78 files changed, 839 insertions, 461 deletions
diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c
index f4bb43fb8016..e077701ae3d9 100644
--- a/drivers/char/agp/parisc-agp.c
+++ b/drivers/char/agp/parisc-agp.c
@@ -225,7 +225,7 @@ static const struct agp_bridge_driver parisc_agp_driver = {
        .configure              = parisc_agp_configure,
        .fetch_size             = parisc_agp_fetch_size,
        .tlb_flush              = parisc_agp_tlbflush,
-        .mask_memory            = parisc_agp_mask_memory,
+        .mask_memory            = parisc_agp_page_mask_memory,
        .masks                  = parisc_agp_masks,
        .agp_enable             = parisc_agp_enable,
        .cache_flush            = global_cache_flush,
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index b90eda8b3440..fd69086d08d5 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -858,6 +858,8 @@ static int cpufreq_add_dev(struct sys_device *sys_dev)
                /* Check for existing affected CPUs.
                 * They may not be aware of it due to CPU Hotplug.
+                 * cpufreq_cpu_put is called when the device is removed
+                 * in __cpufreq_remove_dev()
                 */
                managed_policy = cpufreq_cpu_get(j);
                if (unlikely(managed_policy)) {
@@ -884,7 +886,7 @@ static int cpufreq_add_dev(struct sys_device *sys_dev)
                        ret = sysfs_create_link(&sys_dev->kobj,
                                                &managed_policy->kobj,
                                                "cpufreq");
-                        if (!ret)
+                        if (ret)
                                cpufreq_cpu_put(managed_policy);
                        /*
                         * Success. We only needed to be added to the mask.
@@ -924,6 +926,8 @@ static int cpufreq_add_dev(struct sys_device *sys_dev)
        spin_lock_irqsave(&cpufreq_driver_lock, flags);
        for_each_cpu(j, policy->cpus) {
+                if (!cpu_online(j))
+                        continue;
                per_cpu(cpufreq_cpu_data, j) = policy;
                per_cpu(policy_cpu, j) = policy->cpu;
        }
@@ -1244,13 +1248,22 @@ EXPORT_SYMBOL(cpufreq_get);
 static int cpufreq_suspend(struct sys_device *sysdev, pm_message_t pmsg)
 {
-        int cpu = sysdev->id;
        int ret = 0;
+#ifdef __powerpc__
+        int cpu = sysdev->id;
        unsigned int cur_freq = 0;
        struct cpufreq_policy *cpu_policy;
        dprintk("suspending cpu %u\n", cpu);
+        /*
+         * This whole bogosity is here because Powerbooks are made of fail.
+         * No sane platform should need any of the code below to be run.
+         * (it's entirely the wrong thing to do, as driver->get may
+         *  reenable interrupts on some architectures).
+         */
        if (!cpu_online(cpu))
                return 0;
@@ -1309,6 +1322,7 @@ static int cpufreq_suspend(struct sys_device *sysdev, pm_message_t pmsg)
 out:
        cpufreq_cpu_put(cpu_policy);
+#endif  /* __powerpc__ */
        return ret;
 }
@@ -1322,12 +1336,18 @@ out:
 */
 static int cpufreq_resume(struct sys_device *sysdev)
 {
-        int cpu = sysdev->id;
        int ret = 0;
+#ifdef __powerpc__
+        int cpu = sysdev->id;
        struct cpufreq_policy *cpu_policy;
        dprintk("resuming cpu %u\n", cpu);
+        /* As with the ->suspend method, all the code below is
+         * only necessary because Powerbooks suck.
+         * See commit 42d4dc3f4e1e for jokes. */
        if (!cpu_online(cpu))
                return 0;
@@ -1391,6 +1411,7 @@ out:
        schedule_work(&cpu_policy->update);
 fail:
        cpufreq_cpu_put(cpu_policy);
+#endif  /* __powerpc__ */
        return ret;
 }
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 57490502b21c..bdea7e2f94ba 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -63,6 +63,7 @@ struct cpu_dbs_info_s {
        unsigned int down_skip;
        unsigned int requested_freq;
        int cpu;
+        unsigned int enable:1;
        /*
         * percpu mutex that serializes governor limit change with
         * do_dbs_timer invocation. We do not want do_dbs_timer to run
@@ -141,6 +142,9 @@ dbs_cpufreq_notifier(struct notifier_block *nb, unsigned long val,
        struct cpufreq_policy *policy;
+        if (!this_dbs_info->enable)
+                return 0;
        policy = this_dbs_info->cur_policy;
        /*
@@ -497,6 +501,7 @@ static inline void dbs_timer_init(struct cpu_dbs_info_s *dbs_info)
        int delay = usecs_to_jiffies(dbs_tuners_ins.sampling_rate);
        delay -= jiffies % delay;
+        dbs_info->enable = 1;
        INIT_DELAYED_WORK_DEFERRABLE(&dbs_info->work, do_dbs_timer);
        queue_delayed_work_on(dbs_info->cpu, kconservative_wq, &dbs_info->work,
                                delay);
@@ -504,6 +509,7 @@ static inline void dbs_timer_init(struct cpu_dbs_info_s *dbs_info)
 static inline void dbs_timer_exit(struct cpu_dbs_info_s *dbs_info)
 {
+        dbs_info->enable = 0;
        cancel_delayed_work_sync(&dbs_info->work);
 }
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 24964c1d0af9..e2a10bcba7a1 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -868,6 +868,8 @@ static void amd64_read_dbam_reg(struct amd64_pvt *pvt)
                        goto err_reg;
        }
+        return;
 err_reg:
        debugf0("Error reading F2x%03x.\n", reg);
 }
@@ -2634,6 +2636,8 @@ static void amd64_read_mc_registers(struct amd64_pvt *pvt)
        amd64_dump_misc_regs(pvt);
+        return;
 err_reg:
        debugf0("Reading an MC register failed\n");
@@ -2977,6 +2981,9 @@ static int amd64_check_ecc_enabled(struct amd64_pvt *pvt)
                        "ECC is enabled by BIOS, Proceeding "
                        "with EDAC module initialization\n");
+                /* Signal good ECC status */
+                ret = 0;
                /* CLEAR the override, since BIOS controlled it */
                ecc_enable_override = 0;
        }
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 8fab7890a363..33be210d6723 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -1461,7 +1461,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
                goto out;
        }
-        if (crtc_req->count_connectors > 0 && !mode && !fb) {
+        if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
                DRM_DEBUG("Count connectors is %d but no mode or fb set\n",
                          crtc_req->count_connectors);
                ret = -EINVAL;
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index 3da9cfa31848..6aaa2cb23365 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -706,8 +706,8 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
        struct drm_encoder **save_encoders, *new_encoder;
        struct drm_framebuffer *old_fb = NULL;
        bool save_enabled;
-        bool mode_changed = false;
+        bool mode_changed = false; /* if true do a full mode set */
-        bool fb_changed = false;
+        bool fb_changed = false; /* if true and !mode_changed just do a flip */
        struct drm_connector *connector;
        int count = 0, ro, fail = 0;
        struct drm_crtc_helper_funcs *crtc_funcs;
@@ -758,6 +758,8 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                if (set->crtc->fb == NULL) {
                        DRM_DEBUG("crtc has no fb, full mode set\n");
                        mode_changed = true;
+                } else if (set->fb == NULL) {
+                        mode_changed = true;
                } else if ((set->fb->bits_per_pixel !=
                         set->crtc->fb->bits_per_pixel) ||
                         set->fb->depth != set->crtc->fb->depth)
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 05a44896dffb..f1ba8ff41130 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -722,13 +722,14 @@ int r100_cs_packet_parse(struct radeon_cs_parser *p,
                         unsigned idx)
 {
        struct radeon_cs_chunk *ib_chunk = &p->chunks[p->chunk_ib_idx];
-        uint32_t header = ib_chunk->kdata[idx];
+        uint32_t header;
        if (idx >= ib_chunk->length_dw) {
                DRM_ERROR("Can not parse packet at %d after CS end %d !\n",
                          idx, ib_chunk->length_dw);
                return -EINVAL;
        }
+        header = ib_chunk->kdata[idx];
        pkt->idx = idx;
        pkt->type = CP_PACKET_GET_TYPE(header);
        pkt->count = CP_PACKET_GET_COUNT(header);
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 3cfcee17dc56..0bd5879a4957 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -318,6 +318,14 @@ static int __init radeon_init(void)
        driver = &driver_old;
        driver->num_ioctls = radeon_max_ioctl;
 #if defined(CONFIG_DRM_RADEON_KMS)
+#ifdef CONFIG_VGA_CONSOLE
+        if (vgacon_text_force() && radeon_modeset == -1) {
+                DRM_INFO("VGACON disable radeon kernel modesetting.\n");
+                driver = &driver_old;
+                driver->driver_features &= ~DRIVER_MODESET;
+                radeon_modeset = 0;
+        }
+#endif
        /* if enabled by default */
        if (radeon_modeset == -1) {
                DRM_INFO("radeon default to kernel modesetting.\n");
@@ -329,17 +337,8 @@ static int __init radeon_init(void)
                driver->driver_features |= DRIVER_MODESET;
                driver->num_ioctls = radeon_max_kms_ioctl;
        }
        /* if the vga console setting is enabled still
         * let modprobe override it */
-#ifdef CONFIG_VGA_CONSOLE
-        if (vgacon_text_force() && radeon_modeset == -1) {
-                DRM_INFO("VGACON disable radeon kernel modesetting.\n");
-                driver = &driver_old;
-                driver->driver_features &= ~DRIVER_MODESET;
-                radeon_modeset = 0;
-        }
-#endif
 #endif
        return drm_init(driver);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 937a2f1cdb46..3357110e30ce 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -58,6 +58,8 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
        if (r) {
                DRM_ERROR("Failed to initialize radeon, disabling IOCTL\n");
                radeon_device_fini(rdev);
+                kfree(rdev);
+                dev->dev_private = NULL;
                return r;
        }
        return 0;
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 551e608702e4..fd8f3ca716ea 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -370,6 +370,7 @@ void rv515_vram_info(struct radeon_device *rdev)
        rv515_vram_get_type(rdev);
+        r100_vram_init_sizes(rdev);
        /* FIXME: we should enforce default clock in case GPU is not in
         * default setup
         */
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 6538d4236989..c2b0d710d10f 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1182,13 +1182,14 @@ static int ttm_bo_force_list_clean(struct ttm_bo_device *bdev,
 int ttm_bo_clean_mm(struct ttm_bo_device *bdev, unsigned mem_type)
 {
-        struct ttm_mem_type_manager *man = &bdev->man[mem_type];
+        struct ttm_mem_type_manager *man;
        int ret = -EINVAL;
        if (mem_type >= TTM_NUM_MEM_TYPES) {
                printk(KERN_ERR TTM_PFX "Illegal memory type %d\n", mem_type);
                return ret;
        }
+        man = &bdev->man[mem_type];
        if (!man->has_type) {
                printk(KERN_ERR TTM_PFX "Trying to take down uninitialized "
@@ -1575,6 +1576,10 @@ int ttm_bo_wait(struct ttm_buffer_object *bo,
                        driver->sync_obj_unref(&sync_obj);
                        driver->sync_obj_unref(&tmp_obj);
                        spin_lock(&bo->lock);
+                } else {
+                        spin_unlock(&bo->lock);
+                        driver->sync_obj_unref(&sync_obj);
+                        spin_lock(&bo->lock);
                }
        }
        return 0;
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index ce2e6f38ea01..ad4ada07c6cf 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -150,7 +150,7 @@ static int ttm_copy_io_ttm_page(struct ttm_tt *ttm, void *src,
 #ifdef CONFIG_X86
        dst = kmap_atomic_prot(d, KM_USER0, prot);
 #else
-        if (prot != PAGE_KERNEL)
+        if (pgprot_val(prot) != pgprot_val(PAGE_KERNEL))
                dst = vmap(&d, 1, 0, prot);
        else
                dst = kmap(d);
@@ -163,7 +163,7 @@ static int ttm_copy_io_ttm_page(struct ttm_tt *ttm, void *src,
 #ifdef CONFIG_X86
        kunmap_atomic(dst, KM_USER0);
 #else
-        if (prot != PAGE_KERNEL)
+        if (pgprot_val(prot) != pgprot_val(PAGE_KERNEL))
                vunmap(dst);
        else
                kunmap(d);
@@ -186,7 +186,7 @@ static int ttm_copy_ttm_io_page(struct ttm_tt *ttm, void *dst,
 #ifdef CONFIG_X86
        src = kmap_atomic_prot(s, KM_USER0, prot);
 #else
-        if (prot != PAGE_KERNEL)
+        if (pgprot_val(prot) != pgprot_val(PAGE_KERNEL))
                src = vmap(&s, 1, 0, prot);
        else
                src = kmap(s);
@@ -199,7 +199,7 @@ static int ttm_copy_ttm_io_page(struct ttm_tt *ttm, void *dst,
 #ifdef CONFIG_X86
        kunmap_atomic(src, KM_USER0);
 #else
-        if (prot != PAGE_KERNEL)
+        if (pgprot_val(prot) != pgprot_val(PAGE_KERNEL))
                vunmap(src);
        else
                kunmap(s);
diff --git a/drivers/input/serio/hp_sdc_mlc.c b/drivers/input/serio/hp_sdc_mlc.c
index b587e2d576ac..820e51673b26 100644
--- a/drivers/input/serio/hp_sdc_mlc.c
+++ b/drivers/input/serio/hp_sdc_mlc.c
@@ -296,7 +296,7 @@ static void hp_sdc_mlc_out(hil_mlc *mlc)
        priv->tseq[3] = 0;
        if (mlc->opacket & HIL_CTRL_APE) {
                priv->tseq[3] |= HP_SDC_LPC_APE_IPF;
-                down_trylock(&mlc->csem);
+                BUG_ON(down_trylock(&mlc->csem));
        }
 enqueue:
        hp_sdc_enqueue_transaction(&priv->trans);
diff --git a/drivers/isdn/mISDN/l1oip_core.c b/drivers/isdn/mISDN/l1oip_core.c
index c3b661a666cb..7e5f30dbc0a0 100644
--- a/drivers/isdn/mISDN/l1oip_core.c
+++ b/drivers/isdn/mISDN/l1oip_core.c
@@ -1480,7 +1480,7 @@ l1oip_init(void)
                return -ENOMEM;
        l1oip_cnt = 0;
-        while (type[l1oip_cnt] && l1oip_cnt < MAX_CARDS) {
+        while (l1oip_cnt < MAX_CARDS && type[l1oip_cnt]) {
                switch (type[l1oip_cnt] & 0xff) {
                case 1:
                        pri = 0;
diff --git a/drivers/mfd/twl4030-irq.c b/drivers/mfd/twl4030-irq.c
index bae61b22501c..7d430835655f 100644
--- a/drivers/mfd/twl4030-irq.c
+++ b/drivers/mfd/twl4030-irq.c
@@ -180,14 +180,9 @@ static struct completion irq_event;
 static int twl4030_irq_thread(void *data)
 {
        long irq = (long)data;
-        struct irq_desc *desc = irq_to_desc(irq);
        static unsigned i2c_errors;
        static const unsigned max_i2c_errors = 100;
-        if (!desc) {
-                pr_err("twl4030: Invalid IRQ: %ld\n", irq);
-                return -EINVAL;
-        }
        current->flags |= PF_NOFREEZE;
@@ -240,7 +235,7 @@ static int twl4030_irq_thread(void *data)
                }
                local_irq_enable();
-                desc->chip->unmask(irq);
+                enable_irq(irq);
        }
        return 0;
@@ -255,25 +250,13 @@ static int twl4030_irq_thread(void *data)
 * thread.  All we do here is acknowledge and mask the interrupt and wakeup
 * the kernel thread.
 */
-static void handle_twl4030_pih(unsigned int irq, struct irq_desc *desc)
+static irqreturn_t handle_twl4030_pih(int irq, void *devid)
 {
        /* Acknowledge, clear *AND* mask the interrupt... */
-        desc->chip->ack(irq);
+        disable_irq_nosync(irq);
-        complete(&irq_event);
+        complete(devid);
-}
+        return IRQ_HANDLED;
-static struct task_struct *start_twl4030_irq_thread(long irq)
-{
-        struct task_struct *thread;
-        init_completion(&irq_event);
-        thread = kthread_run(twl4030_irq_thread, (void *)irq, "twl4030-irq");
-        if (!thread)
-                pr_err("twl4030: could not create irq %ld thread!\n", irq);
-        return thread;
 }
 /*----------------------------------------------------------------------*/
 /*
@@ -734,18 +717,28 @@ int twl_init_irq(int irq_num, unsigned irq_base, unsigned irq_end)
        }
        /* install an irq handler to demultiplex the TWL4030 interrupt */
-        task = start_twl4030_irq_thread(irq_num);
-        if (!task) {
-                pr_err("twl4030: irq thread FAIL\n");
-                status = -ESRCH;
-                goto fail;
-        }
-        set_irq_data(irq_num, task);
-        set_irq_chained_handler(irq_num, handle_twl4030_pih);
-        return status;
+        init_completion(&irq_event);
+        status = request_irq(irq_num, handle_twl4030_pih, IRQF_DISABLED,
+                                "TWL4030-PIH", &irq_event);
+        if (status < 0) {
+                pr_err("twl4030: could not claim irq%d: %d\n", irq_num, status);
+                goto fail_rqirq;
+        }
+        task = kthread_run(twl4030_irq_thread, (void *)irq_num, "twl4030-irq");
+        if (IS_ERR(task)) {
+                pr_err("twl4030: could not create irq %d thread!\n", irq_num);
+                status = PTR_ERR(task);
+                goto fail_kthread;
+        }
+        return status;
+fail_kthread:
+        free_irq(irq_num, &irq_event);
+fail_rqirq:
+        /* clean up twl4030_sih_setup */
 fail:
        for (i = irq_base; i < irq_end; i++)
                set_irq_chip_and_handler(i, NULL, NULL);
diff --git a/drivers/net/3c515.c b/drivers/net/3c515.c
index 3e00fa8ea65f..4a7c32895be5 100644
--- a/drivers/net/3c515.c
+++ b/drivers/net/3c515.c
@@ -832,7 +832,9 @@ static int corkscrew_open(struct net_device *dev)
                        skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */
                        vp->rx_ring[i].addr = isa_virt_to_bus(skb->data);
                }
-                vp->rx_ring[i - 1].next = isa_virt_to_bus(&vp->rx_ring[0]);     /* Wrap the ring. */
+                if (i != 0)
+                        vp->rx_ring[i - 1].next =
+                                isa_virt_to_bus(&vp->rx_ring[0]);       /* Wrap the ring. */
                outl(isa_virt_to_bus(&vp->rx_ring[0]), ioaddr + UpListPtr);
        }
        if (vp->full_bus_master_tx) {   /* Boomerang bus master Tx. */
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index c34aee91250b..c20416850948 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -2721,13 +2721,15 @@ dump_tx_ring(struct net_device *dev)
                                   &vp->tx_ring[vp->dirty_tx % TX_RING_SIZE]);
                        issue_and_wait(dev, DownStall);
                        for (i = 0; i < TX_RING_SIZE; i++) {
-                                pr_err("  %d: @%p  length %8.8x status %8.8x\n", i,
+                                unsigned int length;
-                                           &vp->tx_ring[i],
 #if DO_ZEROCOPY
-                                           le32_to_cpu(vp->tx_ring[i].frag[0].length),
+                                length = le32_to_cpu(vp->tx_ring[i].frag[0].length);
 #else
-                                           le32_to_cpu(vp->tx_ring[i].length),
+                                length = le32_to_cpu(vp->tx_ring[i].length);
 #endif
+                                pr_err("  %d: @%p  length %8.8x status %8.8x\n",
+                                           i, &vp->tx_ring[i], length,
                                           le32_to_cpu(vp->tx_ring[i].status));
                        }
                        if (!stalled)
diff --git a/drivers/net/eexpress.c b/drivers/net/eexpress.c
index 1686dca28748..1f016d66684a 100644
--- a/drivers/net/eexpress.c
+++ b/drivers/net/eexpress.c
@@ -1474,13 +1474,13 @@ static void eexp_hw_init586(struct net_device *dev)
        outw(0x0000, ioaddr + 0x800c);
        outw(0x0000, ioaddr + 0x800e);
-        for (i = 0; i < (sizeof(start_code)); i+=32) {
+        for (i = 0; i < ARRAY_SIZE(start_code) * 2; i+=32) {
                int j;
                outw(i, ioaddr + SM_PTR);
-                for (j = 0; j < 16; j+=2)
+                for (j = 0; j < 16 && (i+j)/2 < ARRAY_SIZE(start_code); j+=2)
                        outw(start_code[(i+j)/2],
                             ioaddr+0x4000+j);
-                for (j = 0; j < 16; j+=2)
+                for (j = 0; j < 16 && (i+j+16)/2 < ARRAY_SIZE(start_code); j+=2)
                        outw(start_code[(i+j+16)/2],
                             ioaddr+0x8000+j);
        }
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 78952f8324e2..fa311a950996 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -40,7 +40,7 @@
 #include <asm/io.h>
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0101"
+#define DRV_VERSION     "EHEA_0102"
 /* eHEA capability flags */
 #define DLPAR_PORT_ADD_REM 1
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index e8d46cc1bec2..977c3d358279 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -1545,6 +1545,9 @@ static int ehea_clean_portres(struct ehea_port *port, struct ehea_port_res *pr)
 {
        int ret, i;
+        if (pr->qp)
+                netif_napi_del(&pr->napi);
        ret = ehea_destroy_qp(pr->qp);
        if (!ret) {
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index dbf06e9313cc..2234118eedbb 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -366,9 +366,8 @@ static int gfar_scoalesce(struct net_device *dev, struct ethtool_coalesce *cvals
                return -EINVAL;
        }
-        priv->rxic = mk_ic_value(
+        priv->rxic = mk_ic_value(cvals->rx_max_coalesced_frames,
-                gfar_usecs2ticks(priv, cvals->rx_coalesce_usecs),
+                gfar_usecs2ticks(priv, cvals->rx_coalesce_usecs));
-                cvals->rx_max_coalesced_frames);
        /* Set up tx coalescing */
        if ((cvals->tx_coalesce_usecs == 0) ||
@@ -390,9 +389,8 @@ static int gfar_scoalesce(struct net_device *dev, struct ethtool_coalesce *cvals
                return -EINVAL;
        }
-        priv->txic = mk_ic_value(
+        priv->txic = mk_ic_value(cvals->tx_max_coalesced_frames,
-                gfar_usecs2ticks(priv, cvals->tx_coalesce_usecs),
+                gfar_usecs2ticks(priv, cvals->tx_coalesce_usecs));
-                cvals->tx_max_coalesced_frames);
        gfar_write(&priv->regs->rxic, 0);
        if (priv->rxcoalescing)
diff --git a/drivers/net/igbvf/vf.c b/drivers/net/igbvf/vf.c
index 2a4faf9ade69..a9a61efa964c 100644
--- a/drivers/net/igbvf/vf.c
+++ b/drivers/net/igbvf/vf.c
@@ -274,6 +274,8 @@ static s32 e1000_set_vfta_vf(struct e1000_hw *hw, u16 vid, bool set)
        err = mbx->ops.read_posted(hw, msgbuf, 2);
+        msgbuf[0] &= ~E1000_VT_MSGTYPE_CTS;
        /* if nacked the vlan was rejected */
        if (!err && (msgbuf[0] == (E1000_VF_SET_VLAN | E1000_VT_MSGTYPE_NACK)))
                err = -E1000_ERR_MAC_INIT;
@@ -317,6 +319,8 @@ static void e1000_rar_set_vf(struct e1000_hw *hw, u8 * addr, u32 index)
        if (!ret_val)
                ret_val = mbx->ops.read_posted(hw, msgbuf, 3);
+        msgbuf[0] &= ~E1000_VT_MSGTYPE_CTS;
        /* if nacked the address was rejected, use "perm_addr" */
        if (!ret_val &&
            (msgbuf[0] == (E1000_VF_SET_MAC_ADDR | E1000_VT_MSGTYPE_NACK)))
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index 1b12c7ba275f..e11d83d5852b 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -96,6 +96,8 @@
 #define IXGBE_TX_FLAGS_VLAN_PRIO_MASK   0x0000e000
 #define IXGBE_TX_FLAGS_VLAN_SHIFT       16
+#define IXGBE_MAX_RSC_INT_RATE          162760
 /* wrapper around a pointer to a socket buffer,
 * so a DMA handle can be stored along with the buffer */
 struct ixgbe_tx_buffer {
diff --git a/drivers/net/ixgbe/ixgbe_82598.c b/drivers/net/ixgbe/ixgbe_82598.c
index b9923047ce11..522c03bc1dad 100644
--- a/drivers/net/ixgbe/ixgbe_82598.c
+++ b/drivers/net/ixgbe/ixgbe_82598.c
@@ -50,6 +50,51 @@ static s32 ixgbe_read_i2c_eeprom_82598(struct ixgbe_hw *hw, u8 byte_offset,
                                       u8 *eeprom_data);
 /**
+ *  ixgbe_set_pcie_completion_timeout - set pci-e completion timeout
+ *  @hw: pointer to the HW structure
+ *
+ *  The defaults for 82598 should be in the range of 50us to 50ms,
+ *  however the hardware default for these parts is 500us to 1ms which is less
+ *  than the 10ms recommended by the pci-e spec.  To address this we need to
+ *  increase the value to either 10ms to 250ms for capability version 1 config,
+ *  or 16ms to 55ms for version 2.
+ **/
+void ixgbe_set_pcie_completion_timeout(struct ixgbe_hw *hw)
+{
+        struct ixgbe_adapter *adapter = hw->back;
+        u32 gcr = IXGBE_READ_REG(hw, IXGBE_GCR);
+        u16 pcie_devctl2;
+        /* only take action if timeout value is defaulted to 0 */
+        if (gcr & IXGBE_GCR_CMPL_TMOUT_MASK)
+                goto out;
+        /*
+         * if capababilities version is type 1 we can write the
+         * timeout of 10ms to 250ms through the GCR register
+         */
+        if (!(gcr & IXGBE_GCR_CAP_VER2)) {
+                gcr |= IXGBE_GCR_CMPL_TMOUT_10ms;
+                goto out;
+        }
+        /*
+         * for version 2 capabilities we need to write the config space
+         * directly in order to set the completion timeout value for
+         * 16ms to 55ms
+         */
+        pci_read_config_word(adapter->pdev,
+                             IXGBE_PCI_DEVICE_CONTROL2, &pcie_devctl2);
+        pcie_devctl2 |= IXGBE_PCI_DEVICE_CONTROL2_16ms;
+        pci_write_config_word(adapter->pdev,
+                              IXGBE_PCI_DEVICE_CONTROL2, pcie_devctl2);
+out:
+        /* disable completion timeout resend */
+        gcr &= ~IXGBE_GCR_CMPL_TMOUT_RESEND;
+        IXGBE_WRITE_REG(hw, IXGBE_GCR, gcr);
+}
+/**
 *  ixgbe_get_pcie_msix_count_82598 - Gets MSI-X vector count
 *  @hw: pointer to hardware structure
 *
@@ -153,6 +198,26 @@ out:
 }
 /**
+ *  ixgbe_start_hw_82598 - Prepare hardware for Tx/Rx
+ *  @hw: pointer to hardware structure
+ *
+ *  Starts the hardware using the generic start_hw function.
+ *  Then set pcie completion timeout
+ **/
+s32 ixgbe_start_hw_82598(struct ixgbe_hw *hw)
+{
+        s32 ret_val = 0;
+        ret_val = ixgbe_start_hw_generic(hw);
+        /* set the completion timeout for interface */
+        if (ret_val == 0)
+                ixgbe_set_pcie_completion_timeout(hw);
+        return ret_val;
+}
+/**
 *  ixgbe_get_link_capabilities_82598 - Determines link capabilities
 *  @hw: pointer to hardware structure
 *  @speed: pointer to link speed
@@ -1085,7 +1150,7 @@ out:
 static struct ixgbe_mac_operations mac_ops_82598 = {
        .init_hw                = &ixgbe_init_hw_generic,
        .reset_hw               = &ixgbe_reset_hw_82598,
-        .start_hw               = &ixgbe_start_hw_generic,
+        .start_hw               = &ixgbe_start_hw_82598,
        .clear_hw_cntrs         = &ixgbe_clear_hw_cntrs_generic,
        .get_media_type         = &ixgbe_get_media_type_82598,
        .get_supported_physical_layer = &ixgbe_get_supported_physical_layer_82598,
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index 2a978008fd6e..79144e950a34 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -1975,7 +1975,10 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                 * any other value means disable eitr, which is best
                 * served by setting the interrupt rate very high
                 */
-                adapter->eitr_param = IXGBE_MAX_INT_RATE;
+                if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED)
+                        adapter->eitr_param = IXGBE_MAX_RSC_INT_RATE;
+                else
+                        adapter->eitr_param = IXGBE_MAX_INT_RATE;
                adapter->itr_setting = 0;
        }
@@ -1999,13 +2002,13 @@ static int ixgbe_set_flags(struct net_device *netdev, u32 data)
        ethtool_op_set_flags(netdev, data);
-        if (!(adapter->flags & IXGBE_FLAG2_RSC_CAPABLE))
+        if (!(adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE))
                return 0;
        /* if state changes we need to update adapter->flags and reset */
        if ((!!(data & ETH_FLAG_LRO)) != 
-            (!!(adapter->flags & IXGBE_FLAG2_RSC_ENABLED))) {
+            (!!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED))) {
-                adapter->flags ^= IXGBE_FLAG2_RSC_ENABLED;
+                adapter->flags2 ^= IXGBE_FLAG2_RSC_ENABLED;
                if (netif_running(netdev))
                        ixgbe_reinit_locked(adapter);
                else
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 200454f30f6a..110c65ab5cb5 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -780,7 +780,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                prefetch(next_rxd);
                cleaned_count++;
-                if (adapter->flags & IXGBE_FLAG2_RSC_CAPABLE)
+                if (adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE)
                        rsc_count = ixgbe_get_rsc_count(rx_desc);
                if (rsc_count) {
@@ -2036,7 +2036,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
                        IXGBE_WRITE_REG(hw, IXGBE_PSRTYPE(0), psrtype);
                }
        } else {
-                if (!(adapter->flags & IXGBE_FLAG2_RSC_ENABLED) &&
+                if (!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) &&
                    (netdev->mtu <= ETH_DATA_LEN))
                        rx_buf_len = MAXIMUM_ETHERNET_VLAN_SIZE;
                else
@@ -2165,7 +2165,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
                IXGBE_WRITE_REG(hw, IXGBE_RDRXCTL, rdrxctl);
        }
-        if (adapter->flags & IXGBE_FLAG2_RSC_ENABLED) {
+        if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
                /* Enable 82599 HW-RSC */
                for (i = 0; i < adapter->num_rx_queues; i++) {
                        j = adapter->rx_ring[i].reg_idx;
@@ -3812,8 +3812,8 @@ static int __devinit ixgbe_sw_init(struct ixgbe_adapter *adapter)
                adapter->max_msix_q_vectors = MAX_MSIX_Q_VECTORS_82598;
        } else if (hw->mac.type == ixgbe_mac_82599EB) {
                adapter->max_msix_q_vectors = MAX_MSIX_Q_VECTORS_82599;
-                adapter->flags |= IXGBE_FLAG2_RSC_CAPABLE;
+                adapter->flags2 |= IXGBE_FLAG2_RSC_CAPABLE;
-                adapter->flags |= IXGBE_FLAG2_RSC_ENABLED;
+                adapter->flags2 |= IXGBE_FLAG2_RSC_ENABLED;
                adapter->flags |= IXGBE_FLAG_FDIR_HASH_CAPABLE;
                adapter->ring_feature[RING_F_FDIR].indices =
                                                         IXGBE_MAX_FDIR_INDICES;
@@ -5360,12 +5360,19 @@ static int ixgbe_del_sanmac_netdev(struct net_device *dev)
 static void ixgbe_netpoll(struct net_device *netdev)
 {
        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        int i;
-        disable_irq(adapter->pdev->irq);
        adapter->flags |= IXGBE_FLAG_IN_NETPOLL;
-        ixgbe_intr(adapter->pdev->irq, netdev);
+        if (adapter->flags & IXGBE_FLAG_MSIX_ENABLED) {
+                int num_q_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
+                for (i = 0; i < num_q_vectors; i++) {
+                        struct ixgbe_q_vector *q_vector = adapter->q_vector[i];
+                        ixgbe_msix_clean_many(0, q_vector);
+                }
+        } else {
+                ixgbe_intr(adapter->pdev->irq, netdev);
+        }
        adapter->flags &= ~IXGBE_FLAG_IN_NETPOLL;
-        enable_irq(adapter->pdev->irq);
 }
 #endif
@@ -5611,7 +5618,7 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
        if (pci_using_dac)
                netdev->features |= NETIF_F_HIGHDMA;
-        if (adapter->flags & IXGBE_FLAG2_RSC_ENABLED)
+        if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED)
                netdev->features |= NETIF_F_LRO;
        /* make sure the EEPROM is good */
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index fa87309dc087..be90eb4575f6 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -718,6 +718,12 @@
 #define IXGBE_ECC_STATUS_82599  0x110E0
 #define IXGBE_BAR_CTRL_82599    0x110F4
+/* PCI Express Control */
+#define IXGBE_GCR_CMPL_TMOUT_MASK       0x0000F000
+#define IXGBE_GCR_CMPL_TMOUT_10ms       0x00001000
+#define IXGBE_GCR_CMPL_TMOUT_RESEND     0x00010000
+#define IXGBE_GCR_CAP_VER2              0x00040000
 /* Time Sync Registers */
 #define IXGBE_TSYNCRXCTL 0x05188 /* Rx Time Sync Control register - RW */
 #define IXGBE_TSYNCTXCTL 0x08C00 /* Tx Time Sync Control register - RW */
@@ -1521,6 +1527,7 @@
 /* PCI Bus Info */
 #define IXGBE_PCI_LINK_STATUS     0xB2
+#define IXGBE_PCI_DEVICE_CONTROL2 0xC8
 #define IXGBE_PCI_LINK_WIDTH      0x3F0
 #define IXGBE_PCI_LINK_WIDTH_1    0x10
 #define IXGBE_PCI_LINK_WIDTH_2    0x20
@@ -1531,6 +1538,7 @@
 #define IXGBE_PCI_LINK_SPEED_5000 0x2
 #define IXGBE_PCI_HEADER_TYPE_REGISTER  0x0E
 #define IXGBE_PCI_HEADER_TYPE_MULTIFUNC 0x80
+#define IXGBE_PCI_DEVICE_CONTROL2_16ms  0x0005
 /* Number of 100 microseconds we wait for PCI Express master disable */
 #define IXGBE_PCI_MASTER_DISABLE_TIMEOUT 800
diff --git a/drivers/net/mlx4/en_tx.c b/drivers/net/mlx4/en_tx.c
index 08c43f2ae72b..5a88b3f57693 100644
--- a/drivers/net/mlx4/en_tx.c
+++ b/drivers/net/mlx4/en_tx.c
@@ -249,6 +249,7 @@ static u32 mlx4_en_free_tx_desc(struct mlx4_en_priv *priv,
                                pci_unmap_page(mdev->pdev,
                                        (dma_addr_t) be64_to_cpu(data->addr),
                                         frag->size, PCI_DMA_TODEVICE);
+                                ++data;
                        }
                }
                /* Stamp the freed descriptor */
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 637ac8b89bac..3cd8cfcf627b 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -221,7 +221,7 @@ netxen_napi_disable(struct netxen_adapter *adapter)
        }
 }
-static int nx_set_dma_mask(struct netxen_adapter *adapter, uint8_t revision_id)
+static int nx_set_dma_mask(struct netxen_adapter *adapter)
 {
        struct pci_dev *pdev = adapter->pdev;
        uint64_t mask, cmask;
@@ -229,19 +229,17 @@ static int nx_set_dma_mask(struct netxen_adapter *adapter, uint8_t revision_id)
        adapter->pci_using_dac = 0;
        mask = DMA_BIT_MASK(32);
-        /*
-         * Consistent DMA mask is set to 32 bit because it cannot be set to
-         * 35 bits. For P3 also leave it at 32 bits for now. Only the rings
-         * come off this pool.
-         */
        cmask = DMA_BIT_MASK(32);
+        if (NX_IS_REVISION_P2(adapter->ahw.revision_id)) {
 #ifndef CONFIG_IA64
-        if (revision_id >= NX_P3_B0)
-                mask = DMA_BIT_MASK(39);
-        else if (revision_id == NX_P2_C1)
                mask = DMA_BIT_MASK(35);
 #endif
+        } else {
+                mask = DMA_BIT_MASK(39);
+                cmask = mask;
+        }
        if (pci_set_dma_mask(pdev, mask) == 0 &&
                pci_set_consistent_dma_mask(pdev, cmask) == 0) {
                adapter->pci_using_dac = 1;
@@ -256,7 +254,7 @@ static int
 nx_update_dma_mask(struct netxen_adapter *adapter)
 {
        int change, shift, err;
-        uint64_t mask, old_mask;
+        uint64_t mask, old_mask, old_cmask;
        struct pci_dev *pdev = adapter->pdev;
        change = 0;
@@ -272,14 +270,29 @@ nx_update_dma_mask(struct netxen_adapter *adapter)
        if (change) {
                old_mask = pdev->dma_mask;
+                old_cmask = pdev->dev.coherent_dma_mask;
                mask = (1ULL<<(32+shift)) - 1;
                err = pci_set_dma_mask(pdev, mask);
                if (err)
-                        return pci_set_dma_mask(pdev, old_mask);
+                        goto err_out;
+                if (NX_IS_REVISION_P3(adapter->ahw.revision_id)) {
+                        err = pci_set_consistent_dma_mask(pdev, mask);
+                        if (err)
+                                goto err_out;
+                }
+                dev_info(&pdev->dev, "using %d-bit dma mask\n", 32+shift);
        }
        return 0;
+err_out:
+        pci_set_dma_mask(pdev, old_mask);
+        pci_set_consistent_dma_mask(pdev, old_cmask);
+        return err;
 }
 static void netxen_check_options(struct netxen_adapter *adapter)
@@ -1006,7 +1019,7 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        revision_id = pdev->revision;
        adapter->ahw.revision_id = revision_id;
-        err = nx_set_dma_mask(adapter, revision_id);
+        err = nx_set_dma_mask(adapter);
        if (err)
                goto err_out_free_netdev;
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index 28368157dac4..a646a445fda9 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -1611,8 +1611,11 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                if (pcnet32_dwio_read_csr(ioaddr, 0) == 4
                    && pcnet32_dwio_check(ioaddr)) {
                        a = &pcnet32_dwio;
-                } else
+                } else {
+                        if (pcnet32_debug & NETIF_MSG_PROBE)
+                                printk(KERN_ERR PFX "No access methods\n");
                        goto err_release_region;
+                }
        }
        chip_version =
@@ -1719,7 +1722,9 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                ret = -ENOMEM;
                goto err_release_region;
        }
-        SET_NETDEV_DEV(dev, &pdev->dev);
+        if (pdev)
+                SET_NETDEV_DEV(dev, &pdev->dev);
        if (pcnet32_debug & NETIF_MSG_PROBE)
                printk(KERN_INFO PFX "%s at %#3lx,", chipname, ioaddr);
@@ -1818,7 +1823,6 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
        spin_lock_init(&lp->lock);
-        SET_NETDEV_DEV(dev, &pdev->dev);
        lp->name = chipname;
        lp->shared_irq = shared;
        lp->tx_ring_size = TX_RING_SIZE;        /* default tx ring size */
@@ -1852,12 +1856,6 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
            ((cards_found >= MAX_UNITS) || full_duplex[cards_found]))
                lp->options |= PCNET32_PORT_FD;
-        if (!a) {
-                if (pcnet32_debug & NETIF_MSG_PROBE)
-                        printk(KERN_ERR PFX "No access methods\n");
-                ret = -ENODEV;
-                goto err_free_consistent;
-        }
        lp->a = *a;
        /* prior to register_netdev, dev->name is not yet correct */
@@ -1973,14 +1971,13 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
        return 0;
-      err_free_ring:
+err_free_ring:
        pcnet32_free_ring(dev);
-      err_free_consistent:
        pci_free_consistent(lp->pci_dev, sizeof(*lp->init_block),
                            lp->init_block, lp->init_dma_addr);
-      err_free_netdev:
+err_free_netdev:
        free_netdev(dev);
-      err_release_region:
+err_release_region:
        release_region(ioaddr, PCNET32_TOTAL_SIZE);
        return ret;
 }
@@ -2089,6 +2086,7 @@ static void pcnet32_free_ring(struct net_device *dev)
 static int pcnet32_open(struct net_device *dev)
 {
        struct pcnet32_private *lp = netdev_priv(dev);
+        struct pci_dev *pdev = lp->pci_dev;
        unsigned long ioaddr = dev->base_addr;
        u16 val;
        int i;
@@ -2149,9 +2147,9 @@ static int pcnet32_open(struct net_device *dev)
        lp->a.write_csr(ioaddr, 124, val);
        /* Allied Telesyn AT 2700/2701 FX are 100Mbit only and do not negotiate */
-        if (lp->pci_dev->subsystem_vendor == PCI_VENDOR_ID_AT &&
+        if (pdev && pdev->subsystem_vendor == PCI_VENDOR_ID_AT &&
-            (lp->pci_dev->subsystem_device == PCI_SUBDEVICE_ID_AT_2700FX ||
+            (pdev->subsystem_device == PCI_SUBDEVICE_ID_AT_2700FX ||
-             lp->pci_dev->subsystem_device == PCI_SUBDEVICE_ID_AT_2701FX)) {
+             pdev->subsystem_device == PCI_SUBDEVICE_ID_AT_2701FX)) {
                if (lp->options & PCNET32_PORT_ASEL) {
                        lp->options = PCNET32_PORT_FD | PCNET32_PORT_100;
                        if (netif_msg_link(lp))
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 639d11bc444e..cd37d739ac74 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1384,7 +1384,7 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
        /* create a     fragment for each channel */
        bits = B;
-        while (nfree > 0 &&     len     > 0) {
+        while (len      > 0) {
                list = list->next;
                if (list ==     &ppp->channels) {
                        i =     0;
@@ -1431,29 +1431,31 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
                *otherwise divide it according to the speed
                *of the channel we are going to transmit on
                */
-                if (pch->speed == 0) {
+                if (nfree > 0) {
-                        flen = totlen/nfree     ;
+                        if (pch->speed == 0) {
-                        if (nbigger > 0) {
+                                flen = totlen/nfree     ;
-                                flen++;
+                                if (nbigger > 0) {
-                                nbigger--;
+                                        flen++;
-                        }
+                                        nbigger--;
-                } else {
+                                }
-                        flen = (((totfree - nzero)*(totlen + hdrlen*totfree)) /
+                        } else {
-                                ((totspeed*totfree)/pch->speed)) - hdrlen;
+                                flen = (((totfree - nzero)*(totlen + hdrlen*totfree)) /
-                        if (nbigger > 0) {
+                                        ((totspeed*totfree)/pch->speed)) - hdrlen;
-                                flen += ((totfree - nzero)*pch->speed)/totspeed;
+                                if (nbigger > 0) {
-                                nbigger -= ((totfree - nzero)*pch->speed)/
+                                        flen += ((totfree - nzero)*pch->speed)/totspeed;
+                                        nbigger -= ((totfree - nzero)*pch->speed)/
                                                        totspeed;
+                                }
                        }
+                        nfree--;
                }
-                nfree--;
                /*
                 *check if we are on the last channel or
                 *we exceded the lenght of the data     to
                 *fragment
                 */
-                if ((nfree == 0) || (flen > len))
+                if ((nfree <= 0) || (flen > len))
                        flen = len;
                /*
                 *it is not worth to tx on slow channels:
@@ -1467,7 +1469,7 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
                        continue;
                }
-                mtu     = pch->chan->mtu + 2 - hdrlen;
+                mtu     = pch->chan->mtu - hdrlen;
                if (mtu < 4)
                        mtu     = 4;
                if (flen > mtu)
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index f0031f1f97e5..5f2090233d7b 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -1063,6 +1063,7 @@ static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos)
        else {
                int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote);
+                po = NULL;
                while (++hash < PPPOE_HASH_SIZE) {
                        po = pn->hash_table[hash];
                        if (po)
diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
index e7935d09c896..e0f9219a0aea 100644
--- a/drivers/net/pppol2tp.c
+++ b/drivers/net/pppol2tp.c
@@ -2680,6 +2680,7 @@ out_unregister_pppol2tp_proto:
 static void __exit pppol2tp_exit(void)
 {
        unregister_pppox_proto(PX_PROTO_OL2TP);
+        unregister_pernet_gen_device(pppol2tp_net_id, &pppol2tp_net_ops);
        proto_unregister(&pppol2tp_sk_proto);
 }
diff --git a/drivers/net/s6gmac.c b/drivers/net/s6gmac.c
index 5345e47b35ac..4525cbe8dd69 100644
--- a/drivers/net/s6gmac.c
+++ b/drivers/net/s6gmac.c
@@ -793,7 +793,7 @@ static inline int s6gmac_phy_start(struct net_device *dev)
        struct s6gmac *pd = netdev_priv(dev);
        int i = 0;
        struct phy_device *p = NULL;
-        while ((!(p = pd->mii.bus->phy_map[i])) && (i < PHY_MAX_ADDR))
+        while ((i < PHY_MAX_ADDR) && (!(p = pd->mii.bus->phy_map[i])))
                i++;
        p = phy_connect(dev, dev_name(&p->dev), &s6gmac_adjust_link, 0,
                        PHY_INTERFACE_MODE_RGMII);
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 3550c5dcd93c..0a551d8f5d95 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1488,6 +1488,8 @@ static int sky2_up(struct net_device *dev)
        sky2_set_vlan_mode(hw, port, sky2->vlgrp != NULL);
 #endif
+        sky2->restarting = 0;
        err = sky2_rx_start(sky2);
        if (err)
                goto err_out;
@@ -1500,6 +1502,9 @@ static int sky2_up(struct net_device *dev)
        sky2_set_multicast(dev);
+        /* wake queue incase we are restarting */
+        netif_wake_queue(dev);
        if (netif_msg_ifup(sky2))
                printk(KERN_INFO PFX "%s: enabling interface\n", dev->name);
        return 0;
@@ -1533,6 +1538,8 @@ static inline int tx_dist(unsigned tail, unsigned head)
 /* Number of list elements available for next tx */
 static inline int tx_avail(const struct sky2_port *sky2)
 {
+        if (unlikely(sky2->restarting))
+                return 0;
        return sky2->tx_pending - tx_dist(sky2->tx_cons, sky2->tx_prod);
 }
@@ -1818,6 +1825,10 @@ static int sky2_down(struct net_device *dev)
        if (netif_msg_ifdown(sky2))
                printk(KERN_INFO PFX "%s: disabling interface\n", dev->name);
+        /* explicitly shut off tx incase we're restarting */
+        sky2->restarting = 1;
+        netif_tx_disable(dev);
        /* Force flow control off */
        sky2_write8(hw, SK_REG(port, GMAC_CTRL), GMC_PAUSE_OFF);
@@ -2359,7 +2370,7 @@ static inline void sky2_tx_done(struct net_device *dev, u16 last)
 {
        struct sky2_port *sky2 = netdev_priv(dev);
-        if (netif_running(dev)) {
+        if (likely(netif_running(dev) && !sky2->restarting)) {
                netif_tx_lock(dev);
                sky2_tx_complete(sky2, last);
                netif_tx_unlock(dev);
@@ -4283,6 +4294,7 @@ static __devinit struct net_device *sky2_init_netdev(struct sky2_hw *hw,
        spin_lock_init(&sky2->phy_lock);
        sky2->tx_pending = TX_DEF_PENDING;
        sky2->rx_pending = RX_DEF_PENDING;
+        sky2->restarting = 0;
        hw->dev[port] = dev;
diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
index b5549c9e5107..4486b066b43f 100644
--- a/drivers/net/sky2.h
+++ b/drivers/net/sky2.h
@@ -2051,6 +2051,7 @@ struct sky2_port {
        u8                   duplex;    /* DUPLEX_HALF, DUPLEX_FULL */
        u8                   rx_csum;
        u8                   wol;
+        u8                   restarting;
        enum flow_control    flow_mode;
        enum flow_control    flow_status;
diff --git a/drivers/net/tulip/de4x5.c b/drivers/net/tulip/de4x5.c
index eb72d2e9ab3d..acfdccd44567 100644
--- a/drivers/net/tulip/de4x5.c
+++ b/drivers/net/tulip/de4x5.c
@@ -5059,7 +5059,7 @@ mii_get_phy(struct net_device *dev)
        if ((id == 0) || (id == 65535)) continue;  /* Valid ID? */
        for (j=0; j<limit; j++) {                  /* Search PHY table */
            if (id != phy_info[j].id) continue;    /* ID match? */
-            for (k=0; lp->phy[k].id && (k < DE4X5_MAX_PHY); k++);
+            for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++);
            if (k < DE4X5_MAX_PHY) {
                memcpy((char *)&lp->phy[k],
                       (char *)&phy_info[j], sizeof(struct phy_table));
@@ -5072,7 +5072,7 @@ mii_get_phy(struct net_device *dev)
            break;
        }
        if ((j == limit) && (i < DE4X5_MAX_MII)) {
-            for (k=0; lp->phy[k].id && (k < DE4X5_MAX_PHY); k++);
+            for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++);
            lp->phy[k].addr = i;
            lp->phy[k].id = id;
            lp->phy[k].spd.reg = GENERIC_REG;      /* ANLPA register         */
@@ -5091,7 +5091,7 @@ mii_get_phy(struct net_device *dev)
  purgatory:
    lp->active = 0;
    if (lp->phy[0].id) {                           /* Reset the PHY devices */
-        for (k=0; lp->phy[k].id && (k < DE4X5_MAX_PHY); k++) { /*For each PHY*/
+        for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++) { /*For each PHY*/
            mii_wr(MII_CR_RST, MII_CR, lp->phy[k].addr, DE4X5_MII);
            while (mii_rd(MII_CR, lp->phy[k].addr, DE4X5_MII) & MII_CR_RST);
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index c70604f0329e..8ce5e4cee168 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -5918,20 +5918,19 @@ static int airo_set_essid(struct net_device *dev,
        readSsidRid(local, &SSID_rid);
        /* Check if we asked for `any' */
-        if(dwrq->flags == 0) {
+        if (dwrq->flags == 0) {
                /* Just send an empty SSID list */
                memset(&SSID_rid, 0, sizeof(SSID_rid));
        } else {
-                int     index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+                unsigned index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
                /* Check the size of the string */
-                if(dwrq->length > IW_ESSID_MAX_SIZE) {
+                if (dwrq->length > IW_ESSID_MAX_SIZE)
                        return -E2BIG ;
-                }
                /* Check if index is valid */
-                if((index < 0) || (index >= 4)) {
+                if (index >= ARRAY_SIZE(SSID_rid.ssids))
                        return -EINVAL;
-                }
                /* Set the SSID */
                memset(SSID_rid.ssids[index].ssid, 0,
@@ -6819,7 +6818,7 @@ static int airo_set_txpow(struct net_device *dev,
                return -EINVAL;
        }
        clear_bit (FLAG_RADIO_OFF, &local->flags);
-        for (i = 0; cap_rid.txPowerLevels[i] && (i < 8); i++)
+        for (i = 0; i < 8 && cap_rid.txPowerLevels[i]; i++)
                if (v == cap_rid.txPowerLevels[i]) {
                        readConfigRid(local, 1);
                        local->config.txPower = v;
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index a2fda702b620..ce0e86c36a82 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -460,7 +460,7 @@ static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
                integer = swab32(eep->modalHeader.antCtrlCommon);
                eep->modalHeader.antCtrlCommon = integer;
-                for (i = 0; i < AR5416_MAX_CHAINS; i++) {
+                for (i = 0; i < AR5416_EEP4K_MAX_CHAINS; i++) {
                        integer = swab32(eep->modalHeader.antCtrlChain[i]);
                        eep->modalHeader.antCtrlChain[i] = integer;
                }
@@ -914,7 +914,7 @@ static void ath9k_hw_set_4k_power_per_rate_table(struct ath_hw *ah,
                        ctlMode, numCtlModes, isHt40CtlMode,
                        (pCtlMode[ctlMode] & EXT_ADDITIVE));
-                for (i = 0; (i < AR5416_NUM_CTLS) &&
+                for (i = 0; (i < AR5416_EEP4K_NUM_CTLS) &&
                                pEepData->ctlIndex[i]; i++) {
                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
                                "  LOOP-Ctlidx %d: cfgCtl 0x%2.2x "
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index fbb3a573463e..2de6471d4be9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -112,7 +112,7 @@ enum iwl3945_antenna {
 #define IWL_TX_FIFO_NONE        7
 /* Minimum number of queues. MAX_NUM is defined in hw specific files */
-#define IWL_MIN_NUM_QUEUES      4
+#define IWL39_MIN_NUM_QUEUES    4
 #define IEEE80211_DATA_LEN              2304
 #define IEEE80211_4ADDR_LEN             30
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 6ab07165ea28..18b135f510e5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -1332,6 +1332,9 @@ int iwl_setup_mac(struct iwl_priv *priv)
        hw->wiphy->custom_regulatory = true;
+        /* Firmware does not support this */
+        hw->wiphy->disable_beacon_hints = true;
        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
        /* we create the 802.11 header and a zero-length SSID element */
        hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 11e08c068917..ca00cc8ad4c7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -308,18 +308,18 @@ static ssize_t iwl_dbgfs_nvm_read(struct file *file,
                return -ENODATA;
        }
+        ptr = priv->eeprom;
+        if (!ptr) {
+                IWL_ERR(priv, "Invalid EEPROM/OTP memory\n");
+                return -ENOMEM;
+        }
        /* 4 characters for byte 0xYY */
        buf = kzalloc(buf_size, GFP_KERNEL);
        if (!buf) {
                IWL_ERR(priv, "Can not allocate Buffer\n");
                return -ENOMEM;
        }
-        ptr = priv->eeprom;
-        if (!ptr) {
-                IWL_ERR(priv, "Invalid EEPROM/OTP memory\n");
-                return -ENOMEM;
-        }
        pos += scnprintf(buf + pos, buf_size - pos, "NVM Type: %s\n",
                        (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP)
                        ? "OTP" : "EEPROM");
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index e2d620f0b6e8..650e20af20fa 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -258,8 +258,10 @@ struct iwl_channel_info {
 #define IWL_TX_FIFO_HCCA_2      6
 #define IWL_TX_FIFO_NONE        7
-/* Minimum number of queues. MAX_NUM is defined in hw specific files */
+/* Minimum number of queues. MAX_NUM is defined in hw specific files.
-#define IWL_MIN_NUM_QUEUES      4
+ * Set the minimum to accommodate the 4 standard TX queues, 1 command
+ * queue, 2 (unused) HCCA queues, and 4 HT queues (one for each AC) */
+#define IWL_MIN_NUM_QUEUES      10
 /* Power management (not Tx power) structures */
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 2addf735b193..ffd5c61a7553 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -566,6 +566,8 @@ int iwl_remove_default_wep_key(struct iwl_priv *priv,
        unsigned long flags;
        spin_lock_irqsave(&priv->sta_lock, flags);
+        IWL_DEBUG_WEP(priv, "Removing default WEP key: idx=%d\n",
+                      keyconf->keyidx);
        if (!test_and_clear_bit(keyconf->keyidx, &priv->ucode_key_table))
                IWL_ERR(priv, "index %d not used in uCode key table.\n",
@@ -573,6 +575,11 @@ int iwl_remove_default_wep_key(struct iwl_priv *priv,
        priv->default_wep_key--;
        memset(&priv->wep_keys[keyconf->keyidx], 0, sizeof(priv->wep_keys[0]));
+        if (iwl_is_rfkill(priv)) {
+                IWL_DEBUG_WEP(priv, "Not sending REPLY_WEPKEY command due to RFKILL.\n");
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+                return 0;
+        }
        ret = iwl_send_static_wepkey_cmd(priv, 1);
        IWL_DEBUG_WEP(priv, "Remove default WEP key: idx=%d ret=%d\n",
                      keyconf->keyidx, ret);
@@ -853,6 +860,11 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        if (iwl_is_rfkill(priv)) {
+                IWL_DEBUG_WEP(priv, "Not sending REPLY_ADD_STA command because RFKILL enabled. \n");
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+                return 0;
+        }
        ret =  iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
        spin_unlock_irqrestore(&priv->sta_lock, flags);
        return ret;
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 9bbeec9427f0..2e89040e63be 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -720,8 +720,6 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                goto drop_unlock;
        }
-        spin_unlock_irqrestore(&priv->lock, flags);
        hdr_len = ieee80211_hdrlen(fc);
        /* Find (or create) index into station table for destination station */
@@ -729,7 +727,7 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
        if (sta_id == IWL_INVALID_STATION) {
                IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
                               hdr->addr1);
-                goto drop;
+                goto drop_unlock;
        }
        IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
@@ -750,14 +748,17 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                        txq_id = priv->stations[sta_id].tid[tid].agg.txq_id;
                        swq_id = iwl_virtual_agg_queue_num(swq_id, txq_id);
                }
-                priv->stations[sta_id].tid[tid].tfds_in_queue++;
        }
        txq = &priv->txq[txq_id];
        q = &txq->q;
        txq->swq_id = swq_id;
-        spin_lock_irqsave(&priv->lock, flags);
+        if (unlikely(iwl_queue_space(q) < q->high_mark))
+                goto drop_unlock;
+        if (ieee80211_is_data_qos(fc))
+                priv->stations[sta_id].tid[tid].tfds_in_queue++;
        /* Set up driver data for this TFD */
        memset(&(txq->txb[q->write_ptr]), 0, sizeof(struct iwl_tx_info));
@@ -902,7 +903,6 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 drop_unlock:
        spin_unlock_irqrestore(&priv->lock, flags);
-drop:
        return -1;
 }
 EXPORT_SYMBOL(iwl_tx_skb);
@@ -1171,6 +1171,8 @@ int iwl_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn)
                IWL_ERR(priv, "Start AGG on invalid station\n");
                return -ENXIO;
        }
+        if (unlikely(tid >= MAX_TID_COUNT))
+                return -EINVAL;
        if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_OFF) {
                IWL_ERR(priv, "Start AGG when state is not IWL_AGG_OFF !\n");
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 956798f2c80c..523843369ca2 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -3968,6 +3968,9 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
        hw->wiphy->custom_regulatory = true;
+        /* Firmware does not support this */
+        hw->wiphy->disable_beacon_hints = true;
        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX_3945;
        /* we create the 802.11 header and a zero-length SSID element */
        hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
@@ -4018,10 +4021,10 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
        SET_IEEE80211_DEV(hw, &pdev->dev);
        if ((iwl3945_mod_params.num_of_queues > IWL39_MAX_NUM_QUEUES) ||
-             (iwl3945_mod_params.num_of_queues < IWL_MIN_NUM_QUEUES)) {
+             (iwl3945_mod_params.num_of_queues < IWL39_MIN_NUM_QUEUES)) {
                IWL_ERR(priv,
                        "invalid queues_num, should be between %d and %d\n",
-                        IWL_MIN_NUM_QUEUES, IWL39_MAX_NUM_QUEUES);
+                        IWL39_MIN_NUM_QUEUES, IWL39_MAX_NUM_QUEUES);
                err = -EINVAL;
                goto out_ieee80211_free_hw;
        }
diff --git a/drivers/net/wireless/iwmc3200wifi/commands.c b/drivers/net/wireless/iwmc3200wifi/commands.c
index 834a7f544e5d..e2334d123599 100644
--- a/drivers/net/wireless/iwmc3200wifi/commands.c
+++ b/drivers/net/wireless/iwmc3200wifi/commands.c
@@ -220,6 +220,7 @@ int iwm_store_rxiq_calib_result(struct iwm_priv *iwm)
        eeprom_rxiq = iwm_eeprom_access(iwm, IWM_EEPROM_CALIB_RXIQ);
        if (IS_ERR(eeprom_rxiq)) {
                IWM_ERR(iwm, "Couldn't access EEPROM RX IQ entry\n");
+                kfree(rxiq);
                return PTR_ERR(eeprom_rxiq);
        }
diff --git a/drivers/net/wireless/iwmc3200wifi/netdev.c b/drivers/net/wireless/iwmc3200wifi/netdev.c
index aea5ccf24ccf..bf294e41753b 100644
--- a/drivers/net/wireless/iwmc3200wifi/netdev.c
+++ b/drivers/net/wireless/iwmc3200wifi/netdev.c
@@ -106,10 +106,8 @@ void *iwm_if_alloc(int sizeof_bus, struct device *dev,
        int ret = 0;
        wdev = iwm_wdev_alloc(sizeof_bus, dev);
-        if (!wdev) {
+        if (IS_ERR(wdev))
-                dev_err(dev, "no memory for wireless device instance\n");
+                return wdev;
-                return ERR_PTR(-ENOMEM);
-        }
        iwm = wdev_to_iwm(wdev);
        iwm->bus_ops = if_ops;
diff --git a/drivers/net/wireless/libertas/11d.c b/drivers/net/wireless/libertas/11d.c
index 9a5408e7d94a..5c6968101f0d 100644
--- a/drivers/net/wireless/libertas/11d.c
+++ b/drivers/net/wireless/libertas/11d.c
@@ -47,7 +47,7 @@ static u8 lbs_region_2_code(u8 *region)
 {
        u8 i;
-        for (i = 0; region[i] && i < COUNTRY_CODE_LEN; i++)
+        for (i = 0; i < COUNTRY_CODE_LEN && region[i]; i++)
                region[i] = toupper(region[i]);
        for (i = 0; i < ARRAY_SIZE(region_code_mapping); i++) {
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index b9b374119033..d6997371c27e 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -1,6 +1,7 @@
 /* Copyright (C) 2006, Red Hat, Inc. */
 #include <linux/types.h>
+#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/ieee80211.h>
 #include <linux/if_arp.h>
@@ -43,21 +44,21 @@ static int get_common_rates(struct lbs_private *priv,
        u16 *rates_size)
 {
        u8 *card_rates = lbs_bg_rates;
-        size_t num_card_rates = sizeof(lbs_bg_rates);
        int ret = 0, i, j;
-        u8 tmp[30];
+        u8 tmp[(ARRAY_SIZE(lbs_bg_rates) - 1) * (*rates_size - 1)];
        size_t tmp_size = 0;
        /* For each rate in card_rates that exists in rate1, copy to tmp */
-        for (i = 0; card_rates[i] && (i < num_card_rates); i++) {
+        for (i = 0; i < ARRAY_SIZE(lbs_bg_rates) && card_rates[i]; i++) {
-                for (j = 0; rates[j] && (j < *rates_size); j++) {
+                for (j = 0; j < *rates_size && rates[j]; j++) {
                        if (rates[j] == card_rates[i])
                                tmp[tmp_size++] = card_rates[i];
                }
        }
        lbs_deb_hex(LBS_DEB_JOIN, "AP rates    ", rates, *rates_size);
-        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates, num_card_rates);
+        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates,
+                        ARRAY_SIZE(lbs_bg_rates));
        lbs_deb_hex(LBS_DEB_JOIN, "common rates", tmp, tmp_size);
        lbs_deb_join("TX data rate 0x%02x\n", priv->cur_rate);
@@ -69,10 +70,7 @@ static int get_common_rates(struct lbs_private *priv,
                lbs_pr_alert("Previously set fixed data rate %#x isn't "
                       "compatible with the network.\n", priv->cur_rate);
                ret = -1;
-                goto done;
        }
-        ret = 0;
 done:
        memset(rates, 0, *rates_size);
        *rates_size = min_t(int, tmp_size, *rates_size);
@@ -322,7 +320,7 @@ static int lbs_associate(struct lbs_private *priv,
        rates = (struct mrvl_ie_rates_param_set *) pos;
        rates->header.type = cpu_to_le16(TLV_TYPE_RATES);
        memcpy(&rates->rates, &bss->rates, MAX_RATES);
-        tmplen = MAX_RATES;
+        tmplen = min_t(u16, ARRAY_SIZE(rates->rates), MAX_RATES);
        if (get_common_rates(priv, rates->rates, &tmplen)) {
                ret = -1;
                goto done;
@@ -598,7 +596,7 @@ static int lbs_adhoc_join(struct lbs_private *priv,
        /* Copy Data rates from the rates recorded in scan response */
        memset(cmd.bss.rates, 0, sizeof(cmd.bss.rates));
-        ratesize = min_t(u16, sizeof(cmd.bss.rates), MAX_RATES);
+        ratesize = min_t(u16, ARRAY_SIZE(cmd.bss.rates), MAX_RATES);
        memcpy(cmd.bss.rates, bss->rates, ratesize);
        if (get_common_rates(priv, cmd.bss.rates, &ratesize)) {
                lbs_deb_join("ADHOC_JOIN: get_common_rates returned error.\n");
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
index 601b54249677..6c95af3023cc 100644
--- a/drivers/net/wireless/libertas/scan.c
+++ b/drivers/net/wireless/libertas/scan.c
@@ -5,6 +5,7 @@
  *  for sending scan commands to the firmware.
  */
 #include <linux/types.h>
+#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
 #include <asm/unaligned.h>
@@ -876,7 +877,7 @@ static inline char *lbs_translate_scan(struct lbs_private *priv,
        iwe.u.bitrate.disabled = 0;
        iwe.u.bitrate.value = 0;
-        for (j = 0; bss->rates[j] && (j < sizeof(bss->rates)); j++) {
+        for (j = 0; j < ARRAY_SIZE(bss->rates) && bss->rates[j]; j++) {
                /* Bit rate given in 500 kb/s units */
                iwe.u.bitrate.value = bss->rates[j] * 500000;
                current_val = iwe_stream_add_value(info, start, current_val,
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 40b07b988224..3bd3c779fff3 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -698,7 +698,7 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
                        && !mac->pass_ctrl)
                return 0;
-        fc = *(__le16 *)buffer;
+        fc = get_unaligned((__le16*)buffer);
        need_padding = ieee80211_is_data_qos(fc) ^ ieee80211_has_a4(fc);
        skb = dev_alloc_skb(length + (need_padding ? 2 : 0));
diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c
index 0f0e0b919ef4..a45b0c0d574e 100644
--- a/drivers/parisc/ccio-dma.c
+++ b/drivers/parisc/ccio-dma.c
@@ -70,7 +70,6 @@
 #undef CCIO_COLLECT_STATS
 #endif
-#include <linux/proc_fs.h>
 #include <asm/runway.h>         /* for proc_runway_root */
 #ifdef DEBUG_CCIO_INIT
diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
index c590974e9815..d69bde6a2343 100644
--- a/drivers/parisc/dino.c
+++ b/drivers/parisc/dino.c
@@ -614,7 +614,7 @@ dino_fixup_bus(struct pci_bus *bus)
                            dev_name(&bus->self->dev), i,
                            bus->self->resource[i].start,
                            bus->self->resource[i].end);
-                        pci_assign_resource(bus->self, i);
+                        WARN_ON(pci_assign_resource(bus->self, i));
                        DBG("DEBUG %s after assign %d [0x%lx,0x%lx]\n",
                            dev_name(&bus->self->dev), i,
                            bus->self->resource[i].start,
diff --git a/drivers/parisc/eisa_eeprom.c b/drivers/parisc/eisa_eeprom.c
index 685d94e69d44..8c0b26e9b98a 100644
--- a/drivers/parisc/eisa_eeprom.c
+++ b/drivers/parisc/eisa_eeprom.c
@@ -55,7 +55,7 @@ static ssize_t eisa_eeprom_read(struct file * file,
        ssize_t ret;
        int i;
        
-        if (*ppos >= HPEE_MAX_LENGTH)
+        if (*ppos < 0 || *ppos >= HPEE_MAX_LENGTH)
                return 0;
        
        count = *ppos + count < HPEE_MAX_LENGTH ? count : HPEE_MAX_LENGTH - *ppos;
diff --git a/drivers/parisc/hppb.c b/drivers/parisc/hppb.c
index 13856415b432..815db175d427 100644
--- a/drivers/parisc/hppb.c
+++ b/drivers/parisc/hppb.c
@@ -62,7 +62,8 @@ static int hppb_probe(struct parisc_device *dev)
                }
                card = card->next;
        }
-        printk(KERN_INFO "Found GeckoBoa at 0x%x\n", dev->hpa.start);
+        printk(KERN_INFO "Found GeckoBoa at 0x%llx\n",
+                        (unsigned long long) dev->hpa.start);
        card->hpa = dev->hpa.start;
        card->mmio_region.name = "HP-PB Bus";
@@ -73,8 +74,10 @@ static int hppb_probe(struct parisc_device *dev)
        status = ccio_request_resource(dev, &card->mmio_region);
        if(status < 0) {
-                printk(KERN_ERR "%s: failed to claim HP-PB bus space (%08x, %08x)\n",
+                printk(KERN_ERR "%s: failed to claim HP-PB "
-                        __FILE__, card->mmio_region.start, card->mmio_region.end);
+                        "bus space (0x%08llx, 0x%08llx)\n",
+                        __FILE__, (unsigned long long) card->mmio_region.start,
+                        (unsigned long long) card->mmio_region.end);
        }
        return 0;
diff --git a/drivers/parisc/lba_pci.c b/drivers/parisc/lba_pci.c
index ede614616f8e..3aeb3279c92a 100644
--- a/drivers/parisc/lba_pci.c
+++ b/drivers/parisc/lba_pci.c
@@ -992,7 +992,7 @@ lba_pat_resources(struct parisc_device *pa_dev, struct lba_device *lba_dev)
                return;
        io_pdc_cell = kzalloc(sizeof(pdc_pat_cell_mod_maddr_block_t), GFP_KERNEL);
-        if (!pa_pdc_cell) {
+        if (!io_pdc_cell) {
                kfree(pa_pdc_cell);
                return;
        }
diff --git a/drivers/parisc/pdc_stable.c b/drivers/parisc/pdc_stable.c
index f9f9a5f1bbd0..13a64bc081b6 100644
--- a/drivers/parisc/pdc_stable.c
+++ b/drivers/parisc/pdc_stable.c
@@ -370,7 +370,7 @@ pdcspath_layer_read(struct pdcspath_entry *entry, char *buf)
        if (!i) /* entry is not ready */
                return -ENODATA;
        
-        for (i = 0; devpath->layers[i] && (likely(i < 6)); i++)
+        for (i = 0; i < 6 && devpath->layers[i]; i++)
                out += sprintf(out, "%u ", devpath->layers[i]);
        out += sprintf(out, "\n");
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index 8030e25152fb..c75d6f35cb5f 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -553,40 +553,35 @@ static void _zfcp_erp_unit_reopen_all(struct zfcp_port *port, int clear,
                _zfcp_erp_unit_reopen(unit, clear, id, ref);
 }
-static void zfcp_erp_strategy_followup_actions(struct zfcp_erp_action *act)
+static void zfcp_erp_strategy_followup_failed(struct zfcp_erp_action *act)
 {
-        struct zfcp_adapter *adapter = act->adapter;
-        struct zfcp_port *port = act->port;
-        struct zfcp_unit *unit = act->unit;
-        u32 status = act->status;
-        /* initiate follow-up actions depending on success of finished action */
        switch (act->action) {
        case ZFCP_ERP_ACTION_REOPEN_ADAPTER:
-                if (status == ZFCP_ERP_SUCCEEDED)
+                _zfcp_erp_adapter_reopen(act->adapter, 0, "ersff_1", NULL);
-                        _zfcp_erp_port_reopen_all(adapter, 0, "ersfa_1", NULL);
-                else
-                        _zfcp_erp_adapter_reopen(adapter, 0, "ersfa_2", NULL);
                break;
        case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
-                if (status == ZFCP_ERP_SUCCEEDED)
+                _zfcp_erp_port_forced_reopen(act->port, 0, "ersff_2", NULL);
-                        _zfcp_erp_port_reopen(port, 0, "ersfa_3", NULL);
-                else
-                        _zfcp_erp_adapter_reopen(adapter, 0, "ersfa_4", NULL);
                break;
        case ZFCP_ERP_ACTION_REOPEN_PORT:
-                if (status == ZFCP_ERP_SUCCEEDED)
+                _zfcp_erp_port_reopen(act->port, 0, "ersff_3", NULL);
-                        _zfcp_erp_unit_reopen_all(port, 0, "ersfa_5", NULL);
-                else
-                        _zfcp_erp_port_forced_reopen(port, 0, "ersfa_6", NULL);
                break;
        case ZFCP_ERP_ACTION_REOPEN_UNIT:
-                if (status != ZFCP_ERP_SUCCEEDED)
+                _zfcp_erp_unit_reopen(act->unit, 0, "ersff_4", NULL);
-                        _zfcp_erp_port_reopen(unit->port, 0, "ersfa_7", NULL);
+                break;
+        }
+}
+static void zfcp_erp_strategy_followup_success(struct zfcp_erp_action *act)
+{
+        switch (act->action) {
+        case ZFCP_ERP_ACTION_REOPEN_ADAPTER:
+                _zfcp_erp_port_reopen_all(act->adapter, 0, "ersfs_1", NULL);
+                break;
+        case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
+                _zfcp_erp_port_reopen(act->port, 0, "ersfs_2", NULL);
+                break;
+        case ZFCP_ERP_ACTION_REOPEN_PORT:
+                _zfcp_erp_unit_reopen_all(act->port, 0, "ersfs_3", NULL);
                break;
        }
 }
@@ -801,7 +796,7 @@ static int zfcp_erp_port_forced_strategy(struct zfcp_erp_action *erp_action)
                        return ZFCP_ERP_FAILED;
        case ZFCP_ERP_STEP_PHYS_PORT_CLOSING:
-                if (status & ZFCP_STATUS_PORT_PHYS_OPEN)
+                if (!(status & ZFCP_STATUS_PORT_PHYS_OPEN))
                        return ZFCP_ERP_SUCCEEDED;
        }
        return ZFCP_ERP_FAILED;
@@ -853,11 +848,17 @@ void zfcp_erp_port_strategy_open_lookup(struct work_struct *work)
                                              gid_pn_work);
        retval = zfcp_fc_ns_gid_pn(&port->erp_action);
-        if (retval == -ENOMEM)
+        if (!retval) {
-                zfcp_erp_notify(&port->erp_action, ZFCP_ERP_NOMEM);
+                port->erp_action.step = ZFCP_ERP_STEP_NAMESERVER_LOOKUP;
-        port->erp_action.step = ZFCP_ERP_STEP_NAMESERVER_LOOKUP;
+                goto out;
-        if (retval)
+        }
-                zfcp_erp_notify(&port->erp_action, ZFCP_ERP_FAILED);
+        if (retval == -ENOMEM) {
+                zfcp_erp_notify(&port->erp_action, ZFCP_STATUS_ERP_LOWMEM);
+                goto out;
+        }
+        /* all other error condtions */
+        zfcp_erp_notify(&port->erp_action, 0);
+out:
        zfcp_port_put(port);
 }
@@ -1289,7 +1290,10 @@ static int zfcp_erp_strategy(struct zfcp_erp_action *erp_action)
        retval = zfcp_erp_strategy_statechange(erp_action, retval);
        if (retval == ZFCP_ERP_EXIT)
                goto unlock;
-        zfcp_erp_strategy_followup_actions(erp_action);
+        if (retval == ZFCP_ERP_SUCCEEDED)
+                zfcp_erp_strategy_followup_success(erp_action);
+        if (retval == ZFCP_ERP_FAILED)
+                zfcp_erp_strategy_followup_failed(erp_action);
 unlock:
        write_unlock(&adapter->erp_lock);
diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c
index 2f0705d76b72..47daebfa7e59 100644
--- a/drivers/s390/scsi/zfcp_fc.c
+++ b/drivers/s390/scsi/zfcp_fc.c
@@ -79,11 +79,9 @@ static int zfcp_wka_port_get(struct zfcp_wka_port *wka_port)
        mutex_unlock(&wka_port->mutex);
-        wait_event_timeout(
+        wait_event(wka_port->completion_wq,
-                wka_port->completion_wq,
+                   wka_port->status == ZFCP_WKA_PORT_ONLINE ||
-                wka_port->status == ZFCP_WKA_PORT_ONLINE ||
+                   wka_port->status == ZFCP_WKA_PORT_OFFLINE);
-                wka_port->status == ZFCP_WKA_PORT_OFFLINE,
-                HZ >> 1);
        if (wka_port->status == ZFCP_WKA_PORT_ONLINE) {
                atomic_inc(&wka_port->refcount);
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index c57658f3d34f..47795fbf081f 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -670,8 +670,11 @@ static int zfcp_fsf_req_sbal_get(struct zfcp_adapter *adapter)
                               zfcp_fsf_sbal_check(adapter), 5 * HZ);
        if (ret > 0)
                return 0;
-        if (!ret)
+        if (!ret) {
                atomic_inc(&adapter->qdio_outb_full);
+                /* assume hanging outbound queue, try queue recovery */
+                zfcp_erp_adapter_reopen(adapter, 0, "fsrsg_1", NULL);
+        }
        spin_lock_bh(&adapter->req_q_lock);
        return -EIO;
@@ -722,7 +725,7 @@ static struct zfcp_fsf_req *zfcp_fsf_req_create(struct zfcp_adapter *adapter,
                req = zfcp_fsf_alloc_qtcb(pool);
        if (unlikely(!req))
-                return ERR_PTR(-EIO);
+                return ERR_PTR(-ENOMEM);
        if (adapter->req_no == 0)
                adapter->req_no++;
@@ -1010,6 +1013,23 @@ skip_fsfstatus:
                send_ct->handler(send_ct->handler_data);
 }
+static void zfcp_fsf_setup_ct_els_unchained(struct qdio_buffer_element *sbale,
+                                            struct scatterlist *sg_req,
+                                            struct scatterlist *sg_resp)
+{
+        sbale[0].flags |= SBAL_FLAGS0_TYPE_WRITE_READ;
+        sbale[2].addr   = sg_virt(sg_req);
+        sbale[2].length = sg_req->length;
+        sbale[3].addr   = sg_virt(sg_resp);
+        sbale[3].length = sg_resp->length;
+        sbale[3].flags |= SBAL_FLAGS_LAST_ENTRY;
+}
+static int zfcp_fsf_one_sbal(struct scatterlist *sg)
+{
+        return sg_is_last(sg) && sg->length <= PAGE_SIZE;
+}
 static int zfcp_fsf_setup_ct_els_sbals(struct zfcp_fsf_req *req,
                                       struct scatterlist *sg_req,
                                       struct scatterlist *sg_resp,
@@ -1020,30 +1040,30 @@ static int zfcp_fsf_setup_ct_els_sbals(struct zfcp_fsf_req *req,
        int bytes;
        if (!(feat & FSF_FEATURE_ELS_CT_CHAINED_SBALS)) {
-                if (sg_req->length > PAGE_SIZE || sg_resp->length > PAGE_SIZE ||
+                if (!zfcp_fsf_one_sbal(sg_req) || !zfcp_fsf_one_sbal(sg_resp))
-                    !sg_is_last(sg_req) || !sg_is_last(sg_resp))
                        return -EOPNOTSUPP;
-                sbale[0].flags |= SBAL_FLAGS0_TYPE_WRITE_READ;
+                zfcp_fsf_setup_ct_els_unchained(sbale, sg_req, sg_resp);
-                sbale[2].addr   = sg_virt(sg_req);
+                return 0;
-                sbale[2].length = sg_req->length;
+        }
-                sbale[3].addr   = sg_virt(sg_resp);
-                sbale[3].length = sg_resp->length;
+        /* use single, unchained SBAL if it can hold the request */
-                sbale[3].flags |= SBAL_FLAGS_LAST_ENTRY;
+        if (zfcp_fsf_one_sbal(sg_req) && zfcp_fsf_one_sbal(sg_resp)) {
+                zfcp_fsf_setup_ct_els_unchained(sbale, sg_req, sg_resp);
                return 0;
        }
        bytes = zfcp_qdio_sbals_from_sg(req, SBAL_FLAGS0_TYPE_WRITE_READ,
                                        sg_req, max_sbals);
        if (bytes <= 0)
-                return -ENOMEM;
+                return -EIO;
        req->qtcb->bottom.support.req_buf_length = bytes;
        req->sbale_curr = ZFCP_LAST_SBALE_PER_SBAL;
        bytes = zfcp_qdio_sbals_from_sg(req, SBAL_FLAGS0_TYPE_WRITE_READ,
                                        sg_resp, max_sbals);
        if (bytes <= 0)
-                return -ENOMEM;
+                return -EIO;
        req->qtcb->bottom.support.resp_buf_length = bytes;
        return 0;
@@ -1607,10 +1627,10 @@ static void zfcp_fsf_open_wka_port_handler(struct zfcp_fsf_req *req)
        case FSF_ACCESS_DENIED:
                wka_port->status = ZFCP_WKA_PORT_OFFLINE;
                break;
-        case FSF_PORT_ALREADY_OPEN:
-                break;
        case FSF_GOOD:
                wka_port->handle = header->port_handle;
+                /* fall through */
+        case FSF_PORT_ALREADY_OPEN:
                wka_port->status = ZFCP_WKA_PORT_ONLINE;
        }
 out:
@@ -1731,15 +1751,16 @@ static void zfcp_fsf_close_physical_port_handler(struct zfcp_fsf_req *req)
                zfcp_fsf_access_denied_port(req, port);
                break;
        case FSF_PORT_BOXED:
-                zfcp_erp_port_boxed(port, "fscpph2", req);
-                req->status |= ZFCP_STATUS_FSFREQ_ERROR |
-                               ZFCP_STATUS_FSFREQ_RETRY;
                /* can't use generic zfcp_erp_modify_port_status because
                 * ZFCP_STATUS_COMMON_OPEN must not be reset for the port */
                atomic_clear_mask(ZFCP_STATUS_PORT_PHYS_OPEN, &port->status);
                list_for_each_entry(unit, &port->unit_list_head, list)
                        atomic_clear_mask(ZFCP_STATUS_COMMON_OPEN,
                                          &unit->status);
+                zfcp_erp_port_boxed(port, "fscpph2", req);
+                req->status |= ZFCP_STATUS_FSFREQ_ERROR |
+                               ZFCP_STATUS_FSFREQ_RETRY;
                break;
        case FSF_ADAPTER_STATUS_AVAILABLE:
                switch (header->fsf_status_qual.word[0]) {
@@ -2541,7 +2562,6 @@ struct zfcp_fsf_req *zfcp_fsf_control_file(struct zfcp_adapter *adapter,
        bytes = zfcp_qdio_sbals_from_sg(req, direction, fsf_cfdc->sg,
                                        FSF_MAX_SBALS_PER_REQ);
        if (bytes != ZFCP_CFDC_MAX_SIZE) {
-                retval = -ENOMEM;
                zfcp_fsf_req_free(req);
                goto out;
        }
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 967ede73f4c5..6925a1784682 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -167,20 +167,21 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
        struct zfcp_unit *unit = scpnt->device->hostdata;
        struct zfcp_fsf_req *old_req, *abrt_req;
        unsigned long flags;
-        unsigned long old_req_id = (unsigned long) scpnt->host_scribble;
+        unsigned long old_reqid = (unsigned long) scpnt->host_scribble;
        int retval = SUCCESS;
        int retry = 3;
+        char *dbf_tag;
        /* avoid race condition between late normal completion and abort */
        write_lock_irqsave(&adapter->abort_lock, flags);
        spin_lock(&adapter->req_list_lock);
-        old_req = zfcp_reqlist_find(adapter, old_req_id);
+        old_req = zfcp_reqlist_find(adapter, old_reqid);
        spin_unlock(&adapter->req_list_lock);
        if (!old_req) {
                write_unlock_irqrestore(&adapter->abort_lock, flags);
                zfcp_scsi_dbf_event_abort("lte1", adapter, scpnt, NULL,
-                                          old_req_id);
+                                          old_reqid);
                return FAILED; /* completion could be in progress */
        }
        old_req->data = NULL;
@@ -189,7 +190,7 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
        write_unlock_irqrestore(&adapter->abort_lock, flags);
        while (retry--) {
-                abrt_req = zfcp_fsf_abort_fcp_command(old_req_id, unit);
+                abrt_req = zfcp_fsf_abort_fcp_command(old_reqid, unit);
                if (abrt_req)
                        break;
@@ -197,7 +198,7 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
                if (!(atomic_read(&adapter->status) &
                      ZFCP_STATUS_COMMON_RUNNING)) {
                        zfcp_scsi_dbf_event_abort("nres", adapter, scpnt, NULL,
-                                                  old_req_id);
+                                                  old_reqid);
                        return SUCCESS;
                }
        }
@@ -208,13 +209,14 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
                   abrt_req->status & ZFCP_STATUS_FSFREQ_COMPLETED);
        if (abrt_req->status & ZFCP_STATUS_FSFREQ_ABORTSUCCEEDED)
-                zfcp_scsi_dbf_event_abort("okay", adapter, scpnt, abrt_req, 0);
+                dbf_tag = "okay";
        else if (abrt_req->status & ZFCP_STATUS_FSFREQ_ABORTNOTNEEDED)
-                zfcp_scsi_dbf_event_abort("lte2", adapter, scpnt, abrt_req, 0);
+                dbf_tag = "lte2";
        else {
-                zfcp_scsi_dbf_event_abort("fail", adapter, scpnt, abrt_req, 0);
+                dbf_tag = "fail";
                retval = FAILED;
        }
+        zfcp_scsi_dbf_event_abort(dbf_tag, adapter, scpnt, abrt_req, old_reqid);
        zfcp_fsf_req_free(abrt_req);
        return retval;
 }
@@ -534,6 +536,9 @@ static void zfcp_scsi_rport_register(struct zfcp_port *port)
        struct fc_rport_identifiers ids;
        struct fc_rport *rport;
+        if (port->rport)
+                return;
        ids.node_name = port->wwnn;
        ids.port_name = port->wwpn;
        ids.port_id = port->d_id;
@@ -557,8 +562,10 @@ static void zfcp_scsi_rport_block(struct zfcp_port *port)
 {
        struct fc_rport *rport = port->rport;
-        if (rport)
+        if (rport) {
                fc_remote_port_delete(rport);
+                port->rport = NULL;
+        }
 }
 void zfcp_scsi_schedule_rport_register(struct zfcp_port *port)
diff --git a/drivers/s390/scsi/zfcp_sysfs.c b/drivers/s390/scsi/zfcp_sysfs.c
index 3e51e64d1108..0fe5cce818cb 100644
--- a/drivers/s390/scsi/zfcp_sysfs.c
+++ b/drivers/s390/scsi/zfcp_sysfs.c
@@ -494,9 +494,14 @@ static ssize_t zfcp_sysfs_adapter_q_full_show(struct device *dev,
        struct Scsi_Host *scsi_host = class_to_shost(dev);
        struct zfcp_adapter *adapter =
                (struct zfcp_adapter *) scsi_host->hostdata[0];
+        u64 util;
+        spin_lock_bh(&adapter->qdio_stat_lock);
+        util = adapter->req_q_util;
+        spin_unlock_bh(&adapter->qdio_stat_lock);
        return sprintf(buf, "%d %llu\n", atomic_read(&adapter->qdio_outb_full),
-                       (unsigned long long)adapter->req_q_util);
+                       (unsigned long long)util);
 }
 static DEVICE_ATTR(queue_full, S_IRUGO, zfcp_sysfs_adapter_q_full_show, NULL);
diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
index 2bc22be5f849..145ab9ba55ea 100644
--- a/drivers/scsi/libfc/fc_exch.c
+++ b/drivers/scsi/libfc/fc_exch.c
@@ -415,9 +415,9 @@ static void fc_exch_timeout(struct work_struct *work)
        e_stat = ep->esb_stat;
        if (e_stat & ESB_ST_COMPLETE) {
                ep->esb_stat = e_stat & ~ESB_ST_REC_QUAL;
+                spin_unlock_bh(&ep->ex_lock);
                if (e_stat & ESB_ST_REC_QUAL)
                        fc_exch_rrq(ep);
-                spin_unlock_bh(&ep->ex_lock);
                goto done;
        } else {
                resp = ep->resp;
@@ -1624,14 +1624,14 @@ static void fc_exch_rrq(struct fc_exch *ep)
        struct fc_lport *lp;
        struct fc_els_rrq *rrq;
        struct fc_frame *fp;
-        struct fc_seq *rrq_sp;
        u32 did;
        lp = ep->lp;
        fp = fc_frame_alloc(lp, sizeof(*rrq));
        if (!fp)
-                return;
+                goto retry;
        rrq = fc_frame_payload_get(fp, sizeof(*rrq));
        memset(rrq, 0, sizeof(*rrq));
        rrq->rrq_cmd = ELS_RRQ;
@@ -1647,13 +1647,20 @@ static void fc_exch_rrq(struct fc_exch *ep)
                       fc_host_port_id(lp->host), FC_TYPE_ELS,
                       FC_FC_FIRST_SEQ | FC_FC_END_SEQ | FC_FC_SEQ_INIT, 0);
-        rrq_sp = fc_exch_seq_send(lp, fp, fc_exch_rrq_resp, NULL, ep,
+        if (fc_exch_seq_send(lp, fp, fc_exch_rrq_resp, NULL, ep, lp->e_d_tov))
-                                  lp->e_d_tov);
+                return;
-        if (!rrq_sp) {
-                ep->esb_stat |= ESB_ST_REC_QUAL;
+retry:
-                fc_exch_timer_set_locked(ep, ep->r_a_tov);
+        spin_lock_bh(&ep->ex_lock);
+        if (ep->state & (FC_EX_RST_CLEANUP | FC_EX_DONE)) {
+                spin_unlock_bh(&ep->ex_lock);
+                /* drop hold for rec qual */
+                fc_exch_release(ep);
                return;
        }
+        ep->esb_stat |= ESB_ST_REC_QUAL;
+        fc_exch_timer_set_locked(ep, ep->r_a_tov);
+        spin_unlock_bh(&ep->ex_lock);
 }
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 716cc344c5df..a751f6230c22 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -1974,10 +1974,10 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
                 * good and have never sent us a successful tmf response
                 * then sent more data for the cmd.
                 */
-                spin_lock(&session->lock);
+                spin_lock_bh(&session->lock);
                fail_scsi_task(task, DID_ABORT);
                conn->tmf_state = TMF_INITIAL;
-                spin_unlock(&session->lock);
+                spin_unlock_bh(&session->lock);
                iscsi_start_tx(conn);
                goto success_unlocked;
        case TMF_TIMEDOUT:
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index 54fa1e42dc4d..b3381959acce 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -766,6 +766,7 @@ static int sas_ex_join_wide_port(struct domain_device *parent, int phy_id)
                if (!memcmp(phy->attached_sas_addr, ephy->attached_sas_addr,
                            SAS_ADDR_SIZE) && ephy->port) {
                        sas_port_add_phy(ephy->port, phy->phy);
+                        phy->port = ephy->port;
                        phy->phy_state = PHY_DEVICE_DISCOVERED;
                        return 0;
                }
@@ -945,11 +946,21 @@ static int sas_ex_discover_dev(struct domain_device *dev, int phy_id)
                        if (ex->ex_phy[i].phy_state == PHY_VACANT ||
                            ex->ex_phy[i].phy_state == PHY_NOT_PRESENT)
                                continue;
+                        /*
+                         * Due to races, the phy might not get added to the
+                         * wide port, so we add the phy to the wide port here.
+                         */
                        if (SAS_ADDR(ex->ex_phy[i].attached_sas_addr) ==
-                            SAS_ADDR(child->sas_addr))
+                            SAS_ADDR(child->sas_addr)) {
                                ex->ex_phy[i].phy_state= PHY_DEVICE_DISCOVERED;
+                                res = sas_ex_join_wide_port(dev, i);
+                                if (!res)
+                                        SAS_DPRINTK("Attaching ex phy%d to wide port %016llx\n",
+                                                    i, SAS_ADDR(ex->ex_phy[i].attached_sas_addr));
+                        }
                }
+                res = 0;
        }
        return res;
@@ -1598,7 +1609,7 @@ static int sas_get_phy_attached_sas_addr(struct domain_device *dev,
 }
 static int sas_find_bcast_phy(struct domain_device *dev, int *phy_id,
-                              int from_phy)
+                              int from_phy, bool update)
 {
        struct expander_device *ex = &dev->ex_dev;
        int res = 0;
@@ -1611,7 +1622,9 @@ static int sas_find_bcast_phy(struct domain_device *dev, int *phy_id,
                if (res)
                        goto out;
                else if (phy_change_count != ex->ex_phy[i].phy_change_count) {
-                        ex->ex_phy[i].phy_change_count = phy_change_count;
+                        if (update)
+                                ex->ex_phy[i].phy_change_count =
+                                        phy_change_count;
                        *phy_id = i;
                        return 0;
                }
@@ -1653,31 +1666,52 @@ out:
        kfree(rg_req);
        return res;
 }
+/**
+ * sas_find_bcast_dev -  find the device issue BROADCAST(CHANGE).
+ * @dev:domain device to be detect.
+ * @src_dev: the device which originated BROADCAST(CHANGE).
+ *
+ * Add self-configuration expander suport. Suppose two expander cascading,
+ * when the first level expander is self-configuring, hotplug the disks in
+ * second level expander, BROADCAST(CHANGE) will not only be originated
+ * in the second level expander, but also be originated in the first level
+ * expander (see SAS protocol SAS 2r-14, 7.11 for detail), it is to say,
+ * expander changed count in two level expanders will all increment at least
+ * once, but the phy which chang count has changed is the source device which
+ * we concerned.
+ */
 static int sas_find_bcast_dev(struct domain_device *dev,
                              struct domain_device **src_dev)
 {
        struct expander_device *ex = &dev->ex_dev;
        int ex_change_count = -1;
+        int phy_id = -1;
        int res;
+        struct domain_device *ch;
        res = sas_get_ex_change_count(dev, &ex_change_count);
        if (res)
                goto out;
-        if (ex_change_count != -1 &&
+        if (ex_change_count != -1 && ex_change_count != ex->ex_change_count) {
-            ex_change_count != ex->ex_change_count) {
+                /* Just detect if this expander phys phy change count changed,
-                *src_dev = dev;
+                * in order to determine if this expander originate BROADCAST,
-                ex->ex_change_count = ex_change_count;
+                * and do not update phy change count field in our structure.
-        } else {
+                */
-                struct domain_device *ch;
+                res = sas_find_bcast_phy(dev, &phy_id, 0, false);
+                if (phy_id != -1) {
-                list_for_each_entry(ch, &ex->children, siblings) {
+                        *src_dev = dev;
-                        if (ch->dev_type == EDGE_DEV ||
+                        ex->ex_change_count = ex_change_count;
-                            ch->dev_type == FANOUT_DEV) {
+                        SAS_DPRINTK("Expander phy change count has changed\n");
-                                res = sas_find_bcast_dev(ch, src_dev);
+                        return res;
-                                if (src_dev)
+                } else
-                                        return res;
+                        SAS_DPRINTK("Expander phys DID NOT change\n");
-                        }
+        }
+        list_for_each_entry(ch, &ex->children, siblings) {
+                if (ch->dev_type == EDGE_DEV || ch->dev_type == FANOUT_DEV) {
+                        res = sas_find_bcast_dev(ch, src_dev);
+                        if (src_dev)
+                                return res;
                }
        }
 out:
@@ -1700,24 +1734,26 @@ static void sas_unregister_ex_tree(struct domain_device *dev)
 }
 static void sas_unregister_devs_sas_addr(struct domain_device *parent,
-                                         int phy_id)
+                                         int phy_id, bool last)
 {
        struct expander_device *ex_dev = &parent->ex_dev;
        struct ex_phy *phy = &ex_dev->ex_phy[phy_id];
        struct domain_device *child, *n;
+        if (last) {
-        list_for_each_entry_safe(child, n, &ex_dev->children, siblings) {
+                list_for_each_entry_safe(child, n,
-                if (SAS_ADDR(child->sas_addr) ==
+                        &ex_dev->children, siblings) {
-                    SAS_ADDR(phy->attached_sas_addr)) {
+                        if (SAS_ADDR(child->sas_addr) ==
-                        if (child->dev_type == EDGE_DEV ||
+                            SAS_ADDR(phy->attached_sas_addr)) {
-                            child->dev_type == FANOUT_DEV)
+                                if (child->dev_type == EDGE_DEV ||
-                                sas_unregister_ex_tree(child);
+                                    child->dev_type == FANOUT_DEV)
-                        else
+                                        sas_unregister_ex_tree(child);
-                                sas_unregister_dev(child);
+                                else
-                        break;
+                                        sas_unregister_dev(child);
+                                break;
+                        }
                }
+                sas_disable_routing(parent, phy->attached_sas_addr);
        }
-        sas_disable_routing(parent, phy->attached_sas_addr);
        memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
        sas_port_delete_phy(phy->port, phy->phy);
        if (phy->port->num_phys == 0)
@@ -1770,15 +1806,31 @@ static int sas_discover_new(struct domain_device *dev, int phy_id)
 {
        struct ex_phy *ex_phy = &dev->ex_dev.ex_phy[phy_id];
        struct domain_device *child;
-        int res;
+        bool found = false;
+        int res, i;
        SAS_DPRINTK("ex %016llx phy%d new device attached\n",
                    SAS_ADDR(dev->sas_addr), phy_id);
        res = sas_ex_phy_discover(dev, phy_id);
        if (res)
                goto out;
+        /* to support the wide port inserted */
+        for (i = 0; i < dev->ex_dev.num_phys; i++) {
+                struct ex_phy *ex_phy_temp = &dev->ex_dev.ex_phy[i];
+                if (i == phy_id)
+                        continue;
+                if (SAS_ADDR(ex_phy_temp->attached_sas_addr) ==
+                    SAS_ADDR(ex_phy->attached_sas_addr)) {
+                        found = true;
+                        break;
+                }
+        }
+        if (found) {
+                sas_ex_join_wide_port(dev, phy_id);
+                return 0;
+        }
        res = sas_ex_discover_devices(dev, phy_id);
-        if (res)
+        if (!res)
                goto out;
        list_for_each_entry(child, &dev->ex_dev.children, siblings) {
                if (SAS_ADDR(child->sas_addr) ==
@@ -1793,7 +1845,7 @@ out:
        return res;
 }
-static int sas_rediscover_dev(struct domain_device *dev, int phy_id)
+static int sas_rediscover_dev(struct domain_device *dev, int phy_id, bool last)
 {
        struct expander_device *ex = &dev->ex_dev;
        struct ex_phy *phy = &ex->ex_phy[phy_id];
@@ -1804,11 +1856,11 @@ static int sas_rediscover_dev(struct domain_device *dev, int phy_id)
        switch (res) {
        case SMP_RESP_NO_PHY:
                phy->phy_state = PHY_NOT_PRESENT;
-                sas_unregister_devs_sas_addr(dev, phy_id);
+                sas_unregister_devs_sas_addr(dev, phy_id, last);
                goto out; break;
        case SMP_RESP_PHY_VACANT:
                phy->phy_state = PHY_VACANT;
-                sas_unregister_devs_sas_addr(dev, phy_id);
+                sas_unregister_devs_sas_addr(dev, phy_id, last);
                goto out; break;
        case SMP_RESP_FUNC_ACC:
                break;
@@ -1816,7 +1868,7 @@ static int sas_rediscover_dev(struct domain_device *dev, int phy_id)
        if (SAS_ADDR(attached_sas_addr) == 0) {
                phy->phy_state = PHY_EMPTY;
-                sas_unregister_devs_sas_addr(dev, phy_id);
+                sas_unregister_devs_sas_addr(dev, phy_id, last);
        } else if (SAS_ADDR(attached_sas_addr) ==
                   SAS_ADDR(phy->attached_sas_addr)) {
                SAS_DPRINTK("ex %016llx phy 0x%x broadcast flutter\n",
@@ -1828,12 +1880,27 @@ out:
        return res;
 }
+/**
+ * sas_rediscover - revalidate the domain.
+ * @dev:domain device to be detect.
+ * @phy_id: the phy id will be detected.
+ *
+ * NOTE: this process _must_ quit (return) as soon as any connection
+ * errors are encountered.  Connection recovery is done elsewhere.
+ * Discover process only interrogates devices in order to discover the
+ * domain.For plugging out, we un-register the device only when it is
+ * the last phy in the port, for other phys in this port, we just delete it
+ * from the port.For inserting, we do discovery when it is the
+ * first phy,for other phys in this port, we add it to the port to
+ * forming the wide-port.
+ */
 static int sas_rediscover(struct domain_device *dev, const int phy_id)
 {
        struct expander_device *ex = &dev->ex_dev;
        struct ex_phy *changed_phy = &ex->ex_phy[phy_id];
        int res = 0;
        int i;
+        bool last = true;       /* is this the last phy of the port */
        SAS_DPRINTK("ex %016llx phy%d originated BROADCAST(CHANGE)\n",
                    SAS_ADDR(dev->sas_addr), phy_id);
@@ -1848,13 +1915,13 @@ static int sas_rediscover(struct domain_device *dev, const int phy_id)
                            SAS_ADDR(changed_phy->attached_sas_addr)) {
                                SAS_DPRINTK("phy%d part of wide port with "
                                            "phy%d\n", phy_id, i);
-                                goto out;
+                                last = false;
+                                break;
                        }
                }
-                res = sas_rediscover_dev(dev, phy_id);
+                res = sas_rediscover_dev(dev, phy_id, last);
        } else
                res = sas_discover_new(dev, phy_id);
-out:
        return res;
 }
@@ -1881,7 +1948,7 @@ int sas_ex_revalidate_domain(struct domain_device *port_dev)
                do {
                        phy_id = -1;
-                        res = sas_find_bcast_phy(dev, &phy_id, i);
+                        res = sas_find_bcast_phy(dev, &phy_id, i, true);
                        if (phy_id == -1)
                                break;
                        res = sas_rediscover(dev, phy_id);
diff --git a/drivers/scsi/libsas/sas_port.c b/drivers/scsi/libsas/sas_port.c
index e6ac59c023f1..fe8b74c706d2 100644
--- a/drivers/scsi/libsas/sas_port.c
+++ b/drivers/scsi/libsas/sas_port.c
@@ -56,7 +56,7 @@ static void sas_form_port(struct asd_sas_phy *phy)
                }
        }
-        /* find a port */
+        /* see if the phy should be part of a wide port */
        spin_lock_irqsave(&sas_ha->phy_port_lock, flags);
        for (i = 0; i < sas_ha->num_phys; i++) {
                port = sas_ha->sas_port[i];
@@ -69,12 +69,23 @@ static void sas_form_port(struct asd_sas_phy *phy)
                        SAS_DPRINTK("phy%d matched wide port%d\n", phy->id,
                                    port->id);
                        break;
-                } else if (*(u64 *) port->sas_addr == 0 && port->num_phys==0) {
-                        memcpy(port->sas_addr, phy->sas_addr, SAS_ADDR_SIZE);
-                        break;
                }
                spin_unlock(&port->phy_list_lock);
        }
+        /* The phy does not match any existing port, create a new one */
+        if (i == sas_ha->num_phys) {
+                for (i = 0; i < sas_ha->num_phys; i++) {
+                        port = sas_ha->sas_port[i];
+                        spin_lock(&port->phy_list_lock);
+                        if (*(u64 *)port->sas_addr == 0
+                                && port->num_phys == 0) {
+                                memcpy(port->sas_addr, phy->sas_addr,
+                                        SAS_ADDR_SIZE);
+                                break;
+                        }
+                        spin_unlock(&port->phy_list_lock);
+                }
+        }
        if (i >= sas_ha->num_phys) {
                printk(KERN_NOTICE "%s: couldn't find a free port, bug?\n",
diff --git a/drivers/scsi/qla4xxx/ql4_dbg.c b/drivers/scsi/qla4xxx/ql4_dbg.c
index fcc184cd066d..cbceb0ebabf7 100644
--- a/drivers/scsi/qla4xxx/ql4_dbg.c
+++ b/drivers/scsi/qla4xxx/ql4_dbg.c
@@ -15,19 +15,18 @@ void qla4xxx_dump_buffer(void *b, uint32_t size)
        uint32_t cnt;
        uint8_t *c = b;
-        printk(" 0   1   2   3   4   5   6   7   8   9  Ah  Bh  Ch  Dh  Eh  "
+        printk(" 0   1   2   3   4   5   6   7   8   9  Ah  Bh  Ch  Dh  Eh  "
               "Fh\n");
        printk("------------------------------------------------------------"
               "--\n");
-        for (cnt = 0; cnt < size; cnt++, c++) {
+        for (cnt = 0; cnt < size; c++) {
-                printk(KERN_DEBUG "%02x", *c);
+                printk(KERN_INFO "%02x", *c);
-                if (!(cnt % 16))
+                if (!(++cnt % 16))
-                        printk(KERN_DEBUG "\n");
+                        printk(KERN_INFO "\n");
                else
-                        printk(KERN_DEBUG "  ");
+                        printk(KERN_INFO "  ");
        }
-        if (cnt % 16)
+        printk(KERN_INFO "\n");
-                printk(KERN_DEBUG "\n");
 }
diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
index b586f27c3bd4..81b5f29254e2 100644
--- a/drivers/scsi/qla4xxx/ql4_def.h
+++ b/drivers/scsi/qla4xxx/ql4_def.h
@@ -100,7 +100,6 @@
 #define MAX_SRBS                MAX_CMDS_TO_RISC
 #define MBOX_AEN_REG_COUNT      5
 #define MAX_INIT_RETRIES        5
-#define IOCB_HIWAT_CUSHION      16
 /*
 * Buffer sizes
@@ -184,6 +183,11 @@ struct srb {
        uint16_t cc_stat;
        u_long r_start;         /* Time we recieve a cmd from OS */
        u_long u_start;         /* Time when we handed the cmd to F/W */
+        /* Used for extended sense / status continuation */
+        uint8_t *req_sense_ptr;
+        uint16_t req_sense_len;
+        uint16_t reserved2;
 };
 /*
@@ -302,7 +306,6 @@ struct scsi_qla_host {
        uint32_t tot_ddbs;
        uint16_t        iocb_cnt;
-        uint16_t        iocb_hiwat;
        /* SRB cache. */
 #define SRB_MIN_REQ     128
@@ -436,6 +439,8 @@ struct scsi_qla_host {
        /* Map ddb_list entry by FW ddb index */
        struct ddb_entry *fw_ddb_index_map[MAX_DDB_ENTRIES];
+        /* Saved srb for status continuation entry processing */
+        struct srb *status_srb;
 };
 static inline int is_qla4010(struct scsi_qla_host *ha)
diff --git a/drivers/scsi/qla4xxx/ql4_fw.h b/drivers/scsi/qla4xxx/ql4_fw.h
index 1b667a70cffa..9cd7a608df38 100644
--- a/drivers/scsi/qla4xxx/ql4_fw.h
+++ b/drivers/scsi/qla4xxx/ql4_fw.h
@@ -572,6 +572,7 @@ struct conn_event_log_entry {
 *************************************************************************/
 #define IOCB_MAX_CDB_LEN            16  /* Bytes in a CBD */
 #define IOCB_MAX_SENSEDATA_LEN      32  /* Bytes of sense data */
+#define IOCB_MAX_EXT_SENSEDATA_LEN  60  /* Bytes of extended sense data */
 /* IOCB header structure */
 struct qla4_header {
@@ -733,6 +734,12 @@ struct status_entry {
 };
+/* Status Continuation entry */
+struct status_cont_entry {
+       struct qla4_header hdr; /* 00-03 */
+       uint8_t ext_sense_data[IOCB_MAX_EXT_SENSEDATA_LEN]; /* 04-63 */
+};
 struct passthru0 {
        struct qla4_header hdr;                /* 00-03 */
        uint32_t handle;        /* 04-07 */
diff --git a/drivers/scsi/qla4xxx/ql4_iocb.c b/drivers/scsi/qla4xxx/ql4_iocb.c
index 912a67494adf..e0c32159749c 100644
--- a/drivers/scsi/qla4xxx/ql4_iocb.c
+++ b/drivers/scsi/qla4xxx/ql4_iocb.c
@@ -10,9 +10,42 @@
 #include "ql4_dbg.h"
 #include "ql4_inline.h"
 #include <scsi/scsi_tcq.h>
+static int
+qla4xxx_space_in_req_ring(struct scsi_qla_host *ha, uint16_t req_cnt)
+{
+        uint16_t cnt;
+        /* Calculate number of free request entries. */
+        if ((req_cnt + 2) >= ha->req_q_count) {
+                cnt = (uint16_t) le32_to_cpu(ha->shadow_regs->req_q_out);
+                if (ha->request_in < cnt)
+                        ha->req_q_count = cnt - ha->request_in;
+                else
+                        ha->req_q_count = REQUEST_QUEUE_DEPTH -
+                                                (ha->request_in - cnt);
+        }
+        /* Check if room for request in request ring. */
+        if ((req_cnt + 2) < ha->req_q_count)
+                return 1;
+        else
+                return 0;
+}
+static void qla4xxx_advance_req_ring_ptr(struct scsi_qla_host *ha)
+{
+        /* Advance request queue pointer */
+        if (ha->request_in == (REQUEST_QUEUE_DEPTH - 1)) {
+                ha->request_in = 0;
+                ha->request_ptr = ha->request_ring;
+        } else {
+                ha->request_in++;
+                ha->request_ptr++;
+        }
+}
 /**
 * qla4xxx_get_req_pkt - returns a valid entry in request queue.
 * @ha: Pointer to host adapter structure.
@@ -26,35 +59,18 @@
 static int qla4xxx_get_req_pkt(struct scsi_qla_host *ha,
                               struct queue_entry **queue_entry)
 {
-        uint16_t request_in;
+        uint16_t req_cnt = 1;
-        uint8_t status = QLA_SUCCESS;
-        *queue_entry = ha->request_ptr;
-        /* get the latest request_in and request_out index */
+        if (qla4xxx_space_in_req_ring(ha, req_cnt)) {
-        request_in = ha->request_in;
+                *queue_entry = ha->request_ptr;
-        ha->request_out = (uint16_t) le32_to_cpu(ha->shadow_regs->req_q_out);
-        /* Advance request queue pointer and check for queue full */
-        if (request_in == (REQUEST_QUEUE_DEPTH - 1)) {
-                request_in = 0;
-                ha->request_ptr = ha->request_ring;
-        } else {
-                request_in++;
-                ha->request_ptr++;
-        }
-        /* request queue is full, try again later */
-        if ((ha->iocb_cnt + 1) >= ha->iocb_hiwat) {
-                /* restore request pointer */
-                ha->request_ptr = *queue_entry;
-                status = QLA_ERROR;
-        } else {
-                ha->request_in = request_in;
                memset(*queue_entry, 0, sizeof(**queue_entry));
+                qla4xxx_advance_req_ring_ptr(ha);
+                ha->req_q_count -= req_cnt;
+                return QLA_SUCCESS;
        }
-        return status;
+        return QLA_ERROR;
 }
 /**
@@ -100,21 +116,14 @@ exit_send_marker:
        return status;
 }
-static struct continuation_t1_entry* qla4xxx_alloc_cont_entry(
+static struct continuation_t1_entry *
-        struct scsi_qla_host *ha)
+qla4xxx_alloc_cont_entry(struct scsi_qla_host *ha)
 {
        struct continuation_t1_entry *cont_entry;
        cont_entry = (struct continuation_t1_entry *)ha->request_ptr;
-        /* Advance request queue pointer */
+        qla4xxx_advance_req_ring_ptr(ha);
-        if (ha->request_in == (REQUEST_QUEUE_DEPTH - 1)) {
-                ha->request_in = 0;
-                ha->request_ptr = ha->request_ring;
-        } else {
-                ha->request_in++;
-                ha->request_ptr++;
-        }
        /* Load packet defaults */
        cont_entry->hdr.entryType = ET_CONTINUE;
@@ -197,13 +206,10 @@ int qla4xxx_send_command_to_isp(struct scsi_qla_host *ha, struct srb * srb)
        struct scsi_cmnd *cmd = srb->cmd;
        struct ddb_entry *ddb_entry;
        struct command_t3_entry *cmd_entry;
        int nseg;
        uint16_t tot_dsds;
        uint16_t req_cnt;
        unsigned long flags;
-        uint16_t cnt;
        uint32_t index;
        char tag[2];
@@ -217,6 +223,19 @@ int qla4xxx_send_command_to_isp(struct scsi_qla_host *ha, struct srb * srb)
        index = (uint32_t)cmd->request->tag;
+        /*
+         * Check to see if adapter is online before placing request on
+         * request queue.  If a reset occurs and a request is in the queue,
+         * the firmware will still attempt to process the request, retrieving
+         * garbage for pointers.
+         */
+        if (!test_bit(AF_ONLINE, &ha->flags)) {
+                DEBUG2(printk("scsi%ld: %s: Adapter OFFLINE! "
+                              "Do not issue command.\n",
+                              ha->host_no, __func__));
+                goto queuing_error;
+        }
        /* Calculate the number of request entries needed. */
        nseg = scsi_dma_map(cmd);
        if (nseg < 0)
@@ -224,17 +243,7 @@ int qla4xxx_send_command_to_isp(struct scsi_qla_host *ha, struct srb * srb)
        tot_dsds = nseg;
        req_cnt = qla4xxx_calc_request_entries(tot_dsds);
+        if (!qla4xxx_space_in_req_ring(ha, req_cnt))
-        if (ha->req_q_count < (req_cnt + 2)) {
-                cnt = (uint16_t) le32_to_cpu(ha->shadow_regs->req_q_out);
-                if (ha->request_in < cnt)
-                        ha->req_q_count = cnt - ha->request_in;
-                else
-                        ha->req_q_count = REQUEST_QUEUE_DEPTH -
-                                (ha->request_in - cnt);
-        }
-        if (ha->req_q_count < (req_cnt + 2))
                goto queuing_error;
        /* total iocbs active */
@@ -286,32 +295,10 @@ int qla4xxx_send_command_to_isp(struct scsi_qla_host *ha, struct srb * srb)
                        break;
                }
+        qla4xxx_advance_req_ring_ptr(ha);
-        /* Advance request queue pointer */
-        ha->request_in++;
-        if (ha->request_in == REQUEST_QUEUE_DEPTH) {
-                ha->request_in = 0;
-                ha->request_ptr = ha->request_ring;
-        } else
-                ha->request_ptr++;
        qla4xxx_build_scsi_iocbs(srb, cmd_entry, tot_dsds);
        wmb();
-        /*
-         * Check to see if adapter is online before placing request on
-         * request queue.  If a reset occurs and a request is in the queue,
-         * the firmware will still attempt to process the request, retrieving
-         * garbage for pointers.
-         */
-        if (!test_bit(AF_ONLINE, &ha->flags)) {
-                DEBUG2(printk("scsi%ld: %s: Adapter OFFLINE! "
-                              "Do not issue command.\n",
-                              ha->host_no, __func__));
-                goto queuing_error;
-        }
        srb->cmd->host_scribble = (unsigned char *)srb;
        /* update counters */
diff --git a/drivers/scsi/qla4xxx/ql4_isr.c b/drivers/scsi/qla4xxx/ql4_isr.c
index 799120fcb9be..8025ee16588e 100644
--- a/drivers/scsi/qla4xxx/ql4_isr.c
+++ b/drivers/scsi/qla4xxx/ql4_isr.c
@@ -11,6 +11,98 @@
 #include "ql4_inline.h"
 /**
+ * qla4xxx_copy_sense - copy sense data into cmd sense buffer
+ * @ha: Pointer to host adapter structure.
+ * @sts_entry: Pointer to status entry structure.
+ * @srb: Pointer to srb structure.
+ **/
+static void qla4xxx_copy_sense(struct scsi_qla_host *ha,
+                               struct status_entry *sts_entry,
+                               struct srb *srb)
+{
+        struct scsi_cmnd *cmd = srb->cmd;
+        uint16_t sense_len;
+        memset(cmd->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
+        sense_len = le16_to_cpu(sts_entry->senseDataByteCnt);
+        if (sense_len == 0)
+                return;
+        /* Save total available sense length,
+         * not to exceed cmd's sense buffer size */
+        sense_len = min_t(uint16_t, sense_len, SCSI_SENSE_BUFFERSIZE);
+        srb->req_sense_ptr = cmd->sense_buffer;
+        srb->req_sense_len = sense_len;
+        /* Copy sense from sts_entry pkt */
+        sense_len = min_t(uint16_t, sense_len, IOCB_MAX_SENSEDATA_LEN);
+        memcpy(cmd->sense_buffer, sts_entry->senseData, sense_len);
+        DEBUG2(printk(KERN_INFO "scsi%ld:%d:%d:%d: %s: sense key = %x, "
+                "ASL= %02x, ASC/ASCQ = %02x/%02x\n", ha->host_no,
+                cmd->device->channel, cmd->device->id,
+                cmd->device->lun, __func__,
+                sts_entry->senseData[2] & 0x0f,
+                sts_entry->senseData[7],
+                sts_entry->senseData[12],
+                sts_entry->senseData[13]));
+        DEBUG5(qla4xxx_dump_buffer(cmd->sense_buffer, sense_len));
+        srb->flags |= SRB_GOT_SENSE;
+        /* Update srb, in case a sts_cont pkt follows */
+        srb->req_sense_ptr += sense_len;
+        srb->req_sense_len -= sense_len;
+        if (srb->req_sense_len != 0)
+                ha->status_srb = srb;
+        else
+                ha->status_srb = NULL;
+}
+/**
+ * qla4xxx_status_cont_entry - Process a Status Continuations entry.
+ * @ha: SCSI driver HA context
+ * @sts_cont: Entry pointer
+ *
+ * Extended sense data.
+ */
+static void
+qla4xxx_status_cont_entry(struct scsi_qla_host *ha,
+                          struct status_cont_entry *sts_cont)
+{
+        struct srb *srb = ha->status_srb;
+        struct scsi_cmnd *cmd;
+        uint8_t sense_len;
+        if (srb == NULL)
+                return;
+        cmd = srb->cmd;
+        if (cmd == NULL) {
+                DEBUG2(printk(KERN_INFO "scsi%ld: %s: Cmd already returned "
+                        "back to OS srb=%p srb->state:%d\n", ha->host_no,
+                        __func__, srb, srb->state));
+                ha->status_srb = NULL;
+                return;
+        }
+        /* Copy sense data. */
+        sense_len = min_t(uint16_t, srb->req_sense_len,
+                          IOCB_MAX_EXT_SENSEDATA_LEN);
+        memcpy(srb->req_sense_ptr, sts_cont->ext_sense_data, sense_len);
+        DEBUG5(qla4xxx_dump_buffer(srb->req_sense_ptr, sense_len));
+        srb->req_sense_ptr += sense_len;
+        srb->req_sense_len -= sense_len;
+        /* Place command on done queue. */
+        if (srb->req_sense_len == 0) {
+                qla4xxx_srb_compl(ha, srb);
+                ha->status_srb = NULL;
+        }
+}
+/**
 * qla4xxx_status_entry - processes status IOCBs
 * @ha: Pointer to host adapter structure.
 * @sts_entry: Pointer to status entry structure.
@@ -23,7 +115,6 @@ static void qla4xxx_status_entry(struct scsi_qla_host *ha,
        struct srb *srb;
        struct ddb_entry *ddb_entry;
        uint32_t residual;
-        uint16_t sensebytecnt;
        srb = qla4xxx_del_from_active_array(ha, le32_to_cpu(sts_entry->handle));
        if (!srb) {
@@ -92,24 +183,7 @@ static void qla4xxx_status_entry(struct scsi_qla_host *ha,
                        break;
                /* Copy Sense Data into sense buffer. */
-                memset(cmd->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
+                qla4xxx_copy_sense(ha, sts_entry, srb);
-                sensebytecnt = le16_to_cpu(sts_entry->senseDataByteCnt);
-                if (sensebytecnt == 0)
-                        break;
-                memcpy(cmd->sense_buffer, sts_entry->senseData,
-                       min_t(uint16_t, sensebytecnt, SCSI_SENSE_BUFFERSIZE));
-                DEBUG2(printk("scsi%ld:%d:%d:%d: %s: sense key = %x, "
-                              "ASC/ASCQ = %02x/%02x\n", ha->host_no,
-                              cmd->device->channel, cmd->device->id,
-                              cmd->device->lun, __func__,
-                              sts_entry->senseData[2] & 0x0f,
-                              sts_entry->senseData[12],
-                              sts_entry->senseData[13]));
-                srb->flags |= SRB_GOT_SENSE;
                break;
        case SCS_INCOMPLETE:
@@ -176,23 +250,7 @@ static void qla4xxx_status_entry(struct scsi_qla_host *ha,
                                break;
                        /* Copy Sense Data into sense buffer. */
-                        memset(cmd->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
+                        qla4xxx_copy_sense(ha, sts_entry, srb);
-                        sensebytecnt =
-                                le16_to_cpu(sts_entry->senseDataByteCnt);
-                        if (sensebytecnt == 0)
-                                break;
-                        memcpy(cmd->sense_buffer, sts_entry->senseData,
-                               min_t(uint16_t, sensebytecnt, SCSI_SENSE_BUFFERSIZE));
-                        DEBUG2(printk("scsi%ld:%d:%d:%d: %s: sense key = %x, "
-                                      "ASC/ASCQ = %02x/%02x\n", ha->host_no,
-                                      cmd->device->channel, cmd->device->id,
-                                      cmd->device->lun, __func__,
-                                      sts_entry->senseData[2] & 0x0f,
-                                      sts_entry->senseData[12],
-                                      sts_entry->senseData[13]));
                } else {
                        /*
                         * If RISC reports underrun and target does not
@@ -268,9 +326,10 @@ static void qla4xxx_status_entry(struct scsi_qla_host *ha,
 status_entry_exit:
-        /* complete the request */
+        /* complete the request, if not waiting for status_continuation pkt */
        srb->cc_stat = sts_entry->completionStatus;
-        qla4xxx_srb_compl(ha, srb);
+        if (ha->status_srb == NULL)
+                qla4xxx_srb_compl(ha, srb);
 }
 /**
@@ -305,10 +364,7 @@ static void qla4xxx_process_response_queue(struct scsi_qla_host * ha)
                /* process entry */
                switch (sts_entry->hdr.entryType) {
                case ET_STATUS:
-                        /*
+                        /* Common status */
-                         * Common status - Single completion posted in single
-                         * IOSB.
-                         */
                        qla4xxx_status_entry(ha, sts_entry);
                        break;
@@ -316,9 +372,8 @@ static void qla4xxx_process_response_queue(struct scsi_qla_host * ha)
                        break;
                case ET_STATUS_CONTINUATION:
-                        /* Just throw away the status continuation entries */
+                        qla4xxx_status_cont_entry(ha,
-                        DEBUG2(printk("scsi%ld: %s: Status Continuation entry "
+                                (struct status_cont_entry *) sts_entry);
-                                      "- ignoring\n", ha->host_no, __func__));
                        break;
                case ET_COMMAND:
diff --git a/drivers/scsi/qla4xxx/ql4_mbx.c b/drivers/scsi/qla4xxx/ql4_mbx.c
index 051b0f5e8c8e..09d6d4b76f39 100644
--- a/drivers/scsi/qla4xxx/ql4_mbx.c
+++ b/drivers/scsi/qla4xxx/ql4_mbx.c
@@ -385,16 +385,6 @@ int qla4xxx_get_firmware_status(struct scsi_qla_host * ha)
                              mbox_sts[0]));
                return QLA_ERROR;
        }
-        /* High-water mark of IOCBs */
-        ha->iocb_hiwat = mbox_sts[2];
-        if (ha->iocb_hiwat > IOCB_HIWAT_CUSHION)
-                ha->iocb_hiwat -= IOCB_HIWAT_CUSHION;
-        else
-                dev_info(&ha->pdev->dev, "WARNING!!!  You have less than %d "
-                           "firmware IOCBs available (%d).\n",
-                           IOCB_HIWAT_CUSHION, ha->iocb_hiwat);
        return QLA_SUCCESS;
 }
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index ec9da6ce8489..40e3cafb3a9c 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -66,6 +66,7 @@ static int qla4xxx_sess_get_param(struct iscsi_cls_session *sess,
 static int qla4xxx_host_get_param(struct Scsi_Host *shost,
                                  enum iscsi_host_param param, char *buf);
 static void qla4xxx_recovery_timedout(struct iscsi_cls_session *session);
+static enum blk_eh_timer_return qla4xxx_eh_cmd_timed_out(struct scsi_cmnd *sc);
 /*
 * SCSI host template entry points
@@ -89,6 +90,7 @@ static struct scsi_host_template qla4xxx_driver_template = {
        .eh_device_reset_handler = qla4xxx_eh_device_reset,
        .eh_target_reset_handler = qla4xxx_eh_target_reset,
        .eh_host_reset_handler  = qla4xxx_eh_host_reset,
+        .eh_timed_out           = qla4xxx_eh_cmd_timed_out,
        .slave_configure        = qla4xxx_slave_configure,
        .slave_alloc            = qla4xxx_slave_alloc,
@@ -124,6 +126,21 @@ static struct iscsi_transport qla4xxx_iscsi_transport = {
 static struct scsi_transport_template *qla4xxx_scsi_transport;
+static enum blk_eh_timer_return qla4xxx_eh_cmd_timed_out(struct scsi_cmnd *sc)
+{
+        struct iscsi_cls_session *session;
+        struct ddb_entry *ddb_entry;
+        session = starget_to_session(scsi_target(sc->device));
+        ddb_entry = session->dd_data;
+        /* if we are not logged in then the LLD is going to clean up the cmd */
+        if (atomic_read(&ddb_entry->state) != DDB_STATE_ONLINE)
+                return BLK_EH_RESET_TIMER;
+        else
+                return BLK_EH_NOT_HANDLED;
+}
 static void qla4xxx_recovery_timedout(struct iscsi_cls_session *session)
 {
        struct ddb_entry *ddb_entry = session->dd_data;
@@ -904,18 +921,17 @@ static int qla4xxx_recover_adapter(struct scsi_qla_host *ha,
        /* Flush any pending ddb changed AENs */
        qla4xxx_process_aen(ha, FLUSH_DDB_CHANGED_AENS);
+        qla4xxx_flush_active_srbs(ha);
        /* Reset the firmware.  If successful, function
         * returns with ISP interrupts enabled.
         */
-        if (status == QLA_SUCCESS) {
+        DEBUG2(printk("scsi%ld: %s - Performing soft reset..\n",
-                DEBUG2(printk("scsi%ld: %s - Performing soft reset..\n",
+                      ha->host_no, __func__));
-                              ha->host_no, __func__));
+        if (ql4xxx_lock_drvr_wait(ha) == QLA_SUCCESS)
-                qla4xxx_flush_active_srbs(ha);
+                status = qla4xxx_soft_reset(ha);
-                if (ql4xxx_lock_drvr_wait(ha) == QLA_SUCCESS)
+        else
-                        status = qla4xxx_soft_reset(ha);
+                status = QLA_ERROR;
-                else
-                        status = QLA_ERROR;
-        }
        /* Flush any pending ddb changed AENs */
        qla4xxx_process_aen(ha, FLUSH_DDB_CHANGED_AENS);
@@ -1527,11 +1543,9 @@ static int qla4xxx_eh_device_reset(struct scsi_cmnd *cmd)
 {
        struct scsi_qla_host *ha = to_qla_host(cmd->device->host);
        struct ddb_entry *ddb_entry = cmd->device->hostdata;
-        struct srb *sp;
        int ret = FAILED, stat;
-        sp = (struct srb *) cmd->SCp.ptr;
+        if (!ddb_entry)
-        if (!sp || !ddb_entry)
                return ret;
        dev_info(&ha->pdev->dev,
@@ -1644,7 +1658,7 @@ static int qla4xxx_eh_host_reset(struct scsi_cmnd *cmd)
        ha = (struct scsi_qla_host *) cmd->device->host->hostdata;
        dev_info(&ha->pdev->dev,
-                   "scsi(%ld:%d:%d:%d): ADAPTER RESET ISSUED.\n", ha->host_no,
+                   "scsi(%ld:%d:%d:%d): HOST RESET ISSUED.\n", ha->host_no,
                   cmd->device->channel, cmd->device->id, cmd->device->lun);
        if (qla4xxx_wait_for_hba_online(ha) != QLA_SUCCESS) {
diff --git a/drivers/scsi/qla4xxx/ql4_version.h b/drivers/scsi/qla4xxx/ql4_version.h
index ab984cb89cea..6980cb279c81 100644
--- a/drivers/scsi/qla4xxx/ql4_version.h
+++ b/drivers/scsi/qla4xxx/ql4_version.h
@@ -5,5 +5,5 @@
 * See LICENSE.qla4xxx for copyright and licensing details.
 */
-#define QLA4XXX_DRIVER_VERSION  "5.01.00-k8"
+#define QLA4XXX_DRIVER_VERSION  "5.01.00-k9"
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 783e33c65eb7..b47240ca4b19 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -990,7 +990,7 @@ int iscsi_offload_mesg(struct Scsi_Host *shost,
        struct iscsi_uevent *ev;
        int len = NLMSG_SPACE(sizeof(*ev) + data_size);
-        skb = alloc_skb(len, GFP_NOIO);
+        skb = alloc_skb(len, GFP_ATOMIC);
        if (!skb) {
                printk(KERN_ERR "can not deliver iscsi offload message:OOM\n");
                return -ENOMEM;
@@ -1012,7 +1012,7 @@ int iscsi_offload_mesg(struct Scsi_Host *shost,
        memcpy((char *)ev + sizeof(*ev), data, data_size);
-        return iscsi_multicast_skb(skb, ISCSI_NL_GRP_UIP, GFP_NOIO);
+        return iscsi_multicast_skb(skb, ISCSI_NL_GRP_UIP, GFP_ATOMIC);
 }
 EXPORT_SYMBOL_GPL(iscsi_offload_mesg);
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 5616cd780ff3..b7b9fec67a98 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1840,6 +1840,18 @@ static void sd_read_block_characteristics(struct scsi_disk *sdkp)
        kfree(buffer);
 }
+static int sd_try_extended_inquiry(struct scsi_device *sdp)
+{
+        /*
+         * Although VPD inquiries can go to SCSI-2 type devices,
+         * some USB ones crash on receiving them, and the pages
+         * we currently ask for are for SPC-3 and beyond
+         */
+        if (sdp->scsi_level > SCSI_SPC_2)
+                return 1;
+        return 0;
+}
 /**
 *      sd_revalidate_disk - called the first time a new disk is seen,
 *      performs disk spin up, read_capacity, etc.
@@ -1877,8 +1889,12 @@ static int sd_revalidate_disk(struct gendisk *disk)
         */
        if (sdkp->media_present) {
                sd_read_capacity(sdkp, buffer);
-                sd_read_block_limits(sdkp);
-                sd_read_block_characteristics(sdkp);
+                if (sd_try_extended_inquiry(sdp)) {
+                        sd_read_block_limits(sdkp);
+                        sd_read_block_characteristics(sdkp);
+                }
                sd_read_write_protect_flag(sdkp, buffer);
                sd_read_cache_type(sdkp, buffer);
                sd_read_app_tag_own(sdkp, buffer);
diff --git a/drivers/video/console/sticore.c b/drivers/video/console/sticore.c
index ef7870f5ea08..857b3668b3ba 100644
--- a/drivers/video/console/sticore.c
+++ b/drivers/video/console/sticore.c
@@ -957,9 +957,14 @@ static int __devinit sticore_pci_init(struct pci_dev *pd,
 #ifdef CONFIG_PCI
        unsigned long fb_base, rom_base;
        unsigned int fb_len, rom_len;
+        int err;
        struct sti_struct *sti;
        
-        pci_enable_device(pd);
+        err = pci_enable_device(pd);
+        if (err < 0) {
+                dev_err(&pd->dev, "Cannot enable PCI device\n");
+                return err;
+        }
        fb_base = pci_resource_start(pd, 0);
        fb_len = pci_resource_len(pd, 0);
@@ -1048,7 +1053,7 @@ static void __devinit sti_init_roms(void)
        /* Register drivers for native & PCI cards */
        register_parisc_driver(&pa_sti_driver);
-        pci_register_driver(&pci_sti_driver);
+        WARN_ON(pci_register_driver(&pci_sti_driver));
        /* if we didn't find the given default sti, take the first one */
        if (!default_sti)