234 files changed, 3571 insertions, 1938 deletions

diff --git a/drivers/acpi/acpica/rscalc.c b/drivers/acpi/acpica/rscalc.c
index b6667ff059e..88b5a2c4814 100644
--- a/drivers/acpi/acpica/rscalc.c
+++ b/drivers/acpi/acpica/rscalc.c
@@ -543,6 +543,13 @@ acpi_rs_get_pci_routing_table_length(union acpi_operand_object *package_object,
 
                 package_element = *top_object_list;
 
+                /* We must have a valid Package object */
+
+                if (!package_element ||
+                    (package_element->common.type != ACPI_TYPE_PACKAGE)) {
+                        return_ACPI_STATUS (AE_AML_OPERAND_TYPE);
+                }
+
                 /*
                  * The sub_object_list will now point to an array of the
                  * four IRQ elements: Address, Pin, Source and source_index
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 942d14ac879..d51a17c0f59 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -72,6 +72,7 @@
  *      ICH2    spec c #20      - IDE PRD must not cross a 64K boundary
  *                                and must be dword aligned
  *      ICH2    spec c #24      - UDMA mode 4,5 t85/86 should be 6ns not 3.3
+ *      ICH7    errata #16      - MWDMA1 timings are incorrect
  *
  * Should have been BIOS fixed:
  *      450NX:  errata #19      - DMA hangs on old 450NX
@@ -94,7 +95,7 @@
 #include <linux/dmi.h>
 
 #define DRV_NAME        "ata_piix"
-#define DRV_VERSION     "2.12"
+#define DRV_VERSION     "2.13"
 
 enum {
         PIIX_IOCFG              = 0x54, /* IDE I/O configuration register */
@@ -136,6 +137,7 @@ enum piix_controller_ids {
         ich_pata_33,            /* ICH up to UDMA 33 only */
         ich_pata_66,            /* ICH up to 66 Mhz */
         ich_pata_100,           /* ICH up to UDMA 100 */
+        ich_pata_100_nomwdma1,  /* ICH up to UDMA 100 but with no MWDMA1*/
         ich5_sata,
         ich6_sata,
         ich6m_sata,
@@ -216,8 +218,8 @@ static const struct pci_device_id piix_pci_tbl[] = {
         /* ICH6 (and 6) (i915) UDMA 100 */
         { 0x8086, 0x266F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100 },
         /* ICH7/7-R (i945, i975) UDMA 100*/
-        { 0x8086, 0x27DF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100 },
-        { 0x8086, 0x269E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100 },
+        { 0x8086, 0x27DF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100_nomwdma1 },
+        { 0x8086, 0x269E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100_nomwdma1 },
         /* ICH8 Mobile PATA Controller */
         { 0x8086, 0x2850, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100 },
 
@@ -487,6 +489,15 @@ static struct ata_port_info piix_port_info[] = {
                 .port_ops       = &ich_pata_ops,
         },
 
+        [ich_pata_100_nomwdma1] =
+        {
+                .flags          = PIIX_PATA_FLAGS | PIIX_FLAG_CHECKINTR,
+                .pio_mask       = ATA_PIO4,
+                .mwdma_mask     = ATA_MWDMA2_ONLY,
+                .udma_mask      = ATA_UDMA5,
+                .port_ops       = &ich_pata_ops,
+        },
+
         [ich5_sata] =
         {
                 .flags          = PIIX_SATA_FLAGS,
@@ -594,6 +605,7 @@ static const struct ich_laptop ich_laptop[] = {
         { 0x24CA, 0x1025, 0x003d },     /* ICH4 on ACER TM290 */
         { 0x266F, 0x1025, 0x0066 },     /* ICH6 on ACER Aspire 1694WLMi */
         { 0x2653, 0x1043, 0x82D8 },     /* ICH6M on Asus Eee 701 */
+        { 0x27df, 0x104d, 0x900e },     /* ICH7 on Sony TZ-90 */
         /* end marker */
         { 0, }
 };
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 17c5d48a75d..c9242301cfa 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4091,7 +4091,9 @@ int ata_dev_revalidate(struct ata_device *dev, unsigned int new_class,
 
         /* fail early if !ATA && !ATAPI to avoid issuing [P]IDENTIFY to PMP */
         if (ata_class_enabled(new_class) &&
-            new_class != ATA_DEV_ATA && new_class != ATA_DEV_ATAPI) {
+            new_class != ATA_DEV_ATA &&
+            new_class != ATA_DEV_ATAPI &&
+            new_class != ATA_DEV_SEMB) {
                 ata_dev_printk(dev, KERN_INFO, "class mismatch %u != %u\n",
                                dev->class, new_class);
                 rc = -ENODEV;
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 01831312c36..94919ad03df 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2783,6 +2783,12 @@ static int ata_eh_revalidate_and_attach(struct ata_link *link,
                 } else if (dev->class == ATA_DEV_UNKNOWN &&
                            ehc->tries[dev->devno] &&
                            ata_class_enabled(ehc->classes[dev->devno])) {
+                        /* Temporarily set dev->class, it will be
+                         * permanently set once all configurations are
+                         * complete.  This is necessary because new
+                         * device configuration is done in two
+                         * separate loops.
+                         */
                         dev->class = ehc->classes[dev->devno];
 
                         if (dev->class == ATA_DEV_PMP)
@@ -2790,6 +2796,11 @@ static int ata_eh_revalidate_and_attach(struct ata_link *link,
                         else
                                 rc = ata_dev_read_id(dev, &dev->class,
                                                      readid_flags, dev->id);
+
+                        /* read_id might have changed class, store and reset */
+                        ehc->classes[dev->devno] = dev->class;
+                        dev->class = ATA_DEV_UNKNOWN;
+
                         switch (rc) {
                         case 0:
                                 /* clear error info accumulated during probe */
@@ -2799,13 +2810,11 @@ static int ata_eh_revalidate_and_attach(struct ata_link *link,
                         case -ENOENT:
                                 /* IDENTIFY was issued to non-existent
                                  * device.  No need to reset.  Just
-                                 * thaw and kill the device.
+                                 * thaw and ignore the device.
                                  */
                                 ata_eh_thaw_port(ap);
-                                dev->class = ATA_DEV_UNKNOWN;
                                 break;
                         default:
-                                dev->class = ATA_DEV_UNKNOWN;
                                 goto err;
                         }
                 }
@@ -2826,11 +2835,15 @@ static int ata_eh_revalidate_and_attach(struct ata_link *link,
                     dev->class == ATA_DEV_PMP)
                         continue;
 
+                dev->class = ehc->classes[dev->devno];
+
                 ehc->i.flags |= ATA_EHI_PRINTINFO;
                 rc = ata_dev_configure(dev);
                 ehc->i.flags &= ~ATA_EHI_PRINTINFO;
-                if (rc)
+                if (rc) {
+                        dev->class = ATA_DEV_UNKNOWN;
                         goto err;
+                }
 
                 spin_lock_irqsave(ap->lock, flags);
                 ap->pflags |= ATA_PFLAG_SCSI_HOTPLUG;
@@ -3494,6 +3507,8 @@ static void ata_eh_handle_port_suspend(struct ata_port *ap)
  */
 static void ata_eh_handle_port_resume(struct ata_port *ap)
 {
+        struct ata_link *link;
+        struct ata_device *dev;
         unsigned long flags;
         int rc = 0;
 
@@ -3508,6 +3523,17 @@ static void ata_eh_handle_port_resume(struct ata_port *ap)
 
         WARN_ON(!(ap->pflags & ATA_PFLAG_SUSPENDED));
 
+        /*
+         * Error timestamps are in jiffies which doesn't run while
+         * suspended and PHY events during resume isn't too uncommon.
+         * When the two are combined, it can lead to unnecessary speed
+         * downs if the machine is suspended and resumed repeatedly.
+         * Clear error history.
+         */
+        ata_for_each_link(link, ap, HOST_FIRST)
+                ata_for_each_dev(dev, link, ALL)
+                        ata_ering_clear(&dev->ering);
+
         ata_acpi_set_state(ap, PMSG_ON);
 
         if (ap->ops->port_resume)
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 2733b0c90b7..342316064e9 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -313,7 +313,7 @@ ata_scsi_em_message_show(struct device *dev, struct device_attribute *attr,
                 return ap->ops->em_show(ap, buf);
         return -EINVAL;
 }
-DEVICE_ATTR(em_message, S_IRUGO | S_IWUGO,
+DEVICE_ATTR(em_message, S_IRUGO | S_IWUSR,
                 ata_scsi_em_message_show, ata_scsi_em_message_store);
 EXPORT_SYMBOL_GPL(dev_attr_em_message);
 
@@ -366,7 +366,7 @@ ata_scsi_activity_store(struct device *dev, struct device_attribute *attr,
         }
         return -EINVAL;
 }
-DEVICE_ATTR(sw_activity, S_IWUGO | S_IRUGO, ata_scsi_activity_show,
+DEVICE_ATTR(sw_activity, S_IWUSR | S_IRUGO, ata_scsi_activity_show,
                         ata_scsi_activity_store);
 EXPORT_SYMBOL_GPL(dev_attr_sw_activity);
 
@@ -2142,13 +2142,14 @@ static unsigned int ata_scsiop_inq_89(struct ata_scsi_args *args, u8 *rbuf)
 
 static unsigned int ata_scsiop_inq_b1(struct ata_scsi_args *args, u8 *rbuf)
 {
+        int form_factor = ata_id_form_factor(args->id);
+        int media_rotation_rate = ata_id_rotation_rate(args->id);
+
         rbuf[1] = 0xb1;
         rbuf[3] = 0x3c;
-        if (ata_id_major_version(args->id) > 7) {
-                rbuf[4] = args->id[217] >> 8;
-                rbuf[5] = args->id[217];
-                rbuf[7] = args->id[168] & 0xf;
-        }
+        rbuf[4] = media_rotation_rate >> 8;
+        rbuf[5] = media_rotation_rate;
+        rbuf[7] = form_factor;
 
         return 0;
 }
@@ -2376,7 +2377,23 @@ saving_not_supp:
  */
 static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
 {
-        u64 last_lba = args->dev->n_sectors - 1; /* LBA of the last block */
+        struct ata_device *dev = args->dev;
+        u64 last_lba = dev->n_sectors - 1; /* LBA of the last block */
+        u8 log_per_phys = 0;
+        u16 lowest_aligned = 0;
+        u16 word_106 = dev->id[106];
+        u16 word_209 = dev->id[209];
+
+        if ((word_106 & 0xc000) == 0x4000) {
+                /* Number and offset of logical sectors per physical sector */
+                if (word_106 & (1 << 13))
+                        log_per_phys = word_106 & 0xf;
+                if ((word_209 & 0xc000) == 0x4000) {
+                        u16 first = dev->id[209] & 0x3fff;
+                        if (first > 0)
+                                lowest_aligned = (1 << log_per_phys) - first;
+                }
+        }
 
         VPRINTK("ENTER\n");
 
@@ -2407,6 +2424,11 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
                 /* sector size */
                 rbuf[10] = ATA_SECT_SIZE >> 8;
                 rbuf[11] = ATA_SECT_SIZE & 0xff;
+
+                rbuf[12] = 0;
+                rbuf[13] = log_per_phys;
+                rbuf[14] = (lowest_aligned >> 8) & 0x3f;
+                rbuf[15] = lowest_aligned;
         }
 
         return 0;
diff --git a/drivers/ata/pata_pdc202xx_old.c b/drivers/ata/pata_pdc202xx_old.c
index 5fedb3d4032..2f3c9bed63d 100644
--- a/drivers/ata/pata_pdc202xx_old.c
+++ b/drivers/ata/pata_pdc202xx_old.c
@@ -2,7 +2,7 @@
  * pata_pdc202xx_old.c  - Promise PDC202xx PATA for new ATA layer
  *                        (C) 2005 Red Hat Inc
  *                        Alan Cox <alan@lxorguk.ukuu.org.uk>
- *                        (C) 2007 Bartlomiej Zolnierkiewicz
+ *                        (C) 2007,2009 Bartlomiej Zolnierkiewicz
  *
  * Based in part on linux/drivers/ide/pci/pdc202xx_old.c
  *
@@ -158,7 +158,7 @@ static void pdc2026x_bmdma_start(struct ata_queued_cmd *qc)
         u32 len;
 
         /* Check we keep host level locking here */
-        if (adev->dma_mode >= XFER_UDMA_2)
+        if (adev->dma_mode > XFER_UDMA_2)
                 iowrite8(ioread8(clock) | sel66, clock);
         else
                 iowrite8(ioread8(clock) & ~sel66, clock);
@@ -212,7 +212,7 @@ static void pdc2026x_bmdma_stop(struct ata_queued_cmd *qc)
                 iowrite8(ioread8(clock) & ~sel66, clock);
         }
         /* Flip back to 33Mhz for PIO */
-        if (adev->dma_mode >= XFER_UDMA_2)
+        if (adev->dma_mode > XFER_UDMA_2)
                 iowrite8(ioread8(clock) & ~sel66, clock);
         ata_bmdma_stop(qc);
         pdc202xx_set_piomode(ap, adev);
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index c2e90e1fece..36b8629203b 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -205,6 +205,7 @@ struct cmdhdr_tbl_entry {
  * Description information bitdefs
  */
 enum {
+        CMD_DESC_RES = (1 << 11),
         VENDOR_SPECIFIC_BIST = (1 << 10),
         CMD_DESC_SNOOP_ENABLE = (1 << 9),
         FPDMA_QUEUED_CMD = (1 << 8),
@@ -332,13 +333,14 @@ static unsigned int sata_fsl_fill_sg(struct ata_queued_cmd *qc, void *cmd_desc,
                 dma_addr_t sg_addr = sg_dma_address(sg);
                 u32 sg_len = sg_dma_len(sg);
 
-                VPRINTK("SATA FSL : fill_sg, sg_addr = 0x%x, sg_len = %d\n",
-                        sg_addr, sg_len);
+                VPRINTK("SATA FSL : fill_sg, sg_addr = 0x%llx, sg_len = %d\n",
+                        (unsigned long long)sg_addr, sg_len);
 
                 /* warn if each s/g element is not dword aligned */
                 if (sg_addr & 0x03)
                         ata_port_printk(qc->ap, KERN_ERR,
-                                        "s/g addr unaligned : 0x%x\n", sg_addr);
+                                        "s/g addr unaligned : 0x%llx\n",
+                                        (unsigned long long)sg_addr);
                 if (sg_len & 0x03)
                         ata_port_printk(qc->ap, KERN_ERR,
                                         "s/g len unaligned : 0x%x\n", sg_len);
@@ -387,7 +389,7 @@ static void sata_fsl_qc_prep(struct ata_queued_cmd *qc)
         void __iomem *hcr_base = host_priv->hcr_base;
         unsigned int tag = sata_fsl_tag(qc->tag, hcr_base);
         struct command_desc *cd;
-        u32 desc_info = CMD_DESC_SNOOP_ENABLE;
+        u32 desc_info = CMD_DESC_RES | CMD_DESC_SNOOP_ENABLE;
         u32 num_prde = 0;
         u32 ttl_dwords = 0;
         dma_addr_t cd_paddr;
@@ -840,7 +842,7 @@ issue_srst:
 
         /* device reset/SRST is a control register update FIS, uses tag0 */
         sata_fsl_setup_cmd_hdr_entry(pp, 0,
-                                     SRST_CMD | CMD_DESC_SNOOP_ENABLE, 0, 0, 5);
+                SRST_CMD | CMD_DESC_RES | CMD_DESC_SNOOP_ENABLE, 0, 0, 5);
 
         tf.ctl |= ATA_SRST;     /* setup SRST bit in taskfile control reg */
         ata_tf_to_fis(&tf, pmp, 0, cfis);
@@ -886,7 +888,8 @@ issue_srst:
          * using ATA signature D2H register FIS to the host controller.
          */
 
-        sata_fsl_setup_cmd_hdr_entry(pp, 0, CMD_DESC_SNOOP_ENABLE, 0, 0, 5);
+        sata_fsl_setup_cmd_hdr_entry(pp, 0, CMD_DESC_RES | CMD_DESC_SNOOP_ENABLE,
+                                      0, 0, 5);
 
         tf.ctl &= ~ATA_SRST;    /* 2nd H2D Ctl. register FIS */
         ata_tf_to_fis(&tf, pmp, 0, cfis);
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 870dcfd8235..23714aefb82 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -293,6 +293,10 @@ enum {
         FISCFG_WAIT_DEV_ERR     = (1 << 8),     /* wait for host on DevErr */
         FISCFG_SINGLE_SYNC      = (1 << 16),    /* SYNC on DMA activation */
 
+        PHY_MODE9_GEN2          = 0x398,
+        PHY_MODE9_GEN1          = 0x39c,
+        PHYCFG_OFS              = 0x3a0,        /* only in 65n devices */
+
         MV5_PHY_MODE            = 0x74,
         MV5_LTMODE              = 0x30,
         MV5_PHY_CTL             = 0x0C,
@@ -609,6 +613,8 @@ static int mv_soc_reset_hc(struct mv_host_priv *hpriv,
 static void mv_soc_reset_flash(struct mv_host_priv *hpriv,
                                       void __iomem *mmio);
 static void mv_soc_reset_bus(struct ata_host *host, void __iomem *mmio);
+static void mv_soc_65n_phy_errata(struct mv_host_priv *hpriv,
+                                  void __iomem *mmio, unsigned int port);
 static void mv_reset_pci_bus(struct ata_host *host, void __iomem *mmio);
 static void mv_reset_channel(struct mv_host_priv *hpriv, void __iomem *mmio,
                              unsigned int port_no);
@@ -807,6 +813,14 @@ static const struct mv_hw_ops mv_soc_ops = {
         .reset_bus              = mv_soc_reset_bus,
 };
 
+static const struct mv_hw_ops mv_soc_65n_ops = {
+        .phy_errata             = mv_soc_65n_phy_errata,
+        .enable_leds            = mv_soc_enable_leds,
+        .reset_hc               = mv_soc_reset_hc,
+        .reset_flash            = mv_soc_reset_flash,
+        .reset_bus              = mv_soc_reset_bus,
+};
+
 /*
  * Functions
  */
@@ -3397,6 +3411,53 @@ static void mv_soc_reset_bus(struct ata_host *host, void __iomem *mmio)
         return;
 }
 
+static void mv_soc_65n_phy_errata(struct mv_host_priv *hpriv,
+                                  void __iomem *mmio, unsigned int port)
+{
+        void __iomem *port_mmio = mv_port_base(mmio, port);
+        u32     reg;
+
+        reg = readl(port_mmio + PHY_MODE3);
+        reg &= ~(0x3 << 27);    /* SELMUPF (bits 28:27) to 1 */
+        reg |= (0x1 << 27);
+        reg &= ~(0x3 << 29);    /* SELMUPI (bits 30:29) to 1 */
+        reg |= (0x1 << 29);
+        writel(reg, port_mmio + PHY_MODE3);
+
+        reg = readl(port_mmio + PHY_MODE4);
+        reg &= ~0x1;    /* SATU_OD8 (bit 0) to 0, reserved bit 16 must be set */
+        reg |= (0x1 << 16);
+        writel(reg, port_mmio + PHY_MODE4);
+
+        reg = readl(port_mmio + PHY_MODE9_GEN2);
+        reg &= ~0xf;    /* TXAMP[3:0] (bits 3:0) to 8 */
+        reg |= 0x8;
+        reg &= ~(0x1 << 14);    /* TXAMP[4] (bit 14) to 0 */
+        writel(reg, port_mmio + PHY_MODE9_GEN2);
+
+        reg = readl(port_mmio + PHY_MODE9_GEN1);
+        reg &= ~0xf;    /* TXAMP[3:0] (bits 3:0) to 8 */
+        reg |= 0x8;
+        reg &= ~(0x1 << 14);    /* TXAMP[4] (bit 14) to 0 */
+        writel(reg, port_mmio + PHY_MODE9_GEN1);
+}
+
+/**
+ *      soc_is_65 - check if the soc is 65 nano device
+ *
+ *      Detect the type of the SoC, this is done by reading the PHYCFG_OFS
+ *      register, this register should contain non-zero value and it exists only
+ *      in the 65 nano devices, when reading it from older devices we get 0.
+ */
+static bool soc_is_65n(struct mv_host_priv *hpriv)
+{
+        void __iomem *port0_mmio = mv_port_base(hpriv->base, 0);
+
+        if (readl(port0_mmio + PHYCFG_OFS))
+                return true;
+        return false;
+}
+
 static void mv_setup_ifcfg(void __iomem *port_mmio, int want_gen2i)
 {
         u32 ifcfg = readl(port_mmio + SATA_IFCFG);
@@ -3737,7 +3798,10 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
                 }
                 break;
         case chip_soc:
-                hpriv->ops = &mv_soc_ops;
+                if (soc_is_65n(hpriv))
+                        hpriv->ops = &mv_soc_65n_ops;
+                else
+                        hpriv->ops = &mv_soc_ops;
                 hp_flags |= MV_HP_FLAG_SOC | MV_HP_GEN_IIE |
                         MV_HP_ERRATA_60X1C0;
                 break;
@@ -3800,7 +3864,8 @@ static int mv_init_host(struct ata_host *host, unsigned int board_idx)
         n_hc = mv_get_hc_count(host->ports[0]->flags);
 
         for (port = 0; port < host->n_ports; port++)
-                hpriv->ops->read_preamp(hpriv, port, mmio);
+                if (hpriv->ops->read_preamp)
+                        hpriv->ops->read_preamp(hpriv, port, mmio);
 
         rc = hpriv->ops->reset_hc(hpriv, mmio, n_hc);
         if (rc)
diff --git a/drivers/ata/sata_sx4.c b/drivers/ata/sata_sx4.c
index dce3dccced3..eb05a3c82a9 100644
--- a/drivers/ata/sata_sx4.c
+++ b/drivers/ata/sata_sx4.c
@@ -213,8 +213,9 @@ struct pdc_host_priv {
 
 
 static int pdc_sata_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
-static void pdc_eng_timeout(struct ata_port *ap);
-static void pdc_20621_phy_reset(struct ata_port *ap);
+static void pdc_error_handler(struct ata_port *ap);
+static void pdc_freeze(struct ata_port *ap);
+static void pdc_thaw(struct ata_port *ap);
 static int pdc_port_start(struct ata_port *ap);
 static void pdc20621_qc_prep(struct ata_queued_cmd *qc);
 static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
@@ -233,6 +234,10 @@ static void pdc20621_put_to_dimm(struct ata_host *host,
                                  void *psource, u32 offset, u32 size);
 static void pdc20621_irq_clear(struct ata_port *ap);
 static unsigned int pdc20621_qc_issue(struct ata_queued_cmd *qc);
+static int pdc_softreset(struct ata_link *link, unsigned int *class,
+                         unsigned long deadline);
+static void pdc_post_internal_cmd(struct ata_queued_cmd *qc);
+static int pdc_check_atapi_dma(struct ata_queued_cmd *qc);
 
 
 static struct scsi_host_template pdc_sata_sht = {
@@ -243,20 +248,24 @@ static struct scsi_host_template pdc_sata_sht = {
 
 /* TODO: inherit from base port_ops after converting to new EH */
 static struct ata_port_operations pdc_20621_ops = {
-        .sff_tf_load            = pdc_tf_load_mmio,
-        .sff_tf_read            = ata_sff_tf_read,
-        .sff_check_status       = ata_sff_check_status,
-        .sff_exec_command       = pdc_exec_command_mmio,
-        .sff_dev_select         = ata_sff_dev_select,
-        .phy_reset              = pdc_20621_phy_reset,
+        .inherits               = &ata_sff_port_ops,
+
+        .check_atapi_dma        = pdc_check_atapi_dma,
         .qc_prep                = pdc20621_qc_prep,
         .qc_issue               = pdc20621_qc_issue,
-        .qc_fill_rtf            = ata_sff_qc_fill_rtf,
-        .sff_data_xfer          = ata_sff_data_xfer,
-        .eng_timeout            = pdc_eng_timeout,
-        .sff_irq_clear          = pdc20621_irq_clear,
-        .sff_irq_on             = ata_sff_irq_on,
+
+        .freeze                 = pdc_freeze,
+        .thaw                   = pdc_thaw,
+        .softreset              = pdc_softreset,
+        .error_handler          = pdc_error_handler,
+        .lost_interrupt         = ATA_OP_NULL,
+        .post_internal_cmd      = pdc_post_internal_cmd,
+
         .port_start             = pdc_port_start,
+
+        .sff_tf_load            = pdc_tf_load_mmio,
+        .sff_exec_command       = pdc_exec_command_mmio,
+        .sff_irq_clear          = pdc20621_irq_clear,
 };
 
 static const struct ata_port_info pdc_port_info[] = {
@@ -310,14 +319,6 @@ static int pdc_port_start(struct ata_port *ap)
         return 0;
 }
 
-static void pdc_20621_phy_reset(struct ata_port *ap)
-{
-        VPRINTK("ENTER\n");
-        ap->cbl = ATA_CBL_SATA;
-        ata_port_probe(ap);
-        ata_bus_reset(ap);
-}
-
 static inline void pdc20621_ata_sg(struct ata_taskfile *tf, u8 *buf,
                                    unsigned int portno,
                                            unsigned int total_len)
@@ -686,8 +687,11 @@ static void pdc20621_packet_start(struct ata_queued_cmd *qc)
 static unsigned int pdc20621_qc_issue(struct ata_queued_cmd *qc)
 {
         switch (qc->tf.protocol) {
-        case ATA_PROT_DMA:
         case ATA_PROT_NODATA:
+                if (qc->tf.flags & ATA_TFLAG_POLLING)
+                        break;
+                /*FALLTHROUGH*/
+        case ATA_PROT_DMA:
                 pdc20621_packet_start(qc);
                 return 0;
 
@@ -786,12 +790,7 @@ static inline unsigned int pdc20621_host_intr(struct ata_port *ap,
 
 static void pdc20621_irq_clear(struct ata_port *ap)
 {
-        struct ata_host *host = ap->host;
-        void __iomem *mmio = host->iomap[PDC_MMIO_BAR];
-
-        mmio += PDC_CHIP0_OFS;
-
-        readl(mmio + PDC_20621_SEQMASK);
+        ioread8(ap->ioaddr.status_addr);
 }
 
 static irqreturn_t pdc20621_interrupt(int irq, void *dev_instance)
@@ -859,46 +858,119 @@ static irqreturn_t pdc20621_interrupt(int irq, void *dev_instance)
         return IRQ_RETVAL(handled);
 }
 
-static void pdc_eng_timeout(struct ata_port *ap)
+static void pdc_freeze(struct ata_port *ap)
 {
-        u8 drv_stat;
-        struct ata_host *host = ap->host;
-        struct ata_queued_cmd *qc;
-        unsigned long flags;
+        void __iomem *mmio = ap->ioaddr.cmd_addr;
+        u32 tmp;
 
-        DPRINTK("ENTER\n");
+        /* FIXME: if all 4 ATA engines are stopped, also stop HDMA engine */
 
-        spin_lock_irqsave(&host->lock, flags);
+        tmp = readl(mmio + PDC_CTLSTAT);
+        tmp |= PDC_MASK_INT;
+        tmp &= ~PDC_DMA_ENABLE;
+        writel(tmp, mmio + PDC_CTLSTAT);
+        readl(mmio + PDC_CTLSTAT); /* flush */
+}
 
-        qc = ata_qc_from_tag(ap, ap->link.active_tag);
+static void pdc_thaw(struct ata_port *ap)
+{
+        void __iomem *mmio = ap->ioaddr.cmd_addr;
+        u32 tmp;
 
-        switch (qc->tf.protocol) {
-        case ATA_PROT_DMA:
-        case ATA_PROT_NODATA:
-                ata_port_printk(ap, KERN_ERR, "command timeout\n");
-                qc->err_mask |= __ac_err_mask(ata_wait_idle(ap));
-                break;
+        /* FIXME: start HDMA engine, if zero ATA engines running */
 
-        default:
-                drv_stat = ata_sff_busy_wait(ap, ATA_BUSY | ATA_DRQ, 1000);
+        /* clear IRQ */
+        ioread8(ap->ioaddr.status_addr);
 
-                ata_port_printk(ap, KERN_ERR,
-                                "unknown timeout, cmd 0x%x stat 0x%x\n",
-                                qc->tf.command, drv_stat);
+        /* turn IRQ back on */
+        tmp = readl(mmio + PDC_CTLSTAT);
+        tmp &= ~PDC_MASK_INT;
+        writel(tmp, mmio + PDC_CTLSTAT);
+        readl(mmio + PDC_CTLSTAT); /* flush */
+}
 
-                qc->err_mask |= ac_err_mask(drv_stat);
-                break;
+static void pdc_reset_port(struct ata_port *ap)
+{
+        void __iomem *mmio = ap->ioaddr.cmd_addr + PDC_CTLSTAT;
+        unsigned int i;
+        u32 tmp;
+
+        /* FIXME: handle HDMA copy engine */
+
+        for (i = 11; i > 0; i--) {
+                tmp = readl(mmio);
+                if (tmp & PDC_RESET)
+                        break;
+
+                udelay(100);
+
+                tmp |= PDC_RESET;
+                writel(tmp, mmio);
         }
 
-        spin_unlock_irqrestore(&host->lock, flags);
-        ata_eh_qc_complete(qc);
-        DPRINTK("EXIT\n");
+        tmp &= ~PDC_RESET;
+        writel(tmp, mmio);
+        readl(mmio);    /* flush */
+}
+
+static int pdc_softreset(struct ata_link *link, unsigned int *class,
+                         unsigned long deadline)
+{
+        pdc_reset_port(link->ap);
+        return ata_sff_softreset(link, class, deadline);
+}
+
+static void pdc_error_handler(struct ata_port *ap)
+{
+        if (!(ap->pflags & ATA_PFLAG_FROZEN))
+                pdc_reset_port(ap);
+
+        ata_std_error_handler(ap);
+}
+
+static void pdc_post_internal_cmd(struct ata_queued_cmd *qc)
+{
+        struct ata_port *ap = qc->ap;
+
+        /* make DMA engine forget about the failed command */
+        if (qc->flags & ATA_QCFLAG_FAILED)
+                pdc_reset_port(ap);
+}
+
+static int pdc_check_atapi_dma(struct ata_queued_cmd *qc)
+{
+        u8 *scsicmd = qc->scsicmd->cmnd;
+        int pio = 1; /* atapi dma off by default */
+
+        /* Whitelist commands that may use DMA. */
+        switch (scsicmd[0]) {
+        case WRITE_12:
+        case WRITE_10:
+        case WRITE_6:
+        case READ_12:
+        case READ_10:
+        case READ_6:
+        case 0xad: /* READ_DVD_STRUCTURE */
+        case 0xbe: /* READ_CD */
+                pio = 0;
+        }
+        /* -45150 (FFFF4FA2) to -1 (FFFFFFFF) shall use PIO mode */
+        if (scsicmd[0] == WRITE_10) {
+                unsigned int lba =
+                        (scsicmd[2] << 24) |
+                        (scsicmd[3] << 16) |
+                        (scsicmd[4] << 8) |
+                        scsicmd[5];
+                if (lba >= 0xFFFF4FA2)
+                        pio = 1;
+        }
+        return pio;
 }
 
 static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf)
 {
         WARN_ON(tf->protocol == ATA_PROT_DMA ||
-                tf->protocol == ATA_PROT_NODATA);
+                tf->protocol == ATAPI_PROT_DMA);
         ata_sff_tf_load(ap, tf);
 }
 
@@ -906,7 +978,7 @@ static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf)
 static void pdc_exec_command_mmio(struct ata_port *ap, const struct ata_taskfile *tf)
 {
         WARN_ON(tf->protocol == ATA_PROT_DMA ||
-                tf->protocol == ATA_PROT_NODATA);
+                tf->protocol == ATAPI_PROT_DMA);
         ata_sff_exec_command(ap, tf);
 }
 
diff --git a/drivers/base/iommu.c b/drivers/base/iommu.c
index 9f0e672f4be..8ad4ffea692 100644
--- a/drivers/base/iommu.c
+++ b/drivers/base/iommu.c
@@ -18,6 +18,8 @@
 
 #include <linux/bug.h>
 #include <linux/types.h>
+#include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/iommu.h>
 
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index b5b6c973a2e..8b4708e0624 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -217,7 +217,6 @@ int platform_device_add_data(struct platform_device *pdev, const void *data,
         if (d) {
                 memcpy(d, data, size);
                 pdev->dev.platform_data = d;
-                pdev->platform_data = d;
         }
         return d ? 0 : -ENOMEM;
 }
@@ -247,21 +246,6 @@ int platform_device_add(struct platform_device *pdev)
         else
                 dev_set_name(&pdev->dev, pdev->name);
 
-        /* We will remove platform_data field from struct device
-        * if all platform devices pass its platform specific data
-        * from platform_device. The conversion is going to be a
-        * long time, so we allow the two cases coexist to make
-        * this kind of fix more easily*/
-        if (pdev->platform_data && pdev->dev.platform_data) {
-                printk(KERN_ERR
-                               "%s: use which platform_data?\n",
-                               dev_name(&pdev->dev));
-        } else if (pdev->platform_data) {
-                pdev->dev.platform_data = pdev->platform_data;
-        } else if (pdev->dev.platform_data) {
-                pdev->platform_data = pdev->dev.platform_data;
-        }
-
         for (i = 0; i < pdev->num_resources; i++) {
                 struct resource *p, *r = &pdev->resource[i];
 
@@ -1028,7 +1012,7 @@ static __initdata LIST_HEAD(early_platform_device_list);
 
 /**
  * early_platform_driver_register
- * @edrv: early_platform driver structure
+ * @epdrv: early_platform driver structure
  * @buf: string passed from early_param()
  */
 int __init early_platform_driver_register(struct early_platform_driver *epdrv,
@@ -1112,7 +1096,7 @@ void __init early_platform_driver_register_all(char *class_str)
 
 /**
  * early_platform_match
- * @edrv: early platform driver structure
+ * @epdrv: early platform driver structure
  * @id: id to match against
  */
 static  __init struct platform_device *
@@ -1130,7 +1114,7 @@ early_platform_match(struct early_platform_driver *epdrv, int id)
 
 /**
  * early_platform_left
- * @edrv: early platform driver structure
+ * @epdrv: early platform driver structure
  * @id: return true if id or above exists
  */
 static  __init int early_platform_left(struct early_platform_driver *epdrv,
diff --git a/drivers/char/random.c b/drivers/char/random.c
index f824ef8a927..b2ced39d76b 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1665,15 +1665,20 @@ EXPORT_SYMBOL(secure_dccp_sequence_number);
  * value is not cryptographically secure but for several uses the cost of
  * depleting entropy is too high
  */
+DEFINE_PER_CPU(__u32 [4], get_random_int_hash);
 unsigned int get_random_int(void)
 {
-        /*
-         * Use IP's RNG. It suits our purpose perfectly: it re-keys itself
-         * every second, from the entropy pool (and thus creates a limited
-         * drain on it), and uses halfMD4Transform within the second. We
-         * also mix it with jiffies and the PID:
-         */
-        return secure_ip_id((__force __be32)(current->pid + jiffies));
+        struct keydata *keyptr;
+        __u32 *hash = get_cpu_var(get_random_int_hash);
+        int ret;
+
+        keyptr = get_keyptr();
+        hash[0] += current->pid + jiffies + get_cycles() + (int)(long)&ret;
+
+        ret = half_md4_transform(hash, keyptr->secret);
+        put_cpu_var(get_random_int_hash);
+
+        return ret;
 }
 
 /*
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index aed2b2936ec..39a05b5fa9c 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -408,7 +408,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
         &sysrq_showlocks_op,            /* d */
         &sysrq_term_op,                 /* e */
         &sysrq_moom_op,                 /* f */
-        /* g: May be registered by ppc for kgdb */
+        /* g: May be registered for the kernel debugger */
         NULL,                           /* g */
         NULL,                           /* h - reserved for help */
         &sysrq_kill_op,                 /* i */
@@ -433,7 +433,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
         &sysrq_sync_op,                 /* s */
         &sysrq_showstate_op,            /* t */
         &sysrq_mountro_op,              /* u */
-        /* v: May be registered at init time by SMP VOYAGER */
+        /* v: May be registered for frame buffer console restore */
         NULL,                           /* v */
         &sysrq_showstate_blocked_op,    /* w */
         /* x: May be registered on ppc/powerpc for xmon */
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index a2dee0eb6da..e6ce632a393 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -400,6 +400,9 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
         case KIOCSOUND:
                 if (!perm)
                         goto eperm;
+                /* FIXME: This is an old broken API but we need to keep it
+                   supported and somehow separate the historic advertised
+                   tick rate from any real one */
                 if (arg)
                         arg = CLOCK_TICK_RATE / arg;
                 kd_mksound(arg, 0);
@@ -417,6 +420,9 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                  */
                 ticks = HZ * ((arg >> 16) & 0xffff) / 1000;
                 count = ticks ? (arg & 0xffff) : 0;
+                /* FIXME: This is an old broken API but we need to keep it
+                   supported and somehow separate the historic advertised
+                   tick rate from any real one */
                 if (count)
                         count = CLOCK_TICK_RATE / count;
                 kd_mksound(count, ticks);
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 92438e9dacc..5a87384ea4f 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -804,11 +804,14 @@ dma_async_memcpy_buf_to_buf(struct dma_chan *chan, void *dest,
         dma_addr_t dma_dest, dma_src;
         dma_cookie_t cookie;
         int cpu;
+        unsigned long flags;
 
         dma_src = dma_map_single(dev->dev, src, len, DMA_TO_DEVICE);
         dma_dest = dma_map_single(dev->dev, dest, len, DMA_FROM_DEVICE);
-        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len,
-                                         DMA_CTRL_ACK);
+        flags = DMA_CTRL_ACK |
+                DMA_COMPL_SRC_UNMAP_SINGLE |
+                DMA_COMPL_DEST_UNMAP_SINGLE;
+        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len, flags);
 
         if (!tx) {
                 dma_unmap_single(dev->dev, dma_src, len, DMA_TO_DEVICE);
@@ -850,11 +853,12 @@ dma_async_memcpy_buf_to_pg(struct dma_chan *chan, struct page *page,
         dma_addr_t dma_dest, dma_src;
         dma_cookie_t cookie;
         int cpu;
+        unsigned long flags;
 
         dma_src = dma_map_single(dev->dev, kdata, len, DMA_TO_DEVICE);
         dma_dest = dma_map_page(dev->dev, page, offset, len, DMA_FROM_DEVICE);
-        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len,
-                                         DMA_CTRL_ACK);
+        flags = DMA_CTRL_ACK | DMA_COMPL_SRC_UNMAP_SINGLE;
+        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len, flags);
 
         if (!tx) {
                 dma_unmap_single(dev->dev, dma_src, len, DMA_TO_DEVICE);
@@ -898,12 +902,13 @@ dma_async_memcpy_pg_to_pg(struct dma_chan *chan, struct page *dest_pg,
         dma_addr_t dma_dest, dma_src;
         dma_cookie_t cookie;
         int cpu;
+        unsigned long flags;
 
         dma_src = dma_map_page(dev->dev, src_pg, src_off, len, DMA_TO_DEVICE);
         dma_dest = dma_map_page(dev->dev, dest_pg, dest_off, len,
                                 DMA_FROM_DEVICE);
-        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len,
-                                         DMA_CTRL_ACK);
+        flags = DMA_CTRL_ACK;
+        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len, flags);
 
         if (!tx) {
                 dma_unmap_page(dev->dev, dma_src, len, DMA_TO_DEVICE);
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index a27c0fb1bc1..fb7da5141e9 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -531,9 +531,7 @@ static int __init dmatest_init(void)
                 chan = dma_request_channel(mask, filter, NULL);
                 if (chan) {
                         err = dmatest_add_channel(chan);
-                        if (err == 0)
-                                continue;
-                        else {
+                        if (err) {
                                 dma_release_channel(chan);
                                 break; /* add_channel failed, punt */
                         }
diff --git a/drivers/dma/ioat_dma.c b/drivers/dma/ioat_dma.c
index e4fc33c1c32..1955ee8d6d2 100644
--- a/drivers/dma/ioat_dma.c
+++ b/drivers/dma/ioat_dma.c
@@ -1063,22 +1063,31 @@ static void ioat_dma_cleanup_tasklet(unsigned long data)
 static void
 ioat_dma_unmap(struct ioat_dma_chan *ioat_chan, struct ioat_desc_sw *desc)
 {
-        /*
-         * yes we are unmapping both _page and _single
-         * alloc'd regions with unmap_page. Is this
-         * *really* that bad?
-         */
-        if (!(desc->async_tx.flags & DMA_COMPL_SKIP_DEST_UNMAP))
-                pci_unmap_page(ioat_chan->device->pdev,
-                                pci_unmap_addr(desc, dst),
-                                pci_unmap_len(desc, len),
-                                PCI_DMA_FROMDEVICE);
-
-        if (!(desc->async_tx.flags & DMA_COMPL_SKIP_SRC_UNMAP))
-                pci_unmap_page(ioat_chan->device->pdev,
-                                pci_unmap_addr(desc, src),
-                                pci_unmap_len(desc, len),
-                                PCI_DMA_TODEVICE);
+        if (!(desc->async_tx.flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
+                if (desc->async_tx.flags & DMA_COMPL_DEST_UNMAP_SINGLE)
+                        pci_unmap_single(ioat_chan->device->pdev,
+                                         pci_unmap_addr(desc, dst),
+                                         pci_unmap_len(desc, len),
+                                         PCI_DMA_FROMDEVICE);
+                else
+                        pci_unmap_page(ioat_chan->device->pdev,
+                                       pci_unmap_addr(desc, dst),
+                                       pci_unmap_len(desc, len),
+                                       PCI_DMA_FROMDEVICE);
+        }
+
+        if (!(desc->async_tx.flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
+                if (desc->async_tx.flags & DMA_COMPL_SRC_UNMAP_SINGLE)
+                        pci_unmap_single(ioat_chan->device->pdev,
+                                         pci_unmap_addr(desc, src),
+                                         pci_unmap_len(desc, len),
+                                         PCI_DMA_TODEVICE);
+                else
+                        pci_unmap_page(ioat_chan->device->pdev,
+                                       pci_unmap_addr(desc, src),
+                                       pci_unmap_len(desc, len),
+                                       PCI_DMA_TODEVICE);
+        }
 }
 
 /**
@@ -1363,6 +1372,7 @@ static int ioat_dma_self_test(struct ioatdma_device *device)
         int err = 0;
         struct completion cmp;
         unsigned long tmo;
+        unsigned long flags;
 
         src = kzalloc(sizeof(u8) * IOAT_TEST_SIZE, GFP_KERNEL);
         if (!src)
@@ -1392,8 +1402,9 @@ static int ioat_dma_self_test(struct ioatdma_device *device)
                                  DMA_TO_DEVICE);
         dma_dest = dma_map_single(dma_chan->device->dev, dest, IOAT_TEST_SIZE,
                                   DMA_FROM_DEVICE);
+        flags = DMA_COMPL_SRC_UNMAP_SINGLE | DMA_COMPL_DEST_UNMAP_SINGLE;
         tx = device->common.device_prep_dma_memcpy(dma_chan, dma_dest, dma_src,
-                                                   IOAT_TEST_SIZE, 0);
+                                                   IOAT_TEST_SIZE, flags);
         if (!tx) {
                 dev_err(&device->pdev->dev,
                         "Self-test prep failed, disabling\n");
diff --git a/drivers/dma/ipu/ipu_idmac.c b/drivers/dma/ipu/ipu_idmac.c
index e202a6ce557..9a5bc1a7389 100644
--- a/drivers/dma/ipu/ipu_idmac.c
+++ b/drivers/dma/ipu/ipu_idmac.c
@@ -1272,7 +1272,8 @@ static irqreturn_t idmac_interrupt(int irq, void *dev_id)
         /* Other interrupts do not interfere with this channel */
         spin_lock(&ichan->lock);
         if (unlikely(chan_id != IDMAC_SDC_0 && chan_id != IDMAC_SDC_1 &&
-                     ((curbuf >> chan_id) & 1) == ichan->active_buffer)) {
+                     ((curbuf >> chan_id) & 1) == ichan->active_buffer &&
+                     !list_is_last(ichan->queue.next, &ichan->queue))) {
                 int i = 100;
 
                 /* This doesn't help. See comment in ipu_disable_channel() */
@@ -1547,7 +1548,7 @@ static irqreturn_t ic_sof_irq(int irq, void *dev_id)
         struct idmac_channel *ichan = dev_id;
         printk(KERN_DEBUG "Got SOF IRQ %d on Channel %d\n",
                irq, ichan->dma_chan.chan_id);
-        disable_irq(irq);
+        disable_irq_nosync(irq);
         return IRQ_HANDLED;
 }
 
@@ -1556,7 +1557,7 @@ static irqreturn_t ic_eof_irq(int irq, void *dev_id)
         struct idmac_channel *ichan = dev_id;
         printk(KERN_DEBUG "Got EOF IRQ %d on Channel %d\n",
                irq, ichan->dma_chan.chan_id);
-        disable_irq(irq);
+        disable_irq_nosync(irq);
         return IRQ_HANDLED;
 }
 
diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c
index 7b7ddc2d51c..420a96e7f2d 100644
--- a/drivers/firmware/iscsi_ibft.c
+++ b/drivers/firmware/iscsi_ibft.c
@@ -754,11 +754,11 @@ static int __init ibft_check_nic_for(struct ibft_nic *nic, int entry)
                 rc = 1;
                 break;
         case ibft_eth_ip_addr:
-                if (!memcmp(nic->dhcp, nulls, sizeof(nic->dhcp)))
+                if (memcmp(nic->ip_addr, nulls, sizeof(nic->ip_addr)))
                         rc = 1;
                 break;
         case ibft_eth_subnet_mask:
-                if (!memcmp(nic->dhcp, nulls, sizeof(nic->dhcp)))
+                if (nic->subnet_mask_prefix)
                         rc = 1;
                 break;
         case ibft_eth_origin:
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index 3a22eb9be37..17b24c580c0 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -71,6 +71,7 @@ config DRM_I915
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
         select FB
+        select FRAMEBUFFER_CONSOLE if !EMBEDDED
         tristate "i915 driver"
         help
           Choose this option if you have a system that has Intel 830M, 845G,
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index a04639dc633..45890447fee 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -561,7 +561,6 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
         int saved_x, saved_y;
         struct drm_encoder *encoder;
         bool ret = true;
-        bool depth_changed, bpp_changed;
 
         adjusted_mode = drm_mode_duplicate(dev, mode);
 
@@ -570,15 +569,6 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
         if (!crtc->enabled)
                 return true;
 
-        if (old_fb && crtc->fb) {
-                depth_changed = (old_fb->depth != crtc->fb->depth);
-                bpp_changed = (old_fb->bits_per_pixel !=
-                               crtc->fb->bits_per_pixel);
-        } else {
-                depth_changed = true;
-                bpp_changed = true;
-        }
-
         saved_mode = crtc->mode;
         saved_x = crtc->x;
         saved_y = crtc->y;
@@ -590,15 +580,6 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
         crtc->x = x;
         crtc->y = y;
 
-        if (drm_mode_equal(&saved_mode, &crtc->mode)) {
-                if (saved_x != crtc->x || saved_y != crtc->y ||
-                    depth_changed || bpp_changed) {
-                        ret = !crtc_funcs->mode_set_base(crtc, crtc->x, crtc->y,
-                                                         old_fb);
-                        goto done;
-                }
-        }
-
         /* Pass our mode to the connectors and the CRTC to give them a chance to
          * adjust it according to limitations or connector properties, and also
          * a chance to reject the mode entirely.
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index c4ada8b6295..f01def16a66 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -456,7 +456,8 @@ int drm_ioctl(struct inode *inode, struct file *filp,
                 retcode = -EINVAL;
         } else if (((ioctl->flags & DRM_ROOT_ONLY) && !capable(CAP_SYS_ADMIN)) ||
                    ((ioctl->flags & DRM_AUTH) && !file_priv->authenticated) ||
-                   ((ioctl->flags & DRM_MASTER) && !file_priv->is_master)) {
+                   ((ioctl->flags & DRM_MASTER) && !file_priv->is_master) ||
+                   (!(ioctl->flags & DRM_CONTROL_ALLOW) && (file_priv->minor->type == DRM_MINOR_CONTROL))) {
                 retcode = -EACCES;
         } else {
                 if (cmd & (IOC_IN | IOC_OUT)) {
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index ef878615c49..b9631e3a1ea 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -402,14 +402,14 @@ int drm_get_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
         if (dev->driver->load) {
                 ret = dev->driver->load(dev, ent->driver_data);
                 if (ret)
-                        goto err_g3;
+                        goto err_g4;
         }
 
         /* setup the grouping for the legacy output */
         if (drm_core_check_feature(dev, DRIVER_MODESET)) {
                 ret = drm_mode_group_init_legacy_group(dev, &dev->primary->mode_group);
                 if (ret)
-                        goto err_g3;
+                        goto err_g4;
         }
 
         list_add_tail(&dev->driver_item, &driver->device_list);
@@ -420,8 +420,11 @@ int drm_get_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
 
         return 0;
 
-err_g3:
+err_g4:
         drm_put_minor(&dev->primary);
+err_g3:
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                drm_put_minor(&dev->control);
 err_g2:
         pci_disable_device(pdev);
 err_g1:
@@ -502,11 +505,11 @@ void drm_put_dev(struct drm_device *dev)
                 dev->agp = NULL;
         }
 
-        drm_ht_remove(&dev->map_hash);
-        drm_ctxbitmap_cleanup(dev);
-
         list_for_each_entry_safe(r_list, list_temp, &dev->maplist, head)
                 drm_rmmap(dev, r_list->map);
+        drm_ht_remove(&dev->map_hash);
+
+        drm_ctxbitmap_cleanup(dev);
 
         if (drm_core_check_feature(dev, DRIVER_MODESET))
                 drm_put_minor(&dev->control);
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index 022876ae34f..8f9372921f8 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -489,9 +489,7 @@ int drm_sysfs_device_add(struct drm_minor *minor)
 
         return 0;
 
-        device_unregister(&minor->kdev);
 err_out:
-
         return err;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 051134c56ae..53d54455262 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1011,8 +1011,16 @@ static int i915_load_modeset_init(struct drm_device *dev)
         /* Basic memrange allocator for stolen space (aka vram) */
         drm_mm_init(&dev_priv->vram, 0, prealloc_size);
 
-        /* Let GEM Manage from end of prealloc space to end of aperture */
-        i915_gem_do_init(dev, prealloc_size, agp_size);
+        /* Let GEM Manage from end of prealloc space to end of aperture.
+         *
+         * However, leave one page at the end still bound to the scratch page.
+         * There are a number of places where the hardware apparently
+         * prefetches past the end of the object, and we've seen multiple
+         * hangs with the GPU head pointer stuck in a batchbuffer bound
+         * at the last page of the aperture.  One page should be enough to
+         * keep any prefetching inside of the aperture.
+         */
+        i915_gem_do_init(dev, prealloc_size, agp_size - 4096);
 
         ret = i915_gem_init_ringbuffer(dev);
         if (ret)
@@ -1350,6 +1358,7 @@ struct drm_ioctl_desc i915_ioctls[] = {
         DRM_IOCTL_DEF(DRM_I915_GEM_SET_TILING, i915_gem_set_tiling, 0),
         DRM_IOCTL_DEF(DRM_I915_GEM_GET_TILING, i915_gem_get_tiling, 0),
         DRM_IOCTL_DEF(DRM_I915_GEM_GET_APERTURE, i915_gem_get_aperture_ioctl, 0),
+        DRM_IOCTL_DEF(DRM_I915_GET_PIPE_FROM_CRTC_ID, intel_get_pipe_from_crtc_id, 0),
 };
 
 int i915_max_ioctl = DRM_ARRAY_SIZE(i915_ioctls);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 25065923b8a..9b149fe824c 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -283,6 +283,7 @@ typedef struct drm_i915_private {
         u8 saveAR[21];
         u8 saveDACMASK;
         u8 saveCR[37];
+        uint64_t saveFENCE[16];
 
         struct {
                 struct drm_mm gtt_space;
@@ -705,13 +706,8 @@ extern void intel_modeset_cleanup(struct drm_device *dev);
 #define I915_WRITE16(reg, val)  writel(val, dev_priv->regs + (reg))
 #define I915_READ8(reg)         readb(dev_priv->regs + (reg))
 #define I915_WRITE8(reg, val)   writeb(val, dev_priv->regs + (reg))
-#ifdef writeq
 #define I915_WRITE64(reg, val)  writeq(val, dev_priv->regs + (reg))
-#else
-#define I915_WRITE64(reg, val)  (writel(val, dev_priv->regs + (reg)), \
-                                 writel(upper_32_bits(val), dev_priv->regs + \
-                                        (reg) + 4))
-#endif
+#define I915_READ64(reg)        readq(dev_priv->regs + (reg))
 #define POSTING_READ(reg)       (void)I915_READ(reg)
 
 #define I915_VERBOSE 0
@@ -790,7 +786,8 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
                        (dev)->pci_device == 0x2E22 || \
                        (dev)->pci_device == 0x2E32)
 
-#define IS_I965GM(dev) ((dev)->pci_device == 0x2A02)
+#define IS_I965GM(dev) ((dev)->pci_device == 0x2A02 || \
+                        (dev)->pci_device == 0x2A12)
 
 #define IS_GM45(dev) ((dev)->pci_device == 0x2A42)
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index ee896d91c5b..b189b49c760 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1691,11 +1691,20 @@ static int
 i915_wait_request(struct drm_device *dev, uint32_t seqno)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
+        u32 ier;
         int ret = 0;
 
         BUG_ON(seqno == 0);
 
         if (!i915_seqno_passed(i915_get_gem_seqno(dev), seqno)) {
+                ier = I915_READ(IER);
+                if (!ier) {
+                        DRM_ERROR("something (likely vbetool) disabled "
+                                  "interrupts, re-enabling\n");
+                        i915_driver_irq_preinstall(dev);
+                        i915_driver_irq_postinstall(dev);
+                }
+
                 dev_priv->mm.waiting_gem_seqno = seqno;
                 i915_user_irq_get(dev);
                 ret = wait_event_interruptible(dev_priv->irq_queue,
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 52119473226..15da44cf21b 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -526,6 +526,7 @@
 #define   DPLLA_INPUT_BUFFER_ENABLE     (1 << 0)
 #define D_STATE         0x6104
 #define CG_2D_DIS       0x6200
+#define DPCUNIT_CLOCK_GATE_DISABLE      (1 << 24)
 #define CG_3D_DIS       0x6204
 
 /*
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index d669cc2b42c..ce8a21344a7 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -349,6 +349,18 @@ int i915_save_state(struct drm_device *dev)
         for (i = 0; i < 3; i++)
                 dev_priv->saveSWF2[i] = I915_READ(SWF30 + (i << 2));
 
+        /* Fences */
+        if (IS_I965G(dev)) {
+                for (i = 0; i < 16; i++)
+                        dev_priv->saveFENCE[i] = I915_READ64(FENCE_REG_965_0 + (i * 8));
+        } else {
+                for (i = 0; i < 8; i++)
+                        dev_priv->saveFENCE[i] = I915_READ(FENCE_REG_830_0 + (i * 4));
+
+                if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
+                        for (i = 0; i < 8; i++)
+                                dev_priv->saveFENCE[i+8] = I915_READ(FENCE_REG_945_8 + (i * 4));
+        }
         i915_save_vga(dev);
 
         return 0;
@@ -371,6 +383,18 @@ int i915_restore_state(struct drm_device *dev)
         /* Display arbitration */
         I915_WRITE(DSPARB, dev_priv->saveDSPARB);
 
+        /* Fences */
+        if (IS_I965G(dev)) {
+                for (i = 0; i < 16; i++)
+                        I915_WRITE64(FENCE_REG_965_0 + (i * 8), dev_priv->saveFENCE[i]);
+        } else {
+                for (i = 0; i < 8; i++)
+                        I915_WRITE(FENCE_REG_830_0 + (i * 4), dev_priv->saveFENCE[i]);
+                if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
+                        for (i = 0; i < 8; i++)
+                                I915_WRITE(FENCE_REG_945_8 + (i * 4), dev_priv->saveFENCE[i+8]);
+        }
+
         /* Pipe & plane A info */
         /* Prime the clock */
         if (dev_priv->saveDPLL_A & DPLL_VCO_ENABLE) {
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 9bdd959260a..19148c3df63 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -161,7 +161,7 @@ static bool intel_crt_detect_hotplug(struct drm_connector *connector)
         hotplug_en &= CRT_FORCE_HOTPLUG_MASK;
         hotplug_en |= CRT_HOTPLUG_FORCE_DETECT;
 
-        if (IS_GM45(dev))
+        if (IS_G4X(dev))
                 hotplug_en |= CRT_HOTPLUG_ACTIVATION_PERIOD_64;
 
         hotplug_en |= CRT_HOTPLUG_VOLTAGE_COMPARE_50;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index bdcda36953b..3387cf32f38 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1804,6 +1804,37 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
         }
 }
 
+int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
+                                struct drm_file *file_priv)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_get_pipe_from_crtc_id *pipe_from_crtc_id = data;
+        struct drm_crtc *crtc = NULL;
+        int pipe = -1;
+
+        if (!dev_priv) {
+                DRM_ERROR("called with no initialization\n");
+                return -EINVAL;
+        }
+
+        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+                struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+                if (crtc->base.id == pipe_from_crtc_id->crtc_id) {
+                        pipe = intel_crtc->pipe;
+                        break;
+                }
+        }
+
+        if (pipe == -1) {
+                DRM_ERROR("no such CRTC id\n");
+                return -EINVAL;
+        }
+
+        pipe_from_crtc_id->pipe = pipe;
+
+       return 0;
+}
+
 struct drm_crtc *intel_get_crtc_from_pipe(struct drm_device *dev, int pipe)
 {
         struct drm_crtc *crtc = NULL;
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 957daef8edf..cd4b9c5f715 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -109,7 +109,7 @@ struct intel_i2c_chan *intel_i2c_create(struct drm_device *dev, const u32 reg,
 void intel_i2c_destroy(struct intel_i2c_chan *chan);
 int intel_ddc_get_modes(struct intel_output *intel_output);
 extern bool intel_ddc_probe(struct intel_output *intel_output);
-
+void intel_i2c_quirk_set(struct drm_device *dev, bool enable);
 extern void intel_crt_init(struct drm_device *dev);
 extern void intel_hdmi_init(struct drm_device *dev, int sdvox_reg);
 extern bool intel_sdvo_init(struct drm_device *dev, int output_device);
@@ -125,6 +125,8 @@ extern struct drm_encoder *intel_best_encoder(struct drm_connector *connector);
 
 extern struct drm_display_mode *intel_crtc_mode_get(struct drm_device *dev,
                                                     struct drm_crtc *crtc);
+int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
+                                struct drm_file *file_priv);
 extern void intel_wait_for_vblank(struct drm_device *dev);
 extern struct drm_crtc *intel_get_crtc_from_pipe(struct drm_device *dev, int pipe);
 extern struct drm_crtc *intel_get_load_detect_pipe(struct intel_output *intel_output,
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 3e094beecb9..e4652dcdd9b 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -864,7 +864,7 @@ static void intelfb_sysrq(int dummy1, struct tty_struct *dummy3)
 
 static struct sysrq_key_op sysrq_intelfb_restore_op = {
         .handler = intelfb_sysrq,
-        .help_msg = "force-fb(G)",
+        .help_msg = "force-fb(V)",
         .action_msg = "Restore framebuffer console",
 };
 
@@ -898,7 +898,7 @@ int intelfb_probe(struct drm_device *dev)
                 ret = intelfb_single_fb_probe(dev);
         }
 
-        register_sysrq_key('g', &sysrq_intelfb_restore_op);
+        register_sysrq_key('v', &sysrq_intelfb_restore_op);
 
         return ret;
 }
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 55037422538..d0983bb93a1 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -155,11 +155,18 @@ intel_hdmi_detect(struct drm_connector *connector)
 
         temp = I915_READ(PORT_HOTPLUG_EN);
 
-        I915_WRITE(PORT_HOTPLUG_EN,
-                   temp |
-                   HDMIB_HOTPLUG_INT_EN |
-                   HDMIC_HOTPLUG_INT_EN |
-                   HDMID_HOTPLUG_INT_EN);
+        switch (hdmi_priv->sdvox_reg) {
+        case SDVOB:
+                temp |= HDMIB_HOTPLUG_INT_EN;
+                break;
+        case SDVOC:
+                temp |= HDMIC_HOTPLUG_INT_EN;
+                break;
+        default:
+                return connector_status_unknown;
+        }
+
+        I915_WRITE(PORT_HOTPLUG_EN, temp);
 
         POSTING_READ(PORT_HOTPLUG_EN);
 
diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
index 5ee9d4c2575..f7061f68d05 100644
--- a/drivers/gpu/drm/i915/intel_i2c.c
+++ b/drivers/gpu/drm/i915/intel_i2c.c
@@ -34,6 +34,21 @@
 #include "i915_drm.h"
 #include "i915_drv.h"
 
+void intel_i2c_quirk_set(struct drm_device *dev, bool enable)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
+        /* When using bit bashing for I2C, this bit needs to be set to 1 */
+        if (!IS_IGD(dev))
+                return;
+        if (enable)
+                I915_WRITE(CG_2D_DIS,
+                        I915_READ(CG_2D_DIS) | DPCUNIT_CLOCK_GATE_DISABLE);
+        else
+                I915_WRITE(CG_2D_DIS,
+                        I915_READ(CG_2D_DIS) & (~DPCUNIT_CLOCK_GATE_DISABLE));
+}
+
 /*
  * Intel GPIO access functions
  */
@@ -153,8 +168,10 @@ struct intel_i2c_chan *intel_i2c_create(struct drm_device *dev, const u32 reg,
                 goto out_free;
 
         /* JJJ:  raise SCL and SDA? */
+        intel_i2c_quirk_set(dev, true);
         set_data(chan, 1);
         set_clock(chan, 1);
+        intel_i2c_quirk_set(dev, false);
         udelay(20);
 
         return chan;
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 6619f26e46a..439a8651499 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -384,7 +384,51 @@ static const struct drm_encoder_funcs intel_lvds_enc_funcs = {
         .destroy = intel_lvds_enc_destroy,
 };
 
+static int __init intel_no_lvds_dmi_callback(const struct dmi_system_id *id)
+{
+        DRM_DEBUG("Skipping LVDS initialization for %s\n", id->ident);
+        return 1;
+}
 
+/* These systems claim to have LVDS, but really don't */
+static const struct dmi_system_id __initdata intel_no_lvds[] = {
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "Apple Mac Mini (Core series)",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Macmini1,1"),
+                },
+        },
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "Apple Mac Mini (Core 2 series)",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Macmini2,1"),
+                },
+        },
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "MSI IM-945GSE-A",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "MSI"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "A9830IMS"),
+                },
+        },
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "Dell Studio Hybrid",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Studio Hybrid 140g"),
+                },
+        },
+
+        /* FIXME: add a check for the Aopen Mini PC */
+
+        { }     /* terminating entry */
+};
 
 /**
  * intel_lvds_init - setup LVDS connectors on this device
@@ -404,15 +448,9 @@ void intel_lvds_init(struct drm_device *dev)
         u32 lvds;
         int pipe;
 
-        /* Blacklist machines that we know falsely report LVDS. */
-        /* FIXME: add a check for the Aopen Mini PC */
-
-        /* Apple Mac Mini Core Duo and Mac Mini Core 2 Duo */
-        if(dmi_match(DMI_PRODUCT_NAME, "Macmini1,1") ||
-           dmi_match(DMI_PRODUCT_NAME, "Macmini2,1")) {
-                DRM_DEBUG("Skipping LVDS initialization for Apple Mac Mini\n");
+        /* Skip init on machines we know falsely report LVDS */
+        if (dmi_check_system(intel_no_lvds))
                 return;
-        }
 
         intel_output = kzalloc(sizeof(struct intel_output), GFP_KERNEL);
         if (!intel_output) {
diff --git a/drivers/gpu/drm/i915/intel_modes.c b/drivers/gpu/drm/i915/intel_modes.c
index 07d7ec97616..e0910fefce8 100644
--- a/drivers/gpu/drm/i915/intel_modes.c
+++ b/drivers/gpu/drm/i915/intel_modes.c
@@ -27,6 +27,7 @@
 #include <linux/fb.h>
 #include "drmP.h"
 #include "intel_drv.h"
+#include "i915_drv.h"
 
 /**
  * intel_ddc_probe
@@ -52,7 +53,10 @@ bool intel_ddc_probe(struct intel_output *intel_output)
                 }
         };
 
+        intel_i2c_quirk_set(intel_output->ddc_bus->drm_dev, true);
         ret = i2c_transfer(&intel_output->ddc_bus->adapter, msgs, 2);
+        intel_i2c_quirk_set(intel_output->ddc_bus->drm_dev, false);
+
         if (ret == 2)
                 return true;
 
@@ -70,8 +74,10 @@ int intel_ddc_get_modes(struct intel_output *intel_output)
         struct edid *edid;
         int ret = 0;
 
+        intel_i2c_quirk_set(intel_output->ddc_bus->drm_dev, true);
         edid = drm_get_edid(&intel_output->base,
                             &intel_output->ddc_bus->adapter);
+        intel_i2c_quirk_set(intel_output->ddc_bus->drm_dev, false);
         if (edid) {
                 drm_mode_connector_update_edid_property(&intel_output->base,
                                                         edid);
diff --git a/drivers/gpu/drm/r128/r128_cce.c b/drivers/gpu/drm/r128/r128_cce.c
index 32de4cedc36..077c0455a6b 100644
--- a/drivers/gpu/drm/r128/r128_cce.c
+++ b/drivers/gpu/drm/r128/r128_cce.c
@@ -511,9 +511,9 @@ static int r128_do_init_cce(struct drm_device * dev, drm_r128_init_t * init)
 
 #if __OS_HAS_AGP
         if (!dev_priv->is_pci) {
-                drm_core_ioremap(dev_priv->cce_ring, dev);
-                drm_core_ioremap(dev_priv->ring_rptr, dev);
-                drm_core_ioremap(dev->agp_buffer_map, dev);
+                drm_core_ioremap_wc(dev_priv->cce_ring, dev);
+                drm_core_ioremap_wc(dev_priv->ring_rptr, dev);
+                drm_core_ioremap_wc(dev->agp_buffer_map, dev);
                 if (!dev_priv->cce_ring->handle ||
                     !dev_priv->ring_rptr->handle ||
                     !dev->agp_buffer_map->handle) {
diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
index ed4d27e6ee6..8071d965f14 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.h
+++ b/drivers/gpu/drm/radeon/radeon_drv.h
@@ -99,9 +99,10 @@
  * 1.27- Add support for IGP GART
  * 1.28- Add support for VBL on CRTC2
  * 1.29- R500 3D cmd buffer support
+ * 1.30- Add support for occlusion queries
  */
 #define DRIVER_MAJOR            1
-#define DRIVER_MINOR            29
+#define DRIVER_MINOR            30
 #define DRIVER_PATCHLEVEL       0
 
 /*
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index 7359d9d88e4..acbce5745b0 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -151,7 +151,7 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
         if (fnmode) {
                 int do_translate;
 
-                trans = apple_find_translation((hid->product < 0x220 ||
+                trans = apple_find_translation((hid->product < 0x21d ||
                                         hid->product >= 0x300) ?
                                         powerbook_fn_keys : apple_fn_keys,
                                         usage->code);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 5746a5903bc..8551693d645 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1293,6 +1293,7 @@ static const struct hid_device_id hid_blacklist[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_FORCE3D_PRO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOMO_WHEEL) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOMO_WHEEL2) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G25_WHEEL) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_SIDEWINDER_GV) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K) },
@@ -1824,6 +1825,9 @@ int hid_check_keys_pressed(struct hid_device *hid)
         struct hid_input *hidinput;
         int i;
 
+        if (!(hid->claimed & HID_CLAIMED_INPUT))
+                return 0;
+
         list_for_each_entry(hidinput, &hid->inputs, list) {
                 for (i = 0; i < BITS_TO_LONGS(KEY_MAX); i++)
                         if (hidinput->input->key[i])
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index bdeda4c7cc1..4d5ee2bbc62 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -113,6 +113,11 @@
 #define USB_VENDOR_ID_BERKSHIRE         0x0c98
 #define USB_DEVICE_ID_BERKSHIRE_PCWD    0x1140
 
+#define USB_VENDOR_ID_CH                0x068e
+#define USB_DEVICE_ID_CH_PRO_PEDALS     0x00f2
+#define USB_DEVICE_ID_CH_COMBATSTICK    0x00f4
+#define USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE        0x00ff
+
 #define USB_VENDOR_ID_CHERRY            0x046a
 #define USB_DEVICE_ID_CHERRY_CYMOTION   0x0023
 
@@ -292,6 +297,7 @@
 #define USB_DEVICE_ID_LOGITECH_FORCE3D_PRO      0xc286
 #define USB_DEVICE_ID_LOGITECH_WHEEL    0xc294
 #define USB_DEVICE_ID_LOGITECH_MOMO_WHEEL       0xc295
+#define USB_DEVICE_ID_LOGITECH_G25_WHEEL        0xc299
 #define USB_DEVICE_ID_LOGITECH_ELITE_KBD        0xc30a
 #define USB_DEVICE_ID_S510_RECEIVER     0xc50c
 #define USB_DEVICE_ID_S510_RECEIVER_2   0xc517
diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
index 7b80cb69498..7afbaa0efd1 100644
--- a/drivers/hid/hid-lg.c
+++ b/drivers/hid/hid-lg.c
@@ -297,6 +297,8 @@ static const struct hid_device_id lg_devices[] = {
                 .driver_data = LG_FF },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOMO_WHEEL2),
                 .driver_data = LG_FF },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G25_WHEEL),
+                .driver_data = LG_FF },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2),
                 .driver_data = LG_FF2 },
         { }
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index e263d473117..00ccf4b1985 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -285,8 +285,10 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
 
                                 if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWNAME(0))) {
                                         int len;
-                                        if (!hid->name)
-                                                return 0;
+                                        if (!hid->name) {
+                                                ret = 0;
+                                                break;
+                                        }
                                         len = strlen(hid->name) + 1;
                                         if (len > _IOC_SIZE(cmd))
                                                 len = _IOC_SIZE(cmd);
@@ -297,8 +299,10 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
 
                                 if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWPHYS(0))) {
                                         int len;
-                                        if (!hid->phys)
-                                                return 0;
+                                        if (!hid->phys) {
+                                                ret = 0;
+                                                break;
+                                        }
                                         len = strlen(hid->phys) + 1;
                                         if (len > _IOC_SIZE(cmd))
                                                 len = _IOC_SIZE(cmd);
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 4306cb1b8ce..ac8049b5f1e 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -662,8 +662,8 @@ void usbhid_close(struct hid_device *hid)
         spin_lock_irq(&usbhid->lock);
         if (!--hid->open) {
                 spin_unlock_irq(&usbhid->lock);
+                hid_cancel_delayed_stuff(usbhid);
                 usb_kill_urb(usbhid->urbin);
-                flush_scheduled_work();
                 usbhid->intf->needs_remote_wakeup = 0;
         } else {
                 spin_unlock_irq(&usbhid->lock);
@@ -898,7 +898,7 @@ static int usbhid_parse(struct hid_device *hid)
                 goto err;
         }
 
-        hid->quirks = quirks;
+        hid->quirks |= quirks;
 
         return 0;
 err:
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 4391717d251..d8f7423f363 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -50,6 +50,9 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_COMBATSTICK, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index 0897edef257..bff0103610c 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -348,6 +348,7 @@ static int validate_hwmon_pack(struct atk_data *data, union acpi_object *obj)
         return 0;
 }
 
+#ifdef DEBUG
 static char const *atk_sensor_type(union acpi_object *flags)
 {
         u64 type = flags->integer.value & ATK_TYPE_MASK;
@@ -370,6 +371,7 @@ static char const *atk_sensor_type(union acpi_object *flags)
 
         return what;
 }
+#endif
 
 static void atk_print_sensor(struct atk_data *data, union acpi_object *obj)
 {
diff --git a/drivers/hwmon/w83781d.c b/drivers/hwmon/w83781d.c
index dbfb30c588d..0bdab959b73 100644
--- a/drivers/hwmon/w83781d.c
+++ b/drivers/hwmon/w83781d.c
@@ -1462,7 +1462,8 @@ static struct w83781d_data *w83781d_update_device(struct device *dev)
                                 data->pwm[i] =
                                     w83781d_read_value(data,
                                                        W83781D_REG_PWM[i]);
-                                if ((data->type != w83782d || !client->driver)
+                                /* Only W83782D on SMBus has PWM3 and PWM4 */
+                                if ((data->type != w83782d || !client)
                                     && i == 1)
                                         break;
                         }
diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c
index d420cc5f563..e25e13980af 100644
--- a/drivers/i2c/algos/i2c-algo-bit.c
+++ b/drivers/i2c/algos/i2c-algo-bit.c
@@ -104,7 +104,7 @@ static int sclhi(struct i2c_algo_bit_data *adap)
                  * chips may hold it low ("clock stretching") while they
                  * are processing data internally.
                  */
-                if (time_after_eq(jiffies, start + adap->timeout))
+                if (time_after(jiffies, start + adap->timeout))
                         return -ETIMEDOUT;
                 cond_resched();
         }
diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c
index 6318f7ddc1d..78d42aae008 100644
--- a/drivers/i2c/algos/i2c-algo-pca.c
+++ b/drivers/i2c/algos/i2c-algo-pca.c
@@ -287,10 +287,21 @@ static int pca_xfer(struct i2c_adapter *i2c_adap,
 
                 case 0x30: /* Data byte in I2CDAT has been transmitted; NOT ACK has been received */
                         DEB2("NOT ACK received after data byte\n");
+                        pca_stop(adap);
                         goto out;
 
                 case 0x38: /* Arbitration lost during SLA+W, SLA+R or data bytes */
                         DEB2("Arbitration lost\n");
+                        /*
+                         * The PCA9564 data sheet (2006-09-01) says "A
+                         * START condition will be transmitted when the
+                         * bus becomes free (STOP or SCL and SDA high)"
+                         * when the STA bit is set (p. 11).
+                         *
+                         * In case this won't work, try pca_reset()
+                         * instead.
+                         */
+                        pca_start(adap);
                         goto out;
 
                 case 0x58: /* Data byte has been received; NOT ACK has been returned */
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index a48c8aee021..f1c6ca7e285 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -467,7 +467,7 @@ config I2C_PXA_SLAVE
 
 config I2C_S3C2410
         tristate "S3C2410 I2C Driver"
-        depends on ARCH_S3C2410
+        depends on ARCH_S3C2410 || ARCH_S3C64XX
         help
           Say Y here to include support for I2C controller in the
           Samsung S3C2410 based System-on-Chip devices.
diff --git a/drivers/i2c/busses/i2c-ali1535.c b/drivers/i2c/busses/i2c-ali1535.c
index 981e080b32a..d108450df06 100644
--- a/drivers/i2c/busses/i2c-ali1535.c
+++ b/drivers/i2c/busses/i2c-ali1535.c
@@ -284,7 +284,7 @@ static int ali1535_transaction(struct i2c_adapter *adap)
                  && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 result = -ETIMEDOUT;
                 dev_err(&adap->dev, "SMBus Timeout!\n");
         }
diff --git a/drivers/i2c/busses/i2c-ali15x3.c b/drivers/i2c/busses/i2c-ali15x3.c
index 39066dee46e..d627fceb790 100644
--- a/drivers/i2c/busses/i2c-ali15x3.c
+++ b/drivers/i2c/busses/i2c-ali15x3.c
@@ -306,7 +306,7 @@ static int ali15x3_transaction(struct i2c_adapter *adap)
                  && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 result = -ETIMEDOUT;
                 dev_err(&adap->dev, "SMBus Timeout!\n");
         }
diff --git a/drivers/i2c/busses/i2c-amd756.c b/drivers/i2c/busses/i2c-amd756.c
index 220f4a1eee1..f7d6fe9c49b 100644
--- a/drivers/i2c/busses/i2c-amd756.c
+++ b/drivers/i2c/busses/i2c-amd756.c
@@ -126,7 +126,7 @@ static int amd756_transaction(struct i2c_adapter *adap)
                 } while ((temp & (GS_HST_STS | GS_SMB_STS)) &&
                          (timeout++ < MAX_TIMEOUT));
                 /* If the SMBus is still busy, we give up */
-                if (timeout >= MAX_TIMEOUT) {
+                if (timeout > MAX_TIMEOUT) {
                         dev_dbg(&adap->dev, "Busy wait timeout (%04x)\n", temp);
                         goto abort;
                 }
@@ -143,7 +143,7 @@ static int amd756_transaction(struct i2c_adapter *adap)
         } while ((temp & GS_HST_STS) && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 dev_dbg(&adap->dev, "Completion timeout!\n");
                 goto abort;
         }
diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
index 3fcf78e906d..b5db8b88361 100644
--- a/drivers/i2c/busses/i2c-cpm.c
+++ b/drivers/i2c/busses/i2c-cpm.c
@@ -531,16 +531,16 @@ static int __devinit cpm_i2c_setup(struct cpm_i2c *cpm)
         rbdf = cpm->rbase;
 
         for (i = 0; i < CPM_MAXBD; i++) {
-                cpm->rxbuf[i] = dma_alloc_coherent(
-                        NULL, CPM_MAX_READ + 1, &cpm->rxdma[i], GFP_KERNEL);
+                cpm->rxbuf[i] = dma_alloc_coherent(&cpm->ofdev->dev,
+                                                   CPM_MAX_READ + 1,
+                                                   &cpm->rxdma[i], GFP_KERNEL);
                 if (!cpm->rxbuf[i]) {
                         ret = -ENOMEM;
                         goto out_muram;
                 }
                 out_be32(&rbdf[i].cbd_bufaddr, ((cpm->rxdma[i] + 1) & ~1));
 
-                cpm->txbuf[i] = (unsigned char *)dma_alloc_coherent(
-                        NULL, CPM_MAX_READ + 1, &cpm->txdma[i], GFP_KERNEL);
+                cpm->txbuf[i] = (unsigned char *)dma_alloc_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1, &cpm->txdma[i], GFP_KERNEL);
                 if (!cpm->txbuf[i]) {
                         ret = -ENOMEM;
                         goto out_muram;
@@ -585,10 +585,10 @@ static int __devinit cpm_i2c_setup(struct cpm_i2c *cpm)
 out_muram:
         for (i = 0; i < CPM_MAXBD; i++) {
                 if (cpm->rxbuf[i])
-                        dma_free_coherent(NULL, CPM_MAX_READ + 1,
+                        dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
                                 cpm->rxbuf[i], cpm->rxdma[i]);
                 if (cpm->txbuf[i])
-                        dma_free_coherent(NULL, CPM_MAX_READ + 1,
+                        dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
                                 cpm->txbuf[i], cpm->txdma[i]);
         }
         cpm_muram_free(cpm->dp_addr);
@@ -619,9 +619,9 @@ static void cpm_i2c_shutdown(struct cpm_i2c *cpm)
 
         /* Free all memory */
         for (i = 0; i < CPM_MAXBD; i++) {
-                dma_free_coherent(NULL, CPM_MAX_READ + 1,
+                dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
                         cpm->rxbuf[i], cpm->rxdma[i]);
-                dma_free_coherent(NULL, CPM_MAX_READ + 1,
+                dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
                         cpm->txbuf[i], cpm->txdma[i]);
         }
 
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 10411848fd7..9d2c5adf5d4 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -237,7 +237,7 @@ static int i801_transaction(int xact)
                 status = inb_p(SMBHSTSTS);
         } while ((status & SMBHSTSTS_HOST_BUSY) && (timeout++ < MAX_TIMEOUT));
 
-        result = i801_check_post(status, timeout >= MAX_TIMEOUT);
+        result = i801_check_post(status, timeout > MAX_TIMEOUT);
         if (result < 0)
                 return result;
 
@@ -257,9 +257,9 @@ static void i801_wait_hwpec(void)
         } while ((!(status & SMBHSTSTS_INTR))
                  && (timeout++ < MAX_TIMEOUT));
 
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT)
                 dev_dbg(&I801_dev->dev, "PEC Timeout!\n");
-        }
+
         outb_p(status, SMBHSTSTS);
 }
 
@@ -344,7 +344,7 @@ static int i801_block_transaction_byte_by_byte(union i2c_smbus_data *data,
                 while ((!(status & SMBHSTSTS_BYTE_DONE))
                        && (timeout++ < MAX_TIMEOUT));
 
-                result = i801_check_post(status, timeout >= MAX_TIMEOUT);
+                result = i801_check_post(status, timeout > MAX_TIMEOUT);
                 if (result < 0)
                         return result;
 
diff --git a/drivers/i2c/busses/i2c-isch.c b/drivers/i2c/busses/i2c-isch.c
index b9c01aa9003..9f6b8e0f863 100644
--- a/drivers/i2c/busses/i2c-isch.c
+++ b/drivers/i2c/busses/i2c-isch.c
@@ -112,7 +112,7 @@ static int sch_transaction(void)
         } while ((temp & 0x08) && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 dev_err(&sch_adapter.dev, "SMBus Timeout!\n");
                 result = -ETIMEDOUT;
         }
diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
index 4af5c09f0e8..dd778d7ae04 100644
--- a/drivers/i2c/busses/i2c-mpc.c
+++ b/drivers/i2c/busses/i2c-mpc.c
@@ -164,7 +164,7 @@ static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing)
         return 0;
 }
 
-#ifdef CONFIG_PPC_52xx
+#ifdef CONFIG_PPC_MPC52xx
 static const struct mpc_i2c_divider mpc_i2c_dividers_52xx[] = {
         {20, 0x20}, {22, 0x21}, {24, 0x22}, {26, 0x23},
         {28, 0x24}, {30, 0x01}, {32, 0x25}, {34, 0x02},
@@ -188,7 +188,7 @@ static const struct mpc_i2c_divider mpc_i2c_dividers_52xx[] = {
 
 int mpc_i2c_get_fdr_52xx(struct device_node *node, u32 clock, int prescaler)
 {
-        const struct mpc52xx_i2c_divider *div = NULL;
+        const struct mpc_i2c_divider *div = NULL;
         unsigned int pvr = mfspr(SPRN_PVR);
         u32 divider;
         int i;
@@ -203,7 +203,7 @@ int mpc_i2c_get_fdr_52xx(struct device_node *node, u32 clock, int prescaler)
          * We want to choose an FDR/DFSR that generates an I2C bus speed that
          * is equal to or lower than the requested speed.
          */
-        for (i = 0; i < ARRAY_SIZE(mpc52xx_i2c_dividers); i++) {
+        for (i = 0; i < ARRAY_SIZE(mpc_i2c_dividers_52xx); i++) {
                 div = &mpc_i2c_dividers_52xx[i];
                 /* Old MPC5200 rev A CPUs do not support the high bits */
                 if (div->fdr & 0xc0 && pvr == 0x80822011)
@@ -219,20 +219,23 @@ static void mpc_i2c_setclock_52xx(struct device_node *node,
                                   struct mpc_i2c *i2c,
                                   u32 clock, u32 prescaler)
 {
-        int fdr = mpc52xx_i2c_get_fdr(node, clock, prescaler);
+        int ret, fdr;
+
+        ret = mpc_i2c_get_fdr_52xx(node, clock, prescaler);
+        fdr = (ret >= 0) ? ret : 0x3f; /* backward compatibility */
 
-        if (fdr < 0)
-                fdr = 0x3f; /* backward compatibility */
         writeb(fdr & 0xff, i2c->base + MPC_I2C_FDR);
-        dev_info(i2c->dev, "clock %d Hz (fdr=%d)\n", clock, fdr);
+
+        if (ret >= 0)
+                dev_info(i2c->dev, "clock %d Hz (fdr=%d)\n", clock, fdr);
 }
-#else /* !CONFIG_PPC_52xx */
+#else /* !CONFIG_PPC_MPC52xx */
 static void mpc_i2c_setclock_52xx(struct device_node *node,
                                   struct mpc_i2c *i2c,
                                   u32 clock, u32 prescaler)
 {
 }
-#endif /* CONFIG_PPC_52xx*/
+#endif /* CONFIG_PPC_MPC52xx*/
 
 #ifdef CONFIG_FSL_SOC
 static const struct mpc_i2c_divider mpc_i2c_dividers_8xxx[] = {
@@ -321,14 +324,17 @@ static void mpc_i2c_setclock_8xxx(struct device_node *node,
                                   struct mpc_i2c *i2c,
                                   u32 clock, u32 prescaler)
 {
-        int fdr = mpc_i2c_get_fdr_8xxx(node, clock, prescaler);
+        int ret, fdr;
+
+        ret = mpc_i2c_get_fdr_8xxx(node, clock, prescaler);
+        fdr = (ret >= 0) ? ret : 0x1031; /* backward compatibility */
 
-        if (fdr < 0)
-                fdr = 0x1031; /* backward compatibility */
         writeb(fdr & 0xff, i2c->base + MPC_I2C_FDR);
         writeb((fdr >> 8) & 0xff, i2c->base + MPC_I2C_DFSRR);
-        dev_info(i2c->dev, "clock %d Hz (dfsrr=%d fdr=%d)\n",
-                 clock, fdr >> 8, fdr & 0xff);
+
+        if (ret >= 0)
+                dev_info(i2c->dev, "clock %d Hz (dfsrr=%d fdr=%d)\n",
+                         clock, fdr >> 8, fdr & 0xff);
 }
 
 #else /* !CONFIG_FSL_SOC */
diff --git a/drivers/i2c/busses/i2c-nforce2.c b/drivers/i2c/busses/i2c-nforce2.c
index 2ff4683703a..ec11d1c4e77 100644
--- a/drivers/i2c/busses/i2c-nforce2.c
+++ b/drivers/i2c/busses/i2c-nforce2.c
@@ -173,7 +173,7 @@ static int nforce2_check_status(struct i2c_adapter *adap)
                 temp = inb_p(NVIDIA_SMB_STS);
         } while ((!temp) && (timeout++ < MAX_TIMEOUT));
 
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 dev_dbg(&adap->dev, "SMBus Timeout!\n");
                 if (smbus->can_abort)
                         nforce2_abort(adap);
diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
index c1405c8f6ba..acc7143d965 100644
--- a/drivers/i2c/busses/i2c-pxa.c
+++ b/drivers/i2c/busses/i2c-pxa.c
@@ -265,10 +265,10 @@ static int i2c_pxa_wait_bus_not_busy(struct pxa_i2c *i2c)
                 show_state(i2c);
         }
 
-        if (timeout <= 0)
+        if (timeout < 0)
                 show_state(i2c);
 
-        return timeout <= 0 ? I2C_RETRY : 0;
+        return timeout < 0 ? I2C_RETRY : 0;
 }
 
 static int i2c_pxa_wait_master(struct pxa_i2c *i2c)
@@ -612,7 +612,7 @@ static int i2c_pxa_pio_set_master(struct pxa_i2c *i2c)
                 show_state(i2c);
         }
 
-        if (timeout <= 0) {
+        if (timeout < 0) {
                 show_state(i2c);
                 dev_err(&i2c->adap.dev,
                         "i2c_pxa: timeout waiting for bus free\n");
diff --git a/drivers/i2c/busses/i2c-sis5595.c b/drivers/i2c/busses/i2c-sis5595.c
index f320ab27da4..139f0c7f12a 100644
--- a/drivers/i2c/busses/i2c-sis5595.c
+++ b/drivers/i2c/busses/i2c-sis5595.c
@@ -256,7 +256,7 @@ static int sis5595_transaction(struct i2c_adapter *adap)
         } while (!(temp & 0x40) && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 dev_dbg(&adap->dev, "SMBus Timeout!\n");
                 result = -ETIMEDOUT;
         }
diff --git a/drivers/i2c/busses/i2c-sis630.c b/drivers/i2c/busses/i2c-sis630.c
index 50c3610e602..70ca41e90e5 100644
--- a/drivers/i2c/busses/i2c-sis630.c
+++ b/drivers/i2c/busses/i2c-sis630.c
@@ -173,7 +173,7 @@ static int sis630_transaction_wait(struct i2c_adapter *adap, int size)
         } while (!(temp & 0x0e) && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 dev_dbg(&adap->dev, "SMBus Timeout!\n");
                 result = -ETIMEDOUT;
         }
diff --git a/drivers/i2c/busses/i2c-sis96x.c b/drivers/i2c/busses/i2c-sis96x.c
index 7e1594b4057..8295885b2fd 100644
--- a/drivers/i2c/busses/i2c-sis96x.c
+++ b/drivers/i2c/busses/i2c-sis96x.c
@@ -132,7 +132,7 @@ static int sis96x_transaction(int size)
         } while (!(temp & 0x0e) && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 dev_dbg(&sis96x_adapter.dev, "SMBus Timeout! (0x%02x)\n", temp);
                 result = -ETIMEDOUT;
         }
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index 3d4e0996976..925eb9e245d 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -312,7 +312,6 @@ static int cdrom_decode_status(ide_drive_t *drive, u8 stat)
         ide_hwif_t *hwif = drive->hwif;
         struct request *rq = hwif->rq;
         int err, sense_key, do_end_request = 0;
-        u8 quiet = rq->cmd_flags & REQ_QUIET;
 
         /* get the IDE error register */
         err = ide_read_error(drive);
@@ -347,7 +346,7 @@ static int cdrom_decode_status(ide_drive_t *drive, u8 stat)
                 } else {
                         cdrom_saw_media_change(drive);
 
-                        if (blk_fs_request(rq) && !quiet)
+                        if (blk_fs_request(rq) && !blk_rq_quiet(rq))
                                 printk(KERN_ERR PFX "%s: tray open\n",
                                         drive->name);
                 }
@@ -382,7 +381,7 @@ static int cdrom_decode_status(ide_drive_t *drive, u8 stat)
                  * No point in retrying after an illegal request or data
                  * protect error.
                  */
-                if (!quiet)
+                if (!blk_rq_quiet(rq))
                         ide_dump_status(drive, "command error", stat);
                 do_end_request = 1;
                 break;
@@ -391,14 +390,14 @@ static int cdrom_decode_status(ide_drive_t *drive, u8 stat)
                  * No point in re-trying a zillion times on a bad sector.
                  * If we got here the error is not correctable.
                  */
-                if (!quiet)
+                if (!blk_rq_quiet(rq))
                         ide_dump_status(drive, "media error "
                                         "(bad sector)", stat);
                 do_end_request = 1;
                 break;
         case BLANK_CHECK:
                 /* disk appears blank? */
-                if (!quiet)
+                if (!blk_rq_quiet(rq))
                         ide_dump_status(drive, "media error (blank)",
                                         stat);
                 do_end_request = 1;
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c
index 8d71086f5a1..62f9cf2f94e 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -410,6 +410,7 @@ int cxio_flush_sq(struct t3_wq *wq, struct t3_cq *cq, int count)
         ptr = wq->sq_rptr + count;
         sqp = wq->sq + Q_PTR2IDX(ptr, wq->sq_size_log2);
         while (ptr != wq->sq_wptr) {
+                sqp->signaled = 0;
                 insert_sq_cqe(wq, cq, sqp);
                 ptr++;
                 sqp = wq->sq + Q_PTR2IDX(ptr, wq->sq_size_log2);
diff --git a/drivers/infiniband/hw/ipath/ipath_fs.c b/drivers/infiniband/hw/ipath/ipath_fs.c
index 8dc2bb78160..b3684060465 100644
--- a/drivers/infiniband/hw/ipath/ipath_fs.c
+++ b/drivers/infiniband/hw/ipath/ipath_fs.c
@@ -347,7 +347,7 @@ static int ipathfs_fill_super(struct super_block *sb, void *data,
                 spin_unlock_irqrestore(&ipath_devs_lock, flags);
                 ret = create_device_files(sb, dd);
                 if (ret) {
-                        deactivate_super(sb);
+                        deactivate_locked_super(sb);
                         goto bail;
                 }
                 spin_lock_irqsave(&ipath_devs_lock, flags);
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index 9974e886b8d..8a7dd6795fa 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -86,6 +86,7 @@ struct mlx4_ib_mr {
 
 struct mlx4_ib_fast_reg_page_list {
         struct ib_fast_reg_page_list    ibfrpl;
+        __be64                         *mapped_page_list;
         dma_addr_t                      map;
 };
 
diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index 8e4d26d56a9..8f3666b20ea 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -231,7 +231,11 @@ struct ib_fast_reg_page_list *mlx4_ib_alloc_fast_reg_page_list(struct ib_device
         if (!mfrpl)
                 return ERR_PTR(-ENOMEM);
 
-        mfrpl->ibfrpl.page_list = dma_alloc_coherent(&dev->dev->pdev->dev,
+        mfrpl->ibfrpl.page_list = kmalloc(size, GFP_KERNEL);
+        if (!mfrpl->ibfrpl.page_list)
+                goto err_free;
+
+        mfrpl->mapped_page_list = dma_alloc_coherent(&dev->dev->pdev->dev,
                                                      size, &mfrpl->map,
                                                      GFP_KERNEL);
         if (!mfrpl->ibfrpl.page_list)
@@ -242,6 +246,7 @@ struct ib_fast_reg_page_list *mlx4_ib_alloc_fast_reg_page_list(struct ib_device
         return &mfrpl->ibfrpl;
 
 err_free:
+        kfree(mfrpl->ibfrpl.page_list);
         kfree(mfrpl);
         return ERR_PTR(-ENOMEM);
 }
@@ -252,8 +257,9 @@ void mlx4_ib_free_fast_reg_page_list(struct ib_fast_reg_page_list *page_list)
         struct mlx4_ib_fast_reg_page_list *mfrpl = to_mfrpl(page_list);
         int size = page_list->max_page_list_len * sizeof (u64);
 
-        dma_free_coherent(&dev->dev->pdev->dev, size, page_list->page_list,
+        dma_free_coherent(&dev->dev->pdev->dev, size, mfrpl->mapped_page_list,
                           mfrpl->map);
+        kfree(mfrpl->ibfrpl.page_list);
         kfree(mfrpl);
 }
 
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index f385a24d31d..20724aee76f 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1365,7 +1365,7 @@ static void set_fmr_seg(struct mlx4_wqe_fmr_seg *fseg, struct ib_send_wr *wr)
         int i;
 
         for (i = 0; i < wr->wr.fast_reg.page_list_len; ++i)
-                wr->wr.fast_reg.page_list->page_list[i] =
+                mfrpl->mapped_page_list[i] =
                         cpu_to_be64(wr->wr.fast_reg.page_list->page_list[i] |
                                     MLX4_MTT_FLAG_PRESENT);
 
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c
index 13d7674b293..75223f50de5 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.c
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.c
@@ -599,6 +599,7 @@ static struct scsi_host_template iscsi_iser_sht = {
         .eh_abort_handler       = iscsi_eh_abort,
         .eh_device_reset_handler= iscsi_eh_device_reset,
         .eh_target_reset_handler= iscsi_eh_target_reset,
+        .target_alloc           = iscsi_target_alloc,
         .use_clustering         = DISABLE_CLUSTERING,
         .proc_name              = "iscsi_iser",
         .this_id                = -1,
diff --git a/drivers/input/ff-memless.c b/drivers/input/ff-memless.c
index bc4e40f3ede..2d1415e1683 100644
--- a/drivers/input/ff-memless.c
+++ b/drivers/input/ff-memless.c
@@ -226,7 +226,7 @@ static int get_compatible_type(struct ff_device *ff, int effect_type)
  */
 static void ml_combine_effects(struct ff_effect *effect,
                                struct ml_effect_state *state,
-                               int gain)
+                               unsigned int gain)
 {
         struct ff_effect *new = state->effect;
         unsigned int strong, weak, i;
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 935a1835de2..e54e002665b 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -29,6 +29,23 @@ MODULE_LICENSE("GPL");
 
 #define INPUT_DEVICES   256
 
+/*
+ * EV_ABS events which should not be cached are listed here.
+ */
+static unsigned int input_abs_bypass_init_data[] __initdata = {
+        ABS_MT_TOUCH_MAJOR,
+        ABS_MT_TOUCH_MINOR,
+        ABS_MT_WIDTH_MAJOR,
+        ABS_MT_WIDTH_MINOR,
+        ABS_MT_ORIENTATION,
+        ABS_MT_POSITION_X,
+        ABS_MT_POSITION_Y,
+        ABS_MT_TOOL_TYPE,
+        ABS_MT_BLOB_ID,
+        0
+};
+static unsigned long input_abs_bypass[BITS_TO_LONGS(ABS_CNT)];
+
 static LIST_HEAD(input_dev_list);
 static LIST_HEAD(input_handler_list);
 
@@ -161,6 +178,10 @@ static void input_handle_event(struct input_dev *dev,
                                 disposition = INPUT_PASS_TO_HANDLERS;
                         }
                         break;
+                case SYN_MT_REPORT:
+                        dev->sync = 0;
+                        disposition = INPUT_PASS_TO_HANDLERS;
+                        break;
                 }
                 break;
 
@@ -192,6 +213,11 @@ static void input_handle_event(struct input_dev *dev,
         case EV_ABS:
                 if (is_event_supported(code, dev->absbit, ABS_MAX)) {
 
+                        if (test_bit(code, input_abs_bypass)) {
+                                disposition = INPUT_PASS_TO_HANDLERS;
+                                break;
+                        }
+
                         value = input_defuzz_abs_event(value,
                                         dev->abs[code], dev->absfuzz[code]);
 
@@ -1634,10 +1660,20 @@ static const struct file_operations input_fops = {
         .open = input_open_file,
 };
 
+static void __init input_init_abs_bypass(void)
+{
+        const unsigned int *p;
+
+        for (p = input_abs_bypass_init_data; *p; p++)
+                input_abs_bypass[BIT_WORD(*p)] |= BIT_MASK(*p);
+}
+
 static int __init input_init(void)
 {
         int err;
 
+        input_init_abs_bypass();
+
         err = class_register(&input_class);
         if (err) {
                 printk(KERN_ERR "input: unable to register input_dev class\n");
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 4224f011284..012a5e75399 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -843,7 +843,13 @@ static const struct input_device_id joydev_blacklist[] = {
                                 INPUT_DEVICE_ID_MATCH_KEYBIT,
                 .evbit = { BIT_MASK(EV_KEY) },
                 .keybit = { [BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH) },
-        },      /* Avoid itouchpads, touchscreens and tablets */
+        },      /* Avoid itouchpads and touchscreens */
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = { [BIT_WORD(BTN_DIGI)] = BIT_MASK(BTN_DIGI) },
+        },      /* Avoid tablets, digitisers and similar devices */
         { }     /* Terminating entry */
 };
 
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 444dec07e5d..df3f8aa6811 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -895,6 +895,13 @@ static unsigned int atkbd_amilo_pa1510_forced_release_keys[] = {
 };
 
 /*
+ * Amilo Xi 3650 key release for light touch bar not working
+ */
+static unsigned int atkbd_amilo_xi3650_forced_release_keys[] = {
+        0x67, 0xed, 0x90, 0xa2, 0x99, 0xa4, 0xae, 0xb0, -1U
+};
+
+/*
  * atkbd_set_keycode_table() initializes keyboard's keycode table
  * according to the selected scancode set
  */
@@ -1560,6 +1567,15 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
                 .callback = atkbd_setup_forced_release,
                 .driver_data = atkbd_amilo_pa1510_forced_release_keys,
         },
+        {
+                .ident = "Fujitsu Amilo Xi 3650",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 3650"),
+                },
+                .callback = atkbd_setup_forced_release,
+                .driver_data = atkbd_amilo_xi3650_forced_release_keys,
+        },
         { }
 };
 
diff --git a/drivers/input/keyboard/omap-keypad.c b/drivers/input/keyboard/omap-keypad.c
index 058fa8b02c2..87ec7b18ac6 100644
--- a/drivers/input/keyboard/omap-keypad.c
+++ b/drivers/input/keyboard/omap-keypad.c
@@ -100,8 +100,20 @@ static irqreturn_t omap_kp_interrupt(int irq, void *dev_id)
         /* disable keyboard interrupt and schedule for handling */
         if (cpu_is_omap24xx()) {
                 int i;
-                for (i = 0; i < omap_kp->rows; i++)
-                        disable_irq(gpio_to_irq(row_gpios[i]));
+
+                for (i = 0; i < omap_kp->rows; i++) {
+                        int gpio_irq = gpio_to_irq(row_gpios[i]);
+                        /*
+                         * The interrupt which we're currently handling should
+                         * be disabled _nosync() to avoid deadlocks waiting
+                         * for this handler to complete.  All others should
+                         * be disabled the regular way for SMP safety.
+                         */
+                        if (gpio_irq == irq)
+                                disable_irq_nosync(gpio_irq);
+                        else
+                                disable_irq(gpio_irq);
+                }
         } else
                 /* disable keyboard interrupt and schedule for handling */
                 omap_writew(1, OMAP_MPUIO_BASE + OMAP_MPUIO_KBD_MASKIT);
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index cbedf957cc5..daecc75c72e 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -37,6 +37,7 @@
 #define ALPS_FW_BK_2    0x40
 
 static const struct alps_model_info alps_model_data[] = {
+        { { 0x32, 0x02, 0x14 }, 0xf8, 0xf8, ALPS_PASS | ALPS_DUALPOINT }, /* Toshiba Salellite Pro M10 */
         { { 0x33, 0x02, 0x0a }, 0x88, 0xf8, ALPS_OLDPROTO },            /* UMAX-530T */
         { { 0x53, 0x02, 0x0a }, 0xf8, 0xf8, 0 },
         { { 0x53, 0x02, 0x14 }, 0xf8, 0xf8, 0 },
diff --git a/drivers/input/mouse/appletouch.c b/drivers/input/mouse/appletouch.c
index 454b96112f0..e0140fdc02a 100644
--- a/drivers/input/mouse/appletouch.c
+++ b/drivers/input/mouse/appletouch.c
@@ -255,15 +255,22 @@ MODULE_PARM_DESC(debug, "Activate debugging output");
  */
 static int atp_geyser_init(struct usb_device *udev)
 {
-        char data[8];
+        char *data;
         int size;
         int i;
+        int ret;
+
+        data = kmalloc(8, GFP_KERNEL);
+        if (!data) {
+                err("Out of memory");
+                return -ENOMEM;
+        }
 
         size = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
                         ATP_GEYSER_MODE_READ_REQUEST_ID,
                         USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
                         ATP_GEYSER_MODE_REQUEST_VALUE,
-                        ATP_GEYSER_MODE_REQUEST_INDEX, &data, 8, 5000);
+                        ATP_GEYSER_MODE_REQUEST_INDEX, data, 8, 5000);
 
         if (size != 8) {
                 dprintk("atp_geyser_init: read error\n");
@@ -271,7 +278,8 @@ static int atp_geyser_init(struct usb_device *udev)
                         dprintk("appletouch[%d]: %d\n", i, data[i]);
 
                 err("Failed to read mode from device.");
-                return -EIO;
+                ret = -EIO;
+                goto out_free;
         }
 
         /* Apply the mode switch */
@@ -281,7 +289,7 @@ static int atp_geyser_init(struct usb_device *udev)
                         ATP_GEYSER_MODE_WRITE_REQUEST_ID,
                         USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
                         ATP_GEYSER_MODE_REQUEST_VALUE,
-                        ATP_GEYSER_MODE_REQUEST_INDEX, &data, 8, 5000);
+                        ATP_GEYSER_MODE_REQUEST_INDEX, data, 8, 5000);
 
         if (size != 8) {
                 dprintk("atp_geyser_init: write error\n");
@@ -289,9 +297,13 @@ static int atp_geyser_init(struct usb_device *udev)
                         dprintk("appletouch[%d]: %d\n", i, data[i]);
 
                 err("Failed to request geyser raw mode");
-                return -EIO;
+                ret = -EIO;
+                goto out_free;
         }
-        return 0;
+        ret = 0;
+out_free:
+        kfree(data);
+        return ret;
 }
 
 /*
diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
index 2998a6ac9ae..2d8fc0bf692 100644
--- a/drivers/input/mouse/bcm5974.c
+++ b/drivers/input/mouse/bcm5974.c
@@ -51,6 +51,10 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING2_ANSI    0x0230
 #define USB_DEVICE_ID_APPLE_WELLSPRING2_ISO     0x0231
 #define USB_DEVICE_ID_APPLE_WELLSPRING2_JIS     0x0232
+/* Macbook5,1 (unibody), aka wellspring3 */
+#define USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI    0x0236
+#define USB_DEVICE_ID_APPLE_WELLSPRING3_ISO     0x0237
+#define USB_DEVICE_ID_APPLE_WELLSPRING3_JIS     0x0238
 
 #define BCM5974_DEVICE(prod) {                                  \
         .match_flags = (USB_DEVICE_ID_MATCH_DEVICE |            \
@@ -72,6 +76,10 @@ static const struct usb_device_id bcm5974_table[] = {
         BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING2_ANSI),
         BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING2_ISO),
         BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING2_JIS),
+        /* Macbook5,1 */
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING3_ISO),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING3_JIS),
         /* Terminating entry */
         {}
 };
@@ -96,14 +104,23 @@ struct bt_data {
         u8 rel_y;               /* relative y coordinate */
 };
 
-/* trackpad header structure */
-struct tp_header {
-        u8 unknown1[16];        /* constants, timers, etc */
-        u8 fingers;             /* number of fingers on trackpad */
-        u8 unknown2[9];         /* constants, timers, etc */
+/* trackpad header types */
+enum tp_type {
+        TYPE1,                  /* plain trackpad */
+        TYPE2                   /* button integrated in trackpad */
 };
 
-/* trackpad finger structure */
+/* trackpad finger data offsets, le16-aligned */
+#define FINGER_TYPE1            (13 * sizeof(__le16))
+#define FINGER_TYPE2            (15 * sizeof(__le16))
+
+/* trackpad button data offsets */
+#define BUTTON_TYPE2            15
+
+/* list of device capability bits */
+#define HAS_INTEGRATED_BUTTON   1
+
+/* trackpad finger structure, le16-aligned */
 struct tp_finger {
         __le16 origin;          /* zero when switching track finger */
         __le16 abs_x;           /* absolute x coodinate */
@@ -117,13 +134,11 @@ struct tp_finger {
         __le16 force_minor;     /* trackpad force, minor axis? */
         __le16 unused[3];       /* zeros */
         __le16 multi;           /* one finger: varies, more fingers: constant */
-};
+} __attribute__((packed,aligned(2)));
 
-/* trackpad data structure, empirically at least ten fingers */
-struct tp_data {
-        struct tp_header header;
-        struct tp_finger finger[16];
-};
+/* trackpad finger data size, empirically at least ten fingers */
+#define SIZEOF_FINGER           sizeof(struct tp_finger)
+#define SIZEOF_ALL_FINGERS      (16 * SIZEOF_FINGER)
 
 /* device-specific parameters */
 struct bcm5974_param {
@@ -136,9 +151,12 @@ struct bcm5974_param {
 /* device-specific configuration */
 struct bcm5974_config {
         int ansi, iso, jis;     /* the product id of this device */
+        int caps;               /* device capability bitmask */
         int bt_ep;              /* the endpoint of the button interface */
         int bt_datalen;         /* data length of the button interface */
         int tp_ep;              /* the endpoint of the trackpad interface */
+        enum tp_type tp_type;   /* type of trackpad interface */
+        int tp_offset;          /* offset to trackpad finger data */
         int tp_datalen;         /* data length of the trackpad interface */
         struct bcm5974_param p; /* finger pressure limits */
         struct bcm5974_param w; /* finger width limits */
@@ -158,7 +176,7 @@ struct bcm5974 {
         struct urb *bt_urb;             /* button usb request block */
         struct bt_data *bt_data;        /* button transferred data */
         struct urb *tp_urb;             /* trackpad usb request block */
-        struct tp_data *tp_data;        /* trackpad transferred data */
+        u8 *tp_data;                    /* trackpad transferred data */
         int fingers;                    /* number of fingers on trackpad */
 };
 
@@ -183,8 +201,9 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 USB_DEVICE_ID_APPLE_WELLSPRING_ANSI,
                 USB_DEVICE_ID_APPLE_WELLSPRING_ISO,
                 USB_DEVICE_ID_APPLE_WELLSPRING_JIS,
+                0,
                 0x84, sizeof(struct bt_data),
-                0x81, sizeof(struct tp_data),
+                0x81, TYPE1, FINGER_TYPE1, FINGER_TYPE1 + SIZEOF_ALL_FINGERS,
                 { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 256 },
                 { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
                 { DIM_X, DIM_X / SN_COORD, -4824, 5342 },
@@ -194,13 +213,26 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 USB_DEVICE_ID_APPLE_WELLSPRING2_ANSI,
                 USB_DEVICE_ID_APPLE_WELLSPRING2_ISO,
                 USB_DEVICE_ID_APPLE_WELLSPRING2_JIS,
+                0,
                 0x84, sizeof(struct bt_data),
-                0x81, sizeof(struct tp_data),
+                0x81, TYPE1, FINGER_TYPE1, FINGER_TYPE1 + SIZEOF_ALL_FINGERS,
                 { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 256 },
                 { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
                 { DIM_X, DIM_X / SN_COORD, -4824, 4824 },
                 { DIM_Y, DIM_Y / SN_COORD, -172, 4290 }
         },
+        {
+                USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI,
+                USB_DEVICE_ID_APPLE_WELLSPRING3_ISO,
+                USB_DEVICE_ID_APPLE_WELLSPRING3_JIS,
+                HAS_INTEGRATED_BUTTON,
+                0x84, sizeof(struct bt_data),
+                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
+                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
+                { DIM_X, DIM_X / SN_COORD, -4460, 5166 },
+                { DIM_Y, DIM_Y / SN_COORD, -75, 6700 }
+        },
         {}
 };
 
@@ -257,6 +289,7 @@ static void setup_events_to_report(struct input_dev *input_dev,
         __set_bit(BTN_TOOL_FINGER, input_dev->keybit);
         __set_bit(BTN_TOOL_DOUBLETAP, input_dev->keybit);
         __set_bit(BTN_TOOL_TRIPLETAP, input_dev->keybit);
+        __set_bit(BTN_TOOL_QUADTAP, input_dev->keybit);
         __set_bit(BTN_LEFT, input_dev->keybit);
 }
 
@@ -266,6 +299,11 @@ static int report_bt_state(struct bcm5974 *dev, int size)
         if (size != sizeof(struct bt_data))
                 return -EIO;
 
+        dprintk(7,
+                "bcm5974: button data: %x %x %x %x\n",
+                dev->bt_data->unknown1, dev->bt_data->button,
+                dev->bt_data->rel_x, dev->bt_data->rel_y);
+
         input_report_key(dev->input, BTN_LEFT, dev->bt_data->button);
         input_sync(dev->input);
 
@@ -276,29 +314,37 @@ static int report_bt_state(struct bcm5974 *dev, int size)
 static int report_tp_state(struct bcm5974 *dev, int size)
 {
         const struct bcm5974_config *c = &dev->cfg;
-        const struct tp_finger *f = dev->tp_data->finger;
+        const struct tp_finger *f;
         struct input_dev *input = dev->input;
-        const int fingers = (size - 26) / 28;
-        int raw_p, raw_w, raw_x, raw_y;
-        int ptest = 0, origin = 0, nmin = 0, nmax = 0;
+        int raw_p, raw_w, raw_x, raw_y, raw_n;
+        int ptest = 0, origin = 0, ibt = 0, nmin = 0, nmax = 0;
         int abs_p = 0, abs_w = 0, abs_x = 0, abs_y = 0;
 
-        if (size < 26 || (size - 26) % 28 != 0)
+        if (size < c->tp_offset || (size - c->tp_offset) % SIZEOF_FINGER != 0)
                 return -EIO;
 
+        /* finger data, le16-aligned */
+        f = (const struct tp_finger *)(dev->tp_data + c->tp_offset);
+        raw_n = (size - c->tp_offset) / SIZEOF_FINGER;
+
         /* always track the first finger; when detached, start over */
-        if (fingers) {
+        if (raw_n) {
                 raw_p = raw2int(f->force_major);
                 raw_w = raw2int(f->size_major);
                 raw_x = raw2int(f->abs_x);
                 raw_y = raw2int(f->abs_y);
 
                 dprintk(9,
-                        "bcm5974: raw: p: %+05d w: %+05d x: %+05d y: %+05d\n",
-                        raw_p, raw_w, raw_x, raw_y);
+                        "bcm5974: "
+                        "raw: p: %+05d w: %+05d x: %+05d y: %+05d n: %d\n",
+                        raw_p, raw_w, raw_x, raw_y, raw_n);
 
                 ptest = int2bound(&c->p, raw_p);
                 origin = raw2int(f->origin);
+
+                /* set the integrated button if applicable */
+                if (c->tp_type == TYPE2)
+                        ibt = raw2int(dev->tp_data[BUTTON_TYPE2]);
         }
 
         /* while tracking finger still valid, count all fingers */
@@ -307,12 +353,13 @@ static int report_tp_state(struct bcm5974 *dev, int size)
                 abs_w = int2bound(&c->w, raw_w);
                 abs_x = int2bound(&c->x, raw_x - c->x.devmin);
                 abs_y = int2bound(&c->y, c->y.devmax - raw_y);
-                for (; f != dev->tp_data->finger + fingers; f++) {
+                while (raw_n--) {
                         ptest = int2bound(&c->p, raw2int(f->force_major));
                         if (ptest > PRESSURE_LOW)
                                 nmax++;
                         if (ptest > PRESSURE_HIGH)
                                 nmin++;
+                        f++;
                 }
         }
 
@@ -324,7 +371,8 @@ static int report_tp_state(struct bcm5974 *dev, int size)
         input_report_key(input, BTN_TOUCH, dev->fingers > 0);
         input_report_key(input, BTN_TOOL_FINGER, dev->fingers == 1);
         input_report_key(input, BTN_TOOL_DOUBLETAP, dev->fingers == 2);
-        input_report_key(input, BTN_TOOL_TRIPLETAP, dev->fingers > 2);
+        input_report_key(input, BTN_TOOL_TRIPLETAP, dev->fingers == 3);
+        input_report_key(input, BTN_TOOL_QUADTAP, dev->fingers > 3);
 
         input_report_abs(input, ABS_PRESSURE, abs_p);
         input_report_abs(input, ABS_TOOL_WIDTH, abs_w);
@@ -335,11 +383,15 @@ static int report_tp_state(struct bcm5974 *dev, int size)
 
                 dprintk(8,
                         "bcm5974: abs: p: %+05d w: %+05d x: %+05d y: %+05d "
-                        "nmin: %d nmax: %d n: %d\n",
-                        abs_p, abs_w, abs_x, abs_y, nmin, nmax, dev->fingers);
+                        "nmin: %d nmax: %d n: %d ibt: %d\n", abs_p, abs_w,
+                        abs_x, abs_y, nmin, nmax, dev->fingers, ibt);
 
         }
 
+        /* type 2 reports button events via ibt only */
+        if (c->tp_type == TYPE2)
+                input_report_key(input, BTN_LEFT, ibt);
+
         input_sync(input);
 
         return 0;
@@ -649,6 +701,8 @@ static int bcm5974_probe(struct usb_interface *iface,
         input_dev->name = "bcm5974";
         input_dev->phys = dev->phys;
         usb_to_input_id(dev->udev, &input_dev->id);
+        /* report driver capabilities via the version field */
+        input_dev->id.version = cfg->caps;
         input_dev->dev.parent = &iface->dev;
 
         input_set_drvdata(input_dev, dev);
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 6ab0eb1ada1..4bc78892ba9 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1,7 +1,7 @@
 /*
- * Elantech Touchpad driver (v5)
+ * Elantech Touchpad driver (v6)
  *
- * Copyright (C) 2007-2008 Arjan Opmeer <arjan@opmeer.net>
+ * Copyright (C) 2007-2009 Arjan Opmeer <arjan@opmeer.net>
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License version 2 as published
@@ -178,6 +178,7 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
         struct elantech_data *etd = psmouse->private;
         unsigned char *packet = psmouse->packet;
         int fingers;
+        static int old_fingers;
 
         if (etd->fw_version_maj == 0x01) {
                 /* byte 0:  D   U  p1  p2   1  p3   R   L
@@ -190,6 +191,14 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
                 fingers = (packet[0] & 0xc0) >> 6;
         }
 
+        if (etd->jumpy_cursor) {
+                /* Discard packets that are likely to have bogus coordinates */
+                if (fingers > old_fingers) {
+                        elantech_debug("elantech.c: discarding packet\n");
+                        goto discard_packet_v1;
+                }
+        }
+
         input_report_key(dev, BTN_TOUCH, fingers != 0);
 
         /* byte 2: x7  x6  x5  x4  x3  x2  x1  x0
@@ -216,6 +225,9 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
         }
 
         input_sync(dev);
+
+ discard_packet_v1:
+        old_fingers = fingers;
 }
 
 /*
@@ -363,9 +375,14 @@ static int elantech_set_absolute_mode(struct psmouse *psmouse)
                         rc = -1;
                         break;
                 }
+        }
+
+        if (rc == 0) {
                 /*
-                 * Read back reg 0x10. The touchpad is probably initalising
-                 * and not ready until we read back the value we just wrote.
+                 * Read back reg 0x10. For hardware version 1 we must make
+                 * sure the absolute mode bit is set. For hardware version 2
+                 * the touchpad is probably initalising and not ready until
+                 * we read back the value we just wrote.
                  */
                 do {
                         rc = elantech_read_reg(psmouse, 0x10, &val);
@@ -373,12 +390,18 @@ static int elantech_set_absolute_mode(struct psmouse *psmouse)
                                 break;
                         tries--;
                         elantech_debug("elantech.c: retrying read (%d).\n",
-                                tries);
+                                        tries);
                         msleep(ETP_READ_BACK_DELAY);
                 } while (tries > 0);
-                if (rc)
+
+                if (rc) {
                         pr_err("elantech.c: failed to read back register 0x10.\n");
-                break;
+                } else if (etd->hw_version == 1 &&
+                           !(val & ETP_R10_ABSOLUTE_MODE)) {
+                        pr_err("elantech.c: touchpad refuses "
+                                "to switch to absolute mode.\n");
+                        rc = -1;
+                }
         }
 
         if (rc)
@@ -662,6 +685,17 @@ int elantech_init(struct psmouse *psmouse)
                 param[0], param[1], param[2]);
         etd->capabilities = param[0];
 
+        /*
+         * This firmware seems to suffer from misreporting coordinates when
+         * a touch action starts causing the mouse cursor or scrolled page
+         * to jump. Enable a workaround.
+         */
+        if (etd->fw_version_maj == 0x02 && etd->fw_version_min == 0x22) {
+                pr_info("elantech.c: firmware version 2.34 detected, "
+                        "enabling jumpy cursor workaround\n");
+                etd->jumpy_cursor = 1;
+        }
+
         if (elantech_set_absolute_mode(psmouse)) {
                 pr_err("elantech.c: failed to put touchpad into absolute mode.\n");
                 goto init_fail;
diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
index bee282b540b..ed848cc8081 100644
--- a/drivers/input/mouse/elantech.h
+++ b/drivers/input/mouse/elantech.h
@@ -1,7 +1,7 @@
 /*
- * Elantech Touchpad driver (v5)
+ * Elantech Touchpad driver (v6)
  *
- * Copyright (C) 2007-2008 Arjan Opmeer <arjan@opmeer.net>
+ * Copyright (C) 2007-2009 Arjan Opmeer <arjan@opmeer.net>
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License version 2 as published
@@ -104,6 +104,7 @@ struct elantech_data {
         unsigned char fw_version_min;
         unsigned char hw_version;
         unsigned char paritycheck;
+        unsigned char jumpy_cursor;
         unsigned char parity[256];
 };
 
diff --git a/drivers/input/mouse/lifebook.c b/drivers/input/mouse/lifebook.c
index df81b0aaa9f..15ac3205ac0 100644
--- a/drivers/input/mouse/lifebook.c
+++ b/drivers/input/mouse/lifebook.c
@@ -61,6 +61,12 @@ static const struct dmi_system_id lifebook_dmi_table[] = {
                 },
         },
         {
+                .ident = "Lifebook B-2130",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_NAME, "ZEPHYR"),
+                },
+        },
+        {
                 .ident = "Lifebook B213x/B2150",
                 .matches = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook B2131/B2133/B2150"),
diff --git a/drivers/input/serio/sa1111ps2.c b/drivers/input/serio/sa1111ps2.c
index 57953c0eb82..f412c69478a 100644
--- a/drivers/input/serio/sa1111ps2.c
+++ b/drivers/input/serio/sa1111ps2.c
@@ -77,7 +77,7 @@ static irqreturn_t ps2_txint(int irq, void *dev_id)
         spin_lock(&ps2if->lock);
         status = sa1111_readl(ps2if->base + SA1111_PS2STAT);
         if (ps2if->head == ps2if->tail) {
-                disable_irq(irq);
+                disable_irq_nosync(irq);
                 /* done */
         } else if (status & PS2STAT_TXE) {
                 sa1111_writel(ps2if->buf[ps2if->tail], ps2if->base + SA1111_PS2DATA);
diff --git a/drivers/input/tablet/wacom.h b/drivers/input/tablet/wacom.h
index 677680e9f54..9710bfd49cf 100644
--- a/drivers/input/tablet/wacom.h
+++ b/drivers/input/tablet/wacom.h
@@ -11,7 +11,7 @@
  *  Copyright (c) 2000 Daniel Egger             <egger@suse.de>
  *  Copyright (c) 2001 Frederic Lepied          <flepied@mandrakesoft.com>
  *  Copyright (c) 2004 Panagiotis Issaris       <panagiotis.issaris@mech.kuleuven.ac.be>
- *  Copyright (c) 2002-2008 Ping Cheng          <pingc@wacom.com>
+ *  Copyright (c) 2002-2009 Ping Cheng          <pingc@wacom.com>
  *
  *  ChangeLog:
  *      v0.1 (vp)  - Initial release
@@ -67,6 +67,7 @@
  *      v1.47 (pc) - Added support for Bamboo
  *      v1.48 (pc) - Added support for Bamboo1, BambooFun, and Cintiq 12WX
  *      v1.49 (pc) - Added support for USB Tablet PC (0x90, 0x93, and 0x9A)
+ *      v1.50 (pc) - Fixed a TabletPC touch bug in 2.6.28
  */
 
 /*
@@ -87,7 +88,7 @@
 /*
  * Version Information
  */
-#define DRIVER_VERSION "v1.49"
+#define DRIVER_VERSION "v1.50"
 #define DRIVER_AUTHOR "Vojtech Pavlik <vojtech@ucw.cz>"
 #define DRIVER_DESC "USB Wacom Graphire and Wacom Intuos tablet driver"
 #define DRIVER_LICENSE "GPL"
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index 484496daa0f..b8624f27abf 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -289,6 +289,7 @@ static int wacom_parse_hid(struct usb_interface *intf, struct hid_descriptor *hi
                         5000); /* 5 secs */
         } while (result < 0 && limit++ < 5);
 
+        /* No need to parse the Descriptor. It isn't an error though */
         if (result < 0)
                 goto out;
 
@@ -368,9 +369,8 @@ static int wacom_parse_hid(struct usb_interface *intf, struct hid_descriptor *hi
                 }
         }
 
-        result = 0;
-
  out:
+        result = 0;
         kfree(report);
         return result;
 }
@@ -425,6 +425,15 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
 
         endpoint = &intf->cur_altsetting->endpoint[0].desc;
 
+        /* Initialize touch_x_max and touch_y_max in case it is not defined */
+        if (wacom_wac->features->type == TABLETPC) {
+                features->touch_x_max = 1023;
+                features->touch_y_max = 1023;
+        } else {
+                features->touch_x_max = 0;
+                features->touch_y_max = 0;
+        }
+
         /* TabletPC need to retrieve the physical and logical maximum from report descriptor */
         if (wacom_wac->features->type == TABLETPC) {
                 if (usb_get_extra_descriptor(interface, HID_DEVICET_HID, &hid_desc)) {
diff --git a/drivers/input/touchscreen/tsc2007.c b/drivers/input/touchscreen/tsc2007.c
index 4ab07024689..948e167557f 100644
--- a/drivers/input/touchscreen/tsc2007.c
+++ b/drivers/input/touchscreen/tsc2007.c
@@ -200,8 +200,9 @@ static int tsc2007_read_values(struct tsc2007 *tsc)
 static enum hrtimer_restart tsc2007_timer(struct hrtimer *handle)
 {
         struct tsc2007 *ts = container_of(handle, struct tsc2007, timer);
+        unsigned long flags;
 
-        spin_lock_irq(&ts->lock);
+        spin_lock_irqsave(&ts->lock, flags);
 
         if (unlikely(!ts->get_pendown_state() && ts->pendown)) {
                 struct input_dev *input = ts->input;
@@ -222,7 +223,7 @@ static enum hrtimer_restart tsc2007_timer(struct hrtimer *handle)
                 tsc2007_send_event(ts);
         }
 
-        spin_unlock_irq(&ts->lock);
+        spin_unlock_irqrestore(&ts->lock, flags);
 
         return HRTIMER_NORESTART;
 }
@@ -235,7 +236,7 @@ static irqreturn_t tsc2007_irq(int irq, void *handle)
         spin_lock_irqsave(&ts->lock, flags);
 
         if (likely(ts->get_pendown_state())) {
-                disable_irq(ts->irq);
+                disable_irq_nosync(ts->irq);
                 hrtimer_start(&ts->timer, ktime_set(0, TS_POLL_DELAY),
                                         HRTIMER_MODE_REL);
         }
diff --git a/drivers/input/touchscreen/ucb1400_ts.c b/drivers/input/touchscreen/ucb1400_ts.c
index e868264fe79..f100c7f4c1d 100644
--- a/drivers/input/touchscreen/ucb1400_ts.c
+++ b/drivers/input/touchscreen/ucb1400_ts.c
@@ -256,7 +256,7 @@ static irqreturn_t ucb1400_hard_irq(int irqnr, void *devid)
         struct ucb1400_ts *ucb = devid;
 
         if (irqnr == ucb->irq) {
-                disable_irq(ucb->irq);
+                disable_irq_nosync(ucb->irq);
                 ucb->irq_pending = 1;
                 wake_up(&ucb->ts_wait);
                 return IRQ_HANDLED;
diff --git a/drivers/isdn/capi/capifs.c b/drivers/isdn/capi/capifs.c
index b129409925a..bff72d81f26 100644
--- a/drivers/isdn/capi/capifs.c
+++ b/drivers/isdn/capi/capifs.c
@@ -75,15 +75,17 @@ static int capifs_remount(struct super_block *s, int *flags, char *data)
                 }
         }
 
-        kfree(s->s_options);
-        s->s_options = new_opt;
+        mutex_lock(&s->s_root->d_inode->i_mutex);
 
+        replace_mount_options(s, new_opt);
         config.setuid  = setuid;
         config.setgid  = setgid;
         config.uid     = uid;
         config.gid     = gid;
         config.mode    = mode;
 
+        mutex_unlock(&s->s_root->d_inode->i_mutex);
+
         return 0;
 }
 
@@ -154,13 +156,16 @@ void capifs_new_ncci(unsigned int number, dev_t device)
         if (!inode)
                 return;
         inode->i_ino = number+2;
+
+        dentry = get_node(number);
+
+        /* config contents is protected by root's i_mutex */
         inode->i_uid = config.setuid ? config.uid : current_fsuid();
         inode->i_gid = config.setgid ? config.gid : current_fsgid();
         inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
         init_special_inode(inode, S_IFCHR|config.mode, device);
         //inode->i_op = &capifs_file_inode_operations;
 
-        dentry = get_node(number);
         if (!IS_ERR(dentry) && !dentry->d_inode)
                 d_instantiate(dentry, inode);
         mutex_unlock(&capifs_root->d_inode->i_mutex);
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 1fb91edc7de..47c68bc75a1 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -986,6 +986,9 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
                         oldindex = index;
                         oldpage = page;
 
+                        bitmap->filemap[bitmap->file_pages++] = page;
+                        bitmap->last_page_size = count;
+
                         if (outofdate) {
                                 /*
                                  * if bitmap is out of date, dirty the
@@ -998,15 +1001,9 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
                                 write_page(bitmap, page, 1);
 
                                 ret = -EIO;
-                                if (bitmap->flags & BITMAP_WRITE_ERROR) {
-                                        /* release, page not in filemap yet */
-                                        put_page(page);
+                                if (bitmap->flags & BITMAP_WRITE_ERROR)
                                         goto err;
-                                }
                         }
-
-                        bitmap->filemap[bitmap->file_pages++] = page;
-                        bitmap->last_page_size = count;
                 }
                 paddr = kmap_atomic(page, KM_USER0);
                 if (bitmap->flags & BITMAP_HOSTENDIAN)
@@ -1016,9 +1013,11 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
                 kunmap_atomic(paddr, KM_USER0);
                 if (b) {
                         /* if the disk bit is set, set the memory bit */
-                        bitmap_set_memory_bits(bitmap, i << CHUNK_BLOCK_SHIFT(bitmap),
-                                               ((i+1) << (CHUNK_BLOCK_SHIFT(bitmap)) >= start)
-                                );
+                        int needed = ((sector_t)(i+1) << (CHUNK_BLOCK_SHIFT(bitmap))
+                                      >= start);
+                        bitmap_set_memory_bits(bitmap,
+                                               (sector_t)i << CHUNK_BLOCK_SHIFT(bitmap),
+                                               needed);
                         bit_cnt++;
                         set_page_attr(bitmap, page, BITMAP_PAGE_CLEAN);
                 }
@@ -1154,8 +1153,9 @@ void bitmap_daemon_work(struct bitmap *bitmap)
                         spin_lock_irqsave(&bitmap->lock, flags);
                         clear_page_attr(bitmap, page, BITMAP_PAGE_CLEAN);
                 }
-                bmc = bitmap_get_counter(bitmap, j << CHUNK_BLOCK_SHIFT(bitmap),
-                                        &blocks, 0);
+                bmc = bitmap_get_counter(bitmap,
+                                         (sector_t)j << CHUNK_BLOCK_SHIFT(bitmap),
+                                         &blocks, 0);
                 if (bmc) {
 /*
   if (j < 100) printk("bitmap: j=%lu, *bmc = 0x%x\n", j, *bmc);
@@ -1169,7 +1169,8 @@ void bitmap_daemon_work(struct bitmap *bitmap)
                         } else if (*bmc == 1) {
                                 /* we can clear the bit */
                                 *bmc = 0;
-                                bitmap_count_page(bitmap, j << CHUNK_BLOCK_SHIFT(bitmap),
+                                bitmap_count_page(bitmap,
+                                                  (sector_t)j << CHUNK_BLOCK_SHIFT(bitmap),
                                                   -1);
 
                                 /* clear the bit */
@@ -1514,7 +1515,7 @@ void bitmap_dirty_bits(struct bitmap *bitmap, unsigned long s, unsigned long e)
         unsigned long chunk;
 
         for (chunk = s; chunk <= e; chunk++) {
-                sector_t sec = chunk << CHUNK_BLOCK_SHIFT(bitmap);
+                sector_t sec = (sector_t)chunk << CHUNK_BLOCK_SHIFT(bitmap);
                 bitmap_set_memory_bits(bitmap, sec, 1);
                 bitmap_file_set_bit(bitmap, sec);
         }
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 612343fdde9..fccc8343a25 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3066,11 +3066,8 @@ array_state_store(mddev_t *mddev, const char *buf, size_t len)
                         } else
                                 err = -EBUSY;
                         spin_unlock_irq(&mddev->write_lock);
-                } else {
-                        mddev->ro = 0;
-                        mddev->recovery_cp = MaxSector;
-                        err = do_md_run(mddev);
-                }
+                } else
+                        err = -EINVAL;
                 break;
         case active:
                 if (mddev->pers) {
@@ -4297,6 +4294,7 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
 {
         int err = 0;
         struct gendisk *disk = mddev->gendisk;
+        mdk_rdev_t *rdev;
 
         if (atomic_read(&mddev->openers) > is_open) {
                 printk("md: %s still in use.\n",mdname(mddev));
@@ -4339,6 +4337,13 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
                         /* tell userspace to handle 'inactive' */
                         sysfs_notify_dirent(mddev->sysfs_state);
 
+                        list_for_each_entry(rdev, &mddev->disks, same_set)
+                                if (rdev->raid_disk >= 0) {
+                                        char nm[20];
+                                        sprintf(nm, "rd%d", rdev->raid_disk);
+                                        sysfs_remove_link(&mddev->kobj, nm);
+                                }
+
                         set_capacity(disk, 0);
                         mddev->changed = 1;
 
@@ -4359,7 +4364,6 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
          * Free resources if final stop
          */
         if (mode == 0) {
-                mdk_rdev_t *rdev;
 
                 printk(KERN_INFO "md: %s stopped.\n", mdname(mddev));
 
@@ -4371,13 +4375,6 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
                 }
                 mddev->bitmap_offset = 0;
 
-                list_for_each_entry(rdev, &mddev->disks, same_set)
-                        if (rdev->raid_disk >= 0) {
-                                char nm[20];
-                                sprintf(nm, "rd%d", rdev->raid_disk);
-                                sysfs_remove_link(&mddev->kobj, nm);
-                        }
-
                 /* make sure all md_delayed_delete calls have finished */
                 flush_scheduled_work();
 
@@ -5705,37 +5702,38 @@ static void status_unused(struct seq_file *seq)
 
 static void status_resync(struct seq_file *seq, mddev_t * mddev)
 {
-        sector_t max_blocks, resync, res;
-        unsigned long dt, db, rt;
+        sector_t max_sectors, resync, res;
+        unsigned long dt, db;
+        sector_t rt;
         int scale;
         unsigned int per_milli;
 
-        resync = (mddev->curr_resync - atomic_read(&mddev->recovery_active))/2;
+        resync = mddev->curr_resync - atomic_read(&mddev->recovery_active);
 
         if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery))
-                max_blocks = mddev->resync_max_sectors >> 1;
+                max_sectors = mddev->resync_max_sectors;
         else
-                max_blocks = mddev->dev_sectors / 2;
+                max_sectors = mddev->dev_sectors;
 
         /*
          * Should not happen.
          */
-        if (!max_blocks) {
+        if (!max_sectors) {
                 MD_BUG();
                 return;
         }
         /* Pick 'scale' such that (resync>>scale)*1000 will fit
-         * in a sector_t, and (max_blocks>>scale) will fit in a
+         * in a sector_t, and (max_sectors>>scale) will fit in a
          * u32, as those are the requirements for sector_div.
          * Thus 'scale' must be at least 10
          */
         scale = 10;
         if (sizeof(sector_t) > sizeof(unsigned long)) {
-                while ( max_blocks/2 > (1ULL<<(scale+32)))
+                while ( max_sectors/2 > (1ULL<<(scale+32)))
                         scale++;
         }
         res = (resync>>scale)*1000;
-        sector_div(res, (u32)((max_blocks>>scale)+1));
+        sector_div(res, (u32)((max_sectors>>scale)+1));
 
         per_milli = res;
         {
@@ -5756,25 +5754,35 @@ static void status_resync(struct seq_file *seq, mddev_t * mddev)
                      (test_bit(MD_RECOVERY_SYNC, &mddev->recovery) ?
                       "resync" : "recovery"))),
                    per_milli/10, per_milli % 10,
-                   (unsigned long long) resync,
-                   (unsigned long long) max_blocks);
+                   (unsigned long long) resync/2,
+                   (unsigned long long) max_sectors/2);
 
         /*
-         * We do not want to overflow, so the order of operands and
-         * the * 100 / 100 trick are important. We do a +1 to be
-         * safe against division by zero. We only estimate anyway.
-         *
          * dt: time from mark until now
          * db: blocks written from mark until now
          * rt: remaining time
+         *
+         * rt is a sector_t, so could be 32bit or 64bit.
+         * So we divide before multiply in case it is 32bit and close
+         * to the limit.
+         * We scale the divisor (db) by 32 to avoid loosing precision
+         * near the end of resync when the number of remaining sectors
+         * is close to 'db'.
+         * We then divide rt by 32 after multiplying by db to compensate.
+         * The '+1' avoids division by zero if db is very small.
          */
         dt = ((jiffies - mddev->resync_mark) / HZ);
         if (!dt) dt++;
         db = (mddev->curr_mark_cnt - atomic_read(&mddev->recovery_active))
                 - mddev->resync_mark_cnt;
-        rt = (dt * ((unsigned long)(max_blocks-resync) / (db/2/100+1)))/100;
 
-        seq_printf(seq, " finish=%lu.%lumin", rt / 60, (rt % 60)/6);
+        rt = max_sectors - resync;    /* number of remaining sectors */
+        sector_div(rt, db/32+1);
+        rt *= dt;
+        rt >>= 5;
+
+        seq_printf(seq, " finish=%lu.%lumin", (unsigned long)rt / 60,
+                   ((unsigned long)rt % 60)/6);
 
         seq_printf(seq, " speed=%ldK/sec", db/2/dt);
 }
@@ -5965,7 +5973,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
         return 0;
 }
 
-static struct seq_operations md_seq_ops = {
+static const struct seq_operations md_seq_ops = {
         .start  = md_seq_start,
         .next   = md_seq_next,
         .stop   = md_seq_stop,
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 81a54f17417..499620afb44 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1809,17 +1809,17 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                                 r10_bio->sector = sect;
 
                                 raid10_find_phys(conf, r10_bio);
-                                /* Need to check if this section will still be
+
+                                /* Need to check if the array will still be
                                  * degraded
                                  */
-                                for (j=0; j<conf->copies;j++) {
-                                        int d = r10_bio->devs[j].devnum;
-                                        if (conf->mirrors[d].rdev == NULL ||
-                                            test_bit(Faulty, &conf->mirrors[d].rdev->flags)) {
+                                for (j=0; j<conf->raid_disks; j++)
+                                        if (conf->mirrors[j].rdev == NULL ||
+                                            test_bit(Faulty, &conf->mirrors[j].rdev->flags)) {
                                                 still_degraded = 1;
                                                 break;
                                         }
-                                }
+
                                 must_sync = bitmap_start_sync(mddev->bitmap, sect,
                                                               &sync_blocks, still_degraded);
 
diff --git a/drivers/media/radio/radio-sf16fmi.c b/drivers/media/radio/radio-sf16fmi.c
index 1dba8f0832a..5cf6c45b91f 100644
--- a/drivers/media/radio/radio-sf16fmi.c
+++ b/drivers/media/radio/radio-sf16fmi.c
@@ -153,7 +153,7 @@ static int vidioc_g_tuner(struct file *file, void *priv,
         mult = (fmi->flags & V4L2_TUNER_CAP_LOW) ? 1 : 1000;
         v->rangelow = RSF16_MINFREQ / mult;
         v->rangehigh = RSF16_MAXFREQ / mult;
-        v->rxsubchans = V4L2_TUNER_SUB_MONO | V4L2_TUNER_MODE_STEREO;
+        v->rxsubchans = V4L2_TUNER_SUB_MONO | V4L2_TUNER_SUB_STEREO;
         v->capability = fmi->flags & V4L2_TUNER_CAP_LOW;
         v->audmode = V4L2_TUNER_MODE_STEREO;
         v->signal = fmi_getsigstr(fmi);
diff --git a/drivers/media/radio/radio-sf16fmr2.c b/drivers/media/radio/radio-sf16fmr2.c
index c09ca8600ea..935ff9bcdfc 100644
--- a/drivers/media/radio/radio-sf16fmr2.c
+++ b/drivers/media/radio/radio-sf16fmr2.c
@@ -233,7 +233,7 @@ static int vidioc_g_tuner(struct file *file, void *priv,
         mult = (fmr2->flags & V4L2_TUNER_CAP_LOW) ? 1 : 1000;
         v->rangelow = RSF16_MINFREQ / mult;
         v->rangehigh = RSF16_MAXFREQ / mult;
-        v->rxsubchans = V4L2_TUNER_SUB_MONO | V4L2_TUNER_MODE_STEREO;
+        v->rxsubchans = V4L2_TUNER_SUB_MONO | V4L2_TUNER_SUB_STEREO;
         v->capability = fmr2->flags&V4L2_TUNER_CAP_LOW;
         v->audmode = fmr2->stereo ? V4L2_TUNER_MODE_STEREO:
                                 V4L2_TUNER_MODE_MONO;
diff --git a/drivers/media/video/cafe_ccic.c b/drivers/media/video/cafe_ccic.c
index 5f582726985..c4d181dde1c 100644
--- a/drivers/media/video/cafe_ccic.c
+++ b/drivers/media/video/cafe_ccic.c
@@ -774,6 +774,7 @@ static int cafe_cam_init(struct cafe_camera *cam)
         ret = __cafe_cam_reset(cam);
         if (ret)
                 goto out;
+        chip.ident = V4L2_IDENT_NONE;
         chip.match.type = V4L2_CHIP_MATCH_I2C_ADDR;
         chip.match.addr = cam->sensor_addr;
         ret = sensor_call(cam, core, g_chip_ident, &chip);
diff --git a/drivers/media/video/cx23885/cx23885-dvb.c b/drivers/media/video/cx23885/cx23885-dvb.c
index 0c49a98213c..1dc070da865 100644
--- a/drivers/media/video/cx23885/cx23885-dvb.c
+++ b/drivers/media/video/cx23885/cx23885-dvb.c
@@ -472,7 +472,7 @@ static int dvb_register(struct cx23885_tsport *port)
                         static struct xc2028_ctrl ctl = {
                                 .fname       = XC2028_DEFAULT_FIRMWARE,
                                 .max_len     = 64,
-                                .scode_table = XC3028_FE_OREN538,
+                                .demod       = XC3028_FE_OREN538,
                         };
 
                         fe = dvb_attach(xc2028_attach,
diff --git a/drivers/media/video/ivtv/ivtv-driver.c b/drivers/media/video/ivtv/ivtv-driver.c
index b0195e8ee4d..db2ac9a99ac 100644
--- a/drivers/media/video/ivtv/ivtv-driver.c
+++ b/drivers/media/video/ivtv/ivtv-driver.c
@@ -305,14 +305,17 @@ int ivtv_waitq(wait_queue_head_t *waitq)
 /* Generic utility functions */
 int ivtv_msleep_timeout(unsigned int msecs, int intr)
 {
-        int ret;
         int timeout = msecs_to_jiffies(msecs);
 
         do {
                 set_current_state(intr ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
                 timeout = schedule_timeout(timeout);
-                if (intr && (ret = signal_pending(current)))
-                        return ret;
+                if (intr) {
+                        int ret = signal_pending(current);
+
+                        if (ret)
+                                return ret;
+                }
         } while (timeout);
         return 0;
 }
diff --git a/drivers/media/video/ivtv/ivtv-gpio.c b/drivers/media/video/ivtv/ivtv-gpio.c
index ceb05bdcaf6..85ac707228e 100644
--- a/drivers/media/video/ivtv/ivtv-gpio.c
+++ b/drivers/media/video/ivtv/ivtv-gpio.c
@@ -190,8 +190,8 @@ static int subdev_g_tuner(struct v4l2_subdev *sd, struct v4l2_tuner *vt)
 
         mask = itv->card->gpio_audio_detect.mask;
         if (mask == 0 || (read_reg(IVTV_REG_GPIO_IN) & mask))
-                vt->rxsubchans = V4L2_TUNER_MODE_STEREO |
-                        V4L2_TUNER_MODE_LANG1 | V4L2_TUNER_MODE_LANG2;
+                vt->rxsubchans = V4L2_TUNER_SUB_STEREO |
+                        V4L2_TUNER_SUB_LANG1 | V4L2_TUNER_SUB_LANG2;
         else
                 vt->rxsubchans = V4L2_TUNER_SUB_MONO;
         return 0;
diff --git a/drivers/media/video/ivtv/ivtv-ioctl.c b/drivers/media/video/ivtv/ivtv-ioctl.c
index 4a2d464f055..c342a9fe983 100644
--- a/drivers/media/video/ivtv/ivtv-ioctl.c
+++ b/drivers/media/video/ivtv/ivtv-ioctl.c
@@ -180,7 +180,7 @@ int ivtv_set_speed(struct ivtv *itv, int speed)
 
                 /* Wait for any DMA to finish */
                 prepare_to_wait(&itv->dma_waitq, &wait, TASK_INTERRUPTIBLE);
-                while (itv->i_flags & IVTV_F_I_DMA) {
+                while (test_bit(IVTV_F_I_DMA, &itv->i_flags)) {
                         got_sig = signal_pending(current);
                         if (got_sig)
                                 break;
@@ -1710,7 +1710,8 @@ static int ivtv_decoder_ioctls(struct file *filp, unsigned int cmd, void *arg)
                            we are waiting unlock first and later lock again. */
                         mutex_unlock(&itv->serialize_lock);
                         prepare_to_wait(&itv->event_waitq, &wait, TASK_INTERRUPTIBLE);
-                        if ((itv->i_flags & (IVTV_F_I_EV_DEC_STOPPED|IVTV_F_I_EV_VSYNC)) == 0)
+                        if (!test_bit(IVTV_F_I_EV_DEC_STOPPED, &itv->i_flags) &&
+                            !test_bit(IVTV_F_I_EV_VSYNC, &itv->i_flags))
                                 schedule();
                         finish_wait(&itv->event_waitq, &wait);
                         mutex_lock(&itv->serialize_lock);
diff --git a/drivers/media/video/ivtv/ivtv-irq.c b/drivers/media/video/ivtv/ivtv-irq.c
index 01c14d2b381..cd9db0bf33b 100644
--- a/drivers/media/video/ivtv/ivtv-irq.c
+++ b/drivers/media/video/ivtv/ivtv-irq.c
@@ -196,7 +196,7 @@ static int stream_enc_dma_append(struct ivtv_stream *s, u32 data[CX2341X_MBOX_MA
                                 bytes_needed, s->name);
                 return -1;
         }
-        if (rc && !s->buffers_stolen && (s->s_flags & IVTV_F_S_APPL_IO)) {
+        if (rc && !s->buffers_stolen && test_bit(IVTV_F_S_APPL_IO, &s->s_flags)) {
                 IVTV_WARN("All %s stream buffers are full. Dropping data.\n", s->name);
                 IVTV_WARN("Cause: the application is not reading fast enough.\n");
         }
diff --git a/drivers/media/video/ivtv/ivtv-yuv.c b/drivers/media/video/ivtv/ivtv-yuv.c
index 7912ed6b72e..c0875378acc 100644
--- a/drivers/media/video/ivtv/ivtv-yuv.c
+++ b/drivers/media/video/ivtv/ivtv-yuv.c
@@ -1063,7 +1063,8 @@ static int ivtv_yuv_udma_frame(struct ivtv *itv, struct ivtv_dma_frame *args)
         prepare_to_wait(&itv->dma_waitq, &wait, TASK_INTERRUPTIBLE);
         /* if no UDMA is pending and no UDMA is in progress, then the DMA
            is finished */
-        while (itv->i_flags & (IVTV_F_I_UDMA_PENDING | IVTV_F_I_UDMA)) {
+        while (test_bit(IVTV_F_I_UDMA_PENDING, &itv->i_flags) ||
+               test_bit(IVTV_F_I_UDMA, &itv->i_flags)) {
                 /* don't interrupt if the DMA is in progress but break off
                    a still pending DMA. */
                 got_sig = signal_pending(current);
diff --git a/drivers/media/video/ivtv/ivtvfb.c b/drivers/media/video/ivtv/ivtvfb.c
index 66e6eb51307..fa6bb85cb4b 100644
--- a/drivers/media/video/ivtv/ivtvfb.c
+++ b/drivers/media/video/ivtv/ivtvfb.c
@@ -298,7 +298,8 @@ static int ivtvfb_prep_dec_dma_to_device(struct ivtv *itv,
         prepare_to_wait(&itv->dma_waitq, &wait, TASK_INTERRUPTIBLE);
         /* if no UDMA is pending and no UDMA is in progress, then the DMA
            is finished */
-        while (itv->i_flags & (IVTV_F_I_UDMA_PENDING | IVTV_F_I_UDMA)) {
+        while (test_bit(IVTV_F_I_UDMA_PENDING, &itv->i_flags) ||
+               test_bit(IVTV_F_I_UDMA, &itv->i_flags)) {
                 /* don't interrupt if the DMA is in progress but break off
                    a still pending DMA. */
                 got_sig = signal_pending(current);
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 399412d7f02..507dc85646b 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -1726,14 +1726,17 @@ static int uvc_suspend(struct usb_interface *intf, pm_message_t message)
 static int __uvc_resume(struct usb_interface *intf, int reset)
 {
         struct uvc_device *dev = usb_get_intfdata(intf);
-        int ret;
 
         uvc_trace(UVC_TRACE_SUSPEND, "Resuming interface %u\n",
                 intf->cur_altsetting->desc.bInterfaceNumber);
 
         if (intf->cur_altsetting->desc.bInterfaceSubClass == SC_VIDEOCONTROL) {
-                if (reset && (ret = uvc_ctrl_resume_device(dev)) < 0)
-                        return ret;
+                if (reset) {
+                        int ret = uvc_ctrl_resume_device(dev);
+
+                        if (ret < 0)
+                                return ret;
+                }
 
                 return uvc_status_resume(dev);
         }
diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index a95e17329c5..6ce974d7362 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -742,7 +742,7 @@ static int uvc_alloc_urb_buffers(struct uvc_video_device *video,
 
         /* Buffers are already allocated, bail out. */
         if (video->urb_size)
-                return 0;
+                return video->urb_size / psize;
 
         /* Compute the number of packets. Bulk endpoints might transfer UVC
          * payloads accross multiple URBs.
diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c
index 88f10d6cbc9..be64a502ea2 100644
--- a/drivers/media/video/v4l2-ioctl.c
+++ b/drivers/media/video/v4l2-ioctl.c
@@ -42,6 +42,12 @@
                         printk(KERN_DEBUG "%s: " fmt, vfd->name, ## arg);\
                 } while (0)
 
+/* Zero out the end of the struct pointed to by p.  Everthing after, but
+ * not including, the specified field is cleared. */
+#define CLEAR_AFTER_FIELD(p, field) \
+        memset((u8 *)(p) + offsetof(typeof(*(p)), field) + sizeof((p)->field), \
+        0, sizeof(*(p)) - offsetof(typeof(*(p)), field) - sizeof((p)->field))
+
 struct std_descr {
         v4l2_std_id std;
         const char *descr;
@@ -544,39 +550,39 @@ static int check_fmt(const struct v4l2_ioctl_ops *ops, enum v4l2_buf_type type)
 
         switch (type) {
         case V4L2_BUF_TYPE_VIDEO_CAPTURE:
-                if (ops->vidioc_try_fmt_vid_cap)
+                if (ops->vidioc_g_fmt_vid_cap)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_VIDEO_OVERLAY:
-                if (ops->vidioc_try_fmt_vid_overlay)
+                if (ops->vidioc_g_fmt_vid_overlay)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_VIDEO_OUTPUT:
-                if (ops->vidioc_try_fmt_vid_out)
+                if (ops->vidioc_g_fmt_vid_out)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
-                if (ops->vidioc_try_fmt_vid_out_overlay)
+                if (ops->vidioc_g_fmt_vid_out_overlay)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_VBI_CAPTURE:
-                if (ops->vidioc_try_fmt_vbi_cap)
+                if (ops->vidioc_g_fmt_vbi_cap)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_VBI_OUTPUT:
-                if (ops->vidioc_try_fmt_vbi_out)
+                if (ops->vidioc_g_fmt_vbi_out)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE:
-                if (ops->vidioc_try_fmt_sliced_vbi_cap)
+                if (ops->vidioc_g_fmt_sliced_vbi_cap)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT:
-                if (ops->vidioc_try_fmt_sliced_vbi_out)
+                if (ops->vidioc_g_fmt_sliced_vbi_out)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_PRIVATE:
-                if (ops->vidioc_try_fmt_type_private)
+                if (ops->vidioc_g_fmt_type_private)
                         return 0;
                 break;
         }
@@ -782,44 +788,53 @@ static long __video_do_ioctl(struct file *file,
 
                 switch (f->type) {
                 case V4L2_BUF_TYPE_VIDEO_CAPTURE:
+                        CLEAR_AFTER_FIELD(f, fmt.pix);
                         v4l_print_pix_fmt(vfd, &f->fmt.pix);
                         if (ops->vidioc_s_fmt_vid_cap)
                                 ret = ops->vidioc_s_fmt_vid_cap(file, fh, f);
                         break;
                 case V4L2_BUF_TYPE_VIDEO_OVERLAY:
+                        CLEAR_AFTER_FIELD(f, fmt.win);
                         if (ops->vidioc_s_fmt_vid_overlay)
                                 ret = ops->vidioc_s_fmt_vid_overlay(file,
                                                                     fh, f);
                         break;
                 case V4L2_BUF_TYPE_VIDEO_OUTPUT:
+                        CLEAR_AFTER_FIELD(f, fmt.pix);
                         v4l_print_pix_fmt(vfd, &f->fmt.pix);
                         if (ops->vidioc_s_fmt_vid_out)
                                 ret = ops->vidioc_s_fmt_vid_out(file, fh, f);
                         break;
                 case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
+                        CLEAR_AFTER_FIELD(f, fmt.win);
                         if (ops->vidioc_s_fmt_vid_out_overlay)
                                 ret = ops->vidioc_s_fmt_vid_out_overlay(file,
                                         fh, f);
                         break;
                 case V4L2_BUF_TYPE_VBI_CAPTURE:
+                        CLEAR_AFTER_FIELD(f, fmt.vbi);
                         if (ops->vidioc_s_fmt_vbi_cap)
                                 ret = ops->vidioc_s_fmt_vbi_cap(file, fh, f);
                         break;
                 case V4L2_BUF_TYPE_VBI_OUTPUT:
+                        CLEAR_AFTER_FIELD(f, fmt.vbi);
                         if (ops->vidioc_s_fmt_vbi_out)
                                 ret = ops->vidioc_s_fmt_vbi_out(file, fh, f);
                         break;
                 case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE:
+                        CLEAR_AFTER_FIELD(f, fmt.sliced);
                         if (ops->vidioc_s_fmt_sliced_vbi_cap)
                                 ret = ops->vidioc_s_fmt_sliced_vbi_cap(file,
                                                                         fh, f);
                         break;
                 case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT:
+                        CLEAR_AFTER_FIELD(f, fmt.sliced);
                         if (ops->vidioc_s_fmt_sliced_vbi_out)
                                 ret = ops->vidioc_s_fmt_sliced_vbi_out(file,
                                                                         fh, f);
                         break;
                 case V4L2_BUF_TYPE_PRIVATE:
+                        /* CLEAR_AFTER_FIELD(f, fmt.raw_data); <- does nothing */
                         if (ops->vidioc_s_fmt_type_private)
                                 ret = ops->vidioc_s_fmt_type_private(file,
                                                                 fh, f);
@@ -836,46 +851,55 @@ static long __video_do_ioctl(struct file *file,
                                                 v4l2_type_names));
                 switch (f->type) {
                 case V4L2_BUF_TYPE_VIDEO_CAPTURE:
+                        CLEAR_AFTER_FIELD(f, fmt.pix);
                         if (ops->vidioc_try_fmt_vid_cap)
                                 ret = ops->vidioc_try_fmt_vid_cap(file, fh, f);
                         if (!ret)
                                 v4l_print_pix_fmt(vfd, &f->fmt.pix);
                         break;
                 case V4L2_BUF_TYPE_VIDEO_OVERLAY:
+                        CLEAR_AFTER_FIELD(f, fmt.win);
                         if (ops->vidioc_try_fmt_vid_overlay)
                                 ret = ops->vidioc_try_fmt_vid_overlay(file,
                                         fh, f);
                         break;
                 case V4L2_BUF_TYPE_VIDEO_OUTPUT:
+                        CLEAR_AFTER_FIELD(f, fmt.pix);
                         if (ops->vidioc_try_fmt_vid_out)
                                 ret = ops->vidioc_try_fmt_vid_out(file, fh, f);
                         if (!ret)
                                 v4l_print_pix_fmt(vfd, &f->fmt.pix);
                         break;
                 case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
+                        CLEAR_AFTER_FIELD(f, fmt.win);
                         if (ops->vidioc_try_fmt_vid_out_overlay)
                                 ret = ops->vidioc_try_fmt_vid_out_overlay(file,
                                        fh, f);
                         break;
                 case V4L2_BUF_TYPE_VBI_CAPTURE:
+                        CLEAR_AFTER_FIELD(f, fmt.vbi);
                         if (ops->vidioc_try_fmt_vbi_cap)
                                 ret = ops->vidioc_try_fmt_vbi_cap(file, fh, f);
                         break;
                 case V4L2_BUF_TYPE_VBI_OUTPUT:
+                        CLEAR_AFTER_FIELD(f, fmt.vbi);
                         if (ops->vidioc_try_fmt_vbi_out)
                                 ret = ops->vidioc_try_fmt_vbi_out(file, fh, f);
                         break;
                 case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE:
+                        CLEAR_AFTER_FIELD(f, fmt.sliced);
                         if (ops->vidioc_try_fmt_sliced_vbi_cap)
                                 ret = ops->vidioc_try_fmt_sliced_vbi_cap(file,
                                                                 fh, f);
                         break;
                 case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT:
+                        CLEAR_AFTER_FIELD(f, fmt.sliced);
                         if (ops->vidioc_try_fmt_sliced_vbi_out)
                                 ret = ops->vidioc_try_fmt_sliced_vbi_out(file,
                                                                 fh, f);
                         break;
                 case V4L2_BUF_TYPE_PRIVATE:
+                        /* CLEAR_AFTER_FIELD(f, fmt.raw_data); <- does nothing */
                         if (ops->vidioc_try_fmt_type_private)
                                 ret = ops->vidioc_try_fmt_type_private(file,
                                                                 fh, f);
@@ -898,6 +922,9 @@ static long __video_do_ioctl(struct file *file,
                 if (ret)
                         break;
 
+                if (p->type < V4L2_BUF_TYPE_PRIVATE)
+                        CLEAR_AFTER_FIELD(p, memory);
+
                 ret = ops->vidioc_reqbufs(file, fh, p);
                 dbgarg(cmd, "count=%d, type=%s, memory=%s\n",
                                 p->count,
diff --git a/drivers/media/video/zoran/zoran_driver.c b/drivers/media/video/zoran/zoran_driver.c
index 092333b1c34..643cccaa1aa 100644
--- a/drivers/media/video/zoran/zoran_driver.c
+++ b/drivers/media/video/zoran/zoran_driver.c
@@ -1863,22 +1863,20 @@ static int zoran_querycap(struct file *file, void *__fh, struct v4l2_capability
 
 static int zoran_enum_fmt(struct zoran *zr, struct v4l2_fmtdesc *fmt, int flag)
 {
-        int num = -1, i;
-
-        for (i = 0; i < NUM_FORMATS; i++) {
-                if (zoran_formats[i].flags & flag)
-                        num++;
-                if (num == fmt->index)
-                        break;
+        unsigned int num, i;
+
+        for (num = i = 0; i < NUM_FORMATS; i++) {
+                if (zoran_formats[i].flags & flag && num++ == fmt->index) {
+                        strncpy(fmt->description, zoran_formats[i].name,
+                                sizeof(fmt->description) - 1);
+                        /* fmt struct pre-zeroed, so adding '\0' not neeed */
+                        fmt->pixelformat = zoran_formats[i].fourcc;
+                        if (zoran_formats[i].flags & ZORAN_FORMAT_COMPRESSED)
+                                fmt->flags |= V4L2_FMT_FLAG_COMPRESSED;
+                        return 0;
+                }
         }
-        if (fmt->index < 0 /* late, but not too late */  || i == NUM_FORMATS)
-                return -EINVAL;
-
-        strncpy(fmt->description, zoran_formats[i].name, sizeof(fmt->description)-1);
-        fmt->pixelformat = zoran_formats[i].fourcc;
-        if (zoran_formats[i].flags & ZORAN_FORMAT_COMPRESSED)
-                fmt->flags |= V4L2_FMT_FLAG_COMPRESSED;
-        return 0;
+        return -EINVAL;
 }
 
 static int zoran_enum_fmt_vid_cap(struct file *file, void *__fh,
diff --git a/drivers/misc/isl29003.c b/drivers/misc/isl29003.c
index 2e2a5923d4c..a71e245801e 100644
--- a/drivers/misc/isl29003.c
+++ b/drivers/misc/isl29003.c
@@ -64,6 +64,7 @@ struct isl29003_data {
         struct i2c_client *client;
         struct mutex lock;
         u8 reg_cache[ISL29003_NUM_CACHABLE_REGS];
+        u8 power_state_before_suspend;
 };
 
 static int gain_range[] = {
@@ -411,6 +412,9 @@ static int __devexit isl29003_remove(struct i2c_client *client)
 #ifdef CONFIG_PM
 static int isl29003_suspend(struct i2c_client *client, pm_message_t mesg)
 {
+        struct isl29003_data *data = i2c_get_clientdata(client);
+
+        data->power_state_before_suspend = isl29003_get_power_state(client);
         return isl29003_set_power_state(client, 0);
 }
 
@@ -421,10 +425,11 @@ static int isl29003_resume(struct i2c_client *client)
 
         /* restore registers from cache */
         for (i = 0; i < ARRAY_SIZE(data->reg_cache); i++)
-                if (!i2c_smbus_write_byte_data(client, i, data->reg_cache[i]))
+                if (i2c_smbus_write_byte_data(client, i, data->reg_cache[i]))
                         return -EIO;
 
-        return 0;
+        return isl29003_set_power_state(client,
+                data->power_state_before_suspend);
 }
 
 #else
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index fe8041e619e..b25e9b6516a 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -254,6 +254,14 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
                 brq.data.blocks = req->nr_sectors;
 
                 /*
+                 * The block layer doesn't support all sector count
+                 * restrictions, so we need to be prepared for too big
+                 * requests.
+                 */
+                if (brq.data.blocks > card->host->max_blk_count)
+                        brq.data.blocks = card->host->max_blk_count;
+
+                /*
                  * After a read error, we redo the request one sector at a time
                  * in order to accurately determine which sectors can be read
                  * successfully.
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index fa073ab3fa3..26491173275 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -706,7 +706,7 @@ static void mmc_power_up(struct mmc_host *host)
          * This delay should be sufficient to allow the power supply
          * to reach the minimum voltage.
          */
-        mmc_delay(2);
+        mmc_delay(10);
 
         host->ios.clock = host->f_min;
         host->ios.power_mode = MMC_POWER_ON;
@@ -716,7 +716,7 @@ static void mmc_power_up(struct mmc_host *host)
          * This delay must be at least 74 clock sizes, or 1 ms, or the
          * time required to reach a stable voltage.
          */
-        mmc_delay(2);
+        mmc_delay(10);
 }
 
 static void mmc_power_off(struct mmc_host *host)
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index a663429b3d5..36875dcfa49 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -514,6 +514,7 @@ static int __devinit mmci_probe(struct amba_device *dev, void *id)
         }
 
         host = mmc_priv(mmc);
+        host->mmc = mmc;
         /* Bits 12 thru 19 is the designer */
         host->hw_designer = (dev->periphid >> 12) & 0xff;
         /* Bits 20 thru 23 is the revison */
@@ -545,7 +546,6 @@ static int __devinit mmci_probe(struct amba_device *dev, void *id)
                 host->mclk = clk_get_rate(host->clk);
                 DBG(host, "eventual mclk rate: %u Hz\n", host->mclk);
         }
-        host->mmc = mmc;
         host->base = ioremap(dev->res.start, SZ_4K);
         if (!host->base) {
                 ret = -ENOMEM;
diff --git a/drivers/mmc/host/mvsdio.c b/drivers/mmc/host/mvsdio.c
index b5c375d94ab..c643d0fe118 100644
--- a/drivers/mmc/host/mvsdio.c
+++ b/drivers/mmc/host/mvsdio.c
@@ -825,24 +825,23 @@ static int __exit mvsd_remove(struct platform_device *pdev)
 }
 
 #ifdef CONFIG_PM
-static int mvsd_suspend(struct platform_device *dev, pm_message_t state,
-                           u32 level)
+static int mvsd_suspend(struct platform_device *dev, pm_message_t state)
 {
         struct mmc_host *mmc = platform_get_drvdata(dev);
         int ret = 0;
 
-        if (mmc && level == SUSPEND_DISABLE)
+        if (mmc)
                 ret = mmc_suspend_host(mmc, state);
 
         return ret;
 }
 
-static int mvsd_resume(struct platform_device *dev, u32 level)
+static int mvsd_resume(struct platform_device *dev)
 {
-        struct mmc_host *mmc = platform_dev_get_drvdata(dev);
+        struct mmc_host *mmc = platform_get_drvdata(dev);
         int ret = 0;
 
-        if (mmc && level == RESUME_ENABLE)
+        if (mmc)
                 ret = mmc_resume_host(mmc);
 
         return ret;
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index 5570849188c..bfa25c01c87 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -157,8 +157,6 @@ struct mmc_omap_host {
         struct timer_list       dma_timer;
         unsigned                dma_len;
 
-        short                   power_pin;
-
         struct mmc_omap_slot    *slots[OMAP_MMC_MAX_SLOTS];
         struct mmc_omap_slot    *current_slot;
         spinlock_t              slot_lock;
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index cd37962ec44..65be27995d5 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -522,8 +522,8 @@ static struct sdhci_pci_slot * __devinit sdhci_pci_probe_slot(
 
         host = sdhci_alloc_host(&pdev->dev, sizeof(struct sdhci_pci_slot));
         if (IS_ERR(host)) {
-                ret = PTR_ERR(host);
-                goto unmap;
+                dev_err(&pdev->dev, "cannot allocate host\n");
+                return ERR_PTR(PTR_ERR(host));
         }
 
         slot = sdhci_priv(host);
@@ -541,7 +541,7 @@ static struct sdhci_pci_slot * __devinit sdhci_pci_probe_slot(
         ret = pci_request_region(pdev, bar, mmc_hostname(host->mmc));
         if (ret) {
                 dev_err(&pdev->dev, "cannot request region\n");
-                return ERR_PTR(ret);
+                goto free;
         }
 
         addr = pci_resource_start(pdev, bar);
@@ -572,6 +572,8 @@ unmap:
 
 release:
         pci_release_region(pdev, bar);
+
+free:
         sdhci_free_host(host);
 
         return ERR_PTR(ret);
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index f20a834f430..65c6f996bbd 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -125,7 +125,7 @@
 #define  SDHCI_INT_DATA_MASK    (SDHCI_INT_DATA_END | SDHCI_INT_DMA_END | \
                 SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL | \
                 SDHCI_INT_DATA_TIMEOUT | SDHCI_INT_DATA_CRC | \
-                SDHCI_INT_DATA_END_BIT)
+                SDHCI_INT_DATA_END_BIT | SDHCI_ADMA_ERROR)
 #define SDHCI_INT_ALL_MASK      ((unsigned int)-1)
 
 #define SDHCI_ACMD12_ERR        0x3C
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index 8185b1f3e5e..cc6369ea67d 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -54,7 +54,7 @@
 #define SR_SRWD                 0x80    /* SR write protect */
 
 /* Define max times to check status register before we give up. */
-#define MAX_READY_WAIT_COUNT    100000
+#define MAX_READY_WAIT_JIFFIES  (10 * HZ)       /* eg. M25P128 specs 6s max sector erase */
 #define CMD_SIZE                4
 
 #ifdef CONFIG_M25PXX_USE_FAST_READ
@@ -139,20 +139,20 @@ static inline int write_enable(struct m25p *flash)
  */
 static int wait_till_ready(struct m25p *flash)
 {
-        int count;
+        unsigned long deadline;
         int sr;
 
-        /* one chip guarantees max 5 msec wait here after page writes,
-         * but potentially three seconds (!) after page erase.
-         */
-        for (count = 0; count < MAX_READY_WAIT_COUNT; count++) {
+        deadline = jiffies + MAX_READY_WAIT_JIFFIES;
+
+        do {
                 if ((sr = read_sr(flash)) < 0)
                         break;
                 else if (!(sr & SR_WIP))
                         return 0;
 
-                /* REVISIT sometimes sleeping would be best */
-        }
+                cond_resched();
+
+        } while (!time_after_eq(jiffies, deadline));
 
         return 1;
 }
@@ -246,10 +246,12 @@ static int m25p80_erase(struct mtd_info *mtd, struct erase_info *instr)
         mutex_lock(&flash->lock);
 
         /* whole-chip erase? */
-        if (len == flash->mtd.size && erase_chip(flash)) {
-                instr->state = MTD_ERASE_FAILED;
-                mutex_unlock(&flash->lock);
-                return -EIO;
+        if (len == flash->mtd.size) {
+                if (erase_chip(flash)) {
+                        instr->state = MTD_ERASE_FAILED;
+                        mutex_unlock(&flash->lock);
+                        return -EIO;
+                }
 
         /* REVISIT in some cases we could speed up erasing large regions
          * by using OPCODE_SE instead of OPCODE_BE_4K.  We may have set up
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index fdd6ae85939..bccb4b1ffc4 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -48,11 +48,11 @@ static LIST_HEAD(mtd_notifiers);
  */
 static void mtd_release(struct device *dev)
 {
-        struct mtd_info *mtd = dev_to_mtd(dev);
+        dev_t index = MTD_DEVT(dev_to_mtd(dev)->index);
 
         /* remove /dev/mtdXro node if needed */
-        if (MTD_DEVT(mtd->index))
-                device_destroy(mtd_class, MTD_DEVT(mtd->index) + 1);
+        if (index)
+                device_destroy(mtd_class, index + 1);
 }
 
 static ssize_t mtd_type_show(struct device *dev,
@@ -132,6 +132,17 @@ static ssize_t mtd_writesize_show(struct device *dev,
 }
 static DEVICE_ATTR(writesize, S_IRUGO, mtd_writesize_show, NULL);
 
+static ssize_t mtd_subpagesize_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct mtd_info *mtd = dev_to_mtd(dev);
+        unsigned int subpagesize = mtd->writesize >> mtd->subpage_sft;
+
+        return snprintf(buf, PAGE_SIZE, "%u\n", subpagesize);
+
+}
+static DEVICE_ATTR(subpagesize, S_IRUGO, mtd_subpagesize_show, NULL);
+
 static ssize_t mtd_oobsize_show(struct device *dev,
                 struct device_attribute *attr, char *buf)
 {
@@ -169,6 +180,7 @@ static struct attribute *mtd_attrs[] = {
         &dev_attr_size.attr,
         &dev_attr_erasesize.attr,
         &dev_attr_writesize.attr,
+        &dev_attr_subpagesize.attr,
         &dev_attr_oobsize.attr,
         &dev_attr_numeraseregions.attr,
         &dev_attr_name.attr,
diff --git a/drivers/mtd/mtdsuper.c b/drivers/mtd/mtdsuper.c
index 92285d0089c..af8b42e0a55 100644
--- a/drivers/mtd/mtdsuper.c
+++ b/drivers/mtd/mtdsuper.c
@@ -74,8 +74,7 @@ static int get_sb_mtd_aux(struct file_system_type *fs_type, int flags,
 
         ret = fill_super(sb, data, flags & MS_SILENT ? 1 : 0);
         if (ret < 0) {
-                up_write(&sb->s_umount);
-                deactivate_super(sb);
+                deactivate_locked_super(sb);
                 return ret;
         }
 
diff --git a/drivers/net/arm/ixp4xx_eth.c b/drivers/net/arm/ixp4xx_eth.c
index 448487e22fa..a740053d3af 100644
--- a/drivers/net/arm/ixp4xx_eth.c
+++ b/drivers/net/arm/ixp4xx_eth.c
@@ -338,12 +338,12 @@ static int ixp4xx_mdio_register(void)
         if (cpu_is_ixp43x()) {
                 /* IXP43x lacks NPE-B and uses NPE-C for MII PHY access */
                 if (!(ixp4xx_read_feature_bits() & IXP4XX_FEATURE_NPEC_ETH))
-                        return -ENOSYS;
+                        return -ENODEV;
                 mdio_regs = (struct eth_regs __iomem *)IXP4XX_EthC_BASE_VIRT;
         } else {
                 /* All MII PHY accesses use NPE-B Ethernet registers */
                 if (!(ixp4xx_read_feature_bits() & IXP4XX_FEATURE_NPEB_ETH0))
-                        return -ENOSYS;
+                        return -ENODEV;
                 mdio_regs = (struct eth_regs __iomem *)IXP4XX_EthB_BASE_VIRT;
         }
 
@@ -1174,7 +1174,7 @@ static int __devinit eth_init_one(struct platform_device *pdev)
                 regs_phys  = IXP4XX_EthC_BASE_PHYS;
                 break;
         default:
-                err = -ENOSYS;
+                err = -ENODEV;
                 goto err_free;
         }
 
@@ -1189,15 +1189,10 @@ static int __devinit eth_init_one(struct platform_device *pdev)
                 goto err_free;
         }
 
-        if (register_netdev(dev)) {
-                err = -EIO;
-                goto err_npe_rel;
-        }
-
         port->mem_res = request_mem_region(regs_phys, REGS_SIZE, dev->name);
         if (!port->mem_res) {
                 err = -EBUSY;
-                goto err_unreg;
+                goto err_npe_rel;
         }
 
         port->plat = plat;
@@ -1215,20 +1210,25 @@ static int __devinit eth_init_one(struct platform_device *pdev)
         snprintf(phy_id, BUS_ID_SIZE, PHY_ID_FMT, "0", plat->phy);
         port->phydev = phy_connect(dev, phy_id, &ixp4xx_adjust_link, 0,
                                    PHY_INTERFACE_MODE_MII);
-        if (IS_ERR(port->phydev)) {
-                printk(KERN_ERR "%s: Could not attach to PHY\n", dev->name);
-                return PTR_ERR(port->phydev);
-        }
+        if ((err = IS_ERR(port->phydev)))
+                goto err_free_mem;
 
         port->phydev->irq = PHY_POLL;
 
+        if ((err = register_netdev(dev)))
+                goto err_phy_dis;
+
         printk(KERN_INFO "%s: MII PHY %i on %s\n", dev->name, plat->phy,
                npe_name(port->npe));
 
         return 0;
 
-err_unreg:
-        unregister_netdev(dev);
+err_phy_dis:
+        phy_disconnect(port->phydev);
+err_free_mem:
+        npe_port_tab[NPE_ID(port->id)] = NULL;
+        platform_set_drvdata(pdev, NULL);
+        release_resource(port->mem_res);
 err_npe_rel:
         npe_release(port->npe);
 err_free:
@@ -1242,6 +1242,7 @@ static int __devexit eth_remove_one(struct platform_device *pdev)
         struct port *port = netdev_priv(dev);
 
         unregister_netdev(dev);
+        phy_disconnect(port->phydev);
         npe_port_tab[NPE_ID(port->id)] = NULL;
         platform_set_drvdata(pdev, NULL);
         npe_release(port->npe);
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index d47839184a0..b0cb29d4cc0 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -54,8 +54,8 @@
 
 #define DRV_MODULE_NAME         "bnx2"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "2.0.0"
-#define DRV_MODULE_RELDATE      "April 2, 2009"
+#define DRV_MODULE_VERSION      "2.0.1"
+#define DRV_MODULE_RELDATE      "May 6, 2009"
 #define FW_MIPS_FILE_06         "bnx2/bnx2-mips-06-4.6.16.fw"
 #define FW_RV2P_FILE_06         "bnx2/bnx2-rv2p-06-4.6.16.fw"
 #define FW_MIPS_FILE_09         "bnx2/bnx2-mips-09-4.6.17.fw"
@@ -2600,6 +2600,7 @@ bnx2_get_hw_tx_cons(struct bnx2_napi *bnapi)
         /* Tell compiler that status block fields can change. */
         barrier();
         cons = *bnapi->hw_tx_cons_ptr;
+        barrier();
         if (unlikely((cons & MAX_TX_DESC_CNT) == MAX_TX_DESC_CNT))
                 cons++;
         return cons;
@@ -2879,6 +2880,7 @@ bnx2_get_hw_rx_cons(struct bnx2_napi *bnapi)
         /* Tell compiler that status block fields can change. */
         barrier();
         cons = *bnapi->hw_rx_cons_ptr;
+        barrier();
         if (unlikely((cons & MAX_RX_DESC_CNT) == MAX_RX_DESC_CNT))
                 cons++;
         return cons;
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 553a8991977..46d312bedfb 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -1706,10 +1706,8 @@ void bond_alb_handle_active_change(struct bonding *bond, struct slave *new_slave
  * Called with RTNL
  */
 int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
-        __releases(&bond->curr_slave_lock)
-        __releases(&bond->lock)
         __acquires(&bond->lock)
-        __acquires(&bond->curr_slave_lock)
+        __releases(&bond->lock)
 {
         struct bonding *bond = netdev_priv(bond_dev);
         struct sockaddr *sa = addr;
@@ -1745,9 +1743,6 @@ int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
                 }
         }
 
-        write_unlock_bh(&bond->curr_slave_lock);
-        read_unlock(&bond->lock);
-
         if (swap_slave) {
                 alb_swap_mac_addr(bond, swap_slave, bond->curr_active_slave);
                 alb_fasten_mac_swap(bond, swap_slave, bond->curr_active_slave);
@@ -1755,16 +1750,15 @@ int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
                 alb_set_slave_mac_addr(bond->curr_active_slave, bond_dev->dev_addr,
                                        bond->alb_info.rlb_enabled);
 
+                read_lock(&bond->lock);
                 alb_send_learning_packets(bond->curr_active_slave, bond_dev->dev_addr);
                 if (bond->alb_info.rlb_enabled) {
                         /* inform clients mac address has changed */
                         rlb_req_update_slave_clients(bond, bond->curr_active_slave);
                 }
+                read_unlock(&bond->lock);
         }
 
-        read_lock(&bond->lock);
-        write_lock_bh(&bond->curr_slave_lock);
-
         return 0;
 }
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 63369b6b14d..74824028f85 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2213,33 +2213,24 @@ static int bond_slave_info_query(struct net_device *bond_dev, struct ifslave *in
 {
         struct bonding *bond = netdev_priv(bond_dev);
         struct slave *slave;
-        int i, found = 0;
-
-        if (info->slave_id < 0) {
-                return -ENODEV;
-        }
+        int i, res = -ENODEV;
 
         read_lock(&bond->lock);
 
         bond_for_each_slave(bond, slave, i) {
                 if (i == (int)info->slave_id) {
-                        found = 1;
+                        res = 0;
+                        strcpy(info->slave_name, slave->dev->name);
+                        info->link = slave->link;
+                        info->state = slave->state;
+                        info->link_failure_count = slave->link_failure_count;
                         break;
                 }
         }
 
         read_unlock(&bond->lock);
 
-        if (found) {
-                strcpy(info->slave_name, slave->dev->name);
-                info->link = slave->link;
-                info->state = slave->state;
-                info->link_failure_count = slave->link_failure_count;
-        } else {
-                return -ENODEV;
-        }
-
-        return 0;
+        return res;
 }
 
 /*-------------------------------- Monitoring -------------------------------*/
@@ -5167,16 +5158,15 @@ int bond_create(char *name, struct bond_params *params)
         up_write(&bonding_rwsem);
         rtnl_unlock(); /* allows sysfs registration of net device */
         res = bond_create_sysfs_entry(netdev_priv(bond_dev));
-        if (res < 0) {
-                rtnl_lock();
-                down_write(&bonding_rwsem);
-                bond_deinit(bond_dev);
-                unregister_netdevice(bond_dev);
-                goto out_rtnl;
-        }
+        if (res < 0)
+                goto out_unreg;
 
         return 0;
 
+out_unreg:
+        rtnl_lock();
+        down_write(&bonding_rwsem);
+        unregister_netdevice(bond_dev);
 out_bond:
         bond_deinit(bond_dev);
 out_netdev:
@@ -5191,7 +5181,6 @@ static int __init bonding_init(void)
 {
         int i;
         int res;
-        struct bonding *bond;
 
         printk(KERN_INFO "%s", version);
 
@@ -5222,13 +5211,6 @@ static int __init bonding_init(void)
 
         goto out;
 err:
-        list_for_each_entry(bond, &bond_dev_list, bond_list) {
-                bond_work_cancel_all(bond);
-                destroy_workqueue(bond->wq);
-        }
-
-        bond_destroy_sysfs();
-
         rtnl_lock();
         bond_free_all();
         rtnl_unlock();
diff --git a/drivers/net/cxgb3/t3_hw.c b/drivers/net/cxgb3/t3_hw.c
index e1bd690ff83..4f68aeb2679 100644
--- a/drivers/net/cxgb3/t3_hw.c
+++ b/drivers/net/cxgb3/t3_hw.c
@@ -3779,7 +3779,7 @@ int t3_prep_adapter(struct adapter *adapter, const struct adapter_info *ai,
 
         adapter->params.info = ai;
         adapter->params.nports = ai->nports0 + ai->nports1;
-        adapter->params.chan_map = !!ai->nports0 | (!!ai->nports1 << 1);
+        adapter->params.chan_map = (!!ai->nports0) | (!!ai->nports1 << 1);
         adapter->params.rev = t3_read_reg(adapter, A_PL_REV);
         /*
          * We used to only run the "adapter check task" once a second if
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 6a46ceed943..b1419e21b46 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -3738,7 +3738,7 @@ static irqreturn_t e1000_intr(int irq, void *data)
         struct e1000_hw *hw = &adapter->hw;
         u32 rctl, icr = er32(ICR);
 
-        if (unlikely((!icr) || test_bit(__E1000_RESETTING, &adapter->flags)))
+        if (unlikely((!icr) || test_bit(__E1000_DOWN, &adapter->flags)))
                 return IRQ_NONE;  /* Not our interrupt */
 
         /* IMS will not auto-mask if INT_ASSERTED is not set, and if it is
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 6e317caf429..16a41389575 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -40,7 +40,7 @@
 #include <asm/io.h>
 
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0100"
+#define DRV_VERSION     "EHEA_0101"
 
 /* eHEA capability flags */
 #define DLPAR_PORT_ADD_REM 1
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 604c844d076..b22dab9153f 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -545,14 +545,17 @@ static inline struct sk_buff *get_skb_by_index(struct sk_buff **skb_array,
         x &= (arr_len - 1);
 
         pref = skb_array[x];
-        prefetchw(pref);
-        prefetchw(pref + EHEA_CACHE_LINE);
-
-        pref = (skb_array[x]->data);
-        prefetch(pref);
-        prefetch(pref + EHEA_CACHE_LINE);
-        prefetch(pref + EHEA_CACHE_LINE * 2);
-        prefetch(pref + EHEA_CACHE_LINE * 3);
+        if (pref) {
+                prefetchw(pref);
+                prefetchw(pref + EHEA_CACHE_LINE);
+
+                pref = (skb_array[x]->data);
+                prefetch(pref);
+                prefetch(pref + EHEA_CACHE_LINE);
+                prefetch(pref + EHEA_CACHE_LINE * 2);
+                prefetch(pref + EHEA_CACHE_LINE * 3);
+        }
+
         skb = skb_array[skb_index];
         skb_array[skb_index] = NULL;
         return skb;
@@ -569,12 +572,14 @@ static inline struct sk_buff *get_skb_by_index_ll(struct sk_buff **skb_array,
         x &= (arr_len - 1);
 
         pref = skb_array[x];
-        prefetchw(pref);
-        prefetchw(pref + EHEA_CACHE_LINE);
+        if (pref) {
+                prefetchw(pref);
+                prefetchw(pref + EHEA_CACHE_LINE);
 
-        pref = (skb_array[x]->data);
-        prefetchw(pref);
-        prefetchw(pref + EHEA_CACHE_LINE);
+                pref = (skb_array[x]->data);
+                prefetchw(pref);
+                prefetchw(pref + EHEA_CACHE_LINE);
+        }
 
         skb = skb_array[wqe_index];
         skb_array[wqe_index] = NULL;
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 08c801490c7..e25343588fc 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -2006,7 +2006,7 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
         struct e1000_hw *hw = &adapter->hw;
         u32 rctl;
         u32 srrctl = 0;
-        int i, j;
+        int i;
 
         rctl = rd32(E1000_RCTL);
 
@@ -2071,8 +2071,6 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
         if (adapter->vfs_allocated_count) {
                 u32 vmolr;
 
-                j = adapter->rx_ring[0].reg_idx;
-
                 /* set all queue drop enable bits */
                 wr32(E1000_QDE, ALL_QUEUES);
                 srrctl |= E1000_SRRCTL_DROP_EN;
@@ -2080,16 +2078,16 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
                 /* disable queue 0 to prevent tail write w/o re-config */
                 wr32(E1000_RXDCTL(0), 0);
 
-                vmolr = rd32(E1000_VMOLR(j));
+                vmolr = rd32(E1000_VMOLR(adapter->vfs_allocated_count));
                 if (rctl & E1000_RCTL_LPE)
                         vmolr |= E1000_VMOLR_LPE;
-                if (adapter->num_rx_queues > 0)
+                if (adapter->num_rx_queues > 1)
                         vmolr |= E1000_VMOLR_RSSE;
-                wr32(E1000_VMOLR(j), vmolr);
+                wr32(E1000_VMOLR(adapter->vfs_allocated_count), vmolr);
         }
 
         for (i = 0; i < adapter->num_rx_queues; i++) {
-                j = adapter->rx_ring[i].reg_idx;
+                int j = adapter->rx_ring[i].reg_idx;
                 wr32(E1000_SRRCTL(j), srrctl);
         }
 
diff --git a/drivers/net/mlx4/en_rx.c b/drivers/net/mlx4/en_rx.c
index 7942c4d3cd8..9ee873e872b 100644
--- a/drivers/net/mlx4/en_rx.c
+++ b/drivers/net/mlx4/en_rx.c
@@ -951,7 +951,6 @@ static int mlx4_en_config_rss_qp(struct mlx4_en_priv *priv,
         if (err) {
                 mlx4_err(mdev, "Failed to allocate qp #%d\n", qpn);
                 goto out;
-                return err;
         }
         qp->event = mlx4_en_sqp_event;
 
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index b3185bf2c15..a400d7115f7 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -393,12 +393,12 @@ struct mv643xx_eth_private {
         struct work_struct tx_timeout_task;
 
         struct napi_struct napi;
+        u8 oom;
         u8 work_link;
         u8 work_tx;
         u8 work_tx_end;
         u8 work_rx;
         u8 work_rx_refill;
-        u8 work_rx_oom;
 
         int skb_size;
         struct sk_buff_head rx_recycle;
@@ -661,7 +661,7 @@ static int rxq_refill(struct rx_queue *rxq, int budget)
                                             dma_get_cache_alignment() - 1);
 
                 if (skb == NULL) {
-                        mp->work_rx_oom |= 1 << rxq->index;
+                        mp->oom = 1;
                         goto oom;
                 }
 
@@ -1255,7 +1255,6 @@ static void mib_counters_update(struct mv643xx_eth_private *mp)
 
         spin_lock_bh(&mp->mib_counters_lock);
         p->good_octets_received += mib_read(mp, 0x00);
-        p->good_octets_received += (u64)mib_read(mp, 0x04) << 32;
         p->bad_octets_received += mib_read(mp, 0x08);
         p->internal_mac_transmit_err += mib_read(mp, 0x0c);
         p->good_frames_received += mib_read(mp, 0x10);
@@ -1269,7 +1268,6 @@ static void mib_counters_update(struct mv643xx_eth_private *mp)
         p->frames_512_to_1023_octets += mib_read(mp, 0x30);
         p->frames_1024_to_max_octets += mib_read(mp, 0x34);
         p->good_octets_sent += mib_read(mp, 0x38);
-        p->good_octets_sent += (u64)mib_read(mp, 0x3c) << 32;
         p->good_frames_sent += mib_read(mp, 0x40);
         p->excessive_collision += mib_read(mp, 0x44);
         p->multicast_frames_sent += mib_read(mp, 0x48);
@@ -2167,8 +2165,10 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
 
         mp = container_of(napi, struct mv643xx_eth_private, napi);
 
-        mp->work_rx_refill |= mp->work_rx_oom;
-        mp->work_rx_oom = 0;
+        if (unlikely(mp->oom)) {
+                mp->oom = 0;
+                del_timer(&mp->rx_oom);
+        }
 
         work_done = 0;
         while (work_done < budget) {
@@ -2182,8 +2182,10 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
                         continue;
                 }
 
-                queue_mask = mp->work_tx | mp->work_tx_end |
-                                mp->work_rx | mp->work_rx_refill;
+                queue_mask = mp->work_tx | mp->work_tx_end | mp->work_rx;
+                if (likely(!mp->oom))
+                        queue_mask |= mp->work_rx_refill;
+
                 if (!queue_mask) {
                         if (mv643xx_eth_collect_events(mp))
                                 continue;
@@ -2204,7 +2206,7 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
                         txq_maybe_wake(mp->txq + queue);
                 } else if (mp->work_rx & queue_mask) {
                         work_done += rxq_process(mp->rxq + queue, work_tbd);
-                } else if (mp->work_rx_refill & queue_mask) {
+                } else if (!mp->oom && (mp->work_rx_refill & queue_mask)) {
                         work_done += rxq_refill(mp->rxq + queue, work_tbd);
                 } else {
                         BUG();
@@ -2212,7 +2214,7 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
         }
 
         if (work_done < budget) {
-                if (mp->work_rx_oom)
+                if (mp->oom)
                         mod_timer(&mp->rx_oom, jiffies + (HZ / 10));
                 napi_complete(napi);
                 wrlp(mp, INT_MASK, INT_TX_END | INT_RX | INT_EXT);
@@ -2372,7 +2374,7 @@ static int mv643xx_eth_open(struct net_device *dev)
                 rxq_refill(mp->rxq + i, INT_MAX);
         }
 
-        if (mp->work_rx_oom) {
+        if (mp->oom) {
                 mp->rx_oom.expires = jiffies + (HZ / 10);
                 add_timer(&mp->rx_oom);
         }
diff --git a/drivers/net/ne2k-pci.c b/drivers/net/ne2k-pci.c
index eb66f658f9d..7d83896b8c2 100644
--- a/drivers/net/ne2k-pci.c
+++ b/drivers/net/ne2k-pci.c
@@ -374,18 +374,17 @@ static int __devinit ne2k_pci_init_one (struct pci_dev *pdev,
         dev->ethtool_ops = &ne2k_pci_ethtool_ops;
         NS8390_init(dev, 0);
 
+        memcpy(dev->dev_addr, SA_prom, 6);
+        memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
+
         i = register_netdev(dev);
         if (i)
                 goto err_out_free_netdev;
 
-        for(i = 0; i < 6; i++)
-                dev->dev_addr[i] = SA_prom[i];
         printk("%s: %s found at %#lx, IRQ %d, %pM.\n",
                dev->name, pci_clone_list[chip_idx].name, ioaddr, dev->irq,
                dev->dev_addr);
 
-        memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
-
         return 0;
 
 err_out_free_netdev:
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index eceadf787a6..bf4af5248cb 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -664,7 +664,7 @@ static int netconsole_netdev_event(struct notifier_block *this,
         struct netconsole_target *nt;
         struct net_device *dev = ptr;
 
-        if (!(event == NETDEV_CHANGENAME))
+        if (!(event == NETDEV_CHANGENAME || event == NETDEV_UNREGISTER))
                 goto done;
 
         spin_lock_irqsave(&target_list_lock, flags);
@@ -675,6 +675,15 @@ static int netconsole_netdev_event(struct notifier_block *this,
                         case NETDEV_CHANGENAME:
                                 strlcpy(nt->np.dev_name, dev->name, IFNAMSIZ);
                                 break;
+                        case NETDEV_UNREGISTER:
+                                if (!nt->enabled)
+                                        break;
+                                netpoll_cleanup(&nt->np);
+                                nt->enabled = 0;
+                                printk(KERN_INFO "netconsole: network logging stopped"
+                                        ", interface %s unregistered\n",
+                                        dev->name);
+                                break;
                         }
                 }
                 netconsole_target_put(nt);
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 8ee21030e9a..dfc6cf765fb 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -180,6 +180,20 @@ config USB_NET_CDCETHER
           IEEE 802 "local assignment" bit is set in the address, a "usbX"
           name is used instead.
 
+config USB_NET_CDC_EEM
+        tristate "CDC EEM support"
+        depends on USB_USBNET && EXPERIMENTAL
+        help
+          This option supports devices conforming to the Communication Device
+          Class (CDC) Ethernet Emulation Model, a specification that's easy to
+          implement in device firmware.  The CDC EEM specifications are available
+          from <http://www.usb.org/>.
+
+          This driver creates an interface named "ethX", where X depends on
+          what other networking devices you have in use.  However, if the
+          IEEE 802 "local assignment" bit is set in the address, a "usbX"
+          name is used instead.
+
 config USB_NET_DM9601
         tristate "Davicom DM9601 based USB 1.1 10/100 ethernet devices"
         depends on USB_USBNET
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index 88a87eeb376..c8aef62cf2b 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -9,6 +9,7 @@ obj-$(CONFIG_USB_RTL8150)	+= rtl8150.o
 obj-$(CONFIG_USB_HSO)           += hso.o
 obj-$(CONFIG_USB_NET_AX8817X)   += asix.o
 obj-$(CONFIG_USB_NET_CDCETHER)  += cdc_ether.o
+obj-$(CONFIG_USB_NET_CDC_EEM)   += cdc_eem.o
 obj-$(CONFIG_USB_NET_DM9601)    += dm9601.o
 obj-$(CONFIG_USB_NET_SMSC95XX)  += smsc95xx.o
 obj-$(CONFIG_USB_NET_GL620A)    += gl620a.o
diff --git a/drivers/net/usb/cdc_eem.c b/drivers/net/usb/cdc_eem.c
new file mode 100644
index 00000000000..80e01778dd3
--- /dev/null
+++ b/drivers/net/usb/cdc_eem.c
@@ -0,0 +1,381 @@
+/*
+ * USB CDC EEM network interface driver
+ * Copyright (C) 2009 Oberthur Technologies
+ * by Omar Laazimani, Olivier Condemine
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ctype.h>
+#include <linux/ethtool.h>
+#include <linux/workqueue.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/crc32.h>
+#include <linux/usb/cdc.h>
+#include <linux/usb/usbnet.h>
+
+
+/*
+ * This driver is an implementation of the CDC "Ethernet Emulation
+ * Model" (EEM) specification, which encapsulates Ethernet frames
+ * for transport over USB using a simpler USB device model than the
+ * previous CDC "Ethernet Control Model" (ECM, or "CDC Ethernet").
+ *
+ * For details, see www.usb.org/developers/devclass_docs/CDC_EEM10.pdf
+ *
+ * This version has been tested with GIGAntIC WuaoW SIM Smart Card on 2.6.24,
+ * 2.6.27 and 2.6.30rc2 kernel.
+ * It has also been validated on Openmoko Om 2008.12 (based on 2.6.24 kernel).
+ * build on 23-April-2009
+ */
+
+#define EEM_HEAD        2               /* 2 byte header */
+
+/*-------------------------------------------------------------------------*/
+
+static void eem_linkcmd_complete(struct urb *urb)
+{
+        dev_kfree_skb(urb->context);
+        usb_free_urb(urb);
+}
+
+static void eem_linkcmd(struct usbnet *dev, struct sk_buff *skb)
+{
+        struct urb              *urb;
+        int                     status;
+
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (!urb)
+                goto fail;
+
+        usb_fill_bulk_urb(urb, dev->udev, dev->out,
+                        skb->data, skb->len, eem_linkcmd_complete, skb);
+
+        status = usb_submit_urb(urb, GFP_ATOMIC);
+        if (status) {
+                usb_free_urb(urb);
+fail:
+                dev_kfree_skb(skb);
+                devwarn(dev, "link cmd failure\n");
+                return;
+        }
+}
+
+static int eem_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int status = 0;
+
+        status = usbnet_get_endpoints(dev, intf);
+        if (status < 0) {
+                usb_set_intfdata(intf, NULL);
+                usb_driver_release_interface(driver_of(intf), intf);
+                return status;
+        }
+
+        /* no jumbogram (16K) support for now */
+
+        dev->net->hard_header_len += EEM_HEAD + ETH_FCS_LEN;
+
+        return 0;
+}
+
+/*
+ * EEM permits packing multiple Ethernet frames into USB transfers
+ * (a "bundle"), but for TX we don't try to do that.
+ */
+static struct sk_buff *eem_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+                                       gfp_t flags)
+{
+        struct sk_buff  *skb2 = NULL;
+        u16             len = skb->len;
+        u32             crc = 0;
+        int             padlen = 0;
+
+        /* When ((len + EEM_HEAD + ETH_FCS_LEN) % dev->maxpacket) is
+         * zero, stick two bytes of zero length EEM packet on the end.
+         * Else the framework would add invalid single byte padding,
+         * since it can't know whether ZLPs will be handled right by
+         * all the relevant hardware and software.
+         */
+        if (!((len + EEM_HEAD + ETH_FCS_LEN) % dev->maxpacket))
+                padlen += 2;
+
+        if (!skb_cloned(skb)) {
+                int     headroom = skb_headroom(skb);
+                int     tailroom = skb_tailroom(skb);
+
+                if ((tailroom >= ETH_FCS_LEN + padlen)
+                                && (headroom >= EEM_HEAD))
+                        goto done;
+
+                if ((headroom + tailroom)
+                                > (EEM_HEAD + ETH_FCS_LEN + padlen)) {
+                        skb->data = memmove(skb->head +
+                                        EEM_HEAD,
+                                        skb->data,
+                                        skb->len);
+                        skb_set_tail_pointer(skb, len);
+                        goto done;
+                }
+        }
+
+        skb2 = skb_copy_expand(skb, EEM_HEAD, ETH_FCS_LEN + padlen, flags);
+        if (!skb2)
+                return NULL;
+
+        dev_kfree_skb_any(skb);
+        skb = skb2;
+
+done:
+        /* we don't use the "no Ethernet CRC" option */
+        crc = crc32_le(~0, skb->data, skb->len);
+        crc = ~crc;
+
+        put_unaligned_le32(crc, skb_put(skb, 4));
+
+        /* EEM packet header format:
+         * b0..13:      length of ethernet frame
+         * b14:         bmCRC (1 == valid Ethernet CRC)
+         * b15:         bmType (0 == data)
+         */
+        len = skb->len;
+        put_unaligned_le16(BIT(14) | len, skb_push(skb, 2));
+
+        /* Bundle a zero length EEM packet if needed */
+        if (padlen)
+                put_unaligned_le16(0, skb_put(skb, 2));
+
+        return skb;
+}
+
+static int eem_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        /*
+         * Our task here is to strip off framing, leaving skb with one
+         * data frame for the usbnet framework code to process.  But we
+         * may have received multiple EEM payloads, or command payloads.
+         * So we must process _everything_ as if it's a header, except
+         * maybe the last data payload
+         *
+         * REVISIT the framework needs updating so that when we consume
+         * all payloads (the last or only message was a command, or a
+         * zero length EEM packet) that is not accounted as an rx_error.
+         */
+        do {
+                struct sk_buff  *skb2 = NULL;
+                u16             header;
+                u16             len = 0;
+
+                /* incomplete EEM header? */
+                if (skb->len < EEM_HEAD)
+                        return 0;
+
+                /*
+                 * EEM packet header format:
+                 * b0..14:      EEM type dependant (Data or Command)
+                 * b15:         bmType
+                 */
+                header = get_unaligned_le16(skb->data);
+                skb_pull(skb, EEM_HEAD);
+
+                /*
+                 * The bmType bit helps to denote when EEM
+                 * packet is data or command :
+                 *      bmType = 0      : EEM data payload
+                 *      bmType = 1      : EEM (link) command
+                 */
+                if (header & BIT(15)) {
+                        u16     bmEEMCmd;
+
+                        /*
+                         * EEM (link) command packet:
+                         * b0..10:      bmEEMCmdParam
+                         * b11..13:     bmEEMCmd
+                         * b14:         bmReserved (must be 0)
+                         * b15:         1 (EEM command)
+                         */
+                        if (header & BIT(14)) {
+                                devdbg(dev, "reserved command %04x\n", header);
+                                continue;
+                        }
+
+                        bmEEMCmd = (header >> 11) & 0x7;
+                        switch (bmEEMCmd) {
+
+                        /* Responding to echo requests is mandatory. */
+                        case 0:         /* Echo command */
+                                len = header & 0x7FF;
+
+                                /* bogus command? */
+                                if (skb->len < len)
+                                        return 0;
+
+                                skb2 = skb_clone(skb, GFP_ATOMIC);
+                                if (unlikely(!skb2))
+                                        goto next;
+                                skb_trim(skb2, len);
+                                put_unaligned_le16(BIT(15) | (1 << 11) | len,
+                                                skb_push(skb2, 2));
+                                eem_linkcmd(dev, skb2);
+                                break;
+
+                        /*
+                         * Host may choose to ignore hints.
+                         *  - suspend: peripheral ready to suspend
+                         *  - response: suggest N millisec polling
+                         *  - response complete: suggest N sec polling
+                         */
+                        case 2:         /* Suspend hint */
+                        case 3:         /* Response hint */
+                        case 4:         /* Response complete hint */
+                                continue;
+
+                        /*
+                         * Hosts should never receive host-to-peripheral
+                         * or reserved command codes; or responses to an
+                         * echo command we didn't send.
+                         */
+                        case 1:         /* Echo response */
+                        case 5:         /* Tickle */
+                        default:        /* reserved */
+                                devwarn(dev, "unexpected link command %d\n",
+                                                bmEEMCmd);
+                                continue;
+                        }
+
+                } else {
+                        u32     crc, crc2;
+                        int     is_last;
+
+                        /* zero length EEM packet? */
+                        if (header == 0)
+                                continue;
+
+                        /*
+                         * EEM data packet header :
+                         * b0..13:      length of ethernet frame
+                         * b14:         bmCRC
+                         * b15:         0 (EEM data)
+                         */
+                        len = header & 0x3FFF;
+
+                        /* bogus EEM payload? */
+                        if (skb->len < len)
+                                return 0;
+
+                        /* bogus ethernet frame? */
+                        if (len < (ETH_HLEN + ETH_FCS_LEN))
+                                goto next;
+
+                        /*
+                         * Treat the last payload differently: framework
+                         * code expects our "fixup" to have stripped off
+                         * headers, so "skb" is a data packet (or error).
+                         * Else if it's not the last payload, keep "skb"
+                         * for further processing.
+                         */
+                        is_last = (len == skb->len);
+                        if (is_last)
+                                skb2 = skb;
+                        else {
+                                skb2 = skb_clone(skb, GFP_ATOMIC);
+                                if (unlikely(!skb2))
+                                        return 0;
+                        }
+
+                        crc = get_unaligned_le32(skb2->data
+                                        + len - ETH_FCS_LEN);
+                        skb_trim(skb2, len - ETH_FCS_LEN);
+
+                        /*
+                         * The bmCRC helps to denote when the CRC field in
+                         * the Ethernet frame contains a calculated CRC:
+                         *      bmCRC = 1       : CRC is calculated
+                         *      bmCRC = 0       : CRC = 0xDEADBEEF
+                         */
+                        if (header & BIT(14))
+                                crc2 = ~crc32_le(~0, skb2->data, len);
+                        else
+                                crc2 = 0xdeadbeef;
+
+                        if (is_last)
+                                return crc == crc2;
+
+                        if (unlikely(crc != crc2)) {
+                                dev->stats.rx_errors++;
+                                dev_kfree_skb_any(skb2);
+                        } else
+                                usbnet_skb_return(dev, skb2);
+                }
+
+next:
+                skb_pull(skb, len);
+        } while (skb->len);
+
+        return 1;
+}
+
+static const struct driver_info eem_info = {
+        .description =  "CDC EEM Device",
+        .flags =        FLAG_ETHER,
+        .bind =         eem_bind,
+        .rx_fixup =     eem_rx_fixup,
+        .tx_fixup =     eem_tx_fixup,
+};
+
+/*-------------------------------------------------------------------------*/
+
+static const struct usb_device_id products[] = {
+{
+        USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_EEM,
+                        USB_CDC_PROTO_EEM),
+        .driver_info = (unsigned long) &eem_info,
+},
+{
+        /* EMPTY == end of list */
+},
+};
+MODULE_DEVICE_TABLE(usb, products);
+
+static struct usb_driver eem_driver = {
+        .name =         "cdc_eem",
+        .id_table =     products,
+        .probe =        usbnet_probe,
+        .disconnect =   usbnet_disconnect,
+        .suspend =      usbnet_suspend,
+        .resume =       usbnet_resume,
+};
+
+
+static int __init eem_init(void)
+{
+        return usb_register(&eem_driver);
+}
+module_init(eem_init);
+
+static void __exit eem_exit(void)
+{
+        usb_deregister(&eem_driver);
+}
+module_exit(eem_exit);
+
+MODULE_AUTHOR("Omar Laazimani <omar.oberthur@gmail.com>");
+MODULE_DESCRIPTION("USB CDC EEM");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index dc166532659..5a7283372b5 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -941,6 +941,16 @@ static int smsc95xx_reset(struct usbnet *dev)
         if (netif_msg_ifup(dev))
                 devdbg(dev, "ID_REV = 0x%08x", read_buf);
 
+        /* Configure GPIO pins as LED outputs */
+        write_buf = LED_GPIO_CFG_SPD_LED | LED_GPIO_CFG_LNK_LED |
+                LED_GPIO_CFG_FDX_LED;
+        ret = smsc95xx_write_reg(dev, LED_GPIO_CFG, write_buf);
+        if (ret < 0) {
+                devwarn(dev, "Failed to write LED_GPIO_CFG register, ret=%d",
+                        ret);
+                return ret;
+        }
+
         /* Init Tx */
         write_buf = 0;
         ret = smsc95xx_write_reg(dev, FLOW, write_buf);
@@ -1231,6 +1241,11 @@ static const struct usb_device_id products[] = {
                 USB_DEVICE(0x0424, 0x9500),
                 .driver_info = (unsigned long) &smsc95xx_info,
         },
+        {
+                /* SMSC9512/9514 USB Hub & Ethernet Device */
+                USB_DEVICE(0x0424, 0xec00),
+                .driver_info = (unsigned long) &smsc95xx_info,
+        },
         { },            /* END */
 };
 MODULE_DEVICE_TABLE(usb, products);
diff --git a/drivers/net/usb/smsc95xx.h b/drivers/net/usb/smsc95xx.h
index 66b5c84f302..86bc44977fb 100644
--- a/drivers/net/usb/smsc95xx.h
+++ b/drivers/net/usb/smsc95xx.h
@@ -99,6 +99,9 @@
 #define PM_CTL_WUPS_MULTI_              (0x00000003)
 
 #define LED_GPIO_CFG                    (0x24)
+#define LED_GPIO_CFG_SPD_LED            (0x01000000)
+#define LED_GPIO_CFG_LNK_LED            (0x00100000)
+#define LED_GPIO_CFG_FDX_LED            (0x00010000)
 
 #define GPIO_CFG                        (0x28)
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 9c82a39497e..4d1d47953fc 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -616,10 +616,11 @@ static int virtnet_open(struct net_device *dev)
 static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
                                  struct scatterlist *data, int out, int in)
 {
-        struct scatterlist sg[VIRTNET_SEND_COMMAND_SG_MAX + 2];
+        struct scatterlist *s, sg[VIRTNET_SEND_COMMAND_SG_MAX + 2];
         struct virtio_net_ctrl_hdr ctrl;
         virtio_net_ctrl_ack status = ~0;
         unsigned int tmp;
+        int i;
 
         if (!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_VQ)) {
                 BUG();  /* Caller should know better */
@@ -637,7 +638,8 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
         sg_init_table(sg, out + in);
 
         sg_set_buf(&sg[0], &ctrl, sizeof(ctrl));
-        memcpy(&sg[1], data, sizeof(struct scatterlist) * (out + in - 2));
+        for_each_sg(data, s, out + in - 2, i)
+                sg_set_buf(&sg[i + 1], sg_virt(s), s->length);
         sg_set_buf(&sg[out + in - 1], &status, sizeof(status));
 
         if (vi->cvq->vq_ops->add_buf(vi->cvq, sg, out, in, vi) != 0)
@@ -692,7 +694,7 @@ static void virtnet_set_rx_mode(struct net_device *dev)
         promisc = ((dev->flags & IFF_PROMISC) != 0);
         allmulti = ((dev->flags & IFF_ALLMULTI) != 0);
 
-        sg_set_buf(sg, &promisc, sizeof(promisc));
+        sg_init_one(sg, &promisc, sizeof(promisc));
 
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
                                   VIRTIO_NET_CTRL_RX_PROMISC,
@@ -700,7 +702,7 @@ static void virtnet_set_rx_mode(struct net_device *dev)
                 dev_warn(&dev->dev, "Failed to %sable promisc mode.\n",
                          promisc ? "en" : "dis");
 
-        sg_set_buf(sg, &allmulti, sizeof(allmulti));
+        sg_init_one(sg, &allmulti, sizeof(allmulti));
 
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
                                   VIRTIO_NET_CTRL_RX_ALLMULTI,
@@ -716,6 +718,8 @@ static void virtnet_set_rx_mode(struct net_device *dev)
                 return;
         }
 
+        sg_init_table(sg, 2);
+
         /* Store the unicast list and count in the front of the buffer */
         mac_data->entries = dev->uc_count;
         addr = dev->uc_list;
@@ -744,24 +748,24 @@ static void virtnet_set_rx_mode(struct net_device *dev)
         kfree(buf);
 }
 
-static void virnet_vlan_rx_add_vid(struct net_device *dev, u16 vid)
+static void virtnet_vlan_rx_add_vid(struct net_device *dev, u16 vid)
 {
         struct virtnet_info *vi = netdev_priv(dev);
         struct scatterlist sg;
 
-        sg_set_buf(&sg, &vid, sizeof(vid));
+        sg_init_one(&sg, &vid, sizeof(vid));
 
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
                                   VIRTIO_NET_CTRL_VLAN_ADD, &sg, 1, 0))
                 dev_warn(&dev->dev, "Failed to add VLAN ID %d.\n", vid);
 }
 
-static void virnet_vlan_rx_kill_vid(struct net_device *dev, u16 vid)
+static void virtnet_vlan_rx_kill_vid(struct net_device *dev, u16 vid)
 {
         struct virtnet_info *vi = netdev_priv(dev);
         struct scatterlist sg;
 
-        sg_set_buf(&sg, &vid, sizeof(vid));
+        sg_init_one(&sg, &vid, sizeof(vid));
 
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
                                   VIRTIO_NET_CTRL_VLAN_DEL, &sg, 1, 0))
@@ -794,8 +798,8 @@ static const struct net_device_ops virtnet_netdev = {
         .ndo_set_mac_address = virtnet_set_mac_address,
         .ndo_set_rx_mode     = virtnet_set_rx_mode,
         .ndo_change_mtu      = virtnet_change_mtu,
-        .ndo_vlan_rx_add_vid = virnet_vlan_rx_add_vid,
-        .ndo_vlan_rx_kill_vid = virnet_vlan_rx_kill_vid,
+        .ndo_vlan_rx_add_vid = virtnet_vlan_rx_add_vid,
+        .ndo_vlan_rx_kill_vid = virtnet_vlan_rx_kill_vid,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller = virtnet_netpoll,
 #endif
diff --git a/drivers/net/wan/ixp4xx_hss.c b/drivers/net/wan/ixp4xx_hss.c
index 3bf7d3f447d..765a7f5d6aa 100644
--- a/drivers/net/wan/ixp4xx_hss.c
+++ b/drivers/net/wan/ixp4xx_hss.c
@@ -1249,7 +1249,7 @@ static int __devinit hss_init_one(struct platform_device *pdev)
                 return -ENOMEM;
 
         if ((port->npe = npe_request(0)) == NULL) {
-                err = -ENOSYS;
+                err = -ENODEV;
                 goto err_free;
         }
 
@@ -1311,7 +1311,7 @@ static int __init hss_init_module(void)
         if ((ixp4xx_read_feature_bits() &
              (IXP4XX_FEATURE_HDLC | IXP4XX_FEATURE_HSS)) !=
             (IXP4XX_FEATURE_HDLC | IXP4XX_FEATURE_HSS))
-                return -ENOSYS;
+                return -ENODEV;
 
         spin_lock_init(&npe_lock);
 
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index c36d3a3d655..d7347573912 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -6501,7 +6501,10 @@ static int airo_get_encode(struct net_device *dev,
 
         /* Copy the key to the user buffer */
         dwrq->length = get_wep_key(local, index, &buf[0], sizeof(buf));
-        memcpy(extra, buf, dwrq->length);
+        if (dwrq->length != -1)
+                memcpy(extra, buf, dwrq->length);
+        else
+                dwrq->length = 0;
 
         return 0;
 }
@@ -6659,7 +6662,10 @@ static int airo_get_encodeext(struct net_device *dev,
         
         /* Copy the key to the user buffer */
         ext->key_len = get_wep_key(local, idx, &buf[0], sizeof(buf));
-        memcpy(extra, buf, ext->key_len);
+        if (ext->key_len != -1)
+                memcpy(extra, buf, ext->key_len);
+        else
+                ext->key_len = 0;
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index a08bc8a4fb6..32df27a9c7a 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -214,7 +214,7 @@ static struct pci_driver ath5k_pci_driver = {
  * Prototypes - MAC 802.11 stack related functions
  */
 static int ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
-static int ath5k_reset(struct ath5k_softc *sc, bool stop, bool change_channel);
+static int ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan);
 static int ath5k_reset_wake(struct ath5k_softc *sc);
 static int ath5k_start(struct ieee80211_hw *hw);
 static void ath5k_stop(struct ieee80211_hw *hw);
@@ -1038,16 +1038,13 @@ ath5k_chan_set(struct ath5k_softc *sc, struct ieee80211_channel *chan)
         if (chan->center_freq != sc->curchan->center_freq ||
                 chan->hw_value != sc->curchan->hw_value) {
 
-                sc->curchan = chan;
-                sc->curband = &sc->sbands[chan->band];
-
                 /*
                  * To switch channels clear any pending DMA operations;
                  * wait long enough for the RX fifo to drain, reset the
                  * hardware at the new frequency, and then re-enable
                  * the relevant bits of the h/w.
                  */
-                return ath5k_reset(sc, true, true);
+                return ath5k_reset(sc, chan);
         }
 
         return 0;
@@ -2314,7 +2311,7 @@ ath5k_init(struct ath5k_softc *sc)
         sc->imask = AR5K_INT_RXOK | AR5K_INT_RXERR | AR5K_INT_RXEOL |
                 AR5K_INT_RXORN | AR5K_INT_TXDESC | AR5K_INT_TXEOL |
                 AR5K_INT_FATAL | AR5K_INT_GLOBAL;
-        ret = ath5k_reset(sc, false, false);
+        ret = ath5k_reset(sc, NULL);
         if (ret)
                 goto done;
 
@@ -2599,18 +2596,25 @@ drop_packet:
         return NETDEV_TX_OK;
 }
 
+/*
+ * Reset the hardware.  If chan is not NULL, then also pause rx/tx
+ * and change to the given channel.
+ */
 static int
-ath5k_reset(struct ath5k_softc *sc, bool stop, bool change_channel)
+ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan)
 {
         struct ath5k_hw *ah = sc->ah;
         int ret;
 
         ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "resetting\n");
 
-        if (stop) {
+        if (chan) {
                 ath5k_hw_set_imr(ah, 0);
                 ath5k_txq_cleanup(sc);
                 ath5k_rx_stop(sc);
+
+                sc->curchan = chan;
+                sc->curband = &sc->sbands[chan->band];
         }
         ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, true);
         if (ret) {
@@ -2648,7 +2652,7 @@ ath5k_reset_wake(struct ath5k_softc *sc)
 {
         int ret;
 
-        ret = ath5k_reset(sc, true, true);
+        ret = ath5k_reset(sc, sc->curchan);
         if (!ret)
                 ieee80211_wake_queues(sc->hw);
 
diff --git a/drivers/net/wireless/ath5k/debug.c b/drivers/net/wireless/ath5k/debug.c
index 9770bb3d40f..4904a07e4b5 100644
--- a/drivers/net/wireless/ath5k/debug.c
+++ b/drivers/net/wireless/ath5k/debug.c
@@ -424,7 +424,7 @@ ath5k_debug_dump_bands(struct ath5k_softc *sc)
 
         for (b = 0; b < IEEE80211_NUM_BANDS; b++) {
                 struct ieee80211_supported_band *band = &sc->sbands[b];
-                char bname[5];
+                char bname[6];
                 switch (band->band) {
                 case IEEE80211_BAND_2GHZ:
                         strcpy(bname, "2 GHz");
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index edfa5e149f7..bd438d8acf5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -101,8 +101,8 @@ struct iwl_cfg iwl6000_2agn_cfg = {
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
         .mod_params = &iwl50_mod_params,
-        .valid_tx_ant = ANT_BC,
-        .valid_rx_ant = ANT_BC,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
         .need_pll_cfg = false,
 };
 
@@ -117,8 +117,8 @@ struct iwl_cfg iwl6050_2agn_cfg = {
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
         .mod_params = &iwl50_mod_params,
-        .valid_tx_ant = ANT_BC,
-        .valid_rx_ant = ANT_BC,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
         .need_pll_cfg = false,
 };
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 1ef4192207a..3bb28db4a40 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -3636,7 +3636,9 @@ static struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x0085, 0x1112, iwl6000_2ag_cfg)},
         {IWL_PCI_DEVICE(0x0082, 0x1122, iwl6000_2ag_cfg)},
         {IWL_PCI_DEVICE(0x422B, PCI_ANY_ID, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x422C, PCI_ANY_ID, iwl6000_2agn_cfg)},
         {IWL_PCI_DEVICE(0x4238, PCI_ANY_ID, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x4239, PCI_ANY_ID, iwl6000_2agn_cfg)},
         {IWL_PCI_DEVICE(0x0082, PCI_ANY_ID, iwl6000_2agn_cfg)},
         {IWL_PCI_DEVICE(0x0085, PCI_ANY_ID, iwl6000_3agn_cfg)},
         {IWL_PCI_DEVICE(0x0086, PCI_ANY_ID, iwl6050_3agn_cfg)},
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 23644cf884f..e7c65c4f741 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -925,11 +925,11 @@ void iwl_bg_scan_completed(struct work_struct *work)
 
         IWL_DEBUG_SCAN(priv, "SCAN complete scan\n");
 
+        ieee80211_scan_completed(priv->hw, false);
+
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
-        ieee80211_scan_completed(priv->hw, false);
-
         /* Since setting the TXPOWER may have been deferred while
          * performing the scan, fire one off */
         mutex_lock(&priv->mutex);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 5798fe49c77..44ab03a12e4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -719,6 +719,14 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
 {
         unsigned long flags;
         int ret = 0;
+        __le16 key_flags = 0;
+
+        key_flags |= (STA_KEY_FLG_TKIP | STA_KEY_FLG_MAP_KEY_MSK);
+        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
+        key_flags &= ~STA_KEY_FLG_INVALID;
+
+        if (sta_id == priv->hw_params.bcast_sta_id)
+                key_flags |= STA_KEY_MULTICAST_MSK;
 
         keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
         keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
@@ -738,6 +746,9 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
         WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
                 "no space for a new key");
 
+        priv->stations[sta_id].sta.key.key_flags = key_flags;
+
+
         /* This copy is acutally not needed: we get the key with each TX */
         memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key, 16);
 
@@ -754,9 +765,7 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
 {
         u8 sta_id = IWL_INVALID_STATION;
         unsigned long flags;
-        __le16 key_flags = 0;
         int i;
-        DECLARE_MAC_BUF(mac);
 
         sta_id = iwl_find_station(priv, addr);
         if (sta_id == IWL_INVALID_STATION) {
@@ -771,16 +780,8 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
                 return;
         }
 
-        key_flags |= (STA_KEY_FLG_TKIP | STA_KEY_FLG_MAP_KEY_MSK);
-        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
-        key_flags &= ~STA_KEY_FLG_INVALID;
-
-        if (sta_id == priv->hw_params.bcast_sta_id)
-                key_flags |= STA_KEY_MULTICAST_MSK;
-
         spin_lock_irqsave(&priv->sta_lock, flags);
 
-        priv->stations[sta_id].sta.key.key_flags = key_flags;
         priv->stations[sta_id].sta.key.tkip_rx_tsc_byte2 = (u8) iv32;
 
         for (i = 0; i < 5; i++)
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 617c4235d97..4cce6613350 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -1694,7 +1694,6 @@ void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
         rxq->free_count = 0;
         spin_unlock_irqrestore(&rxq->lock, flags);
 }
-EXPORT_SYMBOL(iwl3945_rx_queue_reset);
 
 /*
  * this should be called while priv->lock is locked
@@ -1745,7 +1744,6 @@ static void iwl3945_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rx
         rxq->bd = NULL;
         rxq->rb_stts  = NULL;
 }
-EXPORT_SYMBOL(iwl3945_rx_queue_free);
 
 
 /* Convert linear signal-to-noise ratio into dB */
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index db91db77650..bebf735cd4b 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2558,6 +2558,11 @@ static int rndis_wext_bind(struct usbnet *usbdev, struct usb_interface *intf)
         mutex_init(&priv->command_lock);
         spin_lock_init(&priv->stats_lock);
 
+        /* because rndis_command() sleeps we need to use workqueue */
+        priv->workqueue = create_singlethread_workqueue("rndis_wlan");
+        INIT_WORK(&priv->work, rndis_wext_worker);
+        INIT_DELAYED_WORK(&priv->stats_work, rndis_update_wireless_stats);
+
         /* try bind rndis_host */
         retval = generic_rndis_bind(usbdev, intf, FLAG_RNDIS_PHYM_WIRELESS);
         if (retval < 0)
@@ -2603,16 +2608,17 @@ static int rndis_wext_bind(struct usbnet *usbdev, struct usb_interface *intf)
         disassociate(usbdev, 1);
         netif_carrier_off(usbdev->net);
 
-        /* because rndis_command() sleeps we need to use workqueue */
-        priv->workqueue = create_singlethread_workqueue("rndis_wlan");
-        INIT_DELAYED_WORK(&priv->stats_work, rndis_update_wireless_stats);
         queue_delayed_work(priv->workqueue, &priv->stats_work,
                 round_jiffies_relative(STATS_UPDATE_JIFFIES));
-        INIT_WORK(&priv->work, rndis_wext_worker);
 
         return 0;
 
 fail:
+        cancel_delayed_work_sync(&priv->stats_work);
+        cancel_work_sync(&priv->work);
+        flush_workqueue(priv->workqueue);
+        destroy_workqueue(priv->workqueue);
+
         kfree(priv);
         return retval;
 }
diff --git a/drivers/net/wireless/rtl818x/rtl8187.h b/drivers/net/wireless/rtl818x/rtl8187.h
index 9718f61809c..edeff82a4d0 100644
--- a/drivers/net/wireless/rtl818x/rtl8187.h
+++ b/drivers/net/wireless/rtl818x/rtl8187.h
@@ -120,6 +120,12 @@ struct rtl8187_priv {
                 __le64 buf;
                 struct sk_buff_head queue;
         } b_tx_status; /* This queue is used by both -b and non-b devices */
+        struct mutex io_mutex;
+        union {
+                u8 bits8;
+                __le16 bits16;
+                __le32 bits32;
+        } *io_dmabuf;
 };
 
 void rtl8187_write_phy(struct ieee80211_hw *dev, u8 addr, u32 data);
@@ -129,10 +135,14 @@ static inline u8 rtl818x_ioread8_idx(struct rtl8187_priv *priv,
 {
         u8 val;
 
+        mutex_lock(&priv->io_mutex);
         usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
                         RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
-                        (unsigned long)addr, idx & 0x03, &val,
-                        sizeof(val), HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits8, sizeof(val), HZ / 2);
+
+        val = priv->io_dmabuf->bits8;
+        mutex_unlock(&priv->io_mutex);
 
         return val;
 }
@@ -147,10 +157,14 @@ static inline u16 rtl818x_ioread16_idx(struct rtl8187_priv *priv,
 {
         __le16 val;
 
+        mutex_lock(&priv->io_mutex);
         usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
                         RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
-                        (unsigned long)addr, idx & 0x03, &val,
-                        sizeof(val), HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits16, sizeof(val), HZ / 2);
+
+        val = priv->io_dmabuf->bits16;
+        mutex_unlock(&priv->io_mutex);
 
         return le16_to_cpu(val);
 }
@@ -165,10 +179,14 @@ static inline u32 rtl818x_ioread32_idx(struct rtl8187_priv *priv,
 {
         __le32 val;
 
+        mutex_lock(&priv->io_mutex);
         usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
                         RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
-                        (unsigned long)addr, idx & 0x03, &val,
-                        sizeof(val), HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits32, sizeof(val), HZ / 2);
+
+        val = priv->io_dmabuf->bits32;
+        mutex_unlock(&priv->io_mutex);
 
         return le32_to_cpu(val);
 }
@@ -181,10 +199,15 @@ static inline u32 rtl818x_ioread32(struct rtl8187_priv *priv, __le32 *addr)
 static inline void rtl818x_iowrite8_idx(struct rtl8187_priv *priv,
                                         u8 *addr, u8 val, u8 idx)
 {
+        mutex_lock(&priv->io_mutex);
+
+        priv->io_dmabuf->bits8 = val;
         usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                         RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        (unsigned long)addr, idx & 0x03, &val,
-                        sizeof(val), HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits8, sizeof(val), HZ / 2);
+
+        mutex_unlock(&priv->io_mutex);
 }
 
 static inline void rtl818x_iowrite8(struct rtl8187_priv *priv, u8 *addr, u8 val)
@@ -195,12 +218,15 @@ static inline void rtl818x_iowrite8(struct rtl8187_priv *priv, u8 *addr, u8 val)
 static inline void rtl818x_iowrite16_idx(struct rtl8187_priv *priv,
                                          __le16 *addr, u16 val, u8 idx)
 {
-        __le16 buf = cpu_to_le16(val);
+        mutex_lock(&priv->io_mutex);
 
+        priv->io_dmabuf->bits16 = cpu_to_le16(val);
         usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                         RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        (unsigned long)addr, idx & 0x03, &buf, sizeof(buf),
-                        HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits16, sizeof(val), HZ / 2);
+
+        mutex_unlock(&priv->io_mutex);
 }
 
 static inline void rtl818x_iowrite16(struct rtl8187_priv *priv, __le16 *addr,
@@ -212,12 +238,15 @@ static inline void rtl818x_iowrite16(struct rtl8187_priv *priv, __le16 *addr,
 static inline void rtl818x_iowrite32_idx(struct rtl8187_priv *priv,
                                          __le32 *addr, u32 val, u8 idx)
 {
-        __le32 buf = cpu_to_le32(val);
+        mutex_lock(&priv->io_mutex);
 
+        priv->io_dmabuf->bits32 = cpu_to_le32(val);
         usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                         RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        (unsigned long)addr, idx & 0x03, &buf, sizeof(buf),
-                        HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits32, sizeof(val), HZ / 2);
+
+        mutex_unlock(&priv->io_mutex);
 }
 
 static inline void rtl818x_iowrite32(struct rtl8187_priv *priv, __le32 *addr,
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index fd81884b9c7..bac6cfba6ab 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -1329,6 +1329,14 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         priv = dev->priv;
         priv->is_rtl8187b = (id->driver_info == DEVICE_RTL8187B);
 
+        /* allocate "DMA aware" buffer for register accesses */
+        priv->io_dmabuf = kmalloc(sizeof(*priv->io_dmabuf), GFP_KERNEL);
+        if (!priv->io_dmabuf) {
+                err = -ENOMEM;
+                goto err_free_dev;
+        }
+        mutex_init(&priv->io_mutex);
+
         SET_IEEE80211_DEV(dev, &intf->dev);
         usb_set_intfdata(intf, dev);
         priv->udev = udev;
@@ -1495,7 +1503,7 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         err = ieee80211_register_hw(dev);
         if (err) {
                 printk(KERN_ERR "rtl8187: Cannot register device\n");
-                goto err_free_dev;
+                goto err_free_dmabuf;
         }
         mutex_init(&priv->conf_mutex);
         skb_queue_head_init(&priv->b_tx_status.queue);
@@ -1506,6 +1514,8 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
 
         return 0;
 
+ err_free_dmabuf:
+        kfree(priv->io_dmabuf);
  err_free_dev:
         ieee80211_free_hw(dev);
         usb_set_intfdata(intf, NULL);
@@ -1526,6 +1536,7 @@ static void __devexit rtl8187_disconnect(struct usb_interface *intf)
         priv = dev->priv;
         usb_reset_device(priv->udev);
         usb_put_dev(interface_to_usbdev(intf));
+        kfree(priv->io_dmabuf);
         ieee80211_free_hw(dev);
 }
 
diff --git a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
index 78df281b297..a09819386a1 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
@@ -88,9 +88,15 @@ static void rtl8225_write_8051(struct ieee80211_hw *dev, u8 addr, __le16 data)
         rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg80);
         udelay(10);
 
+        mutex_lock(&priv->io_mutex);
+
+        priv->io_dmabuf->bits16 = data;
         usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                         RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        addr, 0x8225, &data, sizeof(data), HZ / 2);
+                        addr, 0x8225, &priv->io_dmabuf->bits16, sizeof(data),
+                        HZ / 2);
+
+        mutex_unlock(&priv->io_mutex);
 
         rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg80 | (1 << 2));
         udelay(10);
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 001b328adf8..a563fbe559d 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -59,6 +59,10 @@
 #define DMA_32BIT_PFN           IOVA_PFN(DMA_BIT_MASK(32))
 #define DMA_64BIT_PFN           IOVA_PFN(DMA_BIT_MASK(64))
 
+#ifndef PHYSICAL_PAGE_MASK
+#define PHYSICAL_PAGE_MASK PAGE_MASK
+#endif
+
 /* global iommu list, set NULL for ignored DMAR units */
 static struct intel_iommu **g_iommus;
 
@@ -1216,7 +1220,7 @@ static void dmar_init_reserved_ranges(void)
                         if (!r->flags || !(r->flags & IORESOURCE_MEM))
                                 continue;
                         addr = r->start;
-                        addr &= PAGE_MASK;
+                        addr &= PHYSICAL_PAGE_MASK;
                         size = r->end - addr;
                         size = PAGE_ALIGN(size);
                         iova = reserve_iova(&reserved_iova_list, IOVA_PFN(addr),
@@ -2173,7 +2177,8 @@ static dma_addr_t __intel_map_single(struct device *hwdev, phys_addr_t paddr,
          * is not a big problem
          */
         ret = domain_page_mapping(domain, start_paddr,
-                ((u64)paddr) & PAGE_MASK, size, prot);
+                                  ((u64)paddr) & PHYSICAL_PAGE_MASK,
+                                  size, prot);
         if (ret)
                 goto error;
 
@@ -2463,8 +2468,8 @@ static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int ne
                 addr = page_to_phys(sg_page(sg)) + sg->offset;
                 size = aligned_size((u64)addr, sg->length);
                 ret = domain_page_mapping(domain, start_addr + offset,
-                        ((u64)addr) & PAGE_MASK,
-                        size, prot);
+                                          ((u64)addr) & PHYSICAL_PAGE_MASK,
+                                          size, prot);
                 if (ret) {
                         /*  clear the page */
                         dma_pte_clear_range(domain, start_addr,
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 6f2e6295e77..362773247fb 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -455,8 +455,6 @@ static int msix_capability_init(struct pci_dev *dev,
                 entry->msi_attrib.default_irq = dev->irq;
                 entry->msi_attrib.pos = pos;
                 entry->mask_base = base;
-                entry->masked = readl(base + j * PCI_MSIX_ENTRY_SIZE +
-                                        PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET);
                 msix_mask_irq(entry, 1);
 
                 list_add_tail(&entry->list, &dev->msi_list);
@@ -493,6 +491,12 @@ static int msix_capability_init(struct pci_dev *dev,
         msix_set_enable(dev, 1);
         dev->msix_enabled = 1;
 
+        list_for_each_entry(entry, &dev->msi_list, list) {
+                int vector = entry->msi_attrib.entry_nr;
+                entry->masked = readl(base + vector * PCI_MSIX_ENTRY_SIZE +
+                                        PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET);
+        }
+
         return 0;
 }
 
diff --git a/drivers/pci/pcie/aer/aerdrv.h b/drivers/pci/pcie/aer/aerdrv.h
index c7ad68b6c6d..aa14482a477 100644
--- a/drivers/pci/pcie/aer/aerdrv.h
+++ b/drivers/pci/pcie/aer/aerdrv.h
@@ -95,6 +95,9 @@ struct aer_broadcast_data {
 static inline pci_ers_result_t merge_result(enum pci_ers_result orig,
                 enum pci_ers_result new)
 {
+        if (new == PCI_ERS_RESULT_NONE)
+                return orig;
+
         switch (orig) {
         case PCI_ERS_RESULT_CAN_RECOVER:
         case PCI_ERS_RESULT_RECOVERED:
diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
index b924e2463f8..091ce70051e 100644
--- a/drivers/pci/pcie/portdrv_pci.c
+++ b/drivers/pci/pcie/portdrv_pci.c
@@ -200,7 +200,7 @@ static int slot_reset_iter(struct device *device, void *data)
 
 static pci_ers_result_t pcie_portdrv_slot_reset(struct pci_dev *dev)
 {
-        pci_ers_result_t status = PCI_ERS_RESULT_NONE;
+        pci_ers_result_t status = PCI_ERS_RESULT_RECOVERED;
         int retval;
 
         /* If fatal, restore cfg space for possible link reset at upstream */
diff --git a/drivers/rtc/rtc-twl4030.c b/drivers/rtc/rtc-twl4030.c
index a6341e4f9a0..9c8c70c497d 100644
--- a/drivers/rtc/rtc-twl4030.c
+++ b/drivers/rtc/rtc-twl4030.c
@@ -495,9 +495,7 @@ static int twl4030_rtc_suspend(struct platform_device *pdev, pm_message_t state)
 {
         irqstat = rtc_irq_bits;
 
-        /* REVISIT alarm may need to wake us from sleep */
-        mask_rtc_irq_bit(BIT_RTC_INTERRUPTS_REG_IT_TIMER_M |
-                         BIT_RTC_INTERRUPTS_REG_IT_ALARM_M);
+        mask_rtc_irq_bit(BIT_RTC_INTERRUPTS_REG_IT_TIMER_M);
         return 0;
 }
 
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index 616c60ffcf2..3ac27ee4739 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -97,9 +97,7 @@ static void __init zfcp_init_device_configure(char *busid, u64 wwpn, u64 lun)
         ccw_device_set_online(adapter->ccw_device);
 
         zfcp_erp_wait(adapter);
-        wait_event(adapter->erp_done_wqh,
-                   !(atomic_read(&unit->status) &
-                                ZFCP_STATUS_UNIT_SCSI_WORK_PENDING));
+        flush_work(&unit->scsi_work);
 
         down(&zfcp_data.config_sema);
         zfcp_unit_put(unit);
@@ -279,6 +277,7 @@ struct zfcp_unit *zfcp_unit_enqueue(struct zfcp_port *port, u64 fcp_lun)
 
         atomic_set(&unit->refcount, 0);
         init_waitqueue_head(&unit->remove_wq);
+        INIT_WORK(&unit->scsi_work, zfcp_scsi_scan);
 
         unit->port = port;
         unit->fcp_lun = fcp_lun;
@@ -525,6 +524,8 @@ int zfcp_adapter_enqueue(struct ccw_device *ccw_device)
 
         atomic_clear_mask(ZFCP_STATUS_COMMON_REMOVE, &adapter->status);
 
+        zfcp_fc_nameserver_init(adapter);
+
         if (!zfcp_adapter_scsi_register(adapter))
                 return 0;
 
@@ -553,7 +554,6 @@ void zfcp_adapter_dequeue(struct zfcp_adapter *adapter)
 
         cancel_work_sync(&adapter->scan_work);
         cancel_work_sync(&adapter->stat_work);
-        cancel_delayed_work_sync(&adapter->nsp.work);
         zfcp_adapter_scsi_unregister(adapter);
         sysfs_remove_group(&adapter->ccw_device->dev.kobj,
                            &zfcp_sysfs_adapter_attrs);
@@ -671,8 +671,7 @@ void zfcp_port_dequeue(struct zfcp_port *port)
         list_del(&port->list);
         write_unlock_irq(&zfcp_data.config_lock);
         if (port->rport)
-                fc_remote_port_delete(port->rport);
-        port->rport = NULL;
+                port->rport->dd_data = NULL;
         zfcp_adapter_put(port->adapter);
         sysfs_remove_group(&port->sysfs_device.kobj, &zfcp_sysfs_port_attrs);
         device_unregister(&port->sysfs_device);
diff --git a/drivers/s390/scsi/zfcp_ccw.c b/drivers/s390/scsi/zfcp_ccw.c
index cfb0dcb6e3f..733fe3bf628 100644
--- a/drivers/s390/scsi/zfcp_ccw.c
+++ b/drivers/s390/scsi/zfcp_ccw.c
@@ -108,7 +108,6 @@ static int zfcp_ccw_set_online(struct ccw_device *ccw_device)
         /* initialize request counter */
         BUG_ON(!zfcp_reqlist_isempty(adapter));
         adapter->req_no = 0;
-        zfcp_fc_nameserver_init(adapter);
 
         zfcp_erp_modify_adapter_status(adapter, "ccsonl1", NULL,
                                        ZFCP_STATUS_COMMON_RUNNING, ZFCP_SET);
diff --git a/drivers/s390/scsi/zfcp_cfdc.c b/drivers/s390/scsi/zfcp_cfdc.c
index 10cbfd172a2..8305c874e86 100644
--- a/drivers/s390/scsi/zfcp_cfdc.c
+++ b/drivers/s390/scsi/zfcp_cfdc.c
@@ -4,7 +4,7 @@
  * Userspace interface for accessing the
  * Access Control Lists / Control File Data Channel
  *
- * Copyright IBM Corporation 2008
+ * Copyright IBM Corporation 2008, 2009
  */
 
 #define KMSG_COMPONENT "zfcp"
@@ -197,6 +197,7 @@ static long zfcp_cfdc_dev_ioctl(struct file *file, unsigned int command,
                 retval = -ENXIO;
                 goto free_buffer;
         }
+        zfcp_adapter_get(adapter);
 
         retval = zfcp_cfdc_sg_setup(data->command, fsf_cfdc->sg,
                                     data_user->control_file);
diff --git a/drivers/s390/scsi/zfcp_def.h b/drivers/s390/scsi/zfcp_def.h
index a0318630f04..4c362a9069f 100644
--- a/drivers/s390/scsi/zfcp_def.h
+++ b/drivers/s390/scsi/zfcp_def.h
@@ -255,7 +255,6 @@ enum zfcp_wka_status {
 /* logical unit status */
 #define ZFCP_STATUS_UNIT_SHARED                 0x00000004
 #define ZFCP_STATUS_UNIT_READONLY               0x00000008
-#define ZFCP_STATUS_UNIT_SCSI_WORK_PENDING      0x00000020
 
 /* FSF request status (this does not have a common part) */
 #define ZFCP_STATUS_FSFREQ_TASK_MANAGEMENT      0x00000002
@@ -530,6 +529,7 @@ struct zfcp_unit {
         struct zfcp_erp_action erp_action;     /* pending error recovery */
         atomic_t               erp_counter;
         struct zfcp_latencies   latencies;
+        struct work_struct      scsi_work;
 };
 
 /* FSF request */
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index 631bdb1dfd6..fdc9b4352a6 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -719,6 +719,7 @@ static void zfcp_erp_adapter_strategy_close(struct zfcp_erp_action *act)
         zfcp_qdio_close(adapter);
         zfcp_fsf_req_dismiss_all(adapter);
         adapter->fsf_req_seq_no = 0;
+        zfcp_fc_wka_port_force_offline(&adapter->nsp);
         /* all ports and units are closed */
         zfcp_erp_modify_adapter_status(adapter, "erascl1", NULL,
                                        ZFCP_STATUS_COMMON_OPEN, ZFCP_CLEAR);
@@ -1176,48 +1177,6 @@ static void zfcp_erp_action_dequeue(struct zfcp_erp_action *erp_action)
         }
 }
 
-struct zfcp_erp_add_work {
-        struct zfcp_unit  *unit;
-        struct work_struct work;
-};
-
-static void zfcp_erp_scsi_scan(struct work_struct *work)
-{
-        struct zfcp_erp_add_work *p =
-                container_of(work, struct zfcp_erp_add_work, work);
-        struct zfcp_unit *unit = p->unit;
-        struct fc_rport *rport = unit->port->rport;
-
-        if (rport && rport->port_state == FC_PORTSTATE_ONLINE)
-                scsi_scan_target(&rport->dev, 0, rport->scsi_target_id,
-                         scsilun_to_int((struct scsi_lun *)&unit->fcp_lun), 0);
-        atomic_clear_mask(ZFCP_STATUS_UNIT_SCSI_WORK_PENDING, &unit->status);
-        zfcp_unit_put(unit);
-        wake_up(&unit->port->adapter->erp_done_wqh);
-        kfree(p);
-}
-
-static void zfcp_erp_schedule_work(struct zfcp_unit *unit)
-{
-        struct zfcp_erp_add_work *p;
-
-        p = kzalloc(sizeof(*p), GFP_KERNEL);
-        if (!p) {
-                dev_err(&unit->port->adapter->ccw_device->dev,
-                        "Registering unit 0x%016Lx on port 0x%016Lx failed\n",
-                        (unsigned long long)unit->fcp_lun,
-                        (unsigned long long)unit->port->wwpn);
-                return;
-        }
-
-        zfcp_unit_get(unit);
-        atomic_set_mask(ZFCP_STATUS_UNIT_SCSI_WORK_PENDING, &unit->status);
-        INIT_WORK(&p->work, zfcp_erp_scsi_scan);
-        p->unit = unit;
-        if (!queue_work(zfcp_data.work_queue, &p->work))
-                zfcp_unit_put(unit);
-}
-
 static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result)
 {
         struct zfcp_adapter *adapter = act->adapter;
@@ -1226,11 +1185,11 @@ static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result)
 
         switch (act->action) {
         case ZFCP_ERP_ACTION_REOPEN_UNIT:
-                flush_work(&port->rport_work);
                 if ((result == ZFCP_ERP_SUCCEEDED) && !unit->device) {
-                        if (!(atomic_read(&unit->status) &
-                              ZFCP_STATUS_UNIT_SCSI_WORK_PENDING))
-                                zfcp_erp_schedule_work(unit);
+                        zfcp_unit_get(unit);
+                        if (scsi_queue_work(unit->port->adapter->scsi_host,
+                                            &unit->scsi_work) <= 0)
+                                zfcp_unit_put(unit);
                 }
                 zfcp_unit_put(unit);
                 break;
@@ -1352,6 +1311,11 @@ static int zfcp_erp_thread(void *data)
 
         while (!(atomic_read(&adapter->status) &
                  ZFCP_STATUS_ADAPTER_ERP_THREAD_KILL)) {
+
+                zfcp_rec_dbf_event_thread_lock("erthrd1", adapter);
+                ignore = down_interruptible(&adapter->erp_ready_sem);
+                zfcp_rec_dbf_event_thread_lock("erthrd2", adapter);
+
                 write_lock_irqsave(&adapter->erp_lock, flags);
                 next = adapter->erp_ready_head.next;
                 write_unlock_irqrestore(&adapter->erp_lock, flags);
@@ -1363,10 +1327,6 @@ static int zfcp_erp_thread(void *data)
                         if (zfcp_erp_strategy(act) != ZFCP_ERP_DISMISSED)
                                 zfcp_erp_wakeup(adapter);
                 }
-
-                zfcp_rec_dbf_event_thread_lock("erthrd1", adapter);
-                ignore = down_interruptible(&adapter->erp_ready_sem);
-                zfcp_rec_dbf_event_thread_lock("erthrd2", adapter);
         }
 
         atomic_clear_mask(ZFCP_STATUS_ADAPTER_ERP_THREAD_UP, &adapter->status);
diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
index f6399ca97bc..2e31b536548 100644
--- a/drivers/s390/scsi/zfcp_ext.h
+++ b/drivers/s390/scsi/zfcp_ext.h
@@ -106,6 +106,7 @@ extern void zfcp_fc_plogi_evaluate(struct zfcp_port *, struct fsf_plogi *);
 extern void zfcp_test_link(struct zfcp_port *);
 extern void zfcp_fc_link_test_work(struct work_struct *);
 extern void zfcp_fc_nameserver_init(struct zfcp_adapter *);
+extern void zfcp_fc_wka_port_force_offline(struct zfcp_wka_port *);
 
 /* zfcp_fsf.c */
 extern int zfcp_fsf_open_port(struct zfcp_erp_action *);
@@ -158,6 +159,7 @@ extern void zfcp_scsi_rport_work(struct work_struct *);
 extern void zfcp_scsi_schedule_rport_register(struct zfcp_port *);
 extern void zfcp_scsi_schedule_rport_block(struct zfcp_port *);
 extern void zfcp_scsi_schedule_rports_block(struct zfcp_adapter *);
+extern void zfcp_scsi_scan(struct work_struct *);
 
 /* zfcp_sysfs.c */
 extern struct attribute_group zfcp_sysfs_unit_attrs;
diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c
index e8d032b9dfb..19ae0842047 100644
--- a/drivers/s390/scsi/zfcp_fc.c
+++ b/drivers/s390/scsi/zfcp_fc.c
@@ -98,13 +98,6 @@ static void zfcp_wka_port_offline(struct work_struct *work)
         struct zfcp_wka_port *wka_port =
                         container_of(dw, struct zfcp_wka_port, work);
 
-        /* Don't wait forvever. If the wka_port is too busy take it offline
-           through a new call later */
-        if (!wait_event_timeout(wka_port->completion_wq,
-                                atomic_read(&wka_port->refcount) == 0,
-                                HZ >> 1))
-                return;
-
         mutex_lock(&wka_port->mutex);
         if ((atomic_read(&wka_port->refcount) != 0) ||
             (wka_port->status != ZFCP_WKA_PORT_ONLINE))
@@ -142,6 +135,14 @@ void zfcp_fc_nameserver_init(struct zfcp_adapter *adapter)
         INIT_DELAYED_WORK(&wka_port->work, zfcp_wka_port_offline);
 }
 
+void zfcp_fc_wka_port_force_offline(struct zfcp_wka_port *wka)
+{
+        cancel_delayed_work_sync(&wka->work);
+        mutex_lock(&wka->mutex);
+        wka->status = ZFCP_WKA_PORT_OFFLINE;
+        mutex_unlock(&wka->mutex);
+}
+
 static void _zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req, u32 range,
                                    struct fcp_rscn_element *elem)
 {
@@ -372,7 +373,8 @@ static void zfcp_fc_adisc_handler(unsigned long data)
 
         if (adisc->els.status) {
                 /* request rejected or timed out */
-                zfcp_erp_port_forced_reopen(port, 0, "fcadh_1", NULL);
+                zfcp_erp_port_forced_reopen(port, ZFCP_STATUS_COMMON_ERP_FAILED,
+                                            "fcadh_1", NULL);
                 goto out;
         }
 
@@ -431,11 +433,6 @@ void zfcp_fc_link_test_work(struct work_struct *work)
                 container_of(work, struct zfcp_port, test_link_work);
         int retval;
 
-        if (!(atomic_read(&port->status) & ZFCP_STATUS_COMMON_UNBLOCKED)) {
-                zfcp_port_put(port);
-                return; /* port erp is running and will update rport status */
-        }
-
         zfcp_port_get(port);
         port->rport_task = RPORT_DEL;
         zfcp_scsi_rport_work(&port->rport_work);
@@ -542,6 +539,9 @@ static void zfcp_validate_port(struct zfcp_port *port)
 {
         struct zfcp_adapter *adapter = port->adapter;
 
+        if (!(atomic_read(&port->status) & ZFCP_STATUS_COMMON_NOESC))
+                return;
+
         atomic_clear_mask(ZFCP_STATUS_COMMON_NOESC, &port->status);
 
         if ((port->supported_classes != 0) ||
@@ -602,10 +602,8 @@ static int zfcp_scan_eval_gpn_ft(struct zfcp_gpn_ft *gpn_ft, int max_entries)
                 if (acc->wwpn == fc_host_port_name(adapter->scsi_host))
                         continue;
                 port = zfcp_get_port_by_wwpn(adapter, acc->wwpn);
-                if (port) {
-                        zfcp_port_get(port);
+                if (port)
                         continue;
-                }
 
                 port = zfcp_port_enqueue(adapter, acc->wwpn,
                                          ZFCP_STATUS_COMMON_NOESC, d_id);
@@ -637,7 +635,8 @@ int zfcp_scan_ports(struct zfcp_adapter *adapter)
         max_entries = chain ? ZFCP_GPN_FT_MAX_ENTRIES : ZFCP_GPN_FT_ENTRIES;
         max_bytes = chain ? ZFCP_GPN_FT_MAX_SIZE : ZFCP_CT_SIZE_ONE_PAGE;
 
-        if (fc_host_port_type(adapter->scsi_host) != FC_PORTTYPE_NPORT)
+        if (fc_host_port_type(adapter->scsi_host) != FC_PORTTYPE_NPORT &&
+            fc_host_port_type(adapter->scsi_host) != FC_PORTTYPE_NPIV)
                 return 0;
 
         ret = zfcp_wka_port_get(&adapter->nsp);
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index b29f3121b66..74dee32afba 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -172,12 +172,16 @@ static void zfcp_fsf_link_down_info_eval(struct zfcp_fsf_req *req, char *id,
                                          struct fsf_link_down_info *link_down)
 {
         struct zfcp_adapter *adapter = req->adapter;
+        unsigned long flags;
 
         if (atomic_read(&adapter->status) & ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED)
                 return;
 
         atomic_set_mask(ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED, &adapter->status);
+
+        read_lock_irqsave(&zfcp_data.config_lock, flags);
         zfcp_scsi_schedule_rports_block(adapter);
+        read_unlock_irqrestore(&zfcp_data.config_lock, flags);
 
         if (!link_down)
                 goto out;
@@ -645,30 +649,30 @@ static void zfcp_fsf_exchange_port_data_handler(struct zfcp_fsf_req *req)
         }
 }
 
-static int zfcp_fsf_req_sbal_get(struct zfcp_adapter *adapter)
-        __releases(&adapter->req_q_lock)
-        __acquires(&adapter->req_q_lock)
+static int zfcp_fsf_sbal_check(struct zfcp_adapter *adapter)
 {
         struct zfcp_qdio_queue *req_q = &adapter->req_q;
-        long ret;
 
-        if (atomic_read(&req_q->count) <= -REQUEST_LIST_SIZE)
-                return -EIO;
-        if (atomic_read(&req_q->count) > 0)
-                return 0;
+        spin_lock_bh(&adapter->req_q_lock);
+        if (atomic_read(&req_q->count))
+                return 1;
+        spin_unlock_bh(&adapter->req_q_lock);
+        return 0;
+}
+
+static int zfcp_fsf_req_sbal_get(struct zfcp_adapter *adapter)
+{
+        long ret;
 
-        atomic_dec(&req_q->count);
         spin_unlock_bh(&adapter->req_q_lock);
         ret = wait_event_interruptible_timeout(adapter->request_wq,
-                                        atomic_read(&req_q->count) >= 0,
-                                        5 * HZ);
-        spin_lock_bh(&adapter->req_q_lock);
-        atomic_inc(&req_q->count);
-
+                               zfcp_fsf_sbal_check(adapter), 5 * HZ);
         if (ret > 0)
                 return 0;
         if (!ret)
                 atomic_inc(&adapter->qdio_outb_full);
+
+        spin_lock_bh(&adapter->req_q_lock);
         return -EIO;
 }
 
@@ -766,8 +770,9 @@ static struct zfcp_fsf_req *zfcp_fsf_req_create(struct zfcp_adapter *adapter,
 static int zfcp_fsf_req_send(struct zfcp_fsf_req *req)
 {
         struct zfcp_adapter *adapter = req->adapter;
-        unsigned long flags;
-        int idx;
+        unsigned long        flags;
+        int                  idx;
+        int                  with_qtcb = (req->qtcb != NULL);
 
         /* put allocated FSF request into hash table */
         spin_lock_irqsave(&adapter->req_list_lock, flags);
@@ -789,7 +794,7 @@ static int zfcp_fsf_req_send(struct zfcp_fsf_req *req)
         }
 
         /* Don't increase for unsolicited status */
-        if (req->qtcb)
+        if (with_qtcb)
                 adapter->fsf_req_seq_no++;
         adapter->req_no++;
 
@@ -1253,13 +1258,13 @@ int zfcp_fsf_exchange_config_data_sync(struct zfcp_adapter *adapter,
 
         spin_lock_bh(&adapter->req_q_lock);
         if (zfcp_fsf_req_sbal_get(adapter))
-                goto out;
+                goto out_unlock;
 
         req = zfcp_fsf_req_create(adapter, FSF_QTCB_EXCHANGE_CONFIG_DATA,
                                   0, NULL);
         if (IS_ERR(req)) {
                 retval = PTR_ERR(req);
-                goto out;
+                goto out_unlock;
         }
 
         sbale = zfcp_qdio_sbale_req(req);
@@ -1278,14 +1283,16 @@ int zfcp_fsf_exchange_config_data_sync(struct zfcp_adapter *adapter,
 
         zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
         retval = zfcp_fsf_req_send(req);
-out:
         spin_unlock_bh(&adapter->req_q_lock);
         if (!retval)
                 wait_event(req->completion_wq,
                            req->status & ZFCP_STATUS_FSFREQ_COMPLETED);
 
         zfcp_fsf_req_free(req);
+        return retval;
 
+out_unlock:
+        spin_unlock_bh(&adapter->req_q_lock);
         return retval;
 }
 
@@ -1352,13 +1359,13 @@ int zfcp_fsf_exchange_port_data_sync(struct zfcp_adapter *adapter,
 
         spin_lock_bh(&adapter->req_q_lock);
         if (zfcp_fsf_req_sbal_get(adapter))
-                goto out;
+                goto out_unlock;
 
         req = zfcp_fsf_req_create(adapter, FSF_QTCB_EXCHANGE_PORT_DATA, 0,
                                   NULL);
         if (IS_ERR(req)) {
                 retval = PTR_ERR(req);
-                goto out;
+                goto out_unlock;
         }
 
         if (data)
@@ -1371,14 +1378,18 @@ int zfcp_fsf_exchange_port_data_sync(struct zfcp_adapter *adapter,
         req->handler = zfcp_fsf_exchange_port_data_handler;
         zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
         retval = zfcp_fsf_req_send(req);
-out:
         spin_unlock_bh(&adapter->req_q_lock);
+
         if (!retval)
                 wait_event(req->completion_wq,
                            req->status & ZFCP_STATUS_FSFREQ_COMPLETED);
         zfcp_fsf_req_free(req);
 
         return retval;
+
+out_unlock:
+        spin_unlock_bh(&adapter->req_q_lock);
+        return retval;
 }
 
 static void zfcp_fsf_open_port_handler(struct zfcp_fsf_req *req)
@@ -2472,8 +2483,6 @@ out:
 
 static void zfcp_fsf_control_file_handler(struct zfcp_fsf_req *req)
 {
-        if (req->qtcb->header.fsf_status != FSF_GOOD)
-                req->status |= ZFCP_STATUS_FSFREQ_ERROR;
 }
 
 /**
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 58201e1ae47..e8fbeaeb5fb 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -171,7 +171,7 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
                 write_unlock_irqrestore(&adapter->abort_lock, flags);
                 zfcp_scsi_dbf_event_abort("lte1", adapter, scpnt, NULL,
                                           old_req_id);
-                return SUCCESS;
+                return FAILED; /* completion could be in progress */
         }
         old_req->data = NULL;
 
@@ -486,10 +486,12 @@ static void zfcp_set_rport_dev_loss_tmo(struct fc_rport *rport, u32 timeout)
  */
 static void zfcp_scsi_dev_loss_tmo_callbk(struct fc_rport *rport)
 {
-        struct zfcp_port *port = rport->dd_data;
+        struct zfcp_port *port;
 
         write_lock_irq(&zfcp_data.config_lock);
-        port->rport = NULL;
+        port = rport->dd_data;
+        if (port)
+                port->rport = NULL;
         write_unlock_irq(&zfcp_data.config_lock);
 }
 
@@ -503,9 +505,18 @@ static void zfcp_scsi_dev_loss_tmo_callbk(struct fc_rport *rport)
  */
 static void zfcp_scsi_terminate_rport_io(struct fc_rport *rport)
 {
-        struct zfcp_port *port = rport->dd_data;
+        struct zfcp_port *port;
+
+        write_lock_irq(&zfcp_data.config_lock);
+        port = rport->dd_data;
+        if (port)
+                zfcp_port_get(port);
+        write_unlock_irq(&zfcp_data.config_lock);
 
-        zfcp_erp_port_reopen(port, 0, "sctrpi1", NULL);
+        if (port) {
+                zfcp_erp_port_reopen(port, 0, "sctrpi1", NULL);
+                zfcp_port_put(port);
+        }
 }
 
 static void zfcp_scsi_rport_register(struct zfcp_port *port)
@@ -534,8 +545,10 @@ static void zfcp_scsi_rport_register(struct zfcp_port *port)
 
 static void zfcp_scsi_rport_block(struct zfcp_port *port)
 {
-        if (port->rport)
-                fc_remote_port_delete(port->rport);
+        struct fc_rport *rport = port->rport;
+
+        if (rport)
+                fc_remote_port_delete(rport);
 }
 
 void zfcp_scsi_schedule_rport_register(struct zfcp_port *port)
@@ -583,6 +596,23 @@ void zfcp_scsi_rport_work(struct work_struct *work)
 }
 
 
+void zfcp_scsi_scan(struct work_struct *work)
+{
+        struct zfcp_unit *unit = container_of(work, struct zfcp_unit,
+                                              scsi_work);
+        struct fc_rport *rport;
+
+        flush_work(&unit->port->rport_work);
+        rport = unit->port->rport;
+
+        if (rport && rport->port_state == FC_PORTSTATE_ONLINE)
+                scsi_scan_target(&rport->dev, 0, rport->scsi_target_id,
+                                 scsilun_to_int((struct scsi_lun *)
+                                                &unit->fcp_lun), 0);
+
+        zfcp_unit_put(unit);
+}
+
 struct fc_function_template zfcp_transport_functions = {
         .show_starget_port_id = 1,
         .show_starget_port_name = 1,
diff --git a/drivers/s390/scsi/zfcp_sysfs.c b/drivers/s390/scsi/zfcp_sysfs.c
index 9a3b8e261c0..3e51e64d110 100644
--- a/drivers/s390/scsi/zfcp_sysfs.c
+++ b/drivers/s390/scsi/zfcp_sysfs.c
@@ -254,12 +254,21 @@ static ssize_t zfcp_sysfs_unit_remove_store(struct device *dev,
 
         write_lock_irq(&zfcp_data.config_lock);
         unit = zfcp_get_unit_by_lun(port, fcp_lun);
-        if (unit && (atomic_read(&unit->refcount) == 0)) {
-                zfcp_unit_get(unit);
-                atomic_set_mask(ZFCP_STATUS_COMMON_REMOVE, &unit->status);
-                list_move(&unit->list, &unit_remove_lh);
-        } else
-                unit = NULL;
+        if (unit) {
+                write_unlock_irq(&zfcp_data.config_lock);
+                /* wait for possible timeout during SCSI probe */
+                flush_work(&unit->scsi_work);
+                write_lock_irq(&zfcp_data.config_lock);
+
+                if (atomic_read(&unit->refcount) == 0) {
+                        zfcp_unit_get(unit);
+                        atomic_set_mask(ZFCP_STATUS_COMMON_REMOVE,
+                                        &unit->status);
+                        list_move(&unit->list, &unit_remove_lh);
+                } else {
+                        unit = NULL;
+                }
+        }
 
         write_unlock_irq(&zfcp_data.config_lock);
 
diff --git a/drivers/scsi/cxgb3i/cxgb3i.h b/drivers/scsi/cxgb3i/cxgb3i.h
index d362860e750..59b0958d2d1 100644
--- a/drivers/scsi/cxgb3i/cxgb3i.h
+++ b/drivers/scsi/cxgb3i/cxgb3i.h
@@ -34,7 +34,7 @@
 #include "cxgb3i_offload.h"
 #include "cxgb3i_ddp.h"
 
-#define CXGB3I_SCSI_QDEPTH_DFLT 128
+#define CXGB3I_SCSI_HOST_QDEPTH 1024
 #define CXGB3I_MAX_TARGET       CXGB3I_MAX_CONN
 #define CXGB3I_MAX_LUN          512
 #define ISCSI_PDU_NONPAYLOAD_MAX \
diff --git a/drivers/scsi/cxgb3i/cxgb3i_ddp.c b/drivers/scsi/cxgb3i/cxgb3i_ddp.c
index d06a661c209..99c91254790 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_ddp.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_ddp.c
@@ -120,20 +120,26 @@ static void clear_ddp_map(struct cxgb3i_ddp_info *ddp, unsigned int tag,
 }
 
 static inline int ddp_find_unused_entries(struct cxgb3i_ddp_info *ddp,
-                                          int start, int max, int count,
+                                          unsigned int start, unsigned int max,
+                                          unsigned int count,
                                           struct cxgb3i_gather_list *gl)
 {
-        unsigned int i, j;
+        unsigned int i, j, k;
 
+        /* not enough entries */
+        if ((max - start) < count)
+                return -EBUSY;
+
+        max -= count;
         spin_lock(&ddp->map_lock);
-        for (i = start; i <= max;) {
-                for (j = 0; j < count; j++) {
-                        if (ddp->gl_map[i + j])
+        for (i = start; i < max;) {
+                for (j = 0, k = i; j < count; j++, k++) {
+                        if (ddp->gl_map[k])
                                 break;
                 }
                 if (j == count) {
-                        for (j = 0; j < count; j++)
-                                ddp->gl_map[i + j] = gl;
+                        for (j = 0, k = i; j < count; j++, k++)
+                                ddp->gl_map[k] = gl;
                         spin_unlock(&ddp->map_lock);
                         return i;
                 }
@@ -354,7 +360,7 @@ int cxgb3i_ddp_tag_reserve(struct t3cdev *tdev, unsigned int tid,
         struct cxgb3i_ddp_info *ddp = tdev->ulp_iscsi;
         struct pagepod_hdr hdr;
         unsigned int npods;
-        int idx = -1, idx_max;
+        int idx = -1;
         int err = -ENOMEM;
         u32 sw_tag = *tagp;
         u32 tag;
@@ -367,17 +373,17 @@ int cxgb3i_ddp_tag_reserve(struct t3cdev *tdev, unsigned int tid,
         }
 
         npods = (gl->nelem + PPOD_PAGES_MAX - 1) >> PPOD_PAGES_SHIFT;
-        idx_max = ddp->nppods - npods + 1;
 
         if (ddp->idx_last == ddp->nppods)
-                idx = ddp_find_unused_entries(ddp, 0, idx_max, npods, gl);
+                idx = ddp_find_unused_entries(ddp, 0, ddp->nppods, npods, gl);
         else {
                 idx = ddp_find_unused_entries(ddp, ddp->idx_last + 1,
-                                              idx_max, npods, gl);
-                if (idx < 0 && ddp->idx_last >= npods)
+                                              ddp->nppods, npods, gl);
+                if (idx < 0 && ddp->idx_last >= npods) {
                         idx = ddp_find_unused_entries(ddp, 0,
-                                                      ddp->idx_last - npods + 1,
+                                min(ddp->idx_last + npods, ddp->nppods),
                                                       npods, gl);
+                }
         }
         if (idx < 0) {
                 ddp_log_debug("xferlen %u, gl %u, npods %u NO DDP.\n",
diff --git a/drivers/scsi/cxgb3i/cxgb3i_iscsi.c b/drivers/scsi/cxgb3i/cxgb3i_iscsi.c
index fff8e432764..9212400b9b1 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_iscsi.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_iscsi.c
@@ -876,13 +876,14 @@ static struct scsi_host_template cxgb3i_host_template = {
         .proc_name              = "cxgb3i",
         .queuecommand           = iscsi_queuecommand,
         .change_queue_depth     = iscsi_change_queue_depth,
-        .can_queue              = CXGB3I_SCSI_QDEPTH_DFLT - 1,
+        .can_queue              = CXGB3I_SCSI_HOST_QDEPTH,
         .sg_tablesize           = SG_ALL,
         .max_sectors            = 0xFFFF,
-        .cmd_per_lun            = CXGB3I_SCSI_QDEPTH_DFLT,
+        .cmd_per_lun            = ISCSI_DEF_CMD_PER_LUN,
         .eh_abort_handler       = iscsi_eh_abort,
         .eh_device_reset_handler = iscsi_eh_device_reset,
         .eh_target_reset_handler = iscsi_eh_target_reset,
+        .target_alloc           = iscsi_target_alloc,
         .use_clustering         = DISABLE_CLUSTERING,
         .this_id                = -1,
 };
diff --git a/drivers/scsi/cxgb3i/cxgb3i_offload.c b/drivers/scsi/cxgb3i/cxgb3i_offload.c
index 4d8654cdbda..e11c9c180f3 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_offload.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_offload.c
@@ -1737,7 +1737,7 @@ int cxgb3i_c3cn_send_pdus(struct s3_conn *c3cn, struct sk_buff *skb)
                 c3cn_tx_debug("c3cn 0x%p, snd %u - %u > %u.\n",
                                 c3cn, c3cn->write_seq, c3cn->snd_una,
                                 cxgb3_snd_win);
-                err = -EAGAIN;
+                err = -ENOBUFS;
                 goto out_err;
         }
 
@@ -1775,6 +1775,8 @@ done:
 out_err:
         if (copied == 0 && err == -EPIPE)
                 copied = c3cn->err ? c3cn->err : -EPIPE;
+        else
+                copied = err;
         goto done;
 }
 
diff --git a/drivers/scsi/cxgb3i/cxgb3i_pdu.c b/drivers/scsi/cxgb3i/cxgb3i_pdu.c
index 7eebc9a7cb3..70910507117 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_pdu.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_pdu.c
@@ -400,17 +400,18 @@ int cxgb3i_conn_xmit_pdu(struct iscsi_task *task)
                 return 0;
         }
 
-        if (err < 0 && err != -EAGAIN) {
-                kfree_skb(skb);
-                cxgb3i_tx_debug("itt 0x%x, skb 0x%p, len %u/%u, xmit err %d.\n",
-                                task->itt, skb, skb->len, skb->data_len, err);
-                iscsi_conn_printk(KERN_ERR, task->conn, "xmit err %d.\n", err);
-                iscsi_conn_failure(task->conn, ISCSI_ERR_XMIT_FAILED);
+        if (err == -EAGAIN || err == -ENOBUFS) {
+                /* reset skb to send when we are called again */
+                tdata->skb = skb;
                 return err;
         }
-        /* reset skb to send when we are called again */
-        tdata->skb = skb;
-        return -EAGAIN;
+
+        kfree_skb(skb);
+        cxgb3i_tx_debug("itt 0x%x, skb 0x%p, len %u/%u, xmit err %d.\n",
+                        task->itt, skb, skb->len, skb->data_len, err);
+        iscsi_conn_printk(KERN_ERR, task->conn, "xmit err %d.\n", err);
+        iscsi_conn_failure(task->conn, ISCSI_ERR_XMIT_FAILED);
+        return err;
 }
 
 int cxgb3i_pdu_init(void)
diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c
index 94e1e318977..03e1926f40b 100644
--- a/drivers/scsi/fcoe/fcoe.c
+++ b/drivers/scsi/fcoe/fcoe.c
@@ -57,7 +57,7 @@ DEFINE_RWLOCK(fcoe_hostlist_lock);
 DEFINE_TIMER(fcoe_timer, NULL, 0, 0);
 DEFINE_PER_CPU(struct fcoe_percpu_s, fcoe_percpu);
 
-/* Function Prototyes */
+/* Function Prototypes */
 static int fcoe_reset(struct Scsi_Host *shost);
 static int fcoe_xmit(struct fc_lport *, struct fc_frame *);
 static int fcoe_rcv(struct sk_buff *, struct net_device *,
@@ -138,7 +138,6 @@ static struct scsi_host_template fcoe_shost_template = {
 /**
  * fcoe_lport_config() - sets up the fc_lport
  * @lp: ptr to the fc_lport
- * @shost: ptr to the parent scsi host
  *
  * Returns: 0 for success
  */
@@ -256,6 +255,7 @@ static int fcoe_netdev_config(struct fc_lport *lp, struct net_device *netdev)
         rtnl_lock();
         memcpy(flogi_maddr, (u8[6]) FC_FCOE_FLOGI_MAC, ETH_ALEN);
         dev_unicast_add(fc->real_dev, flogi_maddr, ETH_ALEN);
+        dev_mc_add(fc->real_dev, FIP_ALL_ENODE_MACS, ETH_ALEN, 0);
         rtnl_unlock();
 
         /*
@@ -380,7 +380,7 @@ static int fcoe_if_destroy(struct net_device *netdev)
         dev_mc_delete(fc->real_dev, FIP_ALL_ENODE_MACS, ETH_ALEN, 0);
         rtnl_unlock();
 
-        /* Free the per-CPU revieve threads */
+        /* Free the per-CPU receive threads */
         fcoe_percpu_clean(lp);
 
         /* Free existing skbs */
@@ -720,7 +720,7 @@ static void fcoe_percpu_thread_destroy(unsigned int cpu)
         }
 #else
         /*
-         * This a non-SMP scenario where the singluar Rx thread is
+         * This a non-SMP scenario where the singular Rx thread is
          * being removed. Free all skbs and stop the thread.
          */
         spin_lock_bh(&p->fcoe_rx_list.lock);
@@ -777,7 +777,7 @@ static struct notifier_block fcoe_cpu_notifier = {
  * @skb: the receive skb
  * @dev: associated net device
  * @ptype: context
- * @odldev: last device
+ * @olddev: last device
  *
  * this function will receive the packet and build fc frame and pass it up
  *
@@ -884,7 +884,6 @@ err2:
         kfree_skb(skb);
         return -1;
 }
-EXPORT_SYMBOL_GPL(fcoe_rcv);
 
 /**
  * fcoe_start_io() - pass to netdev to start xmit for fcoe
@@ -905,7 +904,7 @@ static inline int fcoe_start_io(struct sk_buff *skb)
 }
 
 /**
- * fcoe_get_paged_crc_eof() - in case we need alloc a page for crc_eof
+ * fcoe_get_paged_crc_eof() - in case we need to alloc a page for crc_eof
  * @skb: the skb to be xmitted
  * @tlen: total len
  *
@@ -947,7 +946,7 @@ static int fcoe_get_paged_crc_eof(struct sk_buff *skb, int tlen)
 
 /**
  * fcoe_fc_crc() - calculates FC CRC in this fcoe skb
- * @fp: the fc_frame containg data to be checksummed
+ * @fp: the fc_frame containing data to be checksummed
  *
  * This uses crc32() to calculate the crc for fc frame
  * Return   : 32 bit crc
@@ -1011,7 +1010,7 @@ int fcoe_xmit(struct fc_lport *lp, struct fc_frame *fp)
         wlen = skb->len / FCOE_WORD_TO_BYTE;
 
         if (!lp->link_up) {
-                kfree(skb);
+                kfree_skb(skb);
                 return 0;
         }
 
@@ -1062,7 +1061,7 @@ int fcoe_xmit(struct fc_lport *lp, struct fc_frame *fp)
                 cp = NULL;
         }
 
-        /* adjust skb netowrk/transport offsets to match mac/fcoe/fc */
+        /* adjust skb network/transport offsets to match mac/fcoe/fc */
         skb_push(skb, elen + hlen);
         skb_reset_mac_header(skb);
         skb_reset_network_header(skb);
@@ -1123,7 +1122,6 @@ int fcoe_xmit(struct fc_lport *lp, struct fc_frame *fp)
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(fcoe_xmit);
 
 /**
  * fcoe_percpu_receive_thread() - recv thread per cpu
@@ -1296,17 +1294,16 @@ void fcoe_watchdog(ulong vp)
 
 
 /**
- * fcoe_check_wait_queue() - put the skb into fcoe pending xmit queue
- * @lp: the fc_port for this skb
- * @skb: the associated skb to be xmitted
+ * fcoe_check_wait_queue() - attempt to clear the transmit backlog
+ * @lp: the fc_lport
  *
  * This empties the wait_queue, dequeue the head of the wait_queue queue
  * and calls fcoe_start_io() for each packet, if all skb have been
  * transmitted, return qlen or -1 if a error occurs, then restore
- * wait_queue and  try again later.
+ * wait_queue and try again later.
  *
  * The wait_queue is used when the skb transmit fails. skb will go
- * in the wait_queue which will be emptied by the time function OR
+ * in the wait_queue which will be emptied by the timer function or
  * by the next skb transmit.
  *
  * Returns: 0 for success
@@ -1355,10 +1352,6 @@ out:
  */
 static void fcoe_dev_setup()
 {
-        /*
-         * here setup a interface specific wd time to
-         * monitor the link state
-         */
         register_netdevice_notifier(&fcoe_notifier);
 }
 
@@ -1437,10 +1430,9 @@ out:
 
 /**
  * fcoe_if_to_netdev() - parse a name buffer to get netdev
- * @ifname: fixed array for output parsed ifname
  * @buffer: incoming buffer to be copied
  *
- * Returns: NULL or ptr to netdeive
+ * Returns: NULL or ptr to net_device
  */
 static struct net_device *fcoe_if_to_netdev(const char *buffer)
 {
@@ -1458,7 +1450,7 @@ static struct net_device *fcoe_if_to_netdev(const char *buffer)
 }
 
 /**
- * fcoe_netdev_to_module_owner() - finds out the nic drive moddule of the netdev
+ * fcoe_netdev_to_module_owner() - finds out the driver module of the netdev
  * @netdev: the target netdev
  *
  * Returns: ptr to the struct module, NULL for failure
@@ -1488,7 +1480,7 @@ fcoe_netdev_to_module_owner(const struct net_device *netdev)
  * Holds the Ethernet driver module by try_module_get() for
  * the corresponding netdev.
  *
- * Returns: 0 for succsss
+ * Returns: 0 for success
  */
 static int fcoe_ethdrv_get(const struct net_device *netdev)
 {
@@ -1510,7 +1502,7 @@ static int fcoe_ethdrv_get(const struct net_device *netdev)
  * Releases the Ethernet driver module by module_put for
  * the corresponding netdev.
  *
- * Returns: 0 for succsss
+ * Returns: 0 for success
  */
 static int fcoe_ethdrv_put(const struct net_device *netdev)
 {
@@ -1528,7 +1520,7 @@ static int fcoe_ethdrv_put(const struct net_device *netdev)
 
 /**
  * fcoe_destroy() - handles the destroy from sysfs
- * @buffer: expcted to be a eth if name
+ * @buffer: expected to be an eth if name
  * @kp: associated kernel param
  *
  * Returns: 0 for success
@@ -1565,7 +1557,7 @@ out_nodev:
 
 /**
  * fcoe_create() - Handles the create call from sysfs
- * @buffer: expcted to be a eth if name
+ * @buffer: expected to be an eth if name
  * @kp: associated kernel param
  *
  * Returns: 0 for success
@@ -1652,7 +1644,6 @@ int fcoe_link_ok(struct fc_lport *lp)
 
         return rc;
 }
-EXPORT_SYMBOL_GPL(fcoe_link_ok);
 
 /**
  * fcoe_percpu_clean() - Clear the pending skbs for an lport
@@ -1684,7 +1675,6 @@ void fcoe_percpu_clean(struct fc_lport *lp)
                 spin_unlock_bh(&pp->fcoe_rx_list.lock);
         }
 }
-EXPORT_SYMBOL_GPL(fcoe_percpu_clean);
 
 /**
  * fcoe_clean_pending_queue() - Dequeue a skb and free it
@@ -1705,7 +1695,6 @@ void fcoe_clean_pending_queue(struct fc_lport *lp)
         }
         spin_unlock_bh(&fc->fcoe_pending_queue.lock);
 }
-EXPORT_SYMBOL_GPL(fcoe_clean_pending_queue);
 
 /**
  * fcoe_reset() - Resets the fcoe
@@ -1719,11 +1708,10 @@ int fcoe_reset(struct Scsi_Host *shost)
         fc_lport_reset(lport);
         return 0;
 }
-EXPORT_SYMBOL_GPL(fcoe_reset);
 
 /**
  * fcoe_hostlist_lookup_softc() - find the corresponding lport by a given device
- * @device: this is currently ptr to net_device
+ * @dev: this is currently ptr to net_device
  *
  * Returns: NULL or the located fcoe_softc
  */
@@ -1757,11 +1745,10 @@ struct fc_lport *fcoe_hostlist_lookup(const struct net_device *netdev)
 
         return (fc) ? fc->ctlr.lp : NULL;
 }
-EXPORT_SYMBOL_GPL(fcoe_hostlist_lookup);
 
 /**
  * fcoe_hostlist_add() - Add a lport to lports list
- * @lp: ptr to the fc_lport to badded
+ * @lp: ptr to the fc_lport to be added
  *
  * Returns: 0 for success
  */
@@ -1778,11 +1765,10 @@ int fcoe_hostlist_add(const struct fc_lport *lp)
         }
         return 0;
 }
-EXPORT_SYMBOL_GPL(fcoe_hostlist_add);
 
 /**
  * fcoe_hostlist_remove() - remove a lport from lports list
- * @lp: ptr to the fc_lport to badded
+ * @lp: ptr to the fc_lport to be removed
  *
  * Returns: 0 for success
  */
@@ -1798,7 +1784,6 @@ int fcoe_hostlist_remove(const struct fc_lport *lp)
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(fcoe_hostlist_remove);
 
 /**
  * fcoe_init() - fcoe module loading initialization
diff --git a/drivers/scsi/fcoe/libfcoe.c b/drivers/scsi/fcoe/libfcoe.c
index f410f4abb54..62ba0f39c6b 100644
--- a/drivers/scsi/fcoe/libfcoe.c
+++ b/drivers/scsi/fcoe/libfcoe.c
@@ -122,7 +122,7 @@ static void fcoe_ctlr_reset_fcfs(struct fcoe_ctlr *fip)
 }
 
 /**
- * fcoe_ctrl_destroy() - Disable and tear-down the FCoE controller.
+ * fcoe_ctlr_destroy() - Disable and tear-down the FCoE controller.
  * @fip:        FCoE controller.
  *
  * This is called by FCoE drivers before freeing the &fcoe_ctlr.
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index c09d77591f9..dd689ded860 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -3654,6 +3654,7 @@ static int ipr_slave_configure(struct scsi_device *sdev)
 {
         struct ipr_ioa_cfg *ioa_cfg = (struct ipr_ioa_cfg *) sdev->host->hostdata;
         struct ipr_resource_entry *res;
+        struct ata_port *ap = NULL;
         unsigned long lock_flags = 0;
 
         spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
@@ -3672,12 +3673,16 @@ static int ipr_slave_configure(struct scsi_device *sdev)
                 }
                 if (ipr_is_vset_device(res) || ipr_is_scsi_disk(res))
                         sdev->allow_restart = 1;
-                if (ipr_is_gata(res) && res->sata_port) {
+                if (ipr_is_gata(res) && res->sata_port)
+                        ap = res->sata_port->ap;
+                spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
+
+                if (ap) {
                         scsi_adjust_queue_depth(sdev, 0, IPR_MAX_CMD_PER_ATA_LUN);
-                        ata_sas_slave_configure(sdev, res->sata_port->ap);
-                } else {
+                        ata_sas_slave_configure(sdev, ap);
+                } else
                         scsi_adjust_queue_depth(sdev, 0, sdev->host->cmd_per_lun);
-                }
+                return 0;
         }
         spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
         return 0;
diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
index b3e5e08e44a..b7c092d63bb 100644
--- a/drivers/scsi/iscsi_tcp.c
+++ b/drivers/scsi/iscsi_tcp.c
@@ -463,7 +463,7 @@ static int iscsi_sw_tcp_pdu_init(struct iscsi_task *task,
         }
 
         if (err) {
-                iscsi_conn_failure(conn, err);
+                /* got invalid offset/len */
                 return -EIO;
         }
         return 0;
@@ -851,6 +851,7 @@ static struct scsi_host_template iscsi_sw_tcp_sht = {
         .use_clustering         = DISABLE_CLUSTERING,
         .slave_alloc            = iscsi_sw_tcp_slave_alloc,
         .slave_configure        = iscsi_sw_tcp_slave_configure,
+        .target_alloc           = iscsi_target_alloc,
         .proc_name              = "iscsi_tcp",
         .this_id                = -1,
 };
diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c
index e57556ea5b4..4c880656990 100644
--- a/drivers/scsi/libfc/fc_disc.c
+++ b/drivers/scsi/libfc/fc_disc.c
@@ -113,6 +113,11 @@ void fc_disc_stop_rports(struct fc_disc *disc)
                 lport->tt.rport_logoff(rport);
         }
 
+        list_for_each_entry_safe(rdata, next, &disc->rogue_rports, peers) {
+                rport = PRIV_TO_RPORT(rdata);
+                lport->tt.rport_logoff(rport);
+        }
+
         mutex_unlock(&disc->disc_mutex);
 }
 
@@ -131,23 +136,32 @@ static void fc_disc_rport_callback(struct fc_lport *lport,
 {
         struct fc_rport_libfc_priv *rdata = rport->dd_data;
         struct fc_disc *disc = &lport->disc;
-        int found = 0;
 
         FC_DEBUG_DISC("Received a %d event for port (%6x)\n", event,
                       rport->port_id);
 
-        if (event == RPORT_EV_CREATED) {
+        switch (event) {
+        case RPORT_EV_CREATED:
                 if (disc) {
-                        found = 1;
                         mutex_lock(&disc->disc_mutex);
                         list_add_tail(&rdata->peers, &disc->rports);
                         mutex_unlock(&disc->disc_mutex);
                 }
+                break;
+        case RPORT_EV_LOGO:
+        case RPORT_EV_FAILED:
+        case RPORT_EV_STOP:
+                mutex_lock(&disc->disc_mutex);
+                mutex_lock(&rdata->rp_mutex);
+                if (rdata->trans_state == FC_PORTSTATE_ROGUE)
+                        list_del(&rdata->peers);
+                mutex_unlock(&rdata->rp_mutex);
+                mutex_unlock(&disc->disc_mutex);
+                break;
+        default:
+                break;
         }
 
-        if (!found)
-                FC_DEBUG_DISC("The rport (%6x) is not maintained "
-                              "by the discovery layer\n", rport->port_id);
 }
 
 /**
@@ -439,6 +453,7 @@ static int fc_disc_new_target(struct fc_disc *disc,
                         rdata = rport->dd_data;
                         rdata->ops = &fc_disc_rport_ops;
                         rdata->rp_state = RPORT_ST_INIT;
+                        list_add_tail(&rdata->peers, &disc->rogue_rports);
                         lport->tt.rport_login(rport);
                 }
         }
@@ -461,21 +476,29 @@ static void fc_disc_del_target(struct fc_disc *disc, struct fc_rport *rport)
 /**
  * fc_disc_done() - Discovery has been completed
  * @disc: FC discovery context
+ * Locking Note: This function expects that the disc mutex is locked before
+ * it is called. The discovery callback is then made with the lock released,
+ * and the lock is re-taken before returning from this function
  */
 static void fc_disc_done(struct fc_disc *disc)
 {
         struct fc_lport *lport = disc->lport;
+        enum fc_disc_event event;
 
         FC_DEBUG_DISC("Discovery complete for port (%6x)\n",
                       fc_host_port_id(lport->host));
 
-        disc->disc_callback(lport, disc->event);
+        event = disc->event;
         disc->event = DISC_EV_NONE;
 
         if (disc->requested)
                 fc_disc_gpn_ft_req(disc);
         else
                 disc->pending = 0;
+
+        mutex_unlock(&disc->disc_mutex);
+        disc->disc_callback(lport, event);
+        mutex_lock(&disc->disc_mutex);
 }
 
 /**
@@ -622,6 +645,8 @@ static int fc_disc_gpn_ft_parse(struct fc_disc *disc, void *buf, size_t len)
                                 rdata = rport->dd_data;
                                 rdata->ops = &fc_disc_rport_ops;
                                 rdata->local_port = lport;
+                                list_add_tail(&rdata->peers,
+                                              &disc->rogue_rports);
                                 lport->tt.rport_login(rport);
                         } else
                                 FC_DBG("Failed to allocate memory for "
@@ -681,8 +706,8 @@ static void fc_disc_timeout(struct work_struct *work)
  * @fp: response frame
  * @lp_arg: Fibre Channel host port instance
  *
- * Locking Note: This function expects that the disc_mutex is locked
- *               before it is called.
+ * Locking Note: This function is called without disc mutex held, and
+ *               should do all its processing with the mutex held
  */
 static void fc_disc_gpn_ft_resp(struct fc_seq *sp, struct fc_frame *fp,
                                 void *disc_arg)
@@ -695,11 +720,13 @@ static void fc_disc_gpn_ft_resp(struct fc_seq *sp, struct fc_frame *fp,
         unsigned int len;
         int error;
 
+        mutex_lock(&disc->disc_mutex);
         FC_DEBUG_DISC("Received a GPN_FT response on port (%6x)\n",
                       fc_host_port_id(disc->lport->host));
 
         if (IS_ERR(fp)) {
                 fc_disc_error(disc, fp);
+                mutex_unlock(&disc->disc_mutex);
                 return;
         }
 
@@ -744,6 +771,8 @@ static void fc_disc_gpn_ft_resp(struct fc_seq *sp, struct fc_frame *fp,
                         disc->seq_count++;
         }
         fc_frame_free(fp);
+
+        mutex_unlock(&disc->disc_mutex);
 }
 
 /**
@@ -757,7 +786,6 @@ static void fc_disc_gpn_ft_resp(struct fc_seq *sp, struct fc_frame *fp,
 static void fc_disc_single(struct fc_disc *disc, struct fc_disc_port *dp)
 {
         struct fc_lport *lport;
-        struct fc_rport *rport;
         struct fc_rport *new_rport;
         struct fc_rport_libfc_priv *rdata;
 
@@ -766,15 +794,12 @@ static void fc_disc_single(struct fc_disc *disc, struct fc_disc_port *dp)
         if (dp->ids.port_id == fc_host_port_id(lport->host))
                 goto out;
 
-        rport = lport->tt.rport_lookup(lport, dp->ids.port_id);
-        if (rport)
-                fc_disc_del_target(disc, rport);
-
         new_rport = lport->tt.rport_create(dp);
         if (new_rport) {
                 rdata = new_rport->dd_data;
                 rdata->ops = &fc_disc_rport_ops;
                 kfree(dp);
+                list_add_tail(&rdata->peers, &disc->rogue_rports);
                 lport->tt.rport_login(new_rport);
         }
         return;
@@ -836,6 +861,7 @@ int fc_disc_init(struct fc_lport *lport)
         INIT_DELAYED_WORK(&disc->disc_work, fc_disc_timeout);
         mutex_init(&disc->disc_mutex);
         INIT_LIST_HEAD(&disc->rports);
+        INIT_LIST_HEAD(&disc->rogue_rports);
 
         disc->lport = lport;
         disc->delay = FC_DISC_DELAY;
diff --git a/drivers/scsi/libfc/fc_elsct.c b/drivers/scsi/libfc/fc_elsct.c
index dd47fe619d1..5878b34bff1 100644
--- a/drivers/scsi/libfc/fc_elsct.c
+++ b/drivers/scsi/libfc/fc_elsct.c
@@ -41,7 +41,7 @@ static struct fc_seq *fc_elsct_send(struct fc_lport *lport,
                                     void *arg, u32 timer_msec)
 {
         enum fc_rctl r_ctl;
-        u32 did;
+        u32 did = FC_FID_NONE;
         enum fc_fh_type fh_type;
         int rc;
 
diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c
index f555ae99ad4..521f996f9b1 100644
--- a/drivers/scsi/libfc/fc_fcp.c
+++ b/drivers/scsi/libfc/fc_fcp.c
@@ -713,7 +713,7 @@ done:
 static void fc_fcp_recv(struct fc_seq *seq, struct fc_frame *fp, void *arg)
 {
         struct fc_fcp_pkt *fsp = (struct fc_fcp_pkt *)arg;
-        struct fc_lport *lp;
+        struct fc_lport *lport = fsp->lp;
         struct fc_frame_header *fh;
         struct fcp_txrdy *dd;
         u8 r_ctl;
@@ -724,9 +724,8 @@ static void fc_fcp_recv(struct fc_seq *seq, struct fc_frame *fp, void *arg)
 
         fh = fc_frame_header_get(fp);
         r_ctl = fh->fh_r_ctl;
-        lp = fsp->lp;
 
-        if (!(lp->state & LPORT_ST_READY))
+        if (!(lport->state & LPORT_ST_READY))
                 goto out;
         if (fc_fcp_lock_pkt(fsp))
                 goto out;
@@ -779,7 +778,7 @@ errout:
         if (IS_ERR(fp))
                 fc_fcp_error(fsp, fp);
         else if (rc == -ENOMEM)
-                fc_fcp_reduce_can_queue(lp);
+                fc_fcp_reduce_can_queue(lport);
 }
 
 static void fc_fcp_resp(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
index b8178ef398d..e0c247724d2 100644
--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -618,6 +618,11 @@ int fc_fabric_logoff(struct fc_lport *lport)
 {
         lport->tt.disc_stop_final(lport);
         mutex_lock(&lport->lp_mutex);
+        if (lport->dns_rp)
+                lport->tt.rport_logoff(lport->dns_rp);
+        mutex_unlock(&lport->lp_mutex);
+        lport->tt.rport_flush_queue();
+        mutex_lock(&lport->lp_mutex);
         fc_lport_enter_logo(lport);
         mutex_unlock(&lport->lp_mutex);
         cancel_delayed_work_sync(&lport->retry_work);
@@ -639,7 +644,12 @@ EXPORT_SYMBOL(fc_fabric_logoff);
  */
 int fc_lport_destroy(struct fc_lport *lport)
 {
+        mutex_lock(&lport->lp_mutex);
+        lport->state = LPORT_ST_NONE;
+        lport->link_up = 0;
         lport->tt.frame_send = fc_frame_drop;
+        mutex_unlock(&lport->lp_mutex);
+
         lport->tt.fcp_abort_io(lport);
         lport->tt.exch_mgr_reset(lport, 0, 0);
         return 0;
@@ -1032,17 +1042,19 @@ static void fc_lport_rft_id_resp(struct fc_seq *sp, struct fc_frame *fp,
 
         FC_DEBUG_LPORT("Received a RFT_ID response\n");
 
-        if (IS_ERR(fp)) {
-                fc_lport_error(lport, fp);
-                goto err;
-        }
-
         if (lport->state != LPORT_ST_RFT_ID) {
                 FC_DBG("Received a RFT_ID response, but in state %s\n",
                        fc_lport_state(lport));
+                if (IS_ERR(fp))
+                        goto err;
                 goto out;
         }
 
+        if (IS_ERR(fp)) {
+                fc_lport_error(lport, fp);
+                goto err;
+        }
+
         fh = fc_frame_header_get(fp);
         ct = fc_frame_payload_get(fp, sizeof(*ct));
 
@@ -1084,17 +1096,19 @@ static void fc_lport_rpn_id_resp(struct fc_seq *sp, struct fc_frame *fp,
 
         FC_DEBUG_LPORT("Received a RPN_ID response\n");
 
-        if (IS_ERR(fp)) {
-                fc_lport_error(lport, fp);
-                goto err;
-        }
-
         if (lport->state != LPORT_ST_RPN_ID) {
                 FC_DBG("Received a RPN_ID response, but in state %s\n",
                        fc_lport_state(lport));
+                if (IS_ERR(fp))
+                        goto err;
                 goto out;
         }
 
+        if (IS_ERR(fp)) {
+                fc_lport_error(lport, fp);
+                goto err;
+        }
+
         fh = fc_frame_header_get(fp);
         ct = fc_frame_payload_get(fp, sizeof(*ct));
         if (fh && ct && fh->fh_type == FC_TYPE_CT &&
@@ -1134,17 +1148,19 @@ static void fc_lport_scr_resp(struct fc_seq *sp, struct fc_frame *fp,
 
         FC_DEBUG_LPORT("Received a SCR response\n");
 
-        if (IS_ERR(fp)) {
-                fc_lport_error(lport, fp);
-                goto err;
-        }
-
         if (lport->state != LPORT_ST_SCR) {
                 FC_DBG("Received a SCR response, but in state %s\n",
                        fc_lport_state(lport));
+                if (IS_ERR(fp))
+                        goto err;
                 goto out;
         }
 
+        if (IS_ERR(fp)) {
+                fc_lport_error(lport, fp);
+                goto err;
+        }
+
         op = fc_frame_payload_op(fp);
         if (op == ELS_LS_ACC)
                 fc_lport_enter_ready(lport);
@@ -1360,17 +1376,19 @@ static void fc_lport_logo_resp(struct fc_seq *sp, struct fc_frame *fp,
 
         FC_DEBUG_LPORT("Received a LOGO response\n");
 
-        if (IS_ERR(fp)) {
-                fc_lport_error(lport, fp);
-                goto err;
-        }
-
         if (lport->state != LPORT_ST_LOGO) {
                 FC_DBG("Received a LOGO response, but in state %s\n",
                        fc_lport_state(lport));
+                if (IS_ERR(fp))
+                        goto err;
                 goto out;
         }
 
+        if (IS_ERR(fp)) {
+                fc_lport_error(lport, fp);
+                goto err;
+        }
+
         op = fc_frame_payload_op(fp);
         if (op == ELS_LS_ACC)
                 fc_lport_enter_reset(lport);
@@ -1400,10 +1418,6 @@ static void fc_lport_enter_logo(struct fc_lport *lport)
 
         fc_lport_state_enter(lport, LPORT_ST_LOGO);
 
-        /* DNS session should be closed so we can release it here */
-        if (lport->dns_rp)
-                lport->tt.rport_logoff(lport->dns_rp);
-
         fp = fc_frame_alloc(lport, sizeof(*logo));
         if (!fp) {
                 fc_lport_error(lport, fp);
@@ -1444,17 +1458,19 @@ static void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
 
         FC_DEBUG_LPORT("Received a FLOGI response\n");
 
-        if (IS_ERR(fp)) {
-                fc_lport_error(lport, fp);
-                goto err;
-        }
-
         if (lport->state != LPORT_ST_FLOGI) {
                 FC_DBG("Received a FLOGI response, but in state %s\n",
                        fc_lport_state(lport));
+                if (IS_ERR(fp))
+                        goto err;
                 goto out;
         }
 
+        if (IS_ERR(fp)) {
+                fc_lport_error(lport, fp);
+                goto err;
+        }
+
         fh = fc_frame_header_get(fp);
         did = ntoh24(fh->fh_d_id);
         if (fc_frame_payload_op(fp) == ELS_LS_ACC && did != 0) {
diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
index 0472bb73221..747d73c5c8a 100644
--- a/drivers/scsi/libfc/fc_rport.c
+++ b/drivers/scsi/libfc/fc_rport.c
@@ -267,6 +267,10 @@ static void fc_rport_work(struct work_struct *work)
                                "(%6x).\n", ids.port_id);
                         event = RPORT_EV_FAILED;
                 }
+                if (rport->port_id != FC_FID_DIR_SERV)
+                        if (rport_ops->event_callback)
+                                rport_ops->event_callback(lport, rport,
+                                                          RPORT_EV_FAILED);
                 put_device(&rport->dev);
                 rport = new_rport;
                 rdata = new_rport->dd_data;
@@ -325,11 +329,20 @@ int fc_rport_login(struct fc_rport *rport)
 int fc_rport_logoff(struct fc_rport *rport)
 {
         struct fc_rport_libfc_priv *rdata = rport->dd_data;
+        struct fc_lport *lport = rdata->local_port;
 
         mutex_lock(&rdata->rp_mutex);
 
         FC_DEBUG_RPORT("Remove port (%6x)\n", rport->port_id);
 
+        if (rdata->rp_state == RPORT_ST_NONE) {
+                FC_DEBUG_RPORT("(%6x): Port (%6x) in NONE state,"
+                               " not removing", fc_host_port_id(lport->host),
+                               rport->port_id);
+                mutex_unlock(&rdata->rp_mutex);
+                goto out;
+        }
+
         fc_rport_enter_logo(rport);
 
         /*
@@ -349,6 +362,7 @@ int fc_rport_logoff(struct fc_rport *rport)
 
         mutex_unlock(&rdata->rp_mutex);
 
+out:
         return 0;
 }
 
@@ -430,6 +444,7 @@ static void fc_rport_error(struct fc_rport *rport, struct fc_frame *fp)
         case RPORT_ST_PRLI:
         case RPORT_ST_LOGO:
                 rdata->event = RPORT_EV_FAILED;
+                fc_rport_state_enter(rport, RPORT_ST_NONE);
                 queue_work(rport_event_queue,
                            &rdata->event_work);
                 break;
@@ -494,7 +509,7 @@ static void fc_rport_plogi_resp(struct fc_seq *sp, struct fc_frame *fp,
         struct fc_rport *rport = rp_arg;
         struct fc_rport_libfc_priv *rdata = rport->dd_data;
         struct fc_lport *lport = rdata->local_port;
-        struct fc_els_flogi *plp;
+        struct fc_els_flogi *plp = NULL;
         unsigned int tov;
         u16 csp_seq;
         u16 cssp_seq;
@@ -505,17 +520,19 @@ static void fc_rport_plogi_resp(struct fc_seq *sp, struct fc_frame *fp,
         FC_DEBUG_RPORT("Received a PLOGI response from port (%6x)\n",
                        rport->port_id);
 
-        if (IS_ERR(fp)) {
-                fc_rport_error_retry(rport, fp);
-                goto err;
-        }
-
         if (rdata->rp_state != RPORT_ST_PLOGI) {
                 FC_DBG("Received a PLOGI response, but in state %s\n",
                        fc_rport_state(rport));
+                if (IS_ERR(fp))
+                        goto err;
                 goto out;
         }
 
+        if (IS_ERR(fp)) {
+                fc_rport_error_retry(rport, fp);
+                goto err;
+        }
+
         op = fc_frame_payload_op(fp);
         if (op == ELS_LS_ACC &&
             (plp = fc_frame_payload_get(fp, sizeof(*plp))) != NULL) {
@@ -614,17 +631,19 @@ static void fc_rport_prli_resp(struct fc_seq *sp, struct fc_frame *fp,
         FC_DEBUG_RPORT("Received a PRLI response from port (%6x)\n",
                        rport->port_id);
 
-        if (IS_ERR(fp)) {
-                fc_rport_error_retry(rport, fp);
-                goto err;
-        }
-
         if (rdata->rp_state != RPORT_ST_PRLI) {
                 FC_DBG("Received a PRLI response, but in state %s\n",
                        fc_rport_state(rport));
+                if (IS_ERR(fp))
+                        goto err;
                 goto out;
         }
 
+        if (IS_ERR(fp)) {
+                fc_rport_error_retry(rport, fp);
+                goto err;
+        }
+
         op = fc_frame_payload_op(fp);
         if (op == ELS_LS_ACC) {
                 pp = fc_frame_payload_get(fp, sizeof(*pp));
@@ -646,6 +665,7 @@ static void fc_rport_prli_resp(struct fc_seq *sp, struct fc_frame *fp,
         } else {
                 FC_DBG("Bad ELS response\n");
                 rdata->event = RPORT_EV_FAILED;
+                fc_rport_state_enter(rport, RPORT_ST_NONE);
                 queue_work(rport_event_queue, &rdata->event_work);
         }
 
@@ -678,23 +698,26 @@ static void fc_rport_logo_resp(struct fc_seq *sp, struct fc_frame *fp,
         FC_DEBUG_RPORT("Received a LOGO response from port (%6x)\n",
                        rport->port_id);
 
-        if (IS_ERR(fp)) {
-                fc_rport_error_retry(rport, fp);
-                goto err;
-        }
-
         if (rdata->rp_state != RPORT_ST_LOGO) {
                 FC_DEBUG_RPORT("Received a LOGO response, but in state %s\n",
                                fc_rport_state(rport));
+                if (IS_ERR(fp))
+                        goto err;
                 goto out;
         }
 
+        if (IS_ERR(fp)) {
+                fc_rport_error_retry(rport, fp);
+                goto err;
+        }
+
         op = fc_frame_payload_op(fp);
         if (op == ELS_LS_ACC) {
                 fc_rport_enter_rtv(rport);
         } else {
                 FC_DBG("Bad ELS response\n");
                 rdata->event = RPORT_EV_LOGO;
+                fc_rport_state_enter(rport, RPORT_ST_NONE);
                 queue_work(rport_event_queue, &rdata->event_work);
         }
 
@@ -764,17 +787,19 @@ static void fc_rport_rtv_resp(struct fc_seq *sp, struct fc_frame *fp,
         FC_DEBUG_RPORT("Received a RTV response from port (%6x)\n",
                        rport->port_id);
 
-        if (IS_ERR(fp)) {
-                fc_rport_error(rport, fp);
-                goto err;
-        }
-
         if (rdata->rp_state != RPORT_ST_RTV) {
                 FC_DBG("Received a RTV response, but in state %s\n",
                        fc_rport_state(rport));
+                if (IS_ERR(fp))
+                        goto err;
                 goto out;
         }
 
+        if (IS_ERR(fp)) {
+                fc_rport_error(rport, fp);
+                goto err;
+        }
+
         op = fc_frame_payload_op(fp);
         if (op == ELS_LS_ACC) {
                 struct fc_els_rtv_acc *rtv;
@@ -1007,6 +1032,8 @@ static void fc_rport_recv_plogi_req(struct fc_rport *rport,
         default:
                 FC_DEBUG_RPORT("incoming PLOGI from %x in unexpected "
                                "state %d\n", sid, rdata->rp_state);
+                fc_frame_free(fp);
+                return;
                 break;
         }
 
@@ -1098,6 +1125,8 @@ static void fc_rport_recv_prli_req(struct fc_rport *rport,
                 reason = ELS_RJT_NONE;
                 break;
         default:
+                fc_frame_free(rx_fp);
+                return;
                 break;
         }
         len = fr_len(rx_fp) - sizeof(*fh);
@@ -1227,6 +1256,11 @@ static void fc_rport_recv_prlo_req(struct fc_rport *rport, struct fc_seq *sp,
                        "while in state %s\n", ntoh24(fh->fh_s_id),
                        fc_rport_state(rport));
 
+        if (rdata->rp_state == RPORT_ST_NONE) {
+                fc_frame_free(fp);
+                return;
+        }
+
         rjt_data.fp = NULL;
         rjt_data.reason = ELS_RJT_UNAB;
         rjt_data.explan = ELS_EXPL_NONE;
@@ -1256,7 +1290,13 @@ static void fc_rport_recv_logo_req(struct fc_rport *rport, struct fc_seq *sp,
                        "while in state %s\n", ntoh24(fh->fh_s_id),
                        fc_rport_state(rport));
 
+        if (rdata->rp_state == RPORT_ST_NONE) {
+                fc_frame_free(fp);
+                return;
+        }
+
         rdata->event = RPORT_EV_LOGO;
+        fc_rport_state_enter(rport, RPORT_ST_NONE);
         queue_work(rport_event_queue, &rdata->event_work);
 
         lport->tt.seq_els_rsp_send(sp, ELS_LS_ACC, NULL);
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 68962835916..e72b4ad47d3 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -1463,6 +1463,16 @@ int iscsi_change_queue_depth(struct scsi_device *sdev, int depth)
 }
 EXPORT_SYMBOL_GPL(iscsi_change_queue_depth);
 
+int iscsi_target_alloc(struct scsi_target *starget)
+{
+        struct iscsi_cls_session *cls_session = starget_to_session(starget);
+        struct iscsi_session *session = cls_session->dd_data;
+
+        starget->can_queue = session->scsi_cmds_max;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(iscsi_target_alloc);
+
 void iscsi_session_recovery_timedout(struct iscsi_cls_session *cls_session)
 {
         struct iscsi_session *session = cls_session->dd_data;
diff --git a/drivers/scsi/libiscsi_tcp.c b/drivers/scsi/libiscsi_tcp.c
index 91f8ce4d8d0..b579ca9f483 100644
--- a/drivers/scsi/libiscsi_tcp.c
+++ b/drivers/scsi/libiscsi_tcp.c
@@ -1036,8 +1036,11 @@ flush:
 
         rc = conn->session->tt->init_pdu(task, r2t->data_offset + r2t->sent,
                                          r2t->data_count);
-        if (rc)
+        if (rc) {
+                iscsi_conn_failure(conn, ISCSI_ERR_XMIT_FAILED);
                 return rc;
+        }
+
         r2t->sent += r2t->data_count;
         goto flush;
 }
diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index dcba267db71..1105f9a111b 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -443,6 +443,7 @@ struct lpfc_hba {
         uint32_t hba_flag;      /* hba generic flags */
 #define HBA_ERATT_HANDLED       0x1 /* This flag is set when eratt handled */
 
+#define DEFER_ERATT             0x4 /* Deferred error attention in progress */
         struct lpfc_dmabuf slim2p;
 
         MAILBOX_t *mbox;
@@ -723,4 +724,3 @@ lpfc_sli_read_hs(struct lpfc_hba *phba)
 
         return;
 }
-
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 40cf0f4f327..c14f0cbdb12 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -51,7 +51,7 @@
 #define LPFC_LINK_SPEED_STRING "0, 1, 2, 4, 8"
 
 /**
- * lpfc_jedec_to_ascii: Hex to ascii convertor according to JEDEC rules.
+ * lpfc_jedec_to_ascii - Hex to ascii convertor according to JEDEC rules
  * @incr: integer to convert.
  * @hdw: ascii string holding converted integer plus a string terminator.
  *
@@ -82,7 +82,7 @@ lpfc_jedec_to_ascii(int incr, char hdw[])
 }
 
 /**
- * lpfc_drvr_version_show: Return the Emulex driver string with version number.
+ * lpfc_drvr_version_show - Return the Emulex driver string with version number
  * @dev: class unused variable.
  * @attr: device attribute, not used.
  * @buf: on return contains the module description text.
@@ -152,7 +152,7 @@ lpfc_bg_reftag_err_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_info_show: Return some pci info about the host in ascii.
+ * lpfc_info_show - Return some pci info about the host in ascii
  * @dev: class converted to a Scsi_host structure.
  * @attr: device attribute, not used.
  * @buf: on return contains the formatted text from lpfc_info().
@@ -169,7 +169,7 @@ lpfc_info_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_serialnum_show: Return the hba serial number in ascii.
+ * lpfc_serialnum_show - Return the hba serial number in ascii
  * @dev: class converted to a Scsi_host structure.
  * @attr: device attribute, not used.
  * @buf: on return contains the formatted text serial number.
@@ -188,7 +188,7 @@ lpfc_serialnum_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_temp_sensor_show: Return the temperature sensor level.
+ * lpfc_temp_sensor_show - Return the temperature sensor level
  * @dev: class converted to a Scsi_host structure.
  * @attr: device attribute, not used.
  * @buf: on return contains the formatted support level.
@@ -210,7 +210,7 @@ lpfc_temp_sensor_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_modeldesc_show: Return the model description of the hba.
+ * lpfc_modeldesc_show - Return the model description of the hba
  * @dev: class converted to a Scsi_host structure.
  * @attr: device attribute, not used.
  * @buf: on return contains the scsi vpd model description.
@@ -229,7 +229,7 @@ lpfc_modeldesc_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_modelname_show: Return the model name of the hba.
+ * lpfc_modelname_show - Return the model name of the hba
  * @dev: class converted to a Scsi_host structure.
  * @attr: device attribute, not used.
  * @buf: on return contains the scsi vpd model name.
@@ -248,7 +248,7 @@ lpfc_modelname_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_programtype_show: Return the program type of the hba.
+ * lpfc_programtype_show - Return the program type of the hba
  * @dev: class converted to a Scsi_host structure.
  * @attr: device attribute, not used.
  * @buf: on return contains the scsi vpd program type.
@@ -267,7 +267,7 @@ lpfc_programtype_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_mlomgmt_show: Return the Menlo Maintenance sli flag.
+ * lpfc_mlomgmt_show - Return the Menlo Maintenance sli flag
  * @dev: class converted to a Scsi_host structure.
  * @attr: device attribute, not used.
  * @buf: on return contains the Menlo Maintenance sli flag.
@@ -286,7 +286,7 @@ lpfc_mlomgmt_show(struct device *dev, struct device_attribute *attr, char *buf)
 }
 
 /**
- * lpfc_vportnum_show: Return the port number in ascii of the hba.
+ * lpfc_vportnum_show - Return the port number in ascii of the hba
  * @dev: class converted to a Scsi_host structure.
  * @attr: device attribute, not used.
  * @buf: on return contains scsi vpd program type.
@@ -305,7 +305,7 @@ lpfc_vportnum_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_fwrev_show: Return the firmware rev running in the hba.
+ * lpfc_fwrev_show - Return the firmware rev running in the hba
  * @dev: class converted to a Scsi_host structure.
  * @attr: device attribute, not used.
  * @buf: on return contains the scsi vpd program type.
@@ -326,7 +326,7 @@ lpfc_fwrev_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_hdw_show: Return the jedec information about the hba.
+ * lpfc_hdw_show - Return the jedec information about the hba
  * @dev: class converted to a Scsi_host structure.
  * @attr: device attribute, not used.
  * @buf: on return contains the scsi vpd program type.
@@ -347,7 +347,7 @@ lpfc_hdw_show(struct device *dev, struct device_attribute *attr, char *buf)
 }
 
 /**
- * lpfc_option_rom_version_show: Return the adapter ROM FCode version.
+ * lpfc_option_rom_version_show - Return the adapter ROM FCode version
  * @dev: class converted to a Scsi_host structure.
  * @attr: device attribute, not used.
  * @buf: on return contains the ROM and FCode ascii strings.
@@ -366,7 +366,7 @@ lpfc_option_rom_version_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_state_show: Return the link state of the port.
+ * lpfc_state_show - Return the link state of the port
  * @dev: class converted to a Scsi_host structure.
  * @attr: device attribute, not used.
  * @buf: on return contains text describing the state of the link.
@@ -451,7 +451,7 @@ lpfc_link_state_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_num_discovered_ports_show: Return sum of mapped and unmapped vports.
+ * lpfc_num_discovered_ports_show - Return sum of mapped and unmapped vports
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
  * @buf: on return contains the sum of fc mapped and unmapped.
@@ -474,7 +474,7 @@ lpfc_num_discovered_ports_show(struct device *dev,
 }
 
 /**
- * lpfc_issue_lip: Misnomer, name carried over from long ago.
+ * lpfc_issue_lip - Misnomer, name carried over from long ago
  * @shost: Scsi_Host pointer.
  *
  * Description:
@@ -529,7 +529,7 @@ lpfc_issue_lip(struct Scsi_Host *shost)
 }
 
 /**
- * lpfc_do_offline: Issues a mailbox command to bring the link down.
+ * lpfc_do_offline - Issues a mailbox command to bring the link down
  * @phba: lpfc_hba pointer.
  * @type: LPFC_EVT_OFFLINE, LPFC_EVT_WARM_START, LPFC_EVT_KILL.
  *
@@ -537,7 +537,7 @@ lpfc_issue_lip(struct Scsi_Host *shost)
  * Assumes any error from lpfc_do_offline() will be negative.
  * Can wait up to 5 seconds for the port ring buffers count
  * to reach zero, prints a warning if it is not zero and continues.
- * lpfc_workq_post_event() returns a non-zero return coce if call fails.
+ * lpfc_workq_post_event() returns a non-zero return code if call fails.
  *
  * Returns:
  * -EIO error posting the event
@@ -591,7 +591,7 @@ lpfc_do_offline(struct lpfc_hba *phba, uint32_t type)
 }
 
 /**
- * lpfc_selective_reset: Offline then onlines the port.
+ * lpfc_selective_reset - Offline then onlines the port
  * @phba: lpfc_hba pointer.
  *
  * Description:
@@ -632,7 +632,7 @@ lpfc_selective_reset(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_issue_reset: Selectively resets an adapter.
+ * lpfc_issue_reset - Selectively resets an adapter
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
  * @buf: containing the string "selective".
@@ -672,7 +672,7 @@ lpfc_issue_reset(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_nport_evt_cnt_show: Return the number of nport events.
+ * lpfc_nport_evt_cnt_show - Return the number of nport events
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
  * @buf: on return contains the ascii number of nport events.
@@ -691,7 +691,7 @@ lpfc_nport_evt_cnt_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_board_mode_show: Return the state of the board.
+ * lpfc_board_mode_show - Return the state of the board
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
  * @buf: on return contains the state of the adapter.
@@ -720,7 +720,7 @@ lpfc_board_mode_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_board_mode_store: Puts the hba in online, offline, warm or error state.
+ * lpfc_board_mode_store - Puts the hba in online, offline, warm or error state
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
  * @buf: containing one of the strings "online", "offline", "warm" or "error".
@@ -766,14 +766,14 @@ lpfc_board_mode_store(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_get_hba_info: Return various bits of informaton about the adapter.
+ * lpfc_get_hba_info - Return various bits of informaton about the adapter
  * @phba: pointer to the adapter structure.
- * @mxri max xri count.
- * @axri available xri count.
- * @mrpi max rpi count.
- * @arpi available rpi count.
- * @mvpi max vpi count.
- * @avpi available vpi count.
+ * @mxri: max xri count.
+ * @axri: available xri count.
+ * @mrpi: max rpi count.
+ * @arpi: available rpi count.
+ * @mvpi: max vpi count.
+ * @avpi: available vpi count.
  *
  * Description:
  * If an integer pointer for an count is not null then the value for the
@@ -846,7 +846,7 @@ lpfc_get_hba_info(struct lpfc_hba *phba,
 }
 
 /**
- * lpfc_max_rpi_show: Return maximum rpi.
+ * lpfc_max_rpi_show - Return maximum rpi
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
  * @buf: on return contains the maximum rpi count in decimal or "Unknown".
@@ -874,7 +874,7 @@ lpfc_max_rpi_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_used_rpi_show: Return maximum rpi minus available rpi.
+ * lpfc_used_rpi_show - Return maximum rpi minus available rpi
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
  * @buf: containing the used rpi count in decimal or "Unknown".
@@ -902,7 +902,7 @@ lpfc_used_rpi_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_max_xri_show: Return maximum xri.
+ * lpfc_max_xri_show - Return maximum xri
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
  * @buf: on return contains the maximum xri count in decimal or "Unknown".
@@ -930,7 +930,7 @@ lpfc_max_xri_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_used_xri_show: Return maximum xpi minus the available xpi.
+ * lpfc_used_xri_show - Return maximum xpi minus the available xpi
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
  * @buf: on return contains the used xri count in decimal or "Unknown".
@@ -958,7 +958,7 @@ lpfc_used_xri_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_max_vpi_show: Return maximum vpi.
+ * lpfc_max_vpi_show - Return maximum vpi
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
  * @buf: on return contains the maximum vpi count in decimal or "Unknown".
@@ -986,7 +986,7 @@ lpfc_max_vpi_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_used_vpi_show: Return maximum vpi minus the available vpi.
+ * lpfc_used_vpi_show - Return maximum vpi minus the available vpi
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
  * @buf: on return contains the used vpi count in decimal or "Unknown".
@@ -1014,7 +1014,7 @@ lpfc_used_vpi_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_npiv_info_show: Return text about NPIV support for the adapter.
+ * lpfc_npiv_info_show - Return text about NPIV support for the adapter
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
  * @buf: text that must be interpreted to determine if npiv is supported.
@@ -1042,7 +1042,7 @@ lpfc_npiv_info_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_poll_show: Return text about poll support for the adapter.
+ * lpfc_poll_show - Return text about poll support for the adapter
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
  * @buf: on return contains the cfg_poll in hex.
@@ -1064,7 +1064,7 @@ lpfc_poll_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_poll_store: Set the value of cfg_poll for the adapter.
+ * lpfc_poll_store - Set the value of cfg_poll for the adapter
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
  * @buf: one or more lpfc_polling_flags values.
@@ -1136,7 +1136,7 @@ lpfc_poll_store(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_param_show: Return a cfg attribute value in decimal.
+ * lpfc_param_show - Return a cfg attribute value in decimal
  *
  * Description:
  * Macro that given an attr e.g. hba_queue_depth expands
@@ -1164,7 +1164,7 @@ lpfc_##attr##_show(struct device *dev, struct device_attribute *attr, \
 }
 
 /**
- * lpfc_param_hex_show: Return a cfg attribute value in hex.
+ * lpfc_param_hex_show - Return a cfg attribute value in hex
  *
  * Description:
  * Macro that given an attr e.g. hba_queue_depth expands
@@ -1173,7 +1173,7 @@ lpfc_##attr##_show(struct device *dev, struct device_attribute *attr, \
  * lpfc_##attr##_show: Return the hex value of an adapters cfg_xxx field.
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
- * @buf: on return contains the attribute value in hexidecimal.
+ * @buf: on return contains the attribute value in hexadecimal.
  *
  * Returns: size of formatted string.
  **/
@@ -1192,7 +1192,7 @@ lpfc_##attr##_show(struct device *dev, struct device_attribute *attr, \
 }
 
 /**
- * lpfc_param_init: Intializes a cfg attribute.
+ * lpfc_param_init - Intializes a cfg attribute
  *
  * Description:
  * Macro that given an attr e.g. hba_queue_depth expands
@@ -1226,7 +1226,7 @@ lpfc_##attr##_init(struct lpfc_hba *phba, int val) \
 }
 
 /**
- * lpfc_param_set: Set a cfg attribute value.
+ * lpfc_param_set - Set a cfg attribute value
  *
  * Description:
  * Macro that given an attr e.g. hba_queue_depth expands
@@ -1260,7 +1260,7 @@ lpfc_##attr##_set(struct lpfc_hba *phba, int val) \
 }
 
 /**
- * lpfc_param_store: Set a vport attribute value.
+ * lpfc_param_store - Set a vport attribute value
  *
  * Description:
  * Macro that given an attr e.g. hba_queue_depth expands
@@ -1300,7 +1300,7 @@ lpfc_##attr##_store(struct device *dev, struct device_attribute *attr, \
 }
 
 /**
- * lpfc_vport_param_show: Return decimal formatted cfg attribute value.
+ * lpfc_vport_param_show - Return decimal formatted cfg attribute value
  *
  * Description:
  * Macro that given an attr e.g. hba_queue_depth expands
@@ -1326,17 +1326,17 @@ lpfc_##attr##_show(struct device *dev, struct device_attribute *attr, \
 }
 
 /**
- * lpfc_vport_param_hex_show: Return hex formatted attribute value.
+ * lpfc_vport_param_hex_show - Return hex formatted attribute value
  *
  * Description:
  * Macro that given an attr e.g.
  * hba_queue_depth expands into a function with the name
  * lpfc_hba_queue_depth_show
  *
- * lpfc_##attr##_show: prints the attribute value in hexidecimal.
+ * lpfc_##attr##_show: prints the attribute value in hexadecimal.
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
- * @buf: on return contains the attribute value in hexidecimal.
+ * @buf: on return contains the attribute value in hexadecimal.
  *
  * Returns: length of formatted string.
  **/
@@ -1353,7 +1353,7 @@ lpfc_##attr##_show(struct device *dev, struct device_attribute *attr, \
 }
 
 /**
- * lpfc_vport_param_init: Initialize a vport cfg attribute.
+ * lpfc_vport_param_init - Initialize a vport cfg attribute
  *
  * Description:
  * Macro that given an attr e.g. hba_queue_depth expands
@@ -1386,7 +1386,7 @@ lpfc_##attr##_init(struct lpfc_vport *vport, int val) \
 }
 
 /**
- * lpfc_vport_param_set: Set a vport cfg attribute.
+ * lpfc_vport_param_set - Set a vport cfg attribute
  *
  * Description:
  * Macro that given an attr e.g. hba_queue_depth expands
@@ -1417,7 +1417,7 @@ lpfc_##attr##_set(struct lpfc_vport *vport, int val) \
 }
 
 /**
- * lpfc_vport_param_store: Set a vport attribute.
+ * lpfc_vport_param_store - Set a vport attribute
  *
  * Description:
  * Macro that given an attr e.g. hba_queue_depth
@@ -1576,7 +1576,7 @@ static DEVICE_ATTR(lpfc_temp_sensor, S_IRUGO, lpfc_temp_sensor_show, NULL);
 static char *lpfc_soft_wwn_key = "C99G71SL8032A";
 
 /**
- * lpfc_soft_wwn_enable_store: Allows setting of the wwn if the key is valid.
+ * lpfc_soft_wwn_enable_store - Allows setting of the wwn if the key is valid
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
  * @buf: containing the string lpfc_soft_wwn_key.
@@ -1623,10 +1623,10 @@ static DEVICE_ATTR(lpfc_soft_wwn_enable, S_IWUSR, NULL,
                    lpfc_soft_wwn_enable_store);
 
 /**
- * lpfc_soft_wwpn_show: Return the cfg soft ww port name of the adapter.
+ * lpfc_soft_wwpn_show - Return the cfg soft ww port name of the adapter
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
- * @buf: on return contains the wwpn in hexidecimal.
+ * @buf: on return contains the wwpn in hexadecimal.
  *
  * Returns: size of formatted string.
  **/
@@ -1643,10 +1643,10 @@ lpfc_soft_wwpn_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_soft_wwpn_store: Set the ww port name of the adapter.
+ * lpfc_soft_wwpn_store - Set the ww port name of the adapter
  * @dev class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
- * @buf: contains the wwpn in hexidecimal.
+ * @buf: contains the wwpn in hexadecimal.
  * @count: number of wwpn bytes in buf
  *
  * Returns:
@@ -1729,10 +1729,10 @@ static DEVICE_ATTR(lpfc_soft_wwpn, S_IRUGO | S_IWUSR,\
                    lpfc_soft_wwpn_show, lpfc_soft_wwpn_store);
 
 /**
- * lpfc_soft_wwnn_show: Return the cfg soft ww node name for the adapter.
+ * lpfc_soft_wwnn_show - Return the cfg soft ww node name for the adapter
  * @dev: class device that is converted into a Scsi_host.
  * @attr: device attribute, not used.
- * @buf: on return contains the wwnn in hexidecimal.
+ * @buf: on return contains the wwnn in hexadecimal.
  *
  * Returns: size of formatted string.
  **/
@@ -1747,9 +1747,9 @@ lpfc_soft_wwnn_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_soft_wwnn_store: sets the ww node name of the adapter.
+ * lpfc_soft_wwnn_store - sets the ww node name of the adapter
  * @cdev: class device that is converted into a Scsi_host.
- * @buf: contains the ww node name in hexidecimal.
+ * @buf: contains the ww node name in hexadecimal.
  * @count: number of wwnn bytes in buf.
  *
  * Returns:
@@ -1845,7 +1845,7 @@ MODULE_PARM_DESC(lpfc_nodev_tmo,
                  "for a device to come back");
 
 /**
- * lpfc_nodev_tmo_show: Return the hba dev loss timeout value.
+ * lpfc_nodev_tmo_show - Return the hba dev loss timeout value
  * @dev: class converted to a Scsi_host structure.
  * @attr: device attribute, not used.
  * @buf: on return contains the dev loss timeout in decimal.
@@ -1864,7 +1864,7 @@ lpfc_nodev_tmo_show(struct device *dev, struct device_attribute *attr,
 }
 
 /**
- * lpfc_nodev_tmo_init: Set the hba nodev timeout value.
+ * lpfc_nodev_tmo_init - Set the hba nodev timeout value
  * @vport: lpfc vport structure pointer.
  * @val: contains the nodev timeout value.
  *
@@ -1905,7 +1905,7 @@ lpfc_nodev_tmo_init(struct lpfc_vport *vport, int val)
 }
 
 /**
- * lpfc_update_rport_devloss_tmo: Update dev loss tmo value.
+ * lpfc_update_rport_devloss_tmo - Update dev loss tmo value
  * @vport: lpfc vport structure pointer.
  *
  * Description:
@@ -1926,7 +1926,7 @@ lpfc_update_rport_devloss_tmo(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_nodev_tmo_set: Set the vport nodev tmo and devloss tmo values.
+ * lpfc_nodev_tmo_set - Set the vport nodev tmo and devloss tmo values
  * @vport: lpfc vport structure pointer.
  * @val: contains the tmo value.
  *
@@ -1982,7 +1982,7 @@ lpfc_vport_param_init(devloss_tmo, LPFC_DEF_DEVLOSS_TMO,
 lpfc_vport_param_show(devloss_tmo)
 
 /**
- * lpfc_devloss_tmo_set: Sets vport nodev tmo, devloss tmo values, changed bit.
+ * lpfc_devloss_tmo_set - Sets vport nodev tmo, devloss tmo values, changed bit
  * @vport: lpfc vport structure pointer.
  * @val: contains the tmo value.
  *
@@ -2094,7 +2094,7 @@ MODULE_PARM_DESC(lpfc_restrict_login,
 lpfc_vport_param_show(restrict_login);
 
 /**
- * lpfc_restrict_login_init: Set the vport restrict login flag.
+ * lpfc_restrict_login_init - Set the vport restrict login flag
  * @vport: lpfc vport structure pointer.
  * @val: contains the restrict login value.
  *
@@ -2128,7 +2128,7 @@ lpfc_restrict_login_init(struct lpfc_vport *vport, int val)
 }
 
 /**
- * lpfc_restrict_login_set: Set the vport restrict login flag.
+ * lpfc_restrict_login_set - Set the vport restrict login flag
  * @vport: lpfc vport structure pointer.
  * @val: contains the restrict login value.
  *
@@ -2201,7 +2201,7 @@ LPFC_VPORT_ATTR_R(scan_down, 1, 0, 1,
 */
 
 /**
- * lpfc_topology_set: Set the adapters topology field.
+ * lpfc_topology_set - Set the adapters topology field
  * @phba: lpfc_hba pointer.
  * @val: topology value.
  *
@@ -2216,18 +2216,41 @@ LPFC_VPORT_ATTR_R(scan_down, 1, 0, 1,
  * non-zero return value from lpfc_issue_lip()
  * -EINVAL val out of range
  **/
-static int
-lpfc_topology_set(struct lpfc_hba *phba, int val)
+static ssize_t
+lpfc_topology_store(struct device *dev, struct device_attribute *attr,
+                        const char *buf, size_t count)
 {
+        struct Scsi_Host  *shost = class_to_shost(dev);
+        struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+        struct lpfc_hba   *phba = vport->phba;
+        int val = 0;
+        int nolip = 0;
+        const char *val_buf = buf;
         int err;
         uint32_t prev_val;
+
+        if (!strncmp(buf, "nolip ", strlen("nolip "))) {
+                nolip = 1;
+                val_buf = &buf[strlen("nolip ")];
+        }
+
+        if (!isdigit(val_buf[0]))
+                return -EINVAL;
+        if (sscanf(val_buf, "%i", &val) != 1)
+                return -EINVAL;
+
         if (val >= 0 && val <= 6) {
                 prev_val = phba->cfg_topology;
                 phba->cfg_topology = val;
+                if (nolip)
+                        return strlen(buf);
+
                 err = lpfc_issue_lip(lpfc_shost_from_vport(phba->pport));
-                if (err)
+                if (err) {
                         phba->cfg_topology = prev_val;
-                return err;
+                        return -EINVAL;
+                } else
+                        return strlen(buf);
         }
         lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                 "%d:0467 lpfc_topology attribute cannot be set to %d, "
@@ -2240,14 +2263,12 @@ module_param(lpfc_topology, int, 0);
 MODULE_PARM_DESC(lpfc_topology, "Select Fibre Channel topology");
 lpfc_param_show(topology)
 lpfc_param_init(topology, 0, 0, 6)
-lpfc_param_store(topology)
 static DEVICE_ATTR(lpfc_topology, S_IRUGO | S_IWUSR,
                 lpfc_topology_show, lpfc_topology_store);
 
 
 /**
- * lpfc_stat_data_ctrl_store: write call back for lpfc_stat_data_ctrl
- *  sysfs file.
+ * lpfc_stat_data_ctrl_store - write call back for lpfc_stat_data_ctrl sysfs file
  * @dev: Pointer to class device.
  * @buf: Data buffer.
  * @count: Size of the data buffer.
@@ -2282,7 +2303,7 @@ lpfc_stat_data_ctrl_store(struct device *dev, struct device_attribute *attr,
         unsigned long base, step, bucket_type;
 
         if (!strncmp(buf, "setbucket", strlen("setbucket"))) {
-                if (strlen(buf) > LPFC_MAX_DATA_CTRL_LEN)
+                if (strlen(buf) > (LPFC_MAX_DATA_CTRL_LEN - 1))
                         return -EINVAL;
 
                 strcpy(bucket_data, buf);
@@ -2411,8 +2432,7 @@ lpfc_stat_data_ctrl_store(struct device *dev, struct device_attribute *attr,
 
 
 /**
- * lpfc_stat_data_ctrl_show: Read callback function for
- *   lpfc_stat_data_ctrl sysfs file.
+ * lpfc_stat_data_ctrl_show - Read function for lpfc_stat_data_ctrl sysfs file
  * @dev: Pointer to class device object.
  * @buf: Data buffer.
  *
@@ -2489,8 +2509,7 @@ static DEVICE_ATTR(lpfc_stat_data_ctrl, S_IRUGO | S_IWUSR,
 
 
 /**
- * sysfs_drvr_stat_data_read: Read callback function for lpfc_drvr_stat_data
- *  sysfs attribute.
+ * sysfs_drvr_stat_data_read - Read function for lpfc_drvr_stat_data attribute
  * @kobj: Pointer to the kernel object
  * @bin_attr: Attribute object
  * @buff: Buffer pointer
@@ -2585,7 +2604,7 @@ static struct bin_attribute sysfs_drvr_stat_data_attr = {
 */
 
 /**
- * lpfc_link_speed_set: Set the adapters link speed.
+ * lpfc_link_speed_set - Set the adapters link speed
  * @phba: lpfc_hba pointer.
  * @val: link speed value.
  *
@@ -2601,12 +2620,29 @@ static struct bin_attribute sysfs_drvr_stat_data_attr = {
  * non-zero return value from lpfc_issue_lip()
  * -EINVAL val out of range
  **/
-static int
-lpfc_link_speed_set(struct lpfc_hba *phba, int val)
+static ssize_t
+lpfc_link_speed_store(struct device *dev, struct device_attribute *attr,
+                const char *buf, size_t count)
 {
+        struct Scsi_Host  *shost = class_to_shost(dev);
+        struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+        struct lpfc_hba   *phba = vport->phba;
+        int val = 0;
+        int nolip = 0;
+        const char *val_buf = buf;
         int err;
         uint32_t prev_val;
 
+        if (!strncmp(buf, "nolip ", strlen("nolip "))) {
+                nolip = 1;
+                val_buf = &buf[strlen("nolip ")];
+        }
+
+        if (!isdigit(val_buf[0]))
+                return -EINVAL;
+        if (sscanf(val_buf, "%i", &val) != 1)
+                return -EINVAL;
+
         if (((val == LINK_SPEED_1G) && !(phba->lmt & LMT_1Gb)) ||
                 ((val == LINK_SPEED_2G) && !(phba->lmt & LMT_2Gb)) ||
                 ((val == LINK_SPEED_4G) && !(phba->lmt & LMT_4Gb)) ||
@@ -2614,14 +2650,19 @@ lpfc_link_speed_set(struct lpfc_hba *phba, int val)
                 ((val == LINK_SPEED_10G) && !(phba->lmt & LMT_10Gb)))
                 return -EINVAL;
 
-        if ((val >= 0 && val <= LPFC_MAX_LINK_SPEED)
+        if ((val >= 0 && val <= 8)
                 && (LPFC_LINK_SPEED_BITMAP & (1 << val))) {
                 prev_val = phba->cfg_link_speed;
                 phba->cfg_link_speed = val;
+                if (nolip)
+                        return strlen(buf);
+
                 err = lpfc_issue_lip(lpfc_shost_from_vport(phba->pport));
-                if (err)
+                if (err) {
                         phba->cfg_link_speed = prev_val;
-                return err;
+                        return -EINVAL;
+                } else
+                        return strlen(buf);
         }
 
         lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
@@ -2637,7 +2678,7 @@ MODULE_PARM_DESC(lpfc_link_speed, "Select link speed");
 lpfc_param_show(link_speed)
 
 /**
- * lpfc_link_speed_init: Set the adapters link speed.
+ * lpfc_link_speed_init - Set the adapters link speed
  * @phba: lpfc_hba pointer.
  * @val: link speed value.
  *
@@ -2668,7 +2709,6 @@ lpfc_link_speed_init(struct lpfc_hba *phba, int val)
         return -EINVAL;
 }
 
-lpfc_param_store(link_speed)
 static DEVICE_ATTR(lpfc_link_speed, S_IRUGO | S_IWUSR,
                 lpfc_link_speed_show, lpfc_link_speed_store);
 
@@ -2865,7 +2905,7 @@ MODULE_PARM_DESC(lpfc_prot_guard, "host protection guard type");
 
 
 /*
- * lpfc_sg_seg_cnt: Initial Maximum DMA Segment Count
+ * lpfc_sg_seg_cnt - Initial Maximum DMA Segment Count
  * This value can be set to values between 64 and 256. The default value is
  * 64, but may be increased to allow for larger Max I/O sizes. The scsi layer
  * will be allowed to request I/Os of sizes up to (MAX_SEG_COUNT * SEG_SIZE).
@@ -2967,7 +3007,7 @@ struct device_attribute *lpfc_vport_attrs[] = {
 };
 
 /**
- * sysfs_ctlreg_write: Write method for writing to ctlreg.
+ * sysfs_ctlreg_write - Write method for writing to ctlreg
  * @kobj: kernel kobject that contains the kernel class device.
  * @bin_attr: kernel attributes passed to us.
  * @buf: contains the data to be written to the adapter IOREG space.
@@ -3017,7 +3057,7 @@ sysfs_ctlreg_write(struct kobject *kobj, struct bin_attribute *bin_attr,
 }
 
 /**
- * sysfs_ctlreg_read: Read method for reading from ctlreg.
+ * sysfs_ctlreg_read - Read method for reading from ctlreg
  * @kobj: kernel kobject that contains the kernel class device.
  * @bin_attr: kernel attributes passed to us.
  * @buf: if succesful contains the data from the adapter IOREG space.
@@ -3078,7 +3118,7 @@ static struct bin_attribute sysfs_ctlreg_attr = {
 };
 
 /**
- * sysfs_mbox_idle: frees the sysfs mailbox.
+ * sysfs_mbox_idle - frees the sysfs mailbox
  * @phba: lpfc_hba pointer
  **/
 static void
@@ -3095,7 +3135,7 @@ sysfs_mbox_idle(struct lpfc_hba *phba)
 }
 
 /**
- * sysfs_mbox_write: Write method for writing information via mbox.
+ * sysfs_mbox_write - Write method for writing information via mbox
  * @kobj: kernel kobject that contains the kernel class device.
  * @bin_attr: kernel attributes passed to us.
  * @buf: contains the data to be written to sysfs mbox.
@@ -3170,7 +3210,7 @@ sysfs_mbox_write(struct kobject *kobj, struct bin_attribute *bin_attr,
 }
 
 /**
- * sysfs_mbox_read: Read method for reading information via mbox.
+ * sysfs_mbox_read - Read method for reading information via mbox
  * @kobj: kernel kobject that contains the kernel class device.
  * @bin_attr: kernel attributes passed to us.
  * @buf: contains the data to be read from sysfs mbox.
@@ -3374,7 +3414,7 @@ static struct bin_attribute sysfs_mbox_attr = {
 };
 
 /**
- * lpfc_alloc_sysfs_attr: Creates the ctlreg and mbox entries.
+ * lpfc_alloc_sysfs_attr - Creates the ctlreg and mbox entries
  * @vport: address of lpfc vport structure.
  *
  * Return codes:
@@ -3415,7 +3455,7 @@ out:
 }
 
 /**
- * lpfc_free_sysfs_attr: Removes the ctlreg and mbox entries.
+ * lpfc_free_sysfs_attr - Removes the ctlreg and mbox entries
  * @vport: address of lpfc vport structure.
  **/
 void
@@ -3437,7 +3477,7 @@ lpfc_free_sysfs_attr(struct lpfc_vport *vport)
  */
 
 /**
- * lpfc_get_host_port_id: Copy the vport DID into the scsi host port id.
+ * lpfc_get_host_port_id - Copy the vport DID into the scsi host port id
  * @shost: kernel scsi host pointer.
  **/
 static void
@@ -3450,7 +3490,7 @@ lpfc_get_host_port_id(struct Scsi_Host *shost)
 }
 
 /**
- * lpfc_get_host_port_type: Set the value of the scsi host port type.
+ * lpfc_get_host_port_type - Set the value of the scsi host port type
  * @shost: kernel scsi host pointer.
  **/
 static void
@@ -3482,7 +3522,7 @@ lpfc_get_host_port_type(struct Scsi_Host *shost)
 }
 
 /**
- * lpfc_get_host_port_state: Set the value of the scsi host port state.
+ * lpfc_get_host_port_state - Set the value of the scsi host port state
  * @shost: kernel scsi host pointer.
  **/
 static void
@@ -3520,7 +3560,7 @@ lpfc_get_host_port_state(struct Scsi_Host *shost)
 }
 
 /**
- * lpfc_get_host_speed: Set the value of the scsi host speed.
+ * lpfc_get_host_speed - Set the value of the scsi host speed
  * @shost: kernel scsi host pointer.
  **/
 static void
@@ -3556,7 +3596,7 @@ lpfc_get_host_speed(struct Scsi_Host *shost)
 }
 
 /**
- * lpfc_get_host_fabric_name: Set the value of the scsi host fabric name.
+ * lpfc_get_host_fabric_name - Set the value of the scsi host fabric name
  * @shost: kernel scsi host pointer.
  **/
 static void
@@ -3582,7 +3622,7 @@ lpfc_get_host_fabric_name (struct Scsi_Host *shost)
 }
 
 /**
- * lpfc_get_stats: Return statistical information about the adapter.
+ * lpfc_get_stats - Return statistical information about the adapter
  * @shost: kernel scsi host pointer.
  *
  * Notes:
@@ -3707,7 +3747,7 @@ lpfc_get_stats(struct Scsi_Host *shost)
 }
 
 /**
- * lpfc_reset_stats: Copy the adapter link stats information.
+ * lpfc_reset_stats - Copy the adapter link stats information
  * @shost: kernel scsi host pointer.
  **/
 static void
@@ -3788,7 +3828,7 @@ lpfc_reset_stats(struct Scsi_Host *shost)
  */
 
 /**
- * lpfc_get_node_by_target: Return the nodelist for a target.
+ * lpfc_get_node_by_target - Return the nodelist for a target
  * @starget: kernel scsi target pointer.
  *
  * Returns:
@@ -3817,7 +3857,7 @@ lpfc_get_node_by_target(struct scsi_target *starget)
 }
 
 /**
- * lpfc_get_starget_port_id: Set the target port id to the ndlp DID or -1.
+ * lpfc_get_starget_port_id - Set the target port id to the ndlp DID or -1
  * @starget: kernel scsi target pointer.
  **/
 static void
@@ -3829,7 +3869,7 @@ lpfc_get_starget_port_id(struct scsi_target *starget)
 }
 
 /**
- * lpfc_get_starget_node_name: Set the target node name.
+ * lpfc_get_starget_node_name - Set the target node name
  * @starget: kernel scsi target pointer.
  *
  * Description: Set the target node name to the ndlp node name wwn or zero.
@@ -3844,7 +3884,7 @@ lpfc_get_starget_node_name(struct scsi_target *starget)
 }
 
 /**
- * lpfc_get_starget_port_name: Set the target port name.
+ * lpfc_get_starget_port_name - Set the target port name
  * @starget: kernel scsi target pointer.
  *
  * Description:  set the target port name to the ndlp port name wwn or zero.
@@ -3859,7 +3899,7 @@ lpfc_get_starget_port_name(struct scsi_target *starget)
 }
 
 /**
- * lpfc_set_rport_loss_tmo: Set the rport dev loss tmo.
+ * lpfc_set_rport_loss_tmo - Set the rport dev loss tmo
  * @rport: fc rport address.
  * @timeout: new value for dev loss tmo.
  *
@@ -3877,7 +3917,7 @@ lpfc_set_rport_loss_tmo(struct fc_rport *rport, uint32_t timeout)
 }
 
 /**
- * lpfc_rport_show_function: Return rport target information.
+ * lpfc_rport_show_function - Return rport target information
  *
  * Description:
  * Macro that uses field to generate a function with the name lpfc_show_rport_
@@ -3905,7 +3945,7 @@ lpfc_show_rport_##field (struct device *dev,				\
 static FC_RPORT_ATTR(field, S_IRUGO, lpfc_show_rport_##field, NULL)
 
 /**
- * lpfc_set_vport_symbolic_name: Set the vport's symbolic name.
+ * lpfc_set_vport_symbolic_name - Set the vport's symbolic name
  * @fc_vport: The fc_vport who's symbolic name has been changed.
  *
  * Description:
@@ -4048,7 +4088,7 @@ struct fc_function_template lpfc_vport_transport_functions = {
 };
 
 /**
- * lpfc_get_cfgparam: Used during probe_one to init the adapter structure.
+ * lpfc_get_cfgparam - Used during probe_one to init the adapter structure
  * @phba: lpfc_hba pointer.
  **/
 void
@@ -4097,7 +4137,7 @@ lpfc_get_cfgparam(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_get_vport_cfgparam: Used during port create, init the vport structure.
+ * lpfc_get_vport_cfgparam - Used during port create, init the vport structure
  * @vport: lpfc_vport pointer.
  **/
 void
diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h
index 07f4976319a..f88ce3f2619 100644
--- a/drivers/scsi/lpfc/lpfc_crtn.h
+++ b/drivers/scsi/lpfc/lpfc_crtn.h
@@ -184,6 +184,8 @@ void lpfc_sli_poll_fcp_ring(struct lpfc_hba *);
 struct lpfc_iocbq * lpfc_sli_get_iocbq(struct lpfc_hba *);
 void lpfc_sli_release_iocbq(struct lpfc_hba *, struct lpfc_iocbq *);
 uint16_t lpfc_sli_next_iotag(struct lpfc_hba *, struct lpfc_iocbq *);
+void lpfc_sli_cancel_iocbs(struct lpfc_hba *, struct list_head *, uint32_t,
+                           uint32_t);
 
 void lpfc_reset_barrier(struct lpfc_hba * phba);
 int lpfc_sli_brdready(struct lpfc_hba *, uint32_t);
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index 81cdcf46c47..52be5644e07 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -47,7 +47,7 @@
 #include "lpfc_debugfs.h"
 
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
-/**
+/*
  * debugfs interface
  *
  * To access this interface the user should:
@@ -95,7 +95,7 @@ module_param(lpfc_debugfs_max_slow_ring_trc, int, 0);
 MODULE_PARM_DESC(lpfc_debugfs_max_slow_ring_trc,
         "Set debugfs slow ring trace depth");
 
-int lpfc_debugfs_mask_disc_trc;
+static int lpfc_debugfs_mask_disc_trc;
 module_param(lpfc_debugfs_mask_disc_trc, int, 0);
 MODULE_PARM_DESC(lpfc_debugfs_mask_disc_trc,
         "Set debugfs discovery trace mask");
@@ -127,7 +127,7 @@ static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
 static unsigned long lpfc_debugfs_start_time = 0L;
 
 /**
- * lpfc_debugfs_disc_trc_data - Dump discovery logging to a buffer.
+ * lpfc_debugfs_disc_trc_data - Dump discovery logging to a buffer
  * @vport: The vport to gather the log info from.
  * @buf: The buffer to dump log into.
  * @size: The maximum amount of data to process.
@@ -187,7 +187,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_vport *vport, char *buf, int size)
 }
 
 /**
- * lpfc_debugfs_slow_ring_trc_data - Dump slow ring logging to a buffer.
+ * lpfc_debugfs_slow_ring_trc_data - Dump slow ring logging to a buffer
  * @phba: The HBA to gather the log info from.
  * @buf: The buffer to dump log into.
  * @size: The maximum amount of data to process.
@@ -250,7 +250,7 @@ lpfc_debugfs_slow_ring_trc_data(struct lpfc_hba *phba, char *buf, int size)
 static int lpfc_debugfs_last_hbq = -1;
 
 /**
- * lpfc_debugfs_hbqinfo_data - Dump host buffer queue info to a buffer.
+ * lpfc_debugfs_hbqinfo_data - Dump host buffer queue info to a buffer
  * @phba: The HBA to gather host buffer info from.
  * @buf: The buffer to dump log into.
  * @size: The maximum amount of data to process.
@@ -369,7 +369,7 @@ skipit:
 static int lpfc_debugfs_last_hba_slim_off;
 
 /**
- * lpfc_debugfs_dumpHBASlim_data - Dump HBA SLIM info to a buffer.
+ * lpfc_debugfs_dumpHBASlim_data - Dump HBA SLIM info to a buffer
  * @phba: The HBA to gather SLIM info from.
  * @buf: The buffer to dump log into.
  * @size: The maximum amount of data to process.
@@ -399,8 +399,7 @@ lpfc_debugfs_dumpHBASlim_data(struct lpfc_hba *phba, char *buf, int size)
 
         len +=  snprintf(buf+len, size-len, "HBA SLIM\n");
         lpfc_memcpy_from_slim(buffer,
-                ((uint8_t *)phba->MBslimaddr) + lpfc_debugfs_last_hba_slim_off,
-                1024);
+                phba->MBslimaddr + lpfc_debugfs_last_hba_slim_off, 1024);
 
         ptr = (uint32_t *)&buffer[0];
         off = lpfc_debugfs_last_hba_slim_off;
@@ -426,7 +425,7 @@ lpfc_debugfs_dumpHBASlim_data(struct lpfc_hba *phba, char *buf, int size)
 }
 
 /**
- * lpfc_debugfs_dumpHostSlim_data - Dump host SLIM info to a buffer.
+ * lpfc_debugfs_dumpHostSlim_data - Dump host SLIM info to a buffer
  * @phba: The HBA to gather Host SLIM info from.
  * @buf: The buffer to dump log into.
  * @size: The maximum amount of data to process.
@@ -501,7 +500,7 @@ lpfc_debugfs_dumpHostSlim_data(struct lpfc_hba *phba, char *buf, int size)
 }
 
 /**
- * lpfc_debugfs_nodelist_data - Dump target node list to a buffer.
+ * lpfc_debugfs_nodelist_data - Dump target node list to a buffer
  * @vport: The vport to gather target node info from.
  * @buf: The buffer to dump log into.
  * @size: The maximum amount of data to process.
@@ -599,7 +598,7 @@ lpfc_debugfs_nodelist_data(struct lpfc_vport *vport, char *buf, int size)
 #endif
 
 /**
- * lpfc_debugfs_disc_trc - Store discovery trace log.
+ * lpfc_debugfs_disc_trc - Store discovery trace log
  * @vport: The vport to associate this trace string with for retrieval.
  * @mask: Log entry classification.
  * @fmt: Format string to be displayed when dumping the log.
@@ -643,7 +642,7 @@ lpfc_debugfs_disc_trc(struct lpfc_vport *vport, int mask, char *fmt,
 }
 
 /**
- * lpfc_debugfs_slow_ring_trc - Store slow ring trace log.
+ * lpfc_debugfs_slow_ring_trc - Store slow ring trace log
  * @phba: The phba to associate this trace string with for retrieval.
  * @fmt: Format string to be displayed when dumping the log.
  * @data1: 1st data parameter to be applied to @fmt.
@@ -682,7 +681,7 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_hba *phba, char *fmt,
 
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
 /**
- * lpfc_debugfs_disc_trc_open - Open the discovery trace log.
+ * lpfc_debugfs_disc_trc_open - Open the discovery trace log
  * @inode: The inode pointer that contains a vport pointer.
  * @file: The file pointer to attach the log output.
  *
@@ -732,7 +731,7 @@ out:
 }
 
 /**
- * lpfc_debugfs_slow_ring_trc_open - Open the Slow Ring trace log.
+ * lpfc_debugfs_slow_ring_trc_open - Open the Slow Ring trace log
  * @inode: The inode pointer that contains a vport pointer.
  * @file: The file pointer to attach the log output.
  *
@@ -782,7 +781,7 @@ out:
 }
 
 /**
- * lpfc_debugfs_hbqinfo_open - Open the hbqinfo debugfs buffer.
+ * lpfc_debugfs_hbqinfo_open - Open the hbqinfo debugfs buffer
  * @inode: The inode pointer that contains a vport pointer.
  * @file: The file pointer to attach the log output.
  *
@@ -824,7 +823,7 @@ out:
 }
 
 /**
- * lpfc_debugfs_dumpHBASlim_open - Open the Dump HBA SLIM debugfs buffer.
+ * lpfc_debugfs_dumpHBASlim_open - Open the Dump HBA SLIM debugfs buffer
  * @inode: The inode pointer that contains a vport pointer.
  * @file: The file pointer to attach the log output.
  *
@@ -866,7 +865,7 @@ out:
 }
 
 /**
- * lpfc_debugfs_dumpHostSlim_open - Open the Dump Host SLIM debugfs buffer.
+ * lpfc_debugfs_dumpHostSlim_open - Open the Dump Host SLIM debugfs buffer
  * @inode: The inode pointer that contains a vport pointer.
  * @file: The file pointer to attach the log output.
  *
@@ -993,7 +992,7 @@ lpfc_debugfs_dumpDataDif_write(struct file *file, const char __user *buf,
 
 
 /**
- * lpfc_debugfs_nodelist_open - Open the nodelist debugfs file.
+ * lpfc_debugfs_nodelist_open - Open the nodelist debugfs file
  * @inode: The inode pointer that contains a vport pointer.
  * @file: The file pointer to attach the log output.
  *
@@ -1035,7 +1034,7 @@ out:
 }
 
 /**
- * lpfc_debugfs_lseek - Seek through a debugfs file.
+ * lpfc_debugfs_lseek - Seek through a debugfs file
  * @file: The file pointer to seek through.
  * @off: The offset to seek to or the amount to seek by.
  * @whence: Indicates how to seek.
@@ -1073,7 +1072,7 @@ lpfc_debugfs_lseek(struct file *file, loff_t off, int whence)
 }
 
 /**
- * lpfc_debugfs_read - Read a debugfs file.
+ * lpfc_debugfs_read - Read a debugfs file
  * @file: The file pointer to read from.
  * @buf: The buffer to copy the data to.
  * @nbytes: The number of bytes to read.
@@ -1098,7 +1097,7 @@ lpfc_debugfs_read(struct file *file, char __user *buf,
 }
 
 /**
- * lpfc_debugfs_release - Release the buffer used to store debugfs file data.
+ * lpfc_debugfs_release - Release the buffer used to store debugfs file data
  * @inode: The inode pointer that contains a vport pointer. (unused)
  * @file: The file pointer that contains the buffer to release.
  *
@@ -1210,7 +1209,7 @@ static atomic_t lpfc_debugfs_hba_count;
 #endif
 
 /**
- * lpfc_debugfs_initialize - Initialize debugfs for a vport.
+ * lpfc_debugfs_initialize - Initialize debugfs for a vport
  * @vport: The vport pointer to initialize.
  *
  * Description:
@@ -1434,7 +1433,7 @@ debug_failed:
 }
 
 /**
- * lpfc_debugfs_terminate -  Tear down debugfs infrastructure for this vport.
+ * lpfc_debugfs_terminate -  Tear down debugfs infrastructure for this vport
  * @vport: The vport pointer to remove from debugfs.
  *
  * Description:
diff --git a/drivers/scsi/lpfc/lpfc_disc.h b/drivers/scsi/lpfc/lpfc_disc.h
index f29e548a90d..ffd10897207 100644
--- a/drivers/scsi/lpfc/lpfc_disc.h
+++ b/drivers/scsi/lpfc/lpfc_disc.h
@@ -99,6 +99,7 @@ struct lpfc_nodelist {
 #define NLP_USG_FREE_ACK_BIT    0x8     /* Indicate ndlp memory free invoked */
 
         struct timer_list   nlp_delayfunc;      /* Used for delayed ELS cmds */
+        struct lpfc_hba *phba;
         struct fc_rport *rport;                 /* Corresponding FC transport
                                                    port structure */
         struct lpfc_vport *vport;
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index a7302480bc4..b8b34cf5c3d 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -55,7 +55,7 @@ static void lpfc_register_new_vport(struct lpfc_hba *phba,
 static int lpfc_max_els_tries = 3;
 
 /**
- * lpfc_els_chk_latt: Check host link attention event for a vport.
+ * lpfc_els_chk_latt - Check host link attention event for a vport
  * @vport: pointer to a host virtual N_Port data structure.
  *
  * This routine checks whether there is an outstanding host link
@@ -116,7 +116,7 @@ lpfc_els_chk_latt(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_prep_els_iocb: Allocate and prepare a lpfc iocb data structure.
+ * lpfc_prep_els_iocb - Allocate and prepare a lpfc iocb data structure
  * @vport: pointer to a host virtual N_Port data structure.
  * @expectRsp: flag indicating whether response is expected.
  * @cmdSize: size of the ELS command.
@@ -290,7 +290,7 @@ els_iocb_free_pcmb_exit:
 }
 
 /**
- * lpfc_issue_fabric_reglogin: Issue fabric registration login for a vport.
+ * lpfc_issue_fabric_reglogin - Issue fabric registration login for a vport
  * @vport: pointer to a host virtual N_Port data structure.
  *
  * This routine issues a fabric registration login for a @vport. An
@@ -386,7 +386,7 @@ fail:
 }
 
 /**
- * lpfc_cmpl_els_flogi_fabric: Completion function for flogi to a fabric port.
+ * lpfc_cmpl_els_flogi_fabric - Completion function for flogi to a fabric port
  * @vport: pointer to a host virtual N_Port data structure.
  * @ndlp: pointer to a node-list data structure.
  * @sp: pointer to service parameter data structure.
@@ -509,7 +509,7 @@ lpfc_cmpl_els_flogi_fabric(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 }
 
 /**
- * lpfc_cmpl_els_flogi_nport: Completion function for flogi to an N_Port.
+ * lpfc_cmpl_els_flogi_nport - Completion function for flogi to an N_Port
  * @vport: pointer to a host virtual N_Port data structure.
  * @ndlp: pointer to a node-list data structure.
  * @sp: pointer to service parameter data structure.
@@ -626,7 +626,7 @@ fail:
 }
 
 /**
- * lpfc_cmpl_els_flogi: Completion callback function for flogi.
+ * lpfc_cmpl_els_flogi - Completion callback function for flogi
  * @phba: pointer to lpfc hba data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @rspiocb: pointer to lpfc response iocb data structure.
@@ -751,7 +751,7 @@ out:
 }
 
 /**
- * lpfc_issue_els_flogi: Issue an flogi iocb command for a vport.
+ * lpfc_issue_els_flogi - Issue an flogi iocb command for a vport
  * @vport: pointer to a host virtual N_Port data structure.
  * @ndlp: pointer to a node-list data structure.
  * @retry: number of retries to the command IOCB.
@@ -849,7 +849,7 @@ lpfc_issue_els_flogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 }
 
 /**
- * lpfc_els_abort_flogi: Abort all outstanding flogi iocbs.
+ * lpfc_els_abort_flogi - Abort all outstanding flogi iocbs
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine aborts all the outstanding Fabric Login (FLOGI) IOCBs
@@ -898,7 +898,7 @@ lpfc_els_abort_flogi(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_initial_flogi: Issue an initial fabric login for a vport.
+ * lpfc_initial_flogi - Issue an initial fabric login for a vport
  * @vport: pointer to a host virtual N_Port data structure.
  *
  * This routine issues an initial Fabric Login (FLOGI) for the @vport
@@ -949,7 +949,7 @@ lpfc_initial_flogi(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_initial_fdisc: Issue an initial fabric discovery for a vport.
+ * lpfc_initial_fdisc - Issue an initial fabric discovery for a vport
  * @vport: pointer to a host virtual N_Port data structure.
  *
  * This routine issues an initial Fabric Discover (FDISC) for the @vport
@@ -998,7 +998,7 @@ lpfc_initial_fdisc(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_more_plogi: Check and issue remaining plogis for a vport.
+ * lpfc_more_plogi - Check and issue remaining plogis for a vport
  * @vport: pointer to a host virtual N_Port data structure.
  *
  * This routine checks whether there are more remaining Port Logins
@@ -1031,7 +1031,7 @@ lpfc_more_plogi(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_plogi_confirm_nport: Confirm pologi wwpn matches stored ndlp.
+ * lpfc_plogi_confirm_nport - Confirm pologi wwpn matches stored ndlp
  * @phba: pointer to lpfc hba data structure.
  * @prsp: pointer to response IOCB payload.
  * @ndlp: pointer to a node-list data structure.
@@ -1165,7 +1165,7 @@ lpfc_plogi_confirm_nport(struct lpfc_hba *phba, uint32_t *prsp,
 }
 
 /**
- * lpfc_end_rscn: Check and handle more rscn for a vport.
+ * lpfc_end_rscn - Check and handle more rscn for a vport
  * @vport: pointer to a host virtual N_Port data structure.
  *
  * This routine checks whether more Registration State Change
@@ -1197,7 +1197,7 @@ lpfc_end_rscn(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_cmpl_els_plogi: Completion callback function for plogi.
+ * lpfc_cmpl_els_plogi - Completion callback function for plogi
  * @phba: pointer to lpfc hba data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @rspiocb: pointer to lpfc response iocb data structure.
@@ -1322,7 +1322,7 @@ out:
 }
 
 /**
- * lpfc_issue_els_plogi: Issue an plogi iocb command for a vport.
+ * lpfc_issue_els_plogi - Issue an plogi iocb command for a vport
  * @vport: pointer to a host virtual N_Port data structure.
  * @did: destination port identifier.
  * @retry: number of retries to the command IOCB.
@@ -1401,7 +1401,7 @@ lpfc_issue_els_plogi(struct lpfc_vport *vport, uint32_t did, uint8_t retry)
 }
 
 /**
- * lpfc_cmpl_els_prli: Completion callback function for prli.
+ * lpfc_cmpl_els_prli - Completion callback function for prli
  * @phba: pointer to lpfc hba data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @rspiocb: pointer to lpfc response iocb data structure.
@@ -1472,7 +1472,7 @@ out:
 }
 
 /**
- * lpfc_issue_els_prli: Issue a prli iocb command for a vport.
+ * lpfc_issue_els_prli - Issue a prli iocb command for a vport
  * @vport: pointer to a host virtual N_Port data structure.
  * @ndlp: pointer to a node-list data structure.
  * @retry: number of retries to the command IOCB.
@@ -1562,7 +1562,7 @@ lpfc_issue_els_prli(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 }
 
 /**
- * lpfc_rscn_disc: Perform rscn discovery for a vport.
+ * lpfc_rscn_disc - Perform rscn discovery for a vport
  * @vport: pointer to a host virtual N_Port data structure.
  *
  * This routine performs Registration State Change Notification (RSCN)
@@ -1588,7 +1588,7 @@ lpfc_rscn_disc(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_adisc_done: Complete the adisc phase of discovery.
+ * lpfc_adisc_done - Complete the adisc phase of discovery
  * @vport: pointer to lpfc_vport hba data structure that finished all ADISCs.
  *
  * This function is called when the final ADISC is completed during discovery.
@@ -1639,7 +1639,7 @@ lpfc_adisc_done(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_more_adisc: Issue more adisc as needed.
+ * lpfc_more_adisc - Issue more adisc as needed
  * @vport: pointer to a host virtual N_Port data structure.
  *
  * This routine determines whether there are more ndlps on a @vport
@@ -1672,7 +1672,7 @@ lpfc_more_adisc(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_cmpl_els_adisc: Completion callback function for adisc.
+ * lpfc_cmpl_els_adisc - Completion callback function for adisc
  * @phba: pointer to lpfc hba data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @rspiocb: pointer to lpfc response iocb data structure.
@@ -1760,7 +1760,7 @@ out:
 }
 
 /**
- * lpfc_issue_els_adisc: Issue an address discover iocb to an node on a vport.
+ * lpfc_issue_els_adisc - Issue an address discover iocb to an node on a vport
  * @vport: pointer to a virtual N_Port data structure.
  * @ndlp: pointer to a node-list data structure.
  * @retry: number of retries to the command IOCB.
@@ -1833,7 +1833,7 @@ lpfc_issue_els_adisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 }
 
 /**
- * lpfc_cmpl_els_logo: Completion callback function for logo.
+ * lpfc_cmpl_els_logo - Completion callback function for logo
  * @phba: pointer to lpfc hba data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @rspiocb: pointer to lpfc response iocb data structure.
@@ -1910,7 +1910,7 @@ out:
 }
 
 /**
- * lpfc_issue_els_logo: Issue a logo to an node on a vport.
+ * lpfc_issue_els_logo - Issue a logo to an node on a vport
  * @vport: pointer to a virtual N_Port data structure.
  * @ndlp: pointer to a node-list data structure.
  * @retry: number of retries to the command IOCB.
@@ -1991,7 +1991,7 @@ lpfc_issue_els_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 }
 
 /**
- * lpfc_cmpl_els_cmd: Completion callback function for generic els command.
+ * lpfc_cmpl_els_cmd - Completion callback function for generic els command
  * @phba: pointer to lpfc hba data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @rspiocb: pointer to lpfc response iocb data structure.
@@ -2031,7 +2031,7 @@ lpfc_cmpl_els_cmd(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 }
 
 /**
- * lpfc_issue_els_scr: Issue a scr to an node on a vport.
+ * lpfc_issue_els_scr - Issue a scr to an node on a vport
  * @vport: pointer to a host virtual N_Port data structure.
  * @nportid: N_Port identifier to the remote node.
  * @retry: number of retries to the command IOCB.
@@ -2125,7 +2125,7 @@ lpfc_issue_els_scr(struct lpfc_vport *vport, uint32_t nportid, uint8_t retry)
 }
 
 /**
- * lpfc_issue_els_farpr: Issue a farp to an node on a vport.
+ * lpfc_issue_els_farpr - Issue a farp to an node on a vport
  * @vport: pointer to a host virtual N_Port data structure.
  * @nportid: N_Port identifier to the remote node.
  * @retry: number of retries to the command IOCB.
@@ -2236,7 +2236,7 @@ lpfc_issue_els_farpr(struct lpfc_vport *vport, uint32_t nportid, uint8_t retry)
 }
 
 /**
- * lpfc_cancel_retry_delay_tmo: Cancel the timer with delayed iocb-cmd retry.
+ * lpfc_cancel_retry_delay_tmo - Cancel the timer with delayed iocb-cmd retry
  * @vport: pointer to a host virtual N_Port data structure.
  * @nlp: pointer to a node-list data structure.
  *
@@ -2291,7 +2291,7 @@ lpfc_cancel_retry_delay_tmo(struct lpfc_vport *vport, struct lpfc_nodelist *nlp)
 }
 
 /**
- * lpfc_els_retry_delay: Timer function with a ndlp delayed function timer.
+ * lpfc_els_retry_delay - Timer function with a ndlp delayed function timer
  * @ptr: holder for the pointer to the timer function associated data (ndlp).
  *
  * This routine is invoked by the ndlp delayed-function timer to check
@@ -2333,7 +2333,7 @@ lpfc_els_retry_delay(unsigned long ptr)
 }
 
 /**
- * lpfc_els_retry_delay_handler: Work thread handler for ndlp delayed function.
+ * lpfc_els_retry_delay_handler - Work thread handler for ndlp delayed function
  * @ndlp: pointer to a node-list data structure.
  *
  * This routine is the worker-thread handler for processing the @ndlp delayed
@@ -2404,7 +2404,7 @@ lpfc_els_retry_delay_handler(struct lpfc_nodelist *ndlp)
 }
 
 /**
- * lpfc_els_retry: Make retry decision on an els command iocb.
+ * lpfc_els_retry - Make retry decision on an els command iocb
  * @phba: pointer to lpfc hba data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @rspiocb: pointer to lpfc response iocb data structure.
@@ -2732,7 +2732,7 @@ lpfc_els_retry(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 }
 
 /**
- * lpfc_els_free_data: Free lpfc dma buffer and data structure with an iocb.
+ * lpfc_els_free_data - Free lpfc dma buffer and data structure with an iocb
  * @phba: pointer to lpfc hba data structure.
  * @buf_ptr1: pointer to the lpfc DMA buffer data structure.
  *
@@ -2764,7 +2764,7 @@ lpfc_els_free_data(struct lpfc_hba *phba, struct lpfc_dmabuf *buf_ptr1)
 }
 
 /**
- * lpfc_els_free_bpl: Free lpfc dma buffer and data structure with bpl.
+ * lpfc_els_free_bpl - Free lpfc dma buffer and data structure with bpl
  * @phba: pointer to lpfc hba data structure.
  * @buf_ptr: pointer to the lpfc dma buffer data structure.
  *
@@ -2784,7 +2784,7 @@ lpfc_els_free_bpl(struct lpfc_hba *phba, struct lpfc_dmabuf *buf_ptr)
 }
 
 /**
- * lpfc_els_free_iocb: Free a command iocb and its associated resources.
+ * lpfc_els_free_iocb - Free a command iocb and its associated resources
  * @phba: pointer to lpfc hba data structure.
  * @elsiocb: pointer to lpfc els command iocb data structure.
  *
@@ -2877,7 +2877,7 @@ lpfc_els_free_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *elsiocb)
 }
 
 /**
- * lpfc_cmpl_els_logo_acc: Completion callback function to logo acc response.
+ * lpfc_cmpl_els_logo_acc - Completion callback function to logo acc response
  * @phba: pointer to lpfc hba data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @rspiocb: pointer to lpfc response iocb data structure.
@@ -2931,7 +2931,7 @@ lpfc_cmpl_els_logo_acc(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 }
 
 /**
- * lpfc_mbx_cmpl_dflt_rpi: Completion callbk func for unreg dflt rpi mbox cmd.
+ * lpfc_mbx_cmpl_dflt_rpi - Completion callbk func for unreg dflt rpi mbox cmd
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
  *
@@ -2965,7 +2965,7 @@ lpfc_mbx_cmpl_dflt_rpi(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
 }
 
 /**
- * lpfc_cmpl_els_rsp: Completion callback function for els response iocb cmd.
+ * lpfc_cmpl_els_rsp - Completion callback function for els response iocb cmd
  * @phba: pointer to lpfc hba data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @rspiocb: pointer to lpfc response iocb data structure.
@@ -3136,7 +3136,7 @@ out:
 }
 
 /**
- * lpfc_els_rsp_acc: Prepare and issue an acc response iocb command.
+ * lpfc_els_rsp_acc - Prepare and issue an acc response iocb command
  * @vport: pointer to a host virtual N_Port data structure.
  * @flag: the els command code to be accepted.
  * @oldiocb: pointer to the original lpfc command iocb data structure.
@@ -3275,7 +3275,7 @@ lpfc_els_rsp_acc(struct lpfc_vport *vport, uint32_t flag,
 }
 
 /**
- * lpfc_els_rsp_reject: Propare and issue a rjt response iocb command.
+ * lpfc_els_rsp_reject - Propare and issue a rjt response iocb command
  * @vport: pointer to a virtual N_Port data structure.
  * @rejectError:
  * @oldiocb: pointer to the original lpfc command iocb data structure.
@@ -3356,7 +3356,7 @@ lpfc_els_rsp_reject(struct lpfc_vport *vport, uint32_t rejectError,
 }
 
 /**
- * lpfc_els_rsp_adisc_acc: Prepare and issue acc response to adisc iocb cmd.
+ * lpfc_els_rsp_adisc_acc - Prepare and issue acc response to adisc iocb cmd
  * @vport: pointer to a virtual N_Port data structure.
  * @oldiocb: pointer to the original lpfc command iocb data structure.
  * @ndlp: pointer to a node-list data structure.
@@ -3431,7 +3431,7 @@ lpfc_els_rsp_adisc_acc(struct lpfc_vport *vport, struct lpfc_iocbq *oldiocb,
 }
 
 /**
- * lpfc_els_rsp_prli_acc: Prepare and issue acc response to prli iocb cmd.
+ * lpfc_els_rsp_prli_acc - Prepare and issue acc response to prli iocb cmd
  * @vport: pointer to a virtual N_Port data structure.
  * @oldiocb: pointer to the original lpfc command iocb data structure.
  * @ndlp: pointer to a node-list data structure.
@@ -3529,7 +3529,7 @@ lpfc_els_rsp_prli_acc(struct lpfc_vport *vport, struct lpfc_iocbq *oldiocb,
 }
 
 /**
- * lpfc_els_rsp_rnid_acc: Issue rnid acc response iocb command.
+ * lpfc_els_rsp_rnid_acc - Issue rnid acc response iocb command
  * @vport: pointer to a virtual N_Port data structure.
  * @format: rnid command format.
  * @oldiocb: pointer to the original lpfc command iocb data structure.
@@ -3635,7 +3635,7 @@ lpfc_els_rsp_rnid_acc(struct lpfc_vport *vport, uint8_t format,
 }
 
 /**
- * lpfc_els_disc_adisc: Issue remaining adisc iocbs to npr nodes of a vport.
+ * lpfc_els_disc_adisc - Issue remaining adisc iocbs to npr nodes of a vport
  * @vport: pointer to a host virtual N_Port data structure.
  *
  * This routine issues Address Discover (ADISC) ELS commands to those
@@ -3693,7 +3693,7 @@ lpfc_els_disc_adisc(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_els_disc_plogi: Issue plogi for all npr nodes of a vport before adisc.
+ * lpfc_els_disc_plogi - Issue plogi for all npr nodes of a vport before adisc
  * @vport: pointer to a host virtual N_Port data structure.
  *
  * This routine issues Port Login (PLOGI) ELS commands to all the N_Ports
@@ -3752,7 +3752,7 @@ lpfc_els_disc_plogi(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_els_flush_rscn: Clean up any rscn activities with a vport.
+ * lpfc_els_flush_rscn - Clean up any rscn activities with a vport
  * @vport: pointer to a host virtual N_Port data structure.
  *
  * This routine cleans up any Registration State Change Notification
@@ -3791,7 +3791,7 @@ lpfc_els_flush_rscn(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_rscn_payload_check: Check whether there is a pending rscn to a did.
+ * lpfc_rscn_payload_check - Check whether there is a pending rscn to a did
  * @vport: pointer to a host virtual N_Port data structure.
  * @did: remote destination port identifier.
  *
@@ -3866,7 +3866,7 @@ return_did_out:
 }
 
 /**
- * lpfc_rscn_recovery_check: Send recovery event to vport nodes matching rscn
+ * lpfc_rscn_recovery_check - Send recovery event to vport nodes matching rscn
  * @vport: pointer to a host virtual N_Port data structure.
  *
  * This routine sends recovery (NLP_EVT_DEVICE_RECOVERY) event to the
@@ -3895,7 +3895,7 @@ lpfc_rscn_recovery_check(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_send_rscn_event: Send an RSCN event to management application.
+ * lpfc_send_rscn_event - Send an RSCN event to management application
  * @vport: pointer to a host virtual N_Port data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  *
@@ -3938,7 +3938,7 @@ lpfc_send_rscn_event(struct lpfc_vport *vport,
 }
 
 /**
- * lpfc_els_rcv_rscn: Process an unsolicited rscn iocb.
+ * lpfc_els_rcv_rscn - Process an unsolicited rscn iocb
  * @vport: pointer to a host virtual N_Port data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @ndlp: pointer to a node-list data structure.
@@ -4134,7 +4134,7 @@ lpfc_els_rcv_rscn(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
 }
 
 /**
- * lpfc_els_handle_rscn: Handle rscn for a vport.
+ * lpfc_els_handle_rscn - Handle rscn for a vport
  * @vport: pointer to a host virtual N_Port data structure.
  *
  * This routine handles the Registration State Configuration Notification
@@ -4222,7 +4222,7 @@ lpfc_els_handle_rscn(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_els_rcv_flogi: Process an unsolicited flogi iocb.
+ * lpfc_els_rcv_flogi - Process an unsolicited flogi iocb
  * @vport: pointer to a host virtual N_Port data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @ndlp: pointer to a node-list data structure.
@@ -4336,7 +4336,7 @@ lpfc_els_rcv_flogi(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
 }
 
 /**
- * lpfc_els_rcv_rnid: Process an unsolicited rnid iocb.
+ * lpfc_els_rcv_rnid - Process an unsolicited rnid iocb
  * @vport: pointer to a host virtual N_Port data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @ndlp: pointer to a node-list data structure.
@@ -4391,7 +4391,7 @@ lpfc_els_rcv_rnid(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
 }
 
 /**
- * lpfc_els_rcv_lirr: Process an unsolicited lirr iocb.
+ * lpfc_els_rcv_lirr - Process an unsolicited lirr iocb
  * @vport: pointer to a host virtual N_Port data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @ndlp: pointer to a node-list data structure.
@@ -4419,7 +4419,7 @@ lpfc_els_rcv_lirr(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
 }
 
 /**
- * lpfc_els_rsp_rps_acc: Completion callbk func for MBX_READ_LNK_STAT mbox cmd.
+ * lpfc_els_rsp_rps_acc - Completion callbk func for MBX_READ_LNK_STAT mbox cmd
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
  *
@@ -4513,7 +4513,7 @@ lpfc_els_rsp_rps_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
 }
 
 /**
- * lpfc_els_rcv_rps: Process an unsolicited rps iocb.
+ * lpfc_els_rcv_rps - Process an unsolicited rps iocb
  * @vport: pointer to a host virtual N_Port data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @ndlp: pointer to a node-list data structure.
@@ -4590,7 +4590,7 @@ reject_out:
 }
 
 /**
- * lpfc_els_rsp_rpl_acc: Issue an accept rpl els command.
+ * lpfc_els_rsp_rpl_acc - Issue an accept rpl els command
  * @vport: pointer to a host virtual N_Port data structure.
  * @cmdsize: size of the ELS command.
  * @oldiocb: pointer to the original lpfc command iocb data structure.
@@ -4662,7 +4662,7 @@ lpfc_els_rsp_rpl_acc(struct lpfc_vport *vport, uint16_t cmdsize,
 }
 
 /**
- * lpfc_els_rcv_rpl: Process an unsolicited rpl iocb.
+ * lpfc_els_rcv_rpl - Process an unsolicited rpl iocb
  * @vport: pointer to a host virtual N_Port data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @ndlp: pointer to a node-list data structure.
@@ -4721,7 +4721,7 @@ lpfc_els_rcv_rpl(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
 }
 
 /**
- * lpfc_els_rcv_farp: Process an unsolicited farp request els command.
+ * lpfc_els_rcv_farp - Process an unsolicited farp request els command
  * @vport: pointer to a virtual N_Port data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @ndlp: pointer to a node-list data structure.
@@ -4804,7 +4804,7 @@ lpfc_els_rcv_farp(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
 }
 
 /**
- * lpfc_els_rcv_farpr: Process an unsolicited farp response iocb.
+ * lpfc_els_rcv_farpr - Process an unsolicited farp response iocb
  * @vport: pointer to a host virtual N_Port data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @ndlp: pointer to a node-list data structure.
@@ -4842,7 +4842,7 @@ lpfc_els_rcv_farpr(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
 }
 
 /**
- * lpfc_els_rcv_fan: Process an unsolicited fan iocb command.
+ * lpfc_els_rcv_fan - Process an unsolicited fan iocb command
  * @vport: pointer to a host virtual N_Port data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @fan_ndlp: pointer to a node-list data structure.
@@ -4890,7 +4890,7 @@ lpfc_els_rcv_fan(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
 }
 
 /**
- * lpfc_els_timeout: Handler funciton to the els timer.
+ * lpfc_els_timeout - Handler funciton to the els timer
  * @ptr: holder for the timer function associated data.
  *
  * This routine is invoked by the ELS timer after timeout. It posts the ELS
@@ -4919,7 +4919,7 @@ lpfc_els_timeout(unsigned long ptr)
 }
 
 /**
- * lpfc_els_timeout_handler: Process an els timeout event.
+ * lpfc_els_timeout_handler - Process an els timeout event
  * @vport: pointer to a virtual N_Port data structure.
  *
  * This routine is the actual handler function that processes an ELS timeout
@@ -4994,7 +4994,7 @@ lpfc_els_timeout_handler(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_els_flush_cmd: Clean up the outstanding els commands to a vport.
+ * lpfc_els_flush_cmd - Clean up the outstanding els commands to a vport
  * @vport: pointer to a host virtual N_Port data structure.
  *
  * This routine is used to clean up all the outstanding ELS commands on a
@@ -5058,25 +5058,15 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport)
         }
         spin_unlock_irq(&phba->hbalock);
 
-        while (!list_empty(&completions)) {
-                piocb = list_get_first(&completions, struct lpfc_iocbq, list);
-                cmd = &piocb->iocb;
-                list_del_init(&piocb->list);
-
-                if (!piocb->iocb_cmpl)
-                        lpfc_sli_release_iocbq(phba, piocb);
-                else {
-                        cmd->ulpStatus = IOSTAT_LOCAL_REJECT;
-                        cmd->un.ulpWord[4] = IOERR_SLI_ABORTED;
-                        (piocb->iocb_cmpl) (phba, piocb, piocb);
-                }
-        }
+        /* Cancell all the IOCBs from the completions list */
+        lpfc_sli_cancel_iocbs(phba, &completions, IOSTAT_LOCAL_REJECT,
+                              IOERR_SLI_ABORTED);
 
         return;
 }
 
 /**
- * lpfc_els_flush_all_cmd: Clean up all the outstanding els commands to a HBA.
+ * lpfc_els_flush_all_cmd - Clean up all the outstanding els commands to a HBA
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine is used to clean up all the outstanding ELS commands on a
@@ -5121,23 +5111,16 @@ lpfc_els_flush_all_cmd(struct lpfc_hba  *phba)
                 lpfc_sli_issue_abort_iotag(phba, pring, piocb);
         }
         spin_unlock_irq(&phba->hbalock);
-        while (!list_empty(&completions)) {
-                piocb = list_get_first(&completions, struct lpfc_iocbq, list);
-                cmd = &piocb->iocb;
-                list_del_init(&piocb->list);
-                if (!piocb->iocb_cmpl)
-                        lpfc_sli_release_iocbq(phba, piocb);
-                else {
-                        cmd->ulpStatus = IOSTAT_LOCAL_REJECT;
-                        cmd->un.ulpWord[4] = IOERR_SLI_ABORTED;
-                        (piocb->iocb_cmpl) (phba, piocb, piocb);
-                }
-        }
+
+        /* Cancel all the IOCBs from the completions list */
+        lpfc_sli_cancel_iocbs(phba, &completions, IOSTAT_LOCAL_REJECT,
+                              IOERR_SLI_ABORTED);
+
         return;
 }
 
 /**
- * lpfc_send_els_failure_event: Posts an ELS command failure event.
+ * lpfc_send_els_failure_event - Posts an ELS command failure event
  * @phba: Pointer to hba context object.
  * @cmdiocbp: Pointer to command iocb which reported error.
  * @rspiocbp: Pointer to response iocb which reported error.
@@ -5204,7 +5187,7 @@ lpfc_send_els_failure_event(struct lpfc_hba *phba,
 }
 
 /**
- * lpfc_send_els_event: Posts unsolicited els event.
+ * lpfc_send_els_event - Posts unsolicited els event
  * @vport: Pointer to vport object.
  * @ndlp: Pointer FC node object.
  * @cmd: ELS command code.
@@ -5284,7 +5267,7 @@ lpfc_send_els_event(struct lpfc_vport *vport,
 
 
 /**
- * lpfc_els_unsol_buffer: Process an unsolicited event data buffer.
+ * lpfc_els_unsol_buffer - Process an unsolicited event data buffer
  * @phba: pointer to lpfc hba data structure.
  * @pring: pointer to a SLI ring.
  * @vport: pointer to a host virtual N_Port data structure.
@@ -5592,7 +5575,7 @@ dropit:
 }
 
 /**
- * lpfc_find_vport_by_vpid: Find a vport on a HBA through vport identifier.
+ * lpfc_find_vport_by_vpid - Find a vport on a HBA through vport identifier
  * @phba: pointer to lpfc hba data structure.
  * @vpi: host virtual N_Port identifier.
  *
@@ -5622,7 +5605,7 @@ lpfc_find_vport_by_vpid(struct lpfc_hba *phba, uint16_t vpi)
 }
 
 /**
- * lpfc_els_unsol_event: Process an unsolicited event from an els sli ring.
+ * lpfc_els_unsol_event - Process an unsolicited event from an els sli ring
  * @phba: pointer to lpfc hba data structure.
  * @pring: pointer to a SLI ring.
  * @elsiocb: pointer to lpfc els iocb data structure.
@@ -5710,7 +5693,7 @@ lpfc_els_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 }
 
 /**
- * lpfc_do_scr_ns_plogi: Issue a plogi to the name server for scr.
+ * lpfc_do_scr_ns_plogi - Issue a plogi to the name server for scr
  * @phba: pointer to lpfc hba data structure.
  * @vport: pointer to a virtual N_Port data structure.
  *
@@ -5781,7 +5764,7 @@ lpfc_do_scr_ns_plogi(struct lpfc_hba *phba, struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_cmpl_reg_new_vport: Completion callback function to register new vport.
+ * lpfc_cmpl_reg_new_vport - Completion callback function to register new vport
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
  *
@@ -5850,7 +5833,7 @@ lpfc_cmpl_reg_new_vport(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
 }
 
 /**
- * lpfc_register_new_vport: Register a new vport with a HBA.
+ * lpfc_register_new_vport - Register a new vport with a HBA
  * @phba: pointer to lpfc hba data structure.
  * @vport: pointer to a host virtual N_Port data structure.
  * @ndlp: pointer to a node-list data structure.
@@ -5899,7 +5882,7 @@ mbox_err_exit:
 }
 
 /**
- * lpfc_cmpl_els_fdisc: Completion function for fdisc iocb command.
+ * lpfc_cmpl_els_fdisc - Completion function for fdisc iocb command
  * @phba: pointer to lpfc hba data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @rspiocb: pointer to lpfc response iocb data structure.
@@ -6007,7 +5990,7 @@ out:
 }
 
 /**
- * lpfc_issue_els_fdisc: Issue a fdisc iocb command.
+ * lpfc_issue_els_fdisc - Issue a fdisc iocb command
  * @vport: pointer to a virtual N_Port data structure.
  * @ndlp: pointer to a node-list data structure.
  * @retry: number of retries to the command IOCB.
@@ -6101,7 +6084,7 @@ lpfc_issue_els_fdisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 }
 
 /**
- * lpfc_cmpl_els_npiv_logo: Completion function with vport logo.
+ * lpfc_cmpl_els_npiv_logo - Completion function with vport logo
  * @phba: pointer to lpfc hba data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @rspiocb: pointer to lpfc response iocb data structure.
@@ -6136,7 +6119,7 @@ lpfc_cmpl_els_npiv_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 }
 
 /**
- * lpfc_issue_els_npiv_logo: Issue a logo off a vport.
+ * lpfc_issue_els_npiv_logo - Issue a logo off a vport
  * @vport: pointer to a virtual N_Port data structure.
  * @ndlp: pointer to a node-list data structure.
  *
@@ -6197,7 +6180,7 @@ lpfc_issue_els_npiv_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
 }
 
 /**
- * lpfc_fabric_block_timeout: Handler function to the fabric block timer.
+ * lpfc_fabric_block_timeout - Handler function to the fabric block timer
  * @ptr: holder for the timer function associated data.
  *
  * This routine is invoked by the fabric iocb block timer after
@@ -6226,7 +6209,7 @@ lpfc_fabric_block_timeout(unsigned long ptr)
 }
 
 /**
- * lpfc_resume_fabric_iocbs: Issue a fabric iocb from driver internal list.
+ * lpfc_resume_fabric_iocbs - Issue a fabric iocb from driver internal list
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine issues one fabric iocb from the driver internal list to
@@ -6285,7 +6268,7 @@ repeat:
 }
 
 /**
- * lpfc_unblock_fabric_iocbs: Unblock issuing fabric iocb command.
+ * lpfc_unblock_fabric_iocbs - Unblock issuing fabric iocb command
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine unblocks the  issuing fabric iocb command. The function
@@ -6303,7 +6286,7 @@ lpfc_unblock_fabric_iocbs(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_block_fabric_iocbs: Block issuing fabric iocb command.
+ * lpfc_block_fabric_iocbs - Block issuing fabric iocb command
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine blocks the issuing fabric iocb for a specified amount of
@@ -6325,7 +6308,7 @@ lpfc_block_fabric_iocbs(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_cmpl_fabric_iocb: Completion callback function for fabric iocb.
+ * lpfc_cmpl_fabric_iocb - Completion callback function for fabric iocb
  * @phba: pointer to lpfc hba data structure.
  * @cmdiocb: pointer to lpfc command iocb data structure.
  * @rspiocb: pointer to lpfc response iocb data structure.
@@ -6384,7 +6367,7 @@ lpfc_cmpl_fabric_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 }
 
 /**
- * lpfc_issue_fabric_iocb: Issue a fabric iocb command.
+ * lpfc_issue_fabric_iocb - Issue a fabric iocb command
  * @phba: pointer to lpfc hba data structure.
  * @iocb: pointer to lpfc command iocb data structure.
  *
@@ -6453,7 +6436,7 @@ lpfc_issue_fabric_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *iocb)
 }
 
 /**
- * lpfc_fabric_abort_vport: Abort a vport's iocbs from driver fabric iocb list.
+ * lpfc_fabric_abort_vport - Abort a vport's iocbs from driver fabric iocb list
  * @vport: pointer to a virtual N_Port data structure.
  *
  * This routine aborts all the IOCBs associated with a @vport from the
@@ -6468,7 +6451,6 @@ static void lpfc_fabric_abort_vport(struct lpfc_vport *vport)
         LIST_HEAD(completions);
         struct lpfc_hba  *phba = vport->phba;
         struct lpfc_iocbq *tmp_iocb, *piocb;
-        IOCB_t *cmd;
 
         spin_lock_irq(&phba->hbalock);
         list_for_each_entry_safe(piocb, tmp_iocb, &phba->fabric_iocb_list,
@@ -6481,19 +6463,13 @@ static void lpfc_fabric_abort_vport(struct lpfc_vport *vport)
         }
         spin_unlock_irq(&phba->hbalock);
 
-        while (!list_empty(&completions)) {
-                piocb = list_get_first(&completions, struct lpfc_iocbq, list);
-                list_del_init(&piocb->list);
-
-                cmd = &piocb->iocb;
-                cmd->ulpStatus = IOSTAT_LOCAL_REJECT;
-                cmd->un.ulpWord[4] = IOERR_SLI_ABORTED;
-                (piocb->iocb_cmpl) (phba, piocb, piocb);
-        }
+        /* Cancel all the IOCBs from the completions list */
+        lpfc_sli_cancel_iocbs(phba, &completions, IOSTAT_LOCAL_REJECT,
+                              IOERR_SLI_ABORTED);
 }
 
 /**
- * lpfc_fabric_abort_nport: Abort a ndlp's iocbs from driver fabric iocb list.
+ * lpfc_fabric_abort_nport - Abort a ndlp's iocbs from driver fabric iocb list
  * @ndlp: pointer to a node-list data structure.
  *
  * This routine aborts all the IOCBs associated with an @ndlp from the
@@ -6506,10 +6482,9 @@ static void lpfc_fabric_abort_vport(struct lpfc_vport *vport)
 void lpfc_fabric_abort_nport(struct lpfc_nodelist *ndlp)
 {
         LIST_HEAD(completions);
-        struct lpfc_hba  *phba = ndlp->vport->phba;
+        struct lpfc_hba  *phba = ndlp->phba;
         struct lpfc_iocbq *tmp_iocb, *piocb;
         struct lpfc_sli_ring *pring = &phba->sli.ring[LPFC_ELS_RING];
-        IOCB_t *cmd;
 
         spin_lock_irq(&phba->hbalock);
         list_for_each_entry_safe(piocb, tmp_iocb, &phba->fabric_iocb_list,
@@ -6521,19 +6496,13 @@ void lpfc_fabric_abort_nport(struct lpfc_nodelist *ndlp)
         }
         spin_unlock_irq(&phba->hbalock);
 
-        while (!list_empty(&completions)) {
-                piocb = list_get_first(&completions, struct lpfc_iocbq, list);
-                list_del_init(&piocb->list);
-
-                cmd = &piocb->iocb;
-                cmd->ulpStatus = IOSTAT_LOCAL_REJECT;
-                cmd->un.ulpWord[4] = IOERR_SLI_ABORTED;
-                (piocb->iocb_cmpl) (phba, piocb, piocb);
-        }
+        /* Cancel all the IOCBs from the completions list */
+        lpfc_sli_cancel_iocbs(phba, &completions, IOSTAT_LOCAL_REJECT,
+                              IOERR_SLI_ABORTED);
 }
 
 /**
- * lpfc_fabric_abort_hba: Abort all iocbs on driver fabric iocb list.
+ * lpfc_fabric_abort_hba - Abort all iocbs on driver fabric iocb list
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine aborts all the IOCBs currently on the driver internal
@@ -6546,20 +6515,12 @@ void lpfc_fabric_abort_nport(struct lpfc_nodelist *ndlp)
 void lpfc_fabric_abort_hba(struct lpfc_hba *phba)
 {
         LIST_HEAD(completions);
-        struct lpfc_iocbq *piocb;
-        IOCB_t *cmd;
 
         spin_lock_irq(&phba->hbalock);
         list_splice_init(&phba->fabric_iocb_list, &completions);
         spin_unlock_irq(&phba->hbalock);
 
-        while (!list_empty(&completions)) {
-                piocb = list_get_first(&completions, struct lpfc_iocbq, list);
-                list_del_init(&piocb->list);
-
-                cmd = &piocb->iocb;
-                cmd->ulpStatus = IOSTAT_LOCAL_REJECT;
-                cmd->un.ulpWord[4] = IOERR_SLI_ABORTED;
-                (piocb->iocb_cmpl) (phba, piocb, piocb);
-        }
+        /* Cancel all the IOCBs from the completions list */
+        lpfc_sli_cancel_iocbs(phba, &completions, IOSTAT_LOCAL_REJECT,
+                              IOERR_SLI_ABORTED);
 }
diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index 311ed6dea72..e764ce0bf70 100644
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -78,7 +78,7 @@ lpfc_terminate_rport_io(struct fc_rport *rport)
                 return;
         }
 
-        phba  = ndlp->vport->phba;
+        phba  = ndlp->phba;
 
         lpfc_debugfs_disc_trc(ndlp->vport, LPFC_DISC_TRC_RPORT,
                 "rport terminate: sid:x%x did:x%x flg:x%x",
@@ -276,7 +276,7 @@ lpfc_dev_loss_tmo_handler(struct lpfc_nodelist *ndlp)
 }
 
 /**
- * lpfc_alloc_fast_evt: Allocates data structure for posting event.
+ * lpfc_alloc_fast_evt - Allocates data structure for posting event
  * @phba: Pointer to hba context object.
  *
  * This function is called from the functions which need to post
@@ -303,7 +303,7 @@ lpfc_alloc_fast_evt(struct lpfc_hba *phba) {
 }
 
 /**
- * lpfc_free_fast_evt: Frees event data structure.
+ * lpfc_free_fast_evt - Frees event data structure
  * @phba: Pointer to hba context object.
  * @evt:  Event object which need to be freed.
  *
@@ -319,7 +319,7 @@ lpfc_free_fast_evt(struct lpfc_hba *phba,
 }
 
 /**
- * lpfc_send_fastpath_evt: Posts events generated from fast path.
+ * lpfc_send_fastpath_evt - Posts events generated from fast path
  * @phba: Pointer to hba context object.
  * @evtp: Event data structure.
  *
@@ -1858,13 +1858,18 @@ lpfc_disable_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
                                 NLP_STE_UNUSED_NODE);
 }
 /**
- * lpfc_initialize_node: Initialize all fields of node object.
+ * lpfc_initialize_node - Initialize all fields of node object
  * @vport: Pointer to Virtual Port object.
  * @ndlp: Pointer to FC node object.
  * @did: FC_ID of the node.
- *      This function is always called when node object need to
- * be initialized. It initializes all the fields of the node
- * object.
+ *
+ * This function is always called when node object need to be initialized.
+ * It initializes all the fields of the node object. Although the reference
+ * to phba from @ndlp can be obtained indirectly through it's reference to
+ * @vport, a direct reference to phba is taken here by @ndlp. This is due
+ * to the life-span of the @ndlp might go beyond the existence of @vport as
+ * the final release of ndlp is determined by its reference count. And, the
+ * operation on @ndlp needs the reference to phba.
  **/
 static inline void
 lpfc_initialize_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
@@ -1877,6 +1882,7 @@ lpfc_initialize_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
         ndlp->nlp_delayfunc.data = (unsigned long)ndlp;
         ndlp->nlp_DID = did;
         ndlp->vport = vport;
+        ndlp->phba = vport->phba;
         ndlp->nlp_sid = NLP_NO_SID;
         kref_init(&ndlp->kref);
         NLP_INT_NODE_ACT(ndlp);
@@ -2086,7 +2092,6 @@ lpfc_no_rpi(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
         struct lpfc_sli *psli;
         struct lpfc_sli_ring *pring;
         struct lpfc_iocbq *iocb, *next_iocb;
-        IOCB_t *icmd;
         uint32_t rpi, i;
 
         lpfc_fabric_abort_nport(ndlp);
@@ -2122,19 +2127,9 @@ lpfc_no_rpi(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
                 }
         }
 
-        while (!list_empty(&completions)) {
-                iocb = list_get_first(&completions, struct lpfc_iocbq, list);
-                list_del_init(&iocb->list);
-
-                if (!iocb->iocb_cmpl)
-                        lpfc_sli_release_iocbq(phba, iocb);
-                else {
-                        icmd = &iocb->iocb;
-                        icmd->ulpStatus = IOSTAT_LOCAL_REJECT;
-                        icmd->un.ulpWord[4] = IOERR_SLI_ABORTED;
-                        (iocb->iocb_cmpl)(phba, iocb, iocb);
-                }
-        }
+        /* Cancel all the IOCBs from the completions list */
+        lpfc_sli_cancel_iocbs(phba, &completions, IOSTAT_LOCAL_REJECT,
+                              IOERR_SLI_ABORTED);
 
         return 0;
 }
@@ -2186,9 +2181,13 @@ lpfc_unreg_all_rpis(struct lpfc_vport *vport)
                 mbox->mbox_cmpl = lpfc_sli_def_mbox_cmpl;
                 mbox->context1 = NULL;
                 rc = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_TMO);
-                if (rc == MBX_NOT_FINISHED) {
+                if (rc != MBX_TIMEOUT)
                         mempool_free(mbox, phba->mbox_mem_pool);
-                }
+
+                if ((rc == MBX_TIMEOUT) || (rc == MBX_NOT_FINISHED))
+                        lpfc_printf_vlog(vport, KERN_ERR, LOG_MBOX | LOG_VPORT,
+                                "1836 Could not issue "
+                                "unreg_login(all_rpis) status %d\n", rc);
         }
 }
 
@@ -2206,12 +2205,14 @@ lpfc_unreg_default_rpis(struct lpfc_vport *vport)
                 mbox->mbox_cmpl = lpfc_sli_def_mbox_cmpl;
                 mbox->context1 = NULL;
                 rc = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_TMO);
-                if (rc == MBX_NOT_FINISHED) {
+                if (rc != MBX_TIMEOUT)
+                        mempool_free(mbox, phba->mbox_mem_pool);
+
+                if ((rc == MBX_TIMEOUT) || (rc == MBX_NOT_FINISHED))
                         lpfc_printf_vlog(vport, KERN_ERR, LOG_MBOX | LOG_VPORT,
                                          "1815 Could not issue "
-                                         "unreg_did (default rpis)\n");
-                        mempool_free(mbox, phba->mbox_mem_pool);
-                }
+                                         "unreg_did (default rpis) status %d\n",
+                                         rc);
         }
 }
 
@@ -2470,14 +2471,13 @@ lpfc_setup_disc_node(struct lpfc_vport *vport, uint32_t did)
                         if (ndlp->nlp_flag & NLP_RCV_PLOGI)
                                 return NULL;
 
-                        spin_lock_irq(shost->host_lock);
-                        ndlp->nlp_flag |= NLP_NPR_2B_DISC;
-                        spin_unlock_irq(shost->host_lock);
-
                         /* Since this node is marked for discovery,
                          * delay timeout is not needed.
                          */
                         lpfc_cancel_retry_delay_tmo(vport, ndlp);
+                        spin_lock_irq(shost->host_lock);
+                        ndlp->nlp_flag |= NLP_NPR_2B_DISC;
+                        spin_unlock_irq(shost->host_lock);
                 } else
                         ndlp = NULL;
         } else {
@@ -2740,19 +2740,9 @@ lpfc_free_tx(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
         }
         spin_unlock_irq(&phba->hbalock);
 
-        while (!list_empty(&completions)) {
-                iocb = list_get_first(&completions, struct lpfc_iocbq, list);
-                list_del_init(&iocb->list);
-
-                if (!iocb->iocb_cmpl)
-                        lpfc_sli_release_iocbq(phba, iocb);
-                else {
-                        icmd = &iocb->iocb;
-                        icmd->ulpStatus = IOSTAT_LOCAL_REJECT;
-                        icmd->un.ulpWord[4] = IOERR_SLI_ABORTED;
-                        (iocb->iocb_cmpl) (phba, iocb, iocb);
-                }
-        }
+        /* Cancel all the IOCBs from the completions list */
+        lpfc_sli_cancel_iocbs(phba, &completions, IOSTAT_LOCAL_REJECT,
+                              IOERR_SLI_ABORTED);
 }
 
 static void
@@ -3173,7 +3163,7 @@ lpfc_nlp_release(struct kref *kref)
         lpfc_nlp_remove(ndlp->vport, ndlp);
 
         /* clear the ndlp active flag for all release cases */
-        phba = ndlp->vport->phba;
+        phba = ndlp->phba;
         spin_lock_irqsave(&phba->ndlp_lock, flags);
         NLP_CLR_NODE_ACT(ndlp);
         spin_unlock_irqrestore(&phba->ndlp_lock, flags);
@@ -3181,7 +3171,7 @@ lpfc_nlp_release(struct kref *kref)
         /* free ndlp memory for final ndlp release */
         if (NLP_CHK_FREE_REQ(ndlp)) {
                 kfree(ndlp->lat_data);
-                mempool_free(ndlp, ndlp->vport->phba->nlp_mem_pool);
+                mempool_free(ndlp, ndlp->phba->nlp_mem_pool);
         }
 }
 
@@ -3204,7 +3194,7 @@ lpfc_nlp_get(struct lpfc_nodelist *ndlp)
                  * ndlp reference count that is in the process of being
                  * released.
                  */
-                phba = ndlp->vport->phba;
+                phba = ndlp->phba;
                 spin_lock_irqsave(&phba->ndlp_lock, flags);
                 if (!NLP_CHK_NODE_ACT(ndlp) || NLP_CHK_FREE_ACK(ndlp)) {
                         spin_unlock_irqrestore(&phba->ndlp_lock, flags);
@@ -3240,7 +3230,7 @@ lpfc_nlp_put(struct lpfc_nodelist *ndlp)
         "node put:        did:x%x flg:x%x refcnt:x%x",
                 ndlp->nlp_DID, ndlp->nlp_flag,
                 atomic_read(&ndlp->kref.refcount));
-        phba = ndlp->vport->phba;
+        phba = ndlp->phba;
         spin_lock_irqsave(&phba->ndlp_lock, flags);
         /* Check the ndlp memory free acknowledge flag to avoid the
          * possible race condition that kref_put got invoked again
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 06874e6009e..86d1bdcbf2d 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -60,7 +60,7 @@ static struct scsi_transport_template *lpfc_vport_transport_template = NULL;
 static DEFINE_IDR(lpfc_hba_index);
 
 /**
- * lpfc_config_port_prep: Perform lpfc initialization prior to config port.
+ * lpfc_config_port_prep - Perform lpfc initialization prior to config port
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine will do LPFC initialization prior to issuing the CONFIG_PORT
@@ -221,7 +221,7 @@ out_free_mbox:
 }
 
 /**
- * lpfc_config_async_cmpl: Completion handler for config async event mbox cmd.
+ * lpfc_config_async_cmpl - Completion handler for config async event mbox cmd
  * @phba: pointer to lpfc hba data structure.
  * @pmboxq: pointer to the driver internal queue element for mailbox command.
  *
@@ -242,8 +242,7 @@ lpfc_config_async_cmpl(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmboxq)
 }
 
 /**
- * lpfc_dump_wakeup_param_cmpl: Completion handler for dump memory mailbox
- *     command used for getting wake up parameters.
+ * lpfc_dump_wakeup_param_cmpl - dump memory mailbox command completion handler
  * @phba: pointer to lpfc hba data structure.
  * @pmboxq: pointer to the driver internal queue element for mailbox command.
  *
@@ -287,7 +286,7 @@ lpfc_dump_wakeup_param_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmboxq)
 }
 
 /**
- * lpfc_config_port_post: Perform lpfc initialization after config port.
+ * lpfc_config_port_post - Perform lpfc initialization after config port
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine will do LPFC initialization after the CONFIG_PORT mailbox
@@ -303,6 +302,7 @@ int
 lpfc_config_port_post(struct lpfc_hba *phba)
 {
         struct lpfc_vport *vport = phba->pport;
+        struct Scsi_Host *shost = lpfc_shost_from_vport(vport);
         LPFC_MBOXQ_t *pmb;
         MAILBOX_t *mb;
         struct lpfc_dmabuf *mp;
@@ -360,6 +360,11 @@ lpfc_config_port_post(struct lpfc_hba *phba)
                sizeof (struct lpfc_name));
         memcpy(&vport->fc_portname, &vport->fc_sparam.portName,
                sizeof (struct lpfc_name));
+
+        /* Update the fc_host data structures with new wwn. */
+        fc_host_node_name(shost) = wwn_to_u64(vport->fc_nodename.u.wwn);
+        fc_host_port_name(shost) = wwn_to_u64(vport->fc_portname.u.wwn);
+
         /* If no serial number in VPD data, use low 6 bytes of WWNN */
         /* This should be consolidated into parse_vpd ? - mr */
         if (phba->SerialNumber[0] == 0) {
@@ -551,7 +556,7 @@ lpfc_config_port_post(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_hba_down_prep: Perform lpfc uninitialization prior to HBA reset.
+ * lpfc_hba_down_prep - Perform lpfc uninitialization prior to HBA reset
  * @phba: pointer to lpfc HBA data structure.
  *
  * This routine will do LPFC uninitialization before the HBA is reset when
@@ -583,7 +588,7 @@ lpfc_hba_down_prep(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_hba_down_post: Perform lpfc uninitialization after HBA reset.
+ * lpfc_hba_down_post - Perform lpfc uninitialization after HBA reset
  * @phba: pointer to lpfc HBA data structure.
  *
  * This routine will do uninitialization after the HBA is reset when bring
@@ -599,8 +604,6 @@ lpfc_hba_down_post(struct lpfc_hba *phba)
         struct lpfc_sli *psli = &phba->sli;
         struct lpfc_sli_ring *pring;
         struct lpfc_dmabuf *mp, *next_mp;
-        struct lpfc_iocbq *iocb;
-        IOCB_t *cmd = NULL;
         LIST_HEAD(completions);
         int i;
 
@@ -628,20 +631,9 @@ lpfc_hba_down_post(struct lpfc_hba *phba)
                 pring->txcmplq_cnt = 0;
                 spin_unlock_irq(&phba->hbalock);
 
-                while (!list_empty(&completions)) {
-                        iocb = list_get_first(&completions, struct lpfc_iocbq,
-                                list);
-                        cmd = &iocb->iocb;
-                        list_del_init(&iocb->list);
-
-                        if (!iocb->iocb_cmpl)
-                                lpfc_sli_release_iocbq(phba, iocb);
-                        else {
-                                cmd->ulpStatus = IOSTAT_LOCAL_REJECT;
-                                cmd->un.ulpWord[4] = IOERR_SLI_ABORTED;
-                                (iocb->iocb_cmpl) (phba, iocb, iocb);
-                        }
-                }
+                /* Cancel all the IOCBs from the completions list */
+                lpfc_sli_cancel_iocbs(phba, &completions, IOSTAT_LOCAL_REJECT,
+                                      IOERR_SLI_ABORTED);
 
                 lpfc_sli_abort_iocb_ring(phba, pring);
                 spin_lock_irq(&phba->hbalock);
@@ -652,7 +644,7 @@ lpfc_hba_down_post(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_hb_timeout: The HBA-timer timeout handler.
+ * lpfc_hb_timeout - The HBA-timer timeout handler
  * @ptr: unsigned long holds the pointer to lpfc hba data structure.
  *
  * This is the HBA-timer timeout handler registered to the lpfc driver. When
@@ -686,7 +678,7 @@ lpfc_hb_timeout(unsigned long ptr)
 }
 
 /**
- * lpfc_hb_mbox_cmpl: The lpfc heart-beat mailbox command callback function.
+ * lpfc_hb_mbox_cmpl - The lpfc heart-beat mailbox command callback function
  * @phba: pointer to lpfc hba data structure.
  * @pmboxq: pointer to the driver internal queue element for mailbox command.
  *
@@ -721,7 +713,7 @@ lpfc_hb_mbox_cmpl(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmboxq)
 }
 
 /**
- * lpfc_hb_timeout_handler: The HBA-timer timeout handler.
+ * lpfc_hb_timeout_handler - The HBA-timer timeout handler
  * @phba: pointer to lpfc hba data structure.
  *
  * This is the actual HBA-timer timeout handler to be invoked by the worker
@@ -830,7 +822,7 @@ lpfc_hb_timeout_handler(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_offline_eratt: Bring lpfc offline on hardware error attention.
+ * lpfc_offline_eratt - Bring lpfc offline on hardware error attention
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine is called to bring the HBA offline when HBA hardware error
@@ -857,7 +849,73 @@ lpfc_offline_eratt(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_handle_eratt: The HBA hardware error handler.
+ * lpfc_handle_deferred_eratt - The HBA hardware deferred error handler
+ * @phba: pointer to lpfc hba data structure.
+ *
+ * This routine is invoked to handle the deferred HBA hardware error
+ * conditions. This type of error is indicated by HBA by setting ER1
+ * and another ER bit in the host status register. The driver will
+ * wait until the ER1 bit clears before handling the error condition.
+ **/
+static void
+lpfc_handle_deferred_eratt(struct lpfc_hba *phba)
+{
+        uint32_t old_host_status = phba->work_hs;
+        struct lpfc_sli_ring  *pring;
+        struct lpfc_sli *psli = &phba->sli;
+
+        lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                "0479 Deferred Adapter Hardware Error "
+                "Data: x%x x%x x%x\n",
+                phba->work_hs,
+                phba->work_status[0], phba->work_status[1]);
+
+        spin_lock_irq(&phba->hbalock);
+        psli->sli_flag &= ~LPFC_SLI2_ACTIVE;
+        spin_unlock_irq(&phba->hbalock);
+
+
+        /*
+         * Firmware stops when it triggred erratt. That could cause the I/Os
+         * dropped by the firmware. Error iocb (I/O) on txcmplq and let the
+         * SCSI layer retry it after re-establishing link.
+         */
+        pring = &psli->ring[psli->fcp_ring];
+        lpfc_sli_abort_iocb_ring(phba, pring);
+
+        /*
+         * There was a firmware error. Take the hba offline and then
+         * attempt to restart it.
+         */
+        lpfc_offline_prep(phba);
+        lpfc_offline(phba);
+
+        /* Wait for the ER1 bit to clear.*/
+        while (phba->work_hs & HS_FFER1) {
+                msleep(100);
+                phba->work_hs = readl(phba->HSregaddr);
+                /* If driver is unloading let the worker thread continue */
+                if (phba->pport->load_flag & FC_UNLOADING) {
+                        phba->work_hs = 0;
+                        break;
+                }
+        }
+
+        /*
+         * This is to ptrotect against a race condition in which
+         * first write to the host attention register clear the
+         * host status register.
+         */
+        if ((!phba->work_hs) && (!(phba->pport->load_flag & FC_UNLOADING)))
+                phba->work_hs = old_host_status & ~HS_FFER1;
+
+        phba->hba_flag &= ~DEFER_ERATT;
+        phba->work_status[0] = readl(phba->MBslimaddr + 0xa8);
+        phba->work_status[1] = readl(phba->MBslimaddr + 0xac);
+}
+
+/**
+ * lpfc_handle_eratt - The HBA hardware error handler
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine is invoked to handle the following HBA hardware error
@@ -895,6 +953,9 @@ lpfc_handle_eratt(struct lpfc_hba *phba)
                                   (char *) &board_event,
                                   LPFC_NL_VENDOR_ID);
 
+        if (phba->hba_flag & DEFER_ERATT)
+                lpfc_handle_deferred_eratt(phba);
+
         if (phba->work_hs & HS_FFER6) {
                 /* Re-establishing Link */
                 lpfc_printf_log(phba, KERN_INFO, LOG_LINK_EVENT,
@@ -976,7 +1037,7 @@ lpfc_handle_eratt(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_handle_latt: The HBA link event handler.
+ * lpfc_handle_latt - The HBA link event handler
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine is invoked from the worker thread to handle a HBA host
@@ -1063,7 +1124,7 @@ lpfc_handle_latt_err_exit:
 }
 
 /**
- * lpfc_parse_vpd: Parse VPD (Vital Product Data).
+ * lpfc_parse_vpd - Parse VPD (Vital Product Data)
  * @phba: pointer to lpfc hba data structure.
  * @vpd: pointer to the vital product data.
  * @len: length of the vital product data in bytes.
@@ -1213,7 +1274,7 @@ lpfc_parse_vpd(struct lpfc_hba *phba, uint8_t *vpd, int len)
 }
 
 /**
- * lpfc_get_hba_model_desc: Retrieve HBA device model name and description.
+ * lpfc_get_hba_model_desc - Retrieve HBA device model name and description
  * @phba: pointer to lpfc hba data structure.
  * @mdp: pointer to the data structure to hold the derived model name.
  * @descp: pointer to the data structure to hold the derived description.
@@ -1322,7 +1383,8 @@ lpfc_get_hba_model_desc(struct lpfc_hba *phba, uint8_t *mdp, uint8_t *descp)
                 m = (typeof(m)){"LPe11000", max_speed, "PCIe"};
                 break;
         case PCI_DEVICE_ID_ZEPHYR_DCSP:
-                m = (typeof(m)){"LPe11002-SP", max_speed, "PCIe"};
+                m = (typeof(m)){"LP2105", max_speed, "PCIe"};
+                GE = 1;
                 break;
         case PCI_DEVICE_ID_ZMID:
                 m = (typeof(m)){"LPe1150", max_speed, "PCIe"};
@@ -1392,7 +1454,7 @@ lpfc_get_hba_model_desc(struct lpfc_hba *phba, uint8_t *mdp, uint8_t *descp)
 }
 
 /**
- * lpfc_post_buffer: Post IOCB(s) with DMA buffer descriptor(s) to a IOCB ring.
+ * lpfc_post_buffer - Post IOCB(s) with DMA buffer descriptor(s) to a IOCB ring
  * @phba: pointer to lpfc hba data structure.
  * @pring: pointer to a IOCB ring.
  * @cnt: the number of IOCBs to be posted to the IOCB ring.
@@ -1493,7 +1555,7 @@ lpfc_post_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, int cnt)
 }
 
 /**
- * lpfc_post_rcv_buf: Post the initial receive IOCB buffers to ELS ring.
+ * lpfc_post_rcv_buf - Post the initial receive IOCB buffers to ELS ring
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine posts initial receive IOCB buffers to the ELS ring. The
@@ -1518,7 +1580,7 @@ lpfc_post_rcv_buf(struct lpfc_hba *phba)
 #define S(N,V) (((V)<<(N))|((V)>>(32-(N))))
 
 /**
- * lpfc_sha_init: Set up initial array of hash table entries.
+ * lpfc_sha_init - Set up initial array of hash table entries
  * @HashResultPointer: pointer to an array as hash table.
  *
  * This routine sets up the initial values to the array of hash table entries
@@ -1535,7 +1597,7 @@ lpfc_sha_init(uint32_t * HashResultPointer)
 }
 
 /**
- * lpfc_sha_iterate: Iterate initial hash table with the working hash table.
+ * lpfc_sha_iterate - Iterate initial hash table with the working hash table
  * @HashResultPointer: pointer to an initial/result hash table.
  * @HashWorkingPointer: pointer to an working hash table.
  *
@@ -1592,7 +1654,7 @@ lpfc_sha_iterate(uint32_t * HashResultPointer, uint32_t * HashWorkingPointer)
 }
 
 /**
- * lpfc_challenge_key: Create challenge key based on WWPN of the HBA.
+ * lpfc_challenge_key - Create challenge key based on WWPN of the HBA
  * @RandomChallenge: pointer to the entry of host challenge random number array.
  * @HashWorking: pointer to the entry of the working hash array.
  *
@@ -1608,7 +1670,7 @@ lpfc_challenge_key(uint32_t * RandomChallenge, uint32_t * HashWorking)
 }
 
 /**
- * lpfc_hba_init: Perform special handling for LC HBA initialization.
+ * lpfc_hba_init - Perform special handling for LC HBA initialization
  * @phba: pointer to lpfc hba data structure.
  * @hbainit: pointer to an array of unsigned 32-bit integers.
  *
@@ -1637,7 +1699,7 @@ lpfc_hba_init(struct lpfc_hba *phba, uint32_t *hbainit)
 }
 
 /**
- * lpfc_cleanup: Performs vport cleanups before deleting a vport.
+ * lpfc_cleanup - Performs vport cleanups before deleting a vport
  * @vport: pointer to a virtual N_Port data structure.
  *
  * This routine performs the necessary cleanups before deleting the @vport.
@@ -1724,7 +1786,7 @@ lpfc_cleanup(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_stop_vport_timers: Stop all the timers associated with a vport.
+ * lpfc_stop_vport_timers - Stop all the timers associated with a vport
  * @vport: pointer to a virtual N_Port data structure.
  *
  * This routine stops all the timers associated with a @vport. This function
@@ -1741,7 +1803,7 @@ lpfc_stop_vport_timers(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_stop_phba_timers: Stop all the timers associated with an HBA.
+ * lpfc_stop_phba_timers - Stop all the timers associated with an HBA
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine stops all the timers associated with a HBA. This function is
@@ -1761,7 +1823,7 @@ lpfc_stop_phba_timers(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_block_mgmt_io: Mark a HBA's management interface as blocked.
+ * lpfc_block_mgmt_io - Mark a HBA's management interface as blocked
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine marks a HBA's management interface as blocked. Once the HBA's
@@ -1781,7 +1843,7 @@ lpfc_block_mgmt_io(struct lpfc_hba * phba)
 }
 
 /**
- * lpfc_online: Initialize and bring a HBA online.
+ * lpfc_online - Initialize and bring a HBA online
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine initializes the HBA and brings a HBA online. During this
@@ -1839,7 +1901,7 @@ lpfc_online(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_unblock_mgmt_io: Mark a HBA's management interface to be not blocked.
+ * lpfc_unblock_mgmt_io - Mark a HBA's management interface to be not blocked
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine marks a HBA's management interface as not blocked. Once the
@@ -1860,7 +1922,7 @@ lpfc_unblock_mgmt_io(struct lpfc_hba * phba)
 }
 
 /**
- * lpfc_offline_prep: Prepare a HBA to be brought offline.
+ * lpfc_offline_prep - Prepare a HBA to be brought offline
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine is invoked to prepare a HBA to be brought offline. It performs
@@ -1917,7 +1979,7 @@ lpfc_offline_prep(struct lpfc_hba * phba)
 }
 
 /**
- * lpfc_offline: Bring a HBA offline.
+ * lpfc_offline - Bring a HBA offline
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine actually brings a HBA offline. It stops all the timers
@@ -1962,7 +2024,7 @@ lpfc_offline(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_scsi_free: Free all the SCSI buffers and IOCBs from driver lists.
+ * lpfc_scsi_free - Free all the SCSI buffers and IOCBs from driver lists
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine is to free all the SCSI buffers and IOCBs from the driver
@@ -2001,7 +2063,7 @@ lpfc_scsi_free(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_create_port: Create an FC port.
+ * lpfc_create_port - Create an FC port
  * @phba: pointer to lpfc hba data structure.
  * @instance: a unique integer ID to this FC port.
  * @dev: pointer to the device data structure.
@@ -2091,7 +2153,7 @@ out:
 }
 
 /**
- * destroy_port: Destroy an FC port.
+ * destroy_port -  destroy an FC port
  * @vport: pointer to an lpfc virtual N_Port data structure.
  *
  * This routine destroys a FC port from the upper layer protocol. All the
@@ -2116,7 +2178,7 @@ destroy_port(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_get_instance: Get a unique integer ID.
+ * lpfc_get_instance - Get a unique integer ID
  *
  * This routine allocates a unique integer ID from lpfc_hba_index pool. It
  * uses the kernel idr facility to perform the task.
@@ -2139,7 +2201,7 @@ lpfc_get_instance(void)
 }
 
 /**
- * lpfc_scan_finished: method for SCSI layer to detect whether scan is done.
+ * lpfc_scan_finished - method for SCSI layer to detect whether scan is done
  * @shost: pointer to SCSI host data structure.
  * @time: elapsed time of the scan in jiffies.
  *
@@ -2197,7 +2259,7 @@ finished:
 }
 
 /**
- * lpfc_host_attrib_init: Initialize SCSI host attributes on a FC port.
+ * lpfc_host_attrib_init - Initialize SCSI host attributes on a FC port
  * @shost: pointer to SCSI host data structure.
  *
  * This routine initializes a given SCSI host attributes on a FC port. The
@@ -2252,7 +2314,7 @@ void lpfc_host_attrib_init(struct Scsi_Host *shost)
 }
 
 /**
- * lpfc_enable_msix: Enable MSI-X interrupt mode.
+ * lpfc_enable_msix - Enable MSI-X interrupt mode
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine is invoked to enable the MSI-X interrupt vectors. The kernel
@@ -2366,7 +2428,7 @@ msi_fail_out:
 }
 
 /**
- * lpfc_disable_msix: Disable MSI-X interrupt mode.
+ * lpfc_disable_msix - Disable MSI-X interrupt mode
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine is invoked to release the MSI-X vectors and then disable the
@@ -2385,7 +2447,7 @@ lpfc_disable_msix(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_enable_msi: Enable MSI interrupt mode.
+ * lpfc_enable_msi - Enable MSI interrupt mode
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine is invoked to enable the MSI interrupt mode. The kernel
@@ -2423,7 +2485,7 @@ lpfc_enable_msi(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_disable_msi: Disable MSI interrupt mode.
+ * lpfc_disable_msi - Disable MSI interrupt mode
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine is invoked to disable the MSI interrupt mode. The driver
@@ -2441,7 +2503,7 @@ lpfc_disable_msi(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_log_intr_mode: Log the active interrupt mode
+ * lpfc_log_intr_mode - Log the active interrupt mode
  * @phba: pointer to lpfc hba data structure.
  * @intr_mode: active interrupt mode adopted.
  *
@@ -2490,7 +2552,7 @@ lpfc_stop_port(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_enable_intr: Enable device interrupt.
+ * lpfc_enable_intr - Enable device interrupt
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine is invoked to enable device interrupt and associate driver's
@@ -2547,7 +2609,7 @@ lpfc_enable_intr(struct lpfc_hba *phba, uint32_t cfg_mode)
 }
 
 /**
- * lpfc_disable_intr: Disable device interrupt.
+ * lpfc_disable_intr - Disable device interrupt
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine is invoked to disable device interrupt and disassociate the
@@ -2574,7 +2636,7 @@ lpfc_disable_intr(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_pci_probe_one: lpfc PCI probe func to register device to PCI subsystem.
+ * lpfc_pci_probe_one - lpfc PCI probe func to register device to PCI subsystem
  * @pdev: pointer to PCI device
  * @pid: pointer to PCI device identifier
  *
@@ -3010,7 +3072,7 @@ out:
 }
 
 /**
- * lpfc_pci_remove_one: lpfc PCI func to unregister device from PCI subsystem.
+ * lpfc_pci_remove_one - lpfc PCI func to unregister device from PCI subsystem
  * @pdev: pointer to PCI device
  *
  * This routine is to be registered to the kernel's PCI subsystem. When an
@@ -3033,8 +3095,6 @@ lpfc_pci_remove_one(struct pci_dev *pdev)
 
         lpfc_free_sysfs_attr(vport);
 
-        kthread_stop(phba->worker_thread);
-
         /* Release all the vports against this physical port */
         vports = lpfc_create_vport_work_array(phba);
         if (vports != NULL)
@@ -3052,7 +3112,12 @@ lpfc_pci_remove_one(struct pci_dev *pdev)
          * clears the rings, discards all mailbox commands, and resets
          * the HBA.
          */
+
+        /* HBA interrupt will be diabled after this call */
         lpfc_sli_hba_down(phba);
+        /* Stop kthread signal shall trigger work_done one more time */
+        kthread_stop(phba->worker_thread);
+        /* Final cleanup of txcmplq and reset the HBA */
         lpfc_sli_brdrestart(phba);
 
         lpfc_stop_phba_timers(phba);
@@ -3095,7 +3160,7 @@ lpfc_pci_remove_one(struct pci_dev *pdev)
 }
 
 /**
- * lpfc_pci_suspend_one: lpfc PCI func to suspend device for power management.
+ * lpfc_pci_suspend_one - lpfc PCI func to suspend device for power management
  * @pdev: pointer to PCI device
  * @msg: power management message
  *
@@ -3139,7 +3204,7 @@ lpfc_pci_suspend_one(struct pci_dev *pdev, pm_message_t msg)
 }
 
 /**
- * lpfc_pci_resume_one: lpfc PCI func to resume device for power management.
+ * lpfc_pci_resume_one - lpfc PCI func to resume device for power management
  * @pdev: pointer to PCI device
  *
  * This routine is to be registered to the kernel's PCI subsystem to support
@@ -3204,7 +3269,7 @@ lpfc_pci_resume_one(struct pci_dev *pdev)
 }
 
 /**
- * lpfc_io_error_detected: Driver method for handling PCI I/O error detected.
+ * lpfc_io_error_detected - Driver method for handling PCI I/O error detected
  * @pdev: pointer to PCI device.
  * @state: the current PCI connection state.
  *
@@ -3254,7 +3319,7 @@ static pci_ers_result_t lpfc_io_error_detected(struct pci_dev *pdev,
 }
 
 /**
- * lpfc_io_slot_reset: Restart a PCI device from scratch.
+ * lpfc_io_slot_reset - Restart a PCI device from scratch
  * @pdev: pointer to PCI device.
  *
  * This routine is registered to the PCI subsystem for error handling. This is
@@ -3313,7 +3378,7 @@ static pci_ers_result_t lpfc_io_slot_reset(struct pci_dev *pdev)
 }
 
 /**
- * lpfc_io_resume: Resume PCI I/O operation.
+ * lpfc_io_resume - Resume PCI I/O operation
  * @pdev: pointer to PCI device
  *
  * This routine is registered to the PCI subsystem for error handling. It is
@@ -3426,7 +3491,7 @@ static struct pci_driver lpfc_driver = {
 };
 
 /**
- * lpfc_init: lpfc module initialization routine.
+ * lpfc_init - lpfc module initialization routine
  *
  * This routine is to be invoked when the lpfc module is loaded into the
  * kernel. The special kernel macro module_init() is used to indicate the
@@ -3472,7 +3537,7 @@ lpfc_init(void)
 }
 
 /**
- * lpfc_exit: lpfc module removal routine.
+ * lpfc_exit - lpfc module removal routine
  *
  * This routine is invoked when the lpfc module is removed from the kernel.
  * The special kernel macro module_exit() is used to indicate the role of
diff --git a/drivers/scsi/lpfc/lpfc_logmsg.h b/drivers/scsi/lpfc/lpfc_logmsg.h
index a85b7c196bb..1aa85709b01 100644
--- a/drivers/scsi/lpfc/lpfc_logmsg.h
+++ b/drivers/scsi/lpfc/lpfc_logmsg.h
@@ -27,7 +27,7 @@
 #define LOG_FCP                       0x40      /* FCP traffic history */
 #define LOG_NODE                      0x80      /* Node table events */
 #define LOG_TEMP                      0x100     /* Temperature sensor events */
-#define LOG_BG                        0x200     /* BlockBuard events */
+#define LOG_BG                        0x200     /* BlockGuard events */
 #define LOG_MISC                      0x400     /* Miscellaneous events */
 #define LOG_SLI                       0x800     /* SLI events */
 #define LOG_FCP_ERROR                 0x1000    /* log errors, not underruns */
diff --git a/drivers/scsi/lpfc/lpfc_mbox.c b/drivers/scsi/lpfc/lpfc_mbox.c
index 34eeb086a66..134fc7fc212 100644
--- a/drivers/scsi/lpfc/lpfc_mbox.c
+++ b/drivers/scsi/lpfc/lpfc_mbox.c
@@ -39,7 +39,7 @@
 #include "lpfc_compat.h"
 
 /**
- * lpfc_dump_mem: Prepare a mailbox command for retrieving HBA's VPD memory.
+ * lpfc_dump_mem - Prepare a mailbox command for retrieving HBA's VPD memory
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
  * @offset: offset for dumping VPD memory mailbox command.
@@ -77,9 +77,10 @@ lpfc_dump_mem(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmb, uint16_t offset)
 }
 
 /**
- * lpfc_dump_mem: Prepare a mailbox command for retrieving wakeup params.
+ * lpfc_dump_wakeup_param - Prepare mailbox command for retrieving wakeup params
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
+ *
  * This function create a dump memory mailbox command to dump wake up
  * parameters.
  */
@@ -109,7 +110,7 @@ lpfc_dump_wakeup_param(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
 }
 
 /**
- * lpfc_read_nv: Prepare a mailbox command for reading HBA's NVRAM param.
+ * lpfc_read_nv - Prepare a mailbox command for reading HBA's NVRAM param
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
  *
@@ -132,7 +133,7 @@ lpfc_read_nv(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmb)
 }
 
 /**
- * lpfc_config_async: Prepare a mailbox command for enabling HBA async event.
+ * lpfc_config_async - Prepare a mailbox command for enabling HBA async event
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
  * @ring: ring number for the asynchronous event to be configured.
@@ -159,7 +160,7 @@ lpfc_config_async(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmb,
 }
 
 /**
- * lpfc_heart_beat: Prepare a mailbox command for heart beat.
+ * lpfc_heart_beat - Prepare a mailbox command for heart beat
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
  *
@@ -184,7 +185,7 @@ lpfc_heart_beat(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmb)
 }
 
 /**
- * lpfc_read_la: Prepare a mailbox command for reading HBA link attention.
+ * lpfc_read_la - Prepare a mailbox command for reading HBA link attention
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
  * @mp: DMA buffer memory for reading the link attention information into.
@@ -228,7 +229,7 @@ lpfc_read_la(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmb, struct lpfc_dmabuf *mp)
 }
 
 /**
- * lpfc_clear_la: Prepare a mailbox command for clearing HBA link attention.
+ * lpfc_clear_la - Prepare a mailbox command for clearing HBA link attention
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
  *
@@ -257,7 +258,7 @@ lpfc_clear_la(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmb)
 }
 
 /**
- * lpfc_config_link: Prepare a mailbox command for configuring link on a HBA.
+ * lpfc_config_link - Prepare a mailbox command for configuring link on a HBA
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
  *
@@ -305,7 +306,7 @@ lpfc_config_link(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmb)
 }
 
 /**
- * lpfc_config_msi: Prepare a mailbox command for configuring msi-x.
+ * lpfc_config_msi - Prepare a mailbox command for configuring msi-x
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
  *
@@ -383,7 +384,7 @@ lpfc_config_msi(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
 }
 
 /**
- * lpfc_init_link: Prepare a mailbox command for initialize link on a HBA.
+ * lpfc_init_link - Prepare a mailbox command for initialize link on a HBA
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
  * @topology: the link topology for the link to be initialized to.
@@ -463,7 +464,7 @@ lpfc_init_link(struct lpfc_hba * phba,
 }
 
 /**
- * lpfc_read_sparam: Prepare a mailbox command for reading HBA parameters.
+ * lpfc_read_sparam - Prepare a mailbox command for reading HBA parameters
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
  * @vpi: virtual N_Port identifier.
@@ -523,7 +524,7 @@ lpfc_read_sparam(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb, int vpi)
 }
 
 /**
- * lpfc_unreg_did: Prepare a mailbox command for unregistering DID.
+ * lpfc_unreg_did - Prepare a mailbox command for unregistering DID
  * @phba: pointer to lpfc hba data structure.
  * @vpi: virtual N_Port identifier.
  * @did: remote port identifier.
@@ -555,7 +556,7 @@ lpfc_unreg_did(struct lpfc_hba * phba, uint16_t vpi, uint32_t did,
 }
 
 /**
- * lpfc_read_config: Prepare a mailbox command for reading HBA configuration.
+ * lpfc_read_config - Prepare a mailbox command for reading HBA configuration
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
  *
@@ -581,7 +582,7 @@ lpfc_read_config(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmb)
 }
 
 /**
- * lpfc_read_lnk_stat: Prepare a mailbox command for reading HBA link stats.
+ * lpfc_read_lnk_stat - Prepare a mailbox command for reading HBA link stats
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
  *
@@ -606,7 +607,7 @@ lpfc_read_lnk_stat(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmb)
 }
 
 /**
- * lpfc_reg_login: Prepare a mailbox command for registering remote login.
+ * lpfc_reg_login - Prepare a mailbox command for registering remote login
  * @phba: pointer to lpfc hba data structure.
  * @vpi: virtual N_Port identifier.
  * @did: remote port identifier.
@@ -677,7 +678,7 @@ lpfc_reg_login(struct lpfc_hba *phba, uint16_t vpi, uint32_t did,
 }
 
 /**
- * lpfc_unreg_login: Prepare a mailbox command for unregistering remote login.
+ * lpfc_unreg_login - Prepare a mailbox command for unregistering remote login
  * @phba: pointer to lpfc hba data structure.
  * @vpi: virtual N_Port identifier.
  * @rpi: remote port identifier
@@ -709,7 +710,7 @@ lpfc_unreg_login(struct lpfc_hba *phba, uint16_t vpi, uint32_t rpi,
 }
 
 /**
- * lpfc_reg_vpi: Prepare a mailbox command for registering vport identifier.
+ * lpfc_reg_vpi - Prepare a mailbox command for registering vport identifier
  * @phba: pointer to lpfc hba data structure.
  * @vpi: virtual N_Port identifier.
  * @sid: Fibre Channel S_ID (N_Port_ID assigned to a virtual N_Port).
@@ -741,7 +742,7 @@ lpfc_reg_vpi(struct lpfc_hba *phba, uint16_t vpi, uint32_t sid,
 }
 
 /**
- * lpfc_unreg_vpi: Prepare a mailbox command for unregistering vport id.
+ * lpfc_unreg_vpi - Prepare a mailbox command for unregistering vport id
  * @phba: pointer to lpfc hba data structure.
  * @vpi: virtual N_Port identifier.
  * @pmb: pointer to the driver internal queue element for mailbox command.
@@ -771,7 +772,7 @@ lpfc_unreg_vpi(struct lpfc_hba *phba, uint16_t vpi, LPFC_MBOXQ_t *pmb)
 }
 
 /**
- * lpfc_config_pcb_setup: Set up IOCB rings in the Port Control Block (PCB)
+ * lpfc_config_pcb_setup - Set up IOCB rings in the Port Control Block (PCB)
  * @phba: pointer to lpfc hba data structure.
  *
  * This routine sets up and initializes the IOCB rings in the Port Control
@@ -835,7 +836,7 @@ lpfc_config_pcb_setup(struct lpfc_hba * phba)
 }
 
 /**
- * lpfc_read_rev: Prepare a mailbox command for reading HBA revision.
+ * lpfc_read_rev - Prepare a mailbox command for reading HBA revision
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
  *
@@ -861,7 +862,7 @@ lpfc_read_rev(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmb)
 }
 
 /**
- * lpfc_build_hbq_profile2: Set up the HBQ Selection Profile 2.
+ * lpfc_build_hbq_profile2 - Set up the HBQ Selection Profile 2
  * @hbqmb: pointer to the HBQ configuration data structure in mailbox command.
  * @hbq_desc: pointer to the HBQ selection profile descriptor.
  *
@@ -880,7 +881,7 @@ lpfc_build_hbq_profile2(struct config_hbq_var *hbqmb,
 }
 
 /**
- * lpfc_build_hbq_profile3: Set up the HBQ Selection Profile 3.
+ * lpfc_build_hbq_profile3 - Set up the HBQ Selection Profile 3
  * @hbqmb: pointer to the HBQ configuration data structure in mailbox command.
  * @hbq_desc: pointer to the HBQ selection profile descriptor.
  *
@@ -902,7 +903,7 @@ lpfc_build_hbq_profile3(struct config_hbq_var *hbqmb,
 }
 
 /**
- * lpfc_build_hbq_profile5: Set up the HBQ Selection Profile 5.
+ * lpfc_build_hbq_profile5 - Set up the HBQ Selection Profile 5
  * @hbqmb: pointer to the HBQ configuration data structure in mailbox command.
  * @hbq_desc: pointer to the HBQ selection profile descriptor.
  *
@@ -925,7 +926,7 @@ lpfc_build_hbq_profile5(struct config_hbq_var *hbqmb,
 }
 
 /**
- * lpfc_config_hbq: Prepare a mailbox command for configuring an HBQ.
+ * lpfc_config_hbq - Prepare a mailbox command for configuring an HBQ
  * @phba: pointer to lpfc hba data structure.
  * @id: HBQ identifier.
  * @hbq_desc: pointer to the HBA descriptor data structure.
@@ -999,7 +1000,7 @@ lpfc_config_hbq(struct lpfc_hba *phba, uint32_t id,
 }
 
 /**
- * lpfc_config_ring: Prepare a mailbox command for configuring an IOCB ring.
+ * lpfc_config_ring - Prepare a mailbox command for configuring an IOCB ring
  * @phba: pointer to lpfc hba data structure.
  * @ring:
  * @pmb: pointer to the driver internal queue element for mailbox command.
@@ -1057,7 +1058,7 @@ lpfc_config_ring(struct lpfc_hba * phba, int ring, LPFC_MBOXQ_t * pmb)
 }
 
 /**
- * lpfc_config_port: Prepare a mailbox command for configuring port.
+ * lpfc_config_port - Prepare a mailbox command for configuring port
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
  *
@@ -1227,7 +1228,7 @@ lpfc_config_port(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
 }
 
 /**
- * lpfc_kill_board: Prepare a mailbox command for killing board.
+ * lpfc_kill_board - Prepare a mailbox command for killing board
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
  *
@@ -1253,7 +1254,7 @@ lpfc_kill_board(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmb)
 }
 
 /**
- * lpfc_mbox_put: Put a mailbox cmd into the tail of driver's mailbox queue.
+ * lpfc_mbox_put - Put a mailbox cmd into the tail of driver's mailbox queue
  * @phba: pointer to lpfc hba data structure.
  * @mbq: pointer to the driver internal queue element for mailbox command.
  *
@@ -1277,7 +1278,7 @@ lpfc_mbox_put(struct lpfc_hba * phba, LPFC_MBOXQ_t * mbq)
 }
 
 /**
- * lpfc_mbox_get: Remove a mailbox cmd from the head of driver's mailbox queue.
+ * lpfc_mbox_get - Remove a mailbox cmd from the head of driver's mailbox queue
  * @phba: pointer to lpfc hba data structure.
  *
  * Driver maintains a internal mailbox command queue implemented as a linked
@@ -1304,7 +1305,7 @@ lpfc_mbox_get(struct lpfc_hba * phba)
 }
 
 /**
- * lpfc_mbox_cmpl_put: Put mailbox command into mailbox command complete list.
+ * lpfc_mbox_cmpl_put - Put mailbox command into mailbox command complete list
  * @phba: pointer to lpfc hba data structure.
  * @mbq: pointer to the driver internal queue element for mailbox command.
  *
@@ -1327,7 +1328,7 @@ lpfc_mbox_cmpl_put(struct lpfc_hba * phba, LPFC_MBOXQ_t * mbq)
 }
 
 /**
- * lpfc_mbox_tmo_val: Retrieve mailbox command timeout value.
+ * lpfc_mbox_tmo_val - Retrieve mailbox command timeout value
  * @phba: pointer to lpfc hba data structure.
  * @cmd: mailbox command code.
  *
diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
index a4bba206924..35a97673339 100644
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -41,7 +41,7 @@
 
 
 /**
- * lpfc_mem_alloc: create and allocate all PCI and memory pools
+ * lpfc_mem_alloc - create and allocate all PCI and memory pools
  * @phba: HBA to allocate pools for
  *
  * Description: Creates and allocates PCI pools lpfc_scsi_dma_buf_pool,
@@ -136,12 +136,12 @@ lpfc_mem_alloc(struct lpfc_hba * phba)
 }
 
 /**
- * lpfc_mem_free: Frees all PCI and memory allocated by lpfc_mem_alloc
+ * lpfc_mem_free - Frees all PCI and memory allocated by lpfc_mem_alloc
  * @phba: HBA to free memory for
  *
  * Description: Frees PCI pools lpfc_scsi_dma_buf_pool, lpfc_mbuf_pool,
  * lpfc_hbq_pool.  Frees kmalloc-backed mempools for LPFC_MBOXQ_t and
- * lpfc_nodelist.  Also frees the VPI bitmask.
+ * lpfc_nodelist.  Also frees the VPI bitmask
  *
  * Returns: None
  **/
@@ -212,7 +212,7 @@ lpfc_mem_free(struct lpfc_hba * phba)
 }
 
 /**
- * lpfc_mbuf_alloc: Allocate an mbuf from the lpfc_mbuf_pool PCI pool
+ * lpfc_mbuf_alloc - Allocate an mbuf from the lpfc_mbuf_pool PCI pool
  * @phba: HBA which owns the pool to allocate from
  * @mem_flags: indicates if this is a priority (MEM_PRI) allocation
  * @handle: used to return the DMA-mapped address of the mbuf
@@ -249,7 +249,7 @@ lpfc_mbuf_alloc(struct lpfc_hba *phba, int mem_flags, dma_addr_t *handle)
 }
 
 /**
- * __lpfc_mem_free: Free an mbuf from the lpfc_mbuf_pool PCI pool (locked)
+ * __lpfc_mbuf_free - Free an mbuf from the lpfc_mbuf_pool PCI pool (locked)
  * @phba: HBA which owns the pool to return to
  * @virt: mbuf to free
  * @dma: the DMA-mapped address of the lpfc_mbuf_pool to be freed
@@ -278,7 +278,7 @@ __lpfc_mbuf_free(struct lpfc_hba * phba, void *virt, dma_addr_t dma)
 }
 
 /**
- * lpfc_mem_free: Free an mbuf from the lpfc_mbuf_pool PCI pool (unlocked)
+ * lpfc_mbuf_free - Free an mbuf from the lpfc_mbuf_pool PCI pool (unlocked)
  * @phba: HBA which owns the pool to return to
  * @virt: mbuf to free
  * @dma: the DMA-mapped address of the lpfc_mbuf_pool to be freed
@@ -291,7 +291,6 @@ __lpfc_mbuf_free(struct lpfc_hba * phba, void *virt, dma_addr_t dma)
  * Returns: None
  **/
 void
-
 lpfc_mbuf_free(struct lpfc_hba * phba, void *virt, dma_addr_t dma)
 {
         unsigned long iflags;
@@ -303,7 +302,7 @@ lpfc_mbuf_free(struct lpfc_hba * phba, void *virt, dma_addr_t dma)
 }
 
 /**
- * lpfc_els_hbq_alloc: Allocate an HBQ buffer
+ * lpfc_els_hbq_alloc - Allocate an HBQ buffer
  * @phba: HBA to allocate HBQ buffer for
  *
  * Description: Allocates a DMA-mapped HBQ buffer from the lpfc_hbq_pool PCI
@@ -335,7 +334,7 @@ lpfc_els_hbq_alloc(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_mem_hbq_free: Frees an HBQ buffer allocated with lpfc_els_hbq_alloc
+ * lpfc_mem_hbq_free - Frees an HBQ buffer allocated with lpfc_els_hbq_alloc
  * @phba: HBA buffer was allocated for
  * @hbqbp: HBQ container returned by lpfc_els_hbq_alloc
  *
@@ -355,7 +354,7 @@ lpfc_els_hbq_free(struct lpfc_hba *phba, struct hbq_dmabuf *hbqbp)
 }
 
 /**
- * lpfc_in_buf_free: Free a DMA buffer
+ * lpfc_in_buf_free - Free a DMA buffer
  * @phba: HBA buffer is associated with
  * @mp: Buffer to free
  *
diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index 8f548adae9c..08cdc77af41 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -192,7 +192,6 @@ lpfc_els_abort(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
         struct lpfc_sli  *psli = &phba->sli;
         struct lpfc_sli_ring *pring = &psli->ring[LPFC_ELS_RING];
         struct lpfc_iocbq *iocb, *next_iocb;
-        IOCB_t *cmd;
 
         /* Abort outstanding I/O on NPort <nlp_DID> */
         lpfc_printf_vlog(ndlp->vport, KERN_INFO, LOG_DISCOVERY,
@@ -223,19 +222,10 @@ lpfc_els_abort(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
         }
         spin_unlock_irq(&phba->hbalock);
 
-        while (!list_empty(&completions)) {
-                iocb = list_get_first(&completions, struct lpfc_iocbq, list);
-                cmd = &iocb->iocb;
-                list_del_init(&iocb->list);
-
-                if (!iocb->iocb_cmpl)
-                        lpfc_sli_release_iocbq(phba, iocb);
-                else {
-                        cmd->ulpStatus = IOSTAT_LOCAL_REJECT;
-                        cmd->un.ulpWord[4] = IOERR_SLI_ABORTED;
-                        (iocb->iocb_cmpl) (phba, iocb, iocb);
-                }
-        }
+        /* Cancel all the IOCBs from the completions list */
+        lpfc_sli_cancel_iocbs(phba, &completions, IOSTAT_LOCAL_REJECT,
+                              IOERR_SLI_ABORTED);
+
         lpfc_cancel_retry_delay_tmo(phba->pport, ndlp);
         return 0;
 }
diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index 36fd2e75da1..167b66dd34c 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -112,7 +112,7 @@ lpfc_debug_save_dif(struct scsi_cmnd *cmnd)
 }
 
 /**
- * lpfc_update_stats: Update statistical data for the command completion.
+ * lpfc_update_stats - Update statistical data for the command completion
  * @phba: Pointer to HBA object.
  * @lpfc_cmd: lpfc scsi command object pointer.
  *
@@ -165,8 +165,7 @@ lpfc_update_stats(struct lpfc_hba *phba, struct  lpfc_scsi_buf *lpfc_cmd)
 }
 
 /**
- * lpfc_send_sdev_queuedepth_change_event: Posts a queuedepth change
- *                   event.
+ * lpfc_send_sdev_queuedepth_change_event - Posts a queuedepth change event
  * @phba: Pointer to HBA context object.
  * @vport: Pointer to vport object.
  * @ndlp: Pointer to FC node associated with the target.
@@ -220,7 +219,7 @@ lpfc_send_sdev_queuedepth_change_event(struct lpfc_hba *phba,
 }
 
 /**
- * lpfc_rampdown_queue_depth: Post RAMP_DOWN_QUEUE event to worker thread.
+ * lpfc_rampdown_queue_depth - Post RAMP_DOWN_QUEUE event to worker thread
  * @phba: The Hba for which this call is being executed.
  *
  * This routine is called when there is resource error in driver or firmware.
@@ -261,7 +260,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_rampup_queue_depth: Post RAMP_UP_QUEUE event for worker thread.
+ * lpfc_rampup_queue_depth - Post RAMP_UP_QUEUE event for worker thread
  * @phba: The Hba for which this call is being executed.
  *
  * This routine post WORKER_RAMP_UP_QUEUE event for @phba vport. This routine
@@ -273,14 +272,14 @@ lpfc_rampdown_queue_depth(struct lpfc_hba *phba)
  **/
 static inline void
 lpfc_rampup_queue_depth(struct lpfc_vport  *vport,
-                        struct scsi_device *sdev)
+                        uint32_t queue_depth)
 {
         unsigned long flags;
         struct lpfc_hba *phba = vport->phba;
         uint32_t evt_posted;
         atomic_inc(&phba->num_cmd_success);
 
-        if (vport->cfg_lun_queue_depth <= sdev->queue_depth)
+        if (vport->cfg_lun_queue_depth <= queue_depth)
                 return;
         spin_lock_irqsave(&phba->hbalock, flags);
         if (((phba->last_ramp_up_time + QUEUE_RAMP_UP_INTERVAL) > jiffies) ||
@@ -303,7 +302,7 @@ lpfc_rampup_queue_depth(struct lpfc_vport  *vport,
 }
 
 /**
- * lpfc_ramp_down_queue_handler: WORKER_RAMP_DOWN_QUEUE event handler.
+ * lpfc_ramp_down_queue_handler - WORKER_RAMP_DOWN_QUEUE event handler
  * @phba: The Hba for which this call is being executed.
  *
  * This routine is called to  process WORKER_RAMP_DOWN_QUEUE event for worker
@@ -361,7 +360,7 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_ramp_up_queue_handler: WORKER_RAMP_UP_QUEUE event handler.
+ * lpfc_ramp_up_queue_handler - WORKER_RAMP_UP_QUEUE event handler
  * @phba: The Hba for which this call is being executed.
  *
  * This routine is called to  process WORKER_RAMP_UP_QUEUE event for worker
@@ -410,7 +409,7 @@ lpfc_ramp_up_queue_handler(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_scsi_dev_block: set all scsi hosts to block state.
+ * lpfc_scsi_dev_block - set all scsi hosts to block state
  * @phba: Pointer to HBA context object.
  *
  * This function walks vport list and set each SCSI host to block state
@@ -439,7 +438,7 @@ lpfc_scsi_dev_block(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_new_scsi_buf: Scsi buffer allocator.
+ * lpfc_new_scsi_buf - Scsi buffer allocator
  * @vport: The virtual port for which this call being executed.
  *
  * This routine allocates a scsi buffer, which contains all the necessary
@@ -563,7 +562,7 @@ lpfc_new_scsi_buf(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_get_scsi_buf: Get a scsi buffer from lpfc_scsi_buf_list list of Hba.
+ * lpfc_get_scsi_buf - Get a scsi buffer from lpfc_scsi_buf_list list of Hba
  * @phba: The Hba for which this call is being executed.
  *
  * This routine removes a scsi buffer from head of @phba lpfc_scsi_buf_list list
@@ -592,7 +591,7 @@ lpfc_get_scsi_buf(struct lpfc_hba * phba)
 }
 
 /**
- * lpfc_release_scsi_buf: Return a scsi buffer back to hba lpfc_scsi_buf_list list.
+ * lpfc_release_scsi_buf - Return a scsi buffer back to hba's lpfc_scsi_buf_list
  * @phba: The Hba for which this call is being executed.
  * @psb: The scsi buffer which is being released.
  *
@@ -611,7 +610,7 @@ lpfc_release_scsi_buf(struct lpfc_hba *phba, struct lpfc_scsi_buf *psb)
 }
 
 /**
- * lpfc_scsi_prep_dma_buf: Routine to do DMA mapping for scsi buffer.
+ * lpfc_scsi_prep_dma_buf - Routine to do DMA mapping for scsi buffer
  * @phba: The Hba for which this call is being executed.
  * @lpfc_cmd: The scsi buffer which is going to be mapped.
  *
@@ -738,7 +737,7 @@ lpfc_scsi_prep_dma_buf(struct lpfc_hba *phba, struct lpfc_scsi_buf *lpfc_cmd)
          * Due to difference in data length between DIF/non-DIF paths,
          * we need to set word 4 of IOCB here
          */
-        iocb_cmd->un.fcpi.fcpi_parm = le32_to_cpu(scsi_bufflen(scsi_cmnd));
+        iocb_cmd->un.fcpi.fcpi_parm = scsi_bufflen(scsi_cmnd);
         return 0;
 }
 
@@ -823,9 +822,9 @@ lpfc_cmd_blksize(struct scsi_cmnd *sc)
 /**
  * lpfc_get_cmd_dif_parms - Extract DIF parameters from SCSI command
  * @sc:             in: SCSI command
- * @apptagmask      out: app tag mask
- * @apptagval       out: app tag value
- * @reftag          out: ref tag (reference tag)
+ * @apptagmask:     out: app tag mask
+ * @apptagval:      out: app tag value
+ * @reftag:         out: ref tag (reference tag)
  *
  * Description:
  *   Extract DIF paramters from the command if possible.  Otherwise,
@@ -1413,7 +1412,7 @@ out:
 }
 
 /**
- * lpfc_send_scsi_error_event: Posts an event when there is SCSI error.
+ * lpfc_send_scsi_error_event - Posts an event when there is SCSI error
  * @phba: Pointer to hba context object.
  * @vport: Pointer to vport object.
  * @lpfc_cmd: Pointer to lpfc scsi command which reported the error.
@@ -1505,7 +1504,7 @@ lpfc_send_scsi_error_event(struct lpfc_hba *phba, struct lpfc_vport *vport,
 }
 
 /**
- * lpfc_scsi_unprep_dma_buf: Routine to un-map DMA mapping of scatter gather.
+ * lpfc_scsi_unprep_dma_buf - Routine to un-map DMA mapping of scatter gather
  * @phba: The Hba for which this call is being executed.
  * @psb: The scsi buffer which is going to be un-mapped.
  *
@@ -1530,7 +1529,7 @@ lpfc_scsi_unprep_dma_buf(struct lpfc_hba * phba, struct lpfc_scsi_buf * psb)
 }
 
 /**
- * lpfc_handler_fcp_err: FCP response handler.
+ * lpfc_handler_fcp_err - FCP response handler
  * @vport: The virtual port for which this call is being executed.
  * @lpfc_cmd: Pointer to lpfc_scsi_buf data structure.
  * @rsp_iocb: The response IOCB which contains FCP error.
@@ -1674,7 +1673,7 @@ lpfc_handle_fcp_err(struct lpfc_vport *vport, struct lpfc_scsi_buf *lpfc_cmd,
 }
 
 /**
- * lpfc_scsi_cmd_iocb_cmpl: Scsi cmnd IOCB completion routine.
+ * lpfc_scsi_cmd_iocb_cmpl - Scsi cmnd IOCB completion routine
  * @phba: The Hba for which this call is being executed.
  * @pIocbIn: The command IOCBQ for the scsi cmnd.
  * @pIocbOut: The response IOCBQ for the scsi cmnd .
@@ -1694,10 +1693,12 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
         struct lpfc_nodelist *pnode = rdata->pnode;
         struct scsi_cmnd *cmd = lpfc_cmd->pCmd;
         int result;
-        struct scsi_device *sdev, *tmp_sdev;
+        struct scsi_device *tmp_sdev;
         int depth = 0;
         unsigned long flags;
         struct lpfc_fast_path_event *fast_path_evt;
+        struct Scsi_Host *shost = cmd->device->host;
+        uint32_t queue_depth, scsi_id;
 
         lpfc_cmd->result = pIocbOut->iocb.un.ulpWord[4];
         lpfc_cmd->status = pIocbOut->iocb.ulpStatus;
@@ -1808,11 +1809,10 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
 
         lpfc_update_stats(phba, lpfc_cmd);
         result = cmd->result;
-        sdev = cmd->device;
         if (vport->cfg_max_scsicmpl_time &&
            time_after(jiffies, lpfc_cmd->start_time +
                 msecs_to_jiffies(vport->cfg_max_scsicmpl_time))) {
-                spin_lock_irqsave(sdev->host->host_lock, flags);
+                spin_lock_irqsave(shost->host_lock, flags);
                 if (pnode && NLP_CHK_NODE_ACT(pnode)) {
                         if (pnode->cmd_qdepth >
                                 atomic_read(&pnode->cmd_pending) &&
@@ -1825,22 +1825,26 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
 
                         pnode->last_change_time = jiffies;
                 }
-                spin_unlock_irqrestore(sdev->host->host_lock, flags);
+                spin_unlock_irqrestore(shost->host_lock, flags);
         } else if (pnode && NLP_CHK_NODE_ACT(pnode)) {
                 if ((pnode->cmd_qdepth < LPFC_MAX_TGT_QDEPTH) &&
                    time_after(jiffies, pnode->last_change_time +
                               msecs_to_jiffies(LPFC_TGTQ_INTERVAL))) {
-                        spin_lock_irqsave(sdev->host->host_lock, flags);
+                        spin_lock_irqsave(shost->host_lock, flags);
                         pnode->cmd_qdepth += pnode->cmd_qdepth *
                                 LPFC_TGTQ_RAMPUP_PCENT / 100;
                         if (pnode->cmd_qdepth > LPFC_MAX_TGT_QDEPTH)
                                 pnode->cmd_qdepth = LPFC_MAX_TGT_QDEPTH;
                         pnode->last_change_time = jiffies;
-                        spin_unlock_irqrestore(sdev->host->host_lock, flags);
+                        spin_unlock_irqrestore(shost->host_lock, flags);
                 }
         }
 
         lpfc_scsi_unprep_dma_buf(phba, lpfc_cmd);
+
+        /* The sdev is not guaranteed to be valid post scsi_done upcall. */
+        queue_depth = cmd->device->queue_depth;
+        scsi_id = cmd->device->id;
         cmd->scsi_done(cmd);
 
         if (phba->cfg_poll & ENABLE_FCP_RING_POLLING) {
@@ -1848,28 +1852,28 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
                  * If there is a thread waiting for command completion
                  * wake up the thread.
                  */
-                spin_lock_irqsave(sdev->host->host_lock, flags);
+                spin_lock_irqsave(shost->host_lock, flags);
                 lpfc_cmd->pCmd = NULL;
                 if (lpfc_cmd->waitq)
                         wake_up(lpfc_cmd->waitq);
-                spin_unlock_irqrestore(sdev->host->host_lock, flags);
+                spin_unlock_irqrestore(shost->host_lock, flags);
                 lpfc_release_scsi_buf(phba, lpfc_cmd);
                 return;
         }
 
 
         if (!result)
-                lpfc_rampup_queue_depth(vport, sdev);
+                lpfc_rampup_queue_depth(vport, queue_depth);
 
         if (!result && pnode && NLP_CHK_NODE_ACT(pnode) &&
            ((jiffies - pnode->last_ramp_up_time) >
                 LPFC_Q_RAMP_UP_INTERVAL * HZ) &&
            ((jiffies - pnode->last_q_full_time) >
                 LPFC_Q_RAMP_UP_INTERVAL * HZ) &&
-           (vport->cfg_lun_queue_depth > sdev->queue_depth)) {
-                shost_for_each_device(tmp_sdev, sdev->host) {
+           (vport->cfg_lun_queue_depth > queue_depth)) {
+                shost_for_each_device(tmp_sdev, shost) {
                         if (vport->cfg_lun_queue_depth > tmp_sdev->queue_depth){
-                                if (tmp_sdev->id != sdev->id)
+                                if (tmp_sdev->id != scsi_id)
                                         continue;
                                 if (tmp_sdev->ordered_tags)
                                         scsi_adjust_queue_depth(tmp_sdev,
@@ -1885,7 +1889,7 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
                 }
                 lpfc_send_sdev_queuedepth_change_event(phba, vport, pnode,
                         0xFFFFFFFF,
-                        sdev->queue_depth - 1, sdev->queue_depth);
+                        queue_depth , queue_depth + 1);
         }
 
         /*
@@ -1896,8 +1900,8 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
             NLP_CHK_NODE_ACT(pnode)) {
                 pnode->last_q_full_time = jiffies;
 
-                shost_for_each_device(tmp_sdev, sdev->host) {
-                        if (tmp_sdev->id != sdev->id)
+                shost_for_each_device(tmp_sdev, shost) {
+                        if (tmp_sdev->id != scsi_id)
                                 continue;
                         depth = scsi_track_queue_full(tmp_sdev,
                                         tmp_sdev->queue_depth - 1);
@@ -1909,7 +1913,7 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
                  * scsi_track_queue_full.
                  */
                 if (depth == -1)
-                        depth = sdev->host->cmd_per_lun;
+                        depth = shost->cmd_per_lun;
 
                 if (depth) {
                         lpfc_printf_vlog(vport, KERN_WARNING, LOG_FCP,
@@ -1925,17 +1929,17 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
          * If there is a thread waiting for command completion
          * wake up the thread.
          */
-        spin_lock_irqsave(sdev->host->host_lock, flags);
+        spin_lock_irqsave(shost->host_lock, flags);
         lpfc_cmd->pCmd = NULL;
         if (lpfc_cmd->waitq)
                 wake_up(lpfc_cmd->waitq);
-        spin_unlock_irqrestore(sdev->host->host_lock, flags);
+        spin_unlock_irqrestore(shost->host_lock, flags);
 
         lpfc_release_scsi_buf(phba, lpfc_cmd);
 }
 
 /**
- * lpfc_fcpcmd_to_iocb - copy the fcp_cmd data into the IOCB.
+ * lpfc_fcpcmd_to_iocb - copy the fcp_cmd data into the IOCB
  * @data: A pointer to the immediate command data portion of the IOCB.
  * @fcp_cmnd: The FCP Command that is provided by the SCSI layer.
  *
@@ -1953,7 +1957,7 @@ lpfc_fcpcmd_to_iocb(uint8_t *data, struct fcp_cmnd *fcp_cmnd)
 }
 
 /**
- * lpfc_scsi_prep_cmnd:  Routine to convert scsi cmnd to FCP information unit.
+ * lpfc_scsi_prep_cmnd -  Routine to convert scsi cmnd to FCP information unit
  * @vport: The virtual port for which this call is being executed.
  * @lpfc_cmd: The scsi command which needs to send.
  * @pnode: Pointer to lpfc_nodelist.
@@ -2047,7 +2051,7 @@ lpfc_scsi_prep_cmnd(struct lpfc_vport *vport, struct lpfc_scsi_buf *lpfc_cmd,
 }
 
 /**
- * lpfc_scsi_prep_task_mgmt_cmnd: Convert scsi TM cmnd to FCP information unit.
+ * lpfc_scsi_prep_task_mgmt_cmnd - Convert scsi TM cmnd to FCP information unit
  * @vport: The virtual port for which this call is being executed.
  * @lpfc_cmd: Pointer to lpfc_scsi_buf data structure.
  * @lun: Logical unit number.
@@ -2110,7 +2114,7 @@ lpfc_scsi_prep_task_mgmt_cmd(struct lpfc_vport *vport,
 }
 
 /**
- * lpc_taskmgmt_def_cmpl: IOCB completion routine for task management command.
+ * lpfc_taskmgmt_def_cmpl - IOCB completion routine for task management command
  * @phba: The Hba for which this call is being executed.
  * @cmdiocbq: Pointer to lpfc_iocbq data structure.
  * @rspiocbq: Pointer to lpfc_iocbq data structure.
@@ -2131,7 +2135,7 @@ lpfc_tskmgmt_def_cmpl(struct lpfc_hba *phba,
 }
 
 /**
- * lpfc_scsi_tgt_reset: Target reset handler.
+ * lpfc_scsi_tgt_reset - Target reset handler
  * @lpfc_cmd: Pointer to lpfc_scsi_buf data structure
  * @vport: The virtual port for which this call is being executed.
  * @tgt_id: Target ID.
@@ -2198,7 +2202,7 @@ lpfc_scsi_tgt_reset(struct lpfc_scsi_buf *lpfc_cmd, struct lpfc_vport *vport,
 }
 
 /**
- * lpfc_info: Info entry point of scsi_host_template data structure.
+ * lpfc_info - Info entry point of scsi_host_template data structure
  * @host: The scsi host for which this call is being executed.
  *
  * This routine provides module information about hba.
@@ -2236,7 +2240,7 @@ lpfc_info(struct Scsi_Host *host)
 }
 
 /**
- * lpfc_poll_rearm_time: Routine to modify fcp_poll timer of hba.
+ * lpfc_poll_rearm_time - Routine to modify fcp_poll timer of hba
  * @phba: The Hba for which this call is being executed.
  *
  * This routine modifies fcp_poll_timer  field of @phba by cfg_poll_tmo.
@@ -2253,7 +2257,7 @@ static __inline__ void lpfc_poll_rearm_timer(struct lpfc_hba * phba)
 }
 
 /**
- * lpfc_poll_start_timer: Routine to start fcp_poll_timer of HBA.
+ * lpfc_poll_start_timer - Routine to start fcp_poll_timer of HBA
  * @phba: The Hba for which this call is being executed.
  *
  * This routine starts the fcp_poll_timer of @phba.
@@ -2264,7 +2268,7 @@ void lpfc_poll_start_timer(struct lpfc_hba * phba)
 }
 
 /**
- * lpfc_poll_timeout: Restart polling timer.
+ * lpfc_poll_timeout - Restart polling timer
  * @ptr: Map to lpfc_hba data structure pointer.
  *
  * This routine restarts fcp_poll timer, when FCP ring  polling is enable
@@ -2283,8 +2287,7 @@ void lpfc_poll_timeout(unsigned long ptr)
 }
 
 /**
- * lpfc_queuecommand: Queuecommand entry point of Scsi Host Templater data
- * structure.
+ * lpfc_queuecommand - scsi_host_template queuecommand entry point
  * @cmnd: Pointer to scsi_cmnd data structure.
  * @done: Pointer to done routine.
  *
@@ -2450,7 +2453,7 @@ lpfc_queuecommand(struct scsi_cmnd *cmnd, void (*done) (struct scsi_cmnd *))
 }
 
 /**
- * lpfc_block_error_handler: Routine to block error  handler.
+ * lpfc_block_error_handler - Routine to block error  handler
  * @cmnd: Pointer to scsi_cmnd data structure.
  *
  *  This routine blocks execution till fc_rport state is not FC_PORSTAT_BLCOEKD.
@@ -2472,8 +2475,7 @@ lpfc_block_error_handler(struct scsi_cmnd *cmnd)
 }
 
 /**
- * lpfc_abort_handler: Eh_abort_handler entry point of Scsi Host Template data
- *structure.
+ * lpfc_abort_handler - scsi_host_template eh_abort_handler entry point
  * @cmnd: Pointer to scsi_cmnd data structure.
  *
  * This routine aborts @cmnd pending in base driver.
@@ -2578,8 +2580,7 @@ lpfc_abort_handler(struct scsi_cmnd *cmnd)
 }
 
 /**
- * lpfc_device_reset_handler: eh_device_reset entry point of Scsi Host Template
- *data structure.
+ * lpfc_device_reset_handler - scsi_host_template eh_device_reset entry point
  * @cmnd: Pointer to scsi_cmnd data structure.
  *
  * This routine does a device reset by sending a TARGET_RESET task management
@@ -2587,7 +2588,7 @@ lpfc_abort_handler(struct scsi_cmnd *cmnd)
  *
  * Return code :
  *  0x2003 - Error
- *  0ex2002 - Success
+ *  0x2002 - Success
  **/
 static int
 lpfc_device_reset_handler(struct scsi_cmnd *cmnd)
@@ -2707,8 +2708,7 @@ lpfc_device_reset_handler(struct scsi_cmnd *cmnd)
 }
 
 /**
- * lpfc_bus_reset_handler: eh_bus_reset_handler entry point of Scsi Host
- * Template data structure.
+ * lpfc_bus_reset_handler - scsi_host_template eh_bus_reset_handler entry point
  * @cmnd: Pointer to scsi_cmnd data structure.
  *
  * This routine does target reset to all target on @cmnd->device->host.
@@ -2808,8 +2808,7 @@ lpfc_bus_reset_handler(struct scsi_cmnd *cmnd)
 }
 
 /**
- * lpfc_slave_alloc: slave_alloc entry point of Scsi Host Template data
- * structure.
+ * lpfc_slave_alloc - scsi_host_template slave_alloc entry point
  * @sdev: Pointer to scsi_device.
  *
  * This routine populates the cmds_per_lun count + 2 scsi_bufs into  this host's
@@ -2883,8 +2882,7 @@ lpfc_slave_alloc(struct scsi_device *sdev)
 }
 
 /**
- * lpfc_slave_configure: slave_configure entry point of Scsi Host Templater data
- *  structure.
+ * lpfc_slave_configure - scsi_host_template slave_configure entry point
  * @sdev: Pointer to scsi_device.
  *
  * This routine configures following items
@@ -2925,7 +2923,7 @@ lpfc_slave_configure(struct scsi_device *sdev)
 }
 
 /**
- * lpfc_slave_destroy: slave_destroy entry point of SHT data structure.
+ * lpfc_slave_destroy - slave_destroy entry point of SHT data structure
  * @sdev: Pointer to scsi_device.
  *
  * This routine sets @sdev hostatdata filed to null.
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index a36a120561e..eb5c75c45ba 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -68,7 +68,7 @@ typedef enum _lpfc_iocb_type {
 } lpfc_iocb_type;
 
 /**
- * lpfc_cmd_iocb: Get next command iocb entry in the ring.
+ * lpfc_cmd_iocb - Get next command iocb entry in the ring
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  *
@@ -85,7 +85,7 @@ lpfc_cmd_iocb(struct lpfc_hba *phba, struct lpfc_sli_ring *pring)
 }
 
 /**
- * lpfc_resp_iocb: Get next response iocb entry in the ring.
+ * lpfc_resp_iocb - Get next response iocb entry in the ring
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  *
@@ -102,7 +102,7 @@ lpfc_resp_iocb(struct lpfc_hba *phba, struct lpfc_sli_ring *pring)
 }
 
 /**
- * __lpfc_sli_get_iocbq: Allocates an iocb object from iocb pool.
+ * __lpfc_sli_get_iocbq - Allocates an iocb object from iocb pool
  * @phba: Pointer to HBA context object.
  *
  * This function is called with hbalock held. This function
@@ -121,7 +121,7 @@ __lpfc_sli_get_iocbq(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_sli_get_iocbq: Allocates an iocb object from iocb pool.
+ * lpfc_sli_get_iocbq - Allocates an iocb object from iocb pool
  * @phba: Pointer to HBA context object.
  *
  * This function is called with no lock held. This function
@@ -142,7 +142,7 @@ lpfc_sli_get_iocbq(struct lpfc_hba *phba)
 }
 
 /**
- * __lpfc_sli_release_iocbq: Release iocb to the iocb pool.
+ * __lpfc_sli_release_iocbq - Release iocb to the iocb pool
  * @phba: Pointer to HBA context object.
  * @iocbq: Pointer to driver iocb object.
  *
@@ -164,7 +164,7 @@ __lpfc_sli_release_iocbq(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq)
 }
 
 /**
- * lpfc_sli_release_iocbq: Release iocb to the iocb pool.
+ * lpfc_sli_release_iocbq - Release iocb to the iocb pool
  * @phba: Pointer to HBA context object.
  * @iocbq: Pointer to driver iocb object.
  *
@@ -185,8 +185,40 @@ lpfc_sli_release_iocbq(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq)
 }
 
 /**
- * lpfc_sli_iocb_cmd_type: Get the iocb type.
- * @iocb_cmnd : iocb command code.
+ * lpfc_sli_cancel_iocbs - Cancel all iocbs from a list.
+ * @phba: Pointer to HBA context object.
+ * @iocblist: List of IOCBs.
+ * @ulpstatus: ULP status in IOCB command field.
+ * @ulpWord4: ULP word-4 in IOCB command field.
+ *
+ * This function is called with a list of IOCBs to cancel. It cancels the IOCB
+ * on the list by invoking the complete callback function associated with the
+ * IOCB with the provided @ulpstatus and @ulpword4 set to the IOCB commond
+ * fields.
+ **/
+void
+lpfc_sli_cancel_iocbs(struct lpfc_hba *phba, struct list_head *iocblist,
+                      uint32_t ulpstatus, uint32_t ulpWord4)
+{
+        struct lpfc_iocbq *piocb;
+
+        while (!list_empty(iocblist)) {
+                list_remove_head(iocblist, piocb, struct lpfc_iocbq, list);
+
+                if (!piocb->iocb_cmpl)
+                        lpfc_sli_release_iocbq(phba, piocb);
+                else {
+                        piocb->iocb.ulpStatus = ulpstatus;
+                        piocb->iocb.un.ulpWord[4] = ulpWord4;
+                        (piocb->iocb_cmpl) (phba, piocb, piocb);
+                }
+        }
+        return;
+}
+
+/**
+ * lpfc_sli_iocb_cmd_type - Get the iocb type
+ * @iocb_cmnd: iocb command code.
  *
  * This function is called by ring event handler function to get the iocb type.
  * This function translates the iocb command to an iocb command type used to
@@ -295,7 +327,7 @@ lpfc_sli_iocb_cmd_type(uint8_t iocb_cmnd)
 }
 
 /**
- * lpfc_sli_ring_map: Issue config_ring mbox for all rings.
+ * lpfc_sli_ring_map - Issue config_ring mbox for all rings
  * @phba: Pointer to HBA context object.
  *
  * This function is called from SLI initialization code
@@ -338,7 +370,7 @@ lpfc_sli_ring_map(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_sli_ringtxcmpl_put: Adds new iocb to the txcmplq.
+ * lpfc_sli_ringtxcmpl_put - Adds new iocb to the txcmplq
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  * @piocb: Pointer to the driver iocb object.
@@ -370,7 +402,7 @@ lpfc_sli_ringtxcmpl_put(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 }
 
 /**
- * lpfc_sli_ringtx_get: Get first element of the txq.
+ * lpfc_sli_ringtx_get - Get first element of the txq
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  *
@@ -391,7 +423,7 @@ lpfc_sli_ringtx_get(struct lpfc_hba *phba, struct lpfc_sli_ring *pring)
 }
 
 /**
- * lpfc_sli_next_iocb_slot: Get next iocb slot in the ring.
+ * lpfc_sli_next_iocb_slot - Get next iocb slot in the ring
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  *
@@ -445,7 +477,7 @@ lpfc_sli_next_iocb_slot (struct lpfc_hba *phba, struct lpfc_sli_ring *pring)
 }
 
 /**
- * lpfc_sli_next_iotag: Get an iotag for the iocb.
+ * lpfc_sli_next_iotag - Get an iotag for the iocb
  * @phba: Pointer to HBA context object.
  * @iocbq: Pointer to driver iocb object.
  *
@@ -520,7 +552,7 @@ lpfc_sli_next_iotag(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq)
 }
 
 /**
- * lpfc_sli_submit_iocb: Submit an iocb to the firmware.
+ * lpfc_sli_submit_iocb - Submit an iocb to the firmware
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  * @iocb: Pointer to iocb slot in the ring.
@@ -577,7 +609,7 @@ lpfc_sli_submit_iocb(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 }
 
 /**
- * lpfc_sli_update_full_ring: Update the chip attention register.
+ * lpfc_sli_update_full_ring - Update the chip attention register
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  *
@@ -608,7 +640,7 @@ lpfc_sli_update_full_ring(struct lpfc_hba *phba, struct lpfc_sli_ring *pring)
 }
 
 /**
- * lpfc_sli_update_ring: Update chip attention register.
+ * lpfc_sli_update_ring - Update chip attention register
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  *
@@ -632,7 +664,7 @@ lpfc_sli_update_ring(struct lpfc_hba *phba, struct lpfc_sli_ring *pring)
 }
 
 /**
- * lpfc_sli_resume_iocb: Process iocbs in the txq.
+ * lpfc_sli_resume_iocb - Process iocbs in the txq
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  *
@@ -672,7 +704,7 @@ lpfc_sli_resume_iocb(struct lpfc_hba *phba, struct lpfc_sli_ring *pring)
 }
 
 /**
- * lpfc_sli_next_hbq_slot: Get next hbq entry for the HBQ.
+ * lpfc_sli_next_hbq_slot - Get next hbq entry for the HBQ
  * @phba: Pointer to HBA context object.
  * @hbqno: HBQ number.
  *
@@ -717,7 +749,7 @@ lpfc_sli_next_hbq_slot(struct lpfc_hba *phba, uint32_t hbqno)
 }
 
 /**
- * lpfc_sli_hbqbuf_free_all: Free all the hbq buffers.
+ * lpfc_sli_hbqbuf_free_all - Free all the hbq buffers
  * @phba: Pointer to HBA context object.
  *
  * This function is called with no lock held to free all the
@@ -771,7 +803,7 @@ lpfc_sli_hbqbuf_free_all(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_sli_hbq_to_firmware: Post the hbq buffer to firmware.
+ * lpfc_sli_hbq_to_firmware - Post the hbq buffer to firmware
  * @phba: Pointer to HBA context object.
  * @hbqno: HBQ number.
  * @hbq_buf: Pointer to HBQ buffer.
@@ -818,8 +850,8 @@ static struct lpfc_hbq_init lpfc_els_hbq = {
         .profile = 0,
         .ring_mask = (1 << LPFC_ELS_RING),
         .buffer_count = 0,
-        .init_count = 20,
-        .add_count = 5,
+        .init_count = 40,
+        .add_count = 40,
 };
 
 /* HBQ for the extra ring if needed */
@@ -841,7 +873,7 @@ struct lpfc_hbq_init *lpfc_hbq_defs[] = {
 };
 
 /**
- * lpfc_sli_hbqbuf_fill_hbqs: Post more hbq buffers to HBQ.
+ * lpfc_sli_hbqbuf_fill_hbqs - Post more hbq buffers to HBQ
  * @phba: Pointer to HBA context object.
  * @hbqno: HBQ number.
  * @count: Number of HBQ buffers to be posted.
@@ -901,7 +933,7 @@ err:
 }
 
 /**
- * lpfc_sli_hbqbuf_add_hbqs: Post more HBQ buffers to firmware.
+ * lpfc_sli_hbqbuf_add_hbqs - Post more HBQ buffers to firmware
  * @phba: Pointer to HBA context object.
  * @qno: HBQ number.
  *
@@ -917,7 +949,7 @@ lpfc_sli_hbqbuf_add_hbqs(struct lpfc_hba *phba, uint32_t qno)
 }
 
 /**
- * lpfc_sli_hbqbuf_init_hbqs: Post initial buffers to the HBQ.
+ * lpfc_sli_hbqbuf_init_hbqs - Post initial buffers to the HBQ
  * @phba: Pointer to HBA context object.
  * @qno:  HBQ queue number.
  *
@@ -933,7 +965,7 @@ lpfc_sli_hbqbuf_init_hbqs(struct lpfc_hba *phba, uint32_t qno)
 }
 
 /**
- * lpfc_sli_hbqbuf_find: Find the hbq buffer associated with a tag.
+ * lpfc_sli_hbqbuf_find - Find the hbq buffer associated with a tag
  * @phba: Pointer to HBA context object.
  * @tag: Tag of the hbq buffer.
  *
@@ -966,7 +998,7 @@ lpfc_sli_hbqbuf_find(struct lpfc_hba *phba, uint32_t tag)
 }
 
 /**
- * lpfc_sli_free_hbq: Give back the hbq buffer to firmware.
+ * lpfc_sli_free_hbq - Give back the hbq buffer to firmware
  * @phba: Pointer to HBA context object.
  * @hbq_buffer: Pointer to HBQ buffer.
  *
@@ -988,7 +1020,7 @@ lpfc_sli_free_hbq(struct lpfc_hba *phba, struct hbq_dmabuf *hbq_buffer)
 }
 
 /**
- * lpfc_sli_chk_mbx_command: Check if the mailbox is a legitimate mailbox.
+ * lpfc_sli_chk_mbx_command - Check if the mailbox is a legitimate mailbox
  * @mbxCommand: mailbox command code.
  *
  * This function is called by the mailbox event handler function to verify
@@ -1064,8 +1096,7 @@ lpfc_sli_chk_mbx_command(uint8_t mbxCommand)
 }
 
 /**
- * lpfc_sli_wake_mbox_wait: Completion handler for mbox issued from
- *          lpfc_sli_issue_mbox_wait.
+ * lpfc_sli_wake_mbox_wait - lpfc_sli_issue_mbox_wait mbox completion handler
  * @phba: Pointer to HBA context object.
  * @pmboxq: Pointer to mailbox command.
  *
@@ -1096,7 +1127,7 @@ lpfc_sli_wake_mbox_wait(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmboxq)
 
 
 /**
- * lpfc_sli_def_mbox_cmpl: Default mailbox completion handler.
+ * lpfc_sli_def_mbox_cmpl - Default mailbox completion handler
  * @phba: Pointer to HBA context object.
  * @pmb: Pointer to mailbox object.
  *
@@ -1140,7 +1171,7 @@ lpfc_sli_def_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
 }
 
 /**
- * lpfc_sli_handle_mb_event: Handle mailbox completions from firmware.
+ * lpfc_sli_handle_mb_event - Handle mailbox completions from firmware
  * @phba: Pointer to HBA context object.
  *
  * This function is called with no lock held. This function processes all
@@ -1260,7 +1291,7 @@ lpfc_sli_handle_mb_event(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_sli_get_buff: Get the buffer associated with the buffer tag.
+ * lpfc_sli_get_buff - Get the buffer associated with the buffer tag
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  * @tag: buffer tag.
@@ -1288,7 +1319,7 @@ lpfc_sli_get_buff(struct lpfc_hba *phba,
 
 
 /**
- * lpfc_sli_process_unsol_iocb: Unsolicited iocb handler.
+ * lpfc_sli_process_unsol_iocb - Unsolicited iocb handler
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  * @saveq: Pointer to the unsolicited iocb.
@@ -1484,7 +1515,7 @@ lpfc_sli_process_unsol_iocb(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 }
 
 /**
- * lpfc_sli_iocbq_lookup: Find command iocb for the given response iocb.
+ * lpfc_sli_iocbq_lookup - Find command iocb for the given response iocb
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  * @prspiocb: Pointer to response iocb object.
@@ -1521,7 +1552,7 @@ lpfc_sli_iocbq_lookup(struct lpfc_hba *phba,
 }
 
 /**
- * lpfc_sli_process_sol_iocb: process solicited iocb completion.
+ * lpfc_sli_process_sol_iocb - process solicited iocb completion
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  * @saveq: Pointer to the response iocb to be processed.
@@ -1597,7 +1628,7 @@ lpfc_sli_process_sol_iocb(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                          * Ring <ringno> handler: unexpected completion IoTag
                          * <IoTag>
                          */
-                        lpfc_printf_vlog(cmdiocbp->vport, KERN_WARNING, LOG_SLI,
+                        lpfc_printf_log(phba, KERN_WARNING, LOG_SLI,
                                          "0322 Ring %d handler: "
                                          "unexpected completion IoTag x%x "
                                          "Data: x%x x%x x%x x%x\n",
@@ -1614,7 +1645,7 @@ lpfc_sli_process_sol_iocb(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 }
 
 /**
- * lpfc_sli_rsp_pointers_error: Response ring pointer error handler.
+ * lpfc_sli_rsp_pointers_error - Response ring pointer error handler
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  *
@@ -1652,7 +1683,7 @@ lpfc_sli_rsp_pointers_error(struct lpfc_hba *phba, struct lpfc_sli_ring *pring)
 }
 
 /**
- * lpfc_poll_eratt: Error attention polling timer timeout handler.
+ * lpfc_poll_eratt - Error attention polling timer timeout handler
  * @ptr: Pointer to address of HBA context object.
  *
  * This function is invoked by the Error Attention polling timer when the
@@ -1682,7 +1713,7 @@ void lpfc_poll_eratt(unsigned long ptr)
 }
 
 /**
- * lpfc_sli_poll_fcp_ring: Handle FCP ring completion in polling mode.
+ * lpfc_sli_poll_fcp_ring - Handle FCP ring completion in polling mode
  * @phba: Pointer to HBA context object.
  *
  * This function is called from lpfc_queuecommand, lpfc_poll_timeout,
@@ -1845,7 +1876,7 @@ void lpfc_sli_poll_fcp_ring(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_sli_handle_fast_ring_event: Handle ring events on FCP ring.
+ * lpfc_sli_handle_fast_ring_event - Handle ring events on FCP ring
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  * @mask: Host attention register mask for this ring.
@@ -2037,7 +2068,7 @@ lpfc_sli_handle_fast_ring_event(struct lpfc_hba *phba,
 }
 
 /**
- * lpfc_sli_handle_slow_ring_event: Handle ring events for non-FCP rings.
+ * lpfc_sli_handle_slow_ring_event - Handle ring events for non-FCP rings
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  * @mask: Host attention register mask for this ring.
@@ -2311,7 +2342,7 @@ lpfc_sli_handle_slow_ring_event(struct lpfc_hba *phba,
 }
 
 /**
- * lpfc_sli_abort_iocb_ring: Abort all iocbs in the ring.
+ * lpfc_sli_abort_iocb_ring - Abort all iocbs in the ring
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  *
@@ -2325,7 +2356,6 @@ lpfc_sli_abort_iocb_ring(struct lpfc_hba *phba, struct lpfc_sli_ring *pring)
 {
         LIST_HEAD(completions);
         struct lpfc_iocbq *iocb, *next_iocb;
-        IOCB_t *cmd = NULL;
 
         if (pring->ringno == LPFC_ELS_RING) {
                 lpfc_fabric_abort_hba(phba);
@@ -2344,23 +2374,13 @@ lpfc_sli_abort_iocb_ring(struct lpfc_hba *phba, struct lpfc_sli_ring *pring)
 
         spin_unlock_irq(&phba->hbalock);
 
-        while (!list_empty(&completions)) {
-                iocb = list_get_first(&completions, struct lpfc_iocbq, list);
-                cmd = &iocb->iocb;
-                list_del_init(&iocb->list);
-
-                if (!iocb->iocb_cmpl)
-                        lpfc_sli_release_iocbq(phba, iocb);
-                else {
-                        cmd->ulpStatus = IOSTAT_LOCAL_REJECT;
-                        cmd->un.ulpWord[4] = IOERR_SLI_ABORTED;
-                        (iocb->iocb_cmpl) (phba, iocb, iocb);
-                }
-        }
+        /* Cancel all the IOCBs from the completions list */
+        lpfc_sli_cancel_iocbs(phba, &completions, IOSTAT_LOCAL_REJECT,
+                              IOERR_SLI_ABORTED);
 }
 
 /**
- * lpfc_sli_flush_fcp_rings: flush all iocbs in the fcp ring.
+ * lpfc_sli_flush_fcp_rings - flush all iocbs in the fcp ring
  * @phba: Pointer to HBA context object.
  *
  * This function flushes all iocbs in the fcp ring and frees all the iocb
@@ -2374,8 +2394,6 @@ lpfc_sli_flush_fcp_rings(struct lpfc_hba *phba)
 {
         LIST_HEAD(txq);
         LIST_HEAD(txcmplq);
-        struct lpfc_iocbq *iocb;
-        IOCB_t *cmd = NULL;
         struct lpfc_sli *psli = &phba->sli;
         struct lpfc_sli_ring  *pring;
 
@@ -2393,38 +2411,16 @@ lpfc_sli_flush_fcp_rings(struct lpfc_hba *phba)
         spin_unlock_irq(&phba->hbalock);
 
         /* Flush the txq */
-        while (!list_empty(&txq)) {
-                iocb = list_get_first(&txq, struct lpfc_iocbq, list);
-                cmd = &iocb->iocb;
-                list_del_init(&iocb->list);
-
-                if (!iocb->iocb_cmpl)
-                        lpfc_sli_release_iocbq(phba, iocb);
-                else {
-                        cmd->ulpStatus = IOSTAT_LOCAL_REJECT;
-                        cmd->un.ulpWord[4] = IOERR_SLI_DOWN;
-                        (iocb->iocb_cmpl) (phba, iocb, iocb);
-                }
-        }
+        lpfc_sli_cancel_iocbs(phba, &txq, IOSTAT_LOCAL_REJECT,
+                              IOERR_SLI_DOWN);
 
         /* Flush the txcmpq */
-        while (!list_empty(&txcmplq)) {
-                iocb = list_get_first(&txcmplq, struct lpfc_iocbq, list);
-                cmd = &iocb->iocb;
-                list_del_init(&iocb->list);
-
-                if (!iocb->iocb_cmpl)
-                        lpfc_sli_release_iocbq(phba, iocb);
-                else {
-                        cmd->ulpStatus = IOSTAT_LOCAL_REJECT;
-                        cmd->un.ulpWord[4] = IOERR_SLI_DOWN;
-                        (iocb->iocb_cmpl) (phba, iocb, iocb);
-                }
-        }
+        lpfc_sli_cancel_iocbs(phba, &txcmplq, IOSTAT_LOCAL_REJECT,
+                              IOERR_SLI_DOWN);
 }
 
 /**
- * lpfc_sli_brdready: Check for host status bits.
+ * lpfc_sli_brdready - Check for host status bits
  * @phba: Pointer to HBA context object.
  * @mask: Bit mask to be checked.
  *
@@ -2484,7 +2480,7 @@ lpfc_sli_brdready(struct lpfc_hba *phba, uint32_t mask)
 #define BARRIER_TEST_PATTERN (0xdeadbeef)
 
 /**
- * lpfc_reset_barrier: Make HBA ready for HBA reset.
+ * lpfc_reset_barrier - Make HBA ready for HBA reset
  * @phba: Pointer to HBA context object.
  *
  * This function is called before resetting an HBA. This
@@ -2564,7 +2560,7 @@ restore_hc:
 }
 
 /**
- * lpfc_sli_brdkill: Issue a kill_board mailbox command.
+ * lpfc_sli_brdkill - Issue a kill_board mailbox command
  * @phba: Pointer to HBA context object.
  *
  * This function issues a kill_board mailbox command and waits for
@@ -2651,7 +2647,7 @@ lpfc_sli_brdkill(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_sli_brdreset: Reset the HBA.
+ * lpfc_sli_brdreset - Reset the HBA
  * @phba: Pointer to HBA context object.
  *
  * This function resets the HBA by writing HC_INITFF to the control
@@ -2714,7 +2710,7 @@ lpfc_sli_brdreset(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_sli_brdrestart: Restart the HBA.
+ * lpfc_sli_brdrestart - Restart the HBA
  * @phba: Pointer to HBA context object.
  *
  * This function is called in the SLI initialization code path to
@@ -2781,7 +2777,7 @@ lpfc_sli_brdrestart(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_sli_chipset_init: Wait for the restart of the HBA after a restart.
+ * lpfc_sli_chipset_init - Wait for the restart of the HBA after a restart
  * @phba: Pointer to HBA context object.
  *
  * This function is called after a HBA restart to wait for successful
@@ -2876,7 +2872,7 @@ lpfc_sli_chipset_init(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_sli_hbq_count: Get the number of HBQs to be configured.
+ * lpfc_sli_hbq_count - Get the number of HBQs to be configured
  *
  * This function calculates and returns the number of HBQs required to be
  * configured.
@@ -2888,7 +2884,7 @@ lpfc_sli_hbq_count(void)
 }
 
 /**
- * lpfc_sli_hbq_entry_count: Calculate total number of hbq entries.
+ * lpfc_sli_hbq_entry_count - Calculate total number of hbq entries
  *
  * This function adds the number of hbq entries in every HBQ to get
  * the total number of hbq entries required for the HBA and returns
@@ -2907,7 +2903,7 @@ lpfc_sli_hbq_entry_count(void)
 }
 
 /**
- * lpfc_sli_hbq_size: Calculate memory required for all hbq entries.
+ * lpfc_sli_hbq_size - Calculate memory required for all hbq entries
  *
  * This function calculates amount of memory required for all hbq entries
  * to be configured and returns the total memory required.
@@ -2919,7 +2915,7 @@ lpfc_sli_hbq_size(void)
 }
 
 /**
- * lpfc_sli_hbq_setup: configure and initialize HBQs.
+ * lpfc_sli_hbq_setup - configure and initialize HBQs
  * @phba: Pointer to HBA context object.
  *
  * This function is called during the SLI initialization to configure
@@ -2988,7 +2984,7 @@ lpfc_sli_hbq_setup(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_sli_config_port: Issue config port mailbox command.
+ * lpfc_sli_config_port - Issue config port mailbox command
  * @phba: Pointer to HBA context object.
  * @sli_mode: sli mode - 2/3
  *
@@ -3114,7 +3110,7 @@ do_prep_failed:
 
 
 /**
- * lpfc_sli_hba_setup: SLI intialization function.
+ * lpfc_sli_hba_setup - SLI intialization function
  * @phba: Pointer to HBA context object.
  *
  * This function is the main SLI intialization function. This function
@@ -3206,7 +3202,7 @@ lpfc_sli_hba_setup_error:
 
 
 /**
- * lpfc_mbox_timeout: Timeout call back function for mbox timer.
+ * lpfc_mbox_timeout - Timeout call back function for mbox timer
  * @ptr: context object - pointer to hba structure.
  *
  * This is the callback function for mailbox timer. The mailbox
@@ -3237,7 +3233,7 @@ lpfc_mbox_timeout(unsigned long ptr)
 
 
 /**
- * lpfc_mbox_timeout_handler: Worker thread function to handle mailbox timeout.
+ * lpfc_mbox_timeout_handler - Worker thread function to handle mailbox timeout
  * @phba: Pointer to HBA context object.
  *
  * This function is called from worker thread when a mailbox command times out.
@@ -3252,6 +3248,21 @@ lpfc_mbox_timeout_handler(struct lpfc_hba *phba)
         struct lpfc_sli *psli = &phba->sli;
         struct lpfc_sli_ring *pring;
 
+        /* Check the pmbox pointer first.  There is a race condition
+         * between the mbox timeout handler getting executed in the
+         * worklist and the mailbox actually completing. When this
+         * race condition occurs, the mbox_active will be NULL.
+         */
+        spin_lock_irq(&phba->hbalock);
+        if (pmbox == NULL) {
+                lpfc_printf_log(phba, KERN_WARNING,
+                                LOG_MBOX | LOG_SLI,
+                                "0353 Active Mailbox cleared - mailbox timeout "
+                                "exiting\n");
+                spin_unlock_irq(&phba->hbalock);
+                return;
+        }
+
         /* Mbox cmd <mbxCommand> timeout */
         lpfc_printf_log(phba, KERN_ERR, LOG_MBOX | LOG_SLI,
                         "0310 Mailbox command x%x timeout Data: x%x x%x x%p\n",
@@ -3259,6 +3270,7 @@ lpfc_mbox_timeout_handler(struct lpfc_hba *phba)
                         phba->pport->port_state,
                         phba->sli.sli_flag,
                         phba->sli.mbox_active);
+        spin_unlock_irq(&phba->hbalock);
 
         /* Setting state unknown so lpfc_sli_abort_iocb_ring
          * would get IOCB_ERROR from lpfc_sli_issue_iocb, allowing
@@ -3295,7 +3307,7 @@ lpfc_mbox_timeout_handler(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_sli_issue_mbox: Issue a mailbox command to firmware.
+ * lpfc_sli_issue_mbox - Issue a mailbox command to firmware
  * @phba: Pointer to HBA context object.
  * @pmbox: Pointer to mailbox object.
  * @flag: Flag indicating how the mailbox need to be processed.
@@ -3365,6 +3377,12 @@ lpfc_sli_issue_mbox(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmbox, uint32_t flag)
                 goto out_not_finished;
         }
 
+        /* If HBA has a deferred error attention, fail the iocb. */
+        if (unlikely(phba->hba_flag & DEFER_ERATT)) {
+                spin_unlock_irqrestore(&phba->hbalock, drvr_flag);
+                goto out_not_finished;
+        }
+
         psli = &phba->sli;
 
         mb = &pmbox->mb;
@@ -3632,7 +3650,7 @@ out_not_finished:
 }
 
 /**
- * __lpfc_sli_ringtx_put: Add an iocb to the txq.
+ * __lpfc_sli_ringtx_put - Add an iocb to the txq
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  * @piocb: Pointer to address of newly added command iocb.
@@ -3651,7 +3669,7 @@ __lpfc_sli_ringtx_put(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 }
 
 /**
- * lpfc_sli_next_iocb: Get the next iocb in the txq.
+ * lpfc_sli_next_iocb - Get the next iocb in the txq
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  * @piocb: Pointer to address of newly added command iocb.
@@ -3683,7 +3701,7 @@ lpfc_sli_next_iocb(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 }
 
 /**
- * __lpfc_sli_issue_iocb: Lockless version of lpfc_sli_issue_iocb.
+ * __lpfc_sli_issue_iocb - Lockless version of lpfc_sli_issue_iocb
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  * @piocb: Pointer to command iocb.
@@ -3729,6 +3747,10 @@ __lpfc_sli_issue_iocb(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
         if (unlikely(pci_channel_offline(phba->pcidev)))
                 return IOCB_ERROR;
 
+        /* If HBA has a deferred error attention, fail the iocb. */
+        if (unlikely(phba->hba_flag & DEFER_ERATT))
+                return IOCB_ERROR;
+
         /*
          * We should never get an IOCB if we are in a < LINK_DOWN state
          */
@@ -3813,7 +3835,7 @@ __lpfc_sli_issue_iocb(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 
 
 /**
- * lpfc_sli_issue_iocb: Wrapper function for __lpfc_sli_issue_iocb.
+ * lpfc_sli_issue_iocb - Wrapper function for __lpfc_sli_issue_iocb
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  * @piocb: Pointer to command iocb.
@@ -3840,7 +3862,7 @@ lpfc_sli_issue_iocb(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 }
 
 /**
- * lpfc_extra_ring_setup: Extra ring setup function.
+ * lpfc_extra_ring_setup - Extra ring setup function
  * @phba: Pointer to HBA context object.
  *
  * This function is called while driver attaches with the
@@ -3886,7 +3908,7 @@ lpfc_extra_ring_setup( struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_sli_async_event_handler: ASYNC iocb handler function.
+ * lpfc_sli_async_event_handler - ASYNC iocb handler function
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  * @iocbq: Pointer to iocb object.
@@ -3907,6 +3929,7 @@ lpfc_sli_async_event_handler(struct lpfc_hba * phba,
         uint16_t temp;
         struct temp_event temp_event_data;
         struct Scsi_Host *shost;
+        uint32_t *iocb_w;
 
         icmd = &iocbq->iocb;
         evt_code = icmd->un.asyncstat.evt_code;
@@ -3914,13 +3937,23 @@ lpfc_sli_async_event_handler(struct lpfc_hba * phba,
 
         if ((evt_code != ASYNC_TEMP_WARN) &&
                 (evt_code != ASYNC_TEMP_SAFE)) {
+                iocb_w = (uint32_t *) icmd;
                 lpfc_printf_log(phba,
                         KERN_ERR,
                         LOG_SLI,
                         "0346 Ring %d handler: unexpected ASYNC_STATUS"
-                        " evt_code 0x%x\n",
+                        " evt_code 0x%x \n"
+                        "W0  0x%08x W1  0x%08x W2  0x%08x W3  0x%08x\n"
+                        "W4  0x%08x W5  0x%08x W6  0x%08x W7  0x%08x\n"
+                        "W8  0x%08x W9  0x%08x W10 0x%08x W11 0x%08x\n"
+                        "W12 0x%08x W13 0x%08x W14 0x%08x W15 0x%08x\n",
                         pring->ringno,
-                        icmd->un.asyncstat.evt_code);
+                        icmd->un.asyncstat.evt_code,
+                        iocb_w[0], iocb_w[1], iocb_w[2], iocb_w[3],
+                        iocb_w[4], iocb_w[5], iocb_w[6], iocb_w[7],
+                        iocb_w[8], iocb_w[9], iocb_w[10], iocb_w[11],
+                        iocb_w[12], iocb_w[13], iocb_w[14], iocb_w[15]);
+
                 return;
         }
         temp_event_data.data = (uint32_t)temp;
@@ -3954,7 +3987,7 @@ lpfc_sli_async_event_handler(struct lpfc_hba * phba,
 
 
 /**
- * lpfc_sli_setup: SLI ring setup function.
+ * lpfc_sli_setup - SLI ring setup function
  * @phba: Pointer to HBA context object.
  *
  * lpfc_sli_setup sets up rings of the SLI interface with
@@ -4076,7 +4109,7 @@ lpfc_sli_setup(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_sli_queue_setup: Queue initialization function.
+ * lpfc_sli_queue_setup - Queue initialization function
  * @phba: Pointer to HBA context object.
  *
  * lpfc_sli_queue_setup sets up mailbox queues and iocb queues for each
@@ -4115,7 +4148,7 @@ lpfc_sli_queue_setup(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_sli_host_down: Vport cleanup function.
+ * lpfc_sli_host_down - Vport cleanup function
  * @vport: Pointer to virtual port object.
  *
  * lpfc_sli_host_down is called to clean up the resources
@@ -4179,22 +4212,14 @@ lpfc_sli_host_down(struct lpfc_vport *vport)
 
         spin_unlock_irqrestore(&phba->hbalock, flags);
 
-        while (!list_empty(&completions)) {
-                list_remove_head(&completions, iocb, struct lpfc_iocbq, list);
-
-                if (!iocb->iocb_cmpl)
-                        lpfc_sli_release_iocbq(phba, iocb);
-                else {
-                        iocb->iocb.ulpStatus = IOSTAT_LOCAL_REJECT;
-                        iocb->iocb.un.ulpWord[4] = IOERR_SLI_DOWN;
-                        (iocb->iocb_cmpl) (phba, iocb, iocb);
-                }
-        }
+        /* Cancel all the IOCBs from the completions list */
+        lpfc_sli_cancel_iocbs(phba, &completions, IOSTAT_LOCAL_REJECT,
+                              IOERR_SLI_DOWN);
         return 1;
 }
 
 /**
- * lpfc_sli_hba_down: Resource cleanup function for the HBA.
+ * lpfc_sli_hba_down - Resource cleanup function for the HBA
  * @phba: Pointer to HBA context object.
  *
  * This function cleans up all iocb, buffers, mailbox commands
@@ -4216,8 +4241,6 @@ lpfc_sli_hba_down(struct lpfc_hba *phba)
         struct lpfc_sli_ring *pring;
         struct lpfc_dmabuf *buf_ptr;
         LPFC_MBOXQ_t *pmb;
-        struct lpfc_iocbq *iocb;
-        IOCB_t *cmd = NULL;
         int i;
         unsigned long flags = 0;
 
@@ -4245,18 +4268,9 @@ lpfc_sli_hba_down(struct lpfc_hba *phba)
         }
         spin_unlock_irqrestore(&phba->hbalock, flags);
 
-        while (!list_empty(&completions)) {
-                list_remove_head(&completions, iocb, struct lpfc_iocbq, list);
-                cmd = &iocb->iocb;
-
-                if (!iocb->iocb_cmpl)
-                        lpfc_sli_release_iocbq(phba, iocb);
-                else {
-                        cmd->ulpStatus = IOSTAT_LOCAL_REJECT;
-                        cmd->un.ulpWord[4] = IOERR_SLI_DOWN;
-                        (iocb->iocb_cmpl) (phba, iocb, iocb);
-                }
-        }
+        /* Cancel all the IOCBs from the completions list */
+        lpfc_sli_cancel_iocbs(phba, &completions, IOSTAT_LOCAL_REJECT,
+                              IOERR_SLI_DOWN);
 
         spin_lock_irqsave(&phba->hbalock, flags);
         list_splice_init(&phba->elsbuf, &completions);
@@ -4299,7 +4313,7 @@ lpfc_sli_hba_down(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_sli_pcimem_bcopy: SLI memory copy function.
+ * lpfc_sli_pcimem_bcopy - SLI memory copy function
  * @srcp: Source memory pointer.
  * @destp: Destination memory pointer.
  * @cnt: Number of words required to be copied.
@@ -4329,7 +4343,7 @@ lpfc_sli_pcimem_bcopy(void *srcp, void *destp, uint32_t cnt)
 
 
 /**
- * lpfc_sli_ringpostbuf_put: Function to add a buffer to postbufq.
+ * lpfc_sli_ringpostbuf_put - Function to add a buffer to postbufq
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  * @mp: Pointer to driver buffer object.
@@ -4352,8 +4366,7 @@ lpfc_sli_ringpostbuf_put(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 }
 
 /**
- * lpfc_sli_get_buffer_tag: Tag allocation function for a buffer posted
- *          using CMD_QUE_XRI64_CX iocb.
+ * lpfc_sli_get_buffer_tag - allocates a tag for a CMD_QUE_XRI64_CX buffer
  * @phba: Pointer to HBA context object.
  *
  * When HBQ is enabled, buffers are searched based on tags. This function
@@ -4378,8 +4391,7 @@ lpfc_sli_get_buffer_tag(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_sli_ring_taggedbuf_get: Search HBQ buffer associated with
- *              posted using CMD_QUE_XRI64_CX iocb.
+ * lpfc_sli_ring_taggedbuf_get - find HBQ buffer associated with given tag
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  * @tag: Buffer tag.
@@ -4422,8 +4434,7 @@ lpfc_sli_ring_taggedbuf_get(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 }
 
 /**
- * lpfc_sli_ringpostbuf_get: SLI2 buffer search function for
- *      unsolicited ct and els events.
+ * lpfc_sli_ringpostbuf_get - search buffers for unsolicited CT and ELS events
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  * @phys: DMA address of the buffer.
@@ -4466,7 +4477,7 @@ lpfc_sli_ringpostbuf_get(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 }
 
 /**
- * lpfc_sli_abort_els_cmpl: Completion handler for the els abort iocbs.
+ * lpfc_sli_abort_els_cmpl - Completion handler for the els abort iocbs
  * @phba: Pointer to HBA context object.
  * @cmdiocb: Pointer to driver command iocb object.
  * @rspiocb: Pointer to driver response iocb object.
@@ -4542,7 +4553,7 @@ lpfc_sli_abort_els_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 }
 
 /**
- * lpfc_ignore_els_cmpl: Completion handler for aborted ELS command.
+ * lpfc_ignore_els_cmpl - Completion handler for aborted ELS command
  * @phba: Pointer to HBA context object.
  * @cmdiocb: Pointer to driver command iocb object.
  * @rspiocb: Pointer to driver response iocb object.
@@ -4572,7 +4583,7 @@ lpfc_ignore_els_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 }
 
 /**
- * lpfc_sli_issue_abort_iotag: Abort function for a command iocb.
+ * lpfc_sli_issue_abort_iotag - Abort function for a command iocb
  * @phba: Pointer to HBA context object.
  * @pring: Pointer to driver SLI ring object.
  * @cmdiocb: Pointer to driver command iocb object.
@@ -4658,15 +4669,14 @@ abort_iotag_exit:
 }
 
 /**
- * lpfc_sli_validate_fcp_iocb: Filtering function, used to find commands
- *                    associated with a vport/SCSI target/lun.
+ * lpfc_sli_validate_fcp_iocb - find commands associated with a vport or LUN
  * @iocbq: Pointer to driver iocb object.
  * @vport: Pointer to driver virtual port object.
  * @tgt_id: SCSI ID of the target.
  * @lun_id: LUN ID of the scsi device.
  * @ctx_cmd: LPFC_CTX_LUN/LPFC_CTX_TGT/LPFC_CTX_HOST
  *
- * This function acts as iocb filter for functions which abort or count
+ * This function acts as an iocb filter for functions which abort or count
  * all FCP iocbs pending on a lun/SCSI target/SCSI host. It will return
  * 0 if the filtering criteria is met for the given iocb and will return
  * 1 if the filtering criteria is not met.
@@ -4724,7 +4734,7 @@ lpfc_sli_validate_fcp_iocb(struct lpfc_iocbq *iocbq, struct lpfc_vport *vport,
 }
 
 /**
- * lpfc_sli_sum_iocb: Function to count the number of FCP iocbs pending.
+ * lpfc_sli_sum_iocb - Function to count the number of FCP iocbs pending
  * @vport: Pointer to virtual port.
  * @tgt_id: SCSI ID of the target.
  * @lun_id: LUN ID of the scsi device.
@@ -4762,8 +4772,7 @@ lpfc_sli_sum_iocb(struct lpfc_vport *vport, uint16_t tgt_id, uint64_t lun_id,
 }
 
 /**
- * lpfc_sli_abort_fcp_cmpl: Completion handler function for an aborted
- *       FCP iocb.
+ * lpfc_sli_abort_fcp_cmpl - Completion handler function for aborted FCP IOCBs
  * @phba: Pointer to HBA context object
  * @cmdiocb: Pointer to command iocb object.
  * @rspiocb: Pointer to response iocb object.
@@ -4781,8 +4790,7 @@ lpfc_sli_abort_fcp_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 }
 
 /**
- * lpfc_sli_abort_iocb: This function issue abort for all SCSI commands
- *          pending on a SCSI host(vport)/target/lun.
+ * lpfc_sli_abort_iocb - issue abort for all commands on a host/target/LUN
  * @vport: Pointer to virtual port.
  * @pring: Pointer to driver SLI ring object.
  * @tgt_id: SCSI ID of the target.
@@ -4854,8 +4862,7 @@ lpfc_sli_abort_iocb(struct lpfc_vport *vport, struct lpfc_sli_ring *pring,
 }
 
 /**
- * lpfc_sli_wake_iocb_wait: iocb completion handler for iocb issued using
- *                          lpfc_sli_issue_iocb_wait.
+ * lpfc_sli_wake_iocb_wait - lpfc_sli_issue_iocb_wait's completion handler
  * @phba: Pointer to HBA context object.
  * @cmdiocbq: Pointer to command iocb.
  * @rspiocbq: Pointer to response iocb.
@@ -4893,7 +4900,7 @@ lpfc_sli_wake_iocb_wait(struct lpfc_hba *phba,
 }
 
 /**
- * lpfc_sli_issue_iocb_wait: Synchronous function to issue iocb commands.
+ * lpfc_sli_issue_iocb_wait - Synchronous function to issue iocb commands
  * @phba: Pointer to HBA context object..
  * @pring: Pointer to sli ring.
  * @piocb: Pointer to command iocb.
@@ -5000,7 +5007,7 @@ lpfc_sli_issue_iocb_wait(struct lpfc_hba *phba,
 }
 
 /**
- * lpfc_sli_issue_mbox_wait: Synchronous function to issue mailbox.
+ * lpfc_sli_issue_mbox_wait - Synchronous function to issue mailbox
  * @phba: Pointer to HBA context object.
  * @pmboxq: Pointer to driver mailbox object.
  * @timeout: Timeout in number of seconds.
@@ -5070,7 +5077,7 @@ lpfc_sli_issue_mbox_wait(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmboxq,
 }
 
 /**
- * lpfc_sli_flush_mbox_queue: mailbox queue cleanup function.
+ * lpfc_sli_flush_mbox_queue - mailbox queue cleanup function
  * @phba: Pointer to HBA context.
  *
  * This function is called to cleanup any pending mailbox
@@ -5113,7 +5120,7 @@ lpfc_sli_flush_mbox_queue(struct lpfc_hba * phba)
 }
 
 /**
- * lpfc_sli_check_eratt: check error attention events
+ * lpfc_sli_check_eratt - check error attention events
  * @phba: Pointer to HBA context.
  *
  * This function is called form timer soft interrupt context to check HBA's
@@ -5145,11 +5152,31 @@ lpfc_sli_check_eratt(struct lpfc_hba *phba)
                 return 0;
         }
 
+        /*
+         * If there is deferred error attention, do not check for error
+         * attention
+         */
+        if (unlikely(phba->hba_flag & DEFER_ERATT)) {
+                spin_unlock_irq(&phba->hbalock);
+                return 0;
+        }
+
         /* Read chip Host Attention (HA) register */
         ha_copy = readl(phba->HAregaddr);
         if (ha_copy & HA_ERATT) {
                 /* Read host status register to retrieve error event */
                 lpfc_sli_read_hs(phba);
+
+                /* Check if there is a deferred error condition is active */
+                if ((HS_FFER1 & phba->work_hs) &&
+                        ((HS_FFER2 | HS_FFER3 | HS_FFER4 | HS_FFER5 |
+                        HS_FFER6 | HS_FFER7) & phba->work_hs)) {
+                        phba->hba_flag |= DEFER_ERATT;
+                        /* Clear all interrupt enable conditions */
+                        writel(0, phba->HCregaddr);
+                        readl(phba->HCregaddr);
+                }
+
                 /* Set the driver HA work bitmap */
                 phba->work_ha |= HA_ERATT;
                 /* Indicate polling handles this ERATT */
@@ -5162,7 +5189,7 @@ lpfc_sli_check_eratt(struct lpfc_hba *phba)
 }
 
 /**
- * lpfc_sp_intr_handler: The slow-path interrupt handler of lpfc driver.
+ * lpfc_sp_intr_handler - The slow-path interrupt handler of lpfc driver
  * @irq: Interrupt number.
  * @dev_id: The device context pointer.
  *
@@ -5238,6 +5265,16 @@ lpfc_sp_intr_handler(int irq, void *dev_id)
                                 /* Indicate interrupt handler handles ERATT */
                                 phba->hba_flag |= HBA_ERATT_HANDLED;
                 }
+
+                /*
+                 * If there is deferred error attention, do not check for any
+                 * interrupt.
+                 */
+                if (unlikely(phba->hba_flag & DEFER_ERATT)) {
+                        spin_unlock_irq(&phba->hbalock);
+                        return IRQ_NONE;
+                }
+
                 /* Clear up only attention source related to slow-path */
                 writel((ha_copy & (HA_MBATT | HA_R2_CLR_MSK)),
                         phba->HAregaddr);
@@ -5309,8 +5346,22 @@ lpfc_sp_intr_handler(int irq, void *dev_id)
                         }
                 }
                 spin_lock_irqsave(&phba->hbalock, iflag);
-                if (work_ha_copy & HA_ERATT)
+                if (work_ha_copy & HA_ERATT) {
                         lpfc_sli_read_hs(phba);
+                        /*
+                         * Check if there is a deferred error condition
+                         * is active
+                         */
+                        if ((HS_FFER1 & phba->work_hs) &&
+                                ((HS_FFER2 | HS_FFER3 | HS_FFER4 | HS_FFER5 |
+                                HS_FFER6 | HS_FFER7) & phba->work_hs)) {
+                                phba->hba_flag |= DEFER_ERATT;
+                                /* Clear all interrupt enable conditions */
+                                writel(0, phba->HCregaddr);
+                                readl(phba->HCregaddr);
+                        }
+                }
+
                 if ((work_ha_copy & HA_MBATT) && (phba->sli.mbox_active)) {
                         pmb = phba->sli.mbox_active;
                         pmbox = &pmb->mb;
@@ -5423,7 +5474,7 @@ send_current_mbox:
 } /* lpfc_sp_intr_handler */
 
 /**
- * lpfc_fp_intr_handler: The fast-path interrupt handler of lpfc driver.
+ * lpfc_fp_intr_handler - The fast-path interrupt handler of lpfc driver
  * @irq: Interrupt number.
  * @dev_id: The device context pointer.
  *
@@ -5474,6 +5525,14 @@ lpfc_fp_intr_handler(int irq, void *dev_id)
                 ha_copy = readl(phba->HAregaddr);
                 /* Clear up only attention source related to fast-path */
                 spin_lock_irqsave(&phba->hbalock, iflag);
+                /*
+                 * If there is deferred error attention, do not check for
+                 * any interrupt.
+                 */
+                if (unlikely(phba->hba_flag & DEFER_ERATT)) {
+                        spin_unlock_irq(&phba->hbalock);
+                        return IRQ_NONE;
+                }
                 writel((ha_copy & (HA_R0_CLR_MSK | HA_R1_CLR_MSK)),
                         phba->HAregaddr);
                 readl(phba->HAregaddr); /* flush */
@@ -5510,7 +5569,7 @@ lpfc_fp_intr_handler(int irq, void *dev_id)
 }  /* lpfc_fp_intr_handler */
 
 /**
- * lpfc_intr_handler: The device-level interrupt handler of lpfc driver.
+ * lpfc_intr_handler - The device-level interrupt handler of lpfc driver
  * @irq: Interrupt number.
  * @dev_id: The device context pointer.
  *
@@ -5566,6 +5625,14 @@ lpfc_intr_handler(int irq, void *dev_id)
                         phba->hba_flag |= HBA_ERATT_HANDLED;
         }
 
+        /*
+         * If there is deferred error attention, do not check for any interrupt.
+         */
+        if (unlikely(phba->hba_flag & DEFER_ERATT)) {
+                spin_unlock_irq(&phba->hbalock);
+                return IRQ_NONE;
+        }
+
         /* Clear attention sources except link and error attentions */
         writel((phba->ha_copy & ~(HA_LATT | HA_ERATT)), phba->HAregaddr);
         readl(phba->HAregaddr); /* flush */
diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h
index 7e32e95c539..e599519e307 100644
--- a/drivers/scsi/lpfc/lpfc_version.h
+++ b/drivers/scsi/lpfc/lpfc_version.h
@@ -1,7 +1,7 @@
 /*******************************************************************
  * This file is part of the Emulex Linux Device Driver for         *
  * Fibre Channel Host Bus Adapters.                                *
- * Copyright (C) 2004-2008 Emulex.  All rights reserved.           *
+ * Copyright (C) 2004-2009 Emulex.  All rights reserved.           *
  * EMULEX and SLI are trademarks of Emulex.                        *
  * www.emulex.com                                                  *
  *                                                                 *
@@ -18,7 +18,7 @@
  * included with this package.                                     *
  *******************************************************************/
 
-#define LPFC_DRIVER_VERSION "8.3.0"
+#define LPFC_DRIVER_VERSION "8.3.1"
 
 #define LPFC_DRIVER_NAME                "lpfc"
 #define LPFC_SP_DRIVER_HANDLER_NAME     "lpfc:sp"
@@ -26,4 +26,4 @@
 
 #define LPFC_MODULE_DESC "Emulex LightPulse Fibre Channel SCSI driver " \
                 LPFC_DRIVER_VERSION
-#define LPFC_COPYRIGHT "Copyright(c) 2004-2008 Emulex.  All rights reserved."
+#define LPFC_COPYRIGHT "Copyright(c) 2004-2009 Emulex.  All rights reserved."
diff --git a/drivers/scsi/lpfc/lpfc_vport.c b/drivers/scsi/lpfc/lpfc_vport.c
index 63b54c66756..917ad56b0af 100644
--- a/drivers/scsi/lpfc/lpfc_vport.c
+++ b/drivers/scsi/lpfc/lpfc_vport.c
@@ -206,7 +206,7 @@ lpfc_unique_wwpn(struct lpfc_hba *phba, struct lpfc_vport *new_vport)
 }
 
 /**
- * lpfc_discovery_wait: Wait for driver discovery to quiesce.
+ * lpfc_discovery_wait - Wait for driver discovery to quiesce
  * @vport: The virtual port for which this call is being executed.
  *
  * This driver calls this routine specifically from lpfc_vport_delete
@@ -741,7 +741,7 @@ lpfc_destroy_vport_work_array(struct lpfc_hba *phba, struct lpfc_vport **vports)
 
 
 /**
- * lpfc_vport_reset_stat_data: Reset the statistical data for the vport.
+ * lpfc_vport_reset_stat_data - Reset the statistical data for the vport
  * @vport: Pointer to vport object.
  *
  * This function resets the statistical data for the vport. This function
@@ -763,8 +763,7 @@ lpfc_vport_reset_stat_data(struct lpfc_vport *vport)
 
 
 /**
- * lpfc_alloc_bucket: Allocate data buffer required for collecting
- *  statistical data.
+ * lpfc_alloc_bucket - Allocate data buffer required for statistical data
  * @vport: Pointer to vport object.
  *
  * This function allocates data buffer required for all the FC
@@ -797,8 +796,7 @@ lpfc_alloc_bucket(struct lpfc_vport *vport)
 }
 
 /**
- * lpfc_free_bucket: Free data buffer required for collecting
- *  statistical data.
+ * lpfc_free_bucket - Free data buffer required for statistical data
  * @vport: Pointer to vport object.
  *
  * Th function frees statistical data buffer of all the FC
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index a91f5143cea..f3da592f7bc 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -636,6 +636,14 @@ _base_unmask_interrupts(struct MPT2SAS_ADAPTER *ioc)
 static irqreturn_t
 _base_interrupt(int irq, void *bus_id)
 {
+        union reply_descriptor {
+                u64 word;
+                struct {
+                        u32 low;
+                        u32 high;
+                } u;
+        };
+        union reply_descriptor rd;
         u32 post_index, post_index_next, completed_cmds;
         u8 request_desript_type;
         u16 smid;
@@ -656,7 +664,8 @@ _base_interrupt(int irq, void *bus_id)
 
         completed_cmds = 0;
         do {
-                if (ioc->reply_post_free[post_index].Words == ~0ULL)
+                rd.word = ioc->reply_post_free[post_index].Words;
+                if (rd.u.low == UINT_MAX || rd.u.high == UINT_MAX)
                         goto out;
                 reply = 0;
                 cb_idx = 0xFF;
@@ -721,7 +730,7 @@ _base_interrupt(int irq, void *bus_id)
         for (i = 0 ; i < completed_cmds; i++) {
                 post_index = post_index_next;
                 /* poison the reply post descriptor */
-                ioc->reply_post_free[post_index_next].Words = ~0ULL;
+                ioc->reply_post_free[post_index_next].Words = ULLONG_MAX;
                 post_index_next = (post_index ==
                     (ioc->reply_post_queue_depth - 1))
                     ? 0 : post_index + 1;
@@ -1387,6 +1396,64 @@ mpt2sas_base_put_smid_target_assist(struct MPT2SAS_ADAPTER *ioc, u16 smid,
 }
 
 /**
+ * _base_display_dell_branding - Disply branding string
+ * @ioc: per adapter object
+ *
+ * Return nothing.
+ */
+static void
+_base_display_dell_branding(struct MPT2SAS_ADAPTER *ioc)
+{
+        char dell_branding[MPT2SAS_DELL_BRANDING_SIZE];
+
+        if (ioc->pdev->subsystem_vendor != PCI_VENDOR_ID_DELL)
+                return;
+
+        memset(dell_branding, 0, MPT2SAS_DELL_BRANDING_SIZE);
+        switch (ioc->pdev->subsystem_device) {
+        case MPT2SAS_DELL_6GBPS_SAS_HBA_SSDID:
+                strncpy(dell_branding, MPT2SAS_DELL_6GBPS_SAS_HBA_BRANDING,
+                    MPT2SAS_DELL_BRANDING_SIZE - 1);
+                break;
+        case MPT2SAS_DELL_PERC_H200_ADAPTER_SSDID:
+                strncpy(dell_branding, MPT2SAS_DELL_PERC_H200_ADAPTER_BRANDING,
+                    MPT2SAS_DELL_BRANDING_SIZE - 1);
+                break;
+        case MPT2SAS_DELL_PERC_H200_INTEGRATED_SSDID:
+                strncpy(dell_branding,
+                    MPT2SAS_DELL_PERC_H200_INTEGRATED_BRANDING,
+                    MPT2SAS_DELL_BRANDING_SIZE - 1);
+                break;
+        case MPT2SAS_DELL_PERC_H200_MODULAR_SSDID:
+                strncpy(dell_branding,
+                    MPT2SAS_DELL_PERC_H200_MODULAR_BRANDING,
+                    MPT2SAS_DELL_BRANDING_SIZE - 1);
+                break;
+        case MPT2SAS_DELL_PERC_H200_EMBEDDED_SSDID:
+                strncpy(dell_branding,
+                    MPT2SAS_DELL_PERC_H200_EMBEDDED_BRANDING,
+                    MPT2SAS_DELL_BRANDING_SIZE - 1);
+                break;
+        case MPT2SAS_DELL_PERC_H200_SSDID:
+                strncpy(dell_branding, MPT2SAS_DELL_PERC_H200_BRANDING,
+                    MPT2SAS_DELL_BRANDING_SIZE - 1);
+                break;
+        case MPT2SAS_DELL_6GBPS_SAS_SSDID:
+                strncpy(dell_branding, MPT2SAS_DELL_6GBPS_SAS_BRANDING,
+                    MPT2SAS_DELL_BRANDING_SIZE - 1);
+                break;
+        default:
+                sprintf(dell_branding, "0x%4X", ioc->pdev->subsystem_device);
+                break;
+        }
+
+        printk(MPT2SAS_INFO_FMT "%s: Vendor(0x%04X), Device(0x%04X),"
+            " SSVID(0x%04X), SSDID(0x%04X)\n", ioc->name, dell_branding,
+            ioc->pdev->vendor, ioc->pdev->device, ioc->pdev->subsystem_vendor,
+            ioc->pdev->subsystem_device);
+}
+
+/**
  * _base_display_ioc_capabilities - Disply IOC's capabilities.
  * @ioc: per adapter object
  *
@@ -1427,6 +1494,8 @@ _base_display_ioc_capabilities(struct MPT2SAS_ADAPTER *ioc)
                 i++;
         }
 
+        _base_display_dell_branding(ioc);
+
         i = 0;
         printk("), ");
         printk("Capabilities=(");
@@ -3068,7 +3137,7 @@ _base_make_ioc_operational(struct MPT2SAS_ADAPTER *ioc, u8 VF_ID,
 
         /* initialize Reply Post Free Queue */
         for (i = 0; i < ioc->reply_post_queue_depth; i++)
-                ioc->reply_post_free[i].Words = ~0ULL;
+                ioc->reply_post_free[i].Words = ULLONG_MAX;
 
         r = _base_send_ioc_init(ioc, VF_ID, sleep_flag);
         if (r)
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.h b/drivers/scsi/mpt2sas/mpt2sas_base.h
index 6945ff4d382..babd4cc0cb2 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.h
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.h
@@ -68,11 +68,11 @@
 #define MPT2SAS_DRIVER_NAME             "mpt2sas"
 #define MPT2SAS_AUTHOR  "LSI Corporation <DL-MPTFusionLinux@lsi.com>"
 #define MPT2SAS_DESCRIPTION     "LSI MPT Fusion SAS 2.0 Device Driver"
-#define MPT2SAS_DRIVER_VERSION          "00.100.11.16"
+#define MPT2SAS_DRIVER_VERSION          "01.100.02.00"
 #define MPT2SAS_MAJOR_VERSION           00
 #define MPT2SAS_MINOR_VERSION           100
-#define MPT2SAS_BUILD_VERSION           11
-#define MPT2SAS_RELEASE_VERSION         16
+#define MPT2SAS_BUILD_VERSION           02
+#define MPT2SAS_RELEASE_VERSION         00
 
 /*
  * Set MPT2SAS_SG_DEPTH value based on user input.
@@ -130,6 +130,30 @@
 #define MPT2SAS_ERR_FMT                 KERN_ERR MPT2SAS_FMT
 
 /*
+ * Dell HBA branding
+ */
+#define MPT2SAS_DELL_BRANDING_SIZE                 32
+
+#define MPT2SAS_DELL_6GBPS_SAS_HBA_BRANDING        "Dell 6Gbps SAS HBA"
+#define MPT2SAS_DELL_PERC_H200_ADAPTER_BRANDING    "Dell PERC H200 Adapter"
+#define MPT2SAS_DELL_PERC_H200_INTEGRATED_BRANDING "Dell PERC H200 Integrated"
+#define MPT2SAS_DELL_PERC_H200_MODULAR_BRANDING    "Dell PERC H200 Modular"
+#define MPT2SAS_DELL_PERC_H200_EMBEDDED_BRANDING   "Dell PERC H200 Embedded"
+#define MPT2SAS_DELL_PERC_H200_BRANDING            "Dell PERC H200"
+#define MPT2SAS_DELL_6GBPS_SAS_BRANDING            "Dell 6Gbps SAS"
+
+/*
+ * Dell HBA SSDIDs
+ */
+#define MPT2SAS_DELL_6GBPS_SAS_HBA_SSDID           0x1F1C
+#define MPT2SAS_DELL_PERC_H200_ADAPTER_SSDID       0x1F1D
+#define MPT2SAS_DELL_PERC_H200_INTEGRATED_SSDID    0x1F1E
+#define MPT2SAS_DELL_PERC_H200_MODULAR_SSDID       0x1F1F
+#define MPT2SAS_DELL_PERC_H200_EMBEDDED_SSDID      0x1F20
+#define MPT2SAS_DELL_PERC_H200_SSDID               0x1F21
+#define MPT2SAS_DELL_6GBPS_SAS_SSDID               0x1F22
+
+/*
  * per target private data
  */
 #define MPT_TARGET_FLAGS_RAID_COMPONENT 0x01
diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
index 2d4f85c9d7a..ba6ab170bdf 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
@@ -64,6 +64,9 @@
 static struct fasync_struct *async_queue;
 static DECLARE_WAIT_QUEUE_HEAD(ctl_poll_wait);
 
+static int _ctl_send_release(struct MPT2SAS_ADAPTER *ioc, u8 buffer_type,
+    u8 *issue_reset);
+
 /**
  * enum block_state - blocking state
  * @NON_BLOCKING: non blocking
@@ -378,10 +381,22 @@ _ctl_verify_adapter(int ioc_number, struct MPT2SAS_ADAPTER **iocpp)
 void
 mpt2sas_ctl_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase)
 {
+        int i;
+        u8 issue_reset;
+
         switch (reset_phase) {
         case MPT2_IOC_PRE_RESET:
                 dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
                     "MPT2_IOC_PRE_RESET\n", ioc->name, __func__));
+                for (i = 0; i < MPI2_DIAG_BUF_TYPE_COUNT; i++) {
+                        if (!(ioc->diag_buffer_status[i] &
+                            MPT2_DIAG_BUFFER_IS_REGISTERED))
+                                continue;
+                        if ((ioc->diag_buffer_status[i] &
+                            MPT2_DIAG_BUFFER_IS_RELEASED))
+                                continue;
+                        _ctl_send_release(ioc, i, &issue_reset);
+                }
                 break;
         case MPT2_IOC_AFTER_RESET:
                 dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
@@ -395,6 +410,17 @@ mpt2sas_ctl_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase)
         case MPT2_IOC_DONE_RESET:
                 dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
                     "MPT2_IOC_DONE_RESET\n", ioc->name, __func__));
+
+                for (i = 0; i < MPI2_DIAG_BUF_TYPE_COUNT; i++) {
+                        if (!(ioc->diag_buffer_status[i] &
+                            MPT2_DIAG_BUFFER_IS_REGISTERED))
+                                continue;
+                        if ((ioc->diag_buffer_status[i] &
+                            MPT2_DIAG_BUFFER_IS_RELEASED))
+                                continue;
+                        ioc->diag_buffer_status[i] |=
+                            MPT2_DIAG_BUFFER_IS_DIAG_RESET;
+                }
                 break;
         }
 }
@@ -714,8 +740,10 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
 
                 if (tm_request->TaskType ==
                     MPI2_SCSITASKMGMT_TASKTYPE_ABORT_TASK) {
-                        if (_ctl_do_task_abort(ioc, &karg, tm_request))
+                        if (_ctl_do_task_abort(ioc, &karg, tm_request)) {
+                                mpt2sas_base_free_smid(ioc, smid);
                                 goto out;
+                        }
                 }
 
                 mutex_lock(&ioc->tm_cmds.mutex);
@@ -915,9 +943,9 @@ _ctl_getiocinfo(void __user *arg)
         karg.pci_information.u.bits.function = PCI_FUNC(ioc->pdev->devfn);
         karg.pci_information.segment_id = pci_domain_nr(ioc->pdev->bus);
         karg.firmware_version = ioc->facts.FWVersion.Word;
-        strncpy(karg.driver_version, MPT2SAS_DRIVER_VERSION,
-            MPT2_IOCTL_VERSION_LENGTH);
-        karg.driver_version[MPT2_IOCTL_VERSION_LENGTH - 1] = '\0';
+        strcpy(karg.driver_version, MPT2SAS_DRIVER_NAME);
+        strcat(karg.driver_version, "-");
+        strcat(karg.driver_version, MPT2SAS_DRIVER_VERSION);
         karg.bios_version = le32_to_cpu(ioc->bios_pg3.BiosVersion);
 
         if (copy_to_user(arg, &karg, sizeof(karg))) {
@@ -1551,81 +1579,38 @@ _ctl_diag_query(void __user *arg)
 }
 
 /**
- * _ctl_diag_release - request to send Diag Release Message to firmware
- * @arg - user space buffer containing ioctl content
- * @state - NON_BLOCKING or BLOCKING
+ * _ctl_send_release - Diag Release Message
+ * @ioc: per adapter object
+ * @buffer_type - specifies either TRACE or SNAPSHOT
+ * @issue_reset - specifies whether host reset is required.
  *
- * This allows ownership of the specified buffer to returned to the driver,
- * allowing an application to read the buffer without fear that firmware is
- * overwritting information in the buffer.
  */
-static long
-_ctl_diag_release(void __user *arg, enum block_state state)
+static int
+_ctl_send_release(struct MPT2SAS_ADAPTER *ioc, u8 buffer_type, u8 *issue_reset)
 {
-        struct mpt2_diag_release karg;
-        struct MPT2SAS_ADAPTER *ioc;
-        void *request_data;
-        int rc;
         Mpi2DiagReleaseRequest_t *mpi_request;
         Mpi2DiagReleaseReply_t *mpi_reply;
-        u8 buffer_type;
-        unsigned long timeleft;
         u16 smid;
         u16 ioc_status;
-        u8 issue_reset = 0;
-
-        if (copy_from_user(&karg, arg, sizeof(karg))) {
-                printk(KERN_ERR "failure at %s:%d/%s()!\n",
-                    __FILE__, __LINE__, __func__);
-                return -EFAULT;
-        }
-        if (_ctl_verify_adapter(karg.hdr.ioc_number, &ioc) == -1 || !ioc)
-                return -ENODEV;
+        u32 ioc_state;
+        int rc;
+        unsigned long timeleft;
 
         dctlprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s\n", ioc->name,
             __func__));
 
-        buffer_type = karg.unique_id & 0x000000ff;
-        if (!_ctl_diag_capability(ioc, buffer_type)) {
-                printk(MPT2SAS_ERR_FMT "%s: doesn't have capability for "
-                    "buffer_type(0x%02x)\n", ioc->name, __func__, buffer_type);
-                return -EPERM;
-        }
-
-        if ((ioc->diag_buffer_status[buffer_type] &
-            MPT2_DIAG_BUFFER_IS_REGISTERED) == 0) {
-                printk(MPT2SAS_ERR_FMT "%s: buffer_type(0x%02x) is not "
-                    "registered\n", ioc->name, __func__, buffer_type);
-                return -EINVAL;
-        }
-
-        if (karg.unique_id != ioc->unique_id[buffer_type]) {
-                printk(MPT2SAS_ERR_FMT "%s: unique_id(0x%08x) is not "
-                    "registered\n", ioc->name, __func__, karg.unique_id);
-                return -EINVAL;
-        }
-
-        if (ioc->diag_buffer_status[buffer_type] &
-            MPT2_DIAG_BUFFER_IS_RELEASED) {
-                printk(MPT2SAS_ERR_FMT "%s: buffer_type(0x%02x) "
-                    "is already released\n", ioc->name, __func__,
-                    buffer_type);
-                return 0;
-        }
-
-        request_data = ioc->diag_buffer[buffer_type];
+        rc = 0;
+        *issue_reset = 0;
 
-        if (!request_data) {
-                printk(MPT2SAS_ERR_FMT "%s: doesn't have memory allocated for "
-                    "buffer_type(0x%02x)\n", ioc->name, __func__, buffer_type);
-                return -ENOMEM;
+        ioc_state = mpt2sas_base_get_iocstate(ioc, 1);
+        if (ioc_state != MPI2_IOC_STATE_OPERATIONAL) {
+                dctlprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
+                    "skipping due to FAULT state\n", ioc->name,
+                    __func__));
+                rc = -EAGAIN;
+                goto out;
         }
 
-        if (state == NON_BLOCKING && !mutex_trylock(&ioc->ctl_cmds.mutex))
-                return -EAGAIN;
-        else if (mutex_lock_interruptible(&ioc->ctl_cmds.mutex))
-                return -ERESTARTSYS;
-
         if (ioc->ctl_cmds.status != MPT2_CMD_NOT_USED) {
                 printk(MPT2SAS_ERR_FMT "%s: ctl_cmd in use\n",
                     ioc->name, __func__);
@@ -1641,7 +1626,6 @@ _ctl_diag_release(void __user *arg, enum block_state state)
                 goto out;
         }
 
-        rc = 0;
         ioc->ctl_cmds.status = MPT2_CMD_PENDING;
         memset(ioc->ctl_cmds.reply, 0, ioc->reply_sz);
         mpi_request = mpt2sas_base_get_msg_frame(ioc, smid);
@@ -1660,8 +1644,9 @@ _ctl_diag_release(void __user *arg, enum block_state state)
                 _debug_dump_mf(mpi_request,
                     sizeof(Mpi2DiagReleaseRequest_t)/4);
                 if (!(ioc->ctl_cmds.status & MPT2_CMD_RESET))
-                        issue_reset = 1;
-                goto issue_host_reset;
+                        *issue_reset = 1;
+                rc = -EFAULT;
+                goto out;
         }
 
         /* process the completed Reply Message Frame */
@@ -1687,14 +1672,101 @@ _ctl_diag_release(void __user *arg, enum block_state state)
                 rc = -EFAULT;
         }
 
- issue_host_reset:
+ out:
+        ioc->ctl_cmds.status = MPT2_CMD_NOT_USED;
+        return rc;
+}
+
+/**
+ * _ctl_diag_release - request to send Diag Release Message to firmware
+ * @arg - user space buffer containing ioctl content
+ * @state - NON_BLOCKING or BLOCKING
+ *
+ * This allows ownership of the specified buffer to returned to the driver,
+ * allowing an application to read the buffer without fear that firmware is
+ * overwritting information in the buffer.
+ */
+static long
+_ctl_diag_release(void __user *arg, enum block_state state)
+{
+        struct mpt2_diag_release karg;
+        struct MPT2SAS_ADAPTER *ioc;
+        void *request_data;
+        int rc;
+        u8 buffer_type;
+        u8 issue_reset = 0;
+
+        if (copy_from_user(&karg, arg, sizeof(karg))) {
+                printk(KERN_ERR "failure at %s:%d/%s()!\n",
+                    __FILE__, __LINE__, __func__);
+                return -EFAULT;
+        }
+        if (_ctl_verify_adapter(karg.hdr.ioc_number, &ioc) == -1 || !ioc)
+                return -ENODEV;
+
+        dctlprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s\n", ioc->name,
+            __func__));
+
+        buffer_type = karg.unique_id & 0x000000ff;
+        if (!_ctl_diag_capability(ioc, buffer_type)) {
+                printk(MPT2SAS_ERR_FMT "%s: doesn't have capability for "
+                    "buffer_type(0x%02x)\n", ioc->name, __func__, buffer_type);
+                return -EPERM;
+        }
+
+        if ((ioc->diag_buffer_status[buffer_type] &
+            MPT2_DIAG_BUFFER_IS_REGISTERED) == 0) {
+                printk(MPT2SAS_ERR_FMT "%s: buffer_type(0x%02x) is not "
+                    "registered\n", ioc->name, __func__, buffer_type);
+                return -EINVAL;
+        }
+
+        if (karg.unique_id != ioc->unique_id[buffer_type]) {
+                printk(MPT2SAS_ERR_FMT "%s: unique_id(0x%08x) is not "
+                    "registered\n", ioc->name, __func__, karg.unique_id);
+                return -EINVAL;
+        }
+
+        if (ioc->diag_buffer_status[buffer_type] &
+            MPT2_DIAG_BUFFER_IS_RELEASED) {
+                printk(MPT2SAS_ERR_FMT "%s: buffer_type(0x%02x) "
+                    "is already released\n", ioc->name, __func__,
+                    buffer_type);
+                return 0;
+        }
+
+        request_data = ioc->diag_buffer[buffer_type];
+
+        if (!request_data) {
+                printk(MPT2SAS_ERR_FMT "%s: doesn't have memory allocated for "
+                    "buffer_type(0x%02x)\n", ioc->name, __func__, buffer_type);
+                return -ENOMEM;
+        }
+
+        /* buffers were released by due to host reset */
+        if ((ioc->diag_buffer_status[buffer_type] &
+            MPT2_DIAG_BUFFER_IS_DIAG_RESET)) {
+                ioc->diag_buffer_status[buffer_type] |=
+                    MPT2_DIAG_BUFFER_IS_RELEASED;
+                ioc->diag_buffer_status[buffer_type] &=
+                    ~MPT2_DIAG_BUFFER_IS_DIAG_RESET;
+                printk(MPT2SAS_ERR_FMT "%s: buffer_type(0x%02x) "
+                    "was released due to host reset\n", ioc->name, __func__,
+                    buffer_type);
+                return 0;
+        }
+
+        if (state == NON_BLOCKING && !mutex_trylock(&ioc->ctl_cmds.mutex))
+                return -EAGAIN;
+        else if (mutex_lock_interruptible(&ioc->ctl_cmds.mutex))
+                return -ERESTARTSYS;
+
+        rc = _ctl_send_release(ioc, buffer_type, &issue_reset);
+
         if (issue_reset)
                 mpt2sas_base_hard_reset_handler(ioc, CAN_SLEEP,
                     FORCE_BIG_HAMMER);
 
- out:
-
-        ioc->ctl_cmds.status = MPT2_CMD_NOT_USED;
         mutex_unlock(&ioc->ctl_cmds.mutex);
         return rc;
 }
diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.h b/drivers/scsi/mpt2sas/mpt2sas_ctl.h
index dbb6c0cf888..4da11435533 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.h
+++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.h
@@ -50,7 +50,7 @@
 #endif
 
 #define MPT2SAS_DEV_NAME        "mpt2ctl"
-#define MPT2_MAGIC_NUMBER       'm'
+#define MPT2_MAGIC_NUMBER       'L'
 #define MPT2_IOCTL_DEFAULT_TIMEOUT (10) /* in seconds */
 
 /**
@@ -295,8 +295,9 @@ struct mpt2_ioctl_btdh_mapping {
 
 
 /* status bits for ioc->diag_buffer_status */
-#define MPT2_DIAG_BUFFER_IS_REGISTERED  (0x01)
-#define MPT2_DIAG_BUFFER_IS_RELEASED    (0x02)
+#define MPT2_DIAG_BUFFER_IS_REGISTERED  (0x01)
+#define MPT2_DIAG_BUFFER_IS_RELEASED    (0x02)
+#define MPT2_DIAG_BUFFER_IS_DIAG_RESET  (0x04)
 
 /* application flags for mpt2_diag_register, mpt2_diag_query */
 #define MPT2_APP_FLAGS_APP_OWNED        (0x0001)
diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
index 0c463c483c0..e3a7967259e 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -119,7 +119,7 @@ struct sense_info {
  */
 struct fw_event_work {
         struct list_head        list;
-        struct delayed_work     work;
+        struct work_struct      work;
         struct MPT2SAS_ADAPTER *ioc;
         u8                      VF_ID;
         u8                      host_reset_handling;
@@ -516,12 +516,8 @@ _scsih_sas_device_add(struct MPT2SAS_ADAPTER *ioc,
         handle = sas_device->handle;
         parent_handle = sas_device->parent_handle;
         sas_address = sas_device->sas_address;
-        if (!mpt2sas_transport_port_add(ioc, handle, parent_handle)) {
+        if (!mpt2sas_transport_port_add(ioc, handle, parent_handle))
                 _scsih_sas_device_remove(ioc, sas_device);
-        } else if (!sas_device->starget) {
-                mpt2sas_transport_port_remove(ioc, sas_address, parent_handle);
-                _scsih_sas_device_remove(ioc, sas_device);
-        }
 }
 
 /**
@@ -1203,7 +1199,9 @@ scsih_target_destroy(struct scsi_target *starget)
         rphy = dev_to_rphy(starget->dev.parent);
         sas_device = mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
            rphy->identify.sas_address);
-        if (sas_device)
+        if (sas_device && (sas_device->starget == starget) &&
+            (sas_device->id == starget->id) &&
+            (sas_device->channel == starget->channel))
                 sas_device->starget = NULL;
 
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
@@ -2009,8 +2007,8 @@ _scsih_fw_event_add(struct MPT2SAS_ADAPTER *ioc, struct fw_event_work *fw_event)
 
         spin_lock_irqsave(&ioc->fw_event_lock, flags);
         list_add_tail(&fw_event->list, &ioc->fw_event_list);
-        INIT_DELAYED_WORK(&fw_event->work, _firmware_event_work);
-        queue_delayed_work(ioc->firmware_event_thread, &fw_event->work, 1);
+        INIT_WORK(&fw_event->work, _firmware_event_work);
+        queue_work(ioc->firmware_event_thread, &fw_event->work);
         spin_unlock_irqrestore(&ioc->fw_event_lock, flags);
 }
 
@@ -2054,7 +2052,7 @@ _scsih_fw_event_requeue(struct MPT2SAS_ADAPTER *ioc, struct fw_event_work
                 return;
 
         spin_lock_irqsave(&ioc->fw_event_lock, flags);
-        queue_delayed_work(ioc->firmware_event_thread, &fw_event->work, delay);
+        queue_work(ioc->firmware_event_thread, &fw_event->work);
         spin_unlock_irqrestore(&ioc->fw_event_lock, flags);
 }
 
@@ -2863,8 +2861,9 @@ scsih_io_done(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 VF_ID, u32 reply)
                 struct sense_info data;
                 const void *sense_data = mpt2sas_base_get_sense_buffer(ioc,
                     smid);
-                memcpy(scmd->sense_buffer, sense_data,
+                u32 sz = min_t(u32, SCSI_SENSE_BUFFERSIZE,
                     le32_to_cpu(mpi_reply->SenseCount));
+                memcpy(scmd->sense_buffer, sense_data, sz);
                 _scsih_normalize_sense(scmd->sense_buffer, &data);
                 /* failure prediction threshold exceeded */
                 if (data.asc == 0x5D)
@@ -3923,7 +3922,7 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc, u8 VF_ID,
 
                 mpt2sas_scsih_issue_tm(ioc, handle, lun,
                     MPI2_SCSITASKMGMT_TASKTYPE_QUERY_TASK, smid, 30);
-                termination_count += le32_to_cpu(mpi_reply->TerminationCount);
+                ioc->tm_cmds.status = MPT2_CMD_NOT_USED;
 
                 if ((mpi_reply->IOCStatus == MPI2_IOCSTATUS_SUCCESS) &&
                     (mpi_reply->ResponseCode ==
@@ -3933,10 +3932,10 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc, u8 VF_ID,
                         continue;
 
                 mpt2sas_scsih_issue_tm(ioc, handle, lun,
-                    MPI2_SCSITASKMGMT_TASKTYPE_ABRT_TASK_SET, smid, 30);
+                    MPI2_SCSITASKMGMT_TASKTYPE_ABRT_TASK_SET, 0, 30);
+                ioc->tm_cmds.status = MPT2_CMD_NOT_USED;
                 termination_count += le32_to_cpu(mpi_reply->TerminationCount);
         }
-        ioc->tm_cmds.status = MPT2_CMD_NOT_USED;
         ioc->broadcast_aen_busy = 0;
         mutex_unlock(&ioc->tm_cmds.mutex);
 
@@ -4962,7 +4961,7 @@ static void
 _firmware_event_work(struct work_struct *work)
 {
         struct fw_event_work *fw_event = container_of(work,
-            struct fw_event_work, work.work);
+            struct fw_event_work, work);
         unsigned long flags;
         struct MPT2SAS_ADAPTER *ioc = fw_event->ioc;
 
diff --git a/drivers/scsi/osd/osd_initiator.c b/drivers/scsi/osd/osd_initiator.c
index 2a5f0777148..1ce6b24abab 100644
--- a/drivers/scsi/osd/osd_initiator.c
+++ b/drivers/scsi/osd/osd_initiator.c
@@ -205,6 +205,74 @@ static unsigned _osd_req_alist_elem_size(struct osd_request *or, unsigned len)
                 osdv2_attr_list_elem_size(len);
 }
 
+static void _osd_req_alist_elem_encode(struct osd_request *or,
+        void *attr_last, const struct osd_attr *oa)
+{
+        if (osd_req_is_ver1(or)) {
+                struct osdv1_attributes_list_element *attr = attr_last;
+
+                attr->attr_page = cpu_to_be32(oa->attr_page);
+                attr->attr_id = cpu_to_be32(oa->attr_id);
+                attr->attr_bytes = cpu_to_be16(oa->len);
+                memcpy(attr->attr_val, oa->val_ptr, oa->len);
+        } else {
+                struct osdv2_attributes_list_element *attr = attr_last;
+
+                attr->attr_page = cpu_to_be32(oa->attr_page);
+                attr->attr_id = cpu_to_be32(oa->attr_id);
+                attr->attr_bytes = cpu_to_be16(oa->len);
+                memcpy(attr->attr_val, oa->val_ptr, oa->len);
+        }
+}
+
+static int _osd_req_alist_elem_decode(struct osd_request *or,
+        void *cur_p, struct osd_attr *oa, unsigned max_bytes)
+{
+        unsigned inc;
+        if (osd_req_is_ver1(or)) {
+                struct osdv1_attributes_list_element *attr = cur_p;
+
+                if (max_bytes < sizeof(*attr))
+                        return -1;
+
+                oa->len = be16_to_cpu(attr->attr_bytes);
+                inc = _osd_req_alist_elem_size(or, oa->len);
+                if (inc > max_bytes)
+                        return -1;
+
+                oa->attr_page = be32_to_cpu(attr->attr_page);
+                oa->attr_id = be32_to_cpu(attr->attr_id);
+
+                /* OSD1: On empty attributes we return a pointer to 2 bytes
+                 * of zeros. This keeps similar behaviour with OSD2.
+                 * (See below)
+                 */
+                oa->val_ptr = likely(oa->len) ? attr->attr_val :
+                                                (u8 *)&attr->attr_bytes;
+        } else {
+                struct osdv2_attributes_list_element *attr = cur_p;
+
+                if (max_bytes < sizeof(*attr))
+                        return -1;
+
+                oa->len = be16_to_cpu(attr->attr_bytes);
+                inc = _osd_req_alist_elem_size(or, oa->len);
+                if (inc > max_bytes)
+                        return -1;
+
+                oa->attr_page = be32_to_cpu(attr->attr_page);
+                oa->attr_id = be32_to_cpu(attr->attr_id);
+
+                /* OSD2: For convenience, on empty attributes, we return 8 bytes
+                 * of zeros here. This keeps the same behaviour with OSD2r04,
+                 * and is nice with null terminating ASCII fields.
+                 * oa->val_ptr == NULL marks the end-of-list, or error.
+                 */
+                oa->val_ptr = likely(oa->len) ? attr->attr_val : attr->reserved;
+        }
+        return inc;
+}
+
 static unsigned _osd_req_alist_size(struct osd_request *or, void *list_head)
 {
         return osd_req_is_ver1(or) ?
@@ -282,9 +350,9 @@ _osd_req_sec_params(struct osd_request *or)
         struct osd_cdb *ocdb = &or->cdb;
 
         if (osd_req_is_ver1(or))
-                return &ocdb->v1.sec_params;
+                return (struct osd_security_parameters *)&ocdb->v1.sec_params;
         else
-                return &ocdb->v2.sec_params;
+                return (struct osd_security_parameters *)&ocdb->v2.sec_params;
 }
 
 void osd_dev_init(struct osd_dev *osdd, struct scsi_device *scsi_device)
@@ -612,9 +680,9 @@ static int _osd_req_list_objects(struct osd_request *or,
 
         WARN_ON(or->in.bio);
         bio = bio_map_kern(q, list, len, or->alloc_flags);
-        if (!bio) {
+        if (IS_ERR(bio)) {
                 OSD_ERR("!!! Failed to allocate list_objects BIO\n");
-                return -ENOMEM;
+                return PTR_ERR(bio);
         }
 
         bio->bi_rw &= ~(1 << BIO_RW);
@@ -798,7 +866,6 @@ int osd_req_add_set_attr_list(struct osd_request *or,
         attr_last = or->set_attr.buff + total_bytes;
 
         for (; nelem; --nelem) {
-                struct osd_attributes_list_element *attr;
                 unsigned elem_size = _osd_req_alist_elem_size(or, oa->len);
 
                 total_bytes += elem_size;
@@ -811,11 +878,7 @@ int osd_req_add_set_attr_list(struct osd_request *or,
                                 or->set_attr.buff + or->set_attr.total_bytes;
                 }
 
-                attr = attr_last;
-                attr->attr_page = cpu_to_be32(oa->attr_page);
-                attr->attr_id = cpu_to_be32(oa->attr_id);
-                attr->attr_bytes = cpu_to_be16(oa->len);
-                memcpy(attr->attr_val, oa->val_ptr, oa->len);
+                _osd_req_alist_elem_encode(or, attr_last, oa);
 
                 attr_last += elem_size;
                 ++oa;
@@ -1070,15 +1133,10 @@ int osd_req_decode_get_attr_list(struct osd_request *or,
         }
 
         for (n = 0; (n < *nelem) && (cur_bytes < returned_bytes); ++n) {
-                struct osd_attributes_list_element *attr = cur_p;
-                unsigned inc;
+                int inc = _osd_req_alist_elem_decode(or, cur_p, oa,
+                                                 returned_bytes - cur_bytes);
 
-                oa->len = be16_to_cpu(attr->attr_bytes);
-                inc = _osd_req_alist_elem_size(or, oa->len);
-                OSD_DEBUG("oa->len=%d inc=%d cur_bytes=%d\n",
-                          oa->len, inc, cur_bytes);
-                cur_bytes += inc;
-                if (cur_bytes > returned_bytes) {
+                if (inc < 0) {
                         OSD_ERR("BAD FOOD from target. list not valid!"
                                 "c=%d r=%d n=%d\n",
                                 cur_bytes, returned_bytes, n);
@@ -1086,10 +1144,7 @@ int osd_req_decode_get_attr_list(struct osd_request *or,
                         break;
                 }
 
-                oa->attr_page = be32_to_cpu(attr->attr_page);
-                oa->attr_id = be32_to_cpu(attr->attr_id);
-                oa->val_ptr = attr->attr_val;
-
+                cur_bytes += inc;
                 cur_p += inc;
                 ++oa;
         }
@@ -1159,6 +1214,24 @@ static int _osd_req_finalize_attr_page(struct osd_request *or)
         return ret;
 }
 
+static inline void osd_sec_parms_set_out_offset(bool is_v1,
+        struct osd_security_parameters *sec_parms, osd_cdb_offset offset)
+{
+        if (is_v1)
+                sec_parms->v1.data_out_integrity_check_offset = offset;
+        else
+                sec_parms->v2.data_out_integrity_check_offset = offset;
+}
+
+static inline void osd_sec_parms_set_in_offset(bool is_v1,
+        struct osd_security_parameters *sec_parms, osd_cdb_offset offset)
+{
+        if (is_v1)
+                sec_parms->v1.data_in_integrity_check_offset = offset;
+        else
+                sec_parms->v2.data_in_integrity_check_offset = offset;
+}
+
 static int _osd_req_finalize_data_integrity(struct osd_request *or,
         bool has_in, bool has_out, const u8 *cap_key)
 {
@@ -1182,8 +1255,8 @@ static int _osd_req_finalize_data_integrity(struct osd_request *or,
                 or->out_data_integ.get_attributes_bytes = cpu_to_be64(
                         or->enc_get_attr.total_bytes);
 
-                sec_parms->data_out_integrity_check_offset =
-                        osd_req_encode_offset(or, or->out.total_bytes, &pad);
+                osd_sec_parms_set_out_offset(osd_req_is_ver1(or), sec_parms,
+                        osd_req_encode_offset(or, or->out.total_bytes, &pad));
 
                 ret = _req_append_segment(or, pad, &seg, or->out.last_seg,
                                           &or->out);
@@ -1203,8 +1276,8 @@ static int _osd_req_finalize_data_integrity(struct osd_request *or,
                 };
                 unsigned pad;
 
-                sec_parms->data_in_integrity_check_offset =
-                        osd_req_encode_offset(or, or->in.total_bytes, &pad);
+                osd_sec_parms_set_in_offset(osd_req_is_ver1(or), sec_parms,
+                        osd_req_encode_offset(or, or->in.total_bytes, &pad));
 
                 ret = _req_append_segment(or, pad, &seg, or->in.last_seg,
                                           &or->in);
diff --git a/drivers/scsi/osd/osd_uld.c b/drivers/scsi/osd/osd_uld.c
index f644c9571ea..22b59e13ba8 100644
--- a/drivers/scsi/osd/osd_uld.c
+++ b/drivers/scsi/osd/osd_uld.c
@@ -173,26 +173,26 @@ static const struct file_operations osd_fops = {
         .unlocked_ioctl = osd_uld_ioctl,
 };
 
-struct osd_dev *osduld_path_lookup(const char *path)
+struct osd_dev *osduld_path_lookup(const char *name)
 {
-        struct nameidata nd;
+        struct path path;
         struct inode *inode;
         struct cdev *cdev;
         struct osd_uld_device *uninitialized_var(oud);
         int error;
 
-        if (!path || !*path) {
+        if (!name || !*name) {
                 OSD_ERR("Mount with !path || !*path\n");
                 return ERR_PTR(-EINVAL);
         }
 
-        error = path_lookup(path, LOOKUP_FOLLOW, &nd);
+        error = kern_path(name, LOOKUP_FOLLOW, &path);
         if (error) {
-                OSD_ERR("path_lookup of %s faild=>%d\n", path, error);
+                OSD_ERR("path_lookup of %s failed=>%d\n", name, error);
                 return ERR_PTR(error);
         }
 
-        inode = nd.path.dentry->d_inode;
+        inode = path.dentry->d_inode;
         error = -EINVAL; /* Not the right device e.g osd_uld_device */
         if (!S_ISCHR(inode->i_mode)) {
                 OSD_DEBUG("!S_ISCHR()\n");
@@ -202,15 +202,15 @@ struct osd_dev *osduld_path_lookup(const char *path)
         cdev = inode->i_cdev;
         if (!cdev) {
                 OSD_ERR("Before mounting an OSD Based filesystem\n");
-                OSD_ERR("  user-mode must open+close the %s device\n", path);
-                OSD_ERR("  Example: bash: echo < %s\n", path);
+                OSD_ERR("  user-mode must open+close the %s device\n", name);
+                OSD_ERR("  Example: bash: echo < %s\n", name);
                 goto out;
         }
 
         /* The Magic wand. Is it our char-dev */
         /* TODO: Support sg devices */
         if (cdev->owner != THIS_MODULE) {
-                OSD_ERR("Error mounting %s - is not an OSD device\n", path);
+                OSD_ERR("Error mounting %s - is not an OSD device\n", name);
                 goto out;
         }
 
@@ -220,7 +220,7 @@ struct osd_dev *osduld_path_lookup(const char *path)
         error = 0;
 
 out:
-        path_put(&nd.path);
+        path_put(&path);
         return error ? ERR_PTR(error) : &oud->od;
 }
 EXPORT_SYMBOL(osduld_path_lookup);
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index d1cb64ad1a3..bb218c8b6e9 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1291,10 +1291,8 @@ static inline int scsi_target_queue_ready(struct Scsi_Host *shost,
                 if (--starget->target_blocked == 0) {
                         SCSI_LOG_MLQUEUE(3, starget_printk(KERN_INFO, starget,
                                          "unblocking target at zero depth\n"));
-                } else {
-                        blk_plug_device(sdev->request_queue);
+                } else
                         return 0;
-                }
         }
 
         if (scsi_target_is_busy(starget)) {
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 3fcb64b91c4..84044233b63 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -50,6 +50,7 @@
 #include <linux/string_helpers.h>
 #include <linux/async.h>
 #include <asm/uaccess.h>
+#include <asm/unaligned.h>
 
 #include <scsi/scsi.h>
 #include <scsi/scsi_cmnd.h>
@@ -1344,12 +1345,8 @@ static int read_capacity_16(struct scsi_disk *sdkp, struct scsi_device *sdp,
                 return -EINVAL;
         }
 
-        sector_size =   (buffer[8] << 24) | (buffer[9] << 16) |
-                        (buffer[10] << 8) | buffer[11];
-        lba =  (((u64)buffer[0] << 56) | ((u64)buffer[1] << 48) |
-                ((u64)buffer[2] << 40) | ((u64)buffer[3] << 32) |
-                ((u64)buffer[4] << 24) | ((u64)buffer[5] << 16) |
-                ((u64)buffer[6] << 8) | (u64)buffer[7]);
+        sector_size = get_unaligned_be32(&buffer[8]);
+        lba = get_unaligned_be64(&buffer[0]);
 
         sd_read_protection_type(sdkp, buffer);
 
@@ -1400,10 +1397,8 @@ static int read_capacity_10(struct scsi_disk *sdkp, struct scsi_device *sdp,
                 return -EINVAL;
         }
 
-        sector_size =   (buffer[4] << 24) | (buffer[5] << 16) |
-                        (buffer[6] << 8) | buffer[7];
-        lba =   (buffer[0] << 24) | (buffer[1] << 16) |
-                (buffer[2] << 8) | buffer[3];
+        sector_size = get_unaligned_be32(&buffer[4]);
+        lba = get_unaligned_be32(&buffer[0]);
 
         if ((sizeof(sdkp->capacity) == 4) && (lba == 0xffffffff)) {
                 sd_printk(KERN_ERR, sdkp, "Too big for this kernel. Use a "
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 82312df9b0b..e1716f14cd4 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -179,7 +179,7 @@ typedef struct sg_device { /* holds the state of each scsi generic device */
 /* tasklet or soft irq callback */
 static void sg_rq_end_io(struct request *rq, int uptodate);
 static int sg_start_req(Sg_request *srp, unsigned char *cmd);
-static void sg_finish_rem_req(Sg_request * srp);
+static int sg_finish_rem_req(Sg_request * srp);
 static int sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size);
 static ssize_t sg_new_read(Sg_fd * sfp, char __user *buf, size_t count,
                            Sg_request * srp);
@@ -518,7 +518,7 @@ sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp)
                 goto err_out;
         }
 err_out:
-        sg_finish_rem_req(srp);
+        err = sg_finish_rem_req(srp);
         return (0 == err) ? count : err;
 }
 
@@ -1696,9 +1696,10 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd)
         return res;
 }
 
-static void
-sg_finish_rem_req(Sg_request * srp)
+static int sg_finish_rem_req(Sg_request * srp)
 {
+        int ret = 0;
+
         Sg_fd *sfp = srp->parentfp;
         Sg_scatter_hold *req_schp = &srp->data;
 
@@ -1710,12 +1711,14 @@ sg_finish_rem_req(Sg_request * srp)
 
         if (srp->rq) {
                 if (srp->bio)
-                        blk_rq_unmap_user(srp->bio);
+                        ret = blk_rq_unmap_user(srp->bio);
 
                 blk_put_request(srp->rq);
         }
 
         sg_remove_request(sfp, srp);
+
+        return ret;
 }
 
 static int
diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c
index d92ff512d21..291236e6e43 100644
--- a/drivers/scsi/sr_ioctl.c
+++ b/drivers/scsi/sr_ioctl.c
@@ -309,6 +309,11 @@ int sr_drive_status(struct cdrom_device_info *cdi, int slot)
         if (0 == sr_test_unit_ready(cd->device, &sshdr))
                 return CDS_DISC_OK;
 
+        /* SK/ASC/ASCQ of 2/4/1 means "unit is becoming ready" */
+        if (scsi_sense_valid(&sshdr) && sshdr.sense_key == NOT_READY
+                        && sshdr.asc == 0x04 && sshdr.ascq == 0x01)
+                return CDS_DRIVE_NOT_READY;
+
         if (!cdrom_get_media_event(cdi, &med)) {
                 if (med.media_present)
                         return CDS_DISC_OK;
diff --git a/drivers/serial/crisv10.c b/drivers/serial/crisv10.c
index 7ba7d70f04d..7be52fe288e 100644
--- a/drivers/serial/crisv10.c
+++ b/drivers/serial/crisv10.c
@@ -23,16 +23,18 @@ static char *serial_version = "$Revision: 1.25 $";
 #include <linux/mm.h>
 #include <linux/slab.h>
 #include <linux/init.h>
-#include <asm/uaccess.h>
 #include <linux/kernel.h>
 #include <linux/mutex.h>
 #include <linux/bitops.h>
+#include <linux/seq_file.h>
+#include <linux/delay.h>
+#include <linux/module.h>
+#include <linux/uaccess.h>
+#include <linux/io.h>
 
-#include <asm/io.h>
 #include <asm/irq.h>
 #include <asm/dma.h>
 #include <asm/system.h>
-#include <linux/delay.h>
 
 #include <arch/svinto.h>
 
@@ -456,7 +458,6 @@ static struct e100_serial rs_table[] = {
 
 #define NR_PORTS (sizeof(rs_table)/sizeof(struct e100_serial))
 
-static struct ktermios *serial_termios[NR_PORTS];
 #ifdef CONFIG_ETRAX_SERIAL_FAST_TIMER
 static struct fast_timer fast_timers[NR_PORTS];
 #endif
@@ -4257,151 +4258,132 @@ rs_open(struct tty_struct *tty, struct file * filp)
         return 0;
 }
 
+#ifdef CONFIG_PROC_FS
 /*
  * /proc fs routines....
  */
 
-static int line_info(char *buf, struct e100_serial *info)
+static void seq_line_info(struct seq_file *m, struct e100_serial *info)
 {
-        char    stat_buf[30];
-        int     ret;
         unsigned long tmp;
 
-        ret = sprintf(buf, "%d: uart:E100 port:%lX irq:%d",
-                      info->line, (unsigned long)info->ioport, info->irq);
+        seq_printf(m, "%d: uart:E100 port:%lX irq:%d",
+                   info->line, (unsigned long)info->ioport, info->irq);
 
         if (!info->ioport || (info->type == PORT_UNKNOWN)) {
-                ret += sprintf(buf+ret, "\n");
-                return ret;
+                seq_printf(m, "\n");
+                return;
         }
 
-        stat_buf[0] = 0;
-        stat_buf[1] = 0;
-        if (!E100_RTS_GET(info))
-                strcat(stat_buf, "|RTS");
-        if (!E100_CTS_GET(info))
-                strcat(stat_buf, "|CTS");
-        if (!E100_DTR_GET(info))
-                strcat(stat_buf, "|DTR");
-        if (!E100_DSR_GET(info))
-                strcat(stat_buf, "|DSR");
-        if (!E100_CD_GET(info))
-                strcat(stat_buf, "|CD");
-        if (!E100_RI_GET(info))
-                strcat(stat_buf, "|RI");
-
-        ret += sprintf(buf+ret, " baud:%d", info->baud);
-
-        ret += sprintf(buf+ret, " tx:%lu rx:%lu",
+        seq_printf(m, " baud:%d", info->baud);
+        seq_printf(m, " tx:%lu rx:%lu",
                        (unsigned long)info->icount.tx,
                        (unsigned long)info->icount.rx);
         tmp = CIRC_CNT(info->xmit.head, info->xmit.tail, SERIAL_XMIT_SIZE);
-        if (tmp) {
-                ret += sprintf(buf+ret, " tx_pend:%lu/%lu",
-                               (unsigned long)tmp,
-                               (unsigned long)SERIAL_XMIT_SIZE);
-        }
+        if (tmp)
+                seq_printf(m, " tx_pend:%lu/%lu",
+                           (unsigned long)tmp,
+                           (unsigned long)SERIAL_XMIT_SIZE);
 
-        ret += sprintf(buf+ret, " rx_pend:%lu/%lu",
-                       (unsigned long)info->recv_cnt,
-                       (unsigned long)info->max_recv_cnt);
+        seq_printf(m, " rx_pend:%lu/%lu",
+                   (unsigned long)info->recv_cnt,
+                   (unsigned long)info->max_recv_cnt);
 
 #if 1
         if (info->port.tty) {
-
                 if (info->port.tty->stopped)
-                        ret += sprintf(buf+ret, " stopped:%i",
-                                       (int)info->port.tty->stopped);
+                        seq_printf(m, " stopped:%i",
+                                   (int)info->port.tty->stopped);
                 if (info->port.tty->hw_stopped)
-                        ret += sprintf(buf+ret, " hw_stopped:%i",
-                                       (int)info->port.tty->hw_stopped);
+                        seq_printf(m, " hw_stopped:%i",
+                                   (int)info->port.tty->hw_stopped);
         }
 
         {
                 unsigned char rstat = info->ioport[REG_STATUS];
-                if (rstat & IO_MASK(R_SERIAL0_STATUS, xoff_detect) )
-                        ret += sprintf(buf+ret, " xoff_detect:1");
+                if (rstat & IO_MASK(R_SERIAL0_STATUS, xoff_detect))
+                        seq_printf(m, " xoff_detect:1");
         }
 
 #endif
 
-
-
-
         if (info->icount.frame)
-                ret += sprintf(buf+ret, " fe:%lu",
-                               (unsigned long)info->icount.frame);
+                seq_printf(m, " fe:%lu", (unsigned long)info->icount.frame);
 
         if (info->icount.parity)
-                ret += sprintf(buf+ret, " pe:%lu",
-                               (unsigned long)info->icount.parity);
+                seq_printf(m, " pe:%lu", (unsigned long)info->icount.parity);
 
         if (info->icount.brk)
-                ret += sprintf(buf+ret, " brk:%lu",
-                               (unsigned long)info->icount.brk);
+                seq_printf(m, " brk:%lu", (unsigned long)info->icount.brk);
 
         if (info->icount.overrun)
-                ret += sprintf(buf+ret, " oe:%lu",
-                               (unsigned long)info->icount.overrun);
+                seq_printf(m, " oe:%lu", (unsigned long)info->icount.overrun);
 
         /*
          * Last thing is the RS-232 status lines
          */
-        ret += sprintf(buf+ret, " %s\n", stat_buf+1);
-        return ret;
+        if (!E100_RTS_GET(info))
+                seq_puts(m, "|RTS");
+        if (!E100_CTS_GET(info))
+                seq_puts(m, "|CTS");
+        if (!E100_DTR_GET(info))
+                seq_puts(m, "|DTR");
+        if (!E100_DSR_GET(info))
+                seq_puts(m, "|DSR");
+        if (!E100_CD_GET(info))
+                seq_puts(m, "|CD");
+        if (!E100_RI_GET(info))
+                seq_puts(m, "|RI");
+        seq_puts(m, "\n");
 }
 
-int rs_read_proc(char *page, char **start, off_t off, int count,
-                 int *eof, void *data)
+
+static int crisv10_proc_show(struct seq_file *m, void *v)
 {
-        int i, len = 0, l;
-        off_t   begin = 0;
+        int i;
 
-        len += sprintf(page, "serinfo:1.0 driver:%s\n",
-                       serial_version);
-        for (i = 0; i < NR_PORTS && len < 4000; i++) {
+        seq_printf(m, "serinfo:1.0 driver:%s\n", serial_version);
+
+        for (i = 0; i < NR_PORTS; i++) {
                 if (!rs_table[i].enabled)
                         continue;
-                l = line_info(page + len, &rs_table[i]);
-                len += l;
-                if (len+begin > off+count)
-                        goto done;
-                if (len+begin < off) {
-                        begin += len;
-                        len = 0;
-                }
+                seq_line_info(m, &rs_table[i]);
         }
 #ifdef DEBUG_LOG_INCLUDED
         for (i = 0; i < debug_log_pos; i++) {
-                len += sprintf(page + len, "%-4i %lu.%lu ", i, debug_log[i].time, timer_data_to_ns(debug_log[i].timer_data));
-                len += sprintf(page + len, debug_log[i].string, debug_log[i].value);
-                if (len+begin > off+count)
-                        goto done;
-                if (len+begin < off) {
-                        begin += len;
-                        len = 0;
-                }
+                seq_printf(m, "%-4i %lu.%lu ",
+                         i, debug_log[i].time,
+                         timer_data_to_ns(debug_log[i].timer_data));
+                seq_printf(m, debug_log[i].string, debug_log[i].value);
         }
-        len += sprintf(page + len, "debug_log %i/%i  %li bytes\n",
-                       i, DEBUG_LOG_SIZE, begin+len);
+        seq_printf(m, "debug_log %i/%i\n", i, DEBUG_LOG_SIZE);
         debug_log_pos = 0;
 #endif
+        return 0;
+}
 
-        *eof = 1;
-done:
-        if (off >= len+begin)
-                return 0;
-        *start = page + (off-begin);
-        return ((count < begin+len-off) ? count : begin+len-off);
+static int crisv10_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, crisv10_proc_show, NULL);
 }
 
+static const struct file_operations crisv10_proc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = crisv10_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+#endif
+
+
 /* Finally, routines used to initialize the serial driver. */
 
-static void
-show_serial_version(void)
+static void show_serial_version(void)
 {
         printk(KERN_INFO
-               "ETRAX 100LX serial-driver %s, (c) 2000-2004 Axis Communications AB\r\n",
+               "ETRAX 100LX serial-driver %s, "
+               "(c) 2000-2004 Axis Communications AB\r\n",
                &serial_version[11]); /* "$Revision: x.yy" */
 }
 
@@ -4425,13 +4407,14 @@ static const struct tty_operations rs_ops = {
         .break_ctl = rs_break,
         .send_xchar = rs_send_xchar,
         .wait_until_sent = rs_wait_until_sent,
-        .read_proc = rs_read_proc,
         .tiocmget = rs_tiocmget,
-        .tiocmset = rs_tiocmset
+        .tiocmset = rs_tiocmset,
+#ifdef CONFIG_PROC_FS
+        .proc_fops = &crisv10_proc_fops,
+#endif
 };
 
-static int __init
-rs_init(void)
+static int __init rs_init(void)
 {
         int i;
         struct e100_serial *info;
diff --git a/drivers/serial/jsm/jsm.h b/drivers/serial/jsm/jsm.h
index 8871aaa3dba..c0a3e2734e2 100644
--- a/drivers/serial/jsm/jsm.h
+++ b/drivers/serial/jsm/jsm.h
@@ -130,8 +130,6 @@ struct jsm_board
         struct pci_dev  *pci_dev;
         u32             maxports;       /* MAX ports this board can handle */
 
-        spinlock_t      bd_lock;        /* Used to protect board */
-
         spinlock_t      bd_intr_lock;   /* Used to protect the poller tasklet and
                                          * the interrupt routine from each other.
                                          */
diff --git a/drivers/serial/jsm/jsm_driver.c b/drivers/serial/jsm/jsm_driver.c
index d2d32a19862..b3604aa322a 100644
--- a/drivers/serial/jsm/jsm_driver.c
+++ b/drivers/serial/jsm/jsm_driver.c
@@ -88,7 +88,6 @@ static int __devinit jsm_probe_one(struct pci_dev *pdev, const struct pci_device
         else
                 brd->maxports = 2;
 
-        spin_lock_init(&brd->bd_lock);
         spin_lock_init(&brd->bd_intr_lock);
 
         /* store which revision we have */
diff --git a/drivers/serial/nwpserial.c b/drivers/serial/nwpserial.c
index 32f3eaf0d26..9e150b19d72 100644
--- a/drivers/serial/nwpserial.c
+++ b/drivers/serial/nwpserial.c
@@ -145,11 +145,13 @@ static irqreturn_t nwpserial_interrupt(int irq, void *dev_id)
                 ch = dcr_read(up->dcr_host, UART_RX);
                 if (up->port.ignore_status_mask != NWPSERIAL_STATUS_RXVALID)
                         tty_insert_flip_char(tty, ch, TTY_NORMAL);
-        } while (dcr_read(up->dcr_host, UART_RX) & UART_LSR_DR);
+        } while (dcr_read(up->dcr_host, UART_LSR) & UART_LSR_DR);
 
         tty_flip_buffer_push(tty);
         ret = IRQ_HANDLED;
 
+        /* clear interrupt */
+        dcr_write(up->dcr_host, UART_IIR, 1);
 out:
         spin_unlock(&up->port.lock);
         return ret;
diff --git a/drivers/serial/s3c6400.c b/drivers/serial/s3c6400.c
index 06936d13393..3e378523368 100644
--- a/drivers/serial/s3c6400.c
+++ b/drivers/serial/s3c6400.c
@@ -102,6 +102,7 @@ static struct s3c24xx_uart_info s3c6400_uart_inf = {
         .name           = "Samsung S3C6400 UART",
         .type           = PORT_S3C6400,
         .fifosize       = 64,
+        .has_divslot    = 1,
         .rx_fifomask    = S3C2440_UFSTAT_RXMASK,
         .rx_fifoshift   = S3C2440_UFSTAT_RXSHIFT,
         .rx_fifofull    = S3C2440_UFSTAT_RXFULL,
diff --git a/drivers/serial/samsung.c b/drivers/serial/samsung.c
index e06686ae858..93b5d75db12 100644
--- a/drivers/serial/samsung.c
+++ b/drivers/serial/samsung.c
@@ -508,6 +508,7 @@ s3c24xx_serial_setsource(struct uart_port *port, struct s3c24xx_uart_clksrc *c)
 struct baud_calc {
         struct s3c24xx_uart_clksrc      *clksrc;
         unsigned int                     calc;
+        unsigned int                     divslot;
         unsigned int                     quot;
         struct clk                      *src;
 };
@@ -517,6 +518,7 @@ static int s3c24xx_serial_calcbaud(struct baud_calc *calc,
                                    struct s3c24xx_uart_clksrc *clksrc,
                                    unsigned int baud)
 {
+        struct s3c24xx_uart_port *ourport = to_ourport(port);
         unsigned long rate;
 
         calc->src = clk_get(port->dev, clksrc->name);
@@ -527,8 +529,24 @@ static int s3c24xx_serial_calcbaud(struct baud_calc *calc,
         rate /= clksrc->divisor;
 
         calc->clksrc = clksrc;
-        calc->quot = (rate + (8 * baud)) / (16 * baud);
-        calc->calc = (rate / (calc->quot * 16));
+
+        if (ourport->info->has_divslot) {
+                unsigned long div = rate / baud;
+
+                /* The UDIVSLOT register on the newer UARTs allows us to
+                 * get a divisor adjustment of 1/16th on the baud clock.
+                 *
+                 * We don't keep the UDIVSLOT value (the 16ths we calculated
+                 * by not multiplying the baud by 16) as it is easy enough
+                 * to recalculate.
+                 */
+
+                calc->quot = div / 16;
+                calc->calc = rate / div;
+        } else {
+                calc->quot = (rate + (8 * baud)) / (16 * baud);
+                calc->calc = (rate / (calc->quot * 16));
+        }
 
         calc->quot--;
         return 1;
@@ -611,6 +629,30 @@ static unsigned int s3c24xx_serial_getclk(struct uart_port *port,
         return best->quot;
 }
 
+/* udivslot_table[]
+ *
+ * This table takes the fractional value of the baud divisor and gives
+ * the recommended setting for the UDIVSLOT register.
+ */
+static u16 udivslot_table[16] = {
+        [0] = 0x0000,
+        [1] = 0x0080,
+        [2] = 0x0808,
+        [3] = 0x0888,
+        [4] = 0x2222,
+        [5] = 0x4924,
+        [6] = 0x4A52,
+        [7] = 0x54AA,
+        [8] = 0x5555,
+        [9] = 0xD555,
+        [10] = 0xD5D5,
+        [11] = 0xDDD5,
+        [12] = 0xDDDD,
+        [13] = 0xDFDD,
+        [14] = 0xDFDF,
+        [15] = 0xFFDF,
+};
+
 static void s3c24xx_serial_set_termios(struct uart_port *port,
                                        struct ktermios *termios,
                                        struct ktermios *old)
@@ -623,6 +665,7 @@ static void s3c24xx_serial_set_termios(struct uart_port *port,
         unsigned int baud, quot;
         unsigned int ulcon;
         unsigned int umcon;
+        unsigned int udivslot = 0;
 
         /*
          * We don't support modem control lines.
@@ -644,6 +687,7 @@ static void s3c24xx_serial_set_termios(struct uart_port *port,
         /* check to see if we need  to change clock source */
 
         if (ourport->clksrc != clksrc || ourport->baudclk != clk) {
+                dbg("selecting clock %p\n", clk);
                 s3c24xx_serial_setsource(port, clksrc);
 
                 if (ourport->baudclk != NULL && !IS_ERR(ourport->baudclk)) {
@@ -658,6 +702,13 @@ static void s3c24xx_serial_set_termios(struct uart_port *port,
                 ourport->baudclk_rate = clk ? clk_get_rate(clk) : 0;
         }
 
+        if (ourport->info->has_divslot) {
+                unsigned int div = ourport->baudclk_rate / baud;
+
+                udivslot = udivslot_table[div & 15];
+                dbg("udivslot = %04x (div %d)\n", udivslot, div & 15);
+        }
+
         switch (termios->c_cflag & CSIZE) {
         case CS5:
                 dbg("config: 5bits/char\n");
@@ -697,12 +748,16 @@ static void s3c24xx_serial_set_termios(struct uart_port *port,
 
         spin_lock_irqsave(&port->lock, flags);
 
-        dbg("setting ulcon to %08x, brddiv to %d\n", ulcon, quot);
+        dbg("setting ulcon to %08x, brddiv to %d, udivslot %08x\n",
+            ulcon, quot, udivslot);
 
         wr_regl(port, S3C2410_ULCON, ulcon);
         wr_regl(port, S3C2410_UBRDIV, quot);
         wr_regl(port, S3C2410_UMCON, umcon);
 
+        if (ourport->info->has_divslot)
+                wr_regl(port, S3C2443_DIVSLOT, udivslot);
+
         dbg("uart: ulcon = 0x%08x, ucon = 0x%08x, ufcon = 0x%08x\n",
             rd_regl(port, S3C2410_ULCON),
             rd_regl(port, S3C2410_UCON),
diff --git a/drivers/serial/samsung.h b/drivers/serial/samsung.h
index 571d6b90d20..7afb94843a0 100644
--- a/drivers/serial/samsung.h
+++ b/drivers/serial/samsung.h
@@ -21,6 +21,10 @@ struct s3c24xx_uart_info {
         unsigned long           tx_fifoshift;
         unsigned long           tx_fifofull;
 
+        /* uart port features */
+
+        unsigned int            has_divslot:1;
+
         /* clock source control */
 
         int (*get_clksrc)(struct uart_port *, struct s3c24xx_uart_clksrc *clk);
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index 885194a0741..3f3c08c6ba4 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -1373,6 +1373,9 @@ static void cleanup(struct spi_device *spi)
 {
         struct chip_data *chip = spi_get_ctldata(spi);
 
+        if (!chip)
+                return;
+
         if (gpio_is_valid(chip->gpio_cs))
                 gpio_free(chip->gpio_cs);
 
diff --git a/drivers/staging/comedi/TODO b/drivers/staging/comedi/TODO
index 55781295846..15c9348fb93 100644
--- a/drivers/staging/comedi/TODO
+++ b/drivers/staging/comedi/TODO
@@ -11,4 +11,3 @@ Please send patches to Greg Kroah-Hartman <greg@kroah.com> and
 copy:
         Ian Abbott <abbotti@mev.co.uk>
         Frank Mori Hess <fmhess@users.sourceforge.net>
-        David Schleef <ds@schleef.org>
diff --git a/drivers/staging/rt2870/rt2870.h b/drivers/staging/rt2870/rt2870.h
index a42caa37080..a69cf338e49 100644
--- a/drivers/staging/rt2870/rt2870.h
+++ b/drivers/staging/rt2870/rt2870.h
@@ -145,6 +145,7 @@
         {USB_DEVICE(0x0789,0x0162)}, /* Logitec */              \
         {USB_DEVICE(0x0789,0x0163)}, /* Logitec */              \
         {USB_DEVICE(0x0789,0x0164)}, /* Logitec */              \
+        {USB_DEVICE(0x7392,0x7717)}, /* Edimax */               \
         { }/* Terminating entry */                      \
 }
 
diff --git a/drivers/staging/rtl8187se/r8180.h b/drivers/staging/rtl8187se/r8180.h
index 12215fc61dd..db446b7e2e0 100644
--- a/drivers/staging/rtl8187se/r8180.h
+++ b/drivers/staging/rtl8187se/r8180.h
@@ -19,7 +19,7 @@
 #define R8180H
 
 
-#define RTL8180_MODULE_NAME "rtl8180"
+#define RTL8180_MODULE_NAME "r8180"
 #define DMESG(x,a...) printk(KERN_INFO RTL8180_MODULE_NAME ": " x "\n", ## a)
 #define DMESGW(x,a...) printk(KERN_WARNING RTL8180_MODULE_NAME ": WW:" x "\n", ## a)
 #define DMESGE(x,a...) printk(KERN_WARNING RTL8180_MODULE_NAME ": EE:" x "\n", ## a)
diff --git a/drivers/staging/rtl8187se/r8180_core.c b/drivers/staging/rtl8187se/r8180_core.c
index 6ecd12de429..e10413cee0d 100644
--- a/drivers/staging/rtl8187se/r8180_core.c
+++ b/drivers/staging/rtl8187se/r8180_core.c
@@ -640,11 +640,9 @@ void rtl8180_proc_init_one(struct net_device *dev)
 {
         struct proc_dir_entry *e;
         struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        priv->dir_dev = create_proc_entry(dev->name,
-                                          S_IFDIR | S_IRUGO | S_IXUGO,
-                                          rtl8180_proc);
+        priv->dir_dev = rtl8180_proc;
         if (!priv->dir_dev) {
-                DMESGE("Unable to initialize /proc/net/rtl8180/%s\n",
+                DMESGE("Unable to initialize /proc/net/r8180/%s\n",
                       dev->name);
                 return;
         }
@@ -654,7 +652,7 @@ void rtl8180_proc_init_one(struct net_device *dev)
 
         if (!e) {
                 DMESGE("Unable to initialize "
-                      "/proc/net/rtl8180/%s/stats-hw\n",
+                      "/proc/net/r8180/%s/stats-hw\n",
                       dev->name);
         }
 
@@ -663,7 +661,7 @@ void rtl8180_proc_init_one(struct net_device *dev)
 
         if (!e) {
                 DMESGE("Unable to initialize "
-                      "/proc/net/rtl8180/%s/stats-rx\n",
+                      "/proc/net/r8180/%s/stats-rx\n",
                       dev->name);
         }
 
@@ -673,7 +671,7 @@ void rtl8180_proc_init_one(struct net_device *dev)
 
         if (!e) {
                 DMESGE("Unable to initialize "
-                      "/proc/net/rtl8180/%s/stats-tx\n",
+                      "/proc/net/r8180/%s/stats-tx\n",
                       dev->name);
         }
         #if 0
@@ -702,7 +700,7 @@ void rtl8180_proc_init_one(struct net_device *dev)
 
         if (!e) {
                 DMESGE("Unable to initialize "
-                      "/proc/net/rtl8180/%s/registers\n",
+                      "/proc/net/r8180/%s/registers\n",
                       dev->name);
         }
 }
@@ -977,13 +975,6 @@ void check_tx_ring(struct net_device *dev, int pri)
                               *tmp & (1<<15)? "ok": "err", *(tmp+4));
         }
 
-        DMESG("nic at %d",
-                (nic-nicbegin) / 8 /4);
-        DMESG("tail at %d", ((int)tail - (int)begin) /8 /4);
-        DMESG("head at %d", ((int)head - (int)begin) /8 /4);
-        DMESG("check free desc returns %d", check_nic_enought_desc(dev,pri));
-        DMESG("free desc is %d\n", get_curr_tx_free_desc(dev,pri));
-        //rtl8180_reset(dev);
         return;
 }
 
@@ -1736,17 +1727,7 @@ short alloc_tx_desc_ring(struct net_device *dev, int bufsize, int count,
                  * descriptor's buffer must be 256 byte aligned
                  * we shouldn't be here, since we set DMA mask !
                  */
-                DMESGW("Fixing TX alignment");
-                desc = (u32*)((u8*)desc + 256);
-#if (defined(CONFIG_HIGHMEM64G) || defined(CONFIG_64BIT_PHYS_ADDR))
-                desc = (u32*)((u64)desc &~ 0xff);
-                dma_desc = (dma_addr_t)((u8*)dma_desc + 256);
-                dma_desc = (dma_addr_t)((u64)dma_desc &~ 0xff);
-#else
-                desc = (u32*)((u32)desc &~ 0xff);
-                dma_desc = (dma_addr_t)((u8*)dma_desc + 256);
-                dma_desc = (dma_addr_t)((u32)dma_desc &~ 0xff);
-#endif
+                WARN(1, "DMA buffer is not aligned\n");
         }
         tmp=desc;
         for (i=0;i<count;i++)
@@ -1984,18 +1965,7 @@ short alloc_rx_desc_ring(struct net_device *dev, u16 bufsize, int count)
                  * descriptor's buffer must be 256 byte aligned
                  * should never happen since we specify the DMA mask
                  */
-
-                DMESGW("Fixing RX alignment");
-                desc = (u32*)((u8*)desc + 256);
-#if (defined(CONFIG_HIGHMEM64G) || defined(CONFIG_64BIT_PHYS_ADDR))
-                desc = (u32*)((u64)desc &~ 0xff);
-                dma_desc = (dma_addr_t)((u8*)dma_desc + 256);
-                dma_desc = (dma_addr_t)((u64)dma_desc &~ 0xff);
-#else
-                desc = (u32*)((u32)desc &~ 0xff);
-                dma_desc = (dma_addr_t)((u8*)dma_desc + 256);
-                dma_desc = (dma_addr_t)((u32)dma_desc &~ 0xff);
-#endif
+                WARN(1, "DMA buffer is not aligned\n");
         }
 
         priv->rxring=desc;
diff --git a/drivers/staging/winbond/wbusb.c b/drivers/staging/winbond/wbusb.c
index 9c3f9439f35..3b2d52819b4 100644
--- a/drivers/staging/winbond/wbusb.c
+++ b/drivers/staging/winbond/wbusb.c
@@ -386,7 +386,7 @@ static int wb35_probe(struct usb_interface *intf, const struct usb_device_id *id
         if (err)
                 goto error_free_hw;
 
-        usb_set_intfdata(intf, priv);
+        usb_set_intfdata(intf, dev);
 
         return 0;
 
@@ -415,10 +415,15 @@ static void wb35_hw_halt(struct wbsoft_priv *adapter)
 
 static void wb35_disconnect(struct usb_interface *intf)
 {
-        struct wbsoft_priv *priv = usb_get_intfdata(intf);
+        struct ieee80211_hw *hw = usb_get_intfdata(intf);
+        struct wbsoft_priv *priv = hw->priv;
 
         wb35_hw_halt(priv);
 
+        ieee80211_stop_queues(hw);
+        ieee80211_unregister_hw(hw);
+        ieee80211_free_hw(hw);
+
         usb_set_intfdata(intf, NULL);
         usb_put_dev(interface_to_usbdev(intf));
 }
diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index 89299a5ce16..0716cdb44cd 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -27,6 +27,8 @@ obj-$(CONFIG_USB_WUSB)		+= wusbcore/
 
 obj-$(CONFIG_USB_ACM)           += class/
 obj-$(CONFIG_USB_PRINTER)       += class/
+obj-$(CONFIG_USB_WDM)           += class/
+obj-$(CONFIG_USB_TMC)           += class/
 
 obj-$(CONFIG_USB_STORAGE)       += storage/
 obj-$(CONFIG_USB)               += storage/
diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
index 6789089e246..56802d2e994 100644
--- a/drivers/usb/atm/cxacru.c
+++ b/drivers/usb/atm/cxacru.c
@@ -227,8 +227,14 @@ static ssize_t cxacru_sysfs_showattr_s8(s8 value, char *buf)
 
 static ssize_t cxacru_sysfs_showattr_dB(s16 value, char *buf)
 {
-        return snprintf(buf, PAGE_SIZE, "%d.%02u\n",
-                                        value / 100, abs(value) % 100);
+        if (likely(value >= 0)) {
+                return snprintf(buf, PAGE_SIZE, "%u.%02u\n",
+                                        value / 100, value % 100);
+        } else {
+                value = -value;
+                return snprintf(buf, PAGE_SIZE, "-%u.%02u\n",
+                                        value / 100, value % 100);
+        }
 }
 
 static ssize_t cxacru_sysfs_showattr_bool(u32 value, char *buf)
diff --git a/drivers/usb/gadget/usbstring.c b/drivers/usb/gadget/usbstring.c
index 4154be375c7..58c4d37d312 100644
--- a/drivers/usb/gadget/usbstring.c
+++ b/drivers/usb/gadget/usbstring.c
@@ -38,7 +38,7 @@ static int utf8_to_utf16le(const char *s, __le16 *cp, unsigned len)
                                 uchar = (c & 0x1f) << 6;
 
                                 c = (u8) *s++;
-                                if ((c & 0xc0) != 0xc0)
+                                if ((c & 0xc0) != 0x80)
                                         goto fail;
                                 c &= 0x3f;
                                 uchar |= c;
@@ -49,13 +49,13 @@ static int utf8_to_utf16le(const char *s, __le16 *cp, unsigned len)
                                 uchar = (c & 0x0f) << 12;
 
                                 c = (u8) *s++;
-                                if ((c & 0xc0) != 0xc0)
+                                if ((c & 0xc0) != 0x80)
                                         goto fail;
                                 c &= 0x3f;
                                 uchar |= c << 6;
 
                                 c = (u8) *s++;
-                                if ((c & 0xc0) != 0xc0)
+                                if ((c & 0xc0) != 0x80)
                                         goto fail;
                                 c &= 0x3f;
                                 uchar |= c;
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 8100f1d2590..0ab8474b00c 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -56,6 +56,7 @@ static __u16 vendor = FTDI_VID;
 static __u16 product;
 
 struct ftdi_private {
+        struct kref kref;
         ftdi_chip_type_t chip_type;
                                 /* type of device, either SIO or FT8U232AM */
         int baud_base;          /* baud base clock for divisor setting */
@@ -669,6 +670,8 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(ADI_VID, ADI_GNICE_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
+        { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { },                                    /* Optional parameter entry */
         { }                                     /* Terminating entry */
 };
@@ -1352,6 +1355,7 @@ static int ftdi_sio_port_probe(struct usb_serial_port *port)
                 return -ENOMEM;
         }
 
+        kref_init(&priv->kref);
         spin_lock_init(&priv->rx_lock);
         spin_lock_init(&priv->tx_lock);
         init_waitqueue_head(&priv->delta_msr_wait);
@@ -1468,6 +1472,13 @@ static void ftdi_shutdown(struct usb_serial *serial)
         dbg("%s", __func__);
 }
 
+static void ftdi_sio_priv_release(struct kref *k)
+{
+        struct ftdi_private *priv = container_of(k, struct ftdi_private, kref);
+
+        kfree(priv);
+}
+
 static int ftdi_sio_port_remove(struct usb_serial_port *port)
 {
         struct ftdi_private *priv = usb_get_serial_port_data(port);
@@ -1482,7 +1493,7 @@ static int ftdi_sio_port_remove(struct usb_serial_port *port)
 
         if (priv) {
                 usb_set_serial_port_data(port, NULL);
-                kfree(priv);
+                kref_put(&priv->kref, ftdi_sio_priv_release);
         }
 
         return 0;
@@ -1547,7 +1558,8 @@ static int ftdi_open(struct tty_struct *tty,
                 dev_err(&port->dev,
                         "%s - failed submitting read urb, error %d\n",
                         __func__, result);
-
+        else
+                kref_get(&priv->kref);
 
         return result;
 } /* ftdi_open */
@@ -1589,11 +1601,11 @@ static void ftdi_close(struct tty_struct *tty,
         mutex_unlock(&port->serial->disc_mutex);
 
         /* cancel any scheduled reading */
-        cancel_delayed_work(&priv->rx_work);
-        flush_scheduled_work();
+        cancel_delayed_work_sync(&priv->rx_work);
 
         /* shutdown our bulk read */
         usb_kill_urb(port->read_urb);
+        kref_put(&priv->kref, ftdi_sio_priv_release);
 } /* ftdi_close */
 
 
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index c09f658a448..12330fa1c09 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -920,6 +920,12 @@
 #define JETI_SPC1201_PID        0x04b2
 
 /*
+ * Marvell SheevaPlug
+ */
+#define MARVELL_VID             0x9e88
+#define MARVELL_SHEEVAPLUG_PID  0x9e8f
+
+/*
  *   BmRequestType:  1100 0000b
  *   bRequest:       FTDI_E2_READ
  *   wValue:         0
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index fa65a3b0860..4b8b69045fe 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -160,8 +160,9 @@ UNUSUAL_DEV(  0x0420, 0x0001, 0x0100, 0x0100,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE ),
 
-/* Reported by Andrew Nayenko <relan@bk.ru> */
-UNUSUAL_DEV(  0x0421, 0x0019, 0x0592, 0x0592,
+/* Reported by Andrew Nayenko <relan@bk.ru>
+ * Updated for new firmware by Phillip Potter <phillipinda@hotmail.com> */
+UNUSUAL_DEV(  0x0421, 0x0019, 0x0592, 0x0610,
                 "Nokia",
                 "Nokia 6288",
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 7826bdce4bb..0048f1185a6 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -1128,13 +1128,6 @@ config FB_INTEL
           830M/845G/852GM/855GM/865G/915G/915GM/945G/945GM/965G/965GM chipsets.
           Say Y if you have and plan to use such a board.
 
-          If you say Y here and want DDC/I2C support you must first say Y to
-          "I2C support" and "I2C bit-banging support" in the character devices
-          section.
-
-          If you say M here then "I2C support" and "I2C bit-banging support"
-          can be build either as modules or built-in.
-
           To compile this driver as a module, choose M here: the
           module will be called intelfb.
 
@@ -1207,11 +1200,10 @@ config FB_MATROX_G
           pixel and 32 bpp packed pixel. You can also use font widths
           different from 8.
 
-          If you need support for G400 secondary head, you must first say Y to
-          "I2C support" in the character devices section, and then to
-          "Matrox I2C support" and "G400 second head support" here in the
-          framebuffer section. G450/G550 secondary head and digital output
-          are supported without additional modules.
+          If you need support for G400 secondary head, you must say Y to
+          "Matrox I2C support" and "G400 second head support" right below.
+          G450/G550 secondary head and digital output are supported without
+          additional modules.
 
           The driver starts in monitor mode. You must use the matroxset tool 
           (available at <ftp://platan.vc.cvut.cz/pub/linux/matrox-latest/>) to 
@@ -1310,13 +1302,6 @@ config FB_RADEON
           a framebuffer device.  There are both PCI and AGP versions.  You
           don't need to choose this to run the Radeon in plain VGA mode.
 
-          If you say Y here and want DDC/I2C support you must first say Y to
-          "I2C support" and "I2C bit-banging support" in the character devices
-          section.
-
-          If you say M here then "I2C support" and "I2C bit-banging support" 
-          can be build either as modules or built-in.
-
           There is a product page at
           http://apps.ati.com/ATIcompare/
 
diff --git a/drivers/video/Makefile b/drivers/video/Makefile
index 0dbd6c68d76..d8d0be5151e 100644
--- a/drivers/video/Makefile
+++ b/drivers/video/Makefile
@@ -56,7 +56,6 @@ obj-$(CONFIG_FB_CT65550)          += chipsfb.o
 obj-$(CONFIG_FB_IMSTT)            += imsttfb.o
 obj-$(CONFIG_FB_FM2)              += fm2fb.o
 obj-$(CONFIG_FB_VT8623)           += vt8623fb.o
-obj-$(CONFIG_FB_CYBLA)            += cyblafb.o
 obj-$(CONFIG_FB_TRIDENT)          += tridentfb.o
 obj-$(CONFIG_FB_LE80578)          += vermilion/
 obj-$(CONFIG_FB_S3)               += s3fb.o
diff --git a/drivers/video/cfbfillrect.c b/drivers/video/cfbfillrect.c
index 64b35766b2a..ba9f58b2a5e 100644
--- a/drivers/video/cfbfillrect.c
+++ b/drivers/video/cfbfillrect.c
@@ -9,10 +9,6 @@
  *
  * NOTES:
  *
- *  The code for depths like 24 that don't have integer number of pixels per
- *  long is broken and needs to be fixed. For now I turned these types of
- *  mode off.
- *
  *  Also need to add code to deal with cards endians that are different than
  *  the native cpu endians. I also need to deal with MSB position in the word.
  *
@@ -139,7 +135,7 @@ bitfill_unaligned(struct fb_info *p, unsigned long __iomem *dst, int dst_idx,
 
                 // Trailing bits
                 if (last)
-                        FB_WRITEL(comp(pat, FB_READL(dst), first), dst);
+                        FB_WRITEL(comp(pat, FB_READL(dst), last), dst);
         }
 }
 
@@ -281,7 +277,7 @@ bitfill_unaligned_rev(struct fb_info *p, unsigned long __iomem *dst,
 
 void cfb_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
 {
-        unsigned long pat, fg;
+        unsigned long pat, pat2, fg;
         unsigned long width = rect->width, height = rect->height;
         int bits = BITS_PER_LONG, bytes = bits >> 3;
         u32 bpp = p->var.bits_per_pixel;
@@ -297,7 +293,7 @@ void cfb_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
         else
                 fg = rect->color;
 
-        pat = pixel_to_pat( bpp, fg);
+        pat = pixel_to_pat(bpp, fg);
 
         dst = (unsigned long __iomem *)((unsigned long)p->screen_base & ~(bytes-1));
         dst_idx = ((unsigned long)p->screen_base & (bytes - 1))*8;
@@ -333,17 +329,16 @@ void cfb_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
                         dst_idx += p->fix.line_length*8;
                 }
         } else {
-                int right;
-                int r;
-                int rot = (left-dst_idx) % bpp;
+                int right, r;
                 void (*fill_op)(struct fb_info *p, unsigned long __iomem *dst,
                                 int dst_idx, unsigned long pat, int left,
                                 int right, unsigned n, int bits) = NULL;
-
-                /* rotate pattern to correct start position */
-                pat = pat << rot | pat >> (bpp-rot);
-
-                right = bpp-left;
+#ifdef __LITTLE_ENDIAN
+                right = left;
+                left = bpp - right;
+#else
+                right = bpp - left;
+#endif
                 switch (rect->rop) {
                 case ROP_XOR:
                         fill_op = bitfill_unaligned_rev;
@@ -352,17 +347,18 @@ void cfb_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
                         fill_op = bitfill_unaligned;
                         break;
                 default:
-                        printk( KERN_ERR "cfb_fillrect(): unknown rop, defaulting to ROP_COPY\n");
+                        printk(KERN_ERR "cfb_fillrect(): unknown rop, defaulting to ROP_COPY\n");
                         fill_op = bitfill_unaligned;
                         break;
                 }
                 while (height--) {
-                        dst += dst_idx >> (ffs(bits) - 1);
+                        dst += dst_idx / bits;
                         dst_idx &= (bits - 1);
-                        fill_op(p, dst, dst_idx, pat, left, right,
+                        r = dst_idx % bpp;
+                        /* rotate pattern to the correct start position */
+                        pat2 = le_long_to_cpu(rolx(cpu_to_le_long(pat), r, bpp));
+                        fill_op(p, dst, dst_idx, pat2, left, right,
                                 width*bpp, bits);
-                        r = (p->fix.line_length*8) % bpp;
-                        pat = pat << (bpp-r) | pat >> r;
                         dst_idx += p->fix.line_length*8;
                 }
         }
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index d012edda6d1..38e86b84dce 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -1282,7 +1282,7 @@ static int vgacon_font_get(struct vc_data *c, struct console_font *font)
         font->charcount = vga_512_chars ? 512 : 256;
         if (!font->data)
                 return 0;
-        return vgacon_do_font_op(&state, font->data, 0, 0);
+        return vgacon_do_font_op(&state, font->data, 0, vga_512_chars);
 }
 
 #else
diff --git a/drivers/video/fb_draw.h b/drivers/video/fb_draw.h
index 1db622192bd..04c01faaf77 100644
--- a/drivers/video/fb_draw.h
+++ b/drivers/video/fb_draw.h
@@ -33,11 +33,11 @@ pixel_to_pat( u32 bpp, u32 pixel)
         case 8:
                 return 0x0101010101010101ul*pixel;
         case 12:
-                return 0x0001001001001001ul*pixel;
+                return 0x1001001001001001ul*pixel;
         case 16:
                 return 0x0001000100010001ul*pixel;
         case 24:
-                return 0x0000000001000001ul*pixel;
+                return 0x0001000001000001ul*pixel;
         case 32:
                 return 0x0000000100000001ul*pixel;
         default:
@@ -58,11 +58,11 @@ pixel_to_pat( u32 bpp, u32 pixel)
         case 8:
                 return 0x01010101ul*pixel;
         case 12:
-                return 0x00001001ul*pixel;
+                return 0x01001001ul*pixel;
         case 16:
                 return 0x00010001ul*pixel;
         case 24:
-                return 0x00000001ul*pixel;
+                return 0x01000001ul*pixel;
         case 32:
                 return 0x00000001ul*pixel;
         default:
@@ -167,4 +167,17 @@ static inline unsigned long fb_rev_pixels_in_long(unsigned long val,
 
 #endif  /* CONFIG_FB_CFB_REV_PIXELS_IN_BYTE */
 
+#define cpu_to_le_long _cpu_to_le_long(BITS_PER_LONG)
+#define _cpu_to_le_long(x) __cpu_to_le_long(x)
+#define __cpu_to_le_long(x) cpu_to_le##x
+
+#define le_long_to_cpu _le_long_to_cpu(BITS_PER_LONG)
+#define _le_long_to_cpu(x) __le_long_to_cpu(x)
+#define __le_long_to_cpu(x) le##x##_to_cpu
+
+static inline unsigned long rolx(unsigned long word, unsigned int shift, unsigned int x)
+{
+        return (word << shift) | (word >> (x - shift));
+}
+
 #endif /* FB_DRAW_H */
diff --git a/drivers/video/gbefb.c b/drivers/video/gbefb.c
index fe5b519860b..1a83709f961 100644
--- a/drivers/video/gbefb.c
+++ b/drivers/video/gbefb.c
@@ -75,7 +75,7 @@ struct gbefb_par {
 static unsigned int gbe_mem_size = CONFIG_FB_GBE_MEM * 1024*1024;
 static void *gbe_mem;
 static dma_addr_t gbe_dma_addr;
-unsigned long gbe_mem_phys;
+static unsigned long gbe_mem_phys;
 
 static struct {
         uint16_t *cpu;
@@ -185,8 +185,8 @@ static struct fb_videomode default_mode_LCD __initdata = {
         .vmode          = FB_VMODE_NONINTERLACED,
 };
 
-struct fb_videomode *default_mode __initdata = &default_mode_CRT;
-struct fb_var_screeninfo *default_var __initdata = &default_var_CRT;
+static struct fb_videomode *default_mode __initdata = &default_mode_CRT;
+static struct fb_var_screeninfo *default_var __initdata = &default_var_CRT;
 
 static int flat_panel_enabled = 0;
 
@@ -205,7 +205,7 @@ static void gbe_reset(void)
  *              console.
  */
 
-void gbe_turn_off(void)
+static void gbe_turn_off(void)
 {
         int i;
         unsigned int val, x, y, vpixen_off;
@@ -1097,7 +1097,7 @@ static void gbefb_create_sysfs(struct device *dev)
  * Initialization
  */
 
-int __init gbefb_setup(char *options)
+static int __init gbefb_setup(char *options)
 {
         char *this_opt;
 
@@ -1283,7 +1283,7 @@ static struct platform_driver gbefb_driver = {
 
 static struct platform_device *gbefb_device;
 
-int __init gbefb_init(void)
+static int __init gbefb_init(void)
 {
         int ret = platform_driver_register(&gbefb_driver);
         if (!ret) {
@@ -1301,7 +1301,7 @@ int __init gbefb_init(void)
         return ret;
 }
 
-void __exit gbefb_exit(void)
+static void __exit gbefb_exit(void)
 {
         platform_device_unregister(gbefb_device);
         platform_driver_unregister(&gbefb_driver);
diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c
index 21b3692092f..9894de1c9b9 100644
--- a/drivers/video/mx3fb.c
+++ b/drivers/video/mx3fb.c
@@ -1152,11 +1152,11 @@ static struct fb_ops mx3fb_ops = {
  */
 static int mx3fb_suspend(struct platform_device *pdev, pm_message_t state)
 {
-        struct mx3fb_data *drv_data = platform_get_drvdata(pdev);
-        struct mx3fb_info *mx3_fbi = drv_data->fbi->par;
+        struct mx3fb_data *mx3fb = platform_get_drvdata(pdev);
+        struct mx3fb_info *mx3_fbi = mx3fb->fbi->par;
 
         acquire_console_sem();
-        fb_set_suspend(drv_data->fbi, 1);
+        fb_set_suspend(mx3fb->fbi, 1);
         release_console_sem();
 
         if (mx3_fbi->blank == FB_BLANK_UNBLANK) {
@@ -1172,16 +1172,16 @@ static int mx3fb_suspend(struct platform_device *pdev, pm_message_t state)
  */
 static int mx3fb_resume(struct platform_device *pdev)
 {
-        struct mx3fb_data *drv_data = platform_get_drvdata(pdev);
-        struct mx3fb_info *mx3_fbi = drv_data->fbi->par;
+        struct mx3fb_data *mx3fb = platform_get_drvdata(pdev);
+        struct mx3fb_info *mx3_fbi = mx3fb->fbi->par;
 
         if (mx3_fbi->blank == FB_BLANK_UNBLANK) {
                 sdc_enable_channel(mx3_fbi);
-                sdc_set_brightness(mx3fb, drv_data->backlight_level);
+                sdc_set_brightness(mx3fb, mx3fb->backlight_level);
         }
 
         acquire_console_sem();
-        fb_set_suspend(drv_data->fbi, 0);
+        fb_set_suspend(mx3fb->fbi, 0);
         release_console_sem();
 
         return 0;
diff --git a/drivers/video/sysfillrect.c b/drivers/video/sysfillrect.c
index f94d6b6e29e..33ee3d34f9d 100644
--- a/drivers/video/sysfillrect.c
+++ b/drivers/video/sysfillrect.c
@@ -124,7 +124,7 @@ bitfill_unaligned(struct fb_info *p, unsigned long *dst, int dst_idx,
 
                 /* Trailing bits */
                 if (last)
-                        *dst = comp(pat, *dst, first);
+                        *dst = comp(pat, *dst, last);
         }
 }
 
@@ -242,7 +242,7 @@ bitfill_unaligned_rev(struct fb_info *p, unsigned long *dst, int dst_idx,
 
 void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
 {
-        unsigned long pat, fg;
+        unsigned long pat, pat2, fg;
         unsigned long width = rect->width, height = rect->height;
         int bits = BITS_PER_LONG, bytes = bits >> 3;
         u32 bpp = p->var.bits_per_pixel;
@@ -292,17 +292,16 @@ void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
                         dst_idx += p->fix.line_length*8;
                 }
         } else {
-                int right;
-                int r;
-                int rot = (left-dst_idx) % bpp;
+                int right, r;
                 void (*fill_op)(struct fb_info *p, unsigned long *dst,
                                 int dst_idx, unsigned long pat, int left,
                                 int right, unsigned n, int bits) = NULL;
-
-                /* rotate pattern to correct start position */
-                pat = pat << rot | pat >> (bpp-rot);
-
-                right = bpp-left;
+#ifdef __LITTLE_ENDIAN
+                right = left;
+                left = bpp - right;
+#else
+                right = bpp - left;
+#endif
                 switch (rect->rop) {
                 case ROP_XOR:
                         fill_op = bitfill_unaligned_rev;
@@ -311,18 +310,19 @@ void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
                         fill_op = bitfill_unaligned;
                         break;
                 default:
-                        printk(KERN_ERR "cfb_fillrect(): unknown rop, "
+                        printk(KERN_ERR "sys_fillrect(): unknown rop, "
                                 "defaulting to ROP_COPY\n");
                         fill_op = bitfill_unaligned;
                         break;
                 }
                 while (height--) {
-                        dst += dst_idx >> (ffs(bits) - 1);
+                        dst += dst_idx / bits;
                         dst_idx &= (bits - 1);
-                        fill_op(p, dst, dst_idx, pat, left, right,
+                        r = dst_idx % bpp;
+                        /* rotate pattern to the correct start position */
+                        pat2 = le_long_to_cpu(rolx(cpu_to_le_long(pat), r, bpp));
+                        fill_op(p, dst, dst_idx, pat2, left, right,
                                 width*bpp, bits);
-                        r = (p->fix.line_length*8) % bpp;
-                        pat = pat << (bpp-r) | pat >> r;
                         dst_idx += p->fix.line_length*8;
                 }
         }
diff --git a/drivers/video/via/viafbdev.c b/drivers/video/via/viafbdev.c
index e327b84820d..a0fec298216 100644
--- a/drivers/video/via/viafbdev.c
+++ b/drivers/video/via/viafbdev.c
@@ -2103,7 +2103,7 @@ static void viafb_remove_proc(struct proc_dir_entry *viafb_entry)
 
 static int __devinit via_pci_probe(void)
 {
-        unsigned int default_xres, default_yres;
+        unsigned long default_xres, default_yres;
         char *tmpc, *tmpm;
         char *tmpc_sec, *tmpm_sec;
         int vmode_index;
@@ -2196,8 +2196,8 @@ static int __devinit via_pci_probe(void)
         viafb_FB_MM = viaparinfo->fbmem_virt;
         tmpm = viafb_mode;
         tmpc = strsep(&tmpm, "x");
-        strict_strtoul(tmpc, 0, (unsigned long *)&default_xres);
-        strict_strtoul(tmpm, 0, (unsigned long *)&default_yres);
+        strict_strtoul(tmpc, 0, &default_xres);
+        strict_strtoul(tmpm, 0, &default_yres);
 
         vmode_index = viafb_get_mode_index(default_xres, default_yres, 0);
         DEBUG_MSG(KERN_INFO "0->index=%d\n", vmode_index);
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index efa4b363ce7..f5bbd9e8341 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -513,7 +513,8 @@ static ssize_t show_target(struct sys_device *dev, struct sysdev_attribute *attr
                               char *buf)
 {
         return sprintf(buf, "%llu\n",
-                       (u64)balloon_stats.target_pages << PAGE_SHIFT);
+                       (unsigned long long)balloon_stats.target_pages
+                       << PAGE_SHIFT);
 }
 
 static ssize_t store_target(struct sys_device *dev,