242 files changed, 2028 insertions, 1973 deletions
diff --git a/MAINTAINERS b/MAINTAINERS
index e99028ca2f7c..b2afc7ae965b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1676,10 +1676,8 @@ L:	linux-kernel@vger.kernel.org
 S:      Maintained
 LAPB module
-P:      Henner Eisen
-M:      eis@baty.hanse.de
 L:      linux-x25@vger.kernel.org
-S:      Maintained
+S:      Orphan
 LASI 53c700 driver for PARISC
 P:      James E.J. Bottomley
diff --git a/arch/s390/kernel/head31.S b/arch/s390/kernel/head31.S
index d00de17b3778..a4dc61f3285e 100644
--- a/arch/s390/kernel/head31.S
+++ b/arch/s390/kernel/head31.S
@@ -273,7 +273,7 @@ startup_continue:
 .Lbss_end:  .long _end
 .Lparmaddr: .long PARMAREA
 .Lsccbaddr: .long .Lsccb
-        .align  4096
+        .org    0x12000
 .Lsccb:
        .hword  0x1000                  # length, one page
        .byte   0x00,0x00,0x00
@@ -290,7 +290,7 @@ startup_continue:
 .Lscpincr2:
        .quad   0x00
        .fill   3984,1,0
-        .align  4096
+        .org    0x13000
 #ifdef CONFIG_SHARED_KERNEL
        .org    0x100000
diff --git a/arch/s390/kernel/head64.S b/arch/s390/kernel/head64.S
index 47744fcca930..9d80c5b1ef95 100644
--- a/arch/s390/kernel/head64.S
+++ b/arch/s390/kernel/head64.S
@@ -268,7 +268,7 @@ startup_continue:
 .Lparmaddr:
        .quad   PARMAREA
-        .align 4096
+        .org    0x12000
 .Lsccb:
        .hword 0x1000                   # length, one page
        .byte 0x00,0x00,0x00
@@ -285,7 +285,7 @@ startup_continue:
 .Lscpincr2:
        .quad 0x00
        .fill 3984,1,0
-        .align 4096
+        .org    0x13000
 #ifdef CONFIG_SHARED_KERNEL
        .org   0x100000
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 1ca34f54ea8a..c902f059c7aa 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -877,31 +877,57 @@ static struct bin_attribute ipl_scp_data_attr = {
 static decl_subsys(ipl, NULL, NULL);
+static int ipl_register_fcp_files(void)
+{
+        int rc;
+        rc = sysfs_create_group(&ipl_subsys.kset.kobj,
+                                &ipl_fcp_attr_group);
+        if (rc)
+                goto out;
+        rc = sysfs_create_bin_file(&ipl_subsys.kset.kobj,
+                                   &ipl_parameter_attr);
+        if (rc)
+                goto out_ipl_parm;
+        rc = sysfs_create_bin_file(&ipl_subsys.kset.kobj,
+                                   &ipl_scp_data_attr);
+        if (!rc)
+                goto out;
+        sysfs_remove_bin_file(&ipl_subsys.kset.kobj, &ipl_parameter_attr);
+out_ipl_parm:
+        sysfs_remove_group(&ipl_subsys.kset.kobj, &ipl_fcp_attr_group);
+out:
+        return rc;
+}
 static int __init
 ipl_device_sysfs_register(void) {
        int rc;
        rc = firmware_register(&ipl_subsys);
        if (rc)
-                return rc;
+                goto out;
        switch (get_ipl_type()) {
        case ipl_type_ccw:
-                sysfs_create_group(&ipl_subsys.kset.kobj, &ipl_ccw_attr_group);
+                rc = sysfs_create_group(&ipl_subsys.kset.kobj,
+                                        &ipl_ccw_attr_group);
                break;
        case ipl_type_fcp:
-                sysfs_create_group(&ipl_subsys.kset.kobj, &ipl_fcp_attr_group);
+                rc = ipl_register_fcp_files();
-                sysfs_create_bin_file(&ipl_subsys.kset.kobj,
-                                      &ipl_parameter_attr);
-                sysfs_create_bin_file(&ipl_subsys.kset.kobj,
-                                      &ipl_scp_data_attr);
                break;
        default:
-                sysfs_create_group(&ipl_subsys.kset.kobj,
+                rc = sysfs_create_group(&ipl_subsys.kset.kobj,
-                                   &ipl_unknown_attr_group);
+                                        &ipl_unknown_attr_group);
                break;
        }
-        return 0;
+        if (rc)
+                firmware_unregister(&ipl_subsys);
+out:
+        return rc;
 }
 __initcall(ipl_device_sysfs_register);
diff --git a/arch/sparc/kernel/devices.c b/arch/sparc/kernel/devices.c
index adba9dfee35e..af90a5f9ab57 100644
--- a/arch/sparc/kernel/devices.c
+++ b/arch/sparc/kernel/devices.c
@@ -15,6 +15,7 @@
 #include <asm/page.h>
 #include <asm/oplib.h>
+#include <asm/prom.h>
 #include <asm/smp.h>
 #include <asm/system.h>
 #include <asm/cpudata.h>
@@ -34,12 +35,6 @@ static int check_cpu_node(int nd, int *cur_inst,
                          int (*compare)(int, int, void *), void *compare_arg,
                          int *prom_node, int *mid)
 {
-        char node_str[128];
-        prom_getstring(nd, "device_type", node_str, sizeof(node_str));
-        if (strcmp(node_str, "cpu"))
-                return -ENODEV;
-        
        if (!compare(nd, *cur_inst, compare_arg)) {
                if (prom_node)
                        *prom_node = nd;
@@ -59,20 +54,14 @@ static int check_cpu_node(int nd, int *cur_inst,
 static int __cpu_find_by(int (*compare)(int, int, void *), void *compare_arg,
                         int *prom_node, int *mid)
 {
-        int nd, cur_inst, err;
+        struct device_node *dp;
+        int cur_inst;
-        nd = prom_root_node;
        cur_inst = 0;
+        for_each_node_by_type(dp, "cpu") {
-        err = check_cpu_node(nd, &cur_inst, compare, compare_arg,
+                int err = check_cpu_node(dp->node, &cur_inst,
-                             prom_node, mid);
+                                         compare, compare_arg,
-        if (!err)
+                                         prom_node, mid);
-                return 0;
-        nd = prom_getchild(nd);
-        while ((nd = prom_getsibling(nd)) != 0) {
-                err = check_cpu_node(nd, &cur_inst, compare, compare_arg,
-                                     prom_node, mid);
                if (!err)
                        return 0;
        }
diff --git a/arch/sparc/kernel/irq.c b/arch/sparc/kernel/irq.c
index cde73327ca96..72f0201051a0 100644
--- a/arch/sparc/kernel/irq.c
+++ b/arch/sparc/kernel/irq.c
@@ -329,7 +329,7 @@ void handler_irq(int irq, struct pt_regs * regs)
        disable_pil_irq(irq);
 #ifdef CONFIG_SMP
        /* Only rotate on lower priority IRQ's (scsi, ethernet, etc.). */
-        if(irq < 10)
+        if((sparc_cpu_model==sun4m) && (irq < 10))
                smp4m_irq_rotate(cpu);
 #endif
        action = sparc_irq[irq].action;
diff --git a/arch/sparc/kernel/of_device.c b/arch/sparc/kernel/of_device.c
index 5a2faad5d043..97bf87e8cdde 100644
--- a/arch/sparc/kernel/of_device.c
+++ b/arch/sparc/kernel/of_device.c
@@ -596,14 +596,41 @@ static struct of_device * __init scan_one_device(struct device_node *dp,
                static int pil_to_sbus[] = {
                        0, 0, 1, 2, 0, 3, 0, 4, 0, 5, 0, 6, 0, 7, 0, 0,
                };
-                struct device_node *busp = dp->parent;
+                struct device_node *io_unit, *sbi = dp->parent;
                struct linux_prom_registers *regs;
-                int board = of_getintprop_default(busp, "board#", 0);
+                int board, slot;
-                int slot;
+                while (sbi) {
+                        if (!strcmp(sbi->name, "sbi"))
+                                break;
+                        sbi = sbi->parent;
+                }
+                if (!sbi)
+                        goto build_resources;
                regs = of_get_property(dp, "reg", NULL);
+                if (!regs)
+                        goto build_resources;
                slot = regs->which_io;
+                /* If SBI's parent is not io-unit or the io-unit lacks
+                 * a "board#" property, something is very wrong.
+                 */
+                if (!sbi->parent || strcmp(sbi->parent->name, "io-unit")) {
+                        printk("%s: Error, parent is not io-unit.\n",
+                               sbi->full_name);
+                        goto build_resources;
+                }
+                io_unit = sbi->parent;
+                board = of_getintprop_default(io_unit, "board#", -1);
+                if (board == -1) {
+                        printk("%s: Error, lacks board# property.\n",
+                               io_unit->full_name);
+                        goto build_resources;
+                }
                for (i = 0; i < op->num_irqs; i++) {
                        int this_irq = op->irqs[i];
                        int sbusl = pil_to_sbus[this_irq];
@@ -617,6 +644,7 @@ static struct of_device * __init scan_one_device(struct device_node *dp,
                }
        }
+build_resources:
        build_device_resources(op, parent);
        op->dev.parent = parent;
diff --git a/arch/sparc/kernel/prom.c b/arch/sparc/kernel/prom.c
index 4b06dcb00ebd..4ca9e5fc97f4 100644
--- a/arch/sparc/kernel/prom.c
+++ b/arch/sparc/kernel/prom.c
@@ -444,6 +444,7 @@ static struct property * __init build_one_prop(phandle node, char *prev, char *s
        static struct property *tmp = NULL;
        struct property *p;
        int len;
+        const char *name;
        if (tmp) {
                p = tmp;
@@ -456,19 +457,21 @@ static struct property * __init build_one_prop(phandle node, char *prev, char *s
        p->name = (char *) (p + 1);
        if (special_name) {
+                strcpy(p->name, special_name);
                p->length = special_len;
                p->value = prom_early_alloc(special_len);
                memcpy(p->value, special_val, special_len);
        } else {
                if (prev == NULL) {
-                        prom_firstprop(node, p->name);
+                        name = prom_firstprop(node, NULL);
                } else {
-                        prom_nextprop(node, prev, p->name);
+                        name = prom_nextprop(node, prev, NULL);
                }
-                if (strlen(p->name) == 0) {
+                if (strlen(name) == 0) {
                        tmp = p;
                        return NULL;
                }
+                strcpy(p->name, name);
                p->length = prom_getproplen(node, p->name);
                if (p->length <= 0) {
                        p->length = 0;
diff --git a/arch/sparc/kernel/smp.c b/arch/sparc/kernel/smp.c
index 6135d4faeeeb..e311ade1b490 100644
--- a/arch/sparc/kernel/smp.c
+++ b/arch/sparc/kernel/smp.c
@@ -87,6 +87,7 @@ void __cpuinit smp_store_cpu_info(int id)
 void __init smp_cpus_done(unsigned int max_cpus)
 {
        extern void smp4m_smp_done(void);
+        extern void smp4d_smp_done(void);
        unsigned long bogosum = 0;
        int cpu, num;
@@ -100,8 +101,34 @@ void __init smp_cpus_done(unsigned int max_cpus)
                num, bogosum/(500000/HZ),
                (bogosum/(5000/HZ))%100);
-        BUG_ON(sparc_cpu_model != sun4m);
+        switch(sparc_cpu_model) {
-        smp4m_smp_done();
+        case sun4:
+                printk("SUN4\n");
+                BUG();
+                break;
+        case sun4c:
+                printk("SUN4C\n");
+                BUG();
+                break;
+        case sun4m:
+                smp4m_smp_done();
+                break;
+        case sun4d:
+                smp4d_smp_done();
+                break;
+        case sun4e:
+                printk("SUN4E\n");
+                BUG();
+                break;
+        case sun4u:
+                printk("SUN4U\n");
+                BUG();
+                break;
+        default:
+                printk("UNKNOWN!\n");
+                BUG();
+                break;
+        };
 }
 void cpu_panic(void)
@@ -267,9 +294,9 @@ int setup_profiling_timer(unsigned int multiplier)
 void __init smp_prepare_cpus(unsigned int max_cpus)
 {
        extern void smp4m_boot_cpus(void);
+        extern void smp4d_boot_cpus(void);
        int i, cpuid, extra;
-        BUG_ON(sparc_cpu_model != sun4m);
        printk("Entering SMP Mode...\n");
        extra = 0;
@@ -283,7 +310,34 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
        smp_store_cpu_info(boot_cpu_id);
-        smp4m_boot_cpus();
+        switch(sparc_cpu_model) {
+        case sun4:
+                printk("SUN4\n");
+                BUG();
+                break;
+        case sun4c:
+                printk("SUN4C\n");
+                BUG();
+                break;
+        case sun4m:
+                smp4m_boot_cpus();
+                break;
+        case sun4d:
+                smp4d_boot_cpus();
+                break;
+        case sun4e:
+                printk("SUN4E\n");
+                BUG();
+                break;
+        case sun4u:
+                printk("SUN4U\n");
+                BUG();
+                break;
+        default:
+                printk("UNKNOWN!\n");
+                BUG();
+                break;
+        };
 }
 /* Set this up early so that things like the scheduler can init
@@ -323,9 +377,37 @@ void __init smp_prepare_boot_cpu(void)
 int __cpuinit __cpu_up(unsigned int cpu)
 {
        extern int smp4m_boot_one_cpu(int);
-        int ret;
+        extern int smp4d_boot_one_cpu(int);
+        int ret=0;
-        ret = smp4m_boot_one_cpu(cpu);
+        switch(sparc_cpu_model) {
+        case sun4:
+                printk("SUN4\n");
+                BUG();
+                break;
+        case sun4c:
+                printk("SUN4C\n");
+                BUG();
+                break;
+        case sun4m:
+                ret = smp4m_boot_one_cpu(cpu);
+                break;
+        case sun4d:
+                ret = smp4d_boot_one_cpu(cpu);
+                break;
+        case sun4e:
+                printk("SUN4E\n");
+                BUG();
+                break;
+        case sun4u:
+                printk("SUN4U\n");
+                BUG();
+                break;
+        default:
+                printk("UNKNOWN!\n");
+                BUG();
+                break;
+        };
        if (!ret) {
                cpu_set(cpu, smp_commenced_mask);
diff --git a/arch/sparc/kernel/sparc_ksyms.c b/arch/sparc/kernel/sparc_ksyms.c
index 5fb987fc3d63..4d441a554d35 100644
--- a/arch/sparc/kernel/sparc_ksyms.c
+++ b/arch/sparc/kernel/sparc_ksyms.c
@@ -237,7 +237,6 @@ EXPORT_SYMBOL(prom_node_has_property);
 EXPORT_SYMBOL(prom_setprop);
 EXPORT_SYMBOL(saved_command_line);
 EXPORT_SYMBOL(prom_apply_obio_ranges);
-EXPORT_SYMBOL(prom_getname);
 EXPORT_SYMBOL(prom_feval);
 EXPORT_SYMBOL(prom_getbool);
 EXPORT_SYMBOL(prom_getstring);
diff --git a/arch/sparc/kernel/sun4d_smp.c b/arch/sparc/kernel/sun4d_smp.c
index b141b7ee6717..ba843f6a2832 100644
--- a/arch/sparc/kernel/sun4d_smp.c
+++ b/arch/sparc/kernel/sun4d_smp.c
@@ -43,15 +43,10 @@ extern ctxd_t *srmmu_ctx_table_phys;
 extern void calibrate_delay(void);
 extern volatile int smp_processors_ready;
-extern int smp_num_cpus;
 static int smp_highest_cpu;
 extern volatile unsigned long cpu_callin_map[NR_CPUS];
 extern cpuinfo_sparc cpu_data[NR_CPUS];
 extern unsigned char boot_cpu_id;
-extern int smp_activated;
-extern volatile int __cpu_number_map[NR_CPUS];
-extern volatile int __cpu_logical_map[NR_CPUS];
-extern volatile unsigned long ipi_count;
 extern volatile int smp_process_available;
 extern cpumask_t smp_commenced_mask;
@@ -144,6 +139,8 @@ void __init smp4d_callin(void)
        spin_lock_irqsave(&sun4d_imsk_lock, flags);
        cc_set_imsk(cc_get_imsk() & ~0x4000); /* Allow PIL 14 as well */
        spin_unlock_irqrestore(&sun4d_imsk_lock, flags);
+        cpu_set(cpuid, cpu_online_map);
 }
 extern void init_IRQ(void);
@@ -160,51 +157,24 @@ extern unsigned long trapbase_cpu3[];
 void __init smp4d_boot_cpus(void)
 {
-        int cpucount = 0;
-        int i, mid;
-        printk("Entering SMP Mode...\n");
-        
        if (boot_cpu_id)
                current_set[0] = NULL;
-        local_irq_enable();
-        cpus_clear(cpu_present_map);
-        /* XXX This whole thing has to go.  See sparc64. */
-        for (i = 0; !cpu_find_by_instance(i, NULL, &mid); i++)
-                cpu_set(mid, cpu_present_map);
-        SMP_PRINTK(("cpu_present_map %08lx\n", cpus_addr(cpu_present_map)[0]));
-        for(i=0; i < NR_CPUS; i++)
-                __cpu_number_map[i] = -1;
-        for(i=0; i < NR_CPUS; i++)
-                __cpu_logical_map[i] = -1;
-        __cpu_number_map[boot_cpu_id] = 0;
-        __cpu_logical_map[0] = boot_cpu_id;
-        current_thread_info()->cpu = boot_cpu_id;
-        smp_store_cpu_info(boot_cpu_id);
        smp_setup_percpu_timer();
        local_flush_cache_all();
-        if (cpu_find_by_instance(1, NULL, NULL))
+}
-                return;  /* Not an MP box. */
-        SMP_PRINTK(("Iterating over CPUs\n"));
+int smp4d_boot_one_cpu(int i)
-        for(i = 0; i < NR_CPUS; i++) {
+{
-                if(i == boot_cpu_id)
-                        continue;
-                if (cpu_isset(i, cpu_present_map)) {
                        extern unsigned long sun4d_cpu_startup;
                        unsigned long *entry = &sun4d_cpu_startup;
                        struct task_struct *p;
                        int timeout;
-                        int no;
+                        int cpu_node;
+                        cpu_find_by_instance(i, &cpu_node,NULL);
                        /* Cook up an idler for this guy. */
                        p = fork_idle(i);
-                        cpucount++;
                        current_set[i] = task_thread_info(p);
-                        for (no = 0; !cpu_find_by_instance(no, NULL, &mid)
-                                     && mid != i; no++) ;
                        /*
                         * Initialize the contexts table
@@ -216,9 +186,9 @@ void __init smp4d_boot_cpus(void)
                        smp_penguin_ctable.reg_size = 0;
                        /* whirrr, whirrr, whirrrrrrrrr... */
-                        SMP_PRINTK(("Starting CPU %d at %p task %d node %08x\n", i, entry, cpucount, cpu_data(no).prom_node));
+                        SMP_PRINTK(("Starting CPU %d at %p \n", i, entry));
                        local_flush_cache_all();
-                        prom_startcpu(cpu_data(no).prom_node,
+                        prom_startcpu(cpu_node,
                                      &smp_penguin_ctable, 0, (char *)entry);
                                      
                        SMP_PRINTK(("prom_startcpu returned :)\n"));
@@ -230,39 +200,30 @@ void __init smp4d_boot_cpus(void)
                                udelay(200);
                        }
                        
-                        if(cpu_callin_map[i]) {
+        if (!(cpu_callin_map[i])) {
-                                /* Another "Red Snapper". */
+                printk("Processor %d is stuck.\n", i);
-                                __cpu_number_map[i] = cpucount;
+                return -ENODEV;
-                                __cpu_logical_map[cpucount] = i;
-                        } else {
-                                cpucount--;
-                                printk("Processor %d is stuck.\n", i);
-                        }
-                }
-                if(!(cpu_callin_map[i])) {
-                        cpu_clear(i, cpu_present_map);
-                        __cpu_number_map[i] = -1;
-                }
        }
        local_flush_cache_all();
-        if(cpucount == 0) {
+        return 0;
-                printk("Error: only one Processor found.\n");
+}
-                cpu_present_map = cpumask_of_cpu(hard_smp4d_processor_id());
-        } else {
+void __init smp4d_smp_done(void)
-                unsigned long bogosum = 0;
+{
-                
+        int i, first;
-                for_each_present_cpu(i) {
+        int *prev;
-                        bogosum += cpu_data(i).udelay_val;
-                        smp_highest_cpu = i;
+        /* setup cpu list for irq rotation */
+        first = 0;
+        prev = &first;
+        for (i = 0; i < NR_CPUS; i++)
+                if (cpu_online(i)) {
+                        *prev = i;
+                        prev = &cpu_data(i).next;
                }
-                SMP_PRINTK(("Total of %d Processors activated (%lu.%02lu BogoMIPS).\n", cpucount + 1, bogosum/(500000/HZ), (bogosum/(5000/HZ))%100));
+        *prev = first;
-                printk("Total of %d Processors activated (%lu.%02lu BogoMIPS).\n",
+        local_flush_cache_all();
-                       cpucount + 1,
-                       bogosum/(500000/HZ),
-                       (bogosum/(5000/HZ))%100);
-                smp_activated = 1;
-                smp_num_cpus = cpucount + 1;
-        }
        /* Free unneeded trap tables */
        ClearPageReserved(virt_to_page(trapbase_cpu1));
@@ -334,7 +295,7 @@ void smp4d_cross_call(smpfunc_t func, unsigned long arg1, unsigned long arg2,
                        register int i;
                        mask = cpumask_of_cpu(hard_smp4d_processor_id());
-                        cpus_andnot(mask, cpu_present_map, mask);
+                        cpus_andnot(mask, cpu_online_map, mask);
                        for(i = 0; i <= high; i++) {
                                if (cpu_isset(i, mask)) {
                                        ccall_info.processors_in[i] = 0;
diff --git a/arch/sparc/kernel/sys_sparc.c b/arch/sparc/kernel/sys_sparc.c
index 0cdfc9d294b4..a41c8a5c2007 100644
--- a/arch/sparc/kernel/sys_sparc.c
+++ b/arch/sparc/kernel/sys_sparc.c
@@ -465,21 +465,21 @@ sys_rt_sigaction(int sig,
 asmlinkage int sys_getdomainname(char __user *name, int len)
 {
-        int nlen;
+        int nlen, err;
-        int err = -EFAULT;
        
+        if (len < 0 || len > __NEW_UTS_LEN)
+                return -EINVAL;
        down_read(&uts_sem);
        
        nlen = strlen(system_utsname.domainname) + 1;
        if (nlen < len)
                len = nlen;
-        if (len > __NEW_UTS_LEN)
-                goto done;
+        err = -EFAULT;
-        if (copy_to_user(name, system_utsname.domainname, len))
+        if (!copy_to_user(name, system_utsname.domainname, len))
-                goto done;
+                err = 0;
-        err = 0;
-done:
        up_read(&uts_sem);
        return err;
 }
diff --git a/arch/sparc/mm/io-unit.c b/arch/sparc/mm/io-unit.c
index 42c1c700c0a7..2bb1309003dd 100644
--- a/arch/sparc/mm/io-unit.c
+++ b/arch/sparc/mm/io-unit.c
@@ -64,6 +64,7 @@ iounit_init(int sbi_node, int io_node, struct sbus_bus *sbus)
        
        sbus->iommu = (struct iommu_struct *)iounit;
        iounit->page_table = xpt;
+        spin_lock_init(&iounit->lock);
        
        for (xptend = iounit->page_table + (16 * PAGE_SIZE) / sizeof(iopte_t);
             xpt < xptend;)
diff --git a/arch/sparc/prom/tree.c b/arch/sparc/prom/tree.c
index 2bf03ee8cde5..5ec246573a98 100644
--- a/arch/sparc/prom/tree.c
+++ b/arch/sparc/prom/tree.c
@@ -205,24 +205,6 @@ int prom_searchsiblings(int node_start, char *nodename)
        return 0;
 }
-/* Gets name in the form prom v2+ uses it (name@x,yyyyy or name (if no reg)) */
-int prom_getname (int node, char *buffer, int len)
-{
-        int i;
-        struct linux_prom_registers reg[PROMREG_MAX];
-        
-        i = prom_getproperty (node, "name", buffer, len);
-        if (i <= 0) return -1;
-        buffer [i] = 0;
-        len -= i;
-        i = prom_getproperty (node, "reg", (char *)reg, sizeof (reg));
-        if (i <= 0) return 0;
-        if (len < 11) return -1;
-        buffer = strchr (buffer, 0);
-        sprintf (buffer, "@%x,%x", reg[0].which_io, (uint)reg[0].phys_addr);
-        return 0;
-}
 /* Interal version of nextprop that does not alter return values. */
 char * __prom_nextprop(int node, char * oprop)
 {
diff --git a/arch/sparc64/defconfig b/arch/sparc64/defconfig
index 38353621069e..43d9229fca07 100644
--- a/arch/sparc64/defconfig
+++ b/arch/sparc64/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.18-rc1
+# Linux kernel version: 2.6.18-rc2
-# Wed Jul 12 14:00:58 2006
+# Fri Jul 21 14:19:24 2006
 #
 CONFIG_SPARC=y
 CONFIG_SPARC64=y
@@ -36,6 +36,7 @@ CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
+# CONFIG_TASKSTATS is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
 # CONFIG_IKCONFIG is not set
@@ -1120,7 +1121,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_LEGOTOWER is not set
 # CONFIG_USB_LCD is not set
 # CONFIG_USB_LED is not set
-# CONFIG_USB_CY7C63 is not set
+# CONFIG_USB_CYPRESS_CY7C63 is not set
 # CONFIG_USB_CYTHERM is not set
 # CONFIG_USB_PHIDGETKIT is not set
 # CONFIG_USB_PHIDGETSERVO is not set
@@ -1279,7 +1280,6 @@ CONFIG_RAMFS=y
 # CONFIG_NFSD is not set
 # CONFIG_SMB_FS is not set
 # CONFIG_CIFS is not set
-# CONFIG_CIFS_DEBUG2 is not set
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
diff --git a/arch/sparc64/kernel/devices.c b/arch/sparc64/kernel/devices.c
index f8ef2f2b9b37..ec10f7edcf86 100644
--- a/arch/sparc64/kernel/devices.c
+++ b/arch/sparc64/kernel/devices.c
@@ -66,9 +66,6 @@ static int check_cpu_node(struct device_node *dp, int *cur_inst,
                          void *compare_arg,
                          struct device_node **dev_node, int *mid)
 {
-        if (strcmp(dp->type, "cpu"))
-                return -ENODEV;
        if (!compare(dp, *cur_inst, compare_arg)) {
                if (dev_node)
                        *dev_node = dp;
diff --git a/arch/sparc64/kernel/of_device.c b/arch/sparc64/kernel/of_device.c
index 7064cee290ae..238bbf6de07d 100644
--- a/arch/sparc64/kernel/of_device.c
+++ b/arch/sparc64/kernel/of_device.c
@@ -542,9 +542,17 @@ static void __init build_device_resources(struct of_device *op,
        /* Convert to num-cells.  */
        num_reg /= 4;
-        /* Conver to num-entries.  */
+        /* Convert to num-entries.  */
        num_reg /= na + ns;
+        /* Prevent overruning the op->resources[] array.  */
+        if (num_reg > PROMREG_MAX) {
+                printk(KERN_WARNING "%s: Too many regs (%d), "
+                       "limiting to %d.\n",
+                       op->node->full_name, num_reg, PROMREG_MAX);
+                num_reg = PROMREG_MAX;
+        }
        for (index = 0; index < num_reg; index++) {
                struct resource *r = &op->resource[index];
                u32 addr[OF_MAX_ADDR_CELLS];
@@ -650,8 +658,22 @@ apply_interrupt_map(struct device_node *dp, struct device_node *pp,
        next:
                imap += (na + 3);
        }
-        if (i == imlen)
+        if (i == imlen) {
+                /* Psycho and Sabre PCI controllers can have 'interrupt-map'
+                 * properties that do not include the on-board device
+                 * interrupts.  Instead, the device's 'interrupts' property
+                 * is already a fully specified INO value.
+                 *
+                 * Handle this by deciding that, if we didn't get a
+                 * match in the parent's 'interrupt-map', and the
+                 * parent is an IRQ translater, then use the parent as
+                 * our IRQ controller.
+                 */
+                if (pp->irq_trans)
+                        return pp;
                return NULL;
+        }
        *irq_p = irq;
        cp = of_find_node_by_phandle(handle);
@@ -803,6 +825,14 @@ static struct of_device * __init scan_one_device(struct device_node *dp,
                op->num_irqs = 0;
        }
+        /* Prevent overruning the op->irqs[] array.  */
+        if (op->num_irqs > PROMINTR_MAX) {
+                printk(KERN_WARNING "%s: Too many irqs (%d), "
+                       "limiting to %d.\n",
+                       dp->full_name, op->num_irqs, PROMINTR_MAX);
+                op->num_irqs = PROMINTR_MAX;
+        }
        build_device_resources(op, parent);
        for (i = 0; i < op->num_irqs; i++)
                op->irqs[i] = build_one_device_irq(op, parent, op->irqs[i]);
diff --git a/arch/sparc64/kernel/prom.c b/arch/sparc64/kernel/prom.c
index c86007a2aa3f..5cc5ab63293f 100644
--- a/arch/sparc64/kernel/prom.c
+++ b/arch/sparc64/kernel/prom.c
@@ -344,10 +344,12 @@ static unsigned long __psycho_onboard_imap_off[] = {
 /*0x2f*/        PSYCHO_IMAP_CE,
 /*0x30*/        PSYCHO_IMAP_A_ERR,
 /*0x31*/        PSYCHO_IMAP_B_ERR,
-/*0x32*/        PSYCHO_IMAP_PMGMT
+/*0x32*/        PSYCHO_IMAP_PMGMT,
+/*0x33*/        PSYCHO_IMAP_GFX,
+/*0x34*/        PSYCHO_IMAP_EUPA,
 };
 #define PSYCHO_ONBOARD_IRQ_BASE         0x20
-#define PSYCHO_ONBOARD_IRQ_LAST         0x32
+#define PSYCHO_ONBOARD_IRQ_LAST         0x34
 #define psycho_onboard_imap_offset(__ino) \
        __psycho_onboard_imap_off[(__ino) - PSYCHO_ONBOARD_IRQ_BASE]
@@ -529,6 +531,10 @@ static unsigned long __sabre_onboard_imap_off[] = {
 /*0x2e*/        SABRE_IMAP_UE,
 /*0x2f*/        SABRE_IMAP_CE,
 /*0x30*/        SABRE_IMAP_PCIERR,
+/*0x31*/        0 /* reserved */,
+/*0x32*/        0 /* reserved */,
+/*0x33*/        SABRE_IMAP_GFX,
+/*0x34*/        SABRE_IMAP_EUPA,
 };
 #define SABRE_ONBOARD_IRQ_BASE          0x20
 #define SABRE_ONBOARD_IRQ_LAST          0x30
@@ -895,6 +901,8 @@ static unsigned long sysio_irq_offsets[] = {
        SYSIO_IMAP_CE,
        SYSIO_IMAP_SBERR,
        SYSIO_IMAP_PMGMT,
+        SYSIO_IMAP_GFX,
+        SYSIO_IMAP_EUPA,
 };
 #undef bogon
diff --git a/arch/sparc64/kernel/sparc64_ksyms.c b/arch/sparc64/kernel/sparc64_ksyms.c
index 237524d87cab..beffc82a1e85 100644
--- a/arch/sparc64/kernel/sparc64_ksyms.c
+++ b/arch/sparc64/kernel/sparc64_ksyms.c
@@ -254,7 +254,6 @@ EXPORT_SYMBOL(prom_getproperty);
 EXPORT_SYMBOL(prom_node_has_property);
 EXPORT_SYMBOL(prom_setprop);
 EXPORT_SYMBOL(saved_command_line);
-EXPORT_SYMBOL(prom_getname);
 EXPORT_SYMBOL(prom_finddevice);
 EXPORT_SYMBOL(prom_feval);
 EXPORT_SYMBOL(prom_getbool);
diff --git a/arch/sparc64/kernel/sys_sparc.c b/arch/sparc64/kernel/sys_sparc.c
index 51c056df528e..054d0abdb7ee 100644
--- a/arch/sparc64/kernel/sys_sparc.c
+++ b/arch/sparc64/kernel/sys_sparc.c
@@ -701,21 +701,21 @@ extern void check_pending(int signum);
 asmlinkage long sys_getdomainname(char __user *name, int len)
 {
-        int nlen;
+        int nlen, err;
-        int err = -EFAULT;
+        if (len < 0 || len > __NEW_UTS_LEN)
+                return -EINVAL;
        down_read(&uts_sem);
        
        nlen = strlen(system_utsname.domainname) + 1;
        if (nlen < len)
                len = nlen;
-        if (len > __NEW_UTS_LEN)
-                goto done;
+        err = -EFAULT;
-        if (copy_to_user(name, system_utsname.domainname, len))
+        if (!copy_to_user(name, system_utsname.domainname, len))
-                goto done;
+                err = 0;
-        err = 0;
-done:
        up_read(&uts_sem);
        return err;
 }
diff --git a/arch/sparc64/prom/tree.c b/arch/sparc64/prom/tree.c
index 49075abd7cbc..500f05e2cfcb 100644
--- a/arch/sparc64/prom/tree.c
+++ b/arch/sparc64/prom/tree.c
@@ -193,91 +193,6 @@ prom_searchsiblings(int node_start, const char *nodename)
        return 0;
 }
-/* Gets name in the {name@x,yyyyy|name (if no reg)} form */
-int 
-prom_getname (int node, char *buffer, int len)
-{
-        int i, sbus = 0;
-        int pci = 0, ebus = 0, ide = 0;
-        struct linux_prom_registers *reg;
-        struct linux_prom64_registers reg64[PROMREG_MAX];
-        
-        for (sbus = prom_getparent (node); sbus; sbus = prom_getparent (sbus)) {
-                i = prom_getproperty (sbus, "name", buffer, len);
-                if (i > 0) {
-                        buffer [i] = 0;
-                        if (!strcmp (buffer, "sbus"))
-                                goto getit;
-                }
-        }
-        if ((pci = prom_getparent (node))) {
-                i = prom_getproperty (pci, "name", buffer, len);
-                if (i > 0) {
-                        buffer [i] = 0;
-                        if (!strcmp (buffer, "pci"))
-                                goto getit;
-                }
-                pci = 0;
-        }
-        if ((ebus = prom_getparent (node))) {
-                i = prom_getproperty (ebus, "name", buffer, len);
-                if (i > 0) {
-                        buffer[i] = 0;
-                        if (!strcmp (buffer, "ebus"))
-                                goto getit;
-                }
-                ebus = 0;
-        }
-        if ((ide = prom_getparent (node))) {
-                i = prom_getproperty (ide, "name", buffer, len);
-                if (i > 0) {
-                        buffer [i] = 0;
-                        if (!strcmp (buffer, "ide"))
-                                goto getit;
-                }
-                ide = 0;
-        }
-getit:
-        i = prom_getproperty (node, "name", buffer, len);
-        if (i <= 0) {
-                buffer [0] = 0;
-                return -1;
-        }
-        buffer [i] = 0;
-        len -= i;
-        i = prom_getproperty (node, "reg", (char *)reg64, sizeof (reg64));
-        if (i <= 0) return 0;
-        if (len < 16) return -1;
-        buffer = strchr (buffer, 0);
-        if (sbus) {
-                reg = (struct linux_prom_registers *)reg64;
-                sprintf (buffer, "@%x,%x", reg[0].which_io, (uint)reg[0].phys_addr);
-        } else if (pci) {
-                int dev, fn;
-                reg = (struct linux_prom_registers *)reg64;
-                fn = (reg[0].which_io >> 8) & 0x07;
-                dev = (reg[0].which_io >> 11) & 0x1f;
-                if (fn)
-                        sprintf (buffer, "@%x,%x", dev, fn);
-                else
-                        sprintf (buffer, "@%x", dev);
-        } else if (ebus) {
-                reg = (struct linux_prom_registers *)reg64;
-                sprintf (buffer, "@%x,%x", reg[0].which_io, reg[0].phys_addr);
-        } else if (ide) {
-                reg = (struct linux_prom_registers *)reg64;
-                sprintf (buffer, "@%x,%x", reg[0].which_io, reg[0].phys_addr);
-        } else if (i == 4) {    /* Happens on 8042's children on Ultra/PCI. */
-                reg = (struct linux_prom_registers *)reg64;
-                sprintf (buffer, "@%x", reg[0].which_io);
-        } else {
-                sprintf (buffer, "@%x,%x",
-                         (unsigned int)(reg64[0].phys_addr >> 36),
-                         (unsigned int)(reg64[0].phys_addr));
-        }
-        return 0;
-}
 /* Return the first property type for node 'node'.
 * buffer should be at least 32B in length
 */
diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
index 17bc8abd5df5..00f574cbb0d4 100644
--- a/drivers/char/pcmcia/synclink_cs.c
+++ b/drivers/char/pcmcia/synclink_cs.c
@@ -1174,8 +1174,12 @@ static void dcd_change(MGSLPC_INFO *info)
        else
                info->input_signal_events.dcd_down++;
 #ifdef CONFIG_HDLC
-        if (info->netcount)
+        if (info->netcount) {
-                hdlc_set_carrier(info->serial_signals & SerialSignal_DCD, info->netdev);
+                if (info->serial_signals & SerialSignal_DCD)
+                        netif_carrier_on(info->netdev);
+                else
+                        netif_carrier_off(info->netdev);
+        }
 #endif
        wake_up_interruptible(&info->status_event_wait_q);
        wake_up_interruptible(&info->event_wait_q);
@@ -4251,8 +4255,10 @@ static int hdlcdev_open(struct net_device *dev)
        spin_lock_irqsave(&info->lock, flags);
        get_signals(info);
        spin_unlock_irqrestore(&info->lock, flags);
-        hdlc_set_carrier(info->serial_signals & SerialSignal_DCD, dev);
+        if (info->serial_signals & SerialSignal_DCD)
+                netif_carrier_on(dev);
+        else
+                netif_carrier_off(dev);
        return 0;
 }
diff --git a/drivers/char/synclink.c b/drivers/char/synclink.c
index df782dd1098c..78b1b1a2732b 100644
--- a/drivers/char/synclink.c
+++ b/drivers/char/synclink.c
@@ -1344,8 +1344,12 @@ static void mgsl_isr_io_pin( struct mgsl_struct *info )
                        } else
                                info->input_signal_events.dcd_down++;
 #ifdef CONFIG_HDLC
-                        if (info->netcount)
+                        if (info->netcount) {
-                                hdlc_set_carrier(status & MISCSTATUS_DCD, info->netdev);
+                                if (status & MISCSTATUS_DCD)
+                                        netif_carrier_on(info->netdev);
+                                else
+                                        netif_carrier_off(info->netdev);
+                        }
 #endif
                }
                if (status & MISCSTATUS_CTS_LATCHED)
@@ -7844,8 +7848,10 @@ static int hdlcdev_open(struct net_device *dev)
        spin_lock_irqsave(&info->irq_spinlock, flags);
        usc_get_serial_signals(info);
        spin_unlock_irqrestore(&info->irq_spinlock, flags);
-        hdlc_set_carrier(info->serial_signals & SerialSignal_DCD, dev);
+        if (info->serial_signals & SerialSignal_DCD)
+                netif_carrier_on(dev);
+        else
+                netif_carrier_off(dev);
        return 0;
 }
diff --git a/drivers/char/synclink_gt.c b/drivers/char/synclink_gt.c
index e829594195c1..b2dbbdb1bf81 100644
--- a/drivers/char/synclink_gt.c
+++ b/drivers/char/synclink_gt.c
@@ -1497,8 +1497,10 @@ static int hdlcdev_open(struct net_device *dev)
        spin_lock_irqsave(&info->lock, flags);
        get_signals(info);
        spin_unlock_irqrestore(&info->lock, flags);
-        hdlc_set_carrier(info->signals & SerialSignal_DCD, dev);
+        if (info->signals & SerialSignal_DCD)
+                netif_carrier_on(dev);
+        else
+                netif_carrier_off(dev);
        return 0;
 }
@@ -1997,8 +1999,12 @@ static void dcd_change(struct slgt_info *info)
                info->input_signal_events.dcd_down++;
        }
 #ifdef CONFIG_HDLC
-        if (info->netcount)
+        if (info->netcount) {
-                hdlc_set_carrier(info->signals & SerialSignal_DCD, info->netdev);
+                if (info->signals & SerialSignal_DCD)
+                        netif_carrier_on(info->netdev);
+                else
+                        netif_carrier_off(info->netdev);
+        }
 #endif
        wake_up_interruptible(&info->status_event_wait_q);
        wake_up_interruptible(&info->event_wait_q);
diff --git a/drivers/char/synclinkmp.c b/drivers/char/synclinkmp.c
index 1e443a233f51..66f3754fbbdf 100644
--- a/drivers/char/synclinkmp.c
+++ b/drivers/char/synclinkmp.c
@@ -1752,8 +1752,10 @@ static int hdlcdev_open(struct net_device *dev)
        spin_lock_irqsave(&info->lock, flags);
        get_signals(info);
        spin_unlock_irqrestore(&info->lock, flags);
-        hdlc_set_carrier(info->serial_signals & SerialSignal_DCD, dev);
+        if (info->serial_signals & SerialSignal_DCD)
+                netif_carrier_on(dev);
+        else
+                netif_carrier_off(dev);
        return 0;
 }
@@ -2522,8 +2524,12 @@ void isr_io_pin( SLMP_INFO *info, u16 status )
                        } else
                                info->input_signal_events.dcd_down++;
 #ifdef CONFIG_HDLC
-                        if (info->netcount)
+                        if (info->netcount) {
-                                hdlc_set_carrier(status & SerialSignal_DCD, info->netdev);
+                                if (status & SerialSignal_DCD)
+                                        netif_carrier_on(info->netdev);
+                                else
+                                        netif_carrier_off(info->netdev);
+                        }
 #endif
                }
                if (status & MISCSTATUS_CTS_LATCHED)
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index 87299924e735..178f0c547eb7 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -239,6 +239,8 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
        total_ticks = (unsigned int) cputime64_sub(cur_jiffies,
                        this_dbs_info->prev_cpu_wall);
        this_dbs_info->prev_cpu_wall = cur_jiffies;
+        if (!total_ticks)
+                return;
        /*
         * Every sampling_rate, we check, if current idle time is less
         * than 20% (default), then we try to increase frequency
@@ -304,6 +306,9 @@ static void do_dbs_timer(void *data)
        unsigned int cpu = smp_processor_id();
        struct cpu_dbs_info_s *dbs_info = &per_cpu(cpu_dbs_info, cpu);
+        if (!dbs_info->enable)
+                return;
        dbs_check_cpu(dbs_info);
        queue_delayed_work_on(cpu, kondemand_wq, &dbs_info->work,
                        usecs_to_jiffies(dbs_tuners_ins.sampling_rate));
@@ -319,11 +324,11 @@ static inline void dbs_timer_init(unsigned int cpu)
        return;
 }
-static inline void dbs_timer_exit(unsigned int cpu)
+static inline void dbs_timer_exit(struct cpu_dbs_info_s *dbs_info)
 {
-        struct cpu_dbs_info_s *dbs_info = &per_cpu(cpu_dbs_info, cpu);
+        dbs_info->enable = 0;
+        cancel_delayed_work(&dbs_info->work);
-        cancel_rearming_delayed_workqueue(kondemand_wq, &dbs_info->work);
+        flush_workqueue(kondemand_wq);
 }
 static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
@@ -396,8 +401,7 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
        case CPUFREQ_GOV_STOP:
                mutex_lock(&dbs_mutex);
-                dbs_timer_exit(policy->cpu);
+                dbs_timer_exit(this_dbs_info);
-                this_dbs_info->enable = 0;
                sysfs_remove_group(&policy->kobj, &dbs_attr_group);
                dbs_enable--;
                if (dbs_enable == 0)
diff --git a/drivers/dma/ioatdma.c b/drivers/dma/ioatdma.c
index 78bf46d917b7..dbd4d6c3698e 100644
--- a/drivers/dma/ioatdma.c
+++ b/drivers/dma/ioatdma.c
@@ -828,7 +828,7 @@ static int __init ioat_init_module(void)
        /* if forced, worst case is that rmmod hangs */
        __unsafe(THIS_MODULE);
-        return pci_module_init(&ioat_pci_drv);
+        return pci_register_driver(&ioat_pci_drv);
 }
 module_init(ioat_init_module);
diff --git a/drivers/fc4/fc.c b/drivers/fc4/fc.c
index 66d03f242d3c..1a159e8843ca 100644
--- a/drivers/fc4/fc.c
+++ b/drivers/fc4/fc.c
@@ -429,7 +429,7 @@ static inline void fcp_scsi_receive(fc_channel *fc, int token, int status, fc_hd
                
                if (fcmd->data) {
                        if (SCpnt->use_sg)
-                                dma_unmap_sg(fc->dev, (struct scatterlist *)SCpnt->buffer,
+                                dma_unmap_sg(fc->dev, (struct scatterlist *)SCpnt->request_buffer,
                                                SCpnt->use_sg,
                                                SCpnt->sc_data_direction);
                        else
@@ -810,7 +810,7 @@ static int fcp_scsi_queue_it(fc_channel *fc, Scsi_Cmnd *SCpnt, fcp_cmnd *fcmd, i
                                                             SCpnt->request_bufflen,
                                                             SCpnt->sc_data_direction);
                        } else {
-                                struct scatterlist *sg = (struct scatterlist *)SCpnt->buffer;
+                                struct scatterlist *sg = (struct scatterlist *)SCpnt->request_buffer;
                                int nents;
                                FCD(("XXX: Use_sg %d %d\n", SCpnt->use_sg, sg->length))
diff --git a/drivers/message/fusion/Kconfig b/drivers/message/fusion/Kconfig
index bbc229852881..ea31d8470510 100644
--- a/drivers/message/fusion/Kconfig
+++ b/drivers/message/fusion/Kconfig
@@ -48,10 +48,8 @@ config FUSION_SAS
          List of supported controllers:
          LSISAS1064
-          LSISAS1066
          LSISAS1068
          LSISAS1064E
-          LSISAS1066E
          LSISAS1068E
 config FUSION_MAX_SGE
diff --git a/drivers/message/fusion/Makefile b/drivers/message/fusion/Makefile
index b114236f4395..341691390e86 100644
--- a/drivers/message/fusion/Makefile
+++ b/drivers/message/fusion/Makefile
@@ -9,7 +9,6 @@
 #EXTRA_CFLAGS += -DMPT_DEBUG_EXIT
 #EXTRA_CFLAGS += -DMPT_DEBUG_FAIL
 #
 # driver/module specifics...
 #
diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
index 43308df64623..29d0635cce1d 100644
--- a/drivers/message/fusion/mptbase.c
+++ b/drivers/message/fusion/mptbase.c
@@ -436,8 +436,6 @@ mpt_base_reply(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *reply)
                 */
                if (pEvReply->MsgFlags & MPI_MSGFLAGS_CONTINUATION_REPLY) {
                        freereq = 0;
-                        devtverboseprintk((MYIOC_s_WARN_FMT "EVENT_NOTIFICATION reply %p does not return Request frame\n",
-                                ioc->name, pEvReply));
                } else {
                        devtverboseprintk((MYIOC_s_WARN_FMT "EVENT_NOTIFICATION reply %p returns Request frame\n",
                                ioc->name, pEvReply));
@@ -678,19 +676,19 @@ int
 mpt_device_driver_register(struct mpt_pci_driver * dd_cbfunc, int cb_idx)
 {
        MPT_ADAPTER     *ioc;
+        const struct pci_device_id *id;
-        if (cb_idx < 1 || cb_idx >= MPT_MAX_PROTOCOL_DRIVERS) {
+        if (cb_idx < 1 || cb_idx >= MPT_MAX_PROTOCOL_DRIVERS)
                return -EINVAL;
-        }
        MptDeviceDriverHandlers[cb_idx] = dd_cbfunc;
        /* call per pci device probe entry point */
        list_for_each_entry(ioc, &ioc_list, list) {
-                if(dd_cbfunc->probe) {
+                id = ioc->pcidev->driver ?
-                        dd_cbfunc->probe(ioc->pcidev,
+                    ioc->pcidev->driver->id_table : NULL;
-                          ioc->pcidev->driver->id_table);
+                if (dd_cbfunc->probe)
-                }
+                        dd_cbfunc->probe(ioc->pcidev, id);
         }
        return 0;
@@ -1056,9 +1054,8 @@ mpt_host_page_alloc(MPT_ADAPTER *ioc, pIOCInit_t ioc_init)
                                dinitprintk((MYIOC_s_INFO_FMT
                                    "host_page_buffer @ %p, dma @ %x, sz=%d bytes\n",
-                                    ioc->name,
+                                    ioc->name, ioc->HostPageBuffer,
-                                    ioc->HostPageBuffer,
+                                    (u32)ioc->HostPageBuffer_dma,
-                                    ioc->HostPageBuffer_dma,
                                    host_page_buffer_sz));
                                ioc->alloc_total += host_page_buffer_sz;
                                ioc->HostPageBuffer_sz = host_page_buffer_sz;
@@ -1380,6 +1377,7 @@ mpt_attach(struct pci_dev *pdev, const struct pci_device_id *id)
                printk(KERN_WARNING MYNAM
                  ": WARNING - %s did not initialize properly! (%d)\n",
                  ioc->name, r);
                list_del(&ioc->list);
                if (ioc->alt_ioc)
                        ioc->alt_ioc->alt_ioc = NULL;
@@ -1762,9 +1760,9 @@ mpt_do_ioc_recovery(MPT_ADAPTER *ioc, u32 reason, int sleepFlag)
                                                 * chips (mpt_adapter_disable,
                                                 * mpt_diag_reset)
                                                 */
-                                                ioc->cached_fw = NULL;
                                                ddlprintk((MYIOC_s_INFO_FMT ": mpt_upload:  alt_%s has cached_fw=%p \n",
                                                        ioc->name, ioc->alt_ioc->name, ioc->alt_ioc->cached_fw));
+                                                ioc->alt_ioc->cached_fw = NULL;
                                        }
                                } else {
                                        printk(KERN_WARNING MYNAM ": firmware upload failure!\n");
@@ -1885,7 +1883,7 @@ mpt_do_ioc_recovery(MPT_ADAPTER *ioc, u32 reason, int sleepFlag)
                /* FIXME?  Examine results here? */
        }
-out:
+ out:
        if ((ret != 0) && irq_allocated) {
                free_irq(ioc->pci_irq, ioc);
                if (mpt_msi_enable)
@@ -2670,6 +2668,7 @@ SendIocInit(MPT_ADAPTER *ioc, int sleepFlag)
        dinitprintk((MYIOC_s_INFO_FMT "INFO - Wait IOC_OPERATIONAL state (cnt=%d)\n",
                        ioc->name, count));
+        ioc->aen_event_read_flag=0;
        return r;
 }
@@ -2737,6 +2736,8 @@ mpt_alloc_fw_memory(MPT_ADAPTER *ioc, int size)
        if (ioc->alt_ioc && ioc->alt_ioc->cached_fw) {
                ioc->cached_fw = ioc->alt_ioc->cached_fw;  /* use alt_ioc's memory */
                ioc->cached_fw_dma = ioc->alt_ioc->cached_fw_dma;
+                ioc->alloc_total += size;
+                ioc->alt_ioc->alloc_total -= size;
        } else {
                if ( (ioc->cached_fw = pci_alloc_consistent(ioc->pcidev, size, &ioc->cached_fw_dma) ) )
                        ioc->alloc_total += size;
@@ -3166,6 +3167,7 @@ KickStart(MPT_ADAPTER *ioc, int force, int sleepFlag)
 static int
 mpt_diag_reset(MPT_ADAPTER *ioc, int ignore, int sleepFlag)
 {
+        MPT_ADAPTER     *iocp=NULL;
        u32 diag0val;
        u32 doorbell;
        int hard_reset_done = 0;
@@ -3301,17 +3303,23 @@ mpt_diag_reset(MPT_ADAPTER *ioc, int ignore, int sleepFlag)
                        /* FIXME?  Examine results here? */
                }
-                if (ioc->cached_fw) {
+                if (ioc->cached_fw)
+                        iocp = ioc;
+                else if (ioc->alt_ioc && ioc->alt_ioc->cached_fw)
+                        iocp = ioc->alt_ioc;
+                if (iocp) {
                        /* If the DownloadBoot operation fails, the
                         * IOC will be left unusable. This is a fatal error
                         * case.  _diag_reset will return < 0
                         */
                        for (count = 0; count < 30; count ++) {
-                                diag0val = CHIPREG_READ32(&ioc->chip->Diagnostic);
+                                diag0val = CHIPREG_READ32(&iocp->chip->Diagnostic);
                                if (!(diag0val & MPI_DIAG_RESET_ADAPTER)) {
                                        break;
                                }
+                                dprintk((MYIOC_s_INFO_FMT "cached_fw: diag0val=%x count=%d\n",
+                                        iocp->name, diag0val, count));
                                /* wait 1 sec */
                                if (sleepFlag == CAN_SLEEP) {
                                        msleep (1000);
@@ -3320,7 +3328,7 @@ mpt_diag_reset(MPT_ADAPTER *ioc, int ignore, int sleepFlag)
                                }
                        }
                        if ((count = mpt_downloadboot(ioc,
-                                (MpiFwHeader_t *)ioc->cached_fw, sleepFlag)) < 0) {
+                                (MpiFwHeader_t *)iocp->cached_fw, sleepFlag)) < 0) {
                                printk(KERN_WARNING MYNAM
                                        ": firmware downloadboot failure (%d)!\n", count);
                        }
@@ -3907,18 +3915,18 @@ WaitForDoorbellAck(MPT_ADAPTER *ioc, int howlong, int sleepFlag)
        if (sleepFlag == CAN_SLEEP) {
                while (--cntdn) {
+                        msleep (1);
                        intstat = CHIPREG_READ32(&ioc->chip->IntStatus);
                        if (! (intstat & MPI_HIS_IOP_DOORBELL_STATUS))
                                break;
-                        msleep (1);
                        count++;
                }
        } else {
                while (--cntdn) {
+                        mdelay (1);
                        intstat = CHIPREG_READ32(&ioc->chip->IntStatus);
                        if (! (intstat & MPI_HIS_IOP_DOORBELL_STATUS))
                                break;
-                        mdelay (1);
                        count++;
                }
        }
@@ -4883,6 +4891,7 @@ mpt_read_ioc_pg_4(MPT_ADAPTER *ioc)
                pIoc4 = pci_alloc_consistent(ioc->pcidev, iocpage4sz, &ioc4_dma);
                if (!pIoc4)
                        return;
+                ioc->alloc_total += iocpage4sz;
        } else {
                ioc4_dma = ioc->spi_data.IocPg4_dma;
                iocpage4sz = ioc->spi_data.IocPg4Sz;
@@ -4899,6 +4908,7 @@ mpt_read_ioc_pg_4(MPT_ADAPTER *ioc)
        } else {
                pci_free_consistent(ioc->pcidev, iocpage4sz, pIoc4, ioc4_dma);
                ioc->spi_data.pIocPg4 = NULL;
+                ioc->alloc_total -= iocpage4sz;
        }
 }
@@ -5030,19 +5040,18 @@ SendEventAck(MPT_ADAPTER *ioc, EventNotificationReply_t *evnp)
        EventAck_t      *pAck;
        if ((pAck = (EventAck_t *) mpt_get_msg_frame(mpt_base_index, ioc)) == NULL) {
-                printk(MYIOC_s_WARN_FMT "Unable to allocate event ACK "
+                dfailprintk((MYIOC_s_WARN_FMT "%s, no msg frames!!\n",
-                        "request frame for Event=%x EventContext=%x EventData=%x!\n",
+                    ioc->name,__FUNCTION__));
-                        ioc->name, evnp->Event, le32_to_cpu(evnp->EventContext),
-                        le32_to_cpu(evnp->Data[0]));
                return -1;
        }
-        memset(pAck, 0, sizeof(*pAck));
-        dprintk((MYIOC_s_INFO_FMT "Sending EventAck\n", ioc->name));
+        devtverboseprintk((MYIOC_s_INFO_FMT "Sending EventAck\n", ioc->name));
        pAck->Function     = MPI_FUNCTION_EVENT_ACK;
        pAck->ChainOffset  = 0;
+        pAck->Reserved[0]  = pAck->Reserved[1] = 0;
        pAck->MsgFlags     = 0;
+        pAck->Reserved1[0] = pAck->Reserved1[1] = pAck->Reserved1[2] = 0;
        pAck->Event        = evnp->Event;
        pAck->EventContext = evnp->EventContext;
@@ -5704,9 +5713,9 @@ EventDescriptionStr(u8 event, u32 evData0, char *evStr)
                break;
        case MPI_EVENT_EVENT_CHANGE:
                if (evData0)
-                        ds = "Events(ON) Change";
+                        ds = "Events ON";
                else
-                        ds = "Events(OFF) Change";
+                        ds = "Events OFF";
                break;
        case MPI_EVENT_INTEGRATED_RAID:
        {
@@ -5777,8 +5786,27 @@ EventDescriptionStr(u8 event, u32 evData0, char *evStr)
                        break;
                case MPI_EVENT_SAS_DEV_STAT_RC_NO_PERSIST_ADDED:
                        snprintf(evStr, EVENT_DESCR_STR_SZ,
-                            "SAS Device Status Change: No Persistancy "
+                            "SAS Device Status Change: No Persistancy: id=%d", id);
-                            "Added: id=%d", id);
+                        break;
+                case MPI_EVENT_SAS_DEV_STAT_RC_INTERNAL_DEVICE_RESET:
+                        snprintf(evStr, EVENT_DESCR_STR_SZ,
+                            "SAS Device Status Change: Internal Device Reset : id=%d", id);
+                        break;
+                case MPI_EVENT_SAS_DEV_STAT_RC_TASK_ABORT_INTERNAL:
+                        snprintf(evStr, EVENT_DESCR_STR_SZ,
+                            "SAS Device Status Change: Internal Task Abort : id=%d", id);
+                        break;
+                case MPI_EVENT_SAS_DEV_STAT_RC_ABORT_TASK_SET_INTERNAL:
+                        snprintf(evStr, EVENT_DESCR_STR_SZ,
+                            "SAS Device Status Change: Internal Abort Task Set : id=%d", id);
+                        break;
+                case MPI_EVENT_SAS_DEV_STAT_RC_CLEAR_TASK_SET_INTERNAL:
+                        snprintf(evStr, EVENT_DESCR_STR_SZ,
+                            "SAS Device Status Change: Internal Clear Task Set : id=%d", id);
+                        break;
+                case MPI_EVENT_SAS_DEV_STAT_RC_QUERY_TASK_INTERNAL:
+                        snprintf(evStr, EVENT_DESCR_STR_SZ,
+                            "SAS Device Status Change: Internal Query Task : id=%d", id);
                        break;
                default:
                        snprintf(evStr, EVENT_DESCR_STR_SZ,
@@ -6034,7 +6062,7 @@ ProcessEventNotification(MPT_ADAPTER *ioc, EventNotificationReply_t *pEventReply
 *      @ioc: Pointer to MPT_ADAPTER structure
 *      @log_info: U32 LogInfo reply word from the IOC
 *
- *      Refer to lsi/fc_log.h.
+ *      Refer to lsi/mpi_log_fc.h.
 */
 static void
 mpt_fc_log_info(MPT_ADAPTER *ioc, u32 log_info)
@@ -6131,8 +6159,10 @@ mpt_spi_log_info(MPT_ADAPTER *ioc, u32 log_info)
                "Invalid SAS Address",                          /* 01h */
                NULL,                                           /* 02h */
                "Invalid Page",                                 /* 03h */
-                NULL,                                           /* 04h */
+                "Diag Message Error",                           /* 04h */
-                "Task Terminated"                               /* 05h */
+                "Task Terminated",                              /* 05h */
+                "Enclosure Management",                         /* 06h */
+                "Target Mode"                                   /* 07h */
        };
        static char *pl_code_str[] = {
                NULL,                                           /* 00h */
@@ -6158,7 +6188,7 @@ mpt_spi_log_info(MPT_ADAPTER *ioc, u32 log_info)
                "IO Executed",                                  /* 14h */
                "Persistant Reservation Out Not Affiliation Owner", /* 15h */
                "Open Transmit DMA Abort",                      /* 16h */
-                NULL,                                           /* 17h */
+                "IO Device Missing Delay Retry",                /* 17h */
                NULL,                                           /* 18h */
                NULL,                                           /* 19h */
                NULL,                                           /* 1Ah */
@@ -6238,7 +6268,7 @@ static void
 mpt_sp_ioc_info(MPT_ADAPTER *ioc, u32 ioc_status, MPT_FRAME_HDR *mf)
 {
        u32 status = ioc_status & MPI_IOCSTATUS_MASK;
-        char *desc = "";
+        char *desc = NULL;
        switch (status) {
        case MPI_IOCSTATUS_INVALID_FUNCTION: /* 0x0001 */
@@ -6348,7 +6378,7 @@ mpt_sp_ioc_info(MPT_ADAPTER *ioc, u32 ioc_status, MPT_FRAME_HDR *mf)
                desc = "Others";
                break;
        }
-        if (desc != "")
+        if (desc != NULL)
                printk(MYIOC_s_INFO_FMT "IOCStatus(0x%04x): %s\n", ioc->name, status, desc);
 }
@@ -6386,7 +6416,6 @@ EXPORT_SYMBOL(mpt_alloc_fw_memory);
 EXPORT_SYMBOL(mpt_free_fw_memory);
 EXPORT_SYMBOL(mptbase_sas_persist_operation);
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /*
 *      fusion_init - Fusion MPT base driver initialization routine.
diff --git a/drivers/message/fusion/mptbase.h b/drivers/message/fusion/mptbase.h
index a5ce10b67d02..d4cb144ab402 100644
--- a/drivers/message/fusion/mptbase.h
+++ b/drivers/message/fusion/mptbase.h
@@ -75,8 +75,8 @@
 #define COPYRIGHT       "Copyright (c) 1999-2005 " MODULEAUTHOR
 #endif
-#define MPT_LINUX_VERSION_COMMON        "3.04.00"
+#define MPT_LINUX_VERSION_COMMON        "3.04.01"
-#define MPT_LINUX_PACKAGE_NAME          "@(#)mptlinux-3.04.00"
+#define MPT_LINUX_PACKAGE_NAME          "@(#)mptlinux-3.04.01"
 #define WHAT_MAGIC_STRING               "@" "(" "#" ")"
 #define show_mptmod_ver(s,ver)  \
@@ -307,8 +307,8 @@ typedef struct _SYSIF_REGS
        u32     HostIndex;      /* 50     Host Index register        */
        u32     Reserved4[15];  /* 54-8F                             */
        u32     Fubar;          /* 90     For Fubar usage            */
-        u32     Reserved5[1050];/* 94-10F8                           */
+        u32     Reserved5[1050];/* 94-10F8                           */
-        u32     Reset_1078;     /* 10FC   Reset 1078                 */
+        u32     Reset_1078;     /* 10FC   Reset 1078                 */
 } SYSIF_REGS;
 /*
@@ -363,6 +363,7 @@ typedef struct _VirtDevice {
 #define MPT_TARGET_FLAGS_VALID_56       0x10
 #define MPT_TARGET_FLAGS_SAF_TE_ISSUED  0x20
 #define MPT_TARGET_FLAGS_RAID_COMPONENT 0x40
+#define MPT_TARGET_FLAGS_LED_ON         0x80
 /*
 *      /proc/mpt interface
@@ -634,7 +635,6 @@ typedef struct _MPT_ADAPTER
        u16                      handle;
        int                      sas_index; /* index refrencing */
        MPT_SAS_MGMT             sas_mgmt;
-        int                      num_ports;
        struct work_struct       sas_persist_task;
        struct work_struct       fc_setup_reset_work;
@@ -644,7 +644,6 @@ typedef struct _MPT_ADAPTER
        struct work_struct       fc_rescan_work;
        char                     fc_rescan_work_q_name[KOBJ_NAME_LEN];
        struct workqueue_struct *fc_rescan_work_q;
-        u8              port_serial_number;
 } MPT_ADAPTER;
 /*
@@ -982,7 +981,7 @@ typedef struct _MPT_SCSI_HOST {
        wait_queue_head_t         scandv_waitq;
        int                       scandv_wait_done;
        long                      last_queue_full;
-        u8                        mpt_pq_filter;
+        u16                       tm_iocstatus;
 } MPT_SCSI_HOST;
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c
index b4967bb8a7d6..30975ccd9947 100644
--- a/drivers/message/fusion/mptctl.c
+++ b/drivers/message/fusion/mptctl.c
@@ -2332,7 +2332,7 @@ done_free_mem:
 }
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
-/* Prototype Routine for the HP HOST INFO command.
+/* Prototype Routine for the HOST INFO command.
 *
 * Outputs:     None.
 * Return:      0 if successful
@@ -2568,7 +2568,7 @@ mptctl_hp_hostinfo(unsigned long arg, unsigned int data_size)
 }
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
-/* Prototype Routine for the HP TARGET INFO command.
+/* Prototype Routine for the TARGET INFO command.
 *
 * Outputs:     None.
 * Return:      0 if successful
diff --git a/drivers/message/fusion/mptctl.h b/drivers/message/fusion/mptctl.h
index a2f8a97992e6..043941882c6e 100644
--- a/drivers/message/fusion/mptctl.h
+++ b/drivers/message/fusion/mptctl.h
@@ -354,9 +354,6 @@ struct mpt_ioctl_command32 {
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
-/*
- *      HP Specific IOCTL Defines and Structures
- */
 #define CPQFCTS_IOC_MAGIC 'Z'
 #define HP_IOC_MAGIC 'Z'
@@ -364,8 +361,6 @@ struct mpt_ioctl_command32 {
 #define HP_GETHOSTINFO1         _IOR(HP_IOC_MAGIC, 20, hp_host_info_rev0_t)
 #define HP_GETTARGETINFO        _IOR(HP_IOC_MAGIC, 21, hp_target_info_t)
-/* All HP IOCTLs must include this header
- */
 typedef struct _hp_header {
        unsigned int iocnum;
        unsigned int host;
diff --git a/drivers/message/fusion/mptfc.c b/drivers/message/fusion/mptfc.c
index a8f2fa985455..90da7d63b08e 100644
--- a/drivers/message/fusion/mptfc.c
+++ b/drivers/message/fusion/mptfc.c
@@ -77,10 +77,6 @@ MODULE_DESCRIPTION(my_NAME);
 MODULE_LICENSE("GPL");
 /* Command line args */
-static int mpt_pq_filter = 0;
-module_param(mpt_pq_filter, int, 0);
-MODULE_PARM_DESC(mpt_pq_filter, " Enable peripheral qualifier filter: enable=1  (default=0)");
 #define MPTFC_DEV_LOSS_TMO (60)
 static int mptfc_dev_loss_tmo = MPTFC_DEV_LOSS_TMO;     /* reasonable default */
 module_param(mptfc_dev_loss_tmo, int, 0);
@@ -513,8 +509,7 @@ mptfc_slave_alloc(struct scsi_device *sdev)
        if (vtarget->num_luns == 0) {
                vtarget->ioc_id = hd->ioc->id;
-                vtarget->tflags = MPT_TARGET_FLAGS_Q_YES |
+                vtarget->tflags = MPT_TARGET_FLAGS_Q_YES;
-                                  MPT_TARGET_FLAGS_VALID_INQUIRY;
                hd->Targets[sdev->id] = vtarget;
        }
@@ -1129,13 +1124,6 @@ mptfc_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        hd->timer.data = (unsigned long) hd;
        hd->timer.function = mptscsih_timer_expired;
-        hd->mpt_pq_filter = mpt_pq_filter;
-        ddvprintk((MYIOC_s_INFO_FMT
-                "mpt_pq_filter %x\n",
-                ioc->name, 
-                mpt_pq_filter));
        init_waitqueue_head(&hd->scandv_waitq);
        hd->scandv_wait_done = 0;
        hd->last_queue_full = 0;
diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
index f7bd8b11ed3b..f66f2203143a 100644
--- a/drivers/message/fusion/mptsas.c
+++ b/drivers/message/fusion/mptsas.c
@@ -67,20 +67,19 @@
 #define my_VERSION      MPT_LINUX_VERSION_COMMON
 #define MYNAM           "mptsas"
+/*
+ * Reserved channel for integrated raid
+ */
+#define MPTSAS_RAID_CHANNEL     1
 MODULE_AUTHOR(MODULEAUTHOR);
 MODULE_DESCRIPTION(my_NAME);
 MODULE_LICENSE("GPL");
-static int mpt_pq_filter;
-module_param(mpt_pq_filter, int, 0);
-MODULE_PARM_DESC(mpt_pq_filter,
-                "Enable peripheral qualifier filter: enable=1  "
-                "(default=0)");
 static int mpt_pt_clear;
 module_param(mpt_pt_clear, int, 0);
 MODULE_PARM_DESC(mpt_pt_clear,
-                "Clear persistency table: enable=1  "
+                " Clear persistency table: enable=1  "
                "(default=MPTSCSIH_PT_CLEAR=0)");
 static int      mptsasDoneCtx = -1;
@@ -144,7 +143,6 @@ struct mptsas_devinfo {
 * Specific details on ports, wide/narrow
 */
 struct mptsas_portinfo_details{
-        u8      port_id;        /* port number provided to transport */
        u16     num_phys;       /* number of phys belong to this port */
        u64     phy_bitmask;    /* TODO, extend support for 255 phys */
        struct sas_rphy *rphy;  /* transport layer rphy object */
@@ -350,10 +348,10 @@ mptsas_port_delete(struct mptsas_portinfo_details * port_details)
        port_info = port_details->port_info;
        phy_info = port_info->phy_info;
-        dsaswideprintk((KERN_DEBUG "%s: [%p]: port=%02d num_phys=%02d "
+        dsaswideprintk((KERN_DEBUG "%s: [%p]: num_phys=%02d "
                "bitmask=0x%016llX\n",
-                __FUNCTION__, port_details, port_details->port_id,
+                __FUNCTION__, port_details, port_details->num_phys,
-                port_details->num_phys, port_details->phy_bitmask));
+                    port_details->phy_bitmask));
        for (i = 0; i < port_info->num_phys; i++, phy_info++) {
                if(phy_info->port_details != port_details)
@@ -462,9 +460,8 @@ mptsas_setup_wide_ports(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info)
                 * phy be removed by firmware events.
                 */
                dsaswideprintk((KERN_DEBUG
-                        "%s: [%p]: port=%d deleting phy = %d\n",
+                        "%s: [%p]: deleting phy = %d\n",
-                        __FUNCTION__, port_details,
+                        __FUNCTION__, port_details, i));
-                        port_details->port_id, i));
                port_details->num_phys--;
                port_details->phy_bitmask &= ~ (1 << phy_info->phy_id);
                memset(&phy_info->attached, 0, sizeof(struct mptsas_devinfo));
@@ -493,7 +490,6 @@ mptsas_setup_wide_ports(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info)
                                goto out;
                        port_details->num_phys = 1;
                        port_details->port_info = port_info;
-                        port_details->port_id = ioc->port_serial_number++;
                        if (phy_info->phy_id < 64 )
                                port_details->phy_bitmask |=
                                    (1 << phy_info->phy_id);
@@ -525,12 +521,8 @@ mptsas_setup_wide_ports(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info)
                                    mptsas_get_port(phy_info_cmp);
                                port_details->starget =
                                    mptsas_get_starget(phy_info_cmp);
-                                port_details->port_id =
-                                        phy_info_cmp->port_details->port_id;
                                port_details->num_phys =
                                        phy_info_cmp->port_details->num_phys;
-//                              port_info->port_serial_number--;
-                                ioc->port_serial_number--;
                                if (!phy_info_cmp->port_details->num_phys)
                                        kfree(phy_info_cmp->port_details);
                        } else
@@ -554,11 +546,11 @@ mptsas_setup_wide_ports(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info)
                if (!port_details)
                        continue;
                dsaswideprintk((KERN_DEBUG
-                        "%s: [%p]: phy_id=%02d port_id=%02d num_phys=%02d "
+                        "%s: [%p]: phy_id=%02d num_phys=%02d "
                        "bitmask=0x%016llX\n",
                        __FUNCTION__,
-                        port_details, i, port_details->port_id,
+                        port_details, i, port_details->num_phys,
-                        port_details->num_phys, port_details->phy_bitmask));
+                        port_details->phy_bitmask));
                dsaswideprintk((KERN_DEBUG"\t\tport = %p rphy=%p\n",
                        port_details->port, port_details->rphy));
        }
@@ -651,16 +643,13 @@ mptsas_sas_enclosure_pg0(MPT_ADAPTER *ioc, struct mptsas_enclosure *enclosure,
 static int
 mptsas_slave_configure(struct scsi_device *sdev)
 {
-        struct Scsi_Host        *host = sdev->host;
-        MPT_SCSI_HOST           *hd = (MPT_SCSI_HOST *)host->hostdata;
-        /*
+        if (sdev->channel == MPTSAS_RAID_CHANNEL)
-         * RAID volumes placed beyond the last expected port.
+                goto out;
-         * Ignore sending sas mode pages in that case..
-         */
+        sas_read_port_mode_page(sdev);
-        if (sdev->channel < hd->ioc->num_ports)
-                sas_read_port_mode_page(sdev);
+ out:
        return mptscsih_slave_configure(sdev);
 }
@@ -689,10 +678,7 @@ mptsas_target_alloc(struct scsi_target *starget)
        hd->Targets[target_id] = vtarget;
-        /*
+        if (starget->channel == MPTSAS_RAID_CHANNEL)
-         * RAID volumes placed beyond the last expected port.
-         */
-        if (starget->channel == hd->ioc->num_ports)
                goto out;
        rphy = dev_to_rphy(starget->dev.parent);
@@ -743,7 +729,7 @@ mptsas_target_destroy(struct scsi_target *starget)
        if (!starget->hostdata)
                return;
-        if (starget->channel == hd->ioc->num_ports)
+        if (starget->channel == MPTSAS_RAID_CHANNEL)
                goto out;
        rphy = dev_to_rphy(starget->dev.parent);
@@ -783,10 +769,7 @@ mptsas_slave_alloc(struct scsi_device *sdev)
        starget = scsi_target(sdev);
        vdev->vtarget = starget->hostdata;
-        /*
+        if (sdev->channel == MPTSAS_RAID_CHANNEL)
-         * RAID volumes placed beyond the last expected port.
-         */
-        if (sdev->channel == hd->ioc->num_ports)
                goto out;
        rphy = dev_to_rphy(sdev->sdev_target->dev.parent);
@@ -1608,11 +1591,7 @@ static int mptsas_probe_one_phy(struct device *dev,
        if (phy_info->sas_port_add_phy) {
                if (!port) {
-                        port = sas_port_alloc(dev,
+                        port = sas_port_alloc_num(dev);
-                            phy_info->port_details->port_id);
-                        dsaswideprintk((KERN_DEBUG
-                            "sas_port_alloc: port=%p dev=%p port_id=%d\n",
-                            port, dev, phy_info->port_details->port_id));
                        if (!port) {
                                error = -ENOMEM;
                                goto out;
@@ -1625,6 +1604,9 @@ static int mptsas_probe_one_phy(struct device *dev,
                                goto out;
                        }
                        mptsas_set_port(phy_info, port);
+                        dsaswideprintk((KERN_DEBUG
+                            "sas_port_alloc: port=%p dev=%p port_id=%d\n",
+                            port, dev, port->port_identifier));
                }
                dsaswideprintk((KERN_DEBUG "sas_port_add_phy: phy_id=%d\n",
                    phy_info->phy_id));
@@ -1736,7 +1718,6 @@ mptsas_probe_hba_phys(MPT_ADAPTER *ioc)
                hba = NULL;
        }
        mutex_unlock(&ioc->sas_topology_mutex);
-        ioc->num_ports = port_info->num_phys;
        for (i = 0; i < port_info->num_phys; i++) {
                mptsas_sas_phy_pg0(ioc, &port_info->phy_info[i],
@@ -1939,7 +1920,8 @@ mptsas_delete_expander_phys(MPT_ADAPTER *ioc)
                                        expander_sas_address)
                                        continue;
 #ifdef MPT_DEBUG_SAS_WIDE
-                                dev_printk(KERN_DEBUG, &port->dev, "delete\n");
+                                dev_printk(KERN_DEBUG, &port->dev,
+                                    "delete port (%d)\n", port->port_identifier);
 #endif
                                sas_port_delete(port);
                                mptsas_port_delete(phy_info->port_details);
@@ -1984,7 +1966,7 @@ mptsas_scan_sas_topology(MPT_ADAPTER *ioc)
        if (!ioc->raid_data.pIocPg2->NumActiveVolumes)
                goto out;
        for (i=0; i<ioc->raid_data.pIocPg2->NumActiveVolumes; i++) {
-                scsi_add_device(ioc->sh, ioc->num_ports,
+                scsi_add_device(ioc->sh, MPTSAS_RAID_CHANNEL,
                    ioc->raid_data.pIocPg2->RaidVolume[i].VolumeID, 0);
        }
 out:
@@ -2185,7 +2167,8 @@ mptsas_hotplug_work(void *arg)
                       ioc->name, ds, ev->channel, ev->id, phy_info->phy_id);
 #ifdef MPT_DEBUG_SAS_WIDE
-                dev_printk(KERN_DEBUG, &port->dev, "delete\n");
+                dev_printk(KERN_DEBUG, &port->dev,
+                    "delete port (%d)\n", port->port_identifier);
 #endif
                sas_port_delete(port);
                mptsas_port_delete(phy_info->port_details);
@@ -2289,35 +2272,26 @@ mptsas_hotplug_work(void *arg)
                mptsas_set_rphy(phy_info, rphy);
                break;
        case MPTSAS_ADD_RAID:
-                sdev = scsi_device_lookup(
+                sdev = scsi_device_lookup(ioc->sh, MPTSAS_RAID_CHANNEL,
-                        ioc->sh,
+                    ev->id, 0);
-                        ioc->num_ports,
-                        ev->id,
-                        0);
                if (sdev) {
                        scsi_device_put(sdev);
                        break;
                }
                printk(MYIOC_s_INFO_FMT
                       "attaching raid volume, channel %d, id %d\n",
-                       ioc->name, ioc->num_ports, ev->id);
+                       ioc->name, MPTSAS_RAID_CHANNEL, ev->id);
-                scsi_add_device(ioc->sh,
+                scsi_add_device(ioc->sh, MPTSAS_RAID_CHANNEL, ev->id, 0);
-                        ioc->num_ports,
-                        ev->id,
-                        0);
                mpt_findImVolumes(ioc);
                break;
        case MPTSAS_DEL_RAID:
-                sdev = scsi_device_lookup(
+                sdev = scsi_device_lookup(ioc->sh, MPTSAS_RAID_CHANNEL,
-                        ioc->sh,
+                    ev->id, 0);
-                        ioc->num_ports,
-                        ev->id,
-                        0);
                if (!sdev)
                        break;
                printk(MYIOC_s_INFO_FMT
                       "removing raid volume, channel %d, id %d\n",
-                       ioc->name, ioc->num_ports, ev->id);
+                       ioc->name, MPTSAS_RAID_CHANNEL, ev->id);
                vdevice = sdev->hostdata;
                vdevice->vtarget->deleted = 1;
                mptsas_target_reset(ioc, vdevice->vtarget);
@@ -2723,7 +2697,6 @@ mptsas_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        hd->timer.data = (unsigned long) hd;
        hd->timer.function = mptscsih_timer_expired;
-        hd->mpt_pq_filter = mpt_pq_filter;
        ioc->sas_data.ptClear = mpt_pt_clear;
        if (ioc->sas_data.ptClear==1) {
@@ -2731,12 +2704,6 @@ mptsas_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                    ioc, MPI_SAS_OP_CLEAR_ALL_PERSISTENT);
        }
-        ddvprintk((MYIOC_s_INFO_FMT
-                "mpt_pq_filter %x mpt_pq_filter %x\n",
-                ioc->name,
-                mpt_pq_filter,
-                mpt_pq_filter));
        init_waitqueue_head(&hd->scandv_waitq);
        hd->scandv_wait_done = 0;
        hd->last_queue_full = 0;
diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
index 8242b16e3168..30524dc54b16 100644
--- a/drivers/message/fusion/mptscsih.c
+++ b/drivers/message/fusion/mptscsih.c
@@ -66,6 +66,7 @@
 #include "mptbase.h"
 #include "mptscsih.h"
+#include "lsi/mpi_log_sas.h"
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 #define my_NAME         "Fusion MPT SCSI Host driver"
@@ -127,7 +128,7 @@ static void	mptscsih_freeChainBuffers(MPT_ADAPTER *ioc, int req_idx);
 static void     mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR *mf, SCSIIOReply_t *pScsiReply);
 static int      mptscsih_tm_pending_wait(MPT_SCSI_HOST * hd);
 static int      mptscsih_tm_wait_for_completion(MPT_SCSI_HOST * hd, ulong timeout );
-static u32      SCPNT_TO_LOOKUP_IDX(struct scsi_cmnd *sc);
+static int      SCPNT_TO_LOOKUP_IDX(struct scsi_cmnd *sc);
 static int      mptscsih_IssueTaskMgmt(MPT_SCSI_HOST *hd, u8 type, u8 channel, u8 target, u8 lun, int ctx2abort, ulong timeout);
@@ -497,6 +498,34 @@ nextSGEset:
        return SUCCESS;
 } /* mptscsih_AddSGE() */
+static void
+mptscsih_issue_sep_command(MPT_ADAPTER *ioc, VirtTarget *vtarget,
+    U32 SlotStatus)
+{
+        MPT_FRAME_HDR *mf;
+        SEPRequest_t     *SEPMsg;
+        if (ioc->bus_type == FC)
+                return;
+        if ((mf = mpt_get_msg_frame(ioc->InternalCtx, ioc)) == NULL) {
+                dfailprintk((MYIOC_s_WARN_FMT "%s: no msg frames!!\n",
+                    ioc->name,__FUNCTION__));
+                return;
+        }
+        SEPMsg = (SEPRequest_t *)mf;
+        SEPMsg->Function = MPI_FUNCTION_SCSI_ENCLOSURE_PROCESSOR;
+        SEPMsg->Bus = vtarget->bus_id;
+        SEPMsg->TargetID = vtarget->target_id;
+        SEPMsg->Action = MPI_SEP_REQ_ACTION_WRITE_STATUS;
+        SEPMsg->SlotStatus = SlotStatus;
+        devtverboseprintk((MYIOC_s_WARN_FMT
+            "Sending SEP cmd=%x id=%d bus=%d\n",
+            ioc->name, SlotStatus, SEPMsg->TargetID, SEPMsg->Bus));
+        mpt_put_msg_frame(ioc->DoneCtx, ioc, mf);
+}
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /*
 *      mptscsih_io_done - Main SCSI IO callback routine registered to
@@ -520,6 +549,8 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
        SCSIIORequest_t *pScsiReq;
        SCSIIOReply_t   *pScsiReply;
        u16              req_idx, req_idx_MR;
+        VirtDevice       *vdev;
+        VirtTarget       *vtarget;
        hd = (MPT_SCSI_HOST *) ioc->sh->hostdata;
@@ -538,6 +569,7 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
        }
        sc = hd->ScsiLookup[req_idx];
+        hd->ScsiLookup[req_idx] = NULL;
        if (sc == NULL) {
                MPIHeader_t *hdr = (MPIHeader_t *)mf;
@@ -553,6 +585,12 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
                return 1;
        }
+        if ((unsigned char *)mf != sc->host_scribble) {
+                mptscsih_freeChainBuffers(ioc, req_idx);
+                return 1;
+        }
+        sc->host_scribble = NULL;
        sc->result = DID_OK << 16;              /* Set default reply as OK */
        pScsiReq = (SCSIIORequest_t *) mf;
        pScsiReply = (SCSIIOReply_t *) mr;
@@ -640,10 +678,36 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
                        if (hd->sel_timeout[pScsiReq->TargetID] < 0xFFFF)
                                hd->sel_timeout[pScsiReq->TargetID]++;
+                        vdev = sc->device->hostdata;
+                        if (!vdev)
+                                break;
+                        vtarget = vdev->vtarget;
+                        if (vtarget->tflags & MPT_TARGET_FLAGS_LED_ON) {
+                                mptscsih_issue_sep_command(ioc, vtarget,
+                                    MPI_SEP_REQ_SLOTSTATUS_UNCONFIGURED);
+                                vtarget->tflags &= ~MPT_TARGET_FLAGS_LED_ON;
+                        }
                        break;
-                case MPI_IOCSTATUS_SCSI_TASK_TERMINATED:        /* 0x0048 */
                case MPI_IOCSTATUS_SCSI_IOC_TERMINATED:         /* 0x004B */
+                        if ( ioc->bus_type == SAS ) {
+                                u16 ioc_status = le16_to_cpu(pScsiReply->IOCStatus);
+                                if (ioc_status & MPI_IOCSTATUS_FLAG_LOG_INFO_AVAILABLE) {
+                                        u32 log_info = le32_to_cpu(mr->u.reply.IOCLogInfo);
+                                        log_info &=SAS_LOGINFO_MASK;
+                                        if (log_info == SAS_LOGINFO_NEXUS_LOSS) {
+                                                sc->result = (DID_BUS_BUSY << 16);
+                                                break;
+                                        }
+                                }
+                        }
+                        /*
+                         * Allow non-SAS & non-NEXUS_LOSS to drop into below code
+                         */
+                case MPI_IOCSTATUS_SCSI_TASK_TERMINATED:        /* 0x0048 */
                case MPI_IOCSTATUS_SCSI_EXT_TERMINATED:         /* 0x004C */
                        /* Linux handles an unsolicited DID_RESET better
                         * than an unsolicited DID_ABORT.
@@ -658,7 +722,7 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
                                sc->result=DID_SOFT_ERROR << 16;
                        else /* Sufficient data transfer occurred */
                                sc->result = (DID_OK << 16) | scsi_status;
-                        dreplyprintk((KERN_NOTICE 
+                        dreplyprintk((KERN_NOTICE
                            "RESIDUAL_MISMATCH: result=%x on id=%d\n", sc->result, sc->device->id));
                        break;
@@ -784,8 +848,6 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
                                sc->request_bufflen, sc->sc_data_direction);
        }
-        hd->ScsiLookup[req_idx] = NULL;
        sc->scsi_done(sc);              /* Issue the command callback */
        /* Free Chain buffers */
@@ -827,9 +889,17 @@ mptscsih_flush_running_cmds(MPT_SCSI_HOST *hd)
                        dmfprintk(( "flush: ScsiDone (mf=%p,sc=%p)\n",
                                        mf, SCpnt));
+                        /* Free Chain buffers */
+                        mptscsih_freeChainBuffers(ioc, ii);
+                        /* Free Message frames */
+                        mpt_free_msg_frame(ioc, mf);
+                        if ((unsigned char *)mf != SCpnt->host_scribble)
+                                continue;
                        /* Set status, free OS resources (SG DMA buffers)
                         * Do OS callback
-                         * Free driver resources (chain, msg buffers)
                         */
                        if (SCpnt->use_sg) {
                                pci_unmap_sg(ioc->pcidev,
@@ -845,12 +915,6 @@ mptscsih_flush_running_cmds(MPT_SCSI_HOST *hd)
                        SCpnt->result = DID_RESET << 16;
                        SCpnt->host_scribble = NULL;
-                        /* Free Chain buffers */
-                        mptscsih_freeChainBuffers(ioc, ii);
-                        /* Free Message frames */
-                        mpt_free_msg_frame(ioc, mf);
                        SCpnt->scsi_done(SCpnt);        /* Issue the command callback */
                }
        }
@@ -887,10 +951,10 @@ mptscsih_search_running_cmds(MPT_SCSI_HOST *hd, VirtDevice *vdevice)
                if ((sc = hd->ScsiLookup[ii]) != NULL) {
                        mf = (SCSIIORequest_t *)MPT_INDEX_2_MFPTR(hd->ioc, ii);
+                        if (mf == NULL)
+                                continue;
                        dsprintk(( "search_running: found (sc=%p, mf = %p) target %d, lun %d \n",
                                        hd->ScsiLookup[ii], mf, mf->TargetID, mf->LUN[1]));
                        if ((mf->TargetID != ((u8)vdevice->vtarget->target_id)) || (mf->LUN[1] != ((u8) vdevice->lun)))
                                continue;
@@ -899,6 +963,8 @@ mptscsih_search_running_cmds(MPT_SCSI_HOST *hd, VirtDevice *vdevice)
                        hd->ScsiLookup[ii] = NULL;
                        mptscsih_freeChainBuffers(hd->ioc, ii);
                        mpt_free_msg_frame(hd->ioc, (MPT_FRAME_HDR *)mf);
+                        if ((unsigned char *)mf != sc->host_scribble)
+                                continue;
                        if (sc->use_sg) {
                                pci_unmap_sg(hd->ioc->pcidev,
                                (struct scatterlist *) sc->request_buffer,
@@ -1341,8 +1407,8 @@ mptscsih_qcmd(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd *))
                        goto fail;
        }
+        SCpnt->host_scribble = (unsigned char *)mf;
        hd->ScsiLookup[my_idx] = SCpnt;
-        SCpnt->host_scribble = NULL;
        mpt_put_msg_frame(hd->ioc->DoneCtx, hd->ioc, mf);
        dmfprintk((MYIOC_s_INFO_FMT "Issued SCSI cmd (%p) mf=%p idx=%d\n",
@@ -1529,6 +1595,12 @@ mptscsih_TMHandler(MPT_SCSI_HOST *hd, u8 type, u8 channel, u8 target, u8 lun, in
                rc = mpt_HardResetHandler(hd->ioc, CAN_SLEEP);
        }
+        /*
+         * Check IOCStatus from TM reply message
+         */
+         if (hd->tm_iocstatus != MPI_IOCSTATUS_SUCCESS)
+                rc = FAILED;
        dtmprintk((MYIOC_s_INFO_FMT "TMHandler rc = %d!\n", hd->ioc->name, rc));
        return rc;
@@ -1654,6 +1726,7 @@ mptscsih_abort(struct scsi_cmnd * SCpnt)
        int              scpnt_idx;
        int              retval;
        VirtDevice       *vdev;
+        ulong            sn = SCpnt->serial_number;
        /* If we can't locate our host adapter structure, return FAILED status.
         */
@@ -1707,6 +1780,11 @@ mptscsih_abort(struct scsi_cmnd * SCpnt)
                vdev->vtarget->bus_id, vdev->vtarget->target_id, vdev->lun,
                ctx2abort, mptscsih_get_tm_timeout(hd->ioc));
+        if (SCPNT_TO_LOOKUP_IDX(SCpnt) == scpnt_idx &&
+            SCpnt->serial_number == sn) {
+                retval = FAILED;
+        }
        printk (KERN_WARNING MYNAM ": %s: task abort: %s (sc=%p)\n",
                hd->ioc->name,
                ((retval == 0) ? "SUCCESS" : "FAILED" ), SCpnt);
@@ -2023,6 +2101,7 @@ mptscsih_taskmgmt_complete(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *m
                DBG_DUMP_TM_REPLY_FRAME((u32 *)pScsiTmReply);
                iocstatus = le16_to_cpu(pScsiTmReply->IOCStatus) & MPI_IOCSTATUS_MASK;
+                hd->tm_iocstatus = iocstatus;
                dtmprintk((MYIOC_s_WARN_FMT "  SCSI TaskMgmt (%d) IOCStatus=%04x IOCLogInfo=%08x\n",
                        ioc->name, tmType, iocstatus, le32_to_cpu(pScsiTmReply->IOCLogInfo)));
                /* Error?  (anything non-zero?) */
@@ -2401,6 +2480,13 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR
                                ioc->events[idx].data[1] = (sense_data[13] << 8) || sense_data[12];
                                ioc->eventContext++;
+                                if (hd->ioc->pcidev->vendor ==
+                                    PCI_VENDOR_ID_IBM) {
+                                        mptscsih_issue_sep_command(hd->ioc,
+                                            vdev->vtarget, MPI_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT);
+                                        vdev->vtarget->tflags |=
+                                            MPT_TARGET_FLAGS_LED_ON;
+                                }
                        }
                }
        } else {
@@ -2409,7 +2495,7 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR
        }
 }
-static u32
+static int
 SCPNT_TO_LOOKUP_IDX(struct scsi_cmnd *sc)
 {
        MPT_SCSI_HOST *hd;
diff --git a/drivers/message/fusion/mptspi.c b/drivers/message/fusion/mptspi.c
index 0a1ff762205f..e4cc3dd5fc9f 100644
--- a/drivers/message/fusion/mptspi.c
+++ b/drivers/message/fusion/mptspi.c
@@ -83,10 +83,6 @@ static int mpt_saf_te = MPTSCSIH_SAF_TE;
 module_param(mpt_saf_te, int, 0);
 MODULE_PARM_DESC(mpt_saf_te, " Force enabling SEP Processor: enable=1  (default=MPTSCSIH_SAF_TE=0)");
-static int mpt_pq_filter = 0;
-module_param(mpt_pq_filter, int, 0);
-MODULE_PARM_DESC(mpt_pq_filter, " Enable peripheral qualifier filter: enable=1  (default=0)");
 static void mptspi_write_offset(struct scsi_target *, int);
 static void mptspi_write_width(struct scsi_target *, int);
 static int mptspi_write_spi_device_pg1(struct scsi_target *,
@@ -1047,14 +1043,12 @@ mptspi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        hd->timer.function = mptscsih_timer_expired;
        ioc->spi_data.Saf_Te = mpt_saf_te;
-        hd->mpt_pq_filter = mpt_pq_filter;
        hd->negoNvram = MPT_SCSICFG_USE_NVRAM;
        ddvprintk((MYIOC_s_INFO_FMT
-                "saf_te %x mpt_pq_filter %x\n",
+                "saf_te %x\n",
                ioc->name,
-                mpt_saf_te,
+                mpt_saf_te));
-                mpt_pq_filter));
        ioc->spi_data.noQas = 0;
        init_waitqueue_head(&hd->scandv_waitq);
diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
index 36d511729f71..2146cf74425e 100644
--- a/drivers/net/dummy.c
+++ b/drivers/net/dummy.c
@@ -132,6 +132,7 @@ static int __init dummy_init_module(void)
        for (i = 0; i < numdummies && !err; i++)
                err = dummy_init_one(i); 
        if (err) { 
+                i--;
                while (--i >= 0)
                        dummy_free_one(i);
        }
diff --git a/drivers/net/e1000/e1000.h b/drivers/net/e1000/e1000.h
index f411bbb44f86..d304297c496c 100644
--- a/drivers/net/e1000/e1000.h
+++ b/drivers/net/e1000/e1000.h
@@ -110,6 +110,9 @@ struct e1000_adapter;
 #define E1000_MIN_RXD                       80
 #define E1000_MAX_82544_RXD               4096
+/* this is the size past which hardware will drop packets when setting LPE=0 */
+#define MAXIMUM_ETHERNET_VLAN_SIZE 1522
 /* Supported Rx Buffer Sizes */
 #define E1000_RXBUFFER_128   128    /* Used for packet split */
 #define E1000_RXBUFFER_256   256    /* Used for packet split */
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 6d3d41934503..da62db897426 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -36,7 +36,7 @@ static char e1000_driver_string[] = "Intel(R) PRO/1000 Network Driver";
 #else
 #define DRIVERNAPI "-NAPI"
 #endif
-#define DRV_VERSION "7.1.9-k2"DRIVERNAPI
+#define DRV_VERSION "7.1.9-k4"DRIVERNAPI
 char e1000_driver_version[] = DRV_VERSION;
 static char e1000_copyright[] = "Copyright (c) 1999-2006 Intel Corporation.";
@@ -1068,7 +1068,7 @@ e1000_sw_init(struct e1000_adapter *adapter)
        pci_read_config_word(pdev, PCI_COMMAND, &hw->pci_cmd_word);
-        adapter->rx_buffer_len = MAXIMUM_ETHERNET_FRAME_SIZE;
+        adapter->rx_buffer_len = MAXIMUM_ETHERNET_VLAN_SIZE;
        adapter->rx_ps_bsize0 = E1000_RXBUFFER_128;
        hw->max_frame_size = netdev->mtu +
                             ENET_HEADER_SIZE + ETHERNET_FCS_SIZE;
@@ -3148,7 +3148,6 @@ e1000_change_mtu(struct net_device *netdev, int new_mtu)
                adapter->rx_buffer_len = E1000_RXBUFFER_16384;
        /* adjust allocation if LPE protects us, and we aren't using SBP */
-#define MAXIMUM_ETHERNET_VLAN_SIZE 1522
        if (!adapter->hw.tbi_compatibility_on &&
            ((max_frame == MAXIMUM_ETHERNET_FRAME_SIZE) ||
             (max_frame == MAXIMUM_ETHERNET_VLAN_SIZE)))
@@ -3387,8 +3386,8 @@ e1000_intr(int irq, void *data, struct pt_regs *regs)
                E1000_WRITE_REG(hw, IMC, ~0);
                E1000_WRITE_FLUSH(hw);
        }
-        if (likely(netif_rx_schedule_prep(&adapter->polling_netdev[0])))
+        if (likely(netif_rx_schedule_prep(netdev)))
-                __netif_rx_schedule(&adapter->polling_netdev[0]);
+                __netif_rx_schedule(netdev);
        else
                e1000_irq_enable(adapter);
 #else
@@ -3431,34 +3430,26 @@ e1000_clean(struct net_device *poll_dev, int *budget)
 {
        struct e1000_adapter *adapter;
        int work_to_do = min(*budget, poll_dev->quota);
-        int tx_cleaned = 0, i = 0, work_done = 0;
+        int tx_cleaned = 0, work_done = 0;
        /* Must NOT use netdev_priv macro here. */
        adapter = poll_dev->priv;
        /* Keep link state information with original netdev */
-        if (!netif_carrier_ok(adapter->netdev))
+        if (!netif_carrier_ok(poll_dev))
                goto quit_polling;
-        while (poll_dev != &adapter->polling_netdev[i]) {
+        /* e1000_clean is called per-cpu.  This lock protects
-                i++;
+         * tx_ring[0] from being cleaned by multiple cpus
-                BUG_ON(i == adapter->num_rx_queues);
+         * simultaneously.  A failure obtaining the lock means
+         * tx_ring[0] is currently being cleaned anyway. */
+        if (spin_trylock(&adapter->tx_queue_lock)) {
+                tx_cleaned = e1000_clean_tx_irq(adapter,
+                                                &adapter->tx_ring[0]);
+                spin_unlock(&adapter->tx_queue_lock);
        }
-        if (likely(adapter->num_tx_queues == 1)) {
+        adapter->clean_rx(adapter, &adapter->rx_ring[0],
-                /* e1000_clean is called per-cpu.  This lock protects
-                 * tx_ring[0] from being cleaned by multiple cpus
-                 * simultaneously.  A failure obtaining the lock means
-                 * tx_ring[0] is currently being cleaned anyway. */
-                if (spin_trylock(&adapter->tx_queue_lock)) {
-                        tx_cleaned = e1000_clean_tx_irq(adapter,
-                                                        &adapter->tx_ring[0]);
-                        spin_unlock(&adapter->tx_queue_lock);
-                }
-        } else
-                tx_cleaned = e1000_clean_tx_irq(adapter, &adapter->tx_ring[i]);
-        adapter->clean_rx(adapter, &adapter->rx_ring[i],
                          &work_done, work_to_do);
        *budget -= work_done;
@@ -3466,7 +3457,7 @@ e1000_clean(struct net_device *poll_dev, int *budget)
        /* If no Tx and not enough Rx work done, exit the polling mode */
        if ((!tx_cleaned && (work_done == 0)) ||
-           !netif_running(adapter->netdev)) {
+           !netif_running(poll_dev)) {
 quit_polling:
                netif_rx_complete(poll_dev);
                e1000_irq_enable(adapter);
@@ -3681,6 +3672,9 @@ e1000_clean_rx_irq(struct e1000_adapter *adapter,
                length = le16_to_cpu(rx_desc->length);
+                /* adjust length to remove Ethernet CRC */
+                length -= 4;
                if (unlikely(!(status & E1000_RXD_STAT_EOP))) {
                        /* All receives must fit into a single buffer */
                        E1000_DBG("%s: Receive packet consumed multiple"
@@ -3885,8 +3879,9 @@ e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                        pci_dma_sync_single_for_device(pdev,
                                ps_page_dma->ps_page_dma[0],
                                PAGE_SIZE, PCI_DMA_FROMDEVICE);
+                        /* remove the CRC */
+                        l1 -= 4;
                        skb_put(skb, l1);
-                        length += l1;
                        goto copydone;
                } /* if */
                }
@@ -3905,6 +3900,10 @@ e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                        skb->truesize += length;
                }
+                /* strip the ethernet crc, problem is we're using pages now so
+                 * this whole operation can get a little cpu intensive */
+                pskb_trim(skb, skb->len - 4);
 copydone:
                e1000_rx_checksum(adapter, staterr,
                                  le16_to_cpu(rx_desc->wb.lower.hi_dword.csum_ip.csum), skb);
@@ -4752,6 +4751,7 @@ static void
 e1000_netpoll(struct net_device *netdev)
 {
        struct e1000_adapter *adapter = netdev_priv(netdev);
        disable_irq(adapter->pdev->irq);
        e1000_intr(adapter->pdev->irq, netdev, NULL);
        e1000_clean_tx_irq(adapter, adapter->tx_ring);
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index 3a42afab5036..43e3f33ed5e2 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -271,6 +271,7 @@ static int __init ifb_init_module(void)
        for (i = 0; i < numifbs && !err; i++)
                err = ifb_init_one(i); 
        if (err) { 
+                i--;
                while (--i >= 0)
                        ifb_free_one(i);
        }
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index d98f28c34e5c..de91609ca112 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -50,7 +50,7 @@
 #include "sky2.h"
 #define DRV_NAME                "sky2"
-#define DRV_VERSION             "1.4"
+#define DRV_VERSION             "1.5"
 #define PFX                     DRV_NAME " "
 /*
@@ -2204,9 +2204,6 @@ static int sky2_poll(struct net_device *dev0, int *budget)
        int work_done = 0;
        u32 status = sky2_read32(hw, B0_Y2_SP_EISR);
-        if (!~status)
-                goto out;
        if (status & Y2_IS_HW_ERR)
                sky2_hw_intr(hw);
@@ -2243,7 +2240,7 @@ static int sky2_poll(struct net_device *dev0, int *budget)
        if (sky2_more_work(hw))
                return 1;
-out:
        netif_rx_complete(dev0);
        sky2_read32(hw, B0_Y2_SP_LISR);
diff --git a/drivers/net/spider_net.c b/drivers/net/spider_net.c
index fb1d5a8a45cf..647f62e9707d 100644
--- a/drivers/net/spider_net.c
+++ b/drivers/net/spider_net.c
@@ -84,7 +84,7 @@ MODULE_DEVICE_TABLE(pci, spider_net_pci_tbl);
 *
 * returns the content of the specified SMMIO register.
 */
-static u32
+static inline u32
 spider_net_read_reg(struct spider_net_card *card, u32 reg)
 {
        u32 value;
@@ -101,7 +101,7 @@ spider_net_read_reg(struct spider_net_card *card, u32 reg)
 * @reg: register to write to
 * @value: value to write into the specified SMMIO register
 */
-static void
+static inline void
 spider_net_write_reg(struct spider_net_card *card, u32 reg, u32 value)
 {
        value = cpu_to_le32(value);
@@ -259,39 +259,10 @@ spider_net_get_mac_address(struct net_device *netdev)
 *
 * returns the status as in the dmac_cmd_status field of the descriptor
 */
-static enum spider_net_descr_status
+static inline int
 spider_net_get_descr_status(struct spider_net_descr *descr)
 {
-        u32 cmd_status;
+        return descr->dmac_cmd_status & SPIDER_NET_DESCR_IND_PROC_MASK;
-        cmd_status = descr->dmac_cmd_status;
-        cmd_status >>= SPIDER_NET_DESCR_IND_PROC_SHIFT;
-        /* no need to mask out any bits, as cmd_status is 32 bits wide only
-         * (and unsigned) */
-        return cmd_status;
-}
-/**
- * spider_net_set_descr_status -- sets the status of a descriptor
- * @descr: descriptor to change
- * @status: status to set in the descriptor
- *
- * changes the status to the specified value. Doesn't change other bits
- * in the status
- */
-static void
-spider_net_set_descr_status(struct spider_net_descr *descr,
-                            enum spider_net_descr_status status)
-{
-        u32 cmd_status;
-        /* read the status */
-        cmd_status = descr->dmac_cmd_status;
-        /* clean the upper 4 bits */
-        cmd_status &= SPIDER_NET_DESCR_IND_PROC_MASKO;
-        /* add the status to it */
-        cmd_status |= ((u32)status)<<SPIDER_NET_DESCR_IND_PROC_SHIFT;
-        /* and write it back */
-        descr->dmac_cmd_status = cmd_status;
 }
 /**
@@ -328,24 +299,23 @@ spider_net_free_chain(struct spider_net_card *card,
 static int
 spider_net_init_chain(struct spider_net_card *card,
                       struct spider_net_descr_chain *chain,
-                       struct spider_net_descr *start_descr, int no)
+                       struct spider_net_descr *start_descr,
+                       int direction, int no)
 {
        int i;
        struct spider_net_descr *descr;
        dma_addr_t buf;
-        atomic_set(&card->rx_chain_refill,0);
        descr = start_descr;
        memset(descr, 0, sizeof(*descr) * no);
        /* set up the hardware pointers in each descriptor */
        for (i=0; i<no; i++, descr++) {
-                spider_net_set_descr_status(descr, SPIDER_NET_DESCR_NOT_IN_USE);
+                descr->dmac_cmd_status = SPIDER_NET_DESCR_NOT_IN_USE;
                buf = pci_map_single(card->pdev, descr,
                                     SPIDER_NET_DESCR_SIZE,
-                                     PCI_DMA_BIDIRECTIONAL);
+                                     direction);
                if (buf == DMA_ERROR_CODE)
                        goto iommu_error;
@@ -360,10 +330,11 @@ spider_net_init_chain(struct spider_net_card *card,
        start_descr->prev = descr-1;
        descr = start_descr;
-        for (i=0; i < no; i++, descr++) {
+        if (direction == PCI_DMA_FROMDEVICE)
-                descr->next_descr_addr = descr->next->bus_addr;
+                for (i=0; i < no; i++, descr++)
-        }
+                        descr->next_descr_addr = descr->next->bus_addr;
+        spin_lock_init(&chain->lock);
        chain->head = start_descr;
        chain->tail = start_descr;
@@ -375,7 +346,7 @@ iommu_error:
                if (descr->bus_addr)
                        pci_unmap_single(card->pdev, descr->bus_addr,
                                         SPIDER_NET_DESCR_SIZE,
-                                         PCI_DMA_BIDIRECTIONAL);
+                                         direction);
        return -ENOMEM;
 }
@@ -396,7 +367,7 @@ spider_net_free_rx_chain_contents(struct spider_net_card *card)
                        dev_kfree_skb(descr->skb);
                        pci_unmap_single(card->pdev, descr->buf_addr,
                                         SPIDER_NET_MAX_FRAME,
-                                         PCI_DMA_BIDIRECTIONAL);
+                                         PCI_DMA_FROMDEVICE);
                }
                descr = descr->next;
        }
@@ -446,15 +417,16 @@ spider_net_prepare_rx_descr(struct spider_net_card *card,
                skb_reserve(descr->skb, SPIDER_NET_RXBUF_ALIGN - offset);
        /* io-mmu-map the skb */
        buf = pci_map_single(card->pdev, descr->skb->data,
-                             SPIDER_NET_MAX_FRAME, PCI_DMA_BIDIRECTIONAL);
+                        SPIDER_NET_MAX_FRAME, PCI_DMA_FROMDEVICE);
        descr->buf_addr = buf;
        if (buf == DMA_ERROR_CODE) {
                dev_kfree_skb_any(descr->skb);
                if (netif_msg_rx_err(card) && net_ratelimit())
                        pr_err("Could not iommu-map rx buffer\n");
-                spider_net_set_descr_status(descr, SPIDER_NET_DESCR_NOT_IN_USE);
+                descr->dmac_cmd_status = SPIDER_NET_DESCR_NOT_IN_USE;
        } else {
-                descr->dmac_cmd_status = SPIDER_NET_DMAC_RX_CARDOWNED;
+                descr->dmac_cmd_status = SPIDER_NET_DESCR_CARDOWNED |
+                                         SPIDER_NET_DMAC_NOINTR_COMPLETE;
        }
        return error;
@@ -468,7 +440,7 @@ spider_net_prepare_rx_descr(struct spider_net_card *card,
 * chip by writing to the appropriate register. DMA is enabled in
 * spider_net_enable_rxdmac.
 */
-static void
+static inline void
 spider_net_enable_rxchtails(struct spider_net_card *card)
 {
        /* assume chain is aligned correctly */
@@ -483,7 +455,7 @@ spider_net_enable_rxchtails(struct spider_net_card *card)
 * spider_net_enable_rxdmac enables the DMA controller by setting RX_DMA_EN
 * in the GDADMACCNTR register
 */
-static void
+static inline void
 spider_net_enable_rxdmac(struct spider_net_card *card)
 {
        wmb();
@@ -500,23 +472,24 @@ spider_net_enable_rxdmac(struct spider_net_card *card)
 static void
 spider_net_refill_rx_chain(struct spider_net_card *card)
 {
-        struct spider_net_descr_chain *chain;
+        struct spider_net_descr_chain *chain = &card->rx_chain;
+        unsigned long flags;
-        chain = &card->rx_chain;
        /* one context doing the refill (and a second context seeing that
         * and omitting it) is ok. If called by NAPI, we'll be called again
         * as spider_net_decode_one_descr is called several times. If some
         * interrupt calls us, the NAPI is about to clean up anyway. */
-        if (atomic_inc_return(&card->rx_chain_refill) == 1)
+        if (!spin_trylock_irqsave(&chain->lock, flags))
-                while (spider_net_get_descr_status(chain->head) ==
+                return;
-                       SPIDER_NET_DESCR_NOT_IN_USE) {
-                        if (spider_net_prepare_rx_descr(card, chain->head))
+        while (spider_net_get_descr_status(chain->head) ==
-                                break;
+                        SPIDER_NET_DESCR_NOT_IN_USE) {
-                        chain->head = chain->head->next;
+                if (spider_net_prepare_rx_descr(card, chain->head))
-                }
+                        break;
+                chain->head = chain->head->next;
+        }
-        atomic_dec(&card->rx_chain_refill);
+        spin_unlock_irqrestore(&chain->lock, flags);
 }
 /**
@@ -554,111 +527,6 @@ error:
 }
 /**
- * spider_net_release_tx_descr - processes a used tx descriptor
- * @card: card structure
- * @descr: descriptor to release
- *
- * releases a used tx descriptor (unmapping, freeing of skb)
- */
-static void
-spider_net_release_tx_descr(struct spider_net_card *card,
-                            struct spider_net_descr *descr)
-{
-        struct sk_buff *skb;
-        /* unmap the skb */
-        skb = descr->skb;
-        pci_unmap_single(card->pdev, descr->buf_addr, skb->len,
-                         PCI_DMA_BIDIRECTIONAL);
-        dev_kfree_skb_any(skb);
-        /* set status to not used */
-        spider_net_set_descr_status(descr, SPIDER_NET_DESCR_NOT_IN_USE);
-}
-/**
- * spider_net_release_tx_chain - processes sent tx descriptors
- * @card: adapter structure
- * @brutal: if set, don't care about whether descriptor seems to be in use
- *
- * returns 0 if the tx ring is empty, otherwise 1.
- *
- * spider_net_release_tx_chain releases the tx descriptors that spider has
- * finished with (if non-brutal) or simply release tx descriptors (if brutal).
- * If some other context is calling this function, we return 1 so that we're
- * scheduled again (if we were scheduled) and will not loose initiative.
- */
-static int
-spider_net_release_tx_chain(struct spider_net_card *card, int brutal)
-{
-        struct spider_net_descr_chain *tx_chain = &card->tx_chain;
-        enum spider_net_descr_status status;
-        if (atomic_inc_return(&card->tx_chain_release) != 1) {
-                atomic_dec(&card->tx_chain_release);
-                return 1;
-        }
-        for (;;) {
-                status = spider_net_get_descr_status(tx_chain->tail);
-                switch (status) {
-                case SPIDER_NET_DESCR_CARDOWNED:
-                        if (!brutal)
-                                goto out;
-                        /* fallthrough, if we release the descriptors
-                         * brutally (then we don't care about
-                         * SPIDER_NET_DESCR_CARDOWNED) */
-                case SPIDER_NET_DESCR_RESPONSE_ERROR:
-                case SPIDER_NET_DESCR_PROTECTION_ERROR:
-                case SPIDER_NET_DESCR_FORCE_END:
-                        if (netif_msg_tx_err(card))
-                                pr_err("%s: forcing end of tx descriptor "
-                                       "with status x%02x\n",
-                                       card->netdev->name, status);
-                        card->netdev_stats.tx_dropped++;
-                        break;
-                case SPIDER_NET_DESCR_COMPLETE:
-                        card->netdev_stats.tx_packets++;
-                        card->netdev_stats.tx_bytes +=
-                                tx_chain->tail->skb->len;
-                        break;
-                default: /* any other value (== SPIDER_NET_DESCR_NOT_IN_USE) */
-                        goto out;
-                }
-                spider_net_release_tx_descr(card, tx_chain->tail);
-                tx_chain->tail = tx_chain->tail->next;
-        }
-out:
-        atomic_dec(&card->tx_chain_release);
-        netif_wake_queue(card->netdev);
-        if (status == SPIDER_NET_DESCR_CARDOWNED)
-                return 1;
-        return 0;
-}
-/**
- * spider_net_cleanup_tx_ring - cleans up the TX ring
- * @card: card structure
- *
- * spider_net_cleanup_tx_ring is called by the tx_timer (as we don't use
- * interrupts to cleanup our TX ring) and returns sent packets to the stack
- * by freeing them
- */
-static void
-spider_net_cleanup_tx_ring(struct spider_net_card *card)
-{
-        if ( (spider_net_release_tx_chain(card, 0)) &&
-              (card->netdev->flags & IFF_UP) ) {
-                mod_timer(&card->tx_timer, jiffies + SPIDER_NET_TX_TIMER);
-        }
-}
-/**
 * spider_net_get_multicast_hash - generates hash for multicast filter table
 * @addr: multicast address
 *
@@ -761,97 +629,6 @@ spider_net_disable_rxdmac(struct spider_net_card *card)
 }
 /**
- * spider_net_stop - called upon ifconfig down
- * @netdev: interface device structure
- *
- * always returns 0
- */
-int
-spider_net_stop(struct net_device *netdev)
-{
-        struct spider_net_card *card = netdev_priv(netdev);
-        tasklet_kill(&card->rxram_full_tl);
-        netif_poll_disable(netdev);
-        netif_carrier_off(netdev);
-        netif_stop_queue(netdev);
-        del_timer_sync(&card->tx_timer);
-        /* disable/mask all interrupts */
-        spider_net_write_reg(card, SPIDER_NET_GHIINT0MSK, 0);
-        spider_net_write_reg(card, SPIDER_NET_GHIINT1MSK, 0);
-        spider_net_write_reg(card, SPIDER_NET_GHIINT2MSK, 0);
-        /* free_irq(netdev->irq, netdev);*/
-        free_irq(to_pci_dev(netdev->class_dev.dev)->irq, netdev);
-        spider_net_write_reg(card, SPIDER_NET_GDTDMACCNTR,
-                             SPIDER_NET_DMA_TX_FEND_VALUE);
-        /* turn off DMA, force end */
-        spider_net_disable_rxdmac(card);
-        /* release chains */
-        spider_net_release_tx_chain(card, 1);
-        spider_net_free_chain(card, &card->tx_chain);
-        spider_net_free_chain(card, &card->rx_chain);
-        return 0;
-}
-/**
- * spider_net_get_next_tx_descr - returns the next available tx descriptor
- * @card: device structure to get descriptor from
- *
- * returns the address of the next descriptor, or NULL if not available.
- */
-static struct spider_net_descr *
-spider_net_get_next_tx_descr(struct spider_net_card *card)
-{
-        /* check, if head points to not-in-use descr */
-        if ( spider_net_get_descr_status(card->tx_chain.head) ==
-             SPIDER_NET_DESCR_NOT_IN_USE ) {
-                return card->tx_chain.head;
-        } else {
-                return NULL;
-        }
-}
-/**
- * spider_net_set_txdescr_cmdstat - sets the tx descriptor command field
- * @descr: descriptor structure to fill out
- * @skb: packet to consider
- *
- * fills out the command and status field of the descriptor structure,
- * depending on hardware checksum settings.
- */
-static void
-spider_net_set_txdescr_cmdstat(struct spider_net_descr *descr,
-                               struct sk_buff *skb)
-{
-        /* make sure the other fields in the descriptor are written */
-        wmb();
-        if (skb->ip_summed != CHECKSUM_HW) {
-                descr->dmac_cmd_status = SPIDER_NET_DMAC_CMDSTAT_NOCS;
-                return;
-        }
-        /* is packet ip?
-         * if yes: tcp? udp? */
-        if (skb->protocol == htons(ETH_P_IP)) {
-                if (skb->nh.iph->protocol == IPPROTO_TCP)
-                        descr->dmac_cmd_status = SPIDER_NET_DMAC_CMDSTAT_TCPCS;
-                else if (skb->nh.iph->protocol == IPPROTO_UDP)
-                        descr->dmac_cmd_status = SPIDER_NET_DMAC_CMDSTAT_UDPCS;
-                else /* the stack should checksum non-tcp and non-udp
-                        packets on his own: NETIF_F_IP_CSUM */
-                        descr->dmac_cmd_status = SPIDER_NET_DMAC_CMDSTAT_NOCS;
-        }
-}
-/**
 * spider_net_prepare_tx_descr - fill tx descriptor with skb data
 * @card: card structure
 * @descr: descriptor structure to fill out
@@ -864,13 +641,12 @@ spider_net_set_txdescr_cmdstat(struct spider_net_descr *descr,
 */
 static int
 spider_net_prepare_tx_descr(struct spider_net_card *card,
-                            struct spider_net_descr *descr,
                            struct sk_buff *skb)
 {
+        struct spider_net_descr *descr = card->tx_chain.head;
        dma_addr_t buf;
-        buf = pci_map_single(card->pdev, skb->data,
+        buf = pci_map_single(card->pdev, skb->data, skb->len, PCI_DMA_TODEVICE);
-                             skb->len, PCI_DMA_BIDIRECTIONAL);
        if (buf == DMA_ERROR_CODE) {
                if (netif_msg_tx_err(card) && net_ratelimit())
                        pr_err("could not iommu-map packet (%p, %i). "
@@ -880,10 +656,101 @@ spider_net_prepare_tx_descr(struct spider_net_card *card,
        descr->buf_addr = buf;
        descr->buf_size = skb->len;
+        descr->next_descr_addr = 0;
        descr->skb = skb;
        descr->data_status = 0;
-        spider_net_set_txdescr_cmdstat(descr,skb);
+        descr->dmac_cmd_status =
+                        SPIDER_NET_DESCR_CARDOWNED | SPIDER_NET_DMAC_NOCS;
+        if (skb->protocol == htons(ETH_P_IP))
+                switch (skb->nh.iph->protocol) {
+                case IPPROTO_TCP:
+                        descr->dmac_cmd_status |= SPIDER_NET_DMAC_TCP;
+                        break;
+                case IPPROTO_UDP:
+                        descr->dmac_cmd_status |= SPIDER_NET_DMAC_UDP;
+                        break;
+                }
+        descr->prev->next_descr_addr = descr->bus_addr;
+        return 0;
+}
+/**
+ * spider_net_release_tx_descr - processes a used tx descriptor
+ * @card: card structure
+ * @descr: descriptor to release
+ *
+ * releases a used tx descriptor (unmapping, freeing of skb)
+ */
+static inline void
+spider_net_release_tx_descr(struct spider_net_card *card)
+{
+        struct spider_net_descr *descr = card->tx_chain.tail;
+        struct sk_buff *skb;
+        card->tx_chain.tail = card->tx_chain.tail->next;
+        descr->dmac_cmd_status |= SPIDER_NET_DESCR_NOT_IN_USE;
+        /* unmap the skb */
+        skb = descr->skb;
+        pci_unmap_single(card->pdev, descr->buf_addr, skb->len,
+                        PCI_DMA_TODEVICE);
+        dev_kfree_skb_any(skb);
+}
+/**
+ * spider_net_release_tx_chain - processes sent tx descriptors
+ * @card: adapter structure
+ * @brutal: if set, don't care about whether descriptor seems to be in use
+ *
+ * returns 0 if the tx ring is empty, otherwise 1.
+ *
+ * spider_net_release_tx_chain releases the tx descriptors that spider has
+ * finished with (if non-brutal) or simply release tx descriptors (if brutal).
+ * If some other context is calling this function, we return 1 so that we're
+ * scheduled again (if we were scheduled) and will not loose initiative.
+ */
+static int
+spider_net_release_tx_chain(struct spider_net_card *card, int brutal)
+{
+        struct spider_net_descr_chain *chain = &card->tx_chain;
+        int status;
+        spider_net_read_reg(card, SPIDER_NET_GDTDMACCNTR);
+        while (chain->tail != chain->head) {
+                status = spider_net_get_descr_status(chain->tail);
+                switch (status) {
+                case SPIDER_NET_DESCR_COMPLETE:
+                        card->netdev_stats.tx_packets++;
+                        card->netdev_stats.tx_bytes += chain->tail->skb->len;
+                        break;
+                case SPIDER_NET_DESCR_CARDOWNED:
+                        if (!brutal)
+                                return 1;
+                        /* fallthrough, if we release the descriptors
+                         * brutally (then we don't care about
+                         * SPIDER_NET_DESCR_CARDOWNED) */
+                case SPIDER_NET_DESCR_RESPONSE_ERROR:
+                case SPIDER_NET_DESCR_PROTECTION_ERROR:
+                case SPIDER_NET_DESCR_FORCE_END:
+                        if (netif_msg_tx_err(card))
+                                pr_err("%s: forcing end of tx descriptor "
+                                       "with status x%02x\n",
+                                       card->netdev->name, status);
+                        card->netdev_stats.tx_errors++;
+                        break;
+                default:
+                        card->netdev_stats.tx_dropped++;
+                        return 1;
+                }
+                spider_net_release_tx_descr(card);
+        }
        return 0;
 }
@@ -896,18 +763,32 @@ spider_net_prepare_tx_descr(struct spider_net_card *card,
 * spider_net_kick_tx_dma writes the current tx chain head as start address
 * of the tx descriptor chain and enables the transmission DMA engine
 */
-static void
+static inline void
-spider_net_kick_tx_dma(struct spider_net_card *card,
+spider_net_kick_tx_dma(struct spider_net_card *card)
-                       struct spider_net_descr *descr)
 {
-        /* this is the only descriptor in the output chain.
+        struct spider_net_descr *descr;
-         * Enable TX DMA */
-        spider_net_write_reg(card, SPIDER_NET_GDTDCHA,
+        if (spider_net_read_reg(card, SPIDER_NET_GDTDMACCNTR) &
-                             descr->bus_addr);
+                        SPIDER_NET_TX_DMA_EN)
+                goto out;
-        spider_net_write_reg(card, SPIDER_NET_GDTDMACCNTR,
+        descr = card->tx_chain.tail;
-                             SPIDER_NET_DMA_TX_VALUE);
+        for (;;) {
+                if (spider_net_get_descr_status(descr) ==
+                                SPIDER_NET_DESCR_CARDOWNED) {
+                        spider_net_write_reg(card, SPIDER_NET_GDTDCHA,
+                                        descr->bus_addr);
+                        spider_net_write_reg(card, SPIDER_NET_GDTDMACCNTR,
+                                        SPIDER_NET_DMA_TX_VALUE);
+                        break;
+                }
+                if (descr == card->tx_chain.head)
+                        break;
+                descr = descr->next;
+        }
+out:
+        mod_timer(&card->tx_timer, jiffies + SPIDER_NET_TX_TIMER);
 }
 /**
@@ -915,47 +796,69 @@ spider_net_kick_tx_dma(struct spider_net_card *card,
 * @skb: packet to send out
 * @netdev: interface device structure
 *
- * returns 0 on success, <0 on failure
+ * returns 0 on success, !0 on failure
 */
 static int
 spider_net_xmit(struct sk_buff *skb, struct net_device *netdev)
 {
        struct spider_net_card *card = netdev_priv(netdev);
-        struct spider_net_descr *descr;
+        struct spider_net_descr_chain *chain = &card->tx_chain;
+        struct spider_net_descr *descr = chain->head;
+        unsigned long flags;
        int result;
+        spin_lock_irqsave(&chain->lock, flags);
        spider_net_release_tx_chain(card, 0);
-        descr = spider_net_get_next_tx_descr(card);
+        if (chain->head->next == chain->tail->prev) {
+                card->netdev_stats.tx_dropped++;
+                result = NETDEV_TX_LOCKED;
+                goto out;
+        }
-        if (!descr)
+        if (spider_net_get_descr_status(descr) != SPIDER_NET_DESCR_NOT_IN_USE) {
-                goto error;
+                result = NETDEV_TX_LOCKED;
+                goto out;
+        }
-        result = spider_net_prepare_tx_descr(card, descr, skb);
+        if (spider_net_prepare_tx_descr(card, skb) != 0) {
-        if (result)
+                card->netdev_stats.tx_dropped++;
-                goto error;
+                result = NETDEV_TX_BUSY;
+                goto out;
+        }
+        result = NETDEV_TX_OK;
+        spider_net_kick_tx_dma(card);
        card->tx_chain.head = card->tx_chain.head->next;
-        if (spider_net_get_descr_status(descr->prev) !=
+out:
-            SPIDER_NET_DESCR_CARDOWNED) {
+        spin_unlock_irqrestore(&chain->lock, flags);
-                /* make sure the current descriptor is in memory. Then
+        netif_wake_queue(netdev);
-                 * kicking it on again makes sense, if the previous is not
+        return result;
-                 * card-owned anymore. Check the previous descriptor twice
+}
-                 * to omit an mb() in heavy traffic cases */
-                mb();
-                if (spider_net_get_descr_status(descr->prev) !=
-                    SPIDER_NET_DESCR_CARDOWNED)
-                        spider_net_kick_tx_dma(card, descr);
-        }
-        mod_timer(&card->tx_timer, jiffies + SPIDER_NET_TX_TIMER);
+/**
+ * spider_net_cleanup_tx_ring - cleans up the TX ring
+ * @card: card structure
+ *
+ * spider_net_cleanup_tx_ring is called by the tx_timer (as we don't use
+ * interrupts to cleanup our TX ring) and returns sent packets to the stack
+ * by freeing them
+ */
+static void
+spider_net_cleanup_tx_ring(struct spider_net_card *card)
+{
+        unsigned long flags;
-        return NETDEV_TX_OK;
+        spin_lock_irqsave(&card->tx_chain.lock, flags);
-error:
+        if ((spider_net_release_tx_chain(card, 0) != 0) &&
-        card->netdev_stats.tx_dropped++;
+            (card->netdev->flags & IFF_UP))
-        return NETDEV_TX_BUSY;
+                spider_net_kick_tx_dma(card);
+        spin_unlock_irqrestore(&card->tx_chain.lock, flags);
 }
 /**
@@ -1002,7 +905,7 @@ spider_net_pass_skb_up(struct spider_net_descr *descr,
        /* unmap descriptor */
        pci_unmap_single(card->pdev, descr->buf_addr, SPIDER_NET_MAX_FRAME,
-                         PCI_DMA_BIDIRECTIONAL);
+                        PCI_DMA_FROMDEVICE);
        /* the cases we'll throw away the packet immediately */
        if (data_error & SPIDER_NET_DESTROY_RX_FLAGS) {
@@ -1067,14 +970,11 @@ spider_net_pass_skb_up(struct spider_net_descr *descr,
 static int
 spider_net_decode_one_descr(struct spider_net_card *card, int napi)
 {
-        enum spider_net_descr_status status;
+        struct spider_net_descr_chain *chain = &card->rx_chain;
-        struct spider_net_descr *descr;
+        struct spider_net_descr *descr = chain->tail;
-        struct spider_net_descr_chain *chain;
+        int status;
        int result;
-        chain = &card->rx_chain;
-        descr = chain->tail;
        status = spider_net_get_descr_status(descr);
        if (status == SPIDER_NET_DESCR_CARDOWNED) {
@@ -1103,7 +1003,7 @@ spider_net_decode_one_descr(struct spider_net_card *card, int napi)
                               card->netdev->name, status);
                card->netdev_stats.rx_dropped++;
                pci_unmap_single(card->pdev, descr->buf_addr,
-                                 SPIDER_NET_MAX_FRAME, PCI_DMA_BIDIRECTIONAL);
+                                SPIDER_NET_MAX_FRAME, PCI_DMA_FROMDEVICE);
                dev_kfree_skb_irq(descr->skb);
                goto refill;
        }
@@ -1119,7 +1019,7 @@ spider_net_decode_one_descr(struct spider_net_card *card, int napi)
        /* ok, we've got a packet in descr */
        result = spider_net_pass_skb_up(descr, card, napi);
 refill:
-        spider_net_set_descr_status(descr, SPIDER_NET_DESCR_NOT_IN_USE);
+        descr->dmac_cmd_status = SPIDER_NET_DESCR_NOT_IN_USE;
        /* change the descriptor state: */
        if (!napi)
                spider_net_refill_rx_chain(card);
@@ -1291,21 +1191,6 @@ spider_net_set_mac(struct net_device *netdev, void *p)
 }
 /**
- * spider_net_enable_txdmac - enables a TX DMA controller
- * @card: card structure
- *
- * spider_net_enable_txdmac enables the TX DMA controller by setting the
- * descriptor chain tail address
- */
-static void
-spider_net_enable_txdmac(struct spider_net_card *card)
-{
-        /* assume chain is aligned correctly */
-        spider_net_write_reg(card, SPIDER_NET_GDTDCHA,
-                             card->tx_chain.tail->bus_addr);
-}
-/**
 * spider_net_handle_rxram_full - cleans up RX ring upon RX RAM full interrupt
 * @card: card structure
 *
@@ -1653,7 +1538,6 @@ spider_net_enable_card(struct spider_net_card *card)
                { SPIDER_NET_GMRWOLCTRL, 0 },
                { SPIDER_NET_GTESTMD, 0x10000000 },
                { SPIDER_NET_GTTQMSK, 0x00400040 },
-                { SPIDER_NET_GTESTMD, 0 },
                { SPIDER_NET_GMACINTEN, 0 },
@@ -1692,9 +1576,6 @@ spider_net_enable_card(struct spider_net_card *card)
        spider_net_write_reg(card, SPIDER_NET_GRXDMAEN, SPIDER_NET_WOL_VALUE);
-        /* set chain tail adress for TX chain */
-        spider_net_enable_txdmac(card);
        spider_net_write_reg(card, SPIDER_NET_GMACLENLMT,
                             SPIDER_NET_LENLMT_VALUE);
        spider_net_write_reg(card, SPIDER_NET_GMACMODE,
@@ -1709,6 +1590,9 @@ spider_net_enable_card(struct spider_net_card *card)
                             SPIDER_NET_INT1_MASK_VALUE);
        spider_net_write_reg(card, SPIDER_NET_GHIINT2MSK,
                             SPIDER_NET_INT2_MASK_VALUE);
+        spider_net_write_reg(card, SPIDER_NET_GDTDMACCNTR,
+                             SPIDER_NET_GDTDCEIDIS);
 }
 /**
@@ -1728,10 +1612,12 @@ spider_net_open(struct net_device *netdev)
        result = -ENOMEM;
        if (spider_net_init_chain(card, &card->tx_chain,
-                          card->descr, tx_descriptors))
+                        card->descr,
+                        PCI_DMA_TODEVICE, tx_descriptors))
                goto alloc_tx_failed;
        if (spider_net_init_chain(card, &card->rx_chain,
-                          card->descr + tx_descriptors, rx_descriptors))
+                        card->descr + tx_descriptors,
+                        PCI_DMA_FROMDEVICE, rx_descriptors))
                goto alloc_rx_failed;
        /* allocate rx skbs */
@@ -1938,7 +1824,7 @@ spider_net_workaround_rxramfull(struct spider_net_card *card)
        /* empty sequencer data */
        for (sequencer = 0; sequencer < SPIDER_NET_FIRMWARE_SEQS;
             sequencer++) {
-                spider_net_write_reg(card, SPIDER_NET_GSnPRGDAT +
+                spider_net_write_reg(card, SPIDER_NET_GSnPRGADR +
                                     sequencer * 8, 0x0);
                for (i = 0; i < SPIDER_NET_FIRMWARE_SEQWORDS; i++) {
                        spider_net_write_reg(card, SPIDER_NET_GSnPRGDAT +
@@ -1955,6 +1841,49 @@ spider_net_workaround_rxramfull(struct spider_net_card *card)
 }
 /**
+ * spider_net_stop - called upon ifconfig down
+ * @netdev: interface device structure
+ *
+ * always returns 0
+ */
+int
+spider_net_stop(struct net_device *netdev)
+{
+        struct spider_net_card *card = netdev_priv(netdev);
+        tasklet_kill(&card->rxram_full_tl);
+        netif_poll_disable(netdev);
+        netif_carrier_off(netdev);
+        netif_stop_queue(netdev);
+        del_timer_sync(&card->tx_timer);
+        /* disable/mask all interrupts */
+        spider_net_write_reg(card, SPIDER_NET_GHIINT0MSK, 0);
+        spider_net_write_reg(card, SPIDER_NET_GHIINT1MSK, 0);
+        spider_net_write_reg(card, SPIDER_NET_GHIINT2MSK, 0);
+        /* free_irq(netdev->irq, netdev);*/
+        free_irq(to_pci_dev(netdev->class_dev.dev)->irq, netdev);
+        spider_net_write_reg(card, SPIDER_NET_GDTDMACCNTR,
+                             SPIDER_NET_DMA_TX_FEND_VALUE);
+        /* turn off DMA, force end */
+        spider_net_disable_rxdmac(card);
+        /* release chains */
+        if (spin_trylock(&card->tx_chain.lock)) {
+                spider_net_release_tx_chain(card, 1);
+                spin_unlock(&card->tx_chain.lock);
+        }
+        spider_net_free_chain(card, &card->tx_chain);
+        spider_net_free_chain(card, &card->rx_chain);
+        return 0;
+}
+/**
 * spider_net_tx_timeout_task - task scheduled by the watchdog timeout
 * function (to be called not under interrupt status)
 * @data: data, is interface device structure
@@ -1982,7 +1911,7 @@ spider_net_tx_timeout_task(void *data)
                goto out;
        spider_net_open(netdev);
-        spider_net_kick_tx_dma(card, card->tx_chain.head);
+        spider_net_kick_tx_dma(card);
        netif_device_attach(netdev);
 out:
@@ -2065,7 +1994,6 @@ spider_net_setup_netdev(struct spider_net_card *card)
        pci_set_drvdata(card->pdev, netdev);
-        atomic_set(&card->tx_chain_release,0);
        card->rxram_full_tl.data = (unsigned long) card;
        card->rxram_full_tl.func =
                (void (*)(unsigned long)) spider_net_handle_rxram_full;
@@ -2079,7 +2007,7 @@ spider_net_setup_netdev(struct spider_net_card *card)
        spider_net_setup_netdev_ops(netdev);
-        netdev->features = NETIF_F_HW_CSUM;
+        netdev->features = NETIF_F_HW_CSUM | NETIF_F_LLTX;
        /* some time: NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX |
         *              NETIF_F_HW_VLAN_FILTER */
diff --git a/drivers/net/spider_net.h b/drivers/net/spider_net.h
index 3b8d951cf73c..f6dcf180ae3d 100644
--- a/drivers/net/spider_net.h
+++ b/drivers/net/spider_net.h
@@ -208,7 +208,10 @@ extern char spider_net_driver_name[];
 #define SPIDER_NET_DMA_RX_VALUE         0x80000000
 #define SPIDER_NET_DMA_RX_FEND_VALUE    0x00030003
 /* to set TX_DMA_EN */
-#define SPIDER_NET_DMA_TX_VALUE         0x80000000
+#define SPIDER_NET_TX_DMA_EN            0x80000000
+#define SPIDER_NET_GDTDCEIDIS           0x00000002
+#define SPIDER_NET_DMA_TX_VALUE         SPIDER_NET_TX_DMA_EN | \
+                                        SPIDER_NET_GDTDCEIDIS
 #define SPIDER_NET_DMA_TX_FEND_VALUE    0x00030003
 /* SPIDER_NET_UA_DESCR_VALUE is OR'ed with the unicast address */
@@ -329,55 +332,23 @@ enum spider_net_int2_status {
                                  (~SPIDER_NET_TXINT) & \
                                  (~SPIDER_NET_RXINT) )
-#define SPIDER_NET_GPREXEC              0x80000000
+#define SPIDER_NET_GPREXEC                      0x80000000
-#define SPIDER_NET_GPRDAT_MASK          0x0000ffff
+#define SPIDER_NET_GPRDAT_MASK                  0x0000ffff
-/* descriptor bits
+#define SPIDER_NET_DMAC_NOINTR_COMPLETE         0x00800000
- *
+#define SPIDER_NET_DMAC_NOCS                    0x00040000
- * 1010                                 descriptor ready
+#define SPIDER_NET_DMAC_TCP                     0x00020000
- *     0                                descr in middle of chain
+#define SPIDER_NET_DMAC_UDP                     0x00030000
- *      000                             fixed to 0
+#define SPIDER_NET_TXDCEST                      0x08000000
- *
- *         0                            no interrupt on completion
+#define SPIDER_NET_DESCR_IND_PROC_MASK          0xF0000000
- *          000                         fixed to 0
+#define SPIDER_NET_DESCR_COMPLETE               0x00000000 /* used in rx and tx */
- *             1                        no ipsec processing
+#define SPIDER_NET_DESCR_RESPONSE_ERROR         0x10000000 /* used in rx and tx */
- *              1                       last descriptor for this frame
+#define SPIDER_NET_DESCR_PROTECTION_ERROR       0x20000000 /* used in rx and tx */
- *               00                     no checksum
+#define SPIDER_NET_DESCR_FRAME_END              0x40000000 /* used in rx */
- *               10                     tcp checksum
+#define SPIDER_NET_DESCR_FORCE_END              0x50000000 /* used in rx and tx */
- *               11                     udp checksum
+#define SPIDER_NET_DESCR_CARDOWNED              0xA0000000 /* used in rx and tx */
- *
+#define SPIDER_NET_DESCR_NOT_IN_USE             0xF0000000
- *                 00                   fixed to 0
- *                   0                  fixed to 0
- *                    0                 no interrupt on response errors
- *                     0                no interrupt on invalid descr
- *                      0               no interrupt on dma process termination
- *                       0              no interrupt on descr chain end
- *                        0             no interrupt on descr complete
- *
- *                         000          fixed to 0
- *                            0         response error interrupt status
- *                             0        invalid descr status
- *                              0       dma termination status
- *                               0      descr chain end status
- *                                0     descr complete status */
-#define SPIDER_NET_DMAC_CMDSTAT_NOCS    0xa00c0000
-#define SPIDER_NET_DMAC_CMDSTAT_TCPCS   0xa00e0000
-#define SPIDER_NET_DMAC_CMDSTAT_UDPCS   0xa00f0000
-#define SPIDER_NET_DESCR_IND_PROC_SHIFT 28
-#define SPIDER_NET_DESCR_IND_PROC_MASKO 0x0fffffff
-/* descr ready, descr is in middle of chain, get interrupt on completion */
-#define SPIDER_NET_DMAC_RX_CARDOWNED    0xa0800000
-enum spider_net_descr_status {
-        SPIDER_NET_DESCR_COMPLETE               = 0x00, /* used in rx and tx */
-        SPIDER_NET_DESCR_RESPONSE_ERROR         = 0x01, /* used in rx and tx */
-        SPIDER_NET_DESCR_PROTECTION_ERROR       = 0x02, /* used in rx and tx */
-        SPIDER_NET_DESCR_FRAME_END              = 0x04, /* used in rx */
-        SPIDER_NET_DESCR_FORCE_END              = 0x05, /* used in rx and tx */
-        SPIDER_NET_DESCR_CARDOWNED              = 0x0a, /* used in rx and tx */
-        SPIDER_NET_DESCR_NOT_IN_USE /* any other value */
-};
 struct spider_net_descr {
        /* as defined by the hardware */
@@ -398,7 +369,7 @@ struct spider_net_descr {
 } __attribute__((aligned(32)));
 struct spider_net_descr_chain {
-        /* we walk from tail to head */
+        spinlock_t lock;
        struct spider_net_descr *head;
        struct spider_net_descr *tail;
 };
@@ -453,8 +424,6 @@ struct spider_net_card {
        struct spider_net_descr_chain tx_chain;
        struct spider_net_descr_chain rx_chain;
-        atomic_t rx_chain_refill;
-        atomic_t tx_chain_release;
        struct net_device_stats netdev_stats;
diff --git a/drivers/net/sunhme.c b/drivers/net/sunhme.c
index 8673fd4c08c7..c6f5bc3c042f 100644
--- a/drivers/net/sunhme.c
+++ b/drivers/net/sunhme.c
@@ -3255,12 +3255,7 @@ static void __devexit happy_meal_pci_remove(struct pci_dev *pdev)
 }
 static struct pci_device_id happymeal_pci_ids[] = {
-        {
+        { PCI_DEVICE(PCI_VENDOR_ID_SUN, PCI_DEVICE_ID_SUN_HAPPYMEAL) },
-          .vendor       = PCI_VENDOR_ID_SUN,
-          .device       = PCI_DEVICE_ID_SUN_HAPPYMEAL,
-          .subvendor    = PCI_ANY_ID,
-          .subdevice    = PCI_ANY_ID,
-        },
        { }                     /* Terminating entry */
 };
@@ -3275,7 +3270,7 @@ static struct pci_driver hme_pci_driver = {
 static int __init happy_meal_pci_init(void)
 {
-        return pci_module_init(&hme_pci_driver);
+        return pci_register_driver(&hme_pci_driver);
 }
 static void happy_meal_pci_exit(void)
diff --git a/drivers/net/wan/c101.c b/drivers/net/wan/c101.c
index 2c09ec908a3f..435e91ec4620 100644
--- a/drivers/net/wan/c101.c
+++ b/drivers/net/wan/c101.c
@@ -197,7 +197,6 @@ static int c101_open(struct net_device *dev)
        sca_out(IE0_TXINT, MSCI0_OFFSET + IE0, port);
        set_carrier(port);
-        printk(KERN_DEBUG "0x%X\n", sca_in(MSCI1_OFFSET + ST3, port));
        /* enable MSCI1 CDCD interrupt */
        sca_out(IE1_CDCD, MSCI1_OFFSET + IE1, port);
@@ -449,4 +448,5 @@ module_exit(c101_cleanup);
 MODULE_AUTHOR("Krzysztof Halasa <khc@pm.waw.pl>");
 MODULE_DESCRIPTION("Moxa C101 serial port driver");
 MODULE_LICENSE("GPL v2");
-module_param(hw, charp, 0444);  /* hw=irq,ram:irq,... */
+module_param(hw, charp, 0444);
+MODULE_PARM_DESC(hw, "irq,ram:irq,...");
diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c
index b81263eaede0..fbaab5bf71eb 100644
--- a/drivers/net/wan/hdlc_ppp.c
+++ b/drivers/net/wan/hdlc_ppp.c
@@ -107,6 +107,7 @@ int hdlc_ppp_ioctl(struct net_device *dev, struct ifreq *ifr)
                dev->hard_header = NULL;
                dev->type = ARPHRD_PPP;
                dev->addr_len = 0;
+                netif_dormant_off(dev);
                return 0;
        }
diff --git a/drivers/net/wan/hdlc_raw.c b/drivers/net/wan/hdlc_raw.c
index 9456d31cb1c1..f15aa6ba77f1 100644
--- a/drivers/net/wan/hdlc_raw.c
+++ b/drivers/net/wan/hdlc_raw.c
@@ -82,6 +82,7 @@ int hdlc_raw_ioctl(struct net_device *dev, struct ifreq *ifr)
                dev->type = ARPHRD_RAWHDLC;
                dev->flags = IFF_POINTOPOINT | IFF_NOARP;
                dev->addr_len = 0;
+                netif_dormant_off(dev);
                return 0;
        }
diff --git a/drivers/net/wan/hdlc_raw_eth.c b/drivers/net/wan/hdlc_raw_eth.c
index b1285cc8fee6..d1884987f94e 100644
--- a/drivers/net/wan/hdlc_raw_eth.c
+++ b/drivers/net/wan/hdlc_raw_eth.c
@@ -100,6 +100,7 @@ int hdlc_raw_eth_ioctl(struct net_device *dev, struct ifreq *ifr)
                dev->tx_queue_len = old_qlen;
                memcpy(dev->dev_addr, "\x00\x01", 2);
                get_random_bytes(dev->dev_addr + 2, ETH_ALEN - 2);
+                netif_dormant_off(dev);
                return 0;
        }
diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c
index 07e5eef1fe0f..a867fb411f89 100644
--- a/drivers/net/wan/hdlc_x25.c
+++ b/drivers/net/wan/hdlc_x25.c
@@ -212,6 +212,7 @@ int hdlc_x25_ioctl(struct net_device *dev, struct ifreq *ifr)
                dev->hard_header = NULL;
                dev->type = ARPHRD_X25;
                dev->addr_len = 0;
+                netif_dormant_off(dev);
                return 0;
        }
diff --git a/drivers/net/wan/n2.c b/drivers/net/wan/n2.c
index e013b817cab8..dcf46add3adf 100644
--- a/drivers/net/wan/n2.c
+++ b/drivers/net/wan/n2.c
@@ -564,4 +564,5 @@ module_exit(n2_cleanup);
 MODULE_AUTHOR("Krzysztof Halasa <khc@pm.waw.pl>");
 MODULE_DESCRIPTION("RISCom/N2 serial port driver");
 MODULE_LICENSE("GPL v2");
-module_param(hw, charp, 0444);  /* hw=io,irq,ram,ports:io,irq,... */
+module_param(hw, charp, 0444);
+MODULE_PARM_DESC(hw, "io,irq,ram,ports:io,irq,...");
diff --git a/drivers/s390/block/xpram.c b/drivers/s390/block/xpram.c
index 4cd879cb9bdd..1140302ff11d 100644
--- a/drivers/s390/block/xpram.c
+++ b/drivers/s390/block/xpram.c
@@ -304,6 +304,7 @@ static int __init xpram_setup_sizes(unsigned long pages)
 {
        unsigned long mem_needed;
        unsigned long mem_auto;
+        unsigned long long size;
        int mem_auto_no;
        int i;
@@ -321,9 +322,19 @@ static int __init xpram_setup_sizes(unsigned long pages)
        mem_needed = 0;
        mem_auto_no = 0;
        for (i = 0; i < xpram_devs; i++) {
-                if (sizes[i])
+                if (sizes[i]) {
-                        xpram_sizes[i] =
+                        size = simple_strtoull(sizes[i], &sizes[i], 0);
-                                (memparse(sizes[i], &sizes[i]) + 3) & -4UL;
+                        switch (sizes[i][0]) {
+                        case 'g':
+                        case 'G':
+                                size <<= 20;
+                                break;
+                        case 'm':
+                        case 'M':
+                                size <<= 10;
+                        }
+                        xpram_sizes[i] = (size + 3) & -4UL;
+                }
                if (xpram_sizes[i])
                        mem_needed += xpram_sizes[i];
                else
diff --git a/drivers/s390/char/raw3270.c b/drivers/s390/char/raw3270.c
index 95e285b2e25c..7a84014f2037 100644
--- a/drivers/s390/char/raw3270.c
+++ b/drivers/s390/char/raw3270.c
@@ -1106,10 +1106,10 @@ raw3270_delete_device(struct raw3270 *rp)
        /* Remove from device chain. */
        mutex_lock(&raw3270_mutex);
-        if (rp->clttydev)
+        if (rp->clttydev && !IS_ERR(rp->clttydev))
                class_device_destroy(class3270,
                                     MKDEV(IBM_TTY3270_MAJOR, rp->minor));
-        if (rp->cltubdev)
+        if (rp->cltubdev && !IS_ERR(rp->cltubdev))
                class_device_destroy(class3270,
                                     MKDEV(IBM_FS3270_MAJOR, rp->minor));
        list_del_init(&rp->list);
@@ -1173,21 +1173,37 @@ static struct attribute_group raw3270_attr_group = {
        .attrs = raw3270_attrs,
 };
-static void
+static int raw3270_create_attributes(struct raw3270 *rp)
-raw3270_create_attributes(struct raw3270 *rp)
 {
-        //FIXME: check return code
+        int rc;
-        sysfs_create_group(&rp->cdev->dev.kobj, &raw3270_attr_group);
-        rp->clttydev =
+        rc = sysfs_create_group(&rp->cdev->dev.kobj, &raw3270_attr_group);
-                class_device_create(class3270, NULL,
+        if (rc)
-                                    MKDEV(IBM_TTY3270_MAJOR, rp->minor),
+                goto out;
-                                    &rp->cdev->dev, "tty%s",
-                                    rp->cdev->dev.bus_id);
+        rp->clttydev = class_device_create(class3270, NULL,
-        rp->cltubdev =
+                                           MKDEV(IBM_TTY3270_MAJOR, rp->minor),
-                class_device_create(class3270, NULL,
+                                           &rp->cdev->dev, "tty%s",
-                                    MKDEV(IBM_FS3270_MAJOR, rp->minor),
+                                           rp->cdev->dev.bus_id);
-                                    &rp->cdev->dev, "tub%s",
+        if (IS_ERR(rp->clttydev)) {
-                                    rp->cdev->dev.bus_id);
+                rc = PTR_ERR(rp->clttydev);
+                goto out_ttydev;
+        }
+        rp->cltubdev = class_device_create(class3270, NULL,
+                                           MKDEV(IBM_FS3270_MAJOR, rp->minor),
+                                           &rp->cdev->dev, "tub%s",
+                                           rp->cdev->dev.bus_id);
+        if (!IS_ERR(rp->cltubdev))
+                goto out;
+        rc = PTR_ERR(rp->cltubdev);
+        class_device_destroy(class3270, MKDEV(IBM_TTY3270_MAJOR, rp->minor));
+out_ttydev:
+        sysfs_remove_group(&rp->cdev->dev.kobj, &raw3270_attr_group);
+out:
+        return rc;
 }
 /*
@@ -1255,7 +1271,9 @@ raw3270_set_online (struct ccw_device *cdev)
        rc = raw3270_reset_device(rp);
        if (rc)
                goto failure;
-        raw3270_create_attributes(rp);
+        rc = raw3270_create_attributes(rp);
+        if (rc)
+                goto failure;
        set_bit(RAW3270_FLAGS_READY, &rp->flags);
        mutex_lock(&raw3270_mutex);
        list_for_each_entry(np, &raw3270_notifier, list)
diff --git a/drivers/s390/char/tape_class.c b/drivers/s390/char/tape_class.c
index a5c68e60fcf4..643b6d078563 100644
--- a/drivers/s390/char/tape_class.c
+++ b/drivers/s390/char/tape_class.c
@@ -76,14 +76,22 @@ struct tape_class_device *register_tape_dev(
                                device,
                                "%s", tcd->device_name
                        );
-        sysfs_create_link(
+        rc = PTR_ERR(tcd->class_device);
+        if (rc)
+                goto fail_with_cdev;
+        rc = sysfs_create_link(
                &device->kobj,
                &tcd->class_device->kobj,
                tcd->mode_name
        );
+        if (rc)
+                goto fail_with_class_device;
        return tcd;
+fail_with_class_device:
+        class_device_destroy(tape_class, tcd->char_device->dev);
 fail_with_cdev:
        cdev_del(tcd->char_device);
diff --git a/drivers/s390/char/tape_core.c b/drivers/s390/char/tape_core.c
index 122b4d8965c3..2826aed91043 100644
--- a/drivers/s390/char/tape_core.c
+++ b/drivers/s390/char/tape_core.c
@@ -543,20 +543,24 @@ int
 tape_generic_probe(struct ccw_device *cdev)
 {
        struct tape_device *device;
+        int ret;
        device = tape_alloc_device();
        if (IS_ERR(device))
                return -ENODEV;
-        PRINT_INFO("tape device %s found\n", cdev->dev.bus_id);
+        ccw_device_set_options(cdev, CCWDEV_DO_PATHGROUP);
+        ret = sysfs_create_group(&cdev->dev.kobj, &tape_attr_group);
+        if (ret) {
+                tape_put_device(device);
+                PRINT_ERR("probe failed for tape device %s\n", cdev->dev.bus_id);
+                return ret;
+        }
        cdev->dev.driver_data = device;
+        cdev->handler = __tape_do_irq;
        device->cdev = cdev;
        device->cdev_id = busid_to_int(cdev->dev.bus_id);
-        cdev->handler = __tape_do_irq;
+        PRINT_INFO("tape device %s found\n", cdev->dev.bus_id);
+        return ret;
-        ccw_device_set_options(cdev, CCWDEV_DO_PATHGROUP);
-        sysfs_create_group(&cdev->dev.kobj, &tape_attr_group);
-        return 0;
 }
 static inline void
diff --git a/drivers/s390/cio/cmf.c b/drivers/s390/cio/cmf.c
index 0df3af1f08de..828b2d334f0a 100644
--- a/drivers/s390/cio/cmf.c
+++ b/drivers/s390/cio/cmf.c
@@ -1068,6 +1068,7 @@ cmb_show_avg_sample_interval(struct device *dev, struct device_attribute *attr,
        if (count) {
                interval = cmb_data->last_update -
                        cdev->private->cmb_start_time;
+                interval = (interval * 1000) >> 12;
                interval /= count;
        } else
                interval = -1;
diff --git a/drivers/s390/net/ctcmain.c b/drivers/s390/net/ctcmain.c
index 20c8eb16f464..8a4b58120146 100644
--- a/drivers/s390/net/ctcmain.c
+++ b/drivers/s390/net/ctcmain.c
@@ -2686,9 +2686,17 @@ static struct attribute_group ctc_attr_group = {
 static int
 ctc_add_attributes(struct device *dev)
 {
-        device_create_file(dev, &dev_attr_loglevel);
+        int rc;
-        device_create_file(dev, &dev_attr_stats);
-        return 0;
+        rc = device_create_file(dev, &dev_attr_loglevel);
+        if (rc)
+                goto out;
+        rc = device_create_file(dev, &dev_attr_stats);
+        if (!rc)
+                goto out;
+        device_remove_file(dev, &dev_attr_loglevel);
+out:
+        return rc;
 }
 static void
@@ -2901,7 +2909,12 @@ ctc_new_device(struct ccwgroup_device *cgdev)
                goto out;
        }
-        ctc_add_attributes(&cgdev->dev);
+        if (ctc_add_attributes(&cgdev->dev)) {
+                ctc_netdev_unregister(dev);
+                dev->priv = NULL;
+                ctc_free_netdevice(dev, 1);
+                goto out;
+        }
        strlcpy(privptr->fsm->name, dev->name, sizeof (privptr->fsm->name));
diff --git a/drivers/s390/net/qeth_main.c b/drivers/s390/net/qeth_main.c
index 103c41470bd2..5fff1f93973a 100644
--- a/drivers/s390/net/qeth_main.c
+++ b/drivers/s390/net/qeth_main.c
@@ -8451,10 +8451,11 @@ __qeth_reboot_event_card(struct device *dev, void *data)
 static int
 qeth_reboot_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
+        int ret;
-        driver_for_each_device(&qeth_ccwgroup_driver.driver, NULL, NULL,
+        ret = driver_for_each_device(&qeth_ccwgroup_driver.driver, NULL, NULL,
-                               __qeth_reboot_event_card);
+                                     __qeth_reboot_event_card);
-        return NOTIFY_DONE;
+        return ret ? NOTIFY_BAD : NOTIFY_DONE;
 }
diff --git a/drivers/sbus/sbus.c b/drivers/sbus/sbus.c
index 16b59773c0bb..935952ef88f1 100644
--- a/drivers/sbus/sbus.c
+++ b/drivers/sbus/sbus.c
@@ -233,7 +233,7 @@ static void __init build_one_sbus(struct device_node *dp, int num_sbus)
        sbus->ofdev.node = dp;
        sbus->ofdev.dev.parent = NULL;
        sbus->ofdev.dev.bus = &sbus_bus_type;
-        strcpy(sbus->ofdev.dev.bus_id, dp->path_component_name);
+        sprintf(sbus->ofdev.dev.bus_id, "sbus%d", num_sbus);
        if (of_device_register(&sbus->ofdev) != 0)
                printk(KERN_DEBUG "sbus: device registration error for %s!\n",
diff --git a/drivers/scsi/53c7xx.c b/drivers/scsi/53c7xx.c
index c690c2b89e41..acf292736b4e 100644
--- a/drivers/scsi/53c7xx.c
+++ b/drivers/scsi/53c7xx.c
@@ -3451,12 +3451,12 @@ create_cmd (Scsi_Cmnd *cmd) {
    for (i = 0; cmd->use_sg ? (i < cmd->use_sg) : !i; cmd_datain += 4, 
        cmd_dataout += 4, ++i) {
        u32 vbuf = cmd->use_sg
-            ? (u32)page_address(((struct scatterlist *)cmd->buffer)[i].page)+
+            ? (u32)page_address(((struct scatterlist *)cmd->request_buffer)[i].page)+
-              ((struct scatterlist *)cmd->buffer)[i].offset
+              ((struct scatterlist *)cmd->request_buffer)[i].offset
            : (u32)(cmd->request_buffer);
        u32 bbuf = virt_to_bus((void *)vbuf);
        u32 count = cmd->use_sg ?
-            ((struct scatterlist *)cmd->buffer)[i].length :
+            ((struct scatterlist *)cmd->request_buffer)[i].length :
            cmd->request_bufflen;
        /*
@@ -5417,7 +5417,7 @@ insn_to_offset (Scsi_Cmnd *cmd, u32 *insn) {
            if ((buffers = cmd->use_sg)) {
                for (offset = 0, 
-                        segment = (struct scatterlist *) cmd->buffer;
+                        segment = (struct scatterlist *) cmd->request_buffer;
                     buffers && !((found = ((ptr >= (char *)page_address(segment->page)+segment->offset) && 
                            (ptr < ((char *)page_address(segment->page)+segment->offset+segment->length)))));
                     --buffers, offset += segment->length, ++segment)
diff --git a/drivers/scsi/NCR53C9x.c b/drivers/scsi/NCR53C9x.c
index 8a4659e94105..085db4826e0e 100644
--- a/drivers/scsi/NCR53C9x.c
+++ b/drivers/scsi/NCR53C9x.c
@@ -911,7 +911,7 @@ static void esp_get_dmabufs(struct NCR_ESP *esp, Scsi_Cmnd *sp)
                        sp->SCp.ptr =
                                (char *) virt_to_phys(sp->request_buffer);
        } else {
-                sp->SCp.buffer = (struct scatterlist *) sp->buffer;
+                sp->SCp.buffer = (struct scatterlist *) sp->request_buffer;
                sp->SCp.buffers_residual = sp->use_sg - 1;
                sp->SCp.this_residual = sp->SCp.buffer->length;
                if (esp->dma_mmu_get_scsi_sgl)
diff --git a/drivers/scsi/NCR_D700.c b/drivers/scsi/NCR_D700.c
index a06f547e87f7..d05681f9d81a 100644
--- a/drivers/scsi/NCR_D700.c
+++ b/drivers/scsi/NCR_D700.c
@@ -114,7 +114,7 @@ MODULE_DESCRIPTION("NCR Dual700 SCSI Driver");
 MODULE_LICENSE("GPL");
 module_param(NCR_D700, charp, 0);
-static __u8 __initdata id_array[2*(MCA_MAX_SLOT_NR + 1)] =
+static __u8 __devinitdata id_array[2*(MCA_MAX_SLOT_NR + 1)] =
        { [0 ... 2*(MCA_MAX_SLOT_NR + 1)-1] = 7 };
 #ifdef MODULE
@@ -173,7 +173,7 @@ struct NCR_D700_private {
        char                    pad;
 };
-static int 
+static int __devinit
 NCR_D700_probe_one(struct NCR_D700_private *p, int siop, int irq,
                   int slot, u32 region, int differential)
 {
@@ -243,7 +243,7 @@ NCR_D700_intr(int irq, void *data, struct pt_regs *regs)
 * essentially connectecd to the MCA bus independently, it is easier
 * to set them up as two separate host adapters, rather than one
 * adapter with two channels */
-static int
+static int __devinit
 NCR_D700_probe(struct device *dev)
 {
        struct NCR_D700_private *p;
@@ -329,7 +329,7 @@ NCR_D700_probe(struct device *dev)
        for (i = 0; i < 2; i++) {
                int err;
-                if ((err = NCR_D700_probe_one(p, i, slot, irq,
+                if ((err = NCR_D700_probe_one(p, i, irq, slot,
                                              offset_addr + (0x80 * i),
                                              differential)) != 0)
                        printk("D700: SIOP%d: probe failed, error = %d\n",
@@ -349,7 +349,7 @@ NCR_D700_probe(struct device *dev)
        return 0;
 }
-static void
+static void __devexit
 NCR_D700_remove_one(struct Scsi_Host *host)
 {
        scsi_remove_host(host);
@@ -359,7 +359,7 @@ NCR_D700_remove_one(struct Scsi_Host *host)
        release_region(host->base, 64);
 }
-static int
+static int __devexit
 NCR_D700_remove(struct device *dev)
 {
        struct NCR_D700_private *p = dev_get_drvdata(dev);
@@ -380,7 +380,7 @@ static struct mca_driver NCR_D700_driver = {
                .name           = "NCR_D700",
                .bus            = &mca_bus_type,
                .probe          = NCR_D700_probe,
-                .remove         = NCR_D700_remove,
+                .remove         = __devexit_p(NCR_D700_remove),
        },
 };
diff --git a/drivers/scsi/aha152x.c b/drivers/scsi/aha152x.c
index 36e63f82d9f8..f974869ea323 100644
--- a/drivers/scsi/aha152x.c
+++ b/drivers/scsi/aha152x.c
@@ -551,6 +551,11 @@ struct aha152x_hostdata {
 struct aha152x_scdata {
        Scsi_Cmnd *next;        /* next sc in queue */
        struct semaphore *sem;  /* semaphore to block on */
+        unsigned char cmd_len;
+        unsigned char cmnd[MAX_COMMAND_SIZE];
+        unsigned short use_sg;
+        unsigned request_bufflen;
+        void *request_buffer;
 };
@@ -1006,11 +1011,20 @@ static int aha152x_internal_queue(Scsi_Cmnd *SCpnt, struct semaphore *sem, int p
                        return FAILED;
                }
        } else {
+                struct aha152x_scdata *sc;
                SCpnt->host_scribble = kmalloc(sizeof(struct aha152x_scdata), GFP_ATOMIC);
                if(SCpnt->host_scribble==0) {
                        printk(ERR_LEAD "allocation failed\n", CMDINFO(SCpnt));
                        return FAILED;
                }
+                sc = SCDATA(SCpnt);
+                memcpy(sc->cmnd, SCpnt->cmnd, sizeof(sc->cmnd));
+                sc->request_buffer  = SCpnt->request_buffer;
+                sc->request_bufflen = SCpnt->request_bufflen;
+                sc->use_sg          = SCpnt->use_sg;
+                sc->cmd_len         = SCpnt->cmd_len;
        }
        SCNEXT(SCpnt)           = NULL;
@@ -1165,6 +1179,10 @@ static int aha152x_device_reset(Scsi_Cmnd * SCpnt)
        DECLARE_MUTEX_LOCKED(sem);
        struct timer_list timer;
        int ret, issued, disconnected;
+        unsigned char old_cmd_len = SCpnt->cmd_len;
+        unsigned short old_use_sg = SCpnt->use_sg;
+        void *old_buffer = SCpnt->request_buffer;
+        unsigned old_bufflen = SCpnt->request_bufflen;
        unsigned long flags;
 #if defined(AHA152X_DEBUG)
@@ -1198,11 +1216,11 @@ static int aha152x_device_reset(Scsi_Cmnd * SCpnt)
        add_timer(&timer);
        down(&sem);
        del_timer(&timer);
-        
-        SCpnt->cmd_len         = SCpnt->old_cmd_len;
+        SCpnt->cmd_len         = old_cmd_len;
-        SCpnt->use_sg          = SCpnt->old_use_sg;
+        SCpnt->use_sg          = old_use_sg;
-        SCpnt->request_buffer  = SCpnt->buffer;
+        SCpnt->request_buffer  = old_buffer;
-        SCpnt->request_bufflen = SCpnt->bufflen;
+        SCpnt->request_bufflen = old_bufflen;
        DO_LOCK(flags);
@@ -1565,6 +1583,9 @@ static void busfree_run(struct Scsi_Host *shpnt)
 #endif
                if(DONE_SC->SCp.phase & check_condition) {
+                        struct scsi_cmnd *cmd = HOSTDATA(shpnt)->done_SC;
+                        struct aha152x_scdata *sc = SCDATA(cmd);
 #if 0
                        if(HOSTDATA(shpnt)->debug & debug_eh) {
                                printk(ERR_LEAD "received sense: ", CMDINFO(DONE_SC));
@@ -1573,13 +1594,13 @@ static void busfree_run(struct Scsi_Host *shpnt)
 #endif
                        /* restore old command */
-                        memcpy((void *) DONE_SC->cmnd, (void *) DONE_SC->data_cmnd, sizeof(DONE_SC->data_cmnd));
+                        memcpy(cmd->cmnd, sc->cmnd, sizeof(sc->cmnd));
-                        DONE_SC->request_buffer  = DONE_SC->buffer;
+                        cmd->request_buffer  = sc->request_buffer;
-                        DONE_SC->request_bufflen = DONE_SC->bufflen;
+                        cmd->request_bufflen = sc->request_bufflen;
-                        DONE_SC->use_sg          = DONE_SC->old_use_sg;
+                        cmd->use_sg          = sc->use_sg;
-                        DONE_SC->cmd_len         = DONE_SC->old_cmd_len;
+                        cmd->cmd_len         = sc->cmd_len;
-                        DONE_SC->SCp.Status = 0x02;
+                        cmd->SCp.Status = 0x02;
                        HOSTDATA(shpnt)->commands--;
                        if (!HOSTDATA(shpnt)->commands)
diff --git a/drivers/scsi/aic7xxx/aic79xx_core.c b/drivers/scsi/aic7xxx/aic79xx_core.c
index a1e8ca758594..653818d2f802 100644
--- a/drivers/scsi/aic7xxx/aic79xx_core.c
+++ b/drivers/scsi/aic7xxx/aic79xx_core.c
@@ -7289,7 +7289,7 @@ ahd_reset_cmds_pending(struct ahd_softc *ahd)
        ahd->flags &= ~AHD_UPDATE_PEND_CMDS;
 }
-void
+static void
 ahd_done_with_status(struct ahd_softc *ahd, struct scb *scb, uint32_t status)
 {
        cam_status ostat;
diff --git a/drivers/scsi/aic7xxx/aic79xx_osm.c b/drivers/scsi/aic7xxx/aic79xx_osm.c
index b244c7124179..998999c0a972 100644
--- a/drivers/scsi/aic7xxx/aic79xx_osm.c
+++ b/drivers/scsi/aic7xxx/aic79xx_osm.c
@@ -243,25 +243,6 @@ ahd_print_path(struct ahd_softc *ahd, struct scb *scb)
 static uint32_t aic79xx_no_reset;
 /*
- * Certain PCI motherboards will scan PCI devices from highest to lowest,
- * others scan from lowest to highest, and they tend to do all kinds of
- * strange things when they come into contact with PCI bridge chips.  The
- * net result of all this is that the PCI card that is actually used to boot
- * the machine is very hard to detect.  Most motherboards go from lowest
- * PCI slot number to highest, and the first SCSI controller found is the
- * one you boot from.  The only exceptions to this are when a controller
- * has its BIOS disabled.  So, we by default sort all of our SCSI controllers
- * from lowest PCI slot number to highest PCI slot number.  We also force
- * all controllers with their BIOS disabled to the end of the list.  This
- * works on *almost* all computers.  Where it doesn't work, we have this
- * option.  Setting this option to non-0 will reverse the order of the sort
- * to highest first, then lowest, but will still leave cards with their BIOS
- * disabled at the very end.  That should fix everyone up unless there are
- * really strange cirumstances.
- */
-static uint32_t aic79xx_reverse_scan;
-/*
 * Should we force EXTENDED translation on a controller.
 *     0 == Use whatever is in the SEEPROM or default to off
 *     1 == Use whatever is in the SEEPROM or default to on
@@ -350,7 +331,6 @@ MODULE_PARM_DESC(aic79xx,
 "                               periodically to prevent tag starvation.\n"
 "                               This may be required by some older disk\n"
 "                               or drives/RAID arrays.\n"
-"       reverse_scan            Sort PCI devices highest Bus/Slot to lowest\n"
 "       tag_info:<tag_str>      Set per-target tag depth\n"
 "       global_tag_depth:<int>  Global tag depth for all targets on all buses\n"
 "       slewrate:<slewrate_list>Set the signal slew rate (0-15).\n"
@@ -1031,7 +1011,6 @@ aic79xx_setup(char *s)
 #ifdef AHD_DEBUG
                { "debug", &ahd_debug },
 #endif
-                { "reverse_scan", &aic79xx_reverse_scan },
                { "periodic_otag", &aic79xx_periodic_otag },
                { "pci_parity", &aic79xx_pci_parity },
                { "seltime", &aic79xx_seltime },
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.c b/drivers/scsi/aic7xxx/aic7xxx_osm.c
index debf3e2a0798..aa4be8a31415 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm.c
@@ -353,7 +353,6 @@ MODULE_PARM_DESC(aic7xxx,
 "                               periodically to prevent tag starvation.\n"
 "                               This may be required by some older disk\n"
 "                               drives or RAID arrays.\n"
-"       reverse_scan            Sort PCI devices highest Bus/Slot to lowest\n"
 "       tag_info:<tag_str>      Set per-target tag depth\n"
 "       global_tag_depth:<int>  Global tag depth for every target\n"
 "                               on every bus\n"
diff --git a/drivers/scsi/atari_NCR5380.c b/drivers/scsi/atari_NCR5380.c
index 007a14e5c3fd..e397129c90d1 100644
--- a/drivers/scsi/atari_NCR5380.c
+++ b/drivers/scsi/atari_NCR5380.c
@@ -507,7 +507,7 @@ static __inline__ void initialize_SCp(Scsi_Cmnd *cmd)
     */
    if (cmd->use_sg) {
-        cmd->SCp.buffer = (struct scatterlist *) cmd->buffer;
+        cmd->SCp.buffer = (struct scatterlist *) cmd->request_buffer;
        cmd->SCp.buffers_residual = cmd->use_sg - 1;
        cmd->SCp.ptr = (char *)page_address(cmd->SCp.buffer->page)+
                       cmd->SCp.buffer->offset;
diff --git a/drivers/scsi/constants.c b/drivers/scsi/constants.c
index dddd2acce76f..61f6024b61ba 100644
--- a/drivers/scsi/constants.c
+++ b/drivers/scsi/constants.c
@@ -5,6 +5,7 @@
 * Additions for SCSI 3+ (SPC-3 T10/1416-D Rev 07 3 May 2002)
 *   by D. Gilbert and aeb (20020609)
 * Additions for SPC-3 T10/1416-D Rev 21 22 Sept 2004, D. Gilbert 20041025
+ * Update to SPC-4 T10/1713-D Rev 5a, 14 June 2006, D. Gilbert 20060702
 */
 #include <linux/blkdev.h>
@@ -36,55 +37,56 @@ static const char * cdb_byte0_names[] = {
 /* 00-03 */ "Test Unit Ready", "Rezero Unit/Rewind", NULL, "Request Sense",
 /* 04-07 */ "Format Unit/Medium", "Read Block Limits", NULL,
            "Reasssign Blocks",
-/* 08-0d */ "Read (6)", NULL, "Write (6)", "Seek (6)", NULL, NULL,
+/* 08-0d */ "Read(6)", NULL, "Write(6)", "Seek(6)", NULL, NULL,
 /* 0e-12 */ NULL, "Read Reverse", "Write Filemarks", "Space", "Inquiry",  
-/* 13-16 */ "Verify (6)", "Recover Buffered Data", "Mode Select (6)",
+/* 13-16 */ "Verify(6)", "Recover Buffered Data", "Mode Select(6)",
-            "Reserve (6)",
+            "Reserve(6)",
-/* 17-1a */ "Release (6)", "Copy", "Erase", "Mode Sense (6)", 
+/* 17-1a */ "Release(6)", "Copy", "Erase", "Mode Sense(6)",
 /* 1b-1d */ "Start/Stop Unit", "Receive Diagnostic", "Send Diagnostic", 
 /* 1e-1f */ "Prevent/Allow Medium Removal", NULL,
 /* 20-22 */  NULL, NULL, NULL,
 /* 23-28 */ "Read Format Capacities", "Set Window",
-            "Read Capacity (10)", NULL, NULL, "Read (10)", 
+            "Read Capacity(10)", NULL, NULL, "Read(10)",
-/* 29-2d */ "Read Generation", "Write (10)", "Seek (10)", "Erase (10)", 
+/* 29-2d */ "Read Generation", "Write(10)", "Seek(10)", "Erase(10)",
-            "Read updated block", 
+            "Read updated block",
-/* 2e-31 */ "Write Verify (10)", "Verify (10)", "Search High", "Search Equal", 
+/* 2e-31 */ "Write Verify(10)", "Verify(10)", "Search High", "Search Equal",
 /* 32-34 */ "Search Low", "Set Limits", "Prefetch/Read Position", 
-/* 35-37 */ "Synchronize Cache (10)", "Lock/Unlock Cache (10)",
+/* 35-37 */ "Synchronize Cache(10)", "Lock/Unlock Cache(10)",
            "Read Defect Data(10)", 
 /* 38-3c */ "Medium Scan", "Compare", "Copy Verify", "Write Buffer", 
            "Read Buffer", 
-/* 3d-3f */ "Update Block", "Read Long (10)",  "Write Long (10)",
+/* 3d-3f */ "Update Block", "Read Long(10)",  "Write Long(10)",
-/* 40-41 */ "Change Definition", "Write Same (10)",
+/* 40-41 */ "Change Definition", "Write Same(10)",
 /* 42-48 */ "Read sub-channel", "Read TOC/PMA/ATIP", "Read density support",
-            "Play audio (10)", "Get configuration", "Play audio msf",
+            "Play audio(10)", "Get configuration", "Play audio msf",
            "Play audio track/index",
-/* 49-4f */ "Play track relative (10)", "Get event status notification",
+/* 49-4f */ "Play track relative(10)", "Get event status notification",
            "Pause/resume", "Log Select", "Log Sense", "Stop play/scan",
            NULL,
 /* 50-55 */ "Xdwrite", "Xpwrite, Read disk info", "Xdread, Read track info",
-            "Reserve track", "Send OPC info", "Mode Select (10)",
+            "Reserve track", "Send OPC info", "Mode Select(10)",
-/* 56-5b */ "Reserve (10)", "Release (10)", "Repair track", "Read master cue",
+/* 56-5b */ "Reserve(10)", "Release(10)", "Repair track", "Read master cue",
-            "Mode Sense (10)", "Close track/session",
+            "Mode Sense(10)", "Close track/session",
 /* 5c-5f */ "Read buffer capacity", "Send cue sheet", "Persistent reserve in",
            "Persistent reserve out",
 /* 60-67 */ NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
 /* 68-6f */ NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
 /* 70-77 */ NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
 /* 78-7f */ NULL, NULL, NULL, NULL, NULL, NULL, NULL, "Variable length",
-/* 80-84 */ "Xdwrite (16)", "Rebuild (16)", "Regenerate (16)", "Extended copy",
+/* 80-84 */ "Xdwrite(16)", "Rebuild(16)", "Regenerate(16)", "Extended copy",
            "Receive copy results",
-/* 85-89 */ "Memory Export In (16)", "Access control in", "Access control out",
+/* 85-89 */ "ATA command pass through(16)", "Access control in",
-            "Read (16)", "Memory Export Out (16)",
+            "Access control out", "Read(16)", "Memory Export Out(16)",
-/* 8a-8f */ "Write (16)", NULL, "Read attributes", "Write attributes",
+/* 8a-8f */ "Write(16)", NULL, "Read attributes", "Write attributes",
-            "Write and verify (16)", "Verify (16)",
+            "Write and verify(16)", "Verify(16)",
-/* 90-94 */ "Pre-fetch (16)", "Synchronize cache (16)",
+/* 90-94 */ "Pre-fetch(16)", "Synchronize cache(16)",
-            "Lock/unlock cache (16)", "Write same (16)", NULL,
+            "Lock/unlock cache(16)", "Write same(16)", NULL,
 /* 95-99 */ NULL, NULL, NULL, NULL, NULL,
-/* 9a-9f */ NULL, NULL, NULL, NULL, "Service action in (16)",
+/* 9a-9f */ NULL, NULL, NULL, NULL, "Service action in(16)",
-            "Service action out (16)",
+            "Service action out(16)",
-/* a0-a5 */ "Report luns", "Blank", "Send event", "Maintenance in",
+/* a0-a5 */ "Report luns", "ATA command pass through(12)/Blank",
-            "Maintenance out", "Move medium/play audio(12)",
+            "Security protocol in", "Maintenance in", "Maintenance out",
+            "Move medium/play audio(12)",
 /* a6-a9 */ "Exchange medium", "Move medium attached", "Read(12)",
            "Play track relative(12)",
 /* aa-ae */ "Write(12)", NULL, "Erase(12), Get Performance",
@@ -92,12 +94,12 @@ static const char * cdb_byte0_names[] = {
 /* af-b1 */ "Verify(12)", "Search data high(12)", "Search data equal(12)",
 /* b2-b4 */ "Search data low(12)", "Set limits(12)",
            "Read element status attached",
-/* b5-b6 */ "Request volume element address", "Send volume tag, set streaming",
+/* b5-b6 */ "Security protocol out", "Send volume tag, set streaming",
 /* b7-b9 */ "Read defect data(12)", "Read element status", "Read CD msf",
 /* ba-bc */ "Redundancy group (in), Scan",
-            "Redundancy group (out), Set cd-rom speed", "Spare in, Play cd",
+            "Redundancy group (out), Set cd-rom speed", "Spare (in), Play cd",
-/* bd-bf */ "Spare out, Mechanism status", "Volume set in, Read cd",
+/* bd-bf */ "Spare (out), Mechanism status", "Volume set (in), Read cd",
-            "Volume set out, Send DVD structure",
+            "Volume set (out), Send DVD structure",
 };
 struct value_name_pair {
@@ -112,6 +114,7 @@ static const struct value_name_pair maint_in_arr[] = {
        {0xc, "Report supported operation codes"},
        {0xd, "Report supported task management functions"},
        {0xe, "Report priority"},
+        {0xf, "Report timestamp"},
 };
 #define MAINT_IN_SZ ARRAY_SIZE(maint_in_arr)
@@ -120,6 +123,7 @@ static const struct value_name_pair maint_out_arr[] = {
        {0xa, "Set target port groups"},
        {0xb, "Change aliases"},
        {0xe, "Set priority"},
+        {0xe, "Set timestamp"},
 };
 #define MAINT_OUT_SZ ARRAY_SIZE(maint_out_arr)
@@ -427,6 +431,7 @@ static struct error_info additional[] =
        {0x001A, "Rewind operation in progress"},
        {0x001B, "Set capacity operation in progress"},
        {0x001C, "Verify operation in progress"},
+        {0x001D, "ATA pass through information available"},
        {0x0100, "No index/sector signal"},
@@ -438,7 +443,7 @@ static struct error_info additional[] =
        {0x0400, "Logical unit not ready, cause not reportable"},
        {0x0401, "Logical unit is in process of becoming ready"},
-        {0x0402, "Logical unit not ready, initializing cmd. required"},
+        {0x0402, "Logical unit not ready, initializing command required"},
        {0x0403, "Logical unit not ready, manual intervention required"},
        {0x0404, "Logical unit not ready, format in progress"},
        {0x0405, "Logical unit not ready, rebuild in progress"},
@@ -478,6 +483,9 @@ static struct error_info additional[] =
        {0x0B00, "Warning"},
        {0x0B01, "Warning - specified temperature exceeded"},
        {0x0B02, "Warning - enclosure degraded"},
+        {0x0B03, "Warning - background self-test failed"},
+        {0x0B04, "Warning - background pre-scan detected medium error"},
+        {0x0B05, "Warning - background medium scan detected medium error"},
        {0x0C00, "Write error"},
        {0x0C01, "Write error - recovered with auto reallocation"},
@@ -493,6 +501,7 @@ static struct error_info additional[] =
        {0x0C0B, "Auxiliary memory write error"},
        {0x0C0C, "Write error - unexpected unsolicited data"},
        {0x0C0D, "Write error - not enough unsolicited data"},
+        {0x0C0F, "Defects in error window"},
        {0x0D00, "Error detected by third party temporary initiator"},
        {0x0D01, "Third party device failure"},
@@ -504,11 +513,12 @@ static struct error_info additional[] =
        {0x0E00, "Invalid information unit"},
        {0x0E01, "Information unit too short"},
        {0x0E02, "Information unit too long"},
+        {0x0E03, "Invalid field in command information unit"},
        {0x1000, "Id CRC or ECC error"},
-        {0x1001, "Data block guard check failed"},
+        {0x1001, "Logical block guard check failed"},
-        {0x1002, "Data block application tag check failed"},
+        {0x1002, "Logical block application tag check failed"},
-        {0x1003, "Data block reference tag check failed"},
+        {0x1003, "Logical block reference tag check failed"},
        {0x1100, "Unrecovered read error"},
        {0x1101, "Read retries exhausted"},
@@ -530,6 +540,7 @@ static struct error_info additional[] =
        {0x1111, "Read error - loss of streaming"},
        {0x1112, "Auxiliary memory read error"},
        {0x1113, "Read error - failed retransmission request"},
+        {0x1114, "Read error - lba marked bad by application client"},
        {0x1200, "Address mark not found for id field"},
@@ -610,11 +621,14 @@ static struct error_info additional[] =
        {0x2100, "Logical block address out of range"},
        {0x2101, "Invalid element address"},
        {0x2102, "Invalid address for write"},
+        {0x2103, "Invalid write crossing layer jump"},
        {0x2200, "Illegal function (use 20 00, 24 00, or 26 00)"},
        {0x2400, "Invalid field in cdb"},
        {0x2401, "CDB decryption error"},
+        {0x2402, "Obsolete"},
+        {0x2403, "Obsolete"},
        {0x2404, "Security audit value frozen"},
        {0x2405, "Security working key frozen"},
        {0x2406, "Nonce not unique"},
@@ -637,7 +651,10 @@ static struct error_info additional[] =
        {0x260C, "Invalid operation for copy source or destination"},
        {0x260D, "Copy segment granularity violation"},
        {0x260E, "Invalid parameter while port is enabled"},
-        {0x260F, "Invalid data-out buffer integrity"},
+        {0x260F, "Invalid data-out buffer integrity check value"},
+        {0x2610, "Data decryption key fail limit reached"},
+        {0x2611, "Incomplete key-associated data set"},
+        {0x2612, "Vendor specific key reference not found"},
        {0x2700, "Write protected"},
        {0x2701, "Hardware write protected"},
@@ -649,6 +666,7 @@ static struct error_info additional[] =
        {0x2800, "Not ready to ready change, medium may have changed"},
        {0x2801, "Import or export element accessed"},
+        {0x2802, "Format-layer may have changed"},
        {0x2900, "Power on, reset, or bus device reset occurred"},
        {0x2901, "Power on occurred"},
@@ -669,6 +687,11 @@ static struct error_info additional[] =
        {0x2A07, "Implicit asymmetric access state transition failed"},
        {0x2A08, "Priority changed"},
        {0x2A09, "Capacity data has changed"},
+        {0x2A10, "Timestamp changed"},
+        {0x2A11, "Data encryption parameters changed by another i_t nexus"},
+        {0x2A12, "Data encryption parameters changed by vendor specific "
+                 "event"},
+        {0x2A13, "Data encryption key instance counter has changed"},
        {0x2B00, "Copy cannot execute since host cannot disconnect"},
@@ -690,6 +713,7 @@ static struct error_info additional[] =
        {0x2E00, "Insufficient time for operation"},
        {0x2F00, "Commands cleared by another initiator"},
+        {0x2F01, "Commands cleared by power loss notification"},
        {0x3000, "Incompatible medium installed"},
        {0x3001, "Cannot read medium - unknown format"},
@@ -702,7 +726,8 @@ static struct error_info additional[] =
        {0x3008, "Cannot write - application code mismatch"},
        {0x3009, "Current session not fixated for append"},
        {0x300A, "Cleaning request rejected"},
-        {0x300C, "WORM medium, overwrite attempted"},
+        {0x300C, "WORM medium - overwrite attempted"},
+        {0x300D, "WORM medium - integrity check"},
        {0x3010, "Medium not formatted"},
        {0x3100, "Medium format corrupted"},
@@ -790,6 +815,9 @@ static struct error_info additional[] =
        {0x3F0F, "Echo buffer overwritten"},
        {0x3F10, "Medium loadable"},
        {0x3F11, "Medium auxiliary memory accessible"},
+        {0x3F12, "iSCSI IP address added"},
+        {0x3F13, "iSCSI IP address removed"},
+        {0x3F14, "iSCSI IP address changed"},
 /*
 *      {0x40NN, "Ram failure"},
 *      {0x40NN, "Diagnostic failure on component nn"},
@@ -799,6 +827,7 @@ static struct error_info additional[] =
        {0x4300, "Message error"},
        {0x4400, "Internal target failure"},
+        {0x4471, "ATA device failed set features"},
        {0x4500, "Select or reselect failure"},
@@ -807,9 +836,10 @@ static struct error_info additional[] =
        {0x4700, "Scsi parity error"},
        {0x4701, "Data phase CRC error detected"},
        {0x4702, "Scsi parity error detected during st data phase"},
-        {0x4703, "Information unit CRC error detected"},
+        {0x4703, "Information unit iuCRC error detected"},
        {0x4704, "Asynchronous information protection error detected"},
        {0x4705, "Protocol service CRC error"},
+        {0x4706, "Phy test function in progress"},
        {0x477f, "Some commands cleared by iSCSI Protocol event"},
        {0x4800, "Initiator detected error message received"},
@@ -844,6 +874,8 @@ static struct error_info additional[] =
        {0x5300, "Media load or eject failed"},
        {0x5301, "Unload tape failure"},
        {0x5302, "Medium removal prevented"},
+        {0x5303, "Medium removal prevented by data transfer element"},
+        {0x5304, "Medium thread or unthread failure"},
        {0x5400, "Scsi to host system interface failure"},
@@ -855,6 +887,7 @@ static struct error_info additional[] =
        {0x5505, "Insufficient access control resources"},
        {0x5506, "Auxiliary memory out of space"},
        {0x5507, "Quota error"},
+        {0x5508, "Maximum number of supplemental decryption keys exceeded"},
        {0x5700, "Unable to recover table-of-contents"},
@@ -1004,6 +1037,7 @@ static struct error_info additional[] =
        {0x6708, "Assign failure occurred"},
        {0x6709, "Multiply assigned logical unit"},
        {0x670A, "Set target port groups command failed"},
+        {0x670B, "ATA device feature not enabled"},
        {0x6800, "Logical unit not configured"},
@@ -1030,6 +1064,8 @@ static struct error_info additional[] =
        {0x6F03, "Read of scrambled sector without authentication"},
        {0x6F04, "Media region code is mismatched to logical unit region"},
        {0x6F05, "Drive region must be permanent/region reset count error"},
+        {0x6F06, "Insufficient block count for binding nonce recording"},
+        {0x6F07, "Conflict in binding nonce recording"},
 /*
 *      {0x70NN, "Decompression exception short algorithm id of nn"},
 */
@@ -1041,6 +1077,8 @@ static struct error_info additional[] =
        {0x7203, "Session fixation error - incomplete track in session"},
        {0x7204, "Empty or partially written reserved track"},
        {0x7205, "No more track reservations allowed"},
+        {0x7206, "RMZ extension is not allowed"},
+        {0x7207, "No more test zone extensions are allowed"},
        {0x7300, "Cd control error"},
        {0x7301, "Power calibration area almost full"},
@@ -1049,6 +1087,18 @@ static struct error_info additional[] =
        {0x7304, "Program memory area update failure"},
        {0x7305, "Program memory area is full"},
        {0x7306, "RMA/PMA is almost full"},
+        {0x7310, "Current power calibration area almost full"},
+        {0x7311, "Current power calibration area is full"},
+        {0x7317, "RDZ is full"},
+        {0x7400, "Security error"},
+        {0x7401, "Unable to decrypt data"},
+        {0x7402, "Unencrypted data encountered while decrypting"},
+        {0x7403, "Incorrect data encryption key"},
+        {0x7404, "Cryptographic integrity validation failed"},
+        {0x7405, "Error decrypting data"},
+        {0x7471, "Logical unit access not authorized"},
        {0, NULL}
 };
diff --git a/drivers/scsi/esp.c b/drivers/scsi/esp.c
index 10573c24a50b..eaf64c7e54e7 100644
--- a/drivers/scsi/esp.c
+++ b/drivers/scsi/esp.c
@@ -1397,7 +1397,7 @@ static void esp_get_dmabufs(struct esp *esp, struct scsi_cmnd *sp)
                        sp->SCp.ptr = NULL;
                }
        } else {
-                sp->SCp.buffer = (struct scatterlist *) sp->buffer;
+                sp->SCp.buffer = (struct scatterlist *) sp->request_buffer;
                sp->SCp.buffers_residual = sbus_map_sg(esp->sdev,
                                                       sp->SCp.buffer,
                                                       sp->use_sg,
@@ -1410,7 +1410,7 @@ static void esp_get_dmabufs(struct esp *esp, struct scsi_cmnd *sp)
 static void esp_release_dmabufs(struct esp *esp, struct scsi_cmnd *sp)
 {
        if (sp->use_sg) {
-                sbus_unmap_sg(esp->sdev, sp->buffer, sp->use_sg,
+                sbus_unmap_sg(esp->sdev, sp->request_buffer, sp->use_sg,
                              sp->sc_data_direction);
        } else if (sp->request_bufflen) {
                sbus_unmap_single(esp->sdev,
diff --git a/drivers/scsi/ibmvscsi/iseries_vscsi.c b/drivers/scsi/ibmvscsi/iseries_vscsi.c
index 7eed0b098171..6aeb5f003c3c 100644
--- a/drivers/scsi/ibmvscsi/iseries_vscsi.c
+++ b/drivers/scsi/ibmvscsi/iseries_vscsi.c
@@ -81,7 +81,7 @@ int ibmvscsi_init_crq_queue(struct crq_queue *queue,
        int rc;
        single_host_data = hostdata;
-        rc = viopath_open(viopath_hostLp, viomajorsubtype_scsi, 0);
+        rc = viopath_open(viopath_hostLp, viomajorsubtype_scsi, max_requests);
        if (rc < 0) {
                printk("viopath_open failed with rc %d in open_event_path\n",
                       rc);
diff --git a/drivers/scsi/ibmvscsi/rpa_vscsi.c b/drivers/scsi/ibmvscsi/rpa_vscsi.c
index 242b8873b333..ed22b96580c6 100644
--- a/drivers/scsi/ibmvscsi/rpa_vscsi.c
+++ b/drivers/scsi/ibmvscsi/rpa_vscsi.c
@@ -238,6 +238,7 @@ int ibmvscsi_init_crq_queue(struct crq_queue *queue,
        if (rc == 2) {
                /* Adapter is good, but other end is not ready */
                printk(KERN_WARNING "ibmvscsi: Partner adapter not ready\n");
+                retrc = 0;
        } else if (rc != 0) {
                printk(KERN_WARNING "ibmvscsi: Error %d opening adapter\n", rc);
                goto reg_crq_failed;
diff --git a/drivers/scsi/jazz_esp.c b/drivers/scsi/jazz_esp.c
index 3fd8a96f2af3..bfac4441d89f 100644
--- a/drivers/scsi/jazz_esp.c
+++ b/drivers/scsi/jazz_esp.c
@@ -257,7 +257,7 @@ static void dma_mmu_release_scsi_one (struct NCR_ESP *esp, struct scsi_cmnd *sp)
 static void dma_mmu_release_scsi_sgl (struct NCR_ESP *esp, struct scsi_cmnd *sp)
 {
    int sz = sp->use_sg - 1;
-    struct scatterlist *sg = (struct scatterlist *)sp->buffer;
+    struct scatterlist *sg = (struct scatterlist *)sp->request_buffer;
                        
    while(sz >= 0) {
        vdma_free(sg[sz].dma_address);
diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index f81691fcf177..d44f9aac6b8f 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -21,10 +21,12 @@
 struct lpfc_sli2_slim;
-#define LPFC_MAX_TARGET         256     /* max targets supported */
-#define LPFC_MAX_DISC_THREADS   64      /* max outstanding discovery els req */
-#define LPFC_MAX_NS_RETRY       3       /* max NameServer retries */
+#define LPFC_MAX_TARGET         256     /* max number of targets supported */
+#define LPFC_MAX_DISC_THREADS   64      /* max outstanding discovery els
+                                           requests */
+#define LPFC_MAX_NS_RETRY       3       /* Number of retry attempts to contact
+                                           the NameServer  before giving up. */
 #define LPFC_DFT_HBA_Q_DEPTH    2048    /* max cmds per hba */
 #define LPFC_LC_HBA_Q_DEPTH     1024    /* max cmds per low cost hba */
 #define LPFC_LP101_HBA_Q_DEPTH  128     /* max cmds per low cost hba */
@@ -41,7 +43,6 @@ struct lpfc_sli2_slim;
                             (( (u64)(high)<<16 ) << 16)|( (u64)(low))))
 /* Provide maximum configuration definitions. */
 #define LPFC_DRVR_TIMEOUT       16      /* driver iocb timeout value in sec */
-#define MAX_FCP_TARGET          256     /* max num of FCP targets supported */
 #define FC_MAX_ADPTMSG          64
 #define MAX_HBAEVT      32
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index b62a72dfab29..5c68cdd8736f 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -219,9 +219,19 @@ lpfc_issue_lip(struct Scsi_Host *host)
                return -ENOMEM;
        memset((void *)pmboxq, 0, sizeof (LPFC_MBOXQ_t));
-        lpfc_init_link(phba, pmboxq, phba->cfg_topology, phba->cfg_link_speed);
+        pmboxq->mb.mbxCommand = MBX_DOWN_LINK;
+        pmboxq->mb.mbxOwner = OWN_HOST;
        mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq, phba->fc_ratov * 2);
+        if ((mbxstatus == MBX_SUCCESS) && (pmboxq->mb.mbxStatus == 0)) {
+                memset((void *)pmboxq, 0, sizeof (LPFC_MBOXQ_t));
+                lpfc_init_link(phba, pmboxq, phba->cfg_topology,
+                               phba->cfg_link_speed);
+                mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq,
+                                                     phba->fc_ratov * 2);
+        }
        if (mbxstatus == MBX_TIMEOUT)
                pmboxq->mbox_cmpl = lpfc_sli_def_mbox_cmpl;
        else
@@ -233,51 +243,53 @@ lpfc_issue_lip(struct Scsi_Host *host)
        return 0;
 }
-static ssize_t
+static int
-lpfc_nport_evt_cnt_show(struct class_device *cdev, char *buf)
+lpfc_selective_reset(struct lpfc_hba *phba)
 {
-        struct Scsi_Host *host = class_to_shost(cdev);
+        struct completion online_compl;
-        struct lpfc_hba *phba = (struct lpfc_hba*)host->hostdata;
+        int status = 0;
-        return snprintf(buf, PAGE_SIZE, "%d\n", phba->nport_event_cnt);
+        init_completion(&online_compl);
+        lpfc_workq_post_event(phba, &status, &online_compl,
+                              LPFC_EVT_OFFLINE);
+        wait_for_completion(&online_compl);
+        if (status != 0)
+                return -EIO;
+        init_completion(&online_compl);
+        lpfc_workq_post_event(phba, &status, &online_compl,
+                              LPFC_EVT_ONLINE);
+        wait_for_completion(&online_compl);
+        if (status != 0)
+                return -EIO;
+        return 0;
 }
 static ssize_t
-lpfc_board_online_show(struct class_device *cdev, char *buf)
+lpfc_issue_reset(struct class_device *cdev, const char *buf, size_t count)
 {
        struct Scsi_Host *host = class_to_shost(cdev);
        struct lpfc_hba *phba = (struct lpfc_hba*)host->hostdata;
+        int status = -EINVAL;
-        if (phba->fc_flag & FC_OFFLINE_MODE)
+        if (strncmp(buf, "selective", sizeof("selective") - 1) == 0)
-                return snprintf(buf, PAGE_SIZE, "0\n");
+                status = lpfc_selective_reset(phba);
+        if (status == 0)
+                return strlen(buf);
        else
-                return snprintf(buf, PAGE_SIZE, "1\n");
+                return status;
 }
 static ssize_t
-lpfc_board_online_store(struct class_device *cdev, const char *buf,
+lpfc_nport_evt_cnt_show(struct class_device *cdev, char *buf)
-                                                                size_t count)
 {
        struct Scsi_Host *host = class_to_shost(cdev);
        struct lpfc_hba *phba = (struct lpfc_hba*)host->hostdata;
-        struct completion online_compl;
+        return snprintf(buf, PAGE_SIZE, "%d\n", phba->nport_event_cnt);
-        int val=0, status=0;
-        if (sscanf(buf, "%d", &val) != 1)
-                return -EINVAL;
-        init_completion(&online_compl);
-        if (val)
-                lpfc_workq_post_event(phba, &status, &online_compl,
-                                                        LPFC_EVT_ONLINE);
-        else
-                lpfc_workq_post_event(phba, &status, &online_compl,
-                                                        LPFC_EVT_OFFLINE);
-        wait_for_completion(&online_compl);
-        if (!status)
-                return strlen(buf);
-        else
-                return -EIO;
 }
 static ssize_t
@@ -532,10 +544,9 @@ static CLASS_DEVICE_ATTR(lpfc_drvr_version, S_IRUGO, lpfc_drvr_version_show,
                         NULL);
 static CLASS_DEVICE_ATTR(management_version, S_IRUGO, management_version_show,
                         NULL);
-static CLASS_DEVICE_ATTR(board_online, S_IRUGO | S_IWUSR,
-                         lpfc_board_online_show, lpfc_board_online_store);
 static CLASS_DEVICE_ATTR(board_mode, S_IRUGO | S_IWUSR,
                         lpfc_board_mode_show, lpfc_board_mode_store);
+static CLASS_DEVICE_ATTR(issue_reset, S_IWUSR, NULL, lpfc_issue_reset);
 static int lpfc_poll = 0;
 module_param(lpfc_poll, int, 0);
@@ -695,12 +706,12 @@ LPFC_ATTR(discovery_threads, 32, 1, 64, "Maximum number of ELS commands "
                 "during discovery");
 /*
-# lpfc_max_luns: maximum number of LUNs per target driver will support
+# lpfc_max_luns: maximum allowed LUN.
-# Value range is [1,32768]. Default value is 256.
+# Value range is [0,65535]. Default value is 255.
-# NOTE: The SCSI layer will scan each target for this many luns
+# NOTE: The SCSI layer might probe all allowed LUN on some old targets.
 */
-LPFC_ATTR_R(max_luns, 256, 1, 32768,
+LPFC_ATTR_R(max_luns, 255, 0, 65535,
-             "Maximum number of LUNs per target driver will support");
+             "Maximum allowed LUN");
 /*
 # lpfc_poll_tmo: .Milliseconds driver will wait between polling FCP ring.
@@ -739,8 +750,8 @@ struct class_device_attribute *lpfc_host_attrs[] = {
        &class_device_attr_lpfc_max_luns,
        &class_device_attr_nport_evt_cnt,
        &class_device_attr_management_version,
-        &class_device_attr_board_online,
        &class_device_attr_board_mode,
+        &class_device_attr_issue_reset,
        &class_device_attr_lpfc_poll,
        &class_device_attr_lpfc_poll_tmo,
        NULL,
diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h
index ee22173fce43..517e9e4dd461 100644
--- a/drivers/scsi/lpfc/lpfc_crtn.h
+++ b/drivers/scsi/lpfc/lpfc_crtn.h
@@ -147,6 +147,7 @@ int lpfc_sli_hba_setup(struct lpfc_hba *);
 int lpfc_sli_hba_down(struct lpfc_hba *);
 int lpfc_sli_issue_mbox(struct lpfc_hba *, LPFC_MBOXQ_t *, uint32_t);
 int lpfc_sli_handle_mb_event(struct lpfc_hba *);
+int lpfc_sli_flush_mbox_queue(struct lpfc_hba *);
 int lpfc_sli_handle_slow_ring_event(struct lpfc_hba *,
                                    struct lpfc_sli_ring *, uint32_t);
 void lpfc_sli_def_mbox_cmpl(struct lpfc_hba *, LPFC_MBOXQ_t *);
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 4126fd87956f..b89f6cb641e6 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -648,33 +648,32 @@ lpfc_more_plogi(struct lpfc_hba * phba)
 }
 static struct lpfc_nodelist *
-lpfc_plogi_confirm_nport(struct lpfc_hba * phba, struct lpfc_iocbq * cmdiocb,
+lpfc_plogi_confirm_nport(struct lpfc_hba * phba, struct lpfc_dmabuf *prsp,
                         struct lpfc_nodelist *ndlp)
 {
        struct lpfc_nodelist *new_ndlp;
-        struct lpfc_dmabuf *pcmd, *prsp;
        uint32_t *lp;
        struct serv_parm *sp;
        uint8_t name[sizeof (struct lpfc_name)];
        uint32_t rc;
-        pcmd = (struct lpfc_dmabuf *) cmdiocb->context2;
-        prsp = (struct lpfc_dmabuf *) pcmd->list.next;
        lp = (uint32_t *) prsp->virt;
        sp = (struct serv_parm *) ((uint8_t *) lp + sizeof (uint32_t));
+        memset(name, 0, sizeof (struct lpfc_name));
        /* Now we to find out if the NPort we are logging into, matches the WWPN
         * we have for that ndlp. If not, we have some work to do.
         */
        new_ndlp = lpfc_findnode_wwpn(phba, NLP_SEARCH_ALL, &sp->portName);
-        memset(name, 0, sizeof (struct lpfc_name));
+        if (new_ndlp == ndlp)
-        rc =  memcmp(&ndlp->nlp_portname, name, sizeof(struct lpfc_name));
-        if (!rc || (new_ndlp == ndlp)) {
                return ndlp;
-        }
        if (!new_ndlp) {
+                rc =
+                   memcmp(&ndlp->nlp_portname, name, sizeof(struct lpfc_name));
+                if (!rc)
+                        return ndlp;
                new_ndlp = mempool_alloc(phba->nlp_mem_pool, GFP_ATOMIC);
                if (!new_ndlp)
                        return ndlp;
@@ -683,17 +682,21 @@ lpfc_plogi_confirm_nport(struct lpfc_hba * phba, struct lpfc_iocbq * cmdiocb,
        }
        lpfc_unreg_rpi(phba, new_ndlp);
-        new_ndlp->nlp_prev_state = ndlp->nlp_state;
        new_ndlp->nlp_DID = ndlp->nlp_DID;
-        new_ndlp->nlp_state = NLP_STE_PLOGI_ISSUE;
+        new_ndlp->nlp_prev_state = ndlp->nlp_prev_state;
-        lpfc_nlp_list(phba, new_ndlp, NLP_PLOGI_LIST);
+        new_ndlp->nlp_state = ndlp->nlp_state;
+        lpfc_nlp_list(phba, new_ndlp, ndlp->nlp_flag & NLP_LIST_MASK);
        /* Move this back to NPR list */
-        lpfc_unreg_rpi(phba, ndlp);
+        if (memcmp(&ndlp->nlp_portname, name, sizeof(struct lpfc_name)) == 0) {
-        ndlp->nlp_DID = 0; /* Two ndlps cannot have the same did */
+                lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
-        ndlp->nlp_state = NLP_STE_NPR_NODE;
+        }
-        lpfc_nlp_list(phba, ndlp, NLP_NPR_LIST);
+        else {
+                lpfc_unreg_rpi(phba, ndlp);
+                ndlp->nlp_DID = 0; /* Two ndlps cannot have the same did */
+                ndlp->nlp_state = NLP_STE_NPR_NODE;
+                lpfc_nlp_list(phba, ndlp, NLP_NPR_LIST);
+        }
        return new_ndlp;
 }
@@ -703,6 +706,7 @@ lpfc_cmpl_els_plogi(struct lpfc_hba * phba, struct lpfc_iocbq * cmdiocb,
 {
        IOCB_t *irsp;
        struct lpfc_nodelist *ndlp;
+        struct lpfc_dmabuf *prsp;
        int disc, rc, did, type;
@@ -769,7 +773,10 @@ lpfc_cmpl_els_plogi(struct lpfc_hba * phba, struct lpfc_iocbq * cmdiocb,
                }
        } else {
                /* Good status, call state machine */
-                ndlp = lpfc_plogi_confirm_nport(phba, cmdiocb, ndlp);
+                prsp = list_entry(((struct lpfc_dmabuf *)
+                        cmdiocb->context2)->list.next,
+                        struct lpfc_dmabuf, list);
+                ndlp = lpfc_plogi_confirm_nport(phba, prsp, ndlp);
                rc = lpfc_disc_state_machine(phba, ndlp, cmdiocb,
                                        NLP_EVT_CMPL_PLOGI);
        }
@@ -3282,10 +3289,9 @@ lpfc_els_timeout_handler(struct lpfc_hba *phba)
                } else
                        lpfc_sli_release_iocbq(phba, piocb);
        }
-        if (phba->sli.ring[LPFC_ELS_RING].txcmplq_cnt) {
+        if (phba->sli.ring[LPFC_ELS_RING].txcmplq_cnt)
-                phba->els_tmofunc.expires = jiffies + HZ * timeout;
+                mod_timer(&phba->els_tmofunc, jiffies + HZ * timeout);
-                add_timer(&phba->els_tmofunc);
-        }
        spin_unlock_irq(phba->host->host_lock);
 }
@@ -3442,6 +3448,8 @@ lpfc_els_unsol_event(struct lpfc_hba * phba,
                if ((did & Fabric_DID_MASK) == Fabric_DID_MASK) {
                        ndlp->nlp_type |= NLP_FABRIC;
                }
+                ndlp->nlp_state = NLP_STE_UNUSED_NODE;
+                lpfc_nlp_list(phba, ndlp, NLP_UNUSED_LIST);
        }
        phba->fc_stat.elsRcvFrame++;
@@ -3463,13 +3471,14 @@ lpfc_els_unsol_event(struct lpfc_hba * phba,
                        rjt_err = 1;
                        break;
                }
+                ndlp = lpfc_plogi_confirm_nport(phba, mp, ndlp);
                lpfc_disc_state_machine(phba, ndlp, elsiocb, NLP_EVT_RCV_PLOGI);
                break;
        case ELS_CMD_FLOGI:
                phba->fc_stat.elsRcvFLOGI++;
                lpfc_els_rcv_flogi(phba, elsiocb, ndlp, newnode);
                if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                }
                break;
        case ELS_CMD_LOGO:
@@ -3492,7 +3501,7 @@ lpfc_els_unsol_event(struct lpfc_hba * phba,
                phba->fc_stat.elsRcvRSCN++;
                lpfc_els_rcv_rscn(phba, elsiocb, ndlp, newnode);
                if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                }
                break;
        case ELS_CMD_ADISC:
@@ -3535,28 +3544,28 @@ lpfc_els_unsol_event(struct lpfc_hba * phba,
                phba->fc_stat.elsRcvLIRR++;
                lpfc_els_rcv_lirr(phba, elsiocb, ndlp);
                if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                }
                break;
        case ELS_CMD_RPS:
                phba->fc_stat.elsRcvRPS++;
                lpfc_els_rcv_rps(phba, elsiocb, ndlp);
                if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                }
                break;
        case ELS_CMD_RPL:
                phba->fc_stat.elsRcvRPL++;
                lpfc_els_rcv_rpl(phba, elsiocb, ndlp);
                if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                }
                break;
        case ELS_CMD_RNID:
                phba->fc_stat.elsRcvRNID++;
                lpfc_els_rcv_rnid(phba, elsiocb, ndlp);
                if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                }
                break;
        default:
@@ -3568,7 +3577,7 @@ lpfc_els_unsol_event(struct lpfc_hba * phba,
                                "%d:0115 Unknown ELS command x%x received from "
                                "NPORT x%x\n", phba->brd_no, cmd, did);
                if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                }
                break;
        }
diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index adb086009ae0..4d6cf990c4fc 100644
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -1084,7 +1084,7 @@ lpfc_register_remote_port(struct lpfc_hba * phba,
                fc_remote_port_rolechg(rport, rport_ids.roles);
        if ((rport->scsi_target_id != -1) &&
-                (rport->scsi_target_id < MAX_FCP_TARGET)) {
+                (rport->scsi_target_id < LPFC_MAX_TARGET)) {
                ndlp->nlp_sid = rport->scsi_target_id;
        }
@@ -1313,7 +1313,7 @@ lpfc_nlp_list(struct lpfc_hba * phba, struct lpfc_nodelist * nlp, int list)
                        if ((rport_add == mapped) &&
                            ((!nlp->rport) ||
                             (nlp->rport->scsi_target_id == -1) ||
-                             (nlp->rport->scsi_target_id >= MAX_FCP_TARGET))) {
+                             (nlp->rport->scsi_target_id >= LPFC_MAX_TARGET))) {
                                nlp->nlp_state = NLP_STE_UNMAPPED_NODE;
                                spin_lock_irq(phba->host->host_lock);
                                nlp->nlp_flag |= NLP_TGT_NO_SCSIID;
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 81755a3f7c68..ef47b824cbed 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -71,6 +71,7 @@ lpfc_config_port_prep(struct lpfc_hba * phba)
        uint16_t offset = 0;
        static char licensed[56] =
                    "key unlock for use with gnu public licensed code only\0";
+        static int init_key = 1;
        pmb = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
        if (!pmb) {
@@ -82,10 +83,13 @@ lpfc_config_port_prep(struct lpfc_hba * phba)
        phba->hba_state = LPFC_INIT_MBX_CMDS;
        if (lpfc_is_LC_HBA(phba->pcidev->device)) {
-                uint32_t *ptext = (uint32_t *) licensed;
+                if (init_key) {
+                        uint32_t *ptext = (uint32_t *) licensed;
-                for (i = 0; i < 56; i += sizeof (uint32_t), ptext++)
+                        for (i = 0; i < 56; i += sizeof (uint32_t), ptext++)
-                        *ptext = cpu_to_be32(*ptext);
+                                *ptext = cpu_to_be32(*ptext);
+                        init_key = 0;
+                }
                lpfc_read_nv(phba, pmb);
                memset((char*)mb->un.varRDnvp.rsvd3, 0,
@@ -405,19 +409,26 @@ lpfc_config_port_post(struct lpfc_hba * phba)
        }
        /* MBOX buffer will be freed in mbox compl */
-        i = 0;
+        return (0);
+}
+static int
+lpfc_discovery_wait(struct lpfc_hba *phba)
+{
+        int i = 0;
        while ((phba->hba_state != LPFC_HBA_READY) ||
               (phba->num_disc_nodes) || (phba->fc_prli_sent) ||
               ((phba->fc_map_cnt == 0) && (i<2)) ||
-               (psli->sli_flag & LPFC_SLI_MBOX_ACTIVE)) {
+               (phba->sli.sli_flag & LPFC_SLI_MBOX_ACTIVE)) {
                /* Check every second for 30 retries. */
                i++;
                if (i > 30) {
-                        break;
+                        return -ETIMEDOUT;
                }
                if ((i >= 15) && (phba->hba_state <= LPFC_LINK_DOWN)) {
                        /* The link is down.  Set linkdown timeout */
-                        break;
+                        return -ETIMEDOUT;
                }
                /* Delay for 1 second to give discovery time to complete. */
@@ -425,12 +436,7 @@ lpfc_config_port_post(struct lpfc_hba * phba)
        }
-        /* Since num_disc_nodes keys off of PLOGI, delay a bit to let
+        return 0;
-         * any potential PRLIs to flush thru the SLI sub-system.
-         */
-        msleep(50);
-        return (0);
 }
 /************************************************************************/
@@ -1339,7 +1345,8 @@ lpfc_offline(struct lpfc_hba * phba)
        struct lpfc_sli_ring *pring;
        struct lpfc_sli *psli;
        unsigned long iflag;
-        int i = 0;
+        int i;
+        int cnt = 0;
        if (!phba)
                return 0;
@@ -1348,17 +1355,27 @@ lpfc_offline(struct lpfc_hba * phba)
                return 0;
        psli = &phba->sli;
-        pring = &psli->ring[psli->fcp_ring];
        lpfc_linkdown(phba);
+        lpfc_sli_flush_mbox_queue(phba);
-        /* The linkdown event takes 30 seconds to timeout. */
+        for (i = 0; i < psli->num_rings; i++) {
-        while (pring->txcmplq_cnt) {
+                pring = &psli->ring[i];
-                mdelay(10);
+                /* The linkdown event takes 30 seconds to timeout. */
-                if (i++ > 3000)
+                while (pring->txcmplq_cnt) {
-                        break;
+                        mdelay(10);
+                        if (cnt++ > 3000) {
+                                lpfc_printf_log(phba,
+                                        KERN_WARNING, LOG_INIT,
+                                        "%d:0466 Outstanding IO when "
+                                        "bringing Adapter offline\n",
+                                        phba->brd_no);
+                                break;
+                        }
+                }
        }
        /* stop all timers associated with this hba */
        lpfc_stop_timer(phba);
        phba->work_hba_events = 0;
@@ -1639,6 +1656,8 @@ lpfc_pci_probe_one(struct pci_dev *pdev, const struct pci_device_id *pid)
                goto out_free_irq;
        }
+        lpfc_discovery_wait(phba);
        if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
                spin_lock_irq(phba->host->host_lock);
                lpfc_poll_start_timer(phba);
diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
index 07017658ac56..066292d3995a 100644
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -133,6 +133,11 @@ lpfc_mem_free(struct lpfc_hba * phba)
        pci_pool_destroy(phba->lpfc_scsi_dma_buf_pool);
        pci_pool_destroy(phba->lpfc_mbuf_pool);
+        /* Free the iocb lookup array */
+        kfree(psli->iocbq_lookup);
+        psli->iocbq_lookup = NULL;
 }
 void *
diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index 27d60ad897cd..bd0b0e293d63 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -1110,6 +1110,17 @@ lpfc_cmpl_reglogin_reglogin_issue(struct lpfc_hba * phba,
                                phba->brd_no,
                                did, mb->mbxStatus, phba->hba_state);
+                /*
+                 * If RegLogin failed due to lack of HBA resources do not
+                 * retry discovery.
+                 */
+                if (mb->mbxStatus == MBXERR_RPI_FULL) {
+                        ndlp->nlp_prev_state = NLP_STE_UNUSED_NODE;
+                        ndlp->nlp_state = NLP_STE_UNUSED_NODE;
+                        lpfc_nlp_list(phba, ndlp, NLP_UNUSED_LIST);
+                        return ndlp->nlp_state;
+                }
                /* Put ndlp in npr list set plogi timer for 1 sec */
                mod_timer(&ndlp->nlp_delayfunc, jiffies + HZ * 1);
                spin_lock_irq(phba->host->host_lock);
diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index aea1ee472f3d..a760a44173df 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -153,22 +153,6 @@ static void
 lpfc_release_scsi_buf(struct lpfc_hba * phba, struct lpfc_scsi_buf * psb)
 {
        unsigned long iflag = 0;
-        /*
-         * There are only two special cases to consider.  (1) the scsi command
-         * requested scatter-gather usage or (2) the scsi command allocated
-         * a request buffer, but did not request use_sg.  There is a third
-         * case, but it does not require resource deallocation.
-         */
-        if ((psb->seg_cnt > 0) && (psb->pCmd->use_sg)) {
-                dma_unmap_sg(&phba->pcidev->dev, psb->pCmd->request_buffer,
-                                psb->seg_cnt, psb->pCmd->sc_data_direction);
-        } else {
-                 if ((psb->nonsg_phys) && (psb->pCmd->request_bufflen)) {
-                        dma_unmap_single(&phba->pcidev->dev, psb->nonsg_phys,
-                                                psb->pCmd->request_bufflen,
-                                                psb->pCmd->sc_data_direction);
-                 }
-        }
        spin_lock_irqsave(&phba->scsi_buf_list_lock, iflag);
        psb->pCmd = NULL;
@@ -282,6 +266,27 @@ lpfc_scsi_prep_dma_buf(struct lpfc_hba * phba, struct lpfc_scsi_buf * lpfc_cmd)
 }
 static void
+lpfc_scsi_unprep_dma_buf(struct lpfc_hba * phba, struct lpfc_scsi_buf * psb)
+{
+        /*
+         * There are only two special cases to consider.  (1) the scsi command
+         * requested scatter-gather usage or (2) the scsi command allocated
+         * a request buffer, but did not request use_sg.  There is a third
+         * case, but it does not require resource deallocation.
+         */
+        if ((psb->seg_cnt > 0) && (psb->pCmd->use_sg)) {
+                dma_unmap_sg(&phba->pcidev->dev, psb->pCmd->request_buffer,
+                                psb->seg_cnt, psb->pCmd->sc_data_direction);
+        } else {
+                 if ((psb->nonsg_phys) && (psb->pCmd->request_bufflen)) {
+                        dma_unmap_single(&phba->pcidev->dev, psb->nonsg_phys,
+                                                psb->pCmd->request_bufflen,
+                                                psb->pCmd->sc_data_direction);
+                 }
+        }
+}
+static void
 lpfc_handle_fcp_err(struct lpfc_scsi_buf *lpfc_cmd)
 {
        struct scsi_cmnd *cmnd = lpfc_cmd->pCmd;
@@ -454,6 +459,7 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
        cmd->scsi_done(cmd);
        if (phba->cfg_poll & ENABLE_FCP_RING_POLLING) {
+                lpfc_scsi_unprep_dma_buf(phba, lpfc_cmd);
                lpfc_release_scsi_buf(phba, lpfc_cmd);
                return;
        }
@@ -511,6 +517,7 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
                }
        }
+        lpfc_scsi_unprep_dma_buf(phba, lpfc_cmd);
        lpfc_release_scsi_buf(phba, lpfc_cmd);
 }
@@ -609,6 +616,7 @@ lpfc_scsi_prep_cmnd(struct lpfc_hba * phba, struct lpfc_scsi_buf * lpfc_cmd,
 static int
 lpfc_scsi_prep_task_mgmt_cmd(struct lpfc_hba *phba,
                             struct lpfc_scsi_buf *lpfc_cmd,
+                             unsigned int lun,
                             uint8_t task_mgmt_cmd)
 {
        struct lpfc_sli *psli;
@@ -627,8 +635,7 @@ lpfc_scsi_prep_task_mgmt_cmd(struct lpfc_hba *phba,
        piocb = &piocbq->iocb;
        fcp_cmnd = lpfc_cmd->fcp_cmnd;
-        int_to_scsilun(lpfc_cmd->pCmd->device->lun,
+        int_to_scsilun(lun, &lpfc_cmd->fcp_cmnd->fcp_lun);
-                        &lpfc_cmd->fcp_cmnd->fcp_lun);
        fcp_cmnd->fcpCntl2 = task_mgmt_cmd;
        piocb->ulpCommand = CMD_FCP_ICMND64_CR;
@@ -655,14 +662,16 @@ lpfc_scsi_prep_task_mgmt_cmd(struct lpfc_hba *phba,
 static int
 lpfc_scsi_tgt_reset(struct lpfc_scsi_buf * lpfc_cmd, struct lpfc_hba * phba,
-                    unsigned  tgt_id, struct lpfc_rport_data *rdata)
+                    unsigned  tgt_id, unsigned int lun,
+                    struct lpfc_rport_data *rdata)
 {
        struct lpfc_iocbq *iocbq;
        struct lpfc_iocbq *iocbqrsp;
        int ret;
        lpfc_cmd->rdata = rdata;
-        ret = lpfc_scsi_prep_task_mgmt_cmd(phba, lpfc_cmd, FCP_TARGET_RESET);
+        ret = lpfc_scsi_prep_task_mgmt_cmd(phba, lpfc_cmd, lun,
+                                           FCP_TARGET_RESET);
        if (!ret)
                return FAILED;
@@ -822,6 +831,7 @@ lpfc_queuecommand(struct scsi_cmnd *cmnd, void (*done) (struct scsi_cmnd *))
        return 0;
 out_host_busy_free_buf:
+        lpfc_scsi_unprep_dma_buf(phba, lpfc_cmd);
        lpfc_release_scsi_buf(phba, lpfc_cmd);
 out_host_busy:
        return SCSI_MLQUEUE_HOST_BUSY;
@@ -969,12 +979,12 @@ lpfc_reset_lun_handler(struct scsi_cmnd *cmnd)
        if (lpfc_cmd == NULL)
                goto out;
-        lpfc_cmd->pCmd = cmnd;
        lpfc_cmd->timeout = 60;
        lpfc_cmd->scsi_hba = phba;
        lpfc_cmd->rdata = rdata;
-        ret = lpfc_scsi_prep_task_mgmt_cmd(phba, lpfc_cmd, FCP_LUN_RESET);
+        ret = lpfc_scsi_prep_task_mgmt_cmd(phba, lpfc_cmd, cmnd->device->lun,
+                                           FCP_LUN_RESET);
        if (!ret)
                goto out_free_scsi_buf;
@@ -1001,7 +1011,6 @@ lpfc_reset_lun_handler(struct scsi_cmnd *cmnd)
        cmd_status = iocbqrsp->iocb.ulpStatus;
        lpfc_sli_release_iocbq(phba, iocbqrsp);
-        lpfc_release_scsi_buf(phba, lpfc_cmd);
        /*
         * All outstanding txcmplq I/Os should have been aborted by the device.
@@ -1040,6 +1049,8 @@ lpfc_reset_lun_handler(struct scsi_cmnd *cmnd)
        }
 out_free_scsi_buf:
+        lpfc_release_scsi_buf(phba, lpfc_cmd);
        lpfc_printf_log(phba, KERN_ERR, LOG_FCP,
                        "%d:0713 SCSI layer issued LUN reset (%d, %d) "
                        "Data: x%x x%x x%x\n",
@@ -1070,7 +1081,6 @@ lpfc_reset_bus_handler(struct scsi_cmnd *cmnd)
        /* The lpfc_cmd storage is reused.  Set all loop invariants. */
        lpfc_cmd->timeout = 60;
-        lpfc_cmd->pCmd = cmnd;
        lpfc_cmd->scsi_hba = phba;
        /*
@@ -1078,7 +1088,7 @@ lpfc_reset_bus_handler(struct scsi_cmnd *cmnd)
         * targets known to the driver.  Should any target reset
         * fail, this routine returns failure to the midlayer.
         */
-        for (i = 0; i < MAX_FCP_TARGET; i++) {
+        for (i = 0; i < LPFC_MAX_TARGET; i++) {
                /* Search the mapped list for this target ID */
                match = 0;
                list_for_each_entry(ndlp, &phba->fc_nlpmap_list, nlp_listp) {
@@ -1090,8 +1100,8 @@ lpfc_reset_bus_handler(struct scsi_cmnd *cmnd)
                if (!match)
                        continue;
-                ret = lpfc_scsi_tgt_reset(lpfc_cmd, phba,
+                ret = lpfc_scsi_tgt_reset(lpfc_cmd, phba, i, cmnd->device->lun,
-                                          i, ndlp->rport->dd_data);
+                                          ndlp->rport->dd_data);
                if (ret != SUCCESS) {
                        lpfc_printf_log(phba, KERN_ERR, LOG_FCP,
                                "%d:0713 Bus Reset on target %d failed\n",
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index bb69a7a1ec59..350a625fa224 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -191,35 +191,12 @@ static int
 lpfc_sli_ringtxcmpl_put(struct lpfc_hba * phba,
                        struct lpfc_sli_ring * pring, struct lpfc_iocbq * piocb)
 {
-        uint16_t iotag;
        list_add_tail(&piocb->list, &pring->txcmplq);
        pring->txcmplq_cnt++;
        if (unlikely(pring->ringno == LPFC_ELS_RING))
                mod_timer(&phba->els_tmofunc,
                                        jiffies + HZ * (phba->fc_ratov << 1));
-        if (pring->fast_lookup) {
-                /* Setup fast lookup based on iotag for completion */
-                iotag = piocb->iocb.ulpIoTag;
-                if (iotag && (iotag < pring->fast_iotag))
-                        *(pring->fast_lookup + iotag) = piocb;
-                else {
-                        /* Cmd ring <ringno> put: iotag <iotag> greater then
-                           configured max <fast_iotag> wd0 <icmd> */
-                        lpfc_printf_log(phba,
-                                        KERN_ERR,
-                                        LOG_SLI,
-                                        "%d:0316 Cmd ring %d put: iotag x%x "
-                                        "greater then configured max x%x "
-                                        "wd0 x%x\n",
-                                        phba->brd_no,
-                                        pring->ringno, iotag,
-                                        pring->fast_iotag,
-                                        *(((uint32_t *)(&piocb->iocb)) + 7));
-                }
-        }
        return (0);
 }
@@ -601,7 +578,7 @@ lpfc_sli_handle_mb_event(struct lpfc_hba * phba)
                        /* Stray Mailbox Interrupt, mbxCommand <cmd> mbxStatus
                           <status> */
                        lpfc_printf_log(phba,
-                                        KERN_ERR,
+                                        KERN_WARNING,
                                        LOG_MBOX | LOG_SLI,
                                        "%d:0304 Stray Mailbox Interrupt "
                                        "mbxCommand x%x mbxStatus x%x\n",
@@ -1570,8 +1547,8 @@ lpfc_sli_brdready(struct lpfc_hba * phba, uint32_t mask)
 void lpfc_reset_barrier(struct lpfc_hba * phba)
 {
-        uint32_t * resp_buf;
+        uint32_t __iomem *resp_buf;
-        uint32_t * mbox_buf;
+        uint32_t __iomem *mbox_buf;
        volatile uint32_t mbox;
        uint32_t hc_copy;
        int  i;
@@ -1587,7 +1564,7 @@ void lpfc_reset_barrier(struct lpfc_hba * phba)
         * Tell the other part of the chip to suspend temporarily all
         * its DMA activity.
         */
-        resp_buf =  (uint32_t *)phba->MBslimaddr;
+        resp_buf = phba->MBslimaddr;
        /* Disable the error attention */
        hc_copy = readl(phba->HCregaddr);
@@ -1605,7 +1582,7 @@ void lpfc_reset_barrier(struct lpfc_hba * phba)
        ((MAILBOX_t *)&mbox)->mbxOwner = OWN_CHIP;
        writel(BARRIER_TEST_PATTERN, (resp_buf + 1));
-        mbox_buf = (uint32_t *)phba->MBslimaddr;
+        mbox_buf = phba->MBslimaddr;
        writel(mbox, mbox_buf);
        for (i = 0;
@@ -1805,7 +1782,7 @@ lpfc_sli_brdrestart(struct lpfc_hba * phba)
                skip_post = 0;
                word0 = 0;      /* This is really setting up word1 */
        }
-        to_slim = (uint8_t *) phba->MBslimaddr + sizeof (uint32_t);
+        to_slim = phba->MBslimaddr + sizeof (uint32_t);
        writel(*(uint32_t *) mb, to_slim);
        readl(to_slim); /* flush */
@@ -2659,8 +2636,6 @@ lpfc_sli_hba_down(struct lpfc_hba * phba)
                INIT_LIST_HEAD(&(pring->txq));
-                kfree(pring->fast_lookup);
-                pring->fast_lookup = NULL;
        }
        spin_unlock_irqrestore(phba->host->host_lock, flags);
@@ -3110,6 +3085,24 @@ lpfc_sli_issue_mbox_wait(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmboxq,
        return retval;
 }
+int
+lpfc_sli_flush_mbox_queue(struct lpfc_hba * phba)
+{
+        int i = 0;
+        while (phba->sli.sli_flag & LPFC_SLI_MBOX_ACTIVE && !phba->stopped) {
+                if (i++ > LPFC_MBOX_TMO * 1000)
+                        return 1;
+                if (lpfc_sli_handle_mb_event(phba) == 0)
+                        i = 0;
+                msleep(1);
+        }
+        return (phba->sli.sli_flag & LPFC_SLI_MBOX_ACTIVE) ? 1 : 0;
+}
 irqreturn_t
 lpfc_intr_handler(int irq, void *dev_id, struct pt_regs * regs)
 {
diff --git a/drivers/scsi/lpfc/lpfc_sli.h b/drivers/scsi/lpfc/lpfc_sli.h
index a52d6c6cf083..d8ef0d2894d4 100644
--- a/drivers/scsi/lpfc/lpfc_sli.h
+++ b/drivers/scsi/lpfc/lpfc_sli.h
@@ -135,8 +135,6 @@ struct lpfc_sli_ring {
        uint32_t fast_iotag;    /* max fastlookup based iotag           */
        uint32_t iotag_ctr;     /* keeps track of the next iotag to use */
        uint32_t iotag_max;     /* max iotag value to use               */
-        struct lpfc_iocbq ** fast_lookup; /* array of IOCB ptrs indexed by
-                                           iotag */
        struct list_head txq;
        uint16_t txq_cnt;       /* current length of queue */
        uint16_t txq_max;       /* max length */
diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h
index 6b737568b831..10e89c6ae823 100644
--- a/drivers/scsi/lpfc/lpfc_version.h
+++ b/drivers/scsi/lpfc/lpfc_version.h
@@ -18,7 +18,7 @@
 * included with this package.                                     *
 *******************************************************************/
-#define LPFC_DRIVER_VERSION "8.1.6"
+#define LPFC_DRIVER_VERSION "8.1.7"
 #define LPFC_DRIVER_NAME "lpfc"
diff --git a/drivers/scsi/mac53c94.c b/drivers/scsi/mac53c94.c
index 93edaa8696cf..89ef34df5a1d 100644
--- a/drivers/scsi/mac53c94.c
+++ b/drivers/scsi/mac53c94.c
@@ -378,7 +378,7 @@ static void set_dma_cmds(struct fsc_state *state, struct scsi_cmnd *cmd)
                int nseg;
                total = 0;
-                scl = (struct scatterlist *) cmd->buffer;
+                scl = (struct scatterlist *) cmd->request_buffer;
                nseg = pci_map_sg(state->pdev, scl, cmd->use_sg,
                                cmd->sc_data_direction);
                for (i = 0; i < nseg; ++i) {
diff --git a/drivers/scsi/mesh.c b/drivers/scsi/mesh.c
index c88717727be8..5572981a9f92 100644
--- a/drivers/scsi/mesh.c
+++ b/drivers/scsi/mesh.c
@@ -1268,7 +1268,7 @@ static void set_dma_cmds(struct mesh_state *ms, struct scsi_cmnd *cmd)
                if (cmd->use_sg > 0) {
                        int nseg;
                        total = 0;
-                        scl = (struct scatterlist *) cmd->buffer;
+                        scl = (struct scatterlist *) cmd->request_buffer;
                        off = ms->data_ptr;
                        nseg = pci_map_sg(ms->pdev, scl, cmd->use_sg,
                                          cmd->sc_data_direction);
diff --git a/drivers/scsi/pluto.c b/drivers/scsi/pluto.c
index 7abf64d1bfc9..0bd9c60e6455 100644
--- a/drivers/scsi/pluto.c
+++ b/drivers/scsi/pluto.c
@@ -169,8 +169,6 @@ int __init pluto_detect(struct scsi_host_template *tpnt)
                SCpnt->request->rq_status = RQ_SCSI_BUSY;
                
                SCpnt->done = pluto_detect_done;
-                SCpnt->bufflen = 256;
-                SCpnt->buffer = fcs[i].inquiry;
                SCpnt->request_bufflen = 256;
                SCpnt->request_buffer = fcs[i].inquiry;
                PLD(("set up %d %08lx\n", i, (long)SCpnt))
diff --git a/drivers/scsi/qlogicpti.c b/drivers/scsi/qlogicpti.c
index 69e0551a81d2..5b2f0741a55b 100644
--- a/drivers/scsi/qlogicpti.c
+++ b/drivers/scsi/qlogicpti.c
@@ -874,7 +874,7 @@ static inline int load_cmd(struct scsi_cmnd *Cmnd, struct Command_Entry *cmd,
        if (Cmnd->use_sg) {
                int sg_count;
-                sg = (struct scatterlist *) Cmnd->buffer;
+                sg = (struct scatterlist *) Cmnd->request_buffer;
                sg_count = sbus_map_sg(qpti->sdev, sg, Cmnd->use_sg, Cmnd->sc_data_direction);
                ds = cmd->dataseg;
@@ -1278,7 +1278,7 @@ static struct scsi_cmnd *qlogicpti_intr_handler(struct qlogicpti *qpti)
                if (Cmnd->use_sg) {
                        sbus_unmap_sg(qpti->sdev,
-                                      (struct scatterlist *)Cmnd->buffer,
+                                      (struct scatterlist *)Cmnd->request_buffer,
                                      Cmnd->use_sg,
                                      Cmnd->sc_data_direction);
                } else {
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 2ab7df0dcfe8..b332caddd5b3 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -346,7 +346,7 @@ void scsi_log_send(struct scsi_cmnd *cmd)
                        if (level > 3) {
                                printk(KERN_INFO "buffer = 0x%p, bufflen = %d,"
                                       " done = 0x%p, queuecommand 0x%p\n",
-                                        cmd->buffer, cmd->bufflen,
+                                        cmd->request_buffer, cmd->request_bufflen,
                                        cmd->done,
                                        sdev->host->hostt->queuecommand);
@@ -661,11 +661,6 @@ void __scsi_done(struct scsi_cmnd *cmd)
 */
 int scsi_retry_command(struct scsi_cmnd *cmd)
 {
-        /*
-         * Restore the SCSI command state.
-         */
-        scsi_setup_cmd_retry(cmd);
        /*
         * Zero the sense information from the last time we tried
         * this command.
@@ -711,10 +706,6 @@ void scsi_finish_command(struct scsi_cmnd *cmd)
                                "Notifying upper driver of completion "
                                "(result %x)\n", cmd->result));
-        /*
-         * We can get here with use_sg=0, causing a panic in the upper level
-         */
-        cmd->use_sg = cmd->old_use_sg;
        cmd->done(cmd);
 }
 EXPORT_SYMBOL(scsi_finish_command);
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 9c63b00773c4..a80303c6b3fd 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -286,7 +286,7 @@ static int inquiry_evpd_83(unsigned char * arr, int target_dev_id,
                           int dev_id_num, const char * dev_id_str,
                           int dev_id_str_len);
 static int inquiry_evpd_88(unsigned char * arr, int target_dev_id);
-static void do_create_driverfs_files(void);
+static int do_create_driverfs_files(void);
 static void do_remove_driverfs_files(void);
 static int sdebug_add_adapter(void);
@@ -2487,19 +2487,22 @@ static ssize_t sdebug_add_host_store(struct device_driver * ddp,
 DRIVER_ATTR(add_host, S_IRUGO | S_IWUSR, sdebug_add_host_show, 
            sdebug_add_host_store);
-static void do_create_driverfs_files(void)
+static int do_create_driverfs_files(void)
 {
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_add_host);
+        int ret;
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_delay);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_dev_size_mb);
+        ret = driver_create_file(&sdebug_driverfs_driver, &driver_attr_add_host);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_dsense);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_delay);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_every_nth);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_dev_size_mb);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_max_luns);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_dsense);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_num_tgts);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_every_nth);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_num_parts);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_max_luns);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_ptype);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_num_tgts);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_opts);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_num_parts);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_scsi_level);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_ptype);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_opts);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_scsi_level);
+        return ret;
 }
 static void do_remove_driverfs_files(void)
@@ -2522,6 +2525,7 @@ static int __init scsi_debug_init(void)
        unsigned int sz;
        int host_to_add;
        int k;
+        int ret;
        if (scsi_debug_dev_size_mb < 1)
                scsi_debug_dev_size_mb = 1;  /* force minimum 1 MB ramdisk */
@@ -2560,12 +2564,32 @@ static int __init scsi_debug_init(void)
        if (scsi_debug_num_parts > 0)
                sdebug_build_parts(fake_storep);
-        init_all_queued();
+        ret = device_register(&pseudo_primary);
+        if (ret < 0) {
+                printk(KERN_WARNING "scsi_debug: device_register error: %d\n",
+                        ret);
+                goto free_vm;
+        }
+        ret = bus_register(&pseudo_lld_bus);
+        if (ret < 0) {
+                printk(KERN_WARNING "scsi_debug: bus_register error: %d\n",
+                        ret);
+                goto dev_unreg;
+        }
+        ret = driver_register(&sdebug_driverfs_driver);
+        if (ret < 0) {
+                printk(KERN_WARNING "scsi_debug: driver_register error: %d\n",
+                        ret);
+                goto bus_unreg;
+        }
+        ret = do_create_driverfs_files();
+        if (ret < 0) {
+                printk(KERN_WARNING "scsi_debug: driver_create_file error: %d\n",
+                        ret);
+                goto del_files;
+        }
-        device_register(&pseudo_primary);
+        init_all_queued();
-        bus_register(&pseudo_lld_bus);
-        driver_register(&sdebug_driverfs_driver);
-        do_create_driverfs_files();
        sdebug_driver_template.proc_name = (char *)sdebug_proc_name;
@@ -2585,6 +2609,18 @@ static int __init scsi_debug_init(void)
                       scsi_debug_add_host);
        }
        return 0;
+del_files:
+        do_remove_driverfs_files();
+        driver_unregister(&sdebug_driverfs_driver);
+bus_unreg:
+        bus_unregister(&pseudo_lld_bus);
+dev_unreg:
+        device_unregister(&pseudo_primary);
+free_vm:
+        vfree(fake_storep);
+        return ret;
 }
 static void __exit scsi_debug_exit(void)
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 6683d596234a..6a5b731bd5ba 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -460,19 +460,67 @@ static void scsi_eh_done(struct scsi_cmnd *scmd)
 * Return value:
 *    SUCCESS or FAILED or NEEDS_RETRY
 **/
-static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, int timeout)
+static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, int timeout, int copy_sense)
 {
        struct scsi_device *sdev = scmd->device;
        struct Scsi_Host *shost = sdev->host;
+        int old_result = scmd->result;
        DECLARE_COMPLETION(done);
        unsigned long timeleft;
        unsigned long flags;
+        unsigned char old_cmnd[MAX_COMMAND_SIZE];
+        enum dma_data_direction old_data_direction;
+        unsigned short old_use_sg;
+        unsigned char old_cmd_len;
+        unsigned old_bufflen;
+        void *old_buffer;
        int rtn;
+        /*
+         * We need saved copies of a number of fields - this is because
+         * error handling may need to overwrite these with different values
+         * to run different commands, and once error handling is complete,
+         * we will need to restore these values prior to running the actual
+         * command.
+         */
+        old_buffer = scmd->request_buffer;
+        old_bufflen = scmd->request_bufflen;
+        memcpy(old_cmnd, scmd->cmnd, sizeof(scmd->cmnd));
+        old_data_direction = scmd->sc_data_direction;
+        old_cmd_len = scmd->cmd_len;
+        old_use_sg = scmd->use_sg;
+        if (copy_sense) {
+                int gfp_mask = GFP_ATOMIC;
+                if (shost->hostt->unchecked_isa_dma)
+                        gfp_mask |= __GFP_DMA;
+                scmd->sc_data_direction = DMA_FROM_DEVICE;
+                scmd->request_bufflen = 252;
+                scmd->request_buffer = kzalloc(scmd->request_bufflen, gfp_mask);
+                if (!scmd->request_buffer)
+                        return FAILED;
+        } else {
+                scmd->request_buffer = NULL;
+                scmd->request_bufflen = 0;
+                scmd->sc_data_direction = DMA_NONE;
+        }
+        scmd->underflow = 0;
+        scmd->use_sg = 0;
+        scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
        if (sdev->scsi_level <= SCSI_2)
                scmd->cmnd[1] = (scmd->cmnd[1] & 0x1f) |
                        (sdev->lun << 5 & 0xe0);
+        /*
+         * Zero the sense buffer.  The scsi spec mandates that any
+         * untransferred sense data should be interpreted as being zero.
+         */
+        memset(scmd->sense_buffer, 0, sizeof(scmd->sense_buffer));
        shost->eh_action = &done;
        spin_lock_irqsave(shost->host_lock, flags);
@@ -522,6 +570,29 @@ static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, int timeout)
                rtn = FAILED;
        }
+        /*
+         * Last chance to have valid sense data.
+         */
+        if (copy_sense) {
+                if (!SCSI_SENSE_VALID(scmd)) {
+                        memcpy(scmd->sense_buffer, scmd->request_buffer,
+                               sizeof(scmd->sense_buffer));
+                }
+                kfree(scmd->request_buffer);
+        }
+        /*
+         * Restore original data
+         */
+        scmd->request_buffer = old_buffer;
+        scmd->request_bufflen = old_bufflen;
+        memcpy(scmd->cmnd, old_cmnd, sizeof(scmd->cmnd));
+        scmd->sc_data_direction = old_data_direction;
+        scmd->cmd_len = old_cmd_len;
+        scmd->use_sg = old_use_sg;
+        scmd->result = old_result;
        return rtn;
 }
@@ -537,56 +608,10 @@ static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, int timeout)
 static int scsi_request_sense(struct scsi_cmnd *scmd)
 {
        static unsigned char generic_sense[6] =
-        {REQUEST_SENSE, 0, 0, 0, 252, 0};
+                {REQUEST_SENSE, 0, 0, 0, 252, 0};
-        unsigned char *scsi_result;
-        int saved_result;
-        int rtn;
        memcpy(scmd->cmnd, generic_sense, sizeof(generic_sense));
+        return scsi_send_eh_cmnd(scmd, SENSE_TIMEOUT, 1);
-        scsi_result = kmalloc(252, GFP_ATOMIC | ((scmd->device->host->hostt->unchecked_isa_dma) ? __GFP_DMA : 0));
-        if (unlikely(!scsi_result)) {
-                printk(KERN_ERR "%s: cannot allocate scsi_result.\n",
-                       __FUNCTION__);
-                return FAILED;
-        }
-        /*
-         * zero the sense buffer.  some host adapters automatically always
-         * request sense, so it is not a good idea that
-         * scmd->request_buffer and scmd->sense_buffer point to the same
-         * address (db).  0 is not a valid sense code. 
-         */
-        memset(scmd->sense_buffer, 0, sizeof(scmd->sense_buffer));
-        memset(scsi_result, 0, 252);
-        saved_result = scmd->result;
-        scmd->request_buffer = scsi_result;
-        scmd->request_bufflen = 252;
-        scmd->use_sg = 0;
-        scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
-        scmd->sc_data_direction = DMA_FROM_DEVICE;
-        scmd->underflow = 0;
-        rtn = scsi_send_eh_cmnd(scmd, SENSE_TIMEOUT);
-        /* last chance to have valid sense data */
-        if(!SCSI_SENSE_VALID(scmd)) {
-                memcpy(scmd->sense_buffer, scmd->request_buffer,
-                       sizeof(scmd->sense_buffer));
-        }
-        kfree(scsi_result);
-        /*
-         * when we eventually call scsi_finish, we really wish to complete
-         * the original request, so let's restore the original data. (db)
-         */
-        scsi_setup_cmd_retry(scmd);
-        scmd->result = saved_result;
-        return rtn;
 }
 /**
@@ -605,12 +630,6 @@ void scsi_eh_finish_cmd(struct scsi_cmnd *scmd, struct list_head *done_q)
 {
        scmd->device->host->host_failed--;
        scmd->eh_eflags = 0;
-        /*
-         * set this back so that the upper level can correctly free up
-         * things.
-         */
-        scsi_setup_cmd_retry(scmd);
        list_move_tail(&scmd->eh_entry, done_q);
 }
 EXPORT_SYMBOL(scsi_eh_finish_cmd);
@@ -715,47 +734,26 @@ static int scsi_eh_tur(struct scsi_cmnd *scmd)
 {
        static unsigned char tur_command[6] = {TEST_UNIT_READY, 0, 0, 0, 0, 0};
        int retry_cnt = 1, rtn;
-        int saved_result;
 retry_tur:
        memcpy(scmd->cmnd, tur_command, sizeof(tur_command));
-        /*
-         * zero the sense buffer.  the scsi spec mandates that any
-         * untransferred sense data should be interpreted as being zero.
-         */
-        memset(scmd->sense_buffer, 0, sizeof(scmd->sense_buffer));
-        saved_result = scmd->result;
-        scmd->request_buffer = NULL;
-        scmd->request_bufflen = 0;
-        scmd->use_sg = 0;
-        scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
-        scmd->underflow = 0;
-        scmd->sc_data_direction = DMA_NONE;
-        rtn = scsi_send_eh_cmnd(scmd, SENSE_TIMEOUT);
+        rtn = scsi_send_eh_cmnd(scmd, SENSE_TIMEOUT, 0);
-        /*
-         * when we eventually call scsi_finish, we really wish to complete
-         * the original request, so let's restore the original data. (db)
-         */
-        scsi_setup_cmd_retry(scmd);
-        scmd->result = saved_result;
-        /*
-         * hey, we are done.  let's look to see what happened.
-         */
        SCSI_LOG_ERROR_RECOVERY(3, printk("%s: scmd %p rtn %x\n",
                __FUNCTION__, scmd, rtn));
-        if (rtn == SUCCESS)
-                return 0;
+        switch (rtn) {
-        else if (rtn == NEEDS_RETRY) {
+        case NEEDS_RETRY:
                if (retry_cnt--)
                        goto retry_tur;
+                /*FALLTHRU*/
+        case SUCCESS:
                return 0;
+        default:
+                return 1;
        }
-        return 1;
 }
 /**
@@ -837,44 +835,16 @@ static int scsi_try_bus_device_reset(struct scsi_cmnd *scmd)
 static int scsi_eh_try_stu(struct scsi_cmnd *scmd)
 {
        static unsigned char stu_command[6] = {START_STOP, 0, 0, 0, 1, 0};
-        int rtn;
-        int saved_result;
-        if (!scmd->device->allow_restart)
+        if (scmd->device->allow_restart) {
-                return 1;
+                int rtn;
-        memcpy(scmd->cmnd, stu_command, sizeof(stu_command));
-        /*
-         * zero the sense buffer.  the scsi spec mandates that any
-         * untransferred sense data should be interpreted as being zero.
-         */
-        memset(scmd->sense_buffer, 0, sizeof(scmd->sense_buffer));
-        saved_result = scmd->result;
-        scmd->request_buffer = NULL;
-        scmd->request_bufflen = 0;
-        scmd->use_sg = 0;
-        scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
-        scmd->underflow = 0;
-        scmd->sc_data_direction = DMA_NONE;
-        rtn = scsi_send_eh_cmnd(scmd, START_UNIT_TIMEOUT);
+                memcpy(scmd->cmnd, stu_command, sizeof(stu_command));
+                rtn = scsi_send_eh_cmnd(scmd, START_UNIT_TIMEOUT, 0);
-        /*
+                if (rtn == SUCCESS)
-         * when we eventually call scsi_finish, we really wish to complete
+                        return 0;
-         * the original request, so let's restore the original data. (db)
+        }
-         */
-        scsi_setup_cmd_retry(scmd);
-        scmd->result = saved_result;
-        /*
-         * hey, we are done.  let's look to see what happened.
-         */
-        SCSI_LOG_ERROR_RECOVERY(3, printk("%s: scmd %p rtn %x\n",
-                __FUNCTION__, scmd, rtn));
-        if (rtn == SUCCESS)
-                return 0;
        return 1;
 }
@@ -1684,8 +1654,6 @@ scsi_reset_provider(struct scsi_device *dev, int flag)
    
        scmd->scsi_done         = scsi_reset_provider_done_command;
        scmd->done                      = NULL;
-        scmd->buffer                    = NULL;
-        scmd->bufflen                   = 0;
        scmd->request_buffer            = NULL;
        scmd->request_bufflen           = 0;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 08af9aae7df3..077c1c691210 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -436,60 +436,16 @@ EXPORT_SYMBOL_GPL(scsi_execute_async);
 *
 * Arguments:   cmd     - command that is ready to be queued.
 *
- * Returns:     Nothing
- *
 * Notes:       This function has the job of initializing a number of
 *              fields related to error handling.   Typically this will
 *              be called once for each command, as required.
 */
-static int scsi_init_cmd_errh(struct scsi_cmnd *cmd)
+static void scsi_init_cmd_errh(struct scsi_cmnd *cmd)
 {
        cmd->serial_number = 0;
        memset(cmd->sense_buffer, 0, sizeof cmd->sense_buffer);
        if (cmd->cmd_len == 0)
                cmd->cmd_len = COMMAND_SIZE(cmd->cmnd[0]);
-        /*
-         * We need saved copies of a number of fields - this is because
-         * error handling may need to overwrite these with different values
-         * to run different commands, and once error handling is complete,
-         * we will need to restore these values prior to running the actual
-         * command.
-         */
-        cmd->old_use_sg = cmd->use_sg;
-        cmd->old_cmd_len = cmd->cmd_len;
-        cmd->sc_old_data_direction = cmd->sc_data_direction;
-        cmd->old_underflow = cmd->underflow;
-        memcpy(cmd->data_cmnd, cmd->cmnd, sizeof(cmd->cmnd));
-        cmd->buffer = cmd->request_buffer;
-        cmd->bufflen = cmd->request_bufflen;
-        return 1;
-}
-/*
- * Function:   scsi_setup_cmd_retry()
- *
- * Purpose:    Restore the command state for a retry
- *
- * Arguments:  cmd      - command to be restored
- *
- * Returns:    Nothing
- *
- * Notes:      Immediately prior to retrying a command, we need
- *             to restore certain fields that we saved above.
- */
-void scsi_setup_cmd_retry(struct scsi_cmnd *cmd)
-{
-        memcpy(cmd->cmnd, cmd->data_cmnd, sizeof(cmd->data_cmnd));
-        cmd->request_buffer = cmd->buffer;
-        cmd->request_bufflen = cmd->bufflen;
-        cmd->use_sg = cmd->old_use_sg;
-        cmd->cmd_len = cmd->old_cmd_len;
-        cmd->sc_data_direction = cmd->sc_old_data_direction;
-        cmd->underflow = cmd->old_underflow;
 }
 void scsi_device_unbusy(struct scsi_device *sdev)
@@ -807,22 +763,13 @@ static void scsi_free_sgtable(struct scatterlist *sgl, int index)
 */
 static void scsi_release_buffers(struct scsi_cmnd *cmd)
 {
-        struct request *req = cmd->request;
-        /*
-         * Free up any indirection buffers we allocated for DMA purposes. 
-         */
        if (cmd->use_sg)
                scsi_free_sgtable(cmd->request_buffer, cmd->sglist_len);
-        else if (cmd->request_buffer != req->buffer)
-                kfree(cmd->request_buffer);
        /*
         * Zero these out.  They now point to freed memory, and it is
         * dangerous to hang onto the pointers.
         */
-        cmd->buffer  = NULL;
-        cmd->bufflen = 0;
        cmd->request_buffer = NULL;
        cmd->request_bufflen = 0;
 }
@@ -858,7 +805,7 @@ static void scsi_release_buffers(struct scsi_cmnd *cmd)
 void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
 {
        int result = cmd->result;
-        int this_count = cmd->bufflen;
+        int this_count = cmd->request_bufflen;
        request_queue_t *q = cmd->device->request_queue;
        struct request *req = cmd->request;
        int clear_errors = 1;
@@ -866,28 +813,14 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
        int sense_valid = 0;
        int sense_deferred = 0;
-        /*
+        scsi_release_buffers(cmd);
-         * Free up any indirection buffers we allocated for DMA purposes. 
-         * For the case of a READ, we need to copy the data out of the
-         * bounce buffer and into the real buffer.
-         */
-        if (cmd->use_sg)
-                scsi_free_sgtable(cmd->buffer, cmd->sglist_len);
-        else if (cmd->buffer != req->buffer) {
-                if (rq_data_dir(req) == READ) {
-                        unsigned long flags;
-                        char *to = bio_kmap_irq(req->bio, &flags);
-                        memcpy(to, cmd->buffer, cmd->bufflen);
-                        bio_kunmap_irq(to, &flags);
-                }
-                kfree(cmd->buffer);
-        }
        if (result) {
                sense_valid = scsi_command_normalize_sense(cmd, &sshdr);
                if (sense_valid)
                        sense_deferred = scsi_sense_is_deferred(&sshdr);
        }
        if (blk_pc_request(req)) { /* SG_IO ioctl from block level */
                req->errors = result;
                if (result) {
@@ -908,15 +841,6 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
        }
        /*
-         * Zero these out.  They now point to freed memory, and it is
-         * dangerous to hang onto the pointers.
-         */
-        cmd->buffer  = NULL;
-        cmd->bufflen = 0;
-        cmd->request_buffer = NULL;
-        cmd->request_bufflen = 0;
-        /*
         * Next deal with any sectors which we were able to correctly
         * handle.
         */
@@ -1012,7 +936,7 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
                        if (!(req->flags & REQ_QUIET)) {
                                scmd_printk(KERN_INFO, cmd,
                                            "Volume overflow, CDB: ");
-                                __scsi_print_command(cmd->data_cmnd);
+                                __scsi_print_command(cmd->cmnd);
                                scsi_print_sense("", cmd);
                        }
                        /* See SSC3rXX or current. */
@@ -1143,7 +1067,7 @@ static void scsi_blk_pc_done(struct scsi_cmnd *cmd)
         * successfully. Since this is a REQ_BLOCK_PC command the
         * caller should check the request's errors value
         */
-        scsi_io_completion(cmd, cmd->bufflen);
+        scsi_io_completion(cmd, cmd->request_bufflen);
 }
 static void scsi_setup_blk_pc_cmnd(struct scsi_cmnd *cmd)
diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h
index e2fbe9a9d5a9..ae24c85aaeea 100644
--- a/drivers/scsi/scsi_priv.h
+++ b/drivers/scsi/scsi_priv.h
@@ -57,7 +57,6 @@ extern int scsi_eh_scmd_add(struct scsi_cmnd *, int);
 /* scsi_lib.c */
 extern int scsi_maybe_unblock_host(struct scsi_device *sdev);
-extern void scsi_setup_cmd_retry(struct scsi_cmnd *cmd);
 extern void scsi_device_unbusy(struct scsi_device *sdev);
 extern int scsi_queue_insert(struct scsi_cmnd *cmd, int reason);
 extern void scsi_next_command(struct scsi_cmnd *cmd);
diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index dd075627e605..5a625c3fddae 100644
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -41,6 +41,7 @@ struct sas_host_attrs {
        struct mutex lock;
        u32 next_target_id;
        u32 next_expander_id;
+        int next_port_id;
 };
 #define to_sas_host_attrs(host) ((struct sas_host_attrs *)(host)->shost_data)
@@ -146,6 +147,7 @@ static int sas_host_setup(struct transport_container *tc, struct device *dev,
        mutex_init(&sas_host->lock);
        sas_host->next_target_id = 0;
        sas_host->next_expander_id = 0;
+        sas_host->next_port_id = 0;
        return 0;
 }
@@ -327,7 +329,7 @@ sas_phy_protocol_attr(identify.target_port_protocols,
 sas_phy_simple_attr(identify.sas_address, sas_address, "0x%016llx\n",
                unsigned long long);
 sas_phy_simple_attr(identify.phy_identifier, phy_identifier, "%d\n", u8);
-//sas_phy_simple_attr(port_identifier, port_identifier, "%d\n", u8);
+//sas_phy_simple_attr(port_identifier, port_identifier, "%d\n", int);
 sas_phy_linkspeed_attr(negotiated_linkrate);
 sas_phy_linkspeed_attr(minimum_linkrate_hw);
 sas_phy_linkspeed_attr(minimum_linkrate);
@@ -590,6 +592,38 @@ struct sas_port *sas_port_alloc(struct device *parent, int port_id)
 }
 EXPORT_SYMBOL(sas_port_alloc);
+/** sas_port_alloc_num - allocate and initialize a SAS port structure
+ *
+ * @parent:     parent device
+ *
+ * Allocates a SAS port structure and a number to go with it.  This
+ * interface is really for adapters where the port number has no
+ * meansing, so the sas class should manage them.  It will be added to
+ * the device tree below the device specified by @parent which must be
+ * either a Scsi_Host or a sas_expander_device.
+ *
+ * Returns %NULL on error
+ */
+struct sas_port *sas_port_alloc_num(struct device *parent)
+{
+        int index;
+        struct Scsi_Host *shost = dev_to_shost(parent);
+        struct sas_host_attrs *sas_host = to_sas_host_attrs(shost);
+        /* FIXME: use idr for this eventually */
+        mutex_lock(&sas_host->lock);
+        if (scsi_is_sas_expander_device(parent)) {
+                struct sas_rphy *rphy = dev_to_rphy(parent);
+                struct sas_expander_device *exp = rphy_to_expander_device(rphy);
+                index = exp->next_port_id++;
+        } else
+                index = sas_host->next_port_id++;
+        mutex_unlock(&sas_host->lock);
+        return sas_port_alloc(parent, index);
+}
+EXPORT_SYMBOL(sas_port_alloc_num);
 /**
 * sas_port_add - add a SAS port to the device hierarchy
 *
@@ -658,6 +692,13 @@ void sas_port_delete(struct sas_port *port)
        }
        mutex_unlock(&port->phy_list_mutex);
+        if (port->is_backlink) {
+                struct device *parent = port->dev.parent;
+                sysfs_remove_link(&port->dev.kobj, parent->bus_id);
+                port->is_backlink = 0;
+        }
        transport_remove_device(dev);
        device_del(dev);
        transport_destroy_device(dev);
@@ -733,6 +774,19 @@ void sas_port_delete_phy(struct sas_port *port, struct sas_phy *phy)
 }
 EXPORT_SYMBOL(sas_port_delete_phy);
+void sas_port_mark_backlink(struct sas_port *port)
+{
+        struct device *parent = port->dev.parent->parent->parent;
+        if (port->is_backlink)
+                return;
+        port->is_backlink = 1;
+        sysfs_create_link(&port->dev.kobj, &parent->kobj,
+                          parent->bus_id);
+}
+EXPORT_SYMBOL(sas_port_mark_backlink);
 /*
 * SAS remote PHY attributes.
 */
@@ -1140,7 +1194,7 @@ int sas_rphy_add(struct sas_rphy *rphy)
        if (identify->device_type == SAS_END_DEVICE &&
            rphy->scsi_target_id != -1) {
-                scsi_scan_target(&rphy->dev, parent->port_identifier,
+                scsi_scan_target(&rphy->dev, 0,
                                rphy->scsi_target_id, ~0, 0);
        }
@@ -1242,15 +1296,13 @@ static int sas_user_scan(struct Scsi_Host *shost, uint channel,
        mutex_lock(&sas_host->lock);
        list_for_each_entry(rphy, &sas_host->rphy_list, list) {
-                struct sas_port *parent = dev_to_sas_port(rphy->dev.parent);
                if (rphy->identify.device_type != SAS_END_DEVICE ||
                    rphy->scsi_target_id == -1)
                        continue;
-                if ((channel == SCAN_WILD_CARD || channel == parent->port_identifier) &&
+                if ((channel == SCAN_WILD_CARD || channel == 0) &&
                    (id == SCAN_WILD_CARD || id == rphy->scsi_target_id)) {
-                        scsi_scan_target(&rphy->dev, parent->port_identifier,
+                        scsi_scan_target(&rphy->dev, 0,
                                         rphy->scsi_target_id, lun, 1);
                }
        }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 3225d31449e1..98bd3aab9739 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -502,8 +502,7 @@ static int sd_init_command(struct scsi_cmnd * SCpnt)
                SCpnt->cmnd[4] = (unsigned char) this_count;
                SCpnt->cmnd[5] = 0;
        }
-        SCpnt->request_bufflen = SCpnt->bufflen =
+        SCpnt->request_bufflen = this_count * sdp->sector_size;
-                        this_count * sdp->sector_size;
        /*
         * We shouldn't disconnect in the middle of a sector, so with a dumb
diff --git a/drivers/scsi/seagate.c b/drivers/scsi/seagate.c
index 3f312a84c6a7..2679ea8bff1a 100644
--- a/drivers/scsi/seagate.c
+++ b/drivers/scsi/seagate.c
@@ -1002,7 +1002,7 @@ connect_loop:
                        }
 #endif
-                        buffer = (struct scatterlist *) SCint->buffer;
+                        buffer = (struct scatterlist *) SCint->request_buffer;
                        len = buffer->length;
                        data = page_address(buffer->page) + buffer->offset;
                } else {
diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index fd94408577e5..fae6e95a6298 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -360,7 +360,7 @@ static int sr_init_command(struct scsi_cmnd * SCpnt)
                                "mismatch count %d, bytes %d\n",
                                size, SCpnt->request_bufflen);
                        if (SCpnt->request_bufflen > size)
-                                SCpnt->request_bufflen = SCpnt->bufflen = size;
+                                SCpnt->request_bufflen = size;
                }
        }
@@ -387,8 +387,7 @@ static int sr_init_command(struct scsi_cmnd * SCpnt)
        if (this_count > 0xffff) {
                this_count = 0xffff;
-                SCpnt->request_bufflen = SCpnt->bufflen =
+                SCpnt->request_bufflen = this_count * s_size;
-                                this_count * s_size;
        }
        SCpnt->cmnd[2] = (unsigned char) (block >> 24) & 0xff;
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 756ceb93ddc8..7f669b600677 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -368,7 +368,7 @@ static int st_chk_result(struct scsi_tape *STp, struct st_request * SRpnt)
                       SRpnt->cmd[0], SRpnt->cmd[1], SRpnt->cmd[2],
                       SRpnt->cmd[3], SRpnt->cmd[4], SRpnt->cmd[5]);
                if (cmdstatp->have_sense)
-                         __scsi_print_sense("st", SRpnt->sense, SCSI_SENSE_BUFFERSIZE);
+                         __scsi_print_sense(name, SRpnt->sense, SCSI_SENSE_BUFFERSIZE);
        } ) /* end DEB */
        if (!debugging) { /* Abnormal conditions for tape */
                if (!cmdstatp->have_sense)
@@ -384,9 +384,8 @@ static int st_chk_result(struct scsi_tape *STp, struct st_request * SRpnt)
                         scode != VOLUME_OVERFLOW &&
                         SRpnt->cmd[0] != MODE_SENSE &&
                         SRpnt->cmd[0] != TEST_UNIT_READY) {
-                                printk(KERN_WARNING "%s: Error with sense data: ", name);
-                                __scsi_print_sense("st", SRpnt->sense,
+                        __scsi_print_sense(name, SRpnt->sense, SCSI_SENSE_BUFFERSIZE);
-                                                   SCSI_SENSE_BUFFERSIZE);
                }
        }
diff --git a/drivers/scsi/sun3_NCR5380.c b/drivers/scsi/sun3_NCR5380.c
index 2ebe0d663899..2f8073b73bf3 100644
--- a/drivers/scsi/sun3_NCR5380.c
+++ b/drivers/scsi/sun3_NCR5380.c
@@ -517,7 +517,7 @@ static __inline__ void initialize_SCp(Scsi_Cmnd *cmd)
     */
    if (cmd->use_sg) {
-        cmd->SCp.buffer = (struct scatterlist *) cmd->buffer;
+        cmd->SCp.buffer = (struct scatterlist *) cmd->request_buffer;
        cmd->SCp.buffers_residual = cmd->use_sg - 1;
        cmd->SCp.ptr = (char *) SGADDR(cmd->SCp.buffer);
        cmd->SCp.this_residual = cmd->SCp.buffer->length;
diff --git a/drivers/scsi/sun3x_esp.c b/drivers/scsi/sun3x_esp.c
index 1f328cae5c05..6b60536ac92b 100644
--- a/drivers/scsi/sun3x_esp.c
+++ b/drivers/scsi/sun3x_esp.c
@@ -347,7 +347,7 @@ static void dma_mmu_release_scsi_one (struct NCR_ESP *esp, Scsi_Cmnd *sp)
 static void dma_mmu_release_scsi_sgl (struct NCR_ESP *esp, Scsi_Cmnd *sp)
 {
    int sz = sp->use_sg - 1;
-    struct scatterlist *sg = (struct scatterlist *)sp->buffer;
+    struct scatterlist *sg = (struct scatterlist *)sp->request_buffer;
                        
    while(sz >= 0) {
        dvma_unmap((char *)sg[sz].dma_address);
diff --git a/drivers/scsi/wd33c93.c b/drivers/scsi/wd33c93.c
index 680f38ab60d8..2083454db511 100644
--- a/drivers/scsi/wd33c93.c
+++ b/drivers/scsi/wd33c93.c
@@ -373,7 +373,7 @@ wd33c93_queuecommand(struct scsi_cmnd *cmd,
 */
        if (cmd->use_sg) {
-                cmd->SCp.buffer = (struct scatterlist *) cmd->buffer;
+                cmd->SCp.buffer = (struct scatterlist *) cmd->request_buffer;
                cmd->SCp.buffers_residual = cmd->use_sg - 1;
                cmd->SCp.ptr = page_address(cmd->SCp.buffer->page) +
                    cmd->SCp.buffer->offset;
diff --git a/drivers/serial/sunsab.c b/drivers/serial/sunsab.c
index 979497f108c8..dc673e1b6fd9 100644
--- a/drivers/serial/sunsab.c
+++ b/drivers/serial/sunsab.c
@@ -1047,12 +1047,13 @@ static int __devinit sab_probe(struct of_device *op, const struct of_device_id *
        up = &sunsab_ports[inst * 2];
        err = sunsab_init_one(&up[0], op,
-                              sizeof(union sab82532_async_regs),
+                              0,
                              (inst * 2) + 0);
        if (err)
                return err;
-        err = sunsab_init_one(&up[1], op, 0,
+        err = sunsab_init_one(&up[1], op,
+                              sizeof(union sab82532_async_regs),
                              (inst * 2) + 1);
        if (err) {
                of_iounmap(up[0].port.membase,
@@ -1117,7 +1118,7 @@ static int __init sunsab_init(void)
        int err;
        num_channels = 0;
-        for_each_node_by_name(dp, "su")
+        for_each_node_by_name(dp, "se")
                num_channels += 2;
        for_each_node_by_name(dp, "serial") {
                if (of_device_is_compatible(dp, "sab82532"))
diff --git a/drivers/serial/sunzilog.c b/drivers/serial/sunzilog.c
index a1456d9352cb..47bc3d57e019 100644
--- a/drivers/serial/sunzilog.c
+++ b/drivers/serial/sunzilog.c
@@ -68,9 +68,6 @@ static int num_sunzilog;
 #define NUM_SUNZILOG    num_sunzilog
 #define NUM_CHANNELS    (NUM_SUNZILOG * 2)
-#define KEYBOARD_LINE 0x2
-#define MOUSE_LINE    0x3
 #define ZS_CLOCK                4915200 /* Zilog input clock rate. */
 #define ZS_CLOCK_DIVISOR        16      /* Divisor this driver uses. */
@@ -1225,12 +1222,10 @@ static void __init sunzilog_init_kbdms(struct uart_sunzilog_port *up, int channe
 {
        int baud, brg;
-        if (channel == KEYBOARD_LINE) {
+        if (up->flags & SUNZILOG_FLAG_CONS_KEYB) {
-                up->flags |= SUNZILOG_FLAG_CONS_KEYB;
                up->cflag = B1200 | CS8 | CLOCAL | CREAD;
                baud = 1200;
        } else {
-                up->flags |= SUNZILOG_FLAG_CONS_MOUSE;
                up->cflag = B4800 | CS8 | CLOCAL | CREAD;
                baud = 4800;
        }
@@ -1243,14 +1238,14 @@ static void __init sunzilog_init_kbdms(struct uart_sunzilog_port *up, int channe
 }
 #ifdef CONFIG_SERIO
-static void __init sunzilog_register_serio(struct uart_sunzilog_port *up, int channel)
+static void __init sunzilog_register_serio(struct uart_sunzilog_port *up)
 {
        struct serio *serio = &up->serio;
        serio->port_data = up;
        serio->id.type = SERIO_RS232;
-        if (channel == KEYBOARD_LINE) {
+        if (up->flags & SUNZILOG_FLAG_CONS_KEYB) {
                serio->id.proto = SERIO_SUNKBD;
                strlcpy(serio->name, "zskbd", sizeof(serio->name));
        } else {
@@ -1259,7 +1254,8 @@ static void __init sunzilog_register_serio(struct uart_sunzilog_port *up, int ch
                strlcpy(serio->name, "zsms", sizeof(serio->name));
        }
        strlcpy(serio->phys,
-                (channel == KEYBOARD_LINE ? "zs/serio0" : "zs/serio1"),
+                ((up->flags & SUNZILOG_FLAG_CONS_KEYB) ?
+                 "zs/serio0" : "zs/serio1"),
                sizeof(serio->phys));
        serio->write = sunzilog_serio_write;
@@ -1286,8 +1282,8 @@ static void __init sunzilog_init_hw(struct uart_sunzilog_port *up)
                (void) read_zsreg(channel, R0);
        }
-        if (up->port.line == KEYBOARD_LINE ||
+        if (up->flags & (SUNZILOG_FLAG_CONS_KEYB |
-            up->port.line == MOUSE_LINE) {
+                         SUNZILOG_FLAG_CONS_MOUSE)) {
                sunzilog_init_kbdms(up, up->port.line);
                up->curregs[R9] |= (NV | MIE);
                write_zsreg(channel, R9, up->curregs[R9]);
@@ -1313,37 +1309,26 @@ static void __init sunzilog_init_hw(struct uart_sunzilog_port *up)
        spin_unlock_irqrestore(&up->port.lock, flags);
 #ifdef CONFIG_SERIO
-        if (up->port.line == KEYBOARD_LINE || up->port.line == MOUSE_LINE)
+        if (up->flags & (SUNZILOG_FLAG_CONS_KEYB |
-                sunzilog_register_serio(up, up->port.line);
+                         SUNZILOG_FLAG_CONS_MOUSE))
+                sunzilog_register_serio(up);
 #endif
 }
-static int __devinit zs_get_instance(struct device_node *dp)
-{
-        int ret;
-        ret = of_getintprop_default(dp, "slave", -1);
-        if (ret != -1)
-                return ret;
-        if (of_find_property(dp, "keyboard", NULL))
-                ret = 1;
-        else
-                ret = 0;
-        return ret;
-}
 static int zilog_irq = -1;
-static int __devinit zs_probe(struct of_device *dev, const struct of_device_id *match)
+static int __devinit zs_probe(struct of_device *op, const struct of_device_id *match)
 {
-        struct of_device *op = to_of_device(&dev->dev);
+        static int inst;
        struct uart_sunzilog_port *up;
        struct zilog_layout __iomem *rp;
-        int inst = zs_get_instance(dev->node);
+        int keyboard_mouse;
        int err;
+        keyboard_mouse = 0;
+        if (of_find_property(op->node, "keyboard", NULL))
+                keyboard_mouse = 1;
        sunzilog_chip_regs[inst] = of_ioremap(&op->resource[0], 0,
                                              sizeof(struct zilog_layout),
                                              "zs");
@@ -1352,16 +1337,8 @@ static int __devinit zs_probe(struct of_device *dev, const struct of_device_id *
        rp = sunzilog_chip_regs[inst];
-        if (zilog_irq == -1) {
+        if (zilog_irq == -1)
                zilog_irq = op->irqs[0];
-                err = request_irq(zilog_irq, sunzilog_interrupt, IRQF_SHARED,
-                                  "zs", sunzilog_irq_chain);
-                if (err) {
-                        of_iounmap(rp, sizeof(struct zilog_layout));
-                        return err;
-                }
-        }
        up = &sunzilog_port_table[inst * 2];
@@ -1378,7 +1355,7 @@ static int __devinit zs_probe(struct of_device *dev, const struct of_device_id *
        up[0].port.line = (inst * 2) + 0;
        up[0].port.dev = &op->dev;
        up[0].flags |= SUNZILOG_FLAG_IS_CHANNEL_A;
-        if (inst == 1)
+        if (keyboard_mouse)
                up[0].flags |= SUNZILOG_FLAG_CONS_KEYB;
        sunzilog_init_hw(&up[0]);
@@ -1395,11 +1372,11 @@ static int __devinit zs_probe(struct of_device *dev, const struct of_device_id *
        up[1].port.line = (inst * 2) + 1;
        up[1].port.dev = &op->dev;
        up[1].flags |= 0;
-        if (inst == 1)
+        if (keyboard_mouse)
                up[1].flags |= SUNZILOG_FLAG_CONS_MOUSE;
        sunzilog_init_hw(&up[1]);
-        if (inst != 1) {
+        if (!keyboard_mouse) {
                err = uart_add_one_port(&sunzilog_reg, &up[0].port);
                if (err) {
                        of_iounmap(rp, sizeof(struct zilog_layout));
@@ -1411,9 +1388,18 @@ static int __devinit zs_probe(struct of_device *dev, const struct of_device_id *
                        of_iounmap(rp, sizeof(struct zilog_layout));
                        return err;
                }
+        } else {
+                printk(KERN_INFO "%s: Keyboard at MMIO %lx (irq = %d) "
+                       "is a zs\n",
+                       op->dev.bus_id, up[0].port.mapbase, op->irqs[0]);
+                printk(KERN_INFO "%s: Mouse at MMIO %lx (irq = %d) "
+                       "is a zs\n",
+                       op->dev.bus_id, up[1].port.mapbase, op->irqs[0]);
        }
-        dev_set_drvdata(&dev->dev, &up[0]);
+        dev_set_drvdata(&op->dev, &up[0]);
+        inst++;
        return 0;
 }
@@ -1462,36 +1448,65 @@ static struct of_platform_driver zs_driver = {
 static int __init sunzilog_init(void)
 {
        struct device_node *dp;
-        int err;
+        int err, uart_count;
+        int num_keybms;
        NUM_SUNZILOG = 0;
-        for_each_node_by_name(dp, "zs")
+        num_keybms = 0;
+        for_each_node_by_name(dp, "zs") {
                NUM_SUNZILOG++;
+                if (of_find_property(dp, "keyboard", NULL))
+                        num_keybms++;
+        }
+        uart_count = 0;
        if (NUM_SUNZILOG) {
                int uart_count;
                err = sunzilog_alloc_tables();
                if (err)
-                        return err;
+                        goto out;
-                /* Subtract 1 for keyboard, 1 for mouse.  */
+                uart_count = (NUM_SUNZILOG * 2) - (2 * num_keybms);
-                uart_count = (NUM_SUNZILOG * 2) - 2;
                sunzilog_reg.nr = uart_count;
                sunzilog_reg.minor = sunserial_current_minor;
                err = uart_register_driver(&sunzilog_reg);
-                if (err) {
+                if (err)
-                        sunzilog_free_tables();
+                        goto out_free_tables;
-                        return err;
-                }
                sunzilog_reg.tty_driver->name_base = sunzilog_reg.minor - 64;
                sunzilog_reg.cons = SUNZILOG_CONSOLE();
                sunserial_current_minor += uart_count;
        }
-        return of_register_driver(&zs_driver, &of_bus_type);
+        err = of_register_driver(&zs_driver, &of_bus_type);
+        if (err)
+                goto out_unregister_uart;
+        if (zilog_irq != -1) {
+                err = request_irq(zilog_irq, sunzilog_interrupt, IRQF_SHARED,
+                                  "zs", sunzilog_irq_chain);
+                if (err)
+                        goto out_unregister_driver;
+        }
+out:
+        return err;
+out_unregister_driver:
+        of_unregister_driver(&zs_driver);
+out_unregister_uart:
+        if (NUM_SUNZILOG) {
+                uart_unregister_driver(&sunzilog_reg);
+                sunzilog_reg.cons = NULL;
+        }
+out_free_tables:
+        sunzilog_free_tables();
+        goto out;
 }
 static void __exit sunzilog_exit(void)
diff --git a/include/asm-m68k/oplib.h b/include/asm-m68k/oplib.h
index c3594f473ef7..06caa2d08451 100644
--- a/include/asm-m68k/oplib.h
+++ b/include/asm-m68k/oplib.h
@@ -244,11 +244,6 @@ extern void prom_getstring(int node, char *prop, char *buf, int bufsize);
 /* Does the passed node have the given "name"? YES=1 NO=0 */
 extern int prom_nodematch(int thisnode, char *name);
-/* Puts in buffer a prom name in the form name@x,y or name (x for which_io
- * and y for first regs phys address
- */
-extern int prom_getname(int node, char *buf, int buflen);
 /* Search all siblings starting at the passed node for "name" matching
 * the given string.  Returns the node on success, zero on failure.
 */
diff --git a/include/asm-s390/system.h b/include/asm-s390/system.h
index 36a3a85d611a..16040048cd1b 100644
--- a/include/asm-s390/system.h
+++ b/include/asm-s390/system.h
@@ -128,8 +128,13 @@ extern void account_system_vtime(struct task_struct *);
 #define nop() __asm__ __volatile__ ("nop")
-#define xchg(ptr,x) \
+#define xchg(ptr,x)                                                       \
-  ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(void *)(ptr),sizeof(*(ptr))))
+({                                                                        \
+        __typeof__(*(ptr)) __ret;                                         \
+        __ret = (__typeof__(*(ptr)))                                      \
+                __xchg((unsigned long)(x), (void *)(ptr),sizeof(*(ptr))); \
+        __ret;                                                            \
+})
 static inline unsigned long __xchg(unsigned long x, void * ptr, int size)
 {
diff --git a/include/asm-s390/timex.h b/include/asm-s390/timex.h
index 4848057dafe4..5d0332a4c2bd 100644
--- a/include/asm-s390/timex.h
+++ b/include/asm-s390/timex.h
@@ -19,7 +19,7 @@ static inline cycles_t get_cycles(void)
 {
        cycles_t cycles;
-        __asm__("stck 0(%1)" : "=m" (cycles) : "a" (&cycles) : "cc");
+        __asm__ __volatile__ ("stck 0(%1)" : "=m" (cycles) : "a" (&cycles) : "cc");
        return cycles >> 2;
 }
@@ -27,7 +27,7 @@ static inline unsigned long long get_clock (void)
 {
        unsigned long long clk;
-        __asm__("stck 0(%1)" : "=m" (clk) : "a" (&clk) : "cc");
+        __asm__ __volatile__ ("stck 0(%1)" : "=m" (clk) : "a" (&clk) : "cc");
        return clk;
 }
diff --git a/include/asm-sparc/oplib.h b/include/asm-sparc/oplib.h
index f283f8aaf6a9..91691e52c058 100644
--- a/include/asm-sparc/oplib.h
+++ b/include/asm-sparc/oplib.h
@@ -267,11 +267,6 @@ extern void prom_getstring(int node, char *prop, char *buf, int bufsize);
 /* Does the passed node have the given "name"? YES=1 NO=0 */
 extern int prom_nodematch(int thisnode, char *name);
-/* Puts in buffer a prom name in the form name@x,y or name (x for which_io 
- * and y for first regs phys address
- */
-extern int prom_getname(int node, char *buf, int buflen);
 /* Search all siblings starting at the passed node for "name" matching
 * the given string.  Returns the node on success, zero on failure.
 */
diff --git a/include/asm-sparc64/openprom.h b/include/asm-sparc64/openprom.h
index b4959d2b0d99..e01b80559c93 100644
--- a/include/asm-sparc64/openprom.h
+++ b/include/asm-sparc64/openprom.h
@@ -175,7 +175,7 @@ struct linux_nodeops {
 };
 /* More fun PROM structures for device probing. */
-#define PROMREG_MAX     16
+#define PROMREG_MAX     24
 #define PROMVADDR_MAX   16
 #define PROMINTR_MAX    15
diff --git a/include/asm-sparc64/oplib.h b/include/asm-sparc64/oplib.h
index a68b0bb05958..6a0da3b1695c 100644
--- a/include/asm-sparc64/oplib.h
+++ b/include/asm-sparc64/oplib.h
@@ -287,11 +287,6 @@ extern void prom_getstring(int node, const char *prop, char *buf, int bufsize);
 /* Does the passed node have the given "name"? YES=1 NO=0 */
 extern int prom_nodematch(int thisnode, const char *name);
-/* Puts in buffer a prom name in the form name@x,y or name (x for which_io 
- * and y for first regs phys address
- */
-extern int prom_getname(int node, char *buf, int buflen);
 /* Search all siblings starting at the passed node for "name" matching
 * the given string.  Returns the node on success, zero on failure.
 */
diff --git a/include/linux/cpu.h b/include/linux/cpu.h
index 44a11f1ccaf2..8fb344a9abd8 100644
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -48,7 +48,6 @@ static inline void unregister_cpu_notifier(struct notifier_block *nb)
 {
 }
 #endif
-extern int current_in_cpu_hotplug(void);
 int cpu_up(unsigned int cpu);
@@ -61,10 +60,6 @@ static inline int register_cpu_notifier(struct notifier_block *nb)
 static inline void unregister_cpu_notifier(struct notifier_block *nb)
 {
 }
-static inline int current_in_cpu_hotplug(void)
-{
-        return 0;
-}
 #endif /* CONFIG_SMP */
 extern struct sysdev_class cpu_sysdev_class;
@@ -73,7 +68,6 @@ extern struct sysdev_class cpu_sysdev_class;
 /* Stop CPUs going up and down. */
 extern void lock_cpu_hotplug(void);
 extern void unlock_cpu_hotplug(void);
-extern int lock_cpu_hotplug_interruptible(void);
 #define hotcpu_notifier(fn, pri) {                              \
        static struct notifier_block fn##_nb =                  \
                { .notifier_call = fn, .priority = pri };       \
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 76cc099c8580..75f02d8c6ed3 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -924,10 +924,10 @@ static inline void netif_tx_lock_bh(struct net_device *dev)
 static inline int netif_tx_trylock(struct net_device *dev)
 {
-        int err = spin_trylock(&dev->_xmit_lock);
+        int ok = spin_trylock(&dev->_xmit_lock);
-        if (!err)
+        if (likely(ok))
                dev->xmit_lock_owner = smp_processor_id();
-        return err;
+        return ok;
 }
 static inline void netif_tx_unlock(struct net_device *dev)
diff --git a/include/net/netdma.h b/include/net/netdma.h
index 19760eb131aa..ceae5ee85c04 100644
--- a/include/net/netdma.h
+++ b/include/net/netdma.h
@@ -37,7 +37,7 @@ static inline struct dma_chan *get_softnet_dma(void)
 }
 int dma_skb_copy_datagram_iovec(struct dma_chan* chan,
-                const struct sk_buff *skb, int offset, struct iovec *to,
+                struct sk_buff *skb, int offset, struct iovec *to,
                size_t len, struct dma_pinned_list *pinned_list);
 #endif /* CONFIG_NET_DMA */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 5f69158c1006..e5aa7ff1f5b5 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -445,6 +445,7 @@ typedef struct sctp_sender_hb_info {
        struct sctp_paramhdr param_hdr;
        union sctp_addr daddr;
        unsigned long sent_at;
+        __u64 hb_nonce;
 } __attribute__((packed)) sctp_sender_hb_info_t;
 /*
@@ -730,13 +731,10 @@ void sctp_init_addrs(struct sctp_chunk *, union sctp_addr *,
 const union sctp_addr *sctp_source(const struct sctp_chunk *chunk);
 /* This is a structure for holding either an IPv6 or an IPv4 address.  */
-/* sin_family -- AF_INET or AF_INET6
- * sin_port -- ordinary port number
- * sin_addr -- cast to either (struct in_addr) or (struct in6_addr)
- */
 struct sctp_sockaddr_entry {
        struct list_head list;
        union sctp_addr a;
+        __u8 use_as_src;
 };
 typedef struct sctp_chunk *(sctp_packet_phandler_t)(struct sctp_association *);
@@ -984,6 +982,9 @@ struct sctp_transport {
                 */
                char cacc_saw_newack;
        } cacc;
+        /* 64-bit random number sent with heartbeat. */
+        __u64 hb_nonce;
 };
 struct sctp_transport *sctp_transport_new(const union sctp_addr *,
@@ -1138,7 +1139,7 @@ int sctp_bind_addr_copy(struct sctp_bind_addr *dest,
                        sctp_scope_t scope, gfp_t gfp,
                        int flags);
 int sctp_add_bind_addr(struct sctp_bind_addr *, union sctp_addr *,
-                       gfp_t gfp);
+                       __u8 use_as_src, gfp_t gfp);
 int sctp_del_bind_addr(struct sctp_bind_addr *, union sctp_addr *);
 int sctp_bind_addr_match(struct sctp_bind_addr *, const union sctp_addr *,
                         struct sctp_sock *);
diff --git a/include/net/sctp/user.h b/include/net/sctp/user.h
index 8a6bef6f91eb..1b7aae6cdd82 100644
--- a/include/net/sctp/user.h
+++ b/include/net/sctp/user.h
@@ -560,9 +560,18 @@ struct sctp_paddrinfo {
 } __attribute__((packed, aligned(4)));
 /* Peer addresses's state. */
+/* UNKNOWN: Peer address passed by the upper layer in sendmsg or connect[x]
+ * calls.
+ * UNCONFIRMED: Peer address received in INIT/INIT-ACK address parameters.
+ *              Not yet confirmed by a heartbeat and not available for data
+ *              transfers.
+ * ACTIVE : Peer address confirmed, active and available for data transfers.
+ * INACTIVE: Peer address inactive and not available for data transfers.
+ */
 enum sctp_spinfo_state {
        SCTP_INACTIVE,
        SCTP_ACTIVE,
+        SCTP_UNCONFIRMED,
        SCTP_UNKNOWN = 0xffff  /* Value used for transport state unknown */
 };
diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h
index 371f70d9aa92..58e6444eebee 100644
--- a/include/scsi/scsi_cmnd.h
+++ b/include/scsi/scsi_cmnd.h
@@ -58,9 +58,7 @@ struct scsi_cmnd {
        int timeout_per_command;
        unsigned char cmd_len;
-        unsigned char old_cmd_len;
        enum dma_data_direction sc_data_direction;
-        enum dma_data_direction sc_old_data_direction;
        /* These elements define the operation we are about to perform */
 #define MAX_COMMAND_SIZE        16
@@ -71,18 +69,11 @@ struct scsi_cmnd {
        void *request_buffer;           /* Actual requested buffer */
        /* These elements define the operation we ultimately want to perform */
-        unsigned char data_cmnd[MAX_COMMAND_SIZE];
-        unsigned short old_use_sg;      /* We save  use_sg here when requesting
-                                         * sense info */
        unsigned short use_sg;  /* Number of pieces of scatter-gather */
        unsigned short sglist_len;      /* size of malloc'd scatter-gather list */
-        unsigned bufflen;       /* Size of data buffer */
-        void *buffer;           /* Data buffer */
        unsigned underflow;     /* Return error if less than
                                   this amount is transferred */
-        unsigned old_underflow; /* save underflow here when reusing the
-                                 * command for error handling */
        unsigned transfersize;  /* How much we are guaranteed to
                                   transfer with each SCSI transfer
diff --git a/include/scsi/scsi_transport_sas.h b/include/scsi/scsi_transport_sas.h
index e3c503cd175e..6cc2314098cf 100644
--- a/include/scsi/scsi_transport_sas.h
+++ b/include/scsi/scsi_transport_sas.h
@@ -106,6 +106,7 @@ struct sas_end_device {
 struct sas_expander_device {
        int    level;
+        int    next_port_id;
        #define SAS_EXPANDER_VENDOR_ID_LEN      8
        char   vendor_id[SAS_EXPANDER_VENDOR_ID_LEN+1];
@@ -127,8 +128,10 @@ struct sas_expander_device {
 struct sas_port {
        struct device           dev;
-        u8                      port_identifier;
+        int                     port_identifier;
        int                     num_phys;
+        /* port flags */
+        unsigned int            is_backlink:1;
        /* the other end of the link */
        struct sas_rphy         *rphy;
@@ -168,11 +171,13 @@ extern void sas_rphy_delete(struct sas_rphy *);
 extern int scsi_is_sas_rphy(const struct device *);
 struct sas_port *sas_port_alloc(struct device *, int);
+struct sas_port *sas_port_alloc_num(struct device *);
 int sas_port_add(struct sas_port *);
 void sas_port_free(struct sas_port *);
 void sas_port_delete(struct sas_port *);
 void sas_port_add_phy(struct sas_port *, struct sas_phy *);
 void sas_port_delete_phy(struct sas_port *, struct sas_phy *);
+void sas_port_mark_backlink(struct sas_port *);
 int scsi_is_sas_port(const struct device *);
 extern struct scsi_transport_template *
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 70fbf2e83766..f230f9ae01c2 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -16,56 +16,48 @@
 #include <linux/mutex.h>
 /* This protects CPUs going up and down... */
-static DEFINE_MUTEX(cpucontrol);
+static DEFINE_MUTEX(cpu_add_remove_lock);
+static DEFINE_MUTEX(cpu_bitmask_lock);
 static __cpuinitdata BLOCKING_NOTIFIER_HEAD(cpu_chain);
 #ifdef CONFIG_HOTPLUG_CPU
-static struct task_struct *lock_cpu_hotplug_owner;
-static int lock_cpu_hotplug_depth;
-static int __lock_cpu_hotplug(int interruptible)
+/* Crappy recursive lock-takers in cpufreq! Complain loudly about idiots */
-{
+static struct task_struct *recursive;
-        int ret = 0;
+static int recursive_depth;
-        if (lock_cpu_hotplug_owner != current) {
-                if (interruptible)
-                        ret = mutex_lock_interruptible(&cpucontrol);
-                else
-                        mutex_lock(&cpucontrol);
-        }
-        /*
-         * Set only if we succeed in locking
-         */
-        if (!ret) {
-                lock_cpu_hotplug_depth++;
-                lock_cpu_hotplug_owner = current;
-        }
-        return ret;
-}
 void lock_cpu_hotplug(void)
 {
-        __lock_cpu_hotplug(0);
+        struct task_struct *tsk = current;
+        if (tsk == recursive) {
+                static int warnings = 10;
+                if (warnings) {
+                        printk(KERN_ERR "Lukewarm IQ detected in hotplug locking\n");
+                        WARN_ON(1);
+                        warnings--;
+                }
+                recursive_depth++;
+                return;
+        }
+        mutex_lock(&cpu_bitmask_lock);
+        recursive = tsk;
 }
 EXPORT_SYMBOL_GPL(lock_cpu_hotplug);
 void unlock_cpu_hotplug(void)
 {
-        if (--lock_cpu_hotplug_depth == 0) {
+        WARN_ON(recursive != current);
-                lock_cpu_hotplug_owner = NULL;
+        if (recursive_depth) {
-                mutex_unlock(&cpucontrol);
+                recursive_depth--;
+                return;
        }
+        mutex_unlock(&cpu_bitmask_lock);
+        recursive = NULL;
 }
 EXPORT_SYMBOL_GPL(unlock_cpu_hotplug);
-int lock_cpu_hotplug_interruptible(void)
-{
-        return __lock_cpu_hotplug(1);
-}
-EXPORT_SYMBOL_GPL(lock_cpu_hotplug_interruptible);
 #endif  /* CONFIG_HOTPLUG_CPU */
 /* Need to know about CPUs going up/down? */
@@ -122,9 +114,7 @@ int cpu_down(unsigned int cpu)
        struct task_struct *p;
        cpumask_t old_allowed, tmp;
-        if ((err = lock_cpu_hotplug_interruptible()) != 0)
+        mutex_lock(&cpu_add_remove_lock);
-                return err;
        if (num_online_cpus() == 1) {
                err = -EBUSY;
                goto out;
@@ -150,7 +140,10 @@ int cpu_down(unsigned int cpu)
        cpu_clear(cpu, tmp);
        set_cpus_allowed(current, tmp);
+        mutex_lock(&cpu_bitmask_lock);
        p = __stop_machine_run(take_cpu_down, NULL, cpu);
+        mutex_unlock(&cpu_bitmask_lock);
        if (IS_ERR(p)) {
                /* CPU didn't die: tell everyone.  Can't complain. */
                if (blocking_notifier_call_chain(&cpu_chain, CPU_DOWN_FAILED,
@@ -187,7 +180,7 @@ out_thread:
 out_allowed:
        set_cpus_allowed(current, old_allowed);
 out:
-        unlock_cpu_hotplug();
+        mutex_unlock(&cpu_add_remove_lock);
        return err;
 }
 #endif /*CONFIG_HOTPLUG_CPU*/
@@ -197,9 +190,7 @@ int __devinit cpu_up(unsigned int cpu)
        int ret;
        void *hcpu = (void *)(long)cpu;
-        if ((ret = lock_cpu_hotplug_interruptible()) != 0)
+        mutex_lock(&cpu_add_remove_lock);
-                return ret;
        if (cpu_online(cpu) || !cpu_present(cpu)) {
                ret = -EINVAL;
                goto out;
@@ -214,7 +205,9 @@ int __devinit cpu_up(unsigned int cpu)
        }
        /* Arch-specific enabling code. */
+        mutex_lock(&cpu_bitmask_lock);
        ret = __cpu_up(cpu);
+        mutex_unlock(&cpu_bitmask_lock);
        if (ret != 0)
                goto out_notify;
        BUG_ON(!cpu_online(cpu));
@@ -227,6 +220,6 @@ out_notify:
                blocking_notifier_call_chain(&cpu_chain,
                                CPU_UP_CANCELED, hcpu);
 out:
-        unlock_cpu_hotplug();
+        mutex_unlock(&cpu_add_remove_lock);
        return ret;
 }
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index c232dc077438..1a649f2bb9bb 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -762,6 +762,8 @@ static int validate_change(const struct cpuset *cur, const struct cpuset *trial)
 *
 * Call with manage_mutex held.  May nest a call to the
 * lock_cpu_hotplug()/unlock_cpu_hotplug() pair.
+ * Must not be called holding callback_mutex, because we must
+ * not call lock_cpu_hotplug() while holding callback_mutex.
 */
 static void update_cpu_domains(struct cpuset *cur)
@@ -781,7 +783,7 @@ static void update_cpu_domains(struct cpuset *cur)
                if (is_cpu_exclusive(c))
                        cpus_andnot(pspan, pspan, c->cpus_allowed);
        }
-        if (is_removed(cur) || !is_cpu_exclusive(cur)) {
+        if (!is_cpu_exclusive(cur)) {
                cpus_or(pspan, pspan, cur->cpus_allowed);
                if (cpus_equal(pspan, cur->cpus_allowed))
                        return;
@@ -1917,6 +1919,17 @@ static int cpuset_mkdir(struct inode *dir, struct dentry *dentry, int mode)
        return cpuset_create(c_parent, dentry->d_name.name, mode | S_IFDIR);
 }
+/*
+ * Locking note on the strange update_flag() call below:
+ *
+ * If the cpuset being removed is marked cpu_exclusive, then simulate
+ * turning cpu_exclusive off, which will call update_cpu_domains().
+ * The lock_cpu_hotplug() call in update_cpu_domains() must not be
+ * made while holding callback_mutex.  Elsewhere the kernel nests
+ * callback_mutex inside lock_cpu_hotplug() calls.  So the reverse
+ * nesting would risk an ABBA deadlock.
+ */
 static int cpuset_rmdir(struct inode *unused_dir, struct dentry *dentry)
 {
        struct cpuset *cs = dentry->d_fsdata;
@@ -1936,11 +1949,16 @@ static int cpuset_rmdir(struct inode *unused_dir, struct dentry *dentry)
                mutex_unlock(&manage_mutex);
                return -EBUSY;
        }
+        if (is_cpu_exclusive(cs)) {
+                int retval = update_flag(CS_CPU_EXCLUSIVE, cs, "0");
+                if (retval < 0) {
+                        mutex_unlock(&manage_mutex);
+                        return retval;
+                }
+        }
        parent = cs->parent;
        mutex_lock(&callback_mutex);
        set_bit(CS_REMOVED, &cs->flags);
-        if (is_cpu_exclusive(cs))
-                update_cpu_domains(cs);
        list_del(&cs->sibling); /* delete my sibling from parent->children */
        spin_lock(&cs->dentry->d_lock);
        d = dget(cs->dentry);
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 458031bfff55..0ade0c63fdf6 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -542,12 +542,11 @@ static struct net_device *register_vlan_device(const char *eth_IF_name,
         * so it cannot "appear" on us.
         */
        if (!grp) { /* need to add a new group */
-                grp = kmalloc(sizeof(struct vlan_group), GFP_KERNEL);
+                grp = kzalloc(sizeof(struct vlan_group), GFP_KERNEL);
                if (!grp)
                        goto out_free_unregister;
                                        
                /* printk(KERN_ALERT "VLAN REGISTER:  Allocated new group.\n"); */
-                memset(grp, 0, sizeof(struct vlan_group));
                grp->real_dev_ifindex = real_dev->ifindex;
                hlist_add_head_rcu(&grp->hlist, 
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 5ee96d4b40e9..96dc6bb52d14 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -227,12 +227,11 @@ static void atif_drop_device(struct net_device *dev)
 static struct atalk_iface *atif_add_device(struct net_device *dev,
                                           struct atalk_addr *sa)
 {
-        struct atalk_iface *iface = kmalloc(sizeof(*iface), GFP_KERNEL);
+        struct atalk_iface *iface = kzalloc(sizeof(*iface), GFP_KERNEL);
        if (!iface)
                goto out;
-        memset(iface, 0, sizeof(*iface));
        dev_hold(dev);
        iface->dev = dev;
        dev->atalk_ptr = iface;
@@ -559,12 +558,11 @@ static int atrtr_create(struct rtentry *r, struct net_device *devhint)
        }
        if (!rt) {
-                rt = kmalloc(sizeof(*rt), GFP_ATOMIC);
+                rt = kzalloc(sizeof(*rt), GFP_ATOMIC);
                retval = -ENOBUFS;
                if (!rt)
                        goto out_unlock;
-                memset(rt, 0, sizeof(*rt));
                rt->next = atalk_routes;
                atalk_routes = rt;
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index a487233dc466..d00cca97eb33 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -508,10 +508,9 @@ Note: we do not have explicit unassign, but look at _push()
        if (copy_from_user(&be, arg, sizeof be))
                return -EFAULT;
-        brvcc = kmalloc(sizeof(struct br2684_vcc), GFP_KERNEL);
+        brvcc = kzalloc(sizeof(struct br2684_vcc), GFP_KERNEL);
        if (!brvcc)
                return -ENOMEM;
-        memset(brvcc, 0, sizeof(struct br2684_vcc));
        write_lock_irq(&devs_lock);
        net_dev = br2684_find_dev(&be.ifspec);
        if (net_dev == NULL) {
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 2e62105d91bd..7ce7bfe3fbad 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -929,12 +929,11 @@ static int arp_seq_open(struct inode *inode, struct file *file)
        struct seq_file *seq;
        int rc = -EAGAIN;
-        state = kmalloc(sizeof(*state), GFP_KERNEL);
+        state = kzalloc(sizeof(*state), GFP_KERNEL);
        if (!state) {
                rc = -ENOMEM;
                goto out_kfree;
        }
-        memset(state, 0, sizeof(*state));
        state->ns.neigh_sub_iter = clip_seq_sub_iter;
        rc = seq_open(file, &arp_seq_ops);
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 4b68a18171cf..b4aa489849df 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -1811,12 +1811,11 @@ make_entry(struct lec_priv *priv, unsigned char *mac_addr)
 {
        struct lec_arp_table *to_return;
-        to_return = kmalloc(sizeof(struct lec_arp_table), GFP_ATOMIC);
+        to_return = kzalloc(sizeof(struct lec_arp_table), GFP_ATOMIC);
        if (!to_return) {
                printk("LEC: Arp entry kmalloc failed\n");
                return NULL;
        }
-        memset(to_return, 0, sizeof(struct lec_arp_table));
        memcpy(to_return->mac_addr, mac_addr, ETH_ALEN);
        init_timer(&to_return->timer);
        to_return->timer.function = lec_arp_expire_arp;
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 9aafe1e2f048..00704661e83f 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -258,10 +258,9 @@ static struct mpoa_client *alloc_mpc(void)
 {
        struct mpoa_client *mpc;
-        mpc = kmalloc(sizeof (struct mpoa_client), GFP_KERNEL);
+        mpc = kzalloc(sizeof (struct mpoa_client), GFP_KERNEL);
        if (mpc == NULL)
                return NULL;
-        memset(mpc, 0, sizeof(struct mpoa_client));
        rwlock_init(&mpc->ingress_lock);
        rwlock_init(&mpc->egress_lock);
        mpc->next = mpcs;
diff --git a/net/atm/pppoatm.c b/net/atm/pppoatm.c
index 76a7d8ff6c0e..19d5dfc0702f 100644
--- a/net/atm/pppoatm.c
+++ b/net/atm/pppoatm.c
@@ -287,10 +287,9 @@ static int pppoatm_assign_vcc(struct atm_vcc *atmvcc, void __user *arg)
        if (be.encaps != PPPOATM_ENCAPS_AUTODETECT &&
            be.encaps != PPPOATM_ENCAPS_VC && be.encaps != PPPOATM_ENCAPS_LLC)
                return -EINVAL;
-        pvcc = kmalloc(sizeof(*pvcc), GFP_KERNEL);
+        pvcc = kzalloc(sizeof(*pvcc), GFP_KERNEL);
        if (pvcc == NULL)
                return -ENOMEM;
-        memset(pvcc, 0, sizeof(*pvcc));
        pvcc->atmvcc = atmvcc;
        pvcc->old_push = atmvcc->push;
        pvcc->old_pop = atmvcc->pop;
diff --git a/net/atm/resources.c b/net/atm/resources.c
index de25c6408b04..529f7e64aa2c 100644
--- a/net/atm/resources.c
+++ b/net/atm/resources.c
@@ -33,10 +33,9 @@ static struct atm_dev *__alloc_atm_dev(const char *type)
 {
        struct atm_dev *dev;
-        dev = kmalloc(sizeof(*dev), GFP_KERNEL);
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
        if (!dev)
                return NULL;
-        memset(dev, 0, sizeof(*dev));
        dev->type = type;
        dev->signal = ATM_PHY_SIG_UNKNOWN;
        dev->link_rate = ATM_OC3_PCR;
diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c
index 369a75b160f2..867d42537979 100644
--- a/net/ax25/sysctl_net_ax25.c
+++ b/net/ax25/sysctl_net_ax25.c
@@ -203,13 +203,11 @@ void ax25_register_sysctl(void)
        for (ax25_table_size = sizeof(ctl_table), ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next)
                ax25_table_size += sizeof(ctl_table);
-        if ((ax25_table = kmalloc(ax25_table_size, GFP_ATOMIC)) == NULL) {
+        if ((ax25_table = kzalloc(ax25_table_size, GFP_ATOMIC)) == NULL) {
                spin_unlock_bh(&ax25_dev_lock);
                return;
        }
-        memset(ax25_table, 0x00, ax25_table_size);
        for (n = 0, ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next) {
                ctl_table *child = kmalloc(sizeof(ax25_param_table), GFP_ATOMIC);
                if (!child) {
diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
index 159fb8409824..4e4119a12139 100644
--- a/net/bridge/br_ioctl.c
+++ b/net/bridge/br_ioctl.c
@@ -162,12 +162,10 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                if (num > BR_MAX_PORTS)
                        num = BR_MAX_PORTS;
-                indices = kmalloc(num*sizeof(int), GFP_KERNEL);
+                indices = kcalloc(num, sizeof(int), GFP_KERNEL);
                if (indices == NULL)
                        return -ENOMEM;
-                memset(indices, 0, num*sizeof(int));
                get_port_ifindices(br, indices, num);
                if (copy_to_user((void __user *)args[1], indices, num*sizeof(int)))
                        num =  -EFAULT;
@@ -327,11 +325,10 @@ static int old_deviceless(void __user *uarg)
                if (args[2] >= 2048)
                        return -ENOMEM;
-                indices = kmalloc(args[2]*sizeof(int), GFP_KERNEL);
+                indices = kcalloc(args[2], sizeof(int), GFP_KERNEL);
                if (indices == NULL)
                        return -ENOMEM;
-                memset(indices, 0, args[2]*sizeof(int));
                args[2] = get_bridge_ifindices(indices, args[2]);
                ret = copy_to_user((void __user *)args[1], indices, args[2]*sizeof(int))
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 27ce1683caf5..2797e2815418 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -437,7 +437,7 @@ static int ethtool_set_pauseparam(struct net_device *dev, void __user *useraddr)
 {
        struct ethtool_pauseparam pauseparam;
-        if (!dev->ethtool_ops->get_pauseparam)
+        if (!dev->ethtool_ops->set_pauseparam)
                return -EOPNOTSUPP;
        if (copy_from_user(&pauseparam, useraddr, sizeof(pauseparam)))
diff --git a/net/core/user_dma.c b/net/core/user_dma.c
index b7c98dbcdb81..248a6b666aff 100644
--- a/net/core/user_dma.c
+++ b/net/core/user_dma.c
@@ -29,6 +29,7 @@
 #include <linux/socket.h>
 #include <linux/rtnetlink.h> /* for BUG_TRAP */
 #include <net/tcp.h>
+#include <net/netdma.h>
 #define NET_DMA_DEFAULT_COPYBREAK 4096
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index 98a25208440d..476455fbdb03 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -413,11 +413,7 @@ static struct dn_ifaddr *dn_dev_alloc_ifa(void)
 {
        struct dn_ifaddr *ifa;
-        ifa = kmalloc(sizeof(*ifa), GFP_KERNEL);
+        ifa = kzalloc(sizeof(*ifa), GFP_KERNEL);
-        if (ifa) {
-                memset(ifa, 0, sizeof(*ifa));
-        }
        return ifa;
 }
@@ -1105,10 +1101,9 @@ struct dn_dev *dn_dev_create(struct net_device *dev, int *err)
                return NULL;
        *err = -ENOBUFS;
-        if ((dn_db = kmalloc(sizeof(struct dn_dev), GFP_ATOMIC)) == NULL)
+        if ((dn_db = kzalloc(sizeof(struct dn_dev), GFP_ATOMIC)) == NULL)
                return NULL;
-        memset(dn_db, 0, sizeof(struct dn_dev));
        memcpy(&dn_db->parms, p, sizeof(struct dn_dev_parms));
        smp_wmb();
        dev->dn_ptr = dn_db;
diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c
index 0375077391b7..fa20e2efcfc1 100644
--- a/net/decnet/dn_fib.c
+++ b/net/decnet/dn_fib.c
@@ -283,11 +283,10 @@ struct dn_fib_info *dn_fib_create_info(const struct rtmsg *r, struct dn_kern_rta
                        goto err_inval;
        }
-        fi = kmalloc(sizeof(*fi)+nhs*sizeof(struct dn_fib_nh), GFP_KERNEL);
+        fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct dn_fib_nh), GFP_KERNEL);
        err = -ENOBUFS;
        if (fi == NULL)
                goto failure;
-        memset(fi, 0, sizeof(*fi)+nhs*sizeof(struct dn_fib_nh));
        fi->fib_protocol = r->rtm_protocol;
        fi->fib_nhs = nhs;
diff --git a/net/decnet/dn_neigh.c b/net/decnet/dn_neigh.c
index 5ce9c9e0565c..ff0ebe99137d 100644
--- a/net/decnet/dn_neigh.c
+++ b/net/decnet/dn_neigh.c
@@ -580,12 +580,11 @@ static int dn_neigh_seq_open(struct inode *inode, struct file *file)
 {
        struct seq_file *seq;
        int rc = -ENOMEM;
-        struct neigh_seq_state *s = kmalloc(sizeof(*s), GFP_KERNEL);
+        struct neigh_seq_state *s = kzalloc(sizeof(*s), GFP_KERNEL);
        if (!s)
                goto out;
-        memset(s, 0, sizeof(*s));
        rc = seq_open(file, &dn_neigh_seq_ops);
        if (rc)
                goto out_kfree;
diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
index 22f321d9bf9d..6986be754ef2 100644
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -151,10 +151,9 @@ int dn_fib_rtm_newrule(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
                }
        }
-        new_r = kmalloc(sizeof(*new_r), GFP_KERNEL);
+        new_r = kzalloc(sizeof(*new_r), GFP_KERNEL);
        if (!new_r)
                return -ENOMEM;
-        memset(new_r, 0, sizeof(*new_r));
        if (rta[RTA_SRC-1])
                memcpy(&new_r->r_src, RTA_DATA(rta[RTA_SRC-1]), 2);
diff --git a/net/decnet/dn_table.c b/net/decnet/dn_table.c
index 37d9d0a1ac8c..e926c952e363 100644
--- a/net/decnet/dn_table.c
+++ b/net/decnet/dn_table.c
@@ -158,12 +158,10 @@ static void dn_rehash_zone(struct dn_zone *dz)
                        break;
        }
-        ht = kmalloc(new_divisor*sizeof(struct dn_fib_node*), GFP_KERNEL);
+        ht = kcalloc(new_divisor, sizeof(struct dn_fib_node*), GFP_KERNEL);
        if (ht == NULL)
                return;
-        memset(ht, 0, new_divisor*sizeof(struct dn_fib_node *));
        write_lock_bh(&dn_fib_tables_lock);
        old_ht = dz->dz_hash;
        dz->dz_hash = ht;
@@ -184,11 +182,10 @@ static void dn_free_node(struct dn_fib_node *f)
 static struct dn_zone *dn_new_zone(struct dn_hash *table, int z)
 {
        int i;
-        struct dn_zone *dz = kmalloc(sizeof(struct dn_zone), GFP_KERNEL);
+        struct dn_zone *dz = kzalloc(sizeof(struct dn_zone), GFP_KERNEL);
        if (!dz)
                return NULL;
-        memset(dz, 0, sizeof(struct dn_zone));
        if (z) {
                dz->dz_divisor = 16;
                dz->dz_hashmask = 0x0F;
@@ -197,14 +194,12 @@ static struct dn_zone *dn_new_zone(struct dn_hash *table, int z)
                dz->dz_hashmask = 0;
        }
-        dz->dz_hash = kmalloc(dz->dz_divisor*sizeof(struct dn_fib_node *), GFP_KERNEL);
+        dz->dz_hash = kcalloc(dz->dz_divisor, sizeof(struct dn_fib_node *), GFP_KERNEL);
        if (!dz->dz_hash) {
                kfree(dz);
                return NULL;
        }
-        memset(dz->dz_hash, 0, dz->dz_divisor*sizeof(struct dn_fib_node*));
        dz->dz_order = z;
        dz->dz_mask = dnet_make_mask(z);
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 309ae4c6549a..4d66aac13483 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -673,12 +673,11 @@ static int ec_dev_ioctl(struct socket *sock, unsigned int cmd, void __user *arg)
                edev = dev->ec_ptr;
                if (edev == NULL) {
                        /* Magic up a new one. */
-                        edev = kmalloc(sizeof(struct ec_device), GFP_KERNEL);
+                        edev = kzalloc(sizeof(struct ec_device), GFP_KERNEL);
                        if (edev == NULL) {
                                err = -ENOMEM;
                                break;
                        }
-                        memset(edev, 0, sizeof(struct ec_device));
                        dev->ec_ptr = edev;
                } else
                        net2dev_map[edev->net] = NULL;
diff --git a/net/ieee80211/ieee80211_crypt.c b/net/ieee80211/ieee80211_crypt.c
index cb71d794a7d1..5ed0a98b2d76 100644
--- a/net/ieee80211/ieee80211_crypt.c
+++ b/net/ieee80211/ieee80211_crypt.c
@@ -110,11 +110,10 @@ int ieee80211_register_crypto_ops(struct ieee80211_crypto_ops *ops)
        unsigned long flags;
        struct ieee80211_crypto_alg *alg;
-        alg = kmalloc(sizeof(*alg), GFP_KERNEL);
+        alg = kzalloc(sizeof(*alg), GFP_KERNEL);
        if (alg == NULL)
                return -ENOMEM;
-        memset(alg, 0, sizeof(*alg));
        alg->ops = ops;
        spin_lock_irqsave(&ieee80211_crypto_lock, flags);
diff --git a/net/ieee80211/ieee80211_crypt_ccmp.c b/net/ieee80211/ieee80211_crypt_ccmp.c
index 492647382ad0..ed90a8af1444 100644
--- a/net/ieee80211/ieee80211_crypt_ccmp.c
+++ b/net/ieee80211/ieee80211_crypt_ccmp.c
@@ -76,10 +76,9 @@ static void *ieee80211_ccmp_init(int key_idx)
 {
        struct ieee80211_ccmp_data *priv;
-        priv = kmalloc(sizeof(*priv), GFP_ATOMIC);
+        priv = kzalloc(sizeof(*priv), GFP_ATOMIC);
        if (priv == NULL)
                goto fail;
-        memset(priv, 0, sizeof(*priv));
        priv->key_idx = key_idx;
        priv->tfm = crypto_alloc_tfm("aes", 0);
diff --git a/net/ieee80211/ieee80211_crypt_wep.c b/net/ieee80211/ieee80211_crypt_wep.c
index c5a87724aabe..0ebf235f6939 100644
--- a/net/ieee80211/ieee80211_crypt_wep.c
+++ b/net/ieee80211/ieee80211_crypt_wep.c
@@ -39,10 +39,9 @@ static void *prism2_wep_init(int keyidx)
 {
        struct prism2_wep_data *priv;
-        priv = kmalloc(sizeof(*priv), GFP_ATOMIC);
+        priv = kzalloc(sizeof(*priv), GFP_ATOMIC);
        if (priv == NULL)
                goto fail;
-        memset(priv, 0, sizeof(*priv));
        priv->key_idx = keyidx;
        priv->tfm = crypto_alloc_tfm("arc4", 0);
diff --git a/net/ieee80211/ieee80211_wx.c b/net/ieee80211/ieee80211_wx.c
index a78c4f845f66..5cb9cfd35397 100644
--- a/net/ieee80211/ieee80211_wx.c
+++ b/net/ieee80211/ieee80211_wx.c
@@ -369,11 +369,10 @@ int ieee80211_wx_set_encode(struct ieee80211_device *ieee,
                struct ieee80211_crypt_data *new_crypt;
                /* take WEP into use */
-                new_crypt = kmalloc(sizeof(struct ieee80211_crypt_data),
+                new_crypt = kzalloc(sizeof(struct ieee80211_crypt_data),
                                    GFP_KERNEL);
                if (new_crypt == NULL)
                        return -ENOMEM;
-                memset(new_crypt, 0, sizeof(struct ieee80211_crypt_data));
                new_crypt->ops = ieee80211_get_crypto_ops("WEP");
                if (!new_crypt->ops) {
                        request_module("ieee80211_crypt_wep");
@@ -616,13 +615,11 @@ int ieee80211_wx_set_encodeext(struct ieee80211_device *ieee,
                ieee80211_crypt_delayed_deinit(ieee, crypt);
-                new_crypt = (struct ieee80211_crypt_data *)
+                new_crypt = kzalloc(sizeof(*new_crypt), GFP_KERNEL);
-                    kmalloc(sizeof(*new_crypt), GFP_KERNEL);
                if (new_crypt == NULL) {
                        ret = -ENOMEM;
                        goto done;
                }
-                memset(new_crypt, 0, sizeof(struct ieee80211_crypt_data));
                new_crypt->ops = ops;
                if (new_crypt->ops && try_module_get(new_crypt->ops->owner))
                        new_crypt->priv = new_crypt->ops->init(idx);
diff --git a/net/ieee80211/softmac/ieee80211softmac_io.c b/net/ieee80211/softmac/ieee80211softmac_io.c
index 8cc8b20f5cda..6ae5a1dc7956 100644
--- a/net/ieee80211/softmac/ieee80211softmac_io.c
+++ b/net/ieee80211/softmac/ieee80211softmac_io.c
@@ -96,8 +96,7 @@ ieee80211softmac_alloc_mgt(u32 size)
        if(size > IEEE80211_DATA_LEN)
                return NULL;
        /* Allocate the frame */
-        data = kmalloc(size, GFP_ATOMIC);
+        data = kzalloc(size, GFP_ATOMIC);
-        memset(data, 0, size);
        return data;
 }
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 8e748be36c5a..1366bc6ce6a5 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -215,12 +215,10 @@ static int ah_init_state(struct xfrm_state *x)
        if (x->encap)
                goto error;
-        ahp = kmalloc(sizeof(*ahp), GFP_KERNEL);
+        ahp = kzalloc(sizeof(*ahp), GFP_KERNEL);
        if (ahp == NULL)
                return -ENOMEM;
-        memset(ahp, 0, sizeof(*ahp));
        ahp->key = x->aalg->alg_key;
        ahp->key_len = (x->aalg->alg_key_len+7)/8;
        ahp->tfm = crypto_alloc_tfm(x->aalg->alg_name, 0);
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 7b51b3bdb548..c8a3723bc001 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1372,12 +1372,11 @@ static int arp_seq_open(struct inode *inode, struct file *file)
 {
        struct seq_file *seq;
        int rc = -ENOMEM;
-        struct neigh_seq_state *s = kmalloc(sizeof(*s), GFP_KERNEL);
+        struct neigh_seq_state *s = kzalloc(sizeof(*s), GFP_KERNEL);
       
        if (!s)
                goto out;
-        memset(s, 0, sizeof(*s));
        rc = seq_open(file, &arp_seq_ops);
        if (rc)
                goto out_kfree;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index a7c65e9e5ec9..a6cc31d911eb 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -93,10 +93,9 @@ static void devinet_sysctl_unregister(struct ipv4_devconf *p);
 static struct in_ifaddr *inet_alloc_ifa(void)
 {
-        struct in_ifaddr *ifa = kmalloc(sizeof(*ifa), GFP_KERNEL);
+        struct in_ifaddr *ifa = kzalloc(sizeof(*ifa), GFP_KERNEL);
        if (ifa) {
-                memset(ifa, 0, sizeof(*ifa));
                INIT_RCU_HEAD(&ifa->rcu_head);
        }
@@ -140,10 +139,9 @@ struct in_device *inetdev_init(struct net_device *dev)
        ASSERT_RTNL();
-        in_dev = kmalloc(sizeof(*in_dev), GFP_KERNEL);
+        in_dev = kzalloc(sizeof(*in_dev), GFP_KERNEL);
        if (!in_dev)
                goto out;
-        memset(in_dev, 0, sizeof(*in_dev));
        INIT_RCU_HEAD(&in_dev->rcu_head);
        memcpy(&in_dev->cnf, &ipv4_devconf_dflt, sizeof(in_dev->cnf));
        in_dev->cnf.sysctl = NULL;
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 4e112738b3fa..fc2f8ce441de 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -316,12 +316,10 @@ static int esp_init_state(struct xfrm_state *x)
        if (x->ealg == NULL)
                goto error;
-        esp = kmalloc(sizeof(*esp), GFP_KERNEL);
+        esp = kzalloc(sizeof(*esp), GFP_KERNEL);
        if (esp == NULL)
                return -ENOMEM;
-        memset(esp, 0, sizeof(*esp));
        if (x->aalg) {
                struct xfrm_algo_desc *aalg_desc;
diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
index 3c1d32ad35f2..72c633b357cf 100644
--- a/net/ipv4/fib_hash.c
+++ b/net/ipv4/fib_hash.c
@@ -204,11 +204,10 @@ static struct fn_zone *
 fn_new_zone(struct fn_hash *table, int z)
 {
        int i;
-        struct fn_zone *fz = kmalloc(sizeof(struct fn_zone), GFP_KERNEL);
+        struct fn_zone *fz = kzalloc(sizeof(struct fn_zone), GFP_KERNEL);
        if (!fz)
                return NULL;
-        memset(fz, 0, sizeof(struct fn_zone));
        if (z) {
                fz->fz_divisor = 16;
        } else {
@@ -1046,7 +1045,7 @@ static int fib_seq_open(struct inode *inode, struct file *file)
 {
        struct seq_file *seq;
        int rc = -ENOMEM;
-        struct fib_iter_state *s = kmalloc(sizeof(*s), GFP_KERNEL);
+        struct fib_iter_state *s = kzalloc(sizeof(*s), GFP_KERNEL);
       
        if (!s)
                goto out;
@@ -1057,7 +1056,6 @@ static int fib_seq_open(struct inode *inode, struct file *file)
        seq          = file->private_data;
        seq->private = s;
-        memset(s, 0, sizeof(*s));
 out:
        return rc;
 out_kfree:
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 773b12ba4e3c..79b04718bdfd 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -196,10 +196,9 @@ int inet_rtm_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
                }
        }
-        new_r = kmalloc(sizeof(*new_r), GFP_KERNEL);
+        new_r = kzalloc(sizeof(*new_r), GFP_KERNEL);
        if (!new_r)
                return -ENOMEM;
-        memset(new_r, 0, sizeof(*new_r));
        if (rta[RTA_SRC-1])
                memcpy(&new_r->r_src, RTA_DATA(rta[RTA_SRC-1]), 4);
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 5f87533684d5..9be53a8e72c3 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -709,11 +709,10 @@ fib_create_info(const struct rtmsg *r, struct kern_rta *rta,
                        goto failure;
        }
-        fi = kmalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL);
+        fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL);
        if (fi == NULL)
                goto failure;
        fib_info_cnt++;
-        memset(fi, 0, sizeof(*fi)+nhs*sizeof(struct fib_nh));
        fi->fib_protocol = r->rtm_protocol;
@@ -962,10 +961,6 @@ fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
        rtm->rtm_protocol = fi->fib_protocol;
        if (fi->fib_priority)
                RTA_PUT(skb, RTA_PRIORITY, 4, &fi->fib_priority);
-#ifdef CONFIG_NET_CLS_ROUTE
-        if (fi->fib_nh[0].nh_tclassid)
-                RTA_PUT(skb, RTA_FLOW, 4, &fi->fib_nh[0].nh_tclassid);
-#endif
        if (rtnetlink_put_metrics(skb, fi->fib_metrics) < 0)
                goto rtattr_failure;
        if (fi->fib_prefsrc)
@@ -975,6 +970,10 @@ fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
                        RTA_PUT(skb, RTA_GATEWAY, 4, &fi->fib_nh->nh_gw);
                if (fi->fib_nh->nh_oif)
                        RTA_PUT(skb, RTA_OIF, sizeof(int), &fi->fib_nh->nh_oif);
+#ifdef CONFIG_NET_CLS_ROUTE
+                if (fi->fib_nh[0].nh_tclassid)
+                        RTA_PUT(skb, RTA_FLOW, 4, &fi->fib_nh[0].nh_tclassid);
+#endif
        }
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
        if (fi->fib_nhs > 1) {
@@ -993,6 +992,10 @@ fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
                        nhp->rtnh_ifindex = nh->nh_oif;
                        if (nh->nh_gw)
                                RTA_PUT(skb, RTA_GATEWAY, 4, &nh->nh_gw);
+#ifdef CONFIG_NET_CLS_ROUTE
+                        if (nh->nh_tclassid)
+                                RTA_PUT(skb, RTA_FLOW, 4, &nh->nh_tclassid);
+#endif
                        nhp->rtnh_len = skb->tail - (unsigned char*)nhp;
                } endfor_nexthops(fi);
                mp_head->rta_type = RTA_MULTIPATH;
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index d299c8e547d6..9f4b752f5a33 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1028,10 +1028,9 @@ static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im)
         * for deleted items allows change reports to use common code with
         * non-deleted or query-response MCA's.
         */
-        pmc = kmalloc(sizeof(*pmc), GFP_KERNEL);
+        pmc = kzalloc(sizeof(*pmc), GFP_KERNEL);
        if (!pmc)
                return;
-        memset(pmc, 0, sizeof(*pmc));
        spin_lock_bh(&im->lock);
        pmc->interface = im->interface;
        in_dev_hold(in_dev);
@@ -1529,10 +1528,9 @@ static int ip_mc_add1_src(struct ip_mc_list *pmc, int sfmode,
                psf_prev = psf;
        }
        if (!psf) {
-                psf = kmalloc(sizeof(*psf), GFP_ATOMIC);
+                psf = kzalloc(sizeof(*psf), GFP_ATOMIC);
                if (!psf)
                        return -ENOBUFS;
-                memset(psf, 0, sizeof(*psf));
                psf->sf_inaddr = *psfsrc;
                if (psf_prev) {
                        psf_prev->sf_next = psf;
@@ -2380,7 +2378,7 @@ static int igmp_mc_seq_open(struct inode *inode, struct file *file)
 {
        struct seq_file *seq;
        int rc = -ENOMEM;
-        struct igmp_mc_iter_state *s = kmalloc(sizeof(*s), GFP_KERNEL);
+        struct igmp_mc_iter_state *s = kzalloc(sizeof(*s), GFP_KERNEL);
        if (!s)
                goto out;
@@ -2390,7 +2388,6 @@ static int igmp_mc_seq_open(struct inode *inode, struct file *file)
        seq = file->private_data;
        seq->private = s;
-        memset(s, 0, sizeof(*s));
 out:
        return rc;
 out_kfree:
@@ -2555,7 +2552,7 @@ static int igmp_mcf_seq_open(struct inode *inode, struct file *file)
 {
        struct seq_file *seq;
        int rc = -ENOMEM;
-        struct igmp_mcf_iter_state *s = kmalloc(sizeof(*s), GFP_KERNEL);
+        struct igmp_mcf_iter_state *s = kzalloc(sizeof(*s), GFP_KERNEL);
        if (!s)
                goto out;
@@ -2565,7 +2562,6 @@ static int igmp_mcf_seq_open(struct inode *inode, struct file *file)
        seq = file->private_data;
        seq->private = s;
-        memset(s, 0, sizeof(*s));
 out:
        return rc;
 out_kfree:
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 8e7e41b66c79..492858e6faf0 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -909,11 +909,10 @@ static int __init inet_diag_init(void)
                                          sizeof(struct inet_diag_handler *));
        int err = -ENOMEM;
-        inet_diag_table = kmalloc(inet_diag_table_size, GFP_KERNEL);
+        inet_diag_table = kzalloc(inet_diag_table_size, GFP_KERNEL);
        if (!inet_diag_table)
                goto out;
-        memset(inet_diag_table, 0, inet_diag_table_size);
        idiagnl = netlink_kernel_create(NETLINK_INET_DIAG, 0, inet_diag_rcv,
                                        THIS_MODULE);
        if (idiagnl == NULL)
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 6ff9b10d9563..0f9b3a31997b 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -617,7 +617,6 @@ static int ipgre_rcv(struct sk_buff *skb)
                skb->mac.raw = skb->nh.raw;
                skb->nh.raw = __pskb_pull(skb, offset);
                skb_postpull_rcsum(skb, skb->h.raw, offset);
-                memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
                skb->pkt_type = PACKET_HOST;
 #ifdef CONFIG_NET_IPGRE_BROADCAST
                if (MULTICAST(iph->daddr)) {
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index cbcae6544622..406056edc02b 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -256,7 +256,6 @@ int ip_options_compile(struct ip_options * opt, struct sk_buff * skb)
        if (!opt) {
                opt = &(IPCB(skb)->opt);
-                memset(opt, 0, sizeof(struct ip_options));
                iph = skb->nh.raw;
                opt->optlen = ((struct iphdr *)iph)->ihl*4 - sizeof(struct iphdr);
                optptr = iph + sizeof(struct iphdr);
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 8a8b5cf2f7fe..a0c28b2b756e 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -410,11 +410,10 @@ static int ipcomp_init_state(struct xfrm_state *x)
                goto out;
        err = -ENOMEM;
-        ipcd = kmalloc(sizeof(*ipcd), GFP_KERNEL);
+        ipcd = kzalloc(sizeof(*ipcd), GFP_KERNEL);
        if (!ipcd)
                goto out;
-        memset(ipcd, 0, sizeof(*ipcd));
        x->props.header_len = 0;
        if (x->props.mode)
                x->props.header_len += sizeof(struct iphdr);
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 3291d5192aad..76ab50b0d6ef 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -487,7 +487,6 @@ static int ipip_rcv(struct sk_buff *skb)
                skb->mac.raw = skb->nh.raw;
                skb->nh.raw = skb->data;
-                memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
                skb->protocol = htons(ETH_P_IP);
                skb->pkt_type = PACKET_HOST;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index ba33f8621c67..9ccacf57f08b 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1461,7 +1461,6 @@ int pim_rcv_v1(struct sk_buff * skb)
        skb_pull(skb, (u8*)encap - skb->data);
        skb->nh.iph = (struct iphdr *)skb->data;
        skb->dev = reg_dev;
-        memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
        skb->protocol = htons(ETH_P_IP);
        skb->ip_summed = 0;
        skb->pkt_type = PACKET_HOST;
@@ -1517,7 +1516,6 @@ static int pim_rcv(struct sk_buff * skb)
        skb_pull(skb, (u8*)encap - skb->data);
        skb->nh.iph = (struct iphdr *)skb->data;
        skb->dev = reg_dev;
-        memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
        skb->protocol = htons(ETH_P_IP);
        skb->ip_summed = 0;
        skb->pkt_type = PACKET_HOST;
diff --git a/net/ipv4/ipvs/ip_vs_ctl.c b/net/ipv4/ipvs/ip_vs_ctl.c
index f28ec6882162..6a28fafe910c 100644
--- a/net/ipv4/ipvs/ip_vs_ctl.c
+++ b/net/ipv4/ipvs/ip_vs_ctl.c
@@ -735,12 +735,11 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest,
        if (atype != RTN_LOCAL && atype != RTN_UNICAST)
                return -EINVAL;
-        dest = kmalloc(sizeof(struct ip_vs_dest), GFP_ATOMIC);
+        dest = kzalloc(sizeof(struct ip_vs_dest), GFP_ATOMIC);
        if (dest == NULL) {
                IP_VS_ERR("ip_vs_new_dest: kmalloc failed.\n");
                return -ENOMEM;
        }
-        memset(dest, 0, sizeof(struct ip_vs_dest));
        dest->protocol = svc->protocol;
        dest->vaddr = svc->addr;
@@ -1050,14 +1049,12 @@ ip_vs_add_service(struct ip_vs_service_user *u, struct ip_vs_service **svc_p)
                goto out_mod_dec;
        }
-        svc = (struct ip_vs_service *)
+        svc = kzalloc(sizeof(struct ip_vs_service), GFP_ATOMIC);
-                kmalloc(sizeof(struct ip_vs_service), GFP_ATOMIC);
        if (svc == NULL) {
                IP_VS_DBG(1, "ip_vs_add_service: kmalloc failed.\n");
                ret = -ENOMEM;
                goto out_err;
        }
-        memset(svc, 0, sizeof(struct ip_vs_service));
        /* I'm the first user of the service */
        atomic_set(&svc->usecnt, 1);
@@ -1797,7 +1794,7 @@ static int ip_vs_info_open(struct inode *inode, struct file *file)
 {
        struct seq_file *seq;
        int rc = -ENOMEM;
-        struct ip_vs_iter *s = kmalloc(sizeof(*s), GFP_KERNEL);
+        struct ip_vs_iter *s = kzalloc(sizeof(*s), GFP_KERNEL);
        if (!s)
                goto out;
@@ -1808,7 +1805,6 @@ static int ip_vs_info_open(struct inode *inode, struct file *file)
        seq          = file->private_data;
        seq->private = s;
-        memset(s, 0, sizeof(*s));
 out:
        return rc;
 out_kfree:
diff --git a/net/ipv4/ipvs/ip_vs_est.c b/net/ipv4/ipvs/ip_vs_est.c
index 4c1940381ba0..7d68b80c4c19 100644
--- a/net/ipv4/ipvs/ip_vs_est.c
+++ b/net/ipv4/ipvs/ip_vs_est.c
@@ -123,11 +123,10 @@ int ip_vs_new_estimator(struct ip_vs_stats *stats)
 {
        struct ip_vs_estimator *est;
-        est = kmalloc(sizeof(*est), GFP_KERNEL);
+        est = kzalloc(sizeof(*est), GFP_KERNEL);
        if (est == NULL)
                return -ENOMEM;
-        memset(est, 0, sizeof(*est));
        est->stats = stats;
        est->last_conns = stats->conns;
        est->cps = stats->cps<<10;
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index cbffeae3f565..d994c5f5744c 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -172,11 +172,10 @@ clusterip_config_init(struct ipt_clusterip_tgt_info *i, u_int32_t ip,
        struct clusterip_config *c;
        char buffer[16];
-        c = kmalloc(sizeof(*c), GFP_ATOMIC);
+        c = kzalloc(sizeof(*c), GFP_ATOMIC);
        if (!c)
                return NULL;
-        memset(c, 0, sizeof(*c));
        c->dev = dev;
        c->clusterip = ip;
        memcpy(&c->clustermac, &i->clustermac, ETH_ALEN);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a891133f00e4..f6f39e814291 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1640,10 +1640,9 @@ static int tcp_seq_open(struct inode *inode, struct file *file)
        if (unlikely(afinfo == NULL))
                return -EINVAL;
-        s = kmalloc(sizeof(*s), GFP_KERNEL);
+        s = kzalloc(sizeof(*s), GFP_KERNEL);
        if (!s)
                return -ENOMEM;
-        memset(s, 0, sizeof(*s));
        s->family               = afinfo->family;
        s->seq_ops.start        = tcp_seq_start;
        s->seq_ops.next         = tcp_seq_next;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 9bfcddad695b..f136cec96d95 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1468,11 +1468,10 @@ static int udp_seq_open(struct inode *inode, struct file *file)
        struct udp_seq_afinfo *afinfo = PDE(inode)->data;
        struct seq_file *seq;
        int rc = -ENOMEM;
-        struct udp_iter_state *s = kmalloc(sizeof(*s), GFP_KERNEL);
+        struct udp_iter_state *s = kzalloc(sizeof(*s), GFP_KERNEL);
        if (!s)
                goto out;
-        memset(s, 0, sizeof(*s));
        s->family               = afinfo->family;
        s->seq_ops.start        = udp_seq_start;
        s->seq_ops.next         = udp_seq_next;
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index f8d880beb12f..13cafbe56ce3 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -92,7 +92,6 @@ static int xfrm4_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
        skb->mac.raw = memmove(skb->data - skb->mac_len,
                               skb->mac.raw, skb->mac_len);
        skb->nh.raw = skb->data;
-        memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
        err = 0;
 out:
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index bc77c0e1a943..84d7ebdb9d21 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -567,10 +567,9 @@ static inline struct ipv6_txoptions *create_tel(__u8 encap_limit)
        int opt_len = sizeof(*opt) + 8;
-        if (!(opt = kmalloc(opt_len, GFP_ATOMIC))) {
+        if (!(opt = kzalloc(opt_len, GFP_ATOMIC))) {
                return NULL;
        }
-        memset(opt, 0, opt_len);
        opt->tot_len = opt_len;
        opt->dst0opt = (struct ipv6_opt_hdr *) (opt + 1);
        opt->opt_nflen = 8;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index c56aeece2bf5..836eecd7e62b 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -380,7 +380,6 @@ static int ipip6_rcv(struct sk_buff *skb)
                secpath_reset(skb);
                skb->mac.raw = skb->nh.raw;
                skb->nh.raw = skb->data;
-                memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
                IPCB(skb)->flags = 0;
                skb->protocol = htons(ETH_P_IPV6);
                skb->pkt_type = PACKET_HOST;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 7fae48a53bff..17699eeb64d7 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -308,7 +308,7 @@ static void irda_connect_response(struct irda_sock *self)
        IRDA_ASSERT(self != NULL, return;);
-        skb = dev_alloc_skb(64);
+        skb = alloc_skb(64, GFP_ATOMIC);
        if (skb == NULL) {
                IRDA_DEBUG(0, "%s() Unable to allocate sk_buff!\n",
                           __FUNCTION__);
diff --git a/net/irda/ircomm/ircomm_core.c b/net/irda/ircomm/ircomm_core.c
index 9c4a902a9dba..ad6b6af3dd97 100644
--- a/net/irda/ircomm/ircomm_core.c
+++ b/net/irda/ircomm/ircomm_core.c
@@ -115,12 +115,10 @@ struct ircomm_cb *ircomm_open(notify_t *notify, __u8 service_type, int line)
        IRDA_ASSERT(ircomm != NULL, return NULL;);
-        self = kmalloc(sizeof(struct ircomm_cb), GFP_ATOMIC);
+        self = kzalloc(sizeof(struct ircomm_cb), GFP_ATOMIC);
        if (self == NULL)
                return NULL;
-        memset(self, 0, sizeof(struct ircomm_cb));
        self->notify = *notify;
        self->magic = IRCOMM_MAGIC;
diff --git a/net/irda/ircomm/ircomm_lmp.c b/net/irda/ircomm/ircomm_lmp.c
index d9097207aed3..959874b6451f 100644
--- a/net/irda/ircomm/ircomm_lmp.c
+++ b/net/irda/ircomm/ircomm_lmp.c
@@ -81,7 +81,7 @@ static int ircomm_lmp_connect_response(struct ircomm_cb *self,
        
        /* Any userdata supplied? */
        if (userdata == NULL) {
-                tx_skb = dev_alloc_skb(64);
+                tx_skb = alloc_skb(64, GFP_ATOMIC);
                if (!tx_skb)
                        return -ENOMEM;
@@ -115,7 +115,7 @@ static int ircomm_lmp_disconnect_request(struct ircomm_cb *self,
        IRDA_DEBUG(0, "%s()\n", __FUNCTION__ );
        if (!userdata) {
-                tx_skb = dev_alloc_skb(64);
+                tx_skb = alloc_skb(64, GFP_ATOMIC);
                if (!tx_skb)
                        return -ENOMEM;
                
diff --git a/net/irda/ircomm/ircomm_param.c b/net/irda/ircomm/ircomm_param.c
index 6009bab05091..a39f5735a90b 100644
--- a/net/irda/ircomm/ircomm_param.c
+++ b/net/irda/ircomm/ircomm_param.c
@@ -121,7 +121,7 @@ int ircomm_param_request(struct ircomm_tty_cb *self, __u8 pi, int flush)
        skb = self->ctrl_skb;   
        if (!skb) {
-                skb = dev_alloc_skb(256);
+                skb = alloc_skb(256, GFP_ATOMIC);
                if (!skb) {
                        spin_unlock_irqrestore(&self->spinlock, flags);
                        return -ENOMEM;
diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
index b400f27851fc..3bcdb467efc5 100644
--- a/net/irda/ircomm/ircomm_tty.c
+++ b/net/irda/ircomm/ircomm_tty.c
@@ -379,12 +379,11 @@ static int ircomm_tty_open(struct tty_struct *tty, struct file *filp)
        self = hashbin_lock_find(ircomm_tty, line, NULL);
        if (!self) {
                /* No, so make new instance */
-                self = kmalloc(sizeof(struct ircomm_tty_cb), GFP_KERNEL);
+                self = kzalloc(sizeof(struct ircomm_tty_cb), GFP_KERNEL);
                if (self == NULL) {
                        IRDA_ERROR("%s(), kmalloc failed!\n", __FUNCTION__);
                        return -ENOMEM;
                }
-                memset(self, 0, sizeof(struct ircomm_tty_cb));
                
                self->magic = IRCOMM_TTY_MAGIC;
                self->flow = FLOW_STOP;
@@ -759,8 +758,9 @@ static int ircomm_tty_write(struct tty_struct *tty,
                        }
                } else {
                        /* Prepare a full sized frame */
-                        skb = dev_alloc_skb(self->max_data_size+
+                        skb = alloc_skb(self->max_data_size+
-                                            self->max_header_size);
+                                        self->max_header_size,
+                                        GFP_ATOMIC);
                        if (!skb) {
                                spin_unlock_irqrestore(&self->spinlock, flags);
                                return -ENOBUFS;
diff --git a/net/irda/irda_device.c b/net/irda/irda_device.c
index ba40e5495f58..7e7a31798d8d 100644
--- a/net/irda/irda_device.c
+++ b/net/irda/irda_device.c
@@ -401,12 +401,10 @@ dongle_t *irda_device_dongle_init(struct net_device *dev, int type)
        }
        /* Allocate dongle info for this instance */
-        dongle = kmalloc(sizeof(dongle_t), GFP_KERNEL);
+        dongle = kzalloc(sizeof(dongle_t), GFP_KERNEL);
        if (!dongle)
                goto out;
-        memset(dongle, 0, sizeof(dongle_t));
        /* Bind the registration info to this particular instance */
        dongle->issue = reg;
        dongle->dev = dev;
diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index a0472652a44e..61128aa05b40 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -345,7 +345,7 @@ static void iriap_disconnect_request(struct iriap_cb *self)
        IRDA_ASSERT(self != NULL, return;);
        IRDA_ASSERT(self->magic == IAS_MAGIC, return;);
-        tx_skb = dev_alloc_skb(64);
+        tx_skb = alloc_skb(64, GFP_ATOMIC);
        if (tx_skb == NULL) {
                IRDA_DEBUG(0, "%s(), Could not allocate an sk_buff of length %d\n", 
                        __FUNCTION__, 64);
@@ -396,7 +396,7 @@ int iriap_getvaluebyclass_request(struct iriap_cb *self,
        attr_len = strlen(attr);        /* Up to IAS_MAX_ATTRIBNAME = 60 */
        skb_len = self->max_header_size+2+name_len+1+attr_len+4;
-        tx_skb = dev_alloc_skb(skb_len);
+        tx_skb = alloc_skb(skb_len, GFP_ATOMIC);
        if (!tx_skb)
                return -ENOMEM;
@@ -562,7 +562,8 @@ static void iriap_getvaluebyclass_response(struct iriap_cb *self,
         *  value. We add 32 bytes because of the 6 bytes for the frame and
         *  max 5 bytes for the value coding.
         */
-        tx_skb = dev_alloc_skb(value->len + self->max_header_size + 32);
+        tx_skb = alloc_skb(value->len + self->max_header_size + 32,
+                           GFP_ATOMIC);
        if (!tx_skb)
                return;
@@ -700,7 +701,7 @@ void iriap_send_ack(struct iriap_cb *self)
        IRDA_ASSERT(self != NULL, return;);
        IRDA_ASSERT(self->magic == IAS_MAGIC, return;);
-        tx_skb = dev_alloc_skb(64);
+        tx_skb = alloc_skb(64, GFP_ATOMIC);
        if (!tx_skb)
                return;
diff --git a/net/irda/iriap_event.c b/net/irda/iriap_event.c
index a73607450de1..da17395df05a 100644
--- a/net/irda/iriap_event.c
+++ b/net/irda/iriap_event.c
@@ -365,7 +365,7 @@ static void state_r_disconnect(struct iriap_cb *self, IRIAP_EVENT event,
        switch (event) {
        case IAP_LM_CONNECT_INDICATION:
-                tx_skb = dev_alloc_skb(64);
+                tx_skb = alloc_skb(64, GFP_ATOMIC);
                if (tx_skb == NULL) {
                        IRDA_WARNING("%s: unable to malloc!\n", __FUNCTION__);
                        return;
diff --git a/net/irda/irias_object.c b/net/irda/irias_object.c
index 82e665c79991..a154b1d71c0f 100644
--- a/net/irda/irias_object.c
+++ b/net/irda/irias_object.c
@@ -82,13 +82,12 @@ struct ias_object *irias_new_object( char *name, int id)
        IRDA_DEBUG( 4, "%s()\n", __FUNCTION__);
-        obj = kmalloc(sizeof(struct ias_object), GFP_ATOMIC);
+        obj = kzalloc(sizeof(struct ias_object), GFP_ATOMIC);
        if (obj == NULL) {
                IRDA_WARNING("%s(), Unable to allocate object!\n",
                             __FUNCTION__);
                return NULL;
        }
-        memset(obj, 0, sizeof( struct ias_object));
        obj->magic = IAS_OBJECT_MAGIC;
        obj->name = strndup(name, IAS_MAX_CLASSNAME);
@@ -346,13 +345,12 @@ void irias_add_integer_attrib(struct ias_object *obj, char *name, int value,
        IRDA_ASSERT(obj->magic == IAS_OBJECT_MAGIC, return;);
        IRDA_ASSERT(name != NULL, return;);
-        attrib = kmalloc(sizeof(struct ias_attrib), GFP_ATOMIC);
+        attrib = kzalloc(sizeof(struct ias_attrib), GFP_ATOMIC);
        if (attrib == NULL) {
                IRDA_WARNING("%s: Unable to allocate attribute!\n",
                             __FUNCTION__);
                return;
        }
-        memset(attrib, 0, sizeof( struct ias_attrib));
        attrib->magic = IAS_ATTRIB_MAGIC;
        attrib->name = strndup(name, IAS_MAX_ATTRIBNAME);
@@ -382,13 +380,12 @@ void irias_add_octseq_attrib(struct ias_object *obj, char *name, __u8 *octets,
        IRDA_ASSERT(name != NULL, return;);
        IRDA_ASSERT(octets != NULL, return;);
-        attrib = kmalloc(sizeof(struct ias_attrib), GFP_ATOMIC);
+        attrib = kzalloc(sizeof(struct ias_attrib), GFP_ATOMIC);
        if (attrib == NULL) {
                IRDA_WARNING("%s: Unable to allocate attribute!\n",
                             __FUNCTION__);
                return;
        }
-        memset(attrib, 0, sizeof( struct ias_attrib));
        attrib->magic = IAS_ATTRIB_MAGIC;
        attrib->name = strndup(name, IAS_MAX_ATTRIBNAME);
@@ -416,13 +413,12 @@ void irias_add_string_attrib(struct ias_object *obj, char *name, char *value,
        IRDA_ASSERT(name != NULL, return;);
        IRDA_ASSERT(value != NULL, return;);
-        attrib = kmalloc(sizeof( struct ias_attrib), GFP_ATOMIC);
+        attrib = kzalloc(sizeof( struct ias_attrib), GFP_ATOMIC);
        if (attrib == NULL) {
                IRDA_WARNING("%s: Unable to allocate attribute!\n",
                             __FUNCTION__);
                return;
        }
-        memset(attrib, 0, sizeof( struct ias_attrib));
        attrib->magic = IAS_ATTRIB_MAGIC;
        attrib->name = strndup(name, IAS_MAX_ATTRIBNAME);
@@ -443,12 +439,11 @@ struct ias_value *irias_new_integer_value(int integer)
 {
        struct ias_value *value;
-        value = kmalloc(sizeof(struct ias_value), GFP_ATOMIC);
+        value = kzalloc(sizeof(struct ias_value), GFP_ATOMIC);
        if (value == NULL) {
                IRDA_WARNING("%s: Unable to kmalloc!\n", __FUNCTION__);
                return NULL;
        }
-        memset(value, 0, sizeof(struct ias_value));
        value->type = IAS_INTEGER;
        value->len = 4;
@@ -469,12 +464,11 @@ struct ias_value *irias_new_string_value(char *string)
 {
        struct ias_value *value;
-        value = kmalloc(sizeof(struct ias_value), GFP_ATOMIC);
+        value = kzalloc(sizeof(struct ias_value), GFP_ATOMIC);
        if (value == NULL) {
                IRDA_WARNING("%s: Unable to kmalloc!\n", __FUNCTION__);
                return NULL;
        }
-        memset( value, 0, sizeof( struct ias_value));
        value->type = IAS_STRING;
        value->charset = CS_ASCII;
@@ -495,12 +489,11 @@ struct ias_value *irias_new_octseq_value(__u8 *octseq , int len)
 {
        struct ias_value *value;
-        value = kmalloc(sizeof(struct ias_value), GFP_ATOMIC);
+        value = kzalloc(sizeof(struct ias_value), GFP_ATOMIC);
        if (value == NULL) {
                IRDA_WARNING("%s: Unable to kmalloc!\n", __FUNCTION__);
                return NULL;
        }
-        memset(value, 0, sizeof(struct ias_value));
        value->type = IAS_OCT_SEQ;
        /* Check length */
@@ -522,12 +515,11 @@ struct ias_value *irias_new_missing_value(void)
 {
        struct ias_value *value;
-        value = kmalloc(sizeof(struct ias_value), GFP_ATOMIC);
+        value = kzalloc(sizeof(struct ias_value), GFP_ATOMIC);
        if (value == NULL) {
                IRDA_WARNING("%s: Unable to kmalloc!\n", __FUNCTION__);
                return NULL;
        }
-        memset(value, 0, sizeof(struct ias_value));
        value->type = IAS_MISSING;
        value->len = 0;
diff --git a/net/irda/irlan/irlan_common.c b/net/irda/irlan/irlan_common.c
index bd659dd545ac..7dd0a2fe1d20 100644
--- a/net/irda/irlan/irlan_common.c
+++ b/net/irda/irlan/irlan_common.c
@@ -636,7 +636,7 @@ void irlan_get_provider_info(struct irlan_cb *self)
        IRDA_ASSERT(self != NULL, return;);
        IRDA_ASSERT(self->magic == IRLAN_MAGIC, return;);
-        skb = dev_alloc_skb(64);
+        skb = alloc_skb(64, GFP_ATOMIC);
        if (!skb)
                return;
@@ -668,7 +668,7 @@ void irlan_open_data_channel(struct irlan_cb *self)
        IRDA_ASSERT(self != NULL, return;);
        IRDA_ASSERT(self->magic == IRLAN_MAGIC, return;);
        
-        skb = dev_alloc_skb(64);
+        skb = alloc_skb(64, GFP_ATOMIC);
        if (!skb)
                return;
@@ -704,7 +704,7 @@ void irlan_close_data_channel(struct irlan_cb *self)
        if (self->client.tsap_ctrl == NULL)
                return;
-        skb = dev_alloc_skb(64);
+        skb = alloc_skb(64, GFP_ATOMIC);
        if (!skb)
                return;
@@ -739,7 +739,7 @@ static void irlan_open_unicast_addr(struct irlan_cb *self)
        IRDA_ASSERT(self != NULL, return;);
        IRDA_ASSERT(self->magic == IRLAN_MAGIC, return;);       
        
-        skb = dev_alloc_skb(128);
+        skb = alloc_skb(128, GFP_ATOMIC);
        if (!skb)
                return;
@@ -777,7 +777,7 @@ void irlan_set_broadcast_filter(struct irlan_cb *self, int status)
        IRDA_ASSERT(self != NULL, return;);
        IRDA_ASSERT(self->magic == IRLAN_MAGIC, return;);
        
-        skb = dev_alloc_skb(128);
+        skb = alloc_skb(128, GFP_ATOMIC);
        if (!skb)
                return;
@@ -816,7 +816,7 @@ void irlan_set_multicast_filter(struct irlan_cb *self, int status)
        IRDA_ASSERT(self != NULL, return;);
        IRDA_ASSERT(self->magic == IRLAN_MAGIC, return;);
-        skb = dev_alloc_skb(128);
+        skb = alloc_skb(128, GFP_ATOMIC);
        if (!skb)
                return;
        
@@ -856,7 +856,7 @@ static void irlan_get_unicast_addr(struct irlan_cb *self)
        IRDA_ASSERT(self != NULL, return;);
        IRDA_ASSERT(self->magic == IRLAN_MAGIC, return;);
        
-        skb = dev_alloc_skb(128);
+        skb = alloc_skb(128, GFP_ATOMIC);
        if (!skb)
                return;
@@ -891,7 +891,7 @@ void irlan_get_media_char(struct irlan_cb *self)
        IRDA_ASSERT(self != NULL, return;);
        IRDA_ASSERT(self->magic == IRLAN_MAGIC, return;);
        
-        skb = dev_alloc_skb(64);
+        skb = alloc_skb(64, GFP_ATOMIC);
        if (!skb)
                return;
diff --git a/net/irda/irlan/irlan_provider.c b/net/irda/irlan/irlan_provider.c
index 39c202d1c374..9c0df86044d7 100644
--- a/net/irda/irlan/irlan_provider.c
+++ b/net/irda/irlan/irlan_provider.c
@@ -296,7 +296,7 @@ void irlan_provider_send_reply(struct irlan_cb *self, int command,
        IRDA_ASSERT(self != NULL, return;);
        IRDA_ASSERT(self->magic == IRLAN_MAGIC, return;);
-        skb = dev_alloc_skb(128);
+        skb = alloc_skb(128, GFP_ATOMIC);
        if (!skb)
                return;
diff --git a/net/irda/irlap.c b/net/irda/irlap.c
index cade355ac8af..e7852a07495e 100644
--- a/net/irda/irlap.c
+++ b/net/irda/irlap.c
@@ -116,11 +116,10 @@ struct irlap_cb *irlap_open(struct net_device *dev, struct qos_info *qos,
        IRDA_DEBUG(4, "%s()\n", __FUNCTION__);
        /* Initialize the irlap structure. */
-        self = kmalloc(sizeof(struct irlap_cb), GFP_KERNEL);
+        self = kzalloc(sizeof(struct irlap_cb), GFP_KERNEL);
        if (self == NULL)
                return NULL;
-        memset(self, 0, sizeof(struct irlap_cb));
        self->magic = LAP_MAGIC;
        /* Make a binding between the layers */
@@ -882,7 +881,7 @@ static void irlap_change_speed(struct irlap_cb *self, __u32 speed, int now)
        /* Change speed now, or just piggyback speed on frames */
        if (now) {
                /* Send down empty frame to trigger speed change */
-                skb = dev_alloc_skb(0);
+                skb = alloc_skb(0, GFP_ATOMIC);
                if (skb)
                        irlap_queue_xmit(self, skb);
        }
@@ -1222,7 +1221,7 @@ static int irlap_seq_open(struct inode *inode, struct file *file)
 {
        struct seq_file *seq;
        int rc = -ENOMEM;
-        struct irlap_iter_state *s = kmalloc(sizeof(*s), GFP_KERNEL);
+        struct irlap_iter_state *s = kzalloc(sizeof(*s), GFP_KERNEL);
       
        if (!s)
                goto out;
@@ -1238,7 +1237,6 @@ static int irlap_seq_open(struct inode *inode, struct file *file)
        seq          = file->private_data;
        seq->private = s;
-        memset(s, 0, sizeof(*s));
 out:
        return rc;
 out_kfree:
diff --git a/net/irda/irlap_frame.c b/net/irda/irlap_frame.c
index 3e9a06abbdd0..ccb983bf0f4a 100644
--- a/net/irda/irlap_frame.c
+++ b/net/irda/irlap_frame.c
@@ -117,7 +117,7 @@ void irlap_send_snrm_frame(struct irlap_cb *self, struct qos_info *qos)
        IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
        /* Allocate frame */
-        tx_skb = dev_alloc_skb(64);
+        tx_skb = alloc_skb(64, GFP_ATOMIC);
        if (!tx_skb)
                return;
@@ -210,7 +210,7 @@ void irlap_send_ua_response_frame(struct irlap_cb *self, struct qos_info *qos)
        IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
        /* Allocate frame */
-        tx_skb = dev_alloc_skb(64);
+        tx_skb = alloc_skb(64, GFP_ATOMIC);
        if (!tx_skb)
                return;
@@ -250,7 +250,7 @@ void irlap_send_dm_frame( struct irlap_cb *self)
        IRDA_ASSERT(self != NULL, return;);
        IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
-        tx_skb = dev_alloc_skb(32);
+        tx_skb = alloc_skb(32, GFP_ATOMIC);
        if (!tx_skb)
                return;
@@ -282,7 +282,7 @@ void irlap_send_disc_frame(struct irlap_cb *self)
        IRDA_ASSERT(self != NULL, return;);
        IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
-        tx_skb = dev_alloc_skb(16);
+        tx_skb = alloc_skb(16, GFP_ATOMIC);
        if (!tx_skb)
                return;
@@ -315,7 +315,7 @@ void irlap_send_discovery_xid_frame(struct irlap_cb *self, int S, __u8 s,
        IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
        IRDA_ASSERT(discovery != NULL, return;);
-        tx_skb = dev_alloc_skb(64);
+        tx_skb = alloc_skb(64, GFP_ATOMIC);
        if (!tx_skb)
                return;
@@ -422,11 +422,10 @@ static void irlap_recv_discovery_xid_rsp(struct irlap_cb *self,
                return;
        }
-        if ((discovery = kmalloc(sizeof(discovery_t), GFP_ATOMIC)) == NULL) {
+        if ((discovery = kzalloc(sizeof(discovery_t), GFP_ATOMIC)) == NULL) {
                IRDA_WARNING("%s: kmalloc failed!\n", __FUNCTION__);
                return;
        }
-        memset(discovery, 0, sizeof(discovery_t));
        discovery->data.daddr = info->daddr;
        discovery->data.saddr = self->saddr;
@@ -576,7 +575,7 @@ void irlap_send_rr_frame(struct irlap_cb *self, int command)
        struct sk_buff *tx_skb;
        __u8 *frame;
-        tx_skb = dev_alloc_skb(16);
+        tx_skb = alloc_skb(16, GFP_ATOMIC);
        if (!tx_skb)
                return;
@@ -601,7 +600,7 @@ void irlap_send_rd_frame(struct irlap_cb *self)
        struct sk_buff *tx_skb;
        __u8 *frame;
-        tx_skb = dev_alloc_skb(16);
+        tx_skb = alloc_skb(16, GFP_ATOMIC);
        if (!tx_skb)
                return;
@@ -1215,7 +1214,7 @@ void irlap_send_test_frame(struct irlap_cb *self, __u8 caddr, __u32 daddr,
        struct test_frame *frame;
        __u8 *info;
-        tx_skb = dev_alloc_skb(cmd->len+sizeof(struct test_frame));
+        tx_skb = alloc_skb(cmd->len+sizeof(struct test_frame), GFP_ATOMIC);
        if (!tx_skb)
                return;
diff --git a/net/irda/irlmp.c b/net/irda/irlmp.c
index 129ad64c15bb..c440913dee14 100644
--- a/net/irda/irlmp.c
+++ b/net/irda/irlmp.c
@@ -78,10 +78,9 @@ int __init irlmp_init(void)
 {
        IRDA_DEBUG(1, "%s()\n", __FUNCTION__);
        /* Initialize the irlmp structure. */
-        irlmp = kmalloc( sizeof(struct irlmp_cb), GFP_KERNEL);
+        irlmp = kzalloc( sizeof(struct irlmp_cb), GFP_KERNEL);
        if (irlmp == NULL)
                return -ENOMEM;
-        memset(irlmp, 0, sizeof(struct irlmp_cb));
        irlmp->magic = LMP_MAGIC;
@@ -160,12 +159,11 @@ struct lsap_cb *irlmp_open_lsap(__u8 slsap_sel, notify_t *notify, __u8 pid)
                return NULL;
        /* Allocate new instance of a LSAP connection */
-        self = kmalloc(sizeof(struct lsap_cb), GFP_ATOMIC);
+        self = kzalloc(sizeof(struct lsap_cb), GFP_ATOMIC);
        if (self == NULL) {
                IRDA_ERROR("%s: can't allocate memory\n", __FUNCTION__);
                return NULL;
        }
-        memset(self, 0, sizeof(struct lsap_cb));
        self->magic = LMP_LSAP_MAGIC;
        self->slsap_sel = slsap_sel;
@@ -288,12 +286,11 @@ void irlmp_register_link(struct irlap_cb *irlap, __u32 saddr, notify_t *notify)
        /*
         *  Allocate new instance of a LSAP connection
         */
-        lap = kmalloc(sizeof(struct lap_cb), GFP_KERNEL);
+        lap = kzalloc(sizeof(struct lap_cb), GFP_KERNEL);
        if (lap == NULL) {
                IRDA_ERROR("%s: unable to kmalloc\n", __FUNCTION__);
                return;
        }
-        memset(lap, 0, sizeof(struct lap_cb));
        lap->irlap = irlap;
        lap->magic = LMP_LAP_MAGIC;
@@ -395,7 +392,7 @@ int irlmp_connect_request(struct lsap_cb *self, __u8 dlsap_sel,
        /* Any userdata? */
        if (tx_skb == NULL) {
-                tx_skb = dev_alloc_skb(64);
+                tx_skb = alloc_skb(64, GFP_ATOMIC);
                if (!tx_skb)
                        return -ENOMEM;
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index e53bf9e0053e..a1e502ff9070 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -476,11 +476,10 @@ dev_irnet_open(struct inode *	inode,
 #endif /* SECURE_DEVIRNET */
  /* Allocate a private structure for this IrNET instance */
-  ap = kmalloc(sizeof(*ap), GFP_KERNEL);
+  ap = kzalloc(sizeof(*ap), GFP_KERNEL);
  DABORT(ap == NULL, -ENOMEM, FS_ERROR, "Can't allocate struct irnet...\n");
  /* initialize the irnet structure */
-  memset(ap, 0, sizeof(*ap));
  ap->file = file;
  /* PPP channel setup */
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index 49c51c5f1a86..42acf1cde737 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -85,10 +85,9 @@ static pi_param_info_t param_info = { pi_major_call_table, 1, 0x0f, 4 };
 */
 int __init irttp_init(void)
 {
-        irttp = kmalloc(sizeof(struct irttp_cb), GFP_KERNEL);
+        irttp = kzalloc(sizeof(struct irttp_cb), GFP_KERNEL);
        if (irttp == NULL)
                return -ENOMEM;
-        memset(irttp, 0, sizeof(struct irttp_cb));
        irttp->magic = TTP_MAGIC;
@@ -306,7 +305,8 @@ static inline void irttp_fragment_skb(struct tsap_cb *self,
                IRDA_DEBUG(2, "%s(), fragmenting ...\n", __FUNCTION__);
                /* Make new segment */
-                frag = dev_alloc_skb(self->max_seg_size+self->max_header_size);
+                frag = alloc_skb(self->max_seg_size+self->max_header_size,
+                                 GFP_ATOMIC);
                if (!frag)
                        return;
@@ -389,12 +389,11 @@ struct tsap_cb *irttp_open_tsap(__u8 stsap_sel, int credit, notify_t *notify)
                return NULL;
        }
-        self = kmalloc(sizeof(struct tsap_cb), GFP_ATOMIC);
+        self = kzalloc(sizeof(struct tsap_cb), GFP_ATOMIC);
        if (self == NULL) {
                IRDA_DEBUG(0, "%s(), unable to kmalloc!\n", __FUNCTION__);
                return NULL;
        }
-        memset(self, 0, sizeof(struct tsap_cb));
        spin_lock_init(&self->lock);
        /* Initialise todo timer */
@@ -805,7 +804,7 @@ static inline void irttp_give_credit(struct tsap_cb *self)
                   self->send_credit, self->avail_credit, self->remote_credit);
        /* Give credit to peer */
-        tx_skb = dev_alloc_skb(64);
+        tx_skb = alloc_skb(64, GFP_ATOMIC);
        if (!tx_skb)
                return;
@@ -1094,7 +1093,7 @@ int irttp_connect_request(struct tsap_cb *self, __u8 dtsap_sel,
        /* Any userdata supplied? */
        if (userdata == NULL) {
-                tx_skb = dev_alloc_skb(64);
+                tx_skb = alloc_skb(64, GFP_ATOMIC);
                if (!tx_skb)
                        return -ENOMEM;
@@ -1342,7 +1341,7 @@ int irttp_connect_response(struct tsap_cb *self, __u32 max_sdu_size,
        /* Any userdata supplied? */
        if (userdata == NULL) {
-                tx_skb = dev_alloc_skb(64);
+                tx_skb = alloc_skb(64, GFP_ATOMIC);
                if (!tx_skb)
                        return -ENOMEM;
@@ -1541,7 +1540,7 @@ int irttp_disconnect_request(struct tsap_cb *self, struct sk_buff *userdata,
        if (!userdata) {
                struct sk_buff *tx_skb;
-                tx_skb = dev_alloc_skb(64);
+                tx_skb = alloc_skb(64, GFP_ATOMIC);
                if (!tx_skb)
                        return -ENOMEM;
@@ -1876,7 +1875,7 @@ static int irttp_seq_open(struct inode *inode, struct file *file)
        int rc = -ENOMEM;
        struct irttp_iter_state *s;
-        s = kmalloc(sizeof(*s), GFP_KERNEL);
+        s = kzalloc(sizeof(*s), GFP_KERNEL);
        if (!s)
                goto out;
@@ -1886,7 +1885,6 @@ static int irttp_seq_open(struct inode *inode, struct file *file)
        seq          = file->private_data;
        seq->private = s;
-        memset(s, 0, sizeof(*s));
 out:
        return rc;
 out_kfree:
diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
index aea6616cea3d..d504eed416f6 100644
--- a/net/lapb/lapb_iface.c
+++ b/net/lapb/lapb_iface.c
@@ -115,14 +115,12 @@ static struct lapb_cb *lapb_devtostruct(struct net_device *dev)
 */
 static struct lapb_cb *lapb_create_cb(void)
 {
-        struct lapb_cb *lapb = kmalloc(sizeof(*lapb), GFP_ATOMIC);
+        struct lapb_cb *lapb = kzalloc(sizeof(*lapb), GFP_ATOMIC);
        if (!lapb)
                goto out;
-        memset(lapb, 0x00, sizeof(*lapb));
        skb_queue_head_init(&lapb->write_queue);
        skb_queue_head_init(&lapb->ack_queue);
diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
index bd242a49514a..d12413cff5bd 100644
--- a/net/llc/llc_core.c
+++ b/net/llc/llc_core.c
@@ -33,10 +33,9 @@ unsigned char llc_station_mac_sa[ETH_ALEN];
 */
 static struct llc_sap *llc_sap_alloc(void)
 {
-        struct llc_sap *sap = kmalloc(sizeof(*sap), GFP_ATOMIC);
+        struct llc_sap *sap = kzalloc(sizeof(*sap), GFP_ATOMIC);
        if (sap) {
-                memset(sap, 0, sizeof(*sap));
                sap->state = LLC_SAP_STATE_ACTIVE;
                memcpy(sap->laddr.mac, llc_station_mac_sa, ETH_ALEN);
                rwlock_init(&sap->sk_list.lock);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 55c0adc8f115..b85c1f9f1288 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -562,10 +562,9 @@ static int netlink_alloc_groups(struct sock *sk)
        if (err)
                return err;
-        nlk->groups = kmalloc(NLGRPSZ(groups), GFP_KERNEL);
+        nlk->groups = kzalloc(NLGRPSZ(groups), GFP_KERNEL);
        if (nlk->groups == NULL)
                return -ENOMEM;
-        memset(nlk->groups, 0, NLGRPSZ(groups));
        nlk->ngroups = groups;
        return 0;
 }
@@ -1393,11 +1392,10 @@ int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
        struct sock *sk;
        struct netlink_sock *nlk;
-        cb = kmalloc(sizeof(*cb), GFP_KERNEL);
+        cb = kzalloc(sizeof(*cb), GFP_KERNEL);
        if (cb == NULL)
                return -ENOBUFS;
-        memset(cb, 0, sizeof(*cb));
        cb->dump = dump;
        cb->done = done;
        cb->nlh = nlh;
@@ -1668,7 +1666,7 @@ static int netlink_seq_open(struct inode *inode, struct file *file)
        struct nl_seq_iter *iter;
        int err;
-        iter = kmalloc(sizeof(*iter), GFP_KERNEL);
+        iter = kzalloc(sizeof(*iter), GFP_KERNEL);
        if (!iter)
                return -ENOMEM;
@@ -1678,7 +1676,6 @@ static int netlink_seq_open(struct inode *inode, struct file *file)
                return err;
        }
-        memset(iter, 0, sizeof(*iter));
        seq = file->private_data;
        seq->private = iter;
        return 0;
@@ -1747,15 +1744,13 @@ static int __init netlink_proto_init(void)
        if (sizeof(struct netlink_skb_parms) > sizeof(dummy_skb->cb))
                netlink_skb_parms_too_large();
-        nl_table = kmalloc(sizeof(*nl_table) * MAX_LINKS, GFP_KERNEL);
+        nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL);
        if (!nl_table) {
 enomem:
                printk(KERN_CRIT "netlink_init: Cannot allocate nl_table\n");
                return -ENOMEM;
        }
-        memset(nl_table, 0, sizeof(*nl_table) * MAX_LINKS);
        if (num_physpages >= (128 * 1024))
                max = num_physpages >> (21 - PAGE_SHIFT);
        else
diff --git a/net/rxrpc/connection.c b/net/rxrpc/connection.c
index 573b572f8f91..93d2c55ad2d5 100644
--- a/net/rxrpc/connection.c
+++ b/net/rxrpc/connection.c
@@ -58,13 +58,12 @@ static inline int __rxrpc_create_connection(struct rxrpc_peer *peer,
        _enter("%p",peer);
        /* allocate and initialise a connection record */
-        conn = kmalloc(sizeof(struct rxrpc_connection), GFP_KERNEL);
+        conn = kzalloc(sizeof(struct rxrpc_connection), GFP_KERNEL);
        if (!conn) {
                _leave(" = -ENOMEM");
                return -ENOMEM;
        }
-        memset(conn, 0, sizeof(struct rxrpc_connection));
        atomic_set(&conn->usage, 1);
        INIT_LIST_HEAD(&conn->link);
@@ -535,13 +534,12 @@ int rxrpc_conn_newmsg(struct rxrpc_connection *conn,
                return -EINVAL;
        }
-        msg = kmalloc(sizeof(struct rxrpc_message), alloc_flags);
+        msg = kzalloc(sizeof(struct rxrpc_message), alloc_flags);
        if (!msg) {
                _leave(" = -ENOMEM");
                return -ENOMEM;
        }
-        memset(msg, 0, sizeof(*msg));
        atomic_set(&msg->usage, 1);
        INIT_LIST_HEAD(&msg->link);
diff --git a/net/rxrpc/peer.c b/net/rxrpc/peer.c
index ed38f5b17c1b..8a275157a3bb 100644
--- a/net/rxrpc/peer.c
+++ b/net/rxrpc/peer.c
@@ -58,13 +58,12 @@ static int __rxrpc_create_peer(struct rxrpc_transport *trans, __be32 addr,
        _enter("%p,%08x", trans, ntohl(addr));
        /* allocate and initialise a peer record */
-        peer = kmalloc(sizeof(struct rxrpc_peer), GFP_KERNEL);
+        peer = kzalloc(sizeof(struct rxrpc_peer), GFP_KERNEL);
        if (!peer) {
                _leave(" = -ENOMEM");
                return -ENOMEM;
        }
-        memset(peer, 0, sizeof(struct rxrpc_peer));
        atomic_set(&peer->usage, 1);
        INIT_LIST_HEAD(&peer->link);
diff --git a/net/rxrpc/transport.c b/net/rxrpc/transport.c
index dbe6105e83a5..465efc86fccf 100644
--- a/net/rxrpc/transport.c
+++ b/net/rxrpc/transport.c
@@ -68,11 +68,10 @@ int rxrpc_create_transport(unsigned short port,
        _enter("%hu", port);
-        trans = kmalloc(sizeof(struct rxrpc_transport), GFP_KERNEL);
+        trans = kzalloc(sizeof(struct rxrpc_transport), GFP_KERNEL);
        if (!trans)
                return -ENOMEM;
-        memset(trans, 0, sizeof(struct rxrpc_transport));
        atomic_set(&trans->usage, 1);
        INIT_LIST_HEAD(&trans->services);
        INIT_LIST_HEAD(&trans->link);
@@ -312,13 +311,12 @@ static int rxrpc_incoming_msg(struct rxrpc_transport *trans,
        _enter("");
-        msg = kmalloc(sizeof(struct rxrpc_message), GFP_KERNEL);
+        msg = kzalloc(sizeof(struct rxrpc_message), GFP_KERNEL);
        if (!msg) {
                _leave(" = -ENOMEM");
                return -ENOMEM;
        }
-        memset(msg, 0, sizeof(*msg));
        atomic_set(&msg->usage, 1);
        list_add_tail(&msg->link,msgq);
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 9affeeedf107..a2587b52e531 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -312,10 +312,9 @@ struct tc_action *tcf_action_init_1(struct rtattr *rta, struct rtattr *est,
        }
        *err = -ENOMEM;
-        a = kmalloc(sizeof(*a), GFP_KERNEL);
+        a = kzalloc(sizeof(*a), GFP_KERNEL);
        if (a == NULL)
                goto err_mod;
-        memset(a, 0, sizeof(*a));
        /* backward compatibility for policer */
        if (name == NULL)
@@ -492,10 +491,9 @@ tcf_action_get_1(struct rtattr *rta, struct nlmsghdr *n, u32 pid, int *err)
        index = *(int *)RTA_DATA(tb[TCA_ACT_INDEX - 1]);
        *err = -ENOMEM;
-        a = kmalloc(sizeof(struct tc_action), GFP_KERNEL);
+        a = kzalloc(sizeof(struct tc_action), GFP_KERNEL);
        if (a == NULL)
                return NULL;
-        memset(a, 0, sizeof(struct tc_action));
        *err = -EINVAL;
        a->ops = tc_lookup_action(tb[TCA_ACT_KIND - 1]);
@@ -531,12 +529,11 @@ static struct tc_action *create_a(int i)
 {
        struct tc_action *act;
-        act = kmalloc(sizeof(*act), GFP_KERNEL);
+        act = kzalloc(sizeof(*act), GFP_KERNEL);
        if (act == NULL) {
                printk("create_a: failed to alloc!\n");
                return NULL;
        }
-        memset(act, 0, sizeof(*act));
        act->order = i;
        return act;
 }
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 58b3a8652042..f257475e0e0c 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -209,10 +209,9 @@ tcf_pedit_dump(struct sk_buff *skb, struct tc_action *a,int bind, int ref)
        s = sizeof(*opt) + p->nkeys * sizeof(struct tc_pedit_key);
        /* netlink spinlocks held above us - must use ATOMIC */
-        opt = kmalloc(s, GFP_ATOMIC);
+        opt = kzalloc(s, GFP_ATOMIC);
        if (opt == NULL)
                return -ENOBUFS;
-        memset(opt, 0, s);
        memcpy(opt->keys, p->keys, p->nkeys * sizeof(struct tc_pedit_key));
        opt->index = p->index;
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 47e00bd9625e..da905d7b4b40 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -196,10 +196,9 @@ static int tcf_act_police_locate(struct rtattr *rta, struct rtattr *est,
                return ret;
        }
-        p = kmalloc(sizeof(*p), GFP_KERNEL);
+        p = kzalloc(sizeof(*p), GFP_KERNEL);
        if (p == NULL)
                return -ENOMEM;
-        memset(p, 0, sizeof(*p));
        ret = ACT_P_CREATED;
        p->refcnt = 1;
@@ -429,11 +428,10 @@ struct tcf_police * tcf_police_locate(struct rtattr *rta, struct rtattr *est)
                return p;
        }
-        p = kmalloc(sizeof(*p), GFP_KERNEL);
+        p = kzalloc(sizeof(*p), GFP_KERNEL);
        if (p == NULL)
                return NULL;
-        memset(p, 0, sizeof(*p));
        p->refcnt = 1;
        spin_lock_init(&p->lock);
        p->stats_lock = &p->lock;
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index 61507f006b11..86cac49a0531 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -178,19 +178,17 @@ static int basic_change(struct tcf_proto *tp, unsigned long base, u32 handle,
        err = -ENOBUFS;
        if (head == NULL) {
-                head = kmalloc(sizeof(*head), GFP_KERNEL);
+                head = kzalloc(sizeof(*head), GFP_KERNEL);
                if (head == NULL)
                        goto errout;
-                memset(head, 0, sizeof(*head));
                INIT_LIST_HEAD(&head->flist);
                tp->root = head;
        }
-        f = kmalloc(sizeof(*f), GFP_KERNEL);
+        f = kzalloc(sizeof(*f), GFP_KERNEL);
        if (f == NULL)
                goto errout;
-        memset(f, 0, sizeof(*f));
        err = -EINVAL;
        if (handle)
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index d41de91fc4f6..e6973d9b686d 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -267,20 +267,18 @@ static int fw_change(struct tcf_proto *tp, unsigned long base,
                return -EINVAL;
        if (head == NULL) {
-                head = kmalloc(sizeof(struct fw_head), GFP_KERNEL);
+                head = kzalloc(sizeof(struct fw_head), GFP_KERNEL);
                if (head == NULL)
                        return -ENOBUFS;
-                memset(head, 0, sizeof(*head));
                tcf_tree_lock(tp);
                tp->root = head;
                tcf_tree_unlock(tp);
        }
-        f = kmalloc(sizeof(struct fw_filter), GFP_KERNEL);
+        f = kzalloc(sizeof(struct fw_filter), GFP_KERNEL);
        if (f == NULL)
                return -ENOBUFS;
-        memset(f, 0, sizeof(*f));
        f->id = handle;
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index c2e71900f7bd..d3aea730d4c8 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -396,10 +396,9 @@ static int route4_set_parms(struct tcf_proto *tp, unsigned long base,
        h1 = to_hash(nhandle);
        if ((b = head->table[h1]) == NULL) {
                err = -ENOBUFS;
-                b = kmalloc(sizeof(struct route4_bucket), GFP_KERNEL);
+                b = kzalloc(sizeof(struct route4_bucket), GFP_KERNEL);
                if (b == NULL)
                        goto errout;
-                memset(b, 0, sizeof(*b));
                tcf_tree_lock(tp);
                head->table[h1] = b;
@@ -475,20 +474,18 @@ static int route4_change(struct tcf_proto *tp, unsigned long base,
        err = -ENOBUFS;
        if (head == NULL) {
-                head = kmalloc(sizeof(struct route4_head), GFP_KERNEL);
+                head = kzalloc(sizeof(struct route4_head), GFP_KERNEL);
                if (head == NULL)
                        goto errout;
-                memset(head, 0, sizeof(struct route4_head));
                tcf_tree_lock(tp);
                tp->root = head;
                tcf_tree_unlock(tp);
        }
-        f = kmalloc(sizeof(struct route4_filter), GFP_KERNEL);
+        f = kzalloc(sizeof(struct route4_filter), GFP_KERNEL);
        if (f == NULL)
                goto errout;
-        memset(f, 0, sizeof(*f));
        err = route4_set_parms(tp, base, f, handle, head, tb,
                tca[TCA_RATE-1], 1);
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index ba8741971629..6e230ecfba05 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -240,9 +240,8 @@ static int rsvp_init(struct tcf_proto *tp)
 {
        struct rsvp_head *data;
-        data = kmalloc(sizeof(struct rsvp_head), GFP_KERNEL);
+        data = kzalloc(sizeof(struct rsvp_head), GFP_KERNEL);
        if (data) {
-                memset(data, 0, sizeof(struct rsvp_head));
                tp->root = data;
                return 0;
        }
@@ -446,11 +445,10 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base,
                goto errout2;
        err = -ENOBUFS;
-        f = kmalloc(sizeof(struct rsvp_filter), GFP_KERNEL);
+        f = kzalloc(sizeof(struct rsvp_filter), GFP_KERNEL);
        if (f == NULL)
                goto errout2;
-        memset(f, 0, sizeof(*f));
        h2 = 16;
        if (tb[TCA_RSVP_SRC-1]) {
                err = -EINVAL;
@@ -532,10 +530,9 @@ insert:
        /* No session found. Create new one. */
        err = -ENOBUFS;
-        s = kmalloc(sizeof(struct rsvp_session), GFP_KERNEL);
+        s = kzalloc(sizeof(struct rsvp_session), GFP_KERNEL);
        if (s == NULL)
                goto errout;
-        memset(s, 0, sizeof(*s));
        memcpy(s->dst, dst, sizeof(s->dst));
        if (pinfo) {
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index 7870e7bb0bac..5af8a59e1503 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -148,11 +148,10 @@ static int tcindex_init(struct tcf_proto *tp)
        struct tcindex_data *p;
        DPRINTK("tcindex_init(tp %p)\n",tp);
-        p = kmalloc(sizeof(struct tcindex_data),GFP_KERNEL);
+        p = kzalloc(sizeof(struct tcindex_data),GFP_KERNEL);
        if (!p)
                return -ENOMEM;
-        memset(p, 0, sizeof(*p));
        p->mask = 0xffff;
        p->hash = DEFAULT_HASH_SIZE;
        p->fall_through = 1;
@@ -296,16 +295,14 @@ tcindex_set_parms(struct tcf_proto *tp, unsigned long base, u32 handle,
        err = -ENOMEM;
        if (!cp.perfect && !cp.h) {
                if (valid_perfect_hash(&cp)) {
-                        cp.perfect = kmalloc(cp.hash * sizeof(*r), GFP_KERNEL);
+                        cp.perfect = kcalloc(cp.hash, sizeof(*r), GFP_KERNEL);
                        if (!cp.perfect)
                                goto errout;
-                        memset(cp.perfect, 0, cp.hash * sizeof(*r));
                        balloc = 1;
                } else {
-                        cp.h = kmalloc(cp.hash * sizeof(f), GFP_KERNEL);
+                        cp.h = kcalloc(cp.hash, sizeof(f), GFP_KERNEL);
                        if (!cp.h)
                                goto errout;
-                        memset(cp.h, 0, cp.hash * sizeof(f));
                        balloc = 2;
                }
        }
@@ -316,10 +313,9 @@ tcindex_set_parms(struct tcf_proto *tp, unsigned long base, u32 handle,
                r = tcindex_lookup(&cp, handle) ? : &new_filter_result;
        if (r == &new_filter_result) {
-                f = kmalloc(sizeof(*f), GFP_KERNEL);
+                f = kzalloc(sizeof(*f), GFP_KERNEL);
                if (!f)
                        goto errout_alloc;
-                memset(f, 0, sizeof(*f));
        }
        if (tb[TCA_TCINDEX_CLASSID-1]) {
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index d712edcd1bcf..eea366966740 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -307,23 +307,21 @@ static int u32_init(struct tcf_proto *tp)
                if (tp_c->q == tp->q)
                        break;
-        root_ht = kmalloc(sizeof(*root_ht), GFP_KERNEL);
+        root_ht = kzalloc(sizeof(*root_ht), GFP_KERNEL);
        if (root_ht == NULL)
                return -ENOBUFS;
-        memset(root_ht, 0, sizeof(*root_ht));
        root_ht->divisor = 0;
        root_ht->refcnt++;
        root_ht->handle = tp_c ? gen_new_htid(tp_c) : 0x80000000;
        root_ht->prio = tp->prio;
        if (tp_c == NULL) {
-                tp_c = kmalloc(sizeof(*tp_c), GFP_KERNEL);
+                tp_c = kzalloc(sizeof(*tp_c), GFP_KERNEL);
                if (tp_c == NULL) {
                        kfree(root_ht);
                        return -ENOBUFS;
                }
-                memset(tp_c, 0, sizeof(*tp_c));
                tp_c->q = tp->q;
                tp_c->next = u32_list;
                u32_list = tp_c;
@@ -571,10 +569,9 @@ static int u32_change(struct tcf_proto *tp, unsigned long base, u32 handle,
                        if (handle == 0)
                                return -ENOMEM;
                }
-                ht = kmalloc(sizeof(*ht) + divisor*sizeof(void*), GFP_KERNEL);
+                ht = kzalloc(sizeof(*ht) + divisor*sizeof(void*), GFP_KERNEL);
                if (ht == NULL)
                        return -ENOBUFS;
-                memset(ht, 0, sizeof(*ht) + divisor*sizeof(void*));
                ht->tp_c = tp_c;
                ht->refcnt = 0;
                ht->divisor = divisor;
@@ -617,18 +614,16 @@ static int u32_change(struct tcf_proto *tp, unsigned long base, u32 handle,
        s = RTA_DATA(tb[TCA_U32_SEL-1]);
-        n = kmalloc(sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key), GFP_KERNEL);
+        n = kzalloc(sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key), GFP_KERNEL);
        if (n == NULL)
                return -ENOBUFS;
-        memset(n, 0, sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key));
 #ifdef CONFIG_CLS_U32_PERF
-        n->pf = kmalloc(sizeof(struct tc_u32_pcnt) + s->nkeys*sizeof(u64), GFP_KERNEL);
+        n->pf = kzalloc(sizeof(struct tc_u32_pcnt) + s->nkeys*sizeof(u64), GFP_KERNEL);
        if (n->pf == NULL) {
                kfree(n);
                return -ENOBUFS;
        }
-        memset(n->pf, 0, sizeof(struct tc_u32_pcnt) + s->nkeys*sizeof(u64));
 #endif
        memcpy(&n->sel, s, sizeof(*s) + s->nkeys*sizeof(struct tc_u32_key));
diff --git a/net/sched/em_meta.c b/net/sched/em_meta.c
index 698372954f4d..61e3b740ab1a 100644
--- a/net/sched/em_meta.c
+++ b/net/sched/em_meta.c
@@ -773,10 +773,9 @@ static int em_meta_change(struct tcf_proto *tp, void *data, int len,
            TCF_META_ID(hdr->right.kind) > TCF_META_ID_MAX)
                goto errout;
-        meta = kmalloc(sizeof(*meta), GFP_KERNEL);
+        meta = kzalloc(sizeof(*meta), GFP_KERNEL);
        if (meta == NULL)
                goto errout;
-        memset(meta, 0, sizeof(*meta));
        memcpy(&meta->lvalue.hdr, &hdr->left, sizeof(hdr->left));
        memcpy(&meta->rvalue.hdr, &hdr->right, sizeof(hdr->right));
diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index 2405a86093a2..0fd0768a17c6 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -321,10 +321,9 @@ int tcf_em_tree_validate(struct tcf_proto *tp, struct rtattr *rta,
        list_len = RTA_PAYLOAD(rt_list);
        matches_len = tree_hdr->nmatches * sizeof(*em);
-        tree->matches = kmalloc(matches_len, GFP_KERNEL);
+        tree->matches = kzalloc(matches_len, GFP_KERNEL);
        if (tree->matches == NULL)
                goto errout;
-        memset(tree->matches, 0, matches_len);
        /* We do not use rtattr_parse_nested here because the maximum
         * number of attributes is unknown. This saves us the allocation
diff --git a/net/sched/estimator.c b/net/sched/estimator.c
index 5d3ae03e22a7..0ebc98e9be2d 100644
--- a/net/sched/estimator.c
+++ b/net/sched/estimator.c
@@ -139,11 +139,10 @@ int qdisc_new_estimator(struct tc_stats *stats, spinlock_t *stats_lock, struct r
        if (parm->interval < -2 || parm->interval > 3)
                return -EINVAL;
-        est = kmalloc(sizeof(*est), GFP_KERNEL);
+        est = kzalloc(sizeof(*est), GFP_KERNEL);
        if (est == NULL)
                return -ENOBUFS;
-        memset(est, 0, sizeof(*est));
        est->interval = parm->interval + 2;
        est->stats = stats;
        est->stats_lock = stats_lock;
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 80b7f6a8d008..bac881bfe362 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1926,10 +1926,9 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct rtattr **t
        }
        err = -ENOBUFS;
-        cl = kmalloc(sizeof(*cl), GFP_KERNEL);
+        cl = kzalloc(sizeof(*cl), GFP_KERNEL);
        if (cl == NULL)
                goto failure;
-        memset(cl, 0, sizeof(*cl));
        cl->R_tab = rtab;
        rtab = NULL;
        cl->refcnt = 1;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index d735f51686a1..0834c2ee9174 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -432,10 +432,9 @@ struct Qdisc *qdisc_alloc(struct net_device *dev, struct Qdisc_ops *ops)
        size = QDISC_ALIGN(sizeof(*sch));
        size += ops->priv_size + (QDISC_ALIGNTO - 1);
-        p = kmalloc(size, GFP_KERNEL);
+        p = kzalloc(size, GFP_KERNEL);
        if (!p)
                goto errout;
-        memset(p, 0, size);
        sch = (struct Qdisc *) QDISC_ALIGN((unsigned long) p);
        sch->padded = (char *) sch - (char *) p;
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index 0cafdd5feb1b..18e81a8ffb01 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -406,10 +406,9 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp,
        struct gred_sched_data *q;
        if (table->tab[dp] == NULL) {
-                table->tab[dp] = kmalloc(sizeof(*q), GFP_KERNEL);
+                table->tab[dp] = kzalloc(sizeof(*q), GFP_KERNEL);
                if (table->tab[dp] == NULL)
                        return -ENOMEM;
-                memset(table->tab[dp], 0, sizeof(*q));
        }
        q = table->tab[dp];
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 6b1b4a981e88..6a6735a2ed35 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1123,10 +1123,9 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
        if (rsc == NULL && fsc == NULL)
                return -EINVAL;
-        cl = kmalloc(sizeof(struct hfsc_class), GFP_KERNEL);
+        cl = kzalloc(sizeof(struct hfsc_class), GFP_KERNEL);
        if (cl == NULL)
                return -ENOBUFS;
-        memset(cl, 0, sizeof(struct hfsc_class));
        if (rsc != NULL)
                hfsc_change_rsc(cl, rsc, 0);
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index cc5f339e6f91..880a3394a51f 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1559,10 +1559,9 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                        goto failure;
                }
                err = -ENOBUFS;
-                if ((cl = kmalloc(sizeof(*cl), GFP_KERNEL)) == NULL)
+                if ((cl = kzalloc(sizeof(*cl), GFP_KERNEL)) == NULL)
                        goto failure;
                
-                memset(cl, 0, sizeof(*cl));
                cl->refcnt = 1;
                INIT_LIST_HEAD(&cl->sibling);
                INIT_LIST_HEAD(&cl->hlist);
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index c5bd8064e6d8..a08ec4c7c55d 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -148,7 +148,8 @@ static long tabledist(unsigned long mu, long sigma,
 static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
        struct netem_sched_data *q = qdisc_priv(sch);
-        struct netem_skb_cb *cb = (struct netem_skb_cb *)skb->cb;
+        /* We don't fill cb now as skb_unshare() may invalidate it */
+        struct netem_skb_cb *cb;
        struct sk_buff *skb2;
        int ret;
        int count = 1;
@@ -200,6 +201,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                skb->data[net_random() % skb_headlen(skb)] ^= 1<<(net_random() % 8);
        }
+        cb = (struct netem_skb_cb *)skb->cb;
        if (q->gap == 0                 /* not doing reordering */
            || q->counter < q->gap      /* inside last reordering gap */
            || q->reorder < get_crandom(&q->reorder_cor)) {
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 9d05e13e92f6..27329ce9c311 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -441,7 +441,8 @@ void sctp_assoc_set_primary(struct sctp_association *asoc,
        /* If the primary path is changing, assume that the
         * user wants to use this new path.
         */
-        if (transport->state != SCTP_INACTIVE)
+        if ((transport->state == SCTP_ACTIVE) ||
+            (transport->state == SCTP_UNKNOWN))
                asoc->peer.active_path = transport;
        /*
@@ -532,11 +533,11 @@ struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,
        port = addr->v4.sin_port;
        SCTP_DEBUG_PRINTK_IPADDR("sctp_assoc_add_peer:association %p addr: ",
-                                 " port: %d state:%s\n",
+                                 " port: %d state:%d\n",
                                 asoc,
                                 addr,
                                 addr->v4.sin_port,
-                                 peer_state == SCTP_UNKNOWN?"UNKNOWN":"ACTIVE");
+                                 peer_state);
        /* Set the port if it has not been set yet.  */
        if (0 == asoc->peer.port)
@@ -545,9 +546,12 @@ struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,
        /* Check to see if this is a duplicate. */
        peer = sctp_assoc_lookup_paddr(asoc, addr);
        if (peer) {
-                if (peer_state == SCTP_ACTIVE &&
+                if (peer->state == SCTP_UNKNOWN) {
-                    peer->state == SCTP_UNKNOWN)
+                        if (peer_state == SCTP_ACTIVE)
-                     peer->state = SCTP_ACTIVE;
+                                peer->state = SCTP_ACTIVE;
+                        if (peer_state == SCTP_UNCONFIRMED)
+                                peer->state = SCTP_UNCONFIRMED;
+                }
                return peer;
        }
@@ -739,7 +743,8 @@ void sctp_assoc_control_transport(struct sctp_association *asoc,
        list_for_each(pos, &asoc->peer.transport_addr_list) {
                t = list_entry(pos, struct sctp_transport, transports);
-                if (t->state == SCTP_INACTIVE)
+                if ((t->state == SCTP_INACTIVE) ||
+                    (t->state == SCTP_UNCONFIRMED))
                        continue;
                if (!first || t->last_time_heard > first->last_time_heard) {
                        second = first;
@@ -759,7 +764,8 @@ void sctp_assoc_control_transport(struct sctp_association *asoc,
         * [If the primary is active but not most recent, bump the most
         * recently used transport.]
         */
-        if (asoc->peer.primary_path->state != SCTP_INACTIVE &&
+        if (((asoc->peer.primary_path->state == SCTP_ACTIVE) ||
+             (asoc->peer.primary_path->state == SCTP_UNKNOWN)) &&
            first != asoc->peer.primary_path) {
                second = first;
                first = asoc->peer.primary_path;
@@ -1054,7 +1060,7 @@ void sctp_assoc_update(struct sctp_association *asoc,
                                           transports);
                        if (!sctp_assoc_lookup_paddr(asoc, &trans->ipaddr))
                                sctp_assoc_add_peer(asoc, &trans->ipaddr,
-                                                    GFP_ATOMIC, SCTP_ACTIVE);
+                                                    GFP_ATOMIC, trans->state);
                }
                asoc->ctsn_ack_point = asoc->next_tsn - 1;
@@ -1094,7 +1100,8 @@ void sctp_assoc_update_retran_path(struct sctp_association *asoc)
                /* Try to find an active transport. */
-                if (t->state != SCTP_INACTIVE) {
+                if ((t->state == SCTP_ACTIVE) ||
+                    (t->state == SCTP_UNKNOWN)) {
                        break;
                } else {
                        /* Keep track of the next transport in case
diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
index 2b962627f631..2b9c12a170e5 100644
--- a/net/sctp/bind_addr.c
+++ b/net/sctp/bind_addr.c
@@ -146,7 +146,7 @@ void sctp_bind_addr_free(struct sctp_bind_addr *bp)
 /* Add an address to the bind address list in the SCTP_bind_addr structure. */
 int sctp_add_bind_addr(struct sctp_bind_addr *bp, union sctp_addr *new,
-                       gfp_t gfp)
+                       __u8 use_as_src, gfp_t gfp)
 {
        struct sctp_sockaddr_entry *addr;
@@ -163,6 +163,8 @@ int sctp_add_bind_addr(struct sctp_bind_addr *bp, union sctp_addr *new,
        if (!addr->a.v4.sin_port)
                addr->a.v4.sin_port = bp->port;
+        addr->use_as_src = use_as_src;
        INIT_LIST_HEAD(&addr->list);
        list_add_tail(&addr->list, &bp->address_list);
        SCTP_DBG_OBJCNT_INC(addr);
@@ -274,7 +276,7 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list,
                }
                af->from_addr_param(&addr, rawaddr, port, 0);
-                retval = sctp_add_bind_addr(bp, &addr, gfp);
+                retval = sctp_add_bind_addr(bp, &addr, 1, gfp);
                if (retval) {
                        /* Can't finish building the list, clean up. */
                        sctp_bind_addr_clean(bp);
@@ -367,7 +369,7 @@ static int sctp_copy_one_addr(struct sctp_bind_addr *dest,
                    (((AF_INET6 == addr->sa.sa_family) &&
                      (flags & SCTP_ADDR6_ALLOWED) &&
                      (flags & SCTP_ADDR6_PEERSUPP))))
-                        error = sctp_add_bind_addr(dest, addr, gfp);
+                        error = sctp_add_bind_addr(dest, addr, 1, gfp);
        }
        return error;
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 67bd53070ee0..ffda1d680529 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -158,6 +158,12 @@ void sctp_endpoint_add_asoc(struct sctp_endpoint *ep,
 void sctp_endpoint_free(struct sctp_endpoint *ep)
 {
        ep->base.dead = 1;
+        ep->base.sk->sk_state = SCTP_SS_CLOSED;
+        /* Unlink this endpoint, so we can't find it again! */
+        sctp_unhash_endpoint(ep);
        sctp_endpoint_put(ep);
 }
@@ -166,11 +172,6 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
 {
        SCTP_ASSERT(ep->base.dead, "Endpoint is not dead", return);
-        ep->base.sk->sk_state = SCTP_SS_CLOSED;
-        /* Unlink this endpoint, so we can't find it again! */
-        sctp_unhash_endpoint(ep);
        /* Free up the HMAC transform. */
        sctp_crypto_free_tfm(sctp_sk(ep->base.sk)->hmac);
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 8ef08070c8b6..99c0cefc04e0 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -290,7 +290,8 @@ static void sctp_v6_get_saddr(struct sctp_association *asoc,
        sctp_read_lock(addr_lock);
        list_for_each(pos, &bp->address_list) {
                laddr = list_entry(pos, struct sctp_sockaddr_entry, list);
-                if ((laddr->a.sa.sa_family == AF_INET6) &&
+                if ((laddr->use_as_src) &&
+                    (laddr->a.sa.sa_family == AF_INET6) &&
                    (scope <= sctp_scope(&laddr->a))) {
                        bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a);
                        if (!baddr || (matchlen < bmatchlen)) {
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index e5faa351aaad..30b710c54e64 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -691,7 +691,8 @@ int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                if (!new_transport) {
                        new_transport = asoc->peer.active_path;
-                } else if (new_transport->state == SCTP_INACTIVE) {
+                } else if ((new_transport->state == SCTP_INACTIVE) ||
+                           (new_transport->state == SCTP_UNCONFIRMED)) {
                        /* If the chunk is Heartbeat or Heartbeat Ack,
                         * send it to chunk->transport, even if it's
                         * inactive.
@@ -848,7 +849,8 @@ int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                         */
                        new_transport = chunk->transport;
                        if (!new_transport ||
-                            new_transport->state == SCTP_INACTIVE)
+                            ((new_transport->state == SCTP_INACTIVE) ||
+                             (new_transport->state == SCTP_UNCONFIRMED)))
                                new_transport = asoc->peer.active_path;
                        /* Change packets if necessary.  */
@@ -1464,7 +1466,8 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                        /* Mark the destination transport address as
                         * active if it is not so marked.
                         */
-                        if (transport->state == SCTP_INACTIVE) {
+                        if ((transport->state == SCTP_INACTIVE) ||
+                            (transport->state == SCTP_UNCONFIRMED)) {
                                sctp_assoc_control_transport(
                                        transport->asoc,
                                        transport,
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 816c033d7886..1ab03a27a76e 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -240,7 +240,7 @@ int sctp_copy_local_addr_list(struct sctp_bind_addr *bp, sctp_scope_t scope,
                            (((AF_INET6 == addr->a.sa.sa_family) &&
                              (copy_flags & SCTP_ADDR6_ALLOWED) &&
                              (copy_flags & SCTP_ADDR6_PEERSUPP)))) {
-                                error = sctp_add_bind_addr(bp, &addr->a, 
+                                error = sctp_add_bind_addr(bp, &addr->a, 1,
                                                           GFP_ATOMIC);
                                if (error)
                                        goto end_copy;
@@ -486,6 +486,8 @@ static struct dst_entry *sctp_v4_get_dst(struct sctp_association *asoc,
                list_for_each(pos, &bp->address_list) {
                        laddr = list_entry(pos, struct sctp_sockaddr_entry,
                                           list);
+                        if (!laddr->use_as_src)
+                                continue;
                        sctp_v4_dst_saddr(&dst_saddr, dst, bp->port);
                        if (sctp_v4_cmp_addr(&dst_saddr, &laddr->a))
                                goto out_unlock;
@@ -506,7 +508,8 @@ static struct dst_entry *sctp_v4_get_dst(struct sctp_association *asoc,
        list_for_each(pos, &bp->address_list) {
                laddr = list_entry(pos, struct sctp_sockaddr_entry, list);
-                if (AF_INET == laddr->a.sa.sa_family) {
+                if ((laddr->use_as_src) &&
+                    (AF_INET == laddr->a.sa.sa_family)) {
                        fl.fl4_src = laddr->a.v4.sin_addr.s_addr;
                        if (!ip_route_output_key(&rt, &fl)) {
                                dst = &rt->u.dst;
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 2a8773691695..4f11f5858209 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1493,7 +1493,7 @@ no_hmac:
        /* Also, add the destination address. */
        if (list_empty(&retval->base.bind_addr.address_list)) {
-                sctp_add_bind_addr(&retval->base.bind_addr, &chunk->dest,
+                sctp_add_bind_addr(&retval->base.bind_addr, &chunk->dest, 1,
                                   GFP_ATOMIC);
        }
@@ -2017,7 +2017,7 @@ static int sctp_process_param(struct sctp_association *asoc,
                af->from_addr_param(&addr, param.addr, asoc->peer.port, 0);
                scope = sctp_scope(peer_addr);
                if (sctp_in_scope(&addr, scope))
-                        if (!sctp_assoc_add_peer(asoc, &addr, gfp, SCTP_ACTIVE))
+                        if (!sctp_assoc_add_peer(asoc, &addr, gfp, SCTP_UNCONFIRMED))
                                return 0;
                break;
@@ -2418,7 +2418,7 @@ static __u16 sctp_process_asconf_param(struct sctp_association *asoc,
                 * Due to Resource Shortage'.
                 */
-                peer = sctp_assoc_add_peer(asoc, &addr, GFP_ATOMIC, SCTP_ACTIVE);
+                peer = sctp_assoc_add_peer(asoc, &addr, GFP_ATOMIC, SCTP_UNCONFIRMED);
                if (!peer)
                        return SCTP_ERROR_RSRC_LOW;
@@ -2565,6 +2565,7 @@ static int sctp_asconf_param_success(struct sctp_association *asoc,
        union sctp_addr_param *addr_param;
        struct list_head *pos;
        struct sctp_transport *transport;
+        struct sctp_sockaddr_entry *saddr;
        int retval = 0;
        addr_param = (union sctp_addr_param *)
@@ -2578,7 +2579,11 @@ static int sctp_asconf_param_success(struct sctp_association *asoc,
        case SCTP_PARAM_ADD_IP:
                sctp_local_bh_disable();
                sctp_write_lock(&asoc->base.addr_lock);
-                retval = sctp_add_bind_addr(bp, &addr, GFP_ATOMIC);
+                list_for_each(pos, &bp->address_list) {
+                        saddr = list_entry(pos, struct sctp_sockaddr_entry, list);
+                        if (sctp_cmp_addr_exact(&saddr->a, &addr))
+                                saddr->use_as_src = 1;
+                }
                sctp_write_unlock(&asoc->base.addr_lock);
                sctp_local_bh_enable();
                break;
@@ -2591,6 +2596,7 @@ static int sctp_asconf_param_success(struct sctp_association *asoc,
                list_for_each(pos, &asoc->peer.transport_addr_list) {
                        transport = list_entry(pos, struct sctp_transport,
                                                 transports);
+                        dst_release(transport->dst);
                        sctp_transport_route(transport, NULL,
                                             sctp_sk(asoc->base.sk));
                }
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index c5beb2ad7ef7..9c10bdec1afe 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -430,7 +430,11 @@ static void sctp_do_8_2_transport_strike(struct sctp_association *asoc,
        /* The check for association's overall error counter exceeding the
         * threshold is done in the state function.
         */
-        asoc->overall_error_count++;
+        /* When probing UNCONFIRMED addresses, the association overall
+         * error count is NOT incremented
+         */
+        if (transport->state != SCTP_UNCONFIRMED)
+                asoc->overall_error_count++;
        if (transport->state != SCTP_INACTIVE &&
            (transport->error_count++ >= transport->pathmaxrxt)) {
@@ -610,7 +614,7 @@ static void sctp_cmd_transport_on(sctp_cmd_seq_t *cmds,
        /* Mark the destination transport address as active if it is not so
         * marked.
         */
-        if (t->state == SCTP_INACTIVE)
+        if ((t->state == SCTP_INACTIVE) || (t->state == SCTP_UNCONFIRMED))
                sctp_assoc_control_transport(asoc, t, SCTP_TRANSPORT_UP,
                                             SCTP_HEARTBEAT_SUCCESS);
@@ -620,6 +624,10 @@ static void sctp_cmd_transport_on(sctp_cmd_seq_t *cmds,
         */
        hbinfo = (sctp_sender_hb_info_t *) chunk->skb->data;
        sctp_transport_update_rto(t, (jiffies - hbinfo->sent_at));
+        /* Update the heartbeat timer.  */
+        if (!mod_timer(&t->hb_timer, sctp_transport_timeout(t)))
+                sctp_transport_hold(t);
 }
 /* Helper function to do a transport reset at the expiry of the hearbeat
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 9e58144f4851..ead3f1b0ea3d 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -846,6 +846,7 @@ static sctp_disposition_t sctp_sf_heartbeat(const struct sctp_endpoint *ep,
        hbinfo.param_hdr.length = htons(sizeof(sctp_sender_hb_info_t));
        hbinfo.daddr = transport->ipaddr;
        hbinfo.sent_at = jiffies;
+        hbinfo.hb_nonce = transport->hb_nonce;
        /* Send a heartbeat to our peer.  */
        paylen = sizeof(sctp_sender_hb_info_t);
@@ -1048,6 +1049,10 @@ sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
                return SCTP_DISPOSITION_DISCARD;
        }
+        /* Validate the 64-bit random nonce. */
+        if (hbinfo->hb_nonce != link->hb_nonce)
+                return SCTP_DISPOSITION_DISCARD;
        max_interval = link->hbinterval + link->rto;
        /* Check if the timestamp looks valid.  */
@@ -5278,7 +5283,6 @@ static int sctp_eat_data(const struct sctp_association *asoc,
        datalen -= sizeof(sctp_data_chunk_t);
        deliver = SCTP_CMD_CHUNK_ULP;
-        chunk->data_accepted = 1;
        /* Think about partial delivery. */
        if ((datalen >= asoc->rwnd) && (!asoc->ulpq.pd_mode)) {
@@ -5357,6 +5361,8 @@ static int sctp_eat_data(const struct sctp_association *asoc,
        if (SCTP_CMD_CHUNK_ULP == deliver)
                sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
+        chunk->data_accepted = 1;
        /* Note: Some chunks may get overcounted (if we drop) or overcounted
         * if we renege and the chunk arrives again.
         */
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 0a2c71d0d8aa..54722e622e6d 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -369,7 +369,7 @@ SCTP_STATIC int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
        /* Use GFP_ATOMIC since BHs are disabled.  */
        addr->v4.sin_port = ntohs(addr->v4.sin_port);
-        ret = sctp_add_bind_addr(bp, addr, GFP_ATOMIC);
+        ret = sctp_add_bind_addr(bp, addr, 1, GFP_ATOMIC);
        addr->v4.sin_port = htons(addr->v4.sin_port);
        sctp_write_unlock(&ep->base.addr_lock);
        sctp_local_bh_enable();
@@ -491,6 +491,7 @@ static int sctp_send_asconf_add_ip(struct sock		*sk,
        struct sctp_chunk               *chunk;
        struct sctp_sockaddr_entry      *laddr;
        union sctp_addr                 *addr;
+        union sctp_addr                 saveaddr;
        void                            *addr_buf;
        struct sctp_af                  *af;
        struct list_head                *pos;
@@ -558,14 +559,26 @@ static int sctp_send_asconf_add_ip(struct sock		*sk,
                }
                retval = sctp_send_asconf(asoc, chunk);
+                if (retval)
+                        goto out;
-                /* FIXME: After sending the add address ASCONF chunk, we
+                /* Add the new addresses to the bind address list with
-                 * cannot append the address to the association's binding
+                 * use_as_src set to 0.
-                 * address list, because the new address may be used as the
-                 * source of a message sent to the peer before the ASCONF
-                 * chunk is received by the peer.  So we should wait until
-                 * ASCONF_ACK is received.
                 */
+                sctp_local_bh_disable();
+                sctp_write_lock(&asoc->base.addr_lock);
+                addr_buf = addrs;
+                for (i = 0; i < addrcnt; i++) {
+                        addr = (union sctp_addr *)addr_buf;
+                        af = sctp_get_af_specific(addr->v4.sin_family);
+                        memcpy(&saveaddr, addr, af->sockaddr_len);
+                        saveaddr.v4.sin_port = ntohs(saveaddr.v4.sin_port);
+                        retval = sctp_add_bind_addr(bp, &saveaddr, 0,
+                                                    GFP_ATOMIC);
+                        addr_buf += af->sockaddr_len;
+                }
+                sctp_write_unlock(&asoc->base.addr_lock);
+                sctp_local_bh_enable();
        }
 out:
@@ -676,12 +689,15 @@ static int sctp_send_asconf_del_ip(struct sock		*sk,
        struct sctp_sock        *sp;
        struct sctp_endpoint    *ep;
        struct sctp_association *asoc;
+        struct sctp_transport   *transport;
        struct sctp_bind_addr   *bp;
        struct sctp_chunk       *chunk;
        union sctp_addr         *laddr;
+        union sctp_addr         saveaddr;
        void                    *addr_buf;
        struct sctp_af          *af;
-        struct list_head        *pos;
+        struct list_head        *pos, *pos1;
+        struct sctp_sockaddr_entry *saddr;
        int                     i;
        int                     retval = 0;
@@ -748,14 +764,42 @@ static int sctp_send_asconf_del_ip(struct sock		*sk,
                        goto out;
                }
-                retval = sctp_send_asconf(asoc, chunk);
+                /* Reset use_as_src flag for the addresses in the bind address
+                 * list that are to be deleted.
+                 */
+                sctp_local_bh_disable();
+                sctp_write_lock(&asoc->base.addr_lock);
+                addr_buf = addrs;
+                for (i = 0; i < addrcnt; i++) {
+                        laddr = (union sctp_addr *)addr_buf;
+                        af = sctp_get_af_specific(laddr->v4.sin_family);
+                        memcpy(&saveaddr, laddr, af->sockaddr_len);
+                        saveaddr.v4.sin_port = ntohs(saveaddr.v4.sin_port);
+                        list_for_each(pos1, &bp->address_list) {
+                                saddr = list_entry(pos1,
+                                                   struct sctp_sockaddr_entry,
+                                                   list);
+                                if (sctp_cmp_addr_exact(&saddr->a, &saveaddr))
+                                        saddr->use_as_src = 0;
+                        }
+                        addr_buf += af->sockaddr_len;
+                }
+                sctp_write_unlock(&asoc->base.addr_lock);
+                sctp_local_bh_enable();
-                /* FIXME: After sending the delete address ASCONF chunk, we
+                /* Update the route and saddr entries for all the transports
-                 * cannot remove the addresses from the association's bind
+                 * as some of the addresses in the bind address list are
-                 * address list, because there maybe some packet send to
+                 * about to be deleted and cannot be used as source addresses.
-                 * the delete addresses, so we should wait until ASCONF_ACK
-                 * packet is received.
                 */
+                list_for_each(pos1, &asoc->peer.transport_addr_list) {
+                        transport = list_entry(pos1, struct sctp_transport,
+                                               transports);
+                        dst_release(transport->dst);
+                        sctp_transport_route(transport, NULL,
+                                             sctp_sk(asoc->base.sk));
+                }
+                retval = sctp_send_asconf(asoc, chunk);
        }
 out:
        return retval;
@@ -4977,7 +5021,7 @@ static struct sctp_bind_bucket *sctp_bucket_create(
 /* Caller must hold hashbucket lock for this tb with local BH disabled */
 static void sctp_bucket_destroy(struct sctp_bind_bucket *pp)
 {
-        if (hlist_empty(&pp->owner)) {
+        if (pp && hlist_empty(&pp->owner)) {
                if (pp->next)
                        pp->next->pprev = pp->pprev;
                *(pp->pprev) = pp->next;
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 160f62ad1cc5..2763aa93de1a 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -49,6 +49,7 @@
 */
 #include <linux/types.h>
+#include <linux/random.h>
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
@@ -85,7 +86,6 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
        peer->init_sent_count = 0;
-        peer->state = SCTP_ACTIVE;
        peer->param_flags = SPP_HB_DISABLE |
                            SPP_PMTUD_ENABLE |
                            SPP_SACKDELAY_ENABLE;
@@ -109,6 +109,9 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
        peer->hb_timer.function = sctp_generate_heartbeat_event;
        peer->hb_timer.data = (unsigned long)peer;
+        /* Initialize the 64-bit random nonce sent with heartbeat. */
+        get_random_bytes(&peer->hb_nonce, sizeof(peer->hb_nonce));
        atomic_set(&peer->refcnt, 1);
        peer->dead = 0;
@@ -517,7 +520,9 @@ void sctp_transport_lower_cwnd(struct sctp_transport *transport,
 unsigned long sctp_transport_timeout(struct sctp_transport *t)
 {
        unsigned long timeout;
-        timeout = t->hbinterval + t->rto + sctp_jitter(t->rto);
+        timeout = t->rto + sctp_jitter(t->rto);
+        if (t->state != SCTP_UNCONFIRMED)
+                timeout += t->hbinterval;
        timeout += jiffies;
        return timeout;
 }
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 519ebc17c028..4a9aa9393b97 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -225,9 +225,8 @@ gss_alloc_context(void)
 {
        struct gss_cl_ctx *ctx;
-        ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
+        ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
        if (ctx != NULL) {
-                memset(ctx, 0, sizeof(*ctx));
                ctx->gc_proc = RPC_GSS_PROC_DATA;
                ctx->gc_seq = 1;        /* NetApp 6.4R1 doesn't accept seq. no. 0 */
                spin_lock_init(&ctx->gc_seq_lock);
@@ -391,9 +390,8 @@ gss_alloc_msg(struct gss_auth *gss_auth, uid_t uid)
 {
        struct gss_upcall_msg *gss_msg;
-        gss_msg = kmalloc(sizeof(*gss_msg), GFP_KERNEL);
+        gss_msg = kzalloc(sizeof(*gss_msg), GFP_KERNEL);
        if (gss_msg != NULL) {
-                memset(gss_msg, 0, sizeof(*gss_msg));
                INIT_LIST_HEAD(&gss_msg->list);
                rpc_init_wait_queue(&gss_msg->rpc_waitqueue, "RPCSEC_GSS upcall waitq");
                init_waitqueue_head(&gss_msg->waitqueue);
@@ -776,10 +774,9 @@ gss_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
        dprintk("RPC:      gss_create_cred for uid %d, flavor %d\n",
                acred->uid, auth->au_flavor);
-        if (!(cred = kmalloc(sizeof(*cred), GFP_KERNEL)))
+        if (!(cred = kzalloc(sizeof(*cred), GFP_KERNEL)))
                goto out_err;
-        memset(cred, 0, sizeof(*cred));
        atomic_set(&cred->gc_count, 1);
        cred->gc_uid = acred->uid;
        /*
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index b8714a87b34c..70e1e53a632b 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -129,9 +129,8 @@ gss_import_sec_context_kerberos(const void *p,
        const void *end = (const void *)((const char *)p + len);
        struct  krb5_ctx *ctx;
-        if (!(ctx = kmalloc(sizeof(*ctx), GFP_KERNEL)))
+        if (!(ctx = kzalloc(sizeof(*ctx), GFP_KERNEL)))
                goto out_err;
-        memset(ctx, 0, sizeof(*ctx));
        p = simple_get_bytes(p, end, &ctx->initiate, sizeof(ctx->initiate));
        if (IS_ERR(p))
diff --git a/net/sunrpc/auth_gss/gss_mech_switch.c b/net/sunrpc/auth_gss/gss_mech_switch.c
index d88468d21c37..3db745379d06 100644
--- a/net/sunrpc/auth_gss/gss_mech_switch.c
+++ b/net/sunrpc/auth_gss/gss_mech_switch.c
@@ -237,9 +237,8 @@ gss_import_sec_context(const void *input_token, size_t bufsize,
                       struct gss_api_mech      *mech,
                       struct gss_ctx           **ctx_id)
 {
-        if (!(*ctx_id = kmalloc(sizeof(**ctx_id), GFP_KERNEL)))
+        if (!(*ctx_id = kzalloc(sizeof(**ctx_id), GFP_KERNEL)))
                return GSS_S_FAILURE;
-        memset(*ctx_id, 0, sizeof(**ctx_id));
        (*ctx_id)->mech_type = gss_mech_get(mech);
        return mech->gm_ops
diff --git a/net/sunrpc/auth_gss/gss_spkm3_mech.c b/net/sunrpc/auth_gss/gss_spkm3_mech.c
index 3d0432aa45c1..88dcb52d171b 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_mech.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_mech.c
@@ -152,9 +152,8 @@ gss_import_sec_context_spkm3(const void *p, size_t len,
        const void *end = (const void *)((const char *)p + len);
        struct  spkm3_ctx *ctx;
-        if (!(ctx = kmalloc(sizeof(*ctx), GFP_KERNEL)))
+        if (!(ctx = kzalloc(sizeof(*ctx), GFP_KERNEL)))
                goto out_err;
-        memset(ctx, 0, sizeof(*ctx));
        p = simple_get_netobj(p, end, &ctx->ctx_id);
        if (IS_ERR(p))
diff --git a/net/sunrpc/auth_gss/gss_spkm3_token.c b/net/sunrpc/auth_gss/gss_spkm3_token.c
index af0d7ce74686..854a983ccf26 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_token.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_token.c
@@ -90,10 +90,9 @@ asn1_bitstring_len(struct xdr_netobj *in, int *enclen, int *zerobits)
 int
 decode_asn1_bitstring(struct xdr_netobj *out, char *in, int enclen, int explen)
 {
-        if (!(out->data = kmalloc(explen,GFP_KERNEL)))
+        if (!(out->data = kzalloc(explen,GFP_KERNEL)))
                return 0;
        out->len = explen;
-        memset(out->data, 0, explen);
        memcpy(out->data, in, enclen);
        return 1;
 }
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index aa8965e9d307..4ba271f892c8 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -125,10 +125,9 @@ rpc_new_client(struct rpc_xprt *xprt, char *servname,
                goto out_err;
        err = -ENOMEM;
-        clnt = kmalloc(sizeof(*clnt), GFP_KERNEL);
+        clnt = kzalloc(sizeof(*clnt), GFP_KERNEL);
        if (!clnt)
                goto out_err;
-        memset(clnt, 0, sizeof(*clnt));
        atomic_set(&clnt->cl_users, 0);
        atomic_set(&clnt->cl_count, 1);
        clnt->cl_parent = clnt;
diff --git a/net/sunrpc/stats.c b/net/sunrpc/stats.c
index 15c2db26767b..bd98124c3a64 100644
--- a/net/sunrpc/stats.c
+++ b/net/sunrpc/stats.c
@@ -114,13 +114,8 @@ void svc_seq_show(struct seq_file *seq, const struct svc_stat *statp) {
 */
 struct rpc_iostats *rpc_alloc_iostats(struct rpc_clnt *clnt)
 {
-        unsigned int ops = clnt->cl_maxproc;
-        size_t size = ops * sizeof(struct rpc_iostats);
        struct rpc_iostats *new;
+        new = kcalloc(clnt->cl_maxproc, sizeof(struct rpc_iostats), GFP_KERNEL);
-        new = kmalloc(size, GFP_KERNEL);
-        if (new)
-                memset(new, 0 , size);
        return new;
 }
 EXPORT_SYMBOL(rpc_alloc_iostats);
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 01ba60a49572..b76a227dd3ad 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -32,9 +32,8 @@ svc_create(struct svc_program *prog, unsigned int bufsize)
        int vers;
        unsigned int xdrsize;
-        if (!(serv = kmalloc(sizeof(*serv), GFP_KERNEL)))
+        if (!(serv = kzalloc(sizeof(*serv), GFP_KERNEL)))
                return NULL;
-        memset(serv, 0, sizeof(*serv));
        serv->sv_name      = prog->pg_name;
        serv->sv_program   = prog;
        serv->sv_nrthreads = 1;
@@ -159,11 +158,10 @@ svc_create_thread(svc_thread_fn func, struct svc_serv *serv)
        struct svc_rqst *rqstp;
        int             error = -ENOMEM;
-        rqstp = kmalloc(sizeof(*rqstp), GFP_KERNEL);
+        rqstp = kzalloc(sizeof(*rqstp), GFP_KERNEL);
        if (!rqstp)
                goto out;
-        memset(rqstp, 0, sizeof(*rqstp));
        init_waitqueue_head(&rqstp->rq_wait);
        if (!(rqstp->rq_argp = kmalloc(serv->sv_xdrsize, GFP_KERNEL))
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index a27905a0ad27..d9a95732df46 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1322,11 +1322,10 @@ svc_setup_socket(struct svc_serv *serv, struct socket *sock,
        struct sock     *inet;
        dprintk("svc: svc_setup_socket %p\n", sock);
-        if (!(svsk = kmalloc(sizeof(*svsk), GFP_KERNEL))) {
+        if (!(svsk = kzalloc(sizeof(*svsk), GFP_KERNEL))) {
                *errp = -ENOMEM;
                return NULL;
        }
-        memset(svsk, 0, sizeof(*svsk));
        inet = sock->sk;
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 02060d0e7be8..313b68d892c6 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -908,9 +908,8 @@ static struct rpc_xprt *xprt_setup(int proto, struct sockaddr_in *ap, struct rpc
        struct rpc_xprt *xprt;
        struct rpc_rqst *req;
-        if ((xprt = kmalloc(sizeof(struct rpc_xprt), GFP_KERNEL)) == NULL)
+        if ((xprt = kzalloc(sizeof(struct rpc_xprt), GFP_KERNEL)) == NULL)
                return ERR_PTR(-ENOMEM);
-        memset(xprt, 0, sizeof(*xprt)); /* Nnnngh! */
        xprt->addr = *ap;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 21006b109101..ee678ed13b6f 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1276,10 +1276,9 @@ int xs_setup_udp(struct rpc_xprt *xprt, struct rpc_timeout *to)
        xprt->max_reqs = xprt_udp_slot_table_entries;
        slot_table_size = xprt->max_reqs * sizeof(xprt->slot[0]);
-        xprt->slot = kmalloc(slot_table_size, GFP_KERNEL);
+        xprt->slot = kzalloc(slot_table_size, GFP_KERNEL);
        if (xprt->slot == NULL)
                return -ENOMEM;
-        memset(xprt->slot, 0, slot_table_size);
        xprt->prot = IPPROTO_UDP;
        xprt->port = xs_get_random_port();
@@ -1318,10 +1317,9 @@ int xs_setup_tcp(struct rpc_xprt *xprt, struct rpc_timeout *to)
        xprt->max_reqs = xprt_tcp_slot_table_entries;
        slot_table_size = xprt->max_reqs * sizeof(xprt->slot[0]);
-        xprt->slot = kmalloc(slot_table_size, GFP_KERNEL);
+        xprt->slot = kzalloc(slot_table_size, GFP_KERNEL);
        if (xprt->slot == NULL)
                return -ENOMEM;
-        memset(xprt->slot, 0, slot_table_size);
        xprt->prot = IPPROTO_TCP;
        xprt->port = xs_get_random_port();
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 7ef17a449cfd..75a5968c2139 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -665,11 +665,9 @@ int tipc_bearer_init(void)
        int res;
        write_lock_bh(&tipc_net_lock);
-        tipc_bearers = kmalloc(MAX_BEARERS * sizeof(struct bearer), GFP_ATOMIC);
+        tipc_bearers = kcalloc(MAX_BEARERS, sizeof(struct bearer), GFP_ATOMIC);
-        media_list = kmalloc(MAX_MEDIA * sizeof(struct media), GFP_ATOMIC);
+        media_list = kcalloc(MAX_MEDIA, sizeof(struct media), GFP_ATOMIC);
        if (tipc_bearers && media_list) {
-                memset(tipc_bearers, 0, MAX_BEARERS * sizeof(struct bearer));
-                memset(media_list, 0, MAX_MEDIA * sizeof(struct media));
                res = TIPC_OK;
        } else {
                kfree(tipc_bearers);
diff --git a/net/tipc/cluster.c b/net/tipc/cluster.c
index 1dcb6940e338..b46b5188a9fd 100644
--- a/net/tipc/cluster.c
+++ b/net/tipc/cluster.c
@@ -57,29 +57,25 @@ struct cluster *tipc_cltr_create(u32 addr)
        struct _zone *z_ptr;
        struct cluster *c_ptr;
        int max_nodes; 
-        int alloc;
-        c_ptr = (struct cluster *)kmalloc(sizeof(*c_ptr), GFP_ATOMIC);
+        c_ptr = kzalloc(sizeof(*c_ptr), GFP_ATOMIC);
        if (c_ptr == NULL) {
                warn("Cluster creation failure, no memory\n");
                return NULL;
        }
-        memset(c_ptr, 0, sizeof(*c_ptr));
        c_ptr->addr = tipc_addr(tipc_zone(addr), tipc_cluster(addr), 0);
        if (in_own_cluster(addr))
                max_nodes = LOWEST_SLAVE + tipc_max_slaves;
        else
                max_nodes = tipc_max_nodes + 1;
-        alloc = sizeof(void *) * (max_nodes + 1);
-        c_ptr->nodes = (struct node **)kmalloc(alloc, GFP_ATOMIC);
+        c_ptr->nodes = kcalloc(max_nodes + 1, sizeof(void*), GFP_ATOMIC);
        if (c_ptr->nodes == NULL) {
                warn("Cluster creation failure, no memory for node area\n");
                kfree(c_ptr);
                return NULL;
        }
-        memset(c_ptr->nodes, 0, alloc);
        if (in_own_cluster(addr))
                tipc_local_nodes = c_ptr->nodes;
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index 2b8441203120..ee94de92ae99 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -295,7 +295,7 @@ struct link_req *tipc_disc_init_link_req(struct bearer *b_ptr,
 {
        struct link_req *req;
-        req = (struct link_req *)kmalloc(sizeof(*req), GFP_ATOMIC);
+        req = kmalloc(sizeof(*req), GFP_ATOMIC);
        if (!req)
                return NULL;
diff --git a/net/tipc/link.c b/net/tipc/link.c
index c10e18a49b96..693f02eca6d6 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -417,12 +417,11 @@ struct link *tipc_link_create(struct bearer *b_ptr, const u32 peer,
        struct tipc_msg *msg;
        char *if_name;
-        l_ptr = (struct link *)kmalloc(sizeof(*l_ptr), GFP_ATOMIC);
+        l_ptr = kzalloc(sizeof(*l_ptr), GFP_ATOMIC);
        if (!l_ptr) {
                warn("Link creation failed, no memory\n");
                return NULL;
        }
-        memset(l_ptr, 0, sizeof(*l_ptr));
        l_ptr->addr = peer;
        if_name = strchr(b_ptr->publ.name, ':') + 1;
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index a6926ff07bcc..049242ea5c38 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -117,14 +117,12 @@ static struct publication *publ_create(u32 type, u32 lower, u32 upper,
                                       u32 scope, u32 node, u32 port_ref,   
                                       u32 key)
 {
-        struct publication *publ =
+        struct publication *publ = kzalloc(sizeof(*publ), GFP_ATOMIC);
-                (struct publication *)kmalloc(sizeof(*publ), GFP_ATOMIC);
        if (publ == NULL) {
                warn("Publication creation failure, no memory\n");
                return NULL;
        }
-        memset(publ, 0, sizeof(*publ));
        publ->type = type;
        publ->lower = lower;
        publ->upper = upper;
@@ -144,11 +142,7 @@ static struct publication *publ_create(u32 type, u32 lower, u32 upper,
 static struct sub_seq *tipc_subseq_alloc(u32 cnt)
 {
-        u32 sz = cnt * sizeof(struct sub_seq);
+        struct sub_seq *sseq = kcalloc(cnt, sizeof(struct sub_seq), GFP_ATOMIC);
-        struct sub_seq *sseq = (struct sub_seq *)kmalloc(sz, GFP_ATOMIC);
-        if (sseq)
-                memset(sseq, 0, sz);
        return sseq;
 }
@@ -160,8 +154,7 @@ static struct sub_seq *tipc_subseq_alloc(u32 cnt)
 static struct name_seq *tipc_nameseq_create(u32 type, struct hlist_head *seq_head)
 {
-        struct name_seq *nseq = 
+        struct name_seq *nseq = kzalloc(sizeof(*nseq), GFP_ATOMIC);
-                (struct name_seq *)kmalloc(sizeof(*nseq), GFP_ATOMIC);
        struct sub_seq *sseq = tipc_subseq_alloc(1);
        if (!nseq || !sseq) {
@@ -171,7 +164,6 @@ static struct name_seq *tipc_nameseq_create(u32 type, struct hlist_head *seq_hea
                return NULL;
        }
-        memset(nseq, 0, sizeof(*nseq));
        spin_lock_init(&nseq->lock);
        nseq->type = type;
        nseq->sseqs = sseq;
@@ -1060,7 +1052,7 @@ int tipc_nametbl_init(void)
 {
        int array_size = sizeof(struct hlist_head) * tipc_nametbl_size;
-        table.types = (struct hlist_head *)kmalloc(array_size, GFP_ATOMIC);
+        table.types = kmalloc(array_size, GFP_ATOMIC);
        if (!table.types)
                return -ENOMEM;
diff --git a/net/tipc/net.c b/net/tipc/net.c
index e5a359ab4930..a991bf8a7f74 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -160,14 +160,11 @@ void tipc_net_send_external_routes(u32 dest)
 static int net_init(void)
 {
-        u32 sz = sizeof(struct _zone *) * (tipc_max_zones + 1);
        memset(&tipc_net, 0, sizeof(tipc_net));
-        tipc_net.zones = (struct _zone **)kmalloc(sz, GFP_ATOMIC);
+        tipc_net.zones = kcalloc(tipc_max_zones + 1, sizeof(struct _zone *), GFP_ATOMIC);
        if (!tipc_net.zones) {
                return -ENOMEM;
        }
-        memset(tipc_net.zones, 0, sz);
        return TIPC_OK;
 }
diff --git a/net/tipc/port.c b/net/tipc/port.c
index 3251c8d8e53c..b9c8c6b9e94f 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -226,12 +226,11 @@ u32 tipc_createport_raw(void *usr_handle,
        struct tipc_msg *msg;
        u32 ref;
-        p_ptr = kmalloc(sizeof(*p_ptr), GFP_ATOMIC);
+        p_ptr = kzalloc(sizeof(*p_ptr), GFP_ATOMIC);
        if (!p_ptr) {
                warn("Port creation failed, no memory\n");
                return 0;
        }
-        memset(p_ptr, 0, sizeof(*p_ptr));
        ref = tipc_ref_acquire(p_ptr, &p_ptr->publ.lock);
        if (!ref) {
                warn("Port creation failed, reference table exhausted\n");
@@ -1058,7 +1057,7 @@ int tipc_createport(u32 user_ref,
        struct port *p_ptr; 
        u32 ref;
-        up_ptr = (struct user_port *)kmalloc(sizeof(*up_ptr), GFP_ATOMIC);
+        up_ptr = kmalloc(sizeof(*up_ptr), GFP_ATOMIC);
        if (!up_ptr) {
                warn("Port creation failed, no memory\n");
                return -ENOMEM;
diff --git a/net/tipc/ref.c b/net/tipc/ref.c
index 596d3c8ff750..e6d6ae22ea49 100644
--- a/net/tipc/ref.c
+++ b/net/tipc/ref.c
@@ -79,7 +79,7 @@ int tipc_ref_table_init(u32 requested_size, u32 start)
        while (sz < requested_size) {
                sz <<= 1;
        }
-        table = (struct reference *)vmalloc(sz * sizeof(struct reference));
+        table = vmalloc(sz * sizeof(*table));
        if (table == NULL)
                return -ENOMEM;
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index e19b4bcd67ec..c51600ba5f4a 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -393,12 +393,11 @@ static void subscr_named_msg_event(void *usr_handle,
        /* Create subscriber object */
-        subscriber = kmalloc(sizeof(struct subscriber), GFP_ATOMIC);
+        subscriber = kzalloc(sizeof(struct subscriber), GFP_ATOMIC);
        if (subscriber == NULL) {
                warn("Subscriber rejected, no memory\n");
                return;
        }
-        memset(subscriber, 0, sizeof(struct subscriber));
        INIT_LIST_HEAD(&subscriber->subscription_list);
        INIT_LIST_HEAD(&subscriber->subscriber_list);
        subscriber->ref = tipc_ref_acquire(subscriber, &subscriber->lock);
diff --git a/net/tipc/user_reg.c b/net/tipc/user_reg.c
index 1e3ae57c7228..04d1b9be9c51 100644
--- a/net/tipc/user_reg.c
+++ b/net/tipc/user_reg.c
@@ -82,9 +82,8 @@ static int reg_init(void)
        
        spin_lock_bh(&reg_lock);
        if (!users) {
-                users = (struct tipc_user *)kmalloc(USER_LIST_SIZE, GFP_ATOMIC);
+                users = kzalloc(USER_LIST_SIZE, GFP_ATOMIC);
                if (users) {
-                        memset(users, 0, USER_LIST_SIZE);
                        for (i = 1; i <= MAX_USERID; i++) {
                                users[i].next = i - 1;
                        }
diff --git a/net/tipc/zone.c b/net/tipc/zone.c
index 316c4872ff5b..f5b00ea2d5ac 100644
--- a/net/tipc/zone.c
+++ b/net/tipc/zone.c
@@ -52,13 +52,12 @@ struct _zone *tipc_zone_create(u32 addr)
                return NULL;
        }
-        z_ptr = (struct _zone *)kmalloc(sizeof(*z_ptr), GFP_ATOMIC);
+        z_ptr = kzalloc(sizeof(*z_ptr), GFP_ATOMIC);
        if (!z_ptr) {
                warn("Zone creation failed, insufficient memory\n");
                return NULL;
        }
-        memset(z_ptr, 0, sizeof(*z_ptr));
        z_num = tipc_zone(addr);
        z_ptr->addr = tipc_addr(z_num, 0, 0);
        tipc_net.zones[z_num] = z_ptr;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index f70475bfb62a..6f2909279268 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -663,11 +663,10 @@ static int unix_autobind(struct socket *sock)
                goto out;
        err = -ENOMEM;
-        addr = kmalloc(sizeof(*addr) + sizeof(short) + 16, GFP_KERNEL);
+        addr = kzalloc(sizeof(*addr) + sizeof(short) + 16, GFP_KERNEL);
        if (!addr)
                goto out;
-        memset(addr, 0, sizeof(*addr) + sizeof(short) + 16);
        addr->name->sun_family = AF_UNIX;
        atomic_set(&addr->refcnt, 1);
diff --git a/net/wanrouter/af_wanpipe.c b/net/wanrouter/af_wanpipe.c
index a690cf773b6a..6f39faa15832 100644
--- a/net/wanrouter/af_wanpipe.c
+++ b/net/wanrouter/af_wanpipe.c
@@ -370,12 +370,11 @@ static int wanpipe_listen_rcv (struct sk_buff *skb,  struct sock *sk)
         * used by the ioctl call to read call information
         * and to execute commands. 
         */     
-        if ((mbox_ptr = kmalloc(sizeof(mbox_cmd_t), GFP_ATOMIC)) == NULL) {
+        if ((mbox_ptr = kzalloc(sizeof(mbox_cmd_t), GFP_ATOMIC)) == NULL) {
                wanpipe_kill_sock_irq (newsk);
                release_device(dev);            
                return -ENOMEM;
        }
-        memset(mbox_ptr, 0, sizeof(mbox_cmd_t));
        memcpy(mbox_ptr,skb->data,skb->len);
        /* Register the lcn on which incoming call came
@@ -507,11 +506,10 @@ static struct sock *wanpipe_alloc_socket(void)
        if ((sk = sk_alloc(PF_WANPIPE, GFP_ATOMIC, &wanpipe_proto, 1)) == NULL)
                return NULL;
-        if ((wan_opt = kmalloc(sizeof(struct wanpipe_opt), GFP_ATOMIC)) == NULL) {
+        if ((wan_opt = kzalloc(sizeof(struct wanpipe_opt), GFP_ATOMIC)) == NULL) {
                sk_free(sk);
                return NULL;
        }
-        memset(wan_opt, 0x00, sizeof(struct wanpipe_opt));
        wp_sk(sk) = wan_opt;
@@ -2011,10 +2009,9 @@ static int set_ioctl_cmd (struct sock *sk, void *arg)
                dev_put(dev);
                
-                if ((mbox_ptr = kmalloc(sizeof(mbox_cmd_t), GFP_ATOMIC)) == NULL)
+                if ((mbox_ptr = kzalloc(sizeof(mbox_cmd_t), GFP_ATOMIC)) == NULL)
                        return -ENOMEM;
-                memset(mbox_ptr, 0, sizeof(mbox_cmd_t));
                wp_sk(sk)->mbox = mbox_ptr;
                wanpipe_link_driver(dev,sk);
diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
index ad8e8a797790..9479659277ae 100644
--- a/net/wanrouter/wanmain.c
+++ b/net/wanrouter/wanmain.c
@@ -642,18 +642,16 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
        if (cnf->config_id == WANCONFIG_MPPP) {
 #ifdef CONFIG_WANPIPE_MULTPPP
-                pppdev = kmalloc(sizeof(struct ppp_device), GFP_KERNEL);
+                pppdev = kzalloc(sizeof(struct ppp_device), GFP_KERNEL);
                err = -ENOBUFS;
                if (pppdev == NULL)
                        goto out;
-                memset(pppdev, 0, sizeof(struct ppp_device));
+                pppdev->dev = kzalloc(sizeof(struct net_device), GFP_KERNEL);
-                pppdev->dev = kmalloc(sizeof(struct net_device), GFP_KERNEL);
                if (pppdev->dev == NULL) {
                        kfree(pppdev);
                        err = -ENOBUFS;
                        goto out;
                }
-                memset(pppdev->dev, 0, sizeof(struct net_device));
                err = wandev->new_if(wandev, (struct net_device *)pppdev, cnf);
                dev = pppdev->dev;
 #else
@@ -663,11 +661,10 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
                goto out;
 #endif
        } else {
-                dev = kmalloc(sizeof(struct net_device), GFP_KERNEL);
+                dev = kzalloc(sizeof(struct net_device), GFP_KERNEL);
                err = -ENOBUFS;
                if (dev == NULL)
                        goto out;
-                memset(dev, 0, sizeof(struct net_device));
                err = wandev->new_if(wandev, dev, cnf);
        }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 405b741dff43..f35bc676128c 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -307,10 +307,9 @@ struct xfrm_policy *xfrm_policy_alloc(gfp_t gfp)
 {
        struct xfrm_policy *policy;
-        policy = kmalloc(sizeof(struct xfrm_policy), gfp);
+        policy = kzalloc(sizeof(struct xfrm_policy), gfp);
        if (policy) {
-                memset(policy, 0, sizeof(struct xfrm_policy));
                atomic_set(&policy->refcnt, 1);
                rwlock_init(&policy->lock);
                init_timer(&policy->timer);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 43f00fc28a3d..0021aad5db43 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -194,10 +194,9 @@ struct xfrm_state *xfrm_state_alloc(void)
 {
        struct xfrm_state *x;
-        x = kmalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
+        x = kzalloc(sizeof(struct xfrm_state), GFP_ATOMIC);
        if (x) {
-                memset(x, 0, sizeof(struct xfrm_state));
                atomic_set(&x->refcnt, 1);
                atomic_set(&x->tunnel_users, 0);
                INIT_LIST_HEAD(&x->bydst);