+	struct writeback_control wbc;
 	struct dentry *dentry = NULL;
+	int ret = 0;
 
 	while (inode && ext4_test_inode_state(inode, EXT4_STATE_NEWENTRY)) {
 		ext4_clear_inode_state(inode, EXT4_STATE_NEWENTRY);
@@ -136,8 +138,17 @@
 		if (!dentry || !dentry->d_parent || !dentry->d_parent->d_inode)
 			break;
 		inode = dentry->d_parent->d_inode;
-		sync_mapping_buffers(inode->i_mapping);
+		ret = sync_mapping_buffers(inode->i_mapping);
+		if (ret)
+			break;
+		memset(&wbc, 0, sizeof(wbc));
+		wbc.sync_mode = WB_SYNC_ALL;
+		wbc.nr_to_write = 0;         /* only write out the inode */
+		ret = sync_inode(inode, &wbc);
+		if (ret)
+			break;
 	}
+	return ret;
 }
 
 /*
@@ -176,7 +187,7 @@
 	if (!journal) {
 		ret = generic_file_fsync(file, datasync);
 		if (!ret && !list_empty(&inode->i_dentry))
-			ext4_sync_parent(inode);
+			ret = ext4_sync_parent(inode);
 		goto out;
 	}
 
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index ad8e303..f2fa5e8 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -2502,6 +2502,7 @@
 		 * for partial write.
 		 */
 		set_buffer_new(bh);
+		set_buffer_mapped(bh);
 	}
 	return 0;
 }
@@ -4429,8 +4430,8 @@
 	Indirect chain[4];
 	Indirect *partial;
 	__le32 nr = 0;
-	int n;
-	ext4_lblk_t last_block;
+	int n = 0;
+	ext4_lblk_t last_block, max_block;
 	unsigned blocksize = inode->i_sb->s_blocksize;
 
 	trace_ext4_truncate_enter(inode);
@@ -4455,14 +4456,18 @@
 
 	last_block = (inode->i_size + blocksize-1)
 					>> EXT4_BLOCK_SIZE_BITS(inode->i_sb);
+	max_block = (EXT4_SB(inode->i_sb)->s_bitmap_maxbytes + blocksize-1)
+					>> EXT4_BLOCK_SIZE_BITS(inode->i_sb);
 
 	if (inode->i_size & (blocksize - 1))
 		if (ext4_block_truncate_page(handle, mapping, inode->i_size))
 			goto out_stop;
 
-	n = ext4_block_to_path(inode, last_block, offsets, NULL);
-	if (n == 0)
-		goto out_stop;	/* error */
+	if (last_block != max_block) {
+		n = ext4_block_to_path(inode, last_block, offsets, NULL);
+		if (n == 0)
+			goto out_stop;	/* error */
+	}
 
 	/*
 	 * OK.  This truncate is going to happen.  We add the inode to the
@@ -4493,7 +4498,13 @@
 	 */
 	ei->i_disksize = inode->i_size;
 
-	if (n == 1) {		/* direct blocks */
+	if (last_block == max_block) {
+		/*
+		 * It is unnecessary to free any data blocks if last_block is
+		 * equal to the indirect block limit.
+		 */
+		goto out_unlock;
+	} else if (n == 1) {		/* direct blocks */
 		ext4_free_data(handle, inode, NULL, i_data+offsets[0],
 			       i_data + EXT4_NDIR_BLOCKS);
 		goto do_indirects;
@@ -4553,6 +4564,7 @@
 		;
 	}
 
+out_unlock:
 	up_write(&ei->i_data_sem);
 	inode->i_mtime = inode->i_ctime = ext4_current_time(inode);
 	ext4_mark_inode_dirty(handle, inode);
@@ -5398,13 +5410,12 @@
 	/* if nrblocks are contiguous */
 	if (chunk) {
 		/*
-		 * With N contiguous data blocks, it need at most
-		 * N/EXT4_ADDR_PER_BLOCK(inode->i_sb) indirect blocks
-		 * 2 dindirect blocks
-		 * 1 tindirect block
+		 * With N contiguous data blocks, we need at most
+		 * N/EXT4_ADDR_PER_BLOCK(inode->i_sb) + 1 indirect blocks,
+		 * 2 dindirect blocks, and 1 tindirect block
 		 */
-		indirects = nrblocks / EXT4_ADDR_PER_BLOCK(inode->i_sb);
-		return indirects + 3;
+		return DIV_ROUND_UP(nrblocks,
+				    EXT4_ADDR_PER_BLOCK(inode->i_sb)) + 4;
 	}
 	/*
 	 * if nrblocks are not contiguous, worse case, each block touch
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 056474b..8553dfb 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -242,27 +242,44 @@
  * journal_end calls result in the superblock being marked dirty, so
  * that sync() will call the filesystem's write_super callback if
  * appropriate.
+ *
+ * To avoid j_barrier hold in userspace when a user calls freeze(),
+ * ext4 prevents a new handle from being started by s_frozen, which
+ * is in an upper layer.
  */
 handle_t *ext4_journal_start_sb(struct super_block *sb, int nblocks)
 {
 	journal_t *journal;
+	handle_t  *handle;
 
 	if (sb->s_flags & MS_RDONLY)
 		return ERR_PTR(-EROFS);
 
-	vfs_check_frozen(sb, SB_FREEZE_TRANS);
-	/* Special case here: if the journal has aborted behind our
-	 * backs (eg. EIO in the commit thread), then we still need to
-	 * take the FS itself readonly cleanly. */
 	journal = EXT4_SB(sb)->s_journal;
-	if (journal) {
-		if (is_journal_aborted(journal)) {
-			ext4_abort(sb, "Detected aborted journal");
-			return ERR_PTR(-EROFS);
-		}
-		return jbd2_journal_start(journal, nblocks);
+	handle = ext4_journal_current_handle();
+
+	/*
+	 * If a handle has been started, it should be allowed to
+	 * finish, otherwise deadlock could happen between freeze
+	 * and others(e.g. truncate) due to the restart of the
+	 * journal handle if the filesystem is forzen and active
+	 * handles are not stopped.
+	 */
+	if (!handle)
+		vfs_check_frozen(sb, SB_FREEZE_TRANS);
+
+	if (!journal)
+		return ext4_get_nojournal();
+	/*
+	 * Special case here: if the journal has aborted behind our
+	 * backs (eg. EIO in the commit thread), then we still need to
+	 * take the FS itself readonly cleanly.
+	 */
+	if (is_journal_aborted(journal)) {
+		ext4_abort(sb, "Detected aborted journal");
+		return ERR_PTR(-EROFS);
 	}
-	return ext4_get_nojournal();
+	return jbd2_journal_start(journal, nblocks);
 }
 
 /*
@@ -2975,6 +2992,12 @@
 	mutex_unlock(&ext4_li_info->li_list_mtx);
 
 	sbi->s_li_request = elr;
+	/*
+	 * set elr to NULL here since it has been inserted to
+	 * the request_list and the removal and free of it is
+	 * handled by ext4_clear_request_list from now on.
+	 */
+	elr = NULL;
 
 	if (!(ext4_li_info->li_state & EXT4_LAZYINIT_RUNNING)) {
 		ret = ext4_run_lazyinit_thread();
@@ -3385,6 +3408,10 @@
 	get_random_bytes(&sbi->s_next_generation, sizeof(u32));
 	spin_lock_init(&sbi->s_next_gen_lock);
 
+	init_timer(&sbi->s_err_report);
+	sbi->s_err_report.function = print_daily_error_info;
+	sbi->s_err_report.data = (unsigned long) sb;
+
 	err = percpu_counter_init(&sbi->s_freeblocks_counter,
 			ext4_count_free_blocks(sb));
 	if (!err) {
@@ -3646,9 +3673,6 @@
 		 "Opts: %s%s%s", descr, sbi->s_es->s_mount_opts,
 		 *sbi->s_es->s_mount_opts ? "; " : "", orig_data);
 
-	init_timer(&sbi->s_err_report);
-	sbi->s_err_report.function = print_daily_error_info;
-	sbi->s_err_report.data = (unsigned long) sb;
 	if (es->s_error_count)
 		mod_timer(&sbi->s_err_report, jiffies + 300*HZ); /* 5 minutes */
 
@@ -3672,6 +3696,7 @@
 		sbi->s_journal = NULL;
 	}
 failed_mount3:
+	del_timer(&sbi->s_err_report);
 	if (sbi->s_flex_groups) {
 		if (is_vmalloc_addr(sbi->s_flex_groups))
 			vfree(sbi->s_flex_groups);
@@ -4138,6 +4163,11 @@
 /*
  * LVM calls this function before a (read-only) snapshot is created.  This
  * gives us a chance to flush the journal completely and mark the fs clean.
+ *
+ * Note that only this function cannot bring a filesystem to be in a clean
+ * state independently, because ext4 prevents a new handle from being started
+ * by @sb->s_frozen, which stays in an upper layer.  It thus needs help from
+ * the upper layer.
  */
 static int ext4_freeze(struct super_block *sb)
 {
@@ -4614,11 +4644,24 @@
 
 static int ext4_quota_off(struct super_block *sb, int type)
 {
+	struct inode *inode = sb_dqopt(sb)->files[type];
+	handle_t *handle;
+
 	/* Force all delayed allocation blocks to be allocated.
 	 * Caller already holds s_umount sem */
 	if (test_opt(sb, DELALLOC))
 		sync_filesystem(sb);
 
+	/* Update modification times of quota files when userspace can
+	 * start looking at them */
+	handle = ext4_journal_start(inode, 1);
+	if (IS_ERR(handle))
+		goto out;
+	inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+	ext4_mark_inode_dirty(handle, inode);
+	ext4_journal_stop(handle);
+
+out:
 	return dquot_quota_off(sb, type);
 }
 
@@ -4714,9 +4757,8 @@
 	if (inode->i_size < off + len) {
 		i_size_write(inode, off + len);
 		EXT4_I(inode)->i_disksize = inode->i_size;
+		ext4_mark_inode_dirty(handle, inode);
 	}
-	inode->i_mtime = inode->i_ctime = CURRENT_TIME;
-	ext4_mark_inode_dirty(handle, inode);
 	mutex_unlock(&inode->i_mutex);
 	return len;
 }
diff --git a/fs/fhandle.c b/fs/fhandle.c
index bf93ad2..6b08864 100644
--- a/fs/fhandle.c
+++ b/fs/fhandle.c
@@ -7,6 +7,7 @@
 #include <linux/exportfs.h>
 #include <linux/fs_struct.h>
 #include <linux/fsnotify.h>
+#include <linux/personality.h>
 #include <asm/uaccess.h>
 #include "internal.h"
 
diff --git a/fs/filesystems.c b/fs/filesystems.c
index 751d6b2..0845f84 100644
--- a/fs/filesystems.c
+++ b/fs/filesystems.c
@@ -110,14 +110,13 @@
 			*tmp = fs->next;
 			fs->next = NULL;
 			write_unlock(&file_systems_lock);
+			synchronize_rcu();
 			return 0;
 		}
 		tmp = &(*tmp)->next;
 	}
 	write_unlock(&file_systems_lock);
 
-	synchronize_rcu();
-
 	return -EINVAL;
 }
 
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 20af62f..6e28000 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -105,6 +105,8 @@
 	int ret;
 	struct timespec now = current_kernel_time();
 
+	*cbh = NULL;
+
 	if (is_journal_aborted(journal))
 		return 0;
 
@@ -806,7 +808,7 @@
 		if (err)
 			__jbd2_journal_abort_hard(journal);
 	}
-	if (!err && !is_journal_aborted(journal))
+	if (cbh)
 		err = journal_wait_on_commit_record(journal, cbh);
 	if (JBD2_HAS_INCOMPAT_FEATURE(journal,
 				      JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT) &&
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index aba8eba..e0ec3db 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -2413,10 +2413,12 @@
 	new_dev = kmalloc(sizeof(struct devname_cache), GFP_KERNEL);
 	if (!new_dev)
 		return "NODEV-ALLOCFAILURE"; /* Something non-NULL */
+	bd = bdget(device);
 	spin_lock(&devname_cache_lock);
 	if (devcache[i]) {
 		if (devcache[i]->device == device) {
 			kfree(new_dev);
+			bdput(bd);
 			ret = devcache[i]->devname;
 			spin_unlock(&devname_cache_lock);
 			return ret;
@@ -2425,7 +2427,6 @@
 	}
 	devcache[i] = new_dev;
 	devcache[i]->device = device;
-	bd = bdget(device);
 	if (bd) {
 		bdevname(bd, devcache[i]->devname);
 		bdput(bd);
diff --git a/fs/namei.c b/fs/namei.c
index e6cd611..54fc993 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -697,6 +697,7 @@
 		do {
 			seq = read_seqcount_begin(&fs->seq);
 			nd->root = fs->root;
+			nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
 		} while (read_seqcount_retry(&fs->seq, seq));
 	}
 }
diff --git a/fs/namespace.c b/fs/namespace.c
index 7dba2ed..d99bcf5 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1030,18 +1030,6 @@
 	.show	= show_vfsmnt
 };
 
-static int uuid_is_nil(u8 *uuid)
-{
-	int i;
-	u8  *cp = (u8 *)uuid;
-
-	for (i = 0; i < 16; i++) {
-		if (*cp++)
-			return 0;
-	}
-	return 1;
-}
-
 static int show_mountinfo(struct seq_file *m, void *v)
 {
 	struct proc_mounts *p = m->private;
@@ -1085,10 +1073,6 @@
 	if (IS_MNT_UNBINDABLE(mnt))
 		seq_puts(m, " unbindable");
 
-	if (!uuid_is_nil(mnt->mnt_sb->s_uuid))
-		/* print the uuid */
-		seq_printf(m, " uuid:%pU", mnt->mnt_sb->s_uuid);
-
 	/* Filesystem specific data */
 	seq_puts(m, " - ");
 	show_type(m, sb);
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index af0c627..e4cbc11 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -542,11 +542,15 @@
 	if (!nfs_need_commit(nfsi))
 		return 0;
 
+	spin_lock(&inode->i_lock);
 	ret = nfs_scan_list(nfsi, dst, idx_start, npages, NFS_PAGE_TAG_COMMIT);
 	if (ret > 0)
 		nfsi->ncommit -= ret;
+	spin_unlock(&inode->i_lock);
+
 	if (nfs_need_commit(NFS_I(inode)))
 		__mark_inode_dirty(inode, I_DIRTY_DATASYNC);
+
 	return ret;
 }
 #else
@@ -1483,9 +1487,7 @@
 	res = nfs_commit_set_lock(NFS_I(inode), may_wait);
 	if (res <= 0)
 		goto out_mark_dirty;
-	spin_lock(&inode->i_lock);
 	res = nfs_scan_commit(inode, &head, 0, 0);
-	spin_unlock(&inode->i_lock);
 	if (res) {
 		int error;
 
diff --git a/fs/nfsd/lockd.c b/fs/nfsd/lockd.c
index 0c6d816..7c831a2 100644
--- a/fs/nfsd/lockd.c
+++ b/fs/nfsd/lockd.c
@@ -38,7 +38,6 @@
 	exp_readlock();
 	nfserr = nfsd_open(rqstp, &fh, S_IFREG, NFSD_MAY_LOCK, filp);
 	fh_put(&fh);
-	rqstp->rq_client = NULL;
 	exp_readunlock();
  	/* We return nlm error codes as nlm doesn't know
 	 * about nfsd, but nfsd does know about nlm..
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 4b36ec3..aa309aa9 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -397,10 +397,13 @@
 
 static void free_generic_stateid(struct nfs4_stateid *stp)
 {
-	int oflag = nfs4_access_bmap_to_omode(stp);
+	int oflag;
 
-	nfs4_file_put_access(stp->st_file, oflag);
-	put_nfs4_file(stp->st_file);
+	if (stp->st_access_bmap) {
+		oflag = nfs4_access_bmap_to_omode(stp);
+		nfs4_file_put_access(stp->st_file, oflag);
+		put_nfs4_file(stp->st_file);
+	}
 	kmem_cache_free(stateid_slab, stp);
 }
 
diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c
index b10e354..ce4f624 100644
--- a/fs/partitions/ldm.c
+++ b/fs/partitions/ldm.c
@@ -1299,6 +1299,11 @@
 
 	BUG_ON (!data || !frags);
 
+	if (size < 2 * VBLK_SIZE_HEAD) {
+		ldm_error("Value of size is to small.");
+		return false;
+	}
+
 	group = get_unaligned_be32(data + 0x08);
 	rec   = get_unaligned_be16(data + 0x0C);
 	num   = get_unaligned_be16(data + 0x0E);
@@ -1306,6 +1311,10 @@
 		ldm_error ("A VBLK claims to have %d parts.", num);
 		return false;
 	}
+	if (rec >= num) {
+		ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
+		return false;
+	}
 
 	list_for_each (item, frags) {
 		f = list_entry (item, struct frag, list);
@@ -1334,10 +1343,9 @@
 
 	f->map |= (1 << rec);
 
-	if (num > 0) {
-		data += VBLK_SIZE_HEAD;
-		size -= VBLK_SIZE_HEAD;
-	}
+	data += VBLK_SIZE_HEAD;
+	size -= VBLK_SIZE_HEAD;
+
 	memcpy (f->data+rec*(size-VBLK_SIZE_HEAD)+VBLK_SIZE_HEAD, data, size);
 
 	return true;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index dd6628d3..dfa5327 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -3124,11 +3124,16 @@
 /* for the /proc/ directory itself, after non-process stuff has been done */
 int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
 {
-	unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
-	struct task_struct *reaper = get_proc_task(filp->f_path.dentry->d_inode);
+	unsigned int nr;
+	struct task_struct *reaper;
 	struct tgid_iter iter;
 	struct pid_namespace *ns;
 
+	if (filp->f_pos >= PID_MAX_LIMIT + TGID_OFFSET)
+		goto out_no_task;
+	nr = filp->f_pos - FIRST_PROCESS_ENTRY;
+
+	reaper = get_proc_task(filp->f_path.dentry->d_inode);
 	if (!reaper)
 		goto out_no_task;
 
diff --git a/fs/ramfs/file-nommu.c b/fs/ramfs/file-nommu.c
index 9eead2c..fbb0b47 100644
--- a/fs/ramfs/file-nommu.c
+++ b/fs/ramfs/file-nommu.c
@@ -112,6 +112,7 @@
 		SetPageDirty(page);
 
 		unlock_page(page);
+		put_page(page);
 	}
 
 	return 0;
diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
index 919f0de..e6493ca 100644
--- a/fs/ubifs/debug.h
+++ b/fs/ubifs/debug.h
@@ -23,6 +23,12 @@
 #ifndef __UBIFS_DEBUG_H__
 #define __UBIFS_DEBUG_H__
 
+/* Checking helper functions */
+typedef int (*dbg_leaf_callback)(struct ubifs_info *c,
+				 struct ubifs_zbranch *zbr, void *priv);
+typedef int (*dbg_znode_callback)(struct ubifs_info *c,
+				  struct ubifs_znode *znode, void *priv);
+
 #ifdef CONFIG_UBIFS_FS_DEBUG
 
 /**
@@ -270,11 +276,6 @@
 void dbg_dump_index(struct ubifs_info *c);
 void dbg_dump_lpt_lebs(const struct ubifs_info *c);
 
-/* Checking helper functions */
-typedef int (*dbg_leaf_callback)(struct ubifs_info *c,
-				 struct ubifs_zbranch *zbr, void *priv);
-typedef int (*dbg_znode_callback)(struct ubifs_info *c,
-				  struct ubifs_znode *znode, void *priv);
 int dbg_walk_index(struct ubifs_info *c, dbg_leaf_callback leaf_cb,
 		   dbg_znode_callback znode_cb, void *priv);
 
@@ -295,7 +296,6 @@
 int dbg_check_filesystem(struct ubifs_info *c);
 void dbg_check_heap(struct ubifs_info *c, struct ubifs_lpt_heap *heap, int cat,
 		    int add_pos);
-int dbg_check_lprops(struct ubifs_info *c);
 int dbg_check_lpt_nodes(struct ubifs_info *c, struct ubifs_cnode *cnode,
 			int row, int col);
 int dbg_check_inode_size(struct ubifs_info *c, const struct inode *inode,
@@ -401,58 +401,94 @@
 #define DBGKEY(key)  ((char *)(key))
 #define DBGKEY1(key) ((char *)(key))
 
-#define ubifs_debugging_init(c)                0
-#define ubifs_debugging_exit(c)                ({})
+static inline int ubifs_debugging_init(struct ubifs_info *c)      { return 0; }
+static inline void ubifs_debugging_exit(struct ubifs_info *c)     { return; }
+static inline const char *dbg_ntype(int type)                     { return ""; }
+static inline const char *dbg_cstate(int cmt_state)               { return ""; }
+static inline const char *dbg_jhead(int jhead)                    { return ""; }
+static inline const char *
+dbg_get_key_dump(const struct ubifs_info *c,
+		 const union ubifs_key *key)                      { return ""; }
+static inline void dbg_dump_inode(const struct ubifs_info *c,
+				  const struct inode *inode)      { return; }
+static inline void dbg_dump_node(const struct ubifs_info *c,
+				 const void *node)                { return; }
+static inline void dbg_dump_lpt_node(const struct ubifs_info *c,
+				     void *node, int lnum,
+				     int offs)                    { return; }
+static inline void
+dbg_dump_budget_req(const struct ubifs_budget_req *req)           { return; }
+static inline void
+dbg_dump_lstats(const struct ubifs_lp_stats *lst)                 { return; }
+static inline void dbg_dump_budg(struct ubifs_info *c)            { return; }
+static inline void dbg_dump_lprop(const struct ubifs_info *c,
+				  const struct ubifs_lprops *lp)  { return; }
+static inline void dbg_dump_lprops(struct ubifs_info *c)          { return; }
+static inline void dbg_dump_lpt_info(struct ubifs_info *c)        { return; }
+static inline void dbg_dump_leb(const struct ubifs_info *c,
+				int lnum)                         { return; }
+static inline void
+dbg_dump_znode(const struct ubifs_info *c,
+	       const struct ubifs_znode *znode)                   { return; }
+static inline void dbg_dump_heap(struct ubifs_info *c,
+				 struct ubifs_lpt_heap *heap,
+				 int cat)                         { return; }
+static inline void dbg_dump_pnode(struct ubifs_info *c,
+				  struct ubifs_pnode *pnode,
+				  struct ubifs_nnode *parent,
+				  int iip)                        { return; }
+static inline void dbg_dump_tnc(struct ubifs_info *c)             { return; }
+static inline void dbg_dump_index(struct ubifs_info *c)           { return; }
+static inline void dbg_dump_lpt_lebs(const struct ubifs_info *c)  { return; }
 
-#define dbg_ntype(type)                        ""
-#define dbg_cstate(cmt_state)                  ""
-#define dbg_jhead(jhead)                       ""
-#define dbg_get_key_dump(c, key)               ({})
-#define dbg_dump_inode(c, inode)               ({})
-#define dbg_dump_node(c, node)                 ({})
-#define dbg_dump_lpt_node(c, node, lnum, offs) ({})
-#define dbg_dump_budget_req(req)               ({})
-#define dbg_dump_lstats(lst)                   ({})
-#define dbg_dump_budg(c)                       ({})
-#define dbg_dump_lprop(c, lp)                  ({})
-#define dbg_dump_lprops(c)                     ({})
-#define dbg_dump_lpt_info(c)                   ({})
-#define dbg_dump_leb(c, lnum)                  ({})
-#define dbg_dump_znode(c, znode)               ({})
-#define dbg_dump_heap(c, heap, cat)            ({})
-#define dbg_dump_pnode(c, pnode, parent, iip)  ({})
-#define dbg_dump_tnc(c)                        ({})
-#define dbg_dump_index(c)                      ({})
-#define dbg_dump_lpt_lebs(c)                   ({})
+static inline int dbg_walk_index(struct ubifs_info *c,
+				 dbg_leaf_callback leaf_cb,
+				 dbg_znode_callback znode_cb,
+				 void *priv)                      { return 0; }
+static inline void dbg_save_space_info(struct ubifs_info *c)      { return; }
+static inline int dbg_check_space_info(struct ubifs_info *c)      { return 0; }
+static inline int dbg_check_lprops(struct ubifs_info *c)          { return 0; }
+static inline int
+dbg_old_index_check_init(struct ubifs_info *c,
+			 struct ubifs_zbranch *zroot)             { return 0; }
+static inline int
+dbg_check_old_index(struct ubifs_info *c,
+		    struct ubifs_zbranch *zroot)                  { return 0; }
+static inline int dbg_check_cats(struct ubifs_info *c)            { return 0; }
+static inline int dbg_check_ltab(struct ubifs_info *c)            { return 0; }
+static inline int dbg_chk_lpt_free_spc(struct ubifs_info *c)      { return 0; }
+static inline int dbg_chk_lpt_sz(struct ubifs_info *c,
+				 int action, int len)             { return 0; }
+static inline int dbg_check_synced_i_size(struct inode *inode)    { return 0; }
+static inline int dbg_check_dir_size(struct ubifs_info *c,
+				     const struct inode *dir)     { return 0; }
+static inline int dbg_check_tnc(struct ubifs_info *c, int extra)  { return 0; }
+static inline int dbg_check_idx_size(struct ubifs_info *c,
+				     long long idx_size)          { return 0; }
+static inline int dbg_check_filesystem(struct ubifs_info *c)      { return 0; }
+static inline void dbg_check_heap(struct ubifs_info *c,
+				  struct ubifs_lpt_heap *heap,
+				  int cat, int add_pos)           { return; }
+static inline int dbg_check_lpt_nodes(struct ubifs_info *c,
+	struct ubifs_cnode *cnode, int row, int col)              { return 0; }
+static inline int dbg_check_inode_size(struct ubifs_info *c,
+				       const struct inode *inode,
+				       loff_t size)               { return 0; }
+static inline int
+dbg_check_data_nodes_order(struct ubifs_info *c,
+			   struct list_head *head)                { return 0; }
+static inline int
+dbg_check_nondata_nodes_order(struct ubifs_info *c,
+			      struct list_head *head)             { return 0; }
 
-#define dbg_walk_index(c, leaf_cb, znode_cb, priv) 0
-#define dbg_old_index_check_init(c, zroot)         0
-#define dbg_save_space_info(c)                     ({})
-#define dbg_check_space_info(c)                    0
-#define dbg_check_old_index(c, zroot)              0
-#define dbg_check_cats(c)                          0
-#define dbg_check_ltab(c)                          0
-#define dbg_chk_lpt_free_spc(c)                    0
-#define dbg_chk_lpt_sz(c, action, len)             0
-#define dbg_check_synced_i_size(inode)             0
-#define dbg_check_dir_size(c, dir)                 0
-#define dbg_check_tnc(c, x)                        0
-#define dbg_check_idx_size(c, idx_size)            0
-#define dbg_check_filesystem(c)                    0
-#define dbg_check_heap(c, heap, cat, add_pos)      ({})
-#define dbg_check_lprops(c)                        0
-#define dbg_check_lpt_nodes(c, cnode, row, col)    0
-#define dbg_check_inode_size(c, inode, size)       0
-#define dbg_check_data_nodes_order(c, head)        0
-#define dbg_check_nondata_nodes_order(c, head)     0
-#define dbg_force_in_the_gaps_enabled              0
-#define dbg_force_in_the_gaps()                    0
-#define dbg_failure_mode                           0
+static inline int dbg_force_in_the_gaps(void)                     { return 0; }
+#define dbg_force_in_the_gaps_enabled 0
+#define dbg_failure_mode              0
 
-#define dbg_debugfs_init()                         0
-#define dbg_debugfs_exit()
-#define dbg_debugfs_init_fs(c)                     0
-#define dbg_debugfs_exit_fs(c)                     0
+static inline int dbg_debugfs_init(void)                          { return 0; }
+static inline void dbg_debugfs_exit(void)                         { return; }
+static inline int dbg_debugfs_init_fs(struct ubifs_info *c)       { return 0; }
+static inline int dbg_debugfs_exit_fs(struct ubifs_info *c)       { return 0; }
 
 #endif /* !CONFIG_UBIFS_FS_DEBUG */
 #endif /* !__UBIFS_DEBUG_H__ */
diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
index 28be1e6..b286db7 100644
--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@ -1312,6 +1312,9 @@
 
 	dbg_gen("syncing inode %lu", inode->i_ino);
 
+	if (inode->i_sb->s_flags & MS_RDONLY)
+		return 0;
+
 	/*
 	 * VFS has already synchronized dirty pages for this inode. Synchronize
 	 * the inode unless this is a 'datasync()' call.
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index 5ea4020..9ef9ed2 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -293,7 +293,6 @@
 	size_t			nbytes, offset;
 	gfp_t			gfp_mask = xb_to_gfp(flags);
 	unsigned short		page_count, i;
-	pgoff_t			first;
 	xfs_off_t		end;
 	int			error;
 
@@ -333,7 +332,6 @@
 		return error;
 
 	offset = bp->b_offset;
-	first = bp->b_file_offset >> PAGE_SHIFT;
 	bp->b_flags |= _XBF_PAGES;
 
 	for (i = 0; i < bp->b_page_count; i++) {
@@ -657,8 +655,6 @@
 	xfs_off_t		ioff,
 	size_t			isize)
 {
-	struct backing_dev_info *bdi;
-
 	if (bdi_read_congested(target->bt_bdi))
 		return;
 
@@ -919,8 +915,6 @@
 
 	if (atomic_read(&bp->b_pin_count) && (bp->b_flags & XBF_STALE))
 		xfs_log_force(bp->b_target->bt_mount, 0);
-	if (atomic_read(&bp->b_io_remaining))
-		blk_flush_plug(current);
 	down(&bp->b_sema);
 	XB_SET_OWNER(bp);
 
@@ -1309,8 +1303,6 @@
 {
 	trace_xfs_buf_iowait(bp, _RET_IP_);
 
-	if (atomic_read(&bp->b_io_remaining))
-		blk_flush_plug(current);
 	wait_for_completion(&bp->b_iowait);
 
 	trace_xfs_buf_iowait_done(bp, _RET_IP_);
@@ -1747,8 +1739,8 @@
 	do {
 		long	age = xfs_buf_age_centisecs * msecs_to_jiffies(10);
 		long	tout = xfs_buf_timer_centisecs * msecs_to_jiffies(10);
-		int	count = 0;
 		struct list_head tmp;
+		struct blk_plug plug;
 
 		if (unlikely(freezing(current))) {
 			set_bit(XBT_FORCE_SLEEP, &target->bt_flags);
@@ -1764,16 +1756,15 @@
 
 		xfs_buf_delwri_split(target, &tmp, age);
 		list_sort(NULL, &tmp, xfs_buf_cmp);
+
+		blk_start_plug(&plug);
 		while (!list_empty(&tmp)) {
 			struct xfs_buf *bp;
 			bp = list_first_entry(&tmp, struct xfs_buf, b_list);
 			list_del_init(&bp->b_list);
 			xfs_bdstrat_cb(bp);
-			count++;
 		}
-		if (count)
-			blk_flush_plug(current);
-
+		blk_finish_plug(&plug);
 	} while (!kthread_should_stop());
 
 	return 0;
@@ -1793,6 +1784,7 @@
 	int		pincount = 0;
 	LIST_HEAD(tmp_list);
 	LIST_HEAD(wait_list);
+	struct blk_plug plug;
 
 	xfs_buf_runall_queues(xfsconvertd_workqueue);
 	xfs_buf_runall_queues(xfsdatad_workqueue);
@@ -1807,6 +1799,8 @@
 	 * we do that after issuing all the IO.
 	 */
 	list_sort(NULL, &tmp_list, xfs_buf_cmp);
+
+	blk_start_plug(&plug);
 	while (!list_empty(&tmp_list)) {
 		bp = list_first_entry(&tmp_list, struct xfs_buf, b_list);
 		ASSERT(target == bp->b_target);
@@ -1817,10 +1811,10 @@
 		}
 		xfs_bdstrat_cb(bp);
 	}
+	blk_finish_plug(&plug);
 
 	if (wait) {
-		/* Expedite and wait for IO to complete. */
-		blk_flush_plug(current);
+		/* Wait for IO to complete. */
 		while (!list_empty(&wait_list)) {
 			bp = list_first_entry(&wait_list, struct xfs_buf, b_list);
 
diff --git a/fs/xfs/linux-2.6/xfs_message.c b/fs/xfs/linux-2.6/xfs_message.c
index 508e06f..3ca7956 100644
--- a/fs/xfs/linux-2.6/xfs_message.c
+++ b/fs/xfs/linux-2.6/xfs_message.c
@@ -28,53 +28,47 @@
 /*
  * XFS logging functions
  */
-static int
+static void
 __xfs_printk(
 	const char		*level,
 	const struct xfs_mount	*mp,
 	struct va_format	*vaf)
 {
 	if (mp && mp->m_fsname)
-		return printk("%sXFS (%s): %pV\n", level, mp->m_fsname, vaf);
-	return printk("%sXFS: %pV\n", level, vaf);
+		printk("%sXFS (%s): %pV\n", level, mp->m_fsname, vaf);
+	printk("%sXFS: %pV\n", level, vaf);
 }
 
-int xfs_printk(
+void xfs_printk(
 	const char		*level,
 	const struct xfs_mount	*mp,
 	const char		*fmt, ...)
 {
 	struct va_format	vaf;
 	va_list			args;
-	int			 r;
 
 	va_start(args, fmt);
 
 	vaf.fmt = fmt;
 	vaf.va = &args;
 
-	r = __xfs_printk(level, mp, &vaf);
+	__xfs_printk(level, mp, &vaf);
 	va_end(args);
-
-	return r;
 }
 
 #define define_xfs_printk_level(func, kern_level)		\
-int func(const struct xfs_mount *mp, const char *fmt, ...)	\
+void func(const struct xfs_mount *mp, const char *fmt, ...)	\
 {								\
 	struct va_format	vaf;				\
 	va_list			args;				\
-	int			r;				\
 								\
 	va_start(args, fmt);					\
 								\
 	vaf.fmt = fmt;						\
 	vaf.va = &args;						\
 								\
-	r = __xfs_printk(kern_level, mp, &vaf);			\
+	__xfs_printk(kern_level, mp, &vaf);			\
 	va_end(args);						\
-								\
-	return r;						\
 }								\
 
 define_xfs_printk_level(xfs_emerg, KERN_EMERG);
@@ -88,7 +82,7 @@
 define_xfs_printk_level(xfs_debug, KERN_DEBUG);
 #endif
 
-int
+void
 xfs_alert_tag(
 	const struct xfs_mount	*mp,
 	int			panic_tag,
@@ -97,7 +91,6 @@
 	struct va_format	vaf;
 	va_list			args;
 	int			do_panic = 0;
-	int			r;
 
 	if (xfs_panic_mask && (xfs_panic_mask & panic_tag)) {
 		xfs_printk(KERN_ALERT, mp,
@@ -110,12 +103,10 @@
 	vaf.fmt = fmt;
 	vaf.va = &args;
 
-	r = __xfs_printk(KERN_ALERT, mp, &vaf);
+	__xfs_printk(KERN_ALERT, mp, &vaf);
 	va_end(args);
 
 	BUG_ON(do_panic);
-
-	return r;
 }
 
 void
diff --git a/fs/xfs/linux-2.6/xfs_message.h b/fs/xfs/linux-2.6/xfs_message.h
index e77ffa1..f1b3fc1 100644
--- a/fs/xfs/linux-2.6/xfs_message.h
+++ b/fs/xfs/linux-2.6/xfs_message.h
@@ -3,32 +3,34 @@
 
 struct xfs_mount;
 
-extern int xfs_printk(const char *level, const struct xfs_mount *mp,
+extern void xfs_printk(const char *level, const struct xfs_mount *mp,
                       const char *fmt, ...)
         __attribute__ ((format (printf, 3, 4)));
-extern int xfs_emerg(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_emerg(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
-extern int xfs_alert(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_alert(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
-extern int xfs_alert_tag(const struct xfs_mount *mp, int tag,
+extern void xfs_alert_tag(const struct xfs_mount *mp, int tag,
 			 const char *fmt, ...)
         __attribute__ ((format (printf, 3, 4)));
-extern int xfs_crit(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_crit(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
-extern int xfs_err(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_err(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
-extern int xfs_warn(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_warn(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
-extern int xfs_notice(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_notice(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
-extern int xfs_info(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_info(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
 
 #ifdef DEBUG
-extern int xfs_debug(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_debug(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
 #else
-#define xfs_debug(mp, fmt, ...)	(0)
+static inline void xfs_debug(const struct xfs_mount *mp, const char *fmt, ...)
+{
+}
 #endif
 
 extern void assfail(char *expr, char *f, int l);
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index 1ba5c45..b38e58d 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -816,75 +816,6 @@
 	return 0;
 }
 
-/*
- * XFS AIL push thread support
- */
-void
-xfsaild_wakeup(
-	struct xfs_ail		*ailp,
-	xfs_lsn_t		threshold_lsn)
-{
-	/* only ever move the target forwards */
-	if (XFS_LSN_CMP(threshold_lsn, ailp->xa_target) > 0) {
-		ailp->xa_target = threshold_lsn;
-		wake_up_process(ailp->xa_task);
-	}
-}
-
-STATIC int
-xfsaild(
-	void	*data)
-{
-	struct xfs_ail	*ailp = data;
-	xfs_lsn_t	last_pushed_lsn = 0;
-	long		tout = 0; /* milliseconds */
-
-	while (!kthread_should_stop()) {
-		/*
-		 * for short sleeps indicating congestion, don't allow us to
-		 * get woken early. Otherwise all we do is bang on the AIL lock
-		 * without making progress.
-		 */
-		if (tout && tout <= 20)
-			__set_current_state(TASK_KILLABLE);
-		else
-			__set_current_state(TASK_INTERRUPTIBLE);
-		schedule_timeout(tout ?
-				 msecs_to_jiffies(tout) : MAX_SCHEDULE_TIMEOUT);
-
-		/* swsusp */
-		try_to_freeze();
-
-		ASSERT(ailp->xa_mount->m_log);
-		if (XFS_FORCED_SHUTDOWN(ailp->xa_mount))
-			continue;
-
-		tout = xfsaild_push(ailp, &last_pushed_lsn);
-	}
-
-	return 0;
-}	/* xfsaild */
-
-int
-xfsaild_start(
-	struct xfs_ail	*ailp)
-{
-	ailp->xa_target = 0;
-	ailp->xa_task = kthread_run(xfsaild, ailp, "xfsaild/%s",
-				    ailp->xa_mount->m_fsname);
-	if (IS_ERR(ailp->xa_task))
-		return -PTR_ERR(ailp->xa_task);
-	return 0;
-}
-
-void
-xfsaild_stop(
-	struct xfs_ail	*ailp)
-{
-	kthread_stop(ailp->xa_task);
-}
-
-
 /* Catch misguided souls that try to use this interface on XFS */
 STATIC struct inode *
 xfs_fs_alloc_inode(
@@ -1191,22 +1122,12 @@
 		return -error;
 
 	if (laptop_mode) {
-		int	prev_sync_seq = mp->m_sync_seq;
-
 		/*
 		 * The disk must be active because we're syncing.
 		 * We schedule xfssyncd now (now that the disk is
 		 * active) instead of later (when it might not be).
 		 */
-		wake_up_process(mp->m_sync_task);
-		/*
-		 * We have to wait for the sync iteration to complete.
-		 * If we don't, the disk activity caused by the sync
-		 * will come after the sync is completed, and that
-		 * triggers another sync from laptop mode.
-		 */
-		wait_event(mp->m_wait_single_sync_task,
-				mp->m_sync_seq != prev_sync_seq);
+		flush_delayed_work_sync(&mp->m_sync_work);
 	}
 
 	return 0;
@@ -1490,9 +1411,6 @@
 	spin_lock_init(&mp->m_sb_lock);
 	mutex_init(&mp->m_growlock);
 	atomic_set(&mp->m_active_trans, 0);
-	INIT_LIST_HEAD(&mp->m_sync_list);
-	spin_lock_init(&mp->m_sync_lock);
-	init_waitqueue_head(&mp->m_wait_single_sync_task);
 
 	mp->m_super = sb;
 	sb->s_fs_info = mp;
@@ -1799,6 +1717,38 @@
 }
 
 STATIC int __init
+xfs_init_workqueues(void)
+{
+	/*
+	 * max_active is set to 8 to give enough concurency to allow
+	 * multiple work operations on each CPU to run. This allows multiple
+	 * filesystems to be running sync work concurrently, and scales with
+	 * the number of CPUs in the system.
+	 */
+	xfs_syncd_wq = alloc_workqueue("xfssyncd", WQ_CPU_INTENSIVE, 8);
+	if (!xfs_syncd_wq)
+		goto out;
+
+	xfs_ail_wq = alloc_workqueue("xfsail", WQ_CPU_INTENSIVE, 8);
+	if (!xfs_ail_wq)
+		goto out_destroy_syncd;
+
+	return 0;
+
+out_destroy_syncd:
+	destroy_workqueue(xfs_syncd_wq);
+out:
+	return -ENOMEM;
+}
+
+STATIC void
+xfs_destroy_workqueues(void)
+{
+	destroy_workqueue(xfs_ail_wq);
+	destroy_workqueue(xfs_syncd_wq);
+}
+
+STATIC int __init
 init_xfs_fs(void)
 {
 	int			error;
@@ -1813,10 +1763,14 @@
 	if (error)
 		goto out;
 
-	error = xfs_mru_cache_init();
+	error = xfs_init_workqueues();
 	if (error)
 		goto out_destroy_zones;
 
+	error = xfs_mru_cache_init();
+	if (error)
+		goto out_destroy_wq;
+
 	error = xfs_filestream_init();
 	if (error)
 		goto out_mru_cache_uninit;
@@ -1833,6 +1787,10 @@
 	if (error)
 		goto out_cleanup_procfs;
 
+	error = xfs_init_workqueues();
+	if (error)
+		goto out_sysctl_unregister;
+
 	vfs_initquota();
 
 	error = register_filesystem(&xfs_fs_type);
@@ -1850,6 +1808,8 @@
 	xfs_filestream_uninit();
  out_mru_cache_uninit:
 	xfs_mru_cache_uninit();
+ out_destroy_wq:
+	xfs_destroy_workqueues();
  out_destroy_zones:
 	xfs_destroy_zones();
  out:
@@ -1866,6 +1826,7 @@
 	xfs_buf_terminate();
 	xfs_filestream_uninit();
 	xfs_mru_cache_uninit();
+	xfs_destroy_workqueues();
 	xfs_destroy_zones();
 }
 
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index 9cf35a68..e4f9c1b 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -22,6 +22,7 @@
 #include "xfs_log.h"
 #include "xfs_inum.h"
 #include "xfs_trans.h"
+#include "xfs_trans_priv.h"
 #include "xfs_sb.h"
 #include "xfs_ag.h"
 #include "xfs_mount.h"
@@ -39,6 +40,8 @@
 #include <linux/kthread.h>
 #include <linux/freezer.h>
 
+struct workqueue_struct	*xfs_syncd_wq;	/* sync workqueue */
+
 /*
  * The inode lookup is done in batches to keep the amount of lock traffic and
  * radix tree lookups to a minimum. The batch size is a trade off between
@@ -431,62 +434,12 @@
 	xfs_unmountfs_writesb(mp);
 }
 
-/*
- * Enqueue a work item to be picked up by the vfs xfssyncd thread.
- * Doing this has two advantages:
- * - It saves on stack space, which is tight in certain situations
- * - It can be used (with care) as a mechanism to avoid deadlocks.
- * Flushing while allocating in a full filesystem requires both.
- */
-STATIC void
-xfs_syncd_queue_work(
-	struct xfs_mount *mp,
-	void		*data,
-	void		(*syncer)(struct xfs_mount *, void *),
-	struct completion *completion)
+static void
+xfs_syncd_queue_sync(
+	struct xfs_mount        *mp)
 {
-	struct xfs_sync_work *work;
-
-	work = kmem_alloc(sizeof(struct xfs_sync_work), KM_SLEEP);
-	INIT_LIST_HEAD(&work->w_list);
-	work->w_syncer = syncer;
-	work->w_data = data;
-	work->w_mount = mp;
-	work->w_completion = completion;
-	spin_lock(&mp->m_sync_lock);
-	list_add_tail(&work->w_list, &mp->m_sync_list);
-	spin_unlock(&mp->m_sync_lock);
-	wake_up_process(mp->m_sync_task);
-}
-
-/*
- * Flush delayed allocate data, attempting to free up reserved space
- * from existing allocations.  At this point a new allocation attempt
- * has failed with ENOSPC and we are in the process of scratching our
- * heads, looking about for more room...
- */
-STATIC void
-xfs_flush_inodes_work(
-	struct xfs_mount *mp,
-	void		*arg)
-{
-	struct inode	*inode = arg;
-	xfs_sync_data(mp, SYNC_TRYLOCK);
-	xfs_sync_data(mp, SYNC_TRYLOCK | SYNC_WAIT);
-	iput(inode);
-}
-
-void
-xfs_flush_inodes(
-	xfs_inode_t	*ip)
-{
-	struct inode	*inode = VFS_I(ip);
-	DECLARE_COMPLETION_ONSTACK(completion);
-
-	igrab(inode);
-	xfs_syncd_queue_work(ip->i_mount, inode, xfs_flush_inodes_work, &completion);
-	wait_for_completion(&completion);
-	xfs_log_force(ip->i_mount, XFS_LOG_SYNC);
+	queue_delayed_work(xfs_syncd_wq, &mp->m_sync_work,
+				msecs_to_jiffies(xfs_syncd_centisecs * 10));
 }
 
 /*
@@ -496,9 +449,10 @@
  */
 STATIC void
 xfs_sync_worker(
-	struct xfs_mount *mp,
-	void		*unused)
+	struct work_struct *work)
 {
+	struct xfs_mount *mp = container_of(to_delayed_work(work),
+					struct xfs_mount, m_sync_work);
 	int		error;
 
 	if (!(mp->m_flags & XFS_MOUNT_RDONLY)) {
@@ -508,73 +462,106 @@
 			error = xfs_fs_log_dummy(mp);
 		else
 			xfs_log_force(mp, 0);
-		xfs_reclaim_inodes(mp, 0);
 		error = xfs_qm_sync(mp, SYNC_TRYLOCK);
+
+		/* start pushing all the metadata that is currently dirty */
+		xfs_ail_push_all(mp->m_ail);
 	}
-	mp->m_sync_seq++;
-	wake_up(&mp->m_wait_single_sync_task);
+
+	/* queue us up again */
+	xfs_syncd_queue_sync(mp);
 }
 
-STATIC int
-xfssyncd(
-	void			*arg)
+/*
+ * Queue a new inode reclaim pass if there are reclaimable inodes and there
+ * isn't a reclaim pass already in progress. By default it runs every 5s based
+ * on the xfs syncd work default of 30s. Perhaps this should have it's own
+ * tunable, but that can be done if this method proves to be ineffective or too
+ * aggressive.
+ */
+static void
+xfs_syncd_queue_reclaim(
+	struct xfs_mount        *mp)
 {
-	struct xfs_mount	*mp = arg;
-	long			timeleft;
-	xfs_sync_work_t		*work, *n;
-	LIST_HEAD		(tmp);
 
-	set_freezable();
-	timeleft = xfs_syncd_centisecs * msecs_to_jiffies(10);
-	for (;;) {
-		if (list_empty(&mp->m_sync_list))
-			timeleft = schedule_timeout_interruptible(timeleft);
-		/* swsusp */
-		try_to_freeze();
-		if (kthread_should_stop() && list_empty(&mp->m_sync_list))
-			break;
+	/*
+	 * We can have inodes enter reclaim after we've shut down the syncd
+	 * workqueue during unmount, so don't allow reclaim work to be queued
+	 * during unmount.
+	 */
+	if (!(mp->m_super->s_flags & MS_ACTIVE))
+		return;
 
-		spin_lock(&mp->m_sync_lock);
-		/*
-		 * We can get woken by laptop mode, to do a sync -
-		 * that's the (only!) case where the list would be
-		 * empty with time remaining.
-		 */
-		if (!timeleft || list_empty(&mp->m_sync_list)) {
-			if (!timeleft)
-				timeleft = xfs_syncd_centisecs *
-							msecs_to_jiffies(10);
-			INIT_LIST_HEAD(&mp->m_sync_work.w_list);
-			list_add_tail(&mp->m_sync_work.w_list,
-					&mp->m_sync_list);
-		}
-		list_splice_init(&mp->m_sync_list, &tmp);
-		spin_unlock(&mp->m_sync_lock);
-
-		list_for_each_entry_safe(work, n, &tmp, w_list) {
-			(*work->w_syncer)(mp, work->w_data);
-			list_del(&work->w_list);
-			if (work == &mp->m_sync_work)
-				continue;
-			if (work->w_completion)
-				complete(work->w_completion);
-			kmem_free(work);
-		}
+	rcu_read_lock();
+	if (radix_tree_tagged(&mp->m_perag_tree, XFS_ICI_RECLAIM_TAG)) {
+		queue_delayed_work(xfs_syncd_wq, &mp->m_reclaim_work,
+			msecs_to_jiffies(xfs_syncd_centisecs / 6 * 10));
 	}
+	rcu_read_unlock();
+}
 
-	return 0;
+/*
+ * This is a fast pass over the inode cache to try to get reclaim moving on as
+ * many inodes as possible in a short period of time. It kicks itself every few
+ * seconds, as well as being kicked by the inode cache shrinker when memory
+ * goes low. It scans as quickly as possible avoiding locked inodes or those
+ * already being flushed, and once done schedules a future pass.
+ */
+STATIC void
+xfs_reclaim_worker(
+	struct work_struct *work)
+{
+	struct xfs_mount *mp = container_of(to_delayed_work(work),
+					struct xfs_mount, m_reclaim_work);
+
+	xfs_reclaim_inodes(mp, SYNC_TRYLOCK);
+	xfs_syncd_queue_reclaim(mp);
+}
+
+/*
+ * Flush delayed allocate data, attempting to free up reserved space
+ * from existing allocations.  At this point a new allocation attempt
+ * has failed with ENOSPC and we are in the process of scratching our
+ * heads, looking about for more room.
+ *
+ * Queue a new data flush if there isn't one already in progress and
+ * wait for completion of the flush. This means that we only ever have one
+ * inode flush in progress no matter how many ENOSPC events are occurring and
+ * so will prevent the system from bogging down due to every concurrent
+ * ENOSPC event scanning all the active inodes in the system for writeback.
+ */
+void
+xfs_flush_inodes(
+	struct xfs_inode	*ip)
+{
+	struct xfs_mount	*mp = ip->i_mount;
+
+	queue_work(xfs_syncd_wq, &mp->m_flush_work);
+	flush_work_sync(&mp->m_flush_work);
+}
+
+STATIC void
+xfs_flush_worker(
+	struct work_struct *work)
+{
+	struct xfs_mount *mp = container_of(work,
+					struct xfs_mount, m_flush_work);
+
+	xfs_sync_data(mp, SYNC_TRYLOCK);
+	xfs_sync_data(mp, SYNC_TRYLOCK | SYNC_WAIT);
 }
 
 int
 xfs_syncd_init(
 	struct xfs_mount	*mp)
 {
-	mp->m_sync_work.w_syncer = xfs_sync_worker;
-	mp->m_sync_work.w_mount = mp;
-	mp->m_sync_work.w_completion = NULL;
-	mp->m_sync_task = kthread_run(xfssyncd, mp, "xfssyncd/%s", mp->m_fsname);
-	if (IS_ERR(mp->m_sync_task))
-		return -PTR_ERR(mp->m_sync_task);
+	INIT_WORK(&mp->m_flush_work, xfs_flush_worker);
+	INIT_DELAYED_WORK(&mp->m_sync_work, xfs_sync_worker);
+	INIT_DELAYED_WORK(&mp->m_reclaim_work, xfs_reclaim_worker);
+
+	xfs_syncd_queue_sync(mp);
+	xfs_syncd_queue_reclaim(mp);
+
 	return 0;
 }
 
@@ -582,7 +569,9 @@
 xfs_syncd_stop(
 	struct xfs_mount	*mp)
 {
-	kthread_stop(mp->m_sync_task);
+	cancel_delayed_work_sync(&mp->m_sync_work);
+	cancel_delayed_work_sync(&mp->m_reclaim_work);
+	cancel_work_sync(&mp->m_flush_work);
 }
 
 void
@@ -601,6 +590,10 @@
 				XFS_INO_TO_AGNO(ip->i_mount, ip->i_ino),
 				XFS_ICI_RECLAIM_TAG);
 		spin_unlock(&ip->i_mount->m_perag_lock);
+
+		/* schedule periodic background inode reclaim */
+		xfs_syncd_queue_reclaim(ip->i_mount);
+
 		trace_xfs_perag_set_reclaim(ip->i_mount, pag->pag_agno,
 							-1, _RET_IP_);
 	}
@@ -1017,7 +1010,13 @@
 }
 
 /*
- * Shrinker infrastructure.
+ * Inode cache shrinker.
+ *
+ * When called we make sure that there is a background (fast) inode reclaim in
+ * progress, while we will throttle the speed of reclaim via doiing synchronous
+ * reclaim of inodes. That means if we come across dirty inodes, we wait for
+ * them to be cleaned, which we hope will not be very long due to the
+ * background walker having already kicked the IO off on those dirty inodes.
  */
 static int
 xfs_reclaim_inode_shrink(
@@ -1032,10 +1031,15 @@
 
 	mp = container_of(shrink, struct xfs_mount, m_inode_shrink);
 	if (nr_to_scan) {
+		/* kick background reclaimer and push the AIL */
+		xfs_syncd_queue_reclaim(mp);
+		xfs_ail_push_all(mp->m_ail);
+
 		if (!(gfp_mask & __GFP_FS))
 			return -1;
 
-		xfs_reclaim_inodes_ag(mp, SYNC_TRYLOCK, &nr_to_scan);
+		xfs_reclaim_inodes_ag(mp, SYNC_TRYLOCK | SYNC_WAIT,
+					&nr_to_scan);
 		/* terminate if we don't exhaust the scan */
 		if (nr_to_scan > 0)
 			return -1;
diff --git a/fs/xfs/linux-2.6/xfs_sync.h b/fs/xfs/linux-2.6/xfs_sync.h
index 32ba662..e3a6ad2 100644
--- a/fs/xfs/linux-2.6/xfs_sync.h
+++ b/fs/xfs/linux-2.6/xfs_sync.h
@@ -32,6 +32,8 @@
 #define SYNC_WAIT		0x0001	/* wait for i/o to complete */
 #define SYNC_TRYLOCK		0x0002  /* only try to lock inodes */
 
+extern struct workqueue_struct	*xfs_syncd_wq;	/* sync workqueue */
+
 int xfs_syncd_init(struct xfs_mount *mp);
 void xfs_syncd_stop(struct xfs_mount *mp);
 
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index 254ee06..69228aa 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -461,12 +461,10 @@
 	struct xfs_quotainfo	*q = mp->m_quotainfo;
 	int			recl;
 	struct xfs_dquot	*dqp;
-	int			niters;
 	int			error;
 
 	if (!q)
 		return 0;
-	niters = 0;
 again:
 	mutex_lock(&q->qi_dqlist_lock);
 	list_for_each_entry(dqp, &q->qi_dqlist, q_mplist) {
@@ -1314,14 +1312,9 @@
 {
 	xfs_buf_t	*bp;
 	int		error;
-	int		notcommitted;
-	int		incr;
 	int		type;
 
 	ASSERT(blkcnt > 0);
-	notcommitted = 0;
-	incr = (blkcnt > XFS_QM_MAX_DQCLUSTER_LOGSZ) ?
-		XFS_QM_MAX_DQCLUSTER_LOGSZ : blkcnt;
 	type = flags & XFS_QMOPT_UQUOTA ? XFS_DQ_USER :
 		(flags & XFS_QMOPT_PQUOTA ? XFS_DQ_PROJ : XFS_DQ_GROUP);
 	error = 0;
diff --git a/fs/xfs/quota/xfs_qm.h b/fs/xfs/quota/xfs_qm.h
index c9446f1..567b29b 100644
--- a/fs/xfs/quota/xfs_qm.h
+++ b/fs/xfs/quota/xfs_qm.h
@@ -65,11 +65,6 @@
  * block in the dquot/xqm code.
  */
 #define XFS_DQUOT_CLUSTER_SIZE_FSB	(xfs_filblks_t)1
-/*
- * When doing a quotacheck, we log dquot clusters of this many FSBs at most
- * in a single transaction. We don't want to ask for too huge a log reservation.
- */
-#define XFS_QM_MAX_DQCLUSTER_LOGSZ	3
 
 typedef xfs_dqhash_t	xfs_dqlist_t;
 
diff --git a/fs/xfs/quota/xfs_qm_syscalls.c b/fs/xfs/quota/xfs_qm_syscalls.c
index 0d62a07..2dadb15 100644
--- a/fs/xfs/quota/xfs_qm_syscalls.c
+++ b/fs/xfs/quota/xfs_qm_syscalls.c
@@ -313,14 +313,12 @@
 {
 	int		error;
 	uint		qf;
-	uint		accflags;
 	__int64_t	sbflags;
 
 	flags &= (XFS_ALL_QUOTA_ACCT | XFS_ALL_QUOTA_ENFD);
 	/*
 	 * Switching on quota accounting must be done at mount time.
 	 */
-	accflags = flags & XFS_ALL_QUOTA_ACCT;
 	flags &= ~(XFS_ALL_QUOTA_ACCT);
 
 	sbflags = 0;
diff --git a/fs/xfs/xfs_alloc.c b/fs/xfs/xfs_alloc.c
index 4bc3c64..27d64d7 100644
--- a/fs/xfs/xfs_alloc.c
+++ b/fs/xfs/xfs_alloc.c
@@ -2395,17 +2395,33 @@
 	memset(&args, 0, sizeof(xfs_alloc_arg_t));
 	args.tp = tp;
 	args.mp = tp->t_mountp;
+
+	/*
+	 * validate that the block number is legal - the enables us to detect
+	 * and handle a silent filesystem corruption rather than crashing.
+	 */
 	args.agno = XFS_FSB_TO_AGNO(args.mp, bno);
-	ASSERT(args.agno < args.mp->m_sb.sb_agcount);
+	if (args.agno >= args.mp->m_sb.sb_agcount)
+		return EFSCORRUPTED;
+
 	args.agbno = XFS_FSB_TO_AGBNO(args.mp, bno);
+	if (args.agbno >= args.mp->m_sb.sb_agblocks)
+		return EFSCORRUPTED;
+
 	args.pag = xfs_perag_get(args.mp, args.agno);
-	if ((error = xfs_alloc_fix_freelist(&args, XFS_ALLOC_FLAG_FREEING)))
+	ASSERT(args.pag);
+
+	error = xfs_alloc_fix_freelist(&args, XFS_ALLOC_FLAG_FREEING);
+	if (error)
 		goto error0;
-#ifdef DEBUG
-	ASSERT(args.agbp != NULL);
-	ASSERT((args.agbno + len) <=
-		be32_to_cpu(XFS_BUF_TO_AGF(args.agbp)->agf_length));
-#endif
+
+	/* validate the extent size is legal now we have the agf locked */
+	if (args.agbno + len >
+			be32_to_cpu(XFS_BUF_TO_AGF(args.agbp)->agf_length)) {
+		error = EFSCORRUPTED;
+		goto error0;
+	}
+
 	error = xfs_free_ag_extent(tp, args.agbp, args.agno, args.agbno, len, 0);
 error0:
 	xfs_perag_put(args.pag);
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index 46cc401..576fdfe 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -198,6 +198,41 @@
 }
 
 /*
+ * xfs_inode_item_format_extents - convert in-core extents to on-disk form
+ *
+ * For either the data or attr fork in extent format, we need to endian convert
+ * the in-core extent as we place them into the on-disk inode. In this case, we
+ * need to do this conversion before we write the extents into the log. Because
+ * we don't have the disk inode to write into here, we allocate a buffer and
+ * format the extents into it via xfs_iextents_copy(). We free the buffer in
+ * the unlock routine after the copy for the log has been made.
+ *
+ * In the case of the data fork, the in-core and on-disk fork sizes can be
+ * different due to delayed allocation extents. We only log on-disk extents
+ * here, so always use the physical fork size to determine the size of the
+ * buffer we need to allocate.
+ */
+STATIC void
+xfs_inode_item_format_extents(
+	struct xfs_inode	*ip,
+	struct xfs_log_iovec	*vecp,
+	int			whichfork,
+	int			type)
+{
+	xfs_bmbt_rec_t		*ext_buffer;
+
+	ext_buffer = kmem_alloc(XFS_IFORK_SIZE(ip, whichfork), KM_SLEEP);
+	if (whichfork == XFS_DATA_FORK)
+		ip->i_itemp->ili_extents_buf = ext_buffer;
+	else
+		ip->i_itemp->ili_aextents_buf = ext_buffer;
+
+	vecp->i_addr = ext_buffer;
+	vecp->i_len = xfs_iextents_copy(ip, ext_buffer, whichfork);
+	vecp->i_type = type;
+}
+
+/*
  * This is called to fill in the vector of log iovecs for the
  * given inode log item.  It fills the first item with an inode
  * log format structure, the second with the on-disk inode structure,
@@ -213,7 +248,6 @@
 	struct xfs_inode	*ip = iip->ili_inode;
 	uint			nvecs;
 	size_t			data_bytes;
-	xfs_bmbt_rec_t		*ext_buffer;
 	xfs_mount_t		*mp;
 
 	vecp->i_addr = &iip->ili_format;
@@ -320,22 +354,8 @@
 			} else
 #endif
 			{
-				/*
-				 * There are delayed allocation extents
-				 * in the inode, or we need to convert
-				 * the extents to on disk format.
-				 * Use xfs_iextents_copy()
-				 * to copy only the real extents into
-				 * a separate buffer.  We'll free the
-				 * buffer in the unlock routine.
-				 */
-				ext_buffer = kmem_alloc(ip->i_df.if_bytes,
-					KM_SLEEP);
-				iip->ili_extents_buf = ext_buffer;
-				vecp->i_addr = ext_buffer;
-				vecp->i_len = xfs_iextents_copy(ip, ext_buffer,
-						XFS_DATA_FORK);
-				vecp->i_type = XLOG_REG_TYPE_IEXT;
+				xfs_inode_item_format_extents(ip, vecp,
+					XFS_DATA_FORK, XLOG_REG_TYPE_IEXT);
 			}
 			ASSERT(vecp->i_len <= ip->i_df.if_bytes);
 			iip->ili_format.ilf_dsize = vecp->i_len;
@@ -445,19 +465,12 @@
 			 */
 			vecp->i_addr = ip->i_afp->if_u1.if_extents;
 			vecp->i_len = ip->i_afp->if_bytes;
+			vecp->i_type = XLOG_REG_TYPE_IATTR_EXT;
 #else
 			ASSERT(iip->ili_aextents_buf == NULL);
-			/*
-			 * Need to endian flip before logging
-			 */
-			ext_buffer = kmem_alloc(ip->i_afp->if_bytes,
-				KM_SLEEP);
-			iip->ili_aextents_buf = ext_buffer;
-			vecp->i_addr = ext_buffer;
-			vecp->i_len = xfs_iextents_copy(ip, ext_buffer,
-					XFS_ATTR_FORK);
+			xfs_inode_item_format_extents(ip, vecp,
+					XFS_ATTR_FORK, XLOG_REG_TYPE_IATTR_EXT);
 #endif
-			vecp->i_type = XLOG_REG_TYPE_IATTR_EXT;
 			iip->ili_format.ilf_asize = vecp->i_len;
 			vecp++;
 			nvecs++;
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index dc1882a..751e94f 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -204,7 +204,6 @@
 	xfs_agi_t		*agi;	/* agi header data */
 	xfs_agino_t		agino;	/* inode # in allocation group */
 	xfs_agnumber_t		agno;	/* allocation group number */
-	xfs_daddr_t		bno;	/* inode cluster start daddr */
 	int			chunkidx; /* current index into inode chunk */
 	int			clustidx; /* current index into inode cluster */
 	xfs_btree_cur_t		*cur;	/* btree cursor for ialloc btree */
@@ -463,7 +462,6 @@
 						 mp->m_sb.sb_inopblog);
 				}
 				ino = XFS_AGINO_TO_INO(mp, agno, agino);
-				bno = XFS_AGB_TO_DADDR(mp, agno, agbno);
 				/*
 				 * Skip if this inode is free.
 				 */
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 25efa9b..b612ce4 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -761,7 +761,7 @@
 		break;
 	case XLOG_STATE_COVER_NEED:
 	case XLOG_STATE_COVER_NEED2:
-		if (!xfs_trans_ail_tail(log->l_ailp) &&
+		if (!xfs_ail_min_lsn(log->l_ailp) &&
 		    xlog_iclogs_empty(log)) {
 			if (log->l_covered_state == XLOG_STATE_COVER_NEED)
 				log->l_covered_state = XLOG_STATE_COVER_DONE;
@@ -801,7 +801,7 @@
 	xfs_lsn_t		tail_lsn;
 	struct log		*log = mp->m_log;
 
-	tail_lsn = xfs_trans_ail_tail(mp->m_ail);
+	tail_lsn = xfs_ail_min_lsn(mp->m_ail);
 	if (!tail_lsn)
 		tail_lsn = atomic64_read(&log->l_last_sync_lsn);
 
@@ -1239,7 +1239,7 @@
 	 * the filesystem is shutting down.
 	 */
 	if (!XLOG_FORCED_SHUTDOWN(log))
-		xfs_trans_ail_push(log->l_ailp, threshold_lsn);
+		xfs_ail_push(log->l_ailp, threshold_lsn);
 }
 
 /*
@@ -3407,6 +3407,17 @@
 		xfs_emerg(log->l_mp, "%s: invalid ptr", __func__);
 }
 
+/*
+ * Check to make sure the grant write head didn't just over lap the tail.  If
+ * the cycles are the same, we can't be overlapping.  Otherwise, make sure that
+ * the cycles differ by exactly one and check the byte count.
+ *
+ * This check is run unlocked, so can give false positives. Rather than assert
+ * on failures, use a warn-once flag and a panic tag to allow the admin to
+ * determine if they want to panic the machine when such an error occurs. For
+ * debug kernels this will have the same effect as using an assert but, unlinke
+ * an assert, it can be turned off at runtime.
+ */
 STATIC void
 xlog_verify_grant_tail(
 	struct log	*log)
@@ -3414,17 +3425,22 @@
 	int		tail_cycle, tail_blocks;
 	int		cycle, space;
 
-	/*
-	 * Check to make sure the grant write head didn't just over lap the
-	 * tail.  If the cycles are the same, we can't be overlapping.
-	 * Otherwise, make sure that the cycles differ by exactly one and
-	 * check the byte count.
-	 */
 	xlog_crack_grant_head(&log->l_grant_write_head, &cycle, &space);
 	xlog_crack_atomic_lsn(&log->l_tail_lsn, &tail_cycle, &tail_blocks);
 	if (tail_cycle != cycle) {
-		ASSERT(cycle - 1 == tail_cycle);
-		ASSERT(space <= BBTOB(tail_blocks));
+		if (cycle - 1 != tail_cycle &&
+		    !(log->l_flags & XLOG_TAIL_WARN)) {
+			xfs_alert_tag(log->l_mp, XFS_PTAG_LOGRES,
+				"%s: cycle - 1 != tail_cycle", __func__);
+			log->l_flags |= XLOG_TAIL_WARN;
+		}
+
+		if (space > BBTOB(tail_blocks) &&
+		    !(log->l_flags & XLOG_TAIL_WARN)) {
+			xfs_alert_tag(log->l_mp, XFS_PTAG_LOGRES,
+				"%s: space > BBTOB(tail_blocks)", __func__);
+			log->l_flags |= XLOG_TAIL_WARN;
+		}
 	}
 }
 
diff --git a/fs/xfs/xfs_log_priv.h b/fs/xfs/xfs_log_priv.h
index ffae692..5864850 100644
--- a/fs/xfs/xfs_log_priv.h
+++ b/fs/xfs/xfs_log_priv.h
@@ -144,6 +144,7 @@
 #define	XLOG_RECOVERY_NEEDED	0x4	/* log was recovered */
 #define XLOG_IO_ERROR		0x8	/* log hit an I/O error, and being
 					   shutdown */
+#define XLOG_TAIL_WARN		0x10	/* log tail verify warning issued */
 
 #ifdef __KERNEL__
 /*
diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
index a62e897..19af0ab 100644
--- a/fs/xfs/xfs_mount.h
+++ b/fs/xfs/xfs_mount.h
@@ -203,12 +203,9 @@
 	struct mutex		m_icsb_mutex;	/* balancer sync lock */
 #endif
 	struct xfs_mru_cache	*m_filestream;  /* per-mount filestream data */
-	struct task_struct	*m_sync_task;	/* generalised sync thread */
-	xfs_sync_work_t		m_sync_work;	/* work item for VFS_SYNC */
-	struct list_head	m_sync_list;	/* sync thread work item list */
-	spinlock_t		m_sync_lock;	/* work item list lock */
-	int			m_sync_seq;	/* sync thread generation no. */
-	wait_queue_head_t	m_wait_single_sync_task;
+	struct delayed_work	m_sync_work;	/* background sync work */
+	struct delayed_work	m_reclaim_work;	/* background inode reclaim */
+	struct work_struct	m_flush_work;	/* background inode flush */
 	__int64_t		m_update_flags;	/* sb flags we need to update
 						   on the next remount,rw */
 	struct shrinker		m_inode_shrink;	/* inode reclaim shrinker */
diff --git a/fs/xfs/xfs_trans_ail.c b/fs/xfs/xfs_trans_ail.c
index 12aff95..acdb92f 100644
--- a/fs/xfs/xfs_trans_ail.c
+++ b/fs/xfs/xfs_trans_ail.c
@@ -28,74 +28,138 @@
 #include "xfs_trans_priv.h"
 #include "xfs_error.h"
 
-STATIC void xfs_ail_splice(struct xfs_ail *, struct list_head *, xfs_lsn_t);
-STATIC void xfs_ail_delete(struct xfs_ail *, xfs_log_item_t *);
-STATIC xfs_log_item_t * xfs_ail_min(struct xfs_ail *);
-STATIC xfs_log_item_t * xfs_ail_next(struct xfs_ail *, xfs_log_item_t *);
+struct workqueue_struct	*xfs_ail_wq;	/* AIL workqueue */
 
 #ifdef DEBUG
-STATIC void xfs_ail_check(struct xfs_ail *, xfs_log_item_t *);
-#else
+/*
+ * Check that the list is sorted as it should be.
+ */
+STATIC void
+xfs_ail_check(
+	struct xfs_ail	*ailp,
+	xfs_log_item_t	*lip)
+{
+	xfs_log_item_t	*prev_lip;
+
+	if (list_empty(&ailp->xa_ail))
+		return;
+
+	/*
+	 * Check the next and previous entries are valid.
+	 */
+	ASSERT((lip->li_flags & XFS_LI_IN_AIL) != 0);
+	prev_lip = list_entry(lip->li_ail.prev, xfs_log_item_t, li_ail);
+	if (&prev_lip->li_ail != &ailp->xa_ail)
+		ASSERT(XFS_LSN_CMP(prev_lip->li_lsn, lip->li_lsn) <= 0);
+
+	prev_lip = list_entry(lip->li_ail.next, xfs_log_item_t, li_ail);
+	if (&prev_lip->li_ail != &ailp->xa_ail)
+		ASSERT(XFS_LSN_CMP(prev_lip->li_lsn, lip->li_lsn) >= 0);
+
+
+#ifdef XFS_TRANS_DEBUG
+	/*
+	 * Walk the list checking lsn ordering, and that every entry has the
+	 * XFS_LI_IN_AIL flag set. This is really expensive, so only do it
+	 * when specifically debugging the transaction subsystem.
+	 */
+	prev_lip = list_entry(&ailp->xa_ail, xfs_log_item_t, li_ail);
+	list_for_each_entry(lip, &ailp->xa_ail, li_ail) {
+		if (&prev_lip->li_ail != &ailp->xa_ail)
+			ASSERT(XFS_LSN_CMP(prev_lip->li_lsn, lip->li_lsn) <= 0);
+		ASSERT((lip->li_flags & XFS_LI_IN_AIL) != 0);
+		prev_lip = lip;
+	}
+#endif /* XFS_TRANS_DEBUG */
+}
+#else /* !DEBUG */
 #define	xfs_ail_check(a,l)
 #endif /* DEBUG */
 
+/*
+ * Return a pointer to the first item in the AIL.  If the AIL is empty, then
+ * return NULL.
+ */
+static xfs_log_item_t *
+xfs_ail_min(
+	struct xfs_ail  *ailp)
+{
+	if (list_empty(&ailp->xa_ail))
+		return NULL;
+
+	return list_first_entry(&ailp->xa_ail, xfs_log_item_t, li_ail);
+}
+
+ /*
+ * Return a pointer to the last item in the AIL.  If the AIL is empty, then
+ * return NULL.
+ */
+static xfs_log_item_t *
+xfs_ail_max(
+	struct xfs_ail  *ailp)
+{
+	if (list_empty(&ailp->xa_ail))
+		return NULL;
+
+	return list_entry(ailp->xa_ail.prev, xfs_log_item_t, li_ail);
+}
 
 /*
- * This is called by the log manager code to determine the LSN
- * of the tail of the log.  This is exactly the LSN of the first
- * item in the AIL.  If the AIL is empty, then this function
- * returns 0.
+ * Return a pointer to the item which follows the given item in the AIL.  If
+ * the given item is the last item in the list, then return NULL.
+ */
+static xfs_log_item_t *
+xfs_ail_next(
+	struct xfs_ail  *ailp,
+	xfs_log_item_t  *lip)
+{
+	if (lip->li_ail.next == &ailp->xa_ail)
+		return NULL;
+
+	return list_first_entry(&lip->li_ail, xfs_log_item_t, li_ail);
+}
+
+/*
+ * This is called by the log manager code to determine the LSN of the tail of
+ * the log.  This is exactly the LSN of the first item in the AIL.  If the AIL
+ * is empty, then this function returns 0.
  *
- * We need the AIL lock in order to get a coherent read of the
- * lsn of the last item in the AIL.
+ * We need the AIL lock in order to get a coherent read of the lsn of the last
+ * item in the AIL.
  */
 xfs_lsn_t
-xfs_trans_ail_tail(
+xfs_ail_min_lsn(
 	struct xfs_ail	*ailp)
 {
-	xfs_lsn_t	lsn;
+	xfs_lsn_t	lsn = 0;
 	xfs_log_item_t	*lip;
 
 	spin_lock(&ailp->xa_lock);
 	lip = xfs_ail_min(ailp);
-	if (lip == NULL) {
-		lsn = (xfs_lsn_t)0;
-	} else {
+	if (lip)
 		lsn = lip->li_lsn;
-	}
 	spin_unlock(&ailp->xa_lock);
 
 	return lsn;
 }
 
 /*
- * xfs_trans_push_ail
- *
- * This routine is called to move the tail of the AIL forward.  It does this by
- * trying to flush items in the AIL whose lsns are below the given
- * threshold_lsn.
- *
- * the push is run asynchronously in a separate thread, so we return the tail
- * of the log right now instead of the tail after the push. This means we will
- * either continue right away, or we will sleep waiting on the async thread to
- * do its work.
- *
- * We do this unlocked - we only need to know whether there is anything in the
- * AIL at the time we are called. We don't need to access the contents of
- * any of the objects, so the lock is not needed.
+ * Return the maximum lsn held in the AIL, or zero if the AIL is empty.
  */
-void
-xfs_trans_ail_push(
-	struct xfs_ail	*ailp,
-	xfs_lsn_t	threshold_lsn)
+static xfs_lsn_t
+xfs_ail_max_lsn(
+	struct xfs_ail  *ailp)
 {
-	xfs_log_item_t	*lip;
+	xfs_lsn_t       lsn = 0;
+	xfs_log_item_t  *lip;
 
-	lip = xfs_ail_min(ailp);
-	if (lip && !XFS_FORCED_SHUTDOWN(ailp->xa_mount)) {
-		if (XFS_LSN_CMP(threshold_lsn, ailp->xa_target) > 0)
-			xfsaild_wakeup(ailp, threshold_lsn);
-	}
+	spin_lock(&ailp->xa_lock);
+	lip = xfs_ail_max(ailp);
+	if (lip)
+		lsn = lip->li_lsn;
+	spin_unlock(&ailp->xa_lock);
+
+	return lsn;
 }
 
 /*
@@ -236,16 +300,57 @@
 }
 
 /*
- * xfsaild_push does the work of pushing on the AIL.  Returning a timeout of
- * zero indicates that the caller should sleep until woken.
+ * splice the log item list into the AIL at the given LSN.
  */
-long
-xfsaild_push(
-	struct xfs_ail	*ailp,
-	xfs_lsn_t	*last_lsn)
+static void
+xfs_ail_splice(
+	struct xfs_ail  *ailp,
+	struct list_head *list,
+	xfs_lsn_t       lsn)
 {
-	long		tout = 0;
-	xfs_lsn_t	last_pushed_lsn = *last_lsn;
+	xfs_log_item_t  *next_lip;
+
+	/* If the list is empty, just insert the item.  */
+	if (list_empty(&ailp->xa_ail)) {
+		list_splice(list, &ailp->xa_ail);
+		return;
+	}
+
+	list_for_each_entry_reverse(next_lip, &ailp->xa_ail, li_ail) {
+		if (XFS_LSN_CMP(next_lip->li_lsn, lsn) <= 0)
+			break;
+	}
+
+	ASSERT(&next_lip->li_ail == &ailp->xa_ail ||
+	       XFS_LSN_CMP(next_lip->li_lsn, lsn) <= 0);
+
+	list_splice_init(list, &next_lip->li_ail);
+}
+
+/*
+ * Delete the given item from the AIL.  Return a pointer to the item.
+ */
+static void
+xfs_ail_delete(
+	struct xfs_ail  *ailp,
+	xfs_log_item_t  *lip)
+{
+	xfs_ail_check(ailp, lip);
+	list_del(&lip->li_ail);
+	xfs_trans_ail_cursor_clear(ailp, lip);
+}
+
+/*
+ * xfs_ail_worker does the work of pushing on the AIL. It will requeue itself
+ * to run at a later time if there is more work to do to complete the push.
+ */
+STATIC void
+xfs_ail_worker(
+	struct work_struct *work)
+{
+	struct xfs_ail	*ailp = container_of(to_delayed_work(work),
+					struct xfs_ail, xa_work);
+	long		tout;
 	xfs_lsn_t	target =  ailp->xa_target;
 	xfs_lsn_t	lsn;
 	xfs_log_item_t	*lip;
@@ -256,15 +361,15 @@
 
 	spin_lock(&ailp->xa_lock);
 	xfs_trans_ail_cursor_init(ailp, cur);
-	lip = xfs_trans_ail_cursor_first(ailp, cur, *last_lsn);
+	lip = xfs_trans_ail_cursor_first(ailp, cur, ailp->xa_last_pushed_lsn);
 	if (!lip || XFS_FORCED_SHUTDOWN(mp)) {
 		/*
 		 * AIL is empty or our push has reached the end.
 		 */
 		xfs_trans_ail_cursor_done(ailp, cur);
 		spin_unlock(&ailp->xa_lock);
-		*last_lsn = 0;
-		return tout;
+		ailp->xa_last_pushed_lsn = 0;
+		return;
 	}
 
 	XFS_STATS_INC(xs_push_ail);
@@ -301,13 +406,13 @@
 		case XFS_ITEM_SUCCESS:
 			XFS_STATS_INC(xs_push_ail_success);
 			IOP_PUSH(lip);
-			last_pushed_lsn = lsn;
+			ailp->xa_last_pushed_lsn = lsn;
 			break;
 
 		case XFS_ITEM_PUSHBUF:
 			XFS_STATS_INC(xs_push_ail_pushbuf);
 			IOP_PUSHBUF(lip);
-			last_pushed_lsn = lsn;
+			ailp->xa_last_pushed_lsn = lsn;
 			push_xfsbufd = 1;
 			break;
 
@@ -319,7 +424,7 @@
 
 		case XFS_ITEM_LOCKED:
 			XFS_STATS_INC(xs_push_ail_locked);
-			last_pushed_lsn = lsn;
+			ailp->xa_last_pushed_lsn = lsn;
 			stuck++;
 			break;
 
@@ -374,9 +479,23 @@
 		wake_up_process(mp->m_ddev_targp->bt_task);
 	}
 
+	/* assume we have more work to do in a short while */
+	tout = 10;
 	if (!count) {
 		/* We're past our target or empty, so idle */
-		last_pushed_lsn = 0;
+		ailp->xa_last_pushed_lsn = 0;
+
+		/*
+		 * Check for an updated push target before clearing the
+		 * XFS_AIL_PUSHING_BIT. If the target changed, we've got more
+		 * work to do. Wait a bit longer before starting that work.
+		 */
+		smp_rmb();
+		if (ailp->xa_target == target) {
+			clear_bit(XFS_AIL_PUSHING_BIT, &ailp->xa_flags);
+			return;
+		}
+		tout = 50;
 	} else if (XFS_LSN_CMP(lsn, target) >= 0) {
 		/*
 		 * We reached the target so wait a bit longer for I/O to
@@ -384,7 +503,7 @@
 		 * start the next scan from the start of the AIL.
 		 */
 		tout = 50;
-		last_pushed_lsn = 0;
+		ailp->xa_last_pushed_lsn = 0;
 	} else if ((stuck * 100) / count > 90) {
 		/*
 		 * Either there is a lot of contention on the AIL or we
@@ -396,14 +515,61 @@
 		 * continuing from where we were.
 		 */
 		tout = 20;
-	} else {
-		/* more to do, but wait a short while before continuing */
-		tout = 10;
 	}
-	*last_lsn = last_pushed_lsn;
-	return tout;
+
+	/* There is more to do, requeue us.  */
+	queue_delayed_work(xfs_syncd_wq, &ailp->xa_work,
+					msecs_to_jiffies(tout));
 }
 
+/*
+ * This routine is called to move the tail of the AIL forward.  It does this by
+ * trying to flush items in the AIL whose lsns are below the given
+ * threshold_lsn.
+ *
+ * The push is run asynchronously in a workqueue, which means the caller needs
+ * to handle waiting on the async flush for space to become available.
+ * We don't want to interrupt any push that is in progress, hence we only queue
+ * work if we set the pushing bit approriately.
+ *
+ * We do this unlocked - we only need to know whether there is anything in the
+ * AIL at the time we are called. We don't need to access the contents of
+ * any of the objects, so the lock is not needed.
+ */
+void
+xfs_ail_push(
+	struct xfs_ail	*ailp,
+	xfs_lsn_t	threshold_lsn)
+{
+	xfs_log_item_t	*lip;
+
+	lip = xfs_ail_min(ailp);
+	if (!lip || XFS_FORCED_SHUTDOWN(ailp->xa_mount) ||
+	    XFS_LSN_CMP(threshold_lsn, ailp->xa_target) <= 0)
+		return;
+
+	/*
+	 * Ensure that the new target is noticed in push code before it clears
+	 * the XFS_AIL_PUSHING_BIT.
+	 */
+	smp_wmb();
+	ailp->xa_target = threshold_lsn;
+	if (!test_and_set_bit(XFS_AIL_PUSHING_BIT, &ailp->xa_flags))
+		queue_delayed_work(xfs_syncd_wq, &ailp->xa_work, 0);
+}
+
+/*
+ * Push out all items in the AIL immediately
+ */
+void
+xfs_ail_push_all(
+	struct xfs_ail  *ailp)
+{
+	xfs_lsn_t       threshold_lsn = xfs_ail_max_lsn(ailp);
+
+	if (threshold_lsn)
+		xfs_ail_push(ailp, threshold_lsn);
+}
 
 /*
  * This is to be called when an item is unlocked that may have
@@ -615,7 +781,6 @@
 	xfs_mount_t	*mp)
 {
 	struct xfs_ail	*ailp;
-	int		error;
 
 	ailp = kmem_zalloc(sizeof(struct xfs_ail), KM_MAYFAIL);
 	if (!ailp)
@@ -624,15 +789,9 @@
 	ailp->xa_mount = mp;
 	INIT_LIST_HEAD(&ailp->xa_ail);
 	spin_lock_init(&ailp->xa_lock);
-	error = xfsaild_start(ailp);
-	if (error)
-		goto out_free_ailp;
+	INIT_DELAYED_WORK(&ailp->xa_work, xfs_ail_worker);
 	mp->m_ail = ailp;
 	return 0;
-
-out_free_ailp:
-	kmem_free(ailp);
-	return error;
 }
 
 void
@@ -641,124 +800,6 @@
 {
 	struct xfs_ail	*ailp = mp->m_ail;
 
-	xfsaild_stop(ailp);
+	cancel_delayed_work_sync(&ailp->xa_work);
 	kmem_free(ailp);
 }
-
-/*
- * splice the log item list into the AIL at the given LSN.
- */
-STATIC void
-xfs_ail_splice(
-	struct xfs_ail	*ailp,
-	struct list_head *list,
-	xfs_lsn_t	lsn)
-{
-	xfs_log_item_t	*next_lip;
-
-	/*
-	 * If the list is empty, just insert the item.
-	 */
-	if (list_empty(&ailp->xa_ail)) {
-		list_splice(list, &ailp->xa_ail);
-		return;
-	}
-
-	list_for_each_entry_reverse(next_lip, &ailp->xa_ail, li_ail) {
-		if (XFS_LSN_CMP(next_lip->li_lsn, lsn) <= 0)
-			break;
-	}
-
-	ASSERT((&next_lip->li_ail == &ailp->xa_ail) ||
-	       (XFS_LSN_CMP(next_lip->li_lsn, lsn) <= 0));
-
-	list_splice_init(list, &next_lip->li_ail);
-	return;
-}
-
-/*
- * Delete the given item from the AIL.  Return a pointer to the item.
- */
-STATIC void
-xfs_ail_delete(
-	struct xfs_ail	*ailp,
-	xfs_log_item_t	*lip)
-{
-	xfs_ail_check(ailp, lip);
-	list_del(&lip->li_ail);
-	xfs_trans_ail_cursor_clear(ailp, lip);
-}
-
-/*
- * Return a pointer to the first item in the AIL.
- * If the AIL is empty, then return NULL.
- */
-STATIC xfs_log_item_t *
-xfs_ail_min(
-	struct xfs_ail	*ailp)
-{
-	if (list_empty(&ailp->xa_ail))
-		return NULL;
-
-	return list_first_entry(&ailp->xa_ail, xfs_log_item_t, li_ail);
-}
-
-/*
- * Return a pointer to the item which follows
- * the given item in the AIL.  If the given item
- * is the last item in the list, then return NULL.
- */
-STATIC xfs_log_item_t *
-xfs_ail_next(
-	struct xfs_ail	*ailp,
-	xfs_log_item_t	*lip)
-{
-	if (lip->li_ail.next == &ailp->xa_ail)
-		return NULL;
-
-	return list_first_entry(&lip->li_ail, xfs_log_item_t, li_ail);
-}
-
-#ifdef DEBUG
-/*
- * Check that the list is sorted as it should be.
- */
-STATIC void
-xfs_ail_check(
-	struct xfs_ail	*ailp,
-	xfs_log_item_t	*lip)
-{
-	xfs_log_item_t	*prev_lip;
-
-	if (list_empty(&ailp->xa_ail))
-		return;
-
-	/*
-	 * Check the next and previous entries are valid.
-	 */
-	ASSERT((lip->li_flags & XFS_LI_IN_AIL) != 0);
-	prev_lip = list_entry(lip->li_ail.prev, xfs_log_item_t, li_ail);
-	if (&prev_lip->li_ail != &ailp->xa_ail)
-		ASSERT(XFS_LSN_CMP(prev_lip->li_lsn, lip->li_lsn) <= 0);
-
-	prev_lip = list_entry(lip->li_ail.next, xfs_log_item_t, li_ail);
-	if (&prev_lip->li_ail != &ailp->xa_ail)
-		ASSERT(XFS_LSN_CMP(prev_lip->li_lsn, lip->li_lsn) >= 0);
-
-
-#ifdef XFS_TRANS_DEBUG
-	/*
-	 * Walk the list checking lsn ordering, and that every entry has the
-	 * XFS_LI_IN_AIL flag set. This is really expensive, so only do it
-	 * when specifically debugging the transaction subsystem.
-	 */
-	prev_lip = list_entry(&ailp->xa_ail, xfs_log_item_t, li_ail);
-	list_for_each_entry(lip, &ailp->xa_ail, li_ail) {
-		if (&prev_lip->li_ail != &ailp->xa_ail)
-			ASSERT(XFS_LSN_CMP(prev_lip->li_lsn, lip->li_lsn) <= 0);
-		ASSERT((lip->li_flags & XFS_LI_IN_AIL) != 0);
-		prev_lip = lip;
-	}
-#endif /* XFS_TRANS_DEBUG */
-}
-#endif /* DEBUG */
diff --git a/fs/xfs/xfs_trans_priv.h b/fs/xfs/xfs_trans_priv.h
index 35162c2..6b164e9e 100644
--- a/fs/xfs/xfs_trans_priv.h
+++ b/fs/xfs/xfs_trans_priv.h
@@ -65,16 +65,22 @@
 struct xfs_ail {
 	struct xfs_mount	*xa_mount;
 	struct list_head	xa_ail;
-	uint			xa_gen;
-	struct task_struct	*xa_task;
 	xfs_lsn_t		xa_target;
 	struct xfs_ail_cursor	xa_cursors;
 	spinlock_t		xa_lock;
+	struct delayed_work	xa_work;
+	xfs_lsn_t		xa_last_pushed_lsn;
+	unsigned long		xa_flags;
 };
 
+#define XFS_AIL_PUSHING_BIT	0
+
 /*
  * From xfs_trans_ail.c
  */
+
+extern struct workqueue_struct	*xfs_ail_wq;	/* AIL workqueue */
+
 void	xfs_trans_ail_update_bulk(struct xfs_ail *ailp,
 				struct xfs_log_item **log_items, int nr_items,
 				xfs_lsn_t lsn) __releases(ailp->xa_lock);
@@ -98,12 +104,13 @@
 	xfs_trans_ail_delete_bulk(ailp, &lip, 1);
 }
 
-void			xfs_trans_ail_push(struct xfs_ail *, xfs_lsn_t);
+void			xfs_ail_push(struct xfs_ail *, xfs_lsn_t);
+void			xfs_ail_push_all(struct xfs_ail *);
+xfs_lsn_t		xfs_ail_min_lsn(struct xfs_ail *ailp);
+
 void			xfs_trans_unlocked_item(struct xfs_ail *,
 					xfs_log_item_t *);
 
-xfs_lsn_t		xfs_trans_ail_tail(struct xfs_ail *ailp);
-
 struct xfs_log_item	*xfs_trans_ail_cursor_first(struct xfs_ail *ailp,
 					struct xfs_ail_cursor *cur,
 					xfs_lsn_t lsn);
@@ -112,11 +119,6 @@
 void			xfs_trans_ail_cursor_done(struct xfs_ail *ailp,
 					struct xfs_ail_cursor *cur);
 
-long	xfsaild_push(struct xfs_ail *, xfs_lsn_t *);
-void	xfsaild_wakeup(struct xfs_ail *, xfs_lsn_t);
-int	xfsaild_start(struct xfs_ail *);
-void	xfsaild_stop(struct xfs_ail *);
-
 #if BITS_PER_LONG != 64
 static inline void
 xfs_trans_ail_copy_lsn(
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 32176cc..cbbfd98 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -697,7 +697,7 @@
 extern void blk_stop_queue(struct request_queue *q);
 extern void blk_sync_queue(struct request_queue *q);
 extern void __blk_stop_queue(struct request_queue *q);
-extern void __blk_run_queue(struct request_queue *q, bool force_kblockd);
+extern void __blk_run_queue(struct request_queue *q);
 extern void blk_run_queue(struct request_queue *);
 extern int blk_rq_map_user(struct request_queue *, struct request *,
 			   struct rq_map_data *, void __user *, unsigned long,
@@ -857,26 +857,39 @@
 struct blk_plug {
 	unsigned long magic;
 	struct list_head list;
+	struct list_head cb_list;
 	unsigned int should_sort;
 };
+struct blk_plug_cb {
+	struct list_head list;
+	void (*callback)(struct blk_plug_cb *);
+};
 
 extern void blk_start_plug(struct blk_plug *);
 extern void blk_finish_plug(struct blk_plug *);
-extern void __blk_flush_plug(struct task_struct *, struct blk_plug *);
+extern void blk_flush_plug_list(struct blk_plug *, bool);
 
 static inline void blk_flush_plug(struct task_struct *tsk)
 {
 	struct blk_plug *plug = tsk->plug;
 
-	if (unlikely(plug))
-		__blk_flush_plug(tsk, plug);
+	if (plug)
+		blk_flush_plug_list(plug, false);
+}
+
+static inline void blk_schedule_flush_plug(struct task_struct *tsk)
+{
+	struct blk_plug *plug = tsk->plug;
+
+	if (plug)
+		blk_flush_plug_list(plug, true);
 }
 
 static inline bool blk_needs_flush_plug(struct task_struct *tsk)
 {
 	struct blk_plug *plug = tsk->plug;
 
-	return plug && !list_empty(&plug->list);
+	return plug && (!list_empty(&plug->list) || !list_empty(&plug->cb_list));
 }
 
 /*
@@ -1314,6 +1327,11 @@
 {
 }
 
+static inline void blk_schedule_flush_plug(struct task_struct *task)
+{
+}
+
+
 static inline bool blk_needs_flush_plug(struct task_struct *tsk)
 {
 	return false;
diff --git a/include/linux/can/platform/mcp251x.h b/include/linux/can/platform/mcp251x.h
index 8e20540..089fe43 100644
--- a/include/linux/can/platform/mcp251x.h
+++ b/include/linux/can/platform/mcp251x.h
@@ -12,6 +12,7 @@
 /**
  * struct mcp251x_platform_data - MCP251X SPI CAN controller platform data
  * @oscillator_frequency:       - oscillator frequency in Hz
+ * @irq_flags:                  - IRQF configuration flags
  * @board_specific_setup:       - called before probing the chip (power,reset)
  * @transceiver_enable:         - called to power on/off the transceiver
  * @power_enable:               - called to power on/off the mcp *and* the
@@ -24,6 +25,7 @@
 
 struct mcp251x_platform_data {
 	unsigned long oscillator_frequency;
+	unsigned long irq_flags;
 	int (*board_specific_setup)(struct spi_device *spi);
 	int (*transceiver_enable)(int enable);
 	int (*power_enable) (int enable);
diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index e276883..32a4423 100644
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -197,7 +197,6 @@
 struct dm_target_callbacks {
 	struct list_head list;
 	int (*congested_fn) (struct dm_target_callbacks *, int);
-	void (*unplug_fn)(struct dm_target_callbacks *);
 };
 
 int dm_register_target(struct target_type *t);
diff --git a/include/linux/input.h b/include/linux/input.h
index f3a7794..771d6d8 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -167,6 +167,7 @@
 #define SYN_REPORT		0
 #define SYN_CONFIG		1
 #define SYN_MT_REPORT		2
+#define SYN_DROPPED		3
 
 /*
  * Keys and buttons
@@ -553,8 +554,8 @@
 #define KEY_DVD			0x185	/* Media Select DVD */
 #define KEY_AUX			0x186
 #define KEY_MP3			0x187
-#define KEY_AUDIO		0x188
-#define KEY_VIDEO		0x189
+#define KEY_AUDIO		0x188	/* AL Audio Browser */
+#define KEY_VIDEO		0x189	/* AL Movie Browser */
 #define KEY_DIRECTORY		0x18a
 #define KEY_LIST		0x18b
 #define KEY_MEMO		0x18c	/* Media Select Messages */
@@ -603,8 +604,9 @@
 #define KEY_FRAMEFORWARD	0x1b5
 #define KEY_CONTEXT_MENU	0x1b6	/* GenDesc - system context menu */
 #define KEY_MEDIA_REPEAT	0x1b7	/* Consumer - transport control */
-#define KEY_10CHANNELSUP        0x1b8   /* 10 channels up (10+) */
-#define KEY_10CHANNELSDOWN      0x1b9   /* 10 channels down (10-) */
+#define KEY_10CHANNELSUP	0x1b8	/* 10 channels up (10+) */
+#define KEY_10CHANNELSDOWN	0x1b9	/* 10 channels down (10-) */
+#define KEY_IMAGES		0x1ba	/* AL Image Browser */
 
 #define KEY_DEL_EOL		0x1c0
 #define KEY_DEL_EOS		0x1c1
diff --git a/include/linux/input/mt.h b/include/linux/input/mt.h
index b3ac06a..318bb82 100644
--- a/include/linux/input/mt.h
+++ b/include/linux/input/mt.h
@@ -48,6 +48,12 @@
 	input_event(dev, EV_ABS, ABS_MT_SLOT, slot);
 }
 
+static inline bool input_is_mt_axis(int axis)
+{
+	return axis == ABS_MT_SLOT ||
+		(axis >= ABS_MT_FIRST && axis <= ABS_MT_LAST);
+}
+
 void input_mt_report_slot_state(struct input_dev *dev,
 				unsigned int tool_type, bool active);
 
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 5a5ce70..5e9840f5 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -216,7 +216,7 @@
 	return ;
 }
 
-static inline inline void mem_cgroup_rotate_reclaimable_page(struct page *page)
+static inline void mem_cgroup_rotate_reclaimable_page(struct page *page)
 {
 	return ;
 }
diff --git a/include/linux/mfd/core.h b/include/linux/mfd/core.h
index ad1b19a..aef23309 100644
--- a/include/linux/mfd/core.h
+++ b/include/linux/mfd/core.h
@@ -86,16 +86,25 @@
  */
 static inline const struct mfd_cell *mfd_get_cell(struct platform_device *pdev)
 {
-	return pdev->dev.platform_data;
+	return pdev->mfd_cell;
 }
 
 /*
  * Given a platform device that's been created by mfd_add_devices(), fetch
  * the .mfd_data entry from the mfd_cell that created it.
+ * Otherwise just return the platform_data pointer.
+ * This maintains compatibility with platform drivers whose devices aren't
+ * created by the mfd layer, and expect platform_data to contain what would've
+ * otherwise been in mfd_data.
  */
 static inline void *mfd_get_data(struct platform_device *pdev)
 {
-	return mfd_get_cell(pdev)->mfd_data;
+	const struct mfd_cell *cell = mfd_get_cell(pdev);
+
+	if (cell)
+		return cell->mfd_data;
+	else
+		return pdev->dev.platform_data;
 }
 
 extern int mfd_add_devices(struct device *parent, int id,
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index eeec00a..7fa95df 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -270,7 +270,8 @@
 					    unsigned int dataoff,
 					    unsigned int len,
 					    u_int8_t protocol);
-	int		(*route)(struct dst_entry **dst, struct flowi *fl);
+	int		(*route)(struct net *net, struct dst_entry **dst,
+				 struct flowi *fl, bool strict);
 	void		(*saveroute)(const struct sk_buff *skb,
 				     struct nf_queue_entry *entry);
 	int		(*reroute)(struct sk_buff *skb,
diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
index ec333d8..5a262e3 100644
--- a/include/linux/netfilter/ipset/ip_set.h
+++ b/include/linux/netfilter/ipset/ip_set.h
@@ -293,7 +293,7 @@
 	/* Lock protecting the set data */
 	rwlock_t lock;
 	/* References to the set */
-	atomic_t ref;
+	u32 ref;
 	/* The core set type */
 	struct ip_set_type *type;
 	/* The type variant doing the real job */
diff --git a/include/linux/netfilter/ipset/ip_set_ahash.h b/include/linux/netfilter/ipset/ip_set_ahash.h
index ec9d9be..a0196ac7 100644
--- a/include/linux/netfilter/ipset/ip_set_ahash.h
+++ b/include/linux/netfilter/ipset/ip_set_ahash.h
@@ -515,8 +515,7 @@
 	if (h->netmask != HOST_MASK)
 		NLA_PUT_U8(skb, IPSET_ATTR_NETMASK, h->netmask);
 #endif
-	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
-		      htonl(atomic_read(&set->ref) - 1));
+	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
 	NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE, htonl(memsize));
 	if (with_timeout(h->timeout))
 		NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(h->timeout));
diff --git a/include/linux/pid.h b/include/linux/pid.h
index 31afb7e..cdced84 100644
--- a/include/linux/pid.h
+++ b/include/linux/pid.h
@@ -117,7 +117,7 @@
  */
 extern struct pid *find_get_pid(int nr);
 extern struct pid *find_ge_pid(int nr, struct pid_namespace *);
-int next_pidmap(struct pid_namespace *pid_ns, int last);
+int next_pidmap(struct pid_namespace *pid_ns, unsigned int last);
 
 extern struct pid *alloc_pid(struct pid_namespace *ns);
 extern void free_pid(struct pid *pid);
diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h
index d96db98..744942c 100644
--- a/include/linux/platform_device.h
+++ b/include/linux/platform_device.h
@@ -14,6 +14,8 @@
 #include <linux/device.h>
 #include <linux/mod_devicetable.h>
 
+struct mfd_cell;
+
 struct platform_device {
 	const char	* name;
 	int		id;
@@ -23,6 +25,9 @@
 
 	const struct platform_device_id	*id_entry;
 
+	/* MFD cell pointer */
+	struct mfd_cell *mfd_cell;
+
 	/* arch specific additions */
 	struct pdev_archdata	archdata;
 };
diff --git a/include/linux/rio.h b/include/linux/rio.h
index 4e37a7cf..4d50611 100644
--- a/include/linux/rio.h
+++ b/include/linux/rio.h
@@ -396,7 +396,7 @@
 };
 
 /* Architecture and hardware-specific functions */
-extern void rio_register_mport(struct rio_mport *);
+extern int rio_register_mport(struct rio_mport *);
 extern int rio_open_inb_mbox(struct rio_mport *, void *, int, int);
 extern void rio_close_inb_mbox(struct rio_mport *, int);
 extern int rio_open_outb_mbox(struct rio_mport *, void *, int, int);
diff --git a/include/linux/rio_ids.h b/include/linux/rio_ids.h
index 7410d33..0cee015 100644
--- a/include/linux/rio_ids.h
+++ b/include/linux/rio_ids.h
@@ -35,6 +35,7 @@
 #define RIO_DID_IDTCPS6Q		0x035f
 #define RIO_DID_IDTCPS10Q		0x035e
 #define RIO_DID_IDTCPS1848		0x0374
+#define RIO_DID_IDTCPS1432		0x0375
 #define RIO_DID_IDTCPS1616		0x0379
 #define RIO_DID_IDTVPS1616		0x0377
 #define RIO_DID_IDTSPS1616		0x0378
diff --git a/include/linux/rtc.h b/include/linux/rtc.h
index 2ca7e8a..877ece4 100644
--- a/include/linux/rtc.h
+++ b/include/linux/rtc.h
@@ -228,6 +228,8 @@
 			struct rtc_wkalrm *alrm);
 extern int rtc_set_alarm(struct rtc_device *rtc,
 				struct rtc_wkalrm *alrm);
+extern int rtc_initialize_alarm(struct rtc_device *rtc,
+				struct rtc_wkalrm *alrm);
 extern void rtc_update_irq(struct rtc_device *rtc,
 			unsigned long num, unsigned long events);
 
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 4ec2c02..18d63ce 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1254,6 +1254,9 @@
 #endif
 
 	struct mm_struct *mm, *active_mm;
+#ifdef CONFIG_COMPAT_BRK
+	unsigned brk_randomized:1;
+#endif
 #if defined(SPLIT_RSS_COUNTING)
 	struct task_rss_stat	rss_stat;
 #endif
diff --git a/include/linux/suspend.h b/include/linux/suspend.h
index 5a89e36..083ffea 100644
--- a/include/linux/suspend.h
+++ b/include/linux/suspend.h
@@ -249,6 +249,8 @@
 extern int hibernate(void);
 extern bool system_entering_hibernation(void);
 #else /* CONFIG_HIBERNATION */
+static inline void register_nosave_region(unsigned long b, unsigned long e) {}
+static inline void register_nosave_region_late(unsigned long b, unsigned long e) {}
 static inline int swsusp_page_is_forbidden(struct page *p) { return 0; }
 static inline void swsusp_set_page_free(struct page *p) {}
 static inline void swsusp_unset_page_free(struct page *p) {}
@@ -297,14 +299,7 @@
 
 extern struct mutex pm_mutex;
 
-#ifndef CONFIG_HIBERNATION
-static inline void register_nosave_region(unsigned long b, unsigned long e)
-{
-}
-static inline void register_nosave_region_late(unsigned long b, unsigned long e)
-{
-}
-
+#ifndef CONFIG_HIBERNATE_CALLBACKS
 static inline void lock_system_sleep(void) {}
 static inline void unlock_system_sleep(void) {}
 
diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
index 461c011..2b3831b 100644
--- a/include/linux/vmstat.h
+++ b/include/linux/vmstat.h
@@ -58,6 +58,13 @@
 		UNEVICTABLE_PGCLEARED,	/* on COW, page truncate */
 		UNEVICTABLE_PGSTRANDED,	/* unable to isolate on unlock */
 		UNEVICTABLE_MLOCKFREED,
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+		THP_FAULT_ALLOC,
+		THP_FAULT_FALLBACK,
+		THP_COLLAPSE_ALLOC,
+		THP_COLLAPSE_ALLOC_FAILED,
+		THP_SPLIT,
+#endif
 		NR_VM_EVENT_ITEMS
 };
 
diff --git a/include/net/9p/9p.h b/include/net/9p/9p.h
index cdf2e8ac..d2df55b 100644
--- a/include/net/9p/9p.h
+++ b/include/net/9p/9p.h
@@ -139,8 +139,6 @@
  */
 
 enum p9_msg_t {
-	P9_TSYNCFS = 0,
-	P9_RSYNCFS,
 	P9_TLERROR = 6,
 	P9_RLERROR,
 	P9_TSTATFS = 8,
diff --git a/include/net/9p/client.h b/include/net/9p/client.h
index 85c1413..051a99f 100644
--- a/include/net/9p/client.h
+++ b/include/net/9p/client.h
@@ -218,8 +218,8 @@
 void p9_client_begin_disconnect(struct p9_client *clnt);
 struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
 					char *uname, u32 n_uname, char *aname);
-struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
-								int clone);
+struct p9_fid *p9_client_walk(struct p9_fid *oldfid, uint16_t nwname,
+		char **wnames, int clone);
 int p9_client_open(struct p9_fid *fid, int mode);
 int p9_client_fcreate(struct p9_fid *fid, char *name, u32 perm, int mode,
 							char *extension);
@@ -230,7 +230,6 @@
 		gid_t gid, struct p9_qid *qid);
 int p9_client_clunk(struct p9_fid *fid);
 int p9_client_fsync(struct p9_fid *fid, int datasync);
-int p9_client_sync_fs(struct p9_fid *fid);
 int p9_client_remove(struct p9_fid *fid);
 int p9_client_read(struct p9_fid *fid, char *data, char __user *udata,
 							u64 offset, u32 count);
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 814b434..d516f00 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -52,7 +52,7 @@
 	 */
 	if (likely(skb->dev && skb->dev->nd_net))
 		return dev_net(skb->dev);
-	if (skb_dst(skb)->dev)
+	if (skb_dst(skb) && skb_dst(skb)->dev)
 		return dev_net(skb_dst(skb)->dev);
 	WARN(skb->sk, "Maybe skb_sknet should be used in %s() at line:%d\n",
 		      __func__, __LINE__);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index cb13239..025d4cc 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1753,8 +1753,19 @@
  * 	that TX/RX_STOP can pass NULL for this parameter.
  *	The @buf_size parameter is only valid when the action is set to
  *	%IEEE80211_AMPDU_TX_OPERATIONAL and indicates the peer's reorder
- *	buffer size (number of subframes) for this session -- aggregates
- *	containing more subframes than this may not be transmitted to the peer.
+ *	buffer size (number of subframes) for this session -- the driver
+ *	may neither send aggregates containing more subframes than this
+ *	nor send aggregates in a way that lost frames would exceed the
+ *	buffer size. If just limiting the aggregate size, this would be
+ *	possible with a buf_size of 8:
+ *	 - TX: 1.....7
+ *	 - RX:  2....7 (lost frame #1)
+ *	 - TX:        8..1...
+ *	which is invalid since #1 was now re-transmitted well past the
+ *	buffer size of 8. Correct ways to retransmit #1 would be:
+ *	 - TX:       1 or 18 or 81
+ *	Even "189" would be wrong since 1 could be lost again.
+ *
  *	Returns a negative error code on failure.
  *	The callback can sleep.
  *
diff --git a/include/net/route.h b/include/net/route.h
index f88429c..8fce062 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -64,6 +64,7 @@
 
 	__be32			rt_dst;	/* Path destination	*/
 	__be32			rt_src;	/* Path source		*/
+	int			rt_route_iif;
 	int			rt_iif;
 	int			rt_oif;
 	__u32			rt_mark;
@@ -80,12 +81,12 @@
 
 static inline bool rt_is_input_route(struct rtable *rt)
 {
-	return rt->rt_iif != 0;
+	return rt->rt_route_iif != 0;
 }
 
 static inline bool rt_is_output_route(struct rtable *rt)
 {
-	return rt->rt_iif == 0;
+	return rt->rt_route_iif == 0;
 }
 
 struct ip_rt_acct {
diff --git a/include/trace/events/block.h b/include/trace/events/block.h
index 78f18ad..bf36654 100644
--- a/include/trace/events/block.h
+++ b/include/trace/events/block.h
@@ -401,9 +401,9 @@
 
 DECLARE_EVENT_CLASS(block_unplug,
 
-	TP_PROTO(struct request_queue *q),
+	TP_PROTO(struct request_queue *q, unsigned int depth, bool explicit),
 
-	TP_ARGS(q),
+	TP_ARGS(q, depth, explicit),
 
 	TP_STRUCT__entry(
 		__field( int,		nr_rq			)
@@ -411,7 +411,7 @@
 	),
 
 	TP_fast_assign(
-		__entry->nr_rq	= q->rq.count[READ] + q->rq.count[WRITE];
+		__entry->nr_rq = depth;
 		memcpy(__entry->comm, current->comm, TASK_COMM_LEN);
 	),
 
@@ -419,31 +419,19 @@
 );
 
 /**
- * block_unplug_timer - timed release of operations requests in queue to device driver
+ * block_unplug - release of operations requests in request queue
  * @q: request queue to unplug
- *
- * Unplug the request queue @q because a timer expired and allow block
- * operation requests to be sent to the device driver.
- */
-DEFINE_EVENT(block_unplug, block_unplug_timer,
-
-	TP_PROTO(struct request_queue *q),
-
-	TP_ARGS(q)
-);
-
-/**
- * block_unplug_io - release of operations requests in request queue
- * @q: request queue to unplug
+ * @depth: number of requests just added to the queue
+ * @explicit: whether this was an explicit unplug, or one from schedule()
  *
  * Unplug request queue @q because device driver is scheduled to work
  * on elements in the request queue.
  */
-DEFINE_EVENT(block_unplug, block_unplug_io,
+DEFINE_EVENT(block_unplug, block_unplug,
 
-	TP_PROTO(struct request_queue *q),
+	TP_PROTO(struct request_queue *q, unsigned int depth, bool explicit),
 
-	TP_ARGS(q)
+	TP_ARGS(q, depth, explicit)
 );
 
 /**
diff --git a/kernel/futex.c b/kernel/futex.c
index dfb924f..fe28dc2 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1886,7 +1886,7 @@
 	restart->futex.val = val;
 	restart->futex.time = abs_time->tv64;
 	restart->futex.bitset = bitset;
-	restart->futex.flags = flags;
+	restart->futex.flags = flags | FLAGS_HAS_TIMEOUT;
 
 	ret = -ERESTART_RESTARTBLOCK;
 
diff --git a/kernel/module.c b/kernel/module.c
index d5938a5..4d5c16a 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2790,7 +2790,7 @@
 	}
 
 	/* This has to be done once we're sure module name is unique. */
-	if (!mod->taints)
+	if (!mod->taints || mod->taints == (1U<<TAINT_CRAP))
 		dynamic_debug_setup(info.debug, info.num_debug);
 
 	/* Find duplicate symbols */
@@ -2827,7 +2827,7 @@
 	module_bug_cleanup(mod);
 
  ddebug:
-	if (!mod->taints)
+	if (!mod->taints || mod->taints == (1U<<TAINT_CRAP))
 		dynamic_debug_remove(info.debug);
  unlock:
 	mutex_unlock(&module_mutex);
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index 27960f1..8e81a98 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -364,6 +364,7 @@
 			}
 
 			if (mode & PERF_CGROUP_SWIN) {
+				WARN_ON_ONCE(cpuctx->cgrp);
 				/* set cgrp before ctxsw in to
 				 * allow event_filter_match() to not
 				 * have to pass task around
@@ -2423,6 +2424,14 @@
 	if (!ctx || !ctx->nr_events)
 		goto out;
 
+	/*
+	 * We must ctxsw out cgroup events to avoid conflict
+	 * when invoking perf_task_event_sched_in() later on
+	 * in this function. Otherwise we end up trying to
+	 * ctxswin cgroup events which are already scheduled
+	 * in.
+	 */
+	perf_cgroup_sched_out(current);
 	task_ctx_sched_out(ctx, EVENT_ALL);
 
 	raw_spin_lock(&ctx->lock);
@@ -2447,6 +2456,9 @@
 
 	raw_spin_unlock(&ctx->lock);
 
+	/*
+	 * Also calls ctxswin for cgroup events, if any:
+	 */
 	perf_event_context_sched_in(ctx, ctx->task);
 out:
 	local_irq_restore(flags);
diff --git a/kernel/pid.c b/kernel/pid.c
index 02f2212..57a8346 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -217,11 +217,14 @@
 	return -1;
 }
 
-int next_pidmap(struct pid_namespace *pid_ns, int last)
+int next_pidmap(struct pid_namespace *pid_ns, unsigned int last)
 {
 	int offset;
 	struct pidmap *map, *end;
 
+	if (last >= PID_MAX_LIMIT)
+		return -1;
+
 	offset = (last + 1) & BITS_PER_PAGE_MASK;
 	map = &pid_ns->pidmap[(last + 1)/BITS_PER_PAGE];
 	end = &pid_ns->pidmap[PIDMAP_ENTRIES];
diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
index 4603f08..6de9a8f 100644
--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
@@ -18,9 +18,13 @@
 
 	  Turning OFF this setting is NOT recommended! If in doubt, say Y.
 
+config HIBERNATE_CALLBACKS
+	bool
+
 config HIBERNATION
 	bool "Hibernation (aka 'suspend to disk')"
 	depends on SWAP && ARCH_HIBERNATION_POSSIBLE
+	select HIBERNATE_CALLBACKS
 	select LZO_COMPRESS
 	select LZO_DECOMPRESS
 	---help---
@@ -85,7 +89,7 @@
 
 config PM_SLEEP
 	def_bool y
-	depends on SUSPEND || HIBERNATION || XEN_SAVE_RESTORE
+	depends on SUSPEND || HIBERNATE_CALLBACKS
 
 config PM_SLEEP_SMP
 	def_bool y
diff --git a/kernel/sched.c b/kernel/sched.c
index 48013633..312f8b9 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -4111,20 +4111,20 @@
 					try_to_wake_up_local(to_wakeup);
 			}
 			deactivate_task(rq, prev, DEQUEUE_SLEEP);
+
+			/*
+			 * If we are going to sleep and we have plugged IO queued, make
+			 * sure to submit it to avoid deadlocks.
+			 */
+			if (blk_needs_flush_plug(prev)) {
+				raw_spin_unlock(&rq->lock);
+				blk_schedule_flush_plug(prev);
+				raw_spin_lock(&rq->lock);
+			}
 		}
 		switch_count = &prev->nvcsw;
 	}
 
-	/*
-	 * If we are going to sleep and we have plugged IO queued, make
-	 * sure to submit it to avoid deadlocks.
-	 */
-	if (prev->state != TASK_RUNNING && blk_needs_flush_plug(prev)) {
-		raw_spin_unlock(&rq->lock);
-		blk_flush_plug(prev);
-		raw_spin_lock(&rq->lock);
-	}
-
 	pre_schedule(rq, prev);
 
 	if (unlikely(!rq->nr_running))
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 7f00772..6fa833a 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -2104,21 +2104,20 @@
 	      enum cpu_idle_type idle, int *all_pinned,
 	      int *this_best_prio, struct cfs_rq *busiest_cfs_rq)
 {
-	int loops = 0, pulled = 0, pinned = 0;
+	int loops = 0, pulled = 0;
 	long rem_load_move = max_load_move;
 	struct task_struct *p, *n;
 
 	if (max_load_move == 0)
 		goto out;
 
-	pinned = 1;
-
 	list_for_each_entry_safe(p, n, &busiest_cfs_rq->tasks, se.group_node) {
 		if (loops++ > sysctl_sched_nr_migrate)
 			break;
 
 		if ((p->se.load.weight >> 1) > rem_load_move ||
-		    !can_migrate_task(p, busiest, this_cpu, sd, idle, &pinned))
+		    !can_migrate_task(p, busiest, this_cpu, sd, idle,
+				      all_pinned))
 			continue;
 
 		pull_task(busiest, p, this_rq, this_cpu);
@@ -2153,9 +2152,6 @@
 	 */
 	schedstat_add(sd, lb_gained[idle], pulled);
 
-	if (all_pinned)
-		*all_pinned = pinned;
-
 	return max_load_move - rem_load_move;
 }
 
@@ -3127,6 +3123,8 @@
 	if (!sds.busiest || sds.busiest_nr_running == 0)
 		goto out_balanced;
 
+	sds.avg_load = (SCHED_LOAD_SCALE * sds.total_load) / sds.total_pwr;
+
 	/*
 	 * If the busiest group is imbalanced the below checks don't
 	 * work because they assumes all things are equal, which typically
@@ -3151,7 +3149,6 @@
 	 * Don't pull any tasks if this group is already above the domain
 	 * average load.
 	 */
-	sds.avg_load = (SCHED_LOAD_SCALE * sds.total_load) / sds.total_pwr;
 	if (sds.this_load >= sds.avg_load)
 		goto out_balanced;
 
@@ -3340,6 +3337,7 @@
 		 * still unbalanced. ld_moved simply stays zero, so it is
 		 * correctly treated as an imbalance.
 		 */
+		all_pinned = 1;
 		local_irq_save(flags);
 		double_rq_lock(this_rq, busiest);
 		ld_moved = move_tasks(this_rq, this_cpu, busiest,
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 7aa40f8..6957aa2 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -850,29 +850,21 @@
 		__blk_add_trace(bt, 0, 0, 0, BLK_TA_PLUG, 0, 0, NULL);
 }
 
-static void blk_add_trace_unplug_io(void *ignore, struct request_queue *q)
+static void blk_add_trace_unplug(void *ignore, struct request_queue *q,
+				    unsigned int depth, bool explicit)
 {
 	struct blk_trace *bt = q->blk_trace;
 
 	if (bt) {
-		unsigned int pdu = q->rq.count[READ] + q->rq.count[WRITE];
-		__be64 rpdu = cpu_to_be64(pdu);
+		__be64 rpdu = cpu_to_be64(depth);
+		u32 what;
 
-		__blk_add_trace(bt, 0, 0, 0, BLK_TA_UNPLUG_IO, 0,
-				sizeof(rpdu), &rpdu);
-	}
-}
+		if (explicit)
+			what = BLK_TA_UNPLUG_IO;
+		else
+			what = BLK_TA_UNPLUG_TIMER;
 
-static void blk_add_trace_unplug_timer(void *ignore, struct request_queue *q)
-{
-	struct blk_trace *bt = q->blk_trace;
-
-	if (bt) {
-		unsigned int pdu = q->rq.count[READ] + q->rq.count[WRITE];
-		__be64 rpdu = cpu_to_be64(pdu);
-
-		__blk_add_trace(bt, 0, 0, 0, BLK_TA_UNPLUG_TIMER, 0,
-				sizeof(rpdu), &rpdu);
+		__blk_add_trace(bt, 0, 0, 0, what, 0, sizeof(rpdu), &rpdu);
 	}
 }
 
@@ -1015,9 +1007,7 @@
 	WARN_ON(ret);
 	ret = register_trace_block_plug(blk_add_trace_plug, NULL);
 	WARN_ON(ret);
-	ret = register_trace_block_unplug_timer(blk_add_trace_unplug_timer, NULL);
-	WARN_ON(ret);
-	ret = register_trace_block_unplug_io(blk_add_trace_unplug_io, NULL);
+	ret = register_trace_block_unplug(blk_add_trace_unplug, NULL);
 	WARN_ON(ret);
 	ret = register_trace_block_split(blk_add_trace_split, NULL);
 	WARN_ON(ret);
@@ -1032,8 +1022,7 @@
 	unregister_trace_block_rq_remap(blk_add_trace_rq_remap, NULL);
 	unregister_trace_block_bio_remap(blk_add_trace_bio_remap, NULL);
 	unregister_trace_block_split(blk_add_trace_split, NULL);
-	unregister_trace_block_unplug_io(blk_add_trace_unplug_io, NULL);
-	unregister_trace_block_unplug_timer(blk_add_trace_unplug_timer, NULL);
+	unregister_trace_block_unplug(blk_add_trace_unplug, NULL);
 	unregister_trace_block_plug(blk_add_trace_plug, NULL);
 	unregister_trace_block_sleeprq(blk_add_trace_sleeprq, NULL);
 	unregister_trace_block_getrq(blk_add_trace_getrq, NULL);
diff --git a/lib/kstrtox.c b/lib/kstrtox.c
index 05672e8..a235f3c 100644
--- a/lib/kstrtox.c
+++ b/lib/kstrtox.c
@@ -49,12 +49,9 @@
 			val = *s - '0';
 		else if ('a' <= _tolower(*s) && _tolower(*s) <= 'f')
 			val = _tolower(*s) - 'a' + 10;
-		else if (*s == '\n') {
-			if (*(s + 1) == '\0')
-				break;
-			else
-				return -EINVAL;
-		} else
+		else if (*s == '\n' && *(s + 1) == '\0')
+			break;
+		else
 			return -EINVAL;
 
 		if (val >= base)
diff --git a/lib/test-kstrtox.c b/lib/test-kstrtox.c
index 325c2f9..d55769d 100644
--- a/lib/test-kstrtox.c
+++ b/lib/test-kstrtox.c
@@ -315,12 +315,12 @@
 		{"65537",	10,	65537},
 		{"2147483646",	10,	2147483646},
 		{"2147483647",	10,	2147483647},
-		{"2147483648",	10,	2147483648},
-		{"2147483649",	10,	2147483649},
-		{"4294967294",	10,	4294967294},
-		{"4294967295",	10,	4294967295},
-		{"4294967296",	10,	4294967296},
-		{"4294967297",	10,	4294967297},
+		{"2147483648",	10,	2147483648ULL},
+		{"2147483649",	10,	2147483649ULL},
+		{"4294967294",	10,	4294967294ULL},
+		{"4294967295",	10,	4294967295ULL},
+		{"4294967296",	10,	4294967296ULL},
+		{"4294967297",	10,	4294967297ULL},
 		{"9223372036854775806",	10,	9223372036854775806ULL},
 		{"9223372036854775807",	10,	9223372036854775807ULL},
 		{"9223372036854775808",	10,	9223372036854775808ULL},
@@ -369,12 +369,12 @@
 		{"65537",	10,	65537},
 		{"2147483646",	10,	2147483646},
 		{"2147483647",	10,	2147483647},
-		{"2147483648",	10,	2147483648},
-		{"2147483649",	10,	2147483649},
-		{"4294967294",	10,	4294967294},
-		{"4294967295",	10,	4294967295},
-		{"4294967296",	10,	4294967296},
-		{"4294967297",	10,	4294967297},
+		{"2147483648",	10,	2147483648LL},
+		{"2147483649",	10,	2147483649LL},
+		{"4294967294",	10,	4294967294LL},
+		{"4294967295",	10,	4294967295LL},
+		{"4294967296",	10,	4294967296LL},
+		{"4294967297",	10,	4294967297LL},
 		{"9223372036854775806",	10,	9223372036854775806LL},
 		{"9223372036854775807",	10,	9223372036854775807LL},
 	};
@@ -418,10 +418,10 @@
 		{"65537",	10,	65537},
 		{"2147483646",	10,	2147483646},
 		{"2147483647",	10,	2147483647},
-		{"2147483648",	10,	2147483648},
-		{"2147483649",	10,	2147483649},
-		{"4294967294",	10,	4294967294},
-		{"4294967295",	10,	4294967295},
+		{"2147483648",	10,	2147483648U},
+		{"2147483649",	10,	2147483649U},
+		{"4294967294",	10,	4294967294U},
+		{"4294967295",	10,	4294967295U},
 	};
 	TEST_OK(kstrtou32, u32, "%u", test_u32_ok);
 }
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 0a619e0..470dcda 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -244,25 +244,29 @@
 				struct kobj_attribute *attr, char *buf,
 				enum transparent_hugepage_flag flag)
 {
-	if (test_bit(flag, &transparent_hugepage_flags))
-		return sprintf(buf, "[yes] no\n");
-	else
-		return sprintf(buf, "yes [no]\n");
+	return sprintf(buf, "%d\n",
+		       !!test_bit(flag, &transparent_hugepage_flags));
 }
+
 static ssize_t single_flag_store(struct kobject *kobj,
 				 struct kobj_attribute *attr,
 				 const char *buf, size_t count,
 				 enum transparent_hugepage_flag flag)
 {
-	if (!memcmp("yes", buf,
-		    min(sizeof("yes")-1, count))) {
-		set_bit(flag, &transparent_hugepage_flags);
-	} else if (!memcmp("no", buf,
-			   min(sizeof("no")-1, count))) {
-		clear_bit(flag, &transparent_hugepage_flags);
-	} else
+	unsigned long value;
+	int ret;
+
+	ret = kstrtoul(buf, 10, &value);
+	if (ret < 0)
+		return ret;
+	if (value > 1)
 		return -EINVAL;
 
+	if (value)
+		set_bit(flag, &transparent_hugepage_flags);
+	else
+		clear_bit(flag, &transparent_hugepage_flags);
+
 	return count;
 }
 
@@ -680,8 +684,11 @@
 			return VM_FAULT_OOM;
 		page = alloc_hugepage_vma(transparent_hugepage_defrag(vma),
 					  vma, haddr, numa_node_id(), 0);
-		if (unlikely(!page))
+		if (unlikely(!page)) {
+			count_vm_event(THP_FAULT_FALLBACK);
 			goto out;
+		}
+		count_vm_event(THP_FAULT_ALLOC);
 		if (unlikely(mem_cgroup_newpage_charge(page, mm, GFP_KERNEL))) {
 			put_page(page);
 			goto out;
@@ -909,11 +916,13 @@
 		new_page = NULL;
 
 	if (unlikely(!new_page)) {
+		count_vm_event(THP_FAULT_FALLBACK);
 		ret = do_huge_pmd_wp_page_fallback(mm, vma, address,
 						   pmd, orig_pmd, page, haddr);
 		put_page(page);
 		goto out;
 	}
+	count_vm_event(THP_FAULT_ALLOC);
 
 	if (unlikely(mem_cgroup_newpage_charge(new_page, mm, GFP_KERNEL))) {
 		put_page(new_page);
@@ -1390,6 +1399,7 @@
 
 	BUG_ON(!PageSwapBacked(page));
 	__split_huge_page(page, anon_vma);
+	count_vm_event(THP_SPLIT);
 
 	BUG_ON(PageCompound(page));
 out_unlock:
@@ -1784,9 +1794,11 @@
 				      node, __GFP_OTHER_NODE);
 	if (unlikely(!new_page)) {
 		up_read(&mm->mmap_sem);
+		count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
 		*hpage = ERR_PTR(-ENOMEM);
 		return;
 	}
+	count_vm_event(THP_COLLAPSE_ALLOC);
 	if (unlikely(mem_cgroup_newpage_charge(new_page, mm, GFP_KERNEL))) {
 		up_read(&mm->mmap_sem);
 		put_page(new_page);
@@ -2151,8 +2163,11 @@
 #ifndef CONFIG_NUMA
 		if (!*hpage) {
 			*hpage = alloc_hugepage(khugepaged_defrag());
-			if (unlikely(!*hpage))
+			if (unlikely(!*hpage)) {
+				count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
 				break;
+			}
+			count_vm_event(THP_COLLAPSE_ALLOC);
 		}
 #else
 		if (IS_ERR(*hpage))
@@ -2192,8 +2207,11 @@
 
 	do {
 		hpage = alloc_hugepage(khugepaged_defrag());
-		if (!hpage)
+		if (!hpage) {
+			count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
 			khugepaged_alloc_sleep();
+		} else
+			count_vm_event(THP_COLLAPSE_ALLOC);
 	} while (unlikely(!hpage) &&
 		 likely(khugepaged_enabled()));
 	return hpage;
@@ -2210,8 +2228,11 @@
 	while (likely(khugepaged_enabled())) {
 #ifndef CONFIG_NUMA
 		hpage = khugepaged_alloc_hugepage();
-		if (unlikely(!hpage))
+		if (unlikely(!hpage)) {
+			count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
 			break;
+		}
+		count_vm_event(THP_COLLAPSE_ALLOC);
 #else
 		if (IS_ERR(hpage)) {
 			khugepaged_alloc_sleep();
diff --git a/mm/memory.c b/mm/memory.c
index 9da8cab..ce22a25 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1410,6 +1410,13 @@
 	return page;
 }
 
+static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
+{
+	return (vma->vm_flags & VM_GROWSDOWN) &&
+		(vma->vm_start == addr) &&
+		!vma_stack_continue(vma->vm_prev, addr);
+}
+
 /**
  * __get_user_pages() - pin user pages in memory
  * @tsk:	task_struct of target task
@@ -1488,7 +1495,6 @@
 		vma = find_extend_vma(mm, start);
 		if (!vma && in_gate_area(mm, start)) {
 			unsigned long pg = start & PAGE_MASK;
-			struct vm_area_struct *gate_vma = get_gate_vma(mm);
 			pgd_t *pgd;
 			pud_t *pud;
 			pmd_t *pmd;
@@ -1513,10 +1519,11 @@
 				pte_unmap(pte);
 				return i ? : -EFAULT;
 			}
+			vma = get_gate_vma(mm);
 			if (pages) {
 				struct page *page;
 
-				page = vm_normal_page(gate_vma, start, *pte);
+				page = vm_normal_page(vma, start, *pte);
 				if (!page) {
 					if (!(gup_flags & FOLL_DUMP) &&
 					     is_zero_pfn(pte_pfn(*pte)))
@@ -1530,12 +1537,7 @@
 				get_page(page);
 			}
 			pte_unmap(pte);
-			if (vmas)
-				vmas[i] = gate_vma;
-			i++;
-			start += PAGE_SIZE;
-			nr_pages--;
-			continue;
+			goto next_page;
 		}
 
 		if (!vma ||
@@ -1549,6 +1551,13 @@
 			continue;
 		}
 
+		/*
+		 * If we don't actually want the page itself,
+		 * and it's the stack guard page, just skip it.
+		 */
+		if (!pages && stack_guard_page(vma, start))
+			goto next_page;
+
 		do {
 			struct page *page;
 			unsigned int foll_flags = gup_flags;
@@ -1631,6 +1640,7 @@
 				flush_anon_page(vma, page, start);
 				flush_dcache_page(page);
 			}
+next_page:
 			if (vmas)
 				vmas[i] = vma;
 			i++;
@@ -3678,7 +3688,7 @@
 			 */
 #ifdef CONFIG_HAVE_IOREMAP_PROT
 			vma = find_vma(mm, addr);
-			if (!vma)
+			if (!vma || vma->vm_start > addr)
 				break;
 			if (vma->vm_ops && vma->vm_ops->access)
 				ret = vma->vm_ops->access(vma, addr, buf,
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index a2acaf8..9ca1d60 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -375,7 +375,7 @@
 #endif
 
 #ifdef CONFIG_FLATMEM
-	max_mapnr = max(page_to_pfn(page), max_mapnr);
+	max_mapnr = max(pfn, max_mapnr);
 #endif
 
 	ClearPageReserved(page);
diff --git a/mm/mlock.c b/mm/mlock.c
index 2689a08c..6b55e3e 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -135,13 +135,6 @@
 	}
 }
 
-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
-{
-	return (vma->vm_flags & VM_GROWSDOWN) &&
-		(vma->vm_start == addr) &&
-		!vma_stack_continue(vma->vm_prev, addr);
-}
-
 /**
  * __mlock_vma_pages_range() -  mlock a range of pages in the vma.
  * @vma:   target vma
@@ -188,12 +181,6 @@
 	if (vma->vm_flags & VM_LOCKED)
 		gup_flags |= FOLL_MLOCK;
 
-	/* We don't try to access the guard page of a stack vma */
-	if (stack_guard_page(vma, start)) {
-		addr += PAGE_SIZE;
-		nr_pages--;
-	}
-
 	return __get_user_pages(current, mm, addr, nr_pages, gup_flags,
 				NULL, NULL, nonblocking);
 }
diff --git a/mm/mmap.c b/mm/mmap.c
index 2ec8eb5..e27e0cf 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -259,7 +259,7 @@
 	 * randomize_va_space to 2, which will still cause mm->start_brk
 	 * to be arbitrarily shifted
 	 */
-	if (mm->start_brk > PAGE_ALIGN(mm->end_data))
+	if (current->brk_randomized)
 		min_brk = mm->start_brk;
 	else
 		min_brk = mm->end_data;
@@ -1814,11 +1814,14 @@
 		size = vma->vm_end - address;
 		grow = (vma->vm_start - address) >> PAGE_SHIFT;
 
-		error = acct_stack_growth(vma, size, grow);
-		if (!error) {
-			vma->vm_start = address;
-			vma->vm_pgoff -= grow;
-			perf_event_mmap(vma);
+		error = -ENOMEM;
+		if (grow <= vma->vm_pgoff) {
+			error = acct_stack_growth(vma, size, grow);
+			if (!error) {
+				vma->vm_start = address;
+				vma->vm_pgoff -= grow;
+				perf_event_mmap(vma);
+			}
 		}
 	}
 	vma_unlock_anon_vma(vma);
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 6a819d1..83fb72c1 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -84,24 +84,6 @@
 #endif /* CONFIG_NUMA */
 
 /*
- * If this is a system OOM (not a memcg OOM) and the task selected to be
- * killed is not already running at high (RT) priorities, speed up the
- * recovery by boosting the dying task to the lowest FIFO priority.
- * That helps with the recovery and avoids interfering with RT tasks.
- */
-static void boost_dying_task_prio(struct task_struct *p,
-				  struct mem_cgroup *mem)
-{
-	struct sched_param param = { .sched_priority = 1 };
-
-	if (mem)
-		return;
-
-	if (!rt_task(p))
-		sched_setscheduler_nocheck(p, SCHED_FIFO, &param);
-}
-
-/*
  * The process p may have detached its own ->mm while exiting or through
  * use_mm(), but one or more of its subthreads may still have a valid
  * pointer.  Return p, or any of its subthreads with a valid ->mm, with
@@ -452,13 +434,6 @@
 	set_tsk_thread_flag(p, TIF_MEMDIE);
 	force_sig(SIGKILL, p);
 
-	/*
-	 * We give our sacrificial lamb high priority and access to
-	 * all the memory it needs. That way it should be able to
-	 * exit() and clear out its resources quickly...
-	 */
-	boost_dying_task_prio(p, mem);
-
 	return 0;
 }
 #undef K
@@ -482,7 +457,6 @@
 	 */
 	if (p->flags & PF_EXITING) {
 		set_tsk_thread_flag(p, TIF_MEMDIE);
-		boost_dying_task_prio(p, mem);
 		return 0;
 	}
 
@@ -556,7 +530,6 @@
 	 */
 	if (fatal_signal_pending(current)) {
 		set_thread_flag(TIF_MEMDIE);
-		boost_dying_task_prio(current, NULL);
 		return;
 	}
 
@@ -712,7 +685,6 @@
 	 */
 	if (fatal_signal_pending(current)) {
 		set_thread_flag(TIF_MEMDIE);
-		boost_dying_task_prio(current, NULL);
 		return;
 	}
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 2747f5e5a..9f8a97b 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -3176,7 +3176,7 @@
  * Called with zonelists_mutex held always
  * unless system_state == SYSTEM_BOOTING.
  */
-void build_all_zonelists(void *data)
+void __ref build_all_zonelists(void *data)
 {
 	set_zonelist_order();
 
diff --git a/mm/shmem.c b/mm/shmem.c
index 58da7c1..8fa27e4 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -421,7 +421,8 @@
 		 * a waste to allocate index if we cannot allocate data.
 		 */
 		if (sbinfo->max_blocks) {
-			if (percpu_counter_compare(&sbinfo->used_blocks, (sbinfo->max_blocks - 1)) > 0)
+			if (percpu_counter_compare(&sbinfo->used_blocks,
+						sbinfo->max_blocks - 1) >= 0)
 				return ERR_PTR(-ENOSPC);
 			percpu_counter_inc(&sbinfo->used_blocks);
 			spin_lock(&inode->i_lock);
@@ -1397,7 +1398,8 @@
 		shmem_swp_unmap(entry);
 		sbinfo = SHMEM_SB(inode->i_sb);
 		if (sbinfo->max_blocks) {
-			if ((percpu_counter_compare(&sbinfo->used_blocks, sbinfo->max_blocks) > 0) ||
+			if (percpu_counter_compare(&sbinfo->used_blocks,
+						sbinfo->max_blocks) >= 0 ||
 			    shmem_acct_block(info->flags)) {
 				spin_unlock(&info->lock);
 				error = -ENOSPC;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index c7f5a6d..f6b435c 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -41,6 +41,7 @@
 #include <linux/memcontrol.h>
 #include <linux/delayacct.h>
 #include <linux/sysctl.h>
+#include <linux/oom.h>
 
 #include <asm/tlbflush.h>
 #include <asm/div64.h>
@@ -1988,17 +1989,12 @@
 	return zone->pages_scanned < zone_reclaimable_pages(zone) * 6;
 }
 
-/*
- * As hibernation is going on, kswapd is freezed so that it can't mark
- * the zone into all_unreclaimable. It can't handle OOM during hibernation.
- * So let's check zone's unreclaimable in direct reclaim as well as kswapd.
- */
+/* All zones in zonelist are unreclaimable? */
 static bool all_unreclaimable(struct zonelist *zonelist,
 		struct scan_control *sc)
 {
 	struct zoneref *z;
 	struct zone *zone;
-	bool all_unreclaimable = true;
 
 	for_each_zone_zonelist_nodemask(zone, z, zonelist,
 			gfp_zone(sc->gfp_mask), sc->nodemask) {
@@ -2006,13 +2002,11 @@
 			continue;
 		if (!cpuset_zone_allowed_hardwall(zone, GFP_KERNEL))
 			continue;
-		if (zone_reclaimable(zone)) {
-			all_unreclaimable = false;
-			break;
-		}
+		if (!zone->all_unreclaimable)
+			return false;
 	}
 
-	return all_unreclaimable;
+	return true;
 }
 
 /*
@@ -2108,6 +2102,14 @@
 	if (sc->nr_reclaimed)
 		return sc->nr_reclaimed;
 
+	/*
+	 * As hibernation is going on, kswapd is freezed so that it can't mark
+	 * the zone into all_unreclaimable. Thus bypassing all_unreclaimable
+	 * check.
+	 */
+	if (oom_killer_disabled)
+		return 0;
+
 	/* top priority shrink_zones still had more to do? don't OOM, then */
 	if (scanning_global_lru(sc) && !all_unreclaimable(zonelist, sc))
 		return 1;
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 772b39b..897ea9e 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -321,9 +321,12 @@
 		/*
 		 * The fetching of the stat_threshold is racy. We may apply
 		 * a counter threshold to the wrong the cpu if we get
-		 * rescheduled while executing here. However, the following
-		 * will apply the threshold again and therefore bring the
-		 * counter under the threshold.
+		 * rescheduled while executing here. However, the next
+		 * counter update will apply the threshold again and
+		 * therefore bring the counter under the threshold again.
+		 *
+		 * Most of the time the thresholds are the same anyways
+		 * for all cpus in a zone.
 		 */
 		t = this_cpu_read(pcp->stat_threshold);
 
@@ -945,7 +948,16 @@
 	"unevictable_pgs_cleared",
 	"unevictable_pgs_stranded",
 	"unevictable_pgs_mlockfreed",
+
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+	"thp_fault_alloc",
+	"thp_fault_fallback",
+	"thp_collapse_alloc",
+	"thp_collapse_alloc_failed",
+	"thp_split",
 #endif
+
+#endif /* CONFIG_VM_EVENTS_COUNTERS */
 };
 
 static void zoneinfo_show_print(struct seq_file *m, pg_data_t *pgdat,
diff --git a/net/9p/client.c b/net/9p/client.c
index 48b8e08..7736774 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -929,15 +929,15 @@
 }
 EXPORT_SYMBOL(p9_client_attach);
 
-struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
-	int clone)
+struct p9_fid *p9_client_walk(struct p9_fid *oldfid, uint16_t nwname,
+		char **wnames, int clone)
 {
 	int err;
 	struct p9_client *clnt;
 	struct p9_fid *fid;
 	struct p9_qid *wqids;
 	struct p9_req_t *req;
-	int16_t nwqids, count;
+	uint16_t nwqids, count;
 
 	err = 0;
 	wqids = NULL;
@@ -955,7 +955,7 @@
 		fid = oldfid;
 
 
-	P9_DPRINTK(P9_DEBUG_9P, ">>> TWALK fids %d,%d nwname %d wname[0] %s\n",
+	P9_DPRINTK(P9_DEBUG_9P, ">>> TWALK fids %d,%d nwname %ud wname[0] %s\n",
 		oldfid->fid, fid->fid, nwname, wnames ? wnames[0] : NULL);
 
 	req = p9_client_rpc(clnt, P9_TWALK, "ddT", oldfid->fid, fid->fid,
@@ -1220,27 +1220,6 @@
 }
 EXPORT_SYMBOL(p9_client_fsync);
 
-int p9_client_sync_fs(struct p9_fid *fid)
-{
-	int err = 0;
-	struct p9_req_t *req;
-	struct p9_client *clnt;
-
-	P9_DPRINTK(P9_DEBUG_9P, ">>> TSYNC_FS fid %d\n", fid->fid);
-
-	clnt = fid->clnt;
-	req = p9_client_rpc(clnt, P9_TSYNCFS, "d", fid->fid);
-	if (IS_ERR(req)) {
-		err = PTR_ERR(req);
-		goto error;
-	}
-	P9_DPRINTK(P9_DEBUG_9P, "<<< RSYNCFS fid %d\n", fid->fid);
-	p9_free_req(clnt, req);
-error:
-	return err;
-}
-EXPORT_SYMBOL(p9_client_sync_fs);
-
 int p9_client_clunk(struct p9_fid *fid)
 {
 	int err;
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 8a4084f..b58a501 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -265,7 +265,7 @@
 			}
 			break;
 		case 'T':{
-				int16_t *nwname = va_arg(ap, int16_t *);
+				uint16_t *nwname = va_arg(ap, uint16_t *);
 				char ***wnames = va_arg(ap, char ***);
 
 				errcode = p9pdu_readf(pdu, proto_version,
@@ -468,7 +468,8 @@
 		case 'E':{
 				 int32_t cnt = va_arg(ap, int32_t);
 				 const char *k = va_arg(ap, const void *);
-				 const char *u = va_arg(ap, const void *);
+				 const char __user *u = va_arg(ap,
+							const void __user *);
 				 errcode = p9pdu_writef(pdu, proto_version, "d",
 						 cnt);
 				 if (!errcode && pdu_write_urw(pdu, k, u, cnt))
@@ -495,7 +496,7 @@
 			}
 			break;
 		case 'T':{
-				int16_t nwname = va_arg(ap, int);
+				uint16_t nwname = va_arg(ap, int);
 				const char **wnames = va_arg(ap, const char **);
 
 				errcode = p9pdu_writef(pdu, proto_version, "w",
diff --git a/net/9p/trans_common.c b/net/9p/trans_common.c
index d47880e..e883172 100644
--- a/net/9p/trans_common.c
+++ b/net/9p/trans_common.c
@@ -66,7 +66,7 @@
 	uint32_t pdata_mapped_pages;
 	struct trans_rpage_info  *rpinfo;
 
-	*pdata_off = (size_t)req->tc->pubuf & (PAGE_SIZE-1);
+	*pdata_off = (__force size_t)req->tc->pubuf & (PAGE_SIZE-1);
 
 	if (*pdata_off)
 		first_page_bytes = min(((size_t)PAGE_SIZE - *pdata_off),
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index e8f046b..244e707 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -326,8 +326,11 @@
 			outp = pack_sg_list_p(chan->sg, out, VIRTQUEUE_NUM,
 					pdata_off, rpinfo->rp_data, pdata_len);
 		} else {
-			char *pbuf = req->tc->pubuf ? req->tc->pubuf :
-								req->tc->pkbuf;
+			char *pbuf;
+			if (req->tc->pubuf)
+				pbuf = (__force char *) req->tc->pubuf;
+			else
+				pbuf = req->tc->pkbuf;
 			outp = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, pbuf,
 					req->tc->pbuf_size);
 		}
@@ -352,8 +355,12 @@
 			in = pack_sg_list_p(chan->sg, out+inp, VIRTQUEUE_NUM,
 					pdata_off, rpinfo->rp_data, pdata_len);
 		} else {
-			char *pbuf = req->tc->pubuf ? req->tc->pubuf :
-								req->tc->pkbuf;
+			char *pbuf;
+			if (req->tc->pubuf)
+				pbuf = (__force char *) req->tc->pubuf;
+			else
+				pbuf = req->tc->pkbuf;
+
 			in = pack_sg_list(chan->sg, out+inp, VIRTQUEUE_NUM,
 					pbuf, req->tc->pbuf_size);
 		}
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 50af027..5a80f41 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -579,9 +579,15 @@
 
 	list_for_each_entry_safe(req, nreq, &osd->o_linger_requests,
 				 r_linger_osd) {
-		__unregister_linger_request(osdc, req);
+		/*
+		 * reregister request prior to unregistering linger so
+		 * that r_osd is preserved.
+		 */
+		BUG_ON(!list_empty(&req->r_req_lru_item));
 		__register_request(osdc, req);
-		list_move(&req->r_req_lru_item, &osdc->req_unsent);
+		list_add(&req->r_req_lru_item, &osdc->req_unsent);
+		list_add(&req->r_osd_item, &req->r_osd->o_requests);
+		__unregister_linger_request(osdc, req);
 		dout("requeued lingering %p tid %llu osd%d\n", req, req->r_tid,
 		     osd->o_osd);
 	}
@@ -798,7 +804,7 @@
 	req->r_request->hdr.tid = cpu_to_le64(req->r_tid);
 	INIT_LIST_HEAD(&req->r_req_lru_item);
 
-	dout("register_request %p tid %lld\n", req, req->r_tid);
+	dout("__register_request %p tid %lld\n", req, req->r_tid);
 	__insert_request(osdc, req);
 	ceph_osdc_get_request(req);
 	osdc->num_requests++;
diff --git a/net/dsa/mv88e6131.c b/net/dsa/mv88e6131.c
index d951f93..3da4188 100644
--- a/net/dsa/mv88e6131.c
+++ b/net/dsa/mv88e6131.c
@@ -14,6 +14,13 @@
 #include "dsa_priv.h"
 #include "mv88e6xxx.h"
 
+/*
+ * Switch product IDs
+ */
+#define ID_6085		0x04a0
+#define ID_6095		0x0950
+#define ID_6131		0x1060
+
 static char *mv88e6131_probe(struct mii_bus *bus, int sw_addr)
 {
 	int ret;
@@ -21,9 +28,11 @@
 	ret = __mv88e6xxx_reg_read(bus, sw_addr, REG_PORT(0), 0x03);
 	if (ret >= 0) {
 		ret &= 0xfff0;
-		if (ret == 0x0950)
+		if (ret == ID_6085)
+			return "Marvell 88E6085";
+		if (ret == ID_6095)
 			return "Marvell 88E6095/88E6095F";
-		if (ret == 0x1060)
+		if (ret == ID_6131)
 			return "Marvell 88E6131";
 	}
 
@@ -164,6 +173,7 @@
 
 static int mv88e6131_setup_port(struct dsa_switch *ds, int p)
 {
+	struct mv88e6xxx_priv_state *ps = (void *)(ds + 1);
 	int addr = REG_PORT(p);
 	u16 val;
 
@@ -171,10 +181,13 @@
 	 * MAC Forcing register: don't force link, speed, duplex
 	 * or flow control state to any particular values on physical
 	 * ports, but force the CPU port and all DSA ports to 1000 Mb/s
-	 * full duplex.
+	 * (100 Mb/s on 6085) full duplex.
 	 */
 	if (dsa_is_cpu_port(ds, p) || ds->dsa_port_mask & (1 << p))
-		REG_WRITE(addr, 0x01, 0x003e);
+		if (ps->id == ID_6085)
+			REG_WRITE(addr, 0x01, 0x003d); /* 100 Mb/s */
+		else
+			REG_WRITE(addr, 0x01, 0x003e); /* 1000 Mb/s */
 	else
 		REG_WRITE(addr, 0x01, 0x0003);
 
@@ -286,6 +299,8 @@
 	mv88e6xxx_ppu_state_init(ds);
 	mutex_init(&ps->stats_mutex);
 
+	ps->id = REG_READ(REG_PORT(0), 0x03) & 0xfff0;
+
 	ret = mv88e6131_switch_reset(ds);
 	if (ret < 0)
 		return ret;
diff --git a/net/dsa/mv88e6xxx.h b/net/dsa/mv88e6xxx.h
index eb0e0aa..61156ca2 100644
--- a/net/dsa/mv88e6xxx.h
+++ b/net/dsa/mv88e6xxx.h
@@ -39,6 +39,8 @@
 	 * Hold this mutex over snapshot + dump sequences.
 	 */
 	struct mutex	stats_mutex;
+
+	int		id; /* switch product id */
 };
 
 struct mv88e6xxx_hw_stat {
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index f3c0b54..4614bab 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -221,9 +221,10 @@
 	return csum;
 }
 
-static int nf_ip_route(struct dst_entry **dst, struct flowi *fl)
+static int nf_ip_route(struct net *net, struct dst_entry **dst,
+		       struct flowi *fl, bool strict __always_unused)
 {
-	struct rtable *rt = ip_route_output_key(&init_net, &fl->u.ip4);
+	struct rtable *rt = ip_route_output_key(net, &fl->u.ip4);
 	if (IS_ERR(rt))
 		return PTR_ERR(rt);
 	*dst = &rt->dst;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index ea10751..c1acf69 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1891,6 +1891,7 @@
 #ifdef CONFIG_IP_ROUTE_CLASSID
 	rth->dst.tclassid = itag;
 #endif
+	rth->rt_route_iif = dev->ifindex;
 	rth->rt_iif	= dev->ifindex;
 	rth->dst.dev	= init_net.loopback_dev;
 	dev_hold(rth->dst.dev);
@@ -2026,6 +2027,7 @@
 	rth->rt_key_src	= saddr;
 	rth->rt_src	= saddr;
 	rth->rt_gateway	= daddr;
+	rth->rt_route_iif = in_dev->dev->ifindex;
 	rth->rt_iif 	= in_dev->dev->ifindex;
 	rth->dst.dev	= (out_dev)->dev;
 	dev_hold(rth->dst.dev);
@@ -2202,6 +2204,7 @@
 #ifdef CONFIG_IP_ROUTE_CLASSID
 	rth->dst.tclassid = itag;
 #endif
+	rth->rt_route_iif = dev->ifindex;
 	rth->rt_iif	= dev->ifindex;
 	rth->dst.dev	= net->loopback_dev;
 	dev_hold(rth->dst.dev);
@@ -2401,7 +2404,8 @@
 	rth->rt_mark    = oldflp4->flowi4_mark;
 	rth->rt_dst	= fl4->daddr;
 	rth->rt_src	= fl4->saddr;
-	rth->rt_iif	= 0;
+	rth->rt_route_iif = 0;
+	rth->rt_iif	= oldflp4->flowi4_oif ? : dev_out->ifindex;
 	/* get references to the devices that are to be hold by the routing
 	   cache entry */
 	rth->dst.dev	= dev_out;
@@ -2716,6 +2720,7 @@
 		rt->rt_key_dst = ort->rt_key_dst;
 		rt->rt_key_src = ort->rt_key_src;
 		rt->rt_tos = ort->rt_tos;
+		rt->rt_route_iif = ort->rt_route_iif;
 		rt->rt_iif = ort->rt_iif;
 		rt->rt_oif = ort->rt_oif;
 		rt->rt_mark = ort->rt_mark;
@@ -2725,7 +2730,6 @@
 		rt->rt_type = ort->rt_type;
 		rt->rt_dst = ort->rt_dst;
 		rt->rt_src = ort->rt_src;
-		rt->rt_iif = ort->rt_iif;
 		rt->rt_gateway = ort->rt_gateway;
 		rt->rt_spec_dst = ort->rt_spec_dst;
 		rt->peer = ort->peer;
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 13e0e7f..d20a05e 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -74,6 +74,7 @@
 	rt->rt_key_dst = fl4->daddr;
 	rt->rt_key_src = fl4->saddr;
 	rt->rt_tos = fl4->flowi4_tos;
+	rt->rt_route_iif = fl4->flowi4_iif;
 	rt->rt_iif = fl4->flowi4_iif;
 	rt->rt_oif = fl4->flowi4_oif;
 	rt->rt_mark = fl4->flowi4_mark;
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 39aaca2..28bc1f6 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -90,9 +90,18 @@
 	return 0;
 }
 
-static int nf_ip6_route(struct dst_entry **dst, struct flowi *fl)
+static int nf_ip6_route(struct net *net, struct dst_entry **dst,
+			struct flowi *fl, bool strict)
 {
-	*dst = ip6_route_output(&init_net, NULL, &fl->u.ip6);
+	static const struct ipv6_pinfo fake_pinfo;
+	static const struct inet_sock fake_sk = {
+		/* makes ip6_route_output set RT6_LOOKUP_F_IFACE: */
+		.sk.sk_bound_dev_if = 1,
+		.pinet6 = (struct ipv6_pinfo *) &fake_pinfo,
+	};
+	const void *sk = strict ? &fake_sk : NULL;
+
+	*dst = ip6_route_output(net, sk, &fl->u.ip6);
 	return (*dst)->error;
 }
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 56fa125..4f49e5d 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1622,6 +1622,7 @@
 		opt_skb = skb_clone(skb, GFP_ATOMIC);
 
 	if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
+		sock_rps_save_rxhash(sk, skb->rxhash);
 		if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
 			goto reset;
 		if (opt_skb)
@@ -1649,7 +1650,8 @@
 				__kfree_skb(opt_skb);
 			return 0;
 		}
-	}
+	} else
+		sock_rps_save_rxhash(sk, skb->rxhash);
 
 	if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
 		goto reset;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index d7037c0..15c3774 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -505,6 +505,9 @@
 	int rc;
 	int is_udplite = IS_UDPLITE(sk);
 
+	if (!ipv6_addr_any(&inet6_sk(sk)->daddr))
+		sock_rps_save_rxhash(sk, skb->rxhash);
+
 	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
 		goto drop;
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 9d192d6..c5d4530 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2541,7 +2541,6 @@
 		 * same TID from the same station
 		 */
 		rx->skb = skb;
-		rx->flags = 0;
 
 		CALL_RXH(ieee80211_rx_h_decrypt)
 		CALL_RXH(ieee80211_rx_h_check_more_data)
@@ -2612,6 +2611,7 @@
 		.sdata = sta->sdata,
 		.local = sta->local,
 		.queue = tid,
+		.flags = 0,
 	};
 	struct tid_ampdu_rx *tid_agg_rx;
 
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index c3f988a..32bff6d 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -652,7 +652,6 @@
 config NETFILTER_XT_MATCH_ADDRTYPE
 	tristate '"addrtype" address type match support'
 	depends on NETFILTER_ADVANCED
-	depends on (IPV6 || IPV6=n)
 	---help---
 	  This option allows you to match what routing thinks of an address,
 	  eg. UNICAST, LOCAL, BROADCAST, ...
diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c
index bca9699..a113ff0 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
@@ -338,8 +338,7 @@
 	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip));
 	if (map->netmask != 32)
 		NLA_PUT_U8(skb, IPSET_ATTR_NETMASK, map->netmask);
-	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
-		      htonl(atomic_read(&set->ref) - 1));
+	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
 	NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
 		      htonl(sizeof(*map) + map->memsize));
 	if (with_timeout(map->timeout))
diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
index 5e79017..00a3324 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
@@ -434,8 +434,7 @@
 		goto nla_put_failure;
 	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, htonl(map->first_ip));
 	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip));
-	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
-		      htonl(atomic_read(&set->ref) - 1));
+	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
 	NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
 		      htonl(sizeof(*map)
 			    + (map->last_ip - map->first_ip + 1) * map->dsize));
diff --git a/net/netfilter/ipset/ip_set_bitmap_port.c b/net/netfilter/ipset/ip_set_bitmap_port.c
index 165f09b..6b38eb8 100644
--- a/net/netfilter/ipset/ip_set_bitmap_port.c
+++ b/net/netfilter/ipset/ip_set_bitmap_port.c
@@ -320,8 +320,7 @@
 		goto nla_put_failure;
 	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, htons(map->first_port));
 	NLA_PUT_NET16(skb, IPSET_ATTR_PORT_TO, htons(map->last_port));
-	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
-		      htonl(atomic_read(&set->ref) - 1));
+	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
 	NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
 		      htonl(sizeof(*map) + map->memsize));
 	if (with_timeout(map->timeout))
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 253326e..9152e69 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -26,6 +26,7 @@
 
 static LIST_HEAD(ip_set_type_list);		/* all registered set types */
 static DEFINE_MUTEX(ip_set_type_mutex);		/* protects ip_set_type_list */
+static DEFINE_RWLOCK(ip_set_ref_lock);		/* protects the set refs */
 
 static struct ip_set **ip_set_list;		/* all individual sets */
 static ip_set_id_t ip_set_max = CONFIG_IP_SET_MAX; /* max number of sets */
@@ -301,13 +302,18 @@
 static inline void
 __ip_set_get(ip_set_id_t index)
 {
-	atomic_inc(&ip_set_list[index]->ref);
+	write_lock_bh(&ip_set_ref_lock);
+	ip_set_list[index]->ref++;
+	write_unlock_bh(&ip_set_ref_lock);
 }
 
 static inline void
 __ip_set_put(ip_set_id_t index)
 {
-	atomic_dec(&ip_set_list[index]->ref);
+	write_lock_bh(&ip_set_ref_lock);
+	BUG_ON(ip_set_list[index]->ref == 0);
+	ip_set_list[index]->ref--;
+	write_unlock_bh(&ip_set_ref_lock);
 }
 
 /*
@@ -324,7 +330,7 @@
 	struct ip_set *set = ip_set_list[index];
 	int ret = 0;
 
-	BUG_ON(set == NULL || atomic_read(&set->ref) == 0);
+	BUG_ON(set == NULL);
 	pr_debug("set %s, index %u\n", set->name, index);
 
 	if (dim < set->type->dimension ||
@@ -356,7 +362,7 @@
 	struct ip_set *set = ip_set_list[index];
 	int ret;
 
-	BUG_ON(set == NULL || atomic_read(&set->ref) == 0);
+	BUG_ON(set == NULL);
 	pr_debug("set %s, index %u\n", set->name, index);
 
 	if (dim < set->type->dimension ||
@@ -378,7 +384,7 @@
 	struct ip_set *set = ip_set_list[index];
 	int ret = 0;
 
-	BUG_ON(set == NULL || atomic_read(&set->ref) == 0);
+	BUG_ON(set == NULL);
 	pr_debug("set %s, index %u\n", set->name, index);
 
 	if (dim < set->type->dimension ||
@@ -397,7 +403,6 @@
  * Find set by name, reference it once. The reference makes sure the
  * thing pointed to, does not go away under our feet.
  *
- * The nfnl mutex must already be activated.
  */
 ip_set_id_t
 ip_set_get_byname(const char *name, struct ip_set **set)
@@ -423,15 +428,12 @@
  * reference count by 1. The caller shall not assume the index
  * to be valid, after calling this function.
  *
- * The nfnl mutex must already be activated.
  */
 void
 ip_set_put_byindex(ip_set_id_t index)
 {
-	if (ip_set_list[index] != NULL) {
-		BUG_ON(atomic_read(&ip_set_list[index]->ref) == 0);
+	if (ip_set_list[index] != NULL)
 		__ip_set_put(index);
-	}
 }
 EXPORT_SYMBOL_GPL(ip_set_put_byindex);
 
@@ -441,7 +443,6 @@
  * can't be destroyed. The set cannot be renamed due to
  * the referencing either.
  *
- * The nfnl mutex must already be activated.
  */
 const char *
 ip_set_name_byindex(ip_set_id_t index)
@@ -449,7 +450,7 @@
 	const struct ip_set *set = ip_set_list[index];
 
 	BUG_ON(set == NULL);
-	BUG_ON(atomic_read(&set->ref) == 0);
+	BUG_ON(set->ref == 0);
 
 	/* Referenced, so it's safe */
 	return set->name;
@@ -515,10 +516,7 @@
 ip_set_nfnl_put(ip_set_id_t index)
 {
 	nfnl_lock();
-	if (ip_set_list[index] != NULL) {
-		BUG_ON(atomic_read(&ip_set_list[index]->ref) == 0);
-		__ip_set_put(index);
-	}
+	ip_set_put_byindex(index);
 	nfnl_unlock();
 }
 EXPORT_SYMBOL_GPL(ip_set_nfnl_put);
@@ -526,7 +524,7 @@
 /*
  * Communication protocol with userspace over netlink.
  *
- * We already locked by nfnl_lock.
+ * The commands are serialized by the nfnl mutex.
  */
 
 static inline bool
@@ -657,7 +655,6 @@
 		return -ENOMEM;
 	rwlock_init(&set->lock);
 	strlcpy(set->name, name, IPSET_MAXNAMELEN);
-	atomic_set(&set->ref, 0);
 	set->family = family;
 
 	/*
@@ -690,8 +687,8 @@
 
 	/*
 	 * Here, we have a valid, constructed set and we are protected
-	 * by nfnl_lock. Find the first free index in ip_set_list and
-	 * check clashing.
+	 * by the nfnl mutex. Find the first free index in ip_set_list
+	 * and check clashing.
 	 */
 	if ((ret = find_free_id(set->name, &index, &clash)) != 0) {
 		/* If this is the same set and requested, ignore error */
@@ -751,31 +748,51 @@
 	       const struct nlattr * const attr[])
 {
 	ip_set_id_t i;
+	int ret = 0;
 
 	if (unlikely(protocol_failed(attr)))
 		return -IPSET_ERR_PROTOCOL;
 
-	/* References are protected by the nfnl mutex */
+	/* Commands are serialized and references are
+	 * protected by the ip_set_ref_lock.
+	 * External systems (i.e. xt_set) must call
+	 * ip_set_put|get_nfnl_* functions, that way we
+	 * can safely check references here.
+	 *
+	 * list:set timer can only decrement the reference
+	 * counter, so if it's already zero, we can proceed
+	 * without holding the lock.
+	 */
+	read_lock_bh(&ip_set_ref_lock);
 	if (!attr[IPSET_ATTR_SETNAME]) {
 		for (i = 0; i < ip_set_max; i++) {
-			if (ip_set_list[i] != NULL &&
-			    (atomic_read(&ip_set_list[i]->ref)))
-				return -IPSET_ERR_BUSY;
+			if (ip_set_list[i] != NULL && ip_set_list[i]->ref) {
+				ret = IPSET_ERR_BUSY;
+				goto out;
+			}
 		}
+		read_unlock_bh(&ip_set_ref_lock);
 		for (i = 0; i < ip_set_max; i++) {
 			if (ip_set_list[i] != NULL)
 				ip_set_destroy_set(i);
 		}
 	} else {
 		i = find_set_id(nla_data(attr[IPSET_ATTR_SETNAME]));
-		if (i == IPSET_INVALID_ID)
-			return -ENOENT;
-		else if (atomic_read(&ip_set_list[i]->ref))
-			return -IPSET_ERR_BUSY;
+		if (i == IPSET_INVALID_ID) {
+			ret = -ENOENT;
+			goto out;
+		} else if (ip_set_list[i]->ref) {
+			ret = -IPSET_ERR_BUSY;
+			goto out;
+		}
+		read_unlock_bh(&ip_set_ref_lock);
 
 		ip_set_destroy_set(i);
 	}
 	return 0;
+out:
+	read_unlock_bh(&ip_set_ref_lock);
+	return ret;
 }
 
 /* Flush sets */
@@ -834,6 +851,7 @@
 	struct ip_set *set;
 	const char *name2;
 	ip_set_id_t i;
+	int ret = 0;
 
 	if (unlikely(protocol_failed(attr) ||
 		     attr[IPSET_ATTR_SETNAME] == NULL ||
@@ -843,25 +861,33 @@
 	set = find_set(nla_data(attr[IPSET_ATTR_SETNAME]));
 	if (set == NULL)
 		return -ENOENT;
-	if (atomic_read(&set->ref) != 0)
-		return -IPSET_ERR_REFERENCED;
+
+	read_lock_bh(&ip_set_ref_lock);
+	if (set->ref != 0) {
+		ret = -IPSET_ERR_REFERENCED;
+		goto out;
+	}
 
 	name2 = nla_data(attr[IPSET_ATTR_SETNAME2]);
 	for (i = 0; i < ip_set_max; i++) {
 		if (ip_set_list[i] != NULL &&
-		    STREQ(ip_set_list[i]->name, name2))
-			return -IPSET_ERR_EXIST_SETNAME2;
+		    STREQ(ip_set_list[i]->name, name2)) {
+			ret = -IPSET_ERR_EXIST_SETNAME2;
+			goto out;
+		}
 	}
 	strncpy(set->name, name2, IPSET_MAXNAMELEN);
 
-	return 0;
+out:
+	read_unlock_bh(&ip_set_ref_lock);
+	return ret;
 }
 
 /* Swap two sets so that name/index points to the other.
  * References and set names are also swapped.
  *
- * We are protected by the nfnl mutex and references are
- * manipulated only by holding the mutex. The kernel interfaces
+ * The commands are serialized by the nfnl mutex and references are
+ * protected by the ip_set_ref_lock. The kernel interfaces
  * do not hold the mutex but the pointer settings are atomic
  * so the ip_set_list always contains valid pointers to the sets.
  */
@@ -874,7 +900,6 @@
 	struct ip_set *from, *to;
 	ip_set_id_t from_id, to_id;
 	char from_name[IPSET_MAXNAMELEN];
-	u32 from_ref;
 
 	if (unlikely(protocol_failed(attr) ||
 		     attr[IPSET_ATTR_SETNAME] == NULL ||
@@ -899,17 +924,15 @@
 	      from->type->family == to->type->family))
 		return -IPSET_ERR_TYPE_MISMATCH;
 
-	/* No magic here: ref munging protected by the nfnl_lock */
 	strncpy(from_name, from->name, IPSET_MAXNAMELEN);
-	from_ref = atomic_read(&from->ref);
-
 	strncpy(from->name, to->name, IPSET_MAXNAMELEN);
-	atomic_set(&from->ref, atomic_read(&to->ref));
 	strncpy(to->name, from_name, IPSET_MAXNAMELEN);
-	atomic_set(&to->ref, from_ref);
 
+	write_lock_bh(&ip_set_ref_lock);
+	swap(from->ref, to->ref);
 	ip_set_list[from_id] = to;
 	ip_set_list[to_id] = from;
+	write_unlock_bh(&ip_set_ref_lock);
 
 	return 0;
 }
@@ -926,7 +949,7 @@
 {
 	if (cb->args[2]) {
 		pr_debug("release set %s\n", ip_set_list[cb->args[1]]->name);
-		__ip_set_put((ip_set_id_t) cb->args[1]);
+		ip_set_put_byindex((ip_set_id_t) cb->args[1]);
 	}
 	return 0;
 }
@@ -1068,7 +1091,7 @@
 	/* If there was an error or set is done, release set */
 	if (ret || !cb->args[2]) {
 		pr_debug("release set %s\n", ip_set_list[index]->name);
-		__ip_set_put(index);
+		ip_set_put_byindex(index);
 	}
 
 	/* If we dump all sets, continue with dumping last ones */
diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index a47c329..e9159e9 100644
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -43,14 +43,19 @@
 static inline struct set_elem *
 list_set_elem(const struct list_set *map, u32 id)
 {
-	return (struct set_elem *)((char *)map->members + id * map->dsize);
+	return (struct set_elem *)((void *)map->members + id * map->dsize);
+}
+
+static inline struct set_telem *
+list_set_telem(const struct list_set *map, u32 id)
+{
+	return (struct set_telem *)((void *)map->members + id * map->dsize);
 }
 
 static inline bool
 list_set_timeout(const struct list_set *map, u32 id)
 {
-	const struct set_telem *elem =
-		(const struct set_telem *) list_set_elem(map, id);
+	const struct set_telem *elem = list_set_telem(map, id);
 
 	return ip_set_timeout_test(elem->timeout);
 }
@@ -58,19 +63,11 @@
 static inline bool
 list_set_expired(const struct list_set *map, u32 id)
 {
-	const struct set_telem *elem =
-		(const struct set_telem *) list_set_elem(map, id);
+	const struct set_telem *elem = list_set_telem(map, id);
 
 	return ip_set_timeout_expired(elem->timeout);
 }
 
-static inline int
-list_set_exist(const struct set_telem *elem)
-{
-	return elem->id != IPSET_INVALID_ID &&
-	       !ip_set_timeout_expired(elem->timeout);
-}
-
 /* Set list without and with timeout */
 
 static int
@@ -146,11 +143,11 @@
 	struct set_telem *e;
 
 	for (; i < map->size; i++) {
-		e = (struct set_telem *)list_set_elem(map, i);
+		e = list_set_telem(map, i);
 		swap(e->id, id);
+		swap(e->timeout, timeout);
 		if (e->id == IPSET_INVALID_ID)
 			break;
-		swap(e->timeout, timeout);
 	}
 }
 
@@ -164,7 +161,7 @@
 		/* Last element replaced: e.g. add new,before,last */
 		ip_set_put_byindex(e->id);
 	if (with_timeout(map->timeout))
-		list_elem_tadd(map, i, id, timeout);
+		list_elem_tadd(map, i, id, ip_set_timeout_set(timeout));
 	else
 		list_elem_add(map, i, id);
 
@@ -172,11 +169,11 @@
 }
 
 static int
-list_set_del(struct list_set *map, ip_set_id_t id, u32 i)
+list_set_del(struct list_set *map, u32 i)
 {
 	struct set_elem *a = list_set_elem(map, i), *b;
 
-	ip_set_put_byindex(id);
+	ip_set_put_byindex(a->id);
 
 	for (; i < map->size - 1; i++) {
 		b = list_set_elem(map, i + 1);
@@ -308,11 +305,11 @@
 				 (before == 0 ||
 				  (before > 0 &&
 				   next_id_eq(map, i, refid))))
-				ret = list_set_del(map, id, i);
+				ret = list_set_del(map, i);
 			else if (before < 0 &&
 				 elem->id == refid &&
 				 next_id_eq(map, i, id))
-				ret = list_set_del(map, id, i + 1);
+				ret = list_set_del(map, i + 1);
 		}
 		break;
 	default:
@@ -369,8 +366,7 @@
 	NLA_PUT_NET32(skb, IPSET_ATTR_SIZE, htonl(map->size));
 	if (with_timeout(map->timeout))
 		NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(map->timeout));
-	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
-		      htonl(atomic_read(&set->ref) - 1));
+	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
 	NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
 		      htonl(sizeof(*map) + map->size * map->dsize));
 	ipset_nest_end(skb, nested);
@@ -461,16 +457,13 @@
 	struct set_telem *e;
 	u32 i;
 
-	/* We run parallel with other readers (test element)
-	 * but adding/deleting new entries is locked out */
-	read_lock_bh(&set->lock);
-	for (i = map->size - 1; i >= 0; i--) {
-		e = (struct set_telem *) list_set_elem(map, i);
-		if (e->id != IPSET_INVALID_ID &&
-		    list_set_expired(map, i))
-			list_set_del(map, e->id, i);
+	write_lock_bh(&set->lock);
+	for (i = 0; i < map->size; i++) {
+		e = list_set_telem(map, i);
+		if (e->id != IPSET_INVALID_ID && list_set_expired(map, i))
+			list_set_del(map, i);
 	}
-	read_unlock_bh(&set->lock);
+	write_unlock_bh(&set->lock);
 
 	map->gc.expires = jiffies + IPSET_GC_PERIOD(map->timeout) * HZ;
 	add_timer(&map->gc);
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 33733c8..ae47090 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3120,7 +3120,7 @@
 static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
 				   struct netlink_callback *cb)
 {
-	struct net *net = skb_net(skb);
+	struct net *net = skb_sknet(skb);
 	struct netns_ipvs *ipvs = net_ipvs(net);
 
 	mutex_lock(&__ip_vs_mutex);
diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
index 8678823..bcd5ed6 100644
--- a/net/netfilter/nf_conntrack_h323_asn1.c
+++ b/net/netfilter/nf_conntrack_h323_asn1.c
@@ -631,7 +631,7 @@
 		CHECK_BOUND(bs, 2);
 		count = *bs->cur++;
 		count <<= 8;
-		count = *bs->cur++;
+		count += *bs->cur++;
 		break;
 	case SEMI:
 		BYTE_ALIGN(bs);
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 533a183..18b2ce5 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -731,10 +731,10 @@
 
 		memset(&fl2, 0, sizeof(fl2));
 		fl2.daddr = dst->ip;
-		if (!afinfo->route((struct dst_entry **)&rt1,
-				   flowi4_to_flowi(&fl1))) {
-			if (!afinfo->route((struct dst_entry **)&rt2,
-					   flowi4_to_flowi(&fl2))) {
+		if (!afinfo->route(&init_net, (struct dst_entry **)&rt1,
+				   flowi4_to_flowi(&fl1), false)) {
+			if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
+					   flowi4_to_flowi(&fl2), false)) {
 				if (rt1->rt_gateway == rt2->rt_gateway &&
 				    rt1->dst.dev  == rt2->dst.dev)
 					ret = 1;
@@ -755,10 +755,10 @@
 
 		memset(&fl2, 0, sizeof(fl2));
 		ipv6_addr_copy(&fl2.daddr, &dst->in6);
-		if (!afinfo->route((struct dst_entry **)&rt1,
-				   flowi6_to_flowi(&fl1))) {
-			if (!afinfo->route((struct dst_entry **)&rt2,
-					   flowi6_to_flowi(&fl2))) {
+		if (!afinfo->route(&init_net, (struct dst_entry **)&rt1,
+				   flowi6_to_flowi(&fl1), false)) {
+			if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
+					   flowi6_to_flowi(&fl2), false)) {
 				if (!memcmp(&rt1->rt6i_gateway, &rt2->rt6i_gateway,
 					    sizeof(rt1->rt6i_gateway)) &&
 				    rt1->dst.dev == rt2->dst.dev)
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index 6e6b46c..9e63b43 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -166,7 +166,7 @@
 	rcu_read_lock();
 	ai = nf_get_afinfo(family);
 	if (ai != NULL)
-		ai->route((struct dst_entry **)&rt, &fl);
+		ai->route(&init_net, (struct dst_entry **)&rt, &fl, false);
 	rcu_read_unlock();
 
 	if (rt != NULL) {
diff --git a/net/netfilter/xt_addrtype.c b/net/netfilter/xt_addrtype.c
index 2220b85..b77d383 100644
--- a/net/netfilter/xt_addrtype.c
+++ b/net/netfilter/xt_addrtype.c
@@ -32,11 +32,32 @@
 MODULE_ALIAS("ip6t_addrtype");
 
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
-static u32 xt_addrtype_rt6_to_type(const struct rt6_info *rt)
+static u32 match_lookup_rt6(struct net *net, const struct net_device *dev,
+			    const struct in6_addr *addr)
 {
+	const struct nf_afinfo *afinfo;
+	struct flowi6 flow;
+	struct rt6_info *rt;
 	u32 ret;
+	int route_err;
 
-	if (!rt)
+	memset(&flow, 0, sizeof(flow));
+	ipv6_addr_copy(&flow.daddr, addr);
+	if (dev)
+		flow.flowi6_oif = dev->ifindex;
+
+	rcu_read_lock();
+
+	afinfo = nf_get_afinfo(NFPROTO_IPV6);
+	if (afinfo != NULL)
+		route_err = afinfo->route(net, (struct dst_entry **)&rt,
+					flowi6_to_flowi(&flow), !!dev);
+	else
+		route_err = 1;
+
+	rcu_read_unlock();
+
+	if (route_err)
 		return XT_ADDRTYPE_UNREACHABLE;
 
 	if (rt->rt6i_flags & RTF_REJECT)
@@ -48,6 +69,9 @@
 		ret |= XT_ADDRTYPE_LOCAL;
 	if (rt->rt6i_flags & RTF_ANYCAST)
 		ret |= XT_ADDRTYPE_ANYCAST;
+
+
+	dst_release(&rt->dst);
 	return ret;
 }
 
@@ -65,18 +89,8 @@
 		return false;
 
 	if ((XT_ADDRTYPE_LOCAL | XT_ADDRTYPE_ANYCAST |
-	     XT_ADDRTYPE_UNREACHABLE) & mask) {
-		struct rt6_info *rt;
-		u32 type;
-		int ifindex = dev ? dev->ifindex : 0;
-
-		rt = rt6_lookup(net, addr, NULL, ifindex, !!dev);
-
-		type = xt_addrtype_rt6_to_type(rt);
-
-		dst_release(&rt->dst);
-		return !!(mask & type);
-	}
+	     XT_ADDRTYPE_UNREACHABLE) & mask)
+		return !!(mask & match_lookup_rt6(net, dev, addr));
 	return true;
 }
 
diff --git a/net/netfilter/xt_conntrack.c b/net/netfilter/xt_conntrack.c
index 2c0086a..481a86f 100644
--- a/net/netfilter/xt_conntrack.c
+++ b/net/netfilter/xt_conntrack.c
@@ -195,7 +195,7 @@
 		return info->match_flags & XT_CONNTRACK_STATE;
 	if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
 	    (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
-	    !!(info->invert_flags & XT_CONNTRACK_DIRECTION))
+	    !(info->invert_flags & XT_CONNTRACK_DIRECTION))
 		return false;
 
 	if (info->match_flags & XT_CONNTRACK_ORIGSRC)
diff --git a/sound/arm/pxa2xx-pcm-lib.c b/sound/arm/pxa2xx-pcm-lib.c
index 8808b82..76e0d56 100644
--- a/sound/arm/pxa2xx-pcm-lib.c
+++ b/sound/arm/pxa2xx-pcm-lib.c
@@ -140,6 +140,9 @@
 	if (!prtd || !prtd->params)
 		return 0;
 
+	if (prtd->dma_ch == -1)
+		return -EINVAL;
+
 	DCSR(prtd->dma_ch) &= ~DCSR_RUN;
 	DCSR(prtd->dma_ch) = 0;
 	DCMD(prtd->dma_ch) = 0;
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 69e3386..ad97d93 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -3035,6 +3035,7 @@
 	SND_PCI_QUIRK(0x17aa, 0x21c6, "Thinkpad Edge 13", CXT5066_ASUS),
  	SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo Thinkpad", CXT5066_THINKPAD),
 	SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT5066_THINKPAD),
+	SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT5066_THINKPAD),
 	SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo G560", CXT5066_ASUS),
 	SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo", CXT5066_IDEAPAD), /* Fallback for Lenovos without dock mic */
 	{}
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 251773e..715615a 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -1280,6 +1280,39 @@
 					     stream_tag, format, substream);
 }
 
+static void nvhdmi_8ch_7x_set_info_frame_parameters(struct hda_codec *codec,
+						    int channels)
+{
+	unsigned int chanmask;
+	int chan = channels ? (channels - 1) : 1;
+
+	switch (channels) {
+	default:
+	case 0:
+	case 2:
+		chanmask = 0x00;
+		break;
+	case 4:
+		chanmask = 0x08;
+		break;
+	case 6:
+		chanmask = 0x0b;
+		break;
+	case 8:
+		chanmask = 0x13;
+		break;
+	}
+
+	/* Set the audio infoframe channel allocation and checksum fields.  The
+	 * channel count is computed implicitly by the hardware. */
+	snd_hda_codec_write(codec, 0x1, 0,
+			Nv_VERB_SET_Channel_Allocation, chanmask);
+
+	snd_hda_codec_write(codec, 0x1, 0,
+			Nv_VERB_SET_Info_Frame_Checksum,
+			(0x71 - chan - chanmask));
+}
+
 static int nvhdmi_8ch_7x_pcm_close(struct hda_pcm_stream *hinfo,
 				   struct hda_codec *codec,
 				   struct snd_pcm_substream *substream)
@@ -1298,6 +1331,10 @@
 				AC_VERB_SET_STREAM_FORMAT, 0);
 	}
 
+	/* The audio hardware sends a channel count of 0x7 (8ch) when all the
+	 * streams are disabled. */
+	nvhdmi_8ch_7x_set_info_frame_parameters(codec, 8);
+
 	return snd_hda_multi_out_dig_close(codec, &spec->multiout);
 }
 
@@ -1308,37 +1345,16 @@
 				     struct snd_pcm_substream *substream)
 {
 	int chs;
-	unsigned int dataDCC1, dataDCC2, chan, chanmask, channel_id;
+	unsigned int dataDCC1, dataDCC2, channel_id;
 	int i;
 
 	mutex_lock(&codec->spdif_mutex);
 
 	chs = substream->runtime->channels;
-	chan = chs ? (chs - 1) : 1;
 
-	switch (chs) {
-	default:
-	case 0:
-	case 2:
-		chanmask = 0x00;
-		break;
-	case 4:
-		chanmask = 0x08;
-		break;
-	case 6:
-		chanmask = 0x0b;
-		break;
-	case 8:
-		chanmask = 0x13;
-		break;
-	}
 	dataDCC1 = AC_DIG1_ENABLE | AC_DIG1_COPYRIGHT;
 	dataDCC2 = 0x2;
 
-	/* set the Audio InforFrame Channel Allocation */
-	snd_hda_codec_write(codec, 0x1, 0,
-			Nv_VERB_SET_Channel_Allocation, chanmask);
-
 	/* turn off SPDIF once; otherwise the IEC958 bits won't be updated */
 	if (codec->spdif_status_reset && (codec->spdif_ctls & AC_DIG1_ENABLE))
 		snd_hda_codec_write(codec,
@@ -1413,10 +1429,7 @@
 		}
 	}
 
-	/* set the Audio Info Frame Checksum */
-	snd_hda_codec_write(codec, 0x1, 0,
-			Nv_VERB_SET_Info_Frame_Checksum,
-			(0x71 - chan - chanmask));
+	nvhdmi_8ch_7x_set_info_frame_parameters(codec, chs);
 
 	mutex_unlock(&codec->spdif_mutex);
 	return 0;
@@ -1512,6 +1525,11 @@
 	spec->multiout.max_channels = 8;
 	spec->pcm_playback = &nvhdmi_pcm_playback_8ch_7x;
 	codec->patch_ops = nvhdmi_patch_ops_8ch_7x;
+
+	/* Initialize the audio infoframe channel mask and checksum to something
+	 * valid */
+	nvhdmi_8ch_7x_set_info_frame_parameters(codec, 8);
+
 	return 0;
 }
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 7e28a64..52928d9 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -14124,7 +14124,7 @@
 };
 
 static hda_nid_t alc269_adc_candidates[] = {
-	0x08, 0x09, 0x07,
+	0x08, 0x09, 0x07, 0x11,
 };
 
 #define alc269_modes		alc260_modes
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 1395991..94d19c0 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -3408,6 +3408,9 @@
 	hda_nid_t conn[HDA_MAX_NUM_INPUTS];
 	int i, nums;
 
+	if (!(get_wcaps(codec, mux) & AC_WCAP_CONN_LIST))
+		return -1;
+
 	nums = snd_hda_get_connections(codec, mux, conn, ARRAY_SIZE(conn));
 	for (i = 0; i < nums; i++)
 		if (conn[i] == nid)
diff --git a/sound/soc/pxa/pxa2xx-pcm.c b/sound/soc/pxa/pxa2xx-pcm.c
index 02fb664..2ce0b2d 100644
--- a/sound/soc/pxa/pxa2xx-pcm.c
+++ b/sound/soc/pxa/pxa2xx-pcm.c
@@ -65,6 +65,7 @@
 	if (prtd->dma_ch >= 0) {
 		pxa_free_dma(prtd->dma_ch);
 		prtd->dma_ch = -1;
+		prtd->params = NULL;
 	}
 
 	return 0;
diff --git a/sound/soc/pxa/zylonite.c b/sound/soc/pxa/zylonite.c
index ac57726..b644575 100644
--- a/sound/soc/pxa/zylonite.c
+++ b/sound/soc/pxa/zylonite.c
@@ -167,7 +167,7 @@
 	.codec_name = "wm9713-codec",
 	.platform_name = "pxa-pcm-audio",
 	.cpu_dai_name = "pxa2xx-ac97",
-	.codec_name = "wm9713-hifi",
+	.codec_dai_name = "wm9713-hifi",
 	.init = zylonite_wm9713_init,
 },
 {
@@ -176,7 +176,7 @@
 	.codec_name = "wm9713-codec",
 	.platform_name = "pxa-pcm-audio",
 	.cpu_dai_name = "pxa2xx-ac97-aux",
-	.codec_name = "wm9713-aux",
+	.codec_dai_name = "wm9713-aux",
 },
 {
 	.name = "WM9713 Voice",
@@ -184,7 +184,7 @@
 	.codec_name = "wm9713-codec",
 	.platform_name = "pxa-pcm-audio",
 	.cpu_dai_name = "pxa-ssp-dai.2",
-	.codec_name = "wm9713-voice",
+	.codec_dai_name = "wm9713-voice",
 	.ops = &zylonite_voice_ops,
 },
 };
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 4dda589..b76b74d 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -92,8 +92,8 @@
 static int format_register_str(struct snd_soc_codec *codec,
 			       unsigned int reg, char *buf, size_t len)
 {
-	int wordsize = codec->driver->reg_word_size * 2;
-	int regsize = min_bytes_needed(codec->driver->reg_cache_size) * 2;
+	int wordsize = min_bytes_needed(codec->driver->reg_cache_size) * 2;
+	int regsize = codec->driver->reg_word_size * 2;
 	int ret;
 	char tmpbuf[len + 1];
 	char regbuf[regsize + 1];
@@ -132,8 +132,8 @@
 	size_t total = 0;
 	loff_t p = 0;
 
-	wordsize = codec->driver->reg_word_size * 2;
-	regsize = min_bytes_needed(codec->driver->reg_cache_size) * 2;
+	wordsize = min_bytes_needed(codec->driver->reg_cache_size) * 2;
+	regsize = codec->driver->reg_word_size * 2;
 
 	len = wordsize + regsize + 2 + 1;
 
diff --git a/sound/usb/midi.c b/sound/usb/midi.c
index b4b39c0..f928910 100644
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -1301,6 +1301,7 @@
 	case USB_ID(0x15ca, 0x0101): /* Textech USB Midi Cable */
 	case USB_ID(0x15ca, 0x1806): /* Textech USB Midi Cable */
 	case USB_ID(0x1a86, 0x752d): /* QinHeng CH345 "USB2.0-MIDI" */
+	case USB_ID(0xfc08, 0x0101): /* Unknown vendor Cable */
 		ep->max_transfer = 4;
 		break;
 		/*
diff --git a/tools/perf/util/cgroup.c b/tools/perf/util/cgroup.c
index 9fea755..96bee5c 100644
--- a/tools/perf/util/cgroup.c
+++ b/tools/perf/util/cgroup.c
@@ -13,7 +13,7 @@
 {
 	FILE *fp;
 	char mountpoint[MAX_PATH+1], tokens[MAX_PATH+1], type[MAX_PATH+1];
-	char *token, *saved_ptr;
+	char *token, *saved_ptr = NULL;
 	int found = 0;
 
 	fp = fopen("/proc/mounts", "r");